Adds download-space-guard: a 5-min oneshot that caps sabnzbd and
transmission speeds once free space on /var/download drops below 100 GiB,
and pauses sabnzbd below a 15 GiB floor. This prevents a full disk from
hard-wedging sabnzbd with an unrecoverable "Disk full! Forcing Pause";
the guard auto-resumes once space frees up.

Assisted-by: Claude Code (claude-opus-4-8)

/boot is only 1 GiB (disk.nix). Without configurationLimit, GRUB retains
every generation's kernel+initrd until the ESP fills, at which point the
bootloader install fails ("No space left on device") and deploys can't
finish. Keep the 10 most recent; older kernels get pruned automatically.

Assisted-by: Claude Code (claude-fable-5)

The whole system lives on one btrfs-on-LUKS-on-NVMe device, so downloads
and builds were starving latency-sensitive reads — launching a terminal
would freeze for seconds (PSI full IO pressure spikes, near-zero CPU/mem
pressure). Three independent fixes:

- mq-deadline scheduler on nvme0n1: the default "none" gives no read/write
fairness, so reads queued behind up to 1023 writes.
- vm.dirty_bytes/dirty_background_bytes as small fixed values instead of
the ratio defaults (~6/12 GB on 62 GB RAM) that caused multi-GB flush
bursts.
- bypassWorkqueues on the LUKS device to drop the kcryptd serialization
point (safe: AES-NI is present).

Assisted-by: Claude Code (claude-fable-5)

The clan bump removes the `clan.core.vars.generators.<name>.migrateFact`
option, which made every host fail to evaluate. Fact migration is a
one-time step that's long complete, so drop the now-removed option from
all generators (retiolum, syncthing, shadowsocks, hedgedoc, mycelium,
hotdog/orange containers, nextcloud, wiregrill, nix-serve, matrix).

Assisted-by: Claude Code (claude-fable-5)

Level 3 maps to per-packet Trace logging in tincr, which flooded
journald (tens of thousands of suppressed messages per minute) and
rotated all other units' logs out of the journal within hours,
leaving nothing to debug the whatsapp bridge with.

Assisted-by: Claude Code (claude-fable-5[1m])

Outgoing messages went unbridged silently from 2026-05-28 to 2026-06-08
(WhatsApp rejecting sends from the outdated client; fixed by the bridge
update) and no error ever reached the client. Positive per-message
confirmation makes a broken send path visible.

Assisted-by: Claude Code (claude-fable-5[1m])

simple-nixos-mailserver now stores per-user Sieve scripts in each user's
Dovecot home (~/sieve, active link ~/.dovecot.sieve) instead of the old
global /var/sieve, and asserts stateVersion >= 5 when enableManageSieve is
set. Existing scripts were migrated with migration #5 on neoprism.

Assisted-by: Claude Code (claude-opus-4-8[1m])

Run an n2n v3 supernode and point n2n.lassul.us at neoprism.

- Listens on UDP 7654 (main n2n protocol) and TCP 7654 (aux listener used
by edges started with -S2 when their network blocks UDP); both opened in
the firewall.
- Starts as root: the supernode unconditionally drops privileges to nobody
(uid/gid 65534) and aborts if the setuid() fails, so DynamicUser does not
work. It ends up running as uid 65534 with the remaining hardening.
- Sets the federation name with -F krebs (n2n prepends '*', yielding the
federation community '*krebs') to avoid the default '*Federation', which
n2n warns is for testing only. This only scopes supernode-to-supernode
federation, not the community (-c) edges use.

Assisted-by: Claude Code (claude-opus-4-8[1m])