Use nix eval for cache path detection instead of --dry-run

Kernel and qt5webengine builds are memory-intensive. Limiting to
2 parallel jobs prevents swapping on john-endesktop.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -18,3 +18,90 @@ jobs:
         run: nix flake check
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
+
+  build-and-cache:
+    runs-on: ubuntu-latest
+    needs: check
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
+
+      - name: Setup SSH for cache
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
+          chmod 600 ~/.ssh/cache_key
+          ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Setup signing key
+        run: |
+          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
+          chmod 600 /tmp/signing-key
+
+      - name: Build, sign, and cache all packages
+        run: |
+          PACKAGES=(
+            custom-claude-code
+            custom-app-launcher-server
+            custom-mcrcon-rbw
+            custom-tea-rbw
+            custom-rclone-torbox-setup
+            custom-beads
+            custom-gastown
+            qt-pinned-jellyfin-media-player
+            qt-pinned-stremio
+            nix-deck-kernel
+          )
+
+          FAILED=()
+          SKIPPED=()
+          for pkg in "${PACKAGES[@]}"; do
+            echo "::group::Building $pkg"
+
+            # Check if package is already cached by evaluating its store path and checking the remote
+            OUT_PATH=$(nix eval ".#$pkg.outPath" --raw 2>/dev/null)
+            if [ -n "$OUT_PATH" ] && ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
+                "nix path-info '$OUT_PATH' >/dev/null 2>&1"; then
+              echo "⏭ $pkg already cached ($OUT_PATH), skipping"
+              SKIPPED+=("$pkg")
+              echo "::endgroup::"
+              continue
+            fi
+
+            # --cores 2 limits parallel jobs to reduce RAM pressure on john-endesktop
+            if BUILD_OUTPUT=$(nix build ".#$pkg" --no-link --print-out-paths --cores 2 2>&1); then
+              OUT_PATH=$(echo "$BUILD_OUTPUT" | grep '^/nix/store/' | tail -1)
+              echo "$BUILD_OUTPUT"
+              echo "Store path: $OUT_PATH"
+
+              # Sign the closure
+              nix store sign --key-file /tmp/signing-key -r "$OUT_PATH"
+
+              # Push to cache
+              nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "$OUT_PATH"
+
+              # Create GC root to prevent garbage collection
+              OUT_HASH=$(basename "$OUT_PATH" | cut -d'-' -f1)
+              ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
+                "mkdir -p /nix/var/nix/gcroots/ci-cache && ln -sfn $OUT_PATH /nix/var/nix/gcroots/ci-cache/${OUT_HASH}"
+
+              echo "✓ $pkg cached successfully"
+            else
+              echo "✗ $pkg failed to build"
+              FAILED+=("$pkg")
+            fi
+            echo "::endgroup::"
+          done
+
+          if [ ${#SKIPPED[@]} -gt 0 ]; then
+            echo "Skipped (already cached): ${SKIPPED[*]}"
+          fi
+
+          if [ ${#FAILED[@]} -gt 0 ]; then
+            echo "::error::Failed packages: ${FAILED[*]}"
+            exit 1
+          fi
+        env:
+          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769405733,
-        "narHash": "sha256-WpROnW0dRi5ub0SlpKrMBs3pYlSBY4xw22hnTNvBMgI=",
+        "lastModified": 1770711800,
+        "narHash": "sha256-A7S9C5NBhrmf60wxEZiWTOn07eUPEk1d75LixLDedc0=",
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "6e82d1e2eea121ce5dc0964d554879f8b0c08563",
+        "rev": "6a51223b6fb59f97e699d5ac2f9a93967ca66f28",
         "type": "github"
       },
       "original": {
@@ -24,11 +24,11 @@
     "doomemacs": {
       "flake": false,
       "locked": {
-        "lastModified": 1768984347,
-        "narHash": "sha256-VvC4rgAAaFnYLCdcUoz7dTE3kuBNuHIc+GlXOrPCxpg=",
+        "lastModified": 1770765473,
+        "narHash": "sha256-tEuhgaenYbeScYGV2gDivn468kHk+k6lndlxSPNYTes=",
         "owner": "doomemacs",
         "repo": "doomemacs",
-        "rev": "57818a6da90fbef39ff80d62fab2cd319496c3b9",
+        "rev": "a0d6aac43fc94def29c98826e2f0088bcb703d13",
         "type": "github"
       },
       "original": {
@@ -47,11 +47,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1769848312,
-        "narHash": "sha256-ggBocPd1L4l5MFNV0Fw9aSGZZO4aGzCfgh4e6hQ77RE=",
+        "lastModified": 1770602774,
+        "narHash": "sha256-eRcZ279Oaf8ViHtvdWVTpcD9x7bvJ3ipQ1Xq9bd+qlk=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "be0b4f4f28f69be61e9174807250e3235ee11d50",
+        "rev": "a3d87c21d1464f1069d8125cafe6adb84d200185",
         "type": "github"
       },
       "original": {
@@ -81,11 +81,11 @@
     "gastown": {
       "flake": false,
       "locked": {
-        "lastModified": 1769538736,
-        "narHash": "sha256-A33gyS/ERUCFcaFG9PJdIHfIOafguqkRe+DuIZteH5s=",
+        "lastModified": 1770789619,
+        "narHash": "sha256-BDtohweSxBBLM+bAouzsK6tvAo5bZPUviK/ITMIyUag=",
         "owner": "steveyegge",
         "repo": "gastown",
-        "rev": "177094a2335786d1d450fd9e14b935877291c004",
+        "rev": "2779e30fd35c3482912b22e4be89258fe5510167",
         "type": "github"
       },
       "original": {
@@ -206,11 +206,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1769849328,
-        "narHash": "sha256-BjH1Ge6O8ObN6Z97un2U87pl4POO99Q8RSsgIuTZq8Q=",
+        "lastModified": 1770887282,
+        "narHash": "sha256-8vmh9ZSLEuXanLMeiuvAlJCKprBiEBW7N0SbUnMgpfM=",
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "fc1d7190c49558cdc6af20d7657075943a500a93",
+        "rev": "a9cdd935c314894dd03287b287cc21c6f8004c7f",
         "type": "github"
       },
       "original": {
@@ -257,6 +257,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-qt": {
+      "locked": {
+        "lastModified": 1770464364,
+        "narHash": "sha256-z5NJPSBwsLf/OfD8WTmh79tlSU8XgIbwmk6qB1/TFzY=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "23d72dabcb3b12469f57b37170fcbc1789bd7457",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs-unstable": {
       "locked": {
         "lastModified": 1769170682,
@@ -346,6 +362,7 @@
         "nix-darwin": "nix-darwin",
         "nix-doom-emacs-unstraightened": "nix-doom-emacs-unstraightened",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-qt": "nixpkgs-qt",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "perles": "perles",
         "plasma-manager": "plasma-manager",

flake.nix

@@ -4,6 +4,9 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    # Separate nixpkgs for qt5webengine-dependent packages (jellyfin-media-player, etc.)
+    # Updates on separate Renovate schedule to avoid massive qt rebuilds
+    nixpkgs-qt.url = "github:nixos/nixpkgs/nixos-25.11";
 
     nix-darwin = {
       url = "github:nix-darwin/nix-darwin/nix-darwin-25.11";
@@ -74,6 +77,14 @@
         config.allowUnfree = true;
         overlays = unstableOverlays;
       };
+      # Separate nixpkgs for qt5webengine-heavy packages to avoid rebuild churn
+      qt-pinned = import inputs.nixpkgs-qt {
+        system = prev.stdenv.hostPlatform.system;
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+        };
+      };
       custom = prev.callPackage ./packages {};
       # Compatibility: bitwarden renamed to bitwarden-desktop in unstable
       bitwarden-desktop = prev.bitwarden-desktop or prev.bitwarden;
@@ -226,6 +237,47 @@
       ];
     };
 
+    # Packages for CI caching (custom packages, flake inputs, and qt-pinned)
+    packages = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
+          overlays = [ (mkBaseOverlay {}) ];
+        };
+        pkgsQt = import inputs.nixpkgs-qt {
+          inherit system;
+          config = {
+            allowUnfree = true;
+            permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+          };
+        };
+        # Version strings for flake input packages
+        beadsRev = builtins.substring 0 8 (inputs.beads.rev or "unknown");
+        gastownRev = builtins.substring 0 8 (inputs.gastown.rev or "unknown");
+      in {
+        "custom-claude-code" = pkgs.custom.claude-code;
+        "custom-app-launcher-server" = pkgs.custom.app-launcher-server;
+        "custom-mcrcon-rbw" = pkgs.custom.mcrcon-rbw;
+        "custom-tea-rbw" = pkgs.custom.tea-rbw;
+        "custom-rclone-torbox-setup" = pkgs.custom.rclone-torbox-setup;
+        "qt-pinned-jellyfin-media-player" = pkgsQt.jellyfin-media-player;
+        "qt-pinned-stremio" = pkgsQt.stremio;
+        # Flake input packages (beads, gastown) - these get version from input rev
+        "custom-beads" = pkgs.callPackage ./packages/beads {
+          src = inputs.beads;
+          version = "0.49.6-${beadsRev}";
+        };
+        "custom-gastown" = pkgs.callPackage ./packages/gastown {
+          src = inputs.gastown;
+          version = "unstable-${gastownRev}";
+        };
+      } // (if system == "x86_64-linux" then {
+        # nix-deck kernel from Jovian-NixOS (Steam Deck) - expensive to build
+        "nix-deck-kernel" = self.nixosConfigurations.nix-deck.config.boot.kernelPackages.kernel;
+      } else {})
+    );
+
     # Flake apps
     apps = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ] (system:
       let

home/home-kodi.nix

@@ -12,6 +12,7 @@
   home.roles = {
     base.enable = true;
     plasma-manager-kodi.enable = true;
+    kdeconnect.enable = true;
   };
 
   home.packages = with pkgs; [

home/roles/development/default.nix

@@ -5,20 +5,37 @@ with lib;
 let
   cfg = config.home.roles.development;
 
-  # FIXME: Temporary override for upstream beads vendorHash mismatch
-  # Remove after upstream fix: https://github.com/steveyegge/beads/issues/XXX
-  beadsPackage = globalInputs.beads.packages.${system}.default.overrideAttrs (old: {
-    vendorHash = "sha256-YU+bRLVlWtHzJ1QPzcKJ70f+ynp8lMoIeFlm+29BNPE=";
+  # Build beads from flake input with corrected vendorHash
+  # The upstream default.nix has stale vendorHash for commits with server mode
+  beadsRev = builtins.substring 0 8 (globalInputs.beads.rev or "unknown");
 
-    # Performance fix: avoid WHERE IN (8000+ IDs) query pattern that hammers Dolt CPU
-    # See: hq-ihwsj - bd list uses inefficient WHERE IN (all_ids) query pattern
-    # The fix changes SearchIssues to SELECT all columns directly instead of:
-    #   1. SELECT id FROM issues WHERE ... -> collect IDs
-    #   2. SELECT * FROM issues WHERE id IN (all_ids) -> 8000+ placeholder IN clause
-    patches = (old.patches or []) ++ [
-      ./beads-search-query-optimization.patch
-    ];
+  # nixpkgs ships Go 1.25.5, but beads' dolt deps require Go >= 1.25.6
+  go_1_25_6 = pkgs.go_1_25.overrideAttrs (old: rec {
+    version = "1.25.6";
+    src = pkgs.fetchurl {
+      url = "https://go.dev/dl/go${version}.src.tar.gz";
+      hash = "sha256-WMv3ceRNdt5vVtGeM7d9dFoeSJNAkih15GWFuXXCsFk=";
+    };
   });
+  buildGoModule_1_25_6 = pkgs.buildGoModule.override { go = go_1_25_6; };
+
+  beadsPackage = buildGoModule_1_25_6 {
+    pname = "beads";
+    version = "0.49.6-${beadsRev}";
+    src = globalInputs.beads;
+    subPackages = [ "cmd/bd" ];
+    doCheck = false;
+    # Regenerated vendorHash for commit 6a51223b (dolt server mode, Go 1.25.6)
+    vendorHash = "sha256-9RMy0+ZBFg1BAl8Z0EuZK4XVm9QYVekS9i/1ErOIB/c=";
+    nativeBuildInputs = [ pkgs.git pkgs.pkg-config ];
+    buildInputs = [ pkgs.icu ];
+    meta = with lib; {
+      description = "beads (bd) - An issue tracker designed for AI-supervised coding workflows";
+      homepage = "https://github.com/steveyegge/beads";
+      license = licenses.mit;
+      mainProgram = "bd";
+    };
+  };
 
   # Gastown - multi-agent workspace manager (no upstream flake.nix yet)
   # Source is tracked via flake input for renovate updates
@@ -47,14 +64,7 @@ let
       ./gastown-fix-validate-recipient.patch
       # Fix agentBeadToAddress to use title field for hq- prefixed beads
       ./gastown-fix-agent-bead-address-title.patch
-      # Fix agentBeadToAddress to handle rig-specific prefixes (j-, sc-, etc.)
-      ./gastown-fix-agent-bead-rig-prefix.patch
-      # Fix crew/polecat home paths: remove incorrect /rig suffix
-      ./gastown-fix-role-home-paths.patch
-      # Fix town root detection: don't map to Mayor (causes spurious mismatch warnings)
-      ./gastown-fix-town-root-detection.patch
-      # Fix copyDir to handle symlinks (broken symlinks cause "no such file" errors)
-      ./gastown-fix-copydir-symlinks.patch
+      # town-root-detection fix merged upstream (detectRole removed)
       # Statusline optimization: skip expensive beads queries for detached sessions
       # Reduces Dolt CPU from ~70% to ~20% by caching and early-exit
       ./gastown-statusline-optimization.patch

home/roles/development/gastown-fix-agent-bead-address-title.patch

@@ -1,15 +1,15 @@
 diff --git a/internal/mail/router.go b/internal/mail/router.go
 --- a/internal/mail/router.go
 +++ b/internal/mail/router.go
-@@ -326,7 +326,10 @@ func agentBeadToAddress(bead *agentBead) string {
+@@ -315,7 +315,10 @@ func agentBeadToAddress(bead *agentBead) string {
  		}
- 
- 		// Fall back to parsing description for role_type and rig
+
+ 		// For other hq- agents, fall back to description parsing
 -		return parseAgentAddressFromDescription(bead.Description)
 +		if bead.Title != "" && strings.Contains(bead.Title, "/") {
 +			return bead.Title
 +		}
 +		return parseAgentAddressFromDescription(bead.Description)
  	}
- 
+
  	// Handle gt- prefixed IDs (legacy format)

home/roles/emacs/doom/packages.el

@@ -51,6 +51,9 @@
 
 (package! org-caldav)
 
+;; Pin org-msg - upstream doom pin references a force-pushed commit
+(package! org-msg :pin "aa608b399586fb771ad37045a837f8286a0b6124")
+
 ;; Note: Packages with custom recipes must be pinned for nix-doom-emacs-unstraightened
 ;; to build deterministically. Update pins when upgrading packages.
 

machines/john-endesktop/configuration.nix

@@ -54,6 +54,7 @@ with lib;
       4000  # nfs callback
       4001  # nlockmgr
       4002  # mountd
+      5000  # harmonia binary cache
       20048 # mountd
     ];
     allowedUDPPorts = [
@@ -148,6 +149,16 @@ with lib;
     };
   };
 
+  # Harmonia binary cache server
+  # Replaces the broken k8s deployment with native NixOS service
+  services.harmonia = {
+    enable = true;
+    signKeyPaths = [ "/etc/harmonia/signing-key.private" ];
+    settings = {
+      bind = "[::]:5000";
+    };
+  };
+
   # Time zone
   time.timeZone = "America/Los_Angeles"; # Adjust as needed
 

packages/beads/default.nix

@@ -0,0 +1,41 @@
+# Beads package - issue tracker for AI-supervised coding workflows
+# Takes src as argument so it can be called from both overlay and flake packages
+{ lib
+, stdenv
+, buildGoModule
+, fetchurl
+, go_1_25
+, git
+, pkg-config
+, icu
+, src
+, version ? "unknown"
+}:
+
+let
+  # nixpkgs ships Go 1.25.5, but beads' dolt deps require Go >= 1.25.6
+  go_1_25_6 = go_1_25.overrideAttrs (old: rec {
+    version = "1.25.6";
+    src = fetchurl {
+      url = "https://go.dev/dl/go${version}.src.tar.gz";
+      hash = "sha256-WMv3ceRNdt5vVtGeM7d9dFoeSJNAkih15GWFuXXCsFk=";
+    };
+  });
+  buildGoModule_1_25_6 = buildGoModule.override { go = go_1_25_6; };
+in
+buildGoModule_1_25_6 {
+  pname = "beads";
+  inherit version src;
+  subPackages = [ "cmd/bd" ];
+  doCheck = false;
+  # Regenerated vendorHash for commit 6a51223b (dolt server mode, Go 1.25.6)
+  vendorHash = "sha256-9RMy0+ZBFg1BAl8Z0EuZK4XVm9QYVekS9i/1ErOIB/c=";
+  nativeBuildInputs = [ git pkg-config ];
+  buildInputs = [ icu ];
+  meta = with lib; {
+    description = "beads (bd) - An issue tracker designed for AI-supervised coding workflows";
+    homepage = "https://github.com/steveyegge/beads";
+    license = licenses.mit;
+    mainProgram = "bd";
+  };
+}

packages/claude-code/default.nix

@@ -6,24 +6,24 @@
 }:
 
 let
-  version = "2.1.19";
+  version = "2.1.32";
 
   srcs = {
     aarch64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-arm64/claude";
-      sha256 = "d386ac8f6d1479f85d31f369421c824135c10249c32087017d05a5f428852c41";
+      sha256 = "841ac3051c04480a5651bc9f4ae27ab9d3963477250e71892e4d6e05778dd9d3";
     };
     x86_64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-x64/claude";
-      sha256 = "be266b3a952f483d8358ad141e2afe661170386506f479ead992319e4fdc38ac";
+      sha256 = "2b8a57be5640076e17d23e47e9288f2d1faee6564f4e311b5f7132bfde73fded";
     };
     x86_64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-x64/claude";
-      sha256 = "4e2a1c73871ecf3b133376b57ded03333a7a6387f2d2a3a6279bb90a07f7a944";
+      sha256 = "96cd1ba796772481bd49bd67e3b8484565d1f3a99662565516c3bfe16d9afd4a";
     };
     aarch64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-arm64/claude";
-      sha256 = "8c4b61b24ca760d6f7aa2f19727163d122e9fd0c3ce91f106a21b6918a7b1bbb";
+      sha256 = "6f8390c0fde5b802ff777ab54225233f6159d76913adc3b8aea7c8774fa8fe70";
     };
   };
 

packages/gastown/default.nix

@@ -0,0 +1,38 @@
+# Gastown package - multi-agent workspace manager
+# Takes src as argument so it can be called from both overlay and flake packages
+{ lib
+, buildGoModule
+, src
+, version ? "unknown"
+}:
+
+buildGoModule {
+  pname = "gastown";
+  inherit version src;
+  vendorHash = "sha256-ripY9vrYgVW8bngAyMLh0LkU/Xx1UUaLgmAA7/EmWQU=";
+  subPackages = [ "cmd/gt" ];
+  doCheck = false;
+
+  # Must match ldflags from gastown Makefile - BuiltProperly=1 is required
+  # or gt will error with "This binary was built with 'go build' directly"
+  ldflags = [
+    "-X github.com/steveyegge/gastown/internal/cmd.Version=${version}"
+    "-X github.com/steveyegge/gastown/internal/cmd.Commit=${version}"
+    "-X github.com/steveyegge/gastown/internal/cmd.BuildTime=nix-build"
+    "-X github.com/steveyegge/gastown/internal/cmd.BuiltProperly=1"
+  ];
+
+  # Bug fixes not yet merged upstream
+  patches = [
+    ./gastown-fix-validate-recipient.patch
+    ./gastown-fix-agent-bead-address-title.patch
+    ./gastown-statusline-optimization.patch
+  ];
+
+  meta = with lib; {
+    description = "Gas Town - multi-agent workspace manager by Steve Yegge";
+    homepage = "https://github.com/steveyegge/gastown";
+    license = licenses.mit;
+    mainProgram = "gt";
+  };
+}

packages/gastown/gastown-fix-agent-bead-address-title.patch

@@ -0,0 +1,15 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -315,7 +315,10 @@ func agentBeadToAddress(bead *agentBead) string {
+ 		}
+
+ 		// For other hq- agents, fall back to description parsing
+-		return parseAgentAddressFromDescription(bead.Description)
++		if bead.Title != "" && strings.Contains(bead.Title, "/") {
++			return bead.Title
++		}
++		return parseAgentAddressFromDescription(bead.Description)
+ 	}
+
+ 	// Handle gt- prefixed IDs (legacy format)

packages/gastown/gastown-fix-validate-recipient.patch

@@ -0,0 +1,13 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+index b864c069..4b6a045b 100644
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -646,7 +646,7 @@ func (r *Router) validateRecipient(identity string) error {
+ 	}
+ 
+ 	for _, agent := range agents {
+-		if agentBeadToAddress(agent) == identity {
++		if AddressToIdentity(agentBeadToAddress(agent)) == AddressToIdentity(identity) {
+ 			return nil // Found matching agent
+ 		}
+ 	}

packages/gastown/gastown-statusline-optimization.patch

@@ -0,0 +1,135 @@
+diff --git a/internal/cmd/statusline.go b/internal/cmd/statusline.go
+index 2edf1be8..00253eea 100644
+--- a/internal/cmd/statusline.go
++++ b/internal/cmd/statusline.go
+@@ -6,6 +6,7 @@ import (
+ 	"path/filepath"
+ 	"sort"
+ 	"strings"
++	"time"
+ 
+ 	"github.com/spf13/cobra"
+ 	"github.com/steveyegge/gastown/internal/beads"
+@@ -14,6 +15,37 @@ import (
+ 	"github.com/steveyegge/gastown/internal/tmux"
+ 	"github.com/steveyegge/gastown/internal/workspace"
+ )
++// statusLineCacheTTL is how long cached status output remains valid.
++const statusLineCacheTTL = 10 * time.Second
++
++// statusLineCachePath returns the cache file path for a session.
++func statusLineCachePath(session string) string {
++	return filepath.Join(os.TempDir(), fmt.Sprintf("gt-status-%s", session))
++}
++
++// getStatusLineCache returns cached status if fresh, empty string otherwise.
++func getStatusLineCache(session string) string {
++	path := statusLineCachePath(session)
++	info, err := os.Stat(path)
++	if err != nil {
++		return ""
++	}
++	if time.Since(info.ModTime()) > statusLineCacheTTL {
++		return ""
++	}
++	data, err := os.ReadFile(path)
++	if err != nil {
++		return ""
++	}
++	return string(data)
++}
++
++// setStatusLineCache writes status to cache file.
++func setStatusLineCache(session, status string) {
++	path := statusLineCachePath(session)
++	_ = os.WriteFile(path, []byte(status), 0644)
++}
++
+ 
+ var (
+ 	statusLineSession string
+@@ -34,6 +66,19 @@ func init() {
+ func runStatusLine(cmd *cobra.Command, args []string) error {
+ 	t := tmux.NewTmux()
+ 
++	// Optimization: skip expensive beads queries for detached sessions
++	if statusLineSession != "" {
++		if !t.IsSessionAttached(statusLineSession) {
++			fmt.Print("○ |")
++			return nil
++		}
++		// Check cache for attached sessions too
++		if cached := getStatusLineCache(statusLineSession); cached != "" {
++			fmt.Print(cached)
++			return nil
++		}
++	}
++
+ 	// Get session environment
+ 	var rigName, polecat, crew, issue, role string
+ 
+@@ -150,7 +195,11 @@ func runWorkerStatusLine(t *tmux.Tmux, session, rigName, polecat, crew, issue st
+ 
+ 	// Output
+ 	if len(parts) > 0 {
+-		fmt.Print(strings.Join(parts, " | ") + " |")
++		output := strings.Join(parts, " | ") + " |"
++		if statusLineSession != "" {
++			setStatusLineCache(statusLineSession, output)
++		}
++		fmt.Print(output)
+ 	}
+ 
+ 	return nil
+@@ -389,7 +438,11 @@ func runMayorStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -458,7 +511,11 @@ func runDeaconStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -526,7 +583,11 @@ func runWitnessStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -617,7 +678,11 @@ func runRefineryStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 

renovate.json

@@ -13,7 +13,7 @@
   "lockFileMaintenance": {
     "enabled": true,
     "schedule": [
-      "before 5am on monday"
+      "after 2pm and before 4pm on Saturday"
     ]
   },
   "dependencyDashboard": true,
@@ -37,6 +37,9 @@
         "/^nixpkgs$/",
         "/^home-manager$/",
         "/^nix-darwin$/"
+      ],
+      "schedule": [
+        "after 2pm and before 4pm on Saturday"
       ]
     },
     {
@@ -48,6 +51,21 @@
       "matchPackageNames": [
         "/nixpkgs-unstable/",
         "/home-manager-unstable/"
+      ],
+      "schedule": [
+        "after 2pm and before 4pm on Saturday"
+      ]
+    },
+    {
+      "description": "nixpkgs-qt updates on Saturday (staggered from main ecosystem)",
+      "matchManagers": [
+        "nix"
+      ],
+      "matchPackageNames": [
+        "/nixpkgs-qt/"
+      ],
+      "schedule": [
+        "after 4pm and before 6pm on Saturday"
       ]
     },
     {

roles/common.nix

@@ -23,7 +23,13 @@
         max-jobs = "auto";
         trusted-users = [ "johno" ];
         substituters = [
+          "http://john-endesktop.oglehome:5000"
         ];
+        trusted-public-keys = [
+          "harmonia.john-endesktop:1iGr4xZrsR7WtXOlPCgFF3LcODYBpu+B3TS54MyBn4M="
+        ];
+        fallback = true;
+        connect-timeout = 5;
       };
 
       gc = {

roles/kodi/default.nix

@@ -47,23 +47,23 @@ in
       if cfg.jellyfinScaleFactor != null
       then pkgs.symlinkJoin {
         name = "jellyfin-media-player-scaled";
-        paths = [ pkgs.jellyfin-media-player ];
+        paths = [ pkgs.qt-pinned.jellyfin-media-player ];
         nativeBuildInputs = [ pkgs.makeWrapper ];
         postBuild = ''
           mkdir -p $out/bin
           rm -f $out/bin/jellyfin-desktop
-          makeWrapper ${pkgs.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
+          makeWrapper ${pkgs.qt-pinned.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
             --add-flags "--tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
 
           # Update .desktop file to include scale factor and TV mode arguments
           mkdir -p $out/share/applications
           rm -f $out/share/applications/org.jellyfin.JellyfinDesktop.desktop
-          substitute ${pkgs.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
+          substitute ${pkgs.qt-pinned.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             $out/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             --replace-fail "Exec=jellyfin-desktop" "Exec=jellyfin-desktop --tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
         '';
       }
-      else pkgs.jellyfin-media-player;
+      else pkgs.qt-pinned.jellyfin-media-player;
   in mkIf cfg.enable
     {
       users.extraUsers.kodi = {
@@ -77,14 +77,15 @@ in
       };
 
       environment.systemPackages = with pkgs; [
+        firefox
         jellyfinMediaPlayerPkg
         kodiPkg
+        qt-pinned.stremio
         wget
-        firefox
       ] ++ optional cfg.appLauncherServer.enable pkgs.custom.app-launcher-server;
 
       nixpkgs.config.permittedInsecurePackages = lib.warn
-        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player dependency. Remove this once jellyfin is updated to use qt6"
+        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player/stremio dependency. These are pinned to nixpkgs-qt to avoid rebuilds - update that input separately when you have time."
         [
           "qtwebengine-5.15.19"
         ];