pinentry fixees, exwm gated

.envrc

@@ -1 +1 @@
-use flake
+se flake

features/encryption/default.nix

@@ -36,6 +36,25 @@
           allow-loopback-pinentry
         '';
       };
+
+      # pinentry-emacs only attempts its Emacs-loopback socket when ITS OWN
+      # process env has INSIDE_EMACS set (see pinentry-emacs.c) -- and that
+      # process is gpg-agent's child, so it inherits gpg-agent's daemon env,
+      # not the env of whichever client (git, pass, ...) asked it to sign.
+      # Without this, any signing request from outside Emacs (e.g. a plain
+      # terminal, or an agent shelling out to git) always falls through to
+      # the curses pinentry, which fails outright when there's no real tty.
+      #
+      # Only safe to force on when Emacs is structurally guaranteed to be
+      # up and responsive -- i.e. under EXWM, where Emacs *is* the window
+      # manager. Elsewhere Emacs may not be running (fine: the loopback
+      # socket connect fails instantly, same fast fallback as today) or may
+      # be running but transiently busy (not fine: pinentry then blocks on
+      # the Assuan handshake for up to its 60s timeout before falling back,
+      # which is strictly worse than today's instant failure).
+      systemd.user.services.gpg-agent.Service.Environment =
+        lib.mkIf config.azos.suites.exwm.enable ["INSIDE_EMACS=1"];
+
       home.file.".ssh/config".source = ./ssh-config;
       home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub;
       home.file.".gnupg/sshcontrol".source = ./sshcontrol;