feat: install the net panel GTK deps; mark waybar module Phase 2 shipped

The custom/net connection panel (Phase 2, in the dotfiles repo) needs GTK4 layer-shell, so archsetup's Hyprland step now installs gtk4-layer-shell and python-gobject alongside waybar. NetworkManager, curl, rfkill, and resolvectl — the engine's other needs — are already installed. speedtest-go stays deferred to Phase 3.

Record Phase 2 as the dated event-log entry on its task: the engine connection commands, the GTK-free panel model, the GTK layer-shell panel, and the bar interactions settled over live iteration (left = panel, middle = portal, right = notify-or-fix).

1 files changed, 24 insertions, 10 deletions

diff --git a/todo.org b/todo.org
index f1ce9b5..2e3d97f 100644
--- a/todo.org
+++ b/todo.org
@@ -129,16 +129,30 @@ Deferred to Phase 2/3: archsetup deps (gtk4-layer-shell/python-gobject Phase 2,
 speedtest-go-bin Phase 3 — not added before the code that needs them).
 Verify (manual, live): see Manual testing and validation.
 
-*** TODO Phase 2 — panel shell + connection management :network:
-Deliverable: GTK4 + gtk4-layer-shell panel (pocketbook scaffold); =net list/up/
-down/add/edit/remove/rescan= (open + WPA-PSK; enterprise activate-only); MRU list
-with live signal; mutation safety + rollback (keep prior link until target
-activates, no stranding); panel state machines; the panel UX flow (default focus,
-primary buttons, disabled rules, confirmation wording, keyboard nav).
-Tests: fake-nmcli command-sequence assertions (UUID-keyed, escaped parsing:
-colon/backslash/newline/duplicate/hidden/non-ASCII); rollback keeps prior link on
-failed switch; NM-secret write + no-secret-leak; panel state-machine transitions.
-Verify (manual, live): see Manual testing and validation.
+*** 2026-06-29 Mon @ 22:19:25 -0400 Phase 2 shipped — panel shell + connection management
+Shipped to dotfiles (commits =4e7740f=..=24bcac5=, pushed). Engine: =net list= (saved
+MRU + in-range wifi scan, infrastructure types filtered), =net up/down= (UUID-keyed,
+mutation safety — keep prior link until target activates, classify wrong-password vs
+generic, report auto-reactivation), =net add/edit/remove/rescan= (open + WPA-PSK;
+enterprise activate-only; secret to NM's store, never our JSON/log — tested).
+
+Panel: a GTK-free PanelModel (selection, four state machines, the UX-flow enable
+rules, terminal states) + a GTK4 gtk4-layer-shell window (=net panel=) anchored
+top-right under the bar — Connections section with MRU list, active marked, signal
+glyph, row-click select, Connect/Add/Forget/Rescan, confirm-on-forget, worker-thread
+engine calls via GLib.idle_add. GTK imported lazily so the CLI/tests stay GTK-free.
+
+Bar interactions (settled with Craig over live iteration): left = =net-panel= toggle,
+middle = =net portal=, right = =net-fix= (notify the doctor result when one-way; open
+a terminal only when the outcome is fixable — the sudo/interactive case). Airplane on
+Super+Shift+A. archsetup adds =gtk4-layer-shell= + =python-gobject= (this commit);
+already on velox.
+
+Tests: 204 in tests/net (merge ordering/dedup, up/down mutation safety, no-secret-leak
+on add/edit, panel model + state machines, gui row-format helpers). Full dotfiles suite
+green (32 suites). Live-verified on velox: panel opens/toggles, list shows real 24
+profiles, right-click notification delivers (Craig confirmed). Phase 3 (diagnose/repair/
+speedtest IN the panel) is next; the engine for it already exists from Phase 1.
 
 *** TODO Phase 3 — diagnostics + speed test in the panel :network:
 Deliverable: wire =net diagnose= / =net repair= / =net doctor= / =net portal= /