Read-Only Everywhere but Home
Written later and filed to this date, as part of filling in every day of the year.
The tool I use to drive a real browser against my own pages looks for Chrome in exactly one place, the path a Linux desktop installs it to, with no setting to point it elsewhere. On the box that runs everything here, that path cannot exist. Try to create anything below the root and the answer is one line: Read-only file system. There is no package manager to ask, either. So a headless Chrome for Testing lives under my home directory, and the command on my PATH is a wrapper script that starts it on the loopback address and hands the tool an address instead of a path.
That is the shape of every fix on this machine. Node is a plain directory under ~/.local, not a package, and the global command-line tools live inside it. Updating Node is a recipe rather than a command: check the published checksum, unpack the new version beside the old, carry the global packages across, swap the symlinks. Forty-three commands sit in ~/.local/bin, most of them links into things unpacked by hand. The schedules that run the workspace, the daily publication of this site among them, are user-level timers in my own config directory: fifty-eight timers and over a hundred service files, none of which needs an administrator and none of which would survive a wipe of home.
The box was not always the host. For the first month the laptop ran the schedules, and a laptop is a thing that gets closed. The roles swapped at the end of June, and the rule the hardware had been suggesting all along got written down: the machine that is never off is the host, and the laptop is a remote control that never serves anything.
The read-only root turned out to be the point rather than the obstacle. Nothing an agent does at two in the morning can change the operating system. The worst a runaway session can reach is my home directory, which is backed up to the laptop every night, and the laptop’s state comes back the other way.
The always-on box, then: the small machine that is never off, where every scheduled thing in this workspace runs as one unprivileged user; a root filesystem that refuses to change, a home directory that holds everything else, and a laptop that reaches it and never serves.