fix(session): recover user services after a broken logout teardown

2026-07-18 dev-box incident: on a warm relogin (user manager kept alive
by the tty1 greetd session — no linger involved) the previous logout's
graphical-session.target stop had been rejected as a destructive
transaction (easyeffects held a queued start job), so the target stayed
active across the logout. Its WantedBy services (cliphist, swaync,
xdg-desktop-portal-*, swayosd, …) crash-looped against the dead Wayland
socket into start-limit-hit, and the next login's plain
'start hyprland-session.target' was a no-op — every session service
stayed failed, doctor red, until a reboot.

Session bring-up (HM's systemd.extraCommands, rendered into the first
exec-once) now stops both hyprland-session.target and a possibly-stale
graphical-session.target, clears failed/start-limit state with
reset-failed, then starts fresh. All three commands are no-ops after a
clean logout or cold boot.

Verified V1: home generation built against this tree renders the new
command chain into hyprland.conf line 1 (nix build of
homeConfigurations.bernardo with the nomarchy input overridden).
V3 pending: warm relogin on hardware — queued in HARDWARE-QUEUE with
exact steps; BACKLOG #149 updated with the incident evidence (the
exec-once posture it watches is defending against a real race).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -205,6 +205,18 @@ defending against nothing. Do not rip it out on this note alone: it works, and
 the claim needs a real relogin without linger to test (V3 — the same relogin
 that verifies #148's watcher fix would answer it).
 
+**2026-07-18 evidence: the warm relogin is real post-linger.** On the dev
+box the user manager survived a Hyprland logout (the tty1 greetd session
+keeps it alive — no linger involved) and the teardown broke:
+`graphical-session.target`'s stop transaction was rejected as destructive
+(easyeffects had a queued start job), the target stayed active,
+cliphist/swaync/portals/swayosd crash-looped against the dead Wayland
+socket into `start-limit-hit`, and the relogin's plain `start` was a no-op
+— doctor red for the whole session. Session bring-up now stops stale
+targets + `reset-failed` before starting (`hyprland.nix`
+systemd.extraCommands); relogin V3 check queued in HARDWARE-QUEUE. The
+exec-once posture this entry watches is therefore still earning its keep.
+
 ### 120. A netinstall ISO, next to the fat offline one
 
 **Deferred to PROPOSED 2026-07-16 (Bernardo): not now.** Nothing below is

agent/HARDWARE-QUEUE.md

@@ -517,6 +517,16 @@ Everything else below stays open; order is convenience, not a gate.
       `~/.nomarchy/flake.nix` has `?ref=main` (not lagging v1). **Pass:**
       `nomarchy-rebuild` does not die with
       `The option 'nomarchy.hardware' does not exist`.
+- [ ] **Relogin session recovery (2026-07-18 incident)** — after pulling
+      the session-recovery commit and rebuilding: from a full Hyprland
+      session (bar up, a browser open so easyeffects/tray are busy), log
+      out (SUPER+SHIFT+E) and log straight back in at the greeter — do
+      **not** reboot between. **Pass:** `nomarchy-doctor` shows *no failed
+      user units*; `systemctl --user status cliphist swaync
+      xdg-desktop-portal-hyprland swayosd` are all `active (running)`; the
+      bar, notifications, and clipboard history (SUPER+V) work. This is
+      the V3 close for the stale `graphical-session.target` /
+      `start-limit-hit` relogin breakage (BACKLOG #149 note).
 
 ## AMD dev box only
 - [ ] **#118 smartd still runs where drives DO have SMART** (this commit) — the

modules/home/hyprland.nix

@@ -970,6 +970,24 @@ in
     # (Hyprland then boots into emergency mode with no binds).
     configType = "hyprlang";
 
+    # Session bring-up (HM renders these into the first exec-once, after
+    # its dbus-update-activation-environment). The default is just
+    # stop/start of hyprland-session.target — not enough after a broken
+    # logout: if the graphical-session.target *stop* transaction was
+    # rejected mid-teardown (seen 2026-07-18: "transaction is destructive"
+    # while easyeffects had a queued start job), the target stays active
+    # across the logout, its services crash-loop against the dead Wayland
+    # socket into start-limit-hit, and the next login's plain `start` is a
+    # no-op — cliphist/swaync/portals stay failed for the whole session
+    # (doctor all red). So: tear the stale targets down, clear
+    # failed/start-limit state, then start fresh. All three are no-ops
+    # after a clean logout or cold boot.
+    systemd.extraCommands = [
+      "systemctl --user stop hyprland-session.target graphical-session.target"
+      "systemctl --user reset-failed"
+      "systemctl --user start hyprland-session.target"
+    ];
+
     settings = {
       "$mod" = "SUPER";
       "$terminal" = config.nomarchy.terminal;