chore(tasks): clear passed dates and grade the new bugs

The board drifted over four interrupted sessions. Nine tasks carried dates that had already passed, so the agenda showed them as overdue rather than as work with a week attached.

I re-dated or demoted all nine. I closed the pre-vacation list whose departure has passed and recorded where each of its seven items went, then ran a seven-task review batch alongside it.

I filed nine new tasks. Four are bugs, and each carries its severity times frequency arithmetic in the body so the letter can be argued with by fixing an input rather than overridden:

- velox's USB hub tearing down and rebuilding under the Jabra, near-daily, which takes the call audio with it
- the xhci controller refusing D3hot thousands of times per boot, every boot
- the installer never setting Storage=persistent, so a fresh machine keeps no journal across a reboot
- four closed tasks still pinned to the agenda by a planning line they kept

That last one is the shape worth naming. Closing a task stamps CLOSED: and leaves any SCHEDULED: it already had. My agenda doesn't skip scheduled-if-done, so a finished task renders as overdue forever. The rule strips the planning line from a dated sub-task entry and says nothing about a top-level one, which is how five of these accumulated. One was in this diff and is fixed here. The other four predate it and have their own task.

I also re-graded the telega coredump tell down to [#D]. That moves an input rather than overruling the earlier raise. The raise was correct while the assertion fired across five days. The tell has been quiet on both machines for three weeks, so the frequency row moved and the letter followed it. If it reappears, both move back.

I ticked git-lfs, imv and libreoffice-fresh in the undeclared-packages checklist. The installer now declares all three, so a later walk should skip them.

1 files changed, 408 insertions, 72 deletions

diff --git a/todo.org b/todo.org
index 969c1da..40aad3c 100644
--- a/todo.org
+++ b/todo.org
@@ -46,6 +46,248 @@ below):
   input-side-spec.org (DRAFT, four decisions open).
 
 * Archsetup Open Work
+** TODO [#C] Closed tasks pinned to the agenda by a live planning line :chore:quick:solo:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-09-25
+:END:
+Four closed tasks in the Resolved section kept the SCHEDULED or DEADLINE they
+carried while open, so org still renders them on the agenda as weeks overdue. Find
+them with the grep below rather than by line number — an insertion anywhere above
+shifts every number, and the first version of this task carried four that were
+already stale when I wrote them:
+
+#+begin_src sh :results output
+grep -nE '^(CLOSED|SCHEDULED|DEADLINE):.*(CLOSED|SCHEDULED|DEADLINE):' todo.org
+#+end_src
+
+My org config sets =org-agenda-skip-scheduled-if-done= to nil, so a terminal
+keyword doesn't suppress them — only removing the planning line does.
+
+This is the top-level counterpart to the rule that strips the planning line from
+a dated sub-task entry. An interactive close stamps =CLOSED:= and leaves any
+pre-existing =SCHEDULED:= in place, which is how all four survived.
+
+Fix: delete the SCHEDULED/DEADLINE token from each line the grep returns. At =**=
+keep the =CLOSED:= cookie; at =***= and deeper delete the whole planning line,
+CLOSED included, since a dated log heading carries its date in the heading. All
+four current instances are =**=, but the task is built to be run later, which is
+when a deeper one could appear. Verify by re-running the grep and getting no
+output.
+
+The pattern is order-independent on purpose. Matching =CLOSED:.*SCHEDULED:= would
+miss a planning line written the other way round and then report clean over an
+instance it never looked at, and the =^= anchor is what stops the grep matching
+its own source line.
+
+Found 2026-09-25 while fixing a fifth instance that a review caught in the
+then-uncommitted diff. That one is fixed; these four predate it and were left
+out so the commit didn't grow a second concern.
+
+** TODO [#B] velox's USB hub tears down and rebuilds under the Jabra :bug:velox:hardware:audio:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-09-25
+:END:
+The hub at usb 3-2 and whatever hangs off 3-2.1 disconnect and re-enumerate
+together, near-daily, and it takes the call audio with it. When the Jabra
+Speak2 75 comes back as a new device number, Zoom doesn't follow it, so output
+goes nowhere while the device name and every setting still look correct.
+
+Grading: Major severity (audio dies mid-call and needs a manual re-pick; no
+data loss, and a workaround exists) x most-users-frequently (near-daily across
+the whole retained journal, on the primary call path) = P2 = [#B].
+
+Evidence, 2026-09-25 from velox's persistent journal:
+- Today: 11:06:01 the Jabra (0b0e:24ef) enumerates on 3-2.1 as device 5;
+  11:06:02 both it and parent hub 3-2 (device 4) disconnect; 11:06:03 the hub
+  returns as device 6 and the Jabra as 7. One second after plug-in.
+- The same 3-2 / 3-2.1 pair drops on 09-18, 09-20, 09-21 (five times between
+  08:49 and 08:53), 09-21 18:08, 09-22 (four), 09-23, 09-24 (two), 09-25.
+- Companion lines in today's window: "5:0: failed to get current value for
+  ch 0 (-22)", "cannot get min/max values for control 2 (id 5)", and
+  "ucsi_acpi USBC000:00: unknown error 256".
+
+The parent hub is 0a12:4010 — a dock or dongle, not the headset — so the hub is
+the likelier fault and the Jabra the casualty. Some of the listed drops are
+plausibly me unplugging the dock at the end of a day; the 09-21 cluster of five
+inside five minutes and today's one-second-after-plug-in re-enumeration are not.
+
+Not :solo: — splitting hub from headset needs hardware I have to move: the Jabra
+on a direct port with no dock, a different dock or cable, and the dock with
+something else on it. The log work is done.
+
+*** 2026-09-25 Fri @ 12:30:00 -0400 Work's read: bypass the dock, which runs the experiment for free
+Work landed the same conclusion about the hub being the fault rather than the
+Jabra, and drew the better practical consequence from it. Both call paths now
+have a measured failure mode — flaky hub on wired, flaky HFP on bluetooth — so
+choosing between them is the wrong frame. Plugging the Jabra straight into a
+laptop port avoids both.
+
+That also collapses the hardware isolation this task is waiting on. If the direct
+port holds for a few days of real calls, the hub is implicated and the headset is
+cleared, with no deliberate test to run — just using it is the experiment. If it
+drops anyway, the fault is downstream of the hub and this task's scope changes.
+Try the direct port first and read the result off the journal.
+
+Cross-boot queries need =journalctl _TRANSPORT=kernel= with no =-b=. Plain
+=journalctl -k= implies =-b= and silently scopes to the current boot, which is
+what made this look like a single event with no baseline.
+
+** TODO [#B] xhci on velox refuses D3hot thousands of times per boot :bug:velox:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-09-25
+:END:
+=xhci_hcd 0000:c3:00.0: Refused to change power state from D0 to D3hot=, at a
+roughly fixed rate all session, every boot. The controller never reaches D3hot,
+so it holds D0 for the life of the boot — a power-management failure and a
+plausible battery cost on a laptop.
+
+Grading: Minor severity (nothing the user does fails; log noise plus a suspected
+but unmeasured power cost) x every-boot-every-time = P2 = [#B]. Regrade to Major
+if the drain turns out to be measurable — grading the being-in-it, a controller
+pinned in D0 costs continuously rather than in a bounded trickle.
+
+Counts across the five retained boots (oldest to newest): 15772, 1859, 16644,
+9987, 5747. Today's 5747 is the lowest of the set, not an anomaly.
+
+Lead, not a conclusion: the installer puts TLP on every battery machine and TLP
+owns USB power policy. Check its USB autosuspend handling against both these
+refusals and the hub instability in the task above — they may share a cause.
+
+Not :solo: — the diagnosis half is mine to run, but deciding whether to change
+velox's power policy is a preference call about battery versus device stability,
+so it needs your answer before anything is written.
+
+** TODO [#B] The installer never makes the journal persistent :bug:solo:quick:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-09-25
+:END:
+=configure_encrypted_autologin= writes =/etc/systemd/journald.conf.d/
+retention.conf= with =SystemMaxUse=500M= and stops there (archsetup:3624).
+=Storage== is left at its default of =auto=, which is persistent only when
+=/var/log/journal= already exists — and on a fresh Arch install it does not. So
+a machine this installer builds keeps no journal across a reboot, and any
+post-incident question that spans a boot is unanswerable on it.
+
+Grading: Minor severity (the machine works; what's lost is the ability to
+diagnose across a reboot) x every-fresh-install = P2 = [#B]. Not [#A] because no
+live machine is impaired — see below.
+
+Both daily drivers already carry a hand-written =persistent.conf= with
+=Storage=persistent=, so this bites only future installs. velox's is dated
+2026-08-13 17:48, an hour before the installer's own journald block ran at
+18:51 on rebuild day, which is how I know the installer didn't write it. Ratio
+has the same pair of files.
+
+Fix: add =Storage=persistent= to the block that already writes retention.conf,
+with a test pinning it beside the SystemMaxUse assertion. One file, and it
+belongs in the config the installer already owns rather than a second drop-in.
+
+Found while verifying a work handoff that had concluded velox kept no baseline —
+it did, because of the hand-written file. A fresh machine wouldn't have.
+** TODO [#C] Airplane panel key follow-ups from the f977418 commit :refactor:dotfiles:quick:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-09-23
+:END:
+Four items left standing when the airplane keybind moved into the net panel
+(dotfiles f977418, 2026-09-23). None blocked the commit. archsetup drives the
+dotfiles work end to end per the standing rule in notes.org.
+
+- The AIRPLANE console key is shown on desktops (net/src/net/gui.py:576). On
+  ratio the flow is: confirm the prompt, then "airplane mode isn't available
+  on this machine". PanelModel already carries has_wifi and has_speedtest
+  capability flags; a battery or laptop flag could desensitize the key before
+  the question is asked. This one is a design call, which is why the task
+  isn't :solo:.
+- "LEAVE AIRPLANE" is hardcoded in net/src/net/classify.py:52 and diag.py:84
+  instead of shared from viewmodel.AIRPLANE_LEAVE_KEY. Tests pin the coupling,
+  so a rename would surface, but one source is cleaner.
+- tests/net/panel_smoke.py:57 checks the DOCTOR and SPEED TEST console keys
+  only. Add AIRPLANE, and consider a smoke step that opens the confirm dialog
+  and cancels. Needs a compositor to run.
+- Two pre-existing comments on untouched lines still say "keybind":
+  hyprland/.local/bin/airplane-mode:38 and
+  tests/airplane-mode/test_airplane_mode.py:353.
+
+** TODO [#C] Post-install check that every mimeapps.list handler exists :feature:quick:solo:
+:PROPERTIES:
+:CREATED: [2026-09-22 Tue]
+:LAST_REVIEWED: 2026-09-22
+:END:
+Work's optional ask from the 2026-09-18 libreoffice handoff, kept because the
+failure it catches is silent.
+
+The dotfiles =common/.config/mimeapps.list= "[Default Applications]" block
+names a .desktop file per type. When the package behind one is missing,
+xdg-mime does not error — it falls through to the next application claiming
+that type. On velox that meant every .pptx opened PowerPoint inside the
+Windows VM for a month, and the only symptom was that it felt slow.
+
+Add a post-install check that reads every .desktop named in that block and
+reports the ones absent from the machine. Declaring the packages (done
+2026-09-22 for libreoffice-fresh, imv and git-lfs) fixes today's instance; this
+catches the next one, including a handler the dotfiles add later.
+
+Natural home is =scripts/post-rebuild-check=, which already runs this shape of
+verification.
+
+** TODO [#B] Own the meeting transcription service install :feature:velox:ratio:tooling:
+:PROPERTIES:
+:CREATED: [2026-09-22 Tue]
+:LAST_REVIEWED: 2026-09-22
+:END:
+Work built a self-hosted meeting transcription service (whisper.cpp plus
+pyannote diarization) that has run on ratio and velox since 2026-09-17, and
+handed the service side here on 2026-09-19 because it is machine setup rather
+than application work. Installed by hand on both machines today; nothing
+reinstalls it.
+
+The bundle is in [[file:working/meeting-transcription-service/][working/meeting-transcription-service/]], with work's handoff note
+beside it. Scanned for credentials on arrival: clean.
+
+What the install has to provide per machine:
+- =~/.local/share/pyannote-diarize/.venv= — Python 3.12, CPU torch,
+  pyannote.audio 4.0.7, about 1.3 GB, built with uv.
+- =~/.local/share/whisper-models/ggml-large-v3-turbo-q5_0.bin=, plus
+  whisper-cpp itself.
+- The three =src/= scripts where the units expect them, and both user units
+  enabled with linger on so the path unit fires without a login session.
+
+Open decisions before this is buildable, which is why it isn't =:solo:=:
+- Where the code lives in this repo — a new top-level dir, or under =scripts/=.
+- How the Hugging Face step is handled. Accepting the pyannote model terms and
+  caching the model is one-time, online, and interactive. The token is a
+  credential and this repo is anonymously cloneable, so it cannot be committed
+  here; the installer can only prompt for it or read it from the private
+  secrets path.
+
+Known rough edge work flagged: when two runs overlap the second finds the lock
+held, the worker returns silently, and the client reports "finished without
+producing a transcript". Rerunning works. The message should name the lock.
+
+** TODO [#C] Orchestrator sequence pin misses an added step :test:quick:solo:
+:PROPERTIES:
+:CREATED: [2026-09-17 Thu]
+:LAST_REVIEWED: 2026-09-17
+:END:
+Noticed during the 2026-08-08 pre-vacation sweep and never filed; confirmed
+still open 2026-09-17.
+
+=tests/installer-steps/test_orchestrators.py= defines recorder stubs only for
+the sub-steps it expects. A step added to an orchestrator without updating the
+pin calls an undefined function: bash prints "command not found" to stderr,
+nothing reaches stdout, and the recorded sequence still matches. The
+=returncode= assertion sees only the last call's status, so the test passes
+unless the new step happens to be last. The module docstring claims it catches
+"a dropped, added, or reordered" call; it catches drops and reorders.
+
+Fix: define =command_not_found_handle() { echo "UNSTUBBED:$1"; }= in the
+generated script so an unstubbed call lands in stdout and fails the equality,
+plus a test proving it (the file already has one of those for guarded helpers,
+=test_the_check_would_notice_a_missing_call=).
+
+Grading: Minor severity (the VM harness still runs the real steps; only the
+fast pin is blind) x some developers sometimes (fires only when a step is added
+without updating the pin) = P3 = [#C].
 ** TODO [#B] Swap velox's MT7925 for an Intel AX210 :chore:velox:hardware:
 :PROPERTIES:
 :CREATED: [2026-09-16 Wed]
@@ -294,6 +536,23 @@ controller from headset. That's unconfirmed, because ratio didn't answer ssh.
 Once the AX210 is in, re-run the call-load test there. Close this bug if it's
 clean, or regrade it if Intel shows the same signature.
 
+*** 2026-09-22 Tue @ 01:47:56 -0400 A fourth failure on 09-17, and restarting pipewire-pulse is not a full recovery
+From the work session's 09-19 handoff, read back from velox's journal.
+
+The failure recurred Thursday 2026-09-17 at 10:59:32 EDT: kernel "ACL packet
+for unknown connection handle 3837" on boot a440a2a0, with wireplumber logging
+"Failure in Bluetooth audio transport" for 58:18:62:AA:62:9D at 10:59:11 and
+10:59:32. That boot carried five unknown-handle lines. Daily transport-failure
+counts now run 13 on 09-14, 3 on 09-15, 44 on 09-16, and 11 on 09-17 (eight of
+them between 08:56 and 08:58). The handle differs each time, which is what the
+upstream sentinel-handle report predicts, so this is the same firmware fault
+rather than a new one.
+
+Recovery gap worth knowing before the AX210 lands: restarting pipewire-pulse
+strands every Chromium and Electron audio helper process. Each of those apps
+stays silent until it is itself restarted, so the service restart alone leaves
+the browser and any Electron app on a call dead. Restart the apps too.
+
 ** TODO [#B] Visual separator between adjacent waybar modules :feature:waybar:dotfiles:quick:
 :PROPERTIES:
 :CREATED: [2026-09-13 Sun]
@@ -426,10 +685,10 @@ Grading: feature, no hard date, real improvement to the install = [#B].
 the live proof already exists on velox) with no open decision.
 
 ** TODO [#A] Topgrade guarded-upgrade spec — decisions, review, decomposition :feature:maint:dotfiles:
-SCHEDULED: <2026-08-25 Tue>
+SCHEDULED: <2026-09-23 Wed>
 :PROPERTIES:
 :CREATED: [2026-08-25 Tue]
-:LAST_REVIEWED: 2026-08-25
+:LAST_REVIEWED: 2026-09-17
 :SPEC_ID: 81cdfd72-db96-43d3-aa03-779878c99f3e
 :END:
 The waybar maint module's "topgrade freshness" warning never clears: the stamp
@@ -470,6 +729,13 @@ The images are 0600, so an unprivileged =lsinitcpio= exits 1 with "Unable
 to read file" on stderr and nothing on stdout; piped into =grep -c=, that
 empty stdout reads as 0 and looks like a missing module. The gate has to
 run as root and check the exit status, not just the count.
+*** 2026-09-17 Thu @ 08:59:59 -0400 Re-dated to 09-23; the "four open decisions" list above is stale
+The spec is still DRAFT with =Decisions [7/7]=: every decision is made,
+including the four listed above. What's left is the isolated spec-review,
+DRAFT → READY, and spec-response into build tasks. velox has
+=linux-lts 6.18.51 → 6.18.52= pending today, which is the kernel-hold case this
+spec exists for, so no plain topgrade on velox until the hold is built or the
+kernel update runs as its own session.
 
 ** TODO [#C] post-rebuild-check: probe that Emacs frames come up Wayland-native :feature:emacs:velox:solo:quick:
 :PROPERTIES:
@@ -922,11 +1188,10 @@ default, and a udev rule granting the video/input group write access so it
 works without sudo (a bare ssh session got EPERM). Check whether Fn+Space
 (EC-handled on Frameworks) already cycles it — if so the bind is a
 complement, not the only path. Ratio: n/a (desktop).
-** TODO [#A] Post-rebuild verification pass :feature:velox:
-DEADLINE: <2026-08-16 Sun>
+** TODO [#B] Post-rebuild verification pass :feature:velox:solo:
 :PROPERTIES:
 :CREATED: [2026-08-14 Fri]
-:LAST_REVIEWED: 2026-08-14
+:LAST_REVIEWED: 2026-09-17
 :END:
 A rebuilt machine looks finished and isn't. Five gaps surfaced on velox
 within two days of the 2026-08-13 reinstall, and three of them LOOKED
@@ -978,8 +1243,11 @@ right, and authenticates against nothing:
   new one: signal-cli registration (4), bridge cert (6), bridge password (7).
 So the checklist wants two columns, not one.
 
-Graded [#A] because item 5 is live right now and silently disables
-paging, and because the flight is Sunday.
+Originally graded [#A] because item 5 was live and silently disabling paging, with
+a flight that Sunday forcing the date. Both inputs have expired: the flight was
+2026-08-17 and item 5 no longer gates anything time-boxed, so the 2026-09-17
+review dropped this to [#B] and unscheduled it. Kept here because the reason the
+grade was ever [#A] is worth knowing; it is not the current read.
 
 *** 2026-09-13 Sun @ 07:14:54 -0500 Moved the three gap reports into the reinstall working dir
 The 2026-08-14 reports that define the five gaps moved out of inbox/ into
@@ -987,6 +1255,14 @@ The 2026-08-14 reports that define the five gaps moved out of inbox/ into
 [[file:docs/design/2026-08-14-velox-reinstall-gaps-2.org][gap 5]] and
 [[file:docs/design/2026-08-14-velox-reinstall-gaps-3.org][the two email-side gaps]] (the Bridge cert and the Bridge password).
 They file with the rest of the reinstall artifacts when that task closes.
+*** 2026-09-17 Thu @ 08:59:59 -0400 Re-graded [#A] → [#B]; gaps 6 and 7 are the remainder
+=scripts/post-rebuild-check= ships and covers gaps 1-5, with two [#B]
+follow-ups filed (the guarded probe helper and the reference-host mode). Both
+reasons for [#A] are gone: gap 5 is a check now, and the flight has passed.
+What the script still lacks is the two email-side gaps: =mbsync --list=
+parsing (the per-install Bridge cert) and the Bridge password (a real IMAP
+login against =127.0.0.1:1143=, never reading =no such user= as account
+state). Add those two, then close.
 
 ** TODO [#B] Restoring a git repo from backup can resurrect a dangerous diff :bug:
 :PROPERTIES:
@@ -1048,10 +1324,9 @@ plausible reading should not be a dead end.
 Grading: Minor severity (one fallback still puts a wallpaper up) x some
 users sometimes = P3 = [#C].
 ** TODO [#B] archsetup doesn't clone rulesets :bug:velox:
-DEADLINE: <2026-08-15 Sat>
 :PROPERTIES:
 :CREATED: [2026-08-14 Fri]
-:LAST_REVIEWED: 2026-08-14
+:LAST_REVIEWED: 2026-09-17
 :END:
 A fresh install has claude but no =ai=, no skills, no rules, no hooks,
 because =~/code/rulesets= is never cloned. Found on velox 2026-08-14 when
@@ -1131,7 +1406,7 @@ fix and the check is the net under it.
 ** TODO [#B] Settings toggles reset silently at session start :bug:dotfiles:
 :PROPERTIES:
 :CREATED: [2026-07-28 Tue]
-:LAST_REVIEWED: 2026-07-28
+:LAST_REVIEWED: 2026-09-17
 :END:
 Craig, from the roam inbox 2026-07-28: "launching into wayland doesn't honor previous caffeine settings ...or I expect any other settings in the desktop settings module." Captured right after the 08:59 reboot.
 
@@ -1162,45 +1437,28 @@ Related: =[#B] Caffeine state is unreadable on both surfaces= covers display acc
 Launched by hand afterward it runs fine and survives, so gammastep is not broken — it loses a race against compositor readiness at session start. Nothing relaunches it, so night light is simply off for the whole session, silently. (An earlier read of this said night light "has likely never worked from the config". That was wrong: the failure is a startup race, not a permanent break.)
 
 Worth its own task — the fix is a readiness wait or a retry around that exec-once, not a persistence change. Filed here for now because it surfaced during this investigation.
-** VERIFY [#A] Pre-vacation fix list — morning review
-SCHEDULED: <2026-08-08 Sat>
+** DONE [#A] Pre-vacation fix list — morning review
+CLOSED: [2026-09-17 Thu]
 :PROPERTIES:
-:LAST_REVIEWED: 2026-08-08
+:LAST_REVIEWED: 2026-09-17
 :END:
-The full todo.org sweep you asked for before sleeping, ranked by what I'd fix
-before departure (~2026-08-15, velox travels). Approve, reorder, or strike;
-items needing your call say so.
-
-1. Velox reliability (the anchor — [#A] sleep/suspend, rescheduled Wed
-   2026-08-12). Velox is out for repair/upgrade until Tuesday or Wednesday
-   (Craig, 2026-08-08), so every velox item waits for its return — a tight
-   but workable window before the ~08-15 departure. Riders already folded
-   in: the tlp.d radio-enable line, a dotfiles pull, the touchpad-detection
-   spot-check.
-2. Velox machine health for travel (NEW — filed nowhere else): resolve the
-   ~/code/auto-dim-other-buffers.el merge conflict (literal conflict markers
-   in a loaded .el; its emacs suite has been red since 2026-08-01), clear the
-   stale password prompt sitting on its screen since 2026-07-31, and run a
-   maint doctor pass.
-3. Remote access verified from OUTSIDE the LAN while you're still home:
-   tailscale to ratio, truenas, and truenas-kvm from a phone hotspot.
-   DECIDED (Craig, 2026-08-08): the wolf WireGuard profile gets set up on
-   velox when it returns Tue/Wed — added to the velox-return riders. Cheap
-   at home, expensive to debug from a hotel.
-4. The cgit secrets/privacy audit ([#B] below): a world-readable secret
-   standing while you're away is the worst timing. The repo-by-repo scan is
-   mine to run; the public-vs-private call per repo is yours. The archsetup
-   cgit move can wait unless the audit finds something.
-5. Already scheduled today: osbot camera (needs the camera plugged in).
-   Buildable any time: the podman socket + camera udev task (:solo:).
-6. Optional travel niceties blocked on upfront-answerable design calls in
-   their bodies (two for hotspot/metered WiFi in amber, one for network-panel
-   ordering by availability). Answer the calls and I can build both.
-7. Deliberately left off: offline LLM (you declined the vacation track),
-   night-watch/lock-watchdog (ratio stays home with no user to relock; say so
-   if you disagree). Found tonight, low priority: the orchestrator sequence
-   pin can't see an added-but-unstubbed call (it caught drops only) — worth a
-   harness hardening pass someday.
+Reviewed 2026-08-08; the decisions it drew are recorded in the tasks below.
+Closed at the 2026-09-17 review because the ~08-15 departure it ranked work for
+has passed. Where each of the seven items went:
+
+1. Velox reliability → the [#A] sleep/suspend task.
+2. Velox machine health for travel → moot: velox was wiped and reinstalled on
+   2026-08-13.
+3. Remote access from outside the LAN → the wolf WireGuard rider under the
+   sleep/suspend task. Tailscale to ratio works off-LAN (checked 2026-09-17);
+   truenas and truenas-kvm weren't re-checked.
+4. cgit secrets audit → the [#A] audit task and its rotation VERIFY.
+5. Osbot camera → its own task; the podman socket and camera udev rule are
+   installed (sleep/suspend task, 08-17 entry).
+6. Hotspot/metered WiFi and network ordering → the held design calls under
+   Next Session Focus.
+7. The orchestrator sequence-pin gap → filed 2026-09-17 as [#C] Orchestrator
+   sequence pin misses an added step.
 ** TODO [#C] Re-apply the active program at session start :refactor:dotfiles:hyprland:
 :PROPERTIES:
 :CREATED: [2026-07-30 Thu]
@@ -1239,11 +1497,10 @@ An earlier draft graded this Minor, arrived at [#C], and then wrote [#B] beside
 
 Not :solo: — naming is Craig's taste call, and the rail's vocabulary should be decided as a set.
 
-** TODO [#A] Night watch and the lock watchdog fight each other :bug:hyprland:dotfiles:
-DEADLINE: <2026-07-31 Fri>
+** TODO [#B] Night watch and the lock watchdog fight each other :bug:hyprland:dotfiles:
 :PROPERTIES:
 :CREATED: [2026-07-29 Wed]
-:LAST_REVIEWED: 2026-07-29
+:LAST_REVIEWED: 2026-09-17
 :END:
 ROOT CAUSE of the lockdead screens, found 2026-07-29 00:50 within minutes of the relaunch logging going live. hyprlock is not crashing. It is being killed on purpose, by us.
 
@@ -1285,11 +1542,15 @@ Not :solo: — the fix is a design decision between two subsystems, both of whic
 Option 2 is the one I would argue for, but it is Craig's call.
 
 Previous title and framing of this task, kept for the record: "hyprlock still exits mid-lock; the watchdog relaunch is silent". The instrumentation that closed that gap is dotfiles =5bbe2c3=, and it paid for itself in about six hours.
+*** 2026-09-17 Thu @ 08:59:59 -0400 Re-graded [#A] → [#B] and dropped the 07-31 deadline
+The grading paragraph above already concluded [#B]; the heading never followed
+it. The watch stage was parked in =db5ac60= on 2026-07-29, so the collision is
+mitigated and the choice between the three fixes has no date pressure.
 
 ** TODO [#B] The wireguard gpg convention is inert; the installer can't read it :bug:security:network:
 :PROPERTIES:
 :CREATED: [2026-07-28 Tue]
-:LAST_REVIEWED: 2026-07-28
+:LAST_REVIEWED: 2026-09-17
 :END:
 Found 2026-07-28 by an independent review, while deciding whether to commit a newly-encrypted =wolf.conf.gpg=.
 
@@ -1310,10 +1571,10 @@ Until it is resolved, do not commit any =*.conf.gpg=. The encrypted =wolf.conf.g
 
 Related: =[#B] Move archsetup off cgit= and =[#B] Audit cgit-published repos for secrets and privacy=. Both are still open, and both argue for keeping new secrets out of this repo until they land.
 
-** TODO [#B] Timer presets should start in one click :feature:dotfiles:timer:
+** TODO [#C] Timer presets should start in one click :feature:dotfiles:timer:
 :PROPERTIES:
 :CREATED: [2026-07-28 Tue]
-:LAST_REVIEWED: 2026-07-28
+:LAST_REVIEWED: 2026-09-17
 :END:
 Craig, captured 2026-07-28, routed here by home's inbox-zero pass from the shared roam inbox.
 
@@ -1326,11 +1587,14 @@ Panel source is =~/.dotfiles/timer/src/timer/= (=gui.py= for the view, =panel.py
 Not :solo: — the rearrangement is described but not settled, and the result is a visual judgment Craig has to see. The one-click behaviour is buildable on its own; the layout wants a pass in front of him. Per the UI-prototyping rule, sketch the arrangement before touching production code.
 
 Related: =[#C] Add a time selector to the timer panel= covers a duration picker for the same input area. Design them together when either is picked up.
+*** 2026-09-17 Thu @ 08:59:59 -0400 Re-graded [#B] → [#C]
+Untouched for seven weeks, and the layout wants a prototype pass in front of me
+before any production code.
 
 ** TODO [#C] Post-upgrade hooks: compositor restart reminder + font cache rebuild :feature:infra:ratio:solo:
 :PROPERTIES:
 :CREATED: [2026-07-25 Sat]
-:LAST_REVIEWED: 2026-07-25
+:LAST_REVIEWED: 2026-09-17
 :END:
 Handoff from home (2026-07-25), originally combining the 2026-06-07 stale-compositor incident and 2026-06-08 fontconfig crash diagnosis. Add two reproducible pacman =PostTransaction= hooks through archsetup; do not make one-off =/etc= edits:
 
@@ -1338,6 +1602,10 @@ Handoff from home (2026-07-25), originally combining the 2026-06-07 stale-compos
 2. On =Upgrade= of =fontconfig=, =freetype2=, or =harfbuzz=, run =/usr/bin/fc-cache -f= after the transaction. The fontconfig 2.17→2.18 cache-format change left stale cache-9 files that crashed Qt6 apps in =FcCharSetHasChar= until the system font cache was rebuilt.
 
 Acceptance: hook files are source-controlled and installed by archsetup; package/operation/action fields are asserted from the generated hook text; the reminder is print-only and exits successfully; the font hook runs only after successful matching upgrades and invokes the absolute =fc-cache= path. Validate with the fast installer tests plus a disposable pacman-hook parser/install check when practical.
+*** 2026-09-17 Thu @ 08:59:59 -0400 Lead, not diagnosed: ratio's Hyprland aborted on 08-28
+ratio logged a Hyprland SIGABRT coredump at 2026-08-28 15:44, three days after
+the 714-package upgrade of 08-25. Check whether it's the stale-compositor shape
+from 06-04 before citing it as a second occurrence.
 ** VERIFY Should coredump entries group as one journal-digest row per binary? :maint:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-07-24
@@ -1369,14 +1637,14 @@ Not =:quick:= despite being small: four pieces with tests is a sitting rather th
 From the roam inbox (Craig, claimed 2026-07-23): the wallpaper channel switches on sunrise/sunset today (the sun-pair mode, =settings/src/settings/wallpaper.py=, location read live via whereami with a state.json cache). Add a timed-schedule mode as an alternative: fixed clock times drive the transitions rather than the solar calc.
 
 Not :solo: — the capture itself flags the missing inputs ("we'll need to know the transition times, and how many of them there are"). The count and the times are a design decision Craig owes: is it a two-image day/night flip at fixed hours, an N-way ring across the day, per-image dwell vs shared interval? The =set= channel already does fixed-interval cycling through a set, so the new part is specifically clock-anchored transition points, not just "a timer". Ask for the schedule shape at pickup, then build against the existing wallpaper.apply presenter vocabulary.
-** TODO [#C] Auto-dim status forgotten on layout change :bug:dotfiles:
+** TODO [#C] Auto-dim status forgotten on layout change :bug:dotfiles:solo:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-25
+:LAST_REVIEWED: 2026-09-17
 :END:
 From the roam inbox (Craig, 2026-07-25). If auto-dim is toggled off and the layout then changes, auto-dim silently comes back on. A layout switch should not touch the auto-dim state. Likely related to the 2026-07-25 =layout-cycle= rebuild (floating ring) or a hook it fires — check whether the layout-change path resets the dim toggle, and where auto-dim state lives. Grade: minor severity (dim re-enables unexpectedly, no data loss) x every layout change made while dim is off = P3 = [#C].
-** TODO [#C] Maint queue button status wall needs a copy button :feature:dotfiles:maint:
+** TODO [#C] Maint queue button status wall needs a copy button :feature:dotfiles:maint:quick:solo:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-25
+:LAST_REVIEWED: 2026-09-17
 :END:
 From the roam inbox (Craig, 2026-07-25). The maintenance queue button shows the status wall but has no copy button. Add one, following the global COPY key pattern already on the maint doctor wall (dotfiles =8bc79ba=). Grade: cosmetic/feature = [#C].
 ** TODO [#B] Panel family: unify the look across net/bt/maint/audio and desktop-settings :feature:design:dotfiles:
@@ -1400,13 +1668,14 @@ Craig, 2026-07-21 ("mind. blown."): drive the Dupre Night Watch screensaver (doc
 :END:
 Craig, 2026-07-21: the wlogout window (Super+Shift+Q — lock/reboot/shutdown/logout/suspend/hibernate) "isn't great and has bugs." Review it end to end: catalogue the specific bugs, then assess the design against the Dupre instrument-console family (it predates the panel aesthetic). Config lives in dotfiles; the bind is hyprland.conf:428 (=pgrep -x wlogout || wlogout-menu=). Context: the desktop-settings panel spec withdrew lock/suspend in favor of this screen (2026-07-21 amendment), so it's now the sole owner of session-exit actions — worth being good. Grade each bug found via the severity×frequency matrix; this parent stays a [#C] review until specifics emerge.
 ** TODO [#A] Audit cgit-published repos for secrets and privacy :bug:security:
+SCHEDULED: <2026-09-24 Thu>
 :PROPERTIES:
-:LAST_REVIEWED: 2026-08-09
+:LAST_REVIEWED: 2026-09-17
 :END:
 Grading: security carve-out — cgit at git.cjennings.net serves every repo under scan-path=/var/git over unauthenticated https (any repo is anonymously cloneable). Raised [#B] → [#A] on 2026-08-09: the scan found a real live-credential leak (below), so this is now a confirmed exposure with an open rotation blocking, not a hypothetical. Drops back to [#B] once rotation is done and the visibility rulings are made.
 Not :solo: — needs Craig's decisions and the credential rotation. Steps: list repos under /var/git; for each, decide intended public vs private; scan each for secrets (done, below); for any meant-to-be-private repo, actually restrict access (cgit repo.hide only hides from the index — a known repo name is still cloneable; use http auth or move it off the public scan-path); for public repos, confirm no secrets and add a pre-receive/CI secret scan. archsetup's own move is decided and tracked separately below.
 *** VERIFY [#A] Rotate the credentials exposed by the 2026-08-09 dotfiles leak
-SCHEDULED: <2026-08-10 Mon>
+SCHEDULED: <2026-09-24 Thu>
 A plaintext credential file was briefly public in the dotfiles repo and was
 confirmed pulled by an external crawler before the purge, so every credential
 in it must be rotated. Full list, forensic detail, and the remediation record
@@ -2074,6 +2343,10 @@ Evidence report (2026-07-14, count now 64): [[file:docs/design/2026-07-14-undecl
 
 Some entries are libraries likely pulled in as dependencies (blas-openblas, openblas, eigen, tk, lib32-openal, pkcs11-helper, gtk4-layer-shell, webkit2gtk, sane, freerdp, rust-bindgen) — check those only if you want them declared explicitly rather than left to dependency resolution.
 
+git-lfs, imv and libreoffice-fresh are ticked: the installer declares all three
+as of 2026-09-25, so a later walk of this list should skip them rather than
+re-deriving the case for each. The rest of the list is untouched.
+
 - [ ] aws-cli-v2
 - [ ] bats
 - [ ] blas-openblas
@@ -2083,16 +2356,16 @@ Some entries are libraries likely pulled in as dependencies (blas-openblas, open
 - [ ] flatpak
 - [ ] freerdp
 - [ ] geeqie
-- [ ] git-lfs
+- [X] git-lfs
 - [ ] github-cli
 - [ ] gtk4-layer-shell
 - [ ] hugo
-- [ ] imv
+- [X] imv
 - [ ] lc0
 - [ ] lc0-network-sm
 - [ ] ledger
 - [ ] lib32-openal
-- [ ] libreoffice-fresh
+- [X] libreoffice-fresh
 - [ ] minidlna
 - [ ] openai-codex
 - [ ] openblas
@@ -2194,9 +2467,9 @@ Read recommended resources to make informed security decisions (see metrics for
 Practical guidelines for working in public spaces
 
 ** TODO [#A] Ensure sleep/suspend works on laptops
-SCHEDULED: <2026-08-12 Wed>
+SCHEDULED: <2026-09-25 Fri>
 :PROPERTIES:
-:LAST_REVIEWED: 2026-08-08
+:LAST_REVIEWED: 2026-09-17
 :END:
 Raised [#B] → [#A] and scheduled at the 2026-08-08 review: Craig leaves on
 vacation ~2026-08-15 and velox is the travel machine — suspend and battery
@@ -2370,9 +2643,9 @@ got force-cut. If both power-ons went straight to a fresh login, the freeze
 is the answer.
 
 ** TODO [#A] Port Hyprland config to Lua before 0.57 drops .conf support :hyprland:dotfiles:
-SCHEDULED: <2026-08-25 Tue>
+SCHEDULED: <2026-09-24 Thu>
 :PROPERTIES:
-:LAST_REVIEWED: 2026-08-24
+:LAST_REVIEWED: 2026-09-17
 :END:
 Hyprland prints "You are using the .conf config format, support for which will be
 removed in Hyprland 0.57" at every start. Installed and in =extra= is 0.56.2-1, so
@@ -2478,6 +2751,10 @@ WHAT REMAINS:
    it out of the stow package instead.
 6. *=bindm='s missing =mouse= flag is worth an upstream report* if it survives
    0.57. Documented spelling, four variants tested, flag never set.
+*** 2026-09-17 Thu @ 08:59:59 -0400 Re-dated to 09-24; 0.57 still isn't in the repos
+velox runs =hyprland 0.56.2-3= with no Hyprland update pending, so nothing has
+broken yet. The switch still needs me at the keyboard for one restart and the
+manual test.
 
 ** TODO [#B] Manual testing and validation :test:
 :PROPERTIES:
@@ -2487,6 +2764,46 @@ Craig's standing checklist of everything that isn't agent-verifiable. Each child
 
 Priority and type tag added by that audit: the task carried neither, which kept the project's largest live container out of the agenda entirely.
 
+*** Airplane console key in the net panel: does it engage, confirm, and let you back out?
+What we're verifying: that the new AIRPLANE key actually drives the mode both
+ways, that engaging asks first, and that the way out is visible from inside
+airplane mode. The GTK widget layer has no unit coverage and the AT-SPI smoke
+can't run on velox (no weston/sway, no at-spi-bus-launcher), so this is the
+only check that exercises the real wiring.
+
+Do it on AC, and not while you need the network — it stops tailscale, the VPN,
+syncthing, avahi, cups and inbound ssh, and dims the screen.
+
+- Open the net panel (Super+Shift+N). The CONSOLE row should now show three
+  keys: DOCTOR, SPEED TEST, AIRPLANE.
+- Click AIRPLANE.
+Expected: a dialog naming what it will do — wifi off, services stopped, screen
+dimmed, CPU to power — with Cancel and an AIRPLANE button.
+- Press Cancel.
+Expected: nothing happens. Wifi stays up, the key still reads AIRPLANE.
+- Click AIRPLANE again, then confirm.
+Expected: the key's lamp flashes while it runs, then the faceplate shows the
+AIRPLANE badge with a gold lamp, and the key's label changes to LEAVE AIRPLANE.
+Wifi is off and the screen is dimmer.
+- While engaged, try the faceplate wifi switch.
+Expected: it refuses and the status line says to press LEAVE AIRPLANE. It must
+NOT name a keyboard shortcut — the old message said Super+Shift+A, which is
+push-to-talk.
+- Click LEAVE AIRPLANE.
+Expected: no confirmation this time, it just runs. Wifi comes back, brightness
+returns to where it was, and the key reads AIRPLANE again.
+#+begin_src sh :results output
+# The services it stopped should be back. Anything listed here is still down.
+for s in tailscaled.service avahi-daemon.service cups.service sshd.service fail2ban.service; do
+    systemctl is-active --quiet "$s" || echo "still stopped: $s"
+done
+systemctl --user is-active --quiet syncthing.service || echo "still stopped: syncthing (user)"
+echo "airplane state: $(cat "${XDG_RUNTIME_DIR}/airplane-state" 2>/dev/null | head -1)"
+#+end_src
+Expected: no "still stopped" lines, and the state reads mode=off. A service
+that was already stopped before you engaged is correctly left alone, so check
+it was running first if one shows up.
+
 *** Hyprland Lua config: does the real desktop come up, and does Super+drag track?
 What we're verifying: that the Lua port drives a real Hyprland session the way
 the .conf did, and specifically whether the one known delta — the three =bindm=
@@ -3442,10 +3759,9 @@ Tool choice is the open decision (needs Craig): =nerd-dictation= (Vosk, lighter,
 *** 2026-07-21 Tue @ 08:40:00 -0500 Decided (Craig): whisper.cpp + wtype, system-wide
 STT engine = =whisper.cpp= (accurate offline, optional GPU on ratio's Radeon). Typing backend = =wtype= (Wayland-native virtual-keyboard injection into the focused window, no root/daemon), with =ydotool= (uinput) held as a fallback only if a specific app — some XWayland/Electron surface — won't accept wtype's synthetic input. One system-wide path that also covers Emacs buffers and the Claude Code prompt; the Emacs-native =whisper.el= route was NOT chosen. Build scope: whisper.cpp + a model (start with a mid-size English model, tune later), a Hyprland push-to-talk keybind driving a record→transcribe→wtype pipeline, and an autostart/service entry, folded into archsetup so it lands on ratio + velox. Now unblocked (agent-buildable; verification includes a live dictation check).
 
-** TODO [#B] Osbot camera configuration :chore:quick:
-SCHEDULED: <2026-08-08 Sat>
+** TODO [#C] Osbot camera configuration :chore:quick:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-08-08
+:LAST_REVIEWED: 2026-09-17
 :END:
 Re-graded [#C] → [#B] and scheduled at the 2026-08-08 review: Craig leaves on
 vacation in a week (~2026-08-15), so this needs to land before then. Blocked
@@ -3454,6 +3770,9 @@ only on the camera being physically plugged in (no /dev/video node as of
 Craig's roam capture 2026-07-20, routed via .emacs.d sentry inbox-zero as archsetup-owned device setup: "configure osbot camera." Scope to define at pickup (device model, what "configure" covers — kernel module, v4l settings, default framing).
 *** 2026-07-21 Tue @ 08:10:00 -0500 Scoped (Craig): tiny — it works, just needs configuring via a panel
 Craig: the camera works (bought for being Linux-friendly), it just needs configuring. There IS a config panel — =cameractrls= 0.6.10 is installed (a GTK GUI for camera controls: exposure, white balance, PTZ, focus, framing) plus =v4l-utils= for the CLI path. Caveat found 2026-07-21: no =/dev/video*= device is present right now, so the camera isn't currently plugged in / its UVC node isn't enumerated. Task: with the camera connected, confirm it enumerates as a /dev/video node, then set defaults in cameractrls. Small, mostly a live-hardware step.
+*** 2026-09-17 Thu @ 08:59:59 -0400 Re-graded [#B] → [#C] and unscheduled
+The 08-08 raise was only for the vacation deadline, which has passed, and the
+camera is at home. Pick it up the next time the camera is plugged in.
 ** TODO [#C] Re-check python-lyricsgenius --skipinteg workaround :chore:solo:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-08-17
@@ -3544,11 +3863,28 @@ Parse yay errors and provide specific, actionable fixes instead of generic error
 ** TODO [#D] Improve progress indicators throughout install
 Enhance existing indicators to show what's happening in real-time
 
-** TODO [#C] Telega coredump recurrence tell :bug:maint:
+** TODO [#D] Telega coredump recurrence tell :bug:maint:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-21
+:LAST_REVIEWED: 2026-09-17
 :END:
 
+*** 2026-09-17 Thu @ 08:59:59 -0400 Re-graded C → D: the tell has been quiet on both machines since at least 08-28
+Grading: Minor severity (a crashed telega-server restarts; the cost is coredump
+noise and a chat client that blinks) x rare edge case (no occurrence on either
+machine in the ~3 weeks the records cover) = P4 = [#D].
+
+This moves the letter by moving an input, not by overruling the 2026-07-21 raise
+below. That raise was correct on its own frequency row: the tell had just fired,
+repeatedly, across five days. It has since stopped, so the row moved from
+most-users-frequently to rare-edge-case and the letter follows it. If the
+assertion reappears the row moves back and so does the grade.
+
+Checked at the 2026-09-17 review. ratio: =coredumpctl list telega-server= finds
+nothing, and its coredump records reach back to 2026-08-28 (the oldest is an
+unrelated Hyprland SIGABRT); =~/.telega/telega-server.log= (3.0 MB, last written
+09-13) holds zero =tdat_plist_value= assertions. velox: no telega-server
+coredumps either. Back to a watch item; the tell and the durable escape are
+unchanged.
 *** 2026-07-21 Tue @ 08:10:00 -0500 Re-graded D → C (Craig): treat as the actionable version-skew recurrence
 Craig's call: the fired tell counts as the version-skew recurrence this task predicts (zevlg =:latest= outran the installed elisp again), not just benign host noise — so it bumps [#D] → [#C]. Action: re-pin / upgrade the TDLib side (upgrade the elisp telega package on ratio+velox, or move to a host-native pinned TDLib build) so the server's plist parser and the installed elisp agree again. The durable escape remains the host-native pinned TDLib build.