feat(power): suspend-then-hibernate 1h on battery (#115)

Human decision: 1h delay, battery only, Preferences enable/disable.
Wire systemd suspend-then-hibernate + HibernateDelaySec=1h +
HibernateOnACPower=false when settings.power.suspendThenHibernate is on
and boot.resumeDevice is set. Lid: s2h undocked, plain suspend on AC.
nomarchy-suspend for hypridle + Power menu (live state). LUKS unlock
before encrypted hibernate so s2h→disk is not double-password.
state-bridges assert the policy; HARDWARE-QUEUE #115 + suggested order.

V1: nix flake check --no-build. V3: bag-carry on hardware.

modules/nixos/default.nix

@@ -226,6 +226,13 @@ in
     # system unit hooked to the sleep targets: it locks on the RAM-resume
     # sleeps always, and on hibernate only when the disk is unencrypted (no
     # LUKS gate to rely on). Replaces hypridle's old before_sleep_cmd.
+    #
+    # #115 suspend-then-hibernate: the first phase is RAM-resume (lock),
+    # then after HibernateDelaySec systemd enters pure hibernate. Without
+    # an unlock before that second phase, an encrypted resume would demand
+    # LUKS *and* still-locked hyprlock. Drop the session lock immediately
+    # before encrypted hibernate — LUKS is the gate; unencrypted still
+    # locks via the unit below on hibernate.target.
     systemd.services.nomarchy-lock-before-sleep =
       let
         encrypted = builtins.attrNames config.boot.initrd.luks.devices != [ ];
@@ -244,6 +251,20 @@ in
         };
       };
 
+    systemd.services.nomarchy-unlock-before-encrypted-hibernate =
+      let encrypted = builtins.attrNames config.boot.initrd.luks.devices != [ ];
+      in lib.mkIf encrypted {
+        description = "Unlock session before encrypted hibernate (LUKS is the resume gate)";
+        before = [ "systemd-hibernate.service" ];
+        wantedBy = [ "hibernate.target" ];
+        # After lock-before-sleep on the s2h RAM phase; before the image.
+        after = [ "nomarchy-lock-before-sleep.service" ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${config.systemd.package}/bin/loginctl unlock-sessions";
+        };
+      };
+
     # zsh as the default login shell (the desktop's shell experience —
     # starship/bat/eza/zoxide — is configured home-side in shell.nix).
     # programs.zsh.enable wires /etc/zshrc, completion and /etc/shells;

modules/nixos/options.nix

@@ -143,6 +143,26 @@
           Needs nomarchy.system.power.laptop.
         '';
       };
+
+      # #115: suspend → hibernate after 1h on battery. Default true so a
+      # bag-carried laptop stops draining without a menu trip; Preferences
+      # flips settings.power.suspendThenHibernate (state bridge). No-op
+      # when boot.resumeDevice is unset (no hibernate path).
+      suspendThenHibernate = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        defaultText = lib.literalExpression
+          "(settings.power.suspendThenHibernate from state.json) or true";
+        description = ''
+          When true and hibernation is wired (boot.resumeDevice), idle and
+          undocked lid-close use systemd suspend-then-hibernate on battery:
+          sleep, then hibernate after HibernateDelaySec (1 hour). On AC,
+          plain suspend only (HibernateOnACPower=false; lid uses
+          HandleLidSwitchExternalPower=suspend). Toggle from System ›
+          Preferences › Suspend then hibernate — needs a system rebuild for
+          logind; nomarchy-suspend reads the live state for menu/hypridle.
+        '';
+      };
     };
   };
 }

modules/nixos/power.nix

@@ -1,16 +1,33 @@
 # Active power management. One concern, one file: this is the system
 # side — the power daemon (power-profiles-daemon by default, or TLP),
-# thermald, and the battery charge limit. The profile *switcher* and the
-# Waybar *indicator* live home-side (rofi.nix / waybar.nix); they self-
-# gate on powerprofilesctl being present, so there's no system→home wiring
-# to keep in sync (the same way the Waybar battery widget auto-hides on
-# desktops). See the roadmap in README.md.
+# thermald, the battery charge limit, and suspend-then-hibernate (#115).
+# The profile *switcher* and the Waybar *indicator* live home-side
+# (rofi.nix / waybar.nix); they self-gate on powerprofilesctl being
+# present, so there's no system→home wiring to keep in sync (the same
+# way the Waybar battery widget auto-hides on desktops). See the
+# roadmap in README.md.
 { config, lib, pkgs, ... }:
 
 let
   cfg = config.nomarchy.system.power;
+  sysCfg = config.nomarchy.system;
   ppd = cfg.backend == "ppd";
   tlp = cfg.backend == "tlp";
+
+  # settings.power.suspendThenHibernate → this option (ROADMAP § state
+  # bridges #116). null = key absent → leave option default (true).
+  sysState =
+    if sysCfg.stateFile != null
+    then import ../state-read.nix { inherit lib; } sysCfg.stateFile
+    else { };
+  stateS2h =
+    let v = ((sysState.settings or { }).power or { }).suspendThenHibernate or null;
+    in if builtins.isBool v then v else null;
+
+  # Hibernate needs a resume device (installer swapfile / partition).
+  # Without it, offering s2h only produces a suspend that never wakes.
+  canHibernate = (config.boot.resumeDevice or "") != "";
+  s2hActive = cfg.suspendThenHibernate && canHibernate;
 in
 {
   config = lib.mkIf cfg.enable {
@@ -31,18 +48,36 @@ in
     services.power-profiles-daemon.enable = lib.mkDefault ppd;
     services.tlp.enable = lib.mkDefault tlp;
 
+    # State bridge (#115 / #116): menu writes settings.power.suspendThenHibernate.
+    nomarchy.system.power.suspendThenHibernate =
+      lib.mkIf (stateS2h != null) (lib.mkDefault stateS2h);
+
+    # Smart suspend helper (hypridle + Power menu). Live state read.
+    environment.systemPackages = [ pkgs.nomarchy-suspend ];
+
     # Clamshell / dock (BACKLOG #86): when the machine is "docked" in
     # logind's sense (≥1 external display connected), closing the lid
     # must NOT suspend — the external panel is the session. systemd's
     # built-in default is already ignore; we set it explicitly so a
     # downstream override or lock-bump drift is visible, and so
     # checks.clamshell-logind can assert the contract.
-    # Lid alone (undocked) keeps the normal suspend path
-    # (HandleLidSwitch / ExternalPower left to upstream defaults).
-    # Display-profile "docked" layouts (eDP off) are orthogonal and
-    # already handled by nomarchy.displayProfiles.
+    # #115: undocked lid on battery → suspend-then-hibernate when the
+    # toggle is on and resume is wired; on AC → plain suspend so a
+    # docked-at-desk lid-close doesn't plan a hibernate. Display-profile
+    # "docked" layouts (eDP off) are orthogonal (nomarchy.displayProfiles).
     services.logind.settings.Login = {
       HandleLidSwitchDocked = lib.mkDefault "ignore";
+    } // lib.optionalAttrs s2hActive {
+      HandleLidSwitch = lib.mkDefault "suspend-then-hibernate";
+      HandleLidSwitchExternalPower = lib.mkDefault "suspend";
+    };
+
+    # 1h in suspend then hibernate; never start the countdown on AC
+    # (systemd ≥257 HibernateOnACPower). Only matters when something
+    # actually enters suspend-then-hibernate.
+    systemd.sleep.settings.Sleep = lib.mkIf s2hActive {
+      HibernateDelaySec = "1h";
+      HibernateOnACPower = false;
     };
 
     # thermald is Intel-only, so off unless asked (the installer enables