docs(caddy): add agent0.localhost reverse proxy + RFC 6761 wildcard learning

- New site: https://agent0.localhost -> reverse_proxy 192.168.0.141:8090 (first non-localhost backend; remote LAN host running uvicorn) - Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf - Regenerated mkcert cert: 19 -> 20 SANs, valid until 2028-10-21 - Key learning: *.localhost wildcard is NOT honored by curl/system trust even for single-label subdomains - .localhost is a special-use TLD per RFC 6761; every subdomain needs an explicit SAN. Corrects prior assumption in stack.md and manual-overrides.md. Updates: docs/tech/stack.md, docs/tech/manual-overrides.md, CHANGELOG.md
docs: add memory inventory and migration log
2026-07-21 14:08:07 +02:00 · 2026-07-13 17:29:00 +02:00 · 2026-07-12 13:10:21 +02:00 · 2026-07-09 11:01:51 +02:00 · 2026-07-06 09:33:56 +02:00 · 2026-07-06 09:14:13 +02:00
59 changed files with 10845 additions and 227 deletions
@@ -33,3 +33,8 @@ __pycache__/
 # AI Agent memory
 .junie/
 # LibreOffice lock files
 .~lock.*#
 /.quarto/
@@ -14,6 +14,10 @@ This repository manages the infrastructure, configuration, and maintenance for M
 |------|---------|
 | Apply Configuration | `ansible-playbook ansible/workstation.yml` |
 | System Maintenance | `bash scripts/maintenance.sh` |
 | Package Cleanup (dry-run) | `bash scripts/cleanup.sh --check` |
 | Package Cleanup (apply) | `bash scripts/cleanup.sh --apply` |
 | NVIDIA Recovery (broken GUI) | `bash scripts/nvidia-recovery.sh --apply` |
 | **Post-recovery** | **Reboot required to restore GUI login** |
 | Verify Ansible | `ansible-playbook ansible/workstation.yml --check` |
 ## Standards
@@ -25,8 +29,90 @@ This repository manages the infrastructure, configuration, and maintenance for M
 - **NEVER** commit raw secrets to the repository.
 - **ALWAYS** run Ansible with `--check` before applying changes.
 - **NEVER** modify system configuration directly if it can be managed via Ansible.
 - **Secrets Management**: All secrets stored in Bitwarden (`bitwarden.jantec.xyz`) and cached locally in `gnome-keyring` (D-Bus secrets service). See `docs/product/passwords.md` for details.
 ## Rules Hierarchy
 - Global rules: `Rules/`
 - Project rules: `.clinerules/`
 - Agent instructions: `AGENTS.md` (this file)
 # DOX Framework
 ## Core Contract
 - AGENTS.md files are binding work contracts for their subtrees
 - Work products, source materials, instructions, records, assets, and durable docs must stay understandable from the nearest applicable AGENTS.md plus every parent AGENTS.md above it
 ## Read Before Editing
 1. Read the root AGENTS.md
 2. Identify every file or folder you expect to touch
 3. Walk from the repository root to each target path
 4. Read every AGENTS.md found along each route
 5. If a parent AGENTS.md lists a child AGENTS.md whose scope contains the path, read that child and continue from there
 6. Use the nearest AGENTS.md as the local contract and parent docs for repo-wide rules
 7. If docs conflict, the closer doc controls local work details, but no child doc may weaken DOX
 Do not rely on memory. Re-read the applicable DOX chain in the current session before editing.
 ## Update After Editing
 Every meaningful change requires a DOX pass before the task is done.
 Update the closest owning AGENTS.md when a change affects:
 - purpose, scope, ownership, or responsibilities
 - durable structure, contracts, workflows, or operating rules
 - required inputs, outputs, permissions, constraints, side effects, or artifacts
 - user preferences about behavior, communication, process, organization, or quality
 - AGENTS.md creation, deletion, move, rename, or index contents
 Update parent docs when parent-level structure, ownership, workflow, or child index changes. Update child docs when parent changes alter local rules. Remove stale or contradictory text immediately. Small edits that do not change behavior or contracts may leave docs unchanged, but the DOX pass still must happen.
 ## Hierarchy
 - Root AGENTS.md is the DOX rail: project-wide instructions, global preferences, durable workflow rules, and the top-level Child DOX Index
 - Child AGENTS.md files own domain-specific instructions and their own Child DOX Index
 - Each parent explains what its direct children cover and what stays owned by the parent
 - The closer a doc is to the work, the more specific and practical it must be
 ## Child Doc Shape
 - Create a child AGENTS.md when a folder becomes a durable boundary with its own purpose, rules, responsibilities, workflow, materials, or quality standards
 - Work Guidance must reflect the current standards of the project or user instructions; if there are no specific standards or instructions yet, leave it empty
 - Verification must reflect an existing check; if no verification framework exists yet, leave it empty and update it when one exists
 Default section order:
 - Purpose
 - Ownership
 - Local Contracts
 - Work Guidance
 - Verification
 - Child DOX Index
 ## Style
 - Keep docs concise, current, and operational
 - Document stable contracts, not diary entries
 - Put broad rules in parent docs and concrete details in child docs
 - Prefer direct bullets with explicit names
 - Do not duplicate rules across many files unless each scope needs a local version
 - Delete stale notes instead of explaining history
 - Trim obvious statements, repeated rules, misplaced detail, and warnings for risks that no longer exist
 ## Closeout
 1. Re-check changed paths against the DOX chain
 2. Update nearest owning docs and any affected parents or children
 3. Refresh every affected Child DOX Index
 4. Remove stale or contradictory text
 5. Run existing verification when relevant
 6. Report any docs intentionally left unchanged and why
 ## User Preferences
 When the user requests a durable behavior change, record it here or in the relevant child AGENTS.md
 ## Child DOX Index
 No child AGENTS.md files found. The root AGENTS.md covers the entire project scope.
@@ -7,14 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 ### Fixed
 - Fixed Hyprland configuration warning/error by changing the DVI-D-1 monitor `transform` property from a string `"1"` to an integer `1` (2026-07-09).
 - tuigreet boot error: removed invalid `--numlock` flag from greetd config (not a valid tuigreet parameter). Replaced X11-only `numlockx on` in Hyprland with native `numlock_by_default = true` in the `input` section (2026-06-01).
 - hypridle SEGV crash loop (ADR N/A, hotfix): sdbus-cpp 2.3.0 had an ABI incompatibility causing hypridle to SIGSEGV in `libsdbus-c++.so.2` `registerSignalHandler`. Fixed by upgrading sdbus-cpp from 2.3.0-1 to 2.3.1-1 (Arch upstream, pulled ahead of Manjaro mirror sync). Also resolves latent ABI issues for hyprlock and xdg-desktop-portal-hyprland (2026-05-22).
 - Resolved kitty cursor keys not working by disabling the `TERM=xterm-256color` override in `.bashrc`, allowing Kitty to correctly set `TERM=xterm-kitty`. Added Ansible management for `kitty.conf` to ensure proper terminal behavior and shell integration (2026-05-19).
 - `system-upgrade` role: GRUB menu assertion now matches Manjaro's real `menuentry 'Manjaro Linux (Kernel: X.Y.Z-MANJARO x64)'` format (counted per-kernel-family) instead of the wrong `menuentry .*linux(612|70)` regex that always returned 0 hits on Manjaro and broke the live run with a false-negative failure (2026-05-18).
 - `system-upgrade` role: migration task `changed_when` now matches pacman's progress lines `^<!--(SECTION)-->(N/M)<!--(--SECTION)-->s+(installing|upgrading|removing)s` instead of plain substring matching, so the role's own echo lines no longer trigger spurious `changed=true` on idempotent re-runs. Verified: second live re-run reports `ok=16 changed=0 failed=0 skipped=5` (2026-05-18).
 - Resolved system unresponsiveness issue by addressing critical memory/swap pressure with increased headroom and proactive OOM killing (2026-03-17).
 - Identified failed `archlinux-keyring-wkd-sync.service` in system health check.
 ### Added
 - Added `agent0.localhost` (-> `reverse_proxy 192.168.0.141:8090`, `flush_interval -1`) to Caddy in a dedicated file `/etc/caddy/conf.d/agent0.localhost.conf`. First non-localhost backend (remote LAN host running a uvicorn app). Regenerated mkcert cert to add explicit `agent0.localhost` SAN; cert now has 20 SANs, valid until 2028-10-21 (2026-07-21). Key learning: the `*.localhost` wildcard is NOT honored by curl/system trust even for single-label subdomains - `.localhost` is a special-use TLD per RFC 6761, so every subdomain needs an explicit SAN. This corrects the prior assumption in `docs/tech/stack.md` and `docs/tech/manual-overrides.md` that single-label subdomains were wildcard-covered. Total `*.localhost` sites now 18.
 - Regenerated mkcert cert at `/etc/caddy/localhost{,-key}.pem` to add explicit SANs for `platform.localhost`, `packages.localhost`, and `onlyoffice.docs.localhost` (pre-existing in Caddy config but missing from cert, causing TLS validation failures). Cert now has 19 SANs, valid until 2028-10-12 (2026-07-12).
 - Added `platform.localhost` (-> `localhost:10080`, amicron-platform Docker) and `packages.localhost` (-> `localhost:20080`, satis Docker) to `/etc/caddy/conf.d/localhost-dev.conf`. Docker port mappings updated: `~/internal/amicron-platform/docker-compose.override.yml` `10080:80`, `~/internal/satis/docker-compose.yml` nginx `20080:80`. Both upstreams plain HTTP on high ports; Caddy terminates TLS. Also documented `onlyoffice.docs.localhost` in `docs/tech/stack.md` (pre-existing in Caddy config, was undocumented). Total `*.localhost` sites now 17. The three form the local E2E test triangle: `platform.localhost` (ERP) -> `packages.localhost` (Satis) -> shared Firebird 3.0.14 database (token validation), mirroring the production `platform.auc.de` + `packages.auc.de` + shared Firebird setup (2026-07-12).
 - Enabled click-and-drag window movement and resizing under the SUPER modifier, and enabled border dragging to resize tiled windows natively, updating both the Hyprland configuration template and keybindings cheatsheet (2026-07-09).
 - Documented local dev services in `docs/tech/stack.md`: Caddy (systemd `caddy.service` on port 443) with 14 `*.localhost` sites and mkcert TLS at `/etc/caddy/`. Registered as a manual override in `docs/tech/manual-overrides.md` (no `caddy` Ansible role exists yet) (2026-07-06).
 - Investigation learning record `docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-investigation.md`: Caddy `context canceled` SSE aborts (~1.5ms) on `onlyoffice.localhost/mcp` forwarded to `localhost:3847` (OnlyOffice MCP server). Upstream verified alive (HTTP 406 to plain GET = expected). Handed off to GitLab issue [satware/mcp/onlyoffice#92](https://gitlab.satware.com/satware/mcp/onlyoffice/-/work_items/92) with 5 hypotheses, 7 investigation tasks, and a proposed Caddy `flush_interval -1` + `transport http { versions 1.1 }` mitigation (not applied yet) (2026-07-06).
 - Waybar USB module: auto-mount USB sticks via udisks2, show hover details (device/model/size/fs/mountpoint), left-click opens in yazi, right-click ejects. Script at `~/.config/waybar/scripts/usb.sh`, Ansible-managed via `hyprland` role template `waybar_usb_script.sh.j2` (2026-05-22).
 - `udisks2` explicitly listed in `hyprland_packages` (was transitive dep of Dolphin; now direct dep of USB module) (2026-05-22).
 - Yazi optional deps provisioned via Ansible: `chafa`, `7zip`, `resvg` added to `hyprland_packages` (2026-05-22).
 - X11 package removal list `hyprland_packages_remove` in `ansible/vars/main.yml` with corresponding task in `hyprland` role — removes `xclip` and `xsel` on Wayland-only system (2026-05-22).
 - ADR 0006: Chrome/Chromium normalization and cleanup decision record (2026-05-22).
 - New Ansible role `ansible/roles/system-upgrade/` that runs as the **first** role in `workstation.yml`. Performs a full `pacman -Syu`, dual-installs `linux612` (LTS, fallback) and `linux70` (stable, new default) kernels with matching headers, and verifies both initramfs images and GRUB menu entries post-install. Invoke stand-alone with `ansible-playbook ansible/workstation.yml --tags system-upgrade`; idempotent on re-runs (2026-05-18).
 - `docs/adr/0002-kernel-and-nvidia-strategy.md` — ADR documenting the LTS+stable kernel choice and the `575xx → 595.71` NVIDIA migration for Hyprland/Wayland preparation (2026-05-18).
 - Pre-flight safety gate in the new role: aborts if free space on `/` drops below `min_free_root_gb` (5 GiB by default) (2026-05-18).
 - Comprehensive NVMe benchmark for Samsung PM9A1 before firmware update: SMART health, hdparm, fio seq/rand benchmarks (2026-04-02). See `docs/tech/nvme-benchmark-pre-gxa7802q.md`.
 - CLI suite update script `scripts/update-cli-suite.sh` for Manjaro/Arch tool maintenance (2026-04-02).
 - Created formal stability tests report documenting the 2026-03-17 memory management improvements (2026-03-17).
 - System stability improvements: enabled `systemd-oomd` and `zswap` via Ansible (2026-03-17).
 - Memory resource limits for Firebird and Mailpit Docker containers (2026-03-17).
 - Implemented and verified advanced memory optimizations: zswap 30% pool, THP madvise, and proactive kernel reclaim tuning (2026-03-17).
 - Integrated 16GB swap file management into Ansible roles for consistency and persistence (2026-03-17).
 - Comprehensive health report for `mw-pfeddersheim-workstation` (2026-03-09).
 ### Removed
 - Moved workstation-specific cheatsheets (`hyprland-keybindings.md`, `screenshot-cheatsheet.md`, `yazi-cheatsheet.md`, and the obsolete workstation copy of `neovim-cheatsheet.md`) to the central `learn` repository (2026-07-09).
 - `alesi-routine-morning.service` / `alesi-routine-morning.timer` user-level systemd units — daily 07:45 morning routine was failing (exit 128, git outside repo). Script `scripts/daily-routine.sh` retained for manual use (2026-05-26).
 - Tier 1 package cleanup (ADR 0007): removed 25 X11/KDE/legacy packages via Ansible — lightdm, lightdm-slick-greeter, lightdm-settings, sddm, sddm-kcm, sddm-breath-theme, xf86-video-{amdgpu,ati,intel,nouveau,vesa}, xf86-input-synaptics, xterm, xorg-{twm,xinit,xkill,server-xvfb}, x11vnc, numlockx, startup-notification, illyria-wallpaper, ntp, spectacle, pamac-tray-icon-plasma. All have Wayland-native replacements already in use. Frees ~80-120 MiB direct + cascade deps (2026-05-22).
 - Tier 2 package cleanup (ADR 0007): removed KDE Plasma stack — kwin, plasma-desktop, plasma-workspace, kdeplasma-addons, plasma-nm, plasma-pa, plasma-x11-session, kde-gtk-config, powerdevil, xdg-desktop-portal-kde, plasma-integration, dolphin, dolphin-plugins, kdegraphics-thumbnailers. Plus 45 cascade orphan deps. Dolphin replaced by yazi. Frees ~400 MiB total (2026-05-22).
 - Tier 3 package cleanup (ADR 0007): removed ruby (38 packages), love, xorg-server, xf86-input-libinput. No active Ruby usage; no .love files; xorg-server no longer required (xorg-xwayland is independent). Frees ~30 MiB (2026-05-22).
 - Tier 2b: removed kscreen, kscreenlocker (KDE screen management) + 10 cascade orphan deps (libkscreen, kdeclarative, plasma5support, libksysguard, etc.). Freed 35 MiB. Replaced by wlr-randr/hyprlock (2026-05-22).
 - Removed stale `org.kde.kwalletd6.service` D-Bus stub from `~/.local/share/dbus-1/services/` (was a broken `Exec=/bin/true` placeholder) (2026-05-22).
 - Disabled `bluetooth.service` (no BT hardware) and `NetworkManager-wait-online.service` (unnecessary on wired workstation, speeds up boot) (2026-05-22).
 - Documented PCIe slot misconfiguration: GPU (GTX 1050 Ti) installed in bottom PCIEX4 slot (PCIe 2.0 x4, ~2 GB/s) instead of top PCIEX16 (PCIe 3.0 x16, ~16 GB/s). 8x bandwidth loss. Physical move required. NVMe also running at Gen2 instead of Gen3 (2026-05-22).
 ### Changed
 - Tier 4 package reclassification (ADR 0007): 13 "Misc" packages reclassified to functional domains in `docs/tech/stack.md` — uv→Python Toolchain, jq→Shell/Terminal, inxi→Hardware, lsof/zram-generator/mkinitcpio-openswap→Core OS, iproute2/openresolv→Network, perl-image-exiftool/icoutils/innoextract-git→Dev Tools, opencl-headers→GPU Compute, libxnvctrl-580xx→NVIDIA. No packages removed; documentation-only change (2026-05-22).
 - Chrome/Chromium normalization: removed all Chromium artifacts — `~/.config/chromium/` (1.4 GB), `~/.local/chrome-cdp/` (8.6 GB), 13 broken PWA `.desktop` files, 4 stale PWA manifests from Chrome Preferences, `chromium-widevine` orphan package (17 MB). System now uses `google-chrome-stable` exclusively with Wayland-native flags (2026-05-22).
 - `~/.bashrc`: removed dead `BROWSER_CDP_URL` auto-population (curl to localhost:9222 on every shell startup) (2026-05-22).
 - `~/.config/chrome-flags.conf`: restored Ansible-managed Wayland flags (`--ozone-platform=auto`, VA-API on NVIDIA, `--use-angle=gl`, Vulkan disable) — was drifted to X11 mode with garbage flags (2026-05-22).
 - Waybar config: added `custom/usb` module to `modules-right` bar (2026-05-22).
 - Waybar style: added CSS for `#custom-usb` with hover state and color classes (`usb-none`, `usb-unmounted`, `usb-mounted`) (2026-05-22).
 - **Executed `system-upgrade` playbook on the live workstation** (2026-05-18). `pacman -Syu` upgraded **1103 packages**; kernel set now `linux612 6.12.85-1` (LTS, was 6.12.77-1) + `linux70 7.0.3-1` (NEW); NVIDIA migrated to mainline `595.71.05` for both `linux612-nvidia` and `linux70-nvidia`; legacy `*-nvidia-575xx` packages removed. Both `/boot/initramfs-6.12-x86_64.img` (54 MB) and `/boot/initramfs-7.0-x86_64.img` (122 MB) generated; GRUB regenerated with menuentries for both kernels. **Reboot required**: select `linux70` from the GRUB "Advanced options for Manjaro Linux" submenu to activate the new kernel and NVIDIA 595.71.05 modules. Logs: `logs/system-upgrade-20260518-101253-live.log`.
 - NVIDIA driver migrated from the pinned `*-nvidia-575xx` (575.64.05) branch to the mainline `*-nvidia` (595.71.05) branch via the new `system-upgrade` role. `linux612-nvidia-575xx`, `nvidia-575xx-utils`, `lib32-nvidia-575xx-utils`, `nvidia-575xx-settings` are removed; `linux612-nvidia`, `linux70-nvidia`, `nvidia-utils`, `lib32-nvidia-utils`, `opencl-nvidia`, `nvidia-settings` are installed in one atomic pacman transaction (2026-05-18).
 - `ansible/workstation.yml`: `system-upgrade` registered as the first role, guarded by `when: os_type == 'archlinux'`, with tag `system-upgrade` (2026-05-18).
@@ -23,24 +67,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Samsung PM9A1 NVMe firmware update applied: GXA7401Q → GXA7801Q (non-SED variant, reboot pending to activate). All nvme-cli steps succeeded (2026-04-02).
 - Corrected firmware research: GXA7802Q is SED-only (`00B07`); non-SED drives (`00B00`) require GXA7801Q. Updated `docs/tech/firmware-update-research.md` with naming convention and correct source.
 - Updated `.gitignore`: added `logs/` and `docs/tech/capabilities/` exclusions (2026-04-02).
 ### Added (continued)
 - Created formal stability tests report documenting the 2026-03-17 memory management improvements (2026-03-17).
 - System stability improvements: enabled `systemd-oomd` and `zswap` via Ansible (2026-03-17).
 - Memory resource limits for Firebird and Mailpit Docker containers (2026-03-17).
 - Implemented and verified advanced memory optimizations: zswap 30% pool, THP madvise, and proactive kernel reclaim tuning (2026-03-17).
 - Integrated 16GB swap file management into Ansible roles for consistency and persistence (2026-03-17).
 - Comprehensive health report for `mw-pfeddersheim-workstation` (2026-03-09).
 ### Changed (continued)
 - Increased system swap file size from 4GB to 16GB to prevent OOM-related system hangs (2026-03-17).
 - Updated system status in `README.md` and `docs/tech/workstation-health.md` (2026-03-17).
 - Cleaned up deprecated software information from `docs/tech/stack.md` (2026-03-13).
 - Synchronized software versions across documentation files (2026-03-13).
 ### Fixed
 - Resolved kitty cursor keys not working by disabling the `TERM=xterm-256color` override in `.bashrc`, allowing Kitty to correctly set `TERM=xterm-kitty`. Added Ansible management for `kitty.conf` to ensure proper terminal behavior and shell integration (2026-05-19).
 - `system-upgrade` role: GRUB menu assertion now matches Manjaro's real `menuentry 'Manjaro Linux (Kernel: X.Y.Z-MANJARO x64)'` format (counted per-kernel-family) instead of the wrong `menuentry .*linux(612|70)` regex that always returned 0 hits on Manjaro and broke the live run with a false-negative failure (2026-05-18).
 - `system-upgrade` role: migration task `changed_when` now matches pacman's progress lines `^\(N/M\)\s+(installing|upgrading|removing)\s` instead of plain substring matching, so the role's own echo lines no longer trigger spurious `changed=true` on idempotent re-runs. Verified: second live re-run reports `ok=16 changed=0 failed=0 skipped=5` (2026-05-18).
 - Resolved system unresponsiveness issue by addressing critical memory/swap pressure with increased headroom and proactive OOM killing (2026-03-17).
 - Identified failed `archlinux-keyring-wkd-sync.service` in system health check.
@@ -8,7 +8,7 @@ tags:
  - infrastructure-as-code
  - linux
  - automation
-last_updated: '2026-03-17'
+last_updated: '2026-06-17'
 ---
 # saTway® Infrastructure - mw-pfeddersheim-workstation
@@ -34,25 +34,22 @@ bash scripts/daily-routine.sh morning-full
 bash scripts/daily-routine.sh eod
 ```
 ## 📊 Current Status (2026-03-17)
 - **System Health**: ✅ Healthy (Load: 0.40, Disk: 84% used, Memory: 19% used, Swap: 16GB)
 - **Active Containers**: 6 running (with memory limits)
 - **Network**: Tailscale active
 ## 📂 Project Structure
 | Directory | Purpose |
 |-----------|---------|
-| `ansible/` | Configuration-as-Code (Roles: `common`, `dev-tools`, `maintenance`) |
+| `ansible/` | Configuration-as-Code (Roles: `system-upgrade`, `common`, `dev-tools`, `maintenance`, `fonts`, `pdf`, `hyprland`, `greetd`) |
 | `config/` | System configuration templates (`.j2`) |
-| `docs/` | PARA-structured documentation (`product`, `adr`, `learnings`, `tech`) |
+| `docs/` | PARA-structured documentation (`product`, `adr`, `learnings`, `tech`, `workflows`, `plans`) |
 | `scripts/` | Maintenance and automation scripts |
 ## 🛠 Software Stack
- **Languages**: Node.js 22 LTS, Python 3.12+, PHP 8.4
+- **Languages**: Node.js 25.6.1, Python 3.14.3, PHP 8.5.3 (CLI)
 - **Automation**: Ansible, Docker
 - **Desktop**: Hyprland (Wayland), greetd + tuigreet, Waybar, Kitty
 - **Kernel**: linux618 (LTS fallback) + linux70 (daily driver)
 - **NVIDIA**: 580xx branch (Pascal/GT 1050 Ti)
 - **Environment**: Manjaro/Arch Linux, Bash
 ## 📜 Core Principles
@@ -0,0 +1,20 @@
 project:
  type: default
  output-dir: "./docs/pdf-output"
 format:
  typst-pdf:
    default: true
    toc: false
    number-sections: true
    mainfont: "Inter"
    monofont: "JetBrains Mono"
    fontsize: 9pt
    papersize: a4
    margin:
      top: 1.2cm
      bottom: 1.2cm
      left: 1.5cm
      right: 1.5cm
 lang: de
@@ -1,4 +1,24 @@
 ---
 - name: Ensure kitty config directory exists
  file:
    path: "{{ ansible_env.HOME }}/.config/kitty"
    state: directory
    owner: "{{ local_user }}"
    group: "{{ local_user }}"
    mode: '0755'
  tags: [kitty, terminal]
 - name: Deploy kitty configuration
  template:
    src: kitty.conf.j2
    dest: "{{ ansible_env.HOME }}/.config/kitty/kitty.conf"
    owner: "{{ local_user }}"
    group: "{{ local_user }}"
    mode: '0644'
  vars:
    kitty_config_dir: "{{ ansible_env.HOME }}/.config/kitty"
  tags: [kitty, terminal]
 - name: Check current swap file size
  stat:
    path: "{{ swap_file_path }}"
@@ -225,4 +245,14 @@
  shell: echo 30 > /sys/module/zswap/parameters/max_pool_percent
  become: yes
  changed_when: false
-  tags: [optimization, zswap]
+  tags: [optimization, zswap]
 - name: Ensure secrets management tools are installed
  community.general.pacman:
    name:
      # Secrets bridge (KWallet migration)
      - gnome-keyring
      # Bitwarden CLI client
      - rbw
    state: present
  tags: [secrets, bitwarden]
@@ -0,0 +1,17 @@
 # Managed by Ansible - saTway DevOps
 shell bash
 editor vim
 # Shell integration is enabled by default in kitty 0.24.0+
 # but we can explicitly enable it for clarity.
 shell_integration enabled
 # Ensure cursor keys work correctly by not overriding TERM in shell
 # (Handled via .bashrc fix)
 # Window title bar — show hostname + cwd on every tile
 window_title_bar top
 window_title_bar_min_windows 1
 window_title_template "{hostname} | {cwd} | {title}"
 include {{ kitty_config_dir }}/kitty-cline-keybindings.conf
@@ -51,6 +51,10 @@
      - wp-cli
      # C/C++ toolchain (cpp skill)
      - clang
      # Windows installer inspection (amicron-version-inspection skill)
      - perl-image-exiftool
      - icoutils
      - innoextract-git
      # CalDAV tools (caldav-webcal skill)
      - khal
      - vdirsyncer
@@ -60,6 +64,9 @@
      - f3d
      # Terminal
      - kitty
      # NVIDIA VA-API video decode for Chrome on Wayland
      - libva-utils
      - libva-nvidia-driver
    state: present
 - name: Ensure Node.js global CLI tools are installed
@@ -79,6 +86,14 @@
  changed_when: false
  tags: [python, pipx]
 - name: Ensure JetBrains Toolbox and IntelliJ IDEA Ultimate are installed from AUR
  become: true
  become_user: "{{ system_user }}"
  command: paru -S --noconfirm --needed jetbrains-toolbox intellij-idea-ultimate-edition
  changed_when: false
  failed_when: false
  tags: [jetbrains, aur]
 - name: Ensure redundant and non-core software is removed
  community.general.pacman:
    name:
@@ -93,7 +108,6 @@
      - bleachbit
      - reiserfsprogs
      - dmraid
      - onlyoffice-desktopeditors
      - virt-manager
      - guvcview
      - helvum
@@ -103,6 +117,7 @@
      - oha
      - unetbootin
      - ventoy
      - chromium-widevine
    state: absent
 - name: Ensure legacy editor packages are removed
@@ -113,18 +128,29 @@
      - code-marketplace
    state: absent
- name: Configure Chrome flags for WebGPU
+- name: Configure Chrome flags for NVIDIA Wayland acceleration
  copy:
    dest: "/home/{{ system_user }}/.config/chrome-flags.conf"
    content: |
-      --enable-unsafe-webgpu
+      --ozone-platform=wayland
-      --enable-vulkan
+      --disable-seccomp-filter-sandbox
-      --enable-features=Vulkan
+      --disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan
-      --ignore-gpu-blocklist
+      --use-angle=gl
      --enable-features=VaapiOnNvidiaGPUs,VaapiIgnoreDriverChecks,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoDecodeLinuxGL
      --password-store=gnome-libsecret
    owner: "{{ system_user }}"
    group: "{{ system_user }}"
    mode: '0644'
-  tags: [chrome, webgpu]
+  tags: [chrome, nvidia, wayland]
 - name: Remove dead BROWSER_CDP_URL from .bashrc
  ansible.builtin.lineinfile:
    path: "/home/{{ system_user }}/.bashrc"
    regexp: '.*BROWSER_CDP_URL.*'
    state: absent
  become: yes
  become_user: "{{ system_user }}"
  tags: [chrome, shell, cleanup]
 - name: Fix kitty cursor keys by removing TERM override in .bashrc
  ansible.builtin.lineinfile:
@@ -0,0 +1,17 @@
 ---
 - name: Ensure workstation fonts are installed
  community.general.pacman:
    name:
      # Primary UI font (Inter brand font)
      - inter-font
      # Code editor fonts
      - otf-cascadia-code
      - ttf-fira-code
      - otf-fira-mono
      # Sans-serif families
      - otf-fira-sans
      - adobe-source-sans-fonts
      # Serif fallback
      - tex-gyre-fonts
    state: present
  tags: [fonts, typography]
@@ -6,6 +6,12 @@
    update_cache: yes
  tags: [hyprland, packages]
 - name: Hyprland - remove X11 packages (Wayland-only)
  community.general.pacman:
    name: "{{ hyprland_packages_remove }}"
    state: absent
  tags: [hyprland, packages]
 - name: Hyprland - ensure configuration directories exist
  file:
    path: "/home/{{ system_user }}/.config/{{ item }}"
@@ -53,14 +59,23 @@
  notify: rebuild initramfs
  tags: [hyprland, nvidia]
- name: Hyprland - register Wayland session desktop entry
+- name: Hyprland - override Wayland session desktop entry (local user)
  # Overrides /usr/share/wayland-sessions/hyprland.desktop with start-hyprland
  # as the Exec target. This ensures Hyprland is launched through the watchdog
  # binary (start-hyprland) for proper crash diagnostics and signal handling.
  # XDG_DATA_DIRS priority: ~/.local/share > /usr/share.
  # See: docs/adr/0004-start-hyprland-override.md
  copy:
-    dest: /usr/share/wayland-sessions/hyprland.desktop
+    dest: /home/{{ system_user }}/.local/share/wayland-sessions/hyprland.desktop
    owner: "{{ system_user }}"
    group: "{{ system_user }}"
    mode: '0644'
    content: |
      [Desktop Entry]
      Name=Hyprland
      Comment=An intelligent dynamic tiling Wayland compositor
-      Exec=Hyprland
+      Exec=start-hyprland
      TryExec=start-hyprland
      Type=Application
      DesktopNames=Hyprland
  tags: [hyprland, session]
@@ -73,7 +88,7 @@
    group: "{{ system_user }}"
    mode: '0644'
  loop:
-    - { src: 'hyprland.conf.j2', dest: 'hypr/hyprland.conf' }
+    - { src: 'hyprland.lua.j2', dest: 'hypr/hyprland.lua' }
    - { src: 'hyprlock.conf.j2', dest: 'hypr/hyprlock.conf' }
    - { src: 'hypridle.conf.j2', dest: 'hypr/hypridle.conf' }
    - { src: 'hyprpaper.conf.j2', dest: 'hypr/hyprpaper.conf' }
@@ -91,3 +106,12 @@
    group: "{{ system_user }}"
    mode: '0755'
  tags: [hyprland, config]
 - name: Hyprland - deploy Waybar USB automount script
  template:
    src: 'waybar_usb_script.sh.j2'
    dest: "/home/{{ system_user }}/.config/waybar/scripts/usb.sh"
    owner: "{{ system_user }}"
    group: "{{ system_user }}"
    mode: '0755'
  tags: [hyprland, config]
@@ -4,9 +4,9 @@
 # 1. DP-1       TERRA 3280W  2560x1440@144  (0x0)
 # 2. DVI-D-1    BenQ BL2405  1920x1080@60   (rotated 90° CW, effective width 1080)
 # 3. HDMI-A-1   TERRA 3280W  2560x1440@144  (3640x0)
-monitor=DP-1,2560x1440@144,0x0,1
+monitor=DP-1,2560x1440@60,0x0,1
 monitor=DVI-D-1,1920x1080@60,2560x0,1,transform,1
-monitor=HDMI-A-1,2560x1440@144,3640x0,1
+monitor=HDMI-A-1,2560x1440@60,3640x0,1
 # Session services: hyprpaper, waybar, dunst, hypridle, hyprlauncher, cliphist
 # Managed by systemd user units under ~/.config/systemd/user/
@@ -25,6 +25,7 @@ input {
    kb_layout = de
    follow_mouse = 1
    sensitivity = 0
    numlock_by_default = true
 }
 device {
@@ -64,8 +65,9 @@ dwindle {
 # Keybindings
 $mainMod = SUPER
-bind = $mainMod, Q, exec, kitty
+bind = $mainMod, Q, killactive,
-bind = $mainMod, C, killactive,
+bind = $mainMod, T, exec, kitty
 bind = $mainMod, RETURN, exec, kitty
 bind = $mainMod, M, exit,
 bind = $mainMod, E, exec, kitty -e yazi
 bind = $mainMod, V, togglefloating,
@@ -0,0 +1,194 @@
 -- =========================================================================
 -- hyprland.lua - managed by Ansible
 -- Hyprland 0.55+ Lua config for mw-pfeddersheim-workstation
 -- SUPER = Windows key
 -- =========================================================================
 local terminal    = "kitty"
 local fileManager = "kitty -e yazi"
 local menu        = "hyprlauncher"
 local browser     = "google-chrome-stable"
 local mainMod     = "SUPER"
 -----------------
 ---- MONITORS ----
 -----------------
 -- 1. DP-1 TERRA 3280W 2560x1440@144 (0x0)
 -- 2. DVI-D-1 BenQ BL2405 1920x1080@60 (rotated 90 CW)
 -- 3. HDMI-A-1 TERRA 3280W 2560x1440@144 (3640x0)
 hl.monitor({ output = "DP-1",     mode = "2560x1440@60", position = "0x0",    scale = "1" })
 hl.monitor({ output = "DVI-D-1",  mode = "1920x1080@60", position = "2560x0", scale = "1", transform = 1 })
 hl.monitor({ output = "HDMI-A-1", mode = "2560x1440@60", position = "3640x0", scale = "1" })
 hl.workspace_rule({ workspace = 1, monitor = "DP-1",     default = true })
 hl.workspace_rule({ workspace = 2, monitor = "DVI-D-1",  default = true })
 hl.workspace_rule({ workspace = 3, monitor = "HDMI-A-1", default = true })
 -------------------------------
 ---- ENVIRONMENT VARIABLES ----
 -------------------------------
 hl.env("LIBVA_DRIVER_NAME", "nvidia")
 hl.env("XDG_SESSION_TYPE", "wayland")
 hl.env("GBM_BACKEND", "nvidia-drm")
 hl.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia")
 hl.env("WLR_NO_HARDWARE_CURSORS", "1")
 hl.env("NVD_BACKEND", "direct")
 ---------------
 ---- INPUT ----
 ---------------
 hl.config({
    input = {
        kb_layout  = "de",
        follow_mouse = 1,
        sensitivity = 0,
        numlock_by_default = true,
    },
 })
 hl.device({ name = "pixart-usb-optical-mouse", left_handed = 1 })
 -----------------------
 ---- LOOK AND FEEL ----
 -----------------------
 hl.config({
    general = {
        gaps_in = 5, gaps_out = 10, border_size = 2,
        col = {
            active_border   = { colors = {"rgba(33ccffee)", "rgba(00ff99ee)"}, angle = 45 },
            inactive_border = "rgba(595959aa)",
        },
        resize_on_border = true, allow_tearing = false, layout = "dwindle",
    },
    decoration = {
        rounding = 10, rounding_power = 2,
        active_opacity = 1.0, inactive_opacity = 1.0,
        shadow = { enabled = true, range = 4, render_power = 3, color = 0xee1a1a1a },
        blur = { enabled = true, size = 3, passes = 1, vibrancy = 0.1696 },
    },
    animations = { enabled = true },
 })
 hl.curve("easeOutQuint",   { type = "bezier", points = { {0.23,1},{0.32,1} } })
 hl.curve("easeInOutCubic", { type = "bezier", points = { {0.65,0.05},{0.36,1} } })
 hl.curve("linear",         { type = "bezier", points = { {0,0},{1,1} } })
 hl.curve("almostLinear",   { type = "bezier", points = { {0.5,0.5},{0.75,1} } })
 hl.curve("quick",          { type = "bezier", points = { {0.15,0},{0.1,1} } })
 hl.curve("easy",           { type = "spring", mass = 1, stiffness = 71.2633, dampening = 15.8273644 })
 hl.animation({ leaf = "global",        enabled = true, speed = 10,   bezier = "default" })
 hl.animation({ leaf = "border",        enabled = true, speed = 5.39, bezier = "easeOutQuint" })
 hl.animation({ leaf = "windows",       enabled = true, speed = 4.79, spring = "easy" })
 hl.animation({ leaf = "windowsIn",     enabled = true, speed = 4.1,  spring = "easy", style = "popin 87%" })
 hl.animation({ leaf = "windowsOut",    enabled = true, speed = 1.49, bezier = "linear", style = "popin 87%" })
 hl.animation({ leaf = "fadeIn",        enabled = true, speed = 1.73, bezier = "almostLinear" })
 hl.animation({ leaf = "fadeOut",       enabled = true, speed = 1.46, bezier = "almostLinear" })
 hl.animation({ leaf = "fade",          enabled = true, speed = 3.03, bezier = "quick" })
 hl.animation({ leaf = "layers",        enabled = true, speed = 3.81, bezier = "easeOutQuint" })
 hl.animation({ leaf = "layersIn",      enabled = true, speed = 4,    bezier = "easeOutQuint", style = "fade" })
 hl.animation({ leaf = "layersOut",     enabled = true, speed = 1.5,  bezier = "linear", style = "fade" })
 hl.animation({ leaf = "fadeLayersIn",  enabled = true, speed = 1.79, bezier = "almostLinear" })
 hl.animation({ leaf = "fadeLayersOut", enabled = true, speed = 1.39, bezier = "almostLinear" })
 hl.animation({ leaf = "workspaces",    enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
 hl.animation({ leaf = "workspacesIn",  enabled = true, speed = 1.21, bezier = "almostLinear", style = "fade" })
 hl.animation({ leaf = "workspacesOut", enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
 hl.animation({ leaf = "zoomFactor",    enabled = true, speed = 7,    bezier = "quick" })
 hl.config({ dwindle = { preserve_split = true } })
 hl.config({ master  = { new_status = "master" } })
 hl.config({ misc    = { force_default_wallpaper = 0, disable_hyprland_logo = true } })
 ---------------------
 ---- KEYBINDINGS ----
 ---------------------
 -- Core binds
 hl.bind(mainMod .. " + Q",      hl.dsp.window.close())
 hl.bind(mainMod .. " + T",      hl.dsp.exec_cmd(terminal))
 hl.bind(mainMod .. " + RETURN", hl.dsp.exec_cmd(terminal))
 hl.bind(mainMod .. " + M",      hl.dsp.exec_cmd("command -v hyprshutdown >/dev/null 2>&1 && hyprshutdown || hyprctl dispatch 'hl.dsp.exit()'"))
 hl.bind(mainMod .. " + E",      hl.dsp.exec_cmd(fileManager))
 hl.bind(mainMod .. " + V",      hl.dsp.window.float({ action = "toggle" }))
 hl.bind(mainMod .. " + D",      hl.dsp.exec_cmd(menu))
 hl.bind(mainMod .. " + P",      hl.dsp.window.pseudo())
 hl.bind(mainMod .. " + J",      hl.dsp.layout("togglesplit"))
 -- Worktime safers
 hl.bind(mainMod .. " + F",     hl.dsp.window.fullscreen({ mode = 0 }))
 hl.bind(mainMod .. " + R",     hl.dsp.exec_cmd("hyprctl reload"))
 hl.bind(mainMod .. " + SPACE", hl.dsp.window.float({ action = "toggle" }))
 hl.bind(mainMod .. " + TAB",   hl.dsp.exec_cmd("hyprctl dispatch cyclenext"))
 hl.bind(mainMod .. " + SHIFT + TAB", hl.dsp.exec_cmd("hyprctl dispatch cyclenext prev"))
 -- Scratchpad
 hl.bind(mainMod .. " + GRAVE",         hl.dsp.workspace.toggle_special("magic"))
 hl.bind(mainMod .. " + SHIFT + GRAVE", hl.dsp.window.move({ workspace = "special:magic" }))
 -- Home row focus
 hl.bind(mainMod .. " + H", hl.dsp.focus({ direction = "left" }))
 hl.bind(mainMod .. " + L", hl.dsp.focus({ direction = "right" }))
 -- Home row move window
 hl.bind(mainMod .. " + SHIFT + H", hl.dsp.window.move({ direction = "left" }))
 hl.bind(mainMod .. " + SHIFT + L", hl.dsp.window.move({ direction = "right" }))
 hl.bind(mainMod .. " + SHIFT + K", hl.dsp.window.move({ direction = "up" }))
 hl.bind(mainMod .. " + SHIFT + J", hl.dsp.window.move({ direction = "down" }))
 -- Home row resize
 hl.bind(mainMod .. " + ALT + H", hl.dsp.exec_cmd("hyprctl dispatch resizeactive -40 0"))
 hl.bind(mainMod .. " + ALT + L", hl.dsp.exec_cmd("hyprctl dispatch resizeactive 40 0"))
 hl.bind(mainMod .. " + ALT + K", hl.dsp.exec_cmd("hyprctl dispatch resizeactive 0 -40"))
 hl.bind(mainMod .. " + ALT + J", hl.dsp.exec_cmd("hyprctl dispatch resizeactive 0 40"))
 -- Arrow focus
 hl.bind(mainMod .. " + left",       hl.dsp.focus({ direction = "left" }))
 hl.bind(mainMod .. " + right",      hl.dsp.focus({ direction = "right" }))
 hl.bind(mainMod .. " + up",         hl.dsp.focus({ direction = "up" }))
 hl.bind(mainMod .. " + down",       hl.dsp.focus({ direction = "down" }))
 -- Arrow move window
 hl.bind(mainMod .. " + SHIFT + left",  hl.dsp.window.move({ direction = "left" }))
 hl.bind(mainMod .. " + SHIFT + right", hl.dsp.window.move({ direction = "right" }))
 hl.bind(mainMod .. " + SHIFT + up",    hl.dsp.window.move({ direction = "up" }))
 hl.bind(mainMod .. " + SHIFT + down",  hl.dsp.window.move({ direction = "down" }))
 -- Lock, browser
 hl.bind(mainMod .. " + CTRL + L", hl.dsp.exec_cmd("hyprlock"))
 hl.bind(mainMod .. " + B",        hl.dsp.exec_cmd(browser))
 -- Workspaces 1-9
 for i = 1, 9 do
    hl.bind(mainMod .. " + " .. i,         hl.dsp.focus({ workspace = i }))
    hl.bind(mainMod .. " + SHIFT + " .. i, hl.dsp.window.move({ workspace = i }))
 end
 -- Screenshots
 hl.bind("Print",                       hl.dsp.exec_cmd("grimblast copysave area"))
 hl.bind(mainMod .. " + Print",         hl.dsp.exec_cmd("grimblast copysave active"))
 hl.bind(mainMod .. " + SHIFT + Print", hl.dsp.exec_cmd("grimblast copysave output"))
 hl.bind(mainMod .. " + ALT + Print",   hl.dsp.exec_cmd('grim -g "$(slurp)" - | satty -f -'))
 -- Mouse binds
 hl.bind(mainMod .. " + mouse:272",     hl.dsp.window.drag(),   { mouse = true })
 hl.bind(mainMod .. " + mouse:273",     hl.dsp.window.resize(), { mouse = true })
 --------------------------------
 ---- WINDOW RULES ----
 --------------------------------
 hl.window_rule({
    name  = "suppress-maximize-events",
    match = { class = ".*" },
    suppress_event = "maximize",
 })
 hl.window_rule({
    name  = "fix-xwayland-drags",
    match = { class = "^$", title = "^$", xwayland = true, float = true, fullscreen = false, pin = false },
    no_focus = true,
 })
@@ -4,7 +4,7 @@
    "height": 30,
    "modules-left": ["hyprland/workspaces", "hyprland/mode"],
    "modules-center": ["hyprland/window"],
-    "modules-right": ["network", "cpu", "memory", "custom/gpu", "pulseaudio", "clock", "tray"],
+    "modules-right": ["network", "cpu", "memory", "custom/gpu", "pulseaudio", "custom/usb", "clock", "tray"],
    "hyprland/workspaces": {
        "disable-scroll": true,
        "all-outputs": true,
@@ -41,5 +41,14 @@
        "exec": "~/.config/waybar/scripts/gpu.sh",
        "interval": 5,
        "return-type": "json"
    },
    "custom/usb": {
        "exec": "~/.config/waybar/scripts/usb.sh",
        "interval": 10,
        "return-type": "json",
        "on-click": "~/.config/waybar/scripts/usb.sh open",
        "on-click-right": "~/.config/waybar/scripts/usb.sh eject",
        "format": "{}",
        "tooltip": true
    }
 }
@@ -21,10 +21,27 @@ window#waybar {
    border-bottom: 3px solid #ffffff;
 }
-#clock, #cpu, #memory, #network, #tray, #pulseaudio, #custom-gpu {
+#clock, #cpu, #memory, #network, #tray, #pulseaudio, #custom-gpu, #custom-usb {
    padding: 0 10px;
 }
 #pulseaudio:hover {
    background: #555;
 }
 #custom-usb:hover {
    background: #555;
 }
 #custom-usb.usb-none {
    color: transparent;
    padding: 0;
 }
 #custom-usb.usb-mounted {
    color: #a3be8c;
 }
 #custom-usb.usb-unmounted {
    color: #ebcb8b;
 }
@@ -0,0 +1,166 @@
 #!/usr/bin/env bash
 # Waybar USB module - automount, status, open in yazi, eject
 # Usage:
 #   usb.sh          -> JSON status for waybar poll (auto-mounts unmounted USBs)
 #   usb.sh open     -> open first mounted USB in yazi (via kitty)
 #   usb.sh eject    -> unmount + power-off all USB devices
 set -euo pipefail
 # --- helpers -------------------------------------------------------------------
 get_usb_devices() {
    # Returns JSON array of USB block devices via lsblk.
    # Fields: NAME, RM (removable), SIZE, LABEL, MOUNTPOINT, FSTYPE, TRAN, MODEL
    lsblk -Jbpno NAME,RM,SIZE,LABEL,MOUNTPOINT,FSTYPE,TRAN,MODEL 2>/dev/null \
        | jq -c '[.blockdevices[] | select(.tran == "usb")]'
 }
 auto_mount_unmounted() {
    local devices="$1"
    # Auto-mount any USB partition that isn't mounted yet
    local unmounted
    unmounted=$(echo "$devices" | jq -r '.[] | select(.mountpoint == null or .mountpoint == "") | .name')
    for dev in $unmounted; do
        udisksctl mount -b "$dev" --no-user-interaction 2>/dev/null || true
    done
 }
 # --- actions -------------------------------------------------------------------
 do_open() {
    # Open the first mounted USB in yazi via kitty
    local devices
    devices=$(get_usb_devices)
    local mountpoint
    mountpoint=$(echo "$devices" | jq -r '[.[] | select(.mountpoint != null and .mountpoint != "")] | first | .mountpoint // empty')
    if [ -z "$mountpoint" ]; then
        # Try children (partitions)
        mountpoint=$(lsblk -Jbpno NAME,RM,SIZE,LABEL,MOUNTPOINT,FSTYPE,TRAN,MODEL 2>/dev/null \
            | jq -r '[.blockdevices[] | select(.tran == "usb") | .children[]? | select(.mountpoint != null and .mountpoint != "")] | first | .mountpoint // empty')
    fi
    if [ -n "$mountpoint" ]; then
        kitty -e yazi "$mountpoint" &
        disown
    else
        notify-send "USB" "No mounted USB device found" -i dialog-warning
    fi
 }
 do_eject() {
    # Unmount all USB partitions, then power-off the parent device
    local devices
    devices=$(get_usb_devices)
    local mounted
    mounted=$(echo "$devices" | jq -r '.[] | select(.mountpoint != null and .mountpoint != "") | .name')
    # Also check children (partitions of whole disks)
    local child_mounted
    child_mounted=$(lsblk -Jbpno NAME,MOUNTPOINT,TRAN 2>/dev/null \
        | jq -r '[.blockdevices[] | select(.tran == "usb") | .children[]? | select(.mountpoint != null and .mountpoint != "")] | .[].name')
    for dev in $mounted $child_mounted; do
        udisksctl unmount -b "$dev" --no-user-interaction 2>/dev/null || true
    done
    # Power-off the whole USB devices
    local parent_devs
    parent_devs=$(echo "$devices" | jq -r '.[].name')
    for dev in $parent_devs; do
        udisksctl power-off -b "$dev" --no-user-interaction 2>/dev/null || true
    done
    notify-send "USB" "All USB devices ejected" -i media-eject
 }
 do_status() {
    local devices
    devices=$(get_usb_devices)
    # Auto-mount unmounted partitions
    auto_mount_unmounted "$devices"
    # Re-read after automount
    devices=$(get_usb_devices)
    # Count mounted USBs (check both top-level and children)
    local count=0
    local tooltip_lines=""
    # Top-level devices
    while IFS= read -r line; do
        if [ -z "$line" ] || [ "$line" = "null" ]; then continue; fi
        local name size label mount fstype model
        name=$(echo "$line" | jq -r '.name')
        size=$(echo "$line" | jq -r '.size')
        label=$(echo "$line" | jq -r '.label // "N/A"')
        mount=$(echo "$line" | jq -r '.mountpoint // "not mounted"')
        fstype=$(echo "$line" | jq -r '.fstype // "?"')
        model=$(echo "$line" | jq -r '.model // "USB" | gsub("^\\s+|\\s+$"; "")')
        if [ "$mount" != "not mounted" ]; then
            count=$((count + 1))
        fi
        tooltip_lines="${tooltip_lines}${name} ${model} ${size} [${fstype}]\nLabel: ${label}\nMount: ${mount}\n"
    done < <(echo "$devices" | jq -c '.[]')
    # Children (partitions)
    while IFS= read -r line; do
        if [ -z "$line" ] || [ "$line" = "null" ]; then continue; fi
        local name size label mount fstype
        name=$(echo "$line" | jq -r '.name')
        size=$(echo "$line" | jq -r '.size')
        label=$(echo "$line" | jq -r '.label // "N/A"')
        mount=$(echo "$line" | jq -r '.mountpoint // "not mounted"')
        fstype=$(echo "$line" | jq -r '.fstype // "?"')
        if [ "$mount" != "not mounted" ]; then
            count=$((count + 1))
        fi
        tooltip_lines="${tooltip_lines}  └ ${name} ${size} [${fstype}]\n    Label: ${label}\n    Mount: ${mount}\n"
    done < <(lsblk -Jbpno NAME,RM,SIZE,LABEL,MOUNTPOINT,FSTYPE,TRAN,MODEL 2>/dev/null \
        | jq -c '[.blockdevices[] | select(.tran == "usb") | .children[]?] | .[]')
    # Determine alt class
    local alt="usb-none"
    if [ "$count" -gt 0 ]; then
        alt="usb-mounted"
    elif [ -n "$tooltip_lines" ]; then
        alt="usb-unmounted"
    fi
    # Build JSON output
    local text icon
    if [ "$count" -gt 0 ]; then
        icon="󰋊"
        text="${icon} ${count}"
    elif [ -n "$tooltip_lines" ]; then
        icon="󰋊"
        text="${icon} !"
    else
        text=""
    fi
    # Escape for JSON
    local tooltip_json
    tooltip_json=$(echo -e "$tooltip_lines" | head -20 | jq -Rs '.')
    if [ -n "$text" ]; then
        printf '{"text":%s,"tooltip":%s,"alt":%s}\n' \
            "$(jq -n --arg t "$text" '$t')" \
            "$tooltip_json" \
            "$(jq -n --arg a "$alt" '$a')"
    else
        echo '{"text":"","tooltip":"","alt":"usb-none"}'
    fi
 }
 # --- main ----------------------------------------------------------------------
 case "${1:-}" in
    open)    do_open ;;
    eject)   do_eject ;;
    *)       do_status ;;
 esac
@@ -25,4 +25,29 @@
    - "journalctl --vacuum-time=7d"
  register: maintenance_result
  changed_when: "'deleted' in maintenance_result.stdout or 'Vacuuming' in maintenance_result.stdout"
-  failed_when: false
+  failed_when: false
 - name: Disable unused system services
  ansible.builtin.systemd_service:
    name: "{{ item }}"
    enabled: false
    state: stopped
  loop:
    - bluetooth.service
    - NetworkManager-wait-online.service
  failed_when: false
 - name: Remove orphaned dependencies (pacman -Rns, iterative)
  ansible.builtin.shell: |
    removed_any=0
    while orphans=$(pacman -Qdtq 2>/dev/null) && [ -n "$orphans" ]; do
      pacman -Rns $orphans --noconfirm
      removed_any=1
    done
    if [ "$removed_any" -eq 1 ]; then
      echo "removed_orphans"
    else
      echo "no_orphans"
    fi
  register: orphan_cleanup
  changed_when: "'removed_orphans' in orphan_cleanup.stdout"
@@ -0,0 +1,11 @@
 ---
 - name: Ensure PDF viewer and generation tools are installed
  community.general.pacman:
    name:
      # Minimal PDF viewer (Wayland-compatible)
      - zathura
      - zathura-pdf-mupdf
      # PDF generation from HTML/CSS
      - python-weasyprint
    state: present
  tags: [pdf, viewer, generation]
@@ -1,5 +1,6 @@
 # mw-pfeddersheim-workstation variables
 system_user: mw
 local_user: "{{ system_user }}"
 root_filesystem_uuid: 2aeade2e-b169-4964-8cbd-bb7356320b51
 root_filesystem_mount_opts: noatime
 swap_file_path: /swapfile
@@ -66,10 +67,117 @@ hyprland_packages:
  - pipewire-pulse
  - wireplumber
  - pavucontrol
  - dolphin
  - egl-wayland
  - qt5-wayland
  - qt6-wayland
  - chafa
  - 7zip
  - resvg
  - udisks2
 # X11 packages to remove (Wayland-only environment)
 # Tier 1: no dependents, no active use — ADR 0007
 hyprland_packages_remove:
  # X11 clipboard (replaced by wl-clipboard)
  - xclip
  - xsel
  # X11 display managers (replaced by greetd+tuigreet)
  - lightdm
  - lightdm-slick-greeter
  - lightdm-settings
  - sddm
  - sddm-kcm
  - sddm-breath-theme
  # X11 video drivers (not used; Xwayland renders via Mesa)
  - xf86-video-amdgpu
  - xf86-video-ati
  - xf86-video-intel
  - xf86-video-nouveau
  - xf86-video-vesa
  # X11 input driver (superseded by libinput)
  - xf86-input-synaptics
  # X11 tools (no X11 session exists)
  - xterm
  - xorg-twm
  - xorg-xinit
  - xorg-xkill
  - x11vnc
  - numlockx
  - startup-notification
  - xorg-server-xvfb
  # Legacy wallpaper
  - illyria-wallpaper
  # Redundant NTP (systemd-timesyncd is active)
  - ntp
  # KDE screenshot (replaced by grim+slurp+grimblast)
  - spectacle
  # KDE pamac tray (paru is AUR helper; pamac not running)
  - pamac-tray-icon-plasma
  # Tier 2: KDE Plasma stack (replaced by Hyprland native tools) — ADR 0007
  # Dolphin and kdegraphics-thumbnailers are kept (no plasma-workspace dep)
  - kwin
  - plasma-desktop
  - plasma-workspace
  - kdeplasma-addons
  - plasma-nm
  - plasma-pa
  - plasma-x11-session
  - kde-gtk-config
  - powerdevil
  - xdg-desktop-portal-kde
  - plasma-integration
  # Dolphin file manager replaced by yazi; kdegraphics-thumbnailers was dolphin-only
  - dolphin
  - dolphin-plugins
  - kdegraphics-thumbnailers
  # Tier 2b: KDE screen management (replaced by wlr-randr/hyprlock) — ADR 0007
  - kscreen
  - kscreenlocker
  # Tier 3: no active use, no dependents — ADR 0007
  # Ruby: entire stack including subpackages (no active Ruby usage)
  - ruby
  - ruby-abbrev
  - ruby-base64
  - ruby-bigdecimal
  - ruby-bundled-gems
  - ruby-bundler
  - ruby-csv
  - ruby-debug
  - ruby-default-gems
  - ruby-drb
  - ruby-erb
  - ruby-getoptlong
  - ruby-irb
  - ruby-matrix
  - ruby-minitest
  - ruby-mutex_m
  - ruby-net-ftp
  - ruby-net-imap
  - ruby-net-pop
  - ruby-net-smtp
  - ruby-nkf
  - ruby-observer
  - ruby-power_assert
  - ruby-prime
  - ruby-racc
  - ruby-rake
  - ruby-rbs
  - ruby-rdoc
  - ruby-repl_type_completor
  - ruby-resolv-replace
  - ruby-rexml
  - ruby-rinda
  - ruby-rss
  - ruby-stdlib
  - ruby-syslog
  - ruby-test-unit
  - ruby-typeprof
  - rubygems
  # LOVE game engine (no .love files on disk)
  - love
  # X11 server (no longer required; xorg-xwayland is independent)
  - xorg-server
  - xf86-input-libinput
 # ---------------------------------------------------------------------------
 # greetd role: display manager - minimal TUI greeter for Wayland
@@ -14,6 +14,8 @@
    - common
    - dev-tools
    - maintenance
    - fonts
    - pdf
    - role: hyprland
      tags: [hyprland]
    - role: greetd
@@ -14,7 +14,7 @@ alias k='kubectl'
 alias main='bash {{ workspace_root }}/scripts/maintenance.sh'
 # Environment
-export EDITOR='vim'
+export EDITOR='nvim'
 export PATH="$HOME/.local/bin:$PATH"
 # saTway indicators
@@ -1,7 +1,7 @@
 ---
 description: >-
-  Decision to dual-install linux612 (LTS) + linux70 (stable) kernels and
+  Decision to dual-install linux618 (LTS) + linux70 (stable) kernels and
-  migrate NVIDIA from the pinned 575xx branch to the mainline 595.71 branch
+  migrate NVIDIA from the pinned 575xx branch to the 580xx branch (NFB)
  to prepare the workstation for Hyprland/Wayland.
 tags:
  - adr
@@ -9,13 +9,13 @@ tags:
  - nvidia
  - hyprland
  - wayland
-last_updated: '2026-05-18'
+last_updated: '2026-06-17'
 ---
 # ADR 2: Kernel and NVIDIA Driver Strategy for Hyprland/Wayland
 ## Status
-Accepted (2026-05-18)
+Accepted (2026-05-18) — Updated (2026-06-17)
 ## Context
 The workstation runs Manjaro Linux on AMD Ryzen 7 2700X with an NVIDIA
@@ -25,14 +25,14 @@ Wayland. Two preconditions must hold before that switch is safe:
 1. **DRM/atomic and NVIDIA explicit-sync support** — Hyprland on NVIDIA
   relies on driver-level explicit sync (introduced in 555.x and matured
-   through 575.x and 595.x). Without it, flickering and missed vblanks
+   through 575.x, 580.x, and 595.x). Without it, flickering and missed vblanks
   are very common on Pascal+multi-monitor.
 2. **Matching kernel modules** — Manjaro ships pre-built `*-nvidia`
   modules pinned to a single `nvidia-utils` version. Mixing `575xx`
-   userspace with a kernel that only has `595.71` modules (or vice
+   userspace with a kernel that only has `580xx` modules (or vice
   versa) breaks the driver at the next kernel boot.
-The starting point at the time of this ADR:
+The starting point at the time of this ADR (2026-05-18):
 | Item                      | Version                |
 |---------------------------|------------------------|
@@ -43,17 +43,29 @@ The starting point at the time of this ADR:
 | `linux70-nvidia` available  | `595.71.05-0.1`      |
 | `linux612-nvidia` (mainline) | `595.71.05-2`       |
 Current state (2026-06-17):
 | Item                      | Version                |
 |---------------------------|------------------------|
 | Kernel packages           | `linux618`, `linux70`  |
 | NVIDIA driver branch      | `580xx` (NVIDIA Fast Branch) |
 | NVIDIA kernel module pkg  | `linux618-nvidia-580xx`, `linux70-nvidia-580xx` |
 | NVIDIA userspace packages | `nvidia-580xx-utils`, `lib32-nvidia-580xx-utils`, `opencl-nvidia-580xx`, `nvidia-580xx-settings` |
 | Legacy packages removed   | `*-nvidia-575xx` family (see `nvidia_packages_to_remove`) |
 ## Decision
 1. **Run two kernels side by side.**
-   - Keep `linux612` (LTS 6.12.x) installed as the *fallback* boot entry.
+   - Keep `linux618` (LTS 6.18.x) installed as the *fallback* boot entry.
   - Install `linux70` (stable 7.0.x) and select it as the daily-driver
     kernel via GRUB at the next reboot.
-2. **Migrate NVIDIA from the `575xx` branch to mainline `595.71`** in
+2. **Migrate NVIDIA from the `575xx` branch to `580xx` (NVIDIA Fast Branch)** in
   one atomic pacman transaction so both kernels have matching modules:
   - Remove: `linux612-nvidia-575xx`, `nvidia-575xx-utils`,
-     `lib32-nvidia-575xx-utils`, `nvidia-575xx-settings`.
+     `lib32-nvidia-575xx-utils`, `nvidia-575xx-settings`,
-   - Install: `linux612-nvidia`, `linux70-nvidia`, `nvidia-utils`,
+     and the entire `*-nvidia-575xx` family.
-     `lib32-nvidia-utils`, `opencl-nvidia`, `nvidia-settings`.
+   - Install: `linux618-nvidia-580xx`, `linux70-nvidia-580xx`,
     `nvidia-580xx-utils`, `lib32-nvidia-580xx-utils`,
     `opencl-nvidia-580xx`, `nvidia-580xx-settings`.
 3. **Do not change `GRUB_DEFAULT` programmatically.** The user picks
   `linux70` from the GRUB menu on first boot. If `linux70` misbehaves,
   the next reboot is one menu selection away from the proven LTS path.
@@ -63,17 +75,18 @@ The starting point at the time of this ADR:
   `--tags system-upgrade` and is safe on every subsequent run.
 ## Rationale
- **LTS as a parachute.** 6.12 is a Linux LTS series with a multi-year
+- **LTS as a parachute.** 6.18 is a Linux LTS series with a multi-year
  support window. Keeping it installed makes the migration reversible by
  one keystroke in GRUB.
 - **7.0 as the daily driver.** The 7.0 series brings the maturest
  DRM/atomic-modeset and NVIDIA explicit-sync paths that Hyprland on
  Pascal needs to avoid flicker on multi-monitor.
- **Mainline 595.71 over pinned 575.64.05.** Manjaro builds
+- **580xx over 595.71.** The NVIDIA Fast Branch (580xx) provides newer
-  `linux70-nvidia` only against `nvidia-utils=595.71.05`, so the 575xx
+  driver improvements while maintaining backward compatibility. Manjaro
  builds `linux70-nvidia` against `nvidia-580xx-utils`, so the 575xx
  branch is not an option for the new kernel. Pascal (GP107) is fully
-  supported by 595.x, and 595.x ships the latest explicit-sync /
+  supported by 580.x, which ships explicit-sync / modesetting fixes
-  modesetting fixes upstream.
+  upstream.
 - **Single atomic transaction.** Removing the old branch and installing
  the new one in one pacman call (with the removal list narrowed to
  packages that are *actually* installed) keeps the GPU-driver window
@@ -85,24 +98,23 @@ The starting point at the time of this ADR:
 ## Consequences
 - **Two kernels on `/` partition.** Roughly +120 MB for `linux70` plus
-  ~50 MB for `linux70-nvidia`. The role pre-flight refuses to start if
+  ~50 MB for `linux70-nvidia-580xx`. The role pre-flight refuses to start if
  free space on `/` is below 5 GiB.
 - **`mhwd` profile referencing `575xx` stays as-is.** Only the
-  kernel-bound `linux612-nvidia-575xx` and matching userspace are
+  kernel-bound `linux618-nvidia-580xx` and matching userspace are
-  swapped; `mhwd-nvidia-575xx` stays installed so MHWD's profile
+  installed; legacy `*-nvidia-575xx` packages are removed.
  listing remains consistent. A future cleanup can switch the MHWD
  profile to `video-nvidia` once `linux70` is verified.
 - **Manual reboot required.** The role never reboots the machine; it
  ends with a clear notice instructing the user to boot into `linux70`
  from GRUB before applying the next (Hyprland) playbook.
- **Future kernel pin bumps are one-line changes** in
+- **Future kernel/driver pin bumps are one-line changes** in
  `ansible/vars/main.yml` (`kernel_packages` /
-  `nvidia_kernel_modules` lists).
+  `nvidia_kernel_modules` / `nvidia_userspace_packages` lists).
 ## References
 - Hyprland NVIDIA notes (wiki.hypr.land/Nvidia): explicit sync
  available from driver ≥555 and required for tear-free Wayland.
 - `docs/tech/hardware-inventory.md` (NVIDIA section).
 - `ansible/roles/system-upgrade/tasks/main.yml`.
 - `ansible/vars/main.yml` (current kernel and NVIDIA package pins).
 - ADR 1: `docs/adr/0001-use-ansible-for-configuration.md` — anchors the
  "Ansible-first" guardrail this decision follows.
@@ -0,0 +1,72 @@
 ---
 description: >-
  Override the package-managed hyprland.desktop with a local copy that points
  to start-hyprland (watchdog binary), ensuring Hyprland launches with proper
  crash diagnostics, signal handling, and XDG portal support via uwsm.
 status: accepted
 date: 2026-05-21
 ---
 # 0004: start-hyprland Watchdog Override
 ## Context
 Hyprland 0.53+ ships `start-hyprland`, a watchdog binary that monitors the
 compositor process, collects crash diagnostics (crash reports, memory dumps),
 and ensures proper signal handling. When Hyprland detects it was not launched
 via `start-hyprland`, it displays a banner warning:
 > `⚠ Hyprland was started without start-hyprland. This is highly not
 > recommended unless you are in a debugging environment.`
 Our setup uses: greetd → tuigreet → `uwsm start -e -D Hyprland hyprland.desktop`
 uwsm reads the `.desktop` file's `Exec=` field and spawns that binary inside
 a systemd user session. The package-provided `hyprland.desktop` has
 `Exec=Hyprland` (direct binary), bypassing the watchdog.
 ### Research (Dec 2025 – Jan 2026)
 - Hyprland discussion #12661: widespread report of this warning with UWSM.
 - UWSM maintainer Vladimir-csp confirmed: "I'd recommend feeding
  `hyprland.desktop` to uwsm" with the watchdog binary.
 - fufexan (Hyprland maintainer) acknowledged the incompatibility; no upstream
  fix landed as of Jan 2026.
 - Community consensus: point `.desktop` Exec to `start-hyprland` via local
  override to preserve uwsm session management while enabling the watchdog.
 ## Decision
 Create a local override at `~/.local/share/wayland-sessions/hyprland.desktop`
 pointing to `start-hyprland`.
 ### Why local override (not system-wide)?
 - The system file (`/usr/share/wayland-sessions/hyprland.desktop`) is owned by
  the `hyprland` package and gets overwritten on updates.
 - `~/.local/share` has higher XDG_DATA_DIRS priority than `/usr/share`, so
  greetd/tuigreet discover the override first without touching system files.
 - Ansible manages the override idempotently.
 ### Why not modify greetd's command?
 The greetd command (`uwsm start -e -D Hyprland hyprland.desktop`) references
 `hyprland.desktop` generically. Changing the greeting command to
 `start-hyprland` directly would bypass uwsm entirely. The override approach
 keeps the uwsm session management intact while fixing the watchdog issue.
 ## Status
 Implemented in Ansible role `hyprland/tasks/main.yml`:
 - Task registers the override at `~/.local/share/wayland-sessions/hyprland.desktop`
 - Uses `start-hyprland` as `Exec` and `TryExec`
 - Sets correct ownership (`mw`) and permissions (`0644`)
 - Tagged `[hyprland, session]` for idempotent runs
 ## Verification
 After running `ansible-playbook ansible/workstation.yml`:
 1. `cat ~/.local/share/wayland-sessions/hyprland.desktop` should show
   `Exec=start-hyprland`
 2. Next login: the warning banner should no longer appear.
 3. `ps aux | grep start-hyprland` should show the watchdog parent process.
@@ -0,0 +1,120 @@
 # ADR 0006: Chrome/Chromium Normalization and Cleanup
 **Date:** 2026-05-22  
 **Status:** Accepted  
 **Deciders:** Michael Wegener
 ## Context
 The workstation had accumulated significant Chrome/Chromium configuration drift over time:
 - **Dual installation**: Both `google-chrome-stable` (148.0.7778.178) and orphaned `chromium` configs
 - **Dead data directories**:
  - `~/.config/chromium/` (1.4 GB of stale profile data)
  - `~/.local/chrome-cdp/` (8.6 GB Chrome DevTools Protocol debug profile, no longer used)
 - **Broken PWA desktop entries**: 13 non-functional `.desktop` files in `~/.local/share/applications/`
 - **Orphaned packages**: `chromium-widevine` (DRM codec plugin for non-existent Chromium)
 - **Dead shell integrations**: `BROWSER_CDP_URL` environment variable auto-population in `~/.bashrc`
 - **Wayland compatibility**: `chrome-flags.conf` needed Wayland-specific flags for native Wayland rendering
 This drift made it difficult to:
 1. Understand which browser is authoritative
 2. Maintain clean Ansible playbooks
 3. Ensure consistent Wayland behavior
 4. Avoid confusion from broken PWA shortcuts
 ## Decision
 Standardize on **`google-chrome-stable`** as the sole browser and remove all Chromium-related artifacts:
 ### 1. Remove Dead Data Directories
 - ✅ Delete `~/.config/chromium/` entirely (1.4 GB freed)
 - ✅ Delete `~/.local/chrome-cdp/` entirely (8.6 GB freed)
 ### 2. Uninstall Orphaned Packages
 - ✅ `pacman -R chromium-widevine` (17.41 MiB freed)
 ### 3. Delete Broken PWA Desktop Entries
 - ✅ Removed 13 non-functional `.desktop` files from `~/.local/share/applications/`
 - ✅ Deleted 4 PWA manifest directories from `~/.config/google-chrome/Default/Web Applications/Manifest Resources/`
 ### 4. Clean Shell Environment
 - ✅ Removed `BROWSER_CDP_URL` auto-population (lines 140-141) from `~/.bashrc`
 - Bash startup improved from ~60ms to ~3ms
 ### 5. Restore Wayland Configuration
 - ✅ Ansible role `dev-tools` already manages `~/.config/chrome-flags.conf` with Wayland flags
 - ✅ Playbook re-applied to restore `--ozone-platform=auto` and other Wayland optimizations
 ### 6. Update Ansible for Future Maintenance
 - ✅ Added `cleanup` tasks to `dev-tools` role to remove known-dead packages/directories
 - ✅ Documented cleanup procedures in CHANGELOG
 ## Consequences
 ### Positive
 - **10 GB disk space recovered** on root filesystem
 - **Clear browser choice**: Only `google-chrome-stable` is installed and managed
 - **Faster shell startup**: Removed unnecessary `curl` call to `localhost:9222`
 - **Clean desktop**: PWA shortcuts now only show functional applications
 - **Wayland-native rendering**: Chrome uses `--ozone-platform=auto` for native Wayland
 - **Maintainable configuration**: Ansible now includes cleanup tasks for future orphan removal
 ### Negative
 - None significant. Google Chrome is the sole browser, reducing cognitive load.
 ### Neutral
 - AWDI (A Web Developer Interface) tools that required CDP connections must now launch Chrome with `--remote-debugging-port=9222` manually if needed.
 ## Technical Details
 ### Current Browser Installation
 ```
 google-chrome-stable  148.0.7778.178-1  (AUR: paru)
 ```
 ### Ansible Management
 - **Package installation**: `ansible/roles/dev-tools/tasks/main.yml` (lines 112-120)
 - **Chrome flags**: `ansible/roles/dev-tools/tasks/main.yml` (lines 122-135) with `--tags chrome`
 - **Cleanup tasks**: `ansible/roles/dev-tools/tasks/main.yml` (lines 137-158) with `--tags cleanup`
 ### Files Affected
 - **Deleted**:
  - `~/.config/chromium/` (1.4 GB)
  - `~/.local/chrome-cdp/` (8.6 GB)
  - 13 `.desktop` files in `~/.local/share/applications/`
  - 4 PWA manifest dirs in `~/.config/google-chrome/Default/Web Applications/Manifest Resources/`
 - **Modified**:
  - `~/.bashrc` (removed CDP_URL lines)
  - `~/.config/chrome-flags.conf` (restored via Ansible)
 - **Uninstalled**:
  - `chromium-widevine` (17.41 MiB)
 ### Hyprland Integration
 - `SUPER+B` binds to `uwsm app -- google-chrome-stable` (unchanged)
 - Waybar CDP module removed (no longer needed without debug profile)
 - Cheatsheet references updated to reflect Chrome-only workflow
 ## Alternatives Considered
 ### Keep Chromium Installed
 - **Pros**: Open-source browser, no Google telemetry
 - **Cons**: Two browsers to maintain, orphaned packages, confusing shortcuts
 - **Decision**: Rejected. Google Chrome provides better Wayland support and is already the daily driver.
 ### Preserve `chrome-cdp` Profile
 - **Pros**: Could be reactivated for debugging, Playwright/Puppeteer testing
 - **Cons**: 8.6 GB wasted space, not used in 3+ months, on-demand launch is trivial
 - **Decision**: Rejected. AWDI tools can start Chrome with `--remote-debugging-port=9222 --user-data-dir=/tmp/chrome-debug` if needed.
 ### Automated PWA Scrubbing
 - **Pros**: Could remove all PWA configs via Ansible
 - **Cons**: Risk of removing actively-used PWAs (OnlyOffice, JetBrains Toolbox, etc.)
 - **Decision**: Rejected. Manually scrubbed dead PWAs, left functional ones intact.
 ## References
 - [ADR 0004: Start-Hyprland Override](0004-start-hyprland-override.md) — Wayland session management
 - `ansible/roles/dev-tools/tasks/main.yml` — Chrome package and flags management
 - `CHANGELOG.md` — 2026-05-22 cleanup entry
 - `docs/tech/stack.md` — Current software audit (updated)
@@ -0,0 +1,141 @@
 # ADR 0007: Workstation Package Cleanup — Remove X11/KDE Legacy Stack
 **Date**: 2026-05-22
 **Status**: Accepted (Tier 1+2+3+4 executed 2026-05-22)
 **Decision Maker**: Michael Wegener
 ## Context
 The workstation runs Hyprland (Wayland) with greetd+tuigreet. Despite this, 466 explicitly installed packages include ~40 that serve only X11 or KDE Plasma environments — neither of which are in active use. These packages waste disk space, increase update surface, and confuse package inventory.
 ### Current State
 | Domain | Packages | Status |
 |--------|----------|--------|
 | X11 Display Managers | lightdm, lightdm-slick-greeter, sddm, sddm-kcm | Disabled; greetd is active DM |
 | X11 Video Drivers | xf86-video-amdgpu, -ati, -intel, -nouveau, -vesa | Not used; Xwayland renders via Mesa |
 | X11 Input Drivers | xf86-input-synaptics | Superseded by libinput |
 | X11 Tools | xterm, xorg-twm, xorg-xinit, xorg-xkill, x11vnc, numlockx, startup-notification, xorg-server-xvfb | No X11 session exists |
 | KDE/Plasma | kwin, plasma-desktop, plasma-workspace, plasma-nm, plasma-pa, plasma-x11-session, kdeplasma-addons, kde-gtk-config, powerdevil, spectacle, sddm-breath-theme, xdg-desktop-portal-kde, pamac-tray-icon-plasma | Not running; Hyprland equivalents in use |
 | Legacy | illyria-wallpaper, ntp | Unused wallpaper; systemd-timesyncd already active |
 ### Wayland Equivalents Already In Use
 | Function | KDE/X11 Package | Active Wayland Replacement |
 |----------|----------------|--------------------------|
 | Screenshots | spectacle | grim + slurp + grimblast |
 | Network Applet | plasma-nm | waybar `network` module |
 | Audio Applet | plasma-pa | waybar `pulseaudio` module + pavucontrol |
 | Power Mgmt | powerdevil | hypridle + brightnessctl |
 | Desktop Portal | xdg-desktop-portal-kde | xdg-desktop-portal-hyprland |
 | Display Manager | lightdm/sddm | greetd + tuigreet |
 | Clipboard | xclip/xsel | wl-clipboard |
 | VNC | x11vnc | wayvnc (if needed) |
 ## Decision
 ### TIER 1 — Safe Removal (No Dependencies, No Active Use)
 These packages have no dependents and no active role:
 | # | Package | Reason | Size |
 |---|---------|--------|------|
 | 1 | lightdm | DM disabled, greetd is active | 1.1 MiB |
 | 2 | lightdm-slick-greeter | Only required by lightdm | 1.9 MiB |
 | 3 | sddm | DM disabled | 5.3 MiB |
 | 4 | sddm-kcm | Only required by sddm | 0.6 MiB |
 | 5 | sddm-breath-theme | Manjaro KDE branding for sddm | 0.2 MiB |
 | 6 | xterm | X11 terminal; kitty is active | 1.1 MiB |
 | 7 | xorg-twm | X11 window manager | 0.2 MiB |
 | 8 | xorg-xinit | Start X manually (no X11 session) | 0.04 MiB |
 | 9 | xorg-xkill | X11 kill utility | 0.02 MiB |
 | 10 | x11vnc | Only works with X11; wayvnc for Wayland | 1.8 MiB |
 | 11 | numlockx | X11-specific numlock | 0.02 MiB |
 | 12 | startup-notification | X11 startup protocol | 0.06 MiB |
 | 13 | xorg-server-xvfb | Virtual framebuffer; no CI use case | 2.0 MiB |
 | 14 | xf86-video-amdgpu | AMD X11 driver (system has NVIDIA) | 0.2 MiB |
 | 15 | xf86-video-ati | ATI X11 driver (no ATI GPU) | 0.5 MiB |
 | 16 | xf86-video-intel | Intel X11 driver (no Intel GPU) | 2.2 MiB |
 | 17 | xf86-video-nouveau | Nouveau X11 driver (NVIDIA proprietary in use) | 0.2 MiB |
 | 18 | xf86-video-vesa | VESA fallback driver | 0.03 MiB |
 | 19 | xf86-input-synaptics | X11 touchpad driver; libinput replaces it | 4.0 MiB |
 | 20 | illyria-wallpaper | Manjaro wallpaper; not used | 1.0 MiB |
 | 21 | ntp | systemd-timesyncd already active and running | ~2 MiB |
 | 22 | spectacle | grim+slurp+grimblast already bound in Hyprland | 6.1 MiB |
 | 23 | pamac-tray-icon-plasma | pamac not running; paru is AUR helper | 0.08 MiB |
 **Tier 1 Savings: ~31 MiB** (plus dependency trees, likely 80-120 MiB total)
 ### TIER 2 — KDE Plasma Stack Removal (Cascade Removal)
 These form a dependency chain. Removing plasma-workspace cascades:
 | # | Package | Reason | Size |
 |---|---------|--------|------|
 | 24 | plasma-desktop | No KDE desktop in use | 39.3 MiB |
 | 25 | plasma-workspace | Not running; waybar replaces | 55.1 MiB |
 | 26 | kwin | Not running; Hyprland is compositor | 30.9 MiB |
 | 27 | kdeplasma-addons | Requires kwin+plasma-workspace | 12.0 MiB |
 | 28 | plasma-nm | waybar network module in use | 12.8 MiB |
 | 29 | plasma-pa | waybar pulseaudio module in use | 1.9 MiB |
 | 30 | plasma-x11-session | X11 session; Hyprland is active | 3.4 MiB |
 | 31 | kde-gtk-config | KDE GTK integration; not needed | 0.3 MiB |
 | 32 | powerdevil | hypridle replaces | 5.9 MiB |
 | 33 | xdg-desktop-portal-kde | xdg-desktop-portal-hyprland in use | 2.4 MiB |
 **Tier 2 Savings: ~164 MiB** (plus shared KDE deps, likely 250-400 MiB total)
 **Important**: Dolphin and KDE apps that don't depend on plasma-workspace/kwin will remain installed. Dolphin's dependency chain only goes through KDE Frameworks (kio, baloo, etc.), not plasma-workspace.
 ### TIER 3 — Review Required (User Decision)
 | # | Package | Notes | Question |
 |---|---------|-------|----------|
 | 34 | ruby | Explicitly installed; nothing visible uses it. ~50 ruby-* subpackages exist as deps. | Is anything using Ruby? |
 | 35 | love | LÖVE 2D game engine. 4.1 MiB. No .love files found. | Still needed? |
 | 36 | xorg-server | Required by lightdm+sddm (both being removed). xorg-xwayland is separate and will remain. | Remove after Tiers 1+2? |
 | 37 | xf86-input-libinput | Required by xorg-server. If xorg-server goes, this can go too. | Depends on #36 |
 ### TIER 4 — Reclassify (Keep, Move to Correct Domain)
 | Package | Current Domain | New Domain |
 |---------|---------------|------------|
 | uv | Misc | Python Toolchain |
 | jq | Misc | Shell/Terminal |
 | inxi | Misc | Hardware |
 | lsof | Misc | Core OS |
 | iproute2 | Misc | Network |
 | perl-image-exiftool | Misc | Dev Tools |
 | icoutils | Misc | Dev Tools |
 | innoextract-git | Misc | Dev Tools |
 | opencl-headers | Misc | GPU Compute |
 | libxnvctrl-580xx | Misc | NVIDIA |
 | zram-generator | Misc | Core OS |
 | mkinitcpio-openswap | Misc | Core OS |
 | openresolv | Misc | Network |
 ## Execution Plan
 1. **Tier 1**: Remove 23 packages via Ansible + `pacman -Rns` (safe, no dependents)
 2. **Tier 2**: Remove 10 KDE Plasma packages (cascade; verify dolphin survives)
 3. **Tier 3**: Get user decisions, then act
 4. **Tier 4**: Reclassify in Ansible vars (no removal, documentation only)
 5. **Verify**: Run `ansible-playbook --check` after each tier
 6. **Document**: Update `docs/tech/stack.md` and CHANGELOG.md
 ### Safety
 - xorg-xwayland stays (required by Hyprland for X11 app compatibility)
 - xf86-input-libinput stays if xorg-server stays (Tier 3 decision)
 - Dolphin and all KDE Frameworks libs stay (no dependency on plasma-workspace)
 - Backup: `pacman -Qe` snapshot before execution
 ## Expected Outcome
 | Metric | Before | After |
 |--------|--------|-------|
 | Explicit packages | 466 | ~425-430 |
 | Disk freed | — | 300-500 MiB |
 | X11 surface area | 24 packages | 1-2 (xorg-xwayland + maybe xorg-server) |
 | KDE Plasma | 13 packages | 0 |
 | Update complexity | High | Reduced |
@@ -0,0 +1,150 @@
 # ADR-00N: Migrate from KDE Wallet to gnome-keyring + Bitwarden
 ## Status
 Implemented 2026-05-21. Post-reboot verification pending.
 ## Context
 The system was previously configured as a KDE Plasma workstation with KWallet (kwalletd6) for secrets management. After the desktop environment was replaced with Hyprland (Wayland, greetd DM), KWallet no longer auto-unlocks (no PAM integration with greetd) and leaves apps without a functional D-Bus secrets service.
 Apps requiring secrets (himalaya, ssh-agent, git, JetBrains IDEs) were failing to read credentials.
 ## Decision
 ### Architecture
 ```
 ┌────────────────────────
 │  Bitwarden Vault       │  ← Central, cross-device, backup
 │  bitwarden.jantec.xyz   │
 │  (self-hosted)         │
 │         ▲               │
 │   rbw CLI (Rust)       │  ← CLI access, sync add/list
 │  ironmikechw+bitwarden │
 │         ▲               │
 │  gnome-keyr  │  ← Local encrypted cache, D-Bus API for app
 │  libsecret + D-Bus │
 │  org.freedesktop.  │
 │  secrets              │
 └────────────────────────┘
 ```
 ### Components
 | Component | Role | Status |
 |-----------|------|--------|
 | **gnome-keyring** | Local D-Bus secrets provider. Started via systemd socket, enabled for all user sessions. | `enabled` + `active` |
 | **rbw** | Rust Bitwarden CLI. Connects to `https://bitwarden.jantec.xyz`. Uses gnome-keyring as encrypted password store. | `1.15.0`, configured |
 | **libsecret** | GTK/GLib secrets API. Used by git (`credential.helper libsecret`), secret-tool, and apps. | present |
 | **himalaya** | Configured to use `secret-tool lookup email <addr>` for IMAP/SMTP auth.cmd. | needs password entries |
 ### What was migrated from KWallet
 | Source (kwallet folder) | Entries | Destination |
 |------------------------|---------|-------------|
 | ksshaskpass (SSH keys) | id_ed25519 passphrase, id_ed25519_ja_manjaro passphrase | BW + GK |
 | ksshaskpass (host passwords) | b0t@192.168.0.141 | BW + GK |
 | ksshaskpass (tokens) | GitLab PAT, GitHub token | BW + GK |
 | Remmina (5 entries) | VNC/RDP passwords for b0t-devops-box, auc-test, 192.168.0.52, ja-manjaro, vagrant | BW + GK |
 | Nextcloud (3 entries) | mw@cloud.satware.com, mw@data.satware.com, allvater@cloud.makercloud.de | BW + GK |
 | QGIS | Master password | BW + GK |
 | JetBrains AI | AI token | BW + GK |
 | JetBrains Account | Account token | BW only |
 | Browser safe storage | Chrome, Brave, Chromium encryption keys | BW + GK |
 | xdg-desktop-portal | Screen sharing tokens (18 binary entries) | skipped (app-generated) |
 **Total: ~45 meaningful entries migrated**
 ### What was NOT migrated
 | Item | Reason | Action needed |
 |------|--------|--------------|
 | himalaya email passwords | Were not stored in KWallet (probably in KDE KWallet but in a different format) | Must be added manually to GK via `secret-tool` |
 | GitHub CLI token | Was in KWallet but may be expired | Re-auth with `gh auth login` |
 | JetBrains IDE DB/SshConfigPassword | Encrypted app-internal tokens, app-specific | IDEs will re-create via D-Bus on next use |
 ### Config changes
 | File | Change |
 |------|--------|
 | `~/.config/rbw/config.json` | **new** — rbw config pointing to bitwarden.jantec.xyz |
 | `~/.config/systemd/user/default.target.wants/` | gnome-keyring-daemon.service + socket: **enabled** |
 | `~/.gitconfig` | `credential.helper = libsecret` (changed from `store`) |
 | `~/.config/systemd/user/` | gnome-keyring-daemon.service + socket: **enabled** |
 ### KDE Wallet cleanup
 | State | Status |
 |-------|--------|
 | `kwallet` pkg (6.26.0) | Installed (will be removed post-verify) |
 | `kwalletmanager` pkg (26.04.1) | Installed (will be removed post-verify) |
 | `~/.local/share/kwalletd/kdewallet.kwl` | Still exists (backed up) |
 | `~/.local/share/kwalletd/kdewallet_attributes.json` | Still exists (backed up)|
 | `plasma-kwallet-pam.service` | inactive (static) |
 PAM kwallet refs in `/etc/pam.d/*` were already commented out.
 ## Startup / Unlock flow after reboot
 ```
 1. greetd/tuigreet → user login (PAM auth)
 2. gnome-keyring PAM module (pam_gnome_keyring.so) unlocks keyring with login password
 3. gnome-keyring-daemon starts via socket activation (systemd user)
 4. D-Bus org.freedesktop.secrets becomes available
 5. rbw auto-login (via pinentry + gnome-keyring) → vault accessible
 6. himalaya can read IMAP passwords via secret-tool
 7. ssh-add reads SSH passphrases via GK
 8. git-credential-libsecret reads Git creds via GK
 9. JetBrains IDEs read secrets via D-Bus auto-detection
 ```
 ## Post-reboot verification checklist
 - [ ] `systemctl --user is-active gnome-keyring-daemon.service` → `active`
 - [ ] `rbw list | wc -l` → entries available
 - [ ] `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` → returns passphrase
 - [ ] `secret-tool lookup application git service gitlab.satware.com` → returns PAT
 - [ ] `himalaya account list` → accounts show, no auth errors
 - [ ] `rbw get "SSH Key: id_ed25519"` → "SSH gitlab.satware.com"
 - [ ] `git remote` operations work (libsecret helper)
 - [ ] JetBrains IDEs can read DB/Git credentials
 ## Manual steps after reboot
 1. If himalaya shows auth errors, re-enter IMAP passwords:
   ```bash
   # MW account
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
   # JA account  
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
   # JA Gmail
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
   # Michael Gmail
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP Michael" email ironmikechw@gmail.com application himalaya
   ```
 2. If GitHub CLI is stale:
   ```bash
   gh auth login --hostname github.com
   ```
   Then store in GK:
   ```bash
   rbw get "GitHub Personal Token" | secret-tool store --label="GitHub Personal Token" \
     application gh-cli service github.com
   ```
 3. Remove KDE Wallet packages (after all verified working):
   ```bash
   sudo pacman -Rns kwallet kwalletmanager
   ```
 ## Consequences
 - **Positive**: Clean D-Bus secrets service available to all apps. Central vault syncs across devices. No more KWallet prompt on every login. libsecret works.
 - **Negative**: Two layers of keyring (gnome-keyring local cache + Bitwarden vault). If gnome-keyring is corrupted, need `rbw sync`. If Bitwarden server is down, `rbw` won't work (but GK local cache still holds secrets).
 ## Rollback plan
 If the migration fails, restore by:
 1. Re-enable `plasma-kwallet-pam.service`
 2. Revert `credential.helper` to `store`
 3. KWallet data file remains on disk (not deleted)
@@ -55,6 +55,18 @@ hypr launcher config: `~/.config/hypr/hyprlauncher.conf`
 Config: `/etc/greetd/config.toml`
 Default command: `tuigreet --time --remember --asterisks --cmd 'uwsm start -e -D Hyprland hyprland.desktop'`
 ### Wayland Session Override (start-hyprland)
 The package provides `/usr/share/wayland-sessions/hyprland.desktop` with
 `Exec=Hyprland` (direct binary), but Hyprland 0.53+ requires launching through
 `start-hyprland` (watchdog parent process) for crash diagnostics and proper
 signal handling. Otherwise a warning banner appears on login.
 A local override at `~/.local/share/wayland-sessions/hyprland.desktop` sets
 `Exec=start-hyprland`, which uwsm then manages inside the systemd session.
 XDG_DATA_DIRS priority ensures the override wins without touching system files.
 Managed by Ansible role `hyprland` — see `docs/adr/0004-start-hyprland-override.md`.
 ## Key Categories
 | Category | Modifier | Keys | Action |
@@ -1,33 +1,97 @@
-# Learning: Enable WebGPU in Chrome on Linux (Manjaro)
+---
 description: >-
  Chrome 148 on NVIDIA Wayland (Hyprland) — full GPU/video acceleration config.
  Replaced the 2026-03-11 WebGPU flags with state-of-the-art NVIDIA VA-API setup.
 tags: [chrome, nvidia, wayland, vaapi, gpu, acceleration]
 last_updated: '2026-05-21'
 ---
-Date: 2026-03-11
+# Chrome 148 — NVIDIA Wayland Hardware Acceleration
 Date: 2026-05-21 (updated from 2026-03-11)
 ## Context
 WebGPU was reported as unavailable in Chrome despite the API being detected. On Linux, WebGPU support is often experimental and requires specific hardware acceleration flags.
-## Challenge
+Chrome on NVIDIA + Wayland has three known issues:
- The Google Chrome binary on Manjaro (`/usr/bin/google-chrome-stable`) is a wrapper script that supports a custom flag file at `~/.config/chrome-flags.conf`.
+1. **GBM "Permission denied"**: Chrome's seccomp sandbox blocks NVIDIA's `nvidia-drm_gbm.so` on Wayland.
- Enabling WebGPU requires not just the WebGPU flag, but also Vulkan support.
+2. **Vulkan/Wayland incompatibility**: `--ozone-platform=wayland` is not compatible with Vulkan rendering (Chromium issue 334275637).
 3. **NVIDIA VA-API allowlist**: Hardware video decode is blocked on NVIDIA without explicit flags.
-## Solution
+The old WebGPU config (`--enable-unsafe-webgpu`, `--enable-vulkan`) is obsolete —
-Implemented a persistent configuration via Ansible to manage `~/.config/chrome-flags.conf` with the following flags:
+WebGPU works natively in Chrome 148 via ANGLE+OpenGL on Wayland without Vulkan flags.
-```text
+## Required Packages
--enable-unsafe-webgpu
+
--enable-vulkan
+| Package | Reason |
--enable-features=Vulkan
+|---------|--------|
--ignore-gpu-blocklist
+| `libva-utils` | Verification: `vainfo` |
 | `libva-nvidia-driver` | VA-API NVDEC bridge (already installed, was `nvidia-vaapi-driver`) |
 Note: `libva-utils` was installed 2026-05-21. `libva-nvidia-driver` (0.0.17-1) was already present.
 ## Configuration: `~/.config/chrome-flags.conf`
 ```
 --ozone-platform=wayland
 --disable-seccomp-filter-sandbox
 --disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan
 --use-angle=gl
 --enable-features=VaapiOnNvidiaGPUs,VaapiIgnoreDriverChecks,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoDecodeLinuxGL
 --password-store=gnome-libsecret
 ```
-## Key Learnings
+### Flag Rationale
-1. **Persistent Flags**: On Arch-based systems (like Manjaro), use `~/.config/chrome-flags.conf` instead of modifying `.desktop` files, as it survives package updates and is automatically loaded by the Chrome wrapper script.
+
-2. **WebGPU Dependencies**: WebGPU on Linux currently relies on the Vulkan backend. Enabling `--enable-unsafe-webgpu` alone is often insufficient; `--enable-vulkan` and `--enable-features=Vulkan` are required.
+| Flag | Purpose |
-3. **GPU Blocklist**: Linux GPUs are often blocklisted for experimental features. `--ignore-gpu-blocklist` helps override these safety checks for development.
+|------|---------|
 | `--ozone-platform=wayland` | Force Wayland; auto-detect unreliable on Hyprland |
 | `--disable-seccomp-filter-sandbox` | Fixes GBM `Permission denied` (Chrome sandbox blocks NVIDIA GBM on Wayland) |
 | `--disable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan` | Vulkan incompatible with Ozone Wayland; all three must be disabled |
 | `--use-angle=gl` | Force ANGLE→OpenGL backend; prevents auto-selection of Vulkan |
 | `--enable-features=VaapiOnNvidiaGPUs,...` | Bypass NVIDIA video decode allowlist; modern flags (replaced deprecated `VaapiVideoDecoder`) |
 | `--password-store=gnome-libsecret` | gnome-keyring integration (not auto-detected outside GNOME DE) |
 ## Verification
- Applied changes via Ansible role `dev-tools`.
+
- Verified file existence and content.
+```bash
- Verified flag application by inspecting running processes (`ps aux`).
+vainfo                              # Shows VA-API NVDEC decoder capabilities
- Used Playwright (via MCP) to navigate to `https://webgpureport.org/`.
+LIBVA_DRIVER_NAME=nvidia vainfo     # Explicit NVIDIA VA-API check
- Confirmed that while `navigator.gpu` is detected, `requestAdapter()` may still return null in headless/remote-controlled environments due to GPU access limitations.
+```
- **SUCCESS**: Verified that the user's running Chrome instance successfully initializes WebGPU on the actual workstation hardware after the flag application, as confirmed by `https://webgpureport.org/`.
+
 Expected `chrome://gpu` results:
 - Canvas: **Hardware accelerated**
 - Compositing: **Hardware accelerated**
 - Video Decode: **Hardware accelerated** (H.264, VP9, HEVC)
 - WebGL: **Hardware accelerated**
 - WebGPU: **Hardware accelerated**
 - GPU: GTX 1050 Ti / NVIDIA 580.159.03
 - GL implementation: `gl=egl-angle,angle=opengl`
 - GPU process crash count: **0**
 - Ozone platform: **wayland**
 ## Known Warnings
 Three log lines persist despite correct config — these are upstream Chromium warnings:
 ```
 ERROR:ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc:252: '--ozone-platform=wayland' is not compatible with Vulkan
 WARNING:sandbox/policy/linux/sandbox_linux.cc:404: InitializeSandbox() called with multiple threads in process gpu-process
 ERROR:ui/gl/egl_util.cc:92: EGL Driver message (Error) eglCreateContext: Requested version is not supported
 ```
 These are cosmetic. Chrome falls back to ANGLE+OpenGL before they print.
 No fix exists upstream yet (Chromium issue 334275637).
 ## Key Learnings
 1. **Deprecated flags**: `VaapiVideoDecoder`, `VaapiVideoDecodeLinuxGL` replaced by `AcceleratedVideoDecodeLinuxZeroCopyGL`, `AcceleratedVideoDecodeLinuxGL` since Chrome ≥131.
 2. **Vulkan is opt-in, not opt-out**: `--disable-features=Vulkan` alone is insufficient; `VulkanFromANGLE` and `DefaultANGLEVulkan` are auto-enabled and must be listed.
 3. **GBM "Permission denied" is not file perms**: It's seccomp sandbox + NVIDIA GBM. `--disable-seccomp-filter-sandbox` is the confirmed workaround.
 4. **Password store**: Hyprland ≠ GNOME, so `--password-store=gnome-libsecret` explicit flag needed.
 5. **`--ignore-gpu-blocklist` no longer needed**: Chrome 148 recognizes the GTX 1050 Ti + current driver without it.
 ## Ansible Integration
 The `dev-tools` role manages this file. Update both:
 - `ansible/roles/dev-tools/tasks/main.yml` (the copy task content)
 - This learning doc (the rationale)
@@ -0,0 +1,135 @@
 ---
 description: >-
  Session record (2026-06-24) of detecting the YubiKey, planning GPG commit
  signing, building a reusable SPECCOL inventory/provisioning stick, and
  hardening + provisioning a Dell Latitude E7250 as a dedicated air-gapped
  keygen/forensic host.
 tags:
  - learning
  - yubikey
  - gpg
  - security
  - air-gap
  - latitude-e7250
 last_updated: '2026-06-24'
 ---
 # YubiKey + Dell E7250 air-gapped keygen host - 2026-06-24
 ## Summary
 Detected and inventoried the attached YubiKey; researched 2026 best practice
 for hardware-backed Git commit signing; wrote a baby-step plan; then procured,
 hardened, and provisioned a dedicated Dell Latitude E7250 as the permanent
 air-gapped keygen/forensic host. Built a reusable `SPECCOL` USB toolkit
 (inventory + provisioning scripts, verified BIOS, checklist) along the way.
 **Outcome:** E7250 is fully hardened + provisioned and ready to go offline for
 PGP key generation. The YubiKey remains the daily-carry signer; the Type-C USB
 will hold the LUKS-encrypted key recovery backup (pending keygen).
 ## Decisions (with rationale)
 | Decision | Choice | Why |
 |----------|--------|-----|
 | Signing approach | **GPG/OpenPGP on YubiKey** (not SSH `ed25519-sk`) | Secret keys are exportable -> a true LUKS recovery backup on USB is possible (requirement #3). |
 | Keygen environment | **Dedicated air-gapped host** (Dell E7250) instead of a re-booted live USB | Reproducible; Certify key never touches a networked machine; reusable for forensic work. |
 | Key identity | `Michael Wegener <mw@satware.com>`; subkeys ed25519(S)/cv25519(E)/ed25519(A); 2y expiry; touch required | 2026 modern; avoids RSA-deprecation for SSH auth. |
 | Push transport | HTTPS + GPG-sign (unchanged) | Lowest risk; signing is transport-independent. |
 ## Components & final state
 ### 1. YubiKey (serial 30836069, FW 5.7.1, USB-A)
 - OTP: slot 1 programmed, slot 2 empty.
 - FIDO2: PIN set (8 tries left), 4 credentials - `google.com` (Jane Alesi),
  `auth.satware.ai`, `git.g-b-c.de`, `github.com` (satwareAG-ironMike).
 - OATH: empty. PIV: factory-defaults/empty. OpenPGP: **empty, sign-PIN was blocked**.
 - Note: existing GPG keyring has 3 **expired** ed25519 keys tied to a *different*
  card serial (24530904) - stale references, not on this key.
 ### 2. Plan (committed)
 - `docs/plans/2026-06-24-yubikey-gpg-github-signing.md` (commit `5a714e6`).
 - 9 phases (0-9): remediate -> air-gapped keygen -> LUKS backup -> transfer to
  YubiKey -> configure workstation -> register with GitHub -> Ansible -> recovery
  -> 2nd YubiKey.
 ### 3. Boot stick (Type-C USB, 29 GB)
 - Debian Live **13.5.0 Trixie XFCE** ISO, verified (SHA512 + Dell... Debian CD
  OpenPGP signature), `dd`'d clean at ~40 MB/s.
 ### 4. SPECCOL toolkit stick (FAT32, label `SPECCOL`, ~1.9 GB) - reusable
 ```
 toolkit/collect-specs.sh            dock-aware inventory (TPM version, radios,
                                    TB dock nvm/serial, fwupd, robust tooling check)
 devices/latitude-e7250/provision.sh apt update + full-upgrade + tooling + autoremove
                                    + logging + re-inventory (idempotent)
 devices/latitude-e7250/checklist.md hardening + provisioning checklist
 devices/latitude-e7250/bios/        E7250A24.exe (verified) + flash instructions
 devices/latitude-e7250/logs/        one provision log per run
 inventory/<hostname>/               collected hw-specs baselines
 README.txt                          incl. FAT32 "+x" rule (run via `bash`)
 ```
 ### 5. Dell Latitude E7250 (Service Tag JQN3P32) - the air-gapped host
 - i7-5600U (vPro), 16 GB RAM, SK hynix SC210 mSATA 256 GB SSD (TRIM), Intel HD 5500.
 - Debian 13 Trixie, kernel **6.12.94** (dist-upgraded), LUKS on root+swap.
 - **Hardened:** BIOS **A24**; Secure Boot **enabled** (+ kernel lockdown); AMT/vPro
  **disabled** (MEBx); Wi-Fi **off** (gone from bus); Bluetooth **hard-blocked**;
  WWAN (Dell Gobi 5809e 4G LTE) **off**; TPM **cleared -> 1.2-only** (hardware
  limit - no 2.0 option in BIOS A24; non-blocking).
 - **Provisioned:** full dist-upgrade applied; 20/20 Phase-2 tools installed
  (scdaemon, pcscd, pcsc-tools, yubikey-manager/ykman, yubikey-personalization,
  cryptsetup, parted, fdisk, dosfstools, e2fsprogs, paperkey, tpm2-tools, fwupd,
  hdparm, smartmontools, nvme-cli, usbutils, pciutils, rfkill). 0 packages pending.
 - **Dock:** Dell E-Port Replicator (legacy bottom-connector; SMSC USB hubs only;
  no Thunderbolt, no serial, no updatable firmware).
 ## Architecture (refined)
 - **E7250** (offline, LUKS) = keygen + recovery host; holds the Certify key.
 - **YubiKey** = daily-carry commit/tag signer on the workstation.
 - **Type-C USB** = offline LUKS-encrypted recovery backup of the keys (pending Phase 3).
 ## Key learnings / gotchas
 - **LVFS:** the E7250 is **NOT** on the LVFS - no `fwupd`/`.cab` BIOS path; Dell
  dock also not updatable. BIOS update only via the Dell `.exe` (F12 BIOS Flash
  Update or FreeDOS).
 - **Dell package naming:** the YubiKey Manager CLI is Debian package
  **`yubikey-manager`** (provides the `ykman` binary), **not** `ykman`. One invalid
  name aborts the entire `apt-get install`. Fixed in `provision.sh`.
 - **FAT32 +x:** the SPECCOL stick can't store the executable bit - scripts must be
  invoked as `bash <script>` (the toolkit scripts chain each other via `bash`).
 - **TXT vs TPM:** Intel TXT must be **disabled before clearing the TPM** ("TXT must
  be disabled before clearing"). TXT is not needed for this host - left disabled.
 - **TPM version:** `/sys/class/tpm/tpm0/tpm_version_major` (kernel) is the reliable
  TPM 1.2-vs-2.0 indicator; `/dev/tpmrm0` presence also signals TPM 2.0.
 - **OpenPGP sign-PIN block** was pre-existing; a `ykman openpgp reset` will clear it
  before key transfer (Phase 4).
 - **gh auth** token for satwareAG-ironMike is invalid on the workstation; git
  protocol is HTTPS. (Re-auth when starting workstation-side setup.)
 - **Plaintext secrets exposure:** a `yubikey-provision-…` folder with unencrypted
  GnuPG + SSH private keys was on the Type-C USB ("safety net"). It gets destroyed
  when that stick is repartitioned for the LUKS backup (Phase 3) - same keys exist
  on the workstation `~/.gnupg`/`~/.ssh`, so nothing is lost.
 ## Verification baselines captured (on the SPECCOL stick)
 `inventory/michael-latitudee7250/hw-specs-*.txt` across: pre-flash (A19) ->
 post-flash (A24) -> post-provision -> post-TPM-clear. Tooling-detection bugs
 (scdaemon/pcsc-tools/yubikey-personalization binary-name mismatches; ambiguous
 lsusb messages; ANSI codes from fwupd) were fixed in `collect-specs.sh`.
 ## Open items / next steps
 1. On the E7250: (optional) set a BIOS/Setup admin password; **unplug Ethernet
   permanently**.
 2. **Phase 2 - keygen** on the E7250 (tmpfs GNUPGHOME): Certify key + S/E/A
   subkeys. Then Phase 3 (LUKS backup to Type-C USB `sdc3`) and Phase 4 (transfer
   to YubiKey; reset OpenPGP app first to clear the blocked sign-PIN).
 3. Workstation side: `gh auth login`, import public key, configure `git` signing
   (Phases 5-6), fold non-secret config into `ansible/` (Phase 7).
 4. Procure a 2nd YubiKey for redundancy (Phase 9).
 ## Artifacts produced today
 - `docs/plans/2026-06-24-yubikey-gpg-github-signing.md` (commit `5a714e6`)
 - `docs/learnings/2026-06-24-yubikey-e7250-airgap-setup.md` (this file)
 - SPECCOL toolkit stick (toolkit + devices/latitude-e7250/* + verified BIOS A24)
 - Type-C USB = current Debian-Live boot stick (29 GB; to be repurposed as the
  LUKS recovery backup in Phase 3)
@@ -0,0 +1,163 @@
 ---
 description: >-
  Session record (2026-07-03): diagnosed a Remmina SIGSEGV on Wayland when
  keymap was set, traced it to a missing NULL check on XOpenDisplay in
  remmina-plugin-rdp, forked Remmina to gitlab.com/satware, built from
  source, verified the fix, and submitted MR !2757 upstream.
 tags:
  - learning
  - remmina
  - wayland
  - rdp
  - crash-analysis
  - gitlab
  - upstream-contribution
 last_updated: '2026-07-03'
 ---
 # Remmina SIGSEGV on Wayland - diagnosis, fix, upstream MR - 2026-07-03
 ## Summary
 Remmina crashed (SIGSEGV) every time the "Mothership" RDP profile was
 selected. The root cause was a missing NULL check on `XOpenDisplay(0)` in
 `remmina_get_rdp_kbd_remap()` (`plugins/rdp/rdp_plugin.c`), triggered only
 when a `keymap` profile setting was non-empty (e.g. `Map Meta Keys`) and
 the session was Wayland without accessible X11.
 Forked Remmina to `gitlab.com/satware/Remmina`, built from source with
 FreeRDP3, reproduced the crash, applied a 4-line fix, verified it, and
 submitted merge request [!2757](https://gitlab.com/Remmina/Remmina/-/merge_requests/2757)
 to the upstream project.
 ## Incident
 | Field | Value |
 |-------|-------|
 | Symptom | Remmina closes immediately when selecting "Mothership" and clicking connect |
 | Signal | SIGSEGV (segfault) |
 | Crash location | `XKeysymToKeycode()` in `libX11.so.6`, called from `remmina-plugin-rdp.so` |
 | Profile | `group_rdp_mothership_10-10-202-4.remmina` (server `10.10.202.4`) |
 | Working profile | `srv-app-2` (`100.64.0.78`) - identical protocol, no crash |
 ## Diagnosis
 ### Stack trace (from coredumpctl)
 ```
 #0  XKeysymToKeycode (libX11.so.6 + 0x92cd7)
 #1  remmina-plugin-rdp.so + 0xff27
 #2  remmina-plugin-rdp.so + 0x1296b
 ```
 ### Root cause
 In `plugins/rdp/rdp_plugin.c`, function `remmina_get_rdp_kbd_remap()`:
 ```c
 display = XOpenDisplay(0);           // Returns NULL on Wayland
 // NO NULL CHECK
 XKeysymToKeycode(display, table[i])  // SIGSEGV - dereferences NULL
 ```
 The function is only called when `keymap` is non-empty in the profile.
 The working profile had `keymap=` (empty), which skipped the entire code
 path. The crashing profile had `keymap=Map Meta Keys`.
 ### Environment
 | Component | Version |
 |-----------|---------|
 | OS | Manjaro Linux, Wayland session (`XDG_SESSION_TYPE=wayland`) |
 | Remmina | 1.4.43 (git n/a) |
 | FreeRDP | 3.27.0 |
 | Display | `DISPLAY=:0` (Xwayland) but `XOpenDisplay(0)` fails from RDP worker thread |
 ### Key config difference
 | Setting | Mothership (crashes) | srv-app-2 (works) |
 |---------|---------------------|-------------------|
 | `keymap` | `Map Meta Keys` | (empty) |
 ## Fix
 4-line addition in `plugins/rdp/rdp_plugin.c`, function `remmina_get_rdp_kbd_remap()`:
 ```diff
 display = XOpenDisplay(0);
 +if (!display) {
 +    g_free(rdp_kbd_remap);
 +    return NULL;
 +}
 for (i = 0; table[i] > 0; i += 2) {
 ```
 The caller at line ~2148 already checks `if (rdp_kbd_remap != NULL)` before
 use, so returning NULL causes graceful degradation (empty
 `KeyboardRemappingList`) instead of a crash.
 ## Verification
 | Test | Result |
 |------|--------|
 | Reproduce crash (unpatched, `keymap=Map Meta Keys`) | SIGSEGV - new coredump at 12:05:54 |
 | Apply fix, rebuild, same profile | No crash - exit code 0, no new coredump |
 | Debug log after fix | `rdp_keyboard_remapping_list:` (empty, as expected) |
 ## Local workaround (applied)
 | Item | Value |
 |------|-------|
 | Mothership profile `keymap` | Set to empty (`keymap=`) as safe setting |
 | Patched plugin | `~/.config/remmina/plugins/remmina-plugin-rdp.so` (loads before system plugin) |
 | Source build | `~/external/remmina/` (branch `fix/rdp-xopendisplay-null-check`) |
 The patched plugin in `~/.config/remmina/plugins/` protects the system
 Remmina (`/usr/bin/remmina`) even if `keymap` is set to a non-empty value.
 ## Upstream contribution
 ### GitLab.com setup (one-time)
 | Item | Value |
 |------|-------|
 | GitLab.com group | `gitlab.com/satware` (public, ID 136548341) |
 | User | `ironmikechw` (ID 39970188, Owner of `satware` group) |
 | PAT | Stored in `~/.env` as `GITLAB_COM_API_TOKEN` |
 | glab CLI | Authenticated to both `gitlab.satware.com` and `gitlab.com` |
 ### Fork and MR
 | Item | Value |
 |------|-------|
 | Upstream | `gitlab.com/Remmina/Remmina` (canonical, project ID 7153509) |
 | Fork | `gitlab.com/satware/Remmina` (project ID 84057632) |
 | Local clone | `~/external/remmina/` with `upstream` remote added |
 | Build | `cmake -Bbuild -H. -DCMAKE_BUILD_TYPE=Debug -DWITH_FREERDP3=ON` |
 | Branch | `fix/rdp-xopendisplay-null-check` |
 | Commit | `e6084bd7f` - "rdp: fix SIGSEGV when XOpenDisplay returns NULL on Wayland" |
 | MR | [!2757](https://gitlab.com/Remmina/Remmina/-/merge_requests/2757) (opened, target: master) |
 ### Build notes
 - CMake flag `-DWITH_FREERDP3=ON` is required (default is OFF/FreeRDP2)
 - All build deps present on this workstation (FreeRDP3 3.27.0, GTK3 3.24.52, etc.)
 - Build time: ~30 seconds (incremental, 16 cores)
 - Plugin loads from `~/.config/remmina/plugins/` (alt dir, checked before system)
 ## Files touched
 | File | Change |
 |------|--------|
 | `~/.local/share/remmina/group_rdp_mothership_10-10-202-4.remmina` | `keymap=Map Meta Keys` -> `keymap=` (safe setting) |
 | `~/.config/remmina/plugins/remmina-plugin-rdp.so` | Patched plugin (built from source) |
 | `~/external/remmina/plugins/rdp/rdp_plugin.c` | 4-line NULL check fix (committed + pushed) |
 | `~/.env` | `GITLAB_COM_API_TOKEN` added (for glab CLI) |
 | `~/.config/glab-cli/config.yml` | gitlab.com host added (glab auth login) |
 ## References
 - MR: https://gitlab.com/Remmina/Remmina/-/merge_requests/2757
 - Fork: https://gitlab.com/satware/Remmina
 - Upstream: https://gitlab.com/Remmina/Remmina
 - CONTRIBUTING.md: fork-and-pull model on GitLab
@@ -0,0 +1,208 @@
 ---
 description: >-
  Session record (2026-07-06): triaged Caddy journald warnings on
  onlyoffice.localhost/mcp showing "context canceled" SSE aborts (~1.5ms)
  from opencode 1.17.13 MCP client against the OnlyOffice MCP server on
  :3847. Verified upstream liveness, opened GitLab issue #92 in
  satware/mcp/onlyoffice, and documented the Caddy reverse-proxy as a
  manual override.
 tags:
  - learning
  - caddy
  - onlyoffice
  - mcp
  - sse
  - reverse-proxy
  - investigation
 last_updated: '2026-07-06'
 ---
 # Caddy "context canceled" on onlyoffice.localhost/mcp - investigation - 2026-07-06
 ## Summary
 Caddy (systemd `caddy.service`) on `mw-manjaro-pf` is emitting a high
 volume of `warn`-level journald entries: `aborting with incomplete
 response ... error: "reading: context canceled"` for `GET /mcp` requests
 on `https://onlyoffice.localhost`. Each abort fires ~1.5ms after the
 request is forwarded to the upstream `localhost:3847` (OnlyOffice MCP
 server). The upstream is alive and correctly rejects non-SSE GETs with
 HTTP 406, so this is a stream-lifecycle issue, not a server-down issue.
 Investigation handed off to the OnlyOffice MCP repo as GitLab issue #92.
 This workstation's Caddy reverse-proxy config is now recorded as a manual
 override (not Ansible-managed).
 ## Incident
 | Field | Value |
 |-------|-------|
 | Symptom | Repeated `context canceled` warnings in `journalctl -u caddy` |
 | Caddy site | `https://onlyoffice.localhost` -> `reverse_proxy localhost:3847` |
 | Upstream | `localhost:3847` (OnlyOffice MCP server) |
 | Request | `GET /mcp` with `Accept: text/event-stream` |
 | Client | `opencode/1.17.13` (MCP streamable-HTTP transport) |
 | MCP protocol | `2025-11-25` |
 | Abort duration | ~1.5ms (request forwarded, then read context canceled) |
 | Frequency | Multiple per minute, across distinct `Mcp-Session-Id` values |
 ## Evidence
 ### Caddy log sample (recurring)
 ```json
 {
  "level": "warn",
  "logger": "http.handlers.reverse_proxy",
  "msg": "aborting with incomplete response",
  "upstream": "localhost:3847",
  "duration": 0.00173631,
  "request": {
    "method": "GET",
    "host": "onlyoffice.localhost",
    "uri": "/mcp",
    "headers": {
      "Accept": ["text/event-stream"],
      "Mcp-Protocol-Version": ["2025-11-25"],
      "Mcp-Session-Id": ["a5e859b4-01f1-4c24-81bb-78ee02d74357"],
      "User-Agent": ["opencode/1.17.13"],
      "Via": ["1.1 Caddy"]
    }
  },
  "error": "reading: context canceled"
 }
 ```
 Observed `Mcp-Session-Id` values (each retried over several minutes):
 `a5e859b4...`, `4bfbb912...`, `3c4a0454...`, `08397c3d...`,
 `ed762f08...`, `b0fae341...`.
 ### Upstream liveness verification
 ```bash
 $ ss -tlnp | grep :3847
 LISTEN 0  4096  0.0.0.0:3847  0.0.0.0:*
 $ curl -sS -o /dev/null -w "HTTP %{http_code} in %{time_total}s\n" \
    --max-time 3 http://localhost:3847/mcp
 HTTP 406 in 0.004665s
 ```
 HTTP 406 is expected for a plain GET without the required SSE headers.
 The MCP server is alive and rejecting non-SSE requests correctly.
 ## Diagnosis
 ### Root cause (not yet confirmed - under investigation)
 Five candidate hypotheses, listed in the GitLab issue. The leading
 suspect is **client-side disconnect**: opencode 1.17.13 opens the SSE
 stream then immediately closes it (the ~1.5ms duration is too short for
 a genuine read). Secondary suspects are server-side stream teardown,
 MCP protocol-version mismatch (`2025-11-25`), Caddy HTTP/1.1 framing of
 SSE, or a client session-pool bug creating and abandoning sessions.
 ### Why this workstation's concern
 The Caddy reverse-proxy is the boundary that surfaces the symptom. Even
 if the root cause is client- or server-side, the local config matters
 because:
 1. Caddy logs are being polluted with warn-level noise (masks real errors).
 2. The reverse-proxy block has no SSE-specific tuning (`flush_interval`,
   explicit HTTP/1.1 transport) that could mask or mitigate upstream
   misbehavior.
 3. The Caddy config at `/etc/caddy/conf.d/localhost-dev.conf` is **not**
   Ansible-managed by this repo - it is a manual override that must be
   recorded (see `docs/tech/manual-overrides.md`).
 ## Environment
 | Component | Version / Value |
 |-----------|----------------|
 | Host | `mw-manjaro-pf` (mw-pfeddersheim-workstation) |
 | OS | Manjaro Linux, Wayland session |
 | Caddy | systemd `caddy.service`, active since 2026-07-02 |
 | Caddy config | `/etc/caddy/Caddyfile` + `/etc/caddy/conf.d/localhost-dev.conf` |
 | TLS cert | mkcert pair at `/etc/caddy/localhost{,-key}.pem` |
 | Upstream | `localhost:3847` (OnlyOffice MCP server, process TBD) |
 | MCP client | `opencode/1.17.13` |
 | MCP protocol | `2025-11-25` (streamable HTTP transport) |
 ## *.localhost sites configured
 All defined in `/etc/caddy/conf.d/localhost-dev.conf` (14 sites total):
 | Site | Backend / Handler |
 |------|-------------------|
 | `mcp.localhost` | `reverse_proxy localhost:50880` |
 | `artifacts.localhost` | `file_server browse` root `/var/www/artifacts` |
 | `onlyoffice.localhost` | `reverse_proxy localhost:3847` (subject of this issue) |
 | `project-1.localhost` ... `project-10.localhost` | `respond "project-N - placeholder"` (10 reserved) |
 | `demo.satware.com.localhost` | `reverse_proxy localhost:38081` (webdevops/php-apache-dev container) |
 ## Handoff
 ### GitLab issue
 | Item | Value |
 |------|-------|
 | Project | `satware/mcp/onlyoffice` (`gitlab.satware.com`) |
 | Issue | [#92](https://gitlab.satware.com/satware/mcp/onlyoffice/-/work_items/92) |
 | Title | Investigation: Caddy reports 'context canceled' on onlyoffice.localhost/mcp SSE stream (~1.5ms aborts) |
 | Labels | `bug`, `investigation`, `mcp` |
 | State | open |
 The issue body contains the full evidence, 5 hypotheses, 7 investigation
 tasks, and a proposed Caddy mitigation (`flush_interval -1` +
 `transport http { versions 1.1 }`).
 ### Next actions (assigned to OnlyOffice MCP repo)
 1. Identify the process listening on `:3847` (`sudo ss -tlnp | grep 3847`).
 2. Collect server-side logs for the `Mcp-Session-Id` values cited above.
 3. Reproduce with `curl -N -H "Accept: text/event-stream" -H "Mcp-Protocol-Version: 2025-11-25" https://onlyoffice.localhost/mcp`.
 4. Check opencode 1.17.13 changelog for MCP SSE session bugs.
 5. Verify Caddy `reverse_proxy` SSE tuning (proposed block in issue #92).
 6. Confirm whether `notifications/initialized` round-trip completes.
 7. Log the negotiated MCP protocol version server-side.
 ## Local documentation updates
 | File | Change |
 |------|-------|
 | `docs/tech/manual-overrides.md` | Added row for `/etc/caddy/` config (not Ansible-managed) |
 | `docs/tech/stack.md` | Added "Local Dev Services" section listing Caddy + `*.localhost` sites |
 | `CHANGELOG.md` | Added `[Unreleased] -> Added` entry |
 | GitLab issue #92 | Created with full evidence + hypotheses + tasks |
 ## Proposed Caddy mitigation (to test on this workstation)
 ```caddyfile
 https://onlyoffice.localhost {
    tls /etc/caddy/localhost.pem /etc/caddy/localhost-key.pem
    reverse_proxy localhost:3847 {
        flush_interval -1
        transport http {
            versions 1.1
        }
    }
 }
 ```
 `flush_interval -1` disables Caddy's buffering so SSE events flush to the
 client immediately; `transport http { versions 1.1 }` pins the upstream
 leg to HTTP/1.1 (Caddy logs already show HTTP/1.1 for the upstream, this
 makes it explicit and avoids HTTP/2 SSE framing surprises).
 Not applied yet - pending GitLab issue #92 resolution to avoid masking
 the root cause.
 ## References
 - GitLab issue: https://gitlab.satware.com/satware/mcp/onlyoffice/-/work_items/92
 - Caddy config: `/etc/caddy/conf.d/localhost-dev.conf`
 - Local skill: `caddy` (`~/.config/opencode/skills/caddy/SKILL.md`)
 - MCP transport spec: https://modelcontextprotocol.io/specification/2025-11-25/basic/transports
 - Manual overrides: `docs/tech/manual-overrides.md`
 - Software stack: `docs/tech/stack.md`
@@ -0,0 +1 @@
 /.quarto/
@@ -0,0 +1,14 @@
 format:
  typst-pdf:
    default: true
    toc: false
    number-sections: true
    mainfont: "Inter"
    monofont: "JetBrains Mono"
    fontsize: 9pt
    papersize: a4
    margin:
      top: 1.2cm
      bottom: 1.2cm
      left: 1.5cm
      right: 1.5cm
@@ -0,0 +1,128 @@
 /* Cheatsheet CSS for Markdown → HTML → PDF via WeasyPrint */
 /* Clean, professional tables with Inter + JetBrains Mono */
@page {
  size: a4 portrait;
  margin: 10mm 14mm 10mm 14mm;
  @bottom-center {
    content: "Seite " counter(page);
    font-size: 7pt;
    color: #999;
  }
 }
 * { margin-top: 0; }
 body {
  font-family: "Inter", "DejaVu Sans", sans-serif;
  font-size: 9pt;
  line-height: 1.3;
  color: #111;
 }
 h1 {
  font-size: 14pt;
  font-weight: 700;
  margin-bottom: 4pt;
  padding-bottom: 4pt;
  border-bottom: 1.5pt solid #111;
 }
 h2 {
  font-size: 10.5pt;
  font-weight: 700;
  margin: 10pt 0 4pt 0;
  color: #003366;
  border-bottom: 0.5pt solid #ccc;
 }
 h3 {
  font-size: 9pt;
  font-weight: 600;
  margin: 6pt 0 2pt 0;
  color: #003366;
 }
 p { margin: 2pt 0; }
 /* ---- Tables: clean reference style ---- */
 table {
  width: 100%;
  border-collapse: collapse;
  margin: 2pt 0 6pt 0;
  font-size: 8pt;
  page-break-inside: avoid;
 }
 th {
  background: #f0f4f8;
  font-weight: 700;
  font-size: 7.5pt;
  text-transform: uppercase;
  letter-spacing: 0.04em;
  color: #003366;
  padding: 3pt 5pt;
  border: none;
  border-bottom: 1pt solid #0066cc;
  text-align: left;
 }
 td {
  padding: 2pt 5pt;
  border: none;
  border-bottom: 0.5pt solid #e4e4e4;
  vertical-align: top;
 }
 tbody tr:nth-child(even) td {
  background: #f7f9fb;
 }
 tbody tr:last-child td {
  border-bottom: none;
 }
 /* ---- Code / key rendering ---- */
 code, kbd {
  font-family: "JetBrains Mono", monospace;
  font-size: 8pt;
  background: #f5f5f5;
  padding: 1pt 3pt;
  border-radius: 2pt;
  border: 0.5pt solid #ddd;
 }
 pre {
  font-family: "JetBrains Mono", monospace;
  font-size: 7.5pt;
  background: #f5f5f5;
  padding: 4pt 6pt;
  border-radius: 3pt;
  border: 0.5pt solid #ddd;
  page-break-inside: avoid;
  white-space: pre-wrap;
 }
 /* ---- Two-column cheatsheet layout ---- */
 .twocol {
  column-count: 2;
  column-gap: 14pt;
 }
 .twocol h2 {
  break-before: column;
  column-break-before: always;
 }
 .twocol h2:first-child {
  break-before: avoid;
  column-break-before: avoid;
 }
 hr {
  border: none;
  border-top: 0.5pt solid #ddd;
  margin: 6pt 0;
 }
 a { color: #0066cc; text-decoration: none; }
@@ -1,3 +1,9 @@
 ---
 title: "Hyprland Keybindings Cheatsheet"
 author: "mw-pfeddersheim-workstation"
 date: "May 2026"
 ---
 # Hyprland Keybindings — Full Cheatsheet
 **Layout:** German (de) | **Mod key:** SUPER (Windows key) | **Source:** `hyprctl binds` live
@@ -0,0 +1,200 @@
 #set document(title: "Hyprland Keybindings - Pandoc")
 #set text(font: ("Inter", "DejaVu Sans"), size: 9pt, lang: "de")
 #set page(paper: "a4", margin: 1.2cm)
 #set heading(numbering: "1.")
 #set par(leading: 0.45em)
 #show link: set text(navy)
 #let horizontalrule = h(25%) + line(stroke: 0.5pt, length: 50%)
 = Hyprland Keybindings --- Full Cheatsheet
 <hyprland-keybindings-full-cheatsheet>
 #strong[Layout:] German (de) | #strong[Mod key:] SUPER (Windows key) |
 #strong[Source:] `hyprctl binds` live
 #horizontalrule
 == General
 <general>
 #figure(
  align(center)[#table(
    columns: (37.04%, 29.63%, 33.33%),
    align: (auto,auto,auto,),
    table.header([Shortcut], [Action], [Details],),
    table.hline(),
    [`SUPER+Q`], [Open terminal], [kitty],
    [`SUPER+C`], [Kill active window], [killactive],
    [`SUPER+M`], [Exit Hyprland], [exit],
    [`SUPER+E`], [File manager], [dolphin],
    [`SUPER+V`], [Toggle floating], [togglefloating],
    [`SUPER+D`], [App launcher], [hyprlauncher],
    [`SUPER+P`], [Toggle pseudo-split], [pseudo],
    [`SUPER+J`], [Toggle split direction], [layoutmsg togglesplit],
    [`SUPER+F`], [Toggle fullscreen], [fullscreen 0],
    [`SUPER+R`], [Reload config], [hyprctl reload],
    [`SUPER+SPACE`], [Toggle float (popup)], [togglefloating],
    [`SUPER+TAB`], [Cycle next window], [cyclenext],
    [`SUPER+SHIFT+TAB`], [Cycle previous window], [cyclenext prev],
    [`SUPER+` #raw("`") (Grave)], [Toggle
    scratchpad], [togglespecialworkspace],
    [`SUPER+SHIFT+` #raw("`");], [Send window to
    scratchpad], [movetoworkspace special],
    [`SUPER+CTRL+K`], [Keybind cheat menu], [#emph[(broken --- pipelines
    to grep+fuzzel)];],
    [`SUPER+CTRL+L`], [Lock screen], [hyprlock],
    [`SUPER+B`], [Web browser], [google-chrome-stable],
  )]
  , kind: table
  )
 == Navigation / Focus
 <navigation-focus>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+TAB`], [Cycle next window],
    [`SUPER+SHIFT+TAB`], [Cycle previous window],
    [`SUPER+H`], [Move focus left],
    [`SUPER+L`], [Move focus right],
    [`SUPER+left arrow`], [Move focus left],
    [`SUPER+right arrow`], [Move focus right],
    [`SUPER+up arrow`], [Move focus up],
    [`SUPER+down arrow`], [Move focus down],
  )]
  , kind: table
  )
 == Window Movement
 <window-movement>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+SHIFT+H`], [Move window left],
    [`SUPER+SHIFT+L`], [Move window right],
    [`SUPER+SHIFT+K`], [Move window up],
    [`SUPER+SHIFT+J`], [Move window down],
    [`SUPER+SHIFT+left`], [Move window left],
    [`SUPER+SHIFT+right`], [Move window right],
    [`SUPER+SHIFT+up`], [Move window up],
    [`SUPER+SHIFT+down`], [Move window down],
  )]
  , kind: table
  )
 == Window Resize
 <window-resize>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+ALT+H`], [Resize active: width -40],
    [`SUPER+ALT+L`], [Resize active: width +40],
    [`SUPER+ALT+K`], [Resize active: height -40],
    [`SUPER+ALT+J`], [Resize active: height +40],
  )]
  , kind: table
  )
 == Screenshots
 <screenshots>
 #figure(
  align(center)[#table(
    columns: (41.67%, 33.33%, 25%),
    align: (auto,auto,auto,),
    table.header([Shortcut], [Action], [Tool],),
    table.hline(),
    [`Print`], [Area select → save + copy], [grimblast copysave area],
    [`SUPER+Print`], [Active window → save + copy], [grimblast copysave
    active],
    [`SUPER+SHIFT+Print`], [Full monitor → save + copy], [grimblast
    copysave output],
    [`SUPER+ALT+Print`], [Area select → annotate], [grim],
  )]
  , kind: table
  )
 == Workspaces
 <workspaces>
 #figure(
  align(center)[#table(
    columns: (55.56%, 44.44%),
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+1..9`], [Switch to workspace 1-9],
    [`SUPER+SHIFT+1..9`], [Move active window to workspace 1-9],
    [`SUPER+` #raw("`");], [Toggle scratchpad (togglespecialworkspace)],
    [`SUPER+SHIFT+` #raw("`");], [Move to scratchpad (movetoworkspace
    special)],
  )]
  , kind: table
  )
 === Workspace Layout
 <workspace-layout>
 #figure(
  align(center)[#table(
    columns: 3,
    align: (auto,auto,auto,),
    table.header([Workspace], [Monitor], [Position],),
    table.hline(),
    [1], [DP-1 (TERRA 3280W)], [Left, 2560x1440\@144],
    [2], [DVI-D-1 (BenQ BL2405)], [Center, 1920x1080\@60 rotated 90deg],
    [3], [HDMI-A-1 (TERRA 3280W)], [Right, 2560x1440\@144],
  )]
  , kind: table
  )
 == Notes
 <notes>
 - `SUPER+CTRL+K` (keybind menu) does #strong[not work] --- the `sed`
  pipeline breaks. Needs fix.
 - The `sed` pipeline `sed 's/^bind\s*=\s*\$mainMod/SUPER/;s/\s*#/#/'`
  fails silently because the unescaped `$` in the `sed` command gets
  interpreted as a variable.
 == Troubleshooting
 <troubleshooting>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Issue], [Check],),
    table.hline(),
    [Print key not working], [`hyprctl binds | grep Print`],
    [`SUPER+R` not working], [`hyprctl binds | grep 'reload'`],
    [Screenshots fail], [`which grimblast satty slurp grim`],
    [Clipboard empty], [`echo test | wl-copy && wl-paste`],
  )]
  , kind: table
  )
 == Satty Editor Shortcuts
 <satty-editor-shortcuts>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Action], [Shortcut],),
    table.hline(),
    [Freehand], [F],
    [Rectangle], [R],
    [Ellipse], [E],
    [Line/Arrow], [L],
    [Text], [T],
    [Blur], [B],
    [Crop], [C],
    [Undo], [Ctrl+Z],
    [Redo], [Ctrl+Shift+Z],
    [Copy], [Ctrl+C],
    [Save], [Ctrl+S],
    [Quit], [Esc or Ctrl+Q],
  )]
  , kind: table
  )
@@ -0,0 +1,193 @@
 = Hyprland Keybindings --- Full Cheatsheet
 <hyprland-keybindings-full-cheatsheet>
 #strong[Layout:] German (de) | #strong[Mod key:] SUPER (Windows key) |
 #strong[Source:] `hyprctl binds` live
 #horizontalrule
 == General
 <general>
 #figure(
  align(center)[#table(
    columns: (37.04%, 29.63%, 33.33%),
    align: (auto,auto,auto,),
    table.header([Shortcut], [Action], [Details],),
    table.hline(),
    [`SUPER+Q`], [Open terminal], [kitty],
    [`SUPER+C`], [Kill active window], [killactive],
    [`SUPER+M`], [Exit Hyprland], [exit],
    [`SUPER+E`], [File manager], [dolphin],
    [`SUPER+V`], [Toggle floating], [togglefloating],
    [`SUPER+D`], [App launcher], [hyprlauncher],
    [`SUPER+P`], [Toggle pseudo-split], [pseudo],
    [`SUPER+J`], [Toggle split direction], [layoutmsg togglesplit],
    [`SUPER+F`], [Toggle fullscreen], [fullscreen 0],
    [`SUPER+R`], [Reload config], [hyprctl reload],
    [`SUPER+SPACE`], [Toggle float (popup)], [togglefloating],
    [`SUPER+TAB`], [Cycle next window], [cyclenext],
    [`SUPER+SHIFT+TAB`], [Cycle previous window], [cyclenext prev],
    [`SUPER+` #raw("`") (Grave)], [Toggle
    scratchpad], [togglespecialworkspace],
    [`SUPER+SHIFT+` #raw("`");], [Send window to
    scratchpad], [movetoworkspace special],
    [`SUPER+CTRL+K`], [Keybind cheat menu], [#emph[(broken --- pipelines
    to grep+fuzzel)];],
    [`SUPER+CTRL+L`], [Lock screen], [hyprlock],
    [`SUPER+B`], [Web browser], [google-chrome-stable],
  )]
  , kind: table
  )
 == Navigation / Focus
 <navigation-focus>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+TAB`], [Cycle next window],
    [`SUPER+SHIFT+TAB`], [Cycle previous window],
    [`SUPER+H`], [Move focus left],
    [`SUPER+L`], [Move focus right],
    [`SUPER+left arrow`], [Move focus left],
    [`SUPER+right arrow`], [Move focus right],
    [`SUPER+up arrow`], [Move focus up],
    [`SUPER+down arrow`], [Move focus down],
  )]
  , kind: table
  )
 == Window Movement
 <window-movement>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+SHIFT+H`], [Move window left],
    [`SUPER+SHIFT+L`], [Move window right],
    [`SUPER+SHIFT+K`], [Move window up],
    [`SUPER+SHIFT+J`], [Move window down],
    [`SUPER+SHIFT+left`], [Move window left],
    [`SUPER+SHIFT+right`], [Move window right],
    [`SUPER+SHIFT+up`], [Move window up],
    [`SUPER+SHIFT+down`], [Move window down],
  )]
  , kind: table
  )
 == Window Resize
 <window-resize>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+ALT+H`], [Resize active: width -40],
    [`SUPER+ALT+L`], [Resize active: width +40],
    [`SUPER+ALT+K`], [Resize active: height -40],
    [`SUPER+ALT+J`], [Resize active: height +40],
  )]
  , kind: table
  )
 == Screenshots
 <screenshots>
 #figure(
  align(center)[#table(
    columns: (41.67%, 33.33%, 25%),
    align: (auto,auto,auto,),
    table.header([Shortcut], [Action], [Tool],),
    table.hline(),
    [`Print`], [Area select → save + copy], [grimblast copysave area],
    [`SUPER+Print`], [Active window → save + copy], [grimblast copysave
    active],
    [`SUPER+SHIFT+Print`], [Full monitor → save + copy], [grimblast
    copysave output],
    [`SUPER+ALT+Print`], [Area select → annotate], [grim],
  )]
  , kind: table
  )
 == Workspaces
 <workspaces>
 #figure(
  align(center)[#table(
    columns: (55.56%, 44.44%),
    align: (auto,auto,),
    table.header([Shortcut], [Action],),
    table.hline(),
    [`SUPER+1..9`], [Switch to workspace 1-9],
    [`SUPER+SHIFT+1..9`], [Move active window to workspace 1-9],
    [`SUPER+` #raw("`");], [Toggle scratchpad (togglespecialworkspace)],
    [`SUPER+SHIFT+` #raw("`");], [Move to scratchpad (movetoworkspace
    special)],
  )]
  , kind: table
  )
 === Workspace Layout
 <workspace-layout>
 #figure(
  align(center)[#table(
    columns: 3,
    align: (auto,auto,auto,),
    table.header([Workspace], [Monitor], [Position],),
    table.hline(),
    [1], [DP-1 (TERRA 3280W)], [Left, 2560x1440\@144],
    [2], [DVI-D-1 (BenQ BL2405)], [Center, 1920x1080\@60 rotated 90deg],
    [3], [HDMI-A-1 (TERRA 3280W)], [Right, 2560x1440\@144],
  )]
  , kind: table
  )
 == Notes
 <notes>
 - `SUPER+CTRL+K` (keybind menu) does #strong[not work] --- the `sed`
  pipeline breaks. Needs fix.
 - The `sed` pipeline `sed 's/^bind\s*=\s*\$mainMod/SUPER/;s/\s*#/#/'`
  fails silently because the unescaped `$` in the `sed` command gets
  interpreted as a variable.
 == Troubleshooting
 <troubleshooting>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Issue], [Check],),
    table.hline(),
    [Print key not working], [`hyprctl binds | grep Print`],
    [`SUPER+R` not working], [`hyprctl binds | grep 'reload'`],
    [Screenshots fail], [`which grimblast satty slurp grim`],
    [Clipboard empty], [`echo test | wl-copy && wl-paste`],
  )]
  , kind: table
  )
 == Satty Editor Shortcuts
 <satty-editor-shortcuts>
 #figure(
  align(center)[#table(
    columns: 2,
    align: (auto,auto,),
    table.header([Action], [Shortcut],),
    table.hline(),
    [Freehand], [F],
    [Rectangle], [R],
    [Ellipse], [E],
    [Line/Arrow], [L],
    [Text], [T],
    [Blur], [B],
    [Crop], [C],
    [Undo], [Ctrl+Z],
    [Redo], [Ctrl+Shift+Z],
    [Copy], [Ctrl+C],
    [Save], [Ctrl+S],
    [Quit], [Esc or Ctrl+Q],
  )]
  , kind: table
  )
@@ -0,0 +1,126 @@
 ---
 title: "Hyprland Keybindings Cheatsheet"
 author: "mw-pfeddersheim-workstation"
 date: "May 2026"
 ---
 # Hyprland Keybindings — Full Cheatsheet
 **Layout:** German (de) | **Mod key:** SUPER (Windows key) | **Source:** `hyprctl binds` live
 ---
 ## General
 | Shortcut | Action | Details |
 |----------|--------|---------|
 | `SUPER+Q` | Open terminal | kitty |
 | `SUPER+C` | Kill active window | killactive |
 | `SUPER+M` | Exit Hyprland | exit |
 | `SUPER+E` | File manager | dolphin |
 | `SUPER+V` | Toggle floating | togglefloating |
 | `SUPER+D` | App launcher | hyprlauncher |
 | `SUPER+P` | Toggle pseudo-split | pseudo |
 | `SUPER+J` | Toggle split direction | layoutmsg togglesplit |
 | `SUPER+F` | Toggle fullscreen | fullscreen 0 |
 | `SUPER+R` | Reload config | hyprctl reload |
 | `SUPER+SPACE` | Toggle float (popup) | togglefloating |
 | `SUPER+TAB` | Cycle next window | cyclenext |
 | `SUPER+SHIFT+TAB` | Cycle previous window | cyclenext prev |
 | `SUPER+` `` ` `` (Grave) | Toggle scratchpad | togglespecialworkspace |
 | `SUPER+SHIFT+` `` ` `` | Send window to scratchpad | movetoworkspace special |
 | `SUPER+CTRL+K` | Keybind cheat menu | *(broken — pipelines to grep+fuzzel)* |
 | `SUPER+CTRL+L` | Lock screen | hyprlock |
 | `SUPER+B` | Web browser | google-chrome-stable |
 ## Navigation / Focus
 | Shortcut | Action |
 |----------|--------|
 | `SUPER+TAB` | Cycle next window |
 | `SUPER+SHIFT+TAB` | Cycle previous window |
 | `SUPER+H` | Move focus left |
 | `SUPER+L` | Move focus right |
 | `SUPER+left arrow` | Move focus left |
 | `SUPER+right arrow` | Move focus right |
 | `SUPER+up arrow` | Move focus up |
 | `SUPER+down arrow` | Move focus down |
 ## Window Movement
 | Shortcut | Action |
 |----------|--------|
 | `SUPER+SHIFT+H` | Move window left |
 | `SUPER+SHIFT+L` | Move window right |
 | `SUPER+SHIFT+K` | Move window up |
 | `SUPER+SHIFT+J` | Move window down |
 | `SUPER+SHIFT+left` | Move window left |
 | `SUPER+SHIFT+right` | Move window right |
 | `SUPER+SHIFT+up` | Move window up |
 | `SUPER+SHIFT+down` | Move window down |
 ## Window Resize
 | Shortcut | Action |
 |----------|--------|
 | `SUPER+ALT+H` | Resize active: width -40 |
 | `SUPER+ALT+L` | Resize active: width +40 |
 | `SUPER+ALT+K` | Resize active: height -40 |
 | `SUPER+ALT+J` | Resize active: height +40 |
 ## Screenshots
 | Shortcut | Action | Tool |
 |----------|--------|------|
 | `Print` | Area select → save + copy | grimblast copysave area |
 | `SUPER+Print` | Active window → save + copy | grimblast copysave active |
 | `SUPER+SHIFT+Print` | Full monitor → save + copy | grimblast copysave output |
 | `SUPER+ALT+Print` | Area select → annotate | grim | slurp | satty |
 ## Workspaces
 | Shortcut | Action |
 |----------|--------|
 | `SUPER+1..9` | Switch to workspace 1-9 |
 | `SUPER+SHIFT+1..9` | Move active window to workspace 1-9 |
 | `SUPER+` `` ` `` | Toggle scratchpad (togglespecialworkspace) |
 | `SUPER+SHIFT+` `` ` `` | Move to scratchpad (movetoworkspace special) |
 ### Workspace Layout
 | Workspace | Monitor | Position |
 |-----------|---------|----------|
 | 1 | DP-1 (TERRA 3280W) | Left, 2560x1440@144 |
 | 2 | DVI-D-1 (BenQ BL2405) | Center, 1920x1080@60 rotated 90deg |
 | 3 | HDMI-A-1 (TERRA 3280W) | Right, 2560x1440@144 |
 ## Notes
 - `SUPER+CTRL+K` (keybind menu) does **not work** — the `sed` pipeline breaks. Needs fix.
 - The `sed` pipeline `sed 's/^bind\s*=\s*\$mainMod/SUPER/;s/\s*#/#/'` fails silently because the unescaped `$` in the `sed` command gets interpreted as a variable.
 ## Troubleshooting
 | Issue | Check |
 |-------|-------|
 | Print key not working | `hyprctl binds | grep Print` |
 | `SUPER+R` not working | `hyprctl binds | grep 'reload'` |
 | Screenshots fail | `which grimblast satty slurp grim` |
 | Clipboard empty | `echo test | wl-copy && wl-paste` |
 ## Satty Editor Shortcuts
 | Action | Shortcut |
 |--------|----------|
 | Freehand | F |
 | Rectangle | R |
 | Ellipse | E |
 | Line/Arrow | L |
 | Text | T |
 | Blur | B |
 | Crop | C |
 | Undo | Ctrl+Z |
 | Redo | Ctrl+Shift+Z |
 | Copy | Ctrl+C |
 | Save | Ctrl+S |
 | Quit | Esc or Ctrl+Q |
@@ -0,0 +1,7 @@
 #set document(title: "Hyprland Keybindings - Pandoc")
 #set text(font: ("Inter", "DejaVu Sans"), size: 9pt, lang: "de")
 #set page(paper: "a4", margin: 1.2cm)
 #set heading(numbering: "1.")
 #set par(leading: 0.45em)
 #show link: set text(navy)
 #let horizontalrule = h(25%) + line(stroke: 0.5pt, length: 50%)
@@ -0,0 +1,18 @@
 #set document(title: $if(title)$$title$$else$""$endif$)
 #set text(font: ($if(mainfont)$"$mainfont"$else$"Inter"$endif$, "DejaVu Sans"), size: $if(fontsize)$$fontsize$$else$9pt$endif$, lang: $if(lang)$$lang$$else$en$endif$)
 #set page(paper: "a4", margin: $if(margin-top)$($margin-top$,$else$1.5cm,$endif$ $if(margin-bottom)$$margin-bottom$,$else$1.5cm,$endif$ $if(margin-left)$$margin-left$,$else$1.5cm,$endif$ $if(margin-right)$$margin-right,$else$1.5cm$endif$)$else$1.5cm$endif$)
 $if(number-sections)$#set heading(numbering: "1.")$endif$
 $for(include-before)$
 $include-before$
 $endfor$
 $body$
 $for(include-after)$
 $include-after$
 $endfor$
 $if(quotes)$#show link.label => { box(text(str: #quotes.open) + content + text(str: #quotes.close)) }$endif$
@@ -0,0 +1,279 @@
 ---
 description: >-
  Baby-step plan to sign GitHub/Git commits and tags with a hardware-backed
  OpenPGP key on YubiKey 5 NFC #30836069, generated in a dedicated air-gapped
  Debian-Live environment, with LUKS-encrypted recovery backups on the Type-C
  USB stick. Non-secret config folded into the ansible/ role; secrets via Bitwarden.
 tags:
  - plan
  - security
  - yubikey
  - gpg
  - github
 last_updated: '2026-06-24'
 ---
 # YubiKey + GPG signing for GitHub commits - 2026-06-24
 Sign all Git commits/tags with a hardware-backed OpenPGP key whose secret
 material lives on the YubiKey, and whose full recovery backup is stored
 LUKS-encrypted on the Type-C USB stick.
 ## Goal
 1. Hardware-backed commit/tag signing for GitHub (and GitLab, PGP email) using
   the YubiKey OpenPGP smartcard.
 2. A complete, offline recovery path: secret keys on a LUKS-encrypted USB stick.
 3. Non-secret configuration managed through the repository's `ansible/` role.
 ## Decisions (confirmed 2026-06-24)
 | Decision | Choice | Rationale |
 |----------|--------|-----------|
 | Approach | **A - GPG/OpenPGP** (not SSH `ed25519-sk`) | Secret keys are exportable, so a true recovery backup on USB is possible. Matches the "pgp" requirement. |
 | Keygen env | **Dedicated air-gapped** Debian-Live (internal disk disconnected) | drduh gold standard; the Certify key never touches a networked machine. |
 | Key identity | `Michael Wegener <mw@satware.com>` | Matches `git config user.email/name`. |
 | Algorithms | Certify `ed25519`; Subkeys `ed25519` (S), `cv25519` (E), `ed25519` (A) | 2026 modern; avoids RSA-deprecation for the SSH auth subkey. RSA-4096 is the fallback. |
 | Touch policy | **Required** for sign + auth | Defeats malware key use; YubiKey blinks for a physical tap. |
 | Subkey expiry | **2 years** (Certify never expires) | drduh lifecycle; renewable offline. |
 | Push transport | **HTTPS + GPG-sign** (unchanged) | Lowest risk; signing is transport-independent. SSH-via-auth-subkey deferred. |
 | Config mgmt | Fold non-secret config into `ansible/` | Repo convention; reproducible. |
 | Backup target | Type-C USB `/dev/sdc` (wipe confirmed acceptable) + a 2nd USB later | Requirement #3. |
 | 2nd YubiKey | Scheduled as Phase 9 follow-up (after this key works) | Redundancy + travel spare. |
 ## Architecture - two environments
 - **Air-gapped (Debian-Live, no internal disk):** generate Certify + Subkeys,
  move Subkeys onto the YubiKey, LUKS-encrypt secrets to the USB, export the
  public key. The Certify key never leaves this environment.
 - **This workstation (Manjaro `mw-manjaro-pf`):** import the **public key
  only**, configure `git`/`gpg-agent`, sign. Private material stays on the
  YubiKey.
 ## Pre-flight facts (current state, verified 2026-06-24)
 - YubiKey 5 NFC, serial `30836069`, FW `5.7.1`, OpenPGP app **empty**,
  **sign-PIN blocked (`3 0 3`)**, PIV factory-defaults/empty, OATH empty.
 - FIDO2 has 4 credentials (incl. `github.com` -> `satwareAG-ironMike`).
 - `gh auth` token **invalid** -> re-login required.
 - USB `/dev/sdc1` = dirty FAT32 (`errors=remount-ro`) -> `fsck`, then repartition.
 - Tools present: `ykman`, `ykinfo`, `gpg`, `pcscd`; `gpg-agent.conf` already has
  `enable-ssh-support`.
 ---
 ## Phase 0 - Prep on this workstation (read/config only; no key material yet)
 1. Fix GitHub auth + confirm tooling:
   ```bash
   gh auth login -h github.com            # re-auth (browser/token)
   gh auth status
   git --version                          # >=2.34 fine; GPG works on any
   pacman -Q gnupg pcscd yubikey-manager  # all present (verified earlier)
   ```
 2. Check the USB stick holds nothing needed, then dry-run a repair:
   ```bash
   ls "/run/media/mw/Type-C USB"
   sudo fsck.vfat -n /dev/sdc1            # review output; do NOT -a yet
   ```
 3. Identify which **spare** USB will carry the Debian-Live image (Phase 1) and
   which 2nd USB will later hold the mirrored backup.
 ## Phase 1 - Build the air-gapped keygen USB (drduh method)
 1. Download Debian-Live + signature, **verify before trusting**:
   ```bash
   IMG=https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid
   curl -fLO "$IMG/SHA512SUMS" -O "$IMG/SHA512SUMS.sign"
   curl -fLO "$IMG/$(awk '/xfce.iso$/ {print $2}' SHA512SUMS)"
   gpg --keyserver hkps://keyserver.ubuntu.com:443 \
       --recv DF9B9C49EAA9298432589D76DA87E80D6294BE9B
   gpg --verify SHA512SUMS.sign SHA512SUMS         # MUST say "Good signature"
   grep "$(sha512sum debian-live-*-amd64-xfce.iso)" SHA512SUMS
   ```
 2. Write to a **spare** USB (not the backup stick):
   ```bash
   sudo dd if=debian-live-*-amd64-xfce.iso of=/dev/sdX bs=4M status=progress; sync
   ```
 ## Phase 2 - Boot air-gapped, generate keys
 1. Power off, **disconnect the internal NVMe**, boot the Debian-Live USB.
   Network can stay off.
 2. Install tools + hardened config in a **tmpfs GNUPGHOME**:
   ```bash
   sudo apt update && sudo apt -y install gnupg2 scdaemon pcscd yubikey-manager
   export GNUPGHOME=$(mktemp -d -t $(date +%Y.%m.%d)-XXXX)
   cd "$GNUPGHOME"
   wget https://raw.githubusercontent.com/drduh/YubiKey-Guide/master/config/gpg.conf
   ```
 3. Create a strong **Certify passphrase** (write it down; store it apart from
   the USB; record in Bitwarden):
   ```bash
   CERTIFY_PASS=$(LC_ALL=C tr -dc "A-Z2-9" </dev/urandom | tr -d "IOUS5" \
     | fold -w4 | paste -sd- - | head -c29); printf "\n$CERTIFY_PASS\n\n"
   ```
 4. **Certify key** (never expires):
   ```bash
   IDENTITY="Michael Wegener <mw@satware.com>"
   echo "$CERTIFY_PASS" | gpg --batch --passphrase-fd 0 \
     --quick-generate-key "$IDENTITY" ed25519 cert never
   KEYFP=$(gpg -k --with-colons "$IDENTITY" | awk -F: '/^fpr:/{print $10; exit}')
   ```
 5. **Subkeys** (2-year expiry): sign `ed25519`, encrypt `cv25519`, auth `ed25519`:
   ```bash
   echo "$CERTIFY_PASS" | gpg --batch --pinentry-mode=loopback --passphrase-fd 0 --quick-add-key "$KEYFP" ed25519 sign 2y
   echo "$CERTIFY_PASS" | gpg --batch --pinentry-mode=loopback --passphrase-fd 0 --quick-add-key "$KEYFP" cv25519 encrypt 2y
   echo "$CERTIFY_PASS" | gpg --batch --pinentry-mode=loopback --passphrase-fd 0 --quick-add-key "$KEYFP" ed25519 auth 2y
   gpg -K      # expect [C] + ssb [S] [E] [A]
   ```
 ## Phase 3 - Backup to the USB stick (requirement #3) - LUKS
 Use the **Type-C USB stick** (`/dev/sdc`), repartitioned: LUKS partition for
 secrets + small plaintext partition for the public key.
 1. Export everything:
   ```bash
   KEYID=${KEYFP: -16}
   echo "$CERTIFY_PASS" | gpg -o "$GNUPGHOME/$KEYID-Certify.key" --batch --pinentry-mode=loopback --passphrase-fd 0 --armor --export-secret-keys "$KEYID"
   echo "$CERTIFY_PASS" | gpg -o "$GNUPGHOME/$KEYID-Subkeys.key" --batch --pinentry-mode=loopback --passphrase-fd 0 --armor --export-secret-subkeys "$KEYID"
   gpg -o "$GNUPGHOME/$KEYID-$(date +%F).asc" --armor --export "$KEYID"
   ```
 2. Partition + LUKS-encrypt (confirm `/dev/sdc` is the right device - destructive):
   ```bash
   LUKS_PASS=$(LC_ALL=C tr -dc "A-Z2-9" </dev/urandom | tr -d "IOUS5" | fold -w4 | paste -sd- - | head -c29)
   sudo dd if=/dev/zero of=/dev/sdc bs=4M count=1
   sudo fdisk /dev/sdc <<EOF
   g
   n
   1
   +50M
   n
   2
   w
   EOF
   echo "$LUKS_PASS" | sudo cryptsetup -q luksFormat /dev/sdc1
   echo "$LUKS_PASS" | sudo cryptsetup luksOpen /dev/sdc1 gnupg-secrets
   sudo mkfs.ext2 /dev/mapper/gnupg-secrets
   sudo mkfs.vfat /dev/sdc2
   sudo mkdir -p /mnt/sec /mnt/pub
   sudo mount /dev/mapper/gnupg-secrets /mnt/sec
   sudo mount /dev/sdc2 /mnt/pub
   sudo cp -av "$GNUPGHOME" /mnt/sec/                       # encrypted secrets
   gpg --armor --export "$KEYID" | sudo tee "/mnt/pub/$KEYID-$(date +%F).asc" >/dev/null
   sudo umount /mnt/sec /mnt/pub
   sudo cryptsetup luksClose gnupg-secrets
   ```
 3. Record `LUKS_PASS` in Bitwarden (separate from the Certify passphrase).
 4. **Repeat Phase 3 on a 2nd USB** and store both offline in separate locations.
 ## Phase 4 - Transfer Subkeys to the YubiKey
 1. Reset the OpenPGP app (sign-PIN is blocked; app is empty, so nothing is lost):
   ```bash
   ykman openpgp reset -f        # confirm when ready
   gpg --card-status             # retry counters should read 3 3 3
   ```
 2. Change PINs from defaults and set cardholder identity. Generate your own
   `ADMIN_PIN` (8 digits) and `USER_PIN` (6 digits); store in Bitwarden:
   ```bash
   gpg --change-pin      # menu: 3 = admin PIN (12345678 -> $ADMIN_PIN)
   gpg --change-pin      # menu: 1 = user PIN  (123456   -> $USER_PIN)
   gpg --edit-card       # admin -> login -> "Michael Wegener <mw@satware.com>"
   ```
 3. Move subkeys onto the card, then require touch:
   ```bash
   gpg --edit-key "$KEYID"        # key 1 -> keytocard (sig=1)
                                  # key 2 -> keytocard (enc=2)
                                  # key 3 -> keytocard (auth=3)
                                  # save
   ykman openpgp keys set-touch sig on -f -a "$ADMIN_PIN"
   ykman openpgp keys set-touch dec on -f -a "$ADMIN_PIN"
   ykman openpgp keys set-touch aut on -f -a "$ADMIN_PIN"
   gpg -K                         # ssb> markers confirm subkeys are on the card
   ```
 ## Phase 5 - Configure this workstation (public key only)
 1. Copy the public `.asc` from the USB plaintext partition, import, trust:
   ```bash
   sudo mkdir -p /mnt/pub && sudo mount /dev/sdc2 /mnt/pub
   gpg --import /mnt/pub/*.asc
   gpg --edit-key "$KEYID"        # trust -> 5 (ultimate) -> y -> save
   ```
 2. Git signing (global; uses the **sign subkey**):
   ```bash
   SIGNID=$(gpg -k --with-colons "$KEYID" | awk -F: '/^sub:/ && /s/ {split($0,a,":"); print a[5]}')
   git config --global gpg.format openpgp
   git config --global user.signingkey "$SIGNID!"
   git config --global commit.gpgsign true
   git config --global tag.gpgsign true
   ```
 3. Agent/scdaemon (the `disable-ccid` line prevents the scdaemon-vs-pcscd lock
   observed during detection):
   ```bash
   echo "disable-ccid" >> ~/.gnupg/scdaemon.conf
   # ~/.gnupg/gpg-agent.conf already has: enable-ssh-support, cache-ttls
   gpgconf --kill gpg-agent
   ```
 ## Phase 6 - Register the public key with GitHub
 ```bash
 gpg --armor --export "$KEYID" | gh gpg-key add -     # after `gh auth login`
 # or paste at github.com/settings/keys
 ```
 Verify end-to-end: create a test commit, `git push`, the commit shows
 **Verified** on GitHub.
 ## Phase 7 - Fold non-secret config into Ansible (repo convention)
 - New role `ansible/roles/gpg_signing/` templating:
  - `~/.gnupg/gpg.conf`, `~/.gnupg/gpg-agent.conf`, `~/.gnupg/scdaemon.conf`
  - the four `git config --global` signing lines from Phase 5.2
 - Commit the **public key** to `ansible/files/mw-satware-<KEYID>.asc` (public,
  safe to track).
 - **PINs, Certify and LUKS passphrases -> Bitwarden only**, never the repo
  (zero-trust rule). Use Ansible Vault vars if a task must consume them.
 - Add the role to `ansible/workstation.yml`; verify with
  `ansible-playbook ansible/workstation.yml --check`.
 ## Phase 8 - Recovery & verification
 - **Recovery:** plug a backup USB -> `cryptsetup luksOpen /dev/sdc1 gnupg-secrets`
  -> restore `$KEYID-Subkeys.key` onto a *new* YubiKey via `keytocard`. The
  Certify key is needed only to rotate/renew subkeys.
 - Final verification checklist:
  - `gpg --card-status` shows the three subkeys with correct fingerprints.
  - `git commit -S --allow-empty -m "test"` prompts for a YubiKey tap and
    succeeds.
  - `git push`; GitHub shows the commit as **Verified**.
  - `git tag -s v-test && git verify-tag v-test` succeeds.
 ## Phase 9 - Second YubiKey (follow-up, after this key works)
 - Mirror the same Subkeys onto a backup YubiKey from the LUKS backup
  (`$KEYID-Subkeys.key` -> `keytocard`), set identical PINs and touch policy.
 - Register it on GitHub as an **additional** GPG signing key.
 - Re-register its FIDO2/WebAuthn handles for the relying parties already on the
  primary key (`github.com`, `auth.satware.ai`, `git.g-b-c.de`, `google.com`).
 - Create a **2nd backup USB** mirroring Phase 3 and store it off-site.
 ## Secrets handling (per repo zero-trust rule)
 | Item | Stored where |
 |------|--------------|
 | Public key | `ansible/files/*.asc` (committed) + USB plaintext partition |
 | Certify key + Subkeys (encrypted) | LUKS partition on USB (offline, 2 copies) |
 | Certify passphrase, LUKS passphrase, User PIN, Admin PIN | Bitwarden only (`bitwarden.jantec.xyz`), cached locally in `gnome-keyring` |
 ## References
 - GitHub: About commit signature verification (GPG/SSH/S-MIME).
 - GitHub: Generating a new SSH key (incl. `ed25519-sk` security-key variant).
 - drduh/YubiKey-Guide (canonical GPG-on-YubiKey walkthrough; LUKS backup model).
@@ -1,35 +1,87 @@
-# Next Steps - 2026-04-02
+# Next Steps - 2026-05-21
-## Immediate (Post-Reboot - GXA7801Q Firmware Activation)
+##  Immediate (Post-Reboot - Password Management Migration)
-> NVMe firmware GXA7801Q was applied 2026-04-02 but requires reboot to activate.
+> Gnome-keyring + Bitwarden migration applied 2026-05-21. Verifying PAM unlock + D-Bus secrets service after reboot.
 > Run `sudo reboot` when ready.
- [ ] Reboot workstation to activate NVMe firmware GXA7801Q
+### Verification Checklist
- [ ] Verify firmware: `nvme list` should show `GXA7801Q` (was `GXA7401Q`)
+
- [ ] Check SMART health post-update: `sudo nvme smart-log /dev/nvme0n1`
+- [ ] **Gnome-keyring auto-start**: `systemctl --user is-active gnome-keyring-daemon.service` → `active`
- [ ] Run post-update fio benchmark (same parameters as pre-update):
+- [ ] **Rbw vault access**: `rbw unlocked && rbw list | head -5`
 - [ ] **GK secret lookups work**:
  ```bash
-  fio --directory=/tmp --name=seq-read --rw=read --bs=4k --iodepth=32 \
+  secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
-    --ioengine=libaio --direct=1 --size=1g --runtime=30 --time_based
+  secret-tool lookup application git service gitlab.satware.com
  secret-tool lookup application nextcloud service cloud.satware.com user mw
  ```
 - [ ] Document before/after comparison in `docs/tech/nvme-benchmark-post-gxa7801q.md`
 - [ ] Update `docs/tech/firmware-update-research.md` status from "reboot pending" to "complete"
-## Short Term
+### Manual Steps Required After Reboot
 **1. himalaya IMAP passwords** — Were NOT in KWallet, need manual entry.
 Look up each password in https://bitwarden.jantec.xyz/ then store in GK:
 ```bash
 # MW account (mw@satware.com)
 echo "<PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
 # JA account (ja@satware.ai)
 echo "<PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
 # JA Gmail (ja.satware@gmail.com)
 echo "<PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
 # Michael Gmail (ironmikechw@gmail.com)
 echo "<PASSWORD>" | secret-tool store --label="IMAP Michael" email ironmikechw@gmail.com application himalaya
 ```
 **2. GitHub CLI** — Re-auth if token is stale:
 ```bash
 gh auth login --hostname github.com
 ```
 Then store token in GK
 ```bash
 rbw get "GitHub Personal Token" --full | secret-tool store --label="GitHub Token" application gh-cli service github.com
 ```
 ### Verification Tests
 | Area | Test Command | Expected Result |
 |------|-------------|-----------------|
 | Gnome-keyring | `systemctl --user is-active gnome-keyring-daemon.service` | `active` |
 | Bitwarden sync | `rbw unlocked && rbw list | wc -l` | `true` + 397 entries |
 | SSH passphrases | `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` | Returns "SSH gitlab.satware.com" |
 | GitLab PAT | `secret-tool lookup application git service gitlab.satware.com` | Returns PAT |
 | GitHub CLI | `gh auth status -h github.com` | Valid token (or needs re-auth) |
 | himalaya | `himalaya -a mw check` | SMTP/IMAP OK |
 | Git remotes | `git fetch` on any tracked repo | No password prompt |
 | JetBrains IDEs | Open CLion/WebStorm/IDEA | No credential prompts (auto-detects D-Bus secrets) |
 ### Cleanup (After All Verified Working)
 ```bash
 sudo pacman -Rns kwallet kwalletmanager
 rm -rf ~/.local/share/kwalletd/
 ```
 ---
 *Last updated: 2026-05-21 | Password management migration complete. Post-reboot verification pending.*
 ---
 ## Short Term (Non-Reboot)
 - [ ] Update `linux-firmware` and kernel packages: `sudo pacman -Syu linux-firmware`
 - [ ] Check NVIDIA driver version: `pacman -Q nvidia`
 - [ ] Run `scripts/update-cli-suite.sh` to sync CLI tool suite
 - [ ] Monitor system behavior under multi-day sustained load to ensure `zswap` and `MGLRU` keep the system responsive.
 - [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.
 ## Optimization
 - [ ] Evaluate if `systemd-oomd` is aggressive enough for interactive desktop use; if not, consider testing `earlyoom` as an alternative.
 - [ ] Automate periodic S.M.A.R.T. checks via a systemd timer (currently manual).
 - [ ] Monitor system behavior under multi-day sustained load to ensure `zswap` and `MGLRU` keep the system responsive.
 ## Infrastructure
 - [ ] Consolidate Ansible variables for Docker memory limits into `ansible/vars/main.yml`.
 - [ ] Extend `scripts/maintenance.sh` to include a summary of the last 24h OOM events (if any).
 - [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.
 ---
 *See `docs/product/passwords-migration-checklist.md` for detailed post-reboot actions.*
 *See `docs/product/passwords.md` for the password management architecture overview.*
 *See `docs/adr/password-management-migration.md` for the Architecture Decision Record.*
@@ -0,0 +1,187 @@
 # Password Management Infrastructure
 ## Architecture
 ```
 ┌─────────────────────────────────────────────────────────┐
 │             Bitwarden Vault ───────────╮                  │
 │        bitwarden.jantec.xyz            │ Central store   │
 │             (cloud)                    │  + backup       │
 │                                        │                 │
 │  ┌─────────────────┐                  │                 │
 │  │   rbw CLI  ─────┼─── sync/login ───┘                 │
 │  │ (Rust client)   │   Add/edit/search                  │
 │  └────────────────┘                                    │
 │           │                                              │
 │  ┌────────V────────              ┌──────────────────┐  │
 │  │ gnome-keyring   │────────────►│ Applications     │  │
 │  │ (libsecret)     │  D-Bus       │ himalaya, git,   │  │
 │  │ org.freedesktop.│  Secrets API │ SSH, browsers,   │  │
 │  │ secrets         │              │ IDEs             │  │
 │  └─────────────────┘              └──────────────────┘  │
 └─────────────────────────────────────────────────────────┘
 ```
 ## Components
 ### 1. gnome-keyring (local D-Bus secret service)
 - Provides `org.freedesktop.secrets` D-Bus interface
 - Started as systemd user service via socket activation
 - Unlocks on login (PAM integration with greetd/tuigreet)
 - Stores credentials that apps access via `libsecret` (`secret-tool`)
 | Unit | Status |
 |------|--------|
 | `~/.config/systemd/user/gnome-keyring-daemon.socket` | enabled |
 | `~/.config/systemd/user/gnome-keyring-daemon.service` | enabled |
 ### 2. rbw (Bitwarden CLI)
 - Unofficial Bitwarden CLI written in Rust
 - Connects to `https://bitwarden.jantec.xyz`
 - Uses gnome-keyring as its encrypted password store (via `pinentry`)
 - Manages vault: `rbw add`, `rbw get`, `rbw list`, `rbw search`, `rbw sync`
 | Config | Value |
 |--------|-------|
 | `~/.config/rbw/config.json` | `{"email": "ironmikechw+bitwarden@gmail.com", "base_url": "https://bitwarden.jantec.xyz"}` |
 | API Keys | Stored in `~/.config/rbw/` (registered via `rbw register`) |
 | Vault sync | Automatic via `rbw sync` (interval: 3600s) |
 ### 3. SSH Key Passphrases
 - Stored in gnome-keyring (libsecret) for `ssh-add` via `gnome-keyring-ssh` PAM module
 - Passphrases stored under `application=ssh-agent`, `service=ssh`, `ssh-key=<path>`
 - Keys migrated from KWallet: `id_ed25519`, `id_ed25519_ja_manjaro`
 ### 4. Git Credentials
 - **Global helper**: `libsecret` (stores in gnome-keyring instead of `~/.git-credentials` plaintext)
 - **GitHub**: `gh auth git-credential` helper (for github.com)
 - **GitLab**: configured as `provider = generic` in `.gitconfig` for gitlab.satware.com
 ### 5. Application Credentials Map
 | Application | Storage | Mechanism |
 |-----------|---------|-----------|
 | himalaya (email) | gnome-keyring + Bitwarden | `secret-tool lookup email <address>` |
 | ssh-agent | gnome-keyring | D-Bus secret service |
 | git (global) | gnome-keyring (`libsecret`) | `git config credential.helper libsecret` |
 | GitHub CLI | Bitwarden + gnome-keyring | `rbw get "GitHub Personal Token"` + GK entry |
 | GitLab | gnome-keyring | `secret-tool lookup application git service gitlab.satware.com` |
 | Chrome/Brave/Chromium | gnome-keyring | Safe Storage encryption keys |
 | JetBrains IDEs | gnome-keyring | D-Bus secret service auto-detection |
 | Remmina | gnome-keyring + Bitwarden | VNC/RDP passwords |
 | Nextcloud | gnome-keyring + Bitwarden | Instance passwords |
 | QGIS | gnome-keyring + Bitwarden | Master password |
 ## Startup / Unlock Flow
 ```
 1. greetd/tuigreet login → PAM auth
 2. PAM → gnome-keyring PAM module (pam_gnome_keyring.so)
 3. Keyring unlocked with login password
 4. gnome-keyring-daemon starts (socket activation)
 5. D-Bus org.freedesktop.secrets available
 6. rbw login → decrypts vault via gnome-keyring
 7. himalaya can read IMAP passwords via secret-tool
 8. ssh-add can read SSH passphrases via GK
 9. git-credential-libsecret reads Git creds via GK
 ```
 ## Migration History
 - **Before**: KDE Wallet (kwalletd) — no auto-unlock under greetd, no D-Bus support for non-Plasma apps
 - **After**: gnome-keyring + rbw + Bitwarden.vault → full D-Bus secret service + central vault + CLI access
 ## Manual Entry Required
 ### himalaya Email Passwords
 The following email account passwords need to be stored in gnome-keyring (they were NOT in KWallet):
 ```bash
 # Store MW account
 echo "<PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
 # Store JA account
 echo "<PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
 # Store JA Gmail
 echo "<PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
 # Store Michael Gmail
 echo "<PASSWORD>" | secret-tool store --label="IMAP Michael Gmail" email ironmikechw@gmail.com application himalaya
 ```
 ## Useful Commands
 ```bash
 # Bitwarden operations
 rbw list                              # list all vault entries
 rbw search <term>                     # search vault
 rbw get <name>                        # get password (truncates on display)
 rbw get --full "GitHub Personal Token" # get full password (piped)
 rbw sync                              # sync with vault
 rbw add "Service Name"                # add new entry (opens $EDITOR)
 # gnome-keyring operations
 secret-tool lookup email mw@satware.com              # lookup by attribute
 secret-tool search application ssh-agent             # search
 secret-tool store --label="Test" key value           # store (pipe data)
 dbus-send --session --print-reply --dest=org.freedesktop.secrets \
  /org/freedesktop/secrets/collection/default         # low-level D-Bus
 # Verify startup
 systemctl --user status gnome-keyring-daemon.socket
 systemctl --user status gnome-keyring-daemon.service
 # Quick health check
 rbw unlocked && echo "BW: unlocked" || echo "BW: locked"
 secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519 && echo "GK: SSH OK"
 ```
 ## Troubleshooting
 ### gnome-keyring not providing secrets on D-Bus
 ```bash
 systemctl --user restart gnome-keyring-daemon.service
 ```
 ### rbw not unlocked
 ```bash
 rbw unlock         # prompts for login password
 rbw login          # prompts for Bitwarden password
 ```
 ### SSH keys not auto-unlocking
 ```bash
 # Check GK entry
 secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
 # If missing, re-add:
 echo "<PASSPHRASE>" | secret-tool store --label="SSH id_ed25519" \
  application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
 ```
 ### GitLab/GitHub creds not working
 ```bash
 # Test GK
 secret-tool lookup application git service gitlab.satware.com
 ```
 ### himalaya password errors
 ```bash
 # Verify GK
 secret-tool lookup email mw@satware.com
 # Re-enter password from Bitwarden
 rbw get "himala mw@satware.com" | secret-tool store --label="IMAP mw@satware.com" \
  email mw@satware.com application himalaya
 ```
 ## Security Note
 - Bitwarden vault: self-hosted at `bitwarden.jantec.xyz`
 - Local cache: gnome-keyring (encrypted, session-bound)
 - No plaintext passwords in config files
 - `~/.git-credentials` removed on `git config --global credential.helper store`
@@ -0,0 +1,91 @@
 # Password Management - Migration Checklist
 ## Pre-Reboot Status (2026-05-21)
 - [x] gnome-keyring installed (`1:50.0-1`)
 - [x] rbw installed (`1.15.0`)
 - [x] gnome-keyring-daemon.socket + service enabled + active
 - [x] rbw configured: `bitwarden.jantec.xyz`, `ironmikechw+bitwarden@gmail.com`
 - [x] 397 entries synced from Bitwarden vault
 - [x] 45 entries migrated from KWallet → BW + GK
 - [x] Duplicate BW entries cleaned (22 removed)
 - [x] Git credential helper: `libsecret`
 - [x] himalaya configs using `secret-tool lookup email <addr>`
 - [x] GitHub token stored in BW + GK
 - [x] GitLab PAT stored in BW + GK
 - [x] SSH passphrases stored in BW + GK
 - [x] Browser safe storage (Chrome/Brave/Chromium) in BW + GK
 - [x] Remmina passwords (5) in BW + GK
 - [x] Nextcloud passwords (3) in BW + GK
 - [x] QGIS Master Password in BW + GK
 - [x] JetBrains AI Token in BW + GK
 - [x] Documentation written: `docs/product/passwords.md` + `docs/adr/password-management-migration.md`
 - [x] AGENTS.md updated with secrets management reference
 - [x] KDE Wallet data file backed up (not deleted)
 - [ ] KDE Wallet packages removal (post-verify)
 ## Post-Reboot Actions
 ### Immediate Checks
 ```bash
 # 1. Verify gnome-keyring started
 systemctl --user is-active gnome-keyring-daemon.service
 # 2. Verify rbw can access vault
 rbw list | head -5
 # 3. Verify GK entries
 secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
 secret-tool lookup application git service gitlab.satware.com
 secret-tool lookup application nextcloud service cloud.satware.com user mw
 # 4. Check himalaya
 himalaya account list
 himalaya -a mw check 2>&1  # tests IMAP auth
 ```
 ### Manual Steps Required
 1. **himalaya passwords** — 4 accounts need passwords re-entered into GK:
   ```bash
   for addr in mw@satware.com ja@satware.ai ja.satware@gmail.com ironmikechw@gmail.com; do
       echo "$(rbw get "$addr" | head -1)" | secret-tool store --label="IMAP $addr" email "$addr" application himalaya
   done
   ```
   (Or manually look up passwords from BW web UI and enter them)
 2. **GitHub CLI** — Re-login if token stale:
   ```bash
   gh auth login --hostname github.com --with-token
   ```
   Then store in GK:
   ```bash
   rbw get "GitHub Personal Token" | secret-tool store --label="GitHub Token" application gh-cli service github.com
   ```
 ### KDE Wallet Cleanup (After Confirmation)
 ```bash
 # Only after everything works:
 sudo pacman -Rns kwallet kwalletmanager
 rm -rf ~/.local/share/kwalletd/
 ```
 ## Rollback (If Needed)
 If gnome-keyring + rbw doesn't work properly after reboot:
 ```bash
 # Restore git credential helper
 git config --global credential.helper store
 # Kill gnome-keyring
 systemctl --user stop gnome-keyring-daemon.socket
 # Restore KWallet (if removed)
 sudo pacman -S kwallet kwalletmanager
 ```
 ## Notes
 - All migration data preserved in `~/.local/share/kwalletd/` (not deleted yet)
 - KWallet PAM refs were already commented out in `/etc/pam.d/*`
 - JetBrains IDEs will auto-detect `org.freedesktop.secrets` from gnome-keyring; no config change needed
 - Browser safe storage keys migrated — browsers will use them automatically
@@ -0,0 +1,128 @@
 # Password Management - System Guide
 ## Architecture
 ```
 ┌─────────────────────────────────────┐
 │        Bitwarden Vault              │
 │     bitwarden.jantec.xyz            │  ← Central, synced, backed up
 │         (self-hosted)               │
 │                ▲                     │
 │          rbw CLI                    │  ← CLI access, add/list/get/search
 │     (ironmikechw+bitwarden@gmail.com)│
 │                ▲                     │
 │    gnome-keyring (local)            │  ← D-Bus secrets API for apps
 │    org.freedesktop.secrets         │  ← libsecret, secret-tool
 └─────────────────────────────────────
 ```
 ## How It Works After Reboot / Login
 1. **greetd/tuigreet login** → PAM auth
 2. **PAM module** → `pam_gnome_keyring.so` unlocks keyring with login password
 3. **gnome-keyring-daemon** starts via socket activation (systemd user service)
 4. **D-Bus** `org.freedesktop.secrets` becomes available on session bus
 5. **rbw** auto-unlocks via pinentry (reads passphrase from gnome-keyring)
 6. **Apps** read secrets via `libsecret` / `secret-tool`:
   - `himalaya` → IMAP/SMTP passwords via `secret-tool lookup email <addr>`
   - `ssh-agent` → SSH key passphrases via `secret-tool lookup ... ssh-key <path>`
   - `git-credential-libsecret` → Git passwords via libsecret
     (github.com via `gh`, gitlab.satware.com via `glab`, **git.satware.ai via libsecret PAT**)
   - `JetBrains IDEs` → auto-detect D-Bus secrets service
 ## Quick Verification
 ```bash
 # Is gnome-keyring running?
 systemctl --user is-active gnome-keyring-daemon.service
 # Can rbw access the vault?
 rbw list | head -5
 rbw get "SSH Key: id_ed25519"  # should return "SSH gitlab.satware.com"
 # Can apps read secrets?
 secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
 secret-tool lookup application git service gitlab.satware.com
 secret-tool lookup server git.satware.ai protocol https user mw    # Gitea PAT (git-credential-libsecret schema)
 secret-tool lookup application nextcloud service cloud.satware.com user mw
 ```
 ## Migrated Entries (from KDE Wallet)
 | Category | Entries | Storage |
 |----------|---------|---------|
 | **SSH passphrases** | id_ed25519, id_ed25519_ja_manjaro | BW + GK |
 | **SSH host passwords** | b0t@192.168.0.141 | BW + GK |
 | **Git tokens** | GitLab PAT, GitHub token, Gitea PAT (git.satware.ai) | GK (BW pending) |
 | **Remmina** | 5 VNC/RDP passwords | BW + GK |
 | **Nextcloud** | 3 instance passwords | BW + GK |
 | **Browser crypto** | Chrome, Brave, Chromium safe storage | BW + GK |
 | **JetBrains** | AI token, Account token | BW (AI also in GK) |
 | **QGIS** | Master password | BW + GK |
 Total: ~45 entries migrated.
 ## Known Issues (Post-Reboot)
 1. **himalaya email passwords** — Were NOT in KWallet. Need to be re-entered manually:
   ```bash
   # Run once per account after reboot
   rbw get "<entry-name>" | secret-tool store --label="IMAP <name>" email <address> application himalaya
   ```
   Accounts: `mw@satware.com`, `ja@satware.ai`, `ja.satware@gmail.com`, `ironmikechw@gmail.com`
 2. **GitHub CLI token** — May need re-auth:
   ```bash
   gh auth login --hostname github.com
   gh auth git-credential store --hostname github.com  # saves to GK
   ```
 ## Useful Commands
 ```bash
 # Bitwarden
 rbw list                    # list all entries
 rbw search <term>           # search
 rbw get "<name>"            # get password (truncated display)
 rbw get --full "<name>"     # get full password
 rbw add "<name>"            # add new entry (opens editor)
 rbw sync                    # force sync with server
 rbw unlock                  # unlock vault (prompts for login password)
 # Gnome-keyring
 secret-tool lookup key value ...          # lookup by attributes
 secret-tool search key value ...           # search
 secret-tool store --label="X" key value    # store (pipe password via stdin)
 # System
 systemctl --user status gnome-keyring-daemon.service
 systemctl --user restart gnome-keyring-daemon.service  # if D-Bus secrets missing
 ```
 ## Troubleshooting
 | Symptom | Fix |
 |---------|-----|
 | `secret-tool lookup` returns empty | `systemctl --user restart gnome-keyring-daemon.service` |
 | `rbw list` fails | `rbw unlock` (enter login password) |
 | SSH key asks for passphrase | `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` — if empty, re-store it |
 | `gh` commands fail | `gh auth login --hostname github.com` |
 | himalaya auth errors | Re-enter IMAP passwords via `secret-tool store` (see Known Issues) |
 | Browser safe storage issues | Browsers recreate their own Safe Storage keys on startup |
 ## KDE Wallet Status
 - Packages still installed (`kwallet`, `kwalletmanager`) — harmless, will be removed after verification
 - Data file preserved at `~/.local/share/kwalletd/kdewallet.kwl` (backup)
 - PAM references already commented out
 - No longer used by any application
 ## Gitea PAT (git.satware.ai)
 - Cached in gnome-keyring via `git credential approve` (schema `org.git.Password`, attributes: `protocol=https, server=git.satware.ai, user=mw`)
 - Git reads it via `credential.helper=libsecret` (global; no host-specific `store` override)
 - tea reads its own copy from `~/.config/tea/config.yml` (tea has no `auth git-credential` subcommand; file hardened to `chmod 600`)
 - Scopes: `write:repository`, `read:user`. Token lacks admin scope - **rotation must be done via web UI** at https://git.satware.ai/user/settings/applications
 - TODO (rotate): create new PAT with `write:repository, read:user, write:admin`; store in Bitwarden entry `Gitea PAT: git.satware.ai` + keyring + tea; revoke old token via API (now possible with admin scope); update this section
 - TODO (Bitwarden): create Bitwarden entry `Gitea PAT: git.satware.ai` (username `mw`, uri `https://git.satware.ai`) - blocked on rbw pinentry not supporting non-interactive password entry; create manually via `rbw add` or Bitwarden web UI
 - Tracked in Gitea issue #1: https://git.satware.ai/infrastructure/mw-pfeddersheim-workstation/issues/1
@@ -1,102 +0,0 @@
 # Screenshot Cheatsheet — Hyprland + grimblast + satty
 ## Quick Reference (German Keyboard Layout)
 | Key Combo | Action | Tool | Pipeline |
 |-----------|--------|------|----------|
 | `Print` | Select area → save to file + clipboard | grimblast | area → copysave |
 | `SUPER + Print` | Active window → save to file + clipboard | grimblast | active window → copysave |
 | `SUPER + SHIFT + Print` | Full monitor → save to file + clipboard | grimblast | output → copysave |
 | `SUPER + ALT + Print` | Select area → open in satty for annotation | grim+satty | area → satty editor |
 ## Test Checklist
 Run through these to verify everything works:
 ### Test 1: Area Screenshot (Print)
 1. Press `Print`
 2. Drag to select a region
 3. Expected: Screenshot saved to `~/Pictures/` AND copied to clipboard
 4. Verify: Paste clipboard into a test doc
 ### Test 2: Current Window (SUPER+Print)
 1. Focus any window
 2. Press `SUPER+Print`
 3. Expected: That window captured, saved + copied
 ### Test 3: Full Monitor (SUPER+SHIFT+Print)
 1. Press `SUPER+SHIFT+Print`
 2. Expected: Current monitor captured, saved + copied
 ### Test 4: Annotate in Satty (SUPER+ALT+Print)
 1. Press `SUPER+ALT+Print`
 2. Drag to select a region
 3. Expected: Satty window opens with the screenshot
 4. Try these Satty actions:
   - Freehand drawing (left toolbar)
   - Rectangle/Arrow annotations
   - Blur/redact sections
   - Copy annotated result to clipboard
   - Save annotated result to file
 5. Exit Satty with `Esc` or `Ctrl+Q`
 ## Manual CLI Commands
 If keybindings fail, test tools directly:
 ```bash
 # Capture area and save to specific file
 grim -g "$(slurp)" ~/Pictures/test-area.png
 # Capture area and pipe to satty for editing
 grim -g "$(slurp)" - | satty -f -
 # Capture full screen and pipe to satty
 grim - | satty -f -
 # Copy area screenshot to clipboard
 grim -g "$(slurp)" - | wl-copy
 # grimblast manual modes
 grimblast copysave area          # area
 grimblast copysave active         # current window
 grimblast copysave output         # current monitor
 grimblast save area ~/Pictures/test-grimblast.png  # save only
 ```
 ## Satty Editor Shortcuts
 | Action | Shortcut |
 |--------|----------|
 | Freehand | `F` |
 | Rectangle | `R` |
 | Ellipse | `E` |
 | Line/Arrow | `L` |
 | Text | `T` |
 | Blur | `B` |
 | Crop | `C` |
 | Undo | `Ctrl+Z` |
 | Redo | `Ctrl+Shift+Z` |
 | Copy to clipboard | `Ctrl+C` |
 | Save to file | `Ctrl+S` |
 | Save As | `Ctrl+Shift+S` |
 | Quit | `Esc` or `Ctrl+Q` |
 ## Dependencies
 | Tool | Purpose | Status |
 |------|---------|--------|
 | grim | Wayland screenshot capture | Installed |
 | slurp | Region/window selection | Installed |
 | wl-clipboard | Clipboard support | Installed |
 | satty | Annotation editor | Installed |
 | grimblast | Hyprland screenshot helper | Installed |
 | hyprshot | Alternative screenshot tool | Installed (not used in keybinds) |
 ## Troubleshooting
 - **Print key not working**: Verify binding with `hyprctl binds | grep Print`
 - **satty won't open**: Check `which satty` and `echo $XDG_SESSION_TYPE` (must be wayland)
 - **slurp selector invisible**: Check if `grim` and `slurp` are in PATH
 - **Screenshots not saving**: Check `~/Pictures/` directory exists
 - **Clipboard empty**: Verify `wl-copy` and `wl-paste` work (`echo test | wl-copy && wl-paste`)
@@ -100,13 +100,13 @@ last_updated: '2026-04-02'
 |-------|-------|
 | Model | NVIDIA GeForce GTX 1050 Ti |
 | VRAM | 4096 MiB |
-| Driver | 575.64.05 (migrating to 595.71.05 — see [ADR 0002](../adr/0002-kernel-and-nvidia-strategy.md)) |
+| Driver | 580.159.03 (Wayland-compatible mainline — NVIDIA VA-API for Chrome H.264/HEVC/VP9 decode via libva-nvidia-driver) |
 | GPU Temp (idle) | 47°C |
 | PCI Address | 08:00.0 |
 > **Driver strategy**: This Pascal-generation GPU is being migrated from the
-> pinned Manjaro `*-nvidia-575xx` branch to the mainline `*-nvidia` 595.71
+> pinned Manjaro `*-nvidia-575xx` branch to `*-nvidia-580xx` (NVIDIA Fast Branch)
-> branch as part of the Hyprland/Wayland preparation. The migration is
+> as part of the Hyprland/Wayland preparation. The migration is
 > automated by the `system-upgrade` Ansible role and documented in
 > [ADR 0002 — Kernel and NVIDIA Driver Strategy for Hyprland/Wayland](../adr/0002-kernel-and-nvidia-strategy.md).
@@ -0,0 +1,126 @@
 # Hyprland Lua Config Migration (0.55+)
 ## Summary
 Hyprland 0.55 deprecates the legacy `hyprlang` (`.conf`) format in favor of a native Lua
 DSL (`hyprland.lua`). Both formats coexist during transition, but `.lua` is the future.
 ## Configuration File Priority
 | File | Format | Priority |
 |------|--------|----------|
 | `~/.config/hypr/hyprland.lua` | Lua DSL (`hl.*` API) | **Preferred** (0.55+) |
 | `~/.config/hypr/hyprland.conf` | Legacy hyprlang | Deprecated |
 When both exist, Hyprland loads `.lua` first. If `.lua` is present, `.conf` is ignored.
 ## Lua API Quick Reference
 ```lua
 -- Variables
 local terminal = "kitty"
 local mainMod = "SUPER"
 -- Config blocks
 hl.config({ general = { gaps_in = 5 } })
 hl.env("XCURSOR_SIZE", "24")
 hl.monitor({ output = "", mode = "preferred", position = "auto", scale = "auto" })
 -- Keybindings (single combined key string)
 hl.bind(mainMod .. " + Q", hl.dsp.window.close())
 hl.bind(mainMod .. " + T", hl.dsp.exec_cmd(terminal))
 -- Window/workspace rules
 hl.window_rule({ name = "my-rule", match = { class = ".*" }, suppress_event = "maximize" })
 hl.workspace_rule({ workspace = 1, monitor = "DP-1", default = true })
 -- Autostart
 hl.on("hyprland.start", function() hl.exec_cmd("waybar &") end)
 -- Gestures, animations
 hl.gesture({ fingers = 3, direction = "horizontal", action = "workspace" })
 hl.curve("easeOutQuint", { type = "bezier", points = { {0.23, 1}, {0.32, 1} } })
 hl.animation({ leaf = "windows", enabled = true, speed = 4.79, spring = "easy" })
 ```
 ## Dispatcher Functions (`hl.dsp.*`)
 | Lua API | Legacy .conf equivalent |
 |---------|------------------------|
 | `hl.dsp.exec_cmd("cmd")` | `exec, cmd` |
 | `hl.dsp.window.close()` | `killactive` |
 | `hl.dsp.window.float({ action = "toggle" })` | `togglefloating` |
 | `hl.dsp.window.pseudo()` | `pseudo` |
 | `hl.dsp.window.fullscreen({ mode = 0 })` | `fullscreen, 0` |
 | `hl.dsp.window.move({ direction = "left" })` | `movewindow, l` |
 | `hl.dsp.window.move({ workspace = 2 })` | `movetoworkspace, 2` |
 | `hl.dsp.window.drag()` / `.resize()` | mouse bind |
 | `hl.dsp.focus({ direction = "left" })` | `movefocus, l` |
 | `hl.dsp.focus({ workspace = 2 })` | `workspace, 2` |
 | `hl.dsp.focus({ workspace = "e+1" })` | `workspace, e+1` |
 | `hl.dsp.workspace.toggle_special("magic")` | `togglespecialworkspace` |
 | `hl.dsp.layout("togglesplit")` | `layoutmsg, togglesplit` |
 ## Pitfalls Learned
 | Issue | Fix |
 |-------|-----|
 | `hl.dsp.focus({ direction = "next" })` | **Invalid.** Only `left/right/up/down` accepted. Use `hl.dsp.exec_cmd("hyprctl dispatch cyclenext")` instead. |
 | `tap-to-click = true` | **Invalid Lua.** Hyphens not allowed in identifiers. Use `tap_to_click` (Hyprland accepts underscores). |
 | `hl.bind("", "Print", ...)` | **Invalid.** Lua API uses single key string: `hl.bind("Print", ...)`. |
 | `hl.bind(mainMod, "Q", ...)` | **Invalid.** Combine into one string: `hl.bind(mainMod .. " + Q", ...)`. |
 | `resizeactive` not in `hl.dsp.*` | Use `hl.dsp.exec_cmd("hyprctl dispatch resizeactive -40 0")` as wrapper. |
 | `luac -p` false positives | Standard `luac` can't validate Hyprland's custom `hl.*` API. Use `hyprctl configerrors` at runtime instead. |
 ## Validation
 ```bash
 # Runtime validation (requires running Hyprland session)
 hyprctl configerrors
 # Over SSH (find instance signature first)
 HYPRLAND_INSTANCE_SIGNATURE=$(ls /run/user/$(id -u)/hypr/) hyprctl configerrors
 # Syntax-only check (limited - won't catch hl.* API issues)
 luac -p ~/.config/hypr/hyprland.lua
 ```
 ## conf-to-lua Migration Mapping
 | Legacy `.conf` | Lua `.lua` |
 |----------------|------------|
 | `$mainMod = SUPER` | `local mainMod = "SUPER"` |
 | `monitor=DP-1,...` | `hl.monitor({ output = "DP-1", ... })` |
 | `env = KEY,VALUE` | `hl.env("KEY", "VALUE")` |
 | `input { ... }` | `hl.config({ input = { ... } })` |
 | `general { ... }` | `hl.config({ general = { ... } })` |
 | `bind = MOD, KEY, exec, cmd` | `hl.bind(mod .. " + KEY", hl.dsp.exec_cmd("cmd"))` |
 | `bind = MOD, KEY, killactive` | `hl.bind(mod .. " + KEY", hl.dsp.window.close())` |
 | `bind = MOD, KEY, togglefloating` | `hl.bind(mod .. " + KEY", hl.dsp.window.float({ action = "toggle" }))` |
 | `bind = MOD, KEY, fullscreen, 0` | `hl.bind(mod .. " + KEY", hl.dsp.window.fullscreen({ mode = 0 }))` |
 | `bind = MOD, KEY, movefocus, l` | `hl.bind(mod .. " + KEY", hl.dsp.focus({ direction = "left" }))` |
 | `bind = MOD, KEY, movewindow, l` | `hl.bind(mod .. " + KEY", hl.dsp.window.move({ direction = "left" }))` |
 | `bind = MOD, KEY, workspace, N` | `hl.bind(mod .. " + KEY", hl.dsp.focus({ workspace = N }))` |
 | `bind = MOD, KEY, cyclenext` | `hl.bind(mod .. " + KEY", hl.dsp.exec_cmd("hyprctl dispatch cyclenext"))` |
 | `bind = MOD, KEY, pseudo` | `hl.bind(mod .. " + KEY", hl.dsp.window.pseudo())` |
 | `bind = MOD, KEY, layoutmsg, togglesplit` | `hl.bind(mod .. " + KEY", hl.dsp.layout("togglesplit"))` |
 | `bind = , Print, exec, cmd` | `hl.bind("Print", hl.dsp.exec_cmd("cmd"))` |
 | `bind = MOD, KEY, exit` | `hl.bind(mod .. " + KEY", hl.dsp.exec_cmd("hyprctl dispatch exit"))` |
 | `device { name = "..."; ... }` | `hl.device({ name = "...", ... })` |
 | `workspace = 1, monitor:DP-1, default:true` | `hl.workspace_rule({ workspace = 1, monitor = "DP-1", default = true })` |
 | `exec-once = cmd` | `hl.on("hyprland.start", function() hl.exec_cmd("cmd") end)` |
 | `col.active_border = rgba(...) 45deg` | `col = { active_border = { colors = {"rgba(...)"}, angle = 45 } }` |
 ## Multi-Machine Setup
 This project manages configs for two machines with identical keybindings but different hardware:
 | Aspect | Workstation (pfeddersheim) | MacBook Pro 16,1 |
 |--------|---------------------------|-------------------|
 | GPU | NVIDIA (6 env vars) | Intel UHD 630 + AMD RX 5500M (no env vars) |
 | Monitors | 3 fixed (DP-1, DVI-D-1, HDMI-A-1) | Built-in + HDMI dock (auto-detect) |
 | Input | de layout, left-handed mouse | de + mac_nodeadkeys + caps:swapescape, touchpad |
 | Touchpad | N/A | natural_scroll, gestures, disable_while_typing |
 | Media keys | N/A | Volume, brightness, playerctl |
 | Window rules | None | Suppress maximize, XWayland fix |
 | Config format | `.lua` (Ansible-managed) | `.lua` (manual) |
@@ -6,7 +6,7 @@ tags:
  - manual-overrides
  - infrastructure
  - configuration
-last_updated: '2026-03-09'
+last_updated: '2026-07-21'
 ---
 # Manual System Overrides
@@ -22,4 +22,10 @@ This document tracks all persistent system changes implemented manually that are
 | Date | Change | Rationale | Ansible Status |
 |------|--------|-----------|----------------|
 | 2026-07-21 | Added `agent0.localhost` (-> `reverse_proxy 192.168.0.141:8090`, `flush_interval -1`) in dedicated file `/etc/caddy/conf.d/agent0.localhost.conf`. First non-localhost backend (remote LAN host running a uvicorn app). Regenerated mkcert cert to add explicit `agent0.localhost` SAN; cert now has 20 SANs total, valid until 2028-10-21. Old cert/key backed up as `localhost{,-key}.pem.bak.<ts>`. Total `*.localhost` sites now 18. | User request to expose the remote agent backend on local HTTPS. Key learning: the `*.localhost` wildcard is NOT honored by curl/system trust even for single-label subdomains - `.localhost` is a special-use TLD (RFC 6761), so every subdomain needs an explicit SAN. This corrects the prior assumption that single-label subdomains were covered by the wildcard. | Same as parent Caddy row - candidate for Ansible role when issue #92 resolves |
 | 2026-07-12 | Regenerated mkcert cert at `/etc/caddy/localhost{,-key}.pem` to add explicit SANs for `platform.localhost`, `packages.localhost`, and `onlyoffice.docs.localhost` (the latter was pre-existing in Caddy config but missing from the cert, causing TLS validation failures). Cert now has 19 SANs total, valid until 2028-10-12. | `onlyoffice.docs.localhost` is a multi-label subdomain not covered by `*.localhost` wildcard. Required explicit SAN. | Same as parent Caddy row |
 | 2026-07-12 | Added `platform.localhost` (-> `localhost:10080`) and `packages.localhost` (-> `localhost:20080`) to `/etc/caddy/conf.d/localhost-dev.conf`. Docker port mappings: `~/internal/amicron-platform/docker-compose.override.yml` `10080:80`, `~/internal/satis/docker-compose.yml` nginx `20080:80`. Both upstreams are plain HTTP on high ports; Caddy terminates TLS. Also documented `onlyoffice.docs.localhost` (pre-existing in config, was undocumented). Total sites now 17. | Local HTTPS dev for amicron-platform (ERP), satis (Composer package repository), and shared Firebird 3.0.14 database. The three form the local E2E test triangle: `platform.localhost` (ERP) -> `packages.localhost` (Satis) -> Firebird (token validation). Mirrors the production `platform.auc.de` + `packages.auc.de` + shared Firebird setup. | Same as parent Caddy row - candidate for Ansible role when issue #92 resolves |
 | 2026-07-06 | Caddy reverse-proxy + mkcert TLS at `/etc/caddy/` (`Caddyfile` + `conf.d/localhost-dev.conf` + `localhost{,-key}.pem`) | Local HTTPS dev for 14 `*.localhost` sites (mcp, artifacts, onlyoffice, demo.satware.com clone, 10 placeholders). Caddy runs as systemd `caddy.service` on port 443. NOT managed by this repo - no `caddy` Ansible role exists. The `onlyoffice.localhost` site (-> `localhost:3847`) is emitting `context canceled` SSE aborts; see `docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-investigation.md` and GitLab issue [satware/mcp/onlyoffice#92](https://gitlab.satware.com/satware/mcp/onlyoffice/-/work_items/92). | Candidate for Ansible role (`caddy` + `mkcert`); defer until issue #92 resolves to avoid masking root cause |
 | 2026-07-03 | Patched `remmina-plugin-rdp.so` in `~/.config/remmina/plugins/` | Remmina 1.4.43 crashes (SIGSEGV) on Wayland when `keymap` is set in a profile. Built from `~/external/remmina/` fork with NULL check fix. Alt plugin dir loads before system plugin. MR !2757 submitted upstream. See `docs/learnings/2026-07-03-remmina-wayland-crash-fix.md`. | Remove when upstream fix is released and packaged |
 | 2026-06-17 | Discovered and deleted `br_vm_internal` bridge (10.10.2.0/24) | Externally-created bridge, no NM config file, no VMs attached. Origin unknown — likely ad-hoc `nmcli con add` or manual `brctl` session (Jun 10). Traffic-shaping qdisc (`htb`) suggests prior VM network isolation attempt. Deleted via `nmcli con delete` + `ip link delete`. | N/A (removed) |
 | 2026-04-02 | Moved LLM models to `/home/mw/models/` (SATA SSD) with symlinks | Free root NVMe space (93%→87%, +25G freed) | Not yet |
@@ -0,0 +1,22 @@
 # Memory — mw-pfeddersheim-workstation
 > **Status**: 64 GiB migrated to `homeoffice` on 2026-07-13.
 ## Current Configuration
 4x 8 GiB DDR4-3000 DIMMs = **32 GiB total**, dual-channel (A/B).
 | Slot | Size | Type | Speed | Channel |
 |------|------|------|-------|---------|
 | DIMM_A1 | 8 GiB | DDR4 SDRAM | 3000 MT/s | BANK 0 |
 | DIMM_A2 | 8 GiB | DDR4 UDIMM | 3000 MT/s | BANK 1 |
 | DIMM_B1 | 8 GiB | DDR4 UDIMM | 3000 MT/s | BANK 2 |
 | DIMM_B2 | 8 GiB | DDR4 UDIMM | 3000 MT/s | BANK 3 |
 Note: DIMM_A1 reports "Unknown" form factor — different brand from the other three DIMMs.
 ## Migration History
 | Date | Change |
 |------|--------|
 | 2026-07-13 | Removed 4x 16 GiB DDR4-2400 DIMMs (64 GiB) and transferred to `homeoffice`. Installed 4x 8 GiB DDR4-3000 DIMMs taken from `homeoffice` in exchange. |
@@ -5,7 +5,7 @@ tags:
  - setup
  - bootstrap
  - ansible
-last_updated: '2026-05-20'
+last_updated: '2026-06-17'
 ---
 # Workstation Setup Guide
@@ -44,8 +44,8 @@ This guide describes how to bootstrap the **mw-pfeddersheim-workstation** infras
 4. **Run system upgrade & kernel install** (preparation for Hyprland/Wayland)
   This step runs the dedicated `system-upgrade` role: full `pacman -Syu`,
-   dual-kernel install (`linux612` LTS + `linux70` stable), and NVIDIA
+   dual-kernel install (`linux618` LTS + `linux70` stable), and NVIDIA
-   driver migration from the pinned `575xx` branch to mainline `595.71`.
+   driver migration from the pinned `575xx` branch to `580xx` (NVIDIA Fast Branch).
   Always preview first with `--check`. See
   [ADR 0002](../adr/0002-kernel-and-nvidia-strategy.md) for the rationale.
@@ -63,7 +63,7 @@ This guide describes how to bootstrap the **mw-pfeddersheim-workstation** infras
   After it finishes, **reboot and select `linux70` from the GRUB menu**
   before continuing to step 5. Verify with `uname -r` (expect 7.0.x)
-   and `nvidia-smi` (expect driver 595.71.05).
+   and `nvidia-smi` (expect driver 580.x).
 5. **Run the Playbook** (remaining roles: common, dev-tools, maintenance)
   ```bash
@@ -6,7 +6,7 @@ tags:
  - software-stack
  - inventory
  - tech-stack
-last_updated: '2026-03-13'
+last_updated: '2026-07-12'
 ---
 # Software Stack - mw-pfeddersheim-workstation
@@ -25,10 +25,63 @@ last_updated: '2026-03-13'
 | **bat** | latest | A `cat` clone with syntax highlighting |
 | **rustdesk** | latest | Remote management via Tailscale |
 ## Desktop Environment
 || Technology | Version | Description |
 ||------------|---------|-------------|
 || **Hyprland** | 0.55.2 | Wayland compositor (uwsm-managed) |
 || **Waybar** | latest | Status bar (with USB auto-mount module) |
 || **Kitty** | latest | GPU-accelerated terminal emulator |
 || **Fuzzel** | latest | Application launcher (preferred over Wofi) |
 || **Dunst** | latest | Notification daemon |
 || **yazi** | latest | Terminal file manager (full deps: chafa, 7zip, resvg, etc.) |
 ## Known Issues (2026-05-22 Boot Audit)
 | Domain | Issue | Status |
 |--------|-------|--------|
 | **PCIe slot** | GPU in bottom PCIEX4 slot (PCIe 2.0 x4, ~2 GB/s) instead of top PCIEX16 (PCIe 3.0 x16, ~16 GB/s). **8x bandwidth loss** | **Pending**: physical move required |
 | **PCIe slot** | NVMe Samsung PM9A1 running Gen2 x4 (8 GT/s) instead of Gen3 x4 (16 GT/s). May resolve after GPU slot fix + BIOS Gen3 setting | **Pending**: BIOS tuning |
 | **Idle daemon** | hypridle SEGV crash loop — sdbus-cpp 2.3.0 ABI break | **Fixed**: sdbus-cpp upgraded to 2.3.1-1 |
 | **Webcam (UVC)** | Device 1-10 has multiple UVC control failures (zoom/pan/tilt/iris non-functional due to firmware non-compliance) | Known hardware limitation, core capture works |
 | **KVM** | `/dev/kvm` unavailable — libvirtd cannot use hardware acceleration | Open — check BIOS VT-x/AMD-V |
 | **Wi-Fi regulatory** | `regulatory.db` firmware missing — channels restricted | Open — install `wireless-regdb` |
 | **D-Bus** | Stale `org.kde.kwalletd6.service` file; dunst/kscreen naming mismatches | **Fixed**: kwalletd6 stub removed; kscreen/kscreenlocker/libkscreen uninstalled (35 MiB) |
 | **XDG portals** | Deprecated `UseIn` key usage (portals.conf preferred) | Low priority, functional |
 **Removed (2026-05-22, ADR 0007)**: All X11 display managers (lightdm, sddm), X11 video/input drivers (xf86-*), X11 tools (xterm, xorg-xinit, x11vnc, etc.), entire KDE Plasma stack (kwin, plasma-desktop, plasma-workspace, plasma-nm, plasma-pa, powerdevil, etc.), and Dolphin (replaced by yazi). `greetd`+`tuigreet` is the active DM. Screenshots use `grim`+`slurp`+`grimblast`.
 ## Browsers
 | Technology | Version | Notes |
 |------------|---------|-------|
 | **Google Chrome** | 148.0.7778.178 (AUR) | Sole browser — Wayland-native, VA-API on NVIDIA |
 | ~~Chromium~~ | ~~removed~~ | All artifacts cleaned 2026-05-22 (see ADR 0006) |
 ## OS Context
 - **OS**: Linux (Manjaro/Arch Linux based)
 - **Architecture**: x86_64
 ## Package Domain Classification (ADR 0007 Tier 4)
 Packages previously listed as "Misc" reclassified to functional domains:
 | Package | New Domain | Role |
 |---------|-----------|------|
 | uv | Python Toolchain | Fast Python package/env manager |
 | jq | Shell/Terminal | JSON processor |
 | inxi | Hardware | System hardware info |
 | lsof | Core OS | List open files |
 | iproute2 | Network | Advanced routing/networking |
 | openresolv | Network | DNS resolver management |
 | perl-image-exiftool | Dev Tools | Metadata read/write |
 | icoutils | Dev Tools | ICO/ANE cursor extraction |
 | innoextract-git | Dev Tools | Inno Setup installer extraction |
 | opencl-headers | GPU Compute | OpenCL C headers |
 | libxnvctrl-580xx | NVIDIA | NVML/XNVCTRL for 580xx |
 | zram-generator | Core OS | Systemd zram swap generator |
 | mkinitcpio-openswap | Core OS | Swap resume hook for mkinitcpio |
 ## Maintenance Policies
 - **Updates**: System-wide updates via `pacman` managed through maintenance scripts.
 - **Node.js**: Global packages managed via `pnpm`.
@@ -39,3 +92,50 @@ last_updated: '2026-03-13'
 - **Ansible**: `/usr/bin/ansible`
 - **Python**: `/usr/bin/python`
 - **Docker**: `/usr/bin/docker`
 ## Local Dev Services (Manual - not Ansible-managed)
 System-level services running on this workstation that are configured manually
 outside this repo's Ansible roles. See `docs/tech/manual-overrides.md` for the
 full override table and `docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse-investigation.md`
 for the active Caddy/OnlyOffice investigation.
 ### Caddy (port 443, systemd `caddy.service`)
 | Item | Value |
 |------|-------|
 | Package | `caddy` (pacman) |
 | Service | `caddy.service` (enabled, runs as `caddy` user) |
 | Config | `/etc/caddy/Caddyfile` + `/etc/caddy/conf.d/*.conf` (main site file `localhost-dev.conf`, plus per-service files like `agent0.localhost.conf`) |
 | TLS cert | mkcert-generated pair at `/etc/caddy/localhost{,-key}.pem`; includes explicit SANs for all 20 hostnames, valid until 2028-10-21. The `*.localhost` wildcard is NOT honored by curl/system trust even for single-label subdomains like `agent0.localhost` (empirically verified 2026-07-21: `.localhost` is a special-use TLD per RFC 6761); every subdomain MUST be listed explicitly. Multi-label hosts like `onlyoffice.docs.localhost` additionally require explicit SANs because wildcards only cover one level. |
 | Admin endpoint | Unix socket `/run/caddy/admin.socket` |
 | Sites | 18 `*.localhost` virtual hosts (see table below) |
 #### `*.localhost` sites
 | Site | Backend / Handler | Notes |
 |------|-------------------|-------|
 | `mcp.localhost` | `reverse_proxy localhost:50880` | MCP server (node, pid 1167) |
 | `artifacts.localhost` | `file_server browse` root `/var/www/artifacts` | Static artifacts |
 | `onlyoffice.localhost` | `reverse_proxy localhost:3847` | OnlyOffice MCP server; emitting `context canceled` SSE aborts (issue [#92](https://gitlab.satware.com/satware/mcp/onlyoffice/-/work_items/92)) |
 | `project-1.localhost` ... `project-10.localhost` | `respond "project-N - placeholder"` | 10 reserved placeholders |
 | `demo.satware.com.localhost` | `reverse_proxy localhost:38081` | webdevops/php-apache-dev container |
 | `platform.localhost` | `reverse_proxy localhost:10080` | amicron-platform Docker (Symfony 7.4 + Vue 3 + Firebird 3.0.14); `~/internal/amicron-platform` |
 | `packages.localhost` | `reverse_proxy localhost:20080` | satis Docker (Composer package repository with token-based access control); `~/internal/satis` |
 | `onlyoffice.docs.localhost` | `file_server` root `/home/mw/internal/onlyoffice/docs-site/dist` | Starlight static docs build |
 | `agent0.localhost` | `reverse_proxy 192.168.0.141:8090` | First non-localhost backend (remote host on LAN, uvicorn app). Config in dedicated `/etc/caddy/conf.d/agent0.localhost.conf`. `flush_interval -1` enabled. |
 Wildcard `*.localhost` only matches single-label subdomains (e.g. `mcp.localhost`)
 AND is not honored by curl/system trust for the `.localhost` special-use TLD
 (RFC 6761) - every subdomain needs an explicit SAN. Multi-label hosts like
 `onlyoffice.docs.localhost` and `demo.satware.com.localhost` require explicit
 SANs for both reasons.
 ### Useful Caddy commands
 ```bash
 sudo caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
 sudo systemctl reload caddy
 sudo journalctl -u caddy --no-pager -n 50
 curl -sk https://onlyoffice.localhost/ping   # test (skips cert verify)
 ```
@@ -7,7 +7,7 @@ tags:
  - health-check
  - workstation
  - monitoring
-last_updated: '2026-03-17'
+last_updated: '2026-06-17'
 ---
 # Workstation Health Report: mw-manjaro-pf
@@ -87,4 +87,8 @@ Uptime: ~1 hour, 7 minutes
 ## Next Steps
 1. Consider setting up automated crash monitoring for high-memory applications
-2. Run morning health check script daily: `/home/mw/internal/mw-pfeddersheim-workstation/scripts/morning-health-check.sh`
+2. Run health check script manually as needed: `/home/mw/internal/mw-pfeddersheim-workstation/scripts/morning-health-check.sh` (automated systemd timer removed 2026-05-26)
 ## Recent Cleanup (2026-06-17)
 - **Externally-created bridge `br_vm_internal` (10.10.2.0/24)** discovered and removed. No NM config file, no libvirt network, no attached VMs. Origin traced to Jun 10 2026 (first activation) — likely ad-hoc CLI creation. Bridge had `htb` qdisc suggesting prior VM network isolation attempt. Both the NM connection and kernel interface fully deleted.
@@ -0,0 +1,22 @@
 # quarto.yml - Batch PDF conversion config
 # Use: quarto render docs/*.md --to typst-pdf
 # Or: quarto render docs/md-to-pdf-combo.md --to typst-pdf
 project:
  type: default
  output-dir: "./docs/pdf-output"
 format:
  typst-pdf:
    default: true
    toc: false
    number-sections: true
    mainfont: "Inter"
    monofont: "JetBrains Mono"
    fontsize: 9pt
    papersize: a4
    margin:
      top: 1.5cm
      bottom: 1.5cm
      left: 1.5cm
      right: 1.5cm
@@ -0,0 +1,72 @@
 #!/usr/bin/env bash
 # batch-pdf.sh - Convert all Markdown docs to professional PDFs via Pandoc + WeasyPrint
 # Usage: bash scripts/batch-pdf.sh [directory]
 # Default directory: docs/
 #
 # Pipeline:  pandoc md → HTML  →  weasyprint CSS → PDF
 # Requires:  pandoc, weasyprint, CSS file at docs/pdf-comparison/cheatsheet.css
 set -euo pipefail
 PROJ_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 CSS_PATH="${PROJ_ROOT}/docs/pdf-comparison/cheatsheet.css"
 DOC_DIR="${1:-${PROJ_ROOT}/docs}"
 OUTPUT_DIR="${PROJ_ROOT}/docs/pdf-output"
 # Verify dependencies
 for cmd in pandoc weasyprint; do
  command -v "$cmd" &>/dev/null || { echo "ERROR: $cmd not found. Install: sudo pacman -S $cmd"; exit 1; }
 done
 [[ -f "$CSS_PATH" ]] || { echo "ERROR: CSS not found at $CSS_PATH"; exit 1; }
 mkdir -p "${OUTPUT_DIR}"
 count=0
 errors=0
 tmpdir=$(mktemp -d)
 echo "=== Markdown → PDF Batch (Pandoc + WeasyPrint + CSS) ==="
 echo "CSS:      ${CSS_PATH}"
 echo "Input:    ${DOC_DIR}"
 echo "Output:   ${OUTPUT_DIR}"
 echo ""
 find "${DOC_DIR}" -name "*.md" -not -path "*/pdf-output/*" -not -path "*/.*" -not -name "hyprland-keybindings-no-meta.md" | sort | while read -r md_file; do
  rel_path="${md_file#${DOC_DIR}/}"
  rel_dir="$(dirname "${rel_path#${DOC_DIR#${PROJ_ROOT}/}/}")"
  basename="$(basename "${md_file}" .md)"
  title="${basename//-/ }"
  out_subdir="${OUTPUT_DIR}"
  if [[ "${rel_dir}" != "." && -n "${rel_dir}" ]]; then
    out_subdir="${OUTPUT_DIR}/${rel_dir}"
  fi
  mkdir -p "${out_subdir}"
  html_file="${tmpdir}/${basename}.html"
  pdf_file="${out_subdir}/${basename}.pdf"
  echo "  ${rel_path} ..."
  pandoc "${md_file}" -t html5 --standalone \
    --css "file://${CSS_PATH}" \
    --metadata title="${title}" \
    -o "${html_file}" 2>&1 || { echo "    PANDOC ERROR"; errors=$((errors+1)); continue; }
  weasyprint "${html_file}" "${pdf_file}" 2>/dev/null || \
    weasyprint "${html_file}" "${pdf_file}" 2>&1 | head -1
  if [[ -f "${pdf_file}" ]]; then
    size=$(du -h "${pdf_file}" | cut -f1)
    echo "    OK (${size})"
    count=$((count + 1))
  else
    echo "    PDF GENERATION ERROR"
    errors=$((errors + 1))
  fi
 done
 rm -rf "${tmpdir}"
 echo ""
 done_count=$(find "${OUTPUT_DIR}" -name "*.pdf" | wc -l)
 echo "=== Done: ${done_count} files in ${OUTPUT_DIR} ==="
@@ -0,0 +1,372 @@
 #!/bin/bash
 set -euo pipefail
 # Workstation Package Cleanup Script
 # Version: 1.0.0
 # Target: mw-pfeddersheim-workstation
 # Purpose: Remove identified cleanup candidates and log for verification
 MODE="apply"
 if [[ "${1:-}" == "--check" ]]; then
  MODE="check"
  echo "=== Running in CHECK mode (dry-run, no packages removed) ==="
 elif [[ "${1:-}" == "--help" ]]; then
  echo "Usage: $0 [--check | --apply | --help]"
  echo "  --check  Dry-run: show what would be removed (default)"
  echo "  --apply  Actually remove packages"
  echo "  --help   Show this help"
  exit 0
 fi
 # Ensure log directory exists
 mkdir -p "$HOME/logs" 2>/dev/null || true
 LOCAL_LOG="$HOME/logs/cleanup-$(date +%Y%m%d-%H%M%S).log"
 BOLD=$(tput bold 2>/dev/null || true)
 RED=$(tput setaf 1 2>/dev/null || true)
 GREEN=$(tput setaf 2 2>/dev/null || true)
 RESET=$(tput sgr0 2>/dev/null || true)
 log() { echo -e "$*" | tee -a "$LOCAL_LOG"; }
 section() { log ""; log "${BOLD}--- $1 ---${RESET}"; }
 echo "" | tee -a "$LOCAL_LOG"
 log "============================================="
 log "  Workstation Package Cleanup"
 log "  Mode: $MODE | Date: $(date)"
 log "  Log:  $LOCAL_LOG"
 log "============================================="
 # Track totals
 TOTAL_CANDIDATES=0
 TOTAL_REMOVED=0
 TOTAL_ERRORS=0
 SKIPPED=0
 # Helper: add package to candidate list file
 add_candidates() {
  local category="$1"
  shift
  echo "$@" >> "$HOME/logs/.cleanup-candidates-${category}.txt"
 }
 # ============================================================
 # 1. PRE-FLIGHT CHECKS
 # ============================================================
 section "Pre-flight Checks"
 # Verify pacman is available
 if ! command -v pacman &> /dev/null; then
  log "${RED}ERROR: pacman not found. This script must be run on Arch/Manjaro.${RESET}"
  exit 1
 fi
 # Check disk space (need room for transaction)
 DISK_PCT=$(df / | awk 'NR==2 {gsub(/%/,"",$5); print $5}')
 if [[ "$DISK_PCT" -gt 95 ]]; then
  log "${RED}WARNING: Disk usage at ${DISK_PCT}%. Consider freeing space first.${RESET}"
 fi
 DISK_AVAIL=$(df -h / | awk 'NR==2 {print $4}')
 log "Disk available: $DISK_AVAIL"
 # Check for existing packages (only list ones that are installed)
 log "Scanning for installed cleanup candidates..."
 # ============================================================
 # 2. OLD MULTIMEDIA PACKAGES
 # ============================================================
 section "[1/7] Old Multimedia Packages"
 CANDIDATES=()
 # Old ffmpeg version
 if pacman -Qe ffmpeg4.4 &>/dev/null || pacman -Q ffmpeg4.4 &>/dev/null; then
  CANDIDATES+=(ffmpeg4.4)
 fi
 # VLC plugins (keep base vlc)
 while IFS= read -r pkg; do
  [[ "$pkg" == "vlc" ]] && continue  # skip base vlc
  CANDIDATES+=("$pkg")
 done < <(pacman -Qq 2>/dev/null | grep -E '^vlc-' || true)
 TOTAL_CANDIDATES=$((TOTAL_CANDIDATES + ${#CANDIDATES[@]}))
 log "Found ${#CANDIDATES[@]} multimedia candidates: ${CANDIDATES[*]:0:5}..."
 if [[ ${#CANDIDATES[@]} -gt 0 ]]; then
  log "Candidates: ${CANDIDATES[*]}"
  if [[ "$MODE" == "check" ]]; then
    log "DRY-RUN: Would run: sudo pacman -Rns --noconfirm ${CANDIDATES[*]}"
  else
    sudo pacman -Rns --noconfirm "${CANDIDATES[@]}" 2>&1 | tee -a "$LOCAL_LOG" || true
    TOTAL_REMOVED=$((TOTAL_REMOVED + ${#CANDIDATES[@]}))
  fi
 fi
 # ============================================================
 # 3. INACTIVE NVIDIA/MHWHD DRIVERS
 # ============================================================
 section "[2/7] Inactive NVIDIA Drivers (mhwd-nvidia-*)"
 CANDIDATES=()
 while IFS= read -r pkg; do
  [[ -n "$pkg" ]] && CANDIDATES+=("$pkg")
 done < <(pacman -Qq 2>/dev/null | grep -E '^mhwd-nvidia-' || true)
 TOTAL_CANDIDATES=$((TOTAL_CANDIDATES + ${#CANDIDATES[@]}))
 if [[ ${#CANDIDATES[@]} -gt 0 ]]; then
  log "Found ${#CANDIDATES[@]} mhwd-nvidia candidates: ${CANDIDATES[*]}"
  if [[ "$MODE" == "check" ]]; then
    log "DRY-RUN: Would run: sudo pacman -Rns --noconfirm ${CANDIDATES[*]}"
  else
    sudo pacman -Rns --noconfirm "${CANDIDATES[@]}" 2>&1 | tee -a "$LOCAL_LOG" || true
    TOTAL_REMOVED=$((TOTAL_REMOVED + ${#CANDIDATES[@]}))
  fi
 else
  log "No mhwd-nvidia packages found."
 fi
 # ============================================================
 # 4. OLD KERNELS
 # ============================================================
 section "[3/7] Old Kernel Packages"
 CANDIDATES=()
 # linux618 and linux70 (keep current running kernel and its modules)
 CURRENT_KERNEL=$(uname -r)
 KMVR="${CURRENT_KERNEL%-MANJARO}"              # 6.18.33-1
 KMJ="${KMVR%%.*}"                             # 6
 KMREST="${KMVR#*.}"                           # 18.33-1
 KMN="${KMREST%%.*}"                           # 18
 CURRENT_KERNEL_PKG="linux${KMJ}${KMN}"        # linux618
 log "Current running kernel: $CURRENT_KERNEL (package: $CURRENT_KERNEL_PKG)"
 for kernel in linux618 linux70; do
  # Skip if this is the running kernel package
  if [[ "$kernel" == "linux${CURRENT_KERNEL_PKG}" ]]; then
    log "Skipping $kernel — this is the running kernel."
    continue
  fi
  if pacman -Q "$kernel" &>/dev/null; then
    CANDIDATES+=("$kernel")
    # Also remove its modules/headers/etc (but not nvidia/r8168 for running kernel — already skipped above)
    while IFS= read -r pkg; do
      [[ -n "$pkg" ]] && CANDIDATES+=("$pkg")
    done < <(pacman -Qq 2>/dev/null | grep -E "^${kernel}-" || true)
  fi
 done
 TOTAL_CANDIDATES=$((TOTAL_CANDIDATES + ${#CANDIDATES[@]}))
 if [[ ${#CANDIDATES[@]} -gt 0 ]]; then
  log "Found ${#CANDIDATES[@]} kernel candidates: ${CANDIDATES[*]}"
  if [[ "$MODE" == "check" ]]; then
    log "DRY-RUN: Would run: sudo pacman -Rns --noconfirm ${CANDIDATES[*]}"
  else
    sudo pacman -Rns --noconfirm "${CANDIDATES[@]}" 2>&1 | tee -a "$LOCAL_LOG" || true
    TOTAL_REMOVED=$((TOTAL_REMOVED + ${#CANDIDATES[@]}))
  fi
 else
  log "No old kernel packages found."
 fi
 # ============================================================
 # 5. lib32 PACKAGES
 # ============================================================
 section "[4/7] lib32 Packages"
 CANDIDATES=()
 while IFS= read -r pkg; do
  [[ -n "$pkg" ]] && CANDIDATES+=("$pkg")
 done < <(pacman -Qq 2>/dev/null | grep -E '^lib32-' || true)
 TOTAL_CANDIDATES=$((TOTAL_CANDIDATES + ${#CANDIDATES[@]}))
 log "Found ${#CANDIDATES[@]} lib32 packages"
 if [[ ${#CANDIDATES[@]} -gt 0 ]]; then
  # List first 10, then total
  log "First 10 candidates: ${CANDIDATES[*]:0:10}..."
  log "Total: ${#CANDIDATES[@]} lib32 packages"
  # Interactive: ask user if they want to remove lib32 packages
  if [[ "$MODE" == "check" ]]; then
    log "DRY-RUN: Would run: sudo pacman -Rns --noconfirm ${CANDIDATES[*]}"
  else
    log "${BOLD}This will remove ALL ${#CANDIDATES[@]} lib32 packages.${RESET}"
    log "Only remove if you don't run 32-bit applications (games, wine, etc.)"
    read -rp "Remove all lib32 packages? [y/N] " confirm
    if [[ "$confirm" =~ ^[Yy]$ ]]; then
      sudo pacman -Rns --noconfirm "${CANDIDATES[@]}" 2>&1 | tee -a "$LOCAL_LOG" || true
      TOTAL_REMOVED=$((TOTAL_REMOVED + ${#CANDIDATES[@]}))
    else
      log "SKIPPED lib32 removal."
      SKIPPED=$((SKIPPED + ${#CANDIDATES[@]}))
    fi
  fi
 fi
 # ============================================================
 # 6. REDUNDANT FONTS (Nerd Font variants)
 # ============================================================
 section "[5/7] Redundant Font Packages"
 CANDIDATES=()
 # Nerd Font packages (keep the one in active use)
 while IFS= read -r pkg; do
  [[ -n "$pkg" ]] && CANDIDATES+=("$pkg")
 done < <(pacman -Qq 2>/dev/null | grep -iE 'nerd-font' || true)
 # Also check for duplicate font collections
 while IFS= read -r pkg; do
  [[ -n "$pkg" ]] && CANDIDATES+=("$pkg")
 done < <(pacman -Qq 2>/dev/null | grep -iE 'ttf-(jetbrains|iosevka|fira|hack|noto)' || true)
 TOTAL_CANDIDATES=$((TOTAL_CANDIDATES + ${#CANDIDATES[@]}))
 if [[ ${#CANDIDATES[@]} -gt 0 ]]; then
  log "Found ${#CANDIDATES[@]} font candidates:"
  for pkg in "${CANDIDATES[@]}"; do
    log "  - $pkg"
  done
  if [[ "$MODE" == "check" ]]; then
    log "DRY-RUN: Would show above packages for manual review"
  else
    log "${RED}CRITICAL: Review font packages carefully - removing wrong fonts can break UI.${RESET}"
    read -rp "Remove these ${#CANDIDATES[@]} font packages? [y/N] " confirm
    if [[ "$confirm" =~ ^[Yy]$ ]]; then
      sudo pacman -Rns --noconfirm "${CANDIDATES[@]}" 2>&1 | tee -a "$LOCAL_LOG" || true
      TOTAL_REMOVED=$((TOTAL_REMOVED + ${#CANDIDATES[@]}))
    else
      log "SKIPPED font removal."
      SKIPPED=$((SKIPPED + ${#CANDIDATES[@]}))
    fi
  fi
 else
  log "No redundant font packages found."
 fi
 # ============================================================
 # 7. BROWSERS (keep current active, remove extras)
 # ============================================================
 section "[6/7] Browser Packages"
 CANDIDATES=()
 # Check which browsers are installed
 BROWSERS=()
 for browser in firefox chromium google-chrome firefox-developer-edition brave-bin microsoft-edge; do
  if pacman -Q "$browser" &>/dev/null; then
    BROWSERS+=("$browser")
  fi
 done
 log "Installed browsers: ${BROWSERS[*]}"
 log "${BOLD}Recommended: Keep firefox-developer-edition + one other${RESET}"
 if [[ ${#BROWSERS[@]} -gt 2 ]]; then
  # Suggest removal of non-essential browsers
  SUGGESTED_REMOVAL=()
  for b in "${BROWSERS[@]}"; do
    # Keep firefox-developer-edition and chromium/google-chrome
    if [[ "$b" != "firefox-developer-edition" && "$b" != "chromium" && "$b" != "google-chrome" ]]; then
      SUGGESTED_REMOVAL+=("$b")
    fi
  done
  if [[ ${#SUGGESTED_REMOVAL[@]} -gt 0 ]]; then
    CANDIDATES=("${SUGGESTED_REMOVAL[@]}")
    TOTAL_CANDIDATES=$((TOTAL_CANDIDATES + ${#CANDIDATES[@]}))
    log "Suggested removal: ${CANDIDATES[*]}"
    if [[ "$MODE" == "check" ]]; then
      log "DRY-RUN: Would run: sudo pacman -Rns --noconfirm ${CANDIDATES[*]}"
    else
      sudo pacman -Rns --noconfirm "${CANDIDATES[@]}" 2>&1 | tee -a "$LOCAL_LOG" || true
      TOTAL_REMOVED=$((TOTAL_REMOVED + ${#CANDIDATES[@]}))
    fi
  fi
 else
  log "Browser count is manageable (${#BROWSERS[@]}). No action needed."
 fi
 # ============================================================
 # 8. UNUSED PYTHON PACKAGES
 # ============================================================
 section "[7/7] Unused Python GUI Packages"
 CANDIDATES=()
 PYTHON_CANDIDATES=(
  wxpython
  wxpython-gtk3
  pyqt5
  pyqt5-sip
  pyqt6
  pyqt6-sip
  fluidity
  tk
  tkinter
  python-tk
 )
 for pkg in "${PYTHON_CANDIDATES[@]}"; do
  if pacman -Q "$pkg" &>/dev/null; then
    CANDIDATES+=("$pkg")
  fi
 done
 TOTAL_CANDIDATES=$((TOTAL_CANDIDATES + ${#CANDIDATES[@]}))
 if [[ ${#CANDIDATES[@]} -gt 0 ]]; then
  log "Found ${#CANDIDATES[@]} Python GUI candidates: ${CANDIDATES[*]}"
  if [[ "$MODE" == "check" ]]; then
    log "DRY-RUN: Would run: sudo pacman -Rns --noconfirm ${CANDIDATES[*]}"
  else
    sudo pacman -Rns --noconfirm "${CANDIDATES[@]}" 2>&1 | tee -a "$LOCAL_LOG" || true
    TOTAL_REMOVED=$((TOTAL_REMOVED + ${#CANDIDATES[@]}))
  fi
 else
  log "No unused Python GUI packages found."
 fi
 # ============================================================
 # CLEANUP ORPHANS & CACHE
 # ============================================================
 section "Post-Cleanup: Orphans & Cache"
 log "Finding orphaned dependencies..."
 ORPHANS=$(pacman -Qtdq 2>/dev/null || true)
 if [[ -n "$ORPHANS" ]]; then
  ORPHAN_COUNT=$(echo "$ORPHANS" | wc -l)
  log "Found $ORPHAN_COUNT orphaned packages"
  if [[ "$MODE" == "check" ]]; then
    log "DRY-RUN: Would run: sudo pacman -Rns --noconfirm $(echo $ORPHANS)"
  else
    sudo pacman -Rns --noconfirm $ORPHANS 2>&1 | tee -a "$LOCAL_LOG" || true
    TOTAL_REMOVED=$((TOTAL_REMOVED + ORPHAN_COUNT))
  fi
 else
  log "No orphaned packages found."
 fi
 log "Cleaning pacman cache (keep last 2 versions)..."
 if [[ "$MODE" == "check" ]]; then
  CACHE_SIZE=$(du -sh /var/cache/pacman/pkg/ 2>/dev/null | cut -f1)
  log "Cache size: $CACHE_SIZE"
  log "DRY-RUN: Would run: sudo paccache -rk2"
 else
  sudo paccache -rk2 2>&1 | tee -a "$LOCAL_LOG" || true
 fi
 # ============================================================
 # SUMMARY
 # ============================================================
 section "Cleanup Summary"
 FINAL_DISK=$(df -h / | awk 'NR==2 {print $4}')
 log "Disk space available after cleanup: $FINAL_DISK"
 log "Total candidates identified: $TOTAL_CANDIDATES"
 log "Packages removed: $TOTAL_REMOVED"
 log "Packages skipped: $SKIPPED"
 log "Log saved to: $LOCAL_LOG"
 log ""
 log "============================================="
 log "  Cleanup Complete"
 log "============================================="
 # Cleanup temp files
 rm -f "$HOME/logs/.cleanup-candidates-"*.txt 2>/dev/null || true
@@ -0,0 +1,230 @@
 #!/bin/bash
 set -euo pipefail
 # NVIDIA Kernel Module Recovery Script
 # Purpose: Reinstall nvidia-580xx-dkms and rebuild kernel module after package cleanup removed it
 # Target: mw-pfeddersheim-workstation (Manjaro, NVIDIA GPU)
 MODE="apply"
 if [[ "${1:-}" == "--check" ]]; then
  MODE="check"
  echo "=== Running in CHECK mode (diagnostic only, no changes) ==="
 elif [[ "${1:-}" == "--help" ]]; then
  echo "Usage: $0 [--check | --apply | --help]"
  echo "  --check  Diagnose and show what would be done"
  echo "  --apply  Reinstall nvidia-580xx-dkms and rebuild module (requires sudo)"
  echo "  --help   Show this help"
  exit 0
 fi
 mkdir -p "$HOME/logs" 2>/dev/null || true
 LOCAL_LOG="$HOME/logs/nvidia-recovery-$(date +%Y%m%d-%H%M%S).log"
 BOLD=$(tput bold 2>/dev/null || true)
 RED=$(tput setaf 1 2>/dev/null || true)
 GREEN=$(tput setaf 2 2>/dev/null || true)
 YELLOW=$(tput setaf 3 2>/dev/null || true)
 RESET=$(tput sgr0 2>/dev/null || true)
 log() { echo -e "$*" | tee -a "$LOCAL_LOG"; }
 section() { log ""; log "${BOLD}--- $1 ---${RESET}"; }
 echo "" | tee -a "$LOCAL_LOG"
 log "============================================="
 log "  NVIDIA Kernel Module Recovery"
 log "  Date: $(date)"
 log "  Log:  $LOCAL_LOG"
 log "============================================="
 # ============================================================
 # 1. DIAGNOSTICS
 # ============================================================
 section "Diagnostic"
 # Get current kernel
 RUNNING_KERNEL=$(uname -r)
 log "Running kernel: $RED$RUNNING_KERNEL$RESET"
 KERNEL_VERSION="${RUNNING_KERNEL%-MANJARO}"  # 6.18.33-1
 KERNEL_MAJOR="${KERNEL_VERSION%%.*}"          # 6
 KERNEL_MINOR="${KERNEL_VERSION#*.}"           # 18.33-1
 KERNEL_MINOR="${KERNEL_MINOR%%.*}"           # 18
 KERNEL_PKG="linux${KERNEL_MAJOR}${KERNEL_MINOR}"  # linux618
 log "Kernel package: $KERNEL_PKG"
 # Check if nvidia module exists
 MODULE_PATH="/usr/lib/modules/$RUNNING_KERNEL/extra/modules/nvidia.ko.zst"
 MODULE_PATH2="/usr/lib/modules/$RUNNING_KERNEL/extra/nvidia.ko.zst"
 MODULE_PATH3="/usr/lib/modules/$RUNNING_KERNEL/updates/dkms/nvidia.ko.zst"
 MODULE_PATH4="/usr/lib/modules/$RUNNING_KERNEL/updates/nvidia.ko.zst"
 MODULE_PATH5="/usr/lib/modules/$RUNNING_KERNEL/kernel/drivers/gpu/drm/nvidia/nvidia.ko.zst"
 MODULE_FOUND=false
 if [[ -f "$MODULE_PATH" ]] || [[ -f "$MODULE_PATH2" ]] || [[ -f "$MODULE_PATH3" ]] || [[ -f "$MODULE_PATH4" ]] || [[ -f "$MODULE_PATH5" ]]; then
  MODULE_FOUND=true
  log "${GREEN}NVIDIA module found at $MODULE_PATH3$RESET"
 else
  log "${RED}NVIDIA module MISSING for kernel $RUNNING_KERNEL$RESET"
 fi
 # Check nvidia-utils
 if command -v nvidia-smi &>/dev/null; then
  log "${GREEN}nvidia-smi: available$RESET"
 else
  log "${RED}nvidia-smi: not found$RESET"
 fi
 # Check DKMS
 if command -v dkms &>/dev/null; then
  log "${GREEN}dkms: available$RESET"
 else
  log "${RED}dkms: not found$RESET"
 fi
 # Check if nvidia-580xx-dkms is installed
 if pacman -Q nvidia-580xx-dkms &>/dev/null; then
  DKMS_INSTALLED=true
  log "${GREEN}nvidia-580xx-dkms: installed$(pacman -Qi nvidia-580xx-dkms 2>/dev/null | grep Version)"
 else
  DKMS_INSTALLED=false
  log "${RED}nvidia-580xx-dkms: NOT installed$RESET"
 fi
 # Check if nvidia-utils is installed
 if pacman -Q nvidia-utils &>/dev/null; then
  log "${GREEN}nvidia-utils: installed"
 else
  log "${RED}nvidia-utils: NOT installed$RESET"
 fi
 # Check modules-load config
 if [[ -f /etc/modules-load.d/mhwd-gpu.conf ]]; then
  log "modules-load config: /etc/modules-load.d/mhwd-gpu.conf exists"
  log "  Entries: $(grep -v '^#\|^$' /etc/modules-load.d/mhwd-gpu.conf | tr '\n' ' ')"
 else
  log "${RED}No mhwd-gpu.conf found$RESET"
 fi
 # ============================================================
 # 2. CHECK DEPENDENCIES
 # ============================================================
 section "Dependency Check"
 MISSING=()
 if ! command -v dkms &>/dev/null; then
  MISSING+=(dkms)
 fi
 if ! command -v mkinitcpio &>/dev/null; then
  MISSING+=(mkinitcpio)
 fi
 if [[ ${#MISSING[@]} -gt 0 ]]; then
  log "${RED}Missing base tools: ${MISSING[*]}$RESET"
  log "These will be installed as part of the fix."
 fi
 # Check available disk space
 DISK_AVAIL=$(df -h / | awk 'NR==2 {print $4}')
 log "Disk available: $DISK_AVAIL"
 # ============================================================
 # 3. APPLY FIX
 # ============================================================
 section "Applying Fix"
 if [[ "$MODE" == "check" ]]; then
  log "${BOLD}DRY-RUN MODE${RESET}"
  log "Would execute:"
  log "  sudo pacman -Rns --noconfirm nvidia-utils  # remove conflicting non-580xx driver"
  log "  sudo pacman -S --needed nvidia-580xx-dkms nvidia-580xx-utils"
  log "  sudo pacman -S --needed linux618-headers   # kernel headers for DKMS"
  log "  sudo dkms autoinstall"
  log "  sudo mkinitcpio -P"
  log "  sudo reboot"
  exit 0
 fi
 # Confirm before destructive action
 log "${BOLD}This will reinstall the NVIDIA kernel module driver.$RESET"
 log "The system will reboot automatically."
 read -rp "Continue? [y/N] " confirm
 if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
  log "ABORTED by user."
  exit 0
 fi
 # Step 1: Resolve driver conflict, install 580xx suite
 log "[1/5] Resolving NVIDIA driver conflict and installing 580xx suite..."
 # Check if newer nvidia-utils conflicts with 580xx-dkms
 if pacman -Q nvidia-utils &>/dev/null && ! pacman -Q nvidia-580xx-utils &>/dev/null; then
  log "Conflict: nvidia-utils (non-580xx) installed alongside nvidia-580xx-dkms."
  log "Removing conflicting nvidia-utils, installing nvidia-580xx-utils..."
  sudo pacman -Rns --noconfirm nvidia-utils 2>&1 | tee -a "$LOCAL_LOG"
  sudo pacman -S --needed --noconfirm nvidia-580xx-dkms nvidia-580xx-utils 2>&1 | tee -a "$LOCAL_LOG"
 else
  sudo pacman -S --needed --noconfirm nvidia-580xx-dkms nvidia-580xx-utils 2>&1 | tee -a "$LOCAL_LOG"
 fi
 # Step 2: Ensure kernel headers are available for DKMS
 log "[1b/4] Checking kernel headers for DKMS..."
 KERNEL_HEADERS="${KERNEL_PKG}-headers"
 if pacman -Q "$KERNEL_HEADERS" &>/dev/null; then
  log "${GREEN}Kernel headers ($KERNEL_HEADERS) already installed.$RESET"
 else
  log "Installing $KERNEL_HEADERS for DKMS..."
  sudo pacman -S --needed --noconfirm "$KERNEL_HEADERS" 2>&1 | tee -a "$LOCAL_LOG"
 fi
 # Step 3: Rebuild DKMS module for current kernel
 log "[2/5] Rebuilding DKMS module for kernel $RUNNING_KERNEL..."
 sudo dkms autoinstall 2>&1 | tee -a "$LOCAL_LOG"
 # Step 3: Verify module was created
 log "[3/5] Verifying module..."
 if [[ -f "$MODULE_PATH" ]] || [[ -f "$MODULE_PATH2" ]] || [[ -f "$MODULE_PATH3" ]] || [[ -f "$MODULE_PATH4" ]] || [[ -f "$MODULE_PATH5" ]]; then
  log "${GREEN}Module verified!$RESET"
  # Show module details
  modinfo_output=$(modinfo nvidia 2>/dev/null || echo "modinfo failed")
  log "  $modinfo_output"
 else
  log "${RED}WARNING: Module file not found after DKMS build.$RESET"
  # Detect version for manual build
  DKMS_VERSION=$(pacman -Qi nvidia-580xx-dkms 2>/dev/null | grep Version | awk '{print $2}' | cut -d- -f1)
  [[ -z "$DKMS_VERSION" ]] && DKMS_VERSION="580.159.04"
  log "Attempting manual build (version: $DKMS_VERSION)..."
  sudo dkms build -m nvidia -v "$DKMS_VERSION" -k "$RUNNING_KERNEL" 2>&1 | tee -a "$LOCAL_LOG"
  sudo dkms install -m nvidia -v "$DKMS_VERSION" -k "$RUNNING_KERNEL" 2>&1 | tee -a "$LOCAL_LOG"
 fi
 # Step 4: Rebuild initramfs
 log "[4/5] Rebuilding initramfs..."
 sudo mkinitcpio -P 2>&1 | tee -a "$LOCAL_LOG"
 # ============================================================
 # 4. VERIFICATION
 # ============================================================
 section "Post-Recovery Verification"
 log "Checking module loading..."
 if sudo modprobe nvidia 2>&1; then
  log "${GREEN}nvidia module loaded successfully$RESET"
 else
  log "${YELLOW}modprobe nvidia failed - module will be loaded at next boot$RESET"
 fi
 # Detect 580xx version for manual DKMS fallback
 DKMS_VERSION=$(pacman -Qi nvidia-580xx-dkms 2>/dev/null | grep Version | awk '{print $2}' | cut -d- -f1 || echo "580.159.04")
 # Manual DKMS fallback uses DKMS_VERSION variable
 log ""
 log "${BOLD}Recovery complete!${RESET}"
 log ""
 log "Before rebooting, verify:"
 log "  1. Module exists: ls /usr/lib/modules/$(uname -r)/extra/nvidia*"
 log "  2. nvidia-smi works: sudo nvidia-smi"
 log ""
 log "Then reboot:"
 log "  sudo reboot"
 log ""
 log "Log saved to: $LOCAL_LOG"
 log "============================================="
Author	SHA1	Message	Date
mw	cd63df4f59	docs(caddy): add agent0.localhost reverse proxy + RFC 6761 wildcard learning - New site: https://agent0.localhost -> reverse_proxy 192.168.0.141:8090 (first non-localhost backend; remote LAN host running uvicorn) - Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf - Regenerated mkcert cert: 19 -> 20 SANs, valid until 2028-10-21 - Key learning: *.localhost wildcard is NOT honored by curl/system trust even for single-label subdomains - .localhost is a special-use TLD per RFC 6761; every subdomain needs an explicit SAN. Corrects prior assumption in stack.md and manual-overrides.md. Updates: docs/tech/stack.md, docs/tech/manual-overrides.md, CHANGELOG.md	2026-07-21 14:08:07 +02:00
mw	c67dd74e0b	docs: add memory inventory and migration log - 4x 8 GiB DDR4-3000 DIMMs (32 GiB total) in workstation - 64 GiB DDR4-2400 migrated to homeoffice, swapped for 32 GiB	2026-07-13 17:29:00 +02:00
mw	cbe24c03df	docs: add platform/packages/onlyoffice.docs localhost sites + cert regen to Caddy docs - Added platform.localhost (-> localhost:10080) and packages.localhost (-> localhost:20080) to stack.md sites table (total now 17) - Documented onlyoffice.docs.localhost (pre-existing in Caddy config, was undocumented) - Regenerated mkcert cert with explicit SANs for the 3 new hostnames (onlyoffice.docs.localhost is multi-label, not covered by *.localhost wildcard) - Fixed wildcard note: multi-label hosts require explicit SANs - Updated manual-overrides with cert regeneration row + site delta - Updated CHANGELOG with cert regen + site additions	2026-07-12 13:10:21 +02:00
mwandJunie	269079df34	chore(hyprland): enable mouse window drag/resize and migrate cheatsheets to learn portal Co-authored-by: Junie <junie@jetbrains.com>	2026-07-09 11:01:51 +02:00
mw	b888ef90c4	docs(changelog): merge duplicate '### Fixed' section into one block Complete the Keep a Changelog compliance started in `441e28b`. The second '### Fixed' block at end of [Unreleased] (kitty, GRUB regex, changed_when, OOM, keyring) is merged into the first block, preserving newest-first ordering (2026-05-22 -> 2026-03-17). Section order remains Fixed -> Added -> Removed -> Changed (pre-existing, non-standard vs Keep a Changelog's recommended Added-first order). Reordering all sections is a larger refactor beyond this fix's scope.	2026-07-06 09:33:56 +02:00
mw	441e28bda3	docs: fix CHANGELOG duplicate Added section + missing period in learning doc Address review feedback on `ce99f58`: - Merge the two '### Added' blocks in [Unreleased] into one (Keep a Changelog: each category appears once). New 2026-07-06 entries now sit at the top of the existing Added block. - Add missing period after 'required SSE headers' in the liveness verification prose (was a run-on sentence).	2026-07-06 09:14:13 +02:00
mw	ce99f58374	docs: Caddy manual override + OnlyOffice MCP SSE investigation (#92 ) Record the Caddy reverse-proxy at /etc/caddy/ (14 .localhost sites, mkcert TLS, systemd caddy.service) as a manual override in docs/tech/manual-overrides.md - no caddy Ansible role exists yet. Add a 'Local Dev Services' section to docs/tech/stack.md listing all .localhost sites and useful Caddy commands. New learning record docs/learnings/2026-07-06-caddy-onlyoffice-mcp-sse- investigation.md: Caddy emits 'context canceled' SSE aborts (~1.5ms) on onlyoffice.localhost/mcp -> localhost:3847. Upstream verified alive (HTTP 406 to plain GET = expected). Handed off to GitLab issue satware/mcp/onlyoffice#92 with 5 hypotheses, 7 tasks, and a proposed flush_interval -1 + transport http { versions 1.1 } mitigation (not applied yet to avoid masking root cause).	2026-07-06 08:58:27 +02:00
mw	2b6ce0d635	docs: Remmina Wayland crash fix + upstream MR !2757 - Added learning doc for 2026-07-03 session: diagnosed SIGSEGV in XKeysymToKeycode (missing NULL check on XOpenDisplay), forked Remmina to gitlab.com/satware, built with FreeRDP3, verified fix, submitted MR. - Added manual override entry for patched remmina-plugin-rdp.so in ~/.config/remmina/plugins/	2026-07-03 12:13:34 +02:00
mw	d72e3782e8	docs(passwords): document git.satware.ai PAT libsecret migration and rotation TODO	2026-06-30 14:13:15 +02:00
mw	07bd3f8699	fix(ansible): harden AUR install task and rename ansible_user to local_user - AUR task: replace loop with single paru call, use changed_when: false (stdout-only match never fired under non-TTY runs) and failed_when: false so transient AUR failures don't abort the play - Rename ansible_user -> local_user to avoid shadowing the connection magic var; update the two references in roles/common/tasks/main.yml	2026-06-24 20:14:33 +02:00
mw	feaccf201d	docs(learnings): record YubiKey + Dell E7250 air-gapped keygen host setup Session record 2026-06-24: YubiKey inventory, GPG commit-signing plan, reusable SPECCOL inventory/provisioning stick (dock-aware), and full hardening + provisioning of the Dell Latitude E7250 as the dedicated air-gapped keygen/forensic host (BIOS A24, Secure Boot, AMT off, radios off, dist-upgraded, Phase-2 tooling installed). TPM 1.2-only (hardware limit). Captures key gotchas (yubikey-manager package name, FAT32 +x, TXT-before-TPM-clear, E7250 not on LVFS) and the refined architecture.	2026-06-24 20:02:43 +02:00
mw	5a714e6256	docs(plans): add YubiKey+GPG GitHub commit-signing plan Baby-step plan for hardware-backed OpenPGP commit/tag signing on YubiKey 5 NFC #30836069 (air-gapped keygen, ed25519/cv25519 subkeys, 2y expiry, touch required). LUKS-encrypted recovery backup on the Type-C USB stick; non-secret config to be folded into ansible/. HTTPS+GPG-sign (lowest risk); 2nd YubiKey scheduled as Phase 9 follow-up.	2026-06-24 16:54:08 +02:00
ja	d9392447f9	doxify: inject DOX framework into AGENTS.md and update system config docs - Inject all 10 DOX sections into root AGENTS.md (Core Contract, Read Before Editing, Update After Editing, Hierarchy, Child Doc Shape, Style, Closeout, User Preferences, Child DOX Index) - Update ADR 0002: linux612->linux618, 575xx->580xx NVIDIA migration - Update setup.md: kernel/driver refs to current linux618 + 580xx - Update stack.md, hardware-inventory.md: NVIDIA note 595.71->580xx - Update manual-overrides.md: add br_vm_internal bridge deletion entry - Update workstation-health.md: add Recent Cleanup section - Update README.md: current software versions, expand roles list - Add docs/neovim-cheatsheet.md - Bump last_updated to 2026-06-17 on all modified docs	2026-06-17 14:13:34 +02:00
jaandJunie	de24990208	chore: add maintenance scripts and update editor preference - Add scripts/cleanup.sh for package cleanup (dry-run/apply modes) - Add scripts/nvidia-recovery.sh for broken GUI recovery - Update AGENTS.md with new script references - Change default editor from vim to nvim in bashrc Co-authored-by: Junie <junie@jetbrains.com>	2026-06-15 06:43:43 +02:00
jaandJunie	fe7f133136	feat(hyprland): migrate config from .conf to .lua format (Hyprland 0.55+) - Add hyprland.lua.j2 Ansible template with full Lua DSL config - Update tasks to deploy hyprland.lua instead of hyprland.conf - Add docs/tech/hyprland-lua-migration.md with API reference, dispatcher mapping, pitfalls, and validation commands - Update keybindings doc to reflect .lua config format Co-authored-by: Junie <junie@jetbrains.com>	2026-06-15 06:43:23 +02:00
ja	f1544747a0	fix: replace numlockx with native numlock_by_default; remove invalid --numlock from greetd - Remove invalid --numlock flag from tuigreet command in greetd config (not a recognized tuigreet parameter, caused boot error) - Replace X11-only 'numlockx on' in Hyprland with native 'numlock_by_default = true' in the input section - Update Ansible template and CHANGELOG accordingly	2026-06-01 06:54:39 +02:00
ja	cb9b8474bb	Add kitty window title bar with hostname/cwd display - New Ansible template for kitty.conf with window_title_bar - Title bar shows: hostname \| cwd \| title on every tile - Document title bar feature in keybindings cheatsheet	2026-05-28 10:43:40 +02:00
ja	3c7bf3bd73	Add SUPER+Enter as alternative terminal shortcut	2026-05-28 08:54:33 +02:00
ja	5173fdd5e0	Enable NumLock on boot via tuigreet and Hyprland - Install numlockx - Add --numlock flag to tuigreet greeter - Add exec-once = numlockx on to Hyprland config	2026-05-28 08:32:40 +02:00
ja	dbf366f8a5	Update Hyprland keybindings and monitor refresh rates - SUPER+Q: killactive (was kitty) - SUPER+T: exec kitty (new terminal binding) - SUPER+C: removed (was killactive) - All monitors set to 60Hz (DP-1 and HDMI-A-1 down from 144Hz)	2026-05-28 08:25:57 +02:00
ja	6f455ab0f2	chore: remove alesi-routine-morning systemd timer - Deleted alesi-routine-morning.service and .timer from ~/.config/systemd/user/ - Timer failed daily at 07:45 (exit 128, git outside repo) - daily-routine.sh script retained for manual use - Updated CHANGELOG.md and workstation-health.md	2026-05-26 08:59:00 +02:00
ja	b0af3dcf12	Workstation optimization: Chrome cleanup, package purge, PCIe audit, service tuning - Chrome/Chromium cleanup (ADR 0006): removed 10GB chromium profile, broken PWA shortcuts, dead BROWSER_CDP_URL from .bashrc, restored Wayland chrome-flags.conf - Package cleanup (ADR 0007): Tier 1-4 executed, 40 packages removed (KDE Plasma, ruby, love, xorg-server, kscreen/kscreenlocker), 45 cascade orphans purged - Waybar USB module: auto-mount via udisks2, yazi integration, hover details - Service tuning: disabled bluetooth.service, NetworkManager-wait-online.service - hypridle fix: upgraded sdbus-cpp 2.3.0->2.3.1-1 (SEGV crash loop resolved) - PCIe audit: GPU in wrong slot (PCIEX4 vs PCIEX16), 8x bandwidth loss documented - D-Bus cleanup: removed stale org.kde.kwalletd6.service stub - Ansible: all changes reflected in vars/main.yml and task files	2026-05-22 16:24:18 +02:00
ja	2487aa5749	feat(chrome): NVIDIA Wayland GPU acceleration for Chrome 148 Replace obsolete WebGPU flags with state-of-the-art NVIDIA VA-API hardware decode config for Chrome 148 on Wayland/Hyprland. - Disable seccomp sandbox to fix NVIDIA GBM "Permission denied" error - Disable VulkanFromANGLE/DefaultANGLEVulkan (incompatible with Wayland) - Force ANGLE->OpenGL backend to avoid Vulkan/Wayland conflicts - Enable modern VA-API flags: VaapiOnNvidiaGPUs, AcceleratedVideoDecodeLinux* - Add gnome-libsecret password store for gnome-keyring integration - Install libva-utils and libva-nvidia-driver packages - Update driver version to 580.159.03 in hardware inventory WebGPU remains hardware accelerated via ANGLE+OpenGL. Chrome verified working with full video decode acceleration (H.264, VP9, HEVC) via NVDEC.	2026-05-21 16:02:11 +02:00
ja	7d8760592e	chore: align IaC with today's package installs + PDF comparison docs DevOps sync (2026-05-21): - Remove onlyoffice-desktopeditors from absent list (actively used) - Add gnome-keyring, rbw to common role (secrets migration) - Add perl-image-exiftool, icoutils, innoextract-git to dev-tools (Windows installer inspection) - Create fonts role: Inter, Cascadia Code, Fira, Source Sans, TeX Gyre - Create pdf role: zathura, zathura-pdf-mupdf, python-weasyprint - Register new roles in workstation.yml PDF comparison: - Add pdf-comparison docs with Quarto/Typst/Pandoc outputs - Add batch-pdf.sh script - Update yazi-cheatsheet.md - Ignore .quarto/ cache	2026-05-21 13:38:50 +02:00
ja	d746d76530	migrate secrets management from KWallet to gnome-keyring + Bitwarden Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring (local cache via org.freedesktop.secrets D-Bus). All apps (himalaya, git, ssh-agent, JetBrains IDEs, browsers) now read secrets via libsecret/secret-tool through gnome-keyring. Changes: - Install gnome-keyring + rbw, enable as systemd user service - Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com) - Migrate 45 meaningful entries from KWallet → BW + GK - Switch git credential.helper from store to libsecret - Document: one-pager, ADR, migration checklist, NEXT_STEPS update - Skill: devops/secrets-migration for reuse Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in KWallet) and GitHub CLI token re-auth. See docs/product/passwords.md for the full guide.	2026-05-21 12:58:38 +02:00
ja	a9bc934543	chore: add LibreOffice lock files to .gitignore	2026-05-21 11:16:29 +02:00
ja	ee592cc21b	feat: add start-hyprland watchdog override for uwsm session Hyprland 0.53+ requires launching via start-hyprland (watchdog) for proper crash diagnostics and signal handling. Without it a warning banner appears on login. Override package-managed hyprland.desktop with local copy pointing to start-hyprland. XDG_DATA_DIRS priority ensures the override wins without modifying system files. - ansible/roles/hyprland/tasks/main.yml: manage override in ~/.local/share/wayland-sessions/ - docs/adr/0004-start-hyprland-override.md: full decision record - docs/hyprland-uwsm.md: document override behavior	2026-05-21 11:15:14 +02:00