rig_units: midiviz on demand, so no unit starts at login

tools/check-stale-units.py

@@ -18,9 +18,8 @@ committed", it is "is the process executing what I can read", and an uncommitted
 edit counts. mtime answers exactly that and nothing else.
 
 WHAT --fix WILL AND WILL NOT RESTART
-    Restarts the `login` units: they are background lenses and recorders whose
-    restart costs nothing anybody hears (midiviz, the Bridge, gig-log,
-    perf-tray, autoroute, midi-autoconnect).
+    Restarts only `login` units. This rig currently has none: work sessions
+    keep all ParVagues helpers off until an intentional bring-up.
     Reports, never restarts, the rest:
       * parvagues-sc     — restarting it is 15s of silence and a preload warm.
                            gig-up owns when that happens.

tools/rig_units.py

@@ -28,7 +28,7 @@ Two structural causes, both fixed here:
 
 BOOT POLICY, and why it is a per-unit field rather than a global
 ---------------------------------------------------------------
-  "login"     enabled at login where explicitly desired (MIDI lens).
+  "login"     enabled at login where explicitly desired.
   "on-demand" started by an intentional rig bring-up, not enabled at login.
               This includes SuperDirt AND its six background helpers. The owner
               does not perform every day; measured helper CPU is not zero.
@@ -92,12 +92,12 @@ SERVICES = [
     # Debt: its unit file still lives only in ~/.config/systemd/user (not
     # repo-owned like the others).
     ("perf-tray",              "perf tray",   None,      "on-demand",     "tray: what's up, perf mode, gear pause"),
-    # "login", not "manual": PLN asked for the lens to be permanently present
-    # ("now it should always oppen"), on top and on every desktop. On-top is a
+    # On-demand since 2026-10-02: work sessions should not open the MIDI lens.
+    # A rig bring-up still starts it. On-top is a
     # window flag midiviz already sets; all-desktops is a KWin rule keyed on its
     # app id (see the setDesktopFileName call in midiviz.py -- without it the app
     # id was "python3" and a rule would have matched every Python GUI).
-    ("midiviz",                "MIDI lens",   None,      "login",     "the surface, watched (glyph-rain + CC numbers)"),
+    ("midiviz",                "MIDI lens",   None,      "on-demand", "the surface, watched (glyph-rain + CC numbers)"),
     # Added 2026-09-25, and the absence is measured: the 2026-09-24 set lost
     # 17m44s off its head because REC was pressed at 18:27:41 and the set had
     # started at 18:09:57 — two whole tracks that exist in no recording. The
@@ -214,8 +214,8 @@ Wants=pipewire.service
 #
 # So a close is recorded, and it is recorded in $XDG_RUNTIME_DIR: that
 # directory is wiped at logout, which is exactly the lifetime this decision
-# should have. Closed for the rest of this session; back on at next login,
-# with no state to clean up and nothing to forget to undo.
+# should have. Closed for the rest of this session; back on at the next rig
+# bring-up after logout, with no state to clean up.
 def _latch_dir() -> Path:
     rt = os.environ.get("XDG_RUNTIME_DIR") or f"/run/user/{os.getuid()}"
     return Path(rt) / "parvagues"

tools/tests/test_check_stale_units.py

@@ -48,16 +48,16 @@ def test_a_garbled_timestamp_is_not_an_exception():
 
 
 def test_only_login_units_are_ever_auto_restarted():
-    """The three that must not cycle blind, and why, from rig_units' own table:
+    """On-demand units stay under explicit rig control, including midiviz.
+    The three that must not cycle blind, and why, from rig_units' own table:
     parvagues-sc is 15s of silence plus a preload warm, and the two painters
     Conflicts= each other — a blind restart with the classic board plugged kills
     the painter that was correctly lighting it."""
     import rig_units
     policies = {u: pol for u, _l, _p, pol, _w in rig_units.SERVICES}
-    for never in ("parvagues-sc", "lcxl3-driver", "lcxl-leds-watch"):
+    for never in ("parvagues-sc", "lcxl3-driver", "lcxl-leds-watch", "midiviz"):
         assert policies[never] not in CSU.SAFE_TO_RESTART, never
-    for always in ("midiviz", "gig-log", "parvagues-bridge"):
-        assert policies[always] in CSU.SAFE_TO_RESTART, always
+    assert all(policy != "login" for policy in policies.values())
 
 
 def test_exec_paths_reads_the_unit_not_the_units_name(tmp_path):