docs(todo): task-review pass over the oldest-unreviewed batch

Seven tasks walked. Three carried a topic tag but no type tag, so they were
invisible to any filter that asks what kind of work they are.

The net/bt realtime-lamp retrofit gains :solo:. Its scope question was settled
in July, and what remains is buildable and testable without a decision.

Priorities held on review. The zsh PATH gap and the zfs base-image failure both
already sit where the severity-by-frequency read puts them, and the keybinding
family still turns on a design choice nobody has made.

1 files changed, 19 insertions, 7 deletions

diff --git a/todo.org b/todo.org
index ad216b8..72a12dc 100644
--- a/todo.org
+++ b/todo.org
@@ -30,15 +30,27 @@ snapshot_retention_repair (WRITE SANE LIMITS — =snapper -c <config> set-config
 Two fix shapes, decide at work time: (1) wire a digest key — e.g. on the timeline row when the config's installed TIMELINE_LIMIT_* drift from the TOML values (needs the probe to read the installed limits for comparison); or (2) keep it CLI-only deliberately and special-case the roster wording for remedies with no panel key ("CLI only — maint fix"). Option 2 is a few lines; option 1 makes limit drift visible on the board, which is the 2026-05-26 pile-up's root cause. Severity minor × rare edge = P4 per the bug matrix.
 
 ** TODO [#C] minimal tier zsh login PATH gap :bug:dotfiles:quick:solo:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-07-09
+:END:
 The 2026-07-08 fix gave common/ a .zprofile (zsh logins never read .profile, so ~/.local/bin was missing from TTY/ssh PATH — dotfiles 39cef40). The minimal/ tier has the same gap: it carries .zshrc and .profile but no .zprofile, so headless installs (DESKTOP_ENV=none stows minimal/ instead of common/) still get zsh logins without ~/.local/bin. Add a matching minimal/.zprofile (PATH-only prepend, same rationale comment). Verify: fresh minimal stow, zsh -lc 'echo $PATH' shows ~/.local/bin first. The installer itself is clean — it writes no shell profiles; the stow layer owns this.
 
 ** TODO [#C] zfs base VM image build failure: ZFS DKMS module missing :bug:zfs:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-07-09
+:END:
 =FS_PROFILE=zfs make test-vm-base= fails inside the VM at initramfs time: archangel reports "ZFS module not found! DKMS build may have failed" against the installed kernel (linux-lts 6.18.38 at the 2026-07-08 attempt). Likely a kernel/OpenZFS version skew — the archzfs zfs-dkms may not support 6.18 yet. Consequences: the maint scenario harness's zfs lane (Phase 12) is filtered but unexercised, and a real zfs bare-metal install via archangel would plausibly hit the same wall. Diagnosis needs the in-VM pacman/DKMS logs (rerun create-base-vm.sh with =--keep=-style access or pull /var/log from the ISO session before teardown). Priority per the bug matrix: Major severity (zfs install path broken) × some-users-sometimes = P3. When fixed, run =FS_PROFILE=zfs bash scripts/testing/run-maint-scenarios.sh --list= and add zfs scenario files (zpool scrub / autotrim / snapshot destroy) to the harness.
 
 ** TODO [#C] Consistent keybinding family for the panel console :feature:hyprland:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-07-09
+:END:
 Consider putting every panel (net, bluetooth, audio, timer, and the coming maintenance console) on one consistent chord family — a shared modifier set (Super+Shift, Control+Alt, or similar) plus a mnemonic letter per panel (N/B/A/T/M). Today the panels open via waybar clicks only; a uniform chord family makes them keyboard-reachable and predictable. Watch for collisions with existing binds: Super+Shift+A is already PTT toggle, and the hold-to-talk grave bind is load-bearing. Decide the family, audit current hyprland binds for conflicts, wire via the dotfiles hyprland config, and document in the keybind reference. Both machines (velox can't QMK-remap, so chords must work on a plain laptop keyboard).
 
-** TODO [#C] Realtime lamp output for the net + bt doctors :feature:
+** TODO [#C] Realtime lamp output for the net + bt doctors :feature:solo:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-07-09
+:END:
 Retrofit the net doctor (=~/.dotfiles/net/src/net/doctor.py=) and bluetooth doctor (=~/.dotfiles/bluetooth/src/bt/doctor.py=) to stream results as a live output wall — one lamp per escalation step, amber while running, green on success, red on failure — instead of a final summary. Matches the maintenance-console doctor design (see [[file:docs/design/maintenance-console-design-ideas.org][maintenance-console-design-ideas.org]], "Doctor = live output wall"). Goal: every doctor in the system reads the same way. Both doctors already step through an escalation chain re-probing after each, so the steps are natural lamp boundaries.
 
 Scope note (Craig, 2026-07-07): realtime lamp *behavior* only. The maintenance console's wider results-wall layout (date+time stamp column, COPY, persistent history) does NOT backport — the net/bt panels are ~400px wide and lack the horizontal real estate. Their existing output wells keep their compact layout; this task just makes them stream live.
@@ -205,9 +217,9 @@ From the 2026-07-04 roam capture. The waybar collapse mechanism (click the trian
 :END:
 Follow-up from the 2026-07-04 net-panel hardening speedrun (Craig's cj question on the no-WiFi item). The shipped no-wifi-hardware verdict covers "no adapter at all." This tier covers "adapter present but the driver is wedged": read-only health signals — =ip link= (device present but no-carrier / down), =dmesg= / =journalctl -k= for firmware-load failures, =rfkill= for a hard block, =modinfo= / =lsmod= for the driver module — classified before a generic reset. Remedy actions: a privileged =modprobe -r <mod> && modprobe <mod>= reload of the wifi driver, and a firmware-package pointer when the failure is a missing/failed firmware load. Dotfiles net-package work (handled per the archsetup-owns-dotfiles rule). Design pass first to decide whether it's worth a repair tier vs a needs-user-action pointer.
 
-** TODO [#B] Desktop-settings dropdown panel :waybar:
+** TODO [#B] Desktop-settings dropdown panel :feature:waybar:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-24
+:LAST_REVIEWED: 2026-07-09
 :END:
 Initial spec written 2026-07-02: [[file:docs/specs/2026-07-02-desktop-settings-panel-spec.org]] (DRAFT — four decisions await Craig's review before build; architecture updated to the net panel's Blueprint/GTK4 stack).
 
@@ -444,9 +456,9 @@ Root cause was in =retry_install=: =last_exit_code=$?= ran AFTER =if eval ...; t
 *** 2026-05-19 Tue @ 01:25:26 -0500 Verified the b9907c7 emacs-stow fix end-to-end
 =make test= 21:44 → 22:29 (42 min), =test-results/20260518-214516/=. 52/0/5, =ArchSetup Exit Code: 0=. The third-branch path fired correctly — install log =archsetup-2026-05-18-21-45-46.log:14358-14365= shows =From https://git.cjennings.net/dotemacs= → =[new branch] main -> origin/main= → =Reset branch 'main'= → =branch 'main' set up to track 'origin/main'=. No exit-128, no =fatal: not a git repository=. Error Summary down to 7 (was 13 on 2026-05-16); the emacs entry is gone. AUR exit-0 logging triggered for 2 packages this run (mkinitcpio-firmware, tidaler) vs 6 on 2026-05-16 — same bug class, fewer triggers, still tracked under =[#B] AUR exit-0 logged as error=. Issue Attribution: 1 ARCHSETUP entry (Proton VPN Daemon failed — known VM-no-VPN-config artifact). Cleanup ran clean via the normal path.
 
-** TODO [#B] Review undeclared ratio packages for installer inclusion
+** TODO [#B] Review undeclared ratio packages for installer inclusion :chore:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-24
+:LAST_REVIEWED: 2026-07-09
 :END:
 Triggered by the 2026-06-14 =make package-diff= run on ratio: 62 packages are installed but not declared in archsetup. Stripped of the structural buckets — pacstrap base/boot/kernel (base, linux*, grub, efibootmgr, sudo, btrfs-progs, fwupd, logrotate, ex-vi-compat, linux-lts-strix, zram-generator), the =make deps= VM set (qemu-full, virt-manager, virt-viewer, libguestfs, bridge-utils, dnsmasq, archiso), and the yay bootstrap — these 40 remain. Check the ones to add to the installer, then rerun =make package-diff= to confirm they clear.
 
@@ -537,9 +549,9 @@ Add kernel parameter: ~rtc_cmos.use_acpi_alarm=1~ (will become systemd default)
 Consider: ~acpi_mask_gpe=0x1A~ for battery drain, suspend-then-hibernate config
 See Framework community notes on logind.conf and sleep.conf settings
 
-** TODO [#C] Re-check python-lyricsgenius --skipinteg workaround :solo:
+** TODO [#C] Re-check python-lyricsgenius --skipinteg workaround :chore:solo:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-06-24
+:LAST_REVIEWED: 2026-07-09
 :END:
 archsetup installs =python-lyricsgenius= with =--mflags --skipinteg=, skipping makepkg integrity + PGP checks — a workaround originally for an expired-signature issue upstream (surfaced by the 2026-06-23 --noconfirm audit). Periodically test whether the cause has cleared: if a plain =aur_install python-lyricsgenius= builds without complaint, drop the =--skipinteg= workaround. Removal needs a real AUR build to confirm, so it isn't a blind change.