fix(audio): #138 — reprobe escalates to a graph restart, never opens with one

Bernardo's Meet calls lost their microphone because our own dock-audio
reprobe restarted PipeWire/Pulse/WirePlumber on every monitoradded (#100).
Chromium's audio service does not reconnect when the server disappears
under it, so it kept running and enumerated nothing; Zoom, started fresh
into a settled graph, looked fine and made it read like a browser bug.

reprobe now escalates cheapest-first — select → repair a parked card's
profile → restart the graph — so an ordinary plug never touches the graph
and no client loses its connection. wait_for_dock_sink polls for the sink
the plug is about to publish, so "not yet" is not mistaken for "not ever"
and cannot fall through to the restart. The restart stays as rung 3 for
the codec that only publishes its route after a re-probe: the one claim
the original comment made, and the only one it never demonstrated.

Verified on the dev box against the live graph: rung 1 selects the same
sink the restart-first path picked (HiFi__HDMI1__sink) in 2.0s instead of
~3.5s with pipewire/pulse/wireplumber MainPIDs unchanged; rung 3 reachable
and restarts+retries. Diagnosis proof was ordering across four boots —
restart-after-Chromium in both broken sessions, 24s before it in the
healthy one — and Bernardo reproduced on demand with a dock/undock.

Sweep: BACKLOG #138 deleted, ROADMAP gets the design record (incl. the
stale restart-first sentence in the #100 entry), V3 queued on the dev box
(relogin first — the watcher is exec-once), journal entry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -19,6 +19,38 @@ Template:
 
 ---
 
+## 2026-07-16 — #138 dock audio: the graph restart was the bug (44aac0f + this)
+- **Task:** #138 — Meet "no mic or speakers" in Chromium; Zoom fine; no repro
+  on a fresh boot. Bernardo's hypothesis (pipewire restarts → Chromium never
+  reconnects) was right; the restarter turned out to be **us**.
+- **Did:** `dock-audio.nix` `reprobe` restarted PipeWire/Pulse/WirePlumber on
+  every `monitoradded` (#100). Now escalates cheapest-first: select → repair a
+  parked card → restart. Added `wait_for_dock_sink` so a slow sink is not read
+  as "nothing to select" and cannot fall through to the restart. Filed #137/
+  #139/#140/#141 from the same T14s round in 44aac0f.
+- **Verified:** V0 `nix flake check --no-build`. **V2/V3 on the dev box** (real
+  hardware, real graph): built the HM activation package with
+  `--override-input nomarchy path:…` and ran the real tool — rung 1 selects the
+  *same* sink the restart-first path picked (`selected=…HiFi__HDMI1__sink`) in
+  2.0s vs ~3.5s, with pipewire/pulse/wireplumber MainPIDs **unchanged**; rung 3
+  is reachable and restarts+retries as designed. Diagnosis proof: `Started
+  app-org.chromium.Chromium-*.scope` vs `reprobe-start` across 4 boots —
+  restart-after-Chromium in both broken sessions, 24s *before* in the healthy
+  one; Bernardo then reproduced on demand with a dock/undock (09:35:30).
+- **Pending:** V3 queued (dev box): real plug with Chromium open on Meet —
+  **relogin first**, the watcher is `exec-once` (round 6's lesson). Bernardo
+  must `nomarchy-home` to pick this up; his Chromium needs one restart to
+  regain audio (his own 09:35 test killed it, not the fix).
+- **Process note (mine, worth not repeating):** the rung-3 test was meant to be
+  safe via a stubbed `systemctl`, but the `sed` anchored on leading whitespace
+  that **Nix's indented strings strip**, so the stub never applied and the run
+  restarted his live graph for real. It came back clean (services active, dock
+  sink still default) and cost nothing extra only because Chromium was already
+  broken. Lesson: when a test's safety depends on a substitution, **assert the
+  substitution landed** before running the thing it protects you from.
+- **Next suggestion:** #139 (terminal floats — two faults, both root-caused and
+  cheap) or #141 (4 jsonc lines, `$TERMINAL` absent from Waybar's env).
+
 ## 2026-07-15 — #107 upgrade path proven; state-read tip fixed
 - **Task:** Bernardo feared rebuilding on the state.json rename ("what if it
   doesn't boot"). Verify the real upgrade path from a legacy checkout.