docs: Ask before running fmt

fmt reindents non-canonically-formatted files wholesale, burying logical
changes in whitespace churn. Note to match surrounding style by hand.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AGENTS.md

@@ -127,6 +127,9 @@ private keys) is required for editing secrets, deploying, and running dev VMs.
 ## Conventions
 
 - Format with `nixpkgs-fmt` (`fmt`). 2-space indent, `inherit (...)` blocks at the top of `let`.
+  **Ask before running `fmt`** — some files aren't canonically formatted, so `fmt` can reindent a
+  whole file and bury a logical change in whitespace churn. Match the surrounding style by hand and
+  leave formatting to the user unless they ask.
 - Prefer `lib.my` helpers (`mkOpt'`, `mkBoolOpt'`, `mkDefault'`) and `lib.my.c` constants over
   reimplementing.
 - New shared functionality → a module in `*/modules/` + entry in `_list.nix`, options under `my.*`.

nixos/boxes/home/palace/vms/river.nix

@@ -8,10 +8,16 @@
 
     configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
     let
-      inherit (lib) mkForce mkMerge;
+      inherit (lib) mkForce mkMerge mkIf;
       inherit (lib.my) networkdAssignment mkVLAN;
       inherit (lib.my.c) networkd;
       inherit (lib.my.c.home) vlans domain prefixes roceBootModules;
+
+      # Digiweb currently delivers the ISP VLAN (pon-isp, 10) single-tagged, so PPPoE runs on a
+      # VLAN 10 sitting directly on the physical WAN link. Flip this to true to nest it back
+      # inside the wan-pon (131) transport VLAN — double-stacking also needs QinQ (tag-stacking)
+      # on the switch feeding the ONT, or the BRAS never answers PADI.
+      wanStacked = false;
     in
     {
       imports = [
@@ -132,7 +138,7 @@
 
         systemd.network = {
           netdevs = mkMerge [
-            (mkVLAN "wan-vlan-outer" vlans.wan-pon)
+            (mkIf wanStacked (mkVLAN "wan-vlan-outer" vlans.wan-pon))
             (mkVLAN "wan-vlan-inner" vlans.pon-isp)
           ];
 
@@ -165,12 +171,13 @@
 
           networks = {
             "55-lan" = {
-              vlan = [ "wan-vlan-outer" ];
+              # outer transport VLAN when stacked, otherwise the ISP VLAN directly on lan
+              vlan = [ (if wanStacked then "wan-vlan-outer" else "wan-vlan-inner") ];
             };
             # So we don't drop the IP we use to connect to NVMe-oF!
             "60-lan-hi".networkConfig.KeepConfiguration = "static";
 
-            "70-wan-vlan-outer" = {
+            "70-wan-vlan-outer" = mkIf wanStacked {
               matchConfig.Name = "wan-vlan-outer";
               vlan = [ "wan-vlan-inner" ];
               networkConfig = networkd.noL3;
@@ -178,7 +185,8 @@
               # at this layer, so it needs 1512 (inner's 1508B payload + the inner 802.1Q tag)
               linkConfig.MTUBytes = "1512";
             };
-            # pppd attaches PPPoE to this; just needs to be up with no L3
+            # pppd attaches PPPoE to this; just needs to be up with no L3. Hangs off
+            # wan-vlan-outer when stacked, otherwise directly off lan (see "55-lan").
             "71-wan-vlan-inner" = {
               matchConfig.Name = "wan-vlan-inner";
               linkConfig = {