- allow file-path secret references and require approval for breaking changes
- relax the commit subject limit and allow rewriting unpublished local history
- refine tooling plus shell and script selection/validation guidance
The r8169 NIC drops carrier on S3 resume, and systemd-networkd reacts by reconfiguring enp130s0: it dropped the static address/default route and deleted foreign routing policy rules (mihomo's 9000-9010 and Tailscale's 5210-5270). clash's TUN then lost its outbound interface and networking stayed broken until clash was restarted.
- IgnoreCarrierLoss=10s keeps the static address/route across the short carrier loss.
- ManageForeignRoutingPolicyRules=false stops networkd from deleting the TUN/VPN ip rules during the reconfiguration.
The lock listener ignores inhibitors but had no playback condition, so it locked the screen at its timeout even during active media playback (screen-off already skipped via playerctl). Add the same playerctl condition to the lock listener.
niri already owns the org.freedesktop.ScreenSaver interface and feeds its inhibitors into the compositor idle notifier, so hypridle's own registration always fails with 'Another service is already providing...'. Set ignore_dbus_inhibit = true so hypridle no longer tries to claim it; D-Bus inhibits are still handled by niri.
Replace the static hypridle.conf with services.hypridle.settings and add required timeout options so each host tunes its own values:
- idols-ai (PC): 15 min keyboard, 20 min screen-off, 30 min lock.
- 12kingdoms-shoukei (laptop): 3 / 6 / 20 min (previous values).
The options have no defaults because the right values depend on the machine. Update the home-manager eval test to inspect the settings option instead of the old config file text.
Desktop speakers on idols-ai use the EBU R128 broadcast standard (-23 dB), while the quiet built-in laptop speakers on 12kingdoms-shoukei keep -12 dB. Move the target out of the shared preset so each host sets its own value.
Declare the output chain via services.easyeffects.extraPresets and load it with preset.output, replacing the GUI-only configuration that did not survive the tmpfs root.
autogain target is set to -12 dB (EasyEffects defaults to -23, which is too quiet for playback); the limiter acts as a transparent -1 dB safety net via threshold=-1 and gain-boost=false.
Emphasize safety precedence in the intro, and replace the narrow Bash pipeline ban with a trigger-based rule: keep POSIX shell as glue and move to Nushell or Python once quoting, error handling, parsing, types, retries, or portability are involved.
- render Niri on the Intel iGPU while retaining NVIDIA-connected physical outputs
- encode Sunshine streams with Intel VAAPI and wait for a Niri output before startup
- load VKMS persistently for headless sessions and configure `Virtual-1` at 2560x1600@60
- let Moonlight request the stream bitrate instead of enforcing a 20 Mbps host cap
- remove unsupported Dynamic Boost and global NVIDIA session overrides
- grant Sunshine access to virtual input devices
- add a Nushell recovery helper that starts a temporary greetd/Niri session from SSH
- identify and safely replace normal, standalone, or previous transient Niri sessions
- launch the transient service in the background and verify greetd, Niri, and Sunshine before returning
- ignore local `.worktrees` directories and keep eval regression coverage focused on structural behavior
- read Asahi aop-sensors ALS via iio and drive eDP-1 backlight
- drop PrivateUsers for wluma so it can reach the real user D-Bus session
- remove hypridle 10min screen-dim listener: its brightnessctl writes fight
wluma and get learned as manual adjustments
Enable gnomeKeyring for the passwd PAM service so pam_gnome_keyring
updates the login keyring password when the login password changes.
Fixes 'Unlock Login Keyring' prompt desync after changing the password
via passwd (greetd session unlock alone does not update the keyring).
The running clash-verge-rev reports app_id "clash-verge" (lowercase), so the
anchored ^Clash-verge$ pattern never matched and the window opened on whatever
workspace was focused (1terminal). Match case-insensitively.
Change-Id: Iddabdbd66597a7325bdb08cb31434c1ee710dc3e
greetd ran the niri session directly, so exiting the session (e.g.
logout from the lock screen) made greetd immediately restart the
desktop with no authentication.
The broad 'file /** rwlkUx' rule conflicts with rix exec rules pulled in
via nested abstractions (xdg-open): AppArmor 5.0 rejects merged rules
with differing exec modifiers, failing apparmor.service on first load.
Ryan Yin