Frank veto: DirectoryNotEmpty re-fires on every file event (GUI writes,
wallpaper shuffle) un-debounced -> hundreds of heartbeat spawns/day.
The sweep is cheap (57 ms CPU) but the trigger design was event spam.
Exposure-window fix is an open design question; timer unchanged.
Timer-only heartbeat left GUI dotfiles edits uncommitted for up to 59
minutes; a trunk-sync session clearing the dirty tree on 2026-10-18
destroyed a month of uncommitted noctalia bar layout inside that gap.
live-sync.path (DirectoryNotEmpty on dotfiles/) fires the existing
flock-guarded oneshot within seconds of any repo-side dotfiles write,
shrinking the exposure window from ~1h to ~2s. Timer stays as the
hourly catch-all for the machine tiers.
Operator decision at review: 15 min is aggressive for config churn; hourly
keeps the stale-window acceptable (<=1 h) with a fifth of the wakeups.
Timer unit, tier law, and failure-table wording aligned.
The checkout IS the deployment and symlinks make live state (memories,
auto-learned skills, agent config, desktop settings) dirty tracked files
continuously; no commit law covered machine churn, so it accumulated
unpushed for weeks — one disk held the only copy of ~61 managed skills,
a settings fix stayed local-only, and dirty trees refused merges.
scripts/live-sync.sh (systemd user timer, ~15 min) commits ONLY the
allowlisted machine/desktop-live tiers with hooks armed, merges
origin/main, pushes, and reaps wt/* worktrees older than 7 days. Task
dirt outside the allowlist is never staged; conflicts abort and alert
via ntfy; branch guard refuses off main; never --no-verify, never force.
Black-box contract pinned by tests/live-sync.bats (9 tests, suite 36/36).
Refs #11
Import Dankware's environment layer into the repo as home-relative package
trees (niri, gtk-3/4, ghostty, alacritty, fish, zsh, bash, profile,
systemd-user, dconf). scripts/deploy.sh implements stow-equivalent semantics
(check|adopt|sync modes): identical files adopt to symlinks, new files link,
divergent files quarantine-and-replace under .quarantine/<host>/<ts>/ (gitignored).
zz-<hostname> override packages deploy last with override semantics.
Secrets never enter git: GITEA_TOKEN moved from .zshrc into untracked
~/.config/environment.d/secrets.env (0600); tracked .zshrc sources it
guarded. core.hooksPath armed by deploy.sh so the pre-commit secret gate is
live on every machine that deploys.
Frank