docs: adopt system-health-check workflow and host inventories

The workflow and the four host capability inventories move here from the home project. System maintenance is archsetup's domain, and this puts the thresholds TOML and both of its consumers in one repo.

The workflow's prose severity rules now cite the installed TOML keys, and the TOML wins on disagreement. Inventory paths point at docs/homelab-inventory/. A note routes routine ratio/velox checks to the maint CLI, leaving this workflow for the non-Arch hosts and forensic deep dives.

Only the #+HOSTNAME: capability inventories moved (ratio, velox, mybitch, truenas, plus the truenas hardware-specs asset they link). The personal gear records stay in home, and the home-side removal is handed off through its inbox.

1 files changed, 238 insertions, 0 deletions

diff --git a/docs/homelab-inventory/mybitch-laptop.org b/docs/homelab-inventory/mybitch-laptop.org
new file mode 100644
index 0000000..e522c40
--- /dev/null
+++ b/docs/homelab-inventory/mybitch-laptop.org
@@ -0,0 +1,238 @@
+#+TITLE: mybitch - Christine's Laptop
+#+DATE: 2026-01-31
+#+HOSTNAME: mybitch
+
+* Automated Capabilities
+
+# Maintained by the system-health-check workflow. Manual edits may be
+# overwritten when the workflow detects drift between this drawer and the
+# live system. Machine-readable capability signals used to dispatch which
+# checks run on this host.
+
+:PROPERTIES:
+:FS:         ext4
+:PM:         apt
+:ORCH:       none
+:SNAPSHOT:   timeshift
+:MESH:       tailscale
+:BACKUP:     source
+:VIRT:       libvirt
+:INIT:       systemd
+:LAST_AUDIT: 2026-06-23
+:END:
+
+* Overview
+
+| Field    | Value                             |
+|----------+-----------------------------------|
+| Hostname | mybitch                           |
+|----------+-----------------------------------|
+| Type     | Laptop                            |
+|----------+-----------------------------------|
+| Owner    | Christine                         |
+|----------+-----------------------------------|
+| Maker    | Framework                         |
+|----------+-----------------------------------|
+| Model    | Laptop 16 (AMD Ryzen 7040 Series) |
+|----------+-----------------------------------|
+| OS       | Linux Mint 22.3 (Zena)            |
+|----------+-----------------------------------|
+| Kernel   | 6.17.0-23-generic                 |
+|----------+-----------------------------------|
+| Status   | In use                            |
+|----------+-----------------------------------|
+
+* Hardware Specifications
+
+** CPU
+
+| Field        | Value                             |
+|--------------+-----------------------------------|
+| Model        | AMD Ryzen 9 7940HS w/ Radeon 780M |
+|--------------+-----------------------------------|
+| Architecture | Zen 4 (TSMC 5nm)                  |
+|--------------+-----------------------------------|
+| Cores        | 8                                 |
+|--------------+-----------------------------------|
+| Threads      | 16                                |
+|--------------+-----------------------------------|
+| Base Clock   | 4.0 GHz                           |
+|--------------+-----------------------------------|
+| Boost Clock  | 5.25 GHz                          |
+|--------------+-----------------------------------|
+| L2 Cache     | 8 MiB (8x1024 KiB)                |
+|--------------+-----------------------------------|
+| L3 Cache     | 16 MiB                            |
+|--------------+-----------------------------------|
+
+** Memory
+
+| Field     | Value                        |
+|-----------+------------------------------|
+| Total     | 32 GB                        |
+|-----------+------------------------------|
+| Type      | DDR5-5600                    |
+|-----------+------------------------------|
+| Installed | 1x 32GB (A-DATA AD5S560032G) |
+|-----------+------------------------------|
+| Slots     | 2 (1 free)                   |
+|-----------+------------------------------|
+| Max       | 64 GB                        |
+|-----------+------------------------------|
+
+** Graphics
+
+| Device     | Model               | Driver | Notes           |
+|------------+---------------------+--------+-----------------|
+| Dedicated  | AMD Radeon RX 7700S | amdgpu | RDNA 3, Navi 33 |
+|------------+---------------------+--------+-----------------|
+| Integrated | AMD Radeon 780M     | amdgpu | RDNA 3, Phoenix |
+|------------+---------------------+--------+-----------------|
+
+** Storage
+
+| Device       | Model               | Size     | Interface    |
+|--------------+---------------------+----------+--------------|
+| /dev/nvme0n1 | WD BLACK SN770M 2TB | 1.82 TiB | PCIe Gen4 x4 |
+|--------------+---------------------+----------+--------------|
+| /dev/nvme1n1 | WD BLACK SN770 2TB  | 1.82 TiB | PCIe Gen4 x4 |
+|--------------+---------------------+----------+--------------|
+| Total        |                     | 3.64 TiB |              |
+|--------------+---------------------+----------+--------------|
+
+*** Partitions
+
+| Partition      | Size     | Used        | Filesystem | Mount     | Label  |
+|----------------+----------+-------------+------------+-----------+--------|
+| /dev/nvme1n1p2 | 1.82 TiB | 17.4%       | ext4       | /         |        |
+|----------------+----------+-------------+------------+-----------+--------|
+| /dev/nvme1n1p1 | 512 MiB  | 1.2%        | vfat       | /boot/efi |        |
+|----------------+----------+-------------+------------+-----------+--------|
+| /dev/nvme0n1p1 | 1.82 TiB | (unmounted) | ext4       |           | Backup |
+|----------------+----------+-------------+------------+-----------+--------|
+
+** Display
+
+| Field      | Value              |
+|------------+--------------------|
+| Panel      | BOE Display 0x0bc9 |
+|------------+--------------------|
+| Resolution | 2560x1600          |
+|------------+--------------------|
+| Size       | 16" (345x215mm)    |
+|------------+--------------------|
+| Ratio      | 16:10              |
+|------------+--------------------|
+| DPI        | 188                |
+|------------+--------------------|
+
+** Battery
+
+| Field    | Value            |
+|----------+------------------|
+| Model    | NVT FRANDBA      |
+|----------+------------------|
+| Capacity | 85.1 Wh (design) |
+|----------+------------------|
+| Current  | 87.5 Wh (102.9%) |
+|----------+------------------|
+| Cycles   | 13               |
+|----------+------------------|
+| Type     | Li-ion           |
+|----------+------------------|
+
+** Network
+
+| Interface | Type   | Chipset                  |
+|-----------+--------+--------------------------|
+| wlp5s0    | WiFi   | MediaTek MT7922 802.11ax |
+|-----------+--------+--------------------------|
+| Bluetooth | BT 5.2 | MediaTek Wireless_Device |
+|-----------+--------+--------------------------|
+
+** Expansion Cards (Framework)
+
+| Slot | Card                |
+|------+---------------------|
+| 1    | HDMI Expansion Card |
+|------+---------------------|
+
+** Input Modules (Framework)
+
+| Module   | Notes                   |
+|----------+-------------------------|
+| Keyboard | ANSI layout             |
+|----------+-------------------------|
+| Numpad   | Laptop 16 Numpad Module |
+|----------+-------------------------|
+
+* Connected Peripherals
+
+| Device                    | Connection              |
+|---------------------------+-------------------------|
+| Logitech MX Master 3      | Unifying Receiver (USB) |
+|---------------------------+-------------------------|
+| Realtek Laptop Camera     | Internal USB            |
+|---------------------------+-------------------------|
+| Goodix Fingerprint Reader | Internal USB            |
+|---------------------------+-------------------------|
+
+* Network Access
+
+| Method | Address       |
+|--------+---------------|
+| mDNS   | mybitch.local |
+|--------+---------------|
+| SSH    | Yes (OpenSSH) |
+|--------+---------------|
+
+* Notes
+
+- Framework Laptop 16 with modular expansion card system
+- Discrete AMD GPU (RX 7700S) in addition to integrated Radeon 780M
+- Second NVMe slot contains 2TB backup drive (unmounted, labeled "Backup")
+- Uptime at inventory: 4 days
+
+* Operational Changes Log
+
+Deliberate, non-default config changes applied to mybitch (so they can be found and reverted later). Most recent first.
+
+** 2026-05-12 — amdgpu.mes=0 added (escalation of the MES-hang freeze mitigation)
+
+The 2026-05-11 =amdgpu.cwsr_enable=0= mitigation didn't reduce the iGPU "MES failed to respond" errors (14 hits in 14.5h after the fix vs. 38 over 10 days before — rate went *up*), so escalated per the documented path: added =amdgpu.mes=0= to =GRUB_CMDLINE_LINUX_DEFAULT= in =/etc/default/grub= (now =quiet splash amdgpu.cwsr_enable=0 amdgpu.mes=0=). Backup: =/etc/default/grub.bak-2026-05-12-amdgpu-mes=. =update-grub= run; param verified in all 6 =/boot/grub/grub.cfg= entries. Takes effect on next reboot (planned for after the in-progress first rsyncshot backup). =amdgpu.mes=0= disables the GFX11 hardware MES scheduler and falls back to the legacy KIQ path — sidesteps the hanging MES firmware entirely. Tradeoff: KIQ-on-GFX11 is a less-traveled config (small chance of cosmetic display/modeset quirks); irrelevant for Christine's light desktop workload. =cwsr_enable=0= kept (harmless alongside mes=0). *Revert:* restore =/etc/default/grub.bak-2026-05-12-amdgpu-mes= (or sed out = amdgpu.mes=0=), =update-grub=, reboot. After the reboot, check =journalctl -k -b | grep -c 'MES failed'= → should be 0. See the 2026-05-11 entry in =.ai/project-workflows/system-health-check.org='s Known Issues Log for the full background.
+
+** 2026-05-12 — rsyncshot backups + travel keep-awake mode
+
+Set up the same =rsyncshot= → TrueNAS backup mybitch's siblings use, and made mybitch never suspend so backups keep running while Christine travels with it.
+
+*** rsyncshot install (mirrors ratio's setup)
+- =/usr/local/bin/rsyncshot= — the script (source of truth: =~/code/rsyncshot/rsyncshot=).
+- =/etc/rsyncshot/config= — =REMOTE_HOST="cjennings@truenas.tailf3bb8c.ts.net"=, =REMOTE_PATH="/mnt/vault/backups"=, =SSH_IDENTITY_FILE="/root/.ssh/id_ed25519"=. (See "destination pinned to Tailscale" below for why the full MagicDNS name.)
+- =/etc/rsyncshot/include.txt= — =/home /etc /usr/local/bin=. =/etc/rsyncshot/exclude.txt= — copied verbatim from ratio.
+- =/etc/logrotate.d/rsyncshot= — copied verbatim from ratio. =/var/log/rsyncshot.log= — the log.
+- Root crontab: hourly at :30 (hours 0-1,3-23, keep 23) + daily at 2:30 (keep 30), each wrapped in =flock -x /tmp/rsyncshot.lock=. Identical to ratio's schedule.
+- =/root/.ssh/id_ed25519= (+ =.pub=) — new keypair generated on mybitch, no passphrase, comment =root@mybitch-rsyncshot=. mybitch's =cjennings= account had no outbound key (it's a receive-only account), so the backup runs with a dedicated root key instead. The pubkey was appended to =~cjennings/.ssh/authorized_keys= on TrueNAS (the line tagged =root@mybitch-rsyncshot=).
+- =/root/.ssh/config= — =Host truenas truenas.tailf3bb8c.ts.net 100.67.22.65= → =User cjennings=, that IdentityFile, =ServerAliveInterval 60 / ServerAliveCountMax 10 / TCPKeepAlive yes=. Host keys for those names added to =/root/.ssh/known_hosts=.
+- TrueNAS side: =/mnt/vault/backups/mybitch/= directory created, owned =cjennings:cjennings= (=vault/backups= is a ZFS dataset; per-host backups are just subdirectories, like =ratio/= and =velox/=).
+- *Revert:* =sudo crontab -r= (or remove the rsyncshot lines), =sudo rm -rf /usr/local/bin/rsyncshot /etc/rsyncshot /etc/logrotate.d/rsyncshot /var/log/rsyncshot.log /root/.ssh/id_ed25519* /root/.ssh/config=, restore =/root/.ssh/known_hosts= if desired, remove the =root@mybitch-rsyncshot= line from =~cjennings/.ssh/authorized_keys= on TrueNAS, and =rm -rf /mnt/vault/backups/mybitch= on TrueNAS.
+
+*** destination pinned to Tailscale
+=REMOTE_HOST= uses the full Tailscale MagicDNS name =truenas.tailf3bb8c.ts.net= (not the bare =truenas=) so the backup always routes over the tailnet regardless of what a hotel/away-from-home router's DNS resolves =truenas= to. Tailscale uses a direct LAN path between same-LAN peers, so this is near-zero perf cost when mybitch is on the home network. *Revert:* set =REMOTE_HOST="cjennings@truenas"= in =/etc/rsyncshot/config=.
+
+*** keep-awake (never suspend) — three layers
+1. =systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target= — the hard guarantee; suspend can't happen even if requested. *Revert:* =sudo systemctl unmask sleep.target suspend.target hibernate.target hybrid-sleep.target=.
+2. Cinnamon power gsettings for user =cciarm= set to ='nothing'=: =sleep-inactive-ac-type=, =sleep-inactive-battery-type=, =lid-close-ac-action=, =lid-close-battery-action= (schema =org.cinnamon.settings-daemon.plugins.power=). Were ='suspend'/'suspend'/'nothing'/'suspend'=. *Revert:* set them back, or run =gsettings reset= on each key as =cciarm=.
+3. =/etc/systemd/logind.conf.d/no-suspend-keep-awake.conf= — =HandleLidSwitch=ignore=, =HandleLidSwitchExternalPower=ignore=, =HandleLidSwitchDocked=ignore=, =IdleAction=ignore=. (Written but not applied live — =systemd-logind= wasn't restarted because sessions were active; takes effect on next reboot. Layers 1-2 cover the gap.) *Revert:* =sudo rm /etc/systemd/logind.conf.d/no-suspend-keep-awake.conf= then reboot or =systemctl restart systemd-logind=.
+
+When mybitch goes back to being a stationary machine (or this whole arrangement is no longer wanted), reverse layers 1-3. The rsyncshot backup itself is worth keeping regardless.
+
+*** IPv6 set to link-local-only (fixes the tailscale dropout)
+mybitch dropped off the Tailscale tailnet on 2026-05-12 AM. Root cause: the home WiFi ("dupre") has device(s) advertising ULA-only IPv6 RAs (prefixes =fdc4:c4c6:3fb0:16cc::/64= and =fd67:8615:6780:1::/64=) with no default route. NetworkManager (=ipv6.method=auto=) SLAAC'd a "global"-scope ULA address onto wlp5s0 with no v6 internet path, so tailscaled kept trying IPv6 to controlplane/DERP, failed "network is unreachable", flapped, and lost its control connection. mybitch has no working global IPv6 anywhere (no ISP v6), so the fix is to ignore underlay v6:
+- =/etc/NetworkManager/conf.d/ipv6-link-local-only.conf= → =[connection] ipv6.method=link-local= (connection default — covers home WiFi, travel WiFi, phone hotspot).
+- =nmcli con modify dupre ipv6.method link-local= (explicit on the home connection).
+- Effect: wlp5s0 keeps only fe80:: (mDNS still works), no SLAAC, no v6 routes; tailscale0's overlay v6 untouched; tailscaled uses the IPv4 underlay. Activates on reboot or =nmcli dev reapply wlp5s0=.
+- *Revert if mybitch ever gets real IPv6:* =sudo rm /etc/NetworkManager/conf.d/ipv6-link-local-only.conf=; =sudo nmcli con modify dupre ipv6.method auto=; reboot or =nmcli dev reapply wlp5s0=.
+
+*** caveats (relayed to Craig for Christine)
+- mybitch must stay plugged into AC for backups to keep running — masking suspend doesn't stop a battery dying with the lid closed.
+- mybitch must be on WiFi at the destination and stay on the Tailscale tailnet.