[meta]
source_os = "supplement"
target_distro_family = "any"

# Supplementary patterns for users dual-booting Windows alongside any Linux distro.
# These patterns cover coexistence-specific issues that only appear because both OSes
# share the same hardware. This file is merged on top of the primary migration pattern file.

[log_paths]

# ── NTFS / Fast Startup ───────────────────────────────────────────────────────

[[patterns]]
id       = "ntfs-volume-dirty"
sources  = ["kmsg"]
match_text = "volume is dirty"
severity = "warn"
title    = "Windows drive needs a check (Fast Startup)"
body     = "Windows didn't shut down cleanly — it probably used Fast Startup (hibernation). Linux mounted the NTFS partition read-only to protect your data. Fix in Windows: Start -> Power -> hold Shift and click Shut Down (real shutdown, not hibernate). Then turn Fast Startup off: Control Panel -> Power Options -> 'Choose what the power buttons do' -> uncheck 'Turn on fast startup'."

[[patterns]]
id       = "ntfs-force-required"
sources  = ["kmsg"]
match_text = "Dirty flag is set"
severity = "warn"
title    = "NTFS drive mounted read-only (dirty flag)"
body     = "Windows left the NTFS filesystem marked dirty. Boot into Windows and do a full shutdown (Shift+Shut Down), or force-fix on Linux: sudo ntfsfix /dev/sdXN — replace sdXN with the partition shown in the error."

[[patterns]]
id       = "ntfs-hibernation"
sources  = ["kmsg"]
match_text = "Windows is hibernated"
severity = "warn"
title    = "Windows is hibernated — partition locked"
body     = "Linux found a Windows hibernation file (hiberfil.sys) and can't write to the NTFS partition safely. You must resume and properly shut down Windows first. To remove the hibernation file permanently: in Windows as admin, run: powercfg /h off"

# ── Clock skew ────────────────────────────────────────────────────────────────

[[patterns]]
id       = "rtc-time-wrong"
sources  = ["journald"]
match_text = "RTC time"
severity = "info"
title    = "System clock drifted after Windows boot"
body     = "Windows stores the hardware clock in local time; Linux stores it in UTC. Dual-booting causes clock drift between sessions. Fix permanently in Linux: timedatectl set-local-rtc 0 (keep Linux correct and fix Windows instead). Or in Windows, add a registry key to use UTC: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation, add DWORD RealTimeIsUniversal = 1."

# ── GRUB overwritten by Windows ───────────────────────────────────────────────

[[patterns]]
id       = "grub-missing-windows-update"
sources  = ["journald"]
match_text = "error: no such device"
severity = "warn"
title    = "GRUB may have been overwritten"
body     = "Windows Update sometimes overwrites the EFI boot entry. If Linux stopped booting after a Windows update: boot from your Linux USB installer -> rescue/chroot -> reinstall GRUB: grub-install /dev/sdX && update-grub (Debian/Ubuntu) or grub-install /dev/sdX && grub-mkconfig -o /boot/grub/grub.cfg (Arch)."

# ── BitLocker ─────────────────────────────────────────────────────────────────

[[patterns]]
id       = "bitlocker-blocked"
sources  = ["kmsg"]
match_text = "BitLocker"
severity = "info"
title    = "BitLocker encrypted partition"
body     = "This Windows partition is BitLocker-encrypted. Linux can mount it with dislocker: sudo apt install dislocker (Debian) or paru -S dislocker (Arch). You'll need the BitLocker recovery key from your Microsoft account."

# ── Shared NTFS partition permissions ────────────────────────────────────────

[[patterns]]
id       = "ntfs-permission-error"
sources  = ["journald"]
match_text = "ntfs-3g: Failed to open"
severity = "warn"
title    = "NTFS permission error"
body     = "ntfs-3g can't open the Windows partition. Check your /etc/fstab mount options — add uid=1000,gid=1000,umask=022 to give your Linux user access. Make sure Windows is fully shut down first."