Use nix eval for cache path detection instead of --dry-run

Kernel and qt5webengine builds are memory-intensive. Limiting to
2 parallel jobs prevents swapping on john-endesktop.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -23,45 +23,85 @@ jobs:
     runs-on: ubuntu-latest
     needs: check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    strategy:
-      fail-fast: false
-      matrix:
-        machine:
-          - nix-book
-          - boxy
-          - zix790prors
-          - nix-deck
-          - john-endesktop
-          - live-usb
     steps:
       - uses: actions/checkout@v6
 
       - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
 
-      - name: Build ${{ matrix.machine }}
-        id: build
+      - name: Setup SSH for cache
         run: |
-          OUT_PATH=$(nix build .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel --no-link --print-out-paths)
-          echo "out_path=$OUT_PATH" >> "$GITHUB_OUTPUT"
-        env:
-          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
-
-      - name: Sign and push to cache
-        run: |
-          # Write signing key
-          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
-          chmod 600 /tmp/signing-key
-
-          # Sign the closure
-          nix store sign --key-file /tmp/signing-key -r "${{ steps.build.outputs.out_path }}"
-
-          # Setup SSH key for cache push
           mkdir -p ~/.ssh
           echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
           chmod 600 ~/.ssh/cache_key
           ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
 
-          # Push to cache
-          nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "${{ steps.build.outputs.out_path }}"
+      - name: Setup signing key
+        run: |
+          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
+          chmod 600 /tmp/signing-key
+
+      - name: Build, sign, and cache all packages
+        run: |
+          PACKAGES=(
+            custom-claude-code
+            custom-app-launcher-server
+            custom-mcrcon-rbw
+            custom-tea-rbw
+            custom-rclone-torbox-setup
+            custom-beads
+            custom-gastown
+            qt-pinned-jellyfin-media-player
+            qt-pinned-stremio
+            nix-deck-kernel
+          )
+
+          FAILED=()
+          SKIPPED=()
+          for pkg in "${PACKAGES[@]}"; do
+            echo "::group::Building $pkg"
+
+            # Check if package is already cached by evaluating its store path and checking the remote
+            OUT_PATH=$(nix eval ".#$pkg.outPath" --raw 2>/dev/null)
+            if [ -n "$OUT_PATH" ] && ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
+                "nix path-info '$OUT_PATH' >/dev/null 2>&1"; then
+              echo "⏭ $pkg already cached ($OUT_PATH), skipping"
+              SKIPPED+=("$pkg")
+              echo "::endgroup::"
+              continue
+            fi
+
+            # --cores 2 limits parallel jobs to reduce RAM pressure on john-endesktop
+            if BUILD_OUTPUT=$(nix build ".#$pkg" --no-link --print-out-paths --cores 2 2>&1); then
+              OUT_PATH=$(echo "$BUILD_OUTPUT" | grep '^/nix/store/' | tail -1)
+              echo "$BUILD_OUTPUT"
+              echo "Store path: $OUT_PATH"
+
+              # Sign the closure
+              nix store sign --key-file /tmp/signing-key -r "$OUT_PATH"
+
+              # Push to cache
+              nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "$OUT_PATH"
+
+              # Create GC root to prevent garbage collection
+              OUT_HASH=$(basename "$OUT_PATH" | cut -d'-' -f1)
+              ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
+                "mkdir -p /nix/var/nix/gcroots/ci-cache && ln -sfn $OUT_PATH /nix/var/nix/gcroots/ci-cache/${OUT_HASH}"
+
+              echo "✓ $pkg cached successfully"
+            else
+              echo "✗ $pkg failed to build"
+              FAILED+=("$pkg")
+            fi
+            echo "::endgroup::"
+          done
+
+          if [ ${#SKIPPED[@]} -gt 0 ]; then
+            echo "Skipped (already cached): ${SKIPPED[*]}"
+          fi
+
+          if [ ${#FAILED[@]} -gt 0 ]; then
+            echo "::error::Failed packages: ${FAILED[*]}"
+            exit 1
+          fi
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"

flake.lock

@@ -8,28 +8,27 @@
         ]
       },
       "locked": {
-        "lastModified": 1769840331,
-        "narHash": "sha256-Yp0K4JoXX8EcHp1juH4OZ7dcCmkopDu4VvAgZEOxgL8=",
+        "lastModified": 1770711800,
+        "narHash": "sha256-A7S9C5NBhrmf60wxEZiWTOn07eUPEk1d75LixLDedc0=",
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "93965b4abeed920a4701e03571d1b6bb75810722",
+        "rev": "6a51223b6fb59f97e699d5ac2f9a93967ca66f28",
         "type": "github"
       },
       "original": {
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "93965b4abeed920a4701e03571d1b6bb75810722",
         "type": "github"
       }
     },
     "doomemacs": {
       "flake": false,
       "locked": {
-        "lastModified": 1768984347,
-        "narHash": "sha256-VvC4rgAAaFnYLCdcUoz7dTE3kuBNuHIc+GlXOrPCxpg=",
+        "lastModified": 1770765473,
+        "narHash": "sha256-tEuhgaenYbeScYGV2gDivn468kHk+k6lndlxSPNYTes=",
         "owner": "doomemacs",
         "repo": "doomemacs",
-        "rev": "57818a6da90fbef39ff80d62fab2cd319496c3b9",
+        "rev": "a0d6aac43fc94def29c98826e2f0088bcb703d13",
         "type": "github"
       },
       "original": {
@@ -48,11 +47,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769848312,
-        "narHash": "sha256-ggBocPd1L4l5MFNV0Fw9aSGZZO4aGzCfgh4e6hQ77RE=",
+        "lastModified": 1770602774,
+        "narHash": "sha256-eRcZ279Oaf8ViHtvdWVTpcD9x7bvJ3ipQ1Xq9bd+qlk=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "be0b4f4f28f69be61e9174807250e3235ee11d50",
+        "rev": "a3d87c21d1464f1069d8125cafe6adb84d200185",
         "type": "github"
       },
       "original": {
@@ -82,11 +81,11 @@
     "gastown": {
       "flake": false,
       "locked": {
-        "lastModified": 1770098007,
-        "narHash": "sha256-CFlN57BXlR5FobTChdE2GgdIGx4xJcFFCk1E5Q98cSQ=",
+        "lastModified": 1770789619,
+        "narHash": "sha256-BDtohweSxBBLM+bAouzsK6tvAo5bZPUviK/ITMIyUag=",
         "owner": "steveyegge",
         "repo": "gastown",
-        "rev": "13461161063bf7b2365fe5fd4df88e32c3ba2a28",
+        "rev": "2779e30fd35c3482912b22e4be89258fe5510167",
         "type": "github"
       },
       "original": {
@@ -207,11 +206,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1769849328,
-        "narHash": "sha256-BjH1Ge6O8ObN6Z97un2U87pl4POO99Q8RSsgIuTZq8Q=",
+        "lastModified": 1770887282,
+        "narHash": "sha256-8vmh9ZSLEuXanLMeiuvAlJCKprBiEBW7N0SbUnMgpfM=",
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "fc1d7190c49558cdc6af20d7657075943a500a93",
+        "rev": "a9cdd935c314894dd03287b287cc21c6f8004c7f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -46,9 +46,7 @@
     };
 
     beads = {
-      # v0.49.1 has dolt server mode support (gt-1mf.3)
-      # Pinned to 259ddd92 - uses Go 1.24 compatible with nixpkgs
-      url = "github:steveyegge/beads/93965b4abeed920a4701e03571d1b6bb75810722";
+      url = "github:steveyegge/beads";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
 
@@ -82,7 +80,10 @@
       # Separate nixpkgs for qt5webengine-heavy packages to avoid rebuild churn
       qt-pinned = import inputs.nixpkgs-qt {
         system = prev.stdenv.hostPlatform.system;
-        config.allowUnfree = true;
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+        };
       };
       custom = prev.callPackage ./packages {};
       # Compatibility: bitwarden renamed to bitwarden-desktop in unstable
@@ -236,6 +237,47 @@
       ];
     };
 
+    # Packages for CI caching (custom packages, flake inputs, and qt-pinned)
+    packages = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
+          overlays = [ (mkBaseOverlay {}) ];
+        };
+        pkgsQt = import inputs.nixpkgs-qt {
+          inherit system;
+          config = {
+            allowUnfree = true;
+            permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+          };
+        };
+        # Version strings for flake input packages
+        beadsRev = builtins.substring 0 8 (inputs.beads.rev or "unknown");
+        gastownRev = builtins.substring 0 8 (inputs.gastown.rev or "unknown");
+      in {
+        "custom-claude-code" = pkgs.custom.claude-code;
+        "custom-app-launcher-server" = pkgs.custom.app-launcher-server;
+        "custom-mcrcon-rbw" = pkgs.custom.mcrcon-rbw;
+        "custom-tea-rbw" = pkgs.custom.tea-rbw;
+        "custom-rclone-torbox-setup" = pkgs.custom.rclone-torbox-setup;
+        "qt-pinned-jellyfin-media-player" = pkgsQt.jellyfin-media-player;
+        "qt-pinned-stremio" = pkgsQt.stremio;
+        # Flake input packages (beads, gastown) - these get version from input rev
+        "custom-beads" = pkgs.callPackage ./packages/beads {
+          src = inputs.beads;
+          version = "0.49.6-${beadsRev}";
+        };
+        "custom-gastown" = pkgs.callPackage ./packages/gastown {
+          src = inputs.gastown;
+          version = "unstable-${gastownRev}";
+        };
+      } // (if system == "x86_64-linux" then {
+        # nix-deck kernel from Jovian-NixOS (Steam Deck) - expensive to build
+        "nix-deck-kernel" = self.nixosConfigurations.nix-deck.config.boot.kernelPackages.kernel;
+      } else {})
+    );
+
     # Flake apps
     apps = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ] (system:
       let

home/roles/development/default.nix

@@ -8,15 +8,27 @@ let
   # Build beads from flake input with corrected vendorHash
   # The upstream default.nix has stale vendorHash for commits with server mode
   beadsRev = builtins.substring 0 8 (globalInputs.beads.rev or "unknown");
-  beadsPackage = pkgs.buildGoModule {
+
+  # nixpkgs ships Go 1.25.5, but beads' dolt deps require Go >= 1.25.6
+  go_1_25_6 = pkgs.go_1_25.overrideAttrs (old: rec {
+    version = "1.25.6";
+    src = pkgs.fetchurl {
+      url = "https://go.dev/dl/go${version}.src.tar.gz";
+      hash = "sha256-WMv3ceRNdt5vVtGeM7d9dFoeSJNAkih15GWFuXXCsFk=";
+    };
+  });
+  buildGoModule_1_25_6 = pkgs.buildGoModule.override { go = go_1_25_6; };
+
+  beadsPackage = buildGoModule_1_25_6 {
     pname = "beads";
-    version = "0.49.1-${beadsRev}";
+    version = "0.49.6-${beadsRev}";
     src = globalInputs.beads;
     subPackages = [ "cmd/bd" ];
     doCheck = false;
-    # Regenerated vendorHash for commit 93965b4a (has dolt server mode, Go 1.24)
-    vendorHash = "sha256-gwxGv8y4+1+k0741CnOYcyJPTJ5vTrynqPoO8YS9fbQ=";
-    nativeBuildInputs = [ pkgs.git ];
+    # Regenerated vendorHash for commit 6a51223b (dolt server mode, Go 1.25.6)
+    vendorHash = "sha256-9RMy0+ZBFg1BAl8Z0EuZK4XVm9QYVekS9i/1ErOIB/c=";
+    nativeBuildInputs = [ pkgs.git pkgs.pkg-config ];
+    buildInputs = [ pkgs.icu ];
     meta = with lib; {
       description = "beads (bd) - An issue tracker designed for AI-supervised coding workflows";
       homepage = "https://github.com/steveyegge/beads";
@@ -52,10 +64,7 @@ let
       ./gastown-fix-validate-recipient.patch
       # Fix agentBeadToAddress to use title field for hq- prefixed beads
       ./gastown-fix-agent-bead-address-title.patch
-      # Fix crew/polecat home paths: remove incorrect /rig suffix
-      ./gastown-fix-role-home-paths.patch
-      # Fix town root detection: don't map to Mayor (causes spurious mismatch warnings)
-      ./gastown-fix-town-root-detection.patch
+      # town-root-detection fix merged upstream (detectRole removed)
       # Statusline optimization: skip expensive beads queries for detached sessions
       # Reduces Dolt CPU from ~70% to ~20% by caching and early-exit
       ./gastown-statusline-optimization.patch

home/roles/emacs/doom/packages.el

@@ -51,6 +51,9 @@
 
 (package! org-caldav)
 
+;; Pin org-msg - upstream doom pin references a force-pushed commit
+(package! org-msg :pin "aa608b399586fb771ad37045a837f8286a0b6124")
+
 ;; Note: Packages with custom recipes must be pinned for nix-doom-emacs-unstraightened
 ;; to build deterministically. Update pins when upgrading packages.
 

machines/john-endesktop/configuration.nix

@@ -153,7 +153,7 @@ with lib;
   # Replaces the broken k8s deployment with native NixOS service
   services.harmonia = {
     enable = true;
-    signKeyPath = "/etc/harmonia/signing-key.private";
+    signKeyPaths = [ "/etc/harmonia/signing-key.private" ];
     settings = {
       bind = "[::]:5000";
     };

packages/beads/default.nix

@@ -0,0 +1,41 @@
+# Beads package - issue tracker for AI-supervised coding workflows
+# Takes src as argument so it can be called from both overlay and flake packages
+{ lib
+, stdenv
+, buildGoModule
+, fetchurl
+, go_1_25
+, git
+, pkg-config
+, icu
+, src
+, version ? "unknown"
+}:
+
+let
+  # nixpkgs ships Go 1.25.5, but beads' dolt deps require Go >= 1.25.6
+  go_1_25_6 = go_1_25.overrideAttrs (old: rec {
+    version = "1.25.6";
+    src = fetchurl {
+      url = "https://go.dev/dl/go${version}.src.tar.gz";
+      hash = "sha256-WMv3ceRNdt5vVtGeM7d9dFoeSJNAkih15GWFuXXCsFk=";
+    };
+  });
+  buildGoModule_1_25_6 = buildGoModule.override { go = go_1_25_6; };
+in
+buildGoModule_1_25_6 {
+  pname = "beads";
+  inherit version src;
+  subPackages = [ "cmd/bd" ];
+  doCheck = false;
+  # Regenerated vendorHash for commit 6a51223b (dolt server mode, Go 1.25.6)
+  vendorHash = "sha256-9RMy0+ZBFg1BAl8Z0EuZK4XVm9QYVekS9i/1ErOIB/c=";
+  nativeBuildInputs = [ git pkg-config ];
+  buildInputs = [ icu ];
+  meta = with lib; {
+    description = "beads (bd) - An issue tracker designed for AI-supervised coding workflows";
+    homepage = "https://github.com/steveyegge/beads";
+    license = licenses.mit;
+    mainProgram = "bd";
+  };
+}

packages/claude-code/default.nix

@@ -6,24 +6,24 @@
 }:
 
 let
-  version = "2.1.30";
+  version = "2.1.32";
 
   srcs = {
     aarch64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-arm64/claude";
-      sha256 = "3ccc14f322b1e8da0cd58afc254fd5100eee066fa14729f30745e67a3f7979f7";
+      sha256 = "841ac3051c04480a5651bc9f4ae27ab9d3963477250e71892e4d6e05778dd9d3";
     };
     x86_64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-x64/claude";
-      sha256 = "8a083696006483b8382ec0e47cd8f2e3223f3d2cab1a21c524fa08c082b5600e";
+      sha256 = "2b8a57be5640076e17d23e47e9288f2d1faee6564f4e311b5f7132bfde73fded";
     };
     x86_64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-x64/claude";
-      sha256 = "ada8f1cf9272965d38b10f1adb6cea885e621c83f7e7bb233008c721f43fad54";
+      sha256 = "96cd1ba796772481bd49bd67e3b8484565d1f3a99662565516c3bfe16d9afd4a";
     };
     aarch64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-arm64/claude";
-      sha256 = "45fbf35a1011b06f86170b20beb64c599db0658aac70e2de2410c45d15775596";
+      sha256 = "6f8390c0fde5b802ff777ab54225233f6159d76913adc3b8aea7c8774fa8fe70";
     };
   };
 

packages/gastown/default.nix

@@ -0,0 +1,38 @@
+# Gastown package - multi-agent workspace manager
+# Takes src as argument so it can be called from both overlay and flake packages
+{ lib
+, buildGoModule
+, src
+, version ? "unknown"
+}:
+
+buildGoModule {
+  pname = "gastown";
+  inherit version src;
+  vendorHash = "sha256-ripY9vrYgVW8bngAyMLh0LkU/Xx1UUaLgmAA7/EmWQU=";
+  subPackages = [ "cmd/gt" ];
+  doCheck = false;
+
+  # Must match ldflags from gastown Makefile - BuiltProperly=1 is required
+  # or gt will error with "This binary was built with 'go build' directly"
+  ldflags = [
+    "-X github.com/steveyegge/gastown/internal/cmd.Version=${version}"
+    "-X github.com/steveyegge/gastown/internal/cmd.Commit=${version}"
+    "-X github.com/steveyegge/gastown/internal/cmd.BuildTime=nix-build"
+    "-X github.com/steveyegge/gastown/internal/cmd.BuiltProperly=1"
+  ];
+
+  # Bug fixes not yet merged upstream
+  patches = [
+    ./gastown-fix-validate-recipient.patch
+    ./gastown-fix-agent-bead-address-title.patch
+    ./gastown-statusline-optimization.patch
+  ];
+
+  meta = with lib; {
+    description = "Gas Town - multi-agent workspace manager by Steve Yegge";
+    homepage = "https://github.com/steveyegge/gastown";
+    license = licenses.mit;
+    mainProgram = "gt";
+  };
+}

packages/gastown/gastown-fix-agent-bead-address-title.patch

@@ -0,0 +1,15 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -315,7 +315,10 @@ func agentBeadToAddress(bead *agentBead) string {
+ 		}
+
+ 		// For other hq- agents, fall back to description parsing
+-		return parseAgentAddressFromDescription(bead.Description)
++		if bead.Title != "" && strings.Contains(bead.Title, "/") {
++			return bead.Title
++		}
++		return parseAgentAddressFromDescription(bead.Description)
+ 	}
+
+ 	// Handle gt- prefixed IDs (legacy format)

packages/gastown/gastown-fix-validate-recipient.patch

@@ -0,0 +1,13 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+index b864c069..4b6a045b 100644
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -646,7 +646,7 @@ func (r *Router) validateRecipient(identity string) error {
+ 	}
+ 
+ 	for _, agent := range agents {
+-		if agentBeadToAddress(agent) == identity {
++		if AddressToIdentity(agentBeadToAddress(agent)) == AddressToIdentity(identity) {
+ 			return nil // Found matching agent
+ 		}
+ 	}

packages/gastown/gastown-statusline-optimization.patch

@@ -0,0 +1,135 @@
+diff --git a/internal/cmd/statusline.go b/internal/cmd/statusline.go
+index 2edf1be8..00253eea 100644
+--- a/internal/cmd/statusline.go
++++ b/internal/cmd/statusline.go
+@@ -6,6 +6,7 @@ import (
+ 	"path/filepath"
+ 	"sort"
+ 	"strings"
++	"time"
+ 
+ 	"github.com/spf13/cobra"
+ 	"github.com/steveyegge/gastown/internal/beads"
+@@ -14,6 +15,37 @@ import (
+ 	"github.com/steveyegge/gastown/internal/tmux"
+ 	"github.com/steveyegge/gastown/internal/workspace"
+ )
++// statusLineCacheTTL is how long cached status output remains valid.
++const statusLineCacheTTL = 10 * time.Second
++
++// statusLineCachePath returns the cache file path for a session.
++func statusLineCachePath(session string) string {
++	return filepath.Join(os.TempDir(), fmt.Sprintf("gt-status-%s", session))
++}
++
++// getStatusLineCache returns cached status if fresh, empty string otherwise.
++func getStatusLineCache(session string) string {
++	path := statusLineCachePath(session)
++	info, err := os.Stat(path)
++	if err != nil {
++		return ""
++	}
++	if time.Since(info.ModTime()) > statusLineCacheTTL {
++		return ""
++	}
++	data, err := os.ReadFile(path)
++	if err != nil {
++		return ""
++	}
++	return string(data)
++}
++
++// setStatusLineCache writes status to cache file.
++func setStatusLineCache(session, status string) {
++	path := statusLineCachePath(session)
++	_ = os.WriteFile(path, []byte(status), 0644)
++}
++
+ 
+ var (
+ 	statusLineSession string
+@@ -34,6 +66,19 @@ func init() {
+ func runStatusLine(cmd *cobra.Command, args []string) error {
+ 	t := tmux.NewTmux()
+ 
++	// Optimization: skip expensive beads queries for detached sessions
++	if statusLineSession != "" {
++		if !t.IsSessionAttached(statusLineSession) {
++			fmt.Print("○ |")
++			return nil
++		}
++		// Check cache for attached sessions too
++		if cached := getStatusLineCache(statusLineSession); cached != "" {
++			fmt.Print(cached)
++			return nil
++		}
++	}
++
+ 	// Get session environment
+ 	var rigName, polecat, crew, issue, role string
+ 
+@@ -150,7 +195,11 @@ func runWorkerStatusLine(t *tmux.Tmux, session, rigName, polecat, crew, issue st
+ 
+ 	// Output
+ 	if len(parts) > 0 {
+-		fmt.Print(strings.Join(parts, " | ") + " |")
++		output := strings.Join(parts, " | ") + " |"
++		if statusLineSession != "" {
++			setStatusLineCache(statusLineSession, output)
++		}
++		fmt.Print(output)
+ 	}
+ 
+ 	return nil
+@@ -389,7 +438,11 @@ func runMayorStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -458,7 +511,11 @@ func runDeaconStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -526,7 +583,11 @@ func runWitnessStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -617,7 +678,11 @@ func runRefineryStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 

roles/common.nix

@@ -23,10 +23,10 @@
         max-jobs = "auto";
         trusted-users = [ "johno" ];
         substituters = [
-          "https://nix-cache.johnogle.info"
+          "http://john-endesktop.oglehome:5000"
         ];
         trusted-public-keys = [
-          "nix-cache.johnogle.info-1:G0ZGQwcSC4+4SDDFHZI/ZX3a6uFrs/5cjA5Jvaypj0I="
+          "harmonia.john-endesktop:1iGr4xZrsR7WtXOlPCgFF3LcODYBpu+B3TS54MyBn4M="
         ];
         fallback = true;
         connect-timeout = 5;

roles/kodi/default.nix

@@ -77,14 +77,15 @@ in
       };
 
       environment.systemPackages = with pkgs; [
+        firefox
         jellyfinMediaPlayerPkg
         kodiPkg
+        qt-pinned.stremio
         wget
-        firefox
       ] ++ optional cfg.appLauncherServer.enable pkgs.custom.app-launcher-server;
 
       nixpkgs.config.permittedInsecurePackages = lib.warn
-        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player dependency. Remove this once jellyfin is updated to use qt6"
+        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player/stremio dependency. These are pinned to nixpkgs-qt to avoid rebuilds - update that input separately when you have time."
         [
           "qtwebengine-5.15.19"
         ];