fix: archsetup package fixes and velox post-install improvements

Fixed multilib, adwaita-qt, webkit2gtk, touchpad-indicator, tidaler,
pocketbook URL. Added post-archsetup review tasks for laptop setup.
Updated mbsyncrc for STARTTLS and waypaper config.

3 files changed, 83 insertions, 4 deletions

diff --git a/dotfiles/common/.mbsyncrc b/dotfiles/common/.mbsyncrc
index 636791a..fae84ff 100644
--- a/dotfiles/common/.mbsyncrc
+++ b/dotfiles/common/.mbsyncrc
@@ -64,9 +64,8 @@ Host 127.0.0.1
 Port 1143
 User c@cjennings.net
 PassCmd "cat ~/.config/.cmailpass"
-TLSType NONE
-AuthMechs LOGIN
-CertificateFile /etc/ssl/certs/ca-certificates.crt
+TLSType STARTTLS
+CertificateFile ~/.config/protonbridge.pem
 
 IMAPStore cmail-remote
 Account cmail
diff --git a/dotfiles/hyprland/.config/waypaper/config.ini b/dotfiles/hyprland/.config/waypaper/config.ini
index efe2270..08464f2 100644
--- a/dotfiles/hyprland/.config/waypaper/config.ini
+++ b/dotfiles/hyprland/.config/waypaper/config.ini
@@ -2,7 +2,7 @@
 language = en
 folder = ~/pictures/wallpaper
 monitors = All
-wallpaper = ~/pictures/wallpaper/imminent.jpg
+wallpaper = ~/pictures/wallpaper/saves-more-than-text.png
 show_path_in_tooltip = True
 backend = swww
 fill = fill
@@ -24,4 +24,16 @@ mpvpaper_sound = False
 mpvpaper_options = 
 use_xdg_state = False
 stylesheet = /home/cjennings/.config/waypaper/style.css
+keybindings = ~/.config/waypaper/keybindings.ini
+wallpaperengine_folder = ~/.steam/root/steamapps/workshop/content/431960
+linux_wallpaperengine_clamp = none
+linux_wallpaperengine_volume = 15
+linux_wallpaperengine_silent = False
+linux_wallpaperengine_noautomute = False
+linux_wallpaperengine_no_audio_processing = False
+linux_wallpaperengine_fps = 30
+linux_wallpaperengine_disable_particles = True
+linux_wallpaperengine_disable_mouse = False
+linux_wallpaperengine_disable_parallax = False
+linux_wallpaperengine_no_fullscreen_pause = False
 
diff --git a/todo.org b/todo.org
index e2c79b7..4cfc5e0 100644
--- a/todo.org
+++ b/todo.org
@@ -117,6 +117,74 @@ Line 434: =eval "$cmd"= — use arrays or direct execution.
 CLOSED: [2026-02-23 Sun]
 Added check against list of reserved system usernames (root, bin, daemon, sys, etc.).
 
+** TODO [#A] Review post-archsetup laptop setup steps (velox 2026-04-10)
+Items discovered during velox setup that needed manual intervention after archsetup.
+Decide which should be automated in archsetup vs documented as post-install steps.
+
+*** TODO Review: rfkill soft blocks bluetooth and wifi at boot
+Both bluetooth and wifi were soft-blocked by rfkill. Fix was ~rfkill unblock bluetooth/wifi~.
+~systemd-rfkill~ persists state, so unblocking once should stick, but new installs may default to blocked.
+Consider: add ~rfkill unblock all~ to archsetup post-install or a firstboot script.
+
+*** TODO Review: /efi mount permissions world-accessible (security)
+Default vfat mount had ~fmask=0022,dmask=0022~. Fixed to ~fmask=0077,dmask=0077~ in fstab.
+~bootctl~ warned about world-accessible random seed file.
+Consider: set restrictive fmask/dmask in archsetup's fstab generation.
+
+*** TODO Review: tmpfs layered over ZFS /tmp causing systemd-tmpfiles failures
+~systemd-tmpfiles-clean.service~ failed repeatedly with "Protocol driver not attached".
+Root cause: systemd's ~tmp.mount~ (tmpfs) mounted before ZFS's ~/tmp~ dataset, creating a stale layer.
+Fix: ~systemctl mask tmp.mount~. Consider: mask tmp.mount in archsetup when ZFS is used.
+
+*** TODO Review: intel-ucode not installed
+CPU running old microcode. Installed ~intel-ucode~ and rebuilt initramfs.
+Consider: add intel-ucode (or amd-ucode) to archsetup package list based on CPU vendor.
+
+*** TODO Review: syncthing installed but not enabled
+Package was installed but service was not enabled. Fixed with ~systemctl enable --now syncthing@cjennings~.
+Consider: enable syncthing service in archsetup post-install.
+
+*** TODO Review: awww-daemon crashes at boot (coredump)
+Wallpaper daemon crashed with abort() shortly after boot. Hyprland also coredumped at same time.
+May be a race condition. Restarting awww-daemon fixed it. Monitor for recurrence.
+
+*** TODO Review: Hyprland conf.d source ordering
+~source = $HOME/.config/hypr/conf.d/*.conf~ was at top of hyprland.conf (line 9).
+Machine-local overrides (gaps, monitor scale) were overwritten by defaults later in the file.
+Fixed by moving source line to end of file. Update stowed hyprland.conf.
+
+*** TODO Review: natural_scroll not set for mouse (only touchpad)
+~input:natural_scroll~ was missing; only ~touchpad:natural_scroll~ was set.
+Added ~natural_scroll = true~ to input block.
+
+*** TODO Review: touchpad-indicator missing (X11 only, no Wayland equivalent)
+Old ~touchpad-indicator-git~ was X11-only and removed as broken.
+Created ~touchpad-auto~ (auto-disable touchpad when mouse connected) and ~toggle-touchpad~ scripts.
+~touchpad-auto~ watches Hyprland socket for mouseadded/mouseremoved/configreloaded events.
+Device name ~pixa3854:00-093a:0274-touchpad~ is hardcoded — will differ on other machines.
+Added to exec-once and $mod+F9 keybinding.
+Consider: add scripts to stowed dotfiles, make touchpad device name auto-detected.
+
+*** TODO Review: Bluetooth mouse pairing is manual post-install
+Paired Logi M650 via ~bluetoothctl scan on~, ~pair~, ~trust~.
+This is inherently interactive (scan, select device, pair, trust).
+Consider: document as post-install step. No automation possible.
+
+*** TODO Review: pocketbook not installed
+Custom Python package from ~/code/pocketbook needed ~pip install --user -e .~
+Data in ~/.local/share/pocketbook/ needed to be copied from ratio.
+Consider: document in post-install steps (not automatable in archsetup).
+
+*** TODO Review: Tailscale needs login after install
+~tailscaled~ service was enabled but needed ~tailscale up~ for interactive auth.
+Old machine entry needed cleanup in admin console.
+Consider: document as post-install step.
+
+*** TODO Review: docs/ directories need manual sync from existing machine
+docs/ dirs (gitignored) for ~/code and ~/projects repos needed scp/rsync from ratio.
+Same for ~/.emacs.d/docs/. Not in git, so not available after clone.
+Consider: document as post-install step or create a sync script.
+
 ** TODO [#A] Ensure sleep/suspend works on laptops
 Critical functionality for laptop use - current battery drain unacceptable
 **NOTE:** This applies to Framework Laptop (velox), not Framework Desktop (ratio)