Merge remote-tracking branch 'origin/main' into main

agent/BACKLOG.md

@@ -93,18 +93,11 @@ high-ROI, etc.) live in the journal + ROADMAP — not here.*
   fixture. Control-center / MOTD already mention these; the gap is the
   silent first *graphical* session for people who never open those.
 
-- **Fingerprint *or* password, in parallel** (2026-07-11, Bernardo) —
-  `fingerprint.pam` gives pam_fprintd's sequential UX: sudo waits on
-  the reader, password only after failure/timeout. Bernardo wants
-  either factor accepted at the same prompt (type the password *or*
-  touch the sensor, whichever comes first). Stock PAM can't express
-  this; needs a parallel-conversation module (e.g. `pam-any`, not in
-  nixpkgs — would be a new package + `fingerprint.pam = "any"` mode).
-  Cost: medium (package + PAM wiring + careful lockout testing on real
-  hardware). Security note: keep sudo fallback sane if fprintd hangs.
-
 _(#80–#83 + #85–#88 shipped 2026-07-11. Theme A day-2 + neon-glass finish
-  shipped — VISION ✓. Dock/hibernate V3 → HARDWARE-QUEUE.)_
+  shipped — VISION ✓. Dock/hibernate V3 → HARDWARE-QUEUE. Parallel
+  fingerprint-or-password shipped 2026-07-12 (Bernardo promoted it live;
+  `fingerprint.parallel`, pam-fprint-grosshack) — reader V3 →
+  HARDWARE-QUEUE.)_
 
 ### v1.0 pointer