1 files changed, 63 insertions, 0 deletions
diff --git a/docs/design/2026-08-14-velox-reinstall-gaps-2.org b/docs/design/2026-08-14-velox-reinstall-gaps-2.org
new file mode 100644
index 0000000..95842ac
--- /dev/null
+++ b/docs/design/2026-08-14-velox-reinstall-gaps-2.org
@@ -0,0 +1,63 @@
+#+TITLE: Fifth reinstall gap — machine-local .local.el config, and a general shape
+#+AUTHOR: Craig Jennings
+
+* Follow-up to this morning's handoff
+
+Sent you four gaps an hour ago
+([[file:2026-08-14-velox-reinstall-gaps-1.org][the first report]]). Here is a fifth,
+found straight afterwards when I noticed calendar sync was dead on velox.
+
+* What was broken
+
+=calendar-sync.timer= was enabled and firing every fifteen minutes, and failing
+every time with exit 255:
+
+: calendar-sync: No calendars configured (set calendar-sync-calendars)
+
+The three output files sat at zero bytes. The cause is that
+=~/.emacs.d/calendar-sync.local.el= is gitignored, so the reinstall deleted it
+along with everything else untracked, and the module's loader treats a missing
+file as a *silent* no-op. So the config vanished quietly and the only symptom
+was a failing unit nobody was watching.
+
+Cheap to fix once found: the repo tracks =calendar-sync.local.el.example=, and
+that template already encodes the shape velox uses — feeds resolved by
+=:secret-host= against =authinfo.gpg= rather than inlined. The authinfo entries
+had survived, because =~/.authinfo.gpg= is a stow symlink into the dotfiles repo.
+So rebuilding was one copy, and all three feeds now sync clean and land
+byte-identical to ratio's.
+
+* The general shape, which is the part worth acting on
+
+This is the same failure as gap 1, one layer down, and it is worth stating
+generally because the install can act on it:
+
+- A tracked =*.local.el.example= template plus a gitignored =*.local.el= is a
+  deliberate pattern in this config, not a one-off. =.gitignore= lines 56-58
+  list three of them: =calendar-sync.local.el=, =signal-config.local.el=,
+  =google-keep.local.el=. Every one of those is gone on velox right now. I have
+  only repaired the calendar one.
+- Secrets held *by reference* survive a rebuild; secrets held *inline* do not.
+  The calendar config came back for free because the tokens were in
+  =authinfo.gpg=, which is stow-managed and therefore travels. Ratio's copy of
+  the same file inlines its URLs, and had ratio been the machine rebuilt, those
+  three feed tokens would simply have been gone.
+- The failure was silent by design. A missing local config is a no-op, which is
+  right for a machine that never configured the feature and wrong for one that
+  just lost it.
+
+* What the install could do
+
+- After a rebuild, enumerate every tracked =*.local.el.example= in a project and
+  report which have no corresponding =*.local.el=. That is a one-line find and it
+  turns a silent no-op into a visible checklist item.
+- Same for any =*.local.*= convention elsewhere in the fleet — the pattern is not
+  specific to Emacs.
+- Worth pairing with gap 2: a unit that is enabled and failing every fifteen
+  minutes for two days is its own signal. A post-rebuild pass over
+  =systemctl --user list-units --state=failed= would have caught this one
+  without knowing anything about calendars.
+
+That last one generalizes best. Of the five gaps I have sent you, three were
+things that *looked* fine — a stowed unit file, an enabled timer, a present
+clone — and were not.