quickshell: keyring unlock needs --replace, bare --unlock is a no-op

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

settings/quickshell.nix

@@ -644,14 +644,24 @@ in
                 // auto_start unlocks from. So feed the daemon the password
                 // ourselves once PAM has accepted it.
                 //
-                // --unlock without --replace reaches the daemon already
+                // --replace is load-bearing, not decoration. gkd_control_unlock()
-                // running over its control socket; --replace would kill it and
+                // exists but is never called from gkd-main.c — only the
-                // drop the clients that connected first. No trailing newline:
+                // frob-control-* test binaries use it, and those aren't
-                // the daemon reads stdin to EOF and doesn't strip one.
+                // installed — so nothing on the CLI can unlock a daemon that is
+                // already running. --start would be the "talk to the running
+                // daemon" flag, but parse_arguments() explicitly rejects it
+                // next to --unlock. Bare --unlock therefore just tries to become
+                // a second daemon and dies on the already-taken control socket,
+                // which is precisely what it did here. So: take over from the
+                // daemon greetd's PAM started, and unlock on the way up.
+                //
+                // No trailing newline on the write — read_login_password() reads
+                // stdin to EOF and its own comment says "All data (including
+                // newlines) are part of the password".
                 Process {
                     id: keyringUnlock
                     property string secret: ""
-                    command: [ "${pkgs.gnome-keyring}/bin/gnome-keyring-daemon", "--unlock" ]
+                    command: [ "${pkgs.gnome-keyring}/bin/gnome-keyring-daemon", "--replace", "--unlock" ]
                     onStarted: {
                         write(secret);
                         secret = "";