perf(network): nothing waits for a routable address at boot

NetworkManager-wait-online holds network-online.target until a connection is
routable, and multi-user.target sits behind it through docker.service, the only
active unit that pulls the target in.

DECISIONS.md

@@ -1,5 +1,29 @@
 # Decisions
 
+## 2026-09-28 – Nothing waits for a routable address at boot
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: The ThinkPad took 54.7s to boot. Two of those posts are not the
+  configuration's to shorten: 14.7s of firmware, and 14.2s inside the initrd
+  where the machine waits for the LUKS passphrase to be typed — the prompt
+  stands at 4.97s after kernel start, `systemd-cryptsetup` runs at 19.20s.
+  What is left is 14.4s of userspace, and `NetworkManager-wait-online.service`
+  holds 10.6s of it: it keeps `network-online.target` until a connection is
+  routable, and `multi-user.target` sits behind that target through
+  `docker.service`. Of the two units that pull the target in, `docker.service`
+  is the only active one; `fwupd-refresh.service` is not running.
+- **Tradeoffs**: The first approach was to detach `docker.service` from the
+  target instead, which leaves the wait in place for anything else that may
+  want it. It needs `lib.mkForce` on both `after` and `wants`, so the upstream
+  unit's dependency list is copied into this flake and drifts silently on the
+  next nixpkgs bump. Disabling the wait is one line and nothing to keep in
+  sync. What it costs: docker starts without a guarantee that an address is
+  already routable.
+- **How**: `systemd.services.NetworkManager-wait-online.enable = false` in
+  `modules/network.nix`, with the measurement in the comment beside it.
+  Plymouth was not touched: `plymouth-quit-wait.service` shows 2.4s in
+  `systemd-analyze blame` but does not appear in the critical chain.
+
 ## 2026-09-28 – Images open in the viewer, not in the browser
 
 - **Who**: Dominik, ClaudeCode

modules/network.nix

@@ -11,6 +11,13 @@
   # is what hands the keyring password to the connection.
   networking.networkmanager.plugins = [ pkgs.networkmanager-openvpn ];
 
+  # NetworkManager-wait-online holds network-online.target until a connection is
+  # routable, and multi-user.target waits behind it — measured at 10.6s in the
+  # journal, against 14.4s for the whole of userspace. Of the units that pull the
+  # target in, docker.service is the only active one; fwupd-refresh.service is
+  # not running.
+  systemd.services.NetworkManager-wait-online.enable = false;
+
   hardware.bluetooth.enable = true;
   services.blueman.enable = true;