When /var/download drops below 100 GiB free the guard now stops all
transmission torrents (it has no native low-disk pause like sabnzbd's
download_free) and posts a Matrix message to !MRjkvAaFPsjdYCpeiZ:lassul.us
via the archiver bot's access token. Torrents are restarted and a
recovery message sent once space climbs back above the threshold. State
is tracked in StateDirectory so alerts fire only on transitions, not
every run.

Assisted-by: Claude Code (claude-opus-4-8)

The previous guard only throttled sabnzbd below 100 GiB and paused at a
15 GiB floor, which still let the disk fill close to full. Use sabnzbd's
native download_free/complete_free (continuous pause + auto-resume) set
to 100 GiB so it pauses the moment free space drops below that, and have
the guard keep those configured. Transmission has no equivalent low-disk
guard, so the guard still throttles its downloads to a trickle below the
threshold while leaving seeding alone.

Assisted-by: Claude Code (claude-opus-4-8)

Assisted-by: Claude Code (claude-opus-4-8)

Recent wireguard-tools resolve the peer Endpoint in the namespace where
`wg syncconf` runs. The transmission netns has no route until the tunnel
is up, so resolving europe.vpn.airdns.org from inside it always fails;
wg burns ~70s of DNS-retry backoff per attempt before erroring. During a
nixos switch that restarts transmission-netns this stalled the whole
deploy for >2min and left the service (and the download stack) failed.

Resolve the endpoint in the main netns (which has connectivity, and is
already gated on the `host` check above) and hand wg a numeric Endpoint,
so the tunnel comes up instantly. Also fix the bare `sleep` in the DNS
wait loop, which errored under `set -e` instead of retrying.

Assisted-by: Claude Code (claude-opus-4-8)

Adds download-space-guard: a 5-min oneshot that caps sabnzbd and
transmission speeds once free space on /var/download drops below 100 GiB,
and pauses sabnzbd below a 15 GiB floor. This prevents a full disk from
hard-wedging sabnzbd with an unrecoverable "Disk full! Forcing Pause";
the guard auto-resumes once space frees up.

Assisted-by: Claude Code (claude-opus-4-8)

/boot is only 1 GiB (disk.nix). Without configurationLimit, GRUB retains
every generation's kernel+initrd until the ESP fills, at which point the
bootloader install fails ("No space left on device") and deploys can't
finish. Keep the 10 most recent; older kernels get pruned automatically.

Assisted-by: Claude Code (claude-fable-5)

The whole system lives on one btrfs-on-LUKS-on-NVMe device, so downloads
and builds were starving latency-sensitive reads — launching a terminal
would freeze for seconds (PSI full IO pressure spikes, near-zero CPU/mem
pressure). Three independent fixes:

- mq-deadline scheduler on nvme0n1: the default "none" gives no read/write
fairness, so reads queued behind up to 1023 writes.
- vm.dirty_bytes/dirty_background_bytes as small fixed values instead of
the ratio defaults (~6/12 GB on 62 GB RAM) that caused multi-GB flush
bursts.
- bypassWorkqueues on the LUKS device to drop the kcryptd serialization
point (safe: AES-NI is present).

Assisted-by: Claude Code (claude-fable-5)

The clan bump removes the `clan.core.vars.generators.<name>.migrateFact`
option, which made every host fail to evaluate. Fact migration is a
one-time step that's long complete, so drop the now-removed option from
all generators (retiolum, syncthing, shadowsocks, hedgedoc, mycelium,
hotdog/orange containers, nextcloud, wiregrill, nix-serve, matrix).

Assisted-by: Claude Code (claude-fable-5)