One host held ~2500 player sockets and churned thousands more; the server
spends two threads per socket and ran out of tasks for everyone.

Lets the phone reach the agent when it is off retiolum. Long read timeout
and no buffering because /v1/chat/completions streams SSE for the whole
turn; fast connect timeout because coaxmetal is a laptop.

The bearer token is the only authn on this lane and the app cannot do
mTLS, so the location allowlist and limit_req are damage control: only the
endpoints the app calls are reachable, and /api/pty stays 404 even if
backend.mode is enabled later.

Voice both ways over Matrix: local faster-whisper (the "voice" dep group)
transcribes Element voice notes, and replies are spoken by a piper command
provider against a pinned en_US-lessac-medium voice. The built-in piper and
edge backends cannot work here, they lazily pip-install into a read-only
sealed venv. stt.prompt biases the jargon: without it "herdr" transcribes
as "Herter".

herdr runs as lass and keeps its socket under lass's HOME, so the agent
reaches the herd through a sudo wrapper plus a SKILL.md that documents it.
That needs NoNewPrivileges off, sudo is setuid.

The OpenAI-compatible API server is the assistant-button lane for the
WakeHermesClaw app, bound to the retiolum address resolved at start.

The krebs-CA cert expired ~594 days ago and acme-order-renew-jelly.r keeps
failing (exit 11, negative remaining duration), leaving yellow degraded.
jellyfin is reachable over plain http on jelly.r and directly on :8096.

also document why transmission-gc talks to 128.0.0.1: the daemon runs in its
own netns (t1), the gc unit does not (t2), so localhost is not the daemon.

mpvpaper rendered a looping video on every output, which makes every frame
full-screen motion. On the sunshine-streamed tablet screen that meant a
constantly saturated encoder and an unusable stream (97% of frames dropped
at 5 Mbps), and on the real outputs it is pointless power draw.

noctalia owns the desktop background again (wallpaper.enabled = true); pick
the image in its wallpaper panel. ~/wallpaper is no longer seeded, but
lockscreen still uses whatever is in it.

Streams a sway headless output to Moonlight with Sunshine, so an Android
tablet works as a wireless second screen with its touchscreen acting as a
touchpad on the shared cursor.

The output is created once per session and stays disabled until a client
streams: sunshine's prep-cmd enables it at exactly the resolution and
refresh rate the client asks for, and disables it afterwards so sway moves
the workspace back to the real screens. wlroots never reuses a headless
output name, so the name is discovered at creation time, remembered in
$XDG_RUNTIME_DIR and handed to sunshine as an output_name command line
override instead of being hardcoded.

Replaces 2configs/sunshine.nix, which only shipped a manual launcher
script.

styx keeps hass/snapserver/mycelium as a plain LAN client on et0 with a
static lease (10.42.0.3) from acheron; 10.42.0.1 now means the router.
Repoint snapclient, mycelium peers, zigbee2mqtt broker, ignavia's tinc
Address and the gg23 extraHosts accordingly.

Intel N355 mini PC, 2x I226-V, UEFI/NVMe disko, systemd-boot. Only
2configs + retiolum + gg23 for now; NIC naming matches styx (et0 uplink,
int0 LAN). Retiolum card in retiolum/ (10.243.11.2), server tag.

update.sh: the hash probes ran under pipefail/errexit, so an expected hash-mismatch build produced an empty result and the script exited without touching the hashes.

Picks up the darwin tinc-up fix on lassulus/fixes: route the IPv4 prefix into
the utun. Without it macOS only installed a host route for the tunnel address
and every IPv4 packet for the mesh left through the default gateway. Same bug
kartei carried in its copy of the module (krebs/kartei#65); 28a957a6 switched
barnacle to tincr own module, which never had that fix.

Integration branch = Mic92/main + #101 (NAT-leaf dial, loop clock, tunnel-address gate) + #109 (EMSGSIZE clamps minmtu, counts as probe miss, TCP fallback, MTU_INFO clamp mid-rediscovery). Fixes the retiolum blackhole seen as 'pmtu 1293 (min 1319 max 1488)'.

update.sh now blanks both hashes before the probe builds: with the old ones in place nix reused the cached FODs and the bump built stale code.

kartei's darwinModules.retiolum pulled tincd from kartei's own tincr
input, so barnacle ran a different daemon than the NixOS nodes. Now
every machine runs 5pkgs/tincr (Lassulus/tincr fix/edge-walk-address):
barnacle imports tincr's darwinModules.tincr directly with
services.tincr.package set, and reproduces the shim's settings itself
(node data from kartei's hosts.nix exactly as 2configs/retiolum.nix
does, connectTo = krebs hubs + neoprism/starkstrom, LocalDiscovery,
Broadcast = no, the BEGIN/END RETIOLUM HOSTS block in /etc/hosts).
kartei is host database only on both platforms.

New flake input `tincr` (fork branch, module only); kartei's tincr/
crane/fenix follow it so the lock has a single node each.

Three daemon fixes pending upstream as Mic92/tincr#101:

- NAT-leaf dialled at its hub's listener (#100): the ID-mismatch
"orange is neoprism" loop every AutoConnect round.
- Stale loop clock: an accepted conn was timestamped from before the
poll, so the ping sweep reaped it mid-handshake ("Timeout … during
authentication") — every reconnect to an idle listener died.
- Tunnel-address gate: meta/UDP endpoints inside a mesh Subnet
(ignavia↔massulus/barnacle via 42:0:ce16::…) are no longer dialled,
accepted, learnt or published; Android EIO on UDP now falls back to
the relay; per-packet "Broadcasting packet" log demoted to trace.

cargoHash unchanged (same Cargo.lock). update.sh tracks the fork
branch until the PR merges.

Language servers, providers, git/bat/wl-clipboard and 300 unused
treesitter grammars came from the wrapper; take them from PATH instead
and ship only the grammars we edit. Drop lsp-lines, virtual_lines is
builtin.

A --config wrapper breaks 'kitty +kitten icat' (nnn image preview): kitty
only recognises +kitten as argv[1], so it opened a terminal window trying
to exec a program called +kitten. Move the config into tools/ and inject
it via the environment instead.