[meta]
source_os = "supplement"
target_distro_family = "any"

# Supplementary patterns for users dual-booting Windows alongside any Linux distro.
# These patterns cover coexistence-specific issues that only appear because both OSes
# share the same hardware. This file is merged on top of the primary migration pattern file.

[log_paths]

# ── NTFS / Fast Startup ───────────────────────────────────────────────────────

[[patterns]]
id       = "ntfs-volume-dirty"
sources  = ["kmsg"]
match_text = "volume is dirty"
severity = "warn"
title    = "Windows drive needs a check (Fast Startup)"
body     = "Windows didn't shut down cleanly — it probably used Fast Startup (hibernation). Linux mounted the NTFS partition read-only to protect your data. Fix in Windows: Start -> Power -> hold Shift and click Shut Down (real shutdown, not hibernate). Then turn Fast Startup off: Control Panel -> Power Options -> 'Choose what the power buttons do' -> uncheck 'Turn on fast startup'."

[[patterns]]
id       = "ntfs-force-required"
sources  = ["kmsg"]
match_text = "Dirty flag is set"
severity = "warn"
title    = "NTFS drive mounted read-only (dirty flag)"
body     = "Windows left the NTFS filesystem marked dirty. Boot into Windows and do a full shutdown (Shift+Shut Down), or force-fix on Linux: sudo ntfsfix /dev/sdXN — replace sdXN with the partition shown in the error."

[[patterns]]
id       = "ntfs-hibernation"
sources  = ["kmsg"]
match_text = "Windows is hibernated"
severity = "warn"
title    = "Windows is hibernated — partition locked"
body     = "Linux found a Windows hibernation file (hiberfil.sys) and can't write to the NTFS partition safely. You must resume and properly shut down Windows first. To remove the hibernation file permanently: in Windows as admin, run: powercfg /h off"

# ── Clock skew ────────────────────────────────────────────────────────────────

[[patterns]]
id       = "rtc-time-wrong"
sources  = ["journald"]
match_text = "RTC time"
severity = "info"
title    = "System clock drifted after Windows boot"
body     = "Windows stores the hardware clock in local time; Linux stores it in UTC. Dual-booting causes clock drift between sessions. Fix permanently in Linux: timedatectl set-local-rtc 0 (keep Linux correct and fix Windows instead). Or in Windows, add a registry key to use UTC: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation, add DWORD RealTimeIsUniversal = 1."

# ── GRUB overwritten by Windows ───────────────────────────────────────────────

[[patterns]]
id       = "grub-missing-windows-update"
sources  = ["journald"]
match_text = "error: no such device"
severity = "warn"
title    = "GRUB may have been overwritten"
body     = "Windows Update sometimes overwrites the EFI boot entry. If Linux stopped booting after a Windows update: boot from your Linux USB installer -> rescue/chroot -> reinstall GRUB: grub-install /dev/sdX && update-grub (Debian/Ubuntu) or grub-install /dev/sdX && grub-mkconfig -o /boot/grub/grub.cfg (Arch)."

# ── BitLocker ─────────────────────────────────────────────────────────────────

[[patterns]]
id       = "bitlocker-blocked"
sources  = ["kmsg"]
match_text = "BitLocker"
severity = "info"
title    = "BitLocker encrypted partition"
body     = "This Windows partition is BitLocker-encrypted. Linux can mount it with dislocker: sudo apt install dislocker (Debian) or paru -S dislocker (Arch). You'll need the BitLocker recovery key from your Microsoft account."

# ── Shared NTFS partition permissions ────────────────────────────────────────

[[patterns]]
id       = "ntfs-permission-error"
sources  = ["journald"]
match_text = "ntfs-3g: Failed to open"
severity = "warn"
title    = "NTFS permission error"
body     = "ntfs-3g can't open the Windows partition. Check your /etc/fstab mount options — add uid=1000,gid=1000,umask=022 to give your Linux user access. Make sure Windows is fully shut down first."

[[patterns]]
id       = "slow-boot-network-wait"
sources  = ["journald"]
match_text = "Failed to start Network Wait Online"
severity = "warn"
title    = "Boot is slow: waiting for network"
body     = "systemd is waiting for a full network connection before finishing boot. This is almost never needed on a desktop or laptop. Disable it: sudo systemctl disable systemd-networkd-wait-online.service NetworkManager-wait-online.service — then reboot. Unlike Windows, Linux lets you disable any boot step that isn't relevant to your setup."

[[patterns]]
id       = "slow-boot-device-timeout"
sources  = ["journald"]
match_text = "Timed out waiting for device"
severity = "warn"
title    = "Boot is slow: a device that no longer exists"
body     = "systemd is waiting for a disk, partition, or device that isn't connected. Common cause: /etc/fstab has an entry for an external drive or old partition. Check: cat /etc/fstab — look for lines pointing to drives that aren't always connected. Add the 'nofail' option to make them optional: UUID=xxx /mnt/point type defaults,nofail 0 0. Or comment the line out with #."

[[patterns]]
id       = "slow-boot-long-running-job"
sources  = ["journald"]
match_text = "A start job is running for"
severity = "info"
title    = "A service is taking a long time to start"
body     = "A background service is taking longer than expected during boot. To find what's slowing your startup: open a terminal after booting and run: systemd-analyze blame — the top entries are the biggest contributors. For a visual timeline saved to a file: systemd-analyze plot > ~/boot-profile.svg — then open the SVG in a browser."

# ── SSH / remote access ───────────────────────────────────────────────────────

[[patterns]]
id       = "ssh-permissions-key"
sources  = ["journald"]
match_text = "WARNING: UNPROTECTED PRIVATE KEY FILE"
severity = "warn"
title    = "SSH key permissions are too open"
body     = "Your SSH private key is readable by other users on this system — SSH refuses to use it as a security measure. Fix: chmod 600 ~/.ssh/id_rsa (replace id_rsa with the key filename shown in the error). Also lock the directory: chmod 700 ~/.ssh. This is different from Windows where file permissions are mostly advisory."

# ── Flatpak ───────────────────────────────────────────────────────────────────

[[patterns]]
id       = "flatpak-missing-runtime"
sources  = ["journald"]
match_text = "error: runtime/org."
severity = "warn"
title    = "Flatpak app is missing a runtime"
body     = "A Flatpak app can't find a required runtime (a shared set of libraries). Update all runtimes first: flatpak update — if that doesn't fix it, reinstall the app: flatpak install flathub com.example.AppName. Flatpak runtimes are like Windows runtime packages (VC++ Redistributable) but for Linux apps."