chore(todo): two review cycles, vacation re-grades, post-setup closure

I reviewed fourteen tasks across two cycles and re-graded around the coming vacation.

Closed: the Comet KVM setup (I wired it up by hand and both truenas and the KVM are back on the tailnet), the waybar separators (fixed a while back), and the 2026-05-11 VM-error container (the residual four are environmental).

Killed: whole-display dim (the July auto-dim work covers the need) and the annual tool-pain-points review (an undated intention that never fired).

Vacation re-grades: osbot camera and the velox post-setup review raised and scheduled, laptop sleep/suspend raised to A for Monday. Carousel layout demoted to C. Filed the podman-socket and camera-udev task from the winvm handoff.

1 files changed, 148 insertions, 43 deletions

diff --git a/todo.org b/todo.org
index c8b2b81..67e4f6f 100644
--- a/todo.org
+++ b/todo.org
@@ -45,7 +45,30 @@ below):
   input-side-spec.org (DRAFT, four decisions open).
 
 * Archsetup Open Work
-** TODO [#B] Desktop settings don't survive a session restart :bug:dotfiles:hyprland:
+** TODO [#B] Podman API socket and camera-passthrough udev rule :feature:solo:
+:PROPERTIES:
+:CREATED: [2026-08-07 Fri]
+:LAST_REVIEWED: 2026-08-07
+:END:
+From winvm 2026-08-07 (ratio). Two one-time machine-level setups, both live on
+ratio and absent on velox; full evidence and rationale in
+[[file:docs/design/2026-08-07-podman-socket-and-camera-udev.md]].
+
+- Enable the rootless podman socket at install time
+  (=systemctl --user enable --now podman.socket=). Socket-activated, zero idle
+  cost; every podman GUI/API client needs it, and its absence fails silently
+  (Pods opens to an empty window). The installer already carries the
+  "=systemctl --user enable= fails during install" workaround pattern
+  (=archsetup:1270=, =:2722=) — use it.
+- Ship =/etc/udev/rules.d/99-usb-passthrough-cameras.rules= granting
+  GROUP="video", MODE="0660" on the OBSBOT (3564:ff02) and BRIO (046d:085e)
+  USB nodes so =usbredirect= can claim them for VM passthrough. The
+  hard-won finding: =TAG+="uaccess"= alone does NOT work — logind doesn't ACL
+  raw =/dev/bus/usb/*= nodes; the GROUP/MODE grant is what works. Keep the tag
+  anyway (harmless, correct in principle).
+
+Scope: installer step + rule file + tests per existing shapes, and apply both
+live to velox over tailscale (daily-driver sync — neither exists there today).
 :PROPERTIES:
 :CREATED: [2026-07-28 Tue]
 :LAST_REVIEWED: 2026-07-28
@@ -206,12 +229,16 @@ Not :solo: — the rearrangement is described but not settled, and the result is
 
 Related: =[#C] Add a time selector to the timer panel= covers a duration picker for the same input area. Design them together when either is picked up.
 
-** TODO [#A] Comet KVM setup for truenas :feature:infra:truenas:
-DEADLINE: <2026-08-02 Sun>
+** DONE [#A] Comet KVM setup for truenas :feature:infra:truenas:
+CLOSED: [2026-08-08 Sat]
 :PROPERTIES:
 :CREATED: [2026-07-27 Mon]
 :LAST_REVIEWED: 2026-07-27
 :END:
+Resolved: Craig wired up and configured the Comet himself, confirmed working
+2026-08-08. The ATX power-board follow-up (hard power-cycle for a truly wedged
+box) remains unfiled — raise it if the next outage shows the KVM alone isn't
+enough.
 Wire up the GL.iNet Comet (GL-RM1) IP KVM against truenas. It was bought 2026-01-14 for exactly this job and its KB node still reads "Arrived, not yet set up."
 
 Why now: truenas went dark 2026-07-24 and stayed unreachable. Diagnosis from ratio on 2026-07-27 — no tailnet contact for 3 days, 100% packet loss on 192.168.86.5, ARP entry FAILED (nothing answers ARP for the address, so the NIC is down at layer 2), every service port closed, while the gateway and a dozen other LAN hosts stayed reachable. Wake-on-LAN to 70:85:c2:db:9d:94 drew no response. With no console and no out-of-band power control there was no remote remedy at all, so recovery needed hands on the box. The Comet closes exactly that gap: BIOS/UEFI console, Wake-on-LAN, and browser access over its native Tailscale integration.
@@ -666,10 +693,12 @@ On dotfiles main (=b987820=, pushed). Craig chose to share a library, not per-pa
 *** 2026-07-12 Sun @ 09:01:25 -0500 Reconciled maint onto the shared privilege model (dotfiles 7937a9e)
 maint's doctor now resolves every privileged step through =panelkit.privmodel= instead of the old always-=sudo -n= hard-fail: RUN where passwordless (unchanged), PROMPT on a CLI tty (plain sudo, preceded by a wall note), GUIDE events in a GUI with neither — the typable command on the wall, nothing executed. User-scope steps never resolve; a macro's user steps still run around guided privileged ones. Craig's silent-auto decision (above) is implemented as the documented exception: recorded in =maint/remedies.py= (tier semantics) and =panelkit/privmodel.py= (the floor's own docstring), waiving only the confirm gesture, only for the auto-tier reclaim set. TDD (15 new tests red→green incl. both wall renderers), full suite 65/65, live-verified RUN + GUIDE end-to-end on this host via the real launcher shim. Bonus root-cause fix caught by the live run: =probes/logs.py= crashed on journalctl MESSAGE=null entries (key present, so the =.get= default never applied), which broke every real fix's re-probe — normalized at =_journal_lines= with a regression test. Remaining under this task: net Phase 1 / bt Phase 2 / audio adoption (queue items 2-3), and the PROMPT-path + GUI-wall manual checks (see Manual testing and validation).
 
-** TODO [#B] Scrolling/Carousel layout: frame fit + wrap-around :hyprland:
+** TODO [#C] Scrolling/Carousel layout: frame fit + wrap-around :hyprland:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-06
+:LAST_REVIEWED: 2026-08-08
 :END:
+Demoted [#B] → [#C] at the 2026-08-08 review: no motion in two months —
+parking lot until the frame-fit design gets real interest.
 Disabled 2026-06-12 (bind and cycle entry points removed; Super+Shift+S reassigned to whole-desktop screenshot). The layout needs real work before it earns its chord back:
 - What fits in each frame: column/frame sizing so windows land at usable widths instead of arbitrary slices.
 - Wrap-around: navigating past the last frame should wrap to the first (and vice versa).
@@ -809,7 +838,7 @@ Rescoped 2026-07-04 (audit): the tunnels track already shipped most of the origi
 
 ** TODO [#B] Local offline LLM runtime + per-host model cache :tooling:llm:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-06
+:LAST_REVIEWED: 2026-08-08
 :END:
 Add a local-LLM provisioning track so machines can run an offline coding agent when there's no network. Install =llama.cpp= (CPU + Vulkan where practical) and prefetch per-host model files while network is available; expose OpenAI-compat local endpoints (=127.0.0.1:8081= coding, =:8082= general; =:11434= reserved for =ollama= if used). Per the rulesets generic-agent-runtime design pass — rulesets becomes runtime-neutral and owns the runtime manifests + project instructions; archsetup owns machine provisioning + the per-machine model inventory. Source: handoff from rulesets 2026-05-28 ([[file:assets/outbox/2026-05-28-from-rulesets-local-llm-install.org][outbox copy]]).
 
@@ -845,48 +874,64 @@ Boot the configured endpoint and send a short prompt; surface success/failure +
 
 Acceptance: fresh VM install of the ratio profile reaches an endpoint on =:8081= that answers a smoke prompt; velox profile gets Q4_K_M + 8B and answers a prompt within reasonable laptop latency; network-down install completes successfully with the pending-models warning surfaced.
 
-** TODO [#B] Review post-archsetup laptop setup steps (velox 2026-04-10)
+** DONE [#A] Review post-archsetup laptop setup steps (velox 2026-04-10)
+CLOSED: [2026-08-08 Sat]
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-04
+:LAST_REVIEWED: 2026-08-08
 :END:
+Closed at the 2026-08-08 session: every open item got its automate-vs-document
+call and the work landed the same night (tests green, committed). Residual:
+velox itself still needs the new tlp.d radio line and a dotfiles pull — folded
+into the [#A] sleep/suspend task, which works the same files on velox anyway.
 Items discovered during velox setup that needed manual intervention after archsetup.
 Decide which should be automated in archsetup vs documented as post-install steps.
 
-*** TODO Review: rfkill soft blocks bluetooth and wifi at boot
-Both bluetooth and wifi were soft-blocked by rfkill. Fix was ~rfkill unblock bluetooth/wifi~.
-~systemd-rfkill~ persists state, so unblocking once should stick, but new installs may default to blocked.
-Consider: add ~rfkill unblock all~ to archsetup post-install or a firstboot script.
+*** 2026-08-08 Sat @ 04:43:42 -0500 Automated radio enable via TLP (rfkill boot soft-block)
+Root cause sharpened during triage: archsetup masks systemd-rfkill on laptops
+(it fights TLP), so nothing restored radio state at boot — the "unblock once
+should stick" premise was wrong under the mask. Fix in the TLP custom conf:
+=DEVICES_TO_ENABLE_ON_STARTUP="bluetooth wifi"=, the TLP-native mechanism.
+configure_tlp_power parametrized for tests; covered by
+tests/installer-steps/test_configure_tlp_power.py.
 
 *** 2026-07-04 Sat @ 11:48:24 -0500 Automated /efi restrictive mount permissions in fstab generation
 archsetup:2827-2836 now rewrites the /efi fstab line to =fmask=0177,dmask=0077= (idempotent), so fresh installs no longer land the world-accessible =fmask=0022,dmask=0022= default. Confirmed via the 2026-07-04 task audit. (Original velox note: default vfat mount had =fmask=0022,dmask=0022=, hand-fixed to restrictive; bootctl warned about a world-accessible random-seed file.)
 
-*** TODO Review: tmpfs layered over ZFS /tmp causing systemd-tmpfiles failures
-~systemd-tmpfiles-clean.service~ failed repeatedly with "Protocol driver not attached".
-Root cause: systemd's ~tmp.mount~ (tmpfs) mounted before ZFS's ~/tmp~ dataset, creating a stale layer.
-Fix: ~systemctl mask tmp.mount~. Consider: mask tmp.mount in archsetup when ZFS is used.
+*** 2026-08-08 Sat @ 04:43:42 -0500 Automated tmp.mount mask for ZFS /tmp
+New mask_tmp_mount_for_zfs, called from configure_snapshots' ZFS branch:
+masks tmp.mount only when the pool actually carries a dataset mounted at
+/tmp (exact match), silent no-op without zfs or without the dataset. Covered
+by tests/installer-steps/test_mask_tmp_mount_for_zfs.py; the orchestrator
+dispatch pin updated.
 
-*** TODO Review: intel-ucode not installed
-CPU running old microcode. Installed ~intel-ucode~ and rebuilt initramfs.
-Consider: add intel-ucode (or amd-ucode) to archsetup package list based on CPU vendor.
+*** 2026-08-08 Sat @ 04:43:42 -0500 Automated CPU microcode install by vendor
+New install_cpu_microcode, first in boot_ux so grub-mkconfig and mkinitcpio's
+microcode hook both see the installed /boot/<vendor>-ucode.img: vendor_id from
+/proc/cpuinfo → intel-ucode / amd-ucode, error_warn on unknown vendor.
+Covered by tests/installer-steps/test_install_cpu_microcode.py; boot_ux
+sequence pin updated.
 
 *** 2026-07-04 Sat @ 11:48:24 -0500 Automated syncthing user-service enable in archsetup
 archsetup:2263-2271 now installs syncthing and enables the user service (via symlink), so fresh installs no longer leave it installed-but-disabled. Confirmed via the 2026-07-04 task audit. (Original velox note: package installed but service not enabled; hand-fixed with =systemctl enable --now syncthing@cjennings=.)
 
-*** TODO Review: awww-daemon crashes at boot (coredump)
-Wallpaper daemon crashed with abort() shortly after boot. Hyprland also coredumped at same time.
-May be a race condition. Restarting awww-daemon fixed it. Monitor for recurrence.
-
-*** TODO Review: touchpad-indicator missing (X11 only, no Wayland equivalent)
-Old ~touchpad-indicator-git~ was X11-only and removed as broken.
-Created ~touchpad-auto~ (auto-disable touchpad when mouse connected) and ~toggle-touchpad~ scripts.
-~touchpad-auto~ watches Hyprland socket for mouseadded/mouseremoved/configreloaded events.
-Device name ~pixa3854:00-093a:0274-touchpad~ is hardcoded — will differ on other machines.
-Added to exec-once and $mod+F9 keybinding.
-Consider: add scripts to stowed dotfiles, make touchpad device name auto-detected.
-
-*** TODO Review: Bluetooth mouse pairing is manual post-install
-Paired Logi M650 via ~bluetoothctl scan on~, ~pair~, ~trust~.
-This is inherently interactive (scan, select device, pair, trust).
+*** 2026-08-08 Sat @ 04:43:42 -0500 Closed the awww-daemon crash watch — no recurrence
+The April boot crash never recurred across four months of daily use on both
+machines (and the wallpaper stack has since been reworked). Reopen as its own
+bug with fresh evidence if it ever comes back.
+
+*** 2026-08-08 Sat @ 04:43:42 -0500 Automated touchpad device detection in the pointer scripts
+The scripts were already in stowed dotfiles with binds — the open half was the
+hardcoded Framework device name. Both touchpad-auto and toggle-touchpad now
+auto-detect the touchpad (first pointer named *touchpad*, pixa fallback) and
+derive the internal-pointer exclusion set from the detected name, so they
+agree on any machine. Test seams added (--detect / --has-external-mouse);
+tests/touchpad-auto/ new, toggle-touchpad suite still green. Dotfiles commit;
+velox picks it up on its next pull.
+
+*** 2026-08-08 Sat @ 04:43:42 -0500 Documented bluetooth pairing in the post-install checklist
+Inherently interactive, so it can't ride the installer. Documented in the new
+[[file:docs/post-install-checklist.org][docs/post-install-checklist.org]] along
+with the Proton Bridge steps — the standing home for manual post-install work.
 Consider: document as post-install step. No automation possible.
 
 *** 2026-05-26 Tue @ 13:32:31 -0500 pocketbook install concern moot — pulled from publication, folded in-tree
@@ -1092,10 +1137,23 @@ Read recommended resources to make informed security decisions (see metrics for
 :END:
 Practical guidelines for working in public spaces
 
-** TODO [#B] Ensure sleep/suspend works on laptops
+** TODO [#A] Ensure sleep/suspend works on laptops
+SCHEDULED: <2026-08-10 Mon>
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-06
+:LAST_REVIEWED: 2026-08-08
 :END:
+Raised [#B] → [#A] and scheduled at the 2026-08-08 review: Craig leaves on
+vacation ~2026-08-15 and velox is the travel machine — suspend and battery
+drain must be verified working before departure. Verification plan: apply the
+params, suspend velox, measure overnight drain; the hands-on resume check is
+Craig's (a manual-testing entry rides the fix).
+
+While on velox for this (it was offline 2026-08-08, so these ride along):
+- Append =DEVICES_TO_ENABLE_ON_STARTUP="bluetooth wifi"= to its
+  =/etc/tlp.d/01-custom.conf= (the installer now writes it; velox predates
+  that) and confirm radios unblocked after reboot.
+- Pull dotfiles so the touchpad auto-detection lands; spot-check
+  =touchpad-auto --detect= prints the pixa name on real hardware.
 Critical functionality for laptop use - current battery drain unacceptable
 *NOTE:* This applies to Framework Laptop (velox), not Framework Desktop (ratio)
 Add kernel parameter: ~rtc_cmos.use_acpi_alarm=1~ (will become systemd default)
@@ -1834,7 +1892,10 @@ Specced 2026-07-10 after discussion with Craig, and the design grew past the ori
 
 Parent spec: [[file:docs/specs/2026-07-09-audio-doctor-spec.org][docs/specs/2026-07-09-audio-doctor-spec.org]] (IMPLEMENTED). This is a v1 gap found after the fact, not a phase of it.
 
-** TODO [#C] Waybar modules run together — need subtle separators :bug:dotfiles:waybar:
+** DONE [#C] Waybar modules run together — need subtle separators :bug:dotfiles:waybar:
+CLOSED: [2026-08-08 Sat]
+Closed at the 2026-08-08 task review: Craig confirms the separator work landed
+a while back and the bar reads correctly now.
 Craig misreads where one module ends and the next begins — the wind (weather) value runs straight into the date with no visual stop, so he reads the wind figure as the start of the date. Add a light, subtle separator or spacing between adjacent Waybar modules.
 Grading: Minor severity (legibility, nothing broken) x frequent (every glance at the bar) = P3 = [#C].
 Not fully :solo: — needs Craig's eye on the result (separator style is a taste call, plus a live visual check). Prior work added a date-facing divider (dotfiles 103cccb); evidently not enough, so revisit the whole inter-module treatment rather than just the weather/date seam. From .emacs.d handoff 2026-07-20-1114 (roam capture; waybar is archsetup-owned per the dotfiles standing rule).
@@ -1849,18 +1910,44 @@ From the roam inbox (2026-07-20): the shipped Waybar weather chip's comfort colo
 Open design question (Craig): which other conditions/combinations to signal, and how a forecasted severe event (e.g. an upcoming hurricane) should display.
 Grading: Minor severity (legibility on a shipped chip, nothing broken) × frequent (every glance at the bar) = P3 = [#C]. Mostly buildable from the rules above; the severe-event display needs Craig's call. Waybar is archsetup-owned per the dotfiles standing rule.
 ** TODO [#C] Add a time selector to the timer panel :feature:timer:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-08-08
+:END:
 Offer a period-appropriate selector for timer duration, likely drawing on the
 tape-counter idiom, while preserving the existing direct-entry path.
 
 ** TODO [#C] Order network-panel connections by availability :feature:network:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-08-08
+:END:
 Present saved and currently available networks in this order: available saved
 profiles, available unsaved networks, then saved profiles that are unavailable.
 
+Held on a design conflict (recorded 2026-07-19, folded in at the 2026-08-08
+review): this wants one tiered list, but the network-panel spec says "three
+labelled groups, never one merged list" with Saved MRU-first. Craig's call
+before build: reorder within the Saved group only, or merge into one list and
+override the spec. Not :solo: until that's answered.
+
 ** TODO [#C] Indicate hotspot or metered WiFi in amber :feature:network:waybar:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-08-08
+:END:
 Detect hotspot/metered connectivity and render the WiFi icon plus SSID amber,
 while ordinary WiFi stays white.
 
-** TODO [#C] Add a whole-display dim mode :feature:hyprland:
+Held on two design questions (recorded 2026-07-19, folded in at the 2026-08-08
+review), both Craig's call before build:
+- "Hotspot" is ambiguous — connected to a phone's hotspot, or this machine
+  running an AP? Which one (or both) goes amber?
+- Metered detection needs new nmcli reads on the status fast path, whose
+  contract is one nmcli call. Bend the contract, or find a zero-cost signal?
+Not :solo: until both are answered.
+
+** CANCELLED [#C] Add a whole-display dim mode :feature:hyprland:
+CLOSED: [2026-08-08 Sat]
+Killed at the 2026-08-08 task review: the July auto-dim work covers the actual
+need; no separate dim-everything mode wanted.
 Extend auto-dim with an explicit “dim everything” setting for bright
 non-dark-mode contexts, with a security/usability review of its scope.
 
@@ -1892,7 +1979,7 @@ Follow-up from the 2026-07-04 net-panel hardening speedrun (Craig's cj question
 
 ** TODO [#C] Voice dictation / speech-to-text input :feature:tooling:solo:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-06
+:LAST_REVIEWED: 2026-08-08
 :END:
 Push-to-talk dictation that types transcribed speech into the focused Wayland window — usable at any text field, including the Claude Code terminal prompt and Emacs buffers. Claude Code has no built-in voice input; dictation has to happen at the OS level and inject text. Raised 2026-07-03.
 
@@ -1900,10 +1987,17 @@ Tool choice is the open decision (needs Craig): =nerd-dictation= (Vosk, lighter,
 *** 2026-07-21 Tue @ 08:40:00 -0500 Decided (Craig): whisper.cpp + wtype, system-wide
 STT engine = =whisper.cpp= (accurate offline, optional GPU on ratio's Radeon). Typing backend = =wtype= (Wayland-native virtual-keyboard injection into the focused window, no root/daemon), with =ydotool= (uinput) held as a fallback only if a specific app — some XWayland/Electron surface — won't accept wtype's synthetic input. One system-wide path that also covers Emacs buffers and the Claude Code prompt; the Emacs-native =whisper.el= route was NOT chosen. Build scope: whisper.cpp + a model (start with a mid-size English model, tune later), a Hyprland push-to-talk keybind driving a record→transcribe→wtype pipeline, and an autostart/service entry, folded into archsetup so it lands on ratio + velox. Now unblocked (agent-buildable; verification includes a live dictation check).
 
-** TODO [#C] Fix install errors surfaced by the 2026-05-11 VM test run
+** DONE [#C] Fix install errors surfaced by the 2026-05-11 VM test run
+CLOSED: [2026-08-08 Sat]
 :PROPERTIES:
 :LAST_REVIEWED: 2026-07-06
 :END:
+Closed at the 2026-08-08 task review: every archsetup-attributable error was
+fixed and verified (fontconfig, dconf x2, emacs-stow, AUR exit-0 logging at
+the root); the residual four reproduce unchanged and are diagnosed
+environment/non-critical, with two 2026-06-28 full runs attributing zero
+issues to archsetup. Residual thread: confirm the firewall nf_tables pair on
+bare metal at the next real install — no container task needed to carry it.
 *** 2026-06-28 Sun @ 13:29:29 -0400 Audit reconcile: 2026-06-28 btrfs+zfs runs reproduce the same residual set
 Newer full runs landed since the 2026-06-11 reconcile below: the 2026-06-25 zfs run (Testinfra 96/0) and the 2026-06-28 btrfs+zfs runs (97/0, "zero attributed issues"). The residual four were NOT fixed and reproduce unchanged: =enabling firewall= (archsetup:1496-1498, carries a VM-kernel note), =enabling gamemode for user= (archsetup:2221, non-critical), and =tidaler (AUR)=. Zero archsetup-attributed Testinfra issues across both profiles confirms these are environment / non-critical, not archsetup bugs. Bare-metal confirmation of the firewall pair is still the open thread.
 
@@ -1928,7 +2022,15 @@ Root cause was in =retry_install=: =last_exit_code=$?= ran AFTER =if eval ...; t
 *** 2026-05-19 Tue @ 01:25:26 -0500 Verified the b9907c7 emacs-stow fix end-to-end
 =make test= 21:44 → 22:29 (42 min), =test-results/20260518-214516/=. 52/0/5, =ArchSetup Exit Code: 0=. The third-branch path fired correctly — install log =archsetup-2026-05-18-21-45-46.log:14358-14365= shows =From https://git.cjennings.net/dotemacs= → =[new branch] main -> origin/main= → =Reset branch 'main'= → =branch 'main' set up to track 'origin/main'=. No exit-128, no =fatal: not a git repository=. Error Summary down to 7 (was 13 on 2026-05-16); the emacs entry is gone. AUR exit-0 logging triggered for 2 packages this run (mkinitcpio-firmware, tidaler) vs 6 on 2026-05-16 — same bug class, fewer triggers, still tracked under =[#B] AUR exit-0 logged as error=. Issue Attribution: 1 ARCHSETUP entry (Proton VPN Daemon failed — known VM-no-VPN-config artifact). Cleanup ran clean via the normal path.
 
-** TODO [#C] Osbot camera configuration :chore:
+** TODO [#B] Osbot camera configuration :chore:quick:
+SCHEDULED: <2026-08-08 Sat>
+:PROPERTIES:
+:LAST_REVIEWED: 2026-08-08
+:END:
+Re-graded [#C] → [#B] and scheduled at the 2026-08-08 review: Craig leaves on
+vacation in a week (~2026-08-15), so this needs to land before then. Blocked
+only on the camera being physically plugged in (no /dev/video node as of
+2026-08-08). Likely same sitting as the camera-passthrough udev rule task.
 Craig's roam capture 2026-07-20, routed via .emacs.d sentry inbox-zero as archsetup-owned device setup: "configure osbot camera." Scope to define at pickup (device model, what "configure" covers — kernel module, v4l settings, default framing).
 *** 2026-07-21 Tue @ 08:10:00 -0500 Scoped (Craig): tiny — it works, just needs configuring via a panel
 Craig: the camera works (bought for being Linux-friendly), it just needs configuring. There IS a config panel — =cameractrls= 0.6.10 is installed (a GTK GUI for camera controls: exposure, white balance, PTZ, focus, framing) plus =v4l-utils= for the CLI path. Caveat found 2026-07-21: no =/dev/video*= device is present right now, so the camera isn't currently plugged in / its UVC node isn't enumerated. Task: with the camera connected, confirm it enumerates as a /dev/video node, then set defaults in cameractrls. Small, mostly a live-hardware step.
@@ -1954,7 +2056,7 @@ Ran =makepkg --verifysource= on the current AUR PKGBUILD (3.7.0-1). The package
 
 ** TODO [#C] Review theme config architecture for dunst/fuzzel
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-06
+:LAST_REVIEWED: 2026-08-08
 :END:
 The active dunst config is stowed from dotfiles/common/ but theme templates
 live in dotfiles/hyprland/.config/themes/. set-theme copies the templates to
@@ -1968,10 +2070,13 @@ The goal is a single place to edit each config, not two.
 *** 2026-07-21 Tue @ 08:00:00 -0500 Audit reconcile: single-theme now, so the switch-revert pressure is lower
 The theme system went single-theme — Hudson was retired (dotfiles e03436e; documented archsetup 98142bb, 2026-07-18), leaving Dupre as the only theme. So "edits get overwritten on theme switch" now bites only rarely (switches are effectively nonexistent). The structural two-places-to-edit problem still stands and is worth fixing, but the urgency the original grading implied has dropped.
 
-** TODO [#C] Review current tool pain points annually
+** CANCELLED [#C] Review current tool pain points annually
+CLOSED: [2026-08-08 Sat]
 :PROPERTIES:
 :LAST_REVIEWED: 2026-07-06
 :END:
+Killed at the 2026-08-08 task review: an undated annual intention that never
+fired — pain points get surfaced organically as they bite.
 Once-yearly systematic inventory of known deficiencies and friction points in current toolset
 
 ** TODO [#D] Installer + scripts refactor opportunities :refactor:solo: