One host held ~2500 player sockets and churned thousands more; the server
spends two threads per socket and ran out of tasks for everyone.

Lets the phone reach the agent when it is off retiolum. Long read timeout
and no buffering because /v1/chat/completions streams SSE for the whole
turn; fast connect timeout because coaxmetal is a laptop.

The bearer token is the only authn on this lane and the app cannot do
mTLS, so the location allowlist and limit_req are damage control: only the
endpoints the app calls are reachable, and /api/pty stays 404 even if
backend.mode is enabled later.

Voice both ways over Matrix: local faster-whisper (the "voice" dep group)
transcribes Element voice notes, and replies are spoken by a piper command
provider against a pinned en_US-lessac-medium voice. The built-in piper and
edge backends cannot work here, they lazily pip-install into a read-only
sealed venv. stt.prompt biases the jargon: without it "herdr" transcribes
as "Herter".

herdr runs as lass and keeps its socket under lass's HOME, so the agent
reaches the herd through a sudo wrapper plus a SKILL.md that documents it.
That needs NoNewPrivileges off, sudo is setuid.

The OpenAI-compatible API server is the assistant-button lane for the
WakeHermesClaw app, bound to the retiolum address resolved at start.

The krebs-CA cert expired ~594 days ago and acme-order-renew-jelly.r keeps
failing (exit 11, negative remaining duration), leaving yellow degraded.
jellyfin is reachable over plain http on jelly.r and directly on :8096.

also document why transmission-gc talks to 128.0.0.1: the daemon runs in its
own netns (t1), the gc unit does not (t2), so localhost is not the daemon.

mpvpaper rendered a looping video on every output, which makes every frame
full-screen motion. On the sunshine-streamed tablet screen that meant a
constantly saturated encoder and an unusable stream (97% of frames dropped
at 5 Mbps), and on the real outputs it is pointless power draw.

noctalia owns the desktop background again (wallpaper.enabled = true); pick
the image in its wallpaper panel. ~/wallpaper is no longer seeded, but
lockscreen still uses whatever is in it.