Bare `provider = "custom"` resolves its credential from a host-gated
candidate list and only forwards OPENAI_API_KEY when base_url points at
openai.com (upstream #28660 / GHSA-76xc-57q6-vm5m). For any other host it
substitutes the literal placeholder "no-key-required", so the llama
cluster answered 401. Use a named custom_providers entry with key_env,
which is not host-gated, and rename the env var to LLAMA_API_TOKEN.

The collab patch lived here and was applied twice (2configs/covibe.nix with the
collab-web SPA, tools/covibe without it), and the client wrapper hardcoded the
four covibe.lassul.us addresses in shell. covibe owns all of that now:

- 2configs/covibe.nix keeps only the deployment: ompPackage and webRoot come
from the module defaults (covibe.packages.${system}.omp and its SPA).
- tools/covibe passes the addresses to covibe-client.override; the CLI's own
COVIBE_* env fallbacks replace the shell script, and `covibe` in a project
directory still starts a session with arguments going to omp.
- covibe.inputs.llm-agents.follows = "llm-agents" keeps one omp revision, so the
patched omp derivation is unchanged (4nxafz2k…-omp-17.1.4.drv): no new build.
- 2configs/omp-collab-autostart.patch deleted (now covibe/nix/).

The autostart was one-shot, and an omp collab host never returns on its own:
CollabSocket treats 4001/4004/4009/4029 as fatal (no reconnect), and
CollabHost.#broadcast self-stops with "session switched" when the session id
changes — which happens seconds into a fresh session, as the first prompt
creates the real session. Observed on ignavia: hosts died 21s and 88s in
(logging one debug line, "dropping frame, socket closed" t=bye), so the
dashboard listed sessions whose room no longer existed and every browser link
answered "session ended: no such room" for the rest of a multi-hour session.

superviseAutostartCollab() now keeps hosting: it re-hosts on the same preset
room whenever the host disappears without the user asking (/collab stop and
/leave set a flag), with exponential backoff on connect failures. Because
covibe fixes the room id and key, re-hosting restores the identical link, so
QR codes already scanned keep working; retrying also recovers from a stale
4009 host once the relay's keepalive frees the dead room.

readCollabAutostartEnv() also consumes OMP_COLLAB_* from process.env: children
inherit it, so a nested omp would race the host for the same room and one of
them loses with 4009.

Rebased onto omp 17.1.4 (the previous patch only applied with fuzz) and
typechecked with tsgo.

The disko tank/radicle dataset must exist before switching on a live host; if
it is absent the zfsutil mount fails local-fs.target and drops to emergency
mode (no network). nofail degrades that to a skipped mount instead. Create the
dataset with: zfs create -o mountpoint=/var/lib/radicle -o quota=80G tank/radicle

Extend 2configs/radicle.nix into a public seed: allow-all seeding (scope=all),
listen 0.0.0.0:8776 + externalAddresses radicle.lassul.us:8776, radicle-httpd
behind an nginx vhost (radicle.lassul.us, ACME). Drop the tor proxy + onion
preferred seeds. Move the config off xerxes onto neoprism, and put the node
state on tank at /var/lib/radicle with an 80G ZFS quota (radicle has no built-in
byte quota; the dataset bounds it).

Reference pinentry-rofi (or pinentry_mac on darwin) directly in the
wrapper and write it to rbw config before unlocking, instead of relying
on a persisted store path that gets garbage-collected and breaks
'rbw unlock' with 'error spawning pinentry: No such file'.

Browser links now point at https://covibe.lassul.us/c (our client, our
relay) instead of my.omp.sh. Nothing collab-related loads off-site.

- ompPackage: llm.omp + omp-collab-autostart.patch (env-driven headless
collab autostart; covibe owns the room id/key).
- relayHost = covibe.lassul.us; browser links use omp's hosted collab-web,
terminal guests use 'omp join'. Sessions enumerable + killable by id.

nixpkgs now ships the pkg_resources->importlib.resources patch and builds
tulir-telethon standalone (python3.14 works), so the overlay override
broke the build via --replace-fail on an already-patched line.

Replace the greetd gamescope-session (which required STROM_NO_GAMESCOPE and
rendered games directly in the session compositor) with greetd launching sway.

A game's nested gamescope prefers its wayland backend, which needs wlroots
protocols that cage (and, differently, an outer gamescope session) do not give
it. Under those it fell back to gamescope's SDL backend, whose Vulkan swapchain
remake loops and aborts on this RADV RENOIR iGPU (rendervulkan.cpp
vulkan_remake_swapchain) - crashing e.g. Baba Is You a couple seconds in. sway
exposes those protocols, so gamescope inits its wayland backend and never hits
the crashing SDL path. Every game keeps its own gamescope (render resolution,
in-game exit chord, bare-tty portability); no per-game workaround needed.

Also resolve STROM_FLAKE to the /home/strom/strom checkout when present (github
fallback) so changes can be tested on the box before pushing upstream.

Xbox pads pair via JustWorks; on reconnect a pad whose bond went stale
re-initiates pairing, which needs a registered agent to auto-confirm. bluetuith
only has an agent while actively pairing in it, so an autonomous re-pair hit
"No agent available for request type 2" and the link dropped right after
connecting. Run bt-agent -c NoInputNoOutput as a persistent default agent so
pairing/re-pairing always completes.

Also set TemporaryTimeout=30 so the LAN party's hundreds of stray BLE devices
are evicted from the cache instead of piling up and saturating the adapter.