Workstation optimization: Chrome cleanup, package purge, PCIe audit, service tuning

- Chrome/Chromium cleanup (ADR 0006): removed 10GB chromium profile, broken PWA
  shortcuts, dead BROWSER_CDP_URL from .bashrc, restored Wayland chrome-flags.conf
- Package cleanup (ADR 0007): Tier 1-4 executed, 40 packages removed (KDE Plasma,
  ruby, love, xorg-server, kscreen/kscreenlocker), 45 cascade orphans purged
- Waybar USB module: auto-mount via udisks2, yazi integration, hover details
- Service tuning: disabled bluetooth.service, NetworkManager-wait-online.service
- hypridle fix: upgraded sdbus-cpp 2.3.0->2.3.1-1 (SEGV crash loop resolved)
- PCIe audit: GPU in wrong slot (PCIEX4 vs PCIEX16), 8x bandwidth loss documented
- D-Bus cleanup: removed stale org.kde.kwalletd6.service stub
- Ansible: all changes reflected in vars/main.yml and task files

ansible/roles/dev-tools/tasks/main.yml

@@ -109,6 +109,7 @@
       - oha
       - unetbootin
       - ventoy
+      - chromium-widevine
     state: absent
 
 - name: Ensure legacy editor packages are removed
@@ -134,6 +135,15 @@
     mode: '0644'
   tags: [chrome, nvidia, wayland]
 
+- name: Remove dead BROWSER_CDP_URL from .bashrc
+  ansible.builtin.lineinfile:
+    path: "/home/{{ system_user }}/.bashrc"
+    regexp: '.*BROWSER_CDP_URL.*'
+    state: absent
+  become: yes
+  become_user: "{{ system_user }}"
+  tags: [chrome, shell, cleanup]
+
 - name: Fix kitty cursor keys by removing TERM override in .bashrc
   ansible.builtin.lineinfile:
     path: "/home/{{ system_user }}/.bashrc"

ansible/roles/hyprland/tasks/main.yml

@@ -6,6 +6,12 @@
     update_cache: yes
   tags: [hyprland, packages]
 
+- name: Hyprland - remove X11 packages (Wayland-only)
+  community.general.pacman:
+    name: "{{ hyprland_packages_remove }}"
+    state: absent
+  tags: [hyprland, packages]
+
 - name: Hyprland - ensure configuration directories exist
   file:
     path: "/home/{{ system_user }}/.config/{{ item }}"
@@ -100,3 +106,12 @@
     group: "{{ system_user }}"
     mode: '0755'
   tags: [hyprland, config]
+
+- name: Hyprland - deploy Waybar USB automount script
+  template:
+    src: 'waybar_usb_script.sh.j2'
+    dest: "/home/{{ system_user }}/.config/waybar/scripts/usb.sh"
+    owner: "{{ system_user }}"
+    group: "{{ system_user }}"
+    mode: '0755'
+  tags: [hyprland, config]

ansible/roles/hyprland/templates/waybar_config.j2

@@ -4,7 +4,7 @@
     "height": 30,
     "modules-left": ["hyprland/workspaces", "hyprland/mode"],
     "modules-center": ["hyprland/window"],
-    "modules-right": ["network", "cpu", "memory", "custom/gpu", "pulseaudio", "clock", "tray"],
+    "modules-right": ["network", "cpu", "memory", "custom/gpu", "pulseaudio", "custom/usb", "clock", "tray"],
     "hyprland/workspaces": {
         "disable-scroll": true,
         "all-outputs": true,
@@ -41,5 +41,14 @@
         "exec": "~/.config/waybar/scripts/gpu.sh",
         "interval": 5,
         "return-type": "json"
+    },
+    "custom/usb": {
+        "exec": "~/.config/waybar/scripts/usb.sh",
+        "interval": 10,
+        "return-type": "json",
+        "on-click": "~/.config/waybar/scripts/usb.sh open",
+        "on-click-right": "~/.config/waybar/scripts/usb.sh eject",
+        "format": "{}",
+        "tooltip": true
     }
 }

ansible/roles/hyprland/templates/waybar_style.css.j2

@@ -21,10 +21,27 @@ window#waybar {
     border-bottom: 3px solid #ffffff;
 }
 
-#clock, #cpu, #memory, #network, #tray, #pulseaudio, #custom-gpu {
+#clock, #cpu, #memory, #network, #tray, #pulseaudio, #custom-gpu, #custom-usb {
     padding: 0 10px;
 }
 
 #pulseaudio:hover {
     background: #555;
 }
+
+#custom-usb:hover {
+    background: #555;
+}
+
+#custom-usb.usb-none {
+    color: transparent;
+    padding: 0;
+}
+
+#custom-usb.usb-mounted {
+    color: #a3be8c;
+}
+
+#custom-usb.usb-unmounted {
+    color: #ebcb8b;
+}

ansible/roles/hyprland/templates/waybar_usb_script.sh.j2

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# Waybar USB module - automount, status, open in yazi, eject
+# Usage:
+#   usb.sh          -> JSON status for waybar poll (auto-mounts unmounted USBs)
+#   usb.sh open     -> open first mounted USB in yazi (via kitty)
+#   usb.sh eject    -> unmount + power-off all USB devices
+set -euo pipefail
+
+# --- helpers -------------------------------------------------------------------
+
+get_usb_devices() {
+    # Returns JSON array of USB block devices via lsblk.
+    # Fields: NAME, RM (removable), SIZE, LABEL, MOUNTPOINT, FSTYPE, TRAN, MODEL
+    lsblk -Jbpno NAME,RM,SIZE,LABEL,MOUNTPOINT,FSTYPE,TRAN,MODEL 2>/dev/null \
+        | jq -c '[.blockdevices[] | select(.tran == "usb")]'
+}
+
+auto_mount_unmounted() {
+    local devices="$1"
+    # Auto-mount any USB partition that isn't mounted yet
+    local unmounted
+    unmounted=$(echo "$devices" | jq -r '.[] | select(.mountpoint == null or .mountpoint == "") | .name')
+    for dev in $unmounted; do
+        udisksctl mount -b "$dev" --no-user-interaction 2>/dev/null || true
+    done
+}
+
+# --- actions -------------------------------------------------------------------
+
+do_open() {
+    # Open the first mounted USB in yazi via kitty
+    local devices
+    devices=$(get_usb_devices)
+
+    local mountpoint
+    mountpoint=$(echo "$devices" | jq -r '[.[] | select(.mountpoint != null and .mountpoint != "")] | first | .mountpoint // empty')
+
+    if [ -z "$mountpoint" ]; then
+        # Try children (partitions)
+        mountpoint=$(lsblk -Jbpno NAME,RM,SIZE,LABEL,MOUNTPOINT,FSTYPE,TRAN,MODEL 2>/dev/null \
+            | jq -r '[.blockdevices[] | select(.tran == "usb") | .children[]? | select(.mountpoint != null and .mountpoint != "")] | first | .mountpoint // empty')
+    fi
+
+    if [ -n "$mountpoint" ]; then
+        kitty -e yazi "$mountpoint" &
+        disown
+    else
+        notify-send "USB" "No mounted USB device found" -i dialog-warning
+    fi
+}
+
+do_eject() {
+    # Unmount all USB partitions, then power-off the parent device
+    local devices
+    devices=$(get_usb_devices)
+
+    local mounted
+    mounted=$(echo "$devices" | jq -r '.[] | select(.mountpoint != null and .mountpoint != "") | .name')
+
+    # Also check children (partitions of whole disks)
+    local child_mounted
+    child_mounted=$(lsblk -Jbpno NAME,MOUNTPOINT,TRAN 2>/dev/null \
+        | jq -r '[.blockdevices[] | select(.tran == "usb") | .children[]? | select(.mountpoint != null and .mountpoint != "")] | .[].name')
+
+    for dev in $mounted $child_mounted; do
+        udisksctl unmount -b "$dev" --no-user-interaction 2>/dev/null || true
+    done
+
+    # Power-off the whole USB devices
+    local parent_devs
+    parent_devs=$(echo "$devices" | jq -r '.[].name')
+    for dev in $parent_devs; do
+        udisksctl power-off -b "$dev" --no-user-interaction 2>/dev/null || true
+    done
+
+    notify-send "USB" "All USB devices ejected" -i media-eject
+}
+
+do_status() {
+    local devices
+    devices=$(get_usb_devices)
+
+    # Auto-mount unmounted partitions
+    auto_mount_unmounted "$devices"
+    # Re-read after automount
+    devices=$(get_usb_devices)
+
+    # Count mounted USBs (check both top-level and children)
+    local count=0
+    local tooltip_lines=""
+
+    # Top-level devices
+    while IFS= read -r line; do
+        if [ -z "$line" ] || [ "$line" = "null" ]; then continue; fi
+        local name size label mount fstype model
+        name=$(echo "$line" | jq -r '.name')
+        size=$(echo "$line" | jq -r '.size')
+        label=$(echo "$line" | jq -r '.label // "N/A"')
+        mount=$(echo "$line" | jq -r '.mountpoint // "not mounted"')
+        fstype=$(echo "$line" | jq -r '.fstype // "?"')
+        model=$(echo "$line" | jq -r '.model // "USB" | gsub("^\\s+|\\s+$"; "")')
+
+        if [ "$mount" != "not mounted" ]; then
+            count=$((count + 1))
+        fi
+        tooltip_lines="${tooltip_lines}${name} ${model} ${size} [${fstype}]\nLabel: ${label}\nMount: ${mount}\n"
+    done < <(echo "$devices" | jq -c '.[]')
+
+    # Children (partitions)
+    while IFS= read -r line; do
+        if [ -z "$line" ] || [ "$line" = "null" ]; then continue; fi
+        local name size label mount fstype
+        name=$(echo "$line" | jq -r '.name')
+        size=$(echo "$line" | jq -r '.size')
+        label=$(echo "$line" | jq -r '.label // "N/A"')
+        mount=$(echo "$line" | jq -r '.mountpoint // "not mounted"')
+        fstype=$(echo "$line" | jq -r '.fstype // "?"')
+
+        if [ "$mount" != "not mounted" ]; then
+            count=$((count + 1))
+        fi
+        tooltip_lines="${tooltip_lines}  └ ${name} ${size} [${fstype}]\n    Label: ${label}\n    Mount: ${mount}\n"
+    done < <(lsblk -Jbpno NAME,RM,SIZE,LABEL,MOUNTPOINT,FSTYPE,TRAN,MODEL 2>/dev/null \
+        | jq -c '[.blockdevices[] | select(.tran == "usb") | .children[]?] | .[]')
+
+    # Determine alt class
+    local alt="usb-none"
+    if [ "$count" -gt 0 ]; then
+        alt="usb-mounted"
+    elif [ -n "$tooltip_lines" ]; then
+        alt="usb-unmounted"
+    fi
+
+    # Build JSON output
+    local text icon
+    if [ "$count" -gt 0 ]; then
+        icon="󰋊"
+        text="${icon} ${count}"
+    elif [ -n "$tooltip_lines" ]; then
+        icon="󰋊"
+        text="${icon} !"
+    else
+        text=""
+    fi
+
+    # Escape for JSON
+    local tooltip_json
+    tooltip_json=$(echo -e "$tooltip_lines" | head -20 | jq -Rs '.')
+
+    if [ -n "$text" ]; then
+        printf '{"text":%s,"tooltip":%s,"alt":%s}\n' \
+            "$(jq -n --arg t "$text" '$t')" \
+            "$tooltip_json" \
+            "$(jq -n --arg a "$alt" '$a')"
+    else
+        echo '{"text":"","tooltip":"","alt":"usb-none"}'
+    fi
+}
+
+# --- main ----------------------------------------------------------------------
+
+case "${1:-}" in
+    open)    do_open ;;
+    eject)   do_eject ;;
+    *)       do_status ;;
+esac

ansible/roles/maintenance/tasks/main.yml

@@ -25,4 +25,29 @@
     - "journalctl --vacuum-time=7d"
   register: maintenance_result
   changed_when: "'deleted' in maintenance_result.stdout or 'Vacuuming' in maintenance_result.stdout"
-  failed_when: false
+  failed_when: false
+
+- name: Disable unused system services
+  ansible.builtin.systemd_service:
+    name: "{{ item }}"
+    enabled: false
+    state: stopped
+  loop:
+    - bluetooth.service
+    - NetworkManager-wait-online.service
+  failed_when: false
+
+- name: Remove orphaned dependencies (pacman -Rns, iterative)
+  ansible.builtin.shell: |
+    removed_any=0
+    while orphans=$(pacman -Qdtq 2>/dev/null) && [ -n "$orphans" ]; do
+      pacman -Rns $orphans --noconfirm
+      removed_any=1
+    done
+    if [ "$removed_any" -eq 1 ]; then
+      echo "removed_orphans"
+    else
+      echo "no_orphans"
+    fi
+  register: orphan_cleanup
+  changed_when: "'removed_orphans' in orphan_cleanup.stdout"

ansible/vars/main.yml

@@ -66,10 +66,117 @@ hyprland_packages:
   - pipewire-pulse
   - wireplumber
   - pavucontrol
-  - dolphin
   - egl-wayland
   - qt5-wayland
   - qt6-wayland
+  - chafa
+  - 7zip
+  - resvg
+  - udisks2
+
+# X11 packages to remove (Wayland-only environment)
+# Tier 1: no dependents, no active use — ADR 0007
+hyprland_packages_remove:
+  # X11 clipboard (replaced by wl-clipboard)
+  - xclip
+  - xsel
+  # X11 display managers (replaced by greetd+tuigreet)
+  - lightdm
+  - lightdm-slick-greeter
+  - lightdm-settings
+  - sddm
+  - sddm-kcm
+  - sddm-breath-theme
+  # X11 video drivers (not used; Xwayland renders via Mesa)
+  - xf86-video-amdgpu
+  - xf86-video-ati
+  - xf86-video-intel
+  - xf86-video-nouveau
+  - xf86-video-vesa
+  # X11 input driver (superseded by libinput)
+  - xf86-input-synaptics
+  # X11 tools (no X11 session exists)
+  - xterm
+  - xorg-twm
+  - xorg-xinit
+  - xorg-xkill
+  - x11vnc
+  - numlockx
+  - startup-notification
+  - xorg-server-xvfb
+  # Legacy wallpaper
+  - illyria-wallpaper
+  # Redundant NTP (systemd-timesyncd is active)
+  - ntp
+  # KDE screenshot (replaced by grim+slurp+grimblast)
+  - spectacle
+  # KDE pamac tray (paru is AUR helper; pamac not running)
+  - pamac-tray-icon-plasma
+  # Tier 2: KDE Plasma stack (replaced by Hyprland native tools) — ADR 0007
+  # Dolphin and kdegraphics-thumbnailers are kept (no plasma-workspace dep)
+  - kwin
+  - plasma-desktop
+  - plasma-workspace
+  - kdeplasma-addons
+  - plasma-nm
+  - plasma-pa
+  - plasma-x11-session
+  - kde-gtk-config
+  - powerdevil
+  - xdg-desktop-portal-kde
+  - plasma-integration
+  # Dolphin file manager replaced by yazi; kdegraphics-thumbnailers was dolphin-only
+  - dolphin
+  - dolphin-plugins
+  - kdegraphics-thumbnailers
+  # Tier 2b: KDE screen management (replaced by wlr-randr/hyprlock) — ADR 0007
+  - kscreen
+  - kscreenlocker
+  # Tier 3: no active use, no dependents — ADR 0007
+  # Ruby: entire stack including subpackages (no active Ruby usage)
+  - ruby
+  - ruby-abbrev
+  - ruby-base64
+  - ruby-bigdecimal
+  - ruby-bundled-gems
+  - ruby-bundler
+  - ruby-csv
+  - ruby-debug
+  - ruby-default-gems
+  - ruby-drb
+  - ruby-erb
+  - ruby-getoptlong
+  - ruby-irb
+  - ruby-matrix
+  - ruby-minitest
+  - ruby-mutex_m
+  - ruby-net-ftp
+  - ruby-net-imap
+  - ruby-net-pop
+  - ruby-net-smtp
+  - ruby-nkf
+  - ruby-observer
+  - ruby-power_assert
+  - ruby-prime
+  - ruby-racc
+  - ruby-rake
+  - ruby-rbs
+  - ruby-rdoc
+  - ruby-repl_type_completor
+  - ruby-resolv-replace
+  - ruby-rexml
+  - ruby-rinda
+  - ruby-rss
+  - ruby-stdlib
+  - ruby-syslog
+  - ruby-test-unit
+  - ruby-typeprof
+  - rubygems
+  # LOVE game engine (no .love files on disk)
+  - love
+  # X11 server (no longer required; xorg-xwayland is independent)
+  - xorg-server
+  - xf86-input-libinput
 
 # ---------------------------------------------------------------------------
 # greetd role: display manager - minimal TUI greeter for Wayland