fix(nightlight): default OFF, drop wlsunset from auto-enable list

Coordinated fix with moonarch-pkgbuilds: post-install.sh enabled
wlsunset by default, while the PKGBUILD shipped a global-scope
WantedBy symlink. Together that made the toggle's user-scope disable
a no-op — filter persisted across reboots regardless of user intent.

Removing wlsunset from USER_SERVICES makes "off" the install default;
the toggle now works in user scope only, where disable can take effect.

CLAUDE.md

@@ -22,11 +22,13 @@ Laptops mit `charge_control_end_threshold`-Support (ThinkPad, Framework, etc.) e
 
 Waybar-Toggle für wlsunset (Wayland-nativer Blaufilter), persistenter Zustand via systemd:
 - `wlsunset.service` (systemd User-Service) mit `After=kanshi.service` — startet erst wenn alle Outputs konfiguriert sind
+- **Default OFF** — frische Installs starten ohne Filter. PKGBUILD legt für `wlsunset` bewusst KEINEN Symlink in `/etc/systemd/user/graphical-session.target.wants/` an, post-install.sh enabled den Service nicht.
 - Klick auf das Nightlight-Modul in `group/brightness` toggled wlsunset an/aus (`enable --now` / `disable --now`)
-- Zustand überlebt Reboots (enabled/disabled bleibt bestehen)
+- Zustand überlebt Reboots (User-Scope-Symlink in `~/.config/systemd/user/...wants/`)
 - Aktiver Zustand zeigt 󰌵 in Catppuccin Yellow, inaktiv 󰌶 in Standard-Textfarbe
 - Signal SIGRTMIN+11 für sofortiges Waybar-Refresh
 - Scripts: `moonarch-nightlight` (Toggle), `moonarch-waybar-nightlight` (Status-JSON)
+- **Wichtig**: Auf gar keinen Fall einen Global-Scope-Symlink in `/etc/systemd/user/...wants/wlsunset.service` anlegen — der überstimmt jedes User-`disable` und macht den Filter de-facto unausschaltbar.
 
 ## Waybar Config Merger (moonarch-waybar)
 

DECISIONS.md

@@ -1,5 +1,12 @@
 # Decisions
 
+## 2026-05-04 – Nightlight default OFF, no global enablement
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: Filter survived reboots even after the user toggled it off. Root cause: `moonarch-pkgbuilds/moonarch-git/PKGBUILD` looped over every user service in `defaults/etc/systemd/user/*.service` and dropped a WantedBy symlink into `/etc/systemd/user/graphical-session.target.wants/`. That path is global scope. `moonarch-nightlight` runs `systemctl --user disable wlsunset`, which can only remove user-scope symlinks under `~/.config/`. Systemd's own warning during disable spelled it out: "The following unit files have been enabled in global scope. This means they will still be started automatically after a successful disablement in user scope." Verified empirically — `is-enabled` stayed `enabled`, root symlink untouched. Additionally, `scripts/post-install.sh` enabled `wlsunset` by default in its `USER_SERVICES` array, so even without the global symlink the filter would default ON.
+- **Tradeoffs**: Three options weighed. (1) Default OFF + user-scope toggle — minimal change, fresh installs start without filter, toggle creates `~/.config/.../wants/` symlink that user-disable can actually remove. (2) Default ON + user-scope toggle — same plumbing, post-install enables in user scope; filter on by default but disable persists. (3) Status-file gate inside the unit — service stays enabled, ExecStartPre checks a file and exits when off. Picked (1): no behavioral default imposed on fresh installs, no extra plumbing, the toggle stays the single source of truth. Could have moved enablement to a per-user `systemctl --user --global enable` from the .install hook, but that fights the "this is a UI toggle" framing.
+- **How**: `moonarch-pkgbuilds/moonarch-git/PKGBUILD` — symlink loop now skips a `skip_enable` list (currently `wlsunset.service`); skipped services are still installed under `/etc/systemd/user/` but not wanted by `graphical-session.target` at the global level. `moonarch-pkgbuilds/moonarch-git/moonarch.install` — `pre_upgrade()` deletes any pre-existing `/etc/systemd/user/graphical-session.target.wants/wlsunset.service` to clean up systems that received the old packaging. `moonarch/scripts/post-install.sh` — `wlsunset` removed from `USER_SERVICES`; comment explains why. `moonarch/CLAUDE.md` — Nightlight section reflects "Default OFF" and the global-scope-symlink hazard.
+
 ## 2026-05-04 – Battery threshold permissions: udev rule → pkexec helper
 
 - **Who**: Dominik, ClaudeCode

scripts/post-install.sh

@@ -133,11 +133,13 @@ fi
 log "Enabling systemd user services..."
 USER_SERVICES=(
     "kanshi"
-    "wlsunset"
     "stasis"
     "cliphist-text"
     "cliphist-image"
 )
+# wlsunset deliberately excluded: nightlight is a user-toggle (off by default).
+# Enabling it system-wide would create a global-scope WantedBy symlink that
+# overrides any user-scope `systemctl --user disable`.
 
 for service in "${USER_SERVICES[@]}"; do
     if systemctl --user cat "${service}.service" &>/dev/null; then