update.sh: the hash probes ran under pipefail/errexit, so an expected hash-mismatch build produced an empty result and the script exited without touching the hashes.

Picks up the darwin tinc-up fix on lassulus/fixes: route the IPv4 prefix into
the utun. Without it macOS only installed a host route for the tunnel address
and every IPv4 packet for the mesh left through the default gateway. Same bug
kartei carried in its copy of the module (krebs/kartei#65); 28a957a6 switched
barnacle to tincr own module, which never had that fix.

Integration branch = Mic92/main + #101 (NAT-leaf dial, loop clock, tunnel-address gate) + #109 (EMSGSIZE clamps minmtu, counts as probe miss, TCP fallback, MTU_INFO clamp mid-rediscovery). Fixes the retiolum blackhole seen as 'pmtu 1293 (min 1319 max 1488)'.

update.sh now blanks both hashes before the probe builds: with the old ones in place nix reused the cached FODs and the bump built stale code.

kartei's darwinModules.retiolum pulled tincd from kartei's own tincr
input, so barnacle ran a different daemon than the NixOS nodes. Now
every machine runs 5pkgs/tincr (Lassulus/tincr fix/edge-walk-address):
barnacle imports tincr's darwinModules.tincr directly with
services.tincr.package set, and reproduces the shim's settings itself
(node data from kartei's hosts.nix exactly as 2configs/retiolum.nix
does, connectTo = krebs hubs + neoprism/starkstrom, LocalDiscovery,
Broadcast = no, the BEGIN/END RETIOLUM HOSTS block in /etc/hosts).
kartei is host database only on both platforms.

New flake input `tincr` (fork branch, module only); kartei's tincr/
crane/fenix follow it so the lock has a single node each.

Three daemon fixes pending upstream as Mic92/tincr#101:

- NAT-leaf dialled at its hub's listener (#100): the ID-mismatch
"orange is neoprism" loop every AutoConnect round.
- Stale loop clock: an accepted conn was timestamped from before the
poll, so the ping sweep reaped it mid-handshake ("Timeout … during
authentication") — every reconnect to an idle listener died.
- Tunnel-address gate: meta/UDP endpoints inside a mesh Subnet
(ignavia↔massulus/barnacle via 42:0:ce16::…) are no longer dialled,
accepted, learnt or published; Android EIO on UDP now falls back to
the relay; per-packet "Broadcasting packet" log demoted to trace.

cargoHash unchanged (same Cargo.lock). update.sh tracks the fork
branch until the PR merges.

Language servers, providers, git/bat/wl-clipboard and 300 unused
treesitter grammars came from the wrapper; take them from PATH instead
and ship only the grammars we edit. Drop lsp-lines, virtual_lines is
builtin.

A --config wrapper breaks 'kitty +kitten icat' (nnn image preview): kitty
only recognises +kitten as argv[1], so it opened a terminal window trying
to exec a program called +kitten. Move the config into tools/ and inject
it via the environment instead.

Pulls in krebs/kartei#64 (neoprism dialable) and #65 (darwin v4 route).

kartei darwin module only dials eve/eva/ni/prism, krebs hubs that learn about
barnacle when their own registry pins move. A laptop behind NAT needs relays
we control: the same neoprism the NixOS nodes use (dialable once
krebs/kartei#64 lands) plus starkstrom.

Removed from nixpkgs in favour of better-adb-sync, which broke evaluation of
this host. Dropped rather than swapped -- nothing here used it.

starkstrom stays out of the shared kartei registry but should still be
reachable inside the fleet. Its card now lives in retiolum/ in the same
nets.<net> layout kartei and krebs.hosts use, rendered by a copy of kartei
modules/retiolum/hosts.nix, so the entry can move to kartei/lass unchanged if
the rest of krebs should reach it too.

Every superconfig machine injects that set into its tinc hosts: the NixOS
nodes through nixpkgs services.tinc, barnacle through kartei tincr module
(hosts is attrsOf lines, so the entries merge). Previously only starkstrom
itself knew its card, so the fleet had no route to it; now all 16 machines do,
and peers dial its static address directly instead of relaying.

self.retiolum exposes hosts/tincHosts/own, the same interface as kartei, so
both sources merge symmetrically. starkstrom krebs.hosts card is composed from
it -- addresses, aliases and the ed25519 key have one source now; only the
legacy RSA pubkey stockholm insists on stays local.

The daemon stays on nixpkgs services.tinc; only the host database moves.
stockholm pins a kartei from before barnacle and its host type still requires
the legacy RSA pubkey, so peer keys now come from kartei modules/retiolum/hosts.nix
instead of config.krebs.hosts. krebs.hosts is untouched for everything else
(dns, iptables, consul, ...).

Effects: barnacle and 5 newer hosts become known fleet-wide, and the 35
RSA-only entries drop out -- tincr is SPTPS-only and refused them once per
connection attempt anyway.

starkstrom has no kartei card and keeps the one it declares locally in
krebs.hosts; that fallback goes away once it is in kartei.

barnacle is the first node on kartei darwinModules.retiolum: 2configs/retiolum.nix
is built on nixpkgs services.tinc, systemd-networkd and networking.firewall,
none of which exist on nix-darwin.

Host data (addresses, aliases, peer host files) comes from lass/hosts/barnacle
in kartei; the NixOS machines still read their host data through stockholm and
will not route to barnacle until that kartei pin is bumped.

The Ed25519 keypair is a clan var like on the NixOS nodes, but deployed with
neededFor = "activation": clans /run/secrets installer is Linux-only (tmpfs +
move-mount). No RSA half, tincr is SPTPS/Ed25519-only.

The source has a full macOS backend (utun via SYSPROTO_CONTROL, recvmsg_x
batching), and 5pkgs/flake-module.nix filters on meta.availableOn, so the
linux-only platforms list kept packages.<darwin>.tincr from existing.
barnacle needs it for retiolum key generation.

location of person.lass from home-assistant on an OSM map with a 24h trail;
neoprism polls the hass history API every 2 min into a static json,
token via clan vars (where-lassul-us/token)

One radicle-node serves one keypair, so each machine that does radicle
work gets its own identity (vars generator `rad`) and a node running
as the `rad` system user over /var/lib/rad. The profile is group-shared
(setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created
group-writable sqlite files) so any account in group `rad` signs with
the machine identity; mainUser is a member. RAD_HOME points there for
login shells. Imported explicitly on coaxmetal, neoprism, ignavia,
icarus and shodan.

Rename the public seed module to 2configs/radicle.lassul.us.nix and
switch its retired seed.radicle.garden entry to iris.radicle.network.