August 4, 2026

The credential file is shared with `claude` itself and its refresh token is one-time-use, so whichever process refreshes first rotates the other's copy to spent. On a failed refresh the provider kept the stale token and 400d every turn until the service was restarted by hand — measured 2026-08-05, invalid_grant from 00:03 onward while the file on disk already held a valid pair written at 00:08.

exclusionMode was ExclusionMode.Ignore, which tells the compositor to disregard the exclusive zone outright — so the expression below it computed a height that was thrown away and every window laid out underneath the bar. The bar is not app space while it is visible.

FileView loads async, so text() was still empty when onReadyChanged read it once to decide whether this is a new session. It fell through to the unset env var and persisted "" — the same bug, reached by a different route. Verified on device: the stored signature now matches viewtop.instance.

HYPRLAND_INSTANCE_SIGNATURE is unset under viewtop, so this compared "" to "" and isNewHyprlandInstance was false on every start. It gates lock.launchOnStartup, which has therefore never fired once under viewtop, and both Idle.qml copies read it as well.

Measured on the phone, idle, screen on, same session, one flag apart:

Action::Overview shells out to `ipc call overview toggle`. The only handler here was `search`, so that call reached nothing and the three-finger tap did nothing, without an error anyone would see.

The panel, its mask and the loader all moved to overviewOpen || missionControlOpen when mission control landed; the Column holding them did not. So the second-stage pill swipe raised a panel whose entire contents were invisible — WindowOverview instantiated, laid out, and never shown.

Drop temperature for models that removed sampling params (400 otherwise). Preserve signed thinking blocks across tool rounds — Anthropic rejects a tool_use whose preceding thinking block was dropped. Raise default max_tokens to 32k for thinking-by-default models and request summarized display so the reasoning pane is fed.

The shell's answer to "did the session just come up, or did I reload?" was HYPRLAND_INSTANCE_SIGNATURE. That is unset here, so Persistent.qml compared the empty string to the empty string and concluded "not a new instance" every time. `lock.launchOnStartup` is gated on exactly that flag and has therefore never fired once under viewtop; idle behaviour hangs off it too.

publish_toplevel ran at map, on focus change, and on maximize/fullscreen — never on commit. Clients set xdg_toplevel.title *after* mapping and change it constantly after that: a terminal per command, a browser per tab. So the one publish at map time carried the empty string and nothing corrected it.

quickshell holds wlr toplevel handles — that is the protocol with activate and close, so it is the only one that can carry the dock. An ext capture source is named by an ext_foreign_toplevel_handle_v1 from a different protocol, and nothing correlates the two, so the standard per-window path served here was unreachable. Measured: assigning a Toplevel to a ScreencopyView logs "Capture source set to non captureable object" and this compositor is never asked. Every overview card and dock preview was a title over a transparent box while the code to fill it sat here, complete.

Cold boot 2026-08-04: viewtop looked for the socket 0.46s into its life, sessiond's user unit bound it a moment later, and both callers returned for good — every button edge, gesture, wake and touch report discarded for the life of the process, and observe_authority never fed. The phone came up with a working screen and a dead power button; sessiond still read touch: unknown an hour later.

Found on the phone: touch_down on a locked session answered {"delivered": true} while resolve had withheld the contact. A withheld contact stays tracked on purpose — evidence is about the finger — so is_down was the wrong question.

TASK-53 §1-§10.

`on_gesture` called `toggle_float` directly, which made the compositor both the recogniser and the binder — the eighth blind actor DEVICE-STATE-MACHINE §12 forbids by name, and what [host] cost: 652 tunnel recycles in ninety minutes with no way to turn it off.

STATE.md was five days stale. It now carries what is on the phone (viewtop r76, souveraine r333) and the four defects fixed on the glass: per-window capture was unreachable because quickshell holds wlr handles and the ext capture source is named by an ext handle with nothing correlating them; titles were never republished on commit; the border was a filled slab that relied on the client covering its middle; capture came back flipped.

toggle_float was the only caller-visible un-float and it went with the three-finger binding when that became a sessiond verb. Recorded rather than left as dead code with a comment.

Nine findings from an adversarial read of the night's work, ranked. Six others from the same audit are already fixed; these are the rest.

Gitea requires sign-in instance-wide, so a public repo still 403s anonymously. makepkg spawns its own git and git config --global does not reach it; the GIT_CONFIG_COUNT/KEY/VALUE form does, since git reads it per process.

The repo is public now, so makepkg needs no credentials and the extraheader attempt comes back out — it did not work anyway (global git config does not reach makepkg's clone), and config that looks like it authenticates but does not is worse than none.

souveraine-viewtop is the only PKGBUILD whose source= is a repo on our own Gitea; everything else fetches from a public host or from this checkout. So it was the only clone makepkg could not authenticate, and it died with "could not read Username" after twenty minutes of other packages built.

The PKGBUILD has been in pkgs/ since the hand-scp era and appears in none of the build lists here, so the package it exists to replace kept being made by hand on [host]. The device ran r74 while main was several commits ahead, and a green run on the viewtop repo said nothing about that: its CI only checks — fmt, clippy, test, cross-build — and never publishes.