- firefox.service: restartIfChanged/stopIfChanged = false so nixos-rebuild
switch no longer kills all open browser windows
- xdg-desktop-portal-wlr: retry until system-wide pipewire is reachable
(RestartSec=2, startLimitIntervalSec=0) instead of tripping the start-limit
at boot and staying dead, which silently broke screensharing
- workspace-tabs: register the anchor-window scratchpad rule statically in the
sway config, only persist/restore http(s) URLs, and skip anchor-titled
windows in the sway mapping, so the anchor no longer leaks into workspace
files and reappears as a phantom window after a restart

Assisted-by: Claude Code (claude-opus-4-8[1m])

The btmtk WMT-funcc fix (e3ac0d9f1a20) is now upstream; the override
fails to apply against 7.0.10. Use linuxPackages_latest directly.

Assisted-by: Claude Code (claude-opus-4-7)

Adjusts /var/download/games to ipfs:users mode 2775 so the upload
service (running as ipfs) can write into it while lass keeps write via
the users group. systemd-tmpfiles refuses to bootstrap this transition
when child and parent have different owners, so the first chown was
done out-of-band; this `z` rule keeps the perms from drifting.

Also drops the non-existent `download` group from the staging dir
tmpfiles entries (download group only exists on the yellow container,
not on the host).

Assisted-by: Claude Code (claude-opus-4-7)

Adds an ipfs-upload service (Python http.server on 127.0.0.1:8090) and
routes POSTs on ipfs.lassul.us to it (GET/HEAD still go to the kubo
gateway, via nginx upstream + map on $request_method).

Each chunk is written to a deterministic staging file under
/var/download/incoming/uploader/<sha256(rel)>.upload (same fs as the
destination, outside the pin-watcher's watch dirs). When the staging
size reaches the Content-Range total, it is atomically renamed to
/var/lib/ipfs/download/<rel> and pinned with ipfs add --nocopy --pin.

Protocol:
POST /<path> one-shot upload
POST /<path> with Content-Range bytes a-b/T resumable chunk
POST /<path> with Content-Length: 0 returns current offset

Assisted-by: Claude Code (claude-opus-4-7)

Pairing an Xbox Wireless Controller over Bluetooth (LE HoG) on stock
bluez 5.86 failed with "Connection terminated due to authentication
failure" on every connection attempt after pair. Enable xpadneo so the
hid_xpadneo driver handles the controller, and add two bluez tweaks
that resolve the LE auth loop:

* JustWorksRepairing = always: accept fresh pairings without requiring
a manual remove of the prior bond.
* Privacy = device: pin the host BT address so the controller's stored
bond key isn't invalidated when bluez rotates resolvable addresses.

Assisted-by: Claude Code (claude-opus-4-7[1m])