feat: Phase 6 threshold keys (update guard, session-critical, quarterly)

[updates] guard_patterns is the live-update guard's pattern set (mesa/hyprland/wayland runtime plus both hosts' vulkan drivers); [curation.session_critical] is the KILL lever's denylist; timeline_quarterly completes the snapper set-config key set.

1 files changed, 24 insertions, 0 deletions

diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml
index edf54d3..161b4c2 100644
--- a/configs/maintenance-thresholds.toml
+++ b/configs/maintenance-thresholds.toml
@@ -36,6 +36,7 @@ timeline_hourly = 6
 timeline_daily = 7
 timeline_weekly = 2
 timeline_monthly = 2
+timeline_quarterly = 0
 timeline_yearly = 0
 single_keep = 2                     # DELETE STALE keeps the newest N singles
 zfs_count_warn = 1000               # runaway retention
@@ -53,6 +54,18 @@ cve_min_warn = "high"               # arch-audit severity floor that warns (the
 pending_warn = 50                   # "a lot" — reddens the strip border
 cache_stale_hours = 6               # network-tier cache older than this warns
 topgrade_warn_days = 14             # topgrade freshness
+# The live-update guard (never -Syu the graphics/wayland runtime under a
+# live session — the 2026-06-07 mesa+hyprland crash). fnmatch patterns
+# against pending package names; a hit arms UPDATE/TOPGRADE instead of
+# running ("press again to run anyway — or apply from a TTY").
+guard_patterns = [
+  "mesa", "mesa-*", "lib32-mesa*",
+  "hyprland", "hyprland-*", "aquamarine", "hyprutils", "hyprlang",
+  "hyprcursor", "hyprgraphics",
+  "*wayland*", "wlroots*",
+  "vulkan-radeon", "lib32-vulkan-radeon",   # ratio's GPU driver
+  "vulkan-intel", "lib32-vulkan-intel",     # velox's GPU driver
+]
 
 [systemd]
 # The capability-derived expected set (paccache/reflector always;
@@ -116,6 +129,17 @@ entries = [
 [curation.expected_listeners]
 entries = ["sshd", "mpd", "tailscaled"]
 
+[curation.session_critical]
+# Process names KILL must never fire on (the lever renders disabled) —
+# systemd, the compositor and its plumbing, the audio stack, the panel
+# itself, and sshd (a remote session's lifeline). fnmatch patterns.
+entries = [
+  "systemd*", "Hyprland", "Xwayland", "waybar",
+  "dbus-broker*", "dbus-daemon",
+  "pipewire*", "wireplumber",
+  "maint*", "sshd",
+]
+
 [curation.expected_containers]
 entries = ["winvm"]