docs: add upstream tracking comments to plasma-bigscreen files

Flag the custom derivation and workarounds as temporary with TODO
markers and links to the relevant nixpkgs issue/PR. Makes it clear
what to remove once plasma-bigscreen lands in nixpkgs.

.beads/config.yaml

@@ -6,7 +6,7 @@
 # Issue prefix for this repository (used by bd init)
 # If not set, bd init will auto-detect from directory name
 # Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
-# issue-prefix: ""
+issue-prefix: "x"
 
 # Use no-db mode: load from JSONL, no SQLite, write back after each command
 # When true, bd will use .beads/issues.jsonl as the source of truth
@@ -59,4 +59,6 @@ sync-branch: "beads-sync"
 # - linear.url
 # - linear.api-key
 # - github.org
-# - github.repo
+# - github.repo
+
+routing.mode: "explicit"

.gitea/workflows/ci.yml

@@ -18,3 +18,90 @@ jobs:
         run: nix flake check
         env:
           NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"
+
+  build-and-cache:
+    runs-on: ubuntu-latest
+    needs: check
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: https://git.johnogle.info/johno/gitea-actions/nix-setup@v1
+
+      - name: Setup SSH for cache
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.CACHE_SSH_KEY }}" > ~/.ssh/cache_key
+          chmod 600 ~/.ssh/cache_key
+          ssh-keyscan -H ${{ secrets.CACHE_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
+
+      - name: Setup signing key
+        run: |
+          echo "${{ secrets.NIX_SIGNING_KEY }}" > /tmp/signing-key
+          chmod 600 /tmp/signing-key
+
+      - name: Build, sign, and cache all packages
+        run: |
+          PACKAGES=(
+            custom-claude-code
+            custom-app-launcher-server
+            custom-mcrcon-rbw
+            custom-tea-rbw
+            custom-rclone-torbox-setup
+            custom-beads
+            custom-gastown
+            qt-pinned-jellyfin-media-player
+            qt-pinned-stremio
+            nix-deck-kernel
+          )
+
+          FAILED=()
+          SKIPPED=()
+          for pkg in "${PACKAGES[@]}"; do
+            echo "::group::Building $pkg"
+
+            # Check if package is already cached by evaluating its store path and checking the remote
+            OUT_PATH=$(nix eval ".#$pkg.outPath" --raw 2>/dev/null)
+            if [ -n "$OUT_PATH" ] && ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
+                "nix path-info '$OUT_PATH' >/dev/null 2>&1"; then
+              echo "⏭ $pkg already cached ($OUT_PATH), skipping"
+              SKIPPED+=("$pkg")
+              echo "::endgroup::"
+              continue
+            fi
+
+            # --cores 2 limits parallel jobs to reduce RAM pressure on john-endesktop
+            if BUILD_OUTPUT=$(nix build ".#$pkg" --no-link --print-out-paths --cores 2 2>&1); then
+              OUT_PATH=$(echo "$BUILD_OUTPUT" | grep '^/nix/store/' | tail -1)
+              echo "$BUILD_OUTPUT"
+              echo "Store path: $OUT_PATH"
+
+              # Sign the closure
+              nix store sign --key-file /tmp/signing-key -r "$OUT_PATH"
+
+              # Push to cache
+              nix copy --to "ssh-ng://${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }}?ssh-key=$HOME/.ssh/cache_key" "$OUT_PATH"
+
+              # Create GC root to prevent garbage collection
+              OUT_HASH=$(basename "$OUT_PATH" | cut -d'-' -f1)
+              ssh -i ~/.ssh/cache_key ${{ secrets.CACHE_USER }}@${{ secrets.CACHE_HOST }} \
+                "mkdir -p /nix/var/nix/gcroots/ci-cache && ln -sfn $OUT_PATH /nix/var/nix/gcroots/ci-cache/${OUT_HASH}"
+
+              echo "✓ $pkg cached successfully"
+            else
+              echo "✗ $pkg failed to build"
+              FAILED+=("$pkg")
+            fi
+            echo "::endgroup::"
+          done
+
+          if [ ${#SKIPPED[@]} -gt 0 ]; then
+            echo "Skipped (already cached): ${SKIPPED[*]}"
+          fi
+
+          if [ ${#FAILED[@]} -gt 0 ]; then
+            echo "::error::Failed packages: ${FAILED[*]}"
+            exit 1
+          fi
+        env:
+          NIX_CONFIG: "access-tokens = git.johnogle.info=${{ secrets.GITEA_ACCESS_TOKEN }}"

.gitignore

@@ -1,3 +1,8 @@
 result
 thoughts
 .beads
+
+# Gas Town (added by gt)
+.runtime/
+.claude/
+.logs/

flake.lock

@@ -2,17 +2,16 @@
   "nodes": {
     "beads": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs-unstable"
         ]
       },
       "locked": {
-        "lastModified": 1769020852,
-        "narHash": "sha256-MR6evuoa8w6mjYTesTAa3bsRH+c3IB7EOEDTCjsiAp8=",
+        "lastModified": 1772587450,
+        "narHash": "sha256-yJ38xi6nRnEZIV5CEgV8xZK1dky0dVMavfFg4J7gkqw=",
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "cb46db603d34c0190605eecb8724a6c581119f09",
+        "rev": "7f41edd9c4350e5c68ebec6f9571e27833f27133",
         "type": "github"
       },
       "original": {
@@ -24,11 +23,11 @@
     "doomemacs": {
       "flake": false,
       "locked": {
-        "lastModified": 1767773143,
-        "narHash": "sha256-QL/t9v2kFNxBDyNJb/s411o3mxujan+QX5IZglTdpTk=",
+        "lastModified": 1772615218,
+        "narHash": "sha256-z+3c0AGkrMf1xZ+pq57aVp4Zo4KsqFMIjEVzSZinghc=",
         "owner": "doomemacs",
         "repo": "doomemacs",
-        "rev": "3e15fb36d7f94f0a218bda977be4d3f5da983a71",
+        "rev": "d23bbe87721c61f4d5a605f2914b32780bb89949",
         "type": "github"
       },
       "original": {
@@ -47,11 +46,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768011937,
-        "narHash": "sha256-SnU2XTo34vwVaijs+4VwcXTNwMWO4nwzzs08N39UagA=",
+        "lastModified": 1772706147,
+        "narHash": "sha256-C0UMYQg3KBU6+L8TLfQ/s60O6/Tiu/JpN8C/WiIH9DU=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "79abf71d9897cf3b5189f7175cda1b1102abc65c",
+        "rev": "54af2ae96631311dc4d2686a07e4f472fb36f516",
         "type": "github"
       },
       "original": {
@@ -79,19 +78,27 @@
       }
     },
     "gastown": {
-      "flake": false,
+      "inputs": {
+        "beads": [
+          "beads"
+        ],
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
       "locked": {
-        "lastModified": 1769031452,
-        "narHash": "sha256-tTvtLvTr38okqbpNnr5exfurI6VkVKNLcnM+A6O7DGY=",
-        "ref": "refs/heads/main",
-        "rev": "93e22595cd59802a24253b100dcfae98a6849428",
-        "revCount": 2938,
-        "type": "git",
-        "url": "ssh://git@git.johnogle.info:2222/johno/gastown.git"
+        "lastModified": 1772724442,
+        "narHash": "sha256-+H/T745sVDJAztpf3k6zz89YNrpCYsGghbO7O3O/IHw=",
+        "owner": "steveyegge",
+        "repo": "gastown",
+        "rev": "112ff2c4bd145de796d20f35d35e583832a72ce1",
+        "type": "github"
       },
       "original": {
-        "type": "git",
-        "url": "ssh://git@git.johnogle.info:2222/johno/gastown.git"
+        "owner": "steveyegge",
+        "repo": "gastown",
+        "type": "github"
       }
     },
     "google-cookie-retrieval": {
@@ -101,11 +108,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1761423376,
-        "narHash": "sha256-pMy3cnUFfue4vz/y0jx71BfcPGxZf+hk/DtnzWvfU0c=",
+        "lastModified": 1768846578,
+        "narHash": "sha256-82f/+e8HAwmBukiLlr7I3HYvM/2GCd5SOc+BC+qzsOQ=",
         "ref": "refs/heads/main",
-        "rev": "a1f695665771841a988afc965526cbf99160cd77",
-        "revCount": 11,
+        "rev": "c11ff9d3c67372a843a0fa6bf23132e986bd6955",
+        "revCount": 14,
         "type": "git",
         "url": "https://git.johnogle.info/johno/google-cookie-retrieval.git"
       },
@@ -121,11 +128,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767514898,
-        "narHash": "sha256-ONYqnKrPzfKEEPChoJ9qPcfvBqW9ZgieDKD7UezWPg4=",
+        "lastModified": 1772633058,
+        "narHash": "sha256-SO7JapRy2HPhgmqiLbfnW1kMx5rakPMKZ9z3wtRLQjI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7a06e8a2f844e128d3b210a000a62716b6040b7f",
+        "rev": "080657a04188aca25f8a6c70a0fb2ea7e37f1865",
         "type": "github"
       },
       "original": {
@@ -142,11 +149,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767556355,
-        "narHash": "sha256-RDTUBDQBi9D4eD9iJQWtUDN/13MDLX+KmE+TwwNUp2s=",
+        "lastModified": 1772633327,
+        "narHash": "sha256-jl+DJB2DUx7EbWLRng+6HNWW/1/VQOnf0NsQB4PlA7I=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f894bc4ffde179d178d8deb374fcf9855d1a82b7",
+        "rev": "5a75730e6f21ee624cbf86f4915c6e7489c74acc",
         "type": "github"
       },
       "original": {
@@ -164,11 +171,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767082077,
-        "narHash": "sha256-2tL1mRb9uFJThUNfuDm/ehrnPvImL/QDtCxfn71IEz4=",
+        "lastModified": 1772517207,
+        "narHash": "sha256-qxHfxqbigqBTn//U4leIS5he22Wp1GS0+zmwGV7Pozs=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "efd4b22e6fdc6d7fb4e186ae333a4b74e03da440",
+        "rev": "7ca1501c2d80900b5967baea4d42581f84b388dd",
         "type": "github"
       },
       "original": {
@@ -184,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765066094,
-        "narHash": "sha256-0YSU35gfRFJzx/lTGgOt6ubP8K6LeW0vaywzNNqxkl4=",
+        "lastModified": 1772129556,
+        "narHash": "sha256-Utk0zd8STPsUJPyjabhzPc5BpPodLTXrwkpXBHYnpeg=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "688427b1aab9afb478ca07989dc754fa543e03d5",
+        "rev": "ebec37af18215214173c98cf6356d0aca24a2585",
         "type": "github"
       },
       "original": {
@@ -206,11 +213,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1768034604,
-        "narHash": "sha256-62pIZMvGHhYJmMiiBsxHqZt/dFyENPcFHlJq5NJF3Sw=",
+        "lastModified": 1772716420,
+        "narHash": "sha256-T3UEKNTGqBl44AQ0+0OIpiWMXeQ8+4QW/akSc4yeL2A=",
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "9b3b8044fe4ccdcbb2d6f733d7dbe4d5feea18bc",
+        "rev": "be3ecb81a85be302e27d46ff32a1e251e444327d",
         "type": "github"
       },
       "original": {
@@ -243,11 +250,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1767480499,
-        "narHash": "sha256-8IQQUorUGiSmFaPnLSo2+T+rjHtiNWc+OAzeHck7N48=",
+        "lastModified": 1772598333,
+        "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "30a3c519afcf3f99e2c6df3b359aec5692054d92",
+        "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-qt": {
+      "locked": {
+        "lastModified": 1772598333,
+        "narHash": "sha256-YaHht/C35INEX3DeJQNWjNaTcPjYmBwwjFJ2jdtr+5U=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "fabb8c9deee281e50b1065002c9828f2cf7b2239",
         "type": "github"
       },
       "original": {
@@ -259,11 +282,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1767379071,
-        "narHash": "sha256-EgE0pxsrW9jp9YFMkHL9JMXxcqi/OoumPJYwf+Okucw=",
+        "lastModified": 1772624091,
+        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "fb7944c166a3b630f177938e478f0378e64ce108",
+        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
         "type": "github"
       },
       "original": {
@@ -273,6 +296,22 @@
         "type": "github"
       }
     },
+    "perles": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1772661365,
+        "narHash": "sha256-kMlvIpfGMBkN5D1W0O1fcqUiH3dyobcH0GRRLCX7GGo=",
+        "owner": "zjrosen",
+        "repo": "perles",
+        "rev": "326ff1938dfe073daab7939762ce2f44c2ee74a1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zjrosen",
+        "repo": "perles",
+        "type": "github"
+      }
+    },
     "plasma-manager": {
       "inputs": {
         "home-manager": [
@@ -283,11 +322,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763909441,
-        "narHash": "sha256-56LwV51TX/FhgX+5LCG6akQ5KrOWuKgcJa+eUsRMxsc=",
+        "lastModified": 1772361940,
+        "narHash": "sha256-B1Cz+ydL1iaOnGlwOFld/C8lBECPtzhiy/pP93/CuyY=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "b24ed4b272256dfc1cc2291f89a9821d5f9e14b4",
+        "rev": "a4b33606111c9c5dcd10009042bb710307174f51",
         "type": "github"
       },
       "original": {
@@ -306,11 +345,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1763909441,
-        "narHash": "sha256-56LwV51TX/FhgX+5LCG6akQ5KrOWuKgcJa+eUsRMxsc=",
+        "lastModified": 1772361940,
+        "narHash": "sha256-B1Cz+ydL1iaOnGlwOFld/C8lBECPtzhiy/pP93/CuyY=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "b24ed4b272256dfc1cc2291f89a9821d5f9e14b4",
+        "rev": "a4b33606111c9c5dcd10009042bb710307174f51",
         "type": "github"
       },
       "original": {
@@ -330,7 +369,9 @@
         "nix-darwin": "nix-darwin",
         "nix-doom-emacs-unstraightened": "nix-doom-emacs-unstraightened",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-qt": "nixpkgs-qt",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "perles": "perles",
         "plasma-manager": "plasma-manager",
         "plasma-manager-unstable": "plasma-manager-unstable"
       }

flake.nix

@@ -4,6 +4,9 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    # Separate nixpkgs for qt5webengine-dependent packages (jellyfin-media-player, etc.)
+    # Updates on separate Renovate schedule to avoid massive qt rebuilds
+    nixpkgs-qt.url = "github:nixos/nixpkgs/nixos-25.11";
 
     nix-darwin = {
       url = "github:nix-darwin/nix-darwin/nix-darwin-25.11";
@@ -48,7 +51,13 @@
     };
 
     gastown = {
-      url = "git+ssh://git@git.johnogle.info:2222/johno/gastown.git";
+      url = "github:steveyegge/gastown";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.beads.follows = "beads";
+    };
+
+    perles = {
+      url = "github:zjrosen/perles";
       flake = false;  # No flake.nix upstream yet
     };
 
@@ -69,6 +78,14 @@
         config.allowUnfree = true;
         overlays = unstableOverlays;
       };
+      # Separate nixpkgs for qt5webengine-heavy packages to avoid rebuild churn
+      qt-pinned = import inputs.nixpkgs-qt {
+        system = prev.stdenv.hostPlatform.system;
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+        };
+      };
       custom = prev.callPackage ./packages {};
       # Compatibility: bitwarden renamed to bitwarden-desktop in unstable
       bitwarden-desktop = prev.bitwarden-desktop or prev.bitwarden;
@@ -155,6 +172,7 @@
         ./machines/boxy/configuration.nix
         {
           home-manager.users.johno = import ./home/home-media-center.nix;
+          # kodi user: AVR volume control + minimal Plasma config for Bigscreen session
           home-manager.users.kodi = import ./home/home-kodi.nix;
           home-manager.extraSpecialArgs = { inherit system; };
         }
@@ -166,7 +184,16 @@
       modules = nixosModules ++ [
         ./machines/zix790prors/configuration.nix
         {
-          home-manager.users.johno = import ./home/home-desktop.nix;
+          home-manager.users.johno = {
+            imports = [ ./home/home-desktop.nix ];
+            home.roles.i3_sway.extraSwayConfig = {
+              output = {
+                "DP-1" = {
+                  mode = "3440x1440@164.900Hz";
+                };
+              };
+            };
+          };
           home-manager.extraSpecialArgs = { inherit system; };
         }
       ];
@@ -210,7 +237,7 @@
     };
 
     # Darwin/macOS configurations
-    darwinConfigurations."blkfv4yf49kt7" = inputs.nix-darwin.lib.darwinSystem rec {
+    darwinConfigurations."BLKFV4YF49KT7" = inputs.nix-darwin.lib.darwinSystem rec {
       system = "aarch64-darwin";
       modules = darwinModules ++ [
         ./machines/johno-macbookpro/configuration.nix
@@ -221,6 +248,48 @@
       ];
     };
 
+    # Packages for CI caching (custom packages, flake inputs, and qt-pinned)
+    packages = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
+          overlays = [ (mkBaseOverlay {}) ];
+        };
+        pkgsQt = import inputs.nixpkgs-qt {
+          inherit system;
+          config = {
+            allowUnfree = true;
+            permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+          };
+        };
+        # Version strings for flake input packages
+        beadsRev = builtins.substring 0 8 (inputs.beads.rev or "unknown");
+        gastownRev = builtins.substring 0 8 (inputs.gastown.rev or "unknown");
+      in {
+        "custom-claude-code" = pkgs.custom.claude-code;
+        "custom-app-launcher-server" = pkgs.custom.app-launcher-server;
+        "custom-mcrcon-rbw" = pkgs.custom.mcrcon-rbw;
+        "custom-tea-rbw" = pkgs.custom.tea-rbw;
+        "custom-rclone-torbox-setup" = pkgs.custom.rclone-torbox-setup;
+        "qt-pinned-jellyfin-media-player" = pkgsQt.jellyfin-media-player;
+        "qt-pinned-stremio" = pkgsQt.stremio;
+        # Flake input packages (beads, gastown) - these get version from input rev
+        "custom-beads" = pkgs.callPackage ./packages/beads {
+          inherit (pkgs.unstable) buildGoModule;
+          src = inputs.beads;
+          version = "0.52.0-${beadsRev}";
+        };
+        "custom-gastown" = pkgs.callPackage ./packages/gastown {
+          src = inputs.gastown;
+          version = "unstable-${gastownRev}";
+        };
+      } // (if system == "x86_64-linux" then {
+        # nix-deck kernel from Jovian-NixOS (Steam Deck) - expensive to build
+        "nix-deck-kernel" = self.nixosConfigurations.nix-deck.config.boot.kernelPackages.kernel;
+      } else {})
+    );
+
     # Flake apps
     apps = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ] (system:
       let

home/home-darwin-work.nix

@@ -107,7 +107,7 @@
     aerospace = {
       enable = true;
       leader = "cmd";
-      ctrlShortcuts.enable = true;
+      ctrlShortcuts.enable = false;
       sketchybar.enable = true;
       # Optional: Add per-machine userSettings overrides
       # userSettings = {

home/home-kodi.nix

@@ -12,6 +12,7 @@
   home.roles = {
     base.enable = true;
     plasma-manager-kodi.enable = true;
+    kdeconnect.enable = true;
   };
 
   home.packages = with pkgs; [

home/roles/aerospace/default.nix

@@ -632,7 +632,9 @@ in
       text = ''
         #!/bin/bash
 
-        DISK_USAGE=$(df -H / | grep -v Filesystem | awk '{print $5}')
+        # Monitor /System/Volumes/Data which contains user data on APFS
+        # The root / is a read-only snapshot with minimal usage
+        DISK_USAGE=$(df -H /System/Volumes/Data | grep -v Filesystem | awk '{print $5}')
 
         ${pkgs.sketchybar}/bin/sketchybar --set $NAME label="$DISK_USAGE"
       '';

home/roles/base/default.nix

@@ -22,6 +22,7 @@ in
       shellcheck
       tmux
       tree
+      watch
     ];
 
     # Automatic garbage collection for user profile (home-manager generations).

home/roles/development/beads-search-query-optimization.patch

@@ -0,0 +1,44 @@
+diff --git a/internal/storage/dolt/queries.go b/internal/storage/dolt/queries.go
+index 7d8214ee..8acdaae2 100644
+--- a/internal/storage/dolt/queries.go
++++ b/internal/storage/dolt/queries.go
+@@ -212,8 +212,21 @@ func (s *DoltStore) SearchIssues(ctx context.Context, query string, filter types
+ 	}
+ 
+ 	// nolint:gosec // G201: whereSQL contains column comparisons with ?, limitSQL is a safe integer
++	// Performance fix: SELECT all columns directly instead of id-only + WHERE IN (all_ids)
++	// See: hq-ihwsj - bd list uses inefficient WHERE IN (all_ids) query pattern
+ 	querySQL := fmt.Sprintf(`
+-		SELECT id FROM issues
++		SELECT id, content_hash, title, description, design, acceptance_criteria, notes,
++		       status, priority, issue_type, assignee, estimated_minutes,
++		       created_at, created_by, owner, updated_at, closed_at, external_ref,
++		       compaction_level, compacted_at, compacted_at_commit, original_size, source_repo, close_reason,
++		       deleted_at, deleted_by, delete_reason, original_type,
++		       sender, ephemeral, pinned, is_template, crystallizes,
++		       await_type, await_id, timeout_ns, waiters,
++		       hook_bead, role_bead, agent_state, last_activity, role_type, rig, mol_type,
++		       event_kind, actor, target, payload,
++		       due_at, defer_until,
++		       quality_score, work_type, source_system
++		FROM issues
+ 		%s
+ 		ORDER BY priority ASC, created_at DESC
+ 		%s
+@@ -225,7 +238,15 @@ func (s *DoltStore) SearchIssues(ctx context.Context, query string, filter types
+ 	}
+ 	defer rows.Close()
+ 
+-	return s.scanIssueIDs(ctx, rows)
++	var issues []*types.Issue
++	for rows.Next() {
++		issue, err := scanIssueRow(rows)
++		if err != nil {
++			return nil, err
++		}
++		issues = append(issues, issue)
++	}
++	return issues, rows.Err()
+ }
+ 
+ // GetReadyWork returns issues that are ready to work on (not blocked)

home/roles/development/default.nix

@@ -5,21 +5,59 @@ with lib;
 let
   cfg = config.home.roles.development;
 
-  # FIXME: Temporary override for upstream beads vendorHash mismatch
-  # Remove after upstream fix: https://github.com/steveyegge/beads/issues/XXX
-  beadsPackage = globalInputs.beads.packages.${system}.default.overrideAttrs (old: {
-    vendorHash = "sha256-YU+bRLVlWtHzJ1QPzcKJ70f+ynp8lMoIeFlm+29BNPE=";
-  });
+  # Build beads from flake input
+  beadsRev = builtins.substring 0 8 (globalInputs.beads.rev or "unknown");
 
-  # Gastown - multi-agent workspace manager (no upstream flake.nix yet)
+  beadsPackage = pkgs.unstable.buildGoModule {
+    pname = "beads";
+    version = "0.52.0-${beadsRev}";
+    src = globalInputs.beads;
+    subPackages = [ "cmd/bd" ];
+    doCheck = false;
+    vendorHash = "sha256-OL6QGf4xSMpEbmU+41pFdO0Rrs3H162T3pdiW9UfWR0=";
+    nativeBuildInputs = [ pkgs.git pkgs.pkg-config ];
+    buildInputs = [ pkgs.icu ];
+    meta = with lib; {
+      description = "beads (bd) - An issue tracker designed for AI-supervised coding workflows";
+      homepage = "https://github.com/steveyegge/beads";
+      license = licenses.mit;
+      mainProgram = "bd";
+    };
+  };
+
+  # Gastown - multi-agent workspace manager
   # Source is tracked via flake input for renovate updates
+  gastownRev = builtins.substring 0 8 (globalInputs.gastown.rev or "unknown");
   gastownPackage = pkgs.buildGoModule {
     pname = "gastown";
-    version = "unstable-${builtins.substring 0 8 globalInputs.gastown.rev or "unknown"}";
+    version = "unstable-${gastownRev}";
     src = globalInputs.gastown;
-    vendorHash = "sha256-ripY9vrYgVW8bngAyMLh0LkU/Xx1UUaLgmAA7/EmWQU=";
+    vendorHash = "sha256-/+ODyndArUF0nJY9r8G5JKhzQckBHFb48A7EBZmoIr0=";
     subPackages = [ "cmd/gt" ];
     doCheck = false;
+
+    # Must match ldflags from gastown Makefile - BuiltProperly=1 is required
+    # or gt will error with "This binary was built with 'go build' directly"
+    ldflags = [
+      "-X github.com/steveyegge/gastown/internal/cmd.Version=${gastownRev}"
+      "-X github.com/steveyegge/gastown/internal/cmd.Commit=${gastownRev}"
+      "-X github.com/steveyegge/gastown/internal/cmd.BuildTime=nix-build"
+      "-X github.com/steveyegge/gastown/internal/cmd.BuiltProperly=1"
+    ];
+
+    # Bug fixes not yet merged upstream
+    # Each patch is stored in a separate file for clarity and maintainability
+    patches = [
+      # Fix validateRecipient bug: normalize addresses before comparison
+      ./gastown-fix-validate-recipient.patch
+      # Fix agentBeadToAddress to use title field for hq- prefixed beads
+      ./gastown-fix-agent-bead-address-title.patch
+      # town-root-detection fix merged upstream (detectRole removed)
+      # Statusline optimization: skip expensive beads queries for detached sessions
+      # Reduces Dolt CPU from ~70% to ~20% by caching and early-exit
+      ./gastown-statusline-optimization.patch
+    ];
+
     meta = with lib; {
       description = "Gas Town - multi-agent workspace manager by Steve Yegge";
       homepage = "https://github.com/steveyegge/gastown";
@@ -28,6 +66,28 @@ let
     };
   };
 
+  # Perles - TUI for beads issue tracking (no upstream flake.nix yet)
+  # Source is tracked via flake input for renovate updates
+  perlesRev = builtins.substring 0 8 (globalInputs.perles.rev or "unknown");
+  perlesPackage = pkgs.unstable.buildGoModule {
+    pname = "perles";
+    version = "unstable-${perlesRev}";
+    src = globalInputs.perles;
+    vendorHash = "sha256-A5LE9Cor/DRcJtVpiScSoqDYhJIKyaq0cbK+OGmr4XU=";
+    doCheck = false;
+
+    ldflags = [
+      "-X main.version=${perlesRev}"
+    ];
+
+    meta = with lib; {
+      description = "Perles - Terminal UI for beads issue tracking";
+      homepage = "https://github.com/zjrosen/perles";
+      license = licenses.mit;
+      mainProgram = "perles";
+    };
+  };
+
   # Fetch the claude-plugins repository (for humanlayer commands/agents)
   # Update the rev to get newer versions of the commands
   claudePluginsRepo = builtins.fetchGit {
@@ -38,6 +98,12 @@ let
     ref = "main";
   };
 
+  # Claude Code statusline: shows model, cwd, git branch, and context usage %
+  claudeCodeStatusLineConfig = pkgs.writeText "claude-statusline.json" (builtins.toJSON {
+    type = "command";
+    command = ''input=$(cat); model=$(echo "$input" | jq -r '.model.display_name'); cwd=$(echo "$input" | jq -r '.workspace.current_dir'); if git -C "$cwd" rev-parse --git-dir > /dev/null 2>&1; then branch=$(git -C "$cwd" --no-optional-locks rev-parse --abbrev-ref HEAD 2>/dev/null || echo ""); if [ -n "$branch" ]; then git_info=" on $branch"; else git_info=""; fi; else git_info=""; fi; usage=$(echo "$input" | jq '.context_window.current_usage'); if [ "$usage" != "null" ]; then current=$(echo "$usage" | jq '.input_tokens + .cache_creation_input_tokens + .cache_read_input_tokens'); size=$(echo "$input" | jq '.context_window.context_window_size'); pct=$((current * 100 / size)); context_info=" | ''${pct}% context"; else context_info=""; fi; printf "%s in %s%s%s" "$model" "$cwd" "$git_info" "$context_info"'';
+  });
+
 in
 {
   options.home.roles.development = {
@@ -62,13 +128,16 @@ in
     home.packages = [
       beadsPackage
       gastownPackage
+      perlesPackage
       pkgs.unstable.claude-code
       pkgs.unstable.claude-code-router
       pkgs.unstable.codex
+      pkgs.dolt
       pkgs.sqlite
 
       # Custom packages
       pkgs.custom.tea-rbw
+      pkgs.custom.pi-coding-agent
     ];
 
     # Install Claude Code humanlayer command and agent plugins
@@ -86,12 +155,14 @@ in
         if [ -f "$file" ]; then
           filename=$(basename "$file" .md)
           dest="$HOME/.claude/commands/humanlayer:''${filename}.md"
+          rm -f "$dest" 2>/dev/null || true
 
           # Copy file and conditionally remove the "model:" line from frontmatter
           ${if cfg.allowArbitraryClaudeCodeModelSelection
             then "cp \"$file\" \"$dest\""
             else "${pkgs.gnused}/bin/sed '/^model:/d' \"$file\" > \"$dest\""
           }
+          chmod u+w "$dest" 2>/dev/null || true
         fi
       done
 
@@ -100,12 +171,14 @@ in
         if [ -f "$file" ]; then
           filename=$(basename "$file" .md)
           dest="$HOME/.claude/agents/humanlayer:''${filename}.md"
+          rm -f "$dest" 2>/dev/null || true
 
           # Copy file and conditionally remove the "model:" line from frontmatter
           ${if cfg.allowArbitraryClaudeCodeModelSelection
             then "cp \"$file\" \"$dest\""
             else "${pkgs.gnused}/bin/sed '/^model:/d' \"$file\" > \"$dest\""
           }
+          chmod u+w "$dest" 2>/dev/null || true
         fi
       done
 
@@ -120,6 +193,7 @@ in
             sleep 0.5
             cp "$file" "$dest" || echo "Warning: Failed to copy $filename.md to commands"
           fi
+          chmod u+w "$dest" 2>/dev/null || true
         fi
       done
 
@@ -134,13 +208,17 @@ in
             sleep 0.5
             cp "$file" "$dest" || echo "Warning: Failed to copy $filename.md to skills"
           fi
+          chmod u+w "$dest" 2>/dev/null || true
         fi
       done
 
       # Copy micro-skills (compact reusable knowledge referenced by formulas)
       for file in ${./skills/micro}/*.md; do
         if [ -f "$file" ]; then
-          cp "$file" "$HOME/.claude/commands/skills/$(basename "$file")"
+          dest="$HOME/.claude/commands/skills/$(basename "$file")"
+          rm -f "$dest" 2>/dev/null || true
+          cp "$file" "$dest"
+          chmod u+w "$dest" 2>/dev/null || true
         fi
       done
 
@@ -148,7 +226,10 @@ in
       mkdir -p ~/.beads/formulas
       for file in ${./formulas}/*.formula.toml; do
         if [ -f "$file" ]; then
-          cp "$file" "$HOME/.beads/formulas/$(basename "$file")"
+          dest="$HOME/.beads/formulas/$(basename "$file")"
+          rm -f "$dest" 2>/dev/null || true
+          cp "$file" "$dest"
+          chmod u+w "$dest" 2>/dev/null || true
         fi
       done
 
@@ -165,6 +246,18 @@ in
       $DRY_RUN_CMD echo "Claude Code beads integration configured (hooks installed)"
     '';
 
+    # Configure Claude Code statusline (merge into existing settings.json)
+    home.activation.claudeCodeStatusLine = lib.hm.dag.entryAfter ["writeBoundary" "claudeCodeBeadsSetup"] ''
+      SETTINGS="$HOME/.claude/settings.json"
+      mkdir -p "$HOME/.claude"
+      if [ -f "$SETTINGS" ]; then
+        ${pkgs.jq}/bin/jq --slurpfile sl ${claudeCodeStatusLineConfig} '.statusLine = $sl[0]' "$SETTINGS" > "''${SETTINGS}.tmp" && mv "''${SETTINGS}.tmp" "$SETTINGS"
+      else
+        ${pkgs.jq}/bin/jq -n --slurpfile sl ${claudeCodeStatusLineConfig} '{statusLine: $sl[0]}' > "$SETTINGS"
+      fi
+      $DRY_RUN_CMD echo "Claude Code statusline configured"
+    '';
+
     # Beads timer gate checker (Linux only - uses systemd)
     # Runs every 5 minutes to auto-resolve expired timer gates across all beads projects
     # This enables self-scheduling molecules (watchers, patrols, etc.)

home/roles/development/gastown-fix-agent-bead-address-title.patch

@@ -0,0 +1,15 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -315,7 +315,10 @@ func agentBeadToAddress(bead *agentBead) string {
+ 		}
+
+ 		// For other hq- agents, fall back to description parsing
+-		return parseAgentAddressFromDescription(bead.Description)
++		if bead.Title != "" && strings.Contains(bead.Title, "/") {
++			return bead.Title
++		}
++		return parseAgentAddressFromDescription(bead.Description)
+ 	}
+
+ 	// Handle gt- prefixed IDs (legacy format)

home/roles/development/gastown-fix-agent-bead-rig-prefix.patch

@@ -0,0 +1,35 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -330,8 +330,29 @@ func agentBeadToAddress(bead *agentBead) string {
+ 	}
+ 
+ 	// Handle gt- prefixed IDs (legacy format)
+-	if !strings.HasPrefix(id, "gt-") {
+-		return "" // Not a valid agent bead ID
++	// Handle rig-specific prefixes: <prefix>-<rig>-<role>-<name>
++	// Examples: j-java-crew-americano -> java/crew/americano
++	idParts := strings.Split(id, "-")
++	if len(idParts) >= 3 {
++		for i, part := range idParts {
++			if part == "crew" || part == "polecat" || part == "polecats" {
++				if i >= 1 && i < len(idParts)-1 {
++					rig := idParts[i-1]
++					name := strings.Join(idParts[i+1:], "-")
++					return rig + "/" + part + "/" + name
++				}
++			}
++			if part == "witness" || part == "refinery" {
++				if i >= 1 {
++					return idParts[i-1] + "/" + part
++				}
++			}
++		}
++	}
++
++	// Handle gt- prefixed IDs (legacy format)
++	if !strings.HasPrefix(id, "gt-") {
++		return "" // Not a valid agent bead ID
+ 	}
+ 
+ 	// Strip prefix

home/roles/development/gastown-fix-copydir-symlinks.patch

@@ -0,0 +1,25 @@
+diff --git a/internal/git/git.go b/internal/git/git.go
+--- a/internal/git/git.go
++++ b/internal/git/git.go
+@@ -73,7 +73,19 @@ func copyDir(src, dest string) error {
+ 		srcPath := filepath.Join(src, entry.Name())
+ 		destPath := filepath.Join(dest, entry.Name())
+ 
+-		if entry.IsDir() {
++		// Handle symlinks (recreate them, do not follow)
++		if entry.Type()&os.ModeSymlink != 0 {
++			linkTarget, err := os.Readlink(srcPath)
++			if err != nil {
++				return err
++			}
++			if err := os.Symlink(linkTarget, destPath); err != nil {
++				return err
++			}
++			continue
++		}
++
++		if entry.IsDir() {
+ 			if err := copyDir(srcPath, destPath); err != nil {
+ 				return err
+ 			}
+

home/roles/development/gastown-fix-role-home-paths.patch

@@ -0,0 +1,18 @@
+diff --git a/internal/cmd/role.go b/internal/cmd/role.go
+--- a/internal/cmd/role.go
++++ b/internal/cmd/role.go
+@@ -326,11 +326,11 @@ func getRoleHome(role Role, rig, polecat, townRoot string) string {
+ 		if rig == "" || polecat == "" {
+ 			return ""
+ 		}
+-		return filepath.Join(townRoot, rig, "polecats", polecat, "rig")
++		return filepath.Join(townRoot, rig, "polecats", polecat)
+ 	case RoleCrew:
+ 		if rig == "" || polecat == "" {
+ 			return ""
+ 		}
+-		return filepath.Join(townRoot, rig, "crew", polecat, "rig")
++		return filepath.Join(townRoot, rig, "crew", polecat)
+ 	default:
+ 		return ""
+ 	}

home/roles/development/gastown-fix-town-root-detection.patch

@@ -0,0 +1,18 @@
+diff --git a/internal/cmd/prime.go b/internal/cmd/prime.go
+--- a/internal/cmd/prime.go
++++ b/internal/cmd/prime.go
+@@ -276,11 +276,12 @@ func detectRole(cwd, townRoot string) RoleInfo {
+ 
+ 	// Check for mayor role
+ 	// At town root, or in mayor/ or mayor/rig/
+ 	if relPath == "." || relPath == "" {
+-		ctx.Role = RoleMayor
+-		return ctx
++		return ctx // RoleUnknown - town root is shared space
+ 	}
++
++	// Check for mayor role: mayor/ or mayor/rig/
+ 	if len(parts) >= 1 && parts[0] == "mayor" {
+ 		ctx.Role = RoleMayor
+ 		return ctx
+ 	}

home/roles/development/gastown-fix-validate-recipient.patch

@@ -0,0 +1,13 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+index b864c069..4b6a045b 100644
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -646,7 +646,7 @@ func (r *Router) validateRecipient(identity string) error {
+ 	}
+ 
+ 	for _, agent := range agents {
+-		if agentBeadToAddress(agent) == identity {
++		if AddressToIdentity(agentBeadToAddress(agent)) == AddressToIdentity(identity) {
+ 			return nil // Found matching agent
+ 		}
+ 	}

home/roles/development/gastown-statusline-optimization.patch

@@ -0,0 +1,135 @@
+diff --git a/internal/cmd/statusline.go b/internal/cmd/statusline.go
+index 2edf1be8..00253eea 100644
+--- a/internal/cmd/statusline.go
++++ b/internal/cmd/statusline.go
+@@ -6,6 +6,7 @@ import (
+ 	"path/filepath"
+ 	"sort"
+ 	"strings"
++	"time"
+ 
+ 	"github.com/spf13/cobra"
+ 	"github.com/steveyegge/gastown/internal/beads"
+@@ -14,6 +15,37 @@ import (
+ 	"github.com/steveyegge/gastown/internal/tmux"
+ 	"github.com/steveyegge/gastown/internal/workspace"
+ )
++// statusLineCacheTTL is how long cached status output remains valid.
++const statusLineCacheTTL = 10 * time.Second
++
++// statusLineCachePath returns the cache file path for a session.
++func statusLineCachePath(session string) string {
++	return filepath.Join(os.TempDir(), fmt.Sprintf("gt-status-%s", session))
++}
++
++// getStatusLineCache returns cached status if fresh, empty string otherwise.
++func getStatusLineCache(session string) string {
++	path := statusLineCachePath(session)
++	info, err := os.Stat(path)
++	if err != nil {
++		return ""
++	}
++	if time.Since(info.ModTime()) > statusLineCacheTTL {
++		return ""
++	}
++	data, err := os.ReadFile(path)
++	if err != nil {
++		return ""
++	}
++	return string(data)
++}
++
++// setStatusLineCache writes status to cache file.
++func setStatusLineCache(session, status string) {
++	path := statusLineCachePath(session)
++	_ = os.WriteFile(path, []byte(status), 0644)
++}
++
+ 
+ var (
+ 	statusLineSession string
+@@ -34,6 +66,19 @@ func init() {
+ func runStatusLine(cmd *cobra.Command, args []string) error {
+ 	t := tmux.NewTmux()
+ 
++	// Optimization: skip expensive beads queries for detached sessions
++	if statusLineSession != "" {
++		if !t.IsSessionAttached(statusLineSession) {
++			fmt.Print("○ |")
++			return nil
++		}
++		// Check cache for attached sessions too
++		if cached := getStatusLineCache(statusLineSession); cached != "" {
++			fmt.Print(cached)
++			return nil
++		}
++	}
++
+ 	// Get session environment
+ 	var rigName, polecat, crew, issue, role string
+ 
+@@ -150,7 +195,11 @@ func runWorkerStatusLine(t *tmux.Tmux, session, rigName, polecat, crew, issue st
+ 
+ 	// Output
+ 	if len(parts) > 0 {
+-		fmt.Print(strings.Join(parts, " | ") + " |")
++		output := strings.Join(parts, " | ") + " |"
++		if statusLineSession != "" {
++			setStatusLineCache(statusLineSession, output)
++		}
++		fmt.Print(output)
+ 	}
+ 
+ 	return nil
+@@ -389,7 +438,11 @@ func runMayorStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -458,7 +511,11 @@ func runDeaconStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -526,7 +583,11 @@ func runWitnessStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -617,7 +678,11 @@ func runRefineryStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 

home/roles/emacs/default.nix

@@ -8,8 +8,8 @@ let
   doomEmacs = pkgs.fetchFromGitHub {
     owner = "doomemacs";
     repo = "doomemacs";
-    rev = "38d94da67dc84897a4318714dcc48494c016d8c4";
-    sha256 = "sha256-Uc6qONH3jjUVDgW+pPBCGC7mh88ZY05u1y37fQrsxq0=";
+    rev = "d23bbe87721c61f4d5a605f2914b32780bb89949";
+    sha256 = "sha256-z+3c0AGkrMf1xZ+pq57aVp4Zo4KsqFMIjEVzSZinghc=";
   };
 
   # Shared emacs packages

home/roles/emacs/doom/config.el

@@ -53,6 +53,22 @@
 ;; change `org-directory'. It must be set before org loads!
 (setq org-directory "~/org/")
 (after! org
+  ;; Skip recurring events past their CALDAV_UNTIL date
+  ;; org-caldav ignores UNTIL from RRULE, so we store it as a property
+  ;; and filter here in the agenda
+  (defun my/skip-if-past-until ()
+    "Return non-nil if entry has CALDAV_UNTIL and current date is past it."
+    (let ((until-str (org-entry-get nil "CALDAV_UNTIL")))
+      (when (and until-str
+                 (string-match "^\\([0-9]\\{4\\}\\)\\([0-9]\\{2\\}\\)\\([0-9]\\{2\\}\\)" until-str))
+        (let* ((until-year (string-to-number (match-string 1 until-str)))
+               (until-month (string-to-number (match-string 2 until-str)))
+               (until-day (string-to-number (match-string 3 until-str)))
+               (until-time (encode-time 0 0 0 until-day until-month until-year))
+               (today (current-time)))
+          (when (time-less-p until-time today)
+            (org-end-of-subtree t))))))
+
   (setq org-agenda-span 'week
         org-agenda-start-with-log-mode t
         my-agenda-dirs '("projects" "roam")
@@ -61,6 +77,7 @@
                                                                   "\.org$"))
                                                      my-agenda-dirs))
         org-log-done 'time
+        org-agenda-skip-function-global #'my/skip-if-past-until
         org-agenda-custom-commands '(("n" "Agenda"
                                       ((agenda "")
                                        (tags-todo "-someday-recurring")))
@@ -83,25 +100,135 @@
        "d" #'org-agenda-day-view
        "w" #'org-agenda-week-view))
 
-;; (use-package! org-caldav
-;;   :defer t
-;;   :config
-;;   (setq org-caldav-url "https://nextcloud.johnogle.info/remote.php/dav/calendars/johno"
-;;         org-caldav-calendar-id "personal"
-;;         org-icalendar-timezone "America/Los_Angeles"
-;;         org-caldav-inbox "~/org/calendar.org"
-;;         org-caldav-files nil
-;;         org-caldav-sync-direction 'cal->org))
+;; org-caldav: Sync Org entries with Nextcloud CalDAV
+;; Setup requirements:
+;; 1. Create Nextcloud app password: Settings -> Security -> Devices & sessions
+;; 2. Store in rbw: rbw add nextcloud-caldav (put app password as the secret)
+;; 3. Run: doom sync
+;; 4. Test: M-x my/org-caldav-sync-with-rbw (or SPC o a s)
+;;
+;; Note: Conflict resolution is "Org always wins" - treat Org as source of truth
+;; for entries that originated in Org.
 
-(defun my/get-rbw-password (alias)
-  "Return the password for ALIAS via rbw, unlocking the vault only if needed."
-  (let* ((cmd     (format "rbw get %s 2>&1" alias))
-         (output  (shell-command-to-string cmd)))
-    (string-trim output)))
+;; Define sync wrapper before use-package (so keybinding works)
+(defun my/org-caldav-sync-with-rbw ()
+  "Run org-caldav-sync with credentials from rbw embedded in URL."
+  (interactive)
+  (require 'org)
+  (require 'org-caldav)
+  (let* ((password (my/get-rbw-password "nextcloud-caldav"))
+         ;; Embed credentials in URL (url-encode password in case of special chars)
+         (encoded-pass (url-hexify-string password)))
+    (setq org-caldav-url
+          (format "https://johno:%s@nextcloud.johnogle.info/remote.php/dav/calendars/johno"
+                  encoded-pass))
+    (org-caldav-sync)))
+
+(use-package! org-caldav
+  :after org
+  :commands (org-caldav-sync my/org-caldav-sync-with-rbw)
+  :init
+  (map! :leader
+        (:prefix ("o" . "open")
+         (:prefix ("a" . "agenda/calendar")
+          :desc "Sync CalDAV" "s" #'my/org-caldav-sync-with-rbw)))
+  :config
+  ;; Nextcloud CalDAV base URL (credentials added dynamically by sync wrapper)
+  (setq org-caldav-url "https://nextcloud.johnogle.info/remote.php/dav/calendars/johno")
+
+  ;; Timezone for iCalendar export
+  (setq org-icalendar-timezone "America/Los_Angeles")
+
+  ;; Sync state storage (in org directory for multi-machine sync)
+  (setq org-caldav-save-directory (expand-file-name ".org-caldav/" org-directory))
+
+  ;; Backup file for entries before modification
+  (setq org-caldav-backup-file (expand-file-name ".org-caldav/backup.org" org-directory))
+
+  ;; Limit past events to 30 days (avoids uploading years of scheduled tasks)
+  (setq org-caldav-days-in-past 30)
+
+  ;; Sync behavior: bidirectional by default
+  (setq org-caldav-sync-direction 'twoway)
+
+  ;; What changes from calendar sync back to Org (conservative: title and timestamp only)
+  (setq org-caldav-sync-changes-to-org 'title-and-timestamp)
+
+  ;; Deletion handling: never auto-delete to prevent accidental mass deletion
+  (setq org-caldav-delete-calendar-entries 'never)
+  (setq org-caldav-delete-org-entries 'never)
+
+  ;; Enable TODO/VTODO sync
+  (setq org-icalendar-include-todo 'all)
+  (setq org-caldav-sync-todo t)
+
+  ;; Map VTODO percent-complete to org-todo-keywords
+  ;; Format: (PERCENT "KEYWORD") - percent thresholds map to states
+  (setq org-caldav-todo-percent-states
+        '((0 "TODO")
+          (25 "WAIT")
+          (50 "IN-PROGRESS")
+          (100 "DONE")
+          (100 "KILL")))
+
+  ;; Allow export with broken links (mu4e links can't be resolved during export)
+  (setq org-export-with-broken-links 'mark)
+
+  ;; Calendar-specific configuration
+  (setq org-caldav-calendars
+        '(;; Personal calendar: two-way sync with family-shared Nextcloud calendar
+          (:calendar-id "personal"
+           :inbox "~/org/personal-calendar.org"
+           :files ("~/org/personal-calendar.org"))
+
+          ;; Tasks calendar: one-way sync (org → calendar only)
+          ;; SCHEDULED/DEADLINE items from todo.org push to private Tasks calendar.
+          ;; No inbox = no download from calendar (effectively one-way).
+          ;; Note: Create 'tasks' calendar in Nextcloud first, keep it private.
+          (:calendar-id "tasks"
+           :files ("~/org/todo.org"))))
+
+  ;; Handle UNTIL in recurring events
+  ;; org-caldav ignores UNTIL from RRULE - events repeat forever.
+  ;; This advice extracts UNTIL and stores it as a property for agenda filtering.
+  (defun my/org-caldav-add-until-property (orig-fun eventdata-alist)
+    "Advice to store CALDAV_UNTIL property for recurring events."
+    (let ((result (funcall orig-fun eventdata-alist)))
+      (let* ((rrule-props (alist-get 'rrule-props eventdata-alist))
+             (until-str (cadr (assoc 'UNTIL rrule-props)))
+             (summary (alist-get 'summary eventdata-alist)))
+        ;; Debug: log what we're seeing
+        (message "CALDAV-DEBUG: %s | rrule-props: %S | until: %s"
+                 (or summary "?") rrule-props until-str)
+        (when until-str
+          (save-excursion
+            (org-back-to-heading t)
+            (org-entry-put nil "CALDAV_UNTIL" until-str))))
+      result))
+
+  (advice-add 'org-caldav-insert-org-event-or-todo
+              :around #'my/org-caldav-add-until-property)
+  )
+
+(defun my/get-rbw-password (alias &optional no-error)
+  "Return the password for ALIAS via rbw, unlocking the vault only if needed.
+If NO-ERROR is non-nil, return nil instead of signaling an error when
+rbw is unavailable or the entry is not found."
+  (if (not (executable-find "rbw"))
+      (if no-error
+          nil
+        (user-error "rbw: not installed or not in PATH"))
+    (let* ((cmd (format "rbw get %s 2>/dev/null" (shell-quote-argument alias)))
+           (output (string-trim (shell-command-to-string cmd))))
+      (if (string-empty-p output)
+          (if no-error
+              nil
+            (user-error "rbw: no entry found for '%s' - run: rbw add %s" alias alias))
+        output))))
 
 (after! gptel
   :config
-  (setq! gptel-api-key (my/get-rbw-password "openai-api-key-chatgpt-el")
+  (setq! gptel-api-key (my/get-rbw-password "openai-api-key-chatgpt-el" t)
          gptel-default-mode 'org-mode
          gptel-use-tools t
          gptel-confirm-tool-calls 'always
@@ -147,6 +274,18 @@
                  (error (format "Error listing directory %s: %s" dirpath (error-message-string err)))))
    :args (list '(:name "dirpath" :type "string" :description "Directory path to list"))))
 
+(use-package! pi-coding-agent
+  :commands (pi-coding-agent pi-coding-agent-toggle)
+  :init
+  (defalias 'pi 'pi-coding-agent)
+  (map! :leader
+        (:prefix ("o" . "open")
+         :desc "Pi Coding Agent" "p" #'pi-coding-agent))
+  :config
+  ;; Tree-sitter grammars are managed by Nix (treesit-grammars.with-all-grammars),
+  ;; so suppress the auto-install prompt
+  (setq pi-coding-agent-essential-grammar-action 'warn))
+
 (use-package! claude-code-ide
   :commands (claude-code-ide-menu claude-code-ide-open-here)
   :init

home/roles/emacs/doom/packages.el

@@ -49,7 +49,10 @@
 ;; ...Or *all* packages (NOT RECOMMENDED; will likely break things)
 ;; (unpin! t)
 
-;; (package! org-caldav)
+(package! org-caldav)
+
+;; Pin org-msg - upstream doom pin references a force-pushed commit
+(package! org-msg :pin "aa608b399586fb771ad37045a837f8286a0b6124")
 
 ;; Note: Packages with custom recipes must be pinned for nix-doom-emacs-unstraightened
 ;; to build deterministically. Update pins when upgrading packages.
@@ -69,3 +72,8 @@
   :recipe (:type git :repo "https://codeberg.org/ctietze/beads.el.git"
            :files ("lisp/*.el"))
   :pin "f40a6461d3c0fa0969311bbb6a1e30d1bba86c88")
+
+(package! pi-coding-agent
+  :recipe (:host github :repo "dnouri/pi-coding-agent"
+           :files ("*.el"))
+  :pin "8d8158b0a6150ce13d91e561a1223790670acaa7")

home/wallpapers/default.nix

@@ -2,7 +2,7 @@
 # The currentIndex is incremented by `nix run .#rotate-wallpaper`
 # and gets committed as part of `nix run .#upgrade`
 {
-  currentIndex = 1;  # Index into wallpapers list
+  currentIndex = 2;  # Index into wallpapers list
 
   wallpapers = [
     {

machines/boxy/configuration.nix

@@ -22,12 +22,11 @@ with lib;
       sddm = true;
       wayland = true;
     };
-    kodi = {
+    plasma-bigscreen = {
       enable = true;
       autologin = true;
-      wayland = true;
-      appLauncherServer.enable = true;
       jellyfinScaleFactor = 1.0;
+      appLauncherServer.enable = true;
     };
     nfs-mounts.enable = true;
     users.enable = true;
@@ -72,4 +71,3 @@ with lib;
   system.stateVersion = "24.05"; # Did you read the comment?
 
 }
-

machines/john-endesktop/configuration.nix

@@ -54,6 +54,7 @@ with lib;
       4000  # nfs callback
       4001  # nlockmgr
       4002  # mountd
+      5000  # harmonia binary cache
       20048 # mountd
     ];
     allowedUDPPorts = [
@@ -90,6 +91,8 @@ with lib;
     htop
     tmux
     zfs
+    rclone
+    custom.rclone-torbox-setup  # Helper script to set up TorBox credentials via rbw
   ];
 
   # Enable SSH
@@ -126,6 +129,36 @@ with lib;
 
   roles.virtualisation.enable = true;
 
+  # TorBox WebDAV mount for rdt-client and Jellyfin
+  roles.rclone-mount = {
+    enable = true;
+    mounts.torbox = {
+      webdavUrl = "https://webdav.torbox.app";
+      username = "john@ogle.fyi";  # TorBox account email
+      mountPoint = "/media/media/torbox-rclone";
+      environmentFile = "/etc/rclone/torbox.env";
+      vfsCacheMode = "full";  # Best for streaming media
+      dirCacheTime = "5m";
+      extraArgs = [
+        "--buffer-size=64M"
+        "--vfs-read-chunk-size=32M"
+        "--vfs-read-chunk-size-limit=off"
+      ];
+      # Wait for ZFS media pool to be mounted before starting
+      requiresMountsFor = [ "/media" ];
+    };
+  };
+
+  # Harmonia binary cache server
+  # Replaces the broken k8s deployment with native NixOS service
+  services.harmonia = {
+    enable = true;
+    signKeyPaths = [ "/etc/harmonia/signing-key.private" ];
+    settings = {
+      bind = "[::]:5000";
+    };
+  };
+
   # Time zone
   time.timeZone = "America/Los_Angeles"; # Adjust as needed
 

machines/nix-book/configuration.nix

@@ -23,12 +23,12 @@
     printing.enable = true;
     remote-build.builders = [
       {
-        hostName = "zix790prors";
+        hostName = "zix790prors.oglehome";
         maxJobs = 16;
         speedFactor = 3;
       }
       {
-        hostName = "john-endesktop";
+        hostName = "john-endesktop.oglehome";
         maxJobs = 1;
         speedFactor = 1;
       }
@@ -38,7 +38,10 @@
       enable = true;
       extraGroups = [ "video" ];
     };
-    virtualisation.enable = true;
+    virtualisation = {
+      enable = true;
+      waydroid = true;
+    };
   };
 
   # Bootloader.

machines/nix-deck/configuration.nix

@@ -19,11 +19,18 @@
         desktopSession = "plasma";
       };
     };
-    remote-build.builders = [{
-      hostName = "zix790prors";
-      maxJobs = 16;
-      speedFactor = 4;  # Prefer remote heavily on Steam Deck
-    }];
+    remote-build.builders = [
+      {
+        hostName = "zix790prors.oglehome";
+        maxJobs = 16;
+        speedFactor = 4;
+      }
+      {
+        hostName = "john-endesktop.oglehome";
+        maxJobs = 1;
+        speedFactor = 2;
+      }
+    ];
     users = {
       enable = true;
       extraGroups = [ "video" ];

packages/beads/default.nix

@@ -0,0 +1,26 @@
+# Beads package - issue tracker for AI-supervised coding workflows
+# Takes src as argument so it can be called from both overlay and flake packages
+{ lib
+, buildGoModule
+, git
+, pkg-config
+, icu
+, src
+, version ? "unknown"
+}:
+
+buildGoModule {
+  pname = "beads";
+  inherit version src;
+  subPackages = [ "cmd/bd" ];
+  doCheck = false;
+  vendorHash = "sha256-OL6QGf4xSMpEbmU+41pFdO0Rrs3H162T3pdiW9UfWR0=";
+  nativeBuildInputs = [ git pkg-config ];
+  buildInputs = [ icu ];
+  meta = with lib; {
+    description = "beads (bd) - An issue tracker designed for AI-supervised coding workflows";
+    homepage = "https://github.com/steveyegge/beads";
+    license = licenses.mit;
+    mainProgram = "bd";
+  };
+}

packages/claude-code/default.nix

@@ -6,24 +6,24 @@
 }:
 
 let
-  version = "2.1.12";
+  version = "2.1.69";
 
   srcs = {
     aarch64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-arm64/claude";
-      sha256 = "40be59519a84bd35eb1111aa46f72aa6b3443866d3f6336252a198fdcaefbbe5";
+      sha256 = "a86e14f44b167c1e8dbf764f76755b92ecf52c097d732a3461fe65b5fb60be05";
     };
     x86_64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-x64/claude";
-      sha256 = "0eee4b46c91749480bf856f88e49b15a3e944faa9d346679c5f0c0d7fa6f2f54";
+      sha256 = "e5987b4dd502a6542bf86c3c0bcd1d533b774616fc7d49566ce0b2040e6c1374";
     };
     x86_64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-x64/claude";
-      sha256 = "3fe979215489dc1b31463fadf95ed2d2d5473a9969447bb7a46431f4578847d4";
+      sha256 = "b3bdbd5a3cbf8caafe353022170df77fefa80b00003074d4d27e7da8c59e629a";
     };
     aarch64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-arm64/claude";
-      sha256 = "e214b1d3b5afd4cd2de9177359001d41a3eb98cb1e3665fe97edc592f5aa132f";
+      sha256 = "ecc7bbf10513ff122327866eb97212945b73afd7f81e30700375cdf10f50b2a3";
     };
   };
 

packages/default.nix

@@ -4,4 +4,6 @@
   app-launcher-server = pkgs.callPackage ./app-launcher-server {};
   claude-code = pkgs.callPackage ./claude-code {};
   mcrcon-rbw = pkgs.callPackage ./mcrcon-rbw {};
+  rclone-torbox-setup = pkgs.callPackage ./rclone-torbox-setup {};
+  pi-coding-agent = pkgs.callPackage ./pi-coding-agent {};
 }

packages/gastown/default.nix

@@ -0,0 +1,38 @@
+# Gastown package - multi-agent workspace manager
+# Takes src as argument so it can be called from both overlay and flake packages
+{ lib
+, buildGoModule
+, src
+, version ? "unknown"
+}:
+
+buildGoModule {
+  pname = "gastown";
+  inherit version src;
+  vendorHash = "sha256-/+ODyndArUF0nJY9r8G5JKhzQckBHFb48A7EBZmoIr0=";
+  subPackages = [ "cmd/gt" ];
+  doCheck = false;
+
+  # Must match ldflags from gastown Makefile - BuiltProperly=1 is required
+  # or gt will error with "This binary was built with 'go build' directly"
+  ldflags = [
+    "-X github.com/steveyegge/gastown/internal/cmd.Version=${version}"
+    "-X github.com/steveyegge/gastown/internal/cmd.Commit=${version}"
+    "-X github.com/steveyegge/gastown/internal/cmd.BuildTime=nix-build"
+    "-X github.com/steveyegge/gastown/internal/cmd.BuiltProperly=1"
+  ];
+
+  # Bug fixes not yet merged upstream
+  patches = [
+    ./gastown-fix-validate-recipient.patch
+    ./gastown-fix-agent-bead-address-title.patch
+    ./gastown-statusline-optimization.patch
+  ];
+
+  meta = with lib; {
+    description = "Gas Town - multi-agent workspace manager by Steve Yegge";
+    homepage = "https://github.com/steveyegge/gastown";
+    license = licenses.mit;
+    mainProgram = "gt";
+  };
+}

packages/gastown/gastown-fix-agent-bead-address-title.patch

@@ -0,0 +1,15 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -315,7 +315,10 @@ func agentBeadToAddress(bead *agentBead) string {
+ 		}
+
+ 		// For other hq- agents, fall back to description parsing
+-		return parseAgentAddressFromDescription(bead.Description)
++		if bead.Title != "" && strings.Contains(bead.Title, "/") {
++			return bead.Title
++		}
++		return parseAgentAddressFromDescription(bead.Description)
+ 	}
+
+ 	// Handle gt- prefixed IDs (legacy format)

packages/gastown/gastown-fix-validate-recipient.patch

@@ -0,0 +1,13 @@
+diff --git a/internal/mail/router.go b/internal/mail/router.go
+index b864c069..4b6a045b 100644
+--- a/internal/mail/router.go
++++ b/internal/mail/router.go
+@@ -646,7 +646,7 @@ func (r *Router) validateRecipient(identity string) error {
+ 	}
+ 
+ 	for _, agent := range agents {
+-		if agentBeadToAddress(agent) == identity {
++		if AddressToIdentity(agentBeadToAddress(agent)) == AddressToIdentity(identity) {
+ 			return nil // Found matching agent
+ 		}
+ 	}

packages/gastown/gastown-statusline-optimization.patch

@@ -0,0 +1,135 @@
+diff --git a/internal/cmd/statusline.go b/internal/cmd/statusline.go
+index 2edf1be8..00253eea 100644
+--- a/internal/cmd/statusline.go
++++ b/internal/cmd/statusline.go
+@@ -6,6 +6,7 @@ import (
+ 	"path/filepath"
+ 	"sort"
+ 	"strings"
++	"time"
+ 
+ 	"github.com/spf13/cobra"
+ 	"github.com/steveyegge/gastown/internal/beads"
+@@ -14,6 +15,37 @@ import (
+ 	"github.com/steveyegge/gastown/internal/tmux"
+ 	"github.com/steveyegge/gastown/internal/workspace"
+ )
++// statusLineCacheTTL is how long cached status output remains valid.
++const statusLineCacheTTL = 10 * time.Second
++
++// statusLineCachePath returns the cache file path for a session.
++func statusLineCachePath(session string) string {
++	return filepath.Join(os.TempDir(), fmt.Sprintf("gt-status-%s", session))
++}
++
++// getStatusLineCache returns cached status if fresh, empty string otherwise.
++func getStatusLineCache(session string) string {
++	path := statusLineCachePath(session)
++	info, err := os.Stat(path)
++	if err != nil {
++		return ""
++	}
++	if time.Since(info.ModTime()) > statusLineCacheTTL {
++		return ""
++	}
++	data, err := os.ReadFile(path)
++	if err != nil {
++		return ""
++	}
++	return string(data)
++}
++
++// setStatusLineCache writes status to cache file.
++func setStatusLineCache(session, status string) {
++	path := statusLineCachePath(session)
++	_ = os.WriteFile(path, []byte(status), 0644)
++}
++
+ 
+ var (
+ 	statusLineSession string
+@@ -34,6 +66,19 @@ func init() {
+ func runStatusLine(cmd *cobra.Command, args []string) error {
+ 	t := tmux.NewTmux()
+ 
++	// Optimization: skip expensive beads queries for detached sessions
++	if statusLineSession != "" {
++		if !t.IsSessionAttached(statusLineSession) {
++			fmt.Print("○ |")
++			return nil
++		}
++		// Check cache for attached sessions too
++		if cached := getStatusLineCache(statusLineSession); cached != "" {
++			fmt.Print(cached)
++			return nil
++		}
++	}
++
+ 	// Get session environment
+ 	var rigName, polecat, crew, issue, role string
+ 
+@@ -150,7 +195,11 @@ func runWorkerStatusLine(t *tmux.Tmux, session, rigName, polecat, crew, issue st
+ 
+ 	// Output
+ 	if len(parts) > 0 {
+-		fmt.Print(strings.Join(parts, " | ") + " |")
++		output := strings.Join(parts, " | ") + " |"
++		if statusLineSession != "" {
++			setStatusLineCache(statusLineSession, output)
++		}
++		fmt.Print(output)
+ 	}
+ 
+ 	return nil
+@@ -389,7 +438,11 @@ func runMayorStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -458,7 +511,11 @@ func runDeaconStatusLine(t *tmux.Tmux) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -526,7 +583,11 @@ func runWitnessStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 
+@@ -617,7 +678,11 @@ func runRefineryStatusLine(t *tmux.Tmux, rigName string) error {
+ 		}
+ 	}
+ 
+-	fmt.Print(strings.Join(parts, " | ") + " |")
++	output := strings.Join(parts, " | ") + " |"
++	if statusLineSession != "" {
++		setStatusLineCache(statusLineSession, output)
++	}
++	fmt.Print(output)
+ 	return nil
+ }
+ 

packages/pi-coding-agent/default.nix

@@ -0,0 +1,79 @@
+{ lib
+, stdenv
+, fetchurl
+, patchelf
+, glibc
+, makeWrapper
+}:
+
+let
+  version = "0.55.4";
+
+  srcs = {
+    aarch64-darwin = {
+      url = "https://github.com/badlogic/pi-mono/releases/download/v${version}/pi-darwin-arm64.tar.gz";
+      sha256 = "0vsav9frvnzskk6p6j60i7klrs3m8lphhyi4c39mv2mvhpm8fkl5";
+    };
+    x86_64-darwin = {
+      url = "https://github.com/badlogic/pi-mono/releases/download/v${version}/pi-darwin-x64.tar.gz";
+      sha256 = "1377rvhsiiww1bbpgv2v46fjm7iz2smmh8g2yhm28kbsq3gwvvr0";
+    };
+    x86_64-linux = {
+      url = "https://github.com/badlogic/pi-mono/releases/download/v${version}/pi-linux-x64.tar.gz";
+      sha256 = "1wnfwnkfq5ffz6wyqyhciv4lz06bpxims0hv0dlhz0f9vliyc1md";
+    };
+    aarch64-linux = {
+      url = "https://github.com/badlogic/pi-mono/releases/download/v${version}/pi-linux-arm64.tar.gz";
+      sha256 = "00fp37hgjl40kc59jfpv189i7np53ymm037hvds6k9y2sz818wjy";
+    };
+  };
+
+  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+in stdenv.mkDerivation {
+  pname = "pi-coding-agent";
+  inherit version;
+
+  src = fetchurl {
+    inherit (src) url sha256;
+  };
+
+  sourceRoot = "pi";
+
+  # Bun standalone binaries have JS code appended after the ELF sections
+  dontStrip = true;
+  dontPatchELF = true;
+
+  nativeBuildInputs = [ makeWrapper ]
+    ++ lib.optionals stdenv.isLinux [ patchelf ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # Install the full pi directory structure (binary + supporting files)
+    mkdir -p $out/lib/pi-coding-agent
+    cp -r . $out/lib/pi-coding-agent/
+
+    # Create bin wrapper that runs the binary from its lib directory
+    # (pi expects supporting files like themes and wasm relative to itself)
+    mkdir -p $out/bin
+    makeWrapper $out/lib/pi-coding-agent/pi $out/bin/pi
+
+    runHook postInstall
+  '';
+
+  # Manually patch the interpreter for bun standalone binaries on Linux
+  postFixup = lib.optionalString stdenv.isLinux ''
+    interpreter="${glibc}/lib/${if stdenv.hostPlatform.system == "aarch64-linux" then "ld-linux-aarch64.so.1" else "ld-linux-x86-64.so.2"}"
+    patchelf --set-interpreter "$interpreter" $out/lib/pi-coding-agent/pi
+  '';
+
+  meta = with lib; {
+    description = "Minimal terminal coding agent with extensible tools and session management";
+    homepage = "https://github.com/badlogic/pi-mono/tree/main/packages/coding-agent";
+    license = licenses.mit;
+    maintainers = [ ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" "aarch64-linux" ];
+    mainProgram = "pi";
+  };
+}

packages/rclone-torbox-setup/default.nix

@@ -0,0 +1,98 @@
+{ pkgs, ... }:
+
+pkgs.writeShellScriptBin "rclone-torbox-setup" ''
+  set -euo pipefail
+
+  # Default values
+  RBW_ENTRY="''${1:-torbox}"
+  ENV_FILE="''${2:-/etc/rclone/torbox.env}"
+
+  usage() {
+    echo "Usage: rclone-torbox-setup [rbw-entry] [env-file]"
+    echo ""
+    echo "Sets up rclone credentials for TorBox WebDAV mount."
+    echo "Retrieves password from rbw (Bitwarden), obscures it for rclone,"
+    echo "and writes it to the environment file for the systemd service."
+    echo ""
+    echo "Arguments:"
+    echo "  rbw-entry  Name of the Bitwarden entry containing the password (default: torbox)"
+    echo "  env-file   Path to write the environment file (default: /etc/rclone/torbox.env)"
+    echo ""
+    echo "The Bitwarden entry should contain your TorBox password as the password field."
+    echo ""
+    echo "Example:"
+    echo "  rclone-torbox-setup torbox-password /etc/rclone/torbox.env"
+    exit 1
+  }
+
+  if [[ "''${1:-}" == "-h" ]] || [[ "''${1:-}" == "--help" ]]; then
+    usage
+  fi
+
+  echo "rclone TorBox credential setup"
+  echo "=============================="
+  echo ""
+
+  # Check if rbw is available
+  if ! command -v rbw &> /dev/null; then
+    echo "Error: rbw is not available. Please ensure rbw is installed and configured."
+    exit 1
+  fi
+
+  # Check if rclone is available
+  if ! command -v rclone &> /dev/null; then
+    echo "Error: rclone is not available. Please ensure rclone is installed."
+    exit 1
+  fi
+
+  echo "Retrieving password from rbw entry: $RBW_ENTRY"
+
+  # Retrieve password from Bitwarden
+  if ! TORBOX_PASS=$(rbw get "$RBW_ENTRY" 2>/dev/null); then
+    echo ""
+    echo "Error: Failed to retrieve password from rbw entry '$RBW_ENTRY'"
+    echo ""
+    echo "Please ensure:"
+    echo "  1. The entry '$RBW_ENTRY' exists in Bitwarden"
+    echo "  2. rbw is unlocked: rbw unlock"
+    echo "  3. rbw is synced: rbw sync"
+    echo ""
+    echo "To create the entry in Bitwarden:"
+    echo "  - Name: $RBW_ENTRY"
+    echo "  - Password: Your TorBox password"
+    exit 1
+  fi
+
+  echo "Password retrieved successfully"
+
+  # Obscure the password for rclone
+  echo "Obscuring password for rclone..."
+  if ! OBSCURED_PASS=$(echo -n "$TORBOX_PASS" | rclone obscure -); then
+    echo "Error: Failed to obscure password with rclone"
+    exit 1
+  fi
+
+  # Create the directory if needed (requires sudo)
+  ENV_DIR=$(dirname "$ENV_FILE")
+  if [[ ! -d "$ENV_DIR" ]]; then
+    echo "Creating directory $ENV_DIR (requires sudo)..."
+    sudo mkdir -p "$ENV_DIR"
+  fi
+
+  # Write the environment file
+  echo "Writing environment file to $ENV_FILE (requires sudo)..."
+  echo "RCLONE_WEBDAV_PASS=$OBSCURED_PASS" | sudo tee "$ENV_FILE" > /dev/null
+  sudo chmod 600 "$ENV_FILE"
+
+  echo ""
+  echo "Setup complete!"
+  echo ""
+  echo "The environment file has been created at: $ENV_FILE"
+  echo "The rclone-mount-torbox systemd service will use this file."
+  echo ""
+  echo "To activate the mount after NixOS rebuild:"
+  echo "  sudo systemctl start rclone-mount-torbox"
+  echo ""
+  echo "To check status:"
+  echo "  sudo systemctl status rclone-mount-torbox"
+''

renovate.json

@@ -13,7 +13,7 @@
   "lockFileMaintenance": {
     "enabled": true,
     "schedule": [
-      "before 5am on monday"
+      "after 2pm and before 4pm on Saturday"
     ]
   },
   "dependencyDashboard": true,
@@ -37,6 +37,9 @@
         "/^nixpkgs$/",
         "/^home-manager$/",
         "/^nix-darwin$/"
+      ],
+      "schedule": [
+        "after 2pm and before 4pm on Saturday"
       ]
     },
     {
@@ -48,6 +51,21 @@
       "matchPackageNames": [
         "/nixpkgs-unstable/",
         "/home-manager-unstable/"
+      ],
+      "schedule": [
+        "after 2pm and before 4pm on Saturday"
+      ]
+    },
+    {
+      "description": "nixpkgs-qt updates on Saturday (staggered from main ecosystem)",
+      "matchManagers": [
+        "nix"
+      ],
+      "matchPackageNames": [
+        "/nixpkgs-qt/"
+      ],
+      "schedule": [
+        "after 4pm and before 6pm on Saturday"
       ]
     },
     {
@@ -69,7 +87,7 @@
         "/gastown/"
       ],
       "schedule": [
-        "before 6am every day"
+        "before 6am"
       ],
       "automerge": false
     },
@@ -82,7 +100,7 @@
         "/beads/"
       ],
       "schedule": [
-        "before 6am every day"
+        "before 6am"
       ],
       "automerge": false
     }

roles/common.nix

@@ -23,7 +23,13 @@
         max-jobs = "auto";
         trusted-users = [ "johno" ];
         substituters = [
+          "http://john-endesktop.oglehome:5000"
         ];
+        trusted-public-keys = [
+          "harmonia.john-endesktop:1iGr4xZrsR7WtXOlPCgFF3LcODYBpu+B3TS54MyBn4M="
+        ];
+        fallback = true;
+        connect-timeout = 5;
       };
 
       gc = {

roles/default.nix

@@ -12,8 +12,10 @@ with lib;
     ./k3s-node
     ./kodi
     ./nfs-mounts
+    ./plasma-bigscreen
     ./nvidia
     ./printing
+    ./rclone-mount
     ./remote-build
     ./spotifyd
     ./users

roles/desktop/wayland.nix

@@ -11,9 +11,8 @@ in
       enable = true;
       wrapperFeatures.gtk = true;
     };
-    programs.light.enable = true;
-
     environment.systemPackages = with pkgs; [
+      brightnessctl
       grim
       slurp
       wl-clipboard

roles/kodi/default.nix

@@ -47,23 +47,23 @@ in
       if cfg.jellyfinScaleFactor != null
       then pkgs.symlinkJoin {
         name = "jellyfin-media-player-scaled";
-        paths = [ pkgs.jellyfin-media-player ];
+        paths = [ pkgs.qt-pinned.jellyfin-media-player ];
         nativeBuildInputs = [ pkgs.makeWrapper ];
         postBuild = ''
           mkdir -p $out/bin
           rm -f $out/bin/jellyfin-desktop
-          makeWrapper ${pkgs.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
+          makeWrapper ${pkgs.qt-pinned.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
             --add-flags "--tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
 
           # Update .desktop file to include scale factor and TV mode arguments
           mkdir -p $out/share/applications
           rm -f $out/share/applications/org.jellyfin.JellyfinDesktop.desktop
-          substitute ${pkgs.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
+          substitute ${pkgs.qt-pinned.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             $out/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             --replace-fail "Exec=jellyfin-desktop" "Exec=jellyfin-desktop --tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
         '';
       }
-      else pkgs.jellyfin-media-player;
+      else pkgs.qt-pinned.jellyfin-media-player;
   in mkIf cfg.enable
     {
       users.extraUsers.kodi = {
@@ -77,14 +77,15 @@ in
       };
 
       environment.systemPackages = with pkgs; [
+        firefox
         jellyfinMediaPlayerPkg
         kodiPkg
+        qt-pinned.stremio
         wget
-        firefox
       ] ++ optional cfg.appLauncherServer.enable pkgs.custom.app-launcher-server;
 
       nixpkgs.config.permittedInsecurePackages = lib.warn
-        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player dependency. Remove this once jellyfin is updated to use qt6"
+        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player/stremio dependency. These are pinned to nixpkgs-qt to avoid rebuilds - update that input separately when you have time."
         [
           "qtwebengine-5.15.19"
         ];

roles/plasma-bigscreen/default.nix

@@ -0,0 +1,134 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.roles.plasma-bigscreen;
+
+  # Plasma Bigscreen package — not yet in nixpkgs, built from upstream master.
+  # TODO: Replace with pkgs.kdePackages.plasma-bigscreen once available.
+  plasma-bigscreen = pkgs.kdePackages.callPackage ./package.nix {};
+
+  jellyfinMediaPlayerPkg =
+    if cfg.jellyfinScaleFactor != null
+    then pkgs.symlinkJoin {
+      name = "jellyfin-media-player-scaled";
+      paths = [ pkgs.qt-pinned.jellyfin-media-player ];
+      nativeBuildInputs = [ pkgs.makeWrapper ];
+      postBuild = ''
+        mkdir -p $out/bin
+        rm -f $out/bin/jellyfin-desktop
+        makeWrapper ${pkgs.qt-pinned.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
+          --add-flags "--tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
+
+        # Update .desktop file to include scale factor and TV mode arguments
+        mkdir -p $out/share/applications
+        rm -f $out/share/applications/org.jellyfin.JellyfinDesktop.desktop
+        substitute ${pkgs.qt-pinned.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
+          $out/share/applications/org.jellyfin.JellyfinDesktop.desktop \
+          --replace-fail "Exec=jellyfin-desktop" "Exec=jellyfin-desktop --tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
+      '';
+    }
+    else pkgs.qt-pinned.jellyfin-media-player;
+in
+{
+  options.roles.plasma-bigscreen = {
+    enable = mkEnableOption "Plasma Bigscreen TV interface";
+
+    autologin = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Auto-login to Plasma Bigscreen session";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "kodi";
+      description = "User account for the Bigscreen session";
+    };
+
+    jellyfinScaleFactor = mkOption {
+      type = types.nullOr types.float;
+      default = null;
+      description = "Scale factor for Jellyfin Media Player UI (e.g., 1.0 for 100% scaling)";
+    };
+
+    appLauncherServer = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable HTTP app launcher server for remote control";
+      };
+      port = mkOption {
+        type = types.int;
+        default = 8081;
+        description = "Port for the app launcher HTTP server";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Create the bigscreen user
+    users.extraUsers.${cfg.user} = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" "networkmanager" "audio" "video" ];
+    };
+
+    # Plasma Bigscreen is a Plasma 6 shell — needs Plasma 6 desktop manager
+    services.desktopManager.plasma6.enable = true;
+
+    # Register the bigscreen session with the display manager
+    services.displayManager = {
+      sessionPackages = [ plasma-bigscreen ];
+    } // optionalAttrs cfg.autologin {
+      autoLogin.enable = true;
+      autoLogin.user = cfg.user;
+      defaultSession = "plasma-bigscreen-wayland";
+    };
+    xdg.portal.configPackages = [ plasma-bigscreen ];
+
+    # Fix homescreen not being focused after quitting app or on boot
+    # xwaylandvideobridge can interfere with focus; exclude if present
+    environment.plasma6.excludePackages =
+      lib.optional (pkgs.kdePackages ? xwaylandvideobridge) pkgs.kdePackages.xwaylandvideobridge;
+
+    # Firewall for remote control
+    networking.firewall = {
+      allowedTCPPorts = optional cfg.appLauncherServer.enable cfg.appLauncherServer.port;
+    };
+
+    environment.systemPackages = with pkgs; [
+      plasma-bigscreen
+      firefox
+      jellyfinMediaPlayerPkg
+      qt-pinned.stremio
+      wget
+    ] ++ optional cfg.appLauncherServer.enable pkgs.custom.app-launcher-server;
+
+    nixpkgs.config.permittedInsecurePackages = lib.warn
+      "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player/stremio dependency."
+      [
+        "qtwebengine-5.15.19"
+      ];
+
+    programs.kdeconnect.enable = true;
+
+    systemd.user.services = mkIf cfg.appLauncherServer.enable {
+      app-launcher-server = {
+        description = "HTTP App Launcher Server";
+        wantedBy = [ "graphical-session.target" ];
+        after = [ "graphical-session.target" ];
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.custom.app-launcher-server}/bin/app-launcher-server ${toString cfg.appLauncherServer.port}";
+          Restart = "always";
+          RestartSec = "5s";
+          Environment = [
+            "PATH=${pkgs.firefox}/bin:/run/current-system/sw/bin"
+          ];
+        };
+      };
+    };
+
+  };
+}

roles/plasma-bigscreen/package.nix

@@ -0,0 +1,131 @@
+# Plasma Bigscreen — TV interface for Plasma 6
+# Not yet released or packaged in nixpkgs; built from upstream master.
+#
+# TODO: Remove this file once plasma-bigscreen lands in nixpkgs.
+#   Tracking issue: https://github.com/NixOS/nixpkgs/issues/428077
+#   Draft nixpkgs PR: https://github.com/NixOS/nixpkgs/pull/428353
+#   When available, switch to pkgs.kdePackages.plasma-bigscreen.
+#
+# Upstream: https://invent.kde.org/plasma/plasma-bigscreen
+{
+  mkKdeDerivation,
+  lib,
+  fetchFromGitLab,
+  pkg-config,
+  # KDE Frameworks 6
+  ki18n,
+  kdeclarative,
+  kcmutils,
+  knotifications,
+  kio,
+  kwayland,
+  kwindowsystem,
+  ksvg,
+  kiconthemes,
+  kglobalaccel,
+  kdbusaddons,
+  # KDE Plasma 6
+  plasma-workspace,
+  plasma-nano,
+  plasma-nm,
+  plasma-activities,
+  plasma-activities-stats,
+  milou,
+  libkscreen,
+  kdeconnect-kde,
+  # Qt 6
+  qtdeclarative, # needed for Qt6::QmlPrivate — see QCoro workaround in postPatch
+  qtmultimedia,
+  qtwebengine,
+  # Other
+  bluez-qt,
+  qcoro,
+  plasma-wayland-protocols,
+  wayland,
+  sdl3,
+}:
+
+mkKdeDerivation {
+  pname = "plasma-bigscreen";
+  version = "unstable-2026-03-07";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "plasma";
+    repo = "plasma-bigscreen";
+    rev = "bd143fea7e386bac1652b8150a3ed3d5ef7cf93c";
+    hash = "sha256-y439IX7e0+XqxqFj/4+P5le0hA7DiwA+smDsD0UH/fI=";
+  };
+
+  extraNativeBuildInputs = [
+    pkg-config
+  ];
+
+  extraBuildInputs = [
+    # KDE Frameworks
+    ki18n
+    kdeclarative
+    kcmutils
+    knotifications
+    kio
+    kwayland
+    kwindowsystem
+    ksvg
+    kiconthemes
+    kglobalaccel
+    kdbusaddons
+    # Plasma
+    plasma-workspace
+    plasma-nano
+    plasma-nm
+    plasma-activities
+    plasma-activities-stats
+    milou
+    libkscreen
+    kdeconnect-kde
+    # Qt — qtdeclarative is needed for Qt6::QmlPrivate (see postPatch)
+    qtdeclarative
+    qtmultimedia
+    qtwebengine
+    # Other
+    bluez-qt
+    qcoro
+    plasma-wayland-protocols
+    wayland
+    sdl3
+  ];
+
+  postPatch = ''
+    substituteInPlace bin/plasma-bigscreen-wayland.in \
+      --replace @KDE_INSTALL_FULL_LIBEXECDIR@ "${plasma-workspace}/libexec"
+
+    # WORKAROUND: Plasma version numbers must match; we're building an
+    # unreleased package against a stable Plasma release. Remove once
+    # bigscreen is part of the Plasma release cycle.
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'set(PROJECT_VERSION "6.5.80")' 'set(PROJECT_VERSION "${plasma-workspace.version}")'
+
+    # WORKAROUND: QCoro6Qml's cmake config links against Qt6::QmlPrivate but
+    # doesn't call find_package to import the target. This is arguably a QCoro
+    # packaging bug in nixpkgs (it should propagate qtdeclarative). Remove
+    # once QCoro or the nixpkgs plasma-bigscreen package is fixed upstream.
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'find_package(QCoro6' 'find_package(Qt6 ''${QT_MIN_VERSION} CONFIG REQUIRED COMPONENTS QmlPrivate)
+find_package(QCoro6'
+  '';
+
+  preFixup = ''
+    wrapQtApp $out/bin/plasma-bigscreen-wayland
+  '';
+
+  passthru.providedSessions = [
+    "plasma-bigscreen-wayland"
+  ];
+
+  meta = {
+    description = "Plasma shell for TVs (Plasma Bigscreen)";
+    homepage = "https://plasma-bigscreen.org";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+  };
+}

roles/rclone-mount/default.nix

@@ -0,0 +1,149 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.roles.rclone-mount;
+
+  # Generate systemd service for a single mount
+  mkMountService = name: mountCfg: {
+    description = "rclone mount for ${name}";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    # Wait for parent mount points (e.g., ZFS pools) to be available
+    unitConfig = mkIf (mountCfg.requiresMountsFor != []) {
+      RequiresMountsFor = mountCfg.requiresMountsFor;
+    };
+
+    serviceConfig = {
+      Type = "notify";
+      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${mountCfg.mountPoint}";
+      ExecStart = concatStringsSep " " ([
+        "${pkgs.rclone}/bin/rclone mount"
+        ":webdav:${mountCfg.remotePath}"
+        "${mountCfg.mountPoint}"
+        "--webdav-url=${mountCfg.webdavUrl}"
+        "--webdav-vendor=${mountCfg.webdavVendor}"
+        "--webdav-user=${mountCfg.username}"
+        "--allow-other"
+        "--vfs-cache-mode=${mountCfg.vfsCacheMode}"
+        "--dir-cache-time=${mountCfg.dirCacheTime}"
+        "--poll-interval=${mountCfg.pollInterval}"
+        "--log-level=${mountCfg.logLevel}"
+      ] ++ mountCfg.extraArgs);
+      ExecStop = "${pkgs.fuse}/bin/fusermount -uz ${mountCfg.mountPoint}";
+      Restart = "on-failure";
+      RestartSec = "10s";
+      EnvironmentFile = mountCfg.environmentFile;
+    };
+  };
+in
+{
+  options.roles.rclone-mount = {
+    enable = mkEnableOption "Enable rclone WebDAV mounts";
+
+    mounts = mkOption {
+      type = types.attrsOf (types.submodule {
+        options = {
+          webdavUrl = mkOption {
+            type = types.str;
+            description = "WebDAV server URL (e.g., https://webdav.torbox.app)";
+          };
+
+          webdavVendor = mkOption {
+            type = types.enum [ "other" "nextcloud" "owncloud" "sharepoint" "sharepoint-ntlm" "fastmail" ];
+            default = "other";
+            description = "WebDAV server vendor for optimizations";
+          };
+
+          username = mkOption {
+            type = types.str;
+            description = "WebDAV username (often email address)";
+          };
+
+          environmentFile = mkOption {
+            type = types.path;
+            description = ''
+              Path to environment file containing RCLONE_WEBDAV_PASS.
+              The password should be obscured using: rclone obscure <password>
+              File format: RCLONE_WEBDAV_PASS=<obscured_password>
+            '';
+          };
+
+          mountPoint = mkOption {
+            type = types.str;
+            description = "Local mount point path";
+          };
+
+          remotePath = mkOption {
+            type = types.str;
+            default = "/";
+            description = "Remote path on WebDAV server to mount";
+          };
+
+          vfsCacheMode = mkOption {
+            type = types.enum [ "off" "minimal" "writes" "full" ];
+            default = "full";
+            description = ''
+              VFS cache mode. For streaming media, 'full' is recommended.
+              - off: No caching (direct reads/writes)
+              - minimal: Cache open files only
+              - writes: Cache writes and open files
+              - full: Full caching of all files
+            '';
+          };
+
+          dirCacheTime = mkOption {
+            type = types.str;
+            default = "5m";
+            description = "Time to cache directory entries";
+          };
+
+          pollInterval = mkOption {
+            type = types.str;
+            default = "1m";
+            description = "Poll interval for remote changes";
+          };
+
+          logLevel = mkOption {
+            type = types.enum [ "DEBUG" "INFO" "NOTICE" "ERROR" ];
+            default = "INFO";
+            description = "rclone log level";
+          };
+
+          extraArgs = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            description = "Extra arguments to pass to rclone mount";
+          };
+
+          requiresMountsFor = mkOption {
+            type = types.listOf types.str;
+            default = [];
+            description = ''
+              List of mount points that must be available before this service starts.
+              Use this when the mount point's parent is on a ZFS pool or other filesystem
+              that may not be mounted at boot time.
+              Example: [ "/media" ] to wait for the media ZFS pool to mount.
+            '';
+          };
+        };
+      });
+      default = {};
+      description = "Attribute set of rclone WebDAV mounts to configure";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Ensure FUSE is available
+    environment.systemPackages = [ pkgs.rclone pkgs.fuse ];
+    programs.fuse.userAllowOther = true;
+
+    # Create systemd services for each mount
+    systemd.services = mapAttrs' (name: mountCfg:
+      nameValuePair "rclone-mount-${name}" (mkMountService name mountCfg)
+    ) cfg.mounts;
+  };
+}

roles/remote-build/default.nix

@@ -35,12 +35,12 @@
 #    a) Configure builders in configuration.nix:
 #       roles.remote-build.builders = [
 #         {
-#           hostName = "zix790prors";
+#           hostName = "zix790prors.oglehome";
 #           maxJobs = 16;      # Number of parallel build jobs
 #           speedFactor = 3;   # Higher = prefer this builder
 #         }
 #         {
-#           hostName = "john-endesktop";
+#           hostName = "john-endesktop.oglehome";
 #           maxJobs = 1;       # Conservative for busy machines
 #           speedFactor = 1;
 #         }

roles/virtualisation/default.nix

@@ -13,6 +13,11 @@ in
       default = [ "johno" ];
       description = "List of users to add to the docker group";
     };
+    waydroid = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable waydroid support";
+    };
   };
 
   config = mkIf cfg.enable
@@ -21,5 +26,6 @@ in
       programs.virt-manager.enable = true;
       virtualisation.docker.enable = true;
       users.extraGroups.docker.members = cfg.dockerUsers;
+      virtualisation.waydroid.enable = cfg.waydroid;
     };
 }