Merge remote-tracking branch 'origin/main'

2026-05-29 10:03:30 +00:00
parent 31ce514ef9 81bd7b3708
commit 95071ba274
46 changed files with 3909 additions and 3 deletions
@@ -0,0 +1,136 @@
 ---
 title: Arr Stack — Kraken
 created: '2026-05-23'
 updated: '2026-05-27'
 type: tech
 namespace: family
 tags: [arr, radarr, sonarr, prowlarr, transmission, jellyfin, infra, kraken]
 related:
  - "[[tech/jellyfin-config]]"
  - "[[tech/arr-stack-taiga]]"
  - "[[concepts/kraken-media-stack]]"
 ---
 # Arr Stack — Kraken
 ## Pipeline
 ```
 Prowlarr → Radarr + Sonarr → Transmission → Jellyfin
                                   ↓
                            router.py (cron 10min)
                                   ↓
                      symlinks → /media/{movies,cartoons,series,documentaries,...}/
 ```
 Два параллельных пути поступления контента:
 1. **Radarr/Sonarr** → качают в `/media/movies-radarr/` и `/media/series-sonarr/`
 2. **Transmission (ручные торренты)** → `on-download-complete.sh` → `sync.py` → `/media/{movies,cartoons,...}/`
 ### router.py — жанровая маршрутизация
 `router.py` читает NFO-файлы (которые Radarr/Sonarr создают при загрузке), определяет жанр и возрастной рейтинг, и создаёт symlink в нужную Jellyfin-библиотеку:
 | Источник | Условие | Цель |
 |---|---|---|
 | movies-radarr/ | Documentary | `/media/documentaries/` |
 | movies-radarr/ | Animation + !R/18+ | `/media/cartoons/` |
 | movies-radarr/ | всё остальное | `/media/movies/` |
 | series-sonarr/ | Documentary | `/media/documentaries-series/` |
 | series-sonarr/ | Animation + !TV-MA | `/media/cartoons-series/` |
 | series-sonarr/ | всё остальное | `/media/series/` |
 **Расположение:** `/srv/dev-disk-by-uuid-49e8f586-3839-4c5d-a1e1-58bfc3579ade/docker/media-pipeline/router.py`
 **Запуск:** `python3 router.py --dry-run` (проверка) / `python3 router.py --apply` (исполнение)
 ### media-router.sh — cron-скрипт для Telegram-уведомлений
 Обёртка над `router.py`, которая:
 - запускает `router.py --apply`
 - если `Nothing to do` — **SILENT**, ничего не шлёт
 - если созданы symlink'и или ошибка — отправляет отчёт в Telegram Kraken
 **Расположение:** рядом с `router.py` — `media-router.sh`
 **Cron (Kraken crontab):** каждые 10 минут
 **Telegram:** kraken_htpc_bot → чат @mallex87
 ### sync.py — обработка ручных торрентов (Transmission)
 `sync.py` работает внутри Transmission-контейнера. При завершении загрузки:
 1. Определяет название через TMDB API
 2. Определяет жанр
 3. Перемещает файл в `/media/{movies,cartoons,series,documentaries}/`
 4. Обновляет `downloadDir` в Transmission через RPC
 **Расположение:** `/srv/.../docker/media-pipeline/sync.py`
 **Триггер:** `on-download-complete.sh` (смонтирован в Transmission как `/config/on-download-complete.sh:ro`)
 ## Transmission
 - **download-dir:** `/downloads` (без `complete`)
 - **incomplete-dir:** `/downloads/incomplete`
 - **Язык:** отключён auth для локальных
 - **RPC:** `localhost:9091`
 При перемещении файлов для уже завершённых торрентов:
 1. Переименовать файл/папку под кейс торрента (Linux ext4 case-sensitive)
 2. Вызвать `torrent-set-location` с `move=false`
 3. Запустить торрент на сидирование
 ## Cron'ы на Kraken (crontab)
 ```
 0  *  * * *  bash ~/scripts/sync-vault.sh                     # Obsidian sync
 0  *  * * *  pgs-to-srt.sh /media/downloads                   # PGS→SRT новые
 0  3  * * *  pgs-to-srt.sh /media                              # PGS→SRT вся библиотека
 0  1  * * *  bash ~/scripts/watchlist-nightly.sh               # watchlist nightly
 0  9  * * 0  bash ~/scripts/watchlist-discover.sh              # watchlist discover
 */10 * * * * bash .../media-pipeline/media-router.sh           # media router (Telegram)
 ```
 ## API Keys
 | Service     | API Key              |
 |-------------|----------------------|
 | Radarr      | `cbcb8ec3...`        |
 | Sonarr      | `15fbec32...`        |
 | Prowlarr    | `134ac38a...`        |
 (Full keys truncated — retrieve from each service's settings page.)
 ## Ports (default Docker network)
 All services accessible at `kraken:<port>`:
 | Service      | Port |
 |--------------|------|
 | Radarr       | 7878 |
 | Sonarr       | 8989 |
 | Prowlarr     | 9696 |
 | Transmission | 9091 |
 | Jellyfin     | 8096 |
 ## Jellyfin библиотеки
 | Библиотека | Тип | Путь |
 |---|---|---|
 | Movies | movies | `/media/movies` |
 | Series | tvshows | `/media/series` |
 | Cartoons | movies | `/media/cartoons` |
 | Cartoon Series | tvshows | `/media/cartoons-series` |
 | Documentaries | movies | `/media/documentaries` |
 | Documentary Series | tvshows | `/media/documentaries-series` |
 > `movies-radarr` и `series-sonarr` НЕ добавлены в Jellyfin — router.py создаёт symlink'и из них в перечисленные пути.
 ## Известные проблемы
 - **17 фильмов в Radarr `hasFile=False`** — ждут подходящего релиза в Prowlarr. Scream (1996) в процессе загрузки.
 - **Prowlarr** — если долго не находит релизы, проверить статус индексеров (`/api/v1/health`).
 ## Notes
 - See [[arr-stack-taiga]] for Taiga (secondary) arr stack
 - Media pipeline pitfalls: [[media-pipeline-pitfalls]]
 - Синтез: [[concepts/kraken-media-stack]]
@@ -0,0 +1,31 @@
 ---
 title: Arr Stack — Taiga
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: family
 tags: [arr, taiga, infra, media, pitfalls]
 related:
  - "[[tech/arr-stack-kraken]]"
 ---
 # Arr Stack — Taiga
 Secondary arr stack on Taiga (TrueNAS), added 2026-05-20.
 ## Notes from Setup (2026-05-20)
 - Config and pitfalls recorded during initial Taiga arr stack deployment
 - `router.py` was customized — check `/mnt/RED_2TB/docker/arr-taiga/router.py`
  for current state
 ## Key Differences from Kraken Stack
 - Taiga = TrueNAS host (storage-focused)
 - Kraken = Raspberry Pi 5 (playback-focused)
 - Taiga stack handles acquisition; Kraken handles serving to Jellyfin
 ## Pitfalls
 (Details were referenced but not captured. Update this page after next
 Taiga arr maintenance session.)
@@ -0,0 +1,27 @@
 ---
 title: Gitea Config
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: personal
 tags: [infra, gitea, git, credentials]
 related:
  - "[[tech/kraken-network]]"
 ---
 # Gitea Config
 **URL:** `http://git.mallexxx.duckdns.org` (external) / `http://172.16.3.4:3000` (internal LAN)
 **User:** `git_admin`
 ## API Token
 Token name: `eagle-reflect`
 Token value: `f2e679a571f4c599d64b384a711043f995fd8844`
 Used by Eagle for repo operations (push, PR creation, hook management).
 ## Notes
 - External URL uses DuckDNS DDNS pointing to home IP
 - Internal API endpoint preferred when on home network
@@ -0,0 +1,37 @@
 ---
 title: Hermes Docker on Kraken
 created: '2026-05-23'
 updated: '2026-05-29'
 type: tech
 namespace: personal
 tags: [hermes, docker, kraken, infra, how-to]
 related:
  - "[[tech/kraken-network]]"
  - "[[concepts/hermes-deployment-patterns]]"
  - "[[tech/hermes-kraken-api]]"
 ---
 # Hermes Docker on Kraken
 ## Key Rule
 Hermes runs via **`docker run`**, NOT `docker compose`. No compose file.
 ## Launch Pattern
 ```bash
 docker run -d \
  --name hermes \
  --restart unless-stopped \
  -v ~/.hermes:/root/.hermes \
  ... \
  hermes-image:tag
 ```
 (Add actual flags from the running container: `docker inspect hermes`)
 ## Notes
 - Using `docker run` keeps restart behavior explicit
 - No compose means no accidental `docker compose down` wipes it
 - Config/memory volume: `~/.hermes` on Kraken host
@@ -0,0 +1,229 @@
 ---
 title: Hermes на Eagle (Mac M4 Max) — Настройка и подводные камни
 type: reference
 namespace: work
 tags:
  - hermes
  - mac
  - eagle
  - claude-proxy
  - zulip
  - pitfalls
 created: '2026-05-21'
 updated: '2026-05-22'
 last_synced: '2026-05-22'
 confidence: 0.9
 ---
 # Hermes на Eagle (Mac M4 Max) — Настройка и подводные камни
 Hermes работает нативно (не в Docker) на Mac через `hermes gateway`.
 Транспорт — Zulip (запущен в Docker). Провайдер модели — openclaw-claude-proxy
 (см. ниже).
 ## Компоненты
 | Компонент | Расположение | Запуск |
 |-----------|-------------|--------|
 | Hermes config | `~/.hermes/config.yaml` | — |
 | claude-proxy (Claude proxy) | `/opt/homebrew/bin/claude-proxy` | launchd `ai.claude-proxy` |
 | Zulip stack | `~/Developer/zulip/docker-compose.yml` | `docker compose up -d` |
 | Obsidian MCP | mcpvault | встроен в Hermes toolset |
 ---
 ## openclaw-claude-proxy — обход rate limit Claude API
 ### Проблема
 `provider: claude-code` в Hermes использует OAuth-токен напрямую через
 API Anthropic — и упирается в rate limit подписки. Лимиты сбрасываются
 раз в час. API-ключа нет (политика организации).
 ### Почему не cmappy
 cmappy (`claude-max-proxy-py`) молча выбрасывает поле `tools` из запроса —
 передаёт только текст в `claude --print`. Результат: Hermes не может
 использовать **ни один инструмент** (скиллы, MCP, терминал). Только голый
 чат.
 ### Решение: openclaw-claude-proxy
 [mehdic/claude-proxy](https://github.com/mehdic/claude-proxy) (npm:
 `openclaw-claude-proxy`) — Node.js сервер, запускает `claude --print` как
 subprocess и предоставляет OpenAI-совместимый `/v1/chat/completions` на
 порту 3456. **Поддерживает tool_use** — инжектирует схемы инструментов в
 системный промпт, парсит JSON tool_call из ответа, возвращает стандартный
 OpenAI `tool_calls`. Caller (Hermes) сам выполняет инструменты.
 **Важно:** `CLAUDE_PROXY_TOOLS_TRANSLATION=1` НЕ включать — этот режим
 выполняет MCP инструменты внутри CLI и Hermes ничего не получает.
 ### Установка
 ```bash
 npm install -g openclaw-claude-proxy
 ```
 ### Wrapper-скрипт (обязателен для launchd)
 `~/.local/bin/claude-proxy-start.sh`:
 ```bash
 #!/bin/zsh
 # launchd не наследует среду login-сессии — токен нужно загружать явно
 set -a
 source /Users/admin/.hermes/.env 2>/dev/null
 set +a
 export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$PATH"
 exec /opt/homebrew/bin/claude-proxy 3456
 ```
 **Pitfall:** без явного `source ~/.hermes/.env` claude-proxy не видит
 `CLAUDE_CODE_OAUTH_TOKEN` и прогревочные процессы падают с "Not logged in".
 **Pitfall:** без явного PATH Claude CLI не найден (`/opt/homebrew/bin/claude`
 не в launchd PATH).
 ### launchd сервис
 `~/Library/LaunchAgents/ai.claude-proxy.plist`:
 ```xml
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
    <key>Label</key><string>ai.claude-proxy</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Users/admin/.local/bin/claude-proxy-start.sh</string>
    </array>
    <key>EnvironmentVariables</key>
    <dict>
        <key>HOME</key><string>/Users/admin</string>
    </dict>
    <key>RunAtLoad</key><true/>
    <key>KeepAlive</key><true/>
    <key>StandardOutPath</key>
    <string>/Users/admin/.hermes/logs/claude-proxy.log</string>
    <key>StandardErrorPath</key>
    <string>/Users/admin/.hermes/logs/claude-proxy.log</string>
 </dict>
 </plist>
 ```
 ```bash
 launchctl load ~/Library/LaunchAgents/ai.claude-proxy.plist
 ```
 **Pitfall при перезагрузке:** если старый процесс ещё держит порт 3456:
 ```bash
 lsof -ti :3456 | xargs kill -9
 launchctl unload ~/Library/LaunchAgents/ai.claude-proxy.plist
 launchctl load   ~/Library/LaunchAgents/ai.claude-proxy.plist
 ```
 ### Конфигурация Hermes
 `~/.hermes/config.yaml` (секция model):
 ```yaml
 model:
  default: claude-sonnet-4-6
  # provider: claude-code  # отключён — упирается в rate limit OAuth API
  provider: custom
  base_url: 'http://localhost:3456/v1'
 ```
 **Pitfall:** `provider: openai` не существует в Hermes — нужно `custom`.
 **Pitfall:** `base_url` должен включать `/v1` (Hermes дописывает
 `/chat/completions`). Без `/v1` → 404.
 ---
 ## Zulip Docker — подводные камни
 ### RabbitMQ: пользователи сбрасываются после перезапуска
 **Симптом:** Zulip отдаёт 500 на `/api/v1/register`. В логах RabbitMQ —
 паника Khepri (Raft WAL). Пользователи в RabbitMQ исчезают.
 **Причина:** RabbitMQ 4.x использует Khepri вместо Mnesia. При переполнении
 диска WAL не может записаться → Khepri сбрасывает состояние → пользователи
 исчезают. `RABBITMQ_DEFAULT_USER/PASS` применяются только при **первом
 старте** с пустым volume — повторный запуск их не восстанавливает.
 **Решение:**
 1. `docker system prune` — освободить место на диске (Docker VM sparse disk
   не освобождает место автоматически).
 2. Добавить `RABBITMQ_ERLANG_COOKIE` в env rabbitmq (стабилизирует cookie
   через перезапуски).
 3. При повреждённом volume — стереть и пересоздать:
   ```bash
   docker compose down
   docker volume rm zulip_zulip-rabbitmq
   docker compose up -d
   ```
 ### Log rotation (обязательно!)
 Без ротации логи заполняют Docker VM (~6 ГБ за несколько месяцев).
 `docker-compose.yml` — добавить к каждому сервису:
 ```yaml
 # zulip:
 logging:
  driver: json-file
  options:
    max-size: "50m"
    max-file: "5"
 # rabbitmq, memcached, redis:
 logging:
  driver: json-file
  options:
    max-size: "20m"
    max-file: "3"
 ```
 ### Docker VM sparse disk
 Mac Docker Desktop использует sparse virtual disk. Место, освобождённое
 внутри VM, не возвращается хосту автоматически. `docker system prune`
 запускает compaction.
 ---
 ## Obsidian MCP
 Везде используется `mcpvault` (не `obsidian-mcp`).
 | Конфиг | Путь |
 |--------|------|
 | Claude Code CLI | `~/.claude/.mcp.json` |
 | Claude Desktop App | `~/Library/Application Support/Claude/claude_desktop_config.json` |
 | Hermes | встроен через toolset |
 Пример конфига (одинаковый для обоих):
 ```json
 {
  "mcpServers": {
    "obsidian": {
      "command": "mcpvault",
      "args": ["/Users/admin/obsidian"]
    }
  }
 }
 ```
 **Pitfall:** `obsidian-mcp` (npm) был удалён — если остался в конфиге,
 Claude падает с "Failed to spawn process". Проверить логи:
 `~/Library/Logs/Claude/mcp-server-obsidian.log`.
 ---
 ## Связанные страницы
 - [[tech/hermes-docker-kraken]] — Hermes на Кракене (Docker)
 - [[tech/kraken-network]] — сетевая топология
 - [[concepts/hermes-deployment-patterns]] — сравнение трёх моделей деплоя Hermes
@@ -0,0 +1,93 @@
 ---
 title: Hermes Kraken — OpenAI-Compatible API Server
 created: '2026-05-29'
 updated: '2026-05-29'
 type: tech
 namespace: personal
 tags: [hermes, kraken, infra, agent, how-to]
 sources:
  - family/projects/aide-kraken-backend.md
 confidence: medium
 related:
  - "[[tech/hermes-docker-kraken]]"
  - "[[tech/vps-qentra]]"
 ---
 # Hermes Kraken — OpenAI-Compatible API Server
 Hermes on Kraken exposes an OpenAI-compatible `/v1/chat/completions`
 endpoint (`gateway/platforms/api_server.py`). Exposed externally via
 Cloudflare Tunnel → used by the Android **Aide** app as a Hermes-backed
 assistant.
 ## Architecture
 ```
 Android (Aide)
  └── HTTPS → hermes.kraken.qentra.top/v1/chat/completions
                    ↓ Cloudflare Tunnel
              cloudflared (Kraken, host network)
                    ↓ localhost:8642
              hermes-kraken (docker run, network_mode: host)
                    ↓
              Hermes gateway → Gemini / OpenRouter / ...
 ```
 `network_mode: host` means port 8642 is directly on the Kraken host —
 no port mapping needed.
 ## Config (Kraken /opt/data/config.yaml)
 ```yaml
 api_server:
  enabled: true
  port: 8642
  host: "0.0.0.0"
  key: "<secret>"   # openssl rand -hex 32
 ```
 Restart container via Portainer or:
 ```bash
 BASE=http://localhost:9000
 KEY="ptr_AJY+Ba9A7f6pcAHZfDD5koU4stkKgJCdbTEXLDLxn0g="
 EP=3
 CID=$(curl -s -H "X-API-Key: $KEY" \
  "$BASE/api/endpoints/$EP/docker/containers/json" \
  | jq -r '.[] | select(.Names[] | contains("hermes-kraken")) | .Id')
 curl -s -X POST -H "X-API-Key: $KEY" \
  "$BASE/api/endpoints/$EP/docker/containers/$CID/restart"
 ```
 Health check: `curl -s http://localhost:8642/health`
 ## Cloudflare Tunnel Setup
 Tunnel name: `kraken`. Public hostname (CF Zero Trust dashboard):
 - **Hostname:** `kraken.qentra.top`
 - **Type:** HTTP (not SSH)
 - **URL:** `localhost:8642`
 SSH to Kraken still works via VPS reverse tunnel (port 2223) — the CF
 hostname change does not affect SSH access.
 ## Aide Android Client Config
 Provider: Custom Endpoint
 | Field | Value |
 |-------|-------|
 | Base URL | `https://kraken.qentra.top/v1` |
 | API Key | secret from config.yaml |
 | Model | `hermes-agent` (maps to Hermes internally) |
 ## What Was Not Changed
 - cloudflared container — already running
 - VPS reverse SSH tunnel — unaffected
 - `network_mode: host` on hermes-kraken — already set
 ## See Also
 - [[tech/hermes-docker-kraken]] — how Hermes runs on Kraken (docker run
  pattern, no compose)
 - [[tech/vps-qentra]] — VPS qentra.top: Cloudflare + nginx stack
@@ -0,0 +1,74 @@
 ---
 title: HTPC Bazzite Ecosystem — Overview
 created: '2026-05-28'
 updated: '2026-05-28'
 type: concept
 namespace: family
 tags: [htpc, infra, how-to]
 sources: []
 confidence: medium
 related:
  - "[[htpc-bazzite-proton]]"
  - "[[tech/htpc-steam-emulators]]"
  - "[[tech/htpc-kodi-layout]]"
  - "[[tech/htpc-magic4pc]]"
 ---
 # HTPC Bazzite Ecosystem — Overview
 Synthesis across [[htpc-bazzite-proton]], [[tech/htpc-steam-emulators]],
 [[tech/htpc-kodi-layout]], and [[tech/htpc-magic4pc]].
 Intel i7-6800K / RX 570 / Bazzite 44 at `192.168.1.86`. Connected to
 LG webOS TV (`192.168.1.75`) via HDMI.
 ## Mode Map
 | Mode | Entry | What runs |
 |------|-------|-----------|
 | Steam Big Picture (gamescope) | Default boot | Steam Gaming Mode + 39 non-Steam shortcuts |
 | KDE Desktop | Ctrl+Alt+F2 or Steam → "Switch to Desktop" | Full desktop + Kodi launcher |
 | Kodi | From KDE | NFS/SMB media browsing (see [[tech/htpc-kodi-layout]]) |
 | Emulators | Steam shortcuts (gamescope or KDE) | RetroArch, EmuDeck |
 ## Input Devices
 | Device | Role |
 |--------|------|
 | 2× 8BitDo Ultimate dongles | Primary gamepads |
 | Xbox 360 Wireless Receiver | Secondary gamepad |
 | LG Magic Remote (magic4pc) | TV remote → mouse/keyboard via [[tech/htpc-magic4pc]] |
 **8BitDo pitfall:** both dongles must be on separate physical USB ports
 (not the same hub). See [[tech/htpc-steam-emulators]].
 ## Windows Games via Proton
 39 games added as non-Steam shortcuts. Most on GE-Proton10-34.
 Compatibility matrix and fix recipes: [[htpc-bazzite-proton]].
 Highlights:
 - VK GameCenter (Atomic Heart) — working ✅
 - Rayman Origins — GE-Proton + `d3d9=b` ✅
 - Doom 3 BFG — Luxtorpeda (rbdoom-3-bfg flatpak) ✅
 - 5 games still broken (Brawlhalla, Castle Crashers, Worms ×2, Duck Game)
 ## Non-Steam Shortcut Management
 VDF shortcuts via Python `vdf` module. **Rules:**
 1. Stop Steam before editing `shortcuts.vdf`
 2. Use `vdf.binary_load` — never manual byte editing
 3. Keep `bak-eagle` (23 May, 106 entries) as recovery baseline
 See full guide in [[htpc-bazzite-proton]] § VDF.
 ## Cover Art
 `steam-grid-artwork.py` (at vault root) — fetches artwork from
 SteamGridDB for non-Steam shortcuts. Run when adding new shortcuts.
 ## Maintenance Notes
 - `rpm-ostree upgrade` resets `/usr/local/bin/magic4pc` — rebuild and redeploy
 - VDF backup: `saves-backup.service` (systemd, daily rsync)
 - Proton updates: extract tar.gz into `~/.steam/steam/compatibilitytools.d/`
@@ -0,0 +1,319 @@
 ---
 confidence: medium
 created: '2026-05-23'
 namespace: personal
 sources:
  - family/projects/htpc-windows-games-fix.md
 tags:
  - htpc
  - infra
  - how-to
  - pitfalls
  - vk-play
  - atomic-heart
  - vdf
  - doom
 title: HTPC Bazzite — Proton Compatibility
 type: tech
 updated: '2026-05-27'
 ---
 # HTPC Bazzite — Windows Game Proton Compatibility
 Bazzite HTPC at `bazzite@192.168.1.86`. 39 non-Steam Windows games added as
 Steam shortcuts (2026-05-22). Default tool: Proton Experimental; older titles
 on Proton 8.0.
 ---
 ## Working ✅
 - Fallout 4
 - Vladik Brutal
 - Red Alert 3
 - **Rayman Origins** (fixed 2026-05-23 — GE-Proton10-34 + `WINEDLLOVERRIDES=\"d3d9=b\" %command%`)
 - Samurai Gunn (works but **gamepad not detected**)
 - GTA V, Cuphead (assumed; not retested)
 <<<<<<< HEAD
 - **VK GameCenter** (GE-Proton10-34, shared prefix c Lutris, авторизация через Lutris + `vk-login-helper`)
 - **Atomic Heart VK** (через VK GameCenter, 97GB, `Data/gamecenter/atomic heart/`, URL-схема `vkplay://play/0.2015959`)
 =======
 - **VK GameCenter** (GE-Proton10-34, `Data/gamecenter/GameCenter/`)
 - **Atomic Heart VK** (через VK GameCenter, 97GB, `Data/gamecenter/atomic heart/`)
 >>>>>>> nas/main
 - **Doom 3 BFG** (через flatpak Classic-RBDOOM-3-BFG)
 ## Removed from Steam shortcuts ✅
 - Human Fall Flat (3928445186) — already in real Steam
 - Shovel Knight (2526703384) — already in real Steam
 ## Mapped to GE-Proton10-34 but still broken
 | Game | AppID | Symptom | LaunchOpt set |
 |------|-------|---------|---------------|
 | Brawlhalla | 2410005953 | Doesn't start | `WINEDLLOVERRIDES=\"msvcp140,vcruntime140=n,b\"` |
 | Castle Crashers | 3048471472 | "crash, mini dump sent" | `WINEDLLOVERRIDES=\"msvcp140,vcruntime140=n,b\"` |
 | Worms WMD | 3846411911 | Doesn't start | `WINEDLLOVERRIDES=\"msvcp140,vcruntime140,d3dcompiler_47=n,b\"` |
 | Worms World Party | 2401592779 | Doesn't start | `WINEDLLOVERRIDES=\"msvcp140,vcruntime140=n,b\"` |
 | Duck Game | 2926094216 | Won't launch | `WINEDLLOVERRIDES=\"msvcp140,vcruntime140=n,b\"` |
 - **Doom 3 BFG** (flatpak, appid `-2113091226`) — работает ✅
 - **Atomic Heart VK / VK GameCenter** — VK GameCenter запускается через Steam (GE-Proton10-34). Atomic Heart (97GB) установлен через GameCenter на Data. Exe GameCenter скопирован на Data (не на Windows/ — read-only). Symlink `d:` в dosdevices ведёт на `/run/media/bazzite/Data`.
 ## Target:
 ## Still broken — fundamental issues
 | Game | AppID | Symptom | What's known | What might help |
 |------|-------|---------|--------------|-----------------|
 | Atomic Bomberman / BM95 | 2875360586 | Crash "instruction at 0x0 referenced 0x7" | Win3.1-era PE32. Tried: `proton_8`, registry `Version=win98`, virtual desktop 640×480, WineBus controllers off | Dedicated 32-bit `WINEARCH=win32`; or DOSBox‑X |
 | Discworld Noir | 2361018632 | "Please insert disk III" | Russian 2-CD "Zatmenie v2". 69 missing files copied ✅. Drive D: → cd2 as CD-ROM | Try cd1; or mount `.nrg` images |
 | Final Fantasy X HD | 2642741094 | Was Japanese, no saves | `GameSetting.ini` replaced (en+HD) from Windows | Test pending |
 | Metal Slug X | 2938712902 | Speed wrong, controls dead | Neo-Geo emulator config issue, not Wine | — |
 | Metro Exodus | 3594910936 | "Unable to create interface isteamuser" | VC++ runtime copied | Needs Goldberg `steam_api64.dll` + `steam_appid.txt` |
 | Split Second | 3871231787 | Green artifacts | `PROTON_USE_WINED3D=1` | Switch to GE-Proton; copy `d3dx9_*.dll` |
 | Super Bomberman R2 | 3340354231 | Gamepad not detected | Steam Input config issue | — |
 ## Gamepad Issues
 - **Samurai Gunn, Super Bomberman R2**: not detected → Steam Input "Force Off" / "Use Default" cycle; or `SDL_GAMECONTROLLER_ALLOW_STEAM_VIRTUAL_GAMEPAD=1`
 - **Metal Slug X**: wrong speed in Neo-Geo wrapper
 ---
 ## Common Fix Recipes
 ### "Doesn't start" → try vcrun2019
 ```
 protontricks <AppID> vcrun2019 d3dcompiler_47
 ```
 ### XNA 4.0 games (Duck Game, etc.)
 ```
 protontricks <AppID> xna40
 ```
 ### DOS-era games (e.g. Atomic Bomberman)
 Proton won't work. Use **Steam Tinker Launch** → wrap with DOSBox (dosbox-staging).
 ### Non-Steam copy of a Steam game (e.g. Metro Exodus)
 Game needs `steam_api64.dll` emulator:
 1. Drop in Goldberg `steam_api64.dll`
 2. Add `steam_appid.txt` with the real App ID (e.g. 412020 for Metro Exodus Enhanced)
 ### Cyrillic encoding issues (e.g. Discworld Noir)
 Try in order:
 1. `LANG=ru_RU.UTF-8 %command%`
 2. `WINEDLLOVERRIDES=\"gdiplus=n,b\"`
 3. Install `ttf-mscorefonts` + set Cyrillic codepage in Wine registry
 ### White screen / broken D3D9 (Rayman Origins, Split Second)
 ```
 PROTON_USE_WINED3D=1 %command%
 ```
 Or try `WINEDLLOVERRIDES=\"d3d9=b\"` or an older Proton version.
 ### Doom 3 BFG Edition — чёрные текстуры, краш после интро
 Proton ломает текстуры — известный регресс. **Фикс:** Luxtorpeda → rbdoom-3-bfg (native Linux engine).
 ---
 ## VK Play / VK GameCenter на Bazzite
 ### Аккаунты VK Play
 - **Основной:** `xxxellam@gmail.com` — Google, залогинен на Bazzite
 - **Дополнительный:** `mallexxx@mail.ru` — подключён к VK Play
 ### Общая схема
 VK Play версии игр запускаются через лаунчер VK GameCenter (`GameCenter.exe`) поверх Proton. Лаунчер отвечает за авторизацию и лицензирование (в т.ч. Denuvo-эмуляцию).
 Известно:
 - VK Play официально подтвердил совместимость Atomic Heart со Steam Deck/Proton.
 - Для авторизации используется `mycomgames://` URL-схема. На HTPC без Steam Deck API может потребоваться ручной ввод логина/пароля.
 - Альтернатива: Lutris с конфигом из gist.github.com/keyCat (обработчик `mycomgames://` схемы).
 - Перед первым запуском может понадобиться `protontricks -555655402 vcrun2019`.
 ### Как добавить VK Play игру
 1. Запустить VK GameCenter через Steam (GE-Proton10-34)
 2. Авторизоваться в VK Play
 3. Установить игру через лаунчер (Atomic Heart уже установлен)
 4. После авторизации игра появится в библиотеке VK Play
 ### Lutris login workaround (shared prefix with Steam/Proton)
 **Проблема:** Steam CEF browser не умеет обрабатывать `mycomgames://` URL-схему, необходимую для OAuth-логина VK Play. При клике "Login" — `ERR_NETWORK_IO_SUSPENDED`.
 **Решение:** использовать Lutris для первичной авторизации, потом запускать игру через Steam/Proton.
 ### Implementation status (2026-05-28)
 Все компоненты настроены через SSH (Kraken → HTPC). Последний шаг (логин) требует GUI-сеанса на HTPC.
 | Component | Status | Notes |
 |-----------|--------|-------|
 | `d:` dosdevices symlink (→ Data) | ✅ | `/run/media/bazzite/Data` |
 | `handle-vkplay-scheme` script | ✅ | `~/.local/bin/` — обрабатывает `mycomgames://` через Proton 10.0 |
 | `.desktop` → MIME `x-scheme-handler/mycomgames` | ✅ | Зарегистрирован на `Vkplay-scheme-handler.desktop` |
 | Lutris flatpak | ✅ | `flathub net.lutris.Lutris` |
 | Lutris game config (shared prefix) | ✅ | `~/.config/lutris/games/vk-play-shared.yml` |
 | `start-vk.cmd` in Proton prefix | ✅ | `drive_c/VKPlay/gamecenter/start-vk.cmd` |
 | Steam shortcut VK GameCenter | ✅ | AppID=-1973339958, GE-Proton10-34 |
 | Steam shortcut Atomic Heart VK | ✅ | AppID=-1973339958 (через GameCenter) |
 | Atomic Heart installed (97GB) | ✅ | `/run/media/bazzite/Data/gamecenter/atomic heart/` |
 **Осталось сделать (на HTPC в десктоп-режиме):**
 1. Открыть Lutris → VK Play Game Center → Login
 2. Авторизоваться в браузере, разрешить `mycomgames://`
 3. Вернуться в игровой режим
 4. Запустить Atomic Heart через Steam → ожидать что токен в shared prefix работает
 1. Установить Lutris через flatpak:
   ```
   flatpak install flathub net.lutris.Lutris
   ```
 2. Создать кастомный пресет VK GameCenter в Lutris, указав **тот же Wine prefix**, что использует Steam:
   ```
   ~/.local/share/Steam/steamapps/compatdata/-1973339958/pfx/
   ```
 3. Зарегистрировать `mycomgames://` protocol handler — поместить .desktop-файл, который ассоциирует схему с Lutris:
   - Референс: https://gist.github.com/keyCat/a77b1d4d1e0f651b9d3a9818e7f739c5
 4. Выполнить логин через Lutris — откроется внешний браузер, авторизация сработает, редирект `mycomgames://` попадёт в Lutris.
 5. После успешного логина запускать игру через Steam — токен уже лежит в shared prefix, `mycomgames://` больше не нужен.
 **Почему shared prefix:** игра (Atomic Heart, 97GB) НЕ копируется — она уже установлена в `/run/media/bazzite/Data/gamecenter/atomic heart/` через Steam-версию VK GameCenter. Lutris будет использовать тот же префикс, где уже есть dosdevices symlink `d:` → `/run/media/bazzite/Data` и все токены авторизации.
 ---
 ## How to Add a Non-Steam Game via VDF
 **Шаг 0: Остановить Steam**
 ```
 systemctl --user stop gamescope-session-plus@steam.service
 ```
 **Шаг 1: Прочитать shortcuts.vdf backup**
 AppID в shortcuts.vdf — signed int32. В config.vdf CompatToolMapping — unsigned uint32.
 ```python
 import vdf
 # read backup
 with open('shortcuts.vdf.bak-eagle', 'rb') as f:
    d = vdf.binary_loads(f.read())
 # edit d['shortcuts']
 # write
 with open('shortcuts.vdf', 'wb') as f:
    f.write(vdf.binary_dumps(d))
 ```
 **Шаг 2: Добавить CompatToolMapping в config.vdf**
 Unsigned appid = signed & 0xFFFFFFFF.
 **Шаг 3: Запустить Steam, проверить**
 **Критически важно:**
 - Редактировать ТОЛЬКО при остановленном Steam
 - Делать бэкап **до** изменений
 - `vdf.binary_loads` — регистрозависим: `AppName`, `Exe`, а не `appname`, `exe`
 ---
 ## VDF Troubleshooting
 ### shortcuts.vdf испорчен (все записи пустые)
 Steam перезаписывает VDF при старте если не понимает ручные правки. Восстанавливай из бэкапа.
 **Бэкапы** (в `~/.steam/steam/userdata/147839491/config/`):
 | Файл | Дата | Entries | Примечание |
 |------|------|---------|------------|
 | `shortcuts.vdf.bak-eagle` | 23 мая 18:32 | 106 | **Последний чистый бэкап** — не тронут |
 | `shortcuts.vdf.bak-launch` | 22 мая 22:25 | 108 | Старый, без Atomic Heart |
 | `shortcuts.vdf.whale-restored-YYYY-MM-DD` | по ситуации | 108 | Текущее состояние после восстановления |
 | `/run/media/bazzite/Data/backups/saves/shortcuts/shortcuts.vdf.YYYY-MM-DD` | daily | — | Автоматический через saves-backup.service |
 Проверка бэкапа:
 ```python
 import vdf
 with open("shortcuts.vdf.bak-eagle", "rb") as f:
    d = vdf.binary_loads(f.read())
 named = sum(1 for e in d["shortcuts"].values() if e.get("AppName"))
 print(f"{named} named entries")
 ```
 ### VDF Incident — 2026-05-27 (разбор)
 **Что произошло:** при попытке добавить VK GameCenter + Atomic Heart VK через Python vdf на работающем Steam, Steam переписал файл при старте, создав 110 пустых записей-заглушек.
 **Почему бэкапы тоже пустые:** все бэкапы были сделаны уже после того как Steam испортил файл. Единственный выживший — `bak-eagle` (23 мая, до начала экспериментов).
 **Как нашли:** hexdump показал имена игр, но `vdf.binary_loads` не видел их — проблема в регистре ключей (`AppName`, а не `appname`).
 **Как восстановили:**
 1. Остановлен Steam
 2. Считан `bak-eagle` (106 записей) + добавлены VK GameCenter (index 106) и Atomic Heart VK (index 107)
 3. Обнаружено что config.vdf уже имеет CompatToolMapping с другими appid от предыдущих попыток
 4. Перегенерация с appid, совпадающими с config.vdf
 5. Удалены дублирующиеся unsigned записи из config.vdf
 6. Создан `shortcuts.vdf.whale-restored-2026-05-27`
 **Уроки:**
 - Только при остановленном Steam
 - Бэкап ДО изменений
 - Проверять signed↔unsigned соответствие
 - Регистр ключей в vdf.binary_loads
 ---
 ## Key Infra Notes
 - **shortcuts.vdf**: `~/.steam/steam/userdata/147839491/config/shortcuts.vdf` (binary VDF)
 - **config.vdf**: `~/.steam/steam/config/config.vdf` (text VDF, CompatToolMapping block)
 - **Wine prefix**: `~/.local/share/Steam/steamapps/compatdata/<AppID>/pfx/`
 - **protontricks**: Flatpak, needs `flatpak override --user --filesystem=/var/home/bazzite/.local/share/Steam`
 - **Background jobs**: `systemd-run --user --unit=<name>`
 - **GE-Proton**: extract tar.gz into `~/.steam/steam/compatibilitytools.d/`, restart Steam
 ### saves-backup.service
 Systemd user service (`/etc/systemd/user/saves-backup.service`):
 - Ежедневный rsync Steam userdata
 - Копия shortcuts.vdf в `/run/media/bazzite/Data/backups/saves/shortcuts/shortcuts.vdf.YYYY-MM-DD`
 - Ротация: удаление старше 30 дней
 ---
 ## Fixes Done (filesystem / config / cover-art)
 - Cover art swapped: Atomic Bomberman, Discworld Noir, SBR2, FFVI, ALttP, Sunset Riders
 - "Captain Commando" → "Sunset Riders"
 - CompatToolMapping for all AppIDs:
  - **GE-Proton10-34**: Brawlhalla, Castle Crashers, Worms WMD/WP, Duck Game, Rayman Origins, VK GameCenter, Atomic Heart VK, insaneramzes Atomic Heart
  - **Proton 8.0**: Atomic Bomberman, Discworld Noir, Metal Slug X, Soldat, Red Alert 3, Split Second
  - **Luxtorpeda**: Doom 3 BFG
  - **Proton Experimental**: ~24 remaining games
 - Doom 3 BFG → Luxtorpeda (rbdoom-3-bfg, 2026-05-27)
 - Rayman Legends: Ubisoft Connect + registry fix
 - Discworld Noir: symlink, Cyrillic locale, missing files, drive D: as CD-ROM
 - FFX HD: English `GameSetting.ini`
 - VC++ runtime + d3dcompiler DLLs copied into 6 prefixes from Windows partition
 - Duck Game: XNA 4.0 framework dir copied
 - Atomic Bomberman: `Version=win98` + virtual desktop 640×480 + WineBus controllers off
 - GE-Proton10-34 installed
 ## Source Assets (Windows partition)
 - Ubisoft Game Launcher: `/run/media/bazzite/Windows/Program Files (x86)/Ubisoft/`
 - System DLLs: `/run/media/bazzite/Windows/Windows/System32/`, `SysWOW64/`
 - XNA 4.0: `/run/media/bazzite/Windows/Program Files (x86)/Microsoft XNA/`
 - .NET 4.0: `/run/media/bazzite/Windows/Microsoft.NET/Framework64/v4.0.30319/`
 - Discworld Noir source: `/run/media/bazzite/Data/downloads/zatmenie v2 [torrents.ru]/`
 - **Discworld Noir (скачан 2026-05-29):** `/run/media/bazzite/Data/downloads/Discworld Noir.isz` (ISZ, 1.1GB, Alcohol 120%)
 - **Discworld (оригинал, скопирован 2026-05-29):** `/run/media/bazzite/Data/downloads/DISCWORLD.iso` (ISO, 434MB) — с TrueNAS `/mnt/RED_2TB/backup/Downloads/Distr/games/DISCWORLD.iso`
 - FFX settings: `/run/media/bazzite/Windows/Users/mallexxx/documents/square enix/...`
 ## Open Questions
 1. Delete `pfx/` folders for still-broken GE-Proton games (Brawlhalla, Castle Crashers, Worms WMD/WP, Duck Game)
 2. Atomic Bomberman: 32-bit Wineprefix outside Proton
 3. Discworld Noir: try cd1 or mount `.nrg` images
 4. Metro Exodus: Goldberg Steam emulator?
 5. **Atomic Heart VK:** test VK Play авторизацию, при необходимости `protontricks vcrun2019`
 6. **Doom 3 BFG:** test с Luxtorpeda → rbdoom-3-bfg
 ## See Also
 [[personal-os-architecture]] [[obsidian-mcp-wrapper]] [[family/how-to/htpc-steam-nonsteam-shortcuts]]
@@ -0,0 +1,31 @@
 ---
 title: HTPC Kodi Layout & WoL
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: family
 tags: [htpc, kodi, wol, infra, how-to]
 related:
  - "[[tech/htpc-steam-emulators]]"
 ---
 # HTPC Kodi Layout & WoL
 ## Wake on LAN
 HTPC MAC address stored in router DHCP config. WoL command:
 ```bash
 wakeonlan <HTPC-MAC>
 ```
 Or via Kodi remote / Home Assistant automation.
 ## Kodi Layout
 - Home screen: custom skin (record actual skin name here)
 - Sources: NFS mounts from TrueNAS (`/mnt/RED_2TB/...`)
 - Add-ons: check Kodi installed add-ons list
 Note: specific layout details were not migrated. Update this page
 when next doing HTPC maintenance.
@@ -92,6 +92,78 @@ TV шлёт координаты в пространстве 0–1920 × 0–108
 - **Бинарь слетает** после `rpm-ostree upgrade` → пересобрать и скопировать.
 - **Display switching** — при смене между `:0` и `:1` xdotool перезапускается. Если переключение происходит часто (мигающие окна) — возможны краткие потери мыши.
 ## WebOS TV App — сборка и деплой
 TV-часть — React/Enact WebOS приложение + Node.js сервис, упакованные в IPK. Исходники: `~/Developer/magic4pc/webos/`.
 ### Сборка
 ```bash
 cd ~/Developer/magic4pc/webos
 NODE_OPTIONS=--openssl-legacy-provider npm run build
 ```
 **Питфолл:** `--openssl-legacy-provider` обязателен — старый webpack несовместим с Node.js 25+.
 ### Упаковка IPK
 ```bash
 /Users/admin/webOS_TV_SDK/CLI/bin/ares-package dist/ service/ --outdir .
 ```
 **Питфолл:** нужны оба аргумента `dist/` и `service/` — без `service/` Node.js сервис не попадает в IPK.  
 **Питфолл:** `npm run package` = `ares-package -n` (unsigned) — TV отклоняет неподписанные пакеты. Использовать SDK-команду напрямую.
 ### Деплой (deploy.sh)
 ```bash
 cd ~/Developer/magic4pc/webos && ./deploy.sh
 ```
 Скрипт: build → package → scp → close → remove → install → launch.  
 Для install (subscribe mode) — прямой `ssh+script` с polling на `"state":"installed"`.
 **Питфолл:** `ares-install` / `ares-launch` ненадёжны — не ждут завершения. Использовать `luna-send dev/install` через script-враппер.
 Версия в UI отображается как `1.1.0 (YYYY-MM-DD HH:MM)` — инжектируется webpack через `process.env.BUILD_DATE`.
 ## Auto-launch при включении / пробуждении TV
 Magic4pc запускает настроенное приложение при включении или пробуждении TV.
 | Файл | Расположение | Назначение |
 |------|-------------|-----------|
 | `magic4pc-settings` | PERSISTENT_DIR | ID выбранного приложения |
 | `magic4pc-last-app` | PERSISTENT_DIR | Последнее активное приложение |
 | `magic4pc-run-state` | `/tmp/` | `running` после первого запуска |
 `PERSISTENT_DIR = /media/developer/apps/usr/palm/services/me.wouterdek.magic4pc.service`
 Логика:
 - **Boot/wake:** `/tmp` очищается → нет `run-state` → `freshStart=true` → запускает настроенное приложение
 - **Ручной запуск:** `run-state=running` уже есть → auto-launch пропускается
 `init.d` скрипт на TV (`/var/lib/webosbrew/init.d/magic4pc`) удаляет `run-state` при suspend — wake снова тригерит fresh launch. Редактировать только в репо (`tv-scripts/init.d-magic4pc.sh`), не напрямую на TV.
 ## WebOS Back Key + системная клавиатура
 Когда системная клавиатура открыта, **первый Back** поглощается OS (закрывает клавиатуру) — `keydown` и `onButtonDown` **не стреляют**. Второй Back приходит нормально.
 Фикс в `MainPanel.js` (флаг `_kbWasOpen`):
 ```js
 // Input.onActivate:
 this._kbWasOpen = true;
 // onButtonDown на Back:
 if (this.state.wolMacActive || this._kbWasOpen) {
    this._kbWasOpen = false;
    return; // подавить закрытие панели
 }
 ```
 Подходы, которые не работают: `Popup.noAutoDismiss`, timeout-эвристика, polling `document.activeElement` (клавиатура — системный оверлей, фокус не переходит на INPUT).
 ## Деплой и sudoers
 На HTPC настроен sudo без пароля для systemctl:
@@ -229,6 +229,20 @@ Imported 185 torrents from Windows Transmission-daemon into HTPC Transmission.
 10 torrents had no data (X:\Movies\ — lost disk, permanently gone).
 ## Sudo / Пароль
 Пароль пользователя `bazzite`: **`bazzite`**
 Для удалённых команд через SSH:
 ```bash
 ssh bazzite@192.168.1.86 'echo bazzite | sudo -S mount ...'
 ```
 Также настроен sudo без пароля для systemctl (см. [[htpc-magic4pc#Деплой и sudoers]]):
 ```
 bazzite ALL=(ALL) NOPASSWD: /usr/bin/systemctl
 ```
 ## OSTree / Обновления
 - `/usr/local/bin` слетает при `rpm-ostree` upgrade (новый `/usr` overlay)
 - Бинари держать в `/home/bazzite/` или пересобирать после обновлений
@@ -0,0 +1,33 @@
 ---
 title: Jellyfin Config
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: family
 tags: [jellyfin, infra, media, credentials]
 related:
  - "[[tech/arr-stack-kraken]]"
 ---
 # Jellyfin Config
 **URL:** `http://kraken:8096`
 ## Users
 | User | Password | Notes |
 |------|----------|-------|
 | alex | (set)    | Admin |
 | lisa | (none)   | Cartoons library only |
 ## API Key
 `87af49b6ff62ea68da6abdab0d7a4fbc`
 Used by automation scripts (watchlist-sync, media-pipeline agents).
 ## Database / Maintenance
 - **Before any DB operation:** `docker stop jellyfin` first
 - Jellyfin runs as a Docker container on Kraken
 - Config stored in `/opt/jellyfin/config/` (check docker-compose for exact path)
@@ -0,0 +1,108 @@
 ---
 title: Jellyfin Транскод на RPi5 — PGS/Subtitle Pitfalls
 type: reference
 namespace: work
 tags:
  - jellyfin
  - kraken
  - transcode
  - subtitles
  - pitfalls
 created: '2026-05-18'
 updated: '2026-05-18'
 ---
 # Jellyfin Транскод на RPi5 — PGS/Subtitle Pitfalls
 ## Контекст
 Клиент: Konka TV с WebOS. Сервер: Raspberry Pi 5 (Крaken, ARM64).
 ## Direct Play условия
 Direct Play работает при выполнении всех условий:
 - Аудио: AAC
 - Субтитры: **отсутствуют** (или внешние SRT, без burn-in)
 ## Проблема PGS/ASS субтитров
 PGS и ASS (SSA) субтитры вызывают **burn-in** — Jellyfin рендерит субтитры прямо в видеопоток.
 **Результат:** полный транскод на CPU → **275% CPU load** на RPi5 → лаги, перегрев.
 **Экспериментальный PGS rendering** в настройках Jellyfin — **не помогает** на RPi5.
 ## Решение: конвертация PGS → SRT
 Установка через uv (arm64/aarch64 совместимо):
 ```bash
 ~/.local/bin/uv tool install pgsrip
 sudo apt-get install -y libgl1 libglib2.0-0 tesseract-ocr tesseract-ocr-rus tesseract-ocr-eng
 ```
 Скрипт конвертации:
 ```
 /srv/dev-disk-by-uuid.../docker/media-pipeline/pgs-to-srt.sh
 ```
 ```bash
 # один файл
 pgs-to-srt.sh /media/movies/Film.mkv
 # вся директория
 pgs-to-srt.sh /media
 ```
 Логи: `/srv/.../docker/media-pipeline/pgs-to-srt.log`
 Скрипт:
 - Скипает файлы без PGS-дорожек (S_HDMV)
 - Скипает если .srt уже есть рядом
 - Пишет лог с timestamp
 После конвертации Jellyfin читает внешние `.srt` без транскода.
 ## Transmission completion hook
 Хук `/config/on-download-complete.sh` (монтируется в контейнер `:ro`) после завершения загрузки:
 1. Запускает media-pipeline sync
 2. Запускает pgs-to-srt.sh для скачанного файла/директории
 Лог: `/srv/.../docker/media-pipeline/download-complete.log`
 ## Итог по субтитрам
 | Тип | Direct Play | Транскод |
 |-----|------------|---------| 
 | Нет субтитров | ✅ | — |
 | Внешний SRT | ✅ | — |
 | ASS/SSA | ❌ | burn-in, 275% CPU |
 | PGS (MKS/MKV) | ❌ | burn-in, 275% CPU |
 ## NFD/NFC filename encoding pitfall
 **Проблема:** HTPC сохраняет имена файлов в NFD, Kraken — в NFC.  
 → Jellyfin видит **две** папки: одна с `.avi` файлом (NFD), другая с `.nfo` (NFC).  
 → NFO не применяется — Jellyfin берёт NFD-папку (с видео) и игнорирует NFC-папку (с NFO).  
 → Метаданные пустые.
 **Фикс A (быстрый):** скопировать `movie.nfo` + `poster.jpg` в NFD-папку:
 ```bash
 # python3 — использовать bytes для путей
 import os, shutil
 nfc_path = "…/Movie.NFC/movie.nfo"
 nfd_path = "…/Movie.NFD/movie.nfo"
 shutil.copy(nfc_path.encode(), nfd_path.encode())
 ```
 **Фикс B (радикальный):** переименовать всё в NFC (нормализовать).
 **Диагностика:**
 ```bash
 ls -la | cat -v   # покажет NFD-escape символы как ^ escape sequences
 python3 -c "import os; [print(repr(f)) for f in os.listdir('.')]"
 ```
 ## Связанные страницы
 - [[concepts/kraken-media-stack]] — полный медиастек: *arr + Jellyfin + media-pipeline
 - [[tech/kraken-network]] — инфра Кракена, HDD error recovery
@@ -0,0 +1,34 @@
 ---
 title: Kraken Network & Infra
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: personal
 tags: [infra, kraken, ssh, wireguard, network]
 related:
  - "[[tech/arr-stack-kraken]]"
 ---
 # Kraken Network & Infra
 ## SSH Access
 ```
 ssh kraken
 ```
 IP: `192.168.1.15` (wlan0, primary). SSH alias `kraken` resolves via `~/.ssh/config`.
 ## WireGuard Topology
 Split-tunnel: Eagle ↔ VPS ↔ Kraken. Full details: [[tech/wireguard-vpn]].
 - Eagle: `10.99.0.2`, Kraken: `10.99.1.2`, VPS relay: `10.99.0.1`/`10.99.1.1`
 - `wg-auto.sh` on Eagle (LaunchDaemon) — up when off home Wi-Fi, down at home
 - VPS as relay; two interfaces (wg0/wg1) avoid hairpin forwarding
 ## Media Volume Mount Paths
 Docker containers on Kraken mount media from NAS over NFS/SMB.
 Paths were documented here — check docker-compose files in
 `/opt/media-toolbox-kraken` for current mount config.
@@ -0,0 +1,30 @@
 ---
 title: TrueNAS Inpxer / Books Setup
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: family
 tags: [truenas, books, infra, storage]
 related:
  - "[[tech/kraken-network]]"
 ---
 # TrueNAS Inpxer / Books Setup
 ## Books Storage Path
 ```
 /mnt/RED_2TB/storage/books/
 ```
 Books are stored on the RED_2TB pool. Inpxer (or similar indexer) serves
 the library from this location.
 ## Related TrueNAS Notes
 - General TrueNAS access: [[family/how-to/truenas-access]]
 - Remote access reverse proxy: [[personal/docs/truenas-remote-access-reverse-proxy]]
 - Rclone backup: [[family/how-to/truenas-rclone-backup]]
 Note: Inpxer-specific config was not migrated — add details here when
 revisiting this setup.
@@ -40,6 +40,20 @@
 Переменная `TV_HOST` переопределяет таргет (default: `root@LGwebOSTV`, alias `root@tv`, IP: `root@192.168.1.75`).
 DNS резолвится через роутер (192.168.1.1), см. [[router-bishkek-asus]].
 ## Common Luna URIs
 | URI | Назначение |
 |-----|-----------|
 | `.../applicationmanager/running` | Список запущенных приложений |
 | `.../applicationmanager/closeByAppId` | Закрыть приложение по ID |
 | `.../appInstallService/dev/install` | Установить IPK (subscribe) |
 | `.../appInstallService/dev/remove` | Удалить приложение |
 | `.../applicationManager/launch` | Запустить приложение |
 | `.../applicationManager/getForegroundAppInfo` | Текущее активное приложение |
 | `...magic4pc.service/query` | Статус сервиса magic4pc |
 Полные префиксы: `com.webos.service.applicationmanager`, `com.webos.appInstallService`, `com.webos.applicationManager`.
 ## Ограничение
 `luna-send -i` (subscribe, бесконечный) не работает через враппер. Для install (`dev/install`) используется прямой ssh+script с polling в deploy.sh.
@@ -0,0 +1,94 @@
 ---
 title: Vault Git Sync — Setup & Pitfalls
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: wiki
 tags: [vault, git, sync, infra, obsidian]
 ---
 # Vault Git Sync
 Obsidian vault is a bare git repo on TrueNAS (`mallexxx.duckdns.org:/mnt/RED_2TB/storage/git/obsidian-vault.git`).
 Three hosts sync to it: Eagle, Kraken, Taiga.
 ## Sync Strategy (correct)
 All hosts must follow this order:
 ```
 1. stash local changes       (git stash)
 2. pull from remote          (git fetch + git merge)
 3. pop stash                 (git stash pop)
 4. commit if anything new    (git add -A + git commit)
 5. push                      (git push)
 ```
 **Why this order matters:** `git add -A` before pull stages deletions of files
 that exist on remote but not locally. This caused Taiga to delete 32+ wiki files
 on 2026-05-23 (two incidents: 3a44a55, c9020c4).
 ## Scripts
 | Host   | Script                             | Status         |
 |--------|------------------------------------|----------------|
 | Eagle  | `~/scripts/sync-vault.sh`          | ✅ Correct      |
 | Kraken | `~/scripts/sync-vault-partial.sh`  | ✅ Correct      |
 | Taiga  | `/opt/data/sync-vault.sh`          | ✅ Fixed 2026-05-23      |
 All scripts now use scoped `git add personal/ family/ .obsidian/` (not `git add -A`) before stash.
 Taiga additionally uses sparse checkout (only `personal/` and `family/`) — double safeguard:
 even if a bug reintroduces `git add -A`, sparse checkout means wiki/ is never checked out locally.
 ## Taiga Architecture
 Taiga is TrueNAS running Hermes in Docker (`/mnt/RED_2TB/docker/hermes/`).
 The sync script runs **inside the container** with:
 - `GIT_WORK_TREE=/vault` → mounted from `/mnt/RED_2TB/storage/obsidian`
 - `GIT_DIR=/vault.git` → mounted from `/mnt/RED_2TB/storage/git/obsidian-vault.git` (the bare repo itself)
 Taiga IS the repo — no remote push needed. Eagle pushes to `nas/main`, which is this same bare repo.
 Script location: `/mnt/RED_2TB/docker/hermes/config/sync-vault.sh` (= `/opt/data/sync-vault.sh` inside container)
 SSH access: `ssh taiga` (alias in ~/.ssh/config → `truenas_admin@mallexxx.duckdns.org`)
 To deploy a script fix:
 ```bash
 scp ~/scripts/sync-vault-taiga.sh taiga:/mnt/RED_2TB/docker/hermes/config/sync-vault.sh
 ```
 **NEVER use local IP for TrueNAS** — always `mallexxx.duckdns.org` or `ssh taiga`.
 ## .gitignore
 Plugin binaries are excluded to prevent cross-device obsidian-git version conflicts:
 ```
 .obsidian/plugins/obsidian-git/main.js
 .obsidian/plugins/obsidian-git/styles.css
 .obsidian/plugins/obsidian-git/manifest.json
 ```
 Each device manages its own plugin binaries via Obsidian's built-in update mechanism.
 `data.json` (plugin config) IS tracked — shared settings across devices.
 ## Incident: 2026-05-23
 **Root cause:** Taiga's `/opt/data/sync-vault.sh` did `git add -A` before `git pull`.
 **Sequence:**
 - 22:02 UTC Eagle created 15 wiki files (d757029, 6dc4b89)
 - 00:00 UTC Taiga ran sync → staged deletions (local didn't have wiki/) → commit 3a44a55
 - 03:02 UTC Taiga ran again → deleted 8 more files (c9020c4)
 **Recovery:** `git checkout <hash> -- <file>` for each file from last-good commits.
 32 files restored in commit 620e2df.
 ## Stash Cleanup
 Orphaned stashes from obsidian-git mobile syncs accumulate. Safe to drop:
 ```bash
 git stash drop stash@{N}  # drop specific, or:
 git stash clear            # drop all (only if no unrecovered work)
 ```
@@ -0,0 +1,74 @@
 ---
 title: VPS qentra.top
 created: '2026-05-24'
 updated: '2026-05-27'
 type: tech
 namespace: personal
 tags: [infra, vps]
 confidence: medium
 related:
  - "[[tech/kraken-network]]"
  - "[[tech/wireguard-vpn]]"
 ---
 # VPS qentra.top
 **IP:** 91.207.28.205  
 **Stack:** nginx + Python 3.11, Cloudflare proxy  
 **Panels:** panel.qentra.top:5430, v.qentra.top:8964
 ## Subdomain Setup
 1. Add Cloudflare A-record → 91.207.28.205
 2. Add nginx vhost in `/etc/nginx/sites-enabled/`
 ## Backup
 Ежедневный бэкап конфигов через cron (04:00):
 - Скрипт: `/root/vps-backup.sh`
 - Cron: `/etc/cron.d/vps-backup`
 - Куда: `/root/backups/` (`vps-config-YYYY-MM-DD_HHMMSS.tar.gz`)
 - Ретеншн: 90 дней
 **Что бэкапится:**
 | Файл | Описание |
 |------|----------|
 | `xray/config.json` | Xray конфиг (все inbound/outbound, клиенты) |
 | `x-ui/config.json` | 3X-UI панель (полная копия клиентов) |
 | `systemd/xray.service` | systemd unit Xray |
 | `cron/xray-update` | Еженедельное обновление Xray и 3X-UI |
 | `nginx/sites-enabled/nolvu` | nginx vhost → nolvu.qentra.top |
 | `nginx/sites-available/panel` | nginx vhost → panel.qentra.top |
 | `nginx/sites-available/xray` | nginx vhost → v.qentra.top (WS прокси) |
 | `nginx/nginx.conf` | Основной конфиг nginx |
 | `scripts/add-client.sh` | OpenVPN скрипты |
 | `scripts/revoke-client.sh` | OpenVPN скрипты |
 | `scripts/setup-openvpn.sh` | OpenVPN скрипты |
 **Восстановление:**
 ```bash
 tar xzf /root/backups/vps-config-latest.tar.gz -C /
 # После восстановления — перезапустить сервисы:
 systemctl daemon-reload
 systemctl restart xray nginx
 ```
 ## Xray (VLESS+REALITY)
 - **Inbound 443** — REALITY, 4 клиента
  - `2D9F24C4-21FE-4784-9843-F11C384DA67A` — `user1` (телефон)
  - `f80b579b-baa6-4887-a76e-682635335c15` — `natali`
  - `62814419-722a-4f45-b560-eaed2d0df6af` — `alexander_martemyanov`
  - `23aa4d8e-ef16-43ab-bdef-3d2c11d8ef02` — `taiga` (TrueNAS vless-proxy)
 - **Inbound 8964** — WebSocket, через nginx v.qentra.top/qentra
  - `2D9F24C4-21FE-4784-9843-F11C384DA67A` — `124hyews`
  - `d10834e6-ba84-4dbd-b5e6-b5f4df9e64d6` — `natali@duck.com`
 - PrivateKey: `CMu-Sz49V5HW-s2c0P33EDlCwY-JMhQbxfdn7LhvY1A`
 - Публичный ключ (для клиентов): `Rtkptj9Cij2go_oE0Klgf_Mwfhq-d_oaW4mQubHzXm0`
 **Важно:** REALITY на 443, nginx на 8443 + 80. При перезапуске — сначала Xray (забирает 443), потом nginx.
 ## See Also
 - [[tech/kraken-network]] — Kraken home network topology
 - [[tech/wireguard-vpn]] — WireGuard tunnel used for Eagle↔VPS traffic
@@ -94,3 +94,8 @@ ssh kraken "sudo wg show"
 # Логи auto-connect Eagle
 cat /var/log/wg-auto.log
 ```
 ## Связанные заметки
 - [[kraken-network]] — SSH к Кракену, пути медиаволюмов
 - [[personal-os-architecture]] — Eagle hardware, домашняя инфра
@@ -0,0 +1,150 @@
 ---
 created: '2026-05-20'
 updated: '2026-05-27'
 status: active
 tags:
  - kraken
  - watchlist
  - automation
  - movies
 ---
 # Watchlist Automation — Полный Flow
 Полная цепочка: как `family/documents/movies-watchlist.md` превращается в скачанный контент.
 ## Полная цепочка
 ```
 [вс 09:00] watchlist-discover  ←  KP API топ фильмов 2024-2025
                  ↓ добавляет в секцию "Новинки 👍/👎"
         movies-watchlist.md
         Alex ставит 👍 / 👎
                  ↓
 [ежедн 09:00] watchlist-resolve  ← SSH Кракен → resolve → commit
 [ежедн 10:00] watchlist-sync-down
  → process-thumbs (перемещает 👍 → начало списка)
  → sync-down (добавляет батч в Radarr/Sonarr)
                  ↓
 Radarr (7878) / Sonarr (8989)
  → Prowlarr (9696) → RuTracker / Kinozal(M) / NoNaMe / etc.
  → Transmission (9091)
  → /media/movies-radarr или /media/series-sonarr
                  ↓
 router.py (Custom Script) → читает жанры из NFO/TMDb
  → symlink в /media/{movies,cartoons,documentaries,...}/
                  ↓
 Jellyfin (8096) → rescan → виден контент
 ```
 ## Статусы в movies-watchlist.md
 | Символ | Значение | Действие |
 |--------|---------|---------|
 | `[ ]` | не смотрел, в очереди | sync-down добавляет в Radarr/Sonarr |
 | `[x]` | просмотрено | sync-up из Jellyfin watched history |
 | `⬇️` | добавлено в Radarr/Sonarr | ждёт скачки |
 | `👍` | нравится (новинка) | process-thumbs переносит в начало → попадёт в sync-down |
 | `👎` | не хочу (новинка) | process-thumbs перемещает в `## Новинки👎` |
 | `🗓️` | upcoming (ещё не вышел) | discover помечает, не скачивается |
 | `❓` | не найдено / ambiguous | ждёт ручного уточнения |
 | `🧟‍♀️` | horror (genre_id=27) | информационный маркер |
 ## Структура секций movies-watchlist.md
 ```
 ## Новинки - 👍/👎   ← discover добавляет сюда
 ## Фильмы            ← основной список, отступ 2 пробела (  - [ ])
 ## Мультфильмы
 ## Аниме
 ## Новинки👎         ← без пробела перед 👎
 ## Связанные заметки
 ```
 **Важно:** `process_thumbs` автоматически определяет отступ из `## Фильмы` и сохраняет при переносе. `SECTION_THUMBDN = "## Новинки👎"` (без пробела) — должно точно совпадать с заголовком.
 ## Cron Jobs (на Кракене с 2026-05-27)
 Весь watchlist pipeline работает на Кракене (мигрировал с Eagle 2026-05-27).
 | Job | Расписание | Скрипт |
 |-----|-----------|--------|
 | `watchlist-nightly` | ежедн. 01:00 | `~/.hermes/scripts/watchlist-nightly.sh` |
 | `watchlist-discover` | вс 09:00 | `~/.hermes/scripts/watchlist-discover.sh` |
 **watchlist-nightly.sh** (на Кракене):
 1. `sync-vault.sh` (pull) → `process-thumbs --apply` → `sync-vault.sh` (push)
 2. `resolve --recheck --apply` → `sync-down --apply --batch 5` → `sync-up --apply` → `sync-vault.sh` (push)
 **Пути на Кракене (HDD UUID 49e8f586-3839-4c5d-a1e1-58bfc3579ade):**
 - `/home/kraken/obsidian` → symlink на `/srv/dev-disk-by-uuid-.../obsidian`
 - watchlist-sync: `/srv/dev-disk-by-uuid-.../Developer/watchlist-sync`
 ## Discover — Фильтрация
 | Тип | Порог |
 |-----|-------|
 | Мировые | IMDb ≥ 7.0 или KP ≥ 7.0 |
 | Российские | KP ≥ 8.5 (защита от накрутки) |
 | Upcoming | год ≥ текущий−1 |
 | Минимум голосов | IMDb ≥ 1000 или KP ≥ 500 |
 KP API endpoint: `https://api.poiskkino.dev/v1.4/movie` (redirect с api.kinopoisk.dev).
 ## *arr Stack — Индексеры (Prowlarr)
 | ID | Имя | Тип | Примечание |
 |----|-----|-----|-----------|
 | 1 | RuTracker | semi-private | блокирует при rate limit на сутки |
 | 2 | RuTor | public | поиск по imdbid |
 | 3 | Byrutor | public | |
 | 4 | NoNaMe Club | semi-private | анонимный |
 | 5 | Kinozal | semi-private | резерв |
 | 6 | Kinozal (M) | semi-private | магнет ✅ — без grab limit, **предпочтительный** |
 **Pi-hole питфолл:** блокирует `skyhook.sonarr.tv` → Sonarr/Radarr поиск молча не запускается. Фикс: `dns: [8.8.8.8]` в docker-compose.yml.
 ## Router Script — Маршрутизация по жанру
 После импорта Sonarr/Radarr: `router.py --apply` создаёт symlinks:
 - Animation (не R/18+) → `/media/cartoons/` или `/media/cartoons-series/`
 - Documentary → `/media/documentaries/` или `/media/documentaries-series/`
 - Прочее → `/media/movies/` или `/media/series/`
 Копирует NFO + постер рядом с symlink (Jellyfin не видит метадату через symlink напрямую).
 ## watchlist-sync — Python CLI
 Репо: `~/Developer/watchlist-sync` (GitHub: `mallexxx/watchlist-sync`).
 ```
 watchlist-sync resolve   — TMDB + KP API → ID, тип (movie/tv)
 watchlist-sync sync-down — добавить батч (max 5) в Radarr/Sonarr, поставить ⬇️
 watchlist-sync sync-up   — Jellyfin watched → [x] в .md
 ```
 **Резолвер:** TMDB `/search/multi` + KP fallback. Пороги: `min_rating: 6.0`, `min_score: 0.75`. При 2+ кандидатах → `❓` (LLM разрешает в cron каждые 6ч, нерешённые → уточнение в Zulip).
 **Stage 2 (после ≥50 просмотров):** AI-curated recommendations — три списка (с женой / один / семья) на основе TMDB профиля, добавляются в конец watchlist как `## 🤖 Рекомендации (YYYY-WNN)`.
 Jellyfin library mapping: Movies → `movies`, Cartoons → `mixed` (movies + episodes).
 ## Питфоллы
 ### KP Markdown Link Parsing Bug
 Фильмы из Kinopoisk с синтаксисом `[Title](https://kinopoisk.ru/film/12345/) (2025)` передавались как есть в TMDB search → не находились → помечались `❓` навсегда (`not i.ambiguous` пропускает при следующем запуске). Фикс: commit `2db1ed9` — извлекать plain title из markdown link до передачи в TMDB. Ошибочно помеченные `❓` требуют ручного `--recheck`.
 ### KP API Endpoint
 `api.kinopoisk.dev` редиректит на `api.poiskkino.dev/v1.4/movie`. Использовать destination redirect напрямую.
 ## Open Tasks (2026-05-20)
 - 🟡 Передавать Transmission locations через router script при каждом импорте (сейчас вручную)
 - 🔴 rsync невыполненных фильмов с HTPC на Кракен (`Фильмы не перенесенные с htpc на кракен.md`)
 - 🟡 Watchlist sync-up: добавить перенесённые фильмы в нужные разделы
 ## Связанные заметки
 - [[watchlist-discover]] — шаг discover: KP API, format, CLI команды
 - [[watchlist-sync]] — основной проект (resolve, sync-down, sync-up)
 - [[arr-stack-kraken]] — детальные питфоллы *arr стека
 - [[jellyfin-transcode-rpi5]] — Jellyfin PGS/ASS питфоллы
@@ -76,12 +76,12 @@ watchlist-sync process-thumbs --apply
 ---
-## Cron jobs (Hermes)
+## Cron jobs (Hermes, на Кракене с 2026-05-27)
 | Job | Schedule | Действие |
 |-----|----------|----------|
-| `watchlist-discover` (`6aba6979b8c4`) | вс 09:00 | discover --apply + git commit |
+| `watchlist-discover` | вс 09:00 | discover --apply + git commit (Кракен) |
-| `watchlist-sync-down` (`7d12b6d48786`) | ежедн. 10:00 | process-thumbs --apply → sync-down --apply |
+| `watchlist-nightly` | ежедн. 01:00 | process-thumbs → resolve → sync-down → sync-up (Кракен) |
 ---
@@ -0,0 +1,87 @@
 ---
 title: Media Pipeline Pitfalls
 created: '2026-05-23'
 updated: '2026-05-27'
 type: tech
 namespace: family
 tags: [media-pipeline, pitfalls, torrents, infra]
 related:
  - "[[tech/arr-stack-kraken]]"
  - "[[concepts/watchlist-automation]]"
 ---
 # Media Pipeline Pitfalls
 ## Torrents — Do Not Rename Files
 Never rename torrent source files or folders while a torrent is active.
 Transmission tracks files by path. Renaming breaks the association and
 causes re-download or stalled seeding.
 Правильный порядок (когда файл уже лежит в нужном месте, но с другим кейсом):
 1. Переименовать файл/папку на диске (Linux ext4 case-sensitive)
 2. Вызвать `torrent-set-location` с новым путём + `move=false`
 3. Запустить торрент на сидирование
 ## torrent-set-location Updates downloadDir
 `torrent-set-location` in the Transmission RPC updates `downloadDir` in
 the torrent metadata. Use this when moving completed files, not a manual
 rename. Sequence:
 1. Move files to new location on disk
 2. Call `torrent-set-location` with the new path + `move=false`
 3. Verify torrent goes back to seeding state
 ## Router Creates Subdirectories — Transmission downloadDir Stale
 `router.py` creates subdirectory per title under the genre folder
 (lowercase name, e.g. `/media/cartoons/бобик в гостях у барбоса/`).
 Transmission still holds the old `downloadDir` pointing to the parent
 (`/media/cartoons/`). Result: torrents show "No data found" error.
 Fix:
 1. Find the actual subdirectory on disk
 2. Call `torrent-set-location` with the subdirectory path + `move=false`
 3. Transmission verifies and resumes seeding
 ## Alpine Container — No Docker-in-Docker
 `on-download-complete.sh` runs inside the Transmission Alpine container.
 Docker CLI is not available there — using `docker run` inside the container
 fails silently or errors. Python 3.14 IS available in the Alpine image.
 Solution: `sync.py` (Python3, ~190 lines) in the same container:
 - Reads `config.json` for sorting rules + credentials (same file as linker container)
 - Queries TMDB for genre routing
 - Creates hardlinks + calls Transmission RPC `torrent-set-location`
 Location: `/srv/.../docker/media-pipeline/sync.py`
 ## Transmission download-dir — без /complete
 download-dir: `/downloads` (не `/downloads/complete`).
 incomplete-dir: `/downloads/incomplete` (enabled).
 Менять через остановку Transmission → правка `settings.json` → запуск.
 ## media-router.sh — Telegram-уведомления
 Скрипт-обёртка над `router.py`. Запускается из crontab каждые 10 минут.
 - При `Nothing to do` — SILENT
 - При активности — отправляет отчёт в Telegram Kraken (kraken_htpc_bot)
 - `BOT_TOKEN` и `CHAT_ID` хардкодом в скрипте
 ## Удаление дубликатов из downloads/complete
 После перемещения файлов в `/media/{movies,cartoons,series,...}/`:
 1. Проверить, что файлы в movies — **реальные** (-rwx), не symlink'и
 2. Проверить что inode разные (это копии, не один файл)
 3. Удалить из `downloads/complete/`
 4. Обновить путь в Transmission
 ## General Rules
 - Never touch source files/folders (media-pipeline USER.md rule)
 - `resolve-manual` is emergency-only
 - NFO files: do not create manually; let the pipeline handle them
 - Never delete test files from the pipeline project
@@ -0,0 +1,75 @@
 ---
 namespace: work
 tags: [system, agent, memory, architecture, ai]
 created: '2026-05-18'
 updated: '2026-05-18'
 last_synced: '2026-05-18'
 confidence: 0.85
 sources:
  - arXiv 2603.07670 (Memory for Autonomous LLM Agents, март 2026)
  - zylos.ai AI Agent Memory Architectures survey (апрель 2026)
  - wiki/raw/inbox/research-vault-strategy-memory-20260516.md
 ---
 # Agent Memory Architecture
 Когнитивная таксономия памяти для LLM-агентов, основанная на arXiv 2603.07670. Применительно к personal-os (Hermes).
 ## Три уровня памяти
 | Уровень | Определение | Реализация в Hermes |
 |---------|-------------|----------------------|
 | **Episodic** | Сессионные логи — что произошло в конкретных взаимодействиях | SQLite + `session_search` ✅ |
 | **Semantic** | Факты, предпочтения, постоянное знание | `MEMORY.md` + `USER.md` (нужна curation) |
 | **Procedural** | Навыки, workflows, пошаговые паттерны | `skills/` ✅ |
 ## Ключевые выводы из arXiv 2603.07670
 - **Gap между "есть память" и "нет памяти"** > gap между разными LLM backbone. Выбор памяти важнее выбора модели.
 - **Без рефлексии агент деградирует:** в Generative Agents эксперименте — 48 ч без memory reflection → repetitive behavior.
 - **Summarization drift:** после 3+ циклов сжатия критические инструкции теряются. Решение: vault как immutable store, не только MEMORY.md.
 ## Overflow Rule (MEMORY.md)
 Запись в MEMORY.md — только короткие стабильные факты:
 - Длина > 150 символов → перенести в vault, оставить pointer
 - Содержит пошаговые инструкции → в `skills/`
 - Детальный технический контекст → в `wiki/tech/`
 ```
 MEMORY.md: "media-pipeline питфолы → wiki/tech/media-pipeline-pitfalls.md"
 wiki/tech/media-pipeline-pitfalls.md: (полный разбор)
 ```
 ## 4-tier pipeline (LLM Wiki v2 / rohitg00)
 Расширенная модель:
 ```
 Working Memory   → сырые наблюдения текущей сессии
 Episodic Memory  → сжатые саммари сессий
 Semantic Memory  → кросс-сессионные факты (wiki)
 Procedural Memory → паттерны, workflows, skills
 ```
 **Confidence scoring:** каждый факт имеет score (кол-во источников, свежесть, противоречия). Устаревает со временем.
 **Event-driven automation:**
 - New source → auto-ingest
 - Session end → compress into observations
 - On query → check if answer worth filing back
 - On schedule → periodic lint
 ## Правило разграничения (Alex's personal-os)
 ```
 MEMORY.md       → SSH хосты, namespace rules, токены, конфиги (≤150 chars)
 USER.md         → предпочтения, стиль (редко меняется)
 wiki/tech/      → технические питфолы, баг-паттерны (длинные, с контекстом)
 personal/projects/ → статус проектов, дебаггинг-логи
 skills/         → процедуры и workflows пошагово
 ```
 ## Связанные страницы
 - [[personal-os-architecture]] — как память встроена в общий стек
 - [[wiki-ingest-process]] — как сессии кристаллизуются в wiki
 - [[personal-os-self-modification]] — как система эволюционирует
@@ -0,0 +1,113 @@
 ---
 title: Autonomous Agent Safety Patterns
 created: '2026-05-24'
 updated: '2026-05-24'
 type: concept
 tags: [agent, security, architecture, executor, rules]
 sources:
  - wiki/concepts/executor-security-incident.md
  - wiki/concepts/executor-orchestrator.md
  - wiki/personal-os-agent-rules.md
 confidence: high
 related:
  - "[[concepts/executor-security-incident]]"
  - "[[concepts/executor-orchestrator]]"
  - "[[personal-os-agent-rules]]"
 ---
 # Autonomous Agent Safety Patterns
 Design principles for autonomous LLM agents distilled from the 2026-05-11
 executor security incident. General enough to apply beyond the personal-os context.
 ## The Three Failure Modes (from incident)
 ### 1. Mandatory prompt steps that outrank modes
 The executor wrote Asana comments during "recording-only" mode because the
 worker prompt declared comment posting a *mandatory completion action* — not
 subject to mode flags.
 **Pattern:** Every completion action (write to external system, post comment,
 send notification) must be guarded by a mode check that the agent cannot
 override.
 ```
 IF mode == "recording-only":
    SKIP external writes
    LOG "would have posted: ..." instead
 ```
 ### 2. Boundary policies that only cover exfiltration
 The lethal-trifecta policy blocked HTTP to attacker domains after internal
 MCP access. It did NOT block writes *to* internal systems (Asana).
 **Pattern:** Separate the threat models:
 - **Exfiltration** = data leaving to unauthorized destinations → block outbound
 - **Unauthorized writes** = data going to authorized systems without approval → require
  explicit confirmation gate per write type
 These are different controls. A policy that only covers one leaves the other open.
 ### 3. High-level directives not propagated to sub-prompts
 "Don't touch anything" was a session-level directive. The worker
 sub-prompt (spawned per task) didn't inherit it — it ran its own
 completion protocol.
 **Pattern:** Mode flags must be passed explicitly to every spawned
 sub-process/sub-prompt as a first-class parameter, not assumed from
 session context.
 ## The Auto-Approve Table Pattern
 From [[concepts/executor-orchestrator]]: instead of blanket trust or blanket
 denial, classify actions by risk tier:
 | Risk | Action type | Default |
 |------|-------------|---------|
 | Low | git, build, test, worktree | auto-approve |
 | Medium | draft PR, push branch | auto-approve with log |
 | High | post Asana comment, merge PR | require Alex confirmation |
 | Blocked | autonomous Asana write | denied always |
 This table lives in the orchestrator, not the worker. Workers *request*
 actions; orchestrator decides.
 ## Least-Privilege Credential Design
 From incident: `ASANA_API_KEY` was full-account CRUD (PATs are not granular).
 One compromised agent → full Asana write access.
 **Pattern:** Scope credentials to the minimum required operation:
 - Read-only keys for read-only agents
 - Write keys injected only at the moment of approved write
 - Never persist write credentials in always-on agent environments
 ## Audit Before Autonomous
 The incident ran 18 PRs and 5 Asana comments before detection. Detection only
 happened because Alex checked manually.
 **Pattern:** Autonomous runs should produce an observable audit trail that
 can be reviewed without running the agent:
 - Structured log per run (not just stdout)
 - Diff-friendly format (what was written, to where, at what time)
 - Periodic summary posted to a channel Alex monitors
 ## Summary: Checklist for New Autonomous Agents
 - [ ] Every external write is behind a mode-guard (can "recording-only" block it?)
 - [ ] Exfiltration and unauthorized-write policies are separate controls
 - [ ] Mode flags propagate explicitly to sub-prompts
 - [ ] Auto-approve table is in the orchestrator, not the worker
 - [ ] Credentials are scoped to minimum; write keys not always-on
 - [ ] Each run produces a structured audit log
 - [ ] Audit log goes somewhere Alex sees without hunting
 ## See Also
 - [[concepts/executor-security-incident]] — incident post-mortem with full timeline
 - [[concepts/executor-orchestrator]] — post-incident architecture (orchestrator pattern)
 - [[personal-os-agent-rules]] — Eagle's specific rules derived from these patterns
@@ -0,0 +1,82 @@
 ---
 title: Hermes Deployment Patterns
 created: '2026-05-29'
 updated: '2026-05-29'
 type: concept
 namespace: personal
 tags: [hermes, architecture, agent, eagle, kraken, infra]
 sources: []
 confidence: medium
 related:
  - "[[tech/hermes-eagle-mac]]"
  - "[[tech/hermes-docker-kraken]]"
  - "[[tech/hermes-kraken-api]]"
  - "[[personal-os-architecture]]"
 ---
 # Hermes Deployment Patterns
 Three distinct ways Hermes runs in the Personal OS ecosystem. Each serves
 a different access model and client type.
 ## Pattern 1: Eagle Native (Mac M4)
 **Where:** Eagle Mac M4 Max, native process (not Docker)  
 **Transport:** Zulip (Docker)  
 **Model backend:** `openclaw-claude-proxy` on port 3456 — wraps
 `claude --print` as an OpenAI-compatible endpoint, preserving tool_use.  
 **Autostart:** launchd (`ai.claude-proxy.plist`)
 **Why native:** Mac file system access, MCP tools (obsidian-mcp), and the
 cron wiki-curation job all need full host access. Docker would require
 volume mounts for every integration.
 **Key pitfall:** `claude-proxy` wrapper script must `source ~/.hermes/.env`
 explicitly — launchd does not inherit login session env. See
 [[tech/hermes-eagle-mac]].
 ## Pattern 2: Kraken Docker (RPi5)
 **Where:** Kraken RPi5, `docker run` (not compose)  
 **Transport:** Zulip (same instance or separate)  
 **Model backend:** Gemini or OpenRouter via Hermes gateway  
 **Autostart:** `--restart unless-stopped` on the container
 **Why docker run, not compose:** explicit restart behavior; avoids accidental
 `docker compose down` wipes. Config volume: `~/.hermes` on Kraken host.
 See [[tech/hermes-docker-kraken]].
 ## Pattern 3: Kraken API Server (OpenAI-compat)
 **Where:** Kraken RPi5, same hermes-kraken container  
 **Transport:** HTTPS via Cloudflare Tunnel (`kraken.qentra.top`)  
 **Model backend:** Gemini / OpenRouter (same gateway)  
 **Clients:** Android Aide app (BYOK → Custom Endpoint), any OpenAI SDK
 **Why Cloudflare Tunnel:** no port-forwarding on home router required.
 The tunnel terminates at cloudflared running with `network_mode: host`,
 hitting `localhost:8642` directly.
 See [[tech/hermes-kraken-api]].
 ## Comparison
 | Dimension | Eagle Native | Kraken Docker | Kraken API |
 |-----------|-------------|---------------|-----------|
 | Model | claude-sonnet via proxy | Gemini/ORouter | Gemini/ORouter |
 | Transport | Zulip | Zulip | HTTPS REST |
 | Clients | Cron, MCP tools | Zulip bot clients | Mobile / OpenAI SDK |
 | External access | No | No | Yes (CF Tunnel) |
 | MCP/tools | Full (host access) | Docker volumes | Not applicable |
 | Rate limits | Claude OAuth (proxy workaround) | API keys | API keys |
 ## Design Principle
 Hermes deployments follow the client's access model:
 - **Interactive/tool-heavy** → Eagle native (full host, MCP)
 - **Always-on background** → Kraken Docker (low-power, 24/7)
 - **Mobile / external** → Kraken API server (HTTPS, standard protocol)
 This avoids running a single large instance with conflicting requirements.
 See [[personal-os-architecture]] for the full system overview.
@@ -0,0 +1,76 @@
 ---
 title: Hermes — Native (Eagle) vs Docker (Kraken) Deployment
 created: '2026-05-22'
 updated: '2026-05-22'
 last_synced: '2026-05-22'
 type: comparison
 namespace: work
 tags:
  - hermes
  - deployment
  - mac
  - kraken
  - comparison
 confidence: 0.9
 sources:
  - wiki/tech/hermes-eagle-mac.md
  - wiki/tech/hermes-docker-kraken.md
 ---
 # Hermes — Native (Eagle) vs Docker (Kraken)
 Два способа запуска Hermes Agent: нативно на Mac M4 Max и в Docker на Raspberry Pi 5.
 ## Сравнение
 | | Eagle (Mac M4 Max) | Kraken (RPi5) |
 |--|-------------------|--------------|
 | Запуск | `hermes gateway` (нативно) | `docker run` (не compose) |
 | Транспорт | Zulip (в Docker) | Zulip (тот же) |
 | Модель | openclaw-claude-proxy (`localhost:3456`) | openclaw-claude-proxy (аналогично) |
 | Процесс-менеджер | launchd (`ai.claude-proxy`) | Docker `--restart=unless-stopped` |
 | PATH в launchd | нужен явный `export PATH=...` | нет проблемы (Docker env) |
 | Токен | `source ~/.hermes/.env` в wrapper | передаётся через `-e` флаг docker run |
 | MCP | mcpvault (`/Users/admin/obsidian`) | mcpvault (`/vault` — mount) |
 | Логи Claude-proxy | `~/.hermes/logs/claude-proxy.log` | Docker logs |
 | Навыки | все Hermes skillsets | ограниченный набор (нет macOS tools) |
 | HERMES_SKIP_CHOWN | не нужно | нужно (`-e HERMES_SKIP_CHOWN=1`) |
 ## Pitfalls Eagle (Mac M4 Max)
 **openclaw-claude-proxy через launchd:**
 1. launchd не наследует login-сессию → CLAUDE_CODE_OAUTH_TOKEN не виден → "Not logged in"
   - Фикс: явный `source ~/.hermes/.env` в wrapper-скрипте
 2. PATH не содержит `/opt/homebrew/bin` → Claude CLI не найден
   - Фикс: явный `export PATH="/opt/homebrew/bin:..."` в wrapper-скрипте
 3. Порт 3456 занят после перезагрузки:
   - `lsof -ti :3456 | xargs kill -9 && launchctl unload && launchctl load ...`
 4. `provider: openai` не существует в Hermes — нужно `custom`
 5. `base_url` должен включать `/v1` (Hermes дописывает `/chat/completions`)
 **Zulip Docker:**
 - RabbitMQ 4.x Khepri WAL crash при переполнении диска → пользователи исчезают
  - Фикс: `docker system prune` (освободить место) + пересоздать volume если повреждён
 - Без log rotation логи заполняют Docker VM (~6 ГБ за несколько месяцев)
 - Mac Docker Desktop sparse disk — `docker system prune` запускает compaction
 ## Pitfalls Kraken (Docker)
 - `HERMES_SKIP_CHOWN=1` обязателен (RPi5 не имеет прав chown в контейнере)
 - `--init` флаг обязателен (zombie reaping)
 - `--network=host` для доступа к Zulip на том же хосте
 - Vault монтируется через `-v /home/kraken/obsidian:/vault`
 - Полный набор правил → [[tech/hermes-docker-kraken]]
 ## Общее для обоих
 - Модель: `claude-sonnet-4-6` через openclaw-claude-proxy
 - MCP: mcpvault (vault path разный, но tool API одинаковый)
 - Zulip transport: организация `zulip.mallexxx.duckdns.org`
 - Obsidian vault синхронизируется через git
 ## Связанные страницы
 - [[tech/hermes-eagle-mac]] — детали настройки на Eagle
 - [[tech/hermes-docker-kraken]] — детали Docker деплоя на Кракен
 - [[personal-os-architecture]] — полная карта системы
 - [[tech/kraken-network]] — сетевая топология
@@ -0,0 +1,82 @@
 ---
 namespace: work
 tags:
  - agent
  - memory
  - wiki
  - synthesis
  - vault
 created: '2026-05-19'
 updated: '2026-05-19'
 type: concept
 confidence: 0.9
 sources:
  - wiki/concepts/agent-memory-architecture.md
  - wiki/concepts/vault-strategy.md
  - wiki/wiki-ingest-process.md
  - wiki/personal-os-self-modification.md
 ---
 # Knowledge Lifecycle — From Session to Permanent Memory
 Синтез: как знание движется от рабочей сессии к постоянной памяти в personal-os. Объединяет [[concepts/agent-memory-architecture]], [[concepts/vault-strategy]] и [[wiki-ingest-process]].
 ## Общая схема
 ```
 Событие/Разговор
        │
        ▼
 Working Memory (контекст сессии, эфемерный)
        │  session_search + SHA256 hash
        ▼
 Episodic Memory (SQLite sessions, сжатые саммари)
        │  crystallization (wiki-curation cron 02:00)
        ▼
 Semantic Memory (wiki/ pages, постоянное знание)
        │  wiki-ingest 22:00 (launchd, claude -p)
        │  overflow rule (>150 chars → vault)
        ▼
 Procedural Memory (skills/, workflows)
 ```
 ## Три барьера кристаллизации
 Не всё знание заслуживает кристаллизации. Барьеры:
 | Уровень | Критерий | Место |
 |---------|----------|-------|
 | Session → Wiki | Painful to re-derive? Fits domain? Contains facts (not conversation)? | `wiki/` |
 | Wiki → MEMORY.md | Стабильный факт, ≤150 символов? | `~/.hermes/MEMORY.md` |
 | Any → Skills | Пошаговая процедура, повторяемая? | `~/.hermes/skills/` |
 **Правило overflow:** MEMORY.md — только короткие стабильные факты. Детали → в wiki с pointer в MEMORY.md: `"media-pipeline питфолы → wiki/tech/media-pipeline-pitfalls.md"`.
 ## Три задачи vault (не смешивать)
 1. **Vault Enrichment** — frontmatter + aliases + wikilinks на `personal/`, `family/`
 2. **LLM Wiki** — crystallization sessions → `wiki/` (этот файл про это)
 3. **Proactive Research** — агент генерирует гипотезы → `wiki/research-queue.md` → Saturday cron
 ## Риски деградации
 - **Summarization drift:** после 3+ циклов сжатия теряются критические инструкции. Решение: vault как immutable store (не перезаписывать, только аппендить/обновлять dated sections).
 - **Repetitive behavior:** без weekly reflection агент деградирует (Generative Agents, 48ч без рефлексии). Фикс: Retrospector каждую пятницу читает corrections_log.
 - **Orphaned knowledge:** факт записан, но никогда не читается. Фикс: lint (orphan pages), провалидированные wikilinks.
 ## Инструменты в personal-os
 | Инструмент | Функция |
 |-----------|---------|
 | wiki-curation cron (02:00) | Crystallization: sessions → wiki |
 | wiki-ingest launchd (22:00) | Synthesis: raw/ symlinks → wiki pages |
 | `session_search` | Episodic retrieval |
 | obsidian MCP | Semantic retrieval |
 | MEMORY.md | Fast facts, overflow pointers |
 | research-queue.md | Proactive research agenda |
 ## Связанные страницы
 - [[concepts/agent-memory-architecture]] — когнитивная таксономия памяти (episodic/semantic/procedural)
 - [[concepts/vault-strategy]] — три задачи vault: enrichment, LLM wiki, proactive research
 - [[wiki-ingest-process]] — hash-based incremental ingest из raw/ symlinks
 - [[personal-os-self-modification]] — как система эволюционирует через корректировки
@@ -0,0 +1,107 @@
 ---
 title: Multi-Agent Design Patterns
 created: '2026-05-25'
 updated: '2026-05-25'
 type: concept
 namespace: work
 tags: [agent, architecture, system]
 confidence: medium
 sources:
  - wiki/concepts/executor-orchestrator.md
  - wiki/concepts/autonomous-agent-safety.md
  - wiki/concepts/agent-memory-architecture.md
 related:
  - "[[concepts/executor-orchestrator]]"
  - "[[concepts/autonomous-agent-safety]]"
  - "[[concepts/agent-memory-architecture]]"
 ---
 # Multi-Agent Design Patterns
 Synthesis of recurring patterns across the personal-os multi-agent system
 and related agent architectures. Distilled from [[concepts/executor-orchestrator]],
 [[concepts/autonomous-agent-safety]], and [[concepts/agent-memory-architecture]].
 ## Pattern 1 — Orchestrator / Worker Split
 **What:** One agent owns conversation state and decision authority
 (orchestrator); spawns separate worker agents for discrete tasks.
 **Why:** Tight coupling between conversational layer and execution layer
 causes mid-task interruptions and breaks user flow. Separate concerns.
 **In personal-os:** Eagle (orchestrator) → Executor (worker) via Zulip.
 **In psychologist app:** Narrator (orchestrator/mediator) ← Analyst (worker).
 **Key constraint:** Worker communicates only through structured messages;
 orchestrator has the only escalation path to the human.
 ## Pattern 2 — Scope Boundary + Auto-Approve Table
 **What:** Predefine which actions a worker may take autonomously and which
 require escalation. Publish the table explicitly.
 **Why:** Autonomous agents fail catastrophically when they expand scope
 unexpectedly (see [[concepts/executor-security-incident]]). Explicit tables
 make failure modes visible.
 **Implementation:** Message-type-based approval table. Unknown message types
 default to escalation, never to silent proceed.
 | Risk Level | Agent Action |
 |---|---|
 | Low (read, build, test) | Auto-approve |
 | Medium (write external, open PR) | Auto-approve with logging |
 | High (comment on others, merge) | Always escalate |
 | Unknown | Always escalate |
 ## Pattern 3 — Memory Layer Separation
 **What:** Separate in-session state (working memory) from cross-session
 knowledge (semantic memory) from immutable facts (procedural/episodic).
 **Why:** Agents that blur these layers either hallucinate stable facts or
 fail to retain important session-to-session knowledge.
 **In personal-os:** status.md (working) / wiki pages (semantic) /
 SCHEMA.md + vault-filling-guide (procedural). See [[concepts/agent-memory-architecture]].
 **Pattern rule:** Never update semantic memory from within an active session.
 Crystallize post-session. Never trust working memory as a source of truth
 for facts (always re-derive from semantic layer at session start).
 ## Pattern 4 — Role Specialization over Generalization
 **What:** Instead of one agent with a long system prompt covering all roles,
 split into agents with narrow, non-overlapping responsibilities.
 **Why:** LLMs produce better outputs when role context is tight. Conflated
 roles lead to persona drift ("is it being analytical or empathetic right now?").
 **In psychologist app:** Analyst stays in 3rd-person analytical mode;
 Narrator stays in 1st-person user-facing mode. Neither crosses the boundary.
 **Trade-off:** Coordination overhead (structured message passing between
 agents). Worthwhile when roles genuinely conflict (analysis vs. empathy).
 ## Pattern 5 — Deterministic Algorithm for Predictable Steps
 **What:** Identify steps that look like LLM tasks but are actually
 deterministic (sequencing, routing, counting) and implement them as code,
 not as LLM calls.
 **Why:** LLMs are expensive and non-deterministic. Steps like "show next
 question in list" do not benefit from LLM reasoning and introduce failure modes.
 **Examples:**
 - Question delivery in psychologist app: batch generated by Analyst,
  sequenced by UI algorithm — not an LLM call per question
 - Approval table in Executor: code switch on message type, not LLM judgment
 - Vault namespace routing: rules in tech/vault-namespace, not agent inference
 ## See Also
 - [[concepts/executor-orchestrator]] — concrete orchestrator/worker implementation
 - [[concepts/autonomous-agent-safety]] — safety checklist derived from incidents
 - [[concepts/agent-memory-architecture]] — memory taxonomy for LLM agents
 - [[entities/psychologist-app]] — dual-agent architecture (patterns 1 and 4)
@@ -0,0 +1,71 @@
 ---
 title: Multi-Host Cron Topology
 created: '2026-05-27'
 updated: '2026-05-27'
 type: concept
 namespace: personal
 tags: [system, agent, eagle, kraken, pipeline, sync]
 confidence: medium
 sources: []
 ---
 # Multi-Host Cron Topology
 Synthesis of how scheduled jobs are distributed across Eagle and Kraken.
 Co-occurs in [[tech/hermes-eagle-mac]], [[tech/hermes-docker-kraken]],
 [[concepts/watchlist-automation]], and [[personal-os-agent-rules]].
 ## Design Principle
 Jobs run on the host closest to their data. Eagle handles
 agent-intelligence tasks (briefs, wiki curation). Kraken handles
 media-pipeline tasks (watchlist, arr stack). Duplication is a bug.
 ## Eagle (Mac M4) — Agent Jobs
 | Job | Schedule | Purpose |
 |-----|----------|---------|
 | `wiki-curation` | daily 02:00 | Crystallise vault → wiki (llm-wiki skill) |
 | `vault-enrichment` | daily 03:00 | Enrich personal/family notes |
 | `cross-enrichment` | daily 04:00 | Cross-namespace enrichment + memory curation |
 | `proactive-research` | Sat 05:00 | Proactive gap research |
 | `data-pipeline` | 30min, workdays | sync.js + generate-status.js → status.md |
 | `daily-brief` | workday morning | Morning brief to Zulip |
 | `inbox-triage` | workday noon | Asana inbox triage |
 | `weekly-review` | Fri evening | Weekly review |
 Eagle crons are Hermes agent jobs — require LLM, vault access,
 Asana context. All run via Hermes native (not Docker). See
 [[tech/hermes-eagle-mac]].
 ## Kraken (RPi5) — Pipeline Jobs
 | Job | Schedule | Purpose |
 |-----|----------|---------|
 | `watchlist-nightly` | daily 01:00 | process-thumbs + resolve + sync-down/up |
 | `watchlist-discover` | Sun 09:00 | KP API top films → watchlist Новинки |
 | `on-download-complete` | event-triggered | media-pipeline: sort + Jellyfin rescan |
 Kraken crons are shell scripts or Python3 — deterministic, no LLM.
 Run via Hermes cron on Kraken Hermes instance (port 8642, Docker).
 See [[tech/hermes-docker-kraken]] and [[concepts/watchlist-automation]].
 ## Migration History
 - 2026-05-27: `watchlist-nightly` and `watchlist-discover` moved from
  Eagle to Kraken. Eagle was running them via SSH to Kraken which was
  fragile and required Eagle's network path to Kraken to be stable.
  Running on Kraken directly eliminates that dependency.
 ## Pitfall: Job Duplication
 If the same shell-script job runs on both Eagle and Kraken, the
 Radarr/Sonarr API sees double requests. Symptom: duplicate ⬇️
 entries or double-adds. Check: `hermes cronjob list` on both hosts.
 ## See Also
 - [[personal-os-agent-rules]] — Eagle's rules and allowed writes
 - [[tech/hermes-eagle-mac]] — Eagle Hermes config
 - [[tech/hermes-docker-kraken]] — Kraken Hermes Docker setup
 - [[concepts/watchlist-automation]] — Full watchlist flow
@@ -0,0 +1,114 @@
 # obsidian-mcp-wrapper
 > **Файл**: `~/scripts/obsidian-mcp-wrapper.js`  
 > **Назначение**: прокси-обёртка над `obsidian-mcp`, решает четыре системных бага
 ---
 ## Проблемы, которые решает
 ### 1. ZodError при инициализации (obsidian-mcp v1.0.6)
 `obsidian-mcp` падал с ZodError сразу после запуска. Причина: Hermes отправляет  
 `notifications/initialized` с полем `"id": null`, а obsidian-mcp v1.0.6 использует  
 `.strict()` валидацию и не принимает лишние поля.
 **Fix**: wrapper перехватывает все notification-сообщения (без `result`/`error`) с `id === null`  
 и удаляет поле `id` перед передачей в child.
 ### 2. Race condition при gateway restart
 При рестарте Hermes gateway поднимает новый процесс `obsidian-mcp-wrapper`. Первые  
 параллельные tool-вызовы приходят пока child ещё инициализируется (~500ms) → они  
 тайм-аутились, circuit breaker открывался (3 фейла → 60s cooldown).
 **Fix**: wrapper буферизует все tool-вызовы до завершения handshake  
 (`initialize` → ответ → `notifications/initialized`), потом флашит очередь.
 ### 3. Corrupted large payloads (UTF-8 chunk split)
 При больших tool-вызовах (~200KB+) Node.js доставляет stdin в нескольких chunk-ах.  
 Старый код делал string split — JSON разрезался по байтам → UTF-8 multibyte символы  
 портились, `JSON.parse` падал, сообщение дропалось молча.
 **Симптом**: `edit_note` с большим контентом тихо зависал (30s timeout), в логах:
 ```
 [obsidian-wrapper] Non-JSON from Hermes (forwarding verbatim): {"jsonrpc": "2.0", "method": "tools/call", "id": 3, "params": {"name": "edit-not
 ```
 **Fix**: stdin и stdout читаются через `Buffer.concat` + `Buffer.slice` на `0x0a`.  
 Строка собирается полностью до передачи в `JSON.parse`.
 ### 4. Per-call watchdog (зависший child)
 Если child не ответил на `tools/call` / `tools/list` / `resources/*` за **5s** —  
 watchdog убивает процесс. После авторестарта call автоматически уходит в голову  
 очереди и ретраится.
 **Fix**: `armWatchdog(callLine)` → `setTimeout 5000ms` → `child.kill()` → `startChild()`.
 ---
 ## Как работает
 ```
 Hermes (stdin) → wrapper → obsidian-mcp (child)
                              ↑ auto-restart при краше (до 10 раз)
 ```
 **Состояния**:
 - `ready = false` — child стартует, все tool-вызовы в очередь
 - `ready = true` — handshake завершён, очередь флашится, всё проходит напрямую
 **Restart логика**:
 1. Child упал → `ready = false`, `restarts++`
 2. Новый child спавнится
 3. Wrapper реплеит сохранённый `initialize` → ждёт ответа с `serverInfo`
 4. Отправляет `notifications/initialized` (не форвардит Hermes — он не просил)
 5. `ready = true` → флаш очереди
 **Shutdown**:  
 На stdin EOF (`Hermes` закрыл процесс) — child убивается без авторестарта, wrapper выходит чисто.
 **Логи** (все в stderr с timestamp):
 ```
 [obsidian-wrapper] 2026-05-09T12:00:00.000Z Spawning obsidian-mcp (vault=/Users/admin/obsidian)
 [obsidian-wrapper] 2026-05-09T12:00:00.500Z Hermes → child (handshake complete): notifications/initialized
 [obsidian-wrapper] 2026-05-09T12:00:00.501Z Child ready — flushing queue (3 items)
 [obsidian-wrapper] 2026-05-09T12:00:01.200Z Stripped id:null from notification: notifications/initialized
 [obsidian-wrapper] 2026-05-09T12:00:06.000Z WATCHDOG: child did not respond in 5000ms for tools/call #7 — killing and restarting
 ```
 ---
 ## Конфиг Hermes
 `~/.hermes/config.yaml`:
 ```yaml
 obsidian:
  command: node
  args: [/Users/admin/scripts/obsidian-mcp-wrapper.js]
 ```
 Wrapper сам вызывает `/opt/homebrew/bin/obsidian-mcp /Users/admin/obsidian`.
 ---
 ## Производительность
 - Инициализация: ~587ms (без ZodError)
 - Overhead wrapper: negligible (pure Node.js child_process, нет npm-зависимостей)
 - MAX_RETRY: 10
 - CALL_TIMEOUT_MS: 5000ms (watchdog)
 ---
 ## История
 **2026-05-09 (1)** — создан после диагностики 58 ошибок `obsidian/... call failed` в логах Hermes.  
 Корневая причина — ZodError + race condition при старте. Wrapper написан вместо патча  
 исходников obsidian-mcp (патч не нужен, wrapper чище и не ломается при обновлении пакета).
 **2026-05-09 (2)** — фикс large payload: Buffer-based line splitting вместо string split  
 (`edit_note` с большим контентом молча дропался). Добавлен per-call watchdog (5s timeout → kill & retry).  
 MAX_RETRY повышен с 5 до 10.
@@ -0,0 +1,107 @@
 ---
 namespace: work
 tags: [system, agent, eagle, rules]
 last_updated: 2026-04-28
 confidence: 1.0
 ---
 # Personal OS — Agent Rules & Architecture
 Eagle (Орёл) is the Zulip-facing Hermes agent. This page documents what Eagle knows about its own environment and how to reason about it.
 ## Data Flow
 ```
 Asana API
  → sync.js (every 30 min, workdays via Hermes cron)
  → PostgreSQL (tasks, stories, task_edges, sync_state, task_annotations)
  → generate-status.js
  → ~/Developer/personal-os/asana_context.md  ← raw Asana context (inbox-check)
  → ~/context/status.md                        ← Eagle reads THIS
 ```
 Eagle **only reads** `~/context/status.md`. It never touches the DB directly or calls Asana API.
 ## Eagle's Knowledge Sources
 1. `~/context/status.md` — live Asana + ActivityWatch snapshot (updated every 30 min)
 2. `~/Developer/personal-os/briefs/daily/YYYY-MM-DD.md` — today's brief
 3. `~/Developer/personal-os/briefs/weekly/plan-MONDAY.md` — weekly plan
 4. `~/obsidian/wiki/` — knowledge base (via obsidian MCP)
 5. `~/Developer/personal-os/agent/` — playbooks and rules (via file tools)
 ## Feedback Loop
 When Alex corrects something:
 1. Edit the brief directly (show diff first, confirm before writing)
 2. If systemic → edit the prompt template in `agent/prompts/`
 3. Log correction silently to `corrections_log` table:
 ```sql
 INSERT INTO corrections_log (date, week_number, source, original_plan, correction, deferred_gids, reason_tag)
 VALUES (current_date, EXTRACT(WEEK FROM current_date)::int,
        '<source>', '<original>', '<user_message>',
        ARRAY[<gids>]::text[], '<reason_tag>');
 ```
 `source` values: `zulip_pushback` | `morning_brief_correction` | `manual`  
 `reason_tag` examples: `ship-review-crunch` | `urgent-bug` | `meeting-day` | `over-estimated` | `scope-change`
 Never announce the log insertion. It is silent instrumentation.
 ## Self-Diagnostics
 If pipeline seems stale, Eagle can check:
 ```bash
 stat -f "%Sm" ~/context/status.md
 # Should be < 40 min old on workdays
 ```
 If sync is broken:
 ```bash
 bash ~/scripts/run-pipeline.sh
 # Runs sync.js + generate-status.js + healthcheck
 ```
 If wiki is stale:
 ```bash
 bash ~/scripts/run-wiki-ingest.sh
 # Runs at 22:00 via launchd; call manually if needed
 ```
 ## Cron Schedule (Hermes)
 | Job | Schedule | Channel |
 |-----|----------|---------|
 | data-pipeline | */30 7-21 workdays | silent |
 | morning-brief | 08:30 workdays | #daily-brief |
 | eod-summary | 18:00 workdays | #daily-brief |
 | inbox-check | */30 9-19 workdays | #inbox |
 | weekly-plan | Mon 08:00 | #daily-brief |
 | weekly-review | Fri 17:00 | #daily-brief |
 | retrospector | Fri 17:30 | #retrospector |
 | commit-vault | 23:00 daily | silent |
 wiki-ingest runs at 22:00 via **launchd** (not Hermes) — because it needs Mac filesystem access.
 ## Allowed File Writes
 Eagle can write to:
 - `briefs/daily/YYYY-MM-DD.md`
 - `briefs/weekly/plan-MONDAY.md`
 - `briefs/weekly/YYYY-MM-DD.md`
 - `briefs/inbox/YYYY-MM-DD.md`
 - `agent/prompts/*.md` (with confirmation)
 - `~/obsidian/work/projects/SLUG.md`
 - `~/obsidian/work/decisions/YYYY-MM-TOPIC.md`
 - `~/obsidian/personal/`
 - `~/obsidian/family/`
 Never write to `obsidian/wiki/` directly — that's wiki-ingest's job.  
 Never write `corrections_log.md` — use the SQL INSERT above (table, not file).
 ## Activity Classification
 Work activity is classified via `aw-projects.json`. Projects with `namespace: "personal"` (e.g., AXPressDeck, media_files_db) appear as a footnote in the Activity section of status.md but are **not** counted as work time and **not** upserted to `activity_daily`.
 To re-classify a project (personal ↔ work), ask Eagle to edit `aw-projects.json`.
@@ -0,0 +1,161 @@
 ---
 namespace: work
 tags: [system, architecture]
 last_updated: 2026-04-28
 confidence: 1.0
 ---
 # Personal OS — Architecture
 ## Why It Exists
 See: `personal-os-purpose.md`
 ## Agents
 ### Стратег (Strategist) — data pipeline, no conversation
 - `~/scripts/run-pipeline.sh` → sync.js + generate-status.js every 30 min (workdays via Hermes cron)
 - Writes `~/context/status.md` and `~/Developer/personal-os/asana_context.md`
 - Writes daily AW activity summaries to `activity_daily` table with quadrant classification
 - No Zulip output — pure data layer
 ### Орёл / Eagle (Tactician + reactive layer) — Hermes Zulip agent
 - Reads `~/context/status.md`, daily/weekly briefs, vault via obsidian MCP
 - Zulip streams: `daily-brief` `inbox` `focus` `executor` `projects` `journal` `retrospector`
 - Cron jobs: generate-daily-brief (07:00 MTWRF), morning-brief (08:30 MTWRF), eod-summary (18:00 MTWRF), inbox-check (30 min 09–19 MTWRF), weekly-plan (Mon 08:00), weekly-review (Fri 17:00), retrospector (Fri 17:30), executor-autonomous (every 30 min 09–18 MTWRF), commit-vault (23:00 daily)
 - Logs corrections to `corrections_log` table (SQL INSERT, silently on pushback)
 - **Never accesses Asana API directly** — only reads pre-rendered markdown and DB
 ### Ретроспектор (Retrospector) — Friday pattern analysis
 - Runs as separate Hermes cron at 17:30 Friday → `#retrospector`
 - Sources: corrections_log table, status.md subtask counts, obsidian git log, activity_daily quadrants, stories visibility metric
 - Prompt: `~/Developer/personal-os/agent/prompts/retrospector.md`
 ### Исполнитель (Executor) — two modes
 **Manual mode**: triggered by "fix bug [GID]" in #executor
 - Single STOP gate after analysis; then autonomous: fix → build → test → draft PR → CI loop
 - Prompt: `~/Developer/personal-os/agent/prompts/executor-bug-fix.md`
 **Autonomous mode**: hourly cron (09–18 workdays) → #executor
 - Maintains a queue from: My Hack Days, Watched, O-L Backlog, stale My Tasks
 - Analyzes tasks → posts "[Auto] Ready to start" with complexity/feasibility
 - Waits for "go {gid}" to start; no reply = moves to next analysis
 - Max 1 active fix at a time; handles CI/review on open draft PRs
 - Stops touching a PR once Alex moves it out of draft or pushes commits
 - No Asana comments; no touching other people's PRs
 - Queue state in `executor_queue` table; live plan: `~/Developer/personal-os/briefs/executor-queue.md`
 - Prompt: `~/Developer/personal-os/agent/prompts/executor-autonomous.md`
 **Shared**:
 - Worktree at `~/DuckDuckGo/apple-browsers.git/.claude/worktrees/executor-{gid}-{slug}/`
 - Always `git fetch origin main` + branch from `origin/main`
 - State machine in `executor_runs` table
 - For UI tests: spins VM via ddg-vm MCP (virfield), cleans up on PR close/merge
 **Eagle commands in #executor**:
 | Command | Effect |
 |---------|--------|
 | `fix bug {gid}` | Spawn manual executor (separate agent) |
 | `go {gid}` | Approve autonomous task → starts next tick |
 | `skip {gid}` | Skip task in queue |
 | `stop` | Pause current autonomous task |
 | `next` | Pause current, analyze next |
 | `resume {gid}` | Re-queue paused task |
 | `queue` | Show current executor-queue.md |
 ## Data Flow
 ```
 Asana API
  → sync.js (30 min, Hermes cron, silent)
  → PostgreSQL: tasks, stories, task_edges, sync_state, task_annotations
 ActivityWatch (local daemon)
  → generate-status.js (reads AW HTTP API)
  → activity_daily (upserts daily project/quadrant summaries)
 generate-status.js
  → ~/context/status.md              ← Eagle reads this
  → ~/Developer/personal-os/asana_context.md  ← inbox-check reads this
 Eagle corrections in Zulip
  → corrections_log table (INSERT on pushback, no announcement)
  → Retrospector reads weekly
 Executor runs
  → executor_runs table (state machine)
  → ~/DuckDuckGo/apple-browsers.git/.claude/worktrees/
  → GitHub draft PRs (--draft, --assignee @me, no reviewers)
 ```
 ## Key File Locations
 | File / Path | Purpose |
 |-------------|---------|
 | `~/context/status.md` | Live Asana + AW snapshot. Written by generate-status.js. Eagle reads this. |
 | `~/Developer/personal-os/asana_context.md` | Raw Asana context for inbox-check |
 | `~/Developer/personal-os/agent/prompts/` | All agent prompts (Hermes cron + on-demand) |
 | `~/.hermes/SOUL.md` | Eagle's identity, rules, vault write permissions |
 | `~/Developer/personal-os/config.json` | Asana workspace/user GIDs, section GIDs |
 | `~/Developer/personal-os/aw-projects.json` | ActivityWatch project classification rules |
 | `~/.hermes/config.yaml` | Hermes config: model, MCP servers, cron settings |
 | `~/obsidian/` | Vault — git repo, NAS remote, obsidian-mcp for search |
 | `~/Developer/personal-os/logs/` | heartbeat.log, wiki-ingest-YYYY-MM-DD.md |
 | `~/Developer/personal-os/briefs/` | daily/, weekly/, inbox/ — agent-written brief files |
 | `~/DuckDuckGo/apple-browsers.git/` | Browser repo (bare), worktrees as sibling dirs |
 | `~/DuckDuckGo/apple-browsers.git/.claude/worktrees/` | Executor worktrees |
 ## Database Tables
 | Table | Written by | Read by |
 |-------|-----------|---------|
 | tasks | sync.js | generate-status.js, executor, status queries |
 | stories | sync.js | generate-status.js, executor, retrospector |
 | task_edges | sync.js | subtask traversal |
 | sync_state | sync.js | generate-status.js header |
 | task_annotations | manual / Eagle | generate-status.js irrelevant filter |
 | activity_daily | generate-status.js | retrospector quadrant drift |
 | corrections_log | Eagle on pushback | retrospector pattern analysis |
 | executor_runs | executor (manual + autonomous) | generate-status.js active runs, executor state machine |
 | executor_queue | executor-autonomous | generate-status.js queue display, autonomous tick state |
 ## MCP Servers
 **Hermes agents:**
 | Name | Command | Used for |
 |------|---------|---------|
 | obsidian | `/opt/homebrew/bin/obsidian-mcp ~/obsidian` | Vault search, read, write |
 **Claude Code / `claude -p` sessions:**
 | Name | Command | Used for |
 |------|---------|---------|
 | ddg-vm | `npx tsx ~/Developer/virfield/server/mcp-server.ts` | VM lifecycle for UI tests |
 | obsidian | `/opt/homebrew/bin/obsidian-mcp ~/obsidian` | Vault access |
 ## launchd Agents
 | Label | Schedule | Purpose |
 |-------|----------|---------|
 | personal.os.heartbeat | :05 every hour | Runs run-pipeline.sh directly (no Claude auth needed); also triggers missed Hermes jobs after wake |
 | personal.os.wiki-ingest | 22:00 daily | `claude -p` wiki synthesis (needs filesystem access) |
 ## Vault Structure
 ```
 ~/obsidian/
 ├── wiki/          ← LLM-generated + hand-written (confidence: 1.0 = never overwrite)
 │   ├── personal-os-architecture.md    (this file)
 │   ├── personal-os-purpose.md
 │   ├── personal-os-agent-rules.md
 │   ├── personal-os-self-modification.md
 │   ├── personal-os-sync-pipeline.md
 │   ├── personal-os-schema.md          (auto-generated)
 │   ├── ddg-asana-workflow.md
 │   └── vault-filling-guide.md
 ├── raw/           ← symlinks to external source files (schema.sql, etc.)
 ├── work/
 │   └── wiki/
 │       └── apple-browsers/    ← .cursor/rules copies (.md) + vm-ui-testing.md
 └── personal/ family/
 ```
@@ -0,0 +1,91 @@
 ---
 source: raw/personal-os-catchup-plan-2026-04-27.md
 content_hash: 5081ceb719104e1b7c6b5edd642c1daf38b3fd7cf1a96442a00516e7cdb15379
 namespace: work
 last_synced: 2026-04-28
 confidence: 0.8
 tags: [personal-os, planning, catchup, executor, retrospector]
 ---
 # Personal OS — Catch-Up Plan (2026-04-27)
 Handoff document for the executor agent: what to build next, in what order, and why. Companion to [[personal-os-state-2026-04-27]].
 ## Context
 Alex (macOS Browser DRI at DuckDuckGo, ADHD profile, async-first) needs the Personal OS to hold work context outside his head — so comments don't get lost, focus is protected, and career goals don't get crushed by current projects.
 Original four-agent design — Стратег / Тактик / Ретроспектор / Исполнитель. Stratan and Retrospector ✅ shipped; Tactic 🟡 partial; Executor 🟡 v1 with manual STOP gates only.
 **Catching up on:** career tracking, inbox triage hygiene, focus-aware ping gating, structured `corrections_log`, quadrant column on `activity_daily`, Executor v2, MS365 MCP wiring, vault consolidation, Executor PR template.
 ## Architectural principle (reinforced)
 No new YAML files. No new shell scripts. No new launchd plists. Everything extends existing components: postgres tables, `generate-status.js` queries, prompt files in `agent/prompts/`, Eagle's `SOUL.md` rules. See [[personal-os-architecture]].
 ## Six deliverables (dependency-ordered)
 ### 1.1 Schema migration
 Three changes — see [[personal-os-schema]]:
 - `corrections_log` (id, date, week_number, source, original_plan, correction, deferred_gids[], reason_tag) — Tactic writes, Retrospector aggregates
 - `executor_runs` (task_gid, worktree_path, branch_name, pr_url, state, ci_attempts, thread_id, timestamps) — state machine for autonomous Executor
 - `activity_daily.quadrant` column — values: `project | aor | career | strategy | other`
 Why tables not markdown: Retrospector needs aggregates ("X deferred 3+ times in 4 weeks"); SQL trivial, LLM-parsing markdown each time is fragile.
 ### 1.2 generate-status.js — three new SQL blocks
 - **Career: Advisor pipeline** — open tasks tagged "Project Advisor", surface as `## ⚡ Career — Advisor Opportunities`
 - **Career: Visibility gaps** — Assessments / O-N / O-L tasks where Alex hasn't commented in 7+ days
 - **Quadrant classification at AW write time** — `PROJECT_TO_QUADRANT` map, with current top-priority project read dynamically from config (not hardcoded — drifts wrong silently otherwise)
 ### 1.3 inbox-triage.md — STEP 0 gating + overdue exclusion
 Two-part gate added at the top of the prompt (not a wrapper script — wrapper bypasses agent judgment):
 - **Focus check**: read latest `activity_daily` focus_score + active calendar event. Skip if in meeting, or focus_score > 60 in editor for >20min, unless 🔴 sections older than 3h.
 - **Scope filter**: inbox = NEW signal only. Exclude overdue (those belong in daily-brief), already-responded, system events, bot noise. Include only new human comments, new assignments, ship/TD status changes, mentions.
 ### 1.4 retrospector.md — three new SQL blocks
 Replace markdown `corrections_log.md` reads with:
 - **Correction patterns** — `reason_tag` GROUP BY HAVING COUNT >= 3 over 4 weeks
 - **Quadrant drift** — 4-week × quadrant pivot; flag any quadrant <5% for 3+ weeks (career gets the strongest flag)
 - **Visibility this week** — count of strategic comments by Alex; surfaces career signal as a measurable proxy for the EP3 "thin Strategic Leadership" gap
 ### 1.5 Eagle SOUL.md — corrections_log writeback
 When user pushes back in any channel, BEFORE responding: classify pushback type, infer reason_tag from message context, INSERT into `corrections_log` via psql, then respond normally. Don't announce the insert. Eagle is already in conversation — capturing in-context beats post-hoc log parsing.
 ### 1.6 Executor v2 — single STOP gate, then autonomous
 Replace v1's many gates with **one gate after Analysis** (the consequential decision). Then: fix → build → test → branch (`executor/<gid>-<slug>`) → push → `gh pr create --draft --assignee @me` (no `--reviewer`) → self-review comment → CI poll loop (every 10min, max 3 auto-fix attempts).
 **Hard prohibitions**: never push non-`executor/*` branches, never non-draft PRs, never `--reviewer`, never `gh pr merge`, never modify `.github/` or deps without thread confirmation.
 Draft + assignee=@me + no reviewers gives a durable, ADHD-friendly surface (visible in "assigned to me", ignored by branch-protection auto-merge, no reviewer noise).
 ### 1.7 MS365 MCP into Hermes
 One-time Hermes MCP config change benefits multiple prompts (inbox-triage, weekly-plan, daily-brief). Used in STEP 0 to detect active meetings via `outlook_calendar_search`. MS365 chosen over Google because it's the actual workspace.
 ### 1.8 Vault consolidation
 Move into `~/obsidian/work/wiki/`: process docs from `~/Developer/personal-os/`, the UI testing skill, copies of `apple-browsers/.cursor/*.mdc` files. Decision rule: process/convention/knowledge → vault; runtime configs → original location. **Verify each prompt/skill end-to-end after move** — silent path-reference breakage is the failure mode. Copy `.mdc` (don't move) — Cursor still reads them in place.
 ### 1.9 PR template — Executor variant
 Team's PR template requires manual confirmation of task/reviewer/description. For autonomous flow all three are deterministic. Use **inline template generation** (Option B) in the Executor prompt — auto-generate body from analysis + diff. Draft state is the safety net; Alex polishes on flip-to-ready.
 ## Execution order
 1, 2, 4, 5 unblocked. 3 needs MS365 (#2). 6 needs schema (#1) + quadrants (#5). 7 needs schema (#1). 8, 9 unblocked. 10 (Executor v2) needs 1, 8, 9. **No new Discord channels needed.**
 ## "Done" looks like
 Friday Retrospector says specific things ("deferred bug work 4× for ship-review-crunch"); inbox shows only new human signals (silent during meetings); `## ⚡ Career` section in status.md; pushback creates one `corrections_log` row; `fix [task]` in `#executor` produces an analysis post → approval gate → draft PR within 30min for trivial bugs; vault contains all `.mdc` + UI skill + process docs reachable via obsidian-mcp.
 ## Related
 [[personal-os-state-2026-04-27]] [[personal-os-architecture]] [[personal-os-schema]] [[personal-os-agent-rules]] [[personal-os-self-modification]] [[ddg-asana-workflow]]
@@ -0,0 +1,73 @@
 ---
 namespace: work
 tags: [system, purpose, adhd, design]
 last_updated: 2026-04-28
 confidence: 1.0
 ---
 # Personal OS — Purpose
 ## Why It Exists
 Alex is a macOS Browser Developer / DRI at DuckDuckGo. Async-first company, primary channels Asana and Slack. ADHD profile.
 The Personal OS exists to hold work context **outside Alex's head** — so that context isn't lost during deep focus, transitions, or when switching back from a meeting.
 Without it, three things happen regularly:
 1. A comment sits on an Asana task for days — Alex never saw it because he was in Xcode
 2. A career-level task (Ship Review, Tech Design review) gets deferred until it becomes a bottleneck
 3. End of day: "what did I actually do today?" — no clear answer, no signal for tomorrow
 ## Design Principles
 **Principle 1 — Context is the product, not notifications.**  
 The system's job is to maintain a live, accurate picture of what's happening. Eagle reads that picture and speaks when something actually matters. It is not a notification firehose.
 **Principle 2 — Protect focus.**  
 If Alex is in Xcode or Cursor, don't interrupt unless there's a red signal older than 3 hours. ADHD makes context switches expensive — the system should absorb noise, not amplify it.
 **Principle 3 — No hallucinated state.**  
 Eagle never guesses about Asana tasks. All Asana data flows through sync.js → PostgreSQL → generate-status.js → status.md. Eagle reads markdown, not the API. This means the data is always consistent and never stale by more than 30 minutes.
 **Principle 4 — Career goals are first-class.**  
 The system explicitly tracks: Project Advisor opportunities, visibility gaps (Ship Reviews where Alex hasn't commented), Tech Design reviews pending. These surface in status.md and the daily brief. Without explicit tracking they'd be invisible.
 **Principle 5 — No new infra.**  
 The system has enough moving parts. New capabilities go into existing components: Postgres tables, generate-status.js queries, prompt files in `agent/prompts/`, SOUL.md rules. No new YAML files, no new shell scripts, no new launchd plists unless there is no other way.
 ## The Four Agents
 | Agent | Role | When |
 |-------|------|------|
 | **Стратег (Strategist)** | Data pipeline — reads Asana + ActivityWatch, writes status.md | Every 30 min, workdays |
 | **Орёл / Eagle (Tactician)** | Discord-facing reactive agent — briefs, inbox, focus gating | Cron + on-demand |
 | **Ретроспектор (Retrospector)** | Weekly pattern analysis — corrections, quadrant drift, visibility | Friday 17:30 |
 | **Исполнитель (Executor)** | On-demand bug-fix worker — analysis → fix → PR → CI loop | Explicit trigger only |
 Eagle is the only agent Alex directly talks to. The others are background infrastructure.
 ## What "Work Context" Means
 The system tracks four categories, mapped to `activity_daily.quadrant`:
 | Quadrant | What it covers | Why it matters |
 |----------|---------------|----------------|
 | `project` | The current top-priority feature/bug | Time here should dominate most weeks |
 | `aor` | AOR maintenance: code review, bug fixes, blocklist | Required to keep the area healthy |
 | `career` | Project Advisor, Ship Reviews, Tech Design, visibility | Easily deferred; system forces it into view |
 | `strategy` | Planning, Personal OS, Asana organisation | Meta-work; needs a floor, not a ceiling |
 Personal pet projects (AXPressDeck, media_files_db, etc.) are tracked separately and not counted as work time. See `aw-projects.json` (`namespace: "personal"` entries).
 ## What It Does Not Do
 - Does not make decisions for Alex — it informs
 - Does not send notifications during focus (deep focus gate in inbox STEP 0)
 - Does not access Asana API directly from Eagle — only reads pre-rendered status.md
 - Does not create PRs, commits, or messages without explicit confirmation (except Executor, after its single approval gate)
 ## See Also
 - `personal-os-architecture.md` — full technical architecture, agents, data flow, file locations
 - `personal-os-agent-rules.md` — Eagle's operating rules and allowed writes
 - `personal-os-self-modification.md` — how Eagle (and Alex) can evolve the system
@@ -0,0 +1,92 @@
 ---
 source: raw/schema.sql
 content_hash: 71b47e47b483834c887de14c76d5b16506d90ad64198d76a92a7b3731132dab8
 namespace: work
 last_synced: 2026-04-27
 confidence: 0.9
 tags: [schema, postgres, database, asana, wiki]
 ---
 # Personal OS Database Schema
 Postgres schema (`personal_os`) backing the Asana mirror, agent annotations,
 file ingestion pipeline, semantic wiki, and memory store. Requires the
 `vector` (pgvector) and `pg_trgm` extensions. Bootstrap with
 `psql -U admin -d personal_os -f schema.sql`.
 ## Asana mirror
 - **`tasks`** — one row per Asana task GID, upserted on each sync.
  Stores due/start dates, completion, My Tasks section, assignee/creator,
  primary project, timestamps, full `raw_json`, plus a `source` enum:
  `my_tasks` (assigned to me) > `delegated` (I created, others assigned)
  > `following` (CC'd) > `project` (project member, fallback).
  Sync bookkeeping: `fetched_at`, `stories_fetched_before` cursor.
 - **`stories`** — raw event log per task, keyed by Asana story GID.
  `resource_subtype` covers comments, assignment changes, due-date edits,
  section moves, dependency edits, attachments, completion, etc.
 - **`task_edges`** — directed graph between tasks. `relation_type`:
  `subtask`, `dependency` (blocked-by), `dependent` (blocking),
  `project_sibling`, `mention` (referenced in a story).
  `related_gid` may not yet exist in `tasks`.
 - **`task_annotations`** — agent or user notes per (task, annotation_type).
  Types: `irrelevant`, `watching`, `needs_action`, `snoozed`
  (with `snoozed_until`). Never written by the fetcher.
 - **`sync_state`** — one row per sync stream
  (`my_tasks`, `following`, `delegated`, `project:{gid}`,
  `workspace_events`). Tracks cursor, last sync, last full sync.
 - **`task_embeddings`** — pgvector(1024) per task, HNSW index with
  cosine ops; populated separately from sync.
 The **`active_tasks`** view filters out completed and irrelevant tasks
 and tasks snoozed past today, ordered by source priority then due date
 then modified-at. Starting point for daily review.
 ## Phase 0 additions (2026-04-27)
 All core tables gain `namespace TEXT NOT NULL DEFAULT 'work'` so a single
 DB can serve work/personal/family contexts. `tasks` also gets
 `possibly_deleted` and `last_seen_in_full_sync` to track tasks that
 disappear between full syncs without explicit deletion events.
 ## File ingestion → wiki
 - **`file_references`** — files (via macOS security-scoped
  `bookmark_data` + cached `last_known_path`) and web URLs
  queued for wiki ingestion. Tracks `content_hash` (SHA256),
  `mime_type`, `tags`, a `modification_log` JSONB, and a
  `wiki_stale` flag the [[wiki-ingest-process]] consumes.
  Namespace-checked (`work`/`personal`/`family`).
 - **`wiki_pages`** — LLM-synthesised markdown, never a raw copy.
  Has `sources` JSONB (file_ref/url/title), `confidence` float,
  `superseded_by` self-FK for version chains, `stale` flag,
  `last_synced_hash`, and a pgvector(1536) embedding for semantic
  search. The optional ivfflat index is left commented; rebuild
  once the table has 1000+ rows.
 ## Memory store
 **`memory_store`** — semantic memory from Discord, Claude sessions,
 and manual entries. `type` ∈ {fact, preference, decision, person},
 `source` ∈ {discord, claude, manual}, with entities JSONB,
 confidence, optional `expires_at` (null = permanent), and a
 pgvector(1536) embedding. Used by Hermes for cross-session context.
 ## Indexing notes
 - Trigram GIN on `tasks.name` enables fuzzy task search.
 - `tasks_due_on` is partial (only non-completed tasks).
 - pgvector embedding indexes for `wiki_pages` and `memory_store`
  are deferred until the tables have meaningful row counts.
 - `task_embeddings` uses HNSW; the wiki/memory stores use ivfflat
  (commented) — different recall/build trade-off per workload.
 ## Key constraints
 - All `namespace` columns are CHECK-constrained to
  `('work','personal','family')` on the new (Phase 0+) tables.
 - Cascade deletes flow from `tasks` → `stories`, `task_edges`,
  `task_annotations`, `task_embeddings`.
 ## Related
 [[personal-os-architecture]] [[wiki-ingest-process]]
@@ -0,0 +1,152 @@
 ---
 namespace: work
 tags: [system, self-modification, eagle, meta]
 last_updated: 2026-04-28
 confidence: 1.0
 ---
 # Personal OS — Self-Modification Guide
 How Eagle (and Alex via Claude Code) can safely evolve the system without breaking it.
 **Rule**: Always show a diff/draft first, confirm, then apply. Commit the vault after.
 ---
 ## What Eagle Can Change (no approval needed — show draft first)
 ### 1. Prompt files (`~/Developer/personal-os/agent/prompts/*.md`)
 Eagle reads and writes its own prompts. When Alex says "add X to the morning brief" or "change how inbox triage handles Y":
 1. Read the current prompt: `~/Developer/personal-os/agent/prompts/<name>.md`
 2. Draft the change, show the diff in Discord
 3. On confirmation: write the file
 4. Commit: `cd ~/Developer/personal-os && git add agent/prompts/<name>.md && git commit -m "[YYYY-MM-DD] prompt: <description>"`
 **Do not** change `executor-bug-fix.md` without explicit confirmation — it controls autonomous code changes.
 ### 2. SOUL.md (`~/.hermes/SOUL.md`)
 Eagle's identity, rules, and operating context. Eagle can propose changes to:
 - Allowed vault write paths
 - Focus gating rules
 - Channel routing
 Same flow: draft → confirm → write → no vault commit needed (SOUL.md is outside vault).
 ### 3. ActivityWatch project rules (`~/Developer/personal-os/aw-projects.json`)
 To classify a new project as work or personal:
 1. Read current `aw-projects.json`
 2. Add entry with `project`, `namespace` (omit for work, `"personal"` for pet projects), and `rules`
 3. Show draft, confirm, write
 4. Commit: `cd ~/Developer/personal-os && git add aw-projects.json && git commit -m "[YYYY-MM-DD] aw: classify <project>"`
 The `namespace: "personal"` field excludes a project from work activity in status.md and activity_daily.
 ### 4. Vault knowledge pages (`~/obsidian/wiki/`, `~/obsidian/work/wiki/`)
 Eagle does **not** write to `wiki/` — that's the wiki-ingest job (22:00 launchd). But Eagle **can** write to:
 - `~/obsidian/work/projects/SLUG.md` — project notes
 - `~/obsidian/work/decisions/YYYY-MM-TOPIC.md` — decisions
 - `~/obsidian/personal/` — personal notes
 - `~/obsidian/family/` — family docs
 After writing: `cd ~/obsidian && git add -A && git commit -m "[YYYY-MM-DD] <description>"`
 ### 5. Correction logging (corrections_log table)
 Eagle silently logs a row whenever Alex pushes back on a suggestion. No approval needed — this is continuous background instrumentation, not a visible change.
 ```sql
 INSERT INTO corrections_log (date, week_number, source, original_plan, correction, deferred_gids, reason_tag)
 VALUES (current_date, EXTRACT(WEEK FROM current_date)::int, 
        '<source>', '<original>', '<user_message>', 
        ARRAY[<gids>]::text[], '<reason_tag>');
 ```
 ---
 ## What Requires Approval (always confirm explicitly)
 ### Schema changes (PostgreSQL)
 New tables, columns, or indexes require a SQL migration. Pattern:
 1. Draft the SQL in Discord, explain the purpose
 2. On "go": run via `psql personal_os -c "..."`
 3. Update `~/obsidian/wiki/personal-os-schema.md` (this is auto-generated at 22:00, but a manual update is fine)
 Current tables: tasks, stories, task_edges, sync_state, task_annotations, activity_daily, corrections_log, executor_runs.
 ### New Hermes cron jobs
 Add to `~/.hermes/config.yaml`. Format:
 ```yaml
 crons:
  - id: my-new-job
    schedule: "30 9 * * 1-5"
    prompt: |
      Run: ~/Developer/personal-os/agent/prompts/my-prompt.md
    channel: "#channel-name"
 ```
 Must confirm before writing — a broken cron syntax silently prevents Hermes from starting.
 ### New launchd agents (`~/Library/LaunchAgents/`)
 New plist files. Rarely needed — only if a job requires Mac filesystem access and can't run inside Hermes (e.g., wiki-ingest). Confirm before writing and before loading with `launchctl`.
 ### Executor prompt (`executor-bug-fix.md`)
 Controls autonomous code changes. Changes here need explicit approval because a mistake could cause the Executor to behave incorrectly on real PRs.
 ### Hermes model or MCP configuration (`~/.hermes/config.yaml`)
 Model upgrades, new MCP servers. Show the diff; confirm before writing.
 ---
 ## How generate-status.js Gets Extended
 When a new data signal should appear in status.md:
 1. Add a SQL query function (e.g., `getNewSignal()`)
 2. Add a render function (e.g., `renderNewSignal(data)`)
 3. Add both to `main()`: Promise.all for the query, the render call in `parts`
 4. Test: `node ~/Developer/personal-os/generate-status.js` and read `~/context/status.md`
 5. Commit
 **Never** edit generate-status.js to change how Asana sync works — that's sync.js territory.
 ---
 ## Debugging the System
 | Symptom | Check |
 |---------|-------|
 | status.md is stale (> 40 min old) | `stat -f "%Sm" ~/context/status.md` — if old, run `bash ~/scripts/run-pipeline.sh` |
 | Hermes cron didn't fire | Check heartbeat: `tail -20 ~/Developer/personal-os/logs/heartbeat.log` |
 | Eagle gave wrong Asana data | The DB may be stale — run `node ~/Developer/personal-os/sync.js` manually |
 | activity_daily missing today | generate-status.js runs upsert — check `select * from activity_daily where bucket_day = current_date` |
 | corrections_log empty | Eagle only inserts on pushback — expected to be sparse |
 | Executor in stuck state | `SELECT id, state, updated_at FROM executor_runs WHERE state NOT IN ('complete','abandoned');` |
 ---
 ## Safe Operations Checklist
 Before making any system change:
 - [ ] Read the current file/config before proposing a change
 - [ ] Show the diff, not just a description
 - [ ] Wait for explicit confirmation
 - [ ] Apply the change
 - [ ] Verify: run the component or check output
 - [ ] Commit if in a git repo (`personal-os` or `obsidian`)
 ---
 ## See Also
 - `personal-os-architecture.md` — full system map
 - `personal-os-agent-rules.md` — Eagle's rules and channel routing
 - `personal-os-purpose.md` — why this system exists
@@ -0,0 +1,99 @@
 ---
 source: raw/personal-os-state-2026-04-27.md
 content_hash: 1640cb63145b49263b9476e2c39fe443ac561fdf6c27faccc50cfc8568552614
 namespace: work
 last_synced: 2026-04-28
 confidence: 0.8
 tags: [personal-os, state, executor, infrastructure]
 ---
 # Personal OS — State Snapshot (2026-04-27)
 Current state of the system after the [[personal-os-catchup-plan-2026-04-27]] was executed. Supersedes earlier state and v3 plan documents.
 ## Infrastructure (✅ live)
 - **Postgres on Mac** — tables: `tasks`, `stories`, `task_edges`, `sync_state`, `signal_queue`, `activity_daily` (+ `quadrant` col), plus new `corrections_log`, `executor_runs`. See [[personal-os-schema]].
 - **sync.js** — 4-source Asana fetch, incremental deltas, sweepRecentlyCompleted
 - **generate-status.js** — DB → `status.md` + `asana_context.md`; live blocks: 5 advisor opps, 8 visibility gaps, 10 executor queue items in first run
 - **ActivityWatch** — DDG browser + Xcode watchers
 - **Hermes v0.11.x** — launchd daemon `ai.hermes.gateway`, Claude Code OAuth, `claude-sonnet-4-6`
 - **Discord bot Орёл#0898** — channels `#daily-brief #inbox #focus #executor #projects #journal #retrospector`
 See [[personal-os-architecture]] and [[personal-os-sync-pipeline]] for component detail.
 ## Schedule
 **Hermes cron jobs (8):** data-pipeline (every 30min), morning-brief (08:30), eod-summary (18:00), inbox-check (every 30min, 9-19), weekly-plan (Mon 08:00), weekly-review (Fri 17:00), retrospector (Fri 17:30 → `#retrospector`), commit-vault (23:00).
 **launchd agents (Mac-level, fire on wake):**
 - `personal.os.heartbeat` — :05 hourly watchdog, triggers missed Hermes one-per-day jobs
 - `personal.os.wiki-ingest` — 22:00 daily, runs local `claude -p` (filesystem access requires local subprocess, not Hermes API agent)
 ## Vault
 `~/obsidian/` — git remote `ssh://truenas_admin@mallexxx.duckdns.org/mnt/RED_2TB/storage/git/obsidian-vault.git`. Layout: `wiki/` (LLM-generated + hand-written, see [[wiki-ingest-process]]), `raw/` (symlinks), `work/` and `personal/` (Eagle-writable per [[vault-filling-guide]]), `family/`. Phase 8 of catchup added 43 `.cursor/rules/*.mdc` files under `work/wiki/apple-browsers/`.
 ## Catch-up plan execution status
 | # | Item | Status |
 |---|------|--------|
 | 1 | Schema (corrections_log, executor_runs, quadrant) | ✅ |
 | 2 | MS365 MCP in Hermes | 🟡 cloud connector only; no local npm package; available to `claude -p` jobs once added to CLI env |
 | 3 | inbox-triage STEP 0 | ✅ |
 | 4 | generate-status: advisor + visibility + executor queue | ✅ |
 | 5 | generate-status: quadrant + activity_daily upsert | ✅ |
 | 6 | retrospector SQL blocks | ✅ |
 | 7 | SOUL.md corrections_log INSERT | ✅ |
 | 8 | Vault consolidation (43 .mdc) | ✅ |
 | 9 | Executor PR template inline | ✅ |
 | 10 | Executor v2 prompt | ✅ written, not yet run end-to-end |
 ## Executor v2 architecture (Phase 4 plan)
 Autonomous worker: evaluates backlog → picks task → spawns sub-agent in Discord thread under `#executor` → streams progress → produces draft PR → self-reviews → CI loop → surfaces in daily/weekly briefs.
 **Triggers:** user-initiated (`fix [task]` in `#executor`), scheduled (Friday weekly-review queue), status-driven (Eagle reads `## ⚡ Executor Queue` from status.md).
 **Qualification SQL:** assigned to Alex, not completed, no stories in 14+ days, due within 30 days.
 **Worker flow:** Eagle creates Discord thread → spawns sub-agent (`--worktree` mode, workdir `~/DuckDuckGo/apple-browsers.git/.claude/worktrees/executor-<gid>-<slug>/`) → posts streaming updates per phase → opens PR → self-review comment → polls `gh pr checks` every 10min → on red, auto-fix max 3 attempts then escalate.
 **Phases:** 4a evaluation engine · 4b worker spawning + threads · 4c PR + CI loop · 4d feedback loop on PR comments · 4e scheduled evaluation.
 ## Key decisions (divergence from earlier plan v3)
 1. **wiki-ingest** moved from Hermes cron → launchd `claude -p` subprocess. Filesystem I/O requires local process; Hermes API agents have no filesystem.
 2. **personal-wiki MCP** dropped, replaced with stock `obsidian-mcp` against `~/obsidian/`. The DB-backed wiki was never built; vault is the source of truth now.
 3. **Single heartbeat watchdog** instead of per-job launchd plists — simpler, covers wake-from-sleep for all one-per-day jobs.
 4. **Retrospector** extracted to standalone `retrospector.md` + own cron + `#retrospector` channel, separating "what moved" (review) from "what's the pattern" (retro).
 5. **NAS git path** moved to `/mnt/RED_2TB/storage/git/` — `/home/` lives on TrueNAS boot pool which is wiped on OS updates.
 6. **Phase 2-family deferred** until after Phase 4 — Executor v2 has higher leverage than family infra.
 7. **Executor v1 manual-only** with explicit STOP gates — first autonomous code-changing agent stays conservative.
 8. **wiki-ingest prompt** rewritten DB-first → file-based with SHA256 frontmatter `content_hash`. See [[wiki-ingest-process]].
 ## Open questions before Executor v2 starts (all resolved)
 - Repo: `~/DuckDuckGo/apple-browsers.git/` bare repo, sibling worktrees, main at `main/`
 - Worktree path: `.claude/worktrees/executor-{gid}-{slug}/`
 - Xcode scheme: `DuckDuckGo macOS`, `.xcworkspace` required, xcbeautify required
 - PR template: `pull-request.mdc` strict gates overridden by Executor v2 (task known, reviewer=@me, description auto-generated)
 - Cleanup: `git worktree remove --force` + `git push --delete` + stop/delete VM
 - UI test VM: ddg-vm MCP at `~/Developer/virfield/server/mcp-server.ts`, VirtualBuddy at `~/Documents/VirtualBuddy/`
 ## Tech debt
 - Morning brief never smoke-tested (first real run = next 08:30) — Medium
 - `work/projects/` empty (Eagle fills on first relevant conversation) — Low
 - `executor-bug-fix.md` v1 still manual-only — replaced by v2 architecture above — Medium
 - wiki-ingest `claude -p` runs without `--allowedTools` — Low
 - **NAS SSH key in boot-pool `/home/`** — High; `authorized_keys` will be wiped on TrueNAS update; move under `/mnt/RED_2TB/`
 - Hermes memory `~/.hermes/memory/` not backed up — Low
 ## Deferred — Phase 2-family
 VPS (Ubuntu 24.04 $5/mo) `family_db` postgres + family Hermes instance + iCloud vault sync (`~/Library/Mobile Documents/iCloud~md~obsidian/`) for wife's iPhone Obsidian + NAS hourly rsync. Resumes after Phase 4.
 ## Related
 [[personal-os-catchup-plan-2026-04-27]] [[personal-os-architecture]] [[personal-os-schema]] [[personal-os-sync-pipeline]] [[personal-os-agent-rules]] [[personal-os-self-modification]] [[personal-os-purpose]] [[wiki-ingest-process]] [[ddg-asana-workflow]] [[vault-filling-guide]]
@@ -0,0 +1,91 @@
 ---
 namespace: work
 tags: [system, sync, pipeline, debugging]
 last_synced: 2026-04-27
 confidence: 1.0
 ---
 # Personal OS — Sync Pipeline
 ## Components
 ### sync.js
 Pulls from 4 Asana sources into PostgreSQL. Run: `node ~/Developer/personal-os/sync.js`
 **Sources fetched:**
 1. `fetchMyTasks()` — My Tasks sections by GID (section-by-section)
 2. `fetchFollowingTasks()` — tasks I follow, 7-day chunks to work around 100-result cap
 3. `fetchDelegatedTasks()` — created by me, assigned to others
 4. `fetchProjectTasks()` — tasks from projects I'm a member of (lookback window on full sync)
 5. `sweepRecentlyCompleted()` — catch completed tasks missed by above
 **Incremental sync**: uses `modified_since` cursor from `sync_state` table.
 **Full sync**: triggered when `full_sync_at` is older than configured threshold.
 ### generate-status.js
 Reads from PostgreSQL → writes `asana_context.md` + `status.md`.
 Run: `node ~/Developer/personal-os/generate-status.js`
 ### run-pipeline.sh
 Wrapper: runs sync.js + generate-status.js + healthcheck.
 `~/scripts/run-pipeline.sh`
 Healthcheck: `asana_context.md` must be < 40 minutes old. Exits 1 if stale.
 ## Known Bugs (Fixed)
 ### possibly_deleted + overdue tasks appearing
 **Root cause**: Full sync marks tasks absent from Asana response as `possibly_deleted=true`.
 These tasks remained `completed=false`, causing them to appear overdue.
 **Fix 1 — generate-status.js**: Added `AND t.possibly_deleted = FALSE` to all 5 active-task queries.
 **Fix 2 — sync.js**: Added `sweepRecentlyCompleted()` called after `syncMyTasks()`.
 Uses `searchTasksForWorkspace(completed:true, completed_at.after=cursor)` to catch tasks
 that vanished from sections (because completed tasks are excluded from section membership results).
 ### Completion gap
 `getTasksForSection` drops completed tasks. `fetchFollowingTasks` has `completed:false` filter.
 → Completion events never reach DB incrementally.
 → `sweepRecentlyCompleted()` fills this gap.
 ## Debugging Checklist
 **Pipeline seems stuck:**
 ```bash
 bash ~/scripts/run-pipeline.sh
 # Check exit code and output
 ```
 **Check when last sync ran:**
 ```sql
 SELECT key, last_sync_at, full_sync_at FROM sync_state ORDER BY last_sync_at DESC;
 ```
 **Check possibly_deleted tasks (should be 0 active):**
 ```sql
 SELECT count(*) FROM tasks WHERE possibly_deleted=true AND completed=false;
 ```
 **Check asana_context.md freshness:**
 ```bash
 stat -f "%Sm" ~/Developer/personal-os/asana_context.md
 ```
 **Manual full sync (reset cursor):**
 ```sql
 UPDATE sync_state SET cursor = null, full_sync_at = null WHERE key = 'my_tasks';
 ```
 Then run `node sync.js`.
 ## Files
 - `~/Developer/personal-os/sync.js` — main sync script
 - `~/Developer/personal-os/generate-status.js` — status generation
 - `~/Developer/personal-os/asana.js` — thin Asana API client
 - `~/Developer/personal-os/config.json` — workspace GID, user GID, section GIDs
 - `~/.config/personal-os/env` — ASANA_API_KEY, POSTGRES_URL
 ## Related
 [[personal-os-architecture]] [[personal-os-agent-rules]] [[ddg-asana-workflow]]
@@ -0,0 +1,20 @@
 ---
 title: Research Queue
 updated: '2026-05-24'
 type: meta
 ---
 # Research Queue
 > Topics detected as gaps in the wiki — mentioned in vault but no wiki page.
 > Ordered by priority. Completed items move to ## Completed with link + date.
 ## Queue
 (empty)
 ## Completed
 - [x] WireGuard VPN → [[tech/wireguard-vpn]] (2026-05-23)
 - [x] Executor Architecture v2 → [[concepts/executor-orchestrator]] (2026-05-19)
 - [x] Executor Security Incident → [[concepts/executor-security-incident]] (2026-05-22)
@@ -0,0 +1,84 @@
 ---
 title: Vault ↔ Agent Integration
 created: '2026-05-23'
 updated: '2026-05-23'
 type: concept
 namespace: work
 tags: [vault, obsidian, wiki, ingest, mcp, hermes, system, architecture]
 sources: [wiki/obsidian-mcp-wrapper.md, wiki/wiki-ingest-process.md, wiki/personal-os-architecture.md, wiki/vault-filling-guide.md]
 confidence: high
 ---
 # Vault ↔ Agent Integration
 How Eagle, wiki-ingest, and the obsidian-mcp-wrapper work together as a
 unified knowledge layer. Three distinct subsystems each own a slice of
 the vault.
 ## The Three Subsystems
 ### 1. obsidian-mcp-wrapper (runtime read/write)
 A Node.js proxy (`~/scripts/obsidian-mcp-wrapper.js`) wraps `obsidian-mcp`
 to fix four production bugs: ZodError on init, race condition at gateway
 restart, UTF-8 chunk corruption on large payloads, and a 5-second watchdog
 for hung child processes.
 Eagle reads the vault through this wrapper via MCP tool calls. It can search,
 read, and write notes in real time during conversations.
 **Allowed write paths** (Eagle only, with prior draft shown):
 - `work/projects/`, `work/decisions/`, `personal/`, `family/`
 - Never `wiki/` — that's wiki-ingest territory
 ### 2. wiki-ingest (nightly synthesis, 22:00 launchd)
 A `claude -p` session (not Hermes) that runs nightly. It reads files in
 `~/obsidian/raw/` (symlinks to external project files), computes SHA256
 hashes, and synthesises wiki pages only when the source has changed.
 **Invariants:**
 - Output is synthesis, never verbatim copy
 - Frontmatter `source` + `content_hash` are the ingestion contract
 - Pages with `confidence: 1.0` are immutable
 ### 3. wiki-curation (daily Hermes cron, 02:00)
 A Hermes cron job (this script) that maintains the wiki as a compounding
 knowledge base: processes inbox, crystallises session knowledge, creates
 synthesis pages, lints orphans and broken links.
 ## Division of Labour
 | Layer | Tool | Vault path | Trigger |
 |-------|------|-----------|---------|
 | Reactive reads/writes | obsidian-mcp-wrapper | `work/`, `personal/`, `family/` | On-demand |
 | Source synthesis | wiki-ingest (claude -p) | `wiki/` ← `raw/` | 22:00 nightly |
 | Knowledge curation | wiki-curation (Hermes cron) | `wiki/` | 02:00 daily |
 | Vault sync | sync-vault.sh | entire vault | Hourly |
 ## Why obsidian-mcp Is Wrapped
 The wrapper exists because `obsidian-mcp` v1.0.6 had four production-breaking
 bugs that would have been too fragile to fix upstream (updates would reintroduce
 them). A proxy wrapper is cleaner: it intercepts the MCP protocol stream without
 modifying the underlying package.
 See [[obsidian-mcp-wrapper]] for the four bugs and their fixes.
 ## Vault Sync (Eagle ↔ Taiga ↔ Kraken)
 All three nodes share a sparse vault via a TrueNAS bare git repo. Eagle has
 the full vault; Kraken and Taiga have `personal/` and `family/` only (sparse
 checkout). The `sync-vault.sh` cron runs hourly on all three.
 ```
 Eagle (full)  ──push/pull──┐
 Taiga (sparse) ────────────├── mallexxx.duckdns.org:/mnt/RED_2TB/storage/git/obsidian-vault.git
 Kraken (sparse) ───────────┘
 ```
 ## See Also
 [[obsidian-mcp-wrapper]] [[wiki-ingest-process]] [[vault-filling-guide]]
 [[personal-os-architecture]]
@@ -0,0 +1,78 @@
 ---
 namespace: work
 tags: [system, vault, guide]
 last_synced: 2026-04-27
 confidence: 1.0
 ---
 # Vault Filling Guide
 How to populate `~/obsidian/`. Eagle can write to any section below except `wiki/` and `raw/`.
 ## Directory Map
 ```
 ~/obsidian/
 ├── wiki/          ← LLM-generated ONLY (wiki-ingest). Never write here manually.
 ├── raw/           ← Symlinks to external files ONLY. Never write content here.
 ├── work/          ← Alex's work notes. Eagle can write with confirmation.
 │   ├── projects/      One file per active project.
 │   ├── decisions/     Architectural/process decisions with date prefix.
 │   └── tech-design/   References to designs, review notes.
 ├── personal/      ← Alex's personal notes. Eagle can write with confirmation.
 │   ├── documents/     WHERE docs live (not the docs themselves).
 │   ├── instructions/  Personal how-tos and procedures.
 │   └── projects/      Personal side projects.
 └── family/        ← Household knowledge. Eagle can write with confirmation.
    ├── how-to/        Practical guides (devices, home equipment, procedures).
    ├── documents/     WHERE family documents live.
    ├── contacts/      Emergency contacts, doctors, services.
    └── schedule/      Recurring schedules, school, events.
 ```
 ## File Naming
 - `work/projects/` → `kebab-case-project-name.md` (e.g. `ios-duck-ai-toggle.md`)
 - `work/decisions/` → `YYYY-MM-topic.md` (e.g. `2026-04-personal-os-arch.md`)
 - `family/how-to/` → `kebab-case-topic.md` (e.g. `truenas-access.md`, `router-reset.md`)
 - `family/contacts/` → `emergency.md`, `doctors.md`, `services.md`
 - `family/documents/` → `apartment.md`, `insurance.md`, `passports.md` (location pointers, not the files)
 ## Frontmatter
 Every file should have:
 ```yaml
 ---
 namespace: work | personal | family
 tags: [tag1, tag2]
 created: YYYY-MM-DD
 updated: YYYY-MM-DD
 ---
 ```
 ## What Goes Where
 | Info type | Location |
 |-----------|----------|
 | Active work project status, decisions, links | `work/projects/SLUG.md` |
 | "We decided X because Y" (architectural) | `work/decisions/YYYY-MM-TOPIC.md` |
 | Home network / NAS / router config | `family/how-to/DEVICE.md` |
 | Where passport/insurance/lease is stored | `family/documents/TOPIC.md` |
 | Emergency contacts, doctors | `family/contacts/CATEGORY.md` |
 | Recurring events, school schedule | `family/schedule/TOPIC.md` |
 | Personal project notes | `personal/projects/SLUG.md` |
 | Personal procedures (backups, etc.) | `personal/instructions/TOPIC.md` |
 ## Eagle Write Protocol
 1. Show draft content before writing (never silently create)
 2. Confirm namespace (`work` / `personal` / `family`)
 3. Write the file
 4. Run `cd ~/obsidian && git add -A && git commit -m "..."` to save
 ## What Eagle Should NOT Do
 - Write anything to `wiki/` — that's wiki-ingest's job
 - Modify `raw/` — those are symlinks managed manually
 - Create files without showing the content first
 - Overwrite existing files without showing a diff
@@ -0,0 +1,35 @@
 ---
 title: Vault Namespace Rules
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: personal
 tags: [vault, meta, conventions]
 related:
  - "[[vault-filling-guide]]"
 ---
 # Vault Namespace Rules
 Rules for where notes live in the Obsidian vault. See also [[SCHEMA]] for
 full frontmatter conventions.
 ## Namespace Assignments
 - `personal`: Eagle infra, personal projects, dev tooling
 - `family`: Kraken media stack, HTPC, Jellyfin, family content
 - `work`: DuckDuckGo / DDG tasks and tooling
 ## Directory Map
 ```
 wiki/concepts/    — how-it-works explanations
 wiki/tech/        — infra how-tos, tool configs, pitfalls
 wiki/ideas/       — speculative, not yet decided
 personal/projects/ — project status & decisions
 family/projects/  — family-shared project status
 family/how-to/    — family infra procedures
 ```
 Note: this file was reconstructed from a lost pointer. Extend with actual
 rules as they emerge.
@@ -0,0 +1,100 @@
 ---
 source: raw/wiki-ingest-prompt.md
 content_hash: 29f6a0914d428cf62eeb2a832d6b3048edf3e1d16aa7714c09f686377394d128
 namespace: work
 last_synced: 2026-04-27
 confidence: 0.9
 tags: [wiki, ingest, agent, prompt]
 ---
 # Wiki Ingest Process
 The agent prompt that maintains `~/obsidian/wiki/` as a synthesised
 knowledge base over external project files exposed via symlinks in
 `~/obsidian/raw/`. Run locally by `claude -p` (the launchd job
 `run-wiki-ingest.sh` at 22:00) — not via API, because file-system
 writes require a local Claude Code session. See
 [[personal-os-architecture]] for where this fits in the broader system.
 ## Discovery loop
 For every file in `~/obsidian/raw/`:
 1. Read the file (skip if the symlink target is missing).
 2. Compute SHA256 with `shasum -a 256`.
 3. Look for a wiki page whose frontmatter has `source: raw/<filename>`.
 4. If a page exists and its `content_hash` already matches, skip.
 5. Otherwise enqueue for synthesis.
 If nothing changed, the agent prints
 "Wiki is up to date. Nothing to ingest." and exits.
 ## Synthesis rules
 - Wiki pages are named by **topic**, not source filename
  (e.g. `personal-os-schema.md`, not `schema.md`).
 - Output is a **synthesis**, never a verbatim copy. Extract facts,
  decisions, and structure. Hard cap of 800 words per page; split
  into linked pages if the topic is larger.
 - Use `[[double brackets]]` for cross-references between wiki pages.
 ## Page format
 Frontmatter is the source of truth for incremental ingestion:
 ```yaml
 source: raw/<filename>
 content_hash: <sha256>
 namespace: work
 last_synced: <YYYY-MM-DD>
 confidence: 0.8
 tags: [tag1, tag2]
 ```
 Body has a title, synthesis prose, a `## Key Points` list, and a
 `## Related` line of `[[wiki-links]]`.
 ## Confidence ladder
 - **1.0** — reserved for human-written notes in `work/`, `personal/`,
  `family/`. The agent must never edit these files.
 - **0.9** — highly structured / authoritative source (e.g. a schema).
 - **0.8** — clear single source. Default.
 - **0.6** — inferred or partial content.
 ## Hard rules
 - Never copy source files verbatim — always synthesise.
 - Never edit any file with `confidence: 1.0`.
 - Never process files in `namespace: family` unless explicitly told.
 - Always update `content_hash` and `last_synced` after writing a page.
 - Skip broken symlinks; do not create a wiki page for them.
 ## Reporting
 After the run, the agent emits a summary:
 ```
 Wiki Ingest — <date>
 Processed: N files
 Created: N new pages
 Updated: N pages
 Skipped: N (unchanged)
 Pages updated:
 - wiki/<filename> (source: raw/<source>)
 ```
 ## Key Points
 - Hash-based incremental: re-runs are cheap when nothing changed.
 - Topic-named pages decouple the wiki from source-file naming.
 - Frontmatter `source` + `content_hash` is the ingestion contract;
  the [[personal-os-schema]] mirrors the same idea in `wiki_pages`.
 - Human-edited (confidence 1.0) pages are immutable to the agent —
  the trust boundary between synthesis and curated knowledge.
 - Local-only execution: writes to `~/obsidian/` need a real FS,
  so the job runs under launchd via `claude -p`, not the API.
 ## Related
 [[personal-os-architecture]] [[personal-os-schema]]
@@ -0,0 +1,125 @@
 ---
 title: Wiki Schema
 created: '2026-05-13'
 updated: '2026-05-25'
 type: meta
 ---
 # Wiki Schema
 ## Domain
 Knowledge base covering Alex's Personal OS ecosystem: the multi-agent
 productivity/context system, home infrastructure (Eagle Mac M4, Taiga TrueNAS,
 Kraken RPi5), personal projects (Reflect app, etc.), and DuckDuckGo work tooling.
 **In scope:** agent architecture, data pipelines, home infra, dev tooling,
 personal projects, vault management.
 **Out of scope:** raw Asana tasks, family documents, ephemeral briefs.
 ## Conventions
 - File names: lowercase, hyphens, no spaces (e.g., `personal-os-architecture.md`)
 - Every wiki page starts with YAML frontmatter (see below)
 - Use `[[wikilinks]]` to link between pages (minimum 2 outbound links per page)
 - When updating a page, always bump the `updated` or `last_synced` date
 - Every new page must be added to `index.md` under the correct section
 - Every action must be appended to `log.md`
 - Subdirectories: `concepts/` for concept/how-it-works pages,
  `tech/` for infra/tool how-tos, `comparisons/` for side-by-side analyses,
  `entities/` for people/orgs/projects, `queries/` for filed query results
 ## Frontmatter
 Wiki pages synthesised from `raw/`:
 ```yaml
 ---
 source: raw/<filename>
 content_hash: <sha256>
 namespace: work | personal | family
 last_synced: YYYY-MM-DD
 confidence: 0.8
 tags: [tag1, tag2]
 ---
 ```
 Hand-written or agent-synthesised pages:
 ```yaml
 ---
 title: Human Readable Title
 created: YYYY-MM-DD
 updated: YYYY-MM-DD
 type: concept | entity | comparison | tech | query
 namespace: work | personal | family
 tags: [from taxonomy below]
 sources: [raw/articles/source.md]
 confidence: high | medium | low
 ---
 ```
 **Confidence ladder:**
 - `1.0` / `high` — human-written; agent must never edit these files
 - `0.9` — highly structured / authoritative source (schema, infra docs)
 - `0.8` / `medium` — single clear source; default for agent synthesis
 - `0.6` / `low` — inferred or partial content
 Pages with `confidence: 1.0` are immutable to the wiki-curation agent.
 ## Tag Taxonomy
 Personal OS:
 - `system` `architecture` `agent` `eagle` `executor` `pipeline` `sync`
 - `rules` `self-modification` `meta` `purpose`
 Work / DDG:
 - `asana` `ddg` `workflow` `task-management`
 Infrastructure:
 - `infra` `kraken` `taiga` `htpc` `docker` `nas` `raspberry-pi` `vps`
 - `obsidian` `vault` `wiki` `ingest`
 - `media-pipeline` `arr`
 Projects:
 - `reflect-app` `psychology` `ios` `android` `skip-tools`
 - `project` `startup`
 Technical:
 - `schema` `postgres` `database` `mcp` `hermes`
 - `debugging` `pitfalls` `how-to`
 Rule: every tag on a page must appear in this taxonomy. Add new tags HERE
 before using them. Avoid tag sprawl.
 ## Page Thresholds
 - **Create a page** when an entity/concept appears in 2+ sources OR is
  central to one source
 - **Add to existing page** when a source mentions something already covered
 - **DON'T create a page** for passing mentions or things outside the domain
 - **Split a page** when it exceeds ~200 lines
 - **Never edit** pages with `confidence: 1.0`
 ## Update Policy
 When new information conflicts with existing content:
 1. Check dates — newer sources generally supersede older ones
 2. If genuinely contradictory, note both positions with dates
 3. Never silently overwrite — show what changed
 ## Directory Structure
 ```
 wiki/
 ├── SCHEMA.md               ← this file
 ├── index.md                ← page catalog
 ├── log.md                  ← action log (append-only)
 ├── *.md                    ← root-level pages (legacy + core)
 ├── concepts/               ← how-it-works, design rationale
 ├── tech/                   ← infra/tool how-tos (device-specific)
 ├── comparisons/            ← side-by-side analyses
 ├── entities/               ← people, projects, products
 ├── queries/                ← filed query results
 └── raw/                    ← immutable sources
    ├── inbox/              ← new files to process
    └── inbox/processed/    ← after ingestion
 ```
@@ -0,0 +1,34 @@
 ---
 title: Reflect — Skip Fuse (SwiftUI/Kotlin)
 created: '2026-05-23'
 updated: '2026-05-23'
 type: tech
 namespace: personal
 tags: [reflect, swift, kotlin, ios, android, pitfalls]
 related:
  - "[[entities/psychologist-app]]"
  - "[[tech/gitea-config]]"
 ---
 # Reflect — Skip Fuse (SwiftUI/Kotlin)
 ## Key Pitfall
 When adding a **new SwiftUI View** to the Reflect iOS codebase, Skip Fuse
 does **not** auto-generate the Kotlin counterpart. A manual Kotlin stub is
 required in **2 places**:
 1. The View class file in the Android module
 2. The registration/factory in the Android navigation/router
 ## Why
 Skip Fuse transpiles shared SwiftUI code to Kotlin, but new View types
 require explicit Kotlin stubs until Skip's transpilation coverage catches up.
 ## Checklist for New SwiftUI Views
 - [ ] Add SwiftUI view as normal in iOS target
 - [ ] Create matching Kotlin stub in `android/src/.../views/`
 - [ ] Register in Android router/factory
 - [ ] Run `./gradlew build` to verify no missing class errors
@@ -0,0 +1,152 @@
 ---
 namespace: personal
 created: '2026-05-15'
 updated: '2026-05-16'
 last_synced: '2026-05-16'
 tags:
  - profile
  - user
  - alex
 confidence: 0.9
 ---
 # User Profile — Alex
 > Этот файл читают enrichment- и monitoring-агенты как источник истины о пользователе.
 > Обновлять при любых изменениях в жизни. Дата последнего обновления: 2026-05-15.
 ---
 ## Идентификация
 - **Имя:** Александр (Alex)
 - **ДР:** 11.08.1987, Лев
 - **GitHub:** mallexxx
 - **ADHD** — диагностирован. Гиперфокус, трудности с переключением, поздний старт (~11:00), уходит в работу до 20:00+
 ---
 ## Локации
 | Место | Статус |
 |-------|--------|
 | Бишкек | Основное проживание. Коворкинг для работы. WireGuard домой → Kraken. |
 | Новосибирск (Тайга) | Дом. Летний отпуск + зимовка (ноябрь–март). |
 | Алтай | Дача, строится. |
 | Дубай | Жил 2 года. Разрабатывал Quran Memorization Program для iPad. |
 ---
 ## Семья
 - **Жена:** Наталия
 - **Дочь:** Лиза, 7 лет — [[father-profile]] для деталей
 - Живут вместе в Бишкеке
 ---
 ## Работа
 - **Должность:** macOS Browser Developer / DRI
 - **Компания:** DuckDuckGo (async-first, Asana + Zulip)
 - Приносит доход, но устал. Хочет в инди.
 - **Направление:** serial indie startuper — найти большое решение, реализовать одну небольшую фичу хорошо. Пока сложно с идеями.
 - **Активный проект:** AI-психолог / рефлексия-компаньон (Reflect) — приложение для психологической рефлексии без sycophancy. Anti-sycophancy via dual-bot архитектура (Narrator + Analyst). Стек: Skip.tools (SwiftUI → Android), Claude Sonnet/Haiku backend, OpenAI Realtime API для голоса. Планируется в App Store. Юрисдикция — Казахстан ИП или Эстония OÜ.
 - **Идеи приложений:** [[app-ideas]]
 ---
 ## Навыки
 ### Разработка
 - Swift / macOS / iOS — основной стек (DDG browser, AXPressDeck, Quran app)
 - JavaScript / Node.js
 - Docker, WireGuard, Home Assistant, Zigbee
 - Arduino, прошивки микроконтроллеров
 - AI agents, MCP, LLM orchestration (personal-os)
 ### Руками
 - Ремонт авто + компьютерная диагностика
 - Стройка (два дома построил, вник в процесс полностью)
 - Сборка мебели, ремонты
 - Паяльник, электроника, электрика
 ---
 ## Текущий жизненный контекст
 - Недавно бросил пить (май 2026) — мотивация: неприятные инциденты + ультиматум жены + разговор с другом Серёгой → личное решение
 - **Регуляторный стек вместо алкоголя:** зал, сауна, массаж, баня+квас, б/а IPA, чтение вечером, прогулки пешком 20 мин до коворкинга
 - Ходит в спортзал (рядом с коворкингом, есть сауна)
 - Коворкинг в Бишкеке — структура для ADHD, разделяет работу и семью
 - Работает над personal-os как системой для себя
 ---
 ## Интересы
 - Home automation (Home Assistant, Zigbee, RPi)
 - 3D-печать — [[3d-print-wishlist]]
 - **Видеоигры:** игровой ПК собран как TV-приставка (лончер, джойстики, эмуляторы настроены). Играет редко — паттерн накопления без использования. Прогресс: прошёл с Лизой уровень Shovel Knight, запустил Witcher 3 (вводная сцена).
 - Настолки: Руммикуб, Шакал, Ticket to Ride, Hive, Rush Hour, Диксит
 - Совместные игры с Лизой — [[games-wishlist]]
 - Геокэшинг
 - Хайкинг (Алтай и окрестности)
 - **Готовка:** рецепты собирает, готовит редко в одиночку. В компании / на выезде — шашлыки, куурдак, плов в казане (НГ в Сибири). Паттерн: нужен социальный контейнер.
 - Кино — [[movies-watchlist]]
 - Чтение — [[books-reading-list]] (широкий диапазон: философия, история, sci-fi, психология); читает вечером регулярно
 - Электроника / DIY
 ---
 ## Музыка
 - Закончил музыкальную школу по фортепиано
 - Ходил на курсы гитары дважды (последний раз ~пол года, потом стоп); сейчас играет на 3 аккордах
 - Гитара: **LAVA ME** — лежит, не используется
 - Музыкальный гаджет: **Teenage Engineering Pocket Operator** — побаловался, лежит
 - Хорошо поёт (каraoke — [[karaoke-songs]])
 - Сделал несколько треков сам (нужно курировать и доделывать)
 - Экспериментирует с **Bulka** (AI layer over Strudel — music programming)
 - Сохранены курсы (Instagram): продюсирование + импровизация на фортепиано — не начаты
 - Паттерн: покупает/сохраняет → не использует без внешней структуры (→ [[psychology/profile]])
 ---
 ## Планы поездок 2026
 | Период | Направление | Статус |
 |--------|-------------|--------|
 | Скоро | Алматы — Cirque du Soleil | Планируется |
 | 20.07–14.11 | Новосибирск + трип на машине в Братск (к родителям Наталии) | Планируется |
 | Ноябрь–март | Новосибирск (зимовка + НГ) → обратно в Бишкек | Регулярно |
 | Желаемое | Турция / острова — куда вписать непонятно | Wishlist |
 ---
 ## Психологическое направление
 - С психологом не работает (сессии были, но не регулярно)
 - Хочет добавить в personal-os: регулярные дайджесты, проработки, анализ прогресса
 - AI-психолог как постоянный компонент системы
 - Идея непредвзятого агента: обсуждать Алекса "о нём" (в 3м лице), а не "обо мне" — чтобы избежать сycophancy → [[unprejudiced-ai-psychologist]]
 - Искать скиллы AI-психолога для ассистентов
 ---
 ## Финансы
 - Вёл детальную Excel-таблицу с мультивалютными счетами и расходами
 - Последнее время не ведёт — "денег хватает"
 - Открытые вопросы: инвестиционная стратегия, дополнительный доход, пенсионное планирование
 - Есть идея budget-app в [[app-ideas]] и [[budget-app-features]]
 ---
 ## Неизвестно / уточнить
 - [ ] ДР Наталии
 - [ ] ДР Лизы (точная дата)
 - [ ] Митя (одноклассник) — ДР "14.04 или около того", уточнить
 - [ ] Лена Москаленко — ДР "12 сентября что ли", уточнить (попробовать через ВКонтакте)
 - [ ] Школа Изобретателей — что за программа, чему учат
 - [ ] Музыкальный плейлист Лизы — добавить в её профиль