Capture mesh-catalog at feat/r4g (2246ccc4) with the templates its manifests name and its predefined.json, and lay the copy out as a repository's root

The catalogue's manifests moved their content into template files and fall back to predefined keys, so a copy of module.json alone no longer passes the catalogue's own check; the bus's Dockerfile is gone from the catalogue.
2026-10-23 16:24:14 +02:00
parent 68c1220e87
commit 5ccc87f4d0
455 changed files with 12335 additions and 1333 deletions
@@ -7,7 +7,7 @@ The copy carries the catalogue's private details: domains, first names in module
 private addresses. That is acceptable while mesh-controller is private; if it ever goes public, this copy is
 a second place to clean besides the catalogue itself.

-mesh-catalog  e0bc919d4945bb5f13f971f74643a0b714cf45da  modules/*/module.json, modules/nats/Dockerfile
+mesh-catalog  2246ccc492e59579a140752e6f574b2121d296af  modules/*/module.json, modules/*/files, modules/*/templates, predefined.json
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
 mesh-sdk      9205222a98bb0d460e3a827d69d2ff640c500b47  conformance/events/module-event.json

@@ -16,7 +16,8 @@ To move them, from this repository's root, with the two repositories checked out
  rm -rf testdata/beside/mesh-catalog testdata/beside/mesh-host
  mkdir -p testdata/beside/mesh-catalog testdata/beside/mesh-host
  git -C ../mesh-catalog archive <commit> modules | tar -x -C testdata/beside/mesh-catalog --wildcards \
-    'modules/*/module.json' 'modules/nats/Dockerfile'
+    'modules/*/module.json' 'modules/*/files' 'modules/*/templates'
+  git -C ../mesh-catalog show <commit>:predefined.json > testdata/beside/mesh-catalog/predefined.json
  find testdata/beside -name module.json -exec mv {} {}.captured \;
  git -C ../mesh-host archive <commit> examples/foundation-first-node.lock | tar -x -C testdata/beside/mesh-host

@@ -0,0 +1,5 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208): the default cursor theme, for programs that
+# read neither XCURSOR_THEME nor the X resources.
+[Icon Theme]
+Name=Default
+Inherits=Adwaita
@@ -0,0 +1 @@
+Adwaita:dark
@@ -0,0 +1 @@
+/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc
@@ -0,0 +1 @@
+qt6ct
@@ -0,0 +1 @@
+6
@@ -0,0 +1 @@
+Fusion
@@ -0,0 +1 @@
+24
@@ -0,0 +1 @@
+Adwaita
@@ -0,0 +1,9 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at
+# every push; adwaita_appearance switches dark and light for the running session.
+[Settings]
+gtk-theme-name=Adwaita
+gtk-icon-theme-name=Adwaita
+gtk-cursor-theme-name=Adwaita
+gtk-cursor-theme-size=24
+gtk-font-name=Inter 11
+gtk-application-prefer-dark-theme=1
@@ -0,0 +1,11 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208). Replaced at every push.
+#
+# Which portal backend answers each interface. i3 is not a desktop xdg-desktop-portal knows, so with
+# no preference it uses whichever backend happens to be installed: fine while gtk is the only one,
+# wrong the day another arrives as somebody else's dependency. Named instead. gtk also serves
+# org.freedesktop.appearance (dark or light) from GSettings, which the session's start sets.
+[preferred]
+default=gtk
+# Secrets for sandboxed programs come from the keyring's backend. Without this line no backend answers
+# the interface: gtk does not implement it, and gnome-keyring's names only GNOME as its desktop.
+org.freedesktop.impl.portal.Secret=gnome-keyring
@@ -0,0 +1,29 @@
+[Appearance]
+color_scheme_path=/usr/share/qt6ct/colors/darker.conf
+custom_palette=true
+icon_theme=Adwaita
+standard_dialogs=default
+style=Fusion
+
+[Fonts]
+fixed="JetBrainsMono Nerd Font,11,-1,5,50,0,0,0,0,0"
+general="Inter,11,-1,5,50,0,0,0,0,0"
+
+[Interface]
+activate_item_on_single_click=1
+buttonbox_layout=0
+cursor_flash_time=1000
+dialog_buttons_have_icons=1
+double_click_interval=400
+gui_effects=@Invalid()
+keyboard_scheme=2
+menus_have_icons=true
+show_shortcuts_in_context_menus=true
+stylesheets=@Invalid()
+toolbutton_style=4
+underline_shortcut=1
+wheel_scroll_lines=3
+
+[Troubleshooting]
+force_raster_widgets=1
+ignored_applications=@Invalid()
@@ -0,0 +1,10 @@
+# The appearance (module adwaita): GSettings is where the portal reads dark or light, and the portal is
+# the only way it reaches Electron, Chromium, Firefox and flatpaks. Set at every session start to the
+# module's default; adwaita_appearance switches it for a session.
+gsettings set org.gnome.desktop.interface color-scheme 'prefer-dark' || true
+gsettings set org.gnome.desktop.interface gtk-theme 'Adwaita' || true
+gsettings set org.gnome.desktop.interface icon-theme 'Adwaita' || true
+gsettings set org.gnome.desktop.interface cursor-theme 'Adwaita' || true
+gsettings set org.gnome.desktop.interface cursor-size 24 || true
+gsettings set org.gnome.desktop.interface font-name 'Inter 11' || true
+gsettings set org.gnome.desktop.interface monospace-font-name 'JetBrainsMono Nerd Font 11' || true
@@ -0,0 +1,3 @@
+! adwaita: the cursor, for X programs that take it from the resources.
+Xcursor.theme: Adwaita
+Xcursor.size: 24
@@ -1,6 +1,7 @@
 {
  "module": "adwaita",
  "version": "1",
+  "moved": true,
  "capabilities": [
    "package-manager"
  ],
@@ -10,27 +11,79 @@
    "adwaita_icons",
    "adwaita_portal_check"
  ],
-  "environment": {
-    "variables": {
-      "GTK_THEME": "Adwaita:dark",
-      "GTK2_RC_FILES": "/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc",
-      "QT_QPA_PLATFORMTHEME": "qt6ct",
-      "QT_STYLE_OVERRIDE": "Fusion",
-      "QT_SELECT": "6",
-      "XCURSOR_THEME": "Adwaita",
-      "XCURSOR_SIZE": "24"
-    }
-  },
-  "shell": [
+  "items": [
    {
-      "for": "xresources",
-      "slot": "normal",
-      "code": "! adwaita: the cursor, for X programs that take it from the resources.\nXcursor.theme: Adwaita\nXcursor.size: 24\n"
+      "collection": "environment",
+      "name": "gtk-theme",
+      "attributes": {
+        "kind": "variable",
+        "name": "GTK_THEME"
+      },
+      "template": "files/env-gtk-theme"
    },
    {
-      "for": "xinitrc",
-      "slot": "normal",
-      "code": "# The appearance (module adwaita): GSettings is where the portal reads dark or light, and the portal is\n# the only way it reaches Electron, Chromium, Firefox and flatpaks. Set at every session start to the\n# module's default; adwaita_appearance switches it for a session.\ngsettings set org.gnome.desktop.interface color-scheme 'prefer-dark' || true\ngsettings set org.gnome.desktop.interface gtk-theme 'Adwaita' || true\ngsettings set org.gnome.desktop.interface icon-theme 'Adwaita' || true\ngsettings set org.gnome.desktop.interface cursor-theme 'Adwaita' || true\ngsettings set org.gnome.desktop.interface cursor-size 24 || true\ngsettings set org.gnome.desktop.interface font-name 'Inter 11' || true\ngsettings set org.gnome.desktop.interface monospace-font-name 'JetBrainsMono Nerd Font 11' || true\n"
+      "collection": "environment",
+      "name": "gtk2-rc-files",
+      "attributes": {
+        "kind": "variable",
+        "name": "GTK2_RC_FILES"
+      },
+      "template": "files/env-gtk2-rc-files"
+    },
+    {
+      "collection": "environment",
+      "name": "qt-qpa-platformtheme",
+      "attributes": {
+        "kind": "variable",
+        "name": "QT_QPA_PLATFORMTHEME"
+      },
+      "template": "files/env-qt-qpa-platformtheme"
+    },
+    {
+      "collection": "environment",
+      "name": "qt-style-override",
+      "attributes": {
+        "kind": "variable",
+        "name": "QT_STYLE_OVERRIDE"
+      },
+      "template": "files/env-qt-style-override"
+    },
+    {
+      "collection": "environment",
+      "name": "qt-select",
+      "attributes": {
+        "kind": "variable",
+        "name": "QT_SELECT"
+      },
+      "template": "files/env-qt-select"
+    },
+    {
+      "collection": "environment",
+      "name": "xcursor-theme",
+      "attributes": {
+        "kind": "variable",
+        "name": "XCURSOR_THEME"
+      },
+      "template": "files/env-xcursor-theme"
+    },
+    {
+      "collection": "environment",
+      "name": "xcursor-size",
+      "attributes": {
+        "kind": "variable",
+        "name": "XCURSOR_SIZE"
+      },
+      "template": "files/env-xcursor-size"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    },
+    {
+      "collection": "shell:xinitrc:normal",
+      "name": "xinitrc-normal",
+      "template": "files/xinitrc-normal"
    }
  ],
  "resources": [
@@ -65,7 +118,7 @@
      "path": "${machine:account-home}/.config/gtk-3.0/settings.ini",
      "owner": "${machine:account}",
      "mode": "0644",
-      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at\n# every push; adwaita_appearance switches dark and light for the running session.\n[Settings]\ngtk-theme-name=Adwaita\ngtk-icon-theme-name=Adwaita\ngtk-cursor-theme-name=Adwaita\ngtk-cursor-theme-size=24\ngtk-font-name=Inter 11\ngtk-application-prefer-dark-theme=1\n"
+      "template": "files/gtk-settings.ini"
    },
    {
      "id": "gtk4",
@@ -73,7 +126,7 @@
      "path": "${machine:account-home}/.config/gtk-4.0/settings.ini",
      "owner": "${machine:account}",
      "mode": "0644",
-      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at\n# every push; adwaita_appearance switches dark and light for the running session.\n[Settings]\ngtk-theme-name=Adwaita\ngtk-icon-theme-name=Adwaita\ngtk-cursor-theme-name=Adwaita\ngtk-cursor-theme-size=24\ngtk-font-name=Inter 11\ngtk-application-prefer-dark-theme=1\n"
+      "template": "files/gtk-settings.ini"
    },
    {
      "id": "qt6ct",
@@ -81,7 +134,7 @@
      "path": "${machine:account-home}/.config/qt6ct/qt6ct.conf",
      "owner": "${machine:account}",
      "mode": "0644",
-      "content": "[Appearance]\ncolor_scheme_path=/usr/share/qt6ct/colors/darker.conf\ncustom_palette=true\nicon_theme=Adwaita\nstandard_dialogs=default\nstyle=Fusion\n\n[Fonts]\nfixed=\"JetBrainsMono Nerd Font,11,-1,5,50,0,0,0,0,0\"\ngeneral=\"Inter,11,-1,5,50,0,0,0,0,0\"\n\n[Interface]\nactivate_item_on_single_click=1\nbuttonbox_layout=0\ncursor_flash_time=1000\ndialog_buttons_have_icons=1\ndouble_click_interval=400\ngui_effects=@Invalid()\nkeyboard_scheme=2\nmenus_have_icons=true\nshow_shortcuts_in_context_menus=true\nstylesheets=@Invalid()\ntoolbutton_style=4\nunderline_shortcut=1\nwheel_scroll_lines=3\n\n[Troubleshooting]\nforce_raster_widgets=1\nignored_applications=@Invalid()\n"
+      "template": "files/qt6ct.conf"
    },
    {
      "id": "portals",
@@ -89,7 +142,7 @@
      "path": "${machine:account-home}/.config/xdg-desktop-portal/portals.conf",
      "owner": "${machine:account}",
      "mode": "0644",
-      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208). Replaced at every push.\n#\n# Which portal backend answers each interface. i3 is not a desktop xdg-desktop-portal knows, so with\n# no preference it uses whichever backend happens to be installed: fine while gtk is the only one,\n# wrong the day another arrives as somebody else's dependency. Named instead. gtk also serves\n# org.freedesktop.appearance (dark or light) from GSettings, which the session's start sets.\n[preferred]\ndefault=gtk\n# Secrets for sandboxed programs come from the keyring's backend. Without this line no backend answers\n# the interface: gtk does not implement it, and gnome-keyring's names only GNOME as its desktop.\norg.freedesktop.impl.portal.Secret=gnome-keyring\n"
+      "template": "files/portals.conf"
    },
    {
      "id": "cursor",
@@ -97,7 +150,7 @@
      "path": "${machine:account-home}/.icons/default/index.theme",
      "owner": "${machine:account}",
      "mode": "0644",
-      "content": "# Written by the mesh (module adwaita, novox/hq ADR 0208): the default cursor theme, for programs that\n# read neither XCURSOR_THEME nor the X resources.\n[Icon Theme]\nName=Default\nInherits=Adwaita\n"
+      "template": "files/cursor-index.theme"
    }
  ],
  "build": {
@@ -112,6 +165,11 @@
        "loads": [
          "adwaita-tools"
        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1,4 @@
+# The names the artifact store had before, from the setting older-store-names, written by the mesh.
+# artifact_store_references reads every definition under these too (novox/hq issue 323).
+# Replaced on every push; change the setting, never this file.
+older=${config:older-store-names}
@@ -13,19 +13,21 @@
    "artifact_store_references",
    "artifact_store_collect"
  ],
-  "settings": {
-    "older-store-names": {
-      "kind": "preference",
-      "default": "none",
-      "why": "the names the artifact store had before, as a definition may still pin an image under them: host names or host:port, separated by spaces; none when it had no other. artifact_store_references reads every definition under these as well as under the store's current name, so an image a definition pins under one is said to be named by a definition (novox/hq issue 323)"
-    }
-  },
+    "config": {
+      "older-store-names": {
+        "type": "string",
+        "description": "The names the artifact store had before, as host names or host:port separated by spaces, or none when it had no other. artifact_store_references reads every definition under these as well as under the store's current name, so an image a definition pins under one is said to be named by a definition (novox/hq issue 323).",
+        "pattern": "none|[A-Za-z0-9.:-]+( [A-Za-z0-9.:-]+)*",
+        "default": "none"
+      }
+    },
  "resources": [
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "store-names",
@@ -33,7 +35,7 @@
      "path": "${dir:state}/store-names",
      "mode": "0600",
      "trusted": false,
-      "content": "# The names the artifact store had before, from the setting older-store-names, written by the mesh.\n# artifact_store_references reads every definition under these too (novox/hq issue 323).\n# Replaced on every push; change the setting, never this file.\nolder=${setting:older-store-names}\n"
+      "template": "files/store-names"
    }
  ],
  "build": {
@@ -52,6 +54,11 @@
          "MESH_ARTIFACT_STORE_CONTAINER": "mesh-registry",
          "MESH_ARTIFACT_STORE_NAMES_FILE": "${dir:state}/store-names"
        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1,33 @@
+#!/bin/bash
+# zephyrus-backlight + | - | PERCENT — step or set the internal panel's backlight, never below 1 %.
+# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# The panel is the backlight beneath the eDP connector, not a name: in hybrid mode this model also
+# registers the discrete GPU's backlight (nvidia_0), which moves nothing. Writable by the video group
+# through the module's udev rule, so the vendor-key trigger needs no root.
+set -u
+STEP=5
+dev=""
+for d in /sys/class/backlight/*; do
+	[ -e "$d" ] || continue
+	case "$(readlink -f "$d")" in *-eDP-*) dev=$d; break ;; esac
+done
+if [ -z "$dev" ]; then
+	for d in /sys/class/backlight/*; do [ -e "$d" ] && { dev=$d; break; }; done
+fi
+[ -n "$dev" ] || { echo "zephyrus-backlight: no backlight" >&2; exit 1; }
+cur=$(cat "$dev/brightness")
+max=$(cat "$dev/max_brightness")
+pct=$(( cur * 100 / max ))
+case "${1:-}" in
+	+|up|Up) pct=$(( pct + STEP )) ;;
+	-|down|Down) pct=$(( pct - STEP )) ;;
+	''|*[!0-9]*) echo "usage: zephyrus-backlight + | - | PERCENT" >&2; exit 2 ;;
+	*) pct=$1 ;;
+esac
+(( pct < 1 )) && pct=1
+(( pct > 100 )) && pct=100
+new=$(( max * pct / 100 ))
+(( new < 1 )) && new=1
+printf '%s' "$new" >"$dev/brightness" || exit 1
+exec "$(dirname "$0")/zephyrus-notify" 5555 "Brightness: ${pct}%"
@@ -0,0 +1,41 @@
+#!/bin/bash
+# zephyrus-display primary | order — the laptop's internal panel among the outputs.
+# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+#   primary  makes the internal panel X's primary output, where the bars' tray goes.
+#   order    the display key (Fn+F9, which the firmware sends as Super+P): odd workspaces to the
+#            internal panel, even ones to the first external output, or all to the panel when it
+#            is alone. The predecessor's orden-workspaces.
+#
+# The panel is found, not named: the connected output whose name starts with eDP. The predecessor
+# wrote eDP-1, which is what this model calls it today and not a promise.
+set -u
+here=$(dirname "$0")
+panel=$(xrandr --query 2>/dev/null | awk '$2 == "connected" && $1 ~ /^eDP/ { print $1; exit }')
+[ -n "$panel" ] || { echo "zephyrus-display: no internal panel connected" >&2; exit 1; }
+case "${1:-}" in
+primary)
+	exec xrandr --output "$panel" --primary
+	;;
+order)
+	external=$(xrandr --listmonitors 2>/dev/null | awk -v p="$panel" 'NR > 1 && $NF != p { print $NF; exit }')
+	[ -n "$external" ] || external=$panel
+	# i3's workspace list, one object per workspace; num and output read from each. No jq: the
+	# fields are flat strings and numbers, and rect, the only nested value, holds neither name.
+	i3-msg -t get_workspaces 2>/dev/null | sed 's/},{"id"/}\n{"id"/g' |
+		while read -r ws; do
+			num=$(printf '%s' "$ws" | grep -o '"num":-\?[0-9]*' | cut -d: -f2)
+			out=$(printf '%s' "$ws" | grep -o '"output":"[^"]*"' | cut -d'"' -f4)
+			[ -n "$num" ] && [ "$num" -ge 0 ] || continue
+			if [ $((num % 2)) -eq 0 ]; then dest=$external; else dest=$panel; fi
+			[ "$out" = "$dest" ] && continue
+			i3-msg "workspace number $num; move workspace to output $dest" >/dev/null
+		done
+	if [ "$external" = "$panel" ]; then
+		"$here/zephyrus-notify" 7780 "Workspaces: all on the panel"
+	else
+		"$here/zephyrus-notify" 7780 "Workspaces: odd on the panel, even on $external"
+	fi
+	;;
+*) echo "usage: zephyrus-display primary | order" >&2; exit 2 ;;
+esac
@@ -0,0 +1,20 @@
+#!/bin/bash
+# zephyrus-kbd-notify — shows the keyboard backlight's level when it changes. The level itself is set
+# by the firmware and asusd (Fn+F2/F3), which tell UPower; this only listens and notifies. Started once
+# per session from the module's i3 fragment. Shipped by the mesh's asus-zephyrus-g14 module.
+#
+# One instance per session: i3 runs its `exec` lines again on an in-place restart, and the
+# predecessor's listener ran twice after one, showing every change twice.
+set -u
+here=$(dirname "$0")
+lock="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/zephyrus-kbd-notify.lock"
+exec 9>"$lock"
+flock -n 9 || exit 0
+levels=(Off Low Med High)
+dbus-monitor --system "type='signal',interface='org.freedesktop.UPower.KbdBacklight',member='BrightnessChanged'" 2>/dev/null |
+	while read -r line; do
+		if [[ $line =~ int32\ ([0-9]+) ]]; then
+			v=${BASH_REMATCH[1]}
+			"$here/zephyrus-notify" 5556 "Keyboard: ${levels[$v]:-$v}"
+		fi
+	done
@@ -0,0 +1,27 @@
+#!/bin/bash
+# zephyrus-media play-pause | next | previous — the media keys, through MPRIS (playerctl), with a short
+# notification of what happened. Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# From the predecessor's media-control, kept: the lock against a double fire (the vendor keys can
+# repeat), and the notification. Dropped: its fallback to a media server's local API, which needed a
+# token from a file of secrets (novox/hq research 027 question 2). A player that speaks MPRIS is
+# reached; one that does not says so.
+set -u
+here=$(dirname "$0")
+action=${1:-play-pause}
+case "$action" in play-pause | next | previous) ;; *) echo "usage: zephyrus-media play-pause | next | previous" >&2; exit 2 ;; esac
+lock="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/zephyrus-media.lock"
+exec 9>"$lock"
+flock -n 9 || exit 0
+if ! playerctl status >/dev/null 2>&1; then
+	"$here/zephyrus-notify" 7777 "Media: no player"
+	exit 0
+fi
+playerctl "$action" 2>/dev/null
+if [ "$action" = play-pause ]; then
+	sleep 0.2
+	[ "$(playerctl status 2>/dev/null)" = Playing ] && label=Playing || label=Paused
+else
+	label=${action^}
+fi
+"$here/zephyrus-notify" 7777 "Media: $label"
@@ -0,0 +1,12 @@
+#!/bin/bash
+# zephyrus-notify ID SUMMARY — a short desktop notification that replaces the previous one with the
+# same ID, through the session's notification service on its bus. busctl is the service manager's
+# own client, so nothing is installed for it. Shipped by the mesh's asus-zephyrus-g14 module.
+set -u
+id=${1:-0}
+summary=${2:-}
+uid=$(id -u)
+DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/${uid}/bus" \
+	busctl --user call org.freedesktop.Notifications /org/freedesktop/Notifications \
+	org.freedesktop.Notifications Notify susssasa{sv}i \
+	asus-zephyrus-g14 "$id" "" "$summary" "" 0 1 urgency y 0 1500 >/dev/null 2>&1 || true
@@ -0,0 +1,46 @@
+#!/bin/bash
+# zephyrus-session COMMAND [ARG...] — run a command in the operator's graphical session from outside
+# it: from a vendor-key trigger, which triggerhappy runs as the operator's account but with none of
+# the session's environment. Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# What it replaces: the predecessor's `as-user`, which triggerhappy ran as root and which `su`-ed to
+# a named person with a hard-coded user id and display, and sourced a file of secrets on the way.
+# Here the account is whoever runs it, the bus is that account's, and the display is the one the
+# account's own session uses. Nothing is sourced.
+set -u
+uid=$(id -u)
+export XDG_RUNTIME_DIR="/run/user/${uid}"
+export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"
+home=$(getent passwd "$uid" | cut -d: -f6)
+[ -n "$home" ] && export HOME="$home"
+# The session's own window manager says best which display and authority the session uses: read
+# them from its environment, as the desktop modules' session finder does. Then logind, then any
+# process of this account that has a display.
+from_environ() {
+	env=$(tr '\0' '\n' <"/proc/$1/environ" 2>/dev/null) || return 1
+	d=$(printf '%s\n' "$env" | sed -n 's/^DISPLAY=//p' | head -n1)
+	[ -n "$d" ] || return 1
+	export DISPLAY="$d"
+	a=$(printf '%s\n' "$env" | sed -n 's/^XAUTHORITY=//p' | head -n1)
+	[ -n "$a" ] && export XAUTHORITY="$a"
+	return 0
+}
+if [ -z "${DISPLAY:-}" ]; then
+	for pid in $(pgrep -xu "$uid" i3 2>/dev/null); do
+		from_environ "$pid" && break
+	done
+fi
+if [ -z "${DISPLAY:-}" ]; then
+	for s in $(loginctl list-sessions --no-legend 2>/dev/null | awk -v u="$uid" '$2 == u { print $1 }'); do
+		d=$(loginctl show-session "$s" -p Display --value 2>/dev/null)
+		if [ -n "$d" ]; then export DISPLAY="$d"; break; fi
+	done
+fi
+if [ -z "${DISPLAY:-}" ]; then
+	for pid in $(pgrep -u "$uid" 2>/dev/null); do
+		from_environ "$pid" && break
+	done
+fi
+: "${XAUTHORITY:=${HOME}/.Xauthority}"
+export XAUTHORITY
+exec "$@"
@@ -0,0 +1,29 @@
+#!/bin/bash
+# zephyrus-touchpad reset | toggle — apply the touchpad's settings again, or switch it on or off.
+# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# The settings themselves are an X input class (/etc/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf),
+# which X applies every time the device appears — after a resume too, which is what the predecessor's
+# sleep hook existed for. This is the manual form, bound to the touchpad key.
+set -u
+here=$(dirname "$0")
+name=$("$here/zephyrus-session" xinput list --name-only 2>/dev/null | grep -m1 -i 'touchpad')
+[ -n "$name" ] || { echo "zephyrus-touchpad: no touchpad in this session" >&2; exit 1; }
+x() { "$here/zephyrus-session" xinput "$@"; }
+case "${1:-reset}" in
+	reset)
+		x set-prop "$name" "libinput Tapping Enabled" 1
+		x set-prop "$name" "libinput Natural Scrolling Enabled" 1
+		x set-prop "$name" "libinput Accel Speed" 0.15
+		x enable "$name"
+		"$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: reset"
+		;;
+	toggle)
+		if x list-props "$name" | grep -q 'Device Enabled ([0-9]*):[[:space:]]*1'; then
+			x disable "$name"; "$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: off"
+		else
+			x enable "$name"; "$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: on"
+		fi
+		;;
+	*) echo "usage: zephyrus-touchpad reset | toggle" >&2; exit 2 ;;
+esac
@@ -1,6 +1,8 @@
 {
  "module": "asus-zephyrus-g14",
  "version": "1",
+  "moved": true,
+  "templates": "templates",
  "capabilities": [
    "package-manager",
    "service-manager"
@@ -52,80 +54,85 @@
      "id": "scripts",
      "type": "archive",
      "path": "/usr/local/lib/asus-zephyrus-g14",
-      "artifact": "scripts"
+      "artifact": "scripts",
+      "unknown": "program"
    },
    {
      "id": "nvidia-options",
      "type": "file",
      "path": "/etc/modprobe.d/g14-nvidia-power.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# The discrete GPU's driver options on the ROG Zephyrus G14 (GA403, RTX 40 series, hybrid graphics).\n#\n# NVreg_DynamicPowerManagement=0x00 turns runtime D3 off. With it on, a change of power source sends\n# the driver an ACPI notification it fails to handle on this model (\"RmHandleDNotifierEvent: Failed to\n# handle ACPI D-Notifier event, status=0x62\"), and the GPU stops making progress until the machine is\n# powered off. Off costs a few idle watts in hybrid mode and keeps the machine up.\n#\n# NVreg_PreserveVideoMemoryAllocations=1 saves video memory across suspend, so what used the GPU still\n# works after waking. It needs nvidia-suspend, -hibernate and -resume to run around a sleep, which this\n# module's drop-ins on the sleep services ask for.\n#\n# A change here applies when the driver next loads: at the next boot.\noptions nvidia NVreg_PreserveVideoMemoryAllocations=1\noptions nvidia NVreg_DynamicPowerManagement=0x00\n"
+      "template": "templates/modprobe.d/g14-nvidia-power.conf"
    },
    {
      "id": "video-options",
      "type": "file",
      "path": "/etc/modprobe.d/video-brightness-switch.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# The ACPI video driver does not change the backlight itself on the brightness keys: on this model it\n# moves the wrong one. The keys are triggerhappy's (see /etc/triggerhappy/triggers.d/asus-g14.conf).\n# Applies when the module next loads: at the next boot.\noptions video brightness_switch_enabled=0\n"
+      "template": "templates/modprobe.d/video-brightness-switch.conf"
    },
    {
      "id": "suspend-drop-ins",
      "type": "directory",
      "path": "/etc/systemd/system/systemd-suspend.service.d",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
    },
    {
      "id": "nvidia-on-suspend",
      "type": "file",
      "path": "/etc/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as\n# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service\n# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.\n[Unit]\nWants=nvidia-suspend.service nvidia-resume.service\n"
+      "template": "templates/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf"
    },
    {
      "id": "hibernate-drop-ins",
      "type": "directory",
      "path": "/etc/systemd/system/systemd-hibernate.service.d",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
    },
    {
      "id": "nvidia-on-hibernate",
      "type": "file",
      "path": "/etc/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as\n# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service\n# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.\n[Unit]\nWants=nvidia-hibernate.service nvidia-resume.service\n"
+      "template": "templates/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf"
    },
    {
      "id": "suspend-then-hibernate-drop-ins",
      "type": "directory",
      "path": "/etc/systemd/system/systemd-suspend-then-hibernate.service.d",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
    },
    {
      "id": "nvidia-on-suspend-then-hibernate",
      "type": "file",
      "path": "/etc/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as\n# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service\n# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.\n[Unit]\nWants=nvidia-suspend-then-hibernate.service nvidia-resume.service\n"
+      "template": "templates/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf"
    },
    {
      "id": "powerd-drop-ins",
      "type": "directory",
      "path": "/etc/systemd/system/nvidia-powerd.service.d",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
    },
    {
      "id": "powerd-opt-in",
      "type": "file",
      "path": "/etc/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# nvidia-powerd (Dynamic Boost) was the first error in the chain that hung this model's GPU on a change\n# of power source, and asusd starts it on mains. It runs only when the kernel command line says\n# zephyrus.nvidia-powerd — an explicit opt-in, at boot.\n[Unit]\nConditionKernelCommandLine=zephyrus.nvidia-powerd\n"
+      "template": "templates/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf"
    },
    {
      "id": "backlight-rule",
      "type": "file",
      "path": "/etc/udev/rules.d/90-backlight.rules",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# The backlights are writable by the video group, so the brightness keys and the module's brightness tool\n# move the panel without root.\nACTION==\"add\", SUBSYSTEM==\"backlight\", RUN+=\"/usr/bin/chgrp video /sys/class/backlight/%k/brightness\", RUN+=\"/usr/bin/chmod g+w /sys/class/backlight/%k/brightness\"\n"
+      "template": "templates/udev/rules.d/90-backlight.rules"
    },
    {
      "id": "udev",
@@ -144,14 +151,15 @@
      "id": "upower-drop-ins",
      "type": "directory",
      "path": "/etc/UPower/UPower.conf.d",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
    },
    {
      "id": "low-battery",
      "type": "file",
      "path": "/etc/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# On low battery the machine suspends rather than powering off, at 7 % — s2idle still draws a little,\n# so it leaves headroom. A drop-in over the package's own UPower.conf, which stays the package's.\n[UPower]\nUsePercentageForPolicy=true\nPercentageLow=15.0\nPercentageCritical=10.0\nPercentageAction=7.0\nCriticalPowerAction=Suspend\nAllowRiskyCriticalPowerAction=true\n"
+      "template": "templates/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf"
    },
    {
      "id": "upower",
@@ -167,14 +175,30 @@
      "id": "xorg-drop-ins",
      "type": "directory",
      "path": "/etc/X11/xorg.conf.d",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
    },
    {
      "id": "touchpad",
      "type": "file",
      "path": "/etc/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf",
      "mode": "0644",
-      "content": "# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.\n#\n# The touchpad's settings, applied by X every time the device appears — at login and after every\n# resume, when the device is initialised again. This replaces the predecessor's sleep hook, which ran\n# xinput after a resume as a named person on a guessed display.\nSection \"InputClass\"\n    Identifier \"asus-zephyrus-g14 touchpad\"\n    MatchIsTouchpad \"on\"\n    Option \"Tapping\" \"on\"\n    Option \"NaturalScrolling\" \"true\"\n    Option \"AccelSpeed\" \"0.15\"\nEndSection\n"
+      "template": "templates/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:after-wake:normal",
+      "template": "templates/after-wake"
+    },
+    {
+      "collection": "contribution:node-hotkeys:trigger",
+      "template": "templates/hotkeys-triggers"
+    },
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "templates/display-session"
    }
  ],
  "build": {
@@ -194,31 +218,12 @@
        "name": "scripts",
        "kind": "archive",
        "from": "files"
+      },
+      {
+        "name": "templates",
+        "kind": "archive",
+        "from": "templates"
      }
    ]
-  },
-  "contributions": [
-    {
-      "seat": "node-hotkeys",
-      "kind": "trigger",
-      "content": "# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,\n# and the touchpad key. Each runs this module's own script, as the operator's account.\nKEY_PROG1\t1\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause\nKEY_PROG3\t1\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous\nKEY_PROG4\t1\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next\nKEY_BRIGHTNESSDOWN\t1\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -\nKEY_BRIGHTNESSDOWN\t2\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -\nKEY_BRIGHTNESSUP\t1\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +\nKEY_BRIGHTNESSUP\t2\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +\nKEY_F21\t1\t/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset\n"
-    },
-    {
-      "seat": "node-display-session",
-      "kind": "config",
-      "content": "# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the\n# mesh: replaced at every push. Once the controller places contributions to node-display-session\n# (ADR 0210), these become the module's contribution instead of a file in i3's directory.\n#\n# The keys the firmware turns into ordinary key presses. The vendor keys that reach no X client are\n# triggerhappy's (/etc/triggerhappy/triggers.d/asus-g14.conf): M4 and Fn+F4/F5 for media, Fn+F7/F8 for\n# the panel, Fn+F10 for the touchpad. The keyboard backlight (Fn+F2/F3) is the firmware's and asusd's.\n\n# Fn+F6, the screenshot key: the firmware sends Super+Shift+S. Released before it runs, because the\n# screenshot grabs the pointer to select a region, which fails while the key is still held.\nbindsym --release $mod+Shift+s exec --no-startup-id $XDG_CONFIG_HOME/i3/scripts/screenshot.sh\n\n# Fn+F9, the display key: the firmware sends Super+P. Odd workspaces to the panel, even ones to the\n# external output.\nbindsym $mod+p exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display order\n\n# The keyboard backlight's level, shown when it changes.\nexec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-kbd-notify\n"
-    },
-    {
-      "seat": "node-display-session",
-      "kind": "config",
-      "content": "# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the\n# mesh: replaced at every push. Once the controller places contributions to node-display-session\n# (ADR 0210), these become the module's contribution instead of a file in i3's directory.\n#\n# The model's panel and touchpad.\n\n# The internal panel is the primary output, where the bars' tray goes. Which monitors are on and where\n# is the display server's (autorandr, run at every session start).\nexec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display primary\n\n# The touchpad's settings again, by hand. X applies them itself whenever the device appears.\nbindsym $mod+Shift+x exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset\n"
-    }
-  ],
-  "shell": [
-    {
-      "for": "after-wake",
-      "slot": "normal",
-      "code": "# The touchpad's settings again after waking, in the operator's session: X applies the module's\n# input class when the device appears, and this covers a wake that does not initialise it again.\n# Runs as root from the power module; the reset itself runs as the session's owner.\nsleep 2\nowner=$(ps -o user= -C i3 | head -n 1)\n[ -n \"$owner\" ] && runuser -u \"$owner\" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset\ntrue\n"
-    }
-  ]
+  }
 }
@@ -0,0 +1,11 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# On low battery the machine suspends rather than powering off, at 7 % — s2idle still draws a little,
+# so it leaves headroom. A drop-in over the package's own UPower.conf, which stays the package's.
+[UPower]
+UsePercentageForPolicy=true
+PercentageLow=15.0
+PercentageCritical=10.0
+PercentageAction=7.0
+CriticalPowerAction=Suspend
+AllowRiskyCriticalPowerAction=true
@@ -0,0 +1,12 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The touchpad's settings, applied by X every time the device appears — at login and after every
+# resume, when the device is initialised again. This replaces the predecessor's sleep hook, which ran
+# xinput after a resume as a named person on a guessed display.
+Section "InputClass"
+    Identifier "asus-zephyrus-g14 touchpad"
+    MatchIsTouchpad "on"
+    Option "Tapping" "on"
+    Option "NaturalScrolling" "true"
+    Option "AccelSpeed" "0.15"
+EndSection
@@ -0,0 +1,7 @@
+# The touchpad's settings again after waking, in the operator's session: X applies the module's
+# input class when the device appears, and this covers a wake that does not initialise it again.
+# Runs as root from the power module; the reset itself runs as the session's owner.
+sleep 2
+owner=$(ps -o user= -C i3 | head -n 1)
+[ -n "$owner" ] && runuser -u "$owner" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
+true
@@ -0,0 +1,30 @@
+# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the
+# mesh: replaced at every push. Once the controller places contributions to node-display-session
+# (ADR 0210), these become the module's contribution instead of a file in i3's directory.
+#
+# The keys the firmware turns into ordinary key presses. The vendor keys that reach no X client are
+# triggerhappy's (/etc/triggerhappy/triggers.d/asus-g14.conf): M4 and Fn+F4/F5 for media, Fn+F7/F8 for
+# the panel, Fn+F10 for the touchpad. The keyboard backlight (Fn+F2/F3) is the firmware's and asusd's.
+
+# Fn+F6, the screenshot key: the firmware sends Super+Shift+S. Released before it runs, because the
+# screenshot grabs the pointer to select a region, which fails while the key is still held.
+bindsym --release $mod+Shift+s exec --no-startup-id $XDG_CONFIG_HOME/i3/scripts/screenshot.sh
+
+# Fn+F9, the display key: the firmware sends Super+P. Odd workspaces to the panel, even ones to the
+# external output.
+bindsym $mod+p exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display order
+
+# The keyboard backlight's level, shown when it changes.
+exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-kbd-notify
+# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the
+# mesh: replaced at every push. Once the controller places contributions to node-display-session
+# (ADR 0210), these become the module's contribution instead of a file in i3's directory.
+#
+# The model's panel and touchpad.
+
+# The internal panel is the primary output, where the bars' tray goes. Which monitors are on and where
+# is the display server's (autorandr, run at every session start).
+exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display primary
+
+# The touchpad's settings again, by hand. X applies them itself whenever the device appears.
+bindsym $mod+Shift+x exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
@@ -0,0 +1,10 @@
+# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,
+# and the touchpad key. Each runs this module's own script, as the operator's account.
+KEY_PROG1	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause
+KEY_PROG3	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous
+KEY_PROG4	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next
+KEY_BRIGHTNESSDOWN	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSDOWN	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSUP	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_BRIGHTNESSUP	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_F21	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
@@ -0,0 +1,16 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The discrete GPU's driver options on the ROG Zephyrus G14 (GA403, RTX 40 series, hybrid graphics).
+#
+# NVreg_DynamicPowerManagement=0x00 turns runtime D3 off. With it on, a change of power source sends
+# the driver an ACPI notification it fails to handle on this model ("RmHandleDNotifierEvent: Failed to
+# handle ACPI D-Notifier event, status=0x62"), and the GPU stops making progress until the machine is
+# powered off. Off costs a few idle watts in hybrid mode and keeps the machine up.
+#
+# NVreg_PreserveVideoMemoryAllocations=1 saves video memory across suspend, so what used the GPU still
+# works after waking. It needs nvidia-suspend, -hibernate and -resume to run around a sleep, which this
+# module's drop-ins on the sleep services ask for.
+#
+# A change here applies when the driver next loads: at the next boot.
+options nvidia NVreg_PreserveVideoMemoryAllocations=1
+options nvidia NVreg_DynamicPowerManagement=0x00
@@ -0,0 +1,6 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The ACPI video driver does not change the backlight itself on the brightness keys: on this model it
+# moves the wrong one. The keys are triggerhappy's (see /etc/triggerhappy/triggers.d/asus-g14.conf).
+# Applies when the module next loads: at the next boot.
+options video brightness_switch_enabled=0
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# nvidia-powerd (Dynamic Boost) was the first error in the chain that hung this model's GPU on a change
+# of power source, and asusd starts it on mains. It runs only when the kernel command line says
+# zephyrus.nvidia-powerd — an explicit opt-in, at boot.
+[Unit]
+ConditionKernelCommandLine=zephyrus.nvidia-powerd
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as
+# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service
+# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.
+[Unit]
+Wants=nvidia-hibernate.service nvidia-resume.service
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as
+# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service
+# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.
+[Unit]
+Wants=nvidia-suspend-then-hibernate.service nvidia-resume.service
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as
+# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service
+# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.
+[Unit]
+Wants=nvidia-suspend.service nvidia-resume.service
@@ -0,0 +1,5 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The backlights are writable by the video group, so the brightness keys and the module's brightness tool
+# move the panel without root.
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/usr/bin/chgrp video /sys/class/backlight/%k/brightness", RUN+="/usr/bin/chmod g+w /sys/class/backlight/%k/brightness"
@@ -47,17 +47,20 @@
      "id": "state",
      "type": "directory",
      "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "trail",
      "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
    },
    {
      "id": "spool",
      "type": "directory",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
    }
  ],
  "capabilities": [
@@ -0,0 +1,4 @@
+{
+  "password": "${secret:admin}",
+  "host": "${bound:route:name}"
+}
@@ -0,0 +1,7 @@
+DATABASE_HOST=${bound:postgres-database:at}
+DATABASE_PORT=${bound:postgres-database:port}
+DATABASE_NAME=${bound:postgres-database:as}
+DATABASE_USER=${bound:postgres-database:as}
+DATABASE_PASSWORD_FILE=/run/secrets/database
+DISABLE_EMBEDDED_PSQL=true
+BASEROW_PUBLIC_URL=https://${bound:route:name}
@@ -46,31 +46,54 @@
      }
    ]
  },
+  "config": {
+    "host": {
+      "type": "string",
+      "description": "The Host header the module's tools send to Baserow, a host name; the file's default is the name the module's route was given.",
+      "trusted": true,
+      "default": "${bound:route:name}"
+    },
+    "email": {
+      "type": "string",
+      "description": "The email address of the Baserow account the module's tools sign in as; unset, the code falls back to its environment.",
+      "trusted": true,
+      "default": ""
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Baserow at, as a URL; unset, the code falls back to its environment, else this machine's Baserow on port 80.",
+      "trusted": true,
+      "default": ""
+    }
+  },
  "resources": [
    {
      "id": "mesh-state",
      "type": "directory",
      "mode": "0700",
-      "place": "mesh"
+      "place": "mesh",
+      "unknown": "program"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "data",
      "type": "directory",
      "mode": "0755",
-      "owner": "9999:9999"
+      "owner": "9999:9999",
+      "unknown": "program"
    },
    {
      "id": "server-env",
      "type": "file",
      "path": "${dir:state}/server.env",
      "mode": "0600",
-      "content": "DATABASE_HOST=${bound:postgres-database:at}\nDATABASE_PORT=${bound:postgres-database:port}\nDATABASE_NAME=${bound:postgres-database:as}\nDATABASE_USER=${bound:postgres-database:as}\nDATABASE_PASSWORD_FILE=/run/secrets/database\nDISABLE_EMBEDDED_PSQL=true\nBASEROW_PUBLIC_URL=https://${bound:route:name}\n"
+      "template": "files/server.env"
    },
    {
      "id": "net",
@@ -102,8 +125,10 @@
      "type": "file",
      "path": "${dir:mesh-state}/config.json",
      "mode": "0600",
-      "content": "{\n  \"password\": \"${secret:admin}\",\n  \"host\": \"${bound:route:name}\"\n}\n",
-      "merge": "json"
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["host", "email", "url"],
+      "protected": ["password"]
    }
  ],
  "build": {
@@ -122,6 +147,11 @@
          "MESH_BASEROW_URL": "http://127.0.0.1:${port:80}",
          "MESH_BASEROW_CONFIG_FILE": "${dir:mesh-state}/config.json"
        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1,3 @@
+{
+  "accounts": {}
+}
@@ -0,0 +1,10 @@
+#!/bin/sh
+# Betterbird's start, written by the mesh (module betterbird, novox/hq ADR 0316). Replaced at every push.
+#
+# Before Betterbird starts, the module's tools place its user.js in the profile (the settings prefs, accounts, identities, calendars,
+# address-books and tags) and write what Betterbird rewrites itself: the account lists and each declared account's filters. They do
+# it only while no Betterbird of this account runs, because Betterbird rewrites its saved preferences when it quits; a
+# second start while one runs only hands over to it. What the preparation could not do it says here, and
+# betterbird_check says it too. Betterbird starts either way: its configuration never holds the mail back.
+/usr/local/lib/mesh-betterbird/betterbird-tools prepare || echo "betterbird: the mesh's preparation did not complete; betterbird_check says why" >&2
+exec /opt/betterbird/betterbird "$@"
@@ -0,0 +1,6 @@
+{
+  "identities": {},
+  "calendars": {},
+  "address-books": {},
+  "filters": {}
+}
@@ -0,0 +1,25 @@
+[Desktop Entry]
+Version=1.0
+Type=Application
+Name=Betterbird
+GenericName=Mail Client
+Comment=Send and receive mail with Betterbird
+Exec=/usr/local/bin/betterbird %u
+Icon=/opt/betterbird/chrome/icons/default/default128.png
+Terminal=false
+Categories=Network;Email;
+MimeType=message/rfc822;x-scheme-handler/mailto;application/x-xpinstall;application/x-extension-ics;text/calendar;text/vcard;text/x-vcard;x-scheme-handler/webcal;x-scheme-handler/webcals;x-scheme-handler/mid;
+StartupNotify=true
+StartupWMClass=eu.betterbird.Betterbird
+Keywords=Email;E-mail;Calendar;Thunderbird;
+Actions=ComposeMessage;OpenAddressBook;
+# Written by the mesh (module betterbird, novox/hq ADR 0316 §3), in place of the community package's entry:
+# it starts Betterbird through the module's start, and names the icon in the installation, with no link.
+
+[Desktop Action ComposeMessage]
+Name=Write new message
+Exec=/usr/local/bin/betterbird -compose
+
+[Desktop Action OpenAddressBook]
+Name=Open address book
+Exec=/usr/local/bin/betterbird -addressbook
@@ -0,0 +1,3 @@
+{
+  "prefs": {}
+}
@@ -0,0 +1,3 @@
+{
+  "tags": {}
+}
@@ -33,13 +33,59 @@
    "betterbird_drift",
    "betterbird_reminder_test"
  ],
+  "config": {
+    "prefs": {
+      "type": "object",
+      "description": "Betterbird's preferences the operator sets, by their own names (mailnews.*, calendar.* and the like), laid into prefs.json; an account's, a server's and a tag's are refused, as accounts, the four kinds and tags own them (novox/hq ADR 0329 §6).",
+      "trusted": true,
+      "default": {}
+    },
+    "accounts": {
+      "type": "object",
+      "description": "The mail accounts Betterbird is set up with, each by a name of the operator's: its address, its sender's name and its incoming and outgoing servers; no password, token or cookie (novox/hq ADR 0329 §2).",
+      "trusted": true,
+      "default": {}
+    },
+    "identities": {
+      "type": "object",
+      "description": "The identities beside an account's own, each by a name of the operator's: the address and name it sends as, its signature as a list of lines, and the profile's key to adopt on a node.",
+      "trusted": true,
+      "default": {}
+    },
+    "calendars": {
+      "type": "object",
+      "description": "The calendars Betterbird shows, each by a name of the operator's: where it is and how it is reached, and the profile's key to adopt on a node.",
+      "trusted": true,
+      "default": {}
+    },
+    "address-books": {
+      "type": "object",
+      "description": "The address books Betterbird uses, each by a name of the operator's: where it is and how it is reached, and the profile's key to adopt on a node.",
+      "trusted": true,
+      "default": {}
+    },
+    "filters": {
+      "type": "object",
+      "description": "The message filters of each account, by account: what each matches and what it does with the mail.",
+      "trusted": true,
+      "default": {}
+    },
+    "tags": {
+      "type": "object",
+      "description": "The tags Betterbird offers, each by its own key: its name, colour and order; trusted since issue 751, so a change to it is the operator's to approve.",
+      "trusted": true,
+      "default": {}
+    }
+  },
  "resources": [
    {
      "id": "configuration-dir",
      "type": "directory",
      "path": "${machine:account-home}/.config/betterbird",
      "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["accounts-record.json", "configuration-record.json", "kept/"]
    },
    {
      "id": "prefs",
@@ -48,10 +94,10 @@
      "owner": "${machine:account}",
      "mode": "0644",
      "merge": "json",
-      "takes-settings": [
+      "takes-config": [
        "prefs"
      ],
-      "content": "{\n  \"prefs\": {}\n}\n",
+      "template": "files/prefs.json",
      "trusted": true
    },
    {
@@ -61,10 +107,10 @@
      "owner": "${machine:account}",
      "mode": "0600",
      "merge": "json",
-      "takes-settings": [
+      "takes-config": [
        "accounts"
      ],
-      "content": "{\n  \"accounts\": {}\n}\n",
+      "template": "files/accounts.json",
      "trusted": true
    },
    {
@@ -74,13 +120,13 @@
      "owner": "${machine:account}",
      "mode": "0600",
      "merge": "json",
-      "takes-settings": [
+      "takes-config": [
        "identities",
        "calendars",
        "address-books",
        "filters"
      ],
-      "content": "{\n  \"identities\": {},\n  \"calendars\": {},\n  \"address-books\": {},\n  \"filters\": {}\n}\n",
+      "template": "files/configuration.json",
      "trusted": true
    },
    {
@@ -90,11 +136,11 @@
      "owner": "${machine:account}",
      "mode": "0644",
      "merge": "json",
-      "takes-settings": [
+      "takes-config": [
        "tags"
      ],
-      "content": "{\n  \"tags\": {}\n}\n",
-      "trusted": false
+      "template": "files/tags.json",
+      "trusted": true
    },
    {
      "id": "community-package",
@@ -106,45 +152,50 @@
      "id": "installation",
      "type": "archive",
      "path": "/opt/betterbird",
-      "artifact": "archive"
+      "artifact": "archive",
+      "unknown": "program"
    },
    {
      "id": "owl",
      "type": "archive",
      "path": "/opt/betterbird/owl",
-      "artifact": "owl"
+      "artifact": "owl",
+      "unknown": "program"
    },
    {
      "id": "policies",
      "type": "archive",
      "path": "/opt/betterbird/distribution",
-      "artifact": "distribution"
+      "artifact": "distribution",
+      "unknown": "program"
    },
    {
      "id": "spelling",
      "type": "archive",
      "path": "/opt/betterbird/defaults/pref",
-      "artifact": "defaults"
+      "artifact": "defaults",
+      "unknown": "program"
    },
    {
      "id": "preparation",
      "type": "archive",
      "path": "/usr/local/lib/mesh-betterbird",
-      "artifact": "tools"
+      "artifact": "tools",
+      "unknown": "program"
    },
    {
      "id": "start",
      "type": "file",
      "path": "/usr/local/bin/betterbird",
      "mode": "0755",
-      "content": "#!/bin/sh\n# Betterbird's start, written by the mesh (module betterbird, novox/hq ADR 0316). Replaced at every push.\n#\n# Before Betterbird starts, the module's tools place its user.js in the profile (the settings prefs, accounts, identities, calendars,\n# address-books and tags) and write what Betterbird rewrites itself: the account lists and each declared account's filters. They do\n# it only while no Betterbird of this account runs, because Betterbird rewrites its saved preferences when it quits; a\n# second start while one runs only hands over to it. What the preparation could not do it says here, and\n# betterbird_check says it too. Betterbird starts either way: its configuration never holds the mail back.\n/usr/local/lib/mesh-betterbird/betterbird-tools prepare || echo \"betterbird: the mesh's preparation did not complete; betterbird_check says why\" >&2\nexec /opt/betterbird/betterbird \"$@\"\n"
+      "template": "files/betterbird"
    },
    {
      "id": "launcher",
      "type": "file",
      "path": "/usr/local/share/applications/eu.betterbird.Betterbird.desktop",
      "mode": "0644",
-      "content": "[Desktop Entry]\nVersion=1.0\nType=Application\nName=Betterbird\nGenericName=Mail Client\nComment=Send and receive mail with Betterbird\nExec=/usr/local/bin/betterbird %u\nIcon=/opt/betterbird/chrome/icons/default/default128.png\nTerminal=false\nCategories=Network;Email;\nMimeType=message/rfc822;x-scheme-handler/mailto;application/x-xpinstall;application/x-extension-ics;text/calendar;text/vcard;text/x-vcard;x-scheme-handler/webcal;x-scheme-handler/webcals;x-scheme-handler/mid;\nStartupNotify=true\nStartupWMClass=eu.betterbird.Betterbird\nKeywords=Email;E-mail;Calendar;Thunderbird;\nActions=ComposeMessage;OpenAddressBook;\n# Written by the mesh (module betterbird, novox/hq ADR 0316 §3), in place of the community package's entry:\n# it starts Betterbird through the module's start, and names the icon in the installation, with no link.\n\n[Desktop Action ComposeMessage]\nName=Write new message\nExec=/usr/local/bin/betterbird -compose\n\n[Desktop Action OpenAddressBook]\nName=Open address book\nExec=/usr/local/bin/betterbird -addressbook\n"
+      "template": "files/eu.betterbird.Betterbird.desktop"
    }
  ],
  "build": {
@@ -191,6 +242,11 @@
        "name": "defaults",
        "kind": "archive",
        "from": "install/defaults-pref"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1,3 @@
+{
+  "bucket": "${bound:s3-bucket:bucket}"
+}
@@ -0,0 +1,3 @@
+{
+  "mesh-range": "${machine:mesh-range}"
+}
@@ -0,0 +1,9 @@
+{
+  "scanner": "",
+  "scan-folder": "",
+  "printer": "",
+  "printer-certificate": "",
+  "resolution": 300,
+  "color-mode": "color",
+  "crop": true
+}
@@ -0,0 +1,9 @@
+{
+  "scheme": "${bound:s3-bucket:scheme}",
+  "at": "${bound:s3-bucket:at}",
+  "port": "${bound:s3-bucket:port}",
+  "bucket": "${bound:s3-bucket:bucket}",
+  "region": "${bound:s3-bucket:region}",
+  "key": "${bound:s3-bucket:as}",
+  "secret": "${secret:s3-bucket}"
+}
@@ -0,0 +1,314 @@
+{
+  "module": "brother",
+  "version": "1",
+  "requires": [
+    {
+      "name": "s3-bucket",
+      "shares": [
+        {
+          "to": "seat:node-files",
+          "methods": [
+            "put"
+          ]
+        }
+      ]
+    }
+  ],
+  "invokes": [
+    "seat:node-files.upload"
+  ],
+  "binds": {
+    "s3-bucket": "${dir:state}/store-binding.json"
+  },
+  "secrets": {
+    "s3-bucket": "${dir:state}/store.secret"
+  },
+  "config": {
+    "scanner": {
+      "type": "string",
+      "description": "The network scanner's eSCL address, such as http://192.0.2.10/eSCL: the scanner's own address and the path its eSCL service answers on; the operator's, with no default.",
+      "pattern": "^https?://.+",
+      "trusted": true,
+      "required": true
+    },
+    "scan-folder": {
+      "type": "string",
+      "description": "The absolute path of the folder the scans are filed in as PDF files; the module makes it when it files the first scan, and never touches a file in it that it did not write. The operator's, with no default.",
+      "pattern": "^/.+$",
+      "trusted": true,
+      "required": true
+    },
+    "printer": {
+      "type": "string",
+      "description": "The printer's host, such as 192.0.2.10: where its admin page (HTTPS) and its IPP service answer. The device is the scanner's own; the operator's, with no default.",
+      "pattern": "^[A-Za-z0-9.:-]+$",
+      "trusted": true,
+      "required": true
+    },
+    "printer-certificate": {
+      "type": "string",
+      "description": "The SHA-256 fingerprint of the certificate the printer's admin page serves, as 32 upper-case hex pairs joined by colons; several, separated by commas, when the printer serves more than one (it serves an ECDSA and an RSA certificate for one name). The module trusts those certificates alone and refuses any other; the operator's, with no default.",
+      "pattern": "^([0-9A-F]{2}:){31}[0-9A-F]{2}(, *([0-9A-F]{2}:){31}[0-9A-F]{2})*$",
+      "trusted": true,
+      "required": true
+    },
+    "resolution": {
+      "type": "number",
+      "description": "The resolution asked of the scanner, in dpi: 100, 200, 300 or 600. A scanner may give another; the scan is filed at the resolution it gave.",
+      "enum": [
+        100,
+        200,
+        300,
+        600
+      ],
+      "trusted": false,
+      "default": 300
+    },
+    "color-mode": {
+      "type": "string",
+      "description": "Whether the scan is in colour or in grays: color or gray.",
+      "enum": [
+        "color",
+        "gray"
+      ],
+      "trusted": false,
+      "default": "color"
+    },
+    "crop": {
+      "type": "boolean",
+      "description": "Whether the document is cut out of the platen's white lid; false files the whole platen. A feeder scan is never cropped.",
+      "trusted": false,
+      "default": true
+    }
+  },
+  "own-secrets": {
+    "admin-password": {
+      "path": "${dir:state}/admin-password.secret",
+      "issued-by": "outside",
+      "prompt": "the admin password of the Brother printer",
+      "owner": "brother-device"
+    },
+    "broker-device": {
+      "path": "${dir:state}/broker-device.secret",
+      "owner": "brother-device"
+    }
+  },
+  "streams": [
+    {
+      "name": "device-asks",
+      "events": [
+        "device.asked"
+      ],
+      "max-age-days": 1,
+      "max-mib": 8,
+      "retention": "work-queue",
+      "max-deliveries": 3,
+      "duplicates": 24
+    }
+  ],
+  "state": [
+    {
+      "name": "device-answers",
+      "ttl-seconds": 600
+    }
+  ],
+  "seats": [
+    {
+      "name": "scanner",
+      "scope": "mesh",
+      "serves": [
+        "scan",
+        "status",
+        "list",
+        "document"
+      ]
+    },
+    {
+      "name": "printer",
+      "scope": "mesh",
+      "serves": [
+        "status",
+        "settings",
+        "print",
+        "upload"
+      ]
+    }
+  ],
+  "claims": [
+    {
+      "name": "scanner",
+      "scope": "mesh",
+      "serves": [
+        "scan",
+        "status",
+        "list",
+        "document"
+      ]
+    },
+    {
+      "name": "printer",
+      "scope": "mesh",
+      "serves": [
+        "status",
+        "settings",
+        "print",
+        "upload"
+      ]
+    }
+  ],
+  "emits": [
+    "scan.added"
+  ],
+  "tools": [
+    "scanner.scan",
+    "scanner.status",
+    "scanner.list",
+    "scanner.document",
+    "printer.status",
+    "printer.settings",
+    "printer.print",
+    "printer.upload",
+    "brother_health"
+  ],
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "brother-device",
+      "shell": "/usr/bin/nologin"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0711",
+      "owner": "${machine:account}",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "takes-config": [
+        "scanner",
+        "scan-folder",
+        "printer",
+        "printer-certificate",
+        "resolution",
+        "color-mode",
+        "crop"
+      ],
+      "merge": "json",
+      "template": "files/settings.json",
+      "trusted": true
+    },
+    {
+      "id": "store",
+      "type": "file",
+      "path": "${dir:state}/store.json",
+      "owner": "brother-device",
+      "mode": "0600",
+      "template": "files/store.json"
+    },
+    {
+      "id": "bucket",
+      "type": "file",
+      "path": "${dir:state}/bucket.json",
+      "mode": "0644",
+      "template": "files/bucket.json"
+    },
+    {
+      "id": "fetch",
+      "type": "file",
+      "path": "${dir:state}/fetch.json",
+      "owner": "brother-device",
+      "mode": "0600",
+      "template": "files/fetch.json"
+    },
+    {
+      "id": "device",
+      "type": "process",
+      "name": "brother-device",
+      "artifact": "tools",
+      "run": [
+        "./brother",
+        "device"
+      ],
+      "user": "brother-device",
+      "env": {
+        "BROTHER_SETTINGS": "${dir:state}/settings.json",
+        "BROTHER_ADMIN_PASSWORD": "${dir:state}/admin-password.secret",
+        "BROTHER_BROKER": "${dir:state}/broker-device.secret",
+        "BROTHER_STORE": "${dir:state}/store.json",
+        "BROTHER_FETCH": "${dir:state}/fetch.json"
+      },
+      "restart-on": [
+        "settings",
+        "store",
+        "fetch"
+      ],
+      "bus": {
+        "queues": [
+          "device-asks"
+        ],
+        "state": [
+          "device-answers"
+        ],
+        "emits": [
+          "scan.added"
+        ],
+        "invokes": [
+          "seat:document-converter.convert"
+        ]
+      },
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "brother-watch",
+      "artifact": "tools",
+      "run": [
+        "./brother",
+        "watch"
+      ],
+      "user": "brother-device",
+      "health": {
+        "kind": "tool",
+        "tool": "brother_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/brother",
+        "binary": "brother",
+        "loads": [
+          "brother"
+        ],
+        "env": {
+          "BROTHER_SETTINGS": "${dir:state}/settings.json",
+          "BROTHER_BUCKET": "${dir:state}/bucket.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
@@ -0,0 +1,21 @@
+{
+  "module": "buildah",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "user-namespaces"
+  ],
+  "provides": [
+    {
+      "name": "rootless-image-build",
+      "reach": "machine"
+    }
+  ],
+  "resources": [
+    {
+      "id": "buildah",
+      "type": "package",
+      "package": "buildah"
+    }
+  ]
+}
@@ -0,0 +1,58 @@
+#!/bin/sh
+# The mesh's internal certificate authority, trusted by this machine.
+#
+# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).
+# Editing it here lasts until the next apply.
+#
+# There is no prior trust to verify the fetch against — this is the thing that
+# establishes it — so it is made over the mesh's own private network, which is
+# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the
+# route proxy fetch this root for itself). What comes back is checked here: a
+# body that is not a certificate is refused now, rather than believed and then
+# failed by whatever reads the trust store next.
+set -eu
+
+ROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'
+ANCHORS=/etc/ca-certificates/trust-source/anchors
+ANCHOR="$ANCHORS/mesh-internal-ca.crt"
+
+# Arch's layout, said out loud rather than assumed: a machine that keeps its
+# anchors elsewhere fails here, visibly, instead of writing a file nothing
+# reads. That failure is the signal that this belongs in the host, where one
+# operating system's difference lives (novox/hq ADR 0147, option 2).
+[ -d "$ANCHORS" ] || {
+	echo "this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout" >&2
+	exit 1
+}
+
+case "${1:-}" in
+install)
+	tmp=$(mktemp)
+	trap 'rm -f "$tmp"' EXIT
+	# The authority may still be starting, or this machine may have come up
+	# before it: two minutes of asking, then an honest failure.
+	n=0
+	while [ "$n" -lt 60 ]; do
+		if curl --fail --silent --show-error --insecure --max-time 10 \
+			--output "$tmp" "$ROOTS" &&
+			grep -q 'BEGIN CERTIFICATE' "$tmp"; then
+			install -m 0644 "$tmp" "$ANCHOR"
+			update-ca-trust
+			exit 0
+		fi
+		n=$((n + 1))
+		sleep 2
+	done
+	echo "the authority at $ROOTS did not serve a certificate within two minutes" >&2
+	exit 1
+	;;
+remove)
+	# What stopping the unit does, and therefore what being unassigned does.
+	rm -f "$ANCHOR"
+	update-ca-trust
+	;;
+*)
+	echo "usage: $(basename "$0") install|remove" >&2
+	exit 2
+	;;
+esac
@@ -0,0 +1,16 @@
+[Unit]
+Description=The mesh's internal certificate authority, trusted by this machine
+# novox/hq ADR 0147. Starting this unit places the mesh's root among this
+# machine's trust anchors; stopping it takes the root away again, which is what
+# the host does when the module is no longer assigned here.
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${dir:state}/anchor install
+ExecStop=${dir:state}/anchor remove
+
+[Install]
+WantedBy=multi-user.target
@@ -25,21 +25,22 @@
      "id": "state",
      "type": "directory",
      "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "anchor",
      "type": "file",
      "path": "${dir:state}/anchor",
      "mode": "0755",
-      "content": "#!/bin/sh\n# The mesh's internal certificate authority, trusted by this machine.\n#\n# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).\n# Editing it here lasts until the next apply.\n#\n# There is no prior trust to verify the fetch against \u2014 this is the thing that\n# establishes it \u2014 so it is made over the mesh's own private network, which is\n# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the\n# route proxy fetch this root for itself). What comes back is checked here: a\n# body that is not a certificate is refused now, rather than believed and then\n# failed by whatever reads the trust store next.\nset -eu\n\nROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'\nANCHORS=/etc/ca-certificates/trust-source/anchors\nANCHOR=\"$ANCHORS/mesh-internal-ca.crt\"\n\n# Arch's layout, said out loud rather than assumed: a machine that keeps its\n# anchors elsewhere fails here, visibly, instead of writing a file nothing\n# reads. That failure is the signal that this belongs in the host, where one\n# operating system's difference lives (novox/hq ADR 0147, option 2).\n[ -d \"$ANCHORS\" ] || {\n\techo \"this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout\" >&2\n\texit 1\n}\n\ncase \"${1:-}\" in\ninstall)\n\ttmp=$(mktemp)\n\ttrap 'rm -f \"$tmp\"' EXIT\n\t# The authority may still be starting, or this machine may have come up\n\t# before it: two minutes of asking, then an honest failure.\n\tn=0\n\twhile [ \"$n\" -lt 60 ]; do\n\t\tif curl --fail --silent --show-error --insecure --max-time 10 \\\n\t\t\t--output \"$tmp\" \"$ROOTS\" &&\n\t\t\tgrep -q 'BEGIN CERTIFICATE' \"$tmp\"; then\n\t\t\tinstall -m 0644 \"$tmp\" \"$ANCHOR\"\n\t\t\tupdate-ca-trust\n\t\t\texit 0\n\t\tfi\n\t\tn=$((n + 1))\n\t\tsleep 2\n\tdone\n\techo \"the authority at $ROOTS did not serve a certificate within two minutes\" >&2\n\texit 1\n\t;;\nremove)\n\t# What stopping the unit does, and therefore what being unassigned does.\n\trm -f \"$ANCHOR\"\n\tupdate-ca-trust\n\t;;\n*)\n\techo \"usage: $(basename \"$0\") install|remove\" >&2\n\texit 2\n\t;;\nesac\n"
+      "template": "files/anchor"
    },
    {
      "id": "unit",
      "type": "file",
      "path": "/etc/systemd/system/mesh-ca-trust.service",
      "mode": "0644",
-      "content": "[Unit]\nDescription=The mesh's internal certificate authority, trusted by this machine\n# novox/hq ADR 0147. Starting this unit places the mesh's root among this\n# machine's trust anchors; stopping it takes the root away again, which is what\n# the host does when the module is no longer assigned here.\nWants=network-online.target\nAfter=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=${dir:state}/anchor install\nExecStop=${dir:state}/anchor remove\n\n[Install]\nWantedBy=multi-user.target\n"
+      "template": "files/mesh-ca-trust.service"
    },
    {
      "id": "trust",
@@ -52,5 +53,14 @@
        "unit"
      ]
    }
-  ]
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
 }
@@ -0,0 +1 @@
+${machine:agent-account}
@@ -0,0 +1,13 @@
+#!/bin/sh
+# The mesh's (module claude-code, novox/hq ADR 0266): start the agent as the account agents run as on this
+# machine. Written whole at every push: an edit here is overwritten.
+agent='${machine:agent-account}'
+if [ "$(id -un)" = "$agent" ]; then
+	exec claude "$@"
+fi
+# Another account, the operator's, becomes the agent's through its own sudo: the person is the authority. The
+# operator's override of the guard travels only when it is set in this shell, as it would reach claude.
+if [ -n "$MESH_GUARD_OVERRIDE" ]; then
+	exec sudo -iu "$agent" env MESH_GUARD_OVERRIDE="$MESH_GUARD_OVERRIDE" claude "$@"
+fi
+exec sudo -iu "$agent" claude "$@"
@@ -0,0 +1,4 @@
+{
+  "node": "${machine:name}",
+  "console": "http://127.0.0.1:${bound:mcp-endpoint:port}/mcp"
+}
@@ -0,0 +1,10 @@
+{
+  "role": "",
+  "mcp_servers": {},
+  "managed_settings": {},
+  "instructions": {},
+  "output_styles": {},
+  "skills": {},
+  "commands": {},
+  "agents": {}
+}
@@ -0,0 +1,12 @@
+# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the
+# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where
+# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs
+# the real claude: exec, sudo and its sh see no alias.
+if [[ -r /etc/claude-code/agent-account ]]; then
+	() {
+		local agent=$(</etc/claude-code/agent-account)
+		if [[ -n $agent && $agent != $USERNAME ]]; then
+			alias claude=claude-agent
+		fi
+	}
+fi
@@ -1,16 +1,24 @@
 {
  "module": "claude-code",
  "version": "1",
+  "moved": true,
  "slug": "agent",
  "capabilities": [
    "package-manager"
  ],
  "requires": [
-    "mcp-endpoint"
+    "mcp-endpoint",
+    {
+      "name": "gitea-read",
+      "optional": true
+    }
  ],
  "binds": {
    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
  },
+  "secrets": {
+    "gitea-read": "${dir:state}/gitea-read.secret"
+  },
  "uses": [
    "operator-channel"
  ],
@@ -19,7 +27,9 @@
    "holdings",
    "config",
    "proposals",
-    "questions"
+    "questions",
+    "memory",
+    "waits"
  ],
  "reads": [
    "claude-licence-manager.bindings"
@@ -32,6 +42,7 @@
    "claude_code_grant",
    "claude_code_add_api_key",
    "claude_code_registrations",
+    "claude_code_memory",
    "claude_code_mcp_list",
    "claude_code_mcp_register",
    "claude_code_mcp_unregister",
@@ -57,6 +68,7 @@
    "claude_code_proposals",
    "claude_code_ask",
    "claude_code_answer",
+    "claude_code_wait",
    "claude_code_settings_get",
    "claude_code_settings_set",
    "claude_code_settings_clear",
@@ -83,6 +95,57 @@
      }
    ]
  },
+  "config": {
+    "role": {
+      "type": "string",
+      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
+      "trusted": true,
+      "default": ""
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "managed_settings": {
+      "type": "object",
+      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
+      "trusted": true,
+      "predefined": "agent-managed-settings",
+      "default": {}
+    },
+    "instructions": {
+      "type": "object",
+      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "output_styles": {
+      "type": "object",
+      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "skills": {
+      "type": "object",
+      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "commands": {
+      "type": "object",
+      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "agents": {
+      "type": "object",
+      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    }
+  },
  "resources": [
    {
      "id": "package",
@@ -93,21 +156,22 @@
      "id": "managed",
      "type": "directory",
      "path": "/etc/claude-code",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "program"
    },
    {
      "id": "start",
      "type": "file",
      "path": "/usr/local/bin/claude-agent",
      "mode": "0755",
-      "content": "#!/bin/sh\n# The mesh's (module claude-code, novox/hq ADR 0266): start the agent as the account agents run as on this\n# machine. Written whole at every push: an edit here is overwritten.\nagent='${machine:agent-account}'\nif [ \"$(id -un)\" = \"$agent\" ]; then\n\texec claude \"$@\"\nfi\n# Another account, the operator's, becomes the agent's through its own sudo: the person is the authority. The\n# operator's override of the guard travels only when it is set in this shell, as it would reach claude.\nif [ -n \"$MESH_GUARD_OVERRIDE\" ]; then\n\texec sudo -iu \"$agent\" env MESH_GUARD_OVERRIDE=\"$MESH_GUARD_OVERRIDE\" claude \"$@\"\nfi\nexec sudo -iu \"$agent\" claude \"$@\"\n"
+      "template": "files/claude-agent"
    },
    {
      "id": "agent-account-name",
      "type": "file",
      "path": "/etc/claude-code/agent-account",
      "mode": "0644",
-      "content": "${machine:agent-account}\n"
+      "template": "files/agent-account"
    },
    {
      "id": "agent-account",
@@ -121,14 +185,16 @@
      "type": "directory",
      "path": "${machine:agent-home}/.claude",
      "mode": "0700",
-      "owner": "${machine:agent-account}"
+      "owner": "${machine:agent-account}",
+      "unknown": "module"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "owner": "${machine:account}",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "facts",
@@ -136,7 +202,7 @@
      "path": "${dir:state}/facts.json",
      "mode": "0600",
      "owner": "${machine:account}",
-      "content": "{\n  \"node\": \"${machine:name}\",\n  \"console\": \"http://127.0.0.1:${bound:mcp-endpoint:port}/mcp\"\n}\n"
+      "template": "files/facts.json"
    },
    {
      "id": "settings",
@@ -144,15 +210,15 @@
      "path": "${dir:state}/settings.json",
      "mode": "0600",
      "owner": "${machine:account}",
+      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
      "merge": "json",
-      "content": "{\n  \"role\": \"\",\n  \"mcp_servers\": {},\n  \"managed_settings\": {},\n  \"instructions\": {},\n  \"output_styles\": {},\n  \"skills\": {},\n  \"commands\": {},\n  \"agents\": {}\n}\n"
+      "template": "files/settings.json"
    }
  ],
-  "shell": [
+  "items": [
    {
-      "for": "zsh",
-      "slot": "normal",
-      "code": "# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the\n# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where\n# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs\n# the real claude: exec, sudo and its sh see no alias.\nif [[ -r /etc/claude-code/agent-account ]]; then\n\t() {\n\t\tlocal agent=$(</etc/claude-code/agent-account)\n\t\tif [[ -n $agent && $agent != $USERNAME ]]; then\n\t\t\talias claude=claude-agent\n\t\tfi\n\t}\nfi\n"
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
    }
  ],
  "build": {
@@ -172,6 +238,11 @@
          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1 @@
+postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
@@ -0,0 +1,7 @@
+{
+  "cadence_minutes": 240,
+  "floor_minutes": 60,
+  "failures_to_notify": 3,
+  "cooldown_hours": 24,
+  "refresh_warn_days": 3
+}
@@ -8,7 +8,11 @@
  ],
  "contributes": {
    "postgres-database": {
-      "name": "claude_licences"
+      "name": "claude_licences",
+      "readable": [
+        "audit",
+        "binding"
+      ]
    }
  },
  "binds": {
@@ -59,6 +63,10 @@
  "emits": [
    "licence.adopted",
    "licence.refused",
+    "licence.bound",
+    "licence.switched",
+    "licence.released",
+    "licence.rotated",
    "licence.failing",
    "usage.read"
  ],
@@ -68,27 +76,66 @@
  "reads": [
    "claude-code.holdings"
  ],
+  "config": {
+    "cadence_minutes": {
+      "type": "number",
+      "description": "How old a licence's grant may grow before it is rotated, in minutes; 0 keeps 240.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 240
+    },
+    "floor_minutes": {
+      "type": "number",
+      "description": "How little time a grant may have left before it is refreshed in any case, in minutes; 0 keeps 60.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 60
+    },
+    "failures_to_notify": {
+      "type": "number",
+      "description": "How many refreshes of a licence fail in a row before the operator is told, a count; 0 keeps 3.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 3
+    },
+    "cooldown_hours": {
+      "type": "number",
+      "description": "How long after telling the operator about a licence nothing more is said about it, in hours; 0 keeps 24.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 24
+    },
+    "refresh_warn_days": {
+      "type": "number",
+      "description": "How long before a licence's refresh token itself expires the operator is warned, in days; 0 keeps 3.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 3
+    }
+  },
  "resources": [
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "database-url",
      "type": "file",
      "path": "${dir:state}/database.url",
      "mode": "0600",
-      "content": "postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\n"
+      "template": "files/database.url"
    },
    {
      "id": "settings",
      "type": "file",
      "path": "${dir:state}/settings.json",
      "mode": "0600",
+      "takes-config": ["cadence_minutes", "floor_minutes", "failures_to_notify", "cooldown_hours", "refresh_warn_days"],
      "merge": "json",
-      "content": "{\n  \"cadence_minutes\": 240,\n  \"floor_minutes\": 60,\n  \"failures_to_notify\": 3,\n  \"cooldown_hours\": 24,\n  \"refresh_warn_days\": 3\n}\n"
+      "template": "files/settings.json"
    },
    {
      "id": "prepare",
@@ -126,6 +173,11 @@
          "MESH_LICENCE_KEY_FILE": "${dir:state}/grant.key",
          "MESH_LICENCE_SETTINGS": "${dir:state}/settings.json"
        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1,41 @@
+#!/bin/sh
+# clipmenud as the operator's user unit starts it, written by the mesh (module clipmenu). Replaced at every push.
+#
+# The account's service manager starts before the X server does, and has a DISPLAY only once the session's
+# xinitrc has handed it over (module xorg). So this waits, quietly, until the display is known, and exits
+# only when the session ends with it: a quick exit would run the unit into its start limit. DISPLAY, when
+# the manager has it, wins. Without it, exactly one X socket names the display; none or several (a
+# second server beside the session) wait for the session's own to arrive.
+# A running process does not see what the session hands the manager later, so each pass asks the manager.
+until [ -n "$DISPLAY" ]; do
+	for pair in $(systemctl --user show-environment 2>/dev/null | grep -E '^(DISPLAY|XAUTHORITY)='); do
+		export "$pair"
+	done
+	[ -n "$DISPLAY" ] && break
+	set -- /tmp/.X11-unix/X*
+	if [ $# -eq 1 ] && [ -S "$1" ]; then
+		DISPLAY=":${1##*/X}"
+		export DISPLAY
+	else
+		sleep 1
+	fi
+done
+if [ -z "$XAUTHORITY" ] && [ -r "$HOME/.Xauthority" ]; then
+	XAUTHORITY="$HOME/.Xauthority"
+	export XAUTHORITY
+fi
+# clipmenud allows one daemon per account: it takes an exclusive flock on its session_lock file and exits
+# with status 2 when that is held. After a delivery without a new login, the session's older clipmenud (from
+# its xinitrc) still holds it, and a start would run the unit round its restart loop. So this waits, quietly,
+# until the lock is free: it looks at the same file clipmenud locks (the directory is clipmenud's own rule)
+# and lets go at once. Exit status 1 is "held" for util-linux and BusyBox flock alike (no -E: BusyBox lacks it); any other outcome starts clipmenud, which says its own
+# error. Another daemon winning the gap between look and start costs one restart, not a loop.
+lock="${CM_DIR:-${XDG_RUNTIME_DIR-${TMPDIR-/tmp}}}/clipmenu.6.$USER/session_lock"
+while [ -e "$lock" ]; do
+	flock -n "$lock" true
+	[ $? -eq 1 ] || break
+	sleep 2
+done
+PATH="/usr/local/lib/mesh-clipmenu:$PATH"
+export PATH
+exec clipmenud
@@ -0,0 +1,20 @@
+#!/bin/sh
+# xsel as clipmenud sees it, written by the mesh (module clipmenu). Replaced at every push.
+#
+# clipmenud records text, and reads a selection with `timeout 1 xsel -o`. A selection holding an
+# image (a screenshot copied as image/png) is sent in pieces; one second is too short for megabytes,
+# timeout kills xsel half way, and the program owning the image waits for ever for a reader that is
+# gone. From then on nothing can ask the clipboard anything: pastes hang, and an Electron app that
+# asks on its main thread freezes. So a read goes ahead only when the selection offers text.
+case " $* " in
+*" -o "* | *" --output "*)
+	selection=clipboard
+	case " $* " in
+	*" --primary "* | *" -p "*) selection=primary ;;
+	*" --secondary "* | *" -s "*) selection=secondary ;;
+	esac
+	targets=$(timeout 1 xclip -selection "$selection" -t TARGETS -o 2>/dev/null) || exit 1
+	printf '%s\n' "$targets" | grep -qxE 'UTF8_STRING|STRING|TEXT|text/plain(;charset=utf-8)?' || exit 1
+	;;
+esac
+exec /usr/bin/xsel "$@"
@@ -0,0 +1 @@
+15
@@ -0,0 +1 @@
+500
@@ -0,0 +1 @@
+clipboard
@@ -0,0 +1,5 @@
+# The clipboard's history key (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at
+# every push. clipmenu shows the history through `dmenu`, the node's dmenu-compatible command, which
+# the holder of node-launcher answers (rofi on the workstations); the chosen entry is put back on the
+# clipboard.
+bindsym $mod+period exec --no-startup-id clipmenu -p Clipboard
@@ -0,0 +1,14 @@
+# clipmenud in the operator's account (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
+# The package's unit starts clipmenud with no DISPLAY; the module's launcher finds the display and puts the
+# text-only xsel first on the PATH. The settings repeat the module's environment, which the account's
+# service manager does not read.
+[Unit]
+StartLimitIntervalSec=0
+
+[Service]
+RestartSec=2s
+Environment=CM_SELECTIONS=clipboard
+Environment=CM_MAX_CLIPS=500
+Environment=CM_HISTLENGTH=15
+ExecStart=
+ExecStart=/usr/local/lib/mesh-clipmenu/clipmenud-session
@@ -1,6 +1,7 @@
 {
  "module": "clipmenu",
  "version": "1",
+  "moved": true,
  "capabilities": [
    "package-manager"
  ],
@@ -22,18 +23,38 @@
    "clipmenu_clear",
    "clipmenu_delete"
  ],
-  "environment": {
-    "variables": {
-      "CM_SELECTIONS": "clipboard",
-      "CM_MAX_CLIPS": "500",
-      "CM_HISTLENGTH": "15"
-    }
-  },
-  "shell": [
+  "items": [
    {
-      "for": "xinitrc",
-      "slot": "normal",
-      "code": "# The clipboard's history (module clipmenu, novox/hq ADR 0208): clipmenud collects every copy from\n# here on, once per session. It keeps the history in the account's runtime directory, so a reboot\n# forgets it, and with it every password that was ever copied.\n# Through the module's xsel, which reads only a selection offering text (see the README).\nPATH=\"/usr/local/lib/mesh-clipmenu:$PATH\" clipmenud &\n"
+      "collection": "environment",
+      "name": "cm-selections",
+      "attributes": {
+        "kind": "variable",
+        "name": "CM_SELECTIONS"
+      },
+      "template": "files/env-cm-selections"
+    },
+    {
+      "collection": "environment",
+      "name": "cm-max-clips",
+      "attributes": {
+        "kind": "variable",
+        "name": "CM_MAX_CLIPS"
+      },
+      "template": "files/env-cm-max-clips"
+    },
+    {
+      "collection": "environment",
+      "name": "cm-histlength",
+      "attributes": {
+        "kind": "variable",
+        "name": "CM_HISTLENGTH"
+      },
+      "template": "files/env-cm-histlength"
+    },
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-clipmenu.conf"
    }
  ],
  "resources": [
@@ -53,7 +74,42 @@
      "type": "file",
      "path": "/usr/local/lib/mesh-clipmenu/xsel",
      "mode": "0755",
-      "content": "#!/bin/sh\n# xsel as clipmenud sees it, written by the mesh (module clipmenu). Replaced at every push.\n#\n# clipmenud records text, and reads a selection with `timeout 1 xsel -o`. A selection holding an\n# image (a screenshot copied as image/png) is sent in pieces; one second is too short for megabytes,\n# timeout kills xsel half way, and the program owning the image waits for ever for a reader that is\n# gone. From then on nothing can ask the clipboard anything: pastes hang, and an Electron app that\n# asks on its main thread freezes. So a read goes ahead only when the selection offers text.\ncase \" $* \" in\n*\" -o \"* | *\" --output \"*)\n\tselection=clipboard\n\tcase \" $* \" in\n\t*\" --primary \"* | *\" -p \"*) selection=primary ;;\n\t*\" --secondary \"* | *\" -s \"*) selection=secondary ;;\n\tesac\n\ttargets=$(timeout 1 xclip -selection \"$selection\" -t TARGETS -o 2>/dev/null) || exit 1\n\tprintf '%s\\n' \"$targets\" | grep -qxE 'UTF8_STRING|STRING|TEXT|text/plain(;charset=utf-8)?' || exit 1\n\t;;\nesac\nexec /usr/bin/xsel \"$@\"\n"
+      "template": "files/bin/xsel"
+    },
+    {
+      "id": "daemon-dropins",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/systemd/user/clipmenud.service.d",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "daemon-dropin",
+      "type": "file",
+      "path": "${machine:account-home}/.config/systemd/user/clipmenud.service.d/mesh.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/systemd/clipmenud-mesh.conf"
+    },
+    {
+      "id": "launcher",
+      "type": "file",
+      "path": "/usr/local/lib/mesh-clipmenu/clipmenud-session",
+      "mode": "0755",
+      "template": "files/bin/clipmenud-session"
+    },
+    {
+      "id": "daemon",
+      "type": "service",
+      "unit": "clipmenud.service",
+      "scope": "user",
+      "user": "${machine:account}",
+      "state": "running",
+      "boot": "enabled",
+      "health": {
+        "kind": "unit"
+      }
    }
  ],
  "build": {
@@ -68,14 +124,12 @@
        "loads": [
          "clipmenu-tools"
        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
-  },
-  "contributions": [
-    {
-      "seat": "node-display-session",
-      "kind": "config",
-      "content": "# The clipboard's history key (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at\n# every push. clipmenu shows the history through `dmenu`, the node's dmenu-compatible command, which\n# the holder of node-launcher answers (rofi on the workstations); the chosen entry is put back on the\n# clipboard.\nbindsym $mod+period exec --no-startup-id clipmenu -p Clipboard\n"
-    }
-  ]
+  }
 }
@@ -0,0 +1 @@
+{}
@@ -5,20 +5,45 @@
  "own-secrets": {
    "token": "${dir:state}/token"
  },
+  "config": {
+    "atlassian-url": {
+      "type": "string",
+      "description": "The address of the operator's Atlassian site the confluence tools call, as a URL such as https://example.atlassian.net, laid into the file as ATLASSIAN_URL; unset, the code falls back to its environment and answers no calls until it is given.",
+      "trusted": true,
+      "default": ""
+    },
+    "atlassian-email": {
+      "type": "string",
+      "description": "The email address of the Atlassian account the confluence tools sign in as with its API token, laid into the file as ATLASSIAN_EMAIL; unset, the code falls back to its environment and answers no calls until it is given.",
+      "trusted": true,
+      "default": ""
+    }
+  },
  "resources": [
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "config",
      "type": "file",
      "path": "${dir:state}/config.json",
      "merge": "json",
-      "content": "{}",
-      "mode": "0600"
+      "template": "files/config.json",
+      "mode": "0600",
+      "takes-config": [
+        {
+          "key": "atlassian-url",
+          "as": "ATLASSIAN_URL"
+        },
+        {
+          "key": "atlassian-email",
+          "as": "ATLASSIAN_EMAIL"
+        }
+      ]
    }
  ],
  "capabilities": [
@@ -40,6 +65,11 @@
          "MESH_CONFLUENCE_TOKEN_FILE": "${dir:state}/token",
          "MESH_CONFLUENCE_CONFIG_FILE": "${dir:state}/config.json"
        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -1,70 +0,0 @@
-{
-  "module": "de-spiegel",
-  "version": "1",
-  "slug": "spiegel",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "de-spiegel",
-      "endpoint": "web"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
-  "own-secrets": {
-    "smtp-user": "${dir:state}/smtp-user.secret",
-    "smtp-pass": "${dir:state}/smtp-pass.secret"
-  },
-  "listens": [
-    {
-      "name": "web",
-      "port": 35621,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the de-spiegel site and its /contact endpoint over http; its public name is a route grant, and route-proxy reaches it on this published port"
-    }
-  ],
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "${dir:state}/server.env",
-      "mode": "0600",
-      "content": "SMTP_AUTH_USER=${secret:smtp-user}\nSMTP_AUTH_PASS=${secret:smtp-pass}\n"
-    },
-    {
-      "id": "net",
-      "type": "network",
-      "name": "de-spiegel"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "de-spiegel",
-      "image": "registry-api.novox.be/novox/de-spiegel@sha256:e144b72ce9c145870470d765343549f2c60211728cd118b9ff0e4029f36342ba",
-      "network": "de-spiegel",
-      "env-file": [
-        "${dir:state}/server.env"
-      ],
-      "ports": [
-        "35621"
-      ],
-      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (de-spiegel server/index.js); converting is that repository's change",
-      "names-on-purpose": {
-        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
-      }
-    }
-  ]
-}
@@ -0,0 +1,3 @@
+{
+  "desktop-machines": []
+}
@@ -45,6 +45,14 @@
  "tools": [
    "desk_channel_status"
  ],
+  "config": {
+    "desktop-machines": {
+      "type": "list",
+      "description": "The machines, by node name, whose desktop shows the operator's questions and notifications, in the order they are tried; empty shows them on none.",
+      "trusted": true,
+      "default": []
+    }
+  },
  "resources": [
    {
      "id": "account",
@@ -58,7 +66,8 @@
      "type": "directory",
      "mode": "0700",
      "owner": "desk-channel",
-      "place": "."
+      "place": ".",
+      "unknown": "program"
    },
    {
      "id": "settings",
@@ -66,8 +75,9 @@
      "path": "${dir:state}/settings.json",
      "mode": "0600",
      "owner": "desk-channel",
+      "takes-config": ["desktop-machines"],
      "merge": "json",
-      "content": "{\n  \"desktop-machines\": []\n}\n"
+      "template": "files/settings.json"
    }
  ],
  "build": {
@@ -85,6 +95,11 @@
        "env": {
          "MESH_DESK_SETTINGS": "${dir:state}/settings.json"
        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1,38 @@
+{
+  "module": "dev-tools",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "go-toolchain",
+    "node-toolchain"
+  ],
+  "resources": [
+    {
+      "id": "c-compiler",
+      "type": "package",
+      "package": "gcc"
+    },
+    {
+      "id": "make",
+      "type": "package",
+      "package": "make"
+    },
+    {
+      "id": "python",
+      "type": "package",
+      "package": "python"
+    },
+    {
+      "id": "git",
+      "type": "package",
+      "package": "git"
+    },
+    {
+      "id": "jq",
+      "type": "package",
+      "package": "jq"
+    }
+  ]
+}
@@ -5,7 +5,9 @@
    "disk_load",
    "disk_top",
    "disk_filesystems",
-    "disk_devices"
+    "disk_folders",
+    "disk_devices",
+    "cpu_top"
  ],
  "build": {
    "artifacts": [
@@ -50,13 +50,15 @@
      "id": "state",
      "type": "directory",
      "path": "/var/lib/mesh/registry",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
    },
    {
      "id": "registry-data",
      "type": "directory",
      "path": "/var/lib/mesh-registry",
-      "mode": "0700"
+      "mode": "0700",
+      "unknown": "program"
    },
    {
      "id": "store",
@@ -0,0 +1,87 @@
+# Managed by the mesh. dnsmasq's own defaults are replaced whole rather than
+# patched, because this module owns the file and a patch would leave whatever
+# was there before to be discovered later.
+#
+# This is one of the mesh's resolvers (novox/hq ADR 0194, 0223): it holds the
+# `mesh-dns-resolver` seat, which more than one machine may hold, each answering
+# the same names from the same roster. Every node and every container lists every
+# holder and no public resolver, so whichever answers first gives the one answer.
+# It holds the mesh's own names and nothing else (ADR 0191) — the roster is the
+# mesh's, rendered into each holder; no other copy lives on any machine.
+
+# What the mesh computed: one wildcard per machine — its name and everything
+# under it — and the mesh's own suffix as a local domain, so a name under it is
+# answered here or not at all and is never asked upstream. Rewritten whenever a
+# machine joins or leaves, which is why the service below restarts on it: a
+# reload makes dnsmasq re-read hosts files, not its configuration, and a
+# wildcard is configuration.
+conf-file=/etc/mesh-resolver/nodes.conf
+
+# Every zone a module answers itself (ADR 0199): one forwarding line per zone, to
+# the private address of the machine its module runs on and the port its
+# answerer is published on. Nothing in a zone is answered here; what names a zone
+# holds is the module's. Rewritten whenever a zone is declared or moves, and the
+# service restarts on it for the same reason as above.
+conf-file=/etc/mesh-resolver/zones.conf
+
+# Where it answers: this machine's private address, so every node — and every
+# container on every node, which copies its machine's resolvers — can ask; and
+# loopback, for this machine's own use. Never a LAN address: a device that is
+# not a member cannot reach what the mesh's names point at, and a LAN's resolver
+# is its router's (ADR 0194).
+#
+# Named as an ADDRESS and not as the interface that carries it, on purpose. A
+# container's query is addressed to this address but arrives on the runtime's
+# bridge, and dnsmasq checks every query against what it was told to answer on:
+# an `interface=` line admits queries by the interface they arrive on, a
+# `listen-address=` line by the address they are sent to. With `interface=mesh0`
+# alone, a query from a container was received and dropped without a word
+# (novox/hq 04-ISSUES/110). The address admits it whatever bridge it comes in on.
+#
+# bind-interfaces, and never bind-dynamic (novox/hq issue 348). bind-dynamic
+# re-reads the machine's addresses on every change of any link and closes each
+# listener whose interface that reading did not find; a reading made while the
+# container runtime deletes a bridge's virtual links fails ("index gone"), and
+# then every listener is closed until a later change reads cleanly. On
+# 2026-10-09 the private address was left unbound for twenty minutes, the daemon
+# running and silent. bind-interfaces binds each address once, at start, and
+# never closes it. It cannot bind an address that is not there yet, so the unit
+# waits for it (the drop-in below); a new private address restarts the unit, as
+# this file changing always did.
+bind-interfaces
+listen-address=${machine:address}
+listen-address=127.0.0.1
+
+# **It must never read resolv.conf to find out where to forward.** This
+# machine's resolv.conf names this resolver — so a resolver that read it for
+# upstreams would find itself, and every query it could not answer locally would
+# loop until its receive queue filled. That is not theoretical: it filled with
+# 15KB of queries and every lookup on the machine hung. no-resolv makes that loop
+# impossible: the upstreams are the two lines below, and nothing on the machine
+# can redirect them. The mesh's own names never reach them: the local= line in
+# the file above stops them here, answered or refused.
+no-resolv
+server=1.1.1.1
+server=8.8.8.8
+
+# Both upstreams validate DNSSEC and say so with the Authenticated Data bit,
+# and this passes that bit down rather than dropping it, which dnsmasq does
+# unless told. It does not validate itself: an answer's trust is the upstream's
+# and the path to it, which is what a forwarding resolver's trust always was.
+# Without it a program that refuses to run behind a resolver that does not
+# validate — a mail system's admin does exactly that check at start — cannot
+# use this resolver (novox/hq 04-ISSUES/171).
+proxy-dnssec
+
+# A name without a dot is never forwarded, and reverse lookups of private ranges
+# are answered here rather than asking the world who 10.x is.
+domain-needed
+bogus-priv
+
+# **No hosts file, and no operator's files.** This machine's /etc/hosts is its
+# own — the hosts module's block and the operator's lines (ADR 0199) — and the
+# mesh's resolver answers every node, so a line written for one machine's own
+# programs must not become an answer for all of them. Every per-node resolver
+# went wrong exactly here: a hosts file read once at start, an operator's old
+# line beside the mesh's, a drop-in read from a directory nobody owned.
+no-hosts
@@ -0,0 +1,14 @@
+# Written by the mesh (module dnsmasq, novox/hq issue 348). Replaced on every push.
+#
+# The resolver binds its addresses once, at start (bind-interfaces), so it starts only once this
+# machine's private address is there: it waits up to 80 seconds for it, and a start that found it
+# missing is tried again every ten seconds rather than left failed.
+[Unit]
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+ExecStartPre=/usr/bin/sh -c 'for i in $(seq 1 80); do ip -4 -o addr show to ${machine:address} | grep -q . && exit 0; sleep 1; done; echo "${machine:address} is not on this machine" >&2; exit 1'
+Restart=on-failure
+RestartSec=10s
@@ -0,0 +1 @@
+{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}}
@@ -0,0 +1,15 @@
+# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.
+[Unit]
+Description=Prune dangling images and unused build cache (the mesh's docker module)
+# Never volumes, never a container, never an image a container uses: dangling
+# images and build cache nothing refers to, unused for a week. What a person
+# prunes beyond that is docker_prune's, by hand.
+After=docker.service
+ConditionPathExists=/run/docker.sock
+
+[Service]
+Type=oneshot
+Nice=19
+IOSchedulingClass=idle
+ExecStart=/usr/bin/docker image prune --force --filter until=168h
+ExecStart=/usr/bin/docker builder prune --force --filter until=168h
@@ -0,0 +1,11 @@
+# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.
+[Unit]
+Description=Weekly prune of dangling images and unused build cache (the mesh's docker module)
+
+[Timer]
+OnCalendar=weekly
+RandomizedDelaySec=1h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,5 @@
+# The log rotation daemon.json takes, written by the mesh from this machine's settings log-max-size and
+# log-max-file, and judged by the step log-rotation-check before daemon.json is written (novox/hq issue 452).
+# Replaced on every push; change the settings, never this file.
+size=${config:log-max-size}
+files=${config:log-max-file}
@@ -33,6 +33,7 @@
    "docker_disk_usage",
    "docker_networks",
    "docker_volumes",
+    "docker_volumes_remove_anonymous",
    "docker_events",
    "docker_daemon_config",
    "docker_unlabelled",
@@ -44,18 +45,23 @@
      "docker exec cat /etc/resolv.conf"
    ]
  },
-  "settings": {
-    "log-max-size": {
-      "kind": "preference",
-      "default": "100m",
-      "why": "each container's log is cut at this size and the runtime keeps log-max-file of them, so 100m and 10 hold about 1 GB per container: what the one machine with rotation set by hand has (novox/hq issue 452). A whole number from 1 with k, m or g after it, refused before daemon.json is written. The runtime reads it only at its next start, which the mesh never forces, and a container created before that keeps the options it was created with until it is created again"
+    "config": {
+      "log-max-size": {
+        "type": "string",
+        "description": "The size each container's log is cut at, a whole number from 1 with k, m or g after it; the runtime keeps log-max-file of them, so 100m and 10 hold about 1 GB per container (novox/hq issue 452). The runtime reads it only at its next start, which the mesh never forces, and a container created before that keeps the options it was created with until it is created again.",
+        "pattern": "[1-9][0-9]*[kmg]",
+        "trusted": true,
+        "default": "100m"
+      },
+      "log-max-file": {
+        "type": "number",
+        "description": "How many of a container's log files of log-max-size the runtime keeps, a count from 1 to 99, the oldest dropped first; taken at the runtime's next start and by containers created after it, like log-max-size (novox/hq issue 452).",
+        "minimum": 1,
+        "maximum": 99,
+        "trusted": true,
+        "default": 10
+      }
    },
-    "log-max-file": {
-      "kind": "preference",
-      "default": 10,
-      "why": "how many of a container's log files of log-max-size the runtime keeps, the oldest dropped first; a count from 1 to 99, refused before daemon.json is written, taken at the runtime's next start and by containers created after it, like log-max-size (novox/hq issue 452)"
-    }
-  },
  "resources": [
    {
      "id": "package",
@@ -78,7 +84,8 @@
      "id": "state",
      "type": "directory",
      "mode": "0700",
-      "place": "mesh"
+      "place": "mesh",
+      "unknown": "program"
    },
    {
      "id": "log-rotation",
@@ -86,7 +93,7 @@
      "path": "${dir:state}/log-rotation.conf",
      "mode": "0600",
      "trusted": true,
-      "content": "# The log rotation daemon.json takes, written by the mesh from this machine's settings log-max-size and\n# log-max-file, and judged by the step log-rotation-check before daemon.json is written (novox/hq issue 452).\n# Replaced on every push; change the settings, never this file.\nsize=${setting:log-max-size}\nfiles=${setting:log-max-file}\n"
+      "template": "files/log-rotation.conf"
    },
    {
      "id": "log-rotation-check",
@@ -112,7 +119,7 @@
      "mode": "0644",
      "into": "json",
      "trusted": true,
-      "content": "{\"live-restore\": true, \"insecure-registries\": [\"${seat:mesh-artifact-store:reach}\"], \"log-driver\": \"json-file\", \"log-opts\": {\"max-size\": \"${setting:log-max-size}\", \"max-file\": \"${setting:log-max-file}\"}}\n"
+      "template": "files/daemon.json"
    },
    {
      "id": "runtime",
@@ -129,14 +136,14 @@
      "type": "file",
      "path": "/etc/systemd/system/docker-prune.service",
      "mode": "0644",
-      "content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Prune dangling images and unused build cache (the mesh's docker module)\n# Never volumes, never a container, never an image a container uses: dangling\n# images and build cache nothing refers to, unused for a week. What a person\n# prunes beyond that is docker_prune's, by hand.\nAfter=docker.service\nConditionPathExists=/run/docker.sock\n\n[Service]\nType=oneshot\nNice=19\nIOSchedulingClass=idle\nExecStart=/usr/bin/docker image prune --force --filter until=168h\nExecStart=/usr/bin/docker builder prune --force --filter until=168h\n"
+      "template": "files/docker-prune.service"
    },
    {
      "id": "prune-timer",
      "type": "file",
      "path": "/etc/systemd/system/docker-prune.timer",
      "mode": "0644",
-      "content": "# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.\n[Unit]\nDescription=Weekly prune of dangling images and unused build cache (the mesh's docker module)\n\n[Timer]\nOnCalendar=weekly\nRandomizedDelaySec=1h\nPersistent=true\n\n[Install]\nWantedBy=timers.target\n"
+      "template": "files/docker-prune.timer"
    },
    {
      "id": "prune",
@@ -162,6 +169,11 @@
        "loads": [
          "docker-tools"
        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  }
@@ -0,0 +1,110 @@
+# dunst, the notifier (module dunst, novox/hq ADR 0208). Owned by the mesh: this file is replaced
+# at every push. Adopted from the laptop's file of 2026-10-04 (the two workstations differed in
+# position, transparency and corner radius; the laptop's square, opaque, top-right one matches the
+# rest of the desktop). Only what differs from dunst's defaults, and what the desktop relies on.
+#
+# Other modules' rules go in ~/.config/dunst/dunstrc.d/*.conf, which dunst reads after this file,
+# so a drop-in outranks it. dunst is started by D-Bus on the first notification: nothing starts it.
+# When the mesh rewrites this file (a font-size or width setting changed), it tells a running dunst
+# to read it again (its unit's reload, dunstctl reload); what is on screen stays.
+
+[global]
+    monitor = 0
+    follow = none
+
+    # Geometry
+    width = ${config:width}
+    height = (0, 300)
+    origin = top-right
+    offset = (10, 50)
+    notification_limit = 20
+
+    progress_bar = true
+    progress_bar_height = 10
+    progress_bar_frame_width = 1
+    progress_bar_min_width = 150
+    progress_bar_max_width = 300
+
+    indicate_hidden = yes
+    transparency = 0
+    separator_height = 2
+    padding = 8
+    horizontal_padding = 8
+    text_icon_padding = 0
+    frame_width = 3
+    frame_color = "#de5200"
+    gap_size = 0
+    separator_color = frame
+    sort = yes
+    corner_radius = 0
+
+    # Text: the interface face (research 026/04)
+    font = Inter ${config:font-size}
+    line_height = 0
+    markup = full
+    format = "<b>%s</b>\n%b"
+    alignment = left
+    vertical_alignment = center
+    show_age_threshold = 60
+    ellipsize = middle
+    ignore_newline = no
+    stack_duplicates = true
+    hide_duplicate_count = false
+    show_indicators = yes
+
+    # Icons, from the desktop's icon theme
+    enable_recursive_icon_lookup = true
+    icon_theme = Adwaita
+    icon_position = left
+    min_icon_size = 32
+    max_icon_size = 128
+
+    # History
+    sticky_history = yes
+    history_length = 20
+
+    # The context menu is rofi (installed by the rofi module); -no-custom keeps typed text from becoming a choice. Not `dmenu`, the node-launcher's command in
+    # ~/.local/bin: dunst runs in the account's service manager, whose PATH does not hold that
+    # directory (seen on the laptop on 2026-10-10), so the menu never opened. Links open in the
+    # desktop's default browser.
+    dmenu = rofi -dmenu -no-custom -p dunst
+    browser = /usr/bin/xdg-open
+    always_run_script = true
+
+    title = Dunst
+    class = Dunst
+    ignore_dbusclose = false
+
+    # A tap answers (the touchpads have no middle button). do_action runs the notification's only
+    # action, or opens the context menu when it has several; without actions it opens its one link,
+    # if it has one. The notification then closes; a menu dismissed with Escape leaves it shown.
+    mouse_left_click = do_action, close_current
+    mouse_middle_click = do_action, close_current
+    mouse_right_click = close_all
+
+[urgency_low]
+    background = "#000000"
+    foreground = "#ffffff"
+    timeout = 10
+
+[urgency_normal]
+    background = "#000000"
+    foreground = "#ffffff"
+    timeout = 10
+
+[urgency_critical]
+    background = "#000000"
+    foreground = "#ffffff"
+    frame_color = "#ff0000"
+    timeout = 0
+
+# What is shown once is never kept (the review of 2026-10-09): a notification marked secret (a link's
+# code, category mesh.secret) and any transient one leave no entry in the history, which
+# node-notifier.history serves to every caller of the mesh's verbs.
+[mesh-secret]
+    category = "mesh.secret"
+    history_ignore = yes
+
+[transient-history-ignore]
+    match_transient = yes
+    history_ignore = yes
@@ -0,0 +1,4 @@
+# The notifications' key (module dunst, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
+# Super+N opens the menu (rofi) of the actions and links of every notification on screen, so one is
+# chosen from the keyboard as a tap chooses it on the notification.
+bindsym $mod+n exec --no-startup-id dunstctl context
@@ -1,6 +1,7 @@
 {
  "module": "dunst",
  "version": "1",
+  "moved": true,
  "capabilities": [
    "package-manager"
  ],
@@ -22,18 +23,23 @@
    "dunst_count",
    "dunst_reload"
  ],
-  "settings": {
-    "font-size": {
-      "kind": "preference",
-      "default": 10,
-      "why": "10 points of Inter reads well on a screen of about 100 DPI; a denser screen needs a larger size"
+    "config": {
+      "font-size": {
+        "type": "number",
+        "description": "The size of a notification's text, in points of Inter: 10 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+        "minimum": 6,
+        "maximum": 72,
+        "predefined": "font-size",
+        "default": 10
+      },
+      "width": {
+        "type": "number",
+        "description": "The width of a notification, in pixels: 250 fits a title of about forty characters at 10 points, and a larger font needs a wider notification.",
+        "minimum": 50,
+        "maximum": 4000,
+        "default": 250
+      }
    },
-    "width": {
-      "kind": "preference",
-      "default": 250,
-      "why": "250 pixels fits a title of about forty characters at 10 points; a larger font needs a wider notification"
-    }
-  },
  "resources": [
    {
      "id": "package",
@@ -50,14 +56,17 @@
      "type": "directory",
      "path": "${machine:account-home}/.config/dunst",
      "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out"
    },
    {
      "id": "dropins",
      "type": "directory",
      "path": "${machine:account-home}/.config/dunst/dunstrc.d",
      "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["50-slack.conf"]
    },
    {
      "id": "configuration",
@@ -66,7 +75,7 @@
      "path": "${machine:account-home}/.config/dunst/dunstrc",
      "owner": "${machine:account}",
      "mode": "0644",
-      "content": "# dunst, the notifier (module dunst, novox/hq ADR 0208). Owned by the mesh: this file is replaced\n# at every push. Adopted from the laptop's file of 2026-10-04 (the two workstations differed in\n# position, transparency and corner radius; the laptop's square, opaque, top-right one matches the\n# rest of the desktop). Only what differs from dunst's defaults, and what the desktop relies on.\n#\n# Other modules' rules go in ~/.config/dunst/dunstrc.d/*.conf, which dunst reads after this file,\n# so a drop-in outranks it. dunst is started by D-Bus on the first notification: nothing starts it.\n# When the mesh rewrites this file (a font-size or width setting changed), it tells a running dunst\n# to read it again (its unit's reload, dunstctl reload); what is on screen stays.\n\n[global]\n    monitor = 0\n    follow = none\n\n    # Geometry\n    width = ${setting:width}\n    height = (0, 300)\n    origin = top-right\n    offset = (10, 50)\n    notification_limit = 20\n\n    progress_bar = true\n    progress_bar_height = 10\n    progress_bar_frame_width = 1\n    progress_bar_min_width = 150\n    progress_bar_max_width = 300\n\n    indicate_hidden = yes\n    transparency = 0\n    separator_height = 2\n    padding = 8\n    horizontal_padding = 8\n    text_icon_padding = 0\n    frame_width = 3\n    frame_color = \"#de5200\"\n    gap_size = 0\n    separator_color = frame\n    sort = yes\n    corner_radius = 0\n\n    # Text: the interface face (research 026/04)\n    font = Inter ${setting:font-size}\n    line_height = 0\n    markup = full\n    format = \"<b>%s</b>\\n%b\"\n    alignment = left\n    vertical_alignment = center\n    show_age_threshold = 60\n    ellipsize = middle\n    ignore_newline = no\n    stack_duplicates = true\n    hide_duplicate_count = false\n    show_indicators = yes\n\n    # Icons, from the desktop's icon theme\n    enable_recursive_icon_lookup = true\n    icon_theme = Adwaita\n    icon_position = left\n    min_icon_size = 32\n    max_icon_size = 128\n\n    # History\n    sticky_history = yes\n    history_length = 20\n\n    # The context menu is rofi (installed by the rofi module); -no-custom keeps typed text from becoming a choice. Not `dmenu`, the node-launcher's command in\n    # ~/.local/bin: dunst runs in the account's service manager, whose PATH does not hold that\n    # directory (seen on the laptop on 2026-10-10), so the menu never opened. Links open in the\n    # desktop's default browser.\n    dmenu = rofi -dmenu -no-custom -p dunst\n    browser = /usr/bin/xdg-open\n    always_run_script = true\n\n    title = Dunst\n    class = Dunst\n    ignore_dbusclose = false\n\n    # A tap answers (the touchpads have no middle button). do_action runs the notification's only\n    # action, or opens the context menu when it has several; without actions it opens its one link,\n    # if it has one. The notification then closes; a menu dismissed with Escape leaves it shown.\n    mouse_left_click = do_action, close_current\n    mouse_middle_click = do_action, close_current\n    mouse_right_click = close_all\n\n[urgency_low]\n    background = \"#000000\"\n    foreground = \"#ffffff\"\n    timeout = 10\n\n[urgency_normal]\n    background = \"#000000\"\n    foreground = \"#ffffff\"\n    timeout = 10\n\n[urgency_critical]\n    background = \"#000000\"\n    foreground = \"#ffffff\"\n    frame_color = \"#ff0000\"\n    timeout = 0\n\n# What is shown once is never kept (the review of 2026-10-09): a notification marked secret (a link's\n# code, category mesh.secret) and any transient one leave no entry in the history, which\n# node-notifier.history serves to every caller of the mesh's verbs.\n[mesh-secret]\n    category = \"mesh.secret\"\n    history_ignore = yes\n\n[transient-history-ignore]\n    match_transient = yes\n    history_ignore = yes\n"
+      "template": "files/dunstrc"
    },
    {
      "id": "notifier",
@@ -91,6 +100,11 @@
        "loads": [
          "dunst-tools"
        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
      }
    ]
  },
@@ -99,11 +113,11 @@
    "started",
    "paused"
  ],
-  "contributions": [
+  "items": [
    {
-      "seat": "node-display-session",
-      "kind": "config",
-      "content": "# The notifications' key (module dunst, novox/hq ADR 0208). Owned by the mesh: replaced at every push.\n# Super+N opens the menu (rofi) of the actions and links of every notification on screen, so one is\n# chosen from the keyboard as a tap chooses it on the notification.\nbindsym $mod+n exec --no-startup-id dunstctl context\n"
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-dunst.conf"
    }
  ]
 }
@@ -0,0 +1,7 @@
+/var/log/fail2ban.log {
+    missingok
+    notifempty
+    postrotate
+      /usr/bin/fail2ban-client flushlogs >/dev/null || true
+    endscript
+}
@@ -0,0 +1,40 @@
+# Fail2Ban action: ban in both INPUT and DOCKER-USER chains
+# Used by recidive to block repeat offenders from both host and Docker services
+
+[INCLUDES]
+
+before = iptables.conf
+
+[Definition]
+
+type = allports
+
+actionstart = { <iptables> -C f2b-<name> -j <returntype> >/dev/null 2>&1; } || { <iptables> -N f2b-<name> || true; <iptables> -A f2b-<name> -j <returntype>; }
+              { <iptables> -C INPUT -p <protocol> -j f2b-<name> >/dev/null 2>&1; } || { <iptables> -I INPUT -p <protocol> -j f2b-<name>; }
+              { <iptables> -C DOCKER-USER -p <protocol> -j f2b-<name> >/dev/null 2>&1; } || { <iptables> -I DOCKER-USER -p <protocol> -j f2b-<name>; }
+
+actionstop = <iptables> -D INPUT -p <protocol> -j f2b-<name> 2>/dev/null || true
+             <iptables> -D DOCKER-USER -p <protocol> -j f2b-<name> 2>/dev/null || true
+             <iptables> -F f2b-<name>
+             <iptables> -X f2b-<name>
+
+actioncheck = <iptables> -n -L f2b-<name> >/dev/null
+
+actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+
+actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+
+[Init]
+
+chain = INPUT
+name = default
+protocol = tcp
+blocktype = REJECT --reject-with icmp-port-unreachable
+returntype = RETURN
+lockingopt = -w
+iptables = iptables <lockingopt>
+
+[Init?family=inet6]
+
+blocktype = REJECT --reject-with icmp6-port-unreachable
+iptables = ip6tables <lockingopt>
@@ -0,0 +1,48 @@
+[INCLUDES]
+
+before = paths-arch.conf
+
+[DEFAULT]
+
+# Never act on the machine itself or on a tunnel peer: the mesh's private range is
+# ${machine:mesh-range}, named here rather than written as a value the module cannot
+# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.
+# **A ban list never holds a neighbour.** The mesh's own range is named rather than written
+# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own
+# network, not the internet. On a machine behind a router that reflects local traffic, every
+# client in the house arrives as the gateway's address — so one mistyped local request banned
+# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).
+#
+# **Nor the operator's own addresses** (novox/hq ADR 0339, issue 238): the public addresses the operator names
+# as theirs, in the mesh-wide setting own-addresses. An agent polling the forge from the operator's home banned
+# that home for four weeks on 2026-10-04, and nothing in the house reached the control-node until it was found
+# among 400 bans. The file is written by this module's watch from the setting, one entry per line; fail2ban
+# reads it again within a second of a change, so a new value needs no restart. Empty until the operator
+# fills the setting. A jail that sets its own ignoreip leaves all of this out; the watch says so.
+ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10 file:/var/lib/mesh-fail2ban/own-addresses
+
+# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace
+# themselves at one try every ten minutes, under any ten-minute window; a day's window counts
+# them, and a day's ban costs a person who mistyped three times once, from one address, while
+# the mesh's own range is never banned at all.
+bantime  = 1d
+findtime = 1d
+maxretry = 3
+
+# Ban through iptables, not through a firewall front-end the machine may not have. ufw is
+# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out
+# only at ban time: the service reports healthy, the jail counts the attempt, the ban command
+# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a
+# machine the mesh reported as protected.
+#
+# The action below is this module's own, already used by the recidive jail on every machine
+# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is
+# covered too.
+banaction = iptables-allports-dualchain
+banaction_allports = iptables-allports-dualchain
+
+[sshd]
+enabled = true
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
@@ -0,0 +1,3 @@
+{
+  "own-addresses": []
+}
@@ -0,0 +1,9 @@
+[recidive]
+enabled = true
+logpath  = /var/log/fail2ban.log
+# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)
+banaction = iptables-allports-dualchain
+# Banned twice in two weeks, by any jail, is banned for four (novox/hq ADR 0179).
+bantime  = 4w
+findtime = 2w
+maxretry = 2
@@ -0,0 +1,8 @@
+[sshd]
+enabled = true
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+maxretry = 3
+findtime = 1d
+bantime  = 1d
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc`
				`@@ -0,0 +1 @@`
				`postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}`
				`@@ -0,0 +1 @@`
				`{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}}`