Pin-watcher was creating MFS entries for aria2 control files that get
deleted once the download finishes, leaving orphans in the index. Also
ensure the cid-map file is world-readable after creation and after
reconcile rewrites it.

Assisted-by: Claude Code (claude-opus-4-7)

Upstream NixOS tinc module's preStart chowns hosts/ and invitations/
but not the network dir itself, so tincr can't persist the per-peer
address bootstrap cache it tries to write under /etc/tinc/retiolum/
addrcache/. The save fails with "Permission denied" (debug-only), the
cache stays empty, and retries to peers without a live meta-conn fall
back to DNS instead of the last-known address. Drop this tmpfiles rule
once nixpkgs#520533 lands.

Assisted-by: Claude Code (claude-opus-4-7)

New extension queries /api/tags at startup and registers every model
under a single "ollama" provider via the OpenAI-compat layer. Endpoint
points at neoprism.r:11434 — reachable from retiolum via the c-base-ai
autossh tunnel.

settings-env.patch also patches SettingsManager.reload() so the
PI_SETTINGS_FILE merge survives resourceLoader.reload() — without this
the bundled extensions list was being wiped after initial load.

Persistent autossh tunnel via tunnel.c-base.org exposing
ai.cbrp3.c-base.org:11434 on neoprism, reachable from retiolum at
neoprism.r:11434. ssh key generated by clan vars; pubkey must be
installed on tunnel.c-base.org under lassulus before the tunnel comes up.

PR Mic92/tincr#5 (merged 2026-05-11) removes the auto-purge in
on_del_edge that drove reachability oscillation in mixed
tincr/tinc-1.1pre18 meshes.

On top, pin Lassulus/tincr@a25eec05 which adds udp_addr clearing on
ENETUNREACH/EHOSTUNREACH/EAFNOSUPPORT/EADDRNOTAVAIL — without it,
IPv4-only hosts retry the same broken cached IPv6 udp_addr forever
when a peer's wire-advertised contact is v6 only. Submitted upstream
as Mic92/tincr#6.

Under load, the swaymsg get_tree subprocess could time out, the host
returned an empty windows list, and the extension treated that as "no
Firefox windows anywhere" — restoring a window for a workspace that
already had one. Distinguish query failure from a genuinely empty
result and skip restoration when state is unknown.

Adds `s say "..."` which speaks via flite TTS and posts a desktop
notification. The notify skill documents when to use it; the wrapper
registers the skill and allows `s` in Bash so calls don't prompt.