From 8b5e438d787ff73c3344b4c5ea1141cf8b23ef69 Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Mon, 24 Aug 2026 14:27:57 -0600
Subject: chore: stage the Hyprland Lua port with its redeploy kit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hyprland 0.57 drops the .conf format. The port is built and measured identical to the current config in a nested compositor — 38 settings, 103 binds, the host-override chain — but it is not deployed. I put it live this afternoon and took it back out the same hour, because it had not been run on real hardware and the machine has to stay usable until it has.

working/hyprland-lua-port/ carries what the switch needs, including the two reader changes as replayable patches. Those matter more than the config itself: four things read hyprland.conf as a source of truth, and dotfiles-validate globs hypr/*.conf, so with the .conf gone it finds nothing and reports a clean tree.

Two facts not worth re-deriving: with both files present 0.56.2 loads the .lua, so keeping the .conf beside it buys no rollback; and a running compositor rewrites a stub config within a second of the file vanishing, which is what fights a restow.

Also archives finished tasks and folds in several sessions of task-review edits.
---
 todo.org | 953 +++++++++++++++++++++++++++++++++++++++------------------------
 1 file changed, 587 insertions(+), 366 deletions(-)

(limited to 'todo.org')

diff --git a/todo.org b/todo.org
index 176d62b..cf8d242 100644
--- a/todo.org
+++ b/todo.org
@@ -45,36 +45,44 @@ below):
   input-side-spec.org (DRAFT, four decisions open).
 
 * Archsetup Open Work
-** TODO [#A] Velox still carries the install placeholder passwords :bug:security:velox:
-SCHEDULED: <2026-08-20 Thu>
+** TODO [#B] Timeline spine test picks the wrong "next" event off Denver :bug:dotfiles:test:
 :PROPERTIES:
-:CREATED: [2026-08-20 Thu]
-:LAST_REVIEWED: 2026-08-20
+:CREATED: [2026-08-24 Mon]
+:LAST_REVIEWED: 2026-08-24
 :END:
-The 2026-08-13 reinstall set placeholder credentials and the runbook's Phase 5
-item to replace them (=passwd=, =zfs change-key zroot=) was never ticked.
-Confirmed still live 2026-08-20 via the archangel handoff, which had to hand
-them back to Craig to get into the machine: =welcome1= for the pool, =welcome=
-for the accounts.
+=make test= in dotfiles is red before any of this session's work. Two failures,
+both in =settings/faces/timeline-face-spine.test.mjs=: "event bars never leave
+the plot" and "exactly one event is marked as next, and it is the soonest ahead".
 
-So velox's full-disk encryption is currently protected by a dictionary word
-with a digit, on the machine that travels. Anyone who picks it up owns the pool
-and every account on it — the encryption is doing no work at all.
+NOT the bug =c96a216= fixed. Every =spineRows= call in that file is pinned to
+=JUL=, and =scene()= and =EVENTS()= both default to it, so the fixture side is
+already clean and the file's own guard test passes.
 
-Two commands, both on velox:
-- =passwd= for each account.
-- =zfs change-key zroot= for the pool passphrase. Note this is the ZBM unlock
-  passphrase, so get it right before rebooting.
+TWO THINGS TO SETTLE, and they may be one bug or two:
 
-Grading: *severity-alone carve-out* — this is a security exposure, so the
-frequency row does not discount it (=todo-format.md=). Critical severity: total
-compromise of an encrypted-at-rest laptop from a guessable string, with the
-device leaving the house. = P1 = [#A].
+1. =timeline-face-spine.js:466= — =const next = timedOnly(events).find((e) => e.s
+   >= refMs)= takes the first array element starting at or after now, which is
+   the *soonest* only if =events= is sorted by start time. The test's failure
+   message is exactly that it is not: a bar ahead of the spine starts at x=1651.2
+   while the one marked =event-next= sits at x=2132.8. Either sort before the
+   find, or use a min-by rather than a find.
+
+2. Why it is red *here* and presumably green on ratio. The most recent commit to
+   =timeline-face-spine.js= is =ffe43ab feat(settings): draw home where the
+   machine is, not where its zone is=. This machine is =America/Denver= (Craig
+   travelling); the tests pass =home("New Orleans")= explicitly. If a
+   machine-resolved home overrides the explicit argument, the geometry drifts
+   and the test is machine-dependent — which makes it useless as a gate, since it
+   would only ever fail on the machine nobody runs it on. Confirm by running the
+   faces suite with =TZ=America/Chicago= and again with =TZ=America/Denver=.
+
+If item 2 confirms, the design question is whether machine-resolved home belongs
+in the pure geometry layer at all, or whether the host should resolve it and pass
+it in — which is what the test already assumes.
+
+Not blocking the Lua port: =make test-faces= is disjoint from the hypr config and
+the three suites that work touches.
 
-Distinct from the =VERIFY [#A] Rotate the credentials exposed by the 2026-08-09
-dotfiles leak= under the cgit audit — that one covers credentials a crawler
-already took from a public repo. This one is a local default never changed. Both
-are rotation work; neither substitutes for the other.
 ** TODO [#B] Qt apps render oversized on velox :bug:velox:solo:
 :PROPERTIES:
 :CREATED: [2026-08-19 Wed]
@@ -1102,6 +1110,27 @@ snapshot.
 
 =origin= on this machine is still =git@cjennings.net:archsetup.git=, the cgit
 account, so nothing has moved. Everything in the plan stands unchanged.
+
+*** 2026-08-21 Fri @ 14:12:46 -0700 Recorded the publication mechanism: placement is the only control
+The work project verified its own repo reads "not served" against a control
+repo that reads PUBLIC, and reported the mechanism back: the host publishes via
+=GIT_HTTP_EXPORT_ALL= over =GIT_PROJECT_ROOT=/var/git=, so *publication is
+directory placement and nothing else* — there is no per-repo marker, no
+=git-daemon-export-ok= file, no opt-in flag to check. A repo is public because
+of where it sits.
+
+That is the durable hazard for this task's plan, and it cuts both ways. It
+confirms the approach — a bare repo created outside the scan-path is private by
+construction, which is exactly what the plan already specifies. It also means
+nothing in a repo itself records whether it is exposed, so any future move
+*into* =/var/git= publishes silently, with no local artifact to notice. Their
+own repo is private for this reason alone: it lives under =/var/cjennings/git/=,
+outside the served root.
+
+Caveat they raised and I agree with: any enumeration of the served set is a
+snapshot, not a standing fact. The set moved twice while three projects were
+measuring it. Verify placement at the time of the move rather than trusting a
+recorded list.
 ** TODO [#B] Velox boot-failure retrospective — upgrade guard gaps :bug:zfs:maint:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-07-21
@@ -1123,11 +1152,43 @@ any binding.
 
 ** TODO [#B] Reconcile panel keybindings around Super+N :feature:hyprland:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-21
+:LAST_REVIEWED: 2026-08-21
 :END:
-Swap the notification and networking bindings so primary panels are one
-Super-plus-letter chord away, audit the other exceptions, and bring the
-proposed family to Craig for a final mapping decision.
+Put every panel on one consistent chord family — net, bluetooth, audio, timer,
+and the maintenance console — as a shared modifier set plus a mnemonic letter
+per panel (N/B/A/T/M). Today they open by waybar click only, so a uniform
+family is what makes them keyboard-reachable and predictable. The immediate
+move is swapping the notification and networking bindings so the primary panels
+sit one Super-plus-letter chord away.
+
+Maintenance (M) is the chord I want first — it is the panel I keep reaching for
+without one.
+
+Constraints:
+- Super+Shift+A is already the PTT toggle, and the hold-to-talk grave bind is
+  load-bearing. Audit every current hyprland bind for conflicts before
+  proposing a family, and treat these two as fixed.
+- Both machines have to work the same way. Velox can't QMK-remap, so the chords
+  have to be typable on a plain laptop keyboard.
+
+Steps: settle the modifier family, audit the existing binds for collisions,
+wire it through the dotfiles hyprland config, and document it in the keybind
+reference.
+
+The family itself is the one call I haven't made — the audit and the wiring
+follow from it, so that decision comes first rather than last.
+
+*** 2026-08-21 Fri @ 14:15:22 -0700 Merged the duplicate keybinding-family task into this one
+Two tasks were carrying one job: this one and =[#B] Consistent keybinding family
+for the panel console=, filed separately and both stalled. This one had the
+tighter framing and the more recent review; that one had the better body — the
+specific collisions, the velox plain-keyboard constraint, and maintenance-M as
+the priority chord. Folded its detail in here and cancelled it, since two
+half-specified tasks for one decision is plausibly why neither moved.
+
+Not =:solo:= and not =:quick:=: the modifier family is a preference call I have
+to make, judging what's load-bearing among the existing binds needs me too, and
+the audit plus wiring plus docs runs past thirty minutes on its own.
 
 ** TODO [#B] Add storage-capacity signals to the maintenance module :feature:maint:
 :PROPERTIES:
@@ -1146,12 +1207,39 @@ existing device-level workflow.
 
 ** DOING [#B] Widget gallery upgrades :feature:design:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-13
+:LAST_REVIEWED: 2026-08-23
 :END:
-Usability + documentation pass over the [[file:docs/prototypes/panel-widget-gallery.html][panel widget gallery]], orthogonal to the component-generation spec work, so it runs on the =gallery-upgrades= branch (squash merge to main after Craig's UI confirmation + tweaks). Items 1-4 run as a no-approvals speedrun (Craig authorized 2026-07-12); item 5 is a joint brainstorm after the merge.
+Usability + documentation pass over the [[file:docs/prototypes/panel-widget-gallery.html][panel widget gallery]], orthogonal to the component-generation spec work. Items 1-4 run as a no-approvals speedrun (Craig authorized 2026-07-12); item 5 is a joint brainstorm.
+
+The =gallery-upgrades= branch this originally described is gone — no local or remote ref, and every gallery commit since has landed straight on main. Whether it was squash-merged or abandoned, the branch stopped describing how this work runs, so the line came out at the 2026-08-23 review rather than being left to mislead. Work on main.
 *** TODO Extraction-readiness bar for every gallery component :refactor:design:
 Craig's standing directive (2026-07-18, set while finishing the split-flap): every =DUPRE.*= builder should meet the bar the split-flap now sets, since these become regular components. The bar: a contract comment documenting every opt and the full handle surface; no page globals touched (page owns cadence via handles/callbacks, e.g. =onSettle=); all component CSS in one named =DUPRE_CSS= block; refactored until no opportunity worth doing remains (small named helpers, no duplication); construction axes declared via =STYLES= where the component has them. Sweep the existing builders against that list, fix the gaps, and make the bar a stated convention in the widgets.js header or README so new builders inherit it. Overlaps the component-generation spec's extraction phase — reconcile there rather than doing the work twice.
 
+*Audited 2026-08-23 — the sweep covered the bulk and stopped short.* Ten commits
+on 2026-07-18 (=43725ff= … =1dd929d=) carried ~104 of the 112 builders over. Two
+criteria are fully met: 105 builders carry a real contract comment naming opts
+and the handle surface, and component CSS is wholly consolidated — the gallery's
+own =<style>= block holds nothing but page chrome (masthead, grid, toc, card
+frames, validation lamps, palette). Three gaps remain, and they are the whole of
+what's left:
+
+1. *Seven builders were never swept*: =telegraphIndicator=, =radarSweep=,
+   =dotMatrix=, =flipDisc=, =dekatron=, =gearIndicator=, =blinkenlights=. Each
+   carries a one-line comment describing what the widget does, with no opts, no
+   handle surface, no CSS statement. They sit at the tail of =widgets.js= after
+   =responseGraph=, and the last batch was "well-through-response" — the sweep
+   stopped one builder short of the end and never came back. Not a clean cut:
+   =dayDateCal= is in that tail and does have a contract.
+2. *The bar was never written down.* The README documents the API shape (Builder
+   contract) and =DUPRE_CSS= (Styling) — two of the five criteria. The checklist
+   itself appears nowhere, so a new builder inherits nothing and the sweep has to
+   be re-derived from this task every time.
+3. *One page-global reach survived*: =patchBay= does
+   =window.addEventListener('resize', draw)= and never removes it. Fails the
+   no-page-globals criterion and leaks besides — a torn-down instance keeps
+   redrawing on every resize. The other two =document= reaches are benign
+   (=indexPlate= guards a shared SVG def; the other is the CSS injector).
+
 *** 2026-07-18 Sat @ 04:32:20 -0500 Made the N20 split-flap an honest Solari mechanism
 =GW.splitFlap= rebuilt from the drop-fade fake: charset-as-drum stepping (=opts.chars= is the flap order, one flip at a time through intermediates, staggered arrival), re-aim-not-queue retargeting, and the real two-half-panel fold (WAAPI, backfaces hidden), with =animate:false= collapsing to instant jump for reduced motion. Handle grew =setText=/=chars=/=reading()=; default width 3 → 4 cells. Nine probe checks written red-first (arrival, intermediates, one-flap stepping, re-aim discriminator, instant path); technique studied from HotFX and re-derived — no license on their repo, nothing copied (reference filed in =working/retro-stereo-widgets/references/=). Review: sound; its two test-strength notes addressed in the same change.
 
@@ -1308,11 +1396,25 @@ The cross's cell assignments were read off card names and spec sheets, not audit
 ** DOING [#B] Retro widget catalogue :feature:design:
 :PROPERTIES:
 :SPEC_ID: 3ac0d42c-db1a-4d21-bce4-e63785fef0ba
-:LAST_REVIEWED: 2026-07-13
+:LAST_REVIEWED: 2026-08-23
 :END:
 The panel widget gallery ([[file:docs/prototypes/panel-widget-gallery.html][docs/prototypes/panel-widget-gallery.html]]) grows into a retro-instrument component catalogue: reference photos of period hardware → gallery cards (the visual + behavioral spec) → reusable components for three targets (emacs svg.el, web/React, waybar). Tokens single-sourced in [[file:docs/prototypes/tokens.json][tokens.json]] (gen_tokens.py emits web/waybar/elisp); svg.el proof widget shipped (gallery-widget.el, needle gauge). Reference photos live in [[file:working/retro-stereo-widgets/][working/retro-stereo-widgets/]]. Collection converged at R56, then reopened at R57 as the taxonomy found empty cells (110 cards, all behaviorally verified; probes in [[file:tests/gallery-probes/][tests/gallery-probes/]]).
 
 Build runs per the [[file:docs/specs/2026-07-12-component-generation-spec.org][component-generation spec]] (DOING; reviewed + decomposed 2026-07-12): web extraction first (ungated, lossless), then demand-gated Emacs/waybar ports. Banked variant/composition ledger lives in the 2026-07-11/12 session archive.
+
+*The eight open subtasks are really one decision plus three builds* (noted at the
+2026-08-23 review, because "8 open" reads as more contested than it is). Phase 1
+shipped. Phases 3, 4 and 5 and the spec flip are each gated, directly or
+transitively, on *Phase 2 — the demand inventory*, which is my matrix to write
+and nobody else's. That single artifact has been the whole chain's blocker since
+2026-07-12. The three genuinely independent items are the magic-eye rebuild, the
+wind-direction rose, and weather kit integration.
+
+Weather kit integration may already be unblocked: its note says live panel
+verification "awaits a stowed desktop with a private weather location
+configured", and both daily drivers are stowed now. Check whether
+=$WEATHER_LAT=/=$WEATHER_LON= or =~/.config/weather/config.json= is set before
+treating it as still waiting.
 *** TODO [#B] Rebuild the magic-eye tube component :feature:design:
 Reinstate the magic-eye tuning/level indicator (EM34/EM84/6E5 family), but
 replace the earlier weak UI rather than reviving it unchanged. The component
@@ -1397,14 +1499,6 @@ On dotfiles main (=12e3e76=, pushed). =gather_context= derives an auth cause on
 *** 2026-07-12 Sun @ 09:14:00 -0500 Flipped the net spec to IMPLEMENTED and logged the vNext items
 Spec status heading now IMPLEMENTED (dated history line + Status mirror); all four phase headings DONE. vNext items (flaky/drops cluster, DoT/DNSSEC verdict, profile hygiene) logged as the "Net doctor vNext" task. The privileged-fix live halves remain with the VM live-verification sub-task and the manual-testing checklist — findings there come back as bugs.
 
-** TODO [#B] Consistent keybinding family for the panel console :feature:hyprland:
-:PROPERTIES:
-:LAST_REVIEWED: 2026-07-09
-:END:
-Consider putting every panel (net, bluetooth, audio, timer, and the coming maintenance console) on one consistent chord family — a shared modifier set (Super+Shift, Control+Alt, or similar) plus a mnemonic letter per panel (N/B/A/T/M). Today the panels open via waybar clicks only; a uniform chord family makes them keyboard-reachable and predictable. Watch for collisions with existing binds: Super+Shift+A is already PTT toggle, and the hold-to-talk grave bind is load-bearing. Decide the family, audit current hyprland binds for conflicts, wire via the dotfiles hyprland config, and document in the keybind reference. Both machines (velox can't QMK-remap, so chords must work on a plain laptop keyboard).
-*** 2026-07-14 Tue @ 00:31:36 -0500 Folded Craig's ask for a maintenance-panel keybinding; bumped [#C] → [#B]
-Craig asked (in session, 2026-07-14) for a maintenance keybinding specifically — the panel he's reaching for without one. Maintenance (M) is the priority chord when this task gets worked. The capture graduated the task from parking lot to active backlog.
-
 ** DOING [#B] Run-time privilege model, standard across every panel doctor :feature:dotfiles:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-07-13
@@ -1450,134 +1544,32 @@ ACTION before the kill pass: redo the reference scan to grep all invocation sour
 *** 2026-07-14 Tue @ 01:40:48 -0500 Built the audit evidence report
 Shipped as =docs/2026-07-14-bin-audit-evidence.org= in the dotfiles repo (260752a). 150 scripts bucketed: 69 keep (referenced or cron-driven), 74 kill candidates (zero references in the tree), 7 flagged (all dwm-tier, expected on a hyprland host). Config sweep: audacious and wofi configs are orphan candidates, ranger needs an install-vs-delete call (declared in archsetup but not installed on ratio). Shell history was too shallow (~700 lines) to prove by-hand disuse either way — the kill pass stays Craig's call in the parent task.
 
-** TODO [#B] Waybar network module — custom/net :feature:waybar:network:
+** TODO [#C] net vpn CLI subcommand :feature:network:dotfiles:solo:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-09
+:LAST_REVIEWED: 2026-08-21
 :END:
-Unifies the old wifi-no-internet indicator (was =[#C]=) and the network-manager
-dropdown (was =[#B]=) into one =custom/net= module: a tested Python =net= engine
-(nmcli + diagnostics), a thin bar indicator, and a GTK4 layer-shell panel. Code
-lives in the dotfiles repo (hyprland tier + a =net/= package like pocketbook);
-archsetup only installs deps. Secrets stay in NetworkManager's own store (no
-separate credential store). The =captive= script becomes the diagnostics engine.
-Full design, acceptance criteria, and the failure-mode coverage table:
-[[file:docs/design/2026-06-29-waybar-network-module-spec.org][2026-06-29-waybar-network-module-spec.org]].
-
-Phases below, dependency order. Engine/unit work is agent-verifiable (=unittest=
-+ fakes on PATH, coverage via venv); the live-network and visual states need real
-conditions, filed under "Manual testing and validation".
-
-*** 2026-06-29 Mon @ 20:19:11 -0400 Phase 1 shipped — indicator + console recovery
-Shipped to the dotfiles repo (10 commits, =5254bd8=..=c095a22=, pushed to main).
-The =net= engine is a src-layout Python package in-tree, imported by a bin shim
-that resolves the stow symlink back to the repo — so it runs from a bare TTY with
-no install, which the recovery path depends on.
-
-Landed: =net status= (fast path, one nmcli call + sysfs, degraded fallback in
-budget) + =net probe= (native captive probe, single-flight flock, atomic cache,
-fresh/stale/expired/unknown classes, iface/SSID/UUID invalidation); =waybar-net=
-replacing =custom/netspeed=, throughput → tooltip, CSS states in both themes +
-live; =net diagnose= (read-only steps) + =net repair= (rfkill/reset/bounce/
-dns-test, cleanup-verified) + =net doctor [--fix]= with the four terminal
-classifications; =net portal= + the =captive --probe-json= refactor; redacted
-JSONL event log; Makefile recovery targets (=make online= etc.); =~/.config/net/
-config=. Verified live: =make net-status= reads the real wlp170s0 / @Hyatt_WiFi.
-
-Airplane (Craig's call, option 1): =custom/net= absorbs only the *display* — net
-reads the airplane-mode state file and shows an airplane state/glyph. The
-airplane-mode toggle stays (it's a low-power mode — radios + CPU + brightness +
-services — not a radio switch), now on =custom/net='s right-click + signal 15.
-Deleted: =waybar-airplane=, =waybar-netspeed=, =custom/airplane=, their tests +
-css. =airplane-mode= kept.
-
-Tests: 160 in =tests/net/= (fake nmcli/curl/rfkill/resolvectl/ping/getent/
-systemctl on a temp PATH; doctor-classification fixtures; degraded-under-slow-
-nmcli benchmark) + the =captive= probe-mode tests; full dotfiles suite green (32
-suites). Coverage-gap pass via throwaway venv: pure modules ≥90% branch
-(classify 100%), IO-error branches excused in the test docstring.
-Deferred to Phase 2/3: archsetup deps (gtk4-layer-shell/python-gobject Phase 2,
-speedtest-go-bin Phase 3 — not added before the code that needs them).
-Verify (manual, live): see Manual testing and validation.
-
-*** 2026-06-29 Mon @ 22:19:25 -0400 Phase 2 shipped — panel shell + connection management
-Shipped to dotfiles (commits =4e7740f=..=24bcac5=, pushed). Engine: =net list= (saved
-MRU + in-range wifi scan, infrastructure types filtered), =net up/down= (UUID-keyed,
-mutation safety — keep prior link until target activates, classify wrong-password vs
-generic, report auto-reactivation), =net add/edit/remove/rescan= (open + WPA-PSK;
-enterprise activate-only; secret to NM's store, never our JSON/log — tested).
-
-Panel: a GTK-free PanelModel (selection, four state machines, the UX-flow enable
-rules, terminal states) + a GTK4 gtk4-layer-shell window (=net panel=) anchored
-top-right under the bar — Connections section with MRU list, active marked, signal
-glyph, row-click select, Connect/Add/Forget/Rescan, confirm-on-forget, worker-thread
-engine calls via GLib.idle_add. GTK imported lazily so the CLI/tests stay GTK-free.
-
-Bar interactions (settled with Craig over live iteration): left = =net-panel= toggle,
-middle = =net portal=, right = =net-fix= (notify the doctor result when one-way; open
-a terminal only when the outcome is fixable — the sudo/interactive case). Airplane on
-Super+Shift+A. archsetup adds =gtk4-layer-shell= + =python-gobject= (this commit);
-already on velox.
-
-Tests: 204 in tests/net (merge ordering/dedup, up/down mutation safety, no-secret-leak
-on add/edit, panel model + state machines, gui row-format helpers). Full dotfiles suite
-green (32 suites). Live-verified on velox: panel opens/toggles, list shows real 24
-profiles, right-click notification delivers (Craig confirmed). Phase 3 (diagnose/repair/
-speedtest IN the panel) is next; the engine for it already exists from Phase 1.
-
-*** 2026-06-29 Mon @ 22:43:40 -0400 Phase 3 shipped — diagnostics + speed test in the panel
-Shipped to dotfiles (=91277cf=..=691abcb=) + archsetup (=48052d6=, speedtest-go-bin),
-pushed. Engine: =net speedtest= (parses speedtest-go --json → ping from latency ns,
-down/up from per-server byte rates; missing-backend / offline / malformed → error
-envelope per the failure table). Panel grew a section switcher with four pages:
-- Connections (Phase 2).
-- Diagnose: =net diagnose= on a worker thread, each step a row (✓/✗/… glyph + title +
-  redacted evidence), read-only; Open-portal button when captive.
-- Repair: "Get me online" (=net doctor --fix=) + tiers (rfkill/reset/bounce/dns-test)
-  + force portal. Confirmations in-panel with the spec's exact wording; the privileged
-  tiers run via =net-popup= terminal (where the sudo prompt + step output, incl.
-  cleanup-verified, show) — a panel has no tty, and pkexec would mean a prompt per op.
-- Speed test: in-process =net speedtest= (no privilege → inline result: ↓/↑ Mbps + ping
-  + server), Run/Cancel (Cancel pkills the child), error envelope shown.
-
-213 net tests; pure helpers (step_indicator, format_speedtest) unit-tested. Full
-dotfiles suite green (32 suites). One unverified assumption: speedtest-go's dl/ul unit
-(taken as bytes/s; =BYTES_PER_SEC= flips it) — needs one real run vs a reference. The
-in-panel repair streaming (vs terminal) is a named future polish once the GUI-privilege
-story settles.
-
-The waybar network module ([#B] parent) is now COMPLETE through Phase 3. Phase 4
-(in-app help + user guide) and Phase 5 (VPN/WireGuard) remain as future work; the core
-feature (indicator + recovery + panel + diagnostics + speed test) is done.
-Verify (manual, live): see Manual testing and validation.
-
-*** 2026-07-09 Thu @ 16:32:54 -0500 Audit reconcile: Phase 4 is filed on the dotfiles side, waiting on them
-The dotfiles project accepted the Phase 4 handoff and filed it as a =[#C]= task in their own =todo.org= (their note, 2026-07-08 16:56): the help-text audit + panel help affordance, the user-guide/README, and the ratio rollout doc. Not started there. They ping when it lands, and this task's Phase 4 child closes then. Nothing to do here meanwhile.
-
-*** 2026-08-17 Mon @ 19:57:42 -0700 Landed on the dotfiles side; the block is cleared
-dotfiles shipped it as =138da7b= and closed its own task, so this one closes
-with it and the =:blocked:= tag comes off. Found by checking their =todo.org=
-rather than waiting for the ping — their close-out note says "archsetup pinged
-so its Phase 4 task can close", so the handoff worked and only this end was
-left open.
+=cli.py= in the dotfiles =net/= package has no vpn/tunnel parser, so everything
+the panel can already do with tunnels has no command-line equivalent. Fold the
+panel's existing tunnel operations into a =net vpn ...= surface mirroring what
+the Tunnels sub-view does — bring an overlay up, take it down, report status.
 
-All three acceptance criteria are met on their side: the help audit found and
-fixed a stale =net repair= action list (nine of nineteen actions were named;
-both the CLI help and =repair.py='s docstring now generate from the ACTIONS
-registry), =net/README.md= covers every command plus the recovery targets, and
-the ratio rollout is documented with both daily drivers verified current.
+The operations themselves already exist and are tested: dotfiles =2d9d060=
+probes tailscale / NM-wireguard / Proton, =21db05a= brings overlays up and down
+from the panel, =31ba056= taught diagnose and doctor to understand tunnel
+routes, and archsetup =2e40781= imports wireguard configs. This is a CLI surface
+over shipped behavior, not new capability.
 
-They split the panel help affordance out rather than inventing it — no sibling
-panel has one, so its shape is a design call. It is tracked on their side, not
-here.
+Graded [#C] rather than [#B]: the panel already does the job, so this is
+convenience rather than a gap. It earns a bump if I find myself wanting tunnel
+control from a bare TTY — which is the same recovery-path argument that made the
+rest of =net= worth having as a CLI.
 
-Original deliverable, for the record: in-app help (=net --help= + per-command,
-panel help affordance); README/user-guide; archsetup Hyprland dep install
-(=gtk4-layer-shell=, =python-gobject=, =speedtest-go-bin=); ratio manual dep +
-stow step. Handed off 2026-07-04 with the archsetup deps already confirmed
-installed.
+=:solo:= — the subcommand shape is obvious (it mirrors the panel), the =net=
+package's fake-based harness covers the build and verify path, and archsetup owns
+the dotfiles work end to end. Not =:quick:=: every prior net phase landed with
+twenty-odd new tests and a review pass, so this runs past a spare moment.
 
-*** TODO Phase 5 — VPN / WireGuard CLI fold (vNext) :network:
-Rescoped 2026-07-04 (audit): the tunnels track already shipped most of the original Phase 5. Panel tunnel bring-up/down and detection landed (dotfiles 2d9d060 probes tailscale/NM-wireguard/Proton; 21db05a brings overlays up/down from the panel's Tunnels sub-view; 31ba056 diagnose/doctor understand tunnel routes; archsetup 2e40781 wireguard config import; the net-panel-other-interfaces spec is IMPLEMENTED). What remains for Phase 5 is only the =net vpn ...= CLI subcommand — cli.py still has no vpn/tunnel parser. Fold the panel's existing tunnel operations into a CLI surface; spec separately when picked up.
+Carved out of the =custom/net= umbrella when that closed on 2026-08-21.
 
 ** TODO [#B] Local offline LLM runtime + per-host model cache :tooling:llm:
 :PROPERTIES:
@@ -1702,9 +1694,9 @@ Need to investigate proper machine-ID regeneration that doesn't break networking
 Would enable parallel test execution in CI/CD
 Priority C because snapshot-based testing meets current needs
 
-** TODO [#B] Review undeclared ratio packages for installer inclusion :chore:
+** TODO [#C] Review undeclared ratio packages for installer inclusion :chore:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-09
+:LAST_REVIEWED: 2026-08-21
 :END:
 Triggered by the 2026-06-14 =make package-diff= run on ratio: 62 packages are installed but not declared in archsetup. Stripped of the structural buckets — pacstrap base/boot/kernel (base, linux*, grub, efibootmgr, sudo, btrfs-progs, fwupd, logrotate, ex-vi-compat, linux-lts-strix, zram-generator), the =make deps= VM set (qemu-full, virt-manager, virt-viewer, libguestfs, bridge-utils, dnsmasq, archiso), and the yay bootstrap — these 40 remain. Check the ones to add to the installer, then rerun =make package-diff= to confirm they clear.
 
@@ -1753,6 +1745,30 @@ Some entries are libraries likely pulled in as dependencies (blas-openblas, open
 - [ ] webkit2gtk
 - [ ] whisper.cpp
 
+*** 2026-08-21 Fri @ 14:28:18 -0700 Dropped to [#C], and the sharper measurement is on velox now
+Re-graded [#B] → [#C]. Not a change of mind about the value — nothing has been
+ticked since I filed it on 2026-06-14, across two full cycles, and by my own
+scheme [#B] means "this cycle" while [#C] is the parking lot. The grade should
+say where it actually sits.
+
+The premise also moved. This list measures ratio, which carries years of
+accumulated manual installs tangled up with whatever archsetup put there, so a
+package being undeclared says little about whether it matters. Velox is the
+better instrument now: rebuilt from archsetup on 2026-08-13 and working, so a
+=make package-diff= there compares what the installer declares against what a
+machine actually needs, with only days of drift on top. Re-run it on velox
+before walking these forty by hand.
+
+Worth noting the empirical result already came in. The gaps that actually hurt
+after that rebuild — rulesets never cloned, the .emacs.d systemd units never
+linked, the missing =*.local.*= configs — surfaced on their own, and not one of
+them is on this list. That is evidence about what this kind of list catches.
+
+Related but distinct: =[#B] Installed-package drift audit= below builds the tool
+for the opposite direction (declared but missing, and provider substitutions).
+If that lands first it plausibly subsumes the detection half of this one, leaving
+only the include/ignore judgment.
+
 ** TODO [#B] Installed-package drift audit :chore:packages:solo:
 :PROPERTIES:
 :LAST_REVIEWED: 2026-08-02
@@ -1859,14 +1875,227 @@ each on the live machine rather than reading the list back:
 The suspend work itself is untouched — no kernel parameter, no drain
 measurement. Only the riders moved.
 
+** TODO [#A] Port Hyprland config to Lua before 0.57 drops .conf support :hyprland:dotfiles:
+:PROPERTIES:
+:LAST_REVIEWED: 2026-08-24
+:END:
+Hyprland prints "You are using the .conf config format, support for which will be
+removed in Hyprland 0.57" at every start. Installed and in =extra= is 0.56.2-1, so
+the *next* release breaks the config. Craig's call 2026-08-24: port now, under no
+time pressure, rather than pin the package or wait for the upgrade to force it.
+
+STATE (2026-08-24): built and verified in a nested compositor, *not deployed*.
+I deployed it to the dotfiles tree this afternoon and rolled it back the same
+hour on Craig's call — the switch had not been checked on real hardware and the
+machine has to stay usable. The dotfiles repo is untouched at =8f692f5= and the
+live config is the original =hyprland.conf=; =hyprctl reload= after the rollback
+returned zero configerrors and the velox host override is applied
+(=xwayland:force_zero_scaling= false), so the per-host chain is intact.
+
+Everything needed to redeploy is in =working/hyprland-lua-port/= with a README
+carrying the step-by-step: the three =.lua= deliverables, plus the two reader
+changes saved as patches (=reader-changes-for-lua.patch= for dotfiles'
+=dotfiles-validate= and three test suites, =test-desktop-for-lua.patch= for
+archsetup's post-install checks). Both patches were verified to apply clean
+against their repos, and every assertion in them was mutation-tested — each one
+confirmed to go red when the property it guards is removed. Replay them rather
+than rewriting the assertions.
+
+Also settled along the way: =themes/dupre/hyprland.conf= is dead. Nothing sources
+it, no apply script exists, and it has silently drifted from the live config
+(=dab53dff= / =2c2f32ff= against =daa520ff= / =444444ff=). It needs no porting.
+
+HOW IT WAS BUILT. =hyprlang2lua= (github.com/EIonTusk/hyprlang2lua, AUR 0.7.1-1)
+converts hyprlang to the 0.55+ Lua format and preserves comments. Built from
+source into a scratchpad with the local Go rather than installing the AUR package
+— one dependency, and no PKGBUILD executed. Run with =--no-merge=, which emits
+each config section as its own =hl.config()= call at its original position; the
+default merges them into one hoisted call, which both scrambles comment placement
+and puts the =conf.d= source glob BEFORE the config it must override.
+
+THREE DEFECTS THE CONVERTER INTRODUCED, all fixed by hand:
+1. Source glob emitted before the merged config block, silently reversing every
+   per-host override — including velox's =force_zero_scaling = false=, which is
+   the 2026-08-19 Qt scaling fix. =--no-merge= plus moving the glob to the last
+   line fixes it.
+2. =bind = CTRL $mod, S= became ="CTRL" .. mod .. " + S"= → ="CTRLSUPER + S"=;
+   same for =CTRL ALT $mod, K=. Proven fatal, not merely odd: Hyprland answers
+   =hl.bind: failed to parse key string: Unknown keysym: "CTRLSUPER"=. Two dead
+   keybinds.
+3. Super+RETURN is an =exec= of a shell pipeline; the converter pattern-matched
+   the =hyprctl dispatch layoutmsg= prefix and swallowed =&& sleep 0.05 && ...=
+   as the layoutmsg argument. That sleep is the one proven load-bearing 19/19.
+
+Also rebuilt the autostart section: the generator hoists every =exec-once= into
+one block at the end and leaves the comments stranded where the commands were.
+Each command now sits under its own comment again via =at_start= / =at_shutdown=
+/ =at_reload= collectors that the =hl.on()= handlers at the bottom replay.
+
+VERIFIED by running both configs in a nested Hyprland on a headless output and
+diffing runtime state, not by reading: 38 config keys identical (only type
+*rendering* differs — =bool: true= where hyprlang prints =int: 1=);
+=xwayland:force_zero_scaling= false on both sides, so the host override still
+wins; 103 binds registered on both sides with 100 of 103 matching exactly;
+autostart list byte-identical to the 16 =exec-once= lines in order; zero
+=configerrors=; and no ERR/WARN line in the ported run that is absent from the
+original run.
+
+KNOWN DELTA — the three =bindm= binds. hyprlang reports =mouse: true=, the Lua
+path reports =mouse: false=, and the raw bind struct confirms the flag is unset
+rather than merely unreported. Not a transcription error: the wiki documents
+exactly the spelling used (=hl.bind("ALT + mouse:272", hl.dsp.window.drag(),
+{ mouse = true })=), and all four candidate spellings were tested — none sets it.
+Reads as a gap in 0.56.2's Lua config manager. Kept the documented spelling: it
+is correct upstream, harmless now, and starts working when the gap closes. Per
+the wiki that flag is what makes the action fire *while held*, so Super+drag to
+move a window may fire once instead of tracking. Settle it in five seconds after
+switching; worth an upstream report if it survives 0.57.
+
+WHAT REMAINS:
+1. *Craig decides when to switch.* The port is ready to go in; it has not been
+   run on real hardware. The gate is the "Hyprland Lua config" test under Manual
+   testing and validation, which is written to be run right after the switch.
+2. *Four review gates travel with the redeploy*, all written up in that README:
+   exclude any in-repo =retired/= dir from =dotfiles-validate= (its find globs
+   across slashes and would validate the dead config); add tests for the new
+   =dotfiles-validate= Lua branch (25 lines, currently zero coverage — proven
+   vacuous, since stubbing both regexes to =NEVERMATCHES= still passes 15 tests);
+   guard that =hl_source_glob= stays the last statement (the one invariant the
+   per-host layer rests on, and archsetup's VM cannot catch it); and sweep the
+   ~15 prose comments still naming =hyprland.conf=, of which
+   =waybar-reserve:12= is the load-bearing one.
+3. *Redeploy per =working/hyprland-lua-port/README.org=*, which carries the eight
+   steps and the two traps that bit on 2026-08-24: =make restow hyprland= aborts
+   on the pre-existing =obsbot-wb-guard.service= conflict in =common= (restow
+   =hyprland= and the host package individually), and the running Hyprland
+   rewrites a stub =hyprland.conf= within a second of the symlink vanishing
+   (silence it with =hyprctl keyword misc:disable_autoreload 1=, stow, set back
+   to 0).
+4. *Push dotfiles before committing archsetup.* One-directional and load-bearing:
+   archsetup's post-install suite asserts =~/.config/hypr/hyprland.lua= and the
+   installer clones the dotfiles *remote* (=archsetup:1481=), so a local commit is
+   not enough. Confirm with =git ls-tree -r origin/main --name-only | grep
+   hypr/hyprland.lua=.
+5. *Do not leave the =.conf= beside the =.lua= as a rollback.* With both present
+   Hyprland 0.56.2 loads the =.lua= — proven in a nested instance with a fixture
+   whose =.conf= set =gaps_in=11= and =.lua= set =77=; the result was 77. A
+   =.conf= left in place buys nothing and only obscures which file is live. Move
+   it out of the stow package instead.
+6. *=bindm='s missing =mouse= flag is worth an upstream report* if it survives
+   0.57. Documented spelling, four variants tested, flag never set.
+
 ** TODO [#B] Manual testing and validation :test:
 :PROPERTIES:
-:LAST_REVIEWED: 2026-07-09
+:LAST_REVIEWED: 2026-08-23
 :END:
-Craig's standing checklist of everything that isn't agent-verifiable. Each child is one test in the =verification.md= shape (title, what we're verifying, steps, Expected). A child that fails gets its actual behavior written under it and is promoted to a top-level TODO. 44 checks pending as of the 2026-07-09 audit.
+Craig's standing checklist of everything that isn't agent-verifiable. Each child is one test in the =verification.md= shape (title, what we're verifying, steps, Expected). A child that fails gets its actual behavior written under it and is promoted to a top-level TODO. 62 checks pending as of the 2026-08-23 review — up from 44 at the 2026-07-09 audit, so the queue has gained 18 in six weeks and nothing has drained it. A checklist that only grows is on its way to being where tests get filed rather than run; if the next review finds it higher again, the container needs a scheduled sweep rather than another re-stamp.
 
 Priority and type tag added by that audit: the task carried neither, which kept the project's largest live container out of the agenda entirely.
 
+*** Hyprland Lua config: does the real desktop come up, and does Super+drag track?
+What we're verifying: that the Lua port drives a real Hyprland session the way
+the .conf did, and specifically whether the one known delta — the three =bindm=
+binds losing their =mouse= flag — actually costs anything. A nested compositor
+proved 38 config keys, 103 binds and the host-override chain identical, but it
+cannot test real input devices or a real DRM display.
+
+PRECONDITION: run this *only after* redeploying the port per
+=working/hyprland-lua-port/README.org=. As of 2026-08-24 the port is rolled back
+and the live config is the original =hyprland.conf=, so running this now just
+confirms the old config — which is not what it is for. Run it on velox; the stub
+check in the last block is velox-specific.
+- Restart Hyprland (log out and back in, or =hyprctl dispatch exit= from a TTY).
+- Confirm the desktop comes up: waybar present and not off-screen, wallpaper
+  restored, dunst notifications working.
+#+begin_src sh :results output
+# Which config did it actually load, and did anything fail to parse? The log is
+# per-instance under the runtime dir, not in ~/.local/share. Resolve the newest
+# instance dir rather than reading $HYPRLAND_INSTANCE_SIGNATURE: Emacs runs as a
+# daemon that survives the logout in step 1, so a block run from it can still be
+# carrying the PREVIOUS session's signature. That path is gone after the restart,
+# grep prints nothing, and an empty result under "Expected: names hyprland.lua"
+# reads as "the port failed" when it in fact succeeded -- the worst possible
+# wrong answer at exactly the wrong moment.
+log="$(\ls -td "$XDG_RUNTIME_DIR"/hypr/*/ | head -1)hyprland.log"
+echo "reading: $log"
+grep -iE '\[cfg\].*(lua|legacy)' "$log" | tail -3
+hyprctl configerrors
+#+end_src
+Expected: the log names hyprland.lua, and configerrors is empty.
+- Hold Super and drag a window with the left mouse button.
+Expected: the window tracks the pointer continuously while Super is held. If it
+jumps once and stops, the =bindm= =mouse= flag gap is real and costs the drag —
+write that here, promote to a top-level TODO, and report upstream.
+- Hold Super and drag with the right mouse button (resize), same check.
+- Walk the keymap: the launcher, terminal, browser, screenshot chords, the panel
+  family (Super+Shift+B for bluetooth), workspace switching, layout cycling.
+Expected: every chord does what it did before the port.
+#+begin_src sh :results output
+# The stub .conf should stay gone now that Hyprland started from the .lua.
+# Refuse to touch a symlink: on a host that has not been through this port yet,
+# ~/.config/hypr/hyprland.conf is still the stow link to the real config, and
+# deleting it would report "stays gone" as a pass while having broken the desktop.
+f=~/.config/hypr/hyprland.conf
+if [ -L "$f" ]; then
+    echo "REFUSING: $f is a symlink (a live stowed config), not the stub."
+elif [ -f "$f" ]; then
+    rm -f "$f"; sleep 2
+    [ -e "$f" ] && echo "REGENERATED — still stubbing" || echo "stays gone"
+else
+    echo "already absent — nothing to do"
+fi
+#+end_src
+Expected: "stays gone". If it regenerates, Hyprland is still resolving its config
+to the .conf path and the port is not actually live — stop and investigate.
+
+*** Lock screen after a real sleep: is the clock frozen, or is all of hyprlock frozen?
+What we're verifying: which of two very different faults produces the stale
+lock-screen clock Craig sees after waking the machine. Three isolated tests on
+2026-08-24 all failed to reproduce it — hyprlock v0.9.6 repainted correctly
+within one second of a display power-cycle, of a three-minute SIGSTOP, and of
+both together with the =path = screenshot= background. So the cause needs a real
+suspend on real AMD hardware, which only Craig can run.
+
+The distinguishing question is whether *anything* on the lock screen is alive.
+A frozen clock with live input is a rendering bug in the clock. A frozen clock
+with dead input means hyprlock is hung and the compositor is simply holding its
+last pre-suspend frame — a different bug, in the crash/hang recovery layer.
+
+Run this the next time the machine has actually slept (30 min idle, or a lid
+close), not on a screen you just locked by hand.
+
+- Wake the machine and do NOT type your password yet.
+- Read the clock. Note the time it shows and the real time.
+- Type one character into the password field.
+Expected (record which): either the dots appear normally — input is alive, only
+the clock is stale — or nothing appears at all, in which case hyprlock is hung.
+- Keep watching for a full 90 seconds without touching anything else.
+Expected (record which): the clock corrects itself to the current time within a
+minute, or it never changes at all.
+- Note whether the blurred background looks like your desktop or like a
+  previous lock screen (a lock screen photographed behind a lock screen means a
+  second hyprlock was started on top of the first).
+
+Expected: enough to pick one of three — stale-then-corrects (a repaint-interval
+fix), frozen-with-live-input (a rendering fix), or frozen-with-dead-input
+(hyprlock hung; the =screen-lock= watchdog only catches a hyprlock that
+*exits*, and its own header says it is blind to one that hangs).
+
+*** Lock keybind has no crash or hang recovery
+What we're verifying: that a hand-lock is as recoverable as an idle lock.
+=hyprland.conf:495= is =bind = $mod, ESCAPE, exec, hyprlock=, which runs the
+binary directly. hypridle's =lock_cmd= routes through =screen-lock=, which
+relaunches a hyprlock that exits non-zero; the keybind bypasses that entirely.
+=~/.local/var/log/screen-lock.log= does not exist on velox, so the watchdog has
+never recorded a relaunch — consistent with it rarely being in the path at all.
+
+- Lock with Super+Escape.
+- From another tty (ctrl+alt+F3), log in and run: =pkill -x hyprlock=
+- Return to the graphical tty.
+Expected: with the keybind as written, the session is left locked with no client
+and Hyprland draws its "lockscreen app died" screen. If instead a fresh password
+prompt appears, something is already relaunching it and the gap is closed.
+
 *** Clock/DNS deadlock: does the next abrupt power loss strand velox again?
 What we're verifying: that the machine survives an RTC reset unattended. Not the
 coin cell, which is new with the 2026-08-13 mainboard and is ruled out. The RTC
@@ -2953,50 +3182,6 @@ carry a date and Craig's return date isn't known yet — date it and raise it to
 Workaround in the meantime: Bluetooth mouse, already in use.
 
 
-** DONE [#B] Installer GRUB_CMDLINE overwrite drops boot params :bug:solo:
-CLOSED: [2026-07-21 Tue]
-Fixed in f9da097: update_grub_cmdline merges the current value with archsetup's tokens (existing tokens survive, same-key conflicts resolve to archsetup's value) behind a refuse-to-write safety check, via awk + mv with a backup_system_file first. TDD via tests/installer-steps/test_grub_cmdline.py (8 cases incl. cryptdevice/resume/zfs survival and idempotence).
-Grading: Critical severity (unbootable) x some-users-sometimes (machines whose base install set a cryptdevice=/resume=/zfs= cmdline param) = P2 = [#B].
-archsetup:3054 rewrites the whole GRUB_CMDLINE_LINUX_DEFAULT line with a fixed string; nothing re-adds a pre-existing cryptdevice/resume/zfs token, so grub-mkconfig (3059) can bake an unbootable config. Fix: read the current value and append only the missing tokens; assert any pre-existing boot-critical token survives before grub-mkconfig. See [[file:docs/design/2026-07-19-sentry-code-findings.org][sentry code findings]] (S3).
-** DONE [#C] Maint status wall copy buttons :feature:maint:dotfiles:
-CLOSED: [2026-07-21 Tue]
-Shipped in dotfiles 8bc79ba per Craig's calls (one global button, rendered text): COPY on the doctor row serializes every category band via the same card_spec the GUI renders, through panelkit clipboard. TDD tests/maint/test_status_copy.py, full dotfiles make test green, inbox note sent. Live check pending: open the maint panel, press COPY, paste.
-Craig's roam capture 2026-07-20, routed via .emacs.d sentry inbox-zero as archsetup-owned UI work. Dotfiles maint panel work; archsetup drives it end-to-end per the standing rule.
-** DONE [#B] Build: desktop-settings panel :feature:hyprland:dotfiles:
-CLOSED: [2026-07-22 Wed]
-:PROPERTIES:
-:SPEC_ID: d6bb1e73-ec90-4327-85ee-bfa762da5bce
-:END:
-The GTK build of the desktop-settings panel per the spec (docs/specs/2026-07-02-desktop-settings-panel-spec.org, DOING; normative reference: prototype 37). Work happens in dotfiles settings/ — archsetup drives the lifecycle. Two non-blocking build-time picks live in the spec's Review findings (wallpaper setter tool; store location/format) — decide in phase 1 and record there.
-*** 2026-07-22 Wed @ 13:14:01 -0500 Built the backings engine (phase 1) — dotfiles 7a15237
-Landed as dotfiles settings/src/settings (10 modules) + tests/settings (118 tests against fake binaries, auto-discovered by make test — 81 suites green). Covers brightness/kbd (5% floor, x10 drum), toggles (dim, pointer cycle via toggle-touchpad, caffeine), DND class-split (dunst pause level 60, close-all before unpause, alarms punch through live), powerprofilesctl, nightlight (resident gammastep), hypridle.conf renderer + symlink-safe write + caffeine-respecting reload + hyprlock grace, suntimes (pure NOAA math), and the wallpaper engine (awww/mpvpaper/projector adapters, galleries, random draw, atomic JSON store). All three build-time picks recorded as DONE findings in the spec (setter=awww, store=state.json, nightlight=gammastep). Handoff note in ~/.dotfiles/inbox/.
-*** 2026-07-22 Wed @ 15:26:44 -0500 Built the presenters (phase 2) — dotfiles 5172289
-Three GTK-free models per prototype 37, all at 100% line coverage (tests/settings/test_presenters.py, 100 tests; full repo suite green before and after). programs.py: the matrix — eight complete programs (Craig's four factory scenes drafted here per the pre-flight pick, slots 1-4 first-class), pin rows + power radio row, activate returns the full sets, member writes return apply/updated with active-is-live surviving. bench.py: drum mapping (screen never reads 0, floor 5%; kbd floors at 0), idle rail order clamping between enabled neighbors, park/unpark with re-clamp, caffeine bypass, view-state builder tolerant of no-backlight None. channels.py: the eight-channel bank, per-mode sources visibility, alpha/recency sort (unlabeled last), the shared mint/edit/delete grammar for pairs/sets/colors (press arm-cycle, two-picture set minimum, dup rejection, selection clamping), sources guardrails, interval wheel, previews. Handoff note in ~/.dotfiles/inbox/.
-*** 2026-07-22 Wed @ 16:03:52 -0500 Ported prototype 37's instruments to GTK (phase 3) — dotfiles 33d82eb
-The panel renders P37 end to end. New instruments.py carries the three Cairo instruments as clock-free humble objects: ProgramMatrix (glyph/numbered heads over jewel pins + CPU POWER paper letter wheels), DrumRoller (paper drums, drag-to-set, dimmed n/a on no-backlight machines), TripDial (sqrt 300° scale, colored stage tabs, OFF-notch parking, exact-minutes drag counter, BYPASSED · CAFFEINE stamp, bottom legend). gui.py rebuilt to P37's layout with the wallpaper sub-view: channel bank with drawn faces, minted pair/color/set trays (alpha/time sort, edit/delete chip feet), the three presses (pair arm-cycle, color picker, set press + interval wheel), sources with a folder picker. New GTK-free glue all unit-tested (test_panel_glue.py, 33 tests): dial geometry in bench, matrix/idle/wallpaper wiring in panel, presenter-vocabulary channels (pair/solid/random-from-set) in wallpaper.apply. AT-SPI smoke (make test-panel-settings) drives the real wiring against faked backings + a sandboxed store, pinned to its own child pid so it can never fire a live panel's backings. Visually verified on a headless output against P37 captures (main + pair/single/solid/random). Adaptations recorded in the handoff: five-stage dial (WATCH gets its own green — the engine runs watch separately, P37 merged the label), DESKTOP_SETTINGS_START_VIEW test seam. Full suite 84 suites green; window rule widened for the 540px panel. Handoff note in ~/.dotfiles/inbox/.
-*** 2026-07-22 Wed @ 16:47:54 -0500 Integrated phase 4 — dotfiles 680b50d
-Bar consolidation had landed early (74f723e); this pass shipped the rest. settings-project hosts the watch/clock/world channels as HTML faces (settings/faces/) on a gtk-layer-shell background window over WebKit2 — all three visually verified on a headless output, world reading the waybar worldclock roster via query param. settings-watch is the hypridle watch-stage host: throwaway-profile chrome kiosk that reveals only after its window maps behind the lock and relocks before teardown — a failed face degrades to the plain lock, never a bare desktop (unlocked lifecycle verified live; the locked swap goes to the manual checklist). Sun-pair location reads whereami live per transition with last-good cache in state.json (verified live: 9.5s first beat, New Orleans coords, Gogh day side applied); desktop-settings-tick.timer (2 min, enabled on ratio, added to the installer) drives flips and random draws — 23ms no-op beats. dunstrc history_length 100 protects held alarms (full DND cycle verified against live dunst; wtimer alarms already CRITICAL via the notify wrapper, no promotion rule needed). Live hypridle rewrite verified — five-stage regime rendered through the stow symlink, caffeine respected (found engaged, daemon correctly left stopped). Refresh signals needed no rewiring (touchpad signals itself via toggle-touchpad). 45 new tests; suite 84 suites green; smoke 13/13. Handoff note in ~/.dotfiles/inbox/.
-Velox one-time steps (sync doesn't carry): mpvpaper (AUR), optionally power-profiles-daemon (service off), and systemctl --user enable --now desktop-settings-tick.timer.
-*** 2026-07-22 Wed @ 17:05:58 -0500 Landed the 17-point end-to-end pass — dotfiles 9038eee
-Prototype 37's 17-point suite re-derived against the real panel (the original Playwright script wasn't preserved; the functional surface in the spec's Final prototype section is the source). tests/settings/panel_e2e.py + run-panel-e2e.sh + =make test-panel-e2e=: points 1-14 drive the running panel over AT-SPI (program recall with per-backing verification across FOCUS/BATTERY/slot1, pointer console keys, all eight wallpaper channels including projected watch/world stop/start ordering, close); points 15-17 cover the Cairo instruments (drums, tripper dial clamp/park/render/reload, matrix pins + letter wheels with active-is-live) at the backing layer, since AT-SPI can't reach a DrawingArea's hit-tests. Same safety posture as the smoke: sandboxed store, faked backings, pid-pinned a11y node. 17/17 green on ratio's live compositor; full suite 85 green; smoke 13/13; ruff clean. The drag gestures go to the manual checklist below. Handoff note in ~/.dotfiles/inbox/.
-*** 2026-07-22 Wed @ 17:05:58 -0500 Flipped the spec to IMPLEMENTED
-docs/specs/2026-07-02-desktop-settings-panel-spec.org DOING → IMPLEMENTED with a dated history line naming the shipping commits (dotfiles 7a15237 / 74f723e / 5172289 / 33d82eb / 680b50d / 9038eee) and the verification evidence (85 suites, smoke 13/13, e2e 17/17). The four panel drag-gesture checks and the locked-path night-watch swap live under "Manual testing and validation" — human-eye checks, not implementation blockers.
-** CANCELLED [#B] Hyprland layoutmsg crash — bad_variant_access (upstream) :bug:hyprland:
-CLOSED: [2026-07-21 Tue]
-Dropped 2026-07-21 (Craig's call) — not tracking the upstream report. The crash evidence (both reports + tmpfs log excerpts) and the voice-passed issue draft stay preserved in [[file:working/hyprland-layoutmsg-crash/][working/hyprland-layoutmsg-crash/]] if it recurs and is worth reviving.
-Grading: Critical severity (SIGSEGV kills the whole desktop session; every GUI app's unsaved state lost) x rare edge case (twice in ~4.5 months: 2026-03-07 on v0.54.1, 2026-07-20 on v0.55.4) = P2 = [#B]. Upstream Hyprland bug, not this repo's code — the task tracks reporting it and picking up the fix.
-A layoutmsg mfact dispatch (layout-resize, mod+H/L) throws std::bad_variant_access inside Layout::CAlgorithm::layoutMsg, uncaught, SIGSEGV. Both crashes fired from the layout-resize mfact path (keycode 104 shrink today, 108 grow in March). Layout at crash was master and the identical mfact had worked seconds earlier; the pre-crash window held monocle<->master toggles, two window closes dropping focus to "[Window nullptr]", and togglefloating x2. Monocle is a registered v0.55 layout (log shows graceful "Unknown monocle layoutmsg" rejects), so the config is not at fault; related edges are guarded ("mfact -> no window") while this path misses its variant guard. Repo has no newer build (0.55.4-1 installed and repo).
-Evidence preserved in [[file:working/hyprland-layoutmsg-crash/][working/hyprland-layoutmsg-crash/]] (both crash reports + excerpts from the tmpfs session log, extracted before reboot loses it).
-Next: Craig posts the issue himself (2026-07-20 decision) — the voice-passed draft is [[file:working/hyprland-layoutmsg-crash/issue-draft.md][issue-draft.md]], with both crash reports and the log excerpts beside it for attaching. Watch the repo for a fixed release and close on confirmation. The layout-resize script guard was declined (a script can't observe the internal desync).
-** DONE [#C] WireGuard import is now config-less — decide feature fate :feature:network:
-CLOSED: [2026-07-21 Tue]
-Decided 2026-07-21 (Craig): KEEP the import feature. The out-of-band flow is already in place — =assets/wireguard-config/= carries a README documenting "drop plaintext =*.conf= locally at install time (gitignored); ship encrypted =*.conf.gpg= to track", and its =.gitignore= enforces it (=*.conf= blocked, =!*.conf.gpg= allowed). The script also already no-ops gracefully on an empty dir (=shopt -s nullglob= + a =found= flag), so nothing ships and nothing errors when no configs are present. Nothing to build; the fate decision was the whole task.
-scripts/import-wireguard-configs.sh reads assets/wireguard-config/*.conf, but no configs ship in the repo anymore (removed as a public-leak fix; .gitignore blocks plaintext).
-** DONE [#C] Dupre theme waybar.css drifted from live style.css :bug:dotfiles:waybar:
-CLOSED: [2026-07-21 Tue]
-Fixed in dotfiles 3e4e7ff (2026-07-20, "fix(theme): sync dupre waybar.css with the live weather rules") — dupre/waybar.css is byte-identical to live again, restoring the =#custom-weather= selectors/hover/gold divider, so =tests/theme-css= is green.
-Grading: Minor severity (cosmetic, reverts only on a theme switch) × rare edge case (dupre is already the active theme) = P4 = [#D] on user impact, bumped to [#C] because the dotfiles =make test= stays RED until synced, poisoning the green baseline for every future commit.
-The weather-kit work added =#custom-weather= selectors to =hyprland/.config/waybar/style.css= but never mirrored them into =hyprland/.config/themes/dupre/waybar.css=. =tests/theme-css= asserts the two files are identical (set-theme copies the theme file over the live one), so switching to dupre would silently revert the weather chip styling. Fix: sync the theme file to live. Pre-existing; found 2026-07-19 during an unrelated commit's green-baseline run.
 ** DONE [#A] Hyprlock lockout: AMD-iGPU DPMS invalidates the lock, session wedges :bug:hyprland:installer:solo:
 CLOSED: [2026-07-24 Fri]
 :PROPERTIES:
@@ -3572,47 +3757,6 @@ CLOSED: [2026-07-24 Fri]
 From the roam inbox (Craig, claimed 2026-07-22): the waybar PTT icon should not have an outline. Cosmetic × every-glance = P3 = [#C].
 
 Shipped as dotfiles =e63c0cf= (live style.css + dupre theme source). Removed the amber/green text-shadow glow from the armed/talk states, the only outline-like effect on the icon. FLAGGED FOR CRAIG: this is my read of "outline" (the glow). If you meant the glyph shape itself, it's a one-line revert. Confirm live by pressing PTT.
-** DONE [#B] Dotfiles tests leak state across files :bug:test:dotfiles:solo:
-CLOSED: [2026-07-23 Thu]
-Resolved 2026-07-23 as dotfiles =c333598=. The polluter was =tests/weather/test_weather.py=, and it accounted for all 38 failures on its own.
-
-The mechanism was not the env leak the body below guessed at — tests/weather never writes =os.environ=. Its whereami fake did =weather.subprocess.run = ...= on a freshly-loaded module object. The fresh module isolated the weather code, but =weather.subprocess= is the one shared stdlib module object every module in the process holds, so the assignment replaced =subprocess.run= process-wide and never restored it. Every later test file got weather's fake result back from =subprocess.run=; the tell was wtimer asserting on =r.returncode= and getting "'R' object has no attribute 'returncode'", where =R= is weather's fake result class.
-
-Triage: TEST HYGIENE, not production global state. The weather script reads env at import and never writes, so no long-lived-process caching defect sits behind it. A scan for the same pattern (patching a stdlib module attribute reached through another module's namespace) finds exactly one instance in the suite — the three other =setattr= sites all snapshot and restore. So the planned shared env helper across 28 files was aimed at the wrong target and wasn't needed.
-
-Fix: rebind the loaded module's own =subprocess= name to a stub namespace, so nothing outside that module changes and there is nothing to restore.
-
-Gate: =make test= now runs two gates per the add-don't-replace decision — =test-forked= (one process per file, catches order dependence) and the new =test-shared= (every suite in one process, catches leakage). Built on stdlib unittest rather than pytest, since pytest was only the diagnostic tool and isn't a project dependency. Verified as a real gate, not just green today: with the defect deliberately reintroduced it goes red, and green once restored. A focused test in tests/weather pins the invariant on the culprit as well, because the shared gate alone blames the three victim files.
-
-Verification: 3500 tests, both gates, exit 0.
-
-Original finding follows.
-
-Found 2026-07-23 during the speedrun. =make test= is green, but it runs each test file in its own =python3 -m unittest= process, which hides cross-file state leakage. A single-process whole-tree run (=python3 -m pytest tests/ -p no:randomly=) fails 38: 22 in =tests/wtimer/test_wtimer.py=, 10 in =tests/zoom-web/test_zoom_web.py=, 6 in =tests/wlogout-menu/test_wlogout_menu.py=.
-
-Not a regression — a worktree at the pre-speedrun commit produces the identical 22/10/6 profile, so this predates tonight's work. Those three files also pass cleanly when run together (170 passed), so the polluter is a fourth file somewhere in the tree that mutates global state (env var, cwd, or a module-level patch) without restoring it. 28 test files write =os.environ= directly.
-
-Why it matters: the green gate can't see this class of bug, so a real isolation defect — or a genuine failure that only appears under a different order — passes CI silently. Bisect by running the tree with subsets until the polluter is identified (pytest's =-p no:randomly= keeps the order stable while bisecting), fix its cleanup, then decide whether =make test= should gain a single-process pass so the gate covers it.
-** DONE [#B] Wallpaper view freezes the panel — thumbnail decode :bug:dotfiles:solo:
-CLOSED: [2026-07-23 Thu]
-Craig reported 2026-07-23: selecting the wallpaper button freezes the module and the compositor asks whether to kill it. Root cause proven: =_Thumb._draw= decoded each source image with =new_from_file_at_scale= on the GTK main thread. Measured on Craig's 78 wallpapers — a viewport of the 8 largest takes 3.7s, the whole set 13s. That block trips Hyprland's "not responding" watchdog.
-
-Grading: Critical severity (panel unusable, watchdog kill) × every user every time the wallpaper view opens = P1 = [#A] by the matrix. Held at [#B] because step 1 already shipped and removes the user-visible freeze; the remainder is a latency enhancement, not a showstopper.
-
-*** 2026-07-23 Thu @ 15:40 Step 1 — async decode (dotfiles f45f321)
-Moved the decode to a worker thread via a new =settings/thumbcache.py= (pure, injected decode/scheduler/thread; 6 tests). The thumb shows its dark ground until the pixbuf lands, then redraws. Verified live on a headless output: worst main-loop stall opening the pair view dropped from multi-second to 68ms; the cache filled with 81 decoded pixbufs (the one miss is a .webm, correctly falling back to the ▶ glyph). Full suite 3512, both gates, smoke OK. This alone fixes the reported freeze.
-
-*** 2026-07-23 Thu @ 16:30 Step 2 — persistent on-disk cache (dotfiles 463cc4f)
-Built the persistent layer: =settings/thumbstore.py= decodes each source once to a 512px PNG under =~/.cache/settings/thumbs=, keyed by path + mtime so an edited wallpaper self-invalidates. The hot-path decode reads that PNG and scales in-memory. Warming rides the existing =settings tick= CLI verb (the 2-min timer already runs it), building up to =WARM_PER_BEAT=8= missing thumbnails per beat — best-effort, journals a line on failure, never blocks the wallpaper flip. thumbstore is pure (stat/decode/load/save injected); 10 tests.
-
-Went with incremental warming (8/beat, ~10 beats to full) as the safe default rather than full-warm-on-change — the per-beat cap is a one-line flip if Craig wants it faster. Measured: hot-path decode of a viewport dropped from 3.7s cold to 47ms warm. No installer change (the tick service already runs =settings tick=); cache lives outside the repo. Full suite 3522, both gates, smoke OK, live panel verified (81 pixbufs render, 48ms worst stall warm).
-** DONE [#C] Panel scrollbars too short :bug:dotfiles:quick:solo:
-CLOSED: [2026-07-23 Thu]
-Shipped 2026-07-23 as dotfiles =0d64837= (22px scrollbar, 16px trough, 14px slider thickness with a 48px floor along the travel axis). Left open by oversight during the speedrun; closing now.
-
-Follow-on, and my own regression: enlarging the bar to 22px is what made it start covering the thumbnails, because nothing grew the tray to match. Craig reported it the same day ("scrollbars that obscure the images") and it's fixed in =c0ddf57= — the tray now reserves a 22px lane for the bar as a margin on the scrolled box, so the bar sits below the images instead of across them. Measured before: tray 68px, content 68px, a visible 14px bar inside the same 68px. After: tray 90, content 68, bar clear. The lane is a constant under the scrollbar CSS with a note to keep the two in step, since the coupling between bar thickness and tray height is exactly what broke.
-
-From the roam inbox (Craig, claimed 2026-07-23): all scrollbars need to be much taller than before. The always-visible scrollbars shipped in 7e8eb4a set =min-height: 10px; min-width: 10px= on the slider (=settings/src/settings/gui.py=, the =.dupre-panel scrollbar slider= rule) — that's the floor for a short slider, and the trough itself is thin. Raise both the slider floor and the trough thickness so the bar is comfortably grabbable. Cosmetic × every glance at the wallpaper trays = P3 = [#C].
 ** DONE [#C] Video wallpapers don't fit the desktop :bug:dotfiles:solo:
 CLOSED: [2026-07-24 Fri]
 From the roam inbox (Craig, claimed 2026-07-23): videos don't fit the desktop in desktop-settings. The video channel drives mpvpaper (=settings/src/settings/wallpaper.py=); mpvpaper passes options through to mpv, so the fit is a =--panscan=/=--video-unscaled=/keepaspect question rather than a layout one. Reproduce with a video whose aspect differs from the output, pick the mode that fills without distorting (cover, matching how the image channels behave), and cover it in the wallpaper tests. Minor severity × whenever the video channel is selected = P3 = [#C].
@@ -3670,122 +3814,6 @@ CLOSED: [2026-07-24 Fri]
 From the roam inbox (Craig, 2026-07-24 via work), a research idea: Craig wants to save a specific window+app arrangement and have it reappear on demand. What has to be known and built to make that happen — is there prior art (another WM or OS that does session/layout save-restore), what information do those need (app identity, geometry, workspace, launch command), and what are their rules. Explore how far Hyprland can get (hyprctl clients + dispatch, exec rules, window rules by class/title), document thoroughly, and review with Craig next time. Not :solo: — the deliverable is an assessment he reads and decides on, and it may spawn a build task once the shape is clear. Offer to file the build separately if part of it turns out urgent.
 
 RESEARCHED, dotfiles =8cf4728=: =docs/2026-07-24-window-config-save-recall-assessment.org=. Prior art surveyed (i3/sway =append_layout= swallow, KDE window rules, macOS Moom). Three tiers from cheapest: (1) reposition open windows — buildable + testable now; (2) relaunch + place by class rule; (3) full swallow-by-title, which hits the same-class ambiguity every tool hands back to the user. Recommends shipping tier 1; tiers 2-3 need Craig's call on how much manual disambiguation he'll accept.
-** DONE [#C] Velox refresh sweep :chore:maint:
-CLOSED: [2026-07-23 Thu]
-From the roam inbox (Craig, claimed 2026-07-23): velox needs bringing up to date, the mouse/touchpad module is still there, investigate what else didn't move over.
-
-Resolved 2026-07-23 by a full sweep over tailscale. The touchpad module was already gone — velox's running waybar (started 01:05, after the reboot) and its tracked config both carry zero =custom/touchpad= entries; what Craig saw was the pre-restow waybar process from before the reboot, and the reboot cleared it. Sweep results: both machines at dotfiles f9b6404 (all three hyprland lock/exit fixes live on velox, config errors clean, =allow_session_lock_restore= reads true); stow restow clean, only the expected skip-worktree files; rulesets pulled to 50fc7ca and =make install= run (agent-text verified working by invoking it — an earlier "MISSING" reading was a PATH artifact of the non-interactive ssh shell, not a real gap); desktop-settings tick timer active; mpvpaper, power-profiles-daemon, gtk4-layer-shell, webkit2gtk all present.
-
-Genuine remaining differences, all per-machine installs rather than sync failures: =cmail-action=, =gcalcli=, and =playwright= aren't installed on velox, and =obsbot-wb-guard.service= isn't enabled there (the OBSBOT lives on ratio). None block anything; file separately if velox should send mail or drive browser tests.
-*** 2026-08-20 Thu @ 09:53:04 -0700 One of those three closed itself; two still stand
-=cmail-action= is on both daily drivers now, and nothing did it deliberately. It moved into rulesets at =claude-templates/bin/=, and rulesets' =make install= links that whole directory into =~/.local/bin= at every session start — so velox picked it up on its own. Verified here: the symlink was written 05:44 this morning by this session's own startup, and the tool runs.
-
-=gcalcli= and =playwright= are still absent on velox, which stays correct until I say velox should send calendar invites or drive browser tests. =obsbot-wb-guard= is still right to be off here; the camera is on ratio.
-
-Leaving the paragraph above as written rather than striking it (rulesets suggested striking). It is the resolution note of a task closed 2026-07-23 and it was accurate that day. Editing a closed record to match today makes it a worse record, and the useful correction is this dated entry, not a redaction.
-** DONE [#C] Weather tooltip sunrise and sunset :feature:waybar:weather:quick:solo:
-CLOSED: [2026-07-23 Thu]
-Shipped 2026-07-23 as dotfiles =de62e9d=. The two rows sit directly below Humidity in the current-conditions block, rendered in the footer's 12-hour format (=%-I:%M %p=) so the tooltip reads one way throughout.
-
-Confirmed the no-extra-round-trip premise held: =sunrise,sunset= joined the existing =&daily== block. Split =forecast_url= and =reading_from= out of =fetch= so both the request and the reading are testable without network — that's what let the new cases cover a payload missing the fields. Six tests (Normal/Boundary/Error): row placement and format, a pre-change cache with no sun fields, an unparseable stamp, today's pair picked out of the six-day arrays, and the API omitting them. Reused the existing =_at= helper rather than adding a near-duplicate =_first=.
-
-Live-verified against the real API: sunrise 6:14 AM, sunset 7:59 PM for today in New Orleans, rendering in the actual tooltip. Full suite 3506 tests, both gates, exit 0.
-
-Open, not blocking: every other header row carries a glyph (thermometer, droplet, wind arrow) and the sun rows are plain text. The file's glyphs are marked font-confirmed codepoints, and I haven't verified a sunrise/sunset glyph renders rather than showing tofu, so I left them bare. Craig's call.
-
-From the roam inbox (Craig, claimed 2026-07-23): in the weather module's hover text, the section immediately after the location ends with the current humidity. Add the sunrise and sunset times for the current location directly below it.
-
-Cheap to source: the module already calls Open-Meteo with a =&daily== block (=common/.local/bin/weather=, the forecast URL around line 336), so =sunrise,sunset= joins that same request with no extra round trip — normalise_daily already parses the daily arrays. Times arrive as local ISO strings; render in Craig's canonical clock format rather than re-deriving one. The settings package's =suntimes.py= (pure NOAA math, no network) stays the offline fallback path if the API field is ever absent — don't duplicate its math here.
-** DONE [#C] Maint doctor-row copy button :refactor:maint:quick:solo:
-CLOSED: [2026-07-23 Thu]
-Shipped 2026-07-23 as dotfiles =761fa5c=, "fix(maint): drop the COPY key from the doctor row" — the key and its orphaned handler removed from =maint/src/maint/gui.py=. =viewmodel.status_copy_text= stays: it's a tested pure serializer and the obvious source if a copy surface returns somewhere better placed.
-
-Correction to the body below: it describes a per-row button and a separate global one. There is only one COPY key, and it IS the global one Craig added in 8bc79ba two days earlier. He tried it and wanted it gone, so the row now reads DOCTOR · CLEAN UP · REVIEW & FIX.
-
-From the roam inbox (Craig, claimed 2026-07-23): remove the per-doctor-row copy button (next to REVIEW and FIX) from the maint status wall. The global COPY key (dotfiles 8bc79ba, "one global button copying rendered text") stays the one copy surface — the per-row button turned out to be clutter next to it.
-** DONE [#C] WiFi tooltip signal strength :feature:waybar:network:
-CLOSED: [2026-07-22 Wed]
-From the roam inbox (Craig, claimed 2026-07-22): add signal strength to the WiFi tooltip.
-
-Resolved 2026-07-22: the tooltip's signal line existed but never fired on ratio — the mt7925 driver leaves /proc/net/wireless empty (legacy WEXT procfs unimplemented), so the dBm read returned None and the bar glyph fell to the weakest tier. Fix in dotfiles net/: an iw-dev-link nl80211 fallback (only spawns when procfs is empty), a signal_percent mapping, and an enriched line — Signal: ▂▄▆█ 100% · -32 dBm (excellent) — bars by band, percent, raw dBm, band word. The bar icon tier fixed itself as a side effect.
-** DONE [#B] Desktop-settings dropdown panel :feature:waybar:
-CLOSED: [2026-07-22 Wed]
-:PROPERTIES:
-:LAST_REVIEWED: 2026-07-22
-:END:
-Resolved 2026-07-22: shipped end to end via the "Build: desktop-settings panel" task (dotfiles 7a15237 → 9038eee; spec IMPLEMENTED, 85 suites + smoke 13/13 + e2e 17/17). Every open question below got settled in the spec: bar consolidation landed (74f723e), the wallpaper manager became the in-panel sub-view, and the format pickers split into their own sibling spec ([[file:docs/specs/2026-07-19-display-format-single-source-of-truth-spec.org]], DRAFT stub). Remaining human-eye checks live under "Manual testing and validation".
-
-Original body follows as the record.
-
-Initial spec written 2026-07-02: [[file:docs/specs/2026-07-02-desktop-settings-panel-spec.org]] (DRAFT — four decisions await Craig's review before build; architecture updated to the net panel's Blueprint/GTK4 stack).
-
-One waybar dropdown gathering the desktop toggles and sliders into a single settings panel, opened from a gear/settings glyph on the bar. Incorporate:
-- *Auto-dim* toggle (the =custom/dim= feature just shipped — fold in here, or keep the standalone indicator and mirror it).
-- *Brightness* slider (backlight, via brightnessctl).
-- *Keyboard-backlight* brightness slider (brightnessctl on the kbd_backlight class).
-- *Mouse* enable/disable toggle — shown only when a mouse is connected.
-- *Trackpad* enable/disable toggle — shown only when a trackpad is connected (mirror =toggle-touchpad= / =touchpad-auto=).
-- *Idle inhibitor* (the =custom/idle= module that replaced the built-in =idle_inhibitor= 2026-06-24 — toggles the hypridle daemon, state-synced icon).
-- *Airplane mode* (the existing =airplane-mode= toggle; laptop-only).
-
-The conditional rows (mouse, trackpad, airplane) appear only when their hardware/context applies — reuse the laptop/device detection the airplane and touchpad indicators already do.
-
-Design / open questions (propose before building):
-- Panel tech: sliders need a real toolkit (waybar can't host a slider), so a GTK4 + gtk4-layer-shell app like pocketbook is the likely shape.
-- Which existing standalone bar modules (dim, touchpad, airplane, idle_inhibitor) collapse INTO this panel vs. stay on the bar as quick-access indicators. Craig's call.
-
-Implementation notes: a small GTK layer-shell app (mirror pocketbook's structure: src-layout Python package, pytest, Makefile) talking to brightnessctl / hyprctl / the touchpad + airplane helpers. Lives in the dotfiles repo or in-tree like pocketbook. TDD the backing toggle/slider logic. Sizable — worth a design doc first.
-
-Home handoff 2026-07-19 (inbox, resolving the open "few other things" decision — fold into the spec, close the open decision, extend the controls table, then run spec-review, may flip DRAFT→READY). Ownership: home drives the build (dotfiles settings/), archsetup keeps the canonical spec. Full reconciliation in home docs/design/2026-07-19-desktop-settings-module-brainstorm.org.
-- ADD controls: night-light / color temperature; Do Not Disturb / notifications (dunst); lock / suspend quick actions; power profile (performance/balanced/saver); scenes/profiles — one control flipping several toggles at once (Focus, Presentation, Battery-saver, Night). Scenes are the payoff of consolidating everything.
-- OUT (record reasons): volume / master-mute stays with the audio panel (no mirror here); theme light/dark goes to the theme-studio task.
-- FORMAT PICKERS pulled to their own future sibling spec — time/date/weather format is out of THIS panel. Rationale: format settings live in many programs, so the design problem is a single source of truth for the canonical format. Track a future sibling-spec stub in docs/specs (time/date/weather format single-source-of-truth); Craig thinking it through separately, not started.
-- STILL OPEN (spec already flags): wallpaper manager confirmed in scope, but row-that-opens-a-sub-view vs its own sub-spec undecided — resolve at spec-review.
-** DONE [#C] Gallery probe: the fader-drag check is flaky :bug:test:design:quick:solo:
-CLOSED: [2026-07-23 Thu]
-Fixed 2026-07-23. Root cause confirmed rather than suspected: =panel-widget-gallery.html= line 74 sets =html{scroll-behavior:smooth}=, so =scrollIntoView= animates and the fixed 200ms sleep sometimes read =getBoundingClientRect= mid-scroll. The drag then dispatched at stale coordinates, the press missed the fader, and the check reported a dead widget.
-
-Fix: scroll with =behavior:'instant'=. The probe never needed the animation, so this removes the race instead of waiting it out. Also added a =settledRect= guard (rect stable across two reads AND on-screen) for zoom/column relayout, and a =hits()= assertion that the press actually lands on the fader before the drag goes out.
-
-Applied to the toggle-click check too — it shares the same fixed-sleep shape, and it failed for this exact reason during the diagnosis, so fixing only the fader would have left half the defect.
-
-Worth recording: my FIRST fix was wrong and made it worse. Polling until the rect stopped changing returned pre-scroll coordinates every time, because two identical samples are also what you get before the animation starts — an intermittent failure became a consistent one. The new hit-test assertion is what caught it, printing the press point at y=1326 against a 1200px window. That's the argument for asserting the press landed rather than only asserting the readout moved.
-
-Verified against the measured 1-in-6 failure rate: 8 consecutive runs, all three checks passing, with the press point identical every run (429,480) — deterministic, not lucky. Full probe 96 PASS, 0 FAIL, exit 0.
-
-=probe.mjs= check 3 ("fader drag tracks at 3x") intermittently reports =level 68 -> level 68=, i.e. the synthetic drag never registers. It has presumably been doing this all along unnoticed, since the suite is normally run once per batch.
-
-Grading: *Minor* severity (a false FAIL costs a re-run and a few minutes, and never ships a defect) x *most users, frequently* = P3 = =[#C]=.
-
-Frequency measured 2026-07-16, not estimated: 1 failure in 6 consecutive runs, having already fired twice in about fifteen that afternoon. The first grading guessed "some users, sometimes" (~1 in 10); at ~1 in 6, both people who run this suite hit it most sessions, so the row is "most users, frequently". The letter lands on =[#C]= either way, but the input was wrong and the matrix is only worth anything if its inputs are measured.
-
-Suspected cause: the check clicks the 3x size chip, calls =scrollIntoView=, waits a fixed 200ms, then reads =getBoundingClientRect= and dispatches the drag against those coordinates. If the zoom relayout or the smooth scroll hasn't settled, the rect is stale and the press lands off the fader — so the drag is a no-op and the readout never moves. The other timing-sensitive checks share the same fixed-sleep shape.
-
-*Do not fix this by raising the sleep.* That hides the race rather than removing it and leaves the check failing again on a slower run. Wait on the actual condition instead: poll until the rect stops changing between frames, or assert the press landed on the fader before dispatching the drag (the probes' own README already warns that a =find()= miss dispatches into nothing and reports as a widget bug).
-
-Why it matters beyond the annoyance: a gate that cries wolf gets its real failures ignored, and this suite is the only thing standing between the gallery and a silent regression.
-
-Recurrences: 2026-07-18 batch-6 gate (first run, passed 3 reruns); 2026-07-18 batch-9 gate (first cold run, =level 68 -> level 68=, passed 2 reruns); 2026-07-21 double-speedrun run (flashed one RED mid-run, passed on rerun). All were a session's first/early probe run — consistent with the stale-rect theory (cold-start relayout settling slower than the fixed 200ms sleep).
-** DONE [#C] Dotfiles stow conflicts: first-launch risk + restow directory handling :bug:dotfiles:quick:solo:
-CLOSED: [2026-07-23 Thu]
-:PROPERTIES:
-:LAST_REVIEWED: 2026-07-14
-:END:
-Closed 2026-07-23. The last open item was the velox check, and velox is reachable again. Pulled it from =02df01a= to =de62e9d= (clean tree, fast-forward), then ran =make conflicts hyprland=, which dry-runs every tier: "No stow conflicts", exit 0. Its old conflict copy had already cleared against the updated repo, so there was nothing for =make reset= to do.
-
-Verified the pull is live through the symlinks rather than just present in the repo: =~/.local/bin/weather= resolves into the dotfiles tree and returns today's sun times on velox.
-
-Note for the record: =make conflicts common= is not a valid invocation — =check-de= rejects it, because common and the host tier are auto-included in the DE-scoped run. =make conflicts hyprland= is the whole check.
-*** 2026-07-14 Tue @ 00:51:51 -0500 Ratio calibre check passed; waypaper canonical decided (dark-lion)
-Ratio's ~/.config/calibre is a directory symlink into the dotfiles repo (stow folded the whole dir), so the first-launch gap never existed there — check closed. Craig decided dark-lion.jpg is the canonical waypaper wallpaper; the repo config.ini updated from the that-one-up-there.jpg placeholder (the file is skip-worktree volatile, unskipped for the commit and re-flagged). Remaining: when velox is back online, run make conflicts / make reset there so its old conflict copy clears against the updated repo.
-*** 2026-07-02 Thu @ 17:30:00 -0400 Shipped the Makefile hardening + first-launch guard (dotfiles 42a82d2)
-The solo-able subset landed in the speedrun. =make conflicts <de>= is the loud first-launch guard: dry-runs all tiers, parses all four stow error shapes (plain file conflict, foreign symlink, dir-over-file, and restow's unstow_contents non-directory ERROR), lists each blocker with a directory/foreign-symlink marker, exits 1 when any exist. =make reset= now pre-clears the directory and foreign-symlink blockers =--adopt= aborts atomically on (removals printed; repo version wins per the target's contract), then adopts + git-checkouts as before. =make restow='s overwrite path switched rm -f → rm -rf so directory conflicts clear. 8 sandbox tests drive the real Makefile against a throwaway HOME (44 suites green). Also verified on velox: the whereami and mpd-playlists conflicts noted in this task were already hand-converted 2026-06-29 — =make conflicts hyprland= reports clean live. REMAINING (deferred per Craig's speedrun pre-flight): the waypaper canonical decision (live velox dark-lion.jpg vs repo that-one-up-there.jpg) and the ratio calibre-symlink check (ratio paused).
-From the velox calibre incident (2026-06-27, note in ~/.dotfiles/inbox/processed/): calibre was launched before =make stow= ran, wrote its own default config into =~/.config/calibre/=, and silently blocked its own stow — it ran on factory defaults while the rest of common/ stowed fine. General pattern: any GUI app that auto-creates config on first run, launched before stow, blocks its own stow the same way. Velox was repaired by hand (=ln -srf= symlinks byte-identical to =stow --no-folding= output).
-
-Remaining work (re-graded C 2026-07-02 — the first-launch risk and the Makefile handling shipped in the speedrun; what's left is a paused-machine check):
-- Waypaper canonical decision (Craig): RESOLVED 2026-07-14 — dark-lion.jpg is canonical (dotfiles fea3e93), repo config.ini updated off the that-one-up-there.jpg placeholder.
-- Ratio check: RESOLVED 2026-07-14 — ratio's =~/.config/calibre= is a directory symlink into the repo (stow folded the dir), so the first-launch gap never existed there.
-- When velox is back online: run =make conflicts= / =make reset= there so its old conflict copy clears against the updated repo. (velox carries a separate boot-recovery task; check once it's reachable.)
 ** DONE [#B] Weather tooltip caching :feature:waybar:weather:solo:
 CLOSED: [2026-07-25 Sat 10:53]
 From the roam inbox (Craig, claimed 2026-07-22): retrieve the weather tooltip data once per hour and cache it. If the network is unavailable, display the cached tooltip with explanatory text saying so. Dotfiles-side work (archsetup owns the lifecycle); touches common/.local/bin/weather.
@@ -4547,3 +4575,196 @@ Solo — mechanical, an existing convention to copy, and verifiable by running t
 
 
 Fixed in dotfiles =c96a216=. All thirteen bare calls now pass =JUL=. The task's "line 747" was stale (the deliberate =t0= sweep is at 893 and already passed its own ref, so it was never at risk), and the continuation-form call closes its arguments on the next line, which is why a naive grep counts fourteen. Added a guard that reads the file and fails with the offending line numbers, and verified it bites by stripping =JUL= from one call and confirming it went red naming that line.
+** DONE [#A] Velox still carries the install placeholder passwords :bug:security:velox:
+CLOSED: [2026-08-23 Sun] SCHEDULED: <2026-08-20 Thu>
+:PROPERTIES:
+:CREATED: [2026-08-20 Thu]
+:LAST_REVIEWED: 2026-08-20
+:END:
+Closed 2026-08-23: I'd already rotated all three on the 08-14 bringup day, so
+this task was never live. Verified on velox before closing — =chage -l= puts the
+last password change for both =cjennings= and =root= at Aug 14 2026, and
+=/etc/zfs/zroot.key= was rewritten 2026-08-14 05:29 and no longer holds the
+placeholder (checked with a =grep -qx= that returns a yes/no without reading the
+key into a transcript).
+
+The premise below was wrong, and it's worth naming how. Nothing ever tested the
+credentials: the claim came from an unticked runbook item plus the archangel
+session handing back the values the *installer* had set, which reads as "these
+are current" only if you assume nobody changed them in between. An inference
+about a security exposure got recorded in the same voice as a measurement. The
+one command that settles it costs a second.
+
+Original body follows.
+
+The 2026-08-13 reinstall set placeholder credentials and the runbook's Phase 5
+item to replace them (=passwd=, =zfs change-key zroot=) was never ticked.
+Believed still live 2026-08-20 via the archangel handoff, which had to hand
+them back to Craig to get into the machine: =welcome1= for the pool, =welcome=
+for the accounts.
+
+So velox's full-disk encryption is currently protected by a dictionary word
+with a digit, on the machine that travels. Anyone who picks it up owns the pool
+and every account on it — the encryption is doing no work at all.
+
+Two commands, both on velox:
+- =passwd= for each account.
+- =zfs change-key zroot= for the pool passphrase. Note this is the ZBM unlock
+  passphrase, so get it right before rebooting.
+
+Grading: *severity-alone carve-out* — this is a security exposure, so the
+frequency row does not discount it (=todo-format.md=). Critical severity: total
+compromise of an encrypted-at-rest laptop from a guessable string, with the
+device leaving the house. = P1 = [#A].
+
+Distinct from the =VERIFY [#A] Rotate the credentials exposed by the 2026-08-09
+dotfiles leak= under the cgit audit — that one covers credentials a crawler
+already took from a public repo. This one is a local default never changed. Both
+are rotation work; neither substitutes for the other.
+** CANCELLED [#B] Consistent keybinding family for the panel console :feature:hyprland:
+CLOSED: [2026-08-21 Fri]
+:PROPERTIES:
+:LAST_REVIEWED: 2026-07-09
+:END:
+Merged into =[#B] Reconcile panel keybindings around Super+N=, which now carries
+this body's detail: the collision list, the velox plain-keyboard constraint, and
+maintenance-M as the priority chord. Cancelled rather than done — the work is
+still open, just tracked in one place instead of two.
+
+Consider putting every panel (net, bluetooth, audio, timer, and the coming maintenance console) on one consistent chord family — a shared modifier set (Super+Shift, Control+Alt, or similar) plus a mnemonic letter per panel (N/B/A/T/M). Today the panels open via waybar clicks only; a uniform chord family makes them keyboard-reachable and predictable. Watch for collisions with existing binds: Super+Shift+A is already PTT toggle, and the hold-to-talk grave bind is load-bearing. Decide the family, audit current hyprland binds for conflicts, wire via the dotfiles hyprland config, and document in the keybind reference. Both machines (velox can't QMK-remap, so chords must work on a plain laptop keyboard).
+*** 2026-07-14 Tue @ 00:31:36 -0500 Folded Craig's ask for a maintenance-panel keybinding; bumped [#C] → [#B]
+Craig asked (in session, 2026-07-14) for a maintenance keybinding specifically — the panel he's reaching for without one. Maintenance (M) is the priority chord when this task gets worked. The capture graduated the task from parking lot to active backlog.
+** DONE [#B] Waybar network module — custom/net :feature:waybar:network:
+CLOSED: [2026-08-21 Fri]
+:PROPERTIES:
+:LAST_REVIEWED: 2026-07-09
+:END:
+Closed 2026-08-21: the module shipped and is in daily use. Phases 1-4 all landed
+in dotfiles, and the tunnels track absorbed most of what Phase 5 originally
+covered. The one piece genuinely left — the =net vpn= CLI subcommand — is now its
+own task below, so the residual is tracked at its real size instead of holding a
+finished umbrella open.
+Unifies the old wifi-no-internet indicator (was =[#C]=) and the network-manager
+dropdown (was =[#B]=) into one =custom/net= module: a tested Python =net= engine
+(nmcli + diagnostics), a thin bar indicator, and a GTK4 layer-shell panel. Code
+lives in the dotfiles repo (hyprland tier + a =net/= package like pocketbook);
+archsetup only installs deps. Secrets stay in NetworkManager's own store (no
+separate credential store). The =captive= script becomes the diagnostics engine.
+Full design, acceptance criteria, and the failure-mode coverage table:
+[[file:docs/design/2026-06-29-waybar-network-module-spec.org][2026-06-29-waybar-network-module-spec.org]].
+
+Phases below, dependency order. Engine/unit work is agent-verifiable (=unittest=
++ fakes on PATH, coverage via venv); the live-network and visual states need real
+conditions, filed under "Manual testing and validation".
+
+*** 2026-06-29 Mon @ 20:19:11 -0400 Phase 1 shipped — indicator + console recovery
+Shipped to the dotfiles repo (10 commits, =5254bd8=..=c095a22=, pushed to main).
+The =net= engine is a src-layout Python package in-tree, imported by a bin shim
+that resolves the stow symlink back to the repo — so it runs from a bare TTY with
+no install, which the recovery path depends on.
+
+Landed: =net status= (fast path, one nmcli call + sysfs, degraded fallback in
+budget) + =net probe= (native captive probe, single-flight flock, atomic cache,
+fresh/stale/expired/unknown classes, iface/SSID/UUID invalidation); =waybar-net=
+replacing =custom/netspeed=, throughput → tooltip, CSS states in both themes +
+live; =net diagnose= (read-only steps) + =net repair= (rfkill/reset/bounce/
+dns-test, cleanup-verified) + =net doctor [--fix]= with the four terminal
+classifications; =net portal= + the =captive --probe-json= refactor; redacted
+JSONL event log; Makefile recovery targets (=make online= etc.); =~/.config/net/
+config=. Verified live: =make net-status= reads the real wlp170s0 / @Hyatt_WiFi.
+
+Airplane (Craig's call, option 1): =custom/net= absorbs only the *display* — net
+reads the airplane-mode state file and shows an airplane state/glyph. The
+airplane-mode toggle stays (it's a low-power mode — radios + CPU + brightness +
+services — not a radio switch), now on =custom/net='s right-click + signal 15.
+Deleted: =waybar-airplane=, =waybar-netspeed=, =custom/airplane=, their tests +
+css. =airplane-mode= kept.
+
+Tests: 160 in =tests/net/= (fake nmcli/curl/rfkill/resolvectl/ping/getent/
+systemctl on a temp PATH; doctor-classification fixtures; degraded-under-slow-
+nmcli benchmark) + the =captive= probe-mode tests; full dotfiles suite green (32
+suites). Coverage-gap pass via throwaway venv: pure modules ≥90% branch
+(classify 100%), IO-error branches excused in the test docstring.
+Deferred to Phase 2/3: archsetup deps (gtk4-layer-shell/python-gobject Phase 2,
+speedtest-go-bin Phase 3 — not added before the code that needs them).
+Verify (manual, live): see Manual testing and validation.
+
+*** 2026-06-29 Mon @ 22:19:25 -0400 Phase 2 shipped — panel shell + connection management
+Shipped to dotfiles (commits =4e7740f=..=24bcac5=, pushed). Engine: =net list= (saved
+MRU + in-range wifi scan, infrastructure types filtered), =net up/down= (UUID-keyed,
+mutation safety — keep prior link until target activates, classify wrong-password vs
+generic, report auto-reactivation), =net add/edit/remove/rescan= (open + WPA-PSK;
+enterprise activate-only; secret to NM's store, never our JSON/log — tested).
+
+Panel: a GTK-free PanelModel (selection, four state machines, the UX-flow enable
+rules, terminal states) + a GTK4 gtk4-layer-shell window (=net panel=) anchored
+top-right under the bar — Connections section with MRU list, active marked, signal
+glyph, row-click select, Connect/Add/Forget/Rescan, confirm-on-forget, worker-thread
+engine calls via GLib.idle_add. GTK imported lazily so the CLI/tests stay GTK-free.
+
+Bar interactions (settled with Craig over live iteration): left = =net-panel= toggle,
+middle = =net portal=, right = =net-fix= (notify the doctor result when one-way; open
+a terminal only when the outcome is fixable — the sudo/interactive case). Airplane on
+Super+Shift+A. archsetup adds =gtk4-layer-shell= + =python-gobject= (this commit);
+already on velox.
+
+Tests: 204 in tests/net (merge ordering/dedup, up/down mutation safety, no-secret-leak
+on add/edit, panel model + state machines, gui row-format helpers). Full dotfiles suite
+green (32 suites). Live-verified on velox: panel opens/toggles, list shows real 24
+profiles, right-click notification delivers (Craig confirmed). Phase 3 (diagnose/repair/
+speedtest IN the panel) is next; the engine for it already exists from Phase 1.
+
+*** 2026-06-29 Mon @ 22:43:40 -0400 Phase 3 shipped — diagnostics + speed test in the panel
+Shipped to dotfiles (=91277cf=..=691abcb=) + archsetup (=48052d6=, speedtest-go-bin),
+pushed. Engine: =net speedtest= (parses speedtest-go --json → ping from latency ns,
+down/up from per-server byte rates; missing-backend / offline / malformed → error
+envelope per the failure table). Panel grew a section switcher with four pages:
+- Connections (Phase 2).
+- Diagnose: =net diagnose= on a worker thread, each step a row (✓/✗/… glyph + title +
+  redacted evidence), read-only; Open-portal button when captive.
+- Repair: "Get me online" (=net doctor --fix=) + tiers (rfkill/reset/bounce/dns-test)
+  + force portal. Confirmations in-panel with the spec's exact wording; the privileged
+  tiers run via =net-popup= terminal (where the sudo prompt + step output, incl.
+  cleanup-verified, show) — a panel has no tty, and pkexec would mean a prompt per op.
+- Speed test: in-process =net speedtest= (no privilege → inline result: ↓/↑ Mbps + ping
+  + server), Run/Cancel (Cancel pkills the child), error envelope shown.
+
+213 net tests; pure helpers (step_indicator, format_speedtest) unit-tested. Full
+dotfiles suite green (32 suites). One unverified assumption: speedtest-go's dl/ul unit
+(taken as bytes/s; =BYTES_PER_SEC= flips it) — needs one real run vs a reference. The
+in-panel repair streaming (vs terminal) is a named future polish once the GUI-privilege
+story settles.
+
+The waybar network module ([#B] parent) is now COMPLETE through Phase 3. Phase 4
+(in-app help + user guide) and Phase 5 (VPN/WireGuard) remain as future work; the core
+feature (indicator + recovery + panel + diagnostics + speed test) is done.
+Verify (manual, live): see Manual testing and validation.
+
+*** 2026-07-09 Thu @ 16:32:54 -0500 Audit reconcile: Phase 4 is filed on the dotfiles side, waiting on them
+The dotfiles project accepted the Phase 4 handoff and filed it as a =[#C]= task in their own =todo.org= (their note, 2026-07-08 16:56): the help-text audit + panel help affordance, the user-guide/README, and the ratio rollout doc. Not started there. They ping when it lands, and this task's Phase 4 child closes then. Nothing to do here meanwhile.
+
+*** 2026-08-17 Mon @ 19:57:42 -0700 Landed on the dotfiles side; the block is cleared
+dotfiles shipped it as =138da7b= and closed its own task, so this one closes
+with it and the =:blocked:= tag comes off. Found by checking their =todo.org=
+rather than waiting for the ping — their close-out note says "archsetup pinged
+so its Phase 4 task can close", so the handoff worked and only this end was
+left open.
+
+All three acceptance criteria are met on their side: the help audit found and
+fixed a stale =net repair= action list (nine of nineteen actions were named;
+both the CLI help and =repair.py='s docstring now generate from the ACTIONS
+registry), =net/README.md= covers every command plus the recovery targets, and
+the ratio rollout is documented with both daily drivers verified current.
+
+They split the panel help affordance out rather than inventing it — no sibling
+panel has one, so its shape is a design call. It is tracked on their side, not
+here.
+
+Original deliverable, for the record: in-app help (=net --help= + per-command,
+panel help affordance); README/user-guide; archsetup Hyprland dep install
+(=gtk4-layer-shell=, =python-gobject=, =speedtest-go-bin=); ratio manual dep +
+stow step. Handed off 2026-07-04 with the archsetup deps already confirmed
+installed.
+
+*** 2026-08-21 Fri @ 14:18:03 -0700 Promoted the Phase 5 residual out to its own task
+Rescoped 2026-07-04 (audit): the tunnels track already shipped most of the original Phase 5. Panel tunnel bring-up/down and detection landed (dotfiles 2d9d060 probes tailscale/NM-wireguard/Proton; 21db05a brings overlays up/down from the panel's Tunnels sub-view; 31ba056 diagnose/doctor understand tunnel routes; archsetup 2e40781 wireguard config import; the net-panel-other-interfaces spec is IMPLEMENTED). What remains for Phase 5 is only the =net vpn ...= CLI subcommand — cli.py still has no vpn/tunnel parser. Fold the panel's existing tunnel operations into a CLI surface; spec separately when picked up.
-- 
cgit v1.2.3