Skip to content

🧭 NeXuS Compass — Gen6 graphics · apk-world hygiene · node-guards · Chromium

Stamped 2026-07-20 · Anon shutting down — pick up here

Big session. Fixed the E6520's video/graphics end-to-end (VA-API hardware decode, GL threading, hardware cursors, Chromium GPU-raster garbage), cleaned a partially-broken apk world without a single --force or destructive cascade, hardened the apk-sink to tolerate a dirty world, and distilled the whole thing into two universal node tools. Principles: Sane · Simple · Secure · Stealthy · Sustainable · Beautiful (6 now; Sustainable inserted before Beautiful — confirmed by Anon this session).

✅ DONE this session

Gen6 graphics — VERIFIED working end-to-end

Hardware: Dell E6520, Intel Sandy Bridge / HD Graphics 3000 (SNB GT2, Gen6), crocus, OpenGL 3.3 / Mesa 26.1.1. No Vulkan (ANV needs Gen7+). Single Intel GPU, no NVIDIA. - VA-API HW video decode now live: installed libva-intel-driver + libva-utils (Gen6 uses the legacy i965 driver — NOT intel-media-driver, which is Gen8+ and silently won't load). vainfo confirms H.264 (baseline/main/high) + MPEG-2 decode (+H.264 encode). - ~/.config/mpv/mpv.conf: hwdec=no → hwdec=vaapi, vo=gpu. Tested: an h264 940x1280 clip played clean, no garbage, LOW CPU (= real GPU offload). This build has no dmabuf-wl vo — use gpu/gpu-next on Wayland, drm on bare TTY. - ~/.config/fish/conf.d/nexus-graphics.fish (NEW): exports LIBVA_DRIVER_NAME=i965, MESA_GLTHREAD=true, and CHROMIUM_USER_FLAGS. - nexus-wayland-launcher.sh: WLR_NO_HARDWARE_CURSORS is now NVIDIA-only → Intel gets hardware cursors. Also added foot --server startup (see below). - RAM = nothing to do: nexus-dmi-mem.py read it safely → 4 GB ChannelA + 8 GB ChannelB @ 1333 MT/s = dual-channel FLEX (8 GB interleaved full-bandwidth + 4 GB single). 1333 is the SNB max. Fully-symmetric would need 2×8 GB (marginal iGPU gain — not worth $).

Chromium garbage — FIXED (Firefox was always fine)

chrome://gpu dump (~/Downloads/about-gpu-2026-07-20*.txt) showed Chromium on ANGLE→OpenGL ES 3.0 on crocus with Rasterization: Hardware accelerated — HW raster on SNB paints garbage. Fix persisted in nexus-graphics.fish: set -gx CHROMIUM_USER_FLAGS "--disable-gpu-rasterization" (Alpine chromium wrapper appends CHROMIUM_USER_FLAGS — no root). Keeps HW compositing + HW video decode; only raster → CPU. Anon confirmed clean. (Launcher/fuzzel-spawned chromium needs next Wayland session to inherit the env; terminal-launched picks it up now.)

apk world hygiene — 4 errors → 3 benign, NO force, NO cascade damage

Root cause of "all sink installs failing": a dirty apk world made apk exit non-zero on every op; the sink misread that as per-package conflict. - Removed apk-snap (btrfs commit-hook) — root is ext4-on-LVM, so it errored every apk run + spammed subvolume is not a btrfs. Cascaded out snapper + btrfs-progs-libs (dead weight); btrfs-progs tools kept (no btrfs mounts anywhere; sdb1 3.6T unformatted). - incus flavor collision FIXED: had both incus-openrc (LTS) and incus-feature-openrc installed → both own /etc/init.d/incusd. Removed the mismatched incus-feature-openrc (init for a incus-feature daemon that isn't installed); incus-openrc now owns incusd, matching the installed LTS incus. - 3 benign collisions LEFT baselined (removing cascades badly): 3proxy-doc⨯libproxy-doc, outils-doc⨯uutils-coreutils-doc, and freeradius-client⨯ppp-radius — the RADIUS one is STUCK because removing freeradius-client cascades to 58 packages (nagios-plugins-all → all nagios plugins + net-snmp). Deliberately not touched. - Discipline throughout: apk del -s simulate before every delete, never --force (Anon's hard rule: force/override "cripples a system for life").

nexus-apk-sink.sh — HARDENED for a dirty world (backup .bak-20260719_183534)

(1) baseline pre-existing apk error-lines via apk add --simulate busybox; (2) flag a pkg as conflict only if it emits MORE errors than baseline (not on exit code); (3) judge install success by apk info -e STATE not exit code. Result: netscanner sink then walked all 33 pkgs, 0 conflict / 0 dropped.

New tools + manifests

  • ~/scripts/nexus-py.sh (+ .help.md) — uv-powered, narrated Python-env wrapper (run/env/add/info/shell/list/doctor). Kills the venv+activate ritual (fish-safe). uv 0.11.23 already installed.
  • ~/scripts/nexus-node-guards.sh (+ .help.md) — universal "probe-don't-assume" self-correct: guards snapshots (apk-snap only on btrfs), gpu (install only the mesa-vulkan/VA-API driver the GPU can use; Gen6=no-Vulkan), flavors (warn two-impls-per-slot). Modes report/apply. Encodes 6 invariants. Fixed a pipe-subshell scoping bug.
  • ~/scripts/nexus-dmi-mem.py — SMBIOS Type-17 reader from /sys/firmware/dmi/tables/DMI ONLY. Safe replacement for dmidecode -t 17, which HARD-HANGS the E6520 in uninterruptible D-state via /dev/mem (even timeout can't kill it — nearly wedged the box).
  • ~/scripts/nexus_netscanner_sink.pkgs (54 pkgs, curated) — installed via the hardened sink.

Also done earlier this session

  • foot server mode wired into nexus-wayland-launcher.sh (foot --server) + all terminal keybinds across labwc/sway/wayfire switched foot → footclient (incl. sway $term, the grave tdrop dropdown). Cheatsheet updated + corrected (Super+/ opens it, not Super+Space).
  • nexus-cheatsheet.py rewritten to page through less -R -F -X (arrows/PgUp scroll, q quits) — old raw key-loop closed on any ESC-prefixed key and couldn't scroll.
  • NeXuS CLI Arsenal web app brought online: ~/Projects/nexus-arsenal (FastAPI, inventories installed apps + apk enrichment). Ran on 127.0.0.1:8080, then 0.0.0.0:8080 for LAN view.
  • Principle tagline in ~/claude/char-gen-cli/docs/NEXUS_DARK_STACK_BUILD_GUIDE.md → canonical 6 (backup .bak-20260720_074350).
  • Memory: nexus_doctrine_vocab.md (NEW) — Flame·Wick·PERMITTL·Ghost Gate·Janus·DivaChain·NeXiuM·Narcplonk·Proof-of-Witness·Run-Like-Hell + the 4-phase flow. From the NotebookLM infographics in ~/screenshots.

⏳ PENDING doas ops (Anon runs — I never go root)

  • Optional i915 kernel flags (marginal): add i915.enable_fbc=1 i915.fastboot=1 to /boot/extlinux.conf APPEND line + reboot. (I can't edit /boot.)
  • Nothing else blocking — the apk world is clean-enough (3 benign baselined errors); video is done.

▶️ NEXT / PICK UP HERE

  1. Wire nexus-node-guards.sh into the golden-ticket installer nxs-update-install.sh (0-to-hero) — call it near the end so a fresh node auto-arms the right GPU/VA-API driver, gates apk-snap by FS, and warns on flavor collisions. This is the natural home for the GPU-probe + Gen6 defaults.
  2. Canonical tagline sweep: scripts still use the old 4-word Sane · Simple · Secure · Sustainable; sweep to the 6 Sane · Simple · Secure · Stealthy · Sustainable · Beautiful (Anon confirmed order). Was about to when we stopped — Anon said "condense first" (see Open Decisions).
  3. Condense the Dark Stack Build Guide (1259 lines) — Anon's "lets condense first" was aimed here (or at tagline sweep / my verbosity — CONFIRM which).
  4. Optional apk polish: drop to 1 benign error by removing the 2 safe doc-collisions — doas apk del -s 3proxy-doc outils-doc (both pure docs, zero dependents; simulate to confirm no cascade). The RADIUS/nagios one stays baselined.
  5. Arsenal: currently DOWN (died on reboot). Relaunch when wanted: cd ~/Projects/nexus-arsenal && ./.venv/bin/python app_inventory_web.py --no-prescan (add NEXUS_ARSENAL_HOST=0.0.0.0 for LAN — exposes it, no auth).
  6. fish quality-of-life: abbr -a py 'sh ~/scripts/nexus-py.sh' (offered, not added).
  7. Deferred from 2026-07-17 compass (untouched): first Fossil repo ~/scripts → ~/museum/nexus-scripts.fossil; char-gen copy→commit pilot; optional nexus-forge.sh wrapper; TUI sink install (~/scripts/nexus_tui_sink.pkgs, 125 would-install).

📌 OPEN DECISIONS

  • What "condense" meant — the build guide, the tagline sweep, or my reply length? (Anon paused here.)
  • The 3 benign apk collisions — leave baselined forever (sink handles them) vs trim the 2 safe docs vs (RADIUS) live with it. Leaning: trim the 2 docs, leave RADIUS.
  • Central vs project-local venvs — nexus-py standardized on project-local <dir>/.venv; the old central ~/.venv/{dank,caelestia,nexus-hydra} still exist. Converge later?
  • RAM — leave 4+8 flex (fine) vs buy a 2nd 8 GB for symmetric (marginal). Recommend leave.

🧹 CLEANUP / STATE

  • Everything backed up with .bak-<timestamp> (mpv, launcher ×2, sink, cheatsheet ×3, 3 compositor configs, the build guide). No deletions. No secrets touched. Nothing committed/pushed.
  • apk fix -s will show 3 benign errors going forward — EXPECTED (the doc/RADIUS collisions), harmless, baselined by the sink. btrfs snap spam is gone.
  • Reports filed (all per-task): sink-hardening, apk-hygiene, gen6-graphics (+verified), guards+dmi, chromium-fix, principle-tagline, plus earlier cheatsheet/nexus-py/arsenal/netscanner-sink. ~/scripts action report ~48 entries.
  • dmidecode -t 17 / anything reading /dev/mem HARD-HANGS this box — use nexus-dmi-mem.py instead. Don't retry dmidecode.
  • pkill -f <pattern> matching its own cmdline trips a sandbox exit 144 (self-kill) — use pgrep/targeted PIDs; don't chain pkill with other output.
  • Bare-TTY note: currently in a Wayland session (post-reboot). Earlier bare-TTY audio fix (XDG_RUNTIME_DIR) is in conf.d/nexus-xdg-runtime.fish.