Builds a full dev workstation from a bare Arch Linux install. https://git.cjennings.net/archsetup/atom?h=claude%2Fhungry-franklin-09fffc 2026-10-06T19:58:40+00:00 2026-10-06T19:58:40+00:00 Craig Jennings c@cjennings.net 2026-10-06T19:58:40+00:00 urn:sha1:5189b7cdc7647f92382ddda3ca7d1a30fcffa4ce On the Framework 13 with AMD Ryzen AI 300 the kernel's ACP PDM digital-mic path returns a constant full-scale rail instead of audio. With UCM on, that broken DMIC is the only internal mic PipeWire offers, so the built-in microphone is dead in every app. The new step installs a WirePlumber drop-in that turns UCM off and disables the standalone PDM card so nothing can select it. Without UCM the ALC285 falls back to its analog-stereo profile, whose internal-mic pin carries real audio. I gated it on DMI rather than on the acp-pdm-mach card or the hostname. The card exists on every AMD laptop with a PDM mic and stays present after the upstream fix lands, so its presence says nothing about whether the workaround belongs. The fix belongs to the board, not to one machine. The match needs all three of Framework, "Laptop 13" and "AMD Ryzen AI 300". That rules out the Framework Desktop ("AI Max 300") along with the Intel 13, the Ryzen 7040 13 and the 16. The rule inside the drop-in matches the PDM card by name pattern for the same reason: the gate covers the whole board family, so the rule can't pin the one PCI path velox enumerates. The drop-in ships as a file under configs/, so a re-run refreshes it and deleting it plus a wireplumber restart reverts the machine. The installer doesn't restart wireplumber itself: there's no user session bus during install, so the drop-in applies when wireplumber next starts. The audio failure taxonomy gains a row for the bug and a Cluster 5 note, so the audio doctor's use-ucm remedies treat the installed drop-in as the fix rather than as an offending config to remove. 2026-07-14T05:23:16+00:00 Craig Jennings c@cjennings.net 2026-07-14T05:23:16+00:00 urn:sha1:a20db511a2f03d9eb40b2faa606174c260f544d7 The maint probe now reads network.tailscale_health_ignore before grading the tailscale lamp. This ships the fleet default: tailscaled's permanent DNS-unreachable complaint under systemd-resolved, which kept the lamp amber while DNS worked. 2026-07-08T18:09:54+00:00 Craig Jennings c@cjennings.net 2026-07-08T18:09:54+00:00 urn:sha1:cf11bdb6adae3b860562affa9ce123f87cf7625a pacman warned filesystem 755 vs package 700 on both hosts: a world-listable private-key directory, not runtime hardening as the previous commit claimed. pacman never resets existing directory permissions, so I chmod'd 700 on ratio and velox and removed the curation entry. Integrity reads an honest zero on both. 2026-07-08T18:06:38+00:00 Craig Jennings c@cjennings.net 2026-07-08T18:06:38+00:00 urn:sha1:422f34f82f7cb5bc67b84c2b2ed94123111427bd Reinstalling the owning packages reset these eight paths and the system re-drifted every one before the next -Qkk read: cupsd rewrites its three conf files mode 600, StateDirectory re-chowns /var/lib/passim on service start, tmpfiles re-groups /var/log/journal inside the reinstall transaction itself, /etc/ssl/private sits hardened below the packaged mode, and the utempter setgid helper carries ownership drift. They would count as integrity findings forever with no action that clears them. All eight are universal Arch runtime behavior, so they ship as qkk_known defaults rather than per-host curation. The utempter entry also silences a content change on that one binary, noted inline and accepted. I installed the TOML on both hosts; integrity now reads zero on each, with the real findings the metric surfaced along the way fixed for real (a stale hyprland.pc on both hosts, and /root sitting world-listable at 755 on velox, restored to the packaged 750). 2026-07-08T16:47:08+00:00 Craig Jennings c@cjennings.net 2026-07-08T16:47:08+00:00 urn:sha1:2c17b9a912a6b53a2b2f4e311564305382d909fc The maint probe now grades CVE advisories on actionability (a fixed release exists and isn't installed), not severity, so the severity floor is dead config. The section comment records the retirement. I installed it on both hosts. 2026-07-08T14:46:38+00:00 Craig Jennings c@cjennings.net 2026-07-08T14:46:38+00:00 urn:sha1:0c7c7c28f9f8fe5efcc6a9173b32b4e2bc7502f1 2026-07-08T13:22:04+00:00 Craig Jennings c@cjennings.net 2026-07-08T13:22:04+00:00 urn:sha1:eaa22c4e62e96ae6ac792d3ef0074530214018b7 This pairs with the maint probe change: the snapper grade now warns at summed limits + snapshots.timeline_slack. Slack 2 absorbs the hourly create/:45-cleanup timer gap that kept the card amber most of every hour. I installed it on both hosts. 2026-07-08T13:02:07+00:00 Craig Jennings c@cjennings.net 2026-07-08T13:02:07+00:00 urn:sha1:0f31715badfb26a07369888e9731c8c4940b7669 The 10GB threshold sat below the keep-3 steady state on both hosts (ratio 12.6GB, velox 10.8GB after pruning), so the warning persisted with nothing left to clean. paccache keeps three versions per package and never expires by age, which puts the honest ceiling near 17-19GB. At 20GB the metric stays quiet in steady state but still fires within about two months if the paccache timer dies. I installed it on both hosts and the warning cleared on each. 2026-07-08T04:15:41+00:00 Craig Jennings c@cjennings.net 2026-07-08T04:15:41+00:00 urn:sha1:ba6334af5b6b722eb223e0adb19c074c349782fb [updates] guard_patterns is the live-update guard's pattern set (mesa/hyprland/wayland runtime plus both hosts' vulkan drivers); [curation.session_critical] is the KILL lever's denylist; timeline_quarterly completes the snapper set-config key set. 2026-07-08T03:35:18+00:00 Craig Jennings c@cjennings.net 2026-07-08T03:35:18+00:00 urn:sha1:cfa815ac3a622a171cf5ce1be70c2cb49488c16c