Nomarchy/agent/HARDWARE-QUEUE.md

# Hardware queue — V3 checks only a human can run

Everything shipped at V1/V2 whose final verification needs real hardware.
Agents **append** (newest at the bottom of a section) with exact steps;
Bernardo runs them and either checks off (`[x]` + date + verdict) or files
the failure as a NOW bug in BACKLOG.md. Checked-off entries are **pruned**
on the next sync sweep (LOOP.md §5) — outcomes live in the journal/ROADMAP;
git history is the archive. Machines: the **AMD dev box** (Ryzen AI
laptop: AMD + fingerprint + NPU), the **Latitude 5310/5410** (Intel QA),
the **T14s** (webcam case).

## Any machine (dev box is fine)

- [ ] **#96 battery-limit row on threshold-less firmware (Acer M5-481T)** —
      on the Acer (live or installed session with the commit carrying this
      entry): open System (`SUPER+CTRL+I`). **Pass:** a "Battery limit" row
      IS listed (battery present); picking it shows the notification
      explaining the firmware exposes no charge-stop control (not a raw
      error, and the row never silently disappears). On the T14s the row
      must still open the working preset picker.
- [ ] **#101 charge-limit service survives USB-C power-event bursts**
      (round 2) — round 1 FAILED on TuringMachine 2026-07-13 18:16: a
      *spaced* storm (each run finished before the next AC event) landed 5
      successful starts in 10s → `start-limit-hit`, unit marked failed,
      doctor badge — although every run succeeded. Fixed by exempting the
      unit from start rate limiting (`StartLimitIntervalSec=0`) + a
      spaced-storm guard in `checks.battery-charge-limit` (the commit
      carrying this entry). **Re-check:** after pulling/rebuilding this
      commit, `sudo systemctl reset-failed nomarchy-battery-charge-limit
      .service`, then plug/unplug the powered USB-C dock several times in
      quick succession. **Pass:** `systemctl is-failed
      nomarchy-battery-charge-limit.service` stays false, `Result=success`,
      BAT0's `charge_control_end_threshold` still matches the limit, and the
      journal has no new `start-limit-hit`/`Failed with result` lines.
- [ ] **Docking recovery round 8 (undock panel restore, 2026-07-14)** —
      round 7 **FAILED** on the AMD dev box (Bernardo, 5–6 consecutive
      unplugs, none recovered). Its whole diagnosis was wrong, and the way it
      was wrong is the lesson: round 6 read `result=enable-timeout` ×2 +
      `result=ok` ×1 as an intermittent race and retried the keyword. But the
      keyword is **inert, not raced** — with ZERO enabled outputs (panel
      disabled by the dock, external gone) Hyprland 0.55.4 accepts
      `keyword monitor` (prints `ok`, exits 0) and never flushes it until a
      DRM event arrives. Retrying an inert command 25×/poll for 6 polls just
      bought 30s of black screen. Every `result=ok` in that journal was
      **Bernardo plugging the cable back in** — his hotplug flushed the queued
      rule and the next poll took the credit. Probed live 2026-07-14: keyword
      inert across 4s and 5s in two runs, `dispatch forcerendererreload` also
      inert, and only `hyprctl reload` worked — 99ms and 289ms, cable out.
      The transition now escalates to `reload` when the keyword proves inert,
      re-asserts the rule, and restores per-device keyboard layouts (a reload
      drops runtime `device[…]:kb_layout` keywords).
      **Already proven on hardware** (2026-07-14, two real unplugs invoking
      the fixed `nomarchy-display-transition undock eDP-1` directly with the
      watcher paused): panel on and workspaces 1–3 home in 1.8s, journal
      `keyword=inert escalate=reload` → `enable=via-reload` → `result=ok`; and
      the keyboard-restore path with a Logitech K400 whose receiver is in the
      laptop — it kept its remembered `us` across the undock, while a control
      `hyprctl reload` with no restore dropped it to the session's `gb`
      (so `restore_keyboards` is load-bearing, not insurance).
      **What is NOT proven, and is this round:** the *watcher-driven* path
      (the running watcher calls the transition by baked store path, so it
      only picks the fix up at relogin — the round-5 trap), and repetition.
      **Re-check:** relogin (mandatory — see below), dock, then unplug the
      cable **at least five times**, plus once with the lid shut.
      **Pass:** the panel comes back every time with workspaces intact, and
      `journalctl --user
      -t nomarchy-display-transition -t nomarchy-display-watch --since
      '-10 min'` shows `result=ok` for each undock with **no**
      `result=enable-failed`. `keyword=inert escalate=reload` on every undock
      is EXPECTED — that is the fix firing, not a fault. A `result=ok`
      **without** a preceding `keyword=inert` line means the keyword flushed
      on its own and the reload was never needed: interesting, worth
      reporting, still a pass.
- [ ] **Headphone jack-follow (last open count from rounds 4–6,
      2026-07-14)** — rounds 4–6 opened five counts on the AMD dev box; four
      are now **confirmed fixed on hardware** by round 6 (Bernardo): wallpaper
      on the external, automatic dock mode, audio reaching the monitor, and
      the external keyboard prompting **exactly once** (was four times). The
      undock panel is round 7 above. This is the one count **never tested**:
      plugging headphones had stopped moving audio to them, because a pinned
      `default.configured.audio.sink` outranks the priority rules, which kills
      jack-follow on UCM cards where the headphones are their own sink (fixed
      in ce480f3's lineage, unverified). **Re-check:** docked and undocked,
      plug and unplug headphones — audio must move to them and back each time,
      and `journalctl --user -t nomarchy-dock-audio` must show `trigger=jack
      selected=…` on each plug. Worth folding into the round 7 session: the
      dock is already in hand and the two don't interfere.

      **Historical detail for the four settled counts** (kept only until
      round 7 closes; the fixes themselves are in the log):
      — round 4 was run on the AMD dev box and **failed on four counts**
      (Bernardo): no wallpaper on the external monitor, no automatic dock
      mode (System › Display had to be used by hand), audio staying on the
      laptop speakers while docked, and one dock + one external keyboard
      asking for a layout **four times**. Separately, plugging headphones had
      stopped moving audio to them. Causes and fixes in the commit carrying
      this entry: the display watcher's `socat -T 1` closed Hyprland's IPC
      socket after a second of idle, so a dock plugged into an idle desktop
      lost `monitoradded` in the reconnect gap (wallpaper + dock mode + audio
      all hang off that one event); Hyprland lists every key-capable evdev
      node as a "keyboard"; and a pinned `default.configured.audio.sink`
      outranks the priority rules, which kills jack-follow on UCM cards where
      the headphones are their own sink. **Re-run round 4 below in full**,
      plus: (a) leave the desktop untouched for ~30s, then plug the dock —
      wallpaper, dock mode, and audio must all follow with no manual step;
      (b) the external keyboard must prompt **exactly once**, and never for
      the monitor or the lid/power buttons; (c) docked and undocked, plug and
      unplug headphones — audio must move to them and back each time.
      `journalctl --user -t nomarchy-display-watch` should show
      `outputs-changed added=…`, and `-t nomarchy-dock-audio`
      `trigger=jack selected=…` on a headphone plug.

      **Round 5 was itself run and failed (2026-07-14); this entry now covers
      round 6.** Two of the four reports were never actually testing the fix:
      both watchers are Hyprland `exec-once`, so `nomarchy-home` swaps the
      config but leaves the *old* processes running — only `nomarchy-dock-audio`
      (a user service) had picked up new code. **Relogin is mandatory before
      testing either watcher**; confirm with `tr '\0' '\n' < /proc/$(pgrep -f
      bin/nomarchy-display-profile-watch)/cmdline | sed -n 2p` and grep the
      script for `outputs-changed`. The other two were real and are fixed in
      the commit carrying this entry: automatic dock mode did not exist at all
      (the watcher auto-*undocked* but only ever matched display profiles on
      plug, and this box has none saved with `displayProfileAuto` unset, so
      nothing happened — `Dock mode` was interactive-only), and the BenQ's
      audio was unreachable because WirePlumber had `alsa_card.pci-0000_c3_00.1`
      pinned to `pro-audio`, whose raw `pro-output-N` sinks have no ports and
      no routing. The BenQ's own USB card is input-only (all profiles
      `sinks: 0`), so DisplayPort is the only path to its speakers.
      **Also check:** no display profile is saved, yet plugging the BenQ must
      now dock by itself; and `journalctl --user -t nomarchy-dock-audio` shows
      `repaired-card=alsa_card.pci-0000_c3_00.1 profile=HiFi` on the first
      plug, after which audio reaches the monitor's speakers. A saved+matching
      display profile must still win over auto-dock.
- [ ] **Docking recovery round 4 (#100, closed-lid BenQ sequence)** — after
      updating to the commit carrying this entry, run `nomarchy-home` and
      relogin. With the lid open, put visible windows on at least workspaces
      1, 2, and 3 and start audio; plug the BenQ GW2790QT. **Pass on plug:**
      wallpaper appears, audio toasts and moves to a BenQ/GPU HDMI sink, and
      `journalctl --user -t nomarchy-dock-audio -n 10` shows
      `trigger=monitoradded` plus `selected=…` (not only a card event). Open
      System › Display › **Dock mode**. **Pass on dock:** every workspace and
      window is on the BenQ, focus follows, eDP is disabled in `hyprctl
      monitors all -j`, and `systemd-inhibit --list` shows Nomarchy holding
      `handle-lid-switch` for “Safe dock/undock display transition”; there is
      no dangling laptop workspace and no application exits. Close the lid;
      audio/session must stay awake. While still docked, manually choose the
      speakers and change volume/mute: it must stay on speakers. Unplug the
      BenQ **with the lid still closed**, wait 10 seconds, then open it.
      **Pass on undock:** no suspend/crash/hard reset, eDP is already active,
      workspaces 1/2/3 and their windows are intact on it, and the inhibitor
      disappears only after lid-open. `journalctl -b --since '-5 min'` must
      contain no cable-removal `systemd-logind: Suspending...`. Finally close
      the undocked lid normally: the laptop must suspend, proving policy was
      restored. Wake it, replug the BenQ: that fresh plug must move audio back
      to HDMI (manual speakers do not survive a physical replug). If any step
      fails, capture `journalctl --user -t nomarchy-display-watch -t
      nomarchy-display-transition -t nomarchy-dock-audio --since '-10 min'`,
      `systemd-inhibit --list`, `hyprctl monitors all -j`, `hyprctl workspaces
      -j`, and `pactl --format=json list sinks` before changing state again.
- [ ] **Parallel fingerprint-or-password on the real reader** (AMD dev
      box, 2026-07-12) — **sudo path PASSED 2026-07-14** (Bernardo, dev box,
      gen 422, `fingerprint.pam = true`, parallel default): `sudo -k true`
      showed ONE prompt, the typed password worked, touching the sensor
      instead worked, and wrong-finger ×3 fell back to password.
      **Still open:** hyprlock and the greeter must accept both factors and
      not wedge on a leftover prompt after a fingerprint win (known cosmetic
      quirk of the hack — pthread_cancel'd prompt); `fingerprint.parallel =
      false` must restore the old sequential behavior.
      **Do NOT "check password still works with `systemctl stop fprintd`"** —
      that check was in this item and it is a trap that cannot fail. fprintd
      is D-Bus activated, so PAM asks D-Bus and D-Bus starts it straight back
      up: Bernardo ran it and *the fingerprint still authenticated*, which is
      the tell that the daemon never stayed down. It proves nothing about a
      dead reader. The property it was reaching for is structural anyway —
      password is `auth sufficient` at order 11700, independent of the fprintd
      rule at 11400, so no fprintd failure can gate it (verify by eval:
      `nix eval --raw <flake>#nixosConfigurations.<host>.config.security.pam
      .services.sudo.text`), and checks.hardware-toggles asserts that shape in
      the VM with no reader at all. If someone genuinely wants it on hardware
      it needs `systemctl mask` + stop, and masking a working machine's
      authentication daemon to re-prove an evaluated invariant is a bad trade.
- [ ] **#55 fingerprint enroll on real reader** — with
      `nomarchy.hardware.fingerprint.enable` and a physical reader: System ›
      Fingerprint › Enroll a finger; List shows it; Verify succeeds.
      Enroll/List/Verify verified on hardware 2026-07-14 (T14s); the
      remaining unknown is a reader-less machine's self-gate.
- [ ] **fingerprint + auto-login toggles on hardware** (this commit) — on the
      T14s, after removing the pinning lines from `~/.nomarchy/system.nix`
      (`greeter.autoLogin`, `hardware.fingerprint.pam`):
      1. System › Fingerprint shows **Fingerprint (on)** (state already true).
         Toggle it off → terminal opens, sudo system rebuild + home switch →
         toast "Fingerprint off". Expect: sudo now refuses the finger and asks
         only for a password; the lock screen (SUPER+CTRL+L) shows no
         "or scan your finger" line. Toggle back on → both return.
      2. With fingerprint OFF and no finger enrolled, the toggle must REFUSE
         with "Enroll a finger first" and write nothing.
      3. System › Auto-login shows **(on)**. Toggle off → sudo rebuild →
         reboot → tuigreet asks, and accepts password OR finger (fingerprint
         on). Toggle back on → reboot → straight to the session, no prompt.
      Expected throughout: the two are independent, and auto-login on means
      no boot prompt regardless of the fingerprint switch.
- [ ] **#60 non-BAT* battery name (if available)** — on a machine whose
      system battery is **not** named `BAT*` (e.g. `CMB0`): confirm
      charge-limit oneshot writes the threshold, System › Battery limit
      and Power profile rows appear, Waybar power-profile module shows,
      doctor charge-limit section runs. On `BAT0`-only machines this is
      a no-op (charge-limit re-apply passed on `BAT0` — Latitude
      2026-07-10).
- [ ] **btop theme fidelity (#52 residual)** — softGL theme-shot cannot
      open Ghostty, so the hand `btop.theme` assets were only guest-file
      asserted (main_bg / inactive_fg keys) + desktop/bar rendered for
      rose-pine, everforest, summer-night, vantablack, catppuccin. On a
      real session: `nomarchy-theme-sync apply <slug>` then `btop` and
      confirm backgrounds/text match the theme (esp. rose-pine Dawn light
      bg `#faf4ed`, vantablack near-black `#0d0d0d`, catppuccin Mocha
      `#1E1E2E`). One pass cycling those five is enough.
- [ ] **SSH_AUTH_SOCK for GUI clients** — after relogin, launch a GUI git
      client (or `rofi`-launched terminal-less app) and confirm it reaches
      gpg-agent's SSH socket without an interactive shell parent.
- [ ] **Notification inhibited-state glyph** (item 28 color-only sweep,
      iteration #69) — have an app hold a notification inhibitor (e.g. run
      a fullscreen video, or `busctl --user call org.freedesktop.Notifications
      … Inhibit`); the Waybar bell must switch to the muted **bell-off** 󰂛
      (same glyph as DND), NOT the normal bell 󰂜/󰂚. Then release it → the
      bell returns. Repeat on a whole-swap bar (summer-day/night use their
      own bell-off glyph, executive-slate/boreal use 󰂛). The glyph itself
      already renders (DND uses it); this only confirms swaync emits the
      `inhibited-*` class and the bar routes it.
- [ ] **Keyboard layout cycle bind** — with a comma layout (e.g.
      `nomarchy.keyboard.layout = "us,de"`), SUPER+SHIFT+K cycles the
      focused keyboard's layout, the Waybar `󰌌` indicator follows, and
      the row shows in the SUPER+? cheatsheet. — 2026-07-04 attempt:
      no comma layout was configured, so the bind wasn't rendered (the
      gate working as designed, not a failure) — retest after setting a
      comma layout + rebuild + relogin. The SUPER+? no-op found en
      route was a real bug → BACKLOG item 26 (fix shipped; SUPER+?
      cheatsheet PASS on Latitude 2026-07-10).
- [ ] **swaync readable on summer-day** (item 25 fix) — on summer-day
      after `home-update`: `notify-send "title" "body text"` shows
      readable body text; open the control centre (SUPER+N), hover a
      notification row and check the Clear button — all text legible
      (body/buttons now @text on tinted chips, not subtext/surface).
- [ ] **Bar + rofi legible on flexoki-light** (item 27 fix) — switch to
      flexoki-light: every Waybar module readable (window title, tray
      row, dimmed inactive workspaces / muted volume visible-but-dim),
      rofi inputbar/alternate rows show text. Spot-check one dark theme
      (e.g. tokyo-night) for no visual regression in the same spots.
- [ ] **Stub-bar themes got the generated bar** (item 28, 90a5104) —
      switch to catppuccin, lumon, nord and retro-82: each now shows
      the generated styled bar in its own palette (workspace pill,
      padded right cluster) instead of the old raw default Waybar.
      Their rofi menus should look unchanged.
- [ ] **Back-audit spot-check** (item 24) — the keybinds cheatsheet
      (SUPER+? / root menu › Keybindings) now ends in ↩ Back and
      returns to the root picker; spot a couple of submenus (Display,
      VPN › Tailscale) still Back correctly after the audit pass.
- [ ] **Per-device keyboard menu + hotplug restore (re-verify after in-flake
      graduation)** — update to the current `main`, run `nomarchy-home`, and
      relogin with an external keyboard already connected. Open System ›
      Keyboard: both the built-in and external boards must be listed with
      their current layouts. Pick a different layout for the external board;
      it must apply only there and persist in `settings.keyboard.devices`.
      Unplug/replug it: the saved layout must restore without another prompt
      and graduate into a `device{}` block on the next rebuild. Finally plug
      a previously unseen keyboard in after login: the automatic picker must
      appear once and remember that choice too.
- [ ] **Snapshots restore + rollback exercise** (residual — the
      GUI/polkit half passed on hardware 2026-07-04, a47aa3a): in
      `sudo nomarchy-snapshots`, restore a single file (`undochange`)
      and walk a root-config rollback up to (or through) the
      typed-`yes` gate.
- [ ] **Rollback menu (item 9b)** — after a couple of theme changes,
      menu › System › Rollback: recent desktop generations listed
      (newest marked current); picking an older one opens a terminal,
      activates it, and the theme visibly reverts; picking the newer one
      again rolls forward. The two System rows: Snapshots opens the
      snapshot flow, "boot an older generation (how)" fires an
      instruction notification.
- [ ] **Open-a-file smoke (viewers + mime defaults, item 8)** — after
      `nomarchy-home`: from yazi/Thunar, open a PDF (→ zathura, themed to
      the palette), an image (→ imv, NOT GIMP), a video (→ mpv);
      `xdg-open .` on a directory → Thunar; a link → **Chromium**
      (`chromium-browser.desktop` — template default as of 2026-07-10).
- [ ] **Update awareness** — with `nomarchy.updates.enable`, let the timer
      fire (or start the unit): indicator appears only when inputs are
      behind, notification only on count growth, click opens the upgrade
      flow.
- [ ] **VPN menu live paths** — import a real WireGuard `.conf` and an
      `.ovpn` via System → VPN, toggle up/down (● / ○ state), and the
      Tailscale block: up/down + exit-node without sudo (operator grant).
      Exit-node rows now show "hostname — Country City" (2026-07-11,
      header-offset parsing): confirm Mullvad-style nodes carry their
      location, a locationless self-hosted node stays a bare hostname,
      and picking either still sets the node (`tailscale status` shows it).
- [ ] **Printer menu** — with `nomarchy.services.printing`, System →
      Printers opens system-config-printer; add a printer, test page.
- [ ] **GRUB UEFI ISO theme render** — boot the ISO on UEFI hardware:
      composed splash background, palette menu in the lower third, accent
      timeout bar.
- [ ] **Visual theme pass** — live ISO: all six identity themes (bars) +
      the four authored rofi `.rasi` (nord/retro-82/lumon/kanagawa) look
      right, not just parse.
- [ ] **Display profiles, slice a (item 15)** — declare two
      `nomarchy.displayProfiles` (e.g. docked disables eDP-1 + arranges
      the externals; undocked re-enables it), `home-update`, then:
      System › Display › Profiles lists them (● marks active); applying
      is instant (no rebuild) and survives a relogin (the baked
      overlay); "Base layout" restores; a menu resolution pick made
      earlier must NOT re-enable a profile-disabled panel after the
      next rebuild.
- [ ] **Display profiles workspace pins, slice c (item 15)** — give the
      docked profile `workspaces = { "1" = "<ext>"; "9" = "eDP-1"; }`:
      applying the profile moves open workspaces 1/9 to those outputs
      immediately, new visits land there too, and the pins survive a
      relogin (baked `workspace` rules). Switching to a profile without
      pins leaves workspaces where they are (stale session pins are
      expected until reload/rebuild — noted in the applier).
- [ ] **Display profiles auto-switch, slice b (item 15)** — same setup,
      then menu › Profiles › Auto-switch on: plugging the dock/monitor
      applies the matching profile within ~3s (toast names it);
      unplugging switches back; Auto-switch off stops that; with two
      profiles naming the same outputs, no flapping (ties do nothing).
- [ ] **P2 retunes eyeball (item 28b)** — spot-check on top of the P1
      entry below: gruvbox/nord/lumon/everforest/retro-82/white dimmed
      text (inactive workspaces, muted volume) now visible-but-dim;
      latte + rose-pine(dawn) + summer-day warn/battery tint reads on
      the light bases; flexoki-light statuses are the deeper canonical
      600s; latte selected-row/alt-accent pink darker. Anything that
      lost its "dim" feel → reopen 28b.
- [ ] **Retuned palettes eyeball (item 28b P1)** — switch through
      summer-day, flexoki-light, kanagawa, miasma: chips/menus/toasts
      now draw on a *raised* surface (summer-day's was slate-on-cream,
      kanagawa's near-black, miasma's pure black), secondary text
      (tooltips, fastfetch labels) is visible on summer-day +
      flexoki-light, kanagawa floats are lighter than the bg (upstream
      sumiInk4). Anything that reads worse than before → reopen 28b.
- [ ] **Doctor bar tripwire (LATER item)** — with everything healthy
      the bar shows nothing; `systemctl --user start doomed`-style
      induced failure → within ~5 min a red  appears (tooltip lists
      the ✖ lines), clicking opens the sheet in a terminal;
      reset-failed → it disappears on the next poll. Also visible on
      both summer bars.
- [ ] **OCR region (LATER item)** — Tools › Capture › "OCR region →
      clipboard": select a region with visible text → toast reports
      the word count and `wl-paste` yields the text; Esc in slurp
      cancels silently; a text-free region toasts "No text recognized"
      without clobbering the clipboard.
- [ ] **Look & Feel submenu (item 19)** — root menu: "Look & Feel"
      (replacing Theme, root still six rows) → Theme grid opens, Next
      wallpaper cycles instantly, Night light toggles (and is GONE
      from System). SUPER+T / SUPER+SHIFT+T direct binds unchanged.
- [ ] **Launch-or-focus (item 17)** — uncomment the template's
      `nomarchy.launchOrFocus` firefox example (with firefox
      installed), `home-update` + reload: SUPER+B launches firefox
      when closed, FOCUSES the existing window when open (also from
      another workspace); with firefox removed the bind fires a
      "not installed" toast; the row shows under SUPER+?.
- [ ] **Themed greeter + console (item 16)** — after `sys-rebuild` +
      logout: tuigreet renders in theme colors (dark container, accent
      border, themed prompt/time) and a raw tty (CTRL+ALT+F2) shows the
      theme's ANSI palette; on a LUKS machine the passphrase prompt
      follows too. Then switch theme + `sys-rebuild` + logout → the
      greeter follows the new palette. (tuigreet can't run under the
      VM harness — see MEMORY.md — so rendering is hardware-tier.)
- [ ] **Color picker (item 13, final slice)** — SUPER+CTRL+P (or Tools ›
      Color picker): hyprpicker's zoom loupe appears; click a pixel →
      toast shows the hex and `wl-paste` yields it; Esc cancels with no
      toast. Row present in the SUPER+? cheatsheet.
- [ ] **Low-battery toasts (item 13 slice)** — on battery, drain past
      25%: one "Battery low" toast; past 10%: a critical "Battery
      critical" toast that stays up until dismissed (swaync); plug in,
      drain again → it re-notifies; no repeat toasts while it just keeps
      draining. (Crossing logic VM-verified — this checks the real
      swaync rendering in a session.)

- [ ] **Audio opens in Amberol** (iteration #60, item 37) — after
      `nomarchy-home`: double-click an mp3/flac/ogg (or `xdg-open song.mp3`)
      → it opens in Amberol, not mpv; video files still open in mpv.
      (`xdg-mime query default audio/mpeg` → io.bassi.Amberol.desktop.)
- [ ] **rofi menu polish** (iteration #58, item 39 + #56/#57 34/40) —
      after `nomarchy-home`: (a) menu › System › Power profile shows a
      colored icon per profile (performance/balanced/power-saver), not
      just text — icons *render* (not blank); (b) every submenu's ↩ Back
      shows a single arrow, no double; (c) on this single-monitor box,
      System › Display → pick a resolution → Back returns to System
      (not back into the same resolution list).
- [ ] **Screenshot annotation (satty)** (iteration #73) — after `nomarchy-home`:
      hit SUPER+SHIFT+Print (or Tools ▸ Capture ▸ Annotate region) → a region
      select (slurp) appears, then the `satty` UI opens in fullscreen with the
      screenshot loaded. Check that the UI draws on the current theme palette
      (tools colored properly) and hitting save places the screenshot in
      `~/Pictures/Screenshots/` while hitting copy places it in the clipboard.
- [ ] **#76 no-swap Hibernate notify** (#76 itself is closed — the
      hibernate→resume power-cycle **PASSED on TuringMachine 2026-07-12**:
      Bernardo ran the full hibernate → power off → single LUKS unlock →
      session-restored cycle "flawlessly"; this notify check is the one
      remaining leftover) — on a **Nomarchy** machine installed
      with `swap = 0` (or temporarily `sudo swapoff -a` on one): `nomarchy-menu
      → Power → Hibernate` must surface a desktop notification ("Couldn't
      hibernate — likely no swap is configured. See docs/MIGRATION.md →
      Enabling hibernation."), **not** a silent no-op. (`swapon` after, if you
      swapoff'd for the test.)
- [ ] **Night-light geo mode (2026-07-11)** — in `home.nix` set
      `nomarchy.nightlight = { enable = true; latitude = "<lat>";
      longitude = "<long>"; }` (your real coordinates), `nomarchy-home`,
      relogin. Then: `systemctl --user status wlsunset` is running (and
      `hyprsunset` is NOT); after local sunset the screen visibly warms
      (or test by setting coordinates where it's currently night); the
      Waybar moon + menu toggle still flip it instantly and an *off*
      survives relogin (the ExecCondition gate on the swapped unit —
      the eval check proves the wiring, not the runtime gate). **Pass** =
      warm shift at the location's night + toggle/persistence intact.

## AMD dev box only
- [ ] **AMD runtime bits** — VA-API (`vainfo` → radeonsi), amd-pstate EPP
      active and PPD switching governors; opt-ins: ROCm (`rocminfo`, a GPU
      PyTorch/Ollama smoke) and the XDNA NPU driver loading.
- [ ] **Fingerprint** — `fprintd-enroll` + (opt-in PAM) login/sudo.
- [ ] **System ▸ Firmware menu on real LVFS hardware** (item #43,
      `nomarchy-menu firmware`) — on a machine whose firmware/SSD/dock is
      on LVFS: open Menu ▸ System ▸ **Firmware**; confirm the terminal runs
      `fwupdmgr refresh` → lists real `get-updates` → the y/N confirm gates
      correctly → `fwupdmgr update` applies and prints the reboot note when a
      capsule needs one. Verify **no** flash happens on "N"/cancel. (VM only
      proves the menu row + flow renders; a real capsule write is
      hardware-only.)

## Latitude 5310 / 5410 only
- [ ] **v1 QA batch on-hardware pass** (583708d batch was QEMU-verified) —
      general smoke before the next `main → v1` promotion (broader than
      the 2026-07-10 session; include theme/ISO/greeter leftovers).

## T14s only
- [ ] **Webcam IR-hide end-to-end on Nomarchy** — installer detects the
      RGB+IR pair, bakes `hardware.camera.hideIrSensor`; `wpctl status`
      shows one colour source; an app picker lists one camera; Howdy-style
      direct `/dev/video2` reads still work.
- [ ] **Portal/Flatpak libcamera IR (b)/(c)** — after #71 docs: on hardware,
      confirm a Flatpak/portal picker still lists the internal IR node;
      only then investigate (b) WirePlumber libcamera GREY-only monitor
      rule or (c) libcamera/udev-layer hide. Do not ship either without a
      live dual-sensor check (see HARDWARE.md §7 / ROADMAP § Webcam).