Builds a full dev workstation from a bare Arch Linux install. https://git.cjennings.net/archsetup/atom?h=main 2026-09-13T14:23:39+00:00 2026-09-13T14:23:39+00:00 Craig Jennings c@cjennings.net 2026-09-13T14:23:39+00:00 urn:sha1:2f81174b1de13d9148113fb9f3d389ca6c61ac5c The reinstall drill finished on 2026-08-14 and every finding it surfaced already has its own task, so what remained was the record. I filed its working-dir artifacts into permanent homes. The runbook went to docs/ with an Outcome section, since the checklist was never ticked as it ran. The UEFI boot-entry reference went to docs/ too. The three reinstall-gap reports went to docs/design/. The rescued wttrin bundle moved into its own working dir under the task that owns it. Every inbound link is repointed and working/velox-reinstall/ is gone. The lock-screen clock bug is closed because it no longer happens on velox. I couldn't identify the commit that fixed it from the dotfiles or archsetup logs, and the note says so. Its manual-testing check retires with it. 2026-09-13T12:22:10+00:00 Craig Jennings c@cjennings.net 2026-09-13T12:22:10+00:00 urn:sha1:c9f9a9881548114e49752d5bc4feba4a83ed4d84 The inbox held 64 processed-but-kept handoffs from July and August. The inbox discipline no longer allows that state: a file is a task, reference content in a tracked home, or gone. I read each one. Fifty-six were acknowledgments, FYIs, lint pipeline files or requests whose work had already landed. Those are deleted. Eight carried content worth keeping. The 2026-07-15 velox boot-failure diagnosis moves to docs/design, linked from the retrospective task. The three 2026-08-14 reinstall-gap reports move into the velox reinstall working dir, linked from the post-rebuild task. The two Maeda applets and their notes join the clock display references. Two captures had never landed anywhere: the waybar module separator I captured on 2026-07-20 ([#B]) and the window-configuration research idea from 2026-07-24 ([#C]). Both are filed. The velox reinstall task records the two live steps (wsdd off, passim masked) applied over ssh once velox came back, and the health-check log now says velox is masked. 2026-08-19T19:32:07+00:00 Craig Jennings c@cjennings.net 2026-08-19T19:32:07+00:00 urn:sha1:7b68f77a9b99e5400472986cb80bae5fb92e2320 I reproduced the failure by winding velox's clock back 27 days with chronyd stopped, and the cause is not what I recorded. Resolved logged signature-expired against the root DNSKEY and every DS beneath it. The DoT handshake to 1.1.1.1:853 verified clean at that same clock, and the Cloudflare certificate runs Dec 2025 to Dec 2026, so it was never outside its window. An RRSIG window is days to weeks while a certificate is good for a year, so a skew that breaks DNSSEC normally leaves DoT untouched. DNSSEC=allow-downgrade does not rescue it either. Resolved downgrades when a server lacks DNSSEC support, and a signature-window failure is a validation failure, so no downgrade fires. Six retries over eighteen seconds plus a reset-server-features, all dead. I briefly believed otherwise off a test whose success was a cache hit. The fix itself is verified end to end. With the clock wound back and no DNS at all, chronyd reached the IP-addressed source and stepped the clock straight back. Also settled: the clock landed on 2026-07-23 because that is systemd 261.2's build date to the minute, and systemd advances a garbage RTC to its own build epoch at boot. 2026-08-19T19:16:46+00:00 Craig Jennings c@cjennings.net 2026-08-19T19:16:46+00:00 urn:sha1:afbf011aa0937b5702b6d8c1bfca0809ed809425 The installer wrote both halves of a deadlock. configure_dns pins DNSOverTLS=yes with DNSSEC=yes, and both validate against the wall clock. The chrony step enables chronyd without writing a config, so the machine runs Arch's stock one, whose only source is a pool hostname. Boot with a wrong clock and DoT validation fails, so nothing resolves. Chrony then can't resolve its pool, so the clock stays wrong. Neither side moves, and recovery takes a second device. Velox hit this on the road and I diagnosed it from a phone. An address needs no DNS and no certificate, so two IP-addressed sources in a drop-in break the cycle whatever caused the skew. Stock chrony.conf reads no drop-in directory, so it gets a confdir line pointing at one. post-rebuild-check grows a sixth check for the same property. It reads sources only from files chrony is told to read. A drop-in beside a chrony.conf that never names its directory is one chrony won't open, so counting it would pass the machine while describing a file nothing reads. The failure taxonomy gains the mode in its DNS layer and a cluster 5 triage line. Its egress-layer clock entry assumed working DNS and offered set-ntp true, which can't recover this. That entry now says so. 2026-08-09T16:47:36+00:00 Craig Jennings c@cjennings.net 2026-08-09T16:20:43+00:00 urn:sha1:169dab71a063f4fab6c46f95e11d6e85b140cb8f Two one-time machine setups from the winvm handoffs now happen at install time. - The devops podman block enables the rootless podman API socket. Socket-activated, so it costs nothing idle, and API clients like Pods fail with an empty window without it. enable_user_service grew an optional wants-target argument because a socket unit's [Install] is WantedBy=sockets.target. The old default.target link would never socket-activate. - install_camera_passthrough_rules ships 72-usb-passthrough-cameras.rules: GROUP="video", MODE="0660" plus the uaccess tag on the OBSBOT and BRIO USB IDs, so usbredirect can claim them for VM passthrough. The filename is load-bearing: logind's ACL is applied by 73-seat-late.rules, so the tag only works from a file sorting below 73. A test pins that property. Both are live on ratio (the old 99- rules file is retired there). Whether uaccess alone would suffice from the corrected position is untested and stays documented as a hypothesis. 2026-08-09T16:47:36+00:00 Craig Jennings c@cjennings.net 2026-08-08T09:55:52+00:00 urn:sha1:f88dfa7620a289f1aff63e446ebdd31853ac3d51 The checklist is the standing home for manual post-first-boot steps: bluetooth pairing and the Proton Bridge login start it. The podman-socket and camera-udev notes carry the evidence for the filed install-time task, including why uaccess alone can't grant a raw USB node. 2026-07-20T21:10:37+00:00 Craig Jennings c@cjennings.net 2026-07-20T21:10:37+00:00 urn:sha1:074599118036aa4a76fa9210ac1b1704d5e55b9e Ran read-only audits over the last three coverage slices: the VM test framework (S5), the Python (S6), and the elisp prototype (S7). That closes the sentry code-inspection sweep -- all seven slices covered. S5 turned up five bugs (one Major: run-net-scenarios prints a diagnose failure but exits green) and three refactors. S6 found one bug plus a High test-quality defect -- the pacman-hook-order test compares two string literals, so the boot-critical hook ordering it claims to guard is never actually measured. S7 found three Minor bugs in the gallery-widget prototype (the needle clamps while the readout doesn't, a missing cl-lib require, a nil-path load) plus refactor and coverage gaps. Appended every finding to the sentry findings doc, marked the coverage tracker, and filed six graded tasks: the two Major/High defects as [#C], and four [#D] clusters (VM-framework robustness, prototype elisp bugs, test-quality, and a test-framework/prototype refactor group). Detection only -- nothing fixed here. 2026-07-20T12:27:16+00:00 Craig Jennings c@cjennings.net 2026-07-20T12:27:16+00:00 urn:sha1:f5c571712834c87615a040b2901fc3a21e4a98aa Overnight sentry ran its hygiene passes plus a code-inspection pass over the installer and the scripts/ directory. It archived 6 completed tasks to Resolved and logged 19 bugs and 12 refactors in docs/design/2026-07-19-sentry-code-findings.org. I filed the bugs as tasks graded by severity times frequency. Nothing in the codebase changed, this was detection only. Two things stand out. The installer does no partitioning (it's a post-install config layer), so the real data-loss surface is boot config, and it overwrites GRUB_CMDLINE wholesale, which can drop a cryptdevice or resume param and leave a machine unbootable. Three WireGuard configs with live private keys are tracked in git, flagged for a rotate-or-keep decision. 2026-07-19T01:03:16+00:00 Craig Jennings c@cjennings.net 2026-07-19T01:03:16+00:00 urn:sha1:6acbbb47e122c720e864e1d59ccdacb91b19f4e5 Remove retired theme-switching guidance and Hudson references from active documentation. 2026-07-19T00:46:05+00:00 Craig Jennings c@cjennings.net 2026-07-19T00:46:05+00:00 urn:sha1:be2277d0db1afa06c1a1ab468f70b34c8d98e0a1 Install snapshot and live-update hooks before mkinitcpio removal, migrate legacy paths, and cover the ordering invariant.