Lets the phone reach the agent when it is off retiolum. Long read timeout
and no buffering because /v1/chat/completions streams SSE for the whole
turn; fast connect timeout because coaxmetal is a laptop.

The bearer token is the only authn on this lane and the app cannot do
mTLS, so the location allowlist and limit_req are damage control: only the
endpoints the app calls are reachable, and /api/pty stays 404 even if
backend.mode is enabled later.

Voice both ways over Matrix: local faster-whisper (the "voice" dep group)
transcribes Element voice notes, and replies are spoken by a piper command
provider against a pinned en_US-lessac-medium voice. The built-in piper and
edge backends cannot work here, they lazily pip-install into a read-only
sealed venv. stt.prompt biases the jargon: without it "herdr" transcribes
as "Herter".

herdr runs as lass and keeps its socket under lass's HOME, so the agent
reaches the herd through a sudo wrapper plus a SKILL.md that documents it.
That needs NoNewPrivileges off, sudo is setuid.

The OpenAI-compatible API server is the assistant-button lane for the
WakeHermesClaw app, bound to the retiolum address resolved at start.

The krebs-CA cert expired ~594 days ago and acme-order-renew-jelly.r keeps
failing (exit 11, negative remaining duration), leaving yellow degraded.
jellyfin is reachable over plain http on jelly.r and directly on :8096.

also document why transmission-gc talks to 128.0.0.1: the daemon runs in its
own netns (t1), the gc unit does not (t2), so localhost is not the daemon.

mpvpaper rendered a looping video on every output, which makes every frame
full-screen motion. On the sunshine-streamed tablet screen that meant a
constantly saturated encoder and an unusable stream (97% of frames dropped
at 5 Mbps), and on the real outputs it is pointless power draw.

noctalia owns the desktop background again (wallpaper.enabled = true); pick
the image in its wallpaper panel. ~/wallpaper is no longer seeded, but
lockscreen still uses whatever is in it.