1 files changed, 38 insertions, 0 deletions
diff --git a/archive/task-archive.org b/archive/task-archive.org
index 3811cc6..4f2fdaa 100644
--- a/archive/task-archive.org
+++ b/archive/task-archive.org
@@ -2930,3 +2930,41 @@ CLOSED: [2026-08-08 Sat]
 Killed at the 2026-08-08 task review: an undated annual intention that never
 fired — pain points get surfaced organically as they bite.
 Once-yearly systematic inventory of known deficiencies and friction points in current toolset
+** DONE [#B] Podman API socket and camera-passthrough udev rule :feature:solo:
+CLOSED: [2026-08-09 Sun]
+:PROPERTIES:
+:CREATED: [2026-08-07 Fri]
+:LAST_REVIEWED: 2026-08-07
+:END:
+Shipped 2026-08-09: the installer enables the rootless podman socket at
+install time (enable_user_service grew a wants-target arg so socket units
+land in sockets.target.wants) and ships
+=72-usb-passthrough-cameras.rules= — numbered below 73 per the winvm
+rule-ordering correction, GROUP/MODE as the verified grant, uaccess tag kept.
+Applied live on ratio (socket enabled+active, 99- file retired, udev
+reloaded); velox apply rides the velox-return riders on the sleep/suspend
+task. The uaccess-alone hypothesis stays untested until a camera is attached.
+From winvm 2026-08-07 (ratio). Two one-time machine-level setups, both live on
+ratio and absent on velox; full evidence and rationale in
+[[file:docs/design/2026-08-07-podman-socket-and-camera-udev.md]].
+
+- Enable the rootless podman socket at install time
+  (=systemctl --user enable --now podman.socket=). Socket-activated, zero idle
+  cost; every podman GUI/API client needs it, and its absence fails silently
+  (Pods opens to an empty window). The installer already carries the
+  "=systemctl --user enable= fails during install" workaround pattern
+  (=archsetup:1270=, =:2722=) — use it.
+- Ship a udev rule granting GROUP="video", MODE="0660" on the OBSBOT
+  (3564:ff02) and BRIO (046d:085e) USB nodes so =usbredirect= can claim them
+  for VM passthrough. CORRECTED (winvm, 2026-08-08): the original "uaccess
+  can't ACL raw USB nodes" claim was wrong — the mechanism is rule ordering.
+  The ACL is applied by =73-seat-late.rules=, so a =99-= rule adds the tag
+  after that already ran; distro rules that add the tag all sort at or below
+  70. [@70] So number our file below 73 (e.g. =72-usb-passthrough-cameras.rules=),
+  keep the verified GROUP/MODE grant, and keep the tag — correctly ordered it
+  may make uaccess work on its own (untested hypothesis; a tighter grant if
+  it holds, needs the camera plugged in to verify). Reconcile ratio's
+  existing =99-= file (winvm installed it) when the installer version lands.
+
+Scope: installer step + rule file + tests per existing shapes, and apply both
+live to velox over tailscale (daily-driver sync — neither exists there today).