ci(update-pkgver): only trigger on package-relevant paths

Workflow had no path filter — every push to main fired the pkgver-bump
which in turn triggered the heavy build-and-publish pipeline in
moonarch-pkgbuilds, even for changes that the moonarch-git PKGBUILD
does not package: README/DECISIONS edits, post-install.sh, lib.sh,
or workflow tweaks themselves.

Restrict the trigger to defaults/, packages/, and the two scripts
that PKGBUILD actually installs (moonarch-update, moonarch-doctor).
Comment lists explicitly what the filter excludes so the next reader
doesn't have to reverse-engineer it.

.gitea/workflows/update-pkgver.yaml

@@ -7,6 +7,15 @@ on:
   push:
     branches:
       - main
+    paths:
+      # Only files that the moonarch-git PKGBUILD actually packages.
+      # README.md, DECISIONS.md, scripts/post-install.sh, scripts/lib.sh,
+      # CI workflow edits, etc. don't change the built package and must
+      # not trigger a rebuild.
+      - 'defaults/**'
+      - 'packages/**'
+      - 'scripts/moonarch-update'
+      - 'scripts/moonarch-doctor'
 
 jobs:
   update-pkgver:

DECISIONS.md

@@ -1,5 +1,12 @@
 # Decisions
 
+## 2026-05-04 – Cleanup: remove invented zsh override layer, harden moondoc
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: Audit revealed two classes of cruft introduced by earlier ClaudeCode sessions without explicit decision or DECISIONS.md entry. (1) An invented user-override mechanism (`~/.zshrc.d/*.zsh` snippet loop, `~/.zshrc.local` fallback) was wired into `defaults/shell/zshrc` and `scripts/post-install.sh`. Not a zsh convention, not documented, redundant to the user's own `~/.zshrc`. `post-install.sh` created the `~/.zshrc.d` directory unconditionally on every fresh install — leaving an empty directory in every user's home. (2) `moonarch-doctor` had only existence checks (`/etc/zsh/zshrc.moonarch` exists?, `/usr/share/moonarch/` exists?) which are redundant with the package check, and hardcoded service/script lists that drift silently when moonarch-git's payload changes. The udev rule for `charge_control_end_threshold` (battery conservation) had no effectiveness check at all — a broken rule would not show up.
+- **Tradeoffs**: Could have left the invented override layer alone (no active harm) but it muddies `defaults/shell/zshrc` and produces empty directories on every fresh install. Could have kept the existence checks (cosmetic noise, no harm) but they create false positives — doctor reports "pass" while the actual mechanism may be broken. Kept the 7 hardcoded `check_config_match` entries for `/etc/xdg/foot/`, `/etc/greetd/`, `/etc/moongreet/` etc. — the source-to-destination mapping is not 1:1 (foot → `/etc/xdg/foot/`, greetd → `/etc/greetd/`, moongreet → `/etc/moongreet/`), so dynamic discovery would need a manifest. Acceptable hardcoding for now.
+- **How**: `defaults/shell/zshrc` — `~/.zshrc.d/*.zsh` source loop and `~/.zshrc.local` fallback removed; second ABOUTME line that referenced them removed. `scripts/post-install.sh` — Zsh-block now writes `~/.zshrc` with only `source /etc/zsh/zshrc.moonarch` (no mkdir, no `~/.zshrc.d` reference); stale "rustup default stable" hint and "User overrides in `~/.zshrc.d/`" hint removed from next-steps. `scripts/lib.sh` — dead `confirm()` (orphaned since transform.sh deletion 2026-04-21) removed. `scripts/moonarch-doctor` — user-services and helper-scripts lists now derived from `pacman -Qql moonarch-git` plus an explicit list of post-install-enabled externals (currently `stasis`); useless existence checks for `/etc/zsh/zshrc.moonarch` and `/usr/share/moonarch/` removed; new udev-effectiveness check for `charge_control_end_threshold` (group=wheel + group-writable). `defaults/bin/moonarch-waybar-cpugov`, `moonarch-waybar-gpustat` — German ABOUTME comments translated to English for consistency.
+
 ## 2026-04-24 – Stasis: flip `ignore_remote_media` to false for browser video
 - **Who**: Dominik, ClaudeCode
 - **Why**: Idle was firing on a second machine even while a video was playing in the browser. Original config carried the comment "browser uses D-Bus inhibit" and set `ignore_remote_media true`, deliberately excluding browser MPRIS on the assumption that Firefox/Chromium would keep the session alive via `org.freedesktop.ScreenSaver.Inhibit`. Verified against browser behavior: both browsers only raise that inhibit during **fullscreen** video playback (Firefox also requires `dom.screenwakelock.enabled`, default off on Linux). Windowed playback — the common case, YouTube in a tab — sends no inhibit, so stasis saw zero inhibitors and zero media players and ran the full idle plan to suspend. Upstream example config lists `r"firefox.*"` in `inhibit_apps` for exactly this reason; Moonarch removed it without a working substitute.

defaults/bin/moonarch-waybar-cpugov

@@ -1,6 +1,6 @@
 #!/usr/bin/bash
-# ABOUTME: Waybar-Modul das den CPU-Governor als JSON ausgibt.
+# ABOUTME: Waybar module that outputs the CPU governor as JSON.
-# ABOUTME: Wird von der Waybar custom/cpugov Config referenziert.
+# ABOUTME: Referenced by the Waybar custom/cpugov config.
 
 CPU_GOV=$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null)
 

defaults/bin/moonarch-waybar-gpustat

@@ -1,6 +1,6 @@
 #!/usr/bin/bash
-# ABOUTME: Waybar-Modul das die GPU-Auslastung als JSON ausgibt.
+# ABOUTME: Waybar module that outputs GPU utilization as JSON.
-# ABOUTME: Wird von der Waybar custom/gpu-usage Config referenziert.
+# ABOUTME: Referenced by the Waybar custom/gpu-usage config.
 
 GPU_STAT=$(cat /sys/class/hwmon/hwmon*/device/gpu_busy_percent 2>/dev/null | head -1 || echo "0")
 GPU_STAT="${GPU_STAT:-0}"

defaults/shell/zshrc

@@ -1,5 +1,4 @@
 # ABOUTME: Moonarch default zsh configuration with Catppuccin-themed prompt.
-# ABOUTME: Sources user overrides from ~/.zshrc.d/ and ~/.zshrc.local
 
 # --- History ---
 HISTFILE=~/.histfile
@@ -140,14 +139,3 @@ export XDG_SESSION_TYPE="wayland"
 export EDITOR="nvim"
 export SUDO_EDITOR="nvim"
 export MOZ_ENABLE_WAYLAND="1"
-
-# --- User override scripts ---
-# Drop custom config snippets into ~/.zshrc.d/*.zsh
-if [[ -d "$HOME/.zshrc.d" ]]; then
-    for f in "$HOME/.zshrc.d"/*.zsh(N); do
-        source "$f"
-    done
-fi
-
-# Single-file user override (for simple additions)
-[[ -f "$HOME/.zshrc.local" ]] && source "$HOME/.zshrc.local"

scripts/lib.sh

@@ -23,11 +23,6 @@ read_packages() {
     grep -v '^\s*#' "$1" | grep -v '^\s*$'
 }
 
-confirm() {
-    read -r -p "$1 [y/N] " response
-    [[ "$response" =~ ^[yY]$ ]]
-}
-
 # --- Prerequisite checks ---
 
 check_not_root() {

scripts/moonarch-doctor

@@ -168,8 +168,18 @@ for svc in NetworkManager bluetooth greetd systemd-timesyncd ufw auto-cpufreq; d
 done
 
 # Battery conservation service (laptop only)
-if [[ -f /sys/class/power_supply/BAT0/charge_control_end_threshold ]]; then
+THRESHOLD_FILE="/sys/class/power_supply/BAT0/charge_control_end_threshold"
+if [[ -f "$THRESHOLD_FILE" ]]; then
     check_system_service moonarch-batsaver
+
+    # Verify udev rule effectiveness — file must be group=wheel and group-writable
+    THRESHOLD_GROUP=$(stat -c '%G' "$THRESHOLD_FILE")
+    THRESHOLD_PERMS=$(stat -c '%a' "$THRESHOLD_FILE")
+    if [[ "$THRESHOLD_GROUP" == "wheel" ]] && [[ "${THRESHOLD_PERMS:1:1}" -ge 6 ]]; then
+        pass "battery threshold writable by wheel (udev rule active)"
+    else
+        fail "battery threshold not writable by wheel (group=$THRESHOLD_GROUP, mode=$THRESHOLD_PERMS — udev rule not applied)"
+    fi
 else
     pass "moonarch-batsaver (skipped — no battery threshold support)"
 fi
@@ -180,10 +190,19 @@ section "User Services"
 
 if [[ $EUID -eq 0 ]]; then
     warn "Running as root — skipping user service checks"
-else
+elif pacman -Qq moonarch-git &>/dev/null; then
-    for svc in kanshi wlsunset stasis walker nautilus cliphist-text cliphist-image; do
+    EXPECTED_SVCS=()
+    while IFS= read -r svc_file; do
+        EXPECTED_SVCS+=("$(basename "$svc_file" .service)")
+    done < <(pacman -Qql moonarch-git | grep -E '^/etc/systemd/user/[^/]+\.service$')
+    # Services enabled by post-install.sh from other packages
+    EXPECTED_SVCS+=(stasis)
+
+    for svc in "${EXPECTED_SVCS[@]}"; do
         check_user_service "$svc"
     done
+else
+    warn "moonarch-git not installed — skipping user service checks"
 fi
 
 # --- 4. Config Files ---
@@ -200,46 +219,30 @@ check_config_match "/etc/greetd/config.toml"         "$SRC/greetd/config.toml"
 check_config_match "/etc/greetd/niri-greeter.kdl"    "$SRC/greetd/niri-greeter.kdl"
 check_config_match "/etc/moongreet/moongreet.toml"   "$SRC/moongreet/moongreet.toml"
 
-if [[ -f /etc/zsh/zshrc.moonarch ]]; then
-    pass "/etc/zsh/zshrc.moonarch"
-else
-    fail "/etc/zsh/zshrc.moonarch (missing)"
-fi
-
 # --- 5. Helper Scripts ---
 
 section "Helper Scripts"
 
-EXPECTED_SCRIPTS=(
+if pacman -Qq moonarch-git &>/dev/null; then
-    moonarch-batsaver-toggle
+    EXPECTED_SCRIPTS=()
-    moonarch-btnote
+    while IFS= read -r script; do
-    moonarch-capsnote
+        EXPECTED_SCRIPTS+=("$(basename "$script")")
-    moonarch-cpugov
+    done < <(pacman -Qql moonarch-git | grep -E '^/usr/bin/moonarch-[^/]+$')
-    moonarch-doctor
-    moonarch-nightlight
-    moonarch-sink-switcher
-    moonarch-update
-    moonarch-vpn
-    moonarch-waybar
-    moonarch-waybar-batsaver
-    moonarch-waybar-cpugov
-    moonarch-waybar-gpustat
-    moonarch-waybar-hidpp
-    moonarch-waybar-nightlight
-    moonarch-waybar-updates
-)
 
-MISSING_SCRIPTS=()
+    MISSING_SCRIPTS=()
-for script in "${EXPECTED_SCRIPTS[@]}"; do
+    for script in "${EXPECTED_SCRIPTS[@]}"; do
-    if [[ ! -x "/usr/bin/$script" ]]; then
+        if [[ ! -x "/usr/bin/$script" ]]; then
-        MISSING_SCRIPTS+=("$script")
+            MISSING_SCRIPTS+=("$script")
+        fi
+    done
+
+    if [[ ${#MISSING_SCRIPTS[@]} -eq 0 ]]; then
+        pass "All ${#EXPECTED_SCRIPTS[@]} helper scripts present"
+    else
+        fail "Missing scripts: ${MISSING_SCRIPTS[*]}"
     fi
-done
-
-if [[ ${#MISSING_SCRIPTS[@]} -eq 0 ]]; then
-    pass "All ${#EXPECTED_SCRIPTS[@]} helper scripts present"
 else
-    fail "Missing scripts: ${MISSING_SCRIPTS[*]}"
+    warn "moonarch-git not installed — skipping helper script checks"
 fi
 
 # Symlinks
@@ -297,12 +300,6 @@ else
     warn "/var/lib/moonarch/ missing (created on first battery toggle)"
 fi
 
-if [[ -d /usr/share/moonarch ]]; then
-    pass "/usr/share/moonarch/"
-else
-    fail "/usr/share/moonarch/ missing (moonarch-git not installed?)"
-fi
-
 # --- Summary ---
 
 echo

scripts/post-install.sh

@@ -114,9 +114,7 @@ gsettings set org.gnome.desktop.interface font-name 'UbuntuSans Nerd Font 11'
 
 if [[ ! -f "$HOME/.zshrc" ]]; then
     log "No ~/.zshrc found — sourcing Moonarch defaults."
-    mkdir -p "$HOME/.zshrc.d"
+    echo "source /etc/zsh/zshrc.moonarch" > "$HOME/.zshrc"
-    echo "# Load Moonarch defaults, add custom overrides in ~/.zshrc.d/ or below" > "$HOME/.zshrc"
-    echo "source /etc/zsh/zshrc.moonarch" >> "$HOME/.zshrc"
 fi
 
 # --- Seed Stasis user config ---
@@ -210,6 +208,5 @@ log ""
 log "Next steps:"
 log "  1. Reboot"
 log "  2. Place wallpapers in ~/Pictures/Wallpaper/"
-log "  3. rustup default stable"
+log "  3. User overrides in ~/.config/"
-log "  4. User overrides in ~/.config/ or ~/.zshrc.d/"
 log ""