blueline: consolidate wifi bring-up, adopt cellular/MMS path, task audit

wifi: bringup unit now carries the union ordering (slpi/adsp for TZ MSA,
rmtfs+tqftpserv for firmware serving — the 2026-07-20 boot proved the old
load unit's ordering incomplete) and supersedes blueline-wifi-load;
msa-release adopted into the repo (shutdown unload that keeps warm
reboots clean).

cellular: adopt blueline-clat service+script. clat script now pins a host
route to the Fido MMS proxy via the CLAT — with wifi up the wlan default
beat the clat default and MMS died off-carrier. mmsd config contract
documented (MMS_APN must match the bearer APN ltemobile.apn; shipped as
netsvcs which matches nothing).

tasks: retire 06 qtpim (no longer the contacts path), archive 10 (done),
index catches up on 11 (archived); 01 re-pointed at a contacts-store
decision.

blueline/cellular/README.md

@@ -0,0 +1,35 @@
+# blueline cellular data + MMS path
+
+Fido's LTE bearer (`ltemobile.apn`, modem netdev `qmapmux0.0`) is
+IPv6-only with NAT64. IPv4 exists on the phone only through 464XLAT:
+`blueline-clat.service` runs `blueline-clat.sh`, which derives a CLAT
+IPv6 address from the bearer's current /64 and runs `clatd` (PLAT prefix
+via RFC 7050 DNS64 discovery against the carrier's resolvers). The CLAT
+installs a v4 default at metric 2048, so WiFi (metric 600) stays
+preferred for ordinary traffic.
+
+## The MMS routing trap
+
+MMS is carrier-internal: the MMSC proxy (`205.151.11.13:80`) answers only
+from inside Fido's network, i.e. only via the CLAT. With WiFi up, the
+plain routing table sends it out `wlan0` and MMS silently dies. The clat
+script pins `205.151.11.13/32 dev clat` after clatd brings the device up.
+If Fido ever changes the proxy (it is set in
+`~/.mms/modemmanager/mms` `CarrierMMSProxy`), update both places.
+
+## mmsd-tng config contract (`~/.mms/modemmanager/mms`)
+
+- `MMS_APN` must equal the APN of the *connected* bearer —
+  `ltemobile.apn`. (It shipped as `netsvcs`, which matches nothing;
+  mmsd-tng then never considers the bearer usable. Fixed 2026-07-20.)
+- `CarrierMMSC=http://mms.fido.ca`, `CarrierMMSProxy=205.151.11.13:80`.
+- mmsdtng runs in the user session; chatty is the D-Bus consumer
+  (`org.ofono.mms`).
+
+## Known-good state (2026-07-20)
+
+`mmcli -m any`: Fido LTE attached, bearer `ipv4v6` requested, v6-only
+granted. `curl` to the proxy over the pinned clat route: TCP connect OK
+from `192.0.0.1`. IPv6 has no WiFi default (LAN is v4-only), so all v6
+traffic rides the bearer even on WiFi — metered-data caveat, accepted
+for now.

blueline/cellular/blueline-clat.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=464XLAT CLAT daemon for the cellular bearer
+After=NetworkManager.service
+
+[Service]
+ExecStart=/usr/bin/blueline-clat.sh
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

blueline/cellular/blueline-clat.sh

@@ -0,0 +1,58 @@
+#!/bin/sh
+# 464XLAT launcher: derive the CLAT IPv6 address from the cellular bearer's
+# current /64 (changes per attach, so it cannot live in a static config),
+# then run clatd against it. PLAT prefix is discovered via DNS64 (RFC 7050).
+DEV="${CLAT_WAN_DEV:-qmapmux0.0}"
+
+ADDR=""
+i=0
+while [ $i -lt 30 ]; do
+	ADDR="$(ip -6 addr show dev "$DEV" scope global 2>/dev/null \
+		| awk '/inet6/ { print $2; exit }' | cut -d/ -f1)"
+	[ -n "$ADDR" ] && break
+	i=$((i + 1))
+	sleep 2
+done
+
+if [ -z "$ADDR" ]; then
+	echo "no global IPv6 on $DEV after 60s, giving up" >&2
+	exit 1
+fi
+
+CLAT_V6="$(python3 -c "
+import ipaddress, sys
+net = ipaddress.IPv6Interface('$ADDR/64').network
+print(net[0xc1a7])
+")" || exit 1
+
+# RFC 7050 PLAT discovery must query the CARRIER's DNS64 servers; the system
+# resolver may prefer WiFi DNS (no DNS64) and discovery would fail.
+DNS64="$(nmcli -g IP6.DNS device show "$DEV" 2>/dev/null \
+	| sed -e 's/ | /,/g' -e 's/\\//g')"
+
+echo "bearer $DEV prefix holds $ADDR; CLAT address $CLAT_V6; DNS64 $DNS64"
+
+# MMS must ride the CLAT: the Fido MMS proxy (205.151.11.13, from
+# ~/.mms/modemmanager/mms CarrierMMSProxy) is only reachable from inside the
+# carrier network, and while WiFi is up its default route (metric 600) beats
+# the CLAT default (2048) — so without this pin, MMS send/receive dies the
+# moment WiFi connects. Wait for clatd to create the device, then install a
+# host route (replace = idempotent; re-runs on every service restart).
+(
+	i=0
+	while [ $i -lt 30 ]; do
+		if ip link show clat >/dev/null 2>&1; then
+			ip route replace 205.151.11.13/32 dev clat
+			exit 0
+		fi
+		sleep 1
+		i=$((i + 1))
+	done
+	echo "clat device never appeared; MMS proxy route not installed" >&2
+) &
+
+# v4-conncheck off: WiFi may hold a v4 default route now but drop later;
+# the CLAT must exist whenever the bearer does. Route metrics keep WiFi
+# preferred (clat route is metric 2048).
+exec /usr/bin/clatd clat-v6-addr="$CLAT_V6" plat-dev="$DEV" \
+	v4-conncheck-enable=0 ${DNS64:+dns64-servers="$DNS64"}

blueline/wifi-bringup/blueline-wifi-bringup.service

@@ -3,8 +3,17 @@ Description=WCN3990 wifi bring-up after DSP firmware services
 # See blueline-wifi-defer.conf: ath10k_snoc is blacklisted from udev
 # autoload because probing before rmtfs + tqftpserv serve the DSP firmware
 # crashes the wifi firmware and wedges the driver for the whole boot.
-After=rmtfs.service tqftpserv.service
+# Ordering is the union of every dependency proven to matter:
+# - rmtfs + tqftpserv: board data / wlanmdsp.mbn (2026-07-20 boot crashed
+#   with only slpi/adsp/rmtfs ordering — tqftpserv was the missing one)
+# - slpi + adsp: TrustZone MSA arbitration during island boot (the retired
+#   blueline-wifi-load.service's finding, kept here)
+# This unit supersedes blueline-wifi-load.service (same job, no retry,
+# incomplete ordering — disabled 2026-07-20). blueline-wifi-msa-release
+# stays: it owns the shutdown unload that keeps warm reboots clean.
+After=blueline-slpi.service blueline-adsp.service rmtfs.service tqftpserv.service
 Wants=rmtfs.service tqftpserv.service
+Before=NetworkManager.service
 
 [Service]
 Type=oneshot

blueline/wifi-bringup/blueline-wifi-msa-release.service

@@ -0,0 +1,19 @@
+[Unit]
+Description=Release WCN3990 WLAN firmware state before shutdown
+# Warm reboot with ath10k_snoc loaded leaves the WLAN MSA assigned in TZ;
+# the next boot's wlfw handshake then fails forever ("host capability
+# request rejected: 90", later "failed to assign msa map permissions: -22")
+# and only a cold power-off clears it. ath10k's remove path reassigns the
+# MSA back to HLOS, so unloading the module at shutdown/reboot prevents it.
+# (Adopted into the repo 2026-07-20 — this unit predates wifi-bringup and
+# was only ever installed on the phone.)
+After=NetworkManager.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/true
+ExecStop=/usr/bin/modprobe -r ath10k_snoc
+
+[Install]
+WantedBy=multi-user.target