Builds a full dev workstation from a bare Arch Linux install. https://git.cjennings.net/archsetup/atom?h=claude%2Fhungry-franklin-09fffc 2026-10-17T12:07:25+00:00 2026-10-17T12:07:25+00:00 Craig Jennings c@cjennings.net 2026-10-17T12:07:25+00:00 urn:sha1:cd6e11b46ecf2b56bf63d6c11886dccc70875e10 gnome-keyring 48 through 51.1 aborts when a client's first OpenSession is dispatched before the daemon has created its per-client record. Each abort drops the unlocked state and the next request pops the password dialog. On ratio that happened about three times a day from 2026-10-11, when the ChatGPT desktop app's codex app-server started bursting keyring reads. The same-day glib and keyring upgrades were a coincidence, since 50.0 reproduces it too. Upstream's fix (merge request !112) has sat unmerged since August. packages/gnome-keyring is Arch's recipe for 1:51.1-1 built from GNOME's tarball plus one patch. It registers the client at the point of use and returns a real D-Bus error instead of completing OpenSession with a NULL body. It resolves a collection alias only after the caller's session exists. It also locks the alias table so the worker-thread filter can't read an entry the main thread is freeing, a pre-existing defect that AddressSanitizer confirmed. I chose pkgrel 1.1 so stock sorts below the rebuild and any future Arch or upstream fix replaces it on a normal upgrade. Nothing pins the package. install_gnome_keyring_fix replaces the plain stock install, which pacman's --needed would otherwise use to downgrade the rebuild on every re-run. It installs stock only when no gnome-keyring is present, compares versions with vercmp, then stages the recipe into the source dir and builds it with makepkg as the user. The rebuild is a no-op, anything newer skips with a visible note, and a failed build leaves stock in place. I also corrected the keyring-dir comment: the default alias only picks the collection and doesn't unlock anything under autologin. working/keyring-crash holds the probe, the guest fixture and runners, and the deployment script with backup and rollback. status.org there records the cause and results. Stock aborts on the probe's first batch. The patched daemon, its sanitizer build and the installed package pass every mode, and the upstream suite scores the same for both. 2026-10-12T06:19:10+00:00 Craig Jennings c@cjennings.net 2026-10-12T06:19:10+00:00 urn:sha1:e530fd597b62bda520f9804be7da216eea582750 OpenAI publishes the ChatGPT (Codex) desktop app for Arch as chatgpt-bin from its own signed pacman repository, and that's how ratio and velox got it on 2026-10-11. configure_openai_chatgpt_repo reproduces that setup. It fetches the repository signing key and accepts it only when the primary fingerprint matches the pin OpenAI's installer carries. It writes the same drop-in bytes OpenAI's installer writes, so a machine that installer already configured is left alone. Then it adds the Include to pacman.conf and refreshes the databases. supplemental_software installs chatgpt-bin next to claude-desktop. I took the repository over the AUR chatgpt-desktop repackage: the repo keeps the app on ordinary pacman upgrades under OpenAI's signature, and the AUR package conflicts with chatgpt-bin on a machine already using the repo. An untrusted key imports nothing and leaves pacman.conf alone. With the Include present and the key untrusted, TrustedOnly would fail every later pacman transaction. The step returns non-zero instead and chatgpt-bin is skipped. 2026-10-07T13:18:36+00:00 Craig Jennings c@cjennings.net 2026-10-07T13:18:36+00:00 urn:sha1:a6a66ebcff40ea95bbda5aa8f890850ca87e822b 2026-10-06T20:04:14+00:00 Craig Jennings c@cjennings.net 2026-10-06T20:04:14+00:00 urn:sha1:7c9faef02d519d5657020b66ab3853f4bf44b94e 2026-10-06T19:58:40+00:00 Craig Jennings c@cjennings.net 2026-10-06T19:58:40+00:00 urn:sha1:5189b7cdc7647f92382ddda3ca7d1a30fcffa4ce On the Framework 13 with AMD Ryzen AI 300 the kernel's ACP PDM digital-mic path returns a constant full-scale rail instead of audio. With UCM on, that broken DMIC is the only internal mic PipeWire offers, so the built-in microphone is dead in every app. The new step installs a WirePlumber drop-in that turns UCM off and disables the standalone PDM card so nothing can select it. Without UCM the ALC285 falls back to its analog-stereo profile, whose internal-mic pin carries real audio. I gated it on DMI rather than on the acp-pdm-mach card or the hostname. The card exists on every AMD laptop with a PDM mic and stays present after the upstream fix lands, so its presence says nothing about whether the workaround belongs. The fix belongs to the board, not to one machine. The match needs all three of Framework, "Laptop 13" and "AMD Ryzen AI 300". That rules out the Framework Desktop ("AI Max 300") along with the Intel 13, the Ryzen 7040 13 and the 16. The rule inside the drop-in matches the PDM card by name pattern for the same reason: the gate covers the whole board family, so the rule can't pin the one PCI path velox enumerates. The drop-in ships as a file under configs/, so a re-run refreshes it and deleting it plus a wireplumber restart reverts the machine. The installer doesn't restart wireplumber itself: there's no user session bus during install, so the drop-in applies when wireplumber next starts. The audio failure taxonomy gains a row for the bug and a Cluster 5 note, so the audio doctor's use-ucm remedies treat the installed drop-in as the fix rather than as an offending config to remove. 2026-10-06T13:29:15+00:00 Craig Jennings c@cjennings.net 2026-10-06T13:29:15+00:00 urn:sha1:385b0021d0ad028c1bc63fcc8e81de0eb55db4ab Home found velox's internal mic dead on the AMD ACP digital-mic path and applied a WirePlumber drop-in by hand. The new task has the installer carry it, gated on the hardware, with the note to re-check after each kernel update. The closed Fn-keys task moves to the archive. 2026-10-06T12:24:37+00:00 Craig Jennings c@cjennings.net 2026-10-06T12:24:37+00:00 urn:sha1:4a2f811c73f7bceb1e10a565e46fb1b8536fed28 The Signal pager number is rewritten out of every commit. 59 of 951 changed SHA, every descendant of the 08-17 post-rebuild-check commit, and tag v0.5 is untouched. The filter-repo map lands under assets/ so old citations can be translated. The cgit audit task carries the dated record and the release task notes that a full pre-release secrets scan is still owed. Sixteen citations of renamed SHAs across the task list, the task archive and the topgrade spec now point at the new ones. 2026-10-06T07:41:47+00:00 Craig Jennings c@cjennings.net 2026-10-06T07:41:47+00:00 urn:sha1:40a8190729683342948c28e3ea1d13d1c6d4eb7e One RTC-woken suspend-then-hibernate cycle on AC showed btusb torn down and reloaded two seconds after resume, with bluetooth unblocked and powered afterwards. The dated entry under the sleep task carries the timestamps and what the cycle did not prove. The manual check is retired, and the entry-freeze test now re-checks bluetooth after each of its hibernate cycles, since that is the wake the hook exists for. 2026-10-06T07:41:47+00:00 Craig Jennings c@cjennings.net 2026-10-06T07:41:47+00:00 urn:sha1:d6c51ae3ae0cd51b3f3832e831e1d2c28f6b2276 The hook's header and its test docstring said the resume edge has no owner, which contradicted the later paragraph on tlp resume replaying the saved rfkill state. Both now say the replay puts bluetooth back where it was at suspend and applies no policy, so a block present at suspend stays. 2026-10-06T05:02:17+00:00 Craig Jennings c@cjennings.net 2026-10-06T05:02:17+00:00 urn:sha1:73a2a5e6a7fd582bccab858b3b7e9a1c61e6e750 systemd-sleep runs every hook in parallel, so the prefix orders nothing. The comment now says where the settle still wins (a hibernate-class wake) and where the race with tlp resume's state replay stays open (a plain suspend), with the rfkill tell for it.