chore: log dotfiles-separation progress and file processed handoffs

1 files changed, 20 insertions, 0 deletions

diff --git a/assets/outbox/2026-05-22-emacs-proton-bridge-disable-package-service.org b/assets/outbox/2026-05-22-emacs-proton-bridge-disable-package-service.org
new file mode 100644
index 0000000..b4c2fb3
--- /dev/null
+++ b/assets/outbox/2026-05-22-emacs-proton-bridge-disable-package-service.org
@@ -0,0 +1,20 @@
+#+TITLE: Proton Bridge: disable the package systemd service in favor 
+#+SOURCE: from .emacs.d
+#+DATE: 2026-05-22 13:35:21 -0500
+
+Proton Bridge: disable the package systemd service in favor of the Hyprland GUI autostart
+
+ISSUE
+The protonmail-bridge package ships an enabled systemd USER service at /usr/lib/systemd/user/protonmail-bridge.service (ExecStart=/usr/bin/protonmail-bridge-core --noninteractive, Restart=always). hyprland.conf already autostarts the GUI build (exec-once = protonmail-bridge --no-window, line ~46). At login both fire and conflict:
+
+1. No tray icon. The headless service grabs the IMAP/SMTP ports (127.0.0.1:1143 / :1025) before the GUI '--no-window' instance can bind, so the GUI build that would show a StatusNotifierItem tray icon never fully starts. Bridge ends up running headless with no tray and no entry feel in the session.
+
+2. TLS cert mismatch breaks mail clients. The headless --noninteractive service can't reach gnome-keyring (it starts outside the graphical session), so it falls back to its OWN self-signed TLS cert. ~/.config/protonbridge.pem is exported from the GUI build's keychain cert, so mbsync (mu4e) and the work project's cmail-action.py both fail STARTTLS against the headless service with: SSL CERTIFICATE_VERIFY_FAILED: self-signed certificate. Looks like a 'rotated/stale cert' but is not — it's two different certs from two different bridge instances.
+
+SOLUTION (applied on this machine 2026-05-22)
+systemctl --user disable --now protonmail-bridge.service
+
+That leaves the Hyprland exec-once GUI autostart as the sole bridge: tray icon appears, and the served cert matches ~/.config/protonbridge.pem. Verified: 'echo | openssl s_client -starttls imap -connect 127.0.0.1:1143 -CAfile ~/.config/protonbridge.pem' returns 'Verify return code: 0 (ok)', and 'mbsync -a' syncs all accounts (incl. cmail/Proton) with no TLS error.
+
+ARCHSETUP ACTION
+The fix is a per-machine systemctl state change that a fresh install would undo (the package re-enables its service). Make it durable in the setup: either mask/disable protonmail-bridge.service as part of the install, or document that the Hyprland 'exec-once = protonmail-bridge --no-window' is the intended bridge launcher and the package service must stay disabled. Don't run both.