backlog: tidal-ears cloned, GLITCHWAVE synced, HUD pushed, protect installed

Four items closed on the portable-rig front, and one new one opened: no install
step fetches the sister repos CLAUDE.md documents, which is why three separate
manual fixes were needed tonight for one missing line of setup.

backlog.md

@@ -2077,11 +2077,15 @@ as 124 M:
 
     rsync -aH --partial xps22.local:'~/Work/Sound/Tidal/visuals/scenes/' visuals/scenes/
 
-Still open, and a deliberate choice rather than an oversight:
-`~/Work/Art/GLITCHWAVE` (3.1 G) is the SSOT *source* tree. It is needed only to
-re-run `npm run scenes:ingest` for a NEW scene, never to play one. Do not sync
-it to the gig laptop unless we intend to author scenes there — which is also
-the answer to "why was it in Downloads": authoring happens on xps22.
+~~Still open, and a deliberate choice rather than an oversight~~ **SYNCED
+2026-09-06.** `~/Work/Art/GLITCHWAVE` (3.1 G) is the SSOT *source* tree, needed
+only to re-run `npm run scenes:ingest` for a NEW scene, never to play one. It
+was deliberately left on xps22 on the grounds that authoring happens there —
+PLN overruled that: "glitchwave cant hurt tbh". Fetched with `rsync -aH`, so
+this box can now author scenes as well as play them, and the GIF `url:` lines
+scattered through this file resolve locally.
+
+    rsync -aH xps22.local:'~/Work/Art/GLITCHWAVE/' ~/Work/Art/GLITCHWAVE/
 
 ## Sound / mix
 - ~~**`Tidal 12` fader is at `-inf dB`**~~ **DONE, and the framing was wrong.**
@@ -2092,9 +2096,20 @@ the answer to "why was it in Downloads": authoring happens on xps22.
   `fader-baseline.py --restore` in the Ardour-closed window, full restore to the
   2026-08-02 baseline. Nothing further unless the baseline itself should move
   (`--capture`).
-- **`/usr/local/sbin/perf-audio` not deployed**, so gig-up cannot set performance mode
-  and the box played at `gear: None, mode: silent` with the CPU capped at powersave.
-  Needs the root-owned perf.sh + sudoers rule (README "Deploy mode-switching").
+- ~~**`/usr/local/sbin/perf-audio` not deployed**~~ **DONE 2026-09-06** — installed
+  with its sudoers rule (`visudo -cf` parsed OK), so gig-up can set performance mode.
+  It had played at `gear: None, mode: silent` with the CPU capped at powersave.
+- ~~**`parvagues-protect` not installed**~~ **DONE 2026-09-06, and the install
+  immediately exposed a bug in the guard itself** — fixed in `8f2c510`. It ran as
+  root and still could not write `/proc/<pid>/oom_score_adj`: the unit's
+  `CapabilityBoundingSet` omitted `CAP_DAC_OVERRIDE`, which is what uid 0 uses to
+  bypass file permissions, and the target is mode 0644 owned by `pln`. Every write
+  returned EACCES under an error message that said "need root, have uid 0".
+  scsynth and sclang showed `ok` only because they were already at the target, so
+  no write was attempted — the daemon had never protected anything.
+  **Still to verify:** reinstall and watch a restart re-protect on its own, which
+  is the only test that proves it (`systemctl --user restart parvagues-sc`, then
+  `parvagues-protect --check` — expect `oom:200->-1000` naming the NEW pid).
 - **Block size 1024 (~21 ms)** — high for livecoding. Worth tuning the PipeWire quantum.
 - **No ld.so.conf.d preference for PipeWire's libjack**, so `libjack.so.0` resolves to
   jackd2's. `pw-jack` works around it per-app; a system-wide preference would also make
@@ -2141,11 +2156,15 @@ the answer to "why was it in Downloads": authoring happens on xps22.
   `config.pre-midifeedback-20260906-212052.bak`. Worth settling before assuming
   either flag matters.
 
-- **`../tidal-ears/` is not cloned on this box.** `tools/analyze_samples.py` is a
-  committed symlink into it, so it dangles — which broke the whole
-  `test_one_tidal_parser` ratchet at COLLECTION until the guard was taught to
-  skip unreadable paths. Same portable-rig gap as GLITCHWAVE and visuals/scenes:
-  the sisters CLAUDE.md documents are not fetched by any install step.
+- ~~**`../tidal-ears/` is not cloned on this box.**~~ **DONE 2026-09-06** —
+  cloned from `git@git.nech.pl:pln/tidal-ears.git` (branch `main`, 1.4 M; the
+  3.2 G it occupies on xps22 is untracked analysis output, deliberately not
+  fetched). `tools/analyze_samples.py` resolves again.
+  **The gap itself is still open:** no install step fetches the sister repos
+  CLAUDE.md documents. `tools/rig-install.sh` should clone `tidal-ears` and
+  offer `visuals/scenes` + GLITCHWAVE, or `rig-doctor` should at minimum FAIL on
+  a dangling committed symlink — three separate manual fixes for one missing
+  line of setup.
 
 - **pytest is absent from the rig interpreter.** The suite runs under pyenv
   3.11.10 (which lacks `mido`), so 3 `test_lcxl3_display.py` tests fail for
@@ -2154,6 +2173,6 @@ the answer to "why was it in Downloads": authoring happens on xps22.
   rig's own hardware tests are therefore unrunnable where they matter. Same bug
   class as the rig-doctor fix: asking the wrong interpreter.
 
-- **`pulsar-parvagues-hud` 78b1755 is committed but NOT pushed** — that repo is
-  on `main`, which needs an explicit request. It carries the scene-resolver fix
-  without which no backdrop appears on this box.
+- ~~**`pulsar-parvagues-hud` 78b1755 is committed but NOT pushed**~~ **PUSHED
+  2026-09-06** on explicit request (`368bee9..78b1755` → `main`). Carries the
+  scene-resolver fix without which no backdrop appears on this box.