feat(steam): configure Quest VR streaming

feat(nixos): migrate AdGuard to Pikachu
fix(shell): reuse sudo session during deployment
2026-10-21 19:27:57 -04:00 · 2026-10-21 18:51:29 -04:00 · 2026-10-21 17:03:42 -04:00 · 2026-10-21 14:33:36 -04:00 · 2026-10-21 12:05:28 -04:00 · 2026-10-21 00:21:07 -04:00
2977 changed files with 246283 additions and 489741 deletions
--- a/.pi/prompts/review.md
+++ b/.pi/prompts/review.md
@@ -17,15 +17,6 @@ If the target includes multiple matching file types, use all matching skills.
 If the target is a diff, choose skills from the changed files.
 Do not use a style skill when no reviewed file matches it.

-For every reviewed `*.nix` file, run:
-
-```bash
-bazel run //src/natu:natu -- <reviewed-nix-paths>
-```
-
-Pass every reviewed Nix path to Natu.
-Report every Natu diagnostic as an actionable finding.
-
 Report only actionable findings.
 Order findings by severity.
 Do not report preferences unless a loaded rule states them.
@@ -45,7 +36,6 @@ Keep the code excerpt to one to three lines when possible.
 Use a longer excerpt only when the violation needs surrounding context.
 Use `...` to omit unrelated lines from a multi-line excerpt.
 Use a style-skill rule citation in the form `skill::rule-file:line`.
-Cite Natu diagnostics as `natu::<rule-id>`.
 Make the fix direct.
 Do not include alternatives when one fix best follows the cited rule.

--- a/.pi/prompts/tldr.md
+++ b/.pi/prompts/tldr.md
@@ -0,0 +1,8 @@
+---
+description: Summarize an agent response
+argument-hint: "[source request]"
+---
+
+Summarize `${ARGUMENTS:-the preceding agent response}`.
+Keep the summary compact.
+Use no fixed format.
--- a/.pi/skills/agent-writing-guide
+++ b/.pi/skills/agent-writing-guide
@@ -0,0 +1 @@
+../../src/skills/agent-writing-guide
--- a/.pi/skills/conventional-commits
+++ b/.pi/skills/conventional-commits
@@ -0,0 +1 @@
+../../src/skills/conventional-commits
--- a/.pi/skills/craft-skill
+++ b/.pi/skills/craft-skill
@@ -1 +0,0 @@
-../../src/skills/craft-skill
--- a/.pi/skills/retrospect
+++ b/.pi/skills/retrospect
@@ -0,0 +1 @@
+../../src/skills/retrospect
--- a/.pi/skills/to-document
+++ b/.pi/skills/to-document
@@ -1 +0,0 @@
-../../src/skills/to-document
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,7 +3,6 @@
 ## Commit convention

 - Use Conventional Commits for all commit messages.
-  Before writing a commit message, read `docs/conventional-commits.md`.
 - Keep commit messages about the Git history, not the forge workflow.
  Include external references only when they are stable context for the change.
 - When writing commit messages, NEVER auto-add your agent name as co-author.
@@ -49,6 +48,8 @@
 - NEVER ask the user a question using the `AskUserQuestion` tool.
  Ask in plain prose, in your own message, instead, with no exceptions.
  This overrides any default instruction to use it.
+- For review requests, inspect the requested material and report findings.
+  Edit files after the operator accepts a proposed change.
 - Never manually modify `CHANGELOG.md` files or files marked as auto-generated.
  Detect auto-generated files with a layered check.
  Trust an explicit in-file marker first, for example `AUTO-GENERATED, DO NOT EDIT`.
@@ -68,20 +69,6 @@
  after applying an accepted change.
  If the workflow is paused, say that plainly instead of using a dangling transition like "continuing" or "next".

-## Corrections
-
- When you discover that your belief about a project fact or convention was wrong, record the correction.
-  Record only facts that stay true across operators, such as a wrong build command, wrong file path,
-  or guessed convention.
-  Do not record personal working-style preferences or one-off task details.
- Record the correction in the nearest project `AGENTS.md`.
-  Use a dedicated `## Gotchas` section.
-  Create that section when the file lacks one.
- If no project `AGENTS.md` exists, ask before creating one.
-  Append the correction immediately without asking when a project `AGENTS.md` exists.
-  Briefly mention the edit in your response.
-  If an existing entry is wrong or stale, correct or remove it the same way.
-
 ## Gotchas

 - When materializing an external specification, standard, or project-maintained convention, use the
@@ -101,17 +88,12 @@
 - Ariadne Rust tests are declared in Bazel `BUILD` files; do not add `[[test]]` entries to
  `src/ariadne/Cargo.toml` unless explicitly requested.
 - In this monorepo, "dotfiles" refers to the dotfiles/NixOS configuration under `src/dotfiles/` and `configs/nixos/`.
- The flake does not currently define `formatter.x86_64-linux`.
-  Do not use `nix fmt` as a validation command until a formatter is added.
 - The `fix` app passes its current directory to Deadnix.
  Run `nix run .#fix` from the repository root so path exclusions match.
- During the Nix refactor, address each issue that comes up by adding either a Natu rule or a new Nix style rule.
 - Git pathspec searches started in a subdirectory default to that subtree.
  Use `git -C <repository-root>` or top-anchored pathspecs for repository-wide history searches.
 - A `**/*.nix` Git pathspec does not include Nix files directly in its starting directory.
  Include both `*.nix` and `**/*.nix`, or use a recursive `*.nix` pathspec, when linting every Nix file.
- Nix `let` bindings are recursive; their source order does not determine binding availability.
-  Treat Natu `let_order` as a readability rule, not an evaluation dependency.
 - Ariadne extraction must preserve the game-root season prefix for archived source.
  Different game installs can contain compiled scripts with the same internal path.
 - Clew owns Ren'Py extraction, preparation, and compiled-script AST export. Ariadne owns analysis over Clew-produced data.
@@ -122,7 +104,13 @@
 - OMP does not discover project skills from `.pi/skills`.
  Put skills shared by Pi and OMP under `.agents/skills`, or configure OMP's `skills.customDirectories`.
 - Pi is vendored under `third_party/pi` as a linear vendor import.
+  `pkgs.alexion.pi-coding-agent` packages that source and does not use Nixpkgs Pi.
  Do not use `git subtree add` or `git subtree pull` for Pi PR branches.
  Gitea rebases the synthetic upstream root commit without the `third_party/pi` prefix.
  Preserve `git-subtree-dir` and `git-subtree-split` trailers on Pi vendor commits.
 - The default Pi model for NixOS user configuration is set in `configs/nixos/modules/shell/pi/default.nix`, not in vendored Pi source.
+- The `monorepo` and `status` libraries do not have `README.md` files.
+- Check root and `src/skills/.pi/skills/` for enabled symlinks before removing a monorepo skill.
+- Ariadne Rust source files live directly under `src/ariadne/`. The binary entry point is `ariadne_main.rs.
+- Bazel build-style rules live under `src/skills/style/build/rules/`, not `src/skills/style/rules/`.
+- Bazel passes arguments after `--` to the executed binary verbatim. A scaffold can define `//path` as a destination-path syntax.
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,15 +2,6 @@
 # It is not intended for manual editing.
 version = 4

-[[package]]
-name = "aho-corasick"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -71,12 +62,6 @@ dependencies = [
 "serde_json",
 ]

-[[package]]
-name = "autocfg"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
-
 [[package]]
 name = "clap"
 version = "4.6.7"
@@ -108,7 +93,7 @@ dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 3.0.6",
+ "syn",
 ]

 [[package]]
@@ -123,41 +108,6 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"

-[[package]]
-name = "countme"
-version = "3.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
-
-[[package]]
-name = "googletest"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6b5e2f2b556b7b90297a5a35c8267dd43a537923d2b329beefdba2b4ec19d94"
-dependencies = [
- "googletest_macro",
- "num-traits",
- "regex",
- "rustversion",
-]
-
-[[package]]
-name = "googletest_macro"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ae6abc96141edd26bf5aeec0f119c129c44de3ced09e5073711a02cb74725d0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -190,27 +140,6 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 name = "monorepo"
 version = "0.1.0"

-[[package]]
-name = "natu"
-version = "0.1.0"
-dependencies = [
- "clap",
- "googletest",
- "monorepo",
- "rnix",
- "rowan",
- "status",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "once_cell_polyfill"
 version = "1.70.2"
@@ -235,68 +164,6 @@ dependencies = [
 "proc-macro2",
 ]

-[[package]]
-name = "regex"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
-
-[[package]]
-name = "rnix"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c163bd17372eecdf10d351c34584b7de7c1a33be4e92a32f3fb3f5a7fe3f579b"
-dependencies = [
- "rowan",
-]
-
-[[package]]
-name = "rowan"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "417a3a9f582e349834051b8a10c8d71ca88da4211e4093528e36b9845f6b5f21"
-dependencies = [
- "countme",
- "hashbrown",
- "rustc-hash",
- "text-size",
-]
-
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
-[[package]]
-name = "rustversion"
-version = "1.0.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
-
 [[package]]
 name = "serde"
 version = "1.0.229"
@@ -324,7 +191,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.6",
+ "syn",
 ]

 [[package]]
@@ -350,17 +217,6 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

-[[package]]
-name = "syn"
-version = "2.0.119"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
 [[package]]
 name = "syn"
 version = "3.0.6"
@@ -372,12 +228,6 @@ dependencies = [
 "unicode-ident",
 ]

-[[package]]
-name = "text-size"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.26"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,16 +4,12 @@ members = [
    "src/machoke",
    "src/monorepo",
    "src/status",
-    "src/natu",
 ]
 resolver = "3"

 [workspace.dependencies]
 clap = "4"
-googletest = "0.14"
 monorepo = { path = "src/monorepo" }
-rnix = "=0.14.0"
-rowan = "0.16"
 serde = "1.0"
 serde_json = "1.0"
 status = { path = "src/status" }
--- a/configs/nixos/AGENTS.md
+++ b/configs/nixos/AGENTS.md
@@ -1,67 +0,0 @@
-# NixOS configuration instructions
-
-## Desktop
-
- TODO: Verify this path after the NixOS configuration is migrated.
-  When adding a graphical application, add a `window-rewrite` icon mapping in `modules/desktop/session/waybar.nix`.
-  The workspace indicator uses this mapping to show an application icon instead of the generic default glyph.
-  Match the mapping on the window class.
-  Run `hyprctl clients -j | jq -r '.[].class' | sort -u` to list classes in the running session.
- TODO: Verify this path after the NixOS configuration is migrated.
-  Set Hyprland session environment variables in `modules/desktop/session/hyprland/default.nix` with `env = KEY,VALUE`.
-  `home.sessionVariables` do **not** reach the Hyprland session because UWSM does not source `hm-session-vars.sh`.
-  Source cursor values from `config.stylix.cursor`.
-  Set `XCURSOR_*` and `HYPRCURSOR_*` to the same theme for Bibata.
-
-## Firefox
-
- Manage Firefox search engines through `programs.firefox.search` with `force = true`.
-  Hide built-in engines with `<engine>.metaData.hidden = true` because omission does not remove them.
-  Use current engine ids, such as `default = "ddg"` instead of `"DuckDuckGo"`.
-  Decode the built `search.json.mozlz4` with `mozlz4a -d <search.json.mozlz4>` to check the result.
- Avoid Home Manager Firefox extension settings unless the whole profile can use the legacy extension-storage backend.
-  Any non-empty `profiles.<name>.extensions.settings.<id>.settings` sets `extensions.webextensions.ExtensionStorageIDB.enabled = false` for the whole profile.
-
-## Neovim
-
- Nixvim's flake input follows the root nixpkgs source, but its Home Manager module does not reuse the host's `pkgs` instance.
-  Keep `programs.nixvim.nixpkgs.useGlobalPackages = true`.
-  That setting makes Nixvim use the shared package set without warning that its source default changed.
-
-## AI tooling
-
- Use produced literals for Herdr key names that include shifted punctuation.
-  For example, use `prefix+<` instead of `prefix+shift+comma`.
- Put monorepo Pi extension sources in `.pi/extensions/`.
-  Pi discovers them from subdirectories through the local ancestor-resource patch.
- Treat Home Manager-managed Pi settings as generated output.
-  Do not edit them except for throwaway development or local experiments.
-  Promote finished settings into the NixOS configuration before treating them as deployed.
-
-## Gotchas
-
- `configs/nixos/registry/stable-uid.nix` receives library functions through `lib`.
-  Qualify its library calls with `lib.`.
- Guest modules are host-agnostic wiring, while host files own deployment-specific service configuration such as served volumes and host paths.
-  For example, `guests/copyparty.nix` should expose options and translate them into guest mounts/service settings, while `hosts/pikachu/default.nix` chooses `/inbox`, `/media`, and their backing paths.
-  Guest addresses and routes are host-level configuration because a guest module can be used on multiple hosts.
- `sops.secrets.<name>.owner` must name a user known on the decrypting host.
-  Do not set the owner to a guest-only service user unless the host also declares that user.
-  Use a host-visible owner plus a shared group mode when the guest service can read the decrypted secret file through its group.
- A read-only guest bind mount cannot contain nested writable bind mounts unless their mount-point
-  directories already exist inside the read-only source.
-  For aggregate Copyparty volumes such as `/srv` with nested `/srv/inbox`, keep the guest bind mount
-  writable and enforce read-only behavior through Copyparty access plus service `ReadWritePaths`.
- `deploy-to` builds from the source checkout, records the imported closure as the target system profile,
-  and activates it. Do not rely on a target-local monorepo checkout for remote deployment.
- On Pikachu, `nix copy --to ssh://pikachu` accepted a small `nix store add-file` probe,
-  but rejected locally built system paths that lacked trusted signatures.
-  Use a sudo `nix-store --import` path for unsigned deploy closures.
- Public DNS entries are not managed through the NixOS configuration.
-  Do not describe NixOS route choices as public-DNS management.
- Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.
-  Generate it on the target system or live ISO, then stage it before evaluating the flake.
- Configure the Chaotic Nyx cache only on hosts that select `linuxPackages_cachyos` (currently Neogaia
-  and Zeus), not in the generic host module.
- Module-relative paths resolve from the module file. Update them when moving a module into a subdirectory.
- On Pikachu, `uptime` does not support `-s`. Use `who -b` to report the boot time.
--- a/configs/nixos/guests/actualbudget.nix
+++ b/configs/nixos/guests/actualbudget.nix
@@ -1,51 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.guests.actualbudget; # NOLINT(let_order)
-  dataDir = "/data";
-in
-{
-  options.guests.actualbudget = {
-    dataPath = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      example = "/srv/actualbudget";
-      description = "Host path bind-mounted as Actual Budget's data directory.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.dataPath != null;
-        message = "guests.actualbudget.dataPath must point at the host directory that stores Actual Budget data.";
-      }
-    ];
-
-    registry.homepage.${config.networking.hostName}.actualbudget = {
-      tab = "Apps";
-      section = "Other";
-      name = "Actual Budget";
-      description = "Finance";
-      icon = "actual-budget.png";
-    };
-
-    guests.actualbudget = {
-      interior = {
-        modules.services.actualbudget = {
-          enable = true;
-          inherit dataDir;
-        };
-      };
-      mounts.${dataDir}.directory = cfg.dataPath;
-      limits = {
-        memory = lib.mkDefault "2G";
-        cpu = lib.mkDefault "200%";
-        tasksMax = lib.mkDefault 512;
-      };
-    };
-  };
-}
--- a/configs/nixos/guests/adguard.nix
+++ b/configs/nixos/guests/adguard.nix
@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  registry,
+  ...
+}:
+let
+  cfg = config.guests.adguard;
+in
+{
+  options.guests.adguard.adminPasswordHash = lib.mkOption {
+    type = lib.types.str;
+    description = "Bcrypt verifier for the AdGuard Home administrator password.";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.address != null;
+        message = "guests.adguard.address must identify the AdGuard Home guest.";
+      }
+    ];
+
+    registry.homepage.${config.networking.hostName}.adguard = {
+      tab = "System";
+      section = "Network";
+      name = "AdGuard Home";
+      description = "Internal DNS";
+      icon = "adguard-home.svg";
+      href = "http://${cfg.address}";
+    };
+
+    guests.adguard = {
+      interior = {
+        modules.services.adguardhome = {
+          enable = true;
+          inherit (cfg) adminPasswordHash;
+          reverseProxyAddress = registry.address.${config.networking.hostName}."reverse-proxy";
+        };
+
+        services.resolved.settings.Resolve.DNSStubListener = false;
+      };
+
+      limits = {
+        memory = lib.mkDefault "256M";
+        cpu = lib.mkDefault "100%";
+        tasksMax = lib.mkDefault 128;
+      };
+    };
+  };
+}
--- a/configs/nixos/guests/copyparty.nix
+++ b/configs/nixos/guests/copyparty.nix
@@ -4,9 +4,32 @@
  ...
 }:
 let
-  cfg = config.guests.copyparty; # NOLINT(let_order)
+  cfg = config.guests.copyparty;
+in
+{
+  options.guests.copyparty = {
+    passwordSecret = lib.mkOption {
+      type = lib.types.str;
+      default = "services/copyparty/users/${config.user.name}/password";
+      description = "SOPS secret name that contains the Copyparty account password.";
+    };

-  volumeType = lib.types.submodule {
+    statePath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/copyparty";
+      description = "Host path bind-mounted as Copyparty's state directory.";
+    };
+
+    reverseProxy.trustedSources = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "IP ranges that may supply Copyparty's forwarded client IP header.";
+    };
+
+    volumes = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
          options = {
            hostPath = lib.mkOption {
              type = lib.types.str;
@@ -31,48 +54,13 @@ let
            };

            flags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
+              type = lib.types.attrs;
+              default = { };
              description = "Copyparty volume flags.";
            };
          };
-  };
-in
-{
-  options.guests.copyparty = {
-    accountName = lib.mkOption {
-      type = lib.types.str;
-      default = "alexion";
-      description = "Copyparty account name configured for password authentication.";
-    };
-
-    passwordSecret = lib.mkOption {
-      type = lib.types.str;
-      default = "services/copyparty/users/alexion/password";
-      description = "SOPS secret name containing the Copyparty account password.";
-    };
-
-    stateDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/copyparty";
-      description = "Guest path where Copyparty stores service state.";
-    };
-
-    statePath = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      example = "/srv/copyparty";
-      description = "Host path bind-mounted as Copyparty's state directory.";
-    };
-
-    reverseProxy.trustedSources = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      description = "IP ranges that may supply Copyparty's forwarded client IP header.";
-    };
-
-    volumes = lib.mkOption {
-      type = lib.types.attrsOf volumeType;
+        }
+      );
      default = { };
      description = "Copyparty volumes keyed by their URL path.";
    };
@@ -102,24 +90,26 @@ in
    guests.copyparty = {
      interior.modules.services.copyparty = {
        enable = true;
-        inherit (cfg) accountName stateDir;
        passwordFile = "/run/secrets/${cfg.passwordSecret}";
        reverseProxy = {
          enable = cfg.reverseProxy.enable;
          inherit (cfg.reverseProxy) trustedSources;
        };
-        volumes = lib.mapAttrs (_urlPath: volume: {
+        volumes = lib.mapAttrs (
+          _urlPath: volume:
+          {
            inherit (volume)
              path
-            access
-            flags
              readOnly
              ;
-        }) cfg.volumes;
+          }
+          // lib.optionalAttrs (volume.access != { }) { inherit (volume) access; }
+          // lib.optionalAttrs (volume.flags != { }) { inherit (volume) flags; }
+        ) cfg.volumes;
      };

      mounts = {
-        ${cfg.stateDir} = {
+        "/var/lib/copyparty" = {
          directory = cfg.statePath;
          owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
          group = "storage";
--- a/configs/nixos/guests/homepage.nix
+++ b/configs/nixos/guests/homepage.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.homepage; # NOLINT(let_order)
+  cfg = config.guests.homepage;
  environmentFile = "/run/secrets/homepage.env";
 in
 {
--- a/configs/nixos/guests/palworld.nix
+++ b/configs/nixos/guests/palworld.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.palworld; # NOLINT(let_order)
+  cfg = config.guests.palworld;
  steamDir = "/data/steamcmd";
  installDir = "/data/server";
  stateDir = "/data/state";
--- a/configs/nixos/guests/reverse-proxy.nix
+++ b/configs/nixos/guests/reverse-proxy.nix
@@ -13,11 +13,6 @@ in
        modules.services.reverse-proxy.enable = true;

        services.nginx.virtualHosts = {
-          "games.alexion.dev" = {
-            forceSSL = true;
-            enableACME = true;
-            locations."/".proxyPass = "http://10.23.20.32";
-          };
          "git.alexion.dev" = {
            forceSSL = true;
            enableACME = true;
--- a/configs/nixos/guests/romm.nix
+++ b/configs/nixos/guests/romm.nix
@@ -0,0 +1,189 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.guests.romm;
+  rommUid = config.registry."stable-uid".${config.networking.hostName}.romm;
+  redisUid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
+in
+{
+  options.guests.romm = {
+    dataPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm";
+      description = "Host path mounted as RomM application data.";
+    };
+
+    postgresqlPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm/postgresql";
+      description = "Host path mounted as RomM's PostgreSQL data.";
+    };
+
+    redisPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm/redis";
+      description = "Host path mounted as RomM's Redis data.";
+    };
+
+    romsPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/roms";
+      description = "Host path mounted as RomM's ROM library.";
+    };
+
+    biosPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/bios";
+      description = "Host path mounted as RomM's BIOS library.";
+    };
+
+    usersPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/romm/users";
+      description = "Host path mounted as RomM's user assets.";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions =
+      map
+        (path: {
+          assertion = path.value != null;
+          message = "guests.romm.${path.name} must point at the host directory that stores ${path.description}.";
+        })
+        [
+          {
+            name = "dataPath";
+            value = cfg.dataPath;
+            description = "RomM application data";
+          }
+          {
+            name = "postgresqlPath";
+            value = cfg.postgresqlPath;
+            description = "RomM PostgreSQL data";
+          }
+          {
+            name = "redisPath";
+            value = cfg.redisPath;
+            description = "RomM Redis data";
+          }
+          {
+            name = "romsPath";
+            value = cfg.romsPath;
+            description = "RomM's ROM library";
+          }
+          {
+            name = "biosPath";
+            value = cfg.biosPath;
+            description = "RomM's BIOS library";
+          }
+          {
+            name = "usersPath";
+            value = cfg.usersPath;
+            description = "RomM's user assets";
+          }
+        ];
+
+    registry.homepage.${config.networking.hostName}.romm = {
+      tab = "Apps";
+      section = "Media";
+      name = "RomM";
+      description = "Games";
+      icon = "romm.png";
+    };
+
+    guests.romm = {
+      interior = {
+        modules.services.romm.enable = true;
+        services.romm.nginx.virtualHost = cfg.reverseProxy.route.domain;
+      };
+
+      mounts = {
+        "/var/lib/romm" = {
+          directory = cfg.dataPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/var/lib/postgresql" = {
+          directory = cfg.postgresqlPath;
+          owner = config.ids.uids.postgres;
+          group = "storage";
+          mode = "0700";
+        };
+        "/var/lib/redis-romm" = {
+          directory = cfg.redisPath;
+          owner = redisUid;
+          group = "storage";
+          mode = "0700";
+        };
+        "/var/lib/romm/library/roms" = {
+          directory = cfg.romsPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/var/lib/romm/library/bios" = {
+          directory = cfg.biosPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/var/lib/romm/assets/users" = {
+          directory = cfg.usersPath;
+          owner = rommUid;
+          group = "storage";
+          mode = "2770";
+        };
+        "/run/secrets/romm.env" = {
+          file = config.sops.templates."romm.env".path;
+          readOnly = true;
+        };
+      };
+
+      limits = {
+        memory = lib.mkDefault "4G";
+        cpu = lib.mkDefault "200%";
+        tasksMax = lib.mkDefault 512;
+      };
+    };
+
+    sops.secrets =
+      lib.genAttrs
+        [
+          "services/romm/igdb/client-id"
+          "services/romm/igdb/client-secret"
+          "services/romm/retroachievements/api-key"
+          "services/romm/screenscraper/user"
+          "services/romm/screenscraper/password"
+          "services/romm/steamgriddb/api-key"
+        ]
+        (_: {
+          sopsFile = ../secrets + "/${config.networking.hostName}.yaml";
+        });
+
+    sops.templates."romm.env" = {
+      owner = "root";
+      group = "storage";
+      mode = "0440";
+      content = ''
+        IGDB_CLIENT_ID=${config.sops.placeholder."services/romm/igdb/client-id"}
+        IGDB_CLIENT_SECRET=${config.sops.placeholder."services/romm/igdb/client-secret"}
+        SCREENSCRAPER_USER=${config.sops.placeholder."services/romm/screenscraper/user"}
+        SCREENSCRAPER_PASSWORD=${config.sops.placeholder."services/romm/screenscraper/password"}
+        RETROACHIEVEMENTS_API_KEY=${config.sops.placeholder."services/romm/retroachievements/api-key"}
+        STEAMGRIDDB_API_KEY=${config.sops.placeholder."services/romm/steamgriddb/api-key"}
+      '';
+    };
+  };
+}
--- a/configs/nixos/guests/valheim.nix
+++ b/configs/nixos/guests/valheim.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.valheim; # NOLINT(let_order)
+  cfg = config.guests.valheim;
  steamDir = "/data/steamcmd";
  installDir = "/data/server";
  stateDir = "/data/state";
--- a/configs/nixos/hosts/neogaia/default.nix
+++ b/configs/nixos/hosts/neogaia/default.nix
@@ -1,5 +1,6 @@
 {
  inputs,
+  util,
  ...
 }:
 # neogaia — Dell XPS 13 9380 laptop.
@@ -14,8 +15,9 @@

  modules.host.cachyos.enable = true;

-  # So wifi can be joined from the console.
-  networking.networkmanager.enable = true;
+  services.xserver.xkb.options = "caps:swapescape";
+
+  modules.network.enable = true;

  registry.address.neogaia.self = "10.23.50.146";

@@ -38,6 +40,24 @@
  modules.desktop.enable = true;
  modules.desktop.apps.firefox.uiScale = "1.25";
  modules.desktop.apps.obsidian.enable = true;
-  modules.desktop.apps.steam.enable = true;
+
+  registry.waybar.neogaia.battery = {
+    order = 70;
+    settings = {
+      format = "{icon} {capacity}%";
+      format-charging = "${util.glyph "f0e7"} {capacity}%";
+      format-icons = [
+        (util.glyph "f244")
+        (util.glyph "f243")
+        (util.glyph "f242")
+        (util.glyph "f241")
+        (util.glyph "f240")
+      ];
+      states = {
+        warning = 20;
+        critical = 10;
+      };
+    };
+  };

 }
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -29,6 +29,14 @@

  registry.address.pikachu.self = "10.23.10.102";

+  guests.adguard = {
+    enable = true;
+    vlan = 20;
+    mac = "bc:24:11:91:60:bf";
+    address = "10.23.20.33";
+    adminPasswordHash = "$2b$12$wariglnrCvJOnh4b8KnB9eDX4RdQRaaTZtyXMUOilaYSn7xTR0g1e";
+  };
+
  guests.valheim = {
    enable = true;
    vlan = 20;
@@ -71,22 +79,6 @@
    };
  };

-  guests.actualbudget = {
-    enable = true;
-    vlan = 20;
-    mac = "BC:24:11:C1:CD:28";
-    dataPath = "/pikachu/data/actualbudget";
-    address = "10.23.20.42";
-    reverseProxy = {
-      enable = true;
-      route = {
-        domain = "budget.alexion.dev";
-        protocol = "https";
-        port = 5006;
-      };
-    };
-  };
-
  guests.navidrome = {
    enable = true;
    vlan = 20;
@@ -104,6 +96,27 @@
    };
  };

+  guests.romm = {
+    enable = true;
+    vlan = 20;
+    address = "10.23.20.112";
+    dataPath = "/pikachu/data/romm";
+    postgresqlPath = "/pikachu/data/romm/postgresql";
+    redisPath = "/pikachu/data/romm/redis";
+    romsPath = "/pikachu/media/games/emulation/roms";
+    biosPath = "/pikachu/media/games/emulation/bios";
+    usersPath = "/pikachu/media/games/emulation/users";
+    reverseProxy = {
+      enable = true;
+      route = {
+        domain = "games.alexion.dev";
+        protocol = "https";
+        port = 80;
+        clientMaxBodySize = "0";
+      };
+    };
+  };
+
  guests.reverse-proxy = {
    enable = true;
    vlan = 20;
@@ -145,35 +158,21 @@
      "/" = {
        hostPath = "/pikachu/data/copyparty/root";
        path = "/srv";
-        access.r = [ "alexion" ];
        readOnly = true;
      };
      "/inbox" = {
        hostPath = "/pikachu/__inbox";
        path = "/pikachu/__inbox";
-        access.A = [ "alexion" ];
-        flags = [
-          "d2d"
-          "d2t"
-          "dthumb"
-        ];
      };
      "/media" = {
        hostPath = "/pikachu/media";
        path = "/pikachu/media";
-        access.A = [ "alexion" ];
-        flags = [
-          "d2d"
-          "d2t"
-          "dthumb"
-        ];
      };
      "/opds" = {
        hostPath = "/pikachu/data/opds";
        path = "/pikachu/data/opds";
-        access.r = [ "alexion" ];
        readOnly = true;
-        flags = [ "opds" ];
+        flags.opds = true;
      };
    };
  };
--- a/configs/nixos/hosts/zeus/default.nix
+++ b/configs/nixos/hosts/zeus/default.nix
@@ -21,7 +21,7 @@
    enable32Bit = true;
  };

-  networking.networkmanager.enable = true;
+  modules.network.enable = true;

  services.logind.settings.Login = {
    HandlePowerKey = "ignore";
@@ -44,6 +44,7 @@
  modules.desktop.enable = true;
  modules.desktop.apps.obsidian.enable = true;
  modules.desktop.apps.r2modman.enable = true;
+  modules.desktop.emulation.enable = true;
  modules.desktop.apps.signal.enable = true;
  modules.desktop.apps.steam.enable = true;
  modules.desktop.apps.vencord.enable = true;
@@ -52,14 +53,14 @@
    {
      output = "HDMI-A-1";
      mode = "1920x1080@120";
-      position = "0x0";
+      position = "-1080x0";
      scale = 1;
      transform = 3;
    }
    {
      output = "DP-3";
      mode = "2560x1440@239.96";
-      position = "1080x0";
+      position = "0x0";
      scale = 1;
    }
  ];
--- a/configs/nixos/modules/desktop/apps/firefox.nix
+++ b/configs/nixos/modules/desktop/apps/firefox.nix
@@ -3,11 +3,12 @@
  inputs,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Configures Firefox as the desktop browser.
 let
-  cfg = config.modules.desktop.apps.firefox; # NOLINT(let_order)
+  cfg = config.modules.desktop.apps.firefox;
 in
 {
  options.modules.desktop.apps.firefox = {
@@ -26,6 +27,11 @@ in
  };

  config = lib.mkIf cfg.enable {
+    registry.window-icon.${config.networking.hostName}.firefox = {
+      class = ".*[Ff]irefox.*";
+      icon = util.glyph "f269";
+    };
+
    home-manager.users.${config.user.name} = hm: {
      programs.firefox = {
        enable = true;
@@ -61,6 +67,8 @@ in

          # Stylix uses a near-white selection background.
          # Use the Nord selection color because its text stays readable.
+          # Home Manager writes extension settings through Firefox's legacy storage backend.
+          # Extension settings disable `ExtensionStorageIDB` for the whole profile.
          extensions.settings."FirefoxColor@mozilla.com".settings.theme.colors.popup_highlight =
            let
              c = hm.config.lib.stylix.colors;
--- a/configs/nixos/modules/desktop/apps/ghostty.nix
+++ b/configs/nixos/modules/desktop/apps/ghostty.nix
@@ -2,6 +2,7 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Ghostty as the desktop terminal.
@@ -16,10 +17,15 @@ in
      keys = "SUPER + Return";
      action = {
        kind = "exec";
-        command = "${pkgs.ghostty}/bin/ghostty";
+        command = lib.getExe pkgs.ghostty;
      };
    };

+    registry.window-icon.${config.networking.hostName}.ghostty = {
+      class = "com.mitchellh.ghostty";
+      icon = util.glyph "f120";
+    };
+
    home-manager.users.${user}.home.packages = [ pkgs.ghostty ];
  };
 }
--- a/configs/nixos/modules/desktop/apps/obsidian.nix
+++ b/configs/nixos/modules/desktop/apps/obsidian.nix
@@ -2,6 +2,7 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Obsidian as the desktop note-taking vault.
@@ -14,5 +15,10 @@ in

  config = lib.mkIf config.modules.desktop.apps.obsidian.enable {
    home-manager.users.${user}.home.packages = [ pkgs.obsidian ];
+
+    registry.window-icon.${config.networking.hostName}.obsidian = {
+      class = "obsidian";
+      icon = util.glyph "f02d";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/apps/signal.nix
+++ b/configs/nixos/modules/desktop/apps/signal.nix
@@ -2,6 +2,7 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Signal desktop messenger.
@@ -13,5 +14,10 @@ in

  config = lib.mkIf config.modules.desktop.apps.signal.enable {
    home-manager.users.${user}.home.packages = [ pkgs.signal-desktop ];
+
+    registry.window-icon.${config.networking.hostName}.signal = {
+      class = "[Ss]ignal";
+      icon = util.glyph "f4ad";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/apps/steam.nix
+++ b/configs/nixos/modules/desktop/apps/steam.nix
@@ -2,6 +2,7 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Steam game launcher and runtime integration.
@@ -13,6 +14,7 @@

    programs.steam = {
      enable = true;
+      remotePlay.openFirewall = true;
      package = pkgs.steam.override {
        extraEnv.STEAM_FORCE_DESKTOPUI_SCALING = "1.5";
      };
@@ -20,8 +22,14 @@

    hardware.steam-hardware.enable = true;

-    environment.systemPackages = [
-      pkgs.gamescope
-    ];
+    programs.gamescope = {
+      enable = true;
+      capSysNice = true;
+    };
+
+    registry.window-icon.${config.networking.hostName}.steam = {
+      class = "[Ss]team";
+      icon = util.glyph "f1b6";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/apps/vencord.nix
+++ b/configs/nixos/modules/desktop/apps/vencord.nix
@@ -2,6 +2,7 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Vesktop, a Discord client with Vencord built in.
@@ -14,5 +15,10 @@ in

  config = lib.mkIf config.modules.desktop.apps.vencord.enable {
    home-manager.users.${user}.home.packages = [ pkgs.vesktop ];
+
+    registry.window-icon.${config.networking.hostName}.vesktop = {
+      class = "[Vv]esktop";
+      icon = util.glyph "f1ff";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/default.nix
+++ b/configs/nixos/modules/desktop/default.nix
@@ -23,5 +23,6 @@
    modules.desktop.utilities.screenshot.enable = lib.mkDefault true;
    modules.desktop.utilities.theming.enable = lib.mkDefault true;
    modules.desktop.utilities.userdirs.enable = lib.mkDefault true;
+    registry.env.${config.networking.hostName}.NIXOS_OZONE_WL = "1";
  };
 }
--- a/configs/nixos/modules/desktop/emulation.nix
+++ b/configs/nixos/modules/desktop/emulation.nix
@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  ...
+}:
+# Shared directories for emulators.
+let
+  user = config.user.name;
+  directory = "/home/${user}/emulation";
+in
+{
+  options.modules.desktop.emulation.enable = lib.mkEnableOption "shared emulation directories";
+
+  config = lib.mkIf config.modules.desktop.emulation.enable {
+    modules.desktop.emulation.retroarch = {
+      enable = lib.mkDefault true;
+      browserDirectory = "${directory}/roms";
+    };
+
+    home-manager.users.${user} = hm: {
+      home.file = {
+        ".config/retroarch/saves".source = hm.config.lib.file.mkOutOfStoreSymlink "${directory}/saves";
+        ".config/retroarch/states".source = hm.config.lib.file.mkOutOfStoreSymlink "${directory}/states";
+        ".config/retroarch/system".source = hm.config.lib.file.mkOutOfStoreSymlink "${directory}/bios";
+      };
+
+      systemd.user.tmpfiles.rules = map (path: "d ${path} 0700 - - -") [
+        directory
+        "${directory}/bios"
+        "${directory}/roms"
+        "${directory}/saves"
+        "${directory}/states"
+      ];
+    };
+  };
+}
--- a/configs/nixos/modules/desktop/emulation/retroarch.nix
+++ b/configs/nixos/modules/desktop/emulation/retroarch.nix
@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  pkgs,
+  util,
+  ...
+}:
+# RetroArch with the selected PlayStation and Sega Saturn cores.
+let
+  cfg = config.modules.desktop.emulation.retroarch;
+  user = config.user.name;
+in
+{
+  options.modules.desktop.emulation.retroarch = {
+    enable = lib.mkEnableOption "RetroArch with PlayStation and Sega Saturn cores";
+
+    browserDirectory = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      description = "Directory where RetroArch starts its content browser.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = {
+      home.packages = [
+        (pkgs.wrapRetroArch {
+          cores = with pkgs.libretro; [
+            beetle-psx-hw
+            beetle-saturn
+          ];
+          settings = {
+            savefiles_in_content_dir = "false";
+            savestates_in_content_dir = "false";
+            system_directory = "/home/${user}/.config/retroarch/system";
+            video_fullscreen = "true";
+            sort_savefiles_enable = "true";
+            sort_savestates_enable = "true";
+            cloud_sync_enable = "true";
+            cloud_sync_driver = "webdav";
+            webdav_url = "https://games.alexion.dev/api/sync/retroarch/";
+            cloud_sync_sync_saves = "true";
+            cloud_sync_sync_configs = "true";
+            cloud_sync_sync_thumbs = "false";
+            cloud_sync_sync_system = "false";
+            cloud_sync_sync_mode = "0";
+            cloud_sync_destructive = "false";
+          }
+          // lib.optionalAttrs (cfg.browserDirectory != "") {
+            rgui_browser_directory = cfg.browserDirectory;
+          };
+        })
+      ];
+
+    };
+
+    registry.window-icon.${config.networking.hostName}.retroarch = {
+      class = "com.libretro.RetroArch";
+      icon = util.glyph "f11b";
+    };
+  };
+}
--- a/configs/nixos/modules/desktop/session/hyprland/default.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/default.nix
@@ -1,6 +1,7 @@
 {
  config,
  lib,
+  util,
  ...
 }:
 # The Hyprland compositor.
@@ -36,6 +37,7 @@
        config = {
          input = {
            kb_layout = config.services.xserver.xkb.layout;
+            kb_options = config.services.xserver.xkb.options;
            repeat_delay = 250;
            repeat_rate = 45;
            accel_profile = "flat";
@@ -63,6 +65,13 @@
          dwindle.preserve_split = true;
        };

+        env = lib.mapAttrsToList (name: value: {
+          _args = [
+            name
+            value
+          ];
+        }) (lib.attrByPath [ config.networking.hostName ] { } config.registry.env);
+
        bind = lib.mapAttrsToList (_name: keybind: {
          _args = [
            keybind.keys
@@ -111,6 +120,9 @@
          ]
          ++ lib.optional keybind.repeating {
            repeating = true;
+          }
+          ++ lib.optional keybind.locked {
+            locked = true;
          };
        }) (lib.attrByPath [ config.networking.hostName ] { } config.registry.keybind);
      };
@@ -217,5 +229,18 @@
        };
      }
    ];
+
+    registry.waybar.${config.networking.hostName}."hyprland/workspaces" = {
+      position = "left";
+      order = 10;
+      settings = {
+        format = "{id} {windows}";
+        format-window-separator = " ";
+        window-rewrite-default = util.glyph "f2d0";
+        window-rewrite = lib.mapAttrs' (
+          _name: windowIcon: lib.nameValuePair "class<${windowIcon.class}>" windowIcon.icon
+        ) (lib.attrByPath [ config.networking.hostName ] { } config.registry.window-icon);
+      };
+    };
  };
 }
--- a/configs/nixos/modules/desktop/session/hyprland/hypridle.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/hypridle.nix
@@ -5,50 +5,32 @@
  ...
 }:
 # hypridle: idle-triggered locking and display power management.
-let
-  cfg = config.modules.desktop.session.hyprland.hypridle; # NOLINT(let_order)
-
-  # The guard drops the call when a locker is already up, so no idle trigger
-  # stacks a second hyprlock over the first.
-  lockCmd = "${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}";
-  user = config.user.name;
-
-  hyprctl = "${config.programs.hyprland.package}/bin/hyprctl";
-  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
-
-in
 {
-  options.modules.desktop.session.hyprland.hypridle = {
-    enable = lib.mkEnableOption "hypridle idle management";
+  options.modules.desktop.session.hyprland.hypridle.enable =
+    lib.mkEnableOption "hypridle idle management";

-    lockTimeout = lib.mkOption {
-      type = lib.types.ints.positive;
-      default = 300;
-      description = "Seconds of inactivity before the screen locks.";
-    };
-
-  };
-
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.hyprland.hypridle.enable {
    # Closing the lid suspends, and every suspend locks first through the
    # before_sleep_cmd below, so the lid always lands at a locked screen.
    services.logind.settings.Login.HandleLidSwitch = "suspend";

-    home-manager.users.${user}.services.hypridle = {
+    home-manager.users.${config.user.name}.services.hypridle = {
      enable = true;

      settings = {
        general = {
-          lock_cmd = lockCmd;
+          # The guard drops the call when a locker is already up, so no idle
+          # trigger stacks a second hyprlock over the first.
+          lock_cmd = "${lib.getExe' pkgs.procps "pidof"} hyprlock || ${lib.getExe pkgs.hyprlock}";
          before_sleep_cmd = "loginctl lock-session";
          # Waking pokes the compositor in case firmware leaves displays dark.
-          after_sleep_cmd = "${hyprctl} dispatch dpms on";
+          after_sleep_cmd = "${lib.getExe' config.programs.hyprland.package "hyprctl"} dispatch 'hl.dsp.dpms({ action = \"enable\" })'";
        };

        listener = [
          # Lock on idle.
          {
-            timeout = cfg.lockTimeout;
+            timeout = 300;
            on-timeout = "loginctl lock-session";
          }
        ];
--- a/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix
@@ -2,44 +2,54 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # The lock screen: a hyprlock session-lock surface the compositor owns.
 let
-  user = config.user.name;
-
-  # The hyprlock this module installs, used by the lock keybind below.
-  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
-
-  sleepIcon = builtins.fromJSON ''"\udb81\udcb2"'';
-  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
+  sleepIcon = util.glyph [
+    "db81"
+    "dcb2"
+  ];
+  sleepOffIcon = util.glyph [
+    "db81"
+    "dcb3"
+  ];

  idleLockToggle = pkgs.writeShellScript "lockscreen-idle-inhibit-toggle" ''
    unit=lockscreen-idle-inhibit.service

    refresh_waybar() {
-      ${pkgs.procps}/bin/pkill -RTMIN+9 waybar >/dev/null 2>&1 || true
+      ${lib.getExe' pkgs.procps "pkill"} -RTMIN+9 waybar >/dev/null 2>&1 || true
    }

-    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet "$unit"; then
-      ${pkgs.systemd}/bin/systemctl --user stop "$unit"
+    if ${lib.getExe' pkgs.systemd "systemctl"} --user is-active --quiet "$unit"; then
+      ${lib.getExe' pkgs.systemd "systemctl"} --user stop "$unit"
      refresh_waybar
-      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepIcon}"
+      ${lib.getExe' pkgs.swayosd "swayosd-client"} --custom-message "${sleepIcon}"
      exit 0
    fi

-    if ${pkgs.systemd}/bin/systemd-run \
+    if ${lib.getExe' pkgs.systemd "systemd-run"} \
      --user \
      --collect \
      --unit=lockscreen-idle-inhibit \
      --description="Disable idle-triggered screen locking" \
-      ${pkgs.systemd}/bin/systemd-inhibit \
+      ${lib.getExe' pkgs.systemd "systemd-inhibit"} \
      --what=idle \
      --who=lockscreen-hotkey \
      --why="lock screen disabled by hotkey" \
-      ${pkgs.coreutils}/bin/sleep infinity >/dev/null; then
+      ${lib.getExe' pkgs.coreutils "sleep"} infinity >/dev/null; then
      refresh_waybar
-      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepOffIcon}"
+      ${lib.getExe' pkgs.swayosd "swayosd-client"} --custom-message "${sleepOffIcon}"
+    fi
+  '';
+
+  idleLockStatus = pkgs.writeShellScript "waybar-idle-lock-status" ''
+    if ${lib.getExe' pkgs.systemd "systemctl"} --user is-active --quiet lockscreen-idle-inhibit.service; then
+      printf '{"text":"${sleepOffIcon}","tooltip":"Idle locking inhibited","class":"inhibited"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
    fi
  '';
 in
@@ -48,7 +58,7 @@ in
    lib.mkEnableOption "the hyprlock lock screen";

  config = lib.mkIf config.modules.desktop.session.hyprland.hyprlock.enable {
-    home-manager.users.${user} = {
+    home-manager.users.${config.user.name} = {
      # Colors and the lock-screen background come from Stylix's hyprlock target,
      # so only geometry and behaviour are set here.
      programs.hyprlock = {
@@ -81,16 +91,36 @@ in
          };
        };
      };
+    };

-      # Lock on Super+X.
-      # The guard drops the keypress when a locker is already up, so a second
-      # hyprlock never stacks over the first.
-      /*
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod, X, exec, ${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}"
-        "$mod CTRL, X, exec, ${idleLockToggle}"
-      ];
-      */
+    registry.keybind.${config.networking.hostName} = {
+      hyprlock-lock = {
+        keys = "SUPER + X";
+        action = {
+          kind = "exec";
+          # The guard drops the call when a locker is already up, so no manual
+          # trigger stacks a second hyprlock over the first.
+          command = "${lib.getExe' pkgs.procps "pidof"} hyprlock || ${lib.getExe pkgs.hyprlock}";
+        };
+      };
+
+      hyprlock-toggle-idle-inhibit = {
+        keys = "SUPER + CTRL + X";
+        action = {
+          kind = "exec";
+          command = "${idleLockToggle}";
+        };
+      };
+    };
+
+    registry.waybar.${config.networking.hostName}."custom/idle-lock" = {
+      order = 20;
+      settings = {
+        return-type = "json";
+        exec = "${idleLockStatus}";
+        interval = "once";
+        signal = 9;
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/login.nix
+++ b/configs/nixos/modules/desktop/session/login.nix
@@ -13,9 +13,13 @@
  config = lib.mkIf config.modules.desktop.session.login.enable {
    services.greetd = {
      enable = true;
-      settings.default_session.command =
-        "${lib.getExe pkgs.tuigreet} --time --remember "
-        + "--cmd 'uwsm start -e -D Hyprland hyprland.desktop'";
+      settings.default_session.command = lib.escapeShellArgs [
+        (lib.getExe pkgs.tuigreet)
+        "--time"
+        "--remember"
+        "--cmd"
+        "${lib.getExe config.programs.uwsm.package} start -e -D Hyprland hyprland.desktop"
+      ];
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/mako.nix
+++ b/configs/nixos/modules/desktop/session/mako.nix
@@ -2,19 +2,29 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # mako as the notification daemon: toasts, a do-not-disturb mode, and history recall.
 let
-  user = config.user.name;
+  dndStatus = pkgs.writeShellScript "waybar-dnd-status" ''
+    if ${lib.getExe' pkgs.mako "makoctl"} mode 2>/dev/null | ${lib.getExe pkgs.gnugrep} -qx dnd; then
+      printf '{"text":"${util.glyph "f1f6"}","tooltip":"Do not disturb: on","class":"dnd"}\n'
+    else
+      printf '{"text":"${util.glyph "f0f3"}","tooltip":"Notifications on","class":"active"}\n'
+    fi
+  '';

-  makoctl = "${pkgs.mako}/bin/makoctl";
+  dndToggle = pkgs.writeShellScript "waybar-dnd-toggle" ''
+    ${lib.getExe' pkgs.mako "makoctl"} mode -t dnd >/dev/null 2>&1
+    ${lib.getExe' pkgs.procps "pkill"} -RTMIN+8 waybar
+  '';
 in
 {
  options.modules.desktop.session.mako.enable = lib.mkEnableOption "the mako notification daemon";

  config = lib.mkIf config.modules.desktop.session.mako.enable {
-    home-manager.users.${user} = {
+    home-manager.users.${config.user.name} = {
      # Colors and the popup font come from Stylix's mako target, so only
      # behaviour is set here.
      services.mako = {
@@ -31,15 +41,25 @@ in
          "mode=dnd".invisible = true;
        };
      };
+    };

-      # Recall the last notification from history, keyboard-only like the rest
-      # of the session.
-      # $mod is defined by the compositor config these binds share.
-      /*
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod, N, exec, ${makoctl} restore"
-      ];
-      */
+    registry.keybind.${config.networking.hostName}.mako-history = {
+      keys = "SUPER + N";
+      action = {
+        kind = "exec";
+        command = "${lib.getExe' pkgs.mako "makoctl"} restore";
+      };
+    };
+
+    registry.waybar.${config.networking.hostName}."custom/dnd" = {
+      order = 80;
+      settings = {
+        return-type = "json";
+        exec = "${dndStatus}";
+        on-click = "${dndToggle}";
+        interval = "once";
+        signal = 8;
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/rofi.nix
+++ b/configs/nixos/modules/desktop/session/rofi.nix
@@ -6,19 +6,17 @@
 }:
 # rofi as the desktop launcher and dmenu-style menu frontend.
 let
-  user = config.user.name;
-
  # A session menu built on the same themed rofi, so the power actions look
  # like every other menu the launcher drives.
  powerMenu = pkgs.writeShellScript "rofi-power-menu" ''
    chosen=$(printf '%s\n' Lock Suspend 'Log out' Reboot 'Shut down' \
-      | ${pkgs.rofi}/bin/rofi -dmenu -i -p Power)
+      | ${lib.getExe pkgs.rofi} -dmenu -i -p Power)
    case "$chosen" in
-      Lock) ${pkgs.systemd}/bin/loginctl lock-session ;;
-      Suspend) ${pkgs.systemd}/bin/systemctl suspend ;;
-      'Log out') ${pkgs.systemd}/bin/loginctl terminate-session "$XDG_SESSION_ID" ;;
-      Reboot) ${pkgs.systemd}/bin/systemctl reboot ;;
-      'Shut down') ${pkgs.systemd}/bin/systemctl poweroff ;;
+      Lock) ${lib.getExe' pkgs.systemd "loginctl"} lock-session ;;
+      Suspend) ${lib.getExe' pkgs.systemd "systemctl"} suspend ;;
+      'Log out') ${lib.getExe' pkgs.systemd "loginctl"} terminate-session "$XDG_SESSION_ID" ;;
+      Reboot) ${lib.getExe' pkgs.systemd "systemctl"} reboot ;;
+      'Shut down') ${lib.getExe' pkgs.systemd "systemctl"} poweroff ;;
    esac
  '';
 in
@@ -26,28 +24,43 @@ in
  options.modules.desktop.session.rofi.enable = lib.mkEnableOption "the rofi launcher";

  config = lib.mkIf config.modules.desktop.session.rofi.enable {
-    home-manager.users.${user} = {
-      # No theme is set here: Stylix's rofi target supplies the Nord one.
+    home-manager.users.${config.user.name} = hm: {
+      # Stylix supplies the Nord theme.
      programs.rofi = {
        enable = true;
-
        # Application launch is the only mode, kept minimal so the prompt opens
        # as fast as rofi can read the desktop entries.
        # Icons are off: resolving one per entry is the bulk of drun's startup.
-        extraConfig = {
+        settings = {
+          font = lib.mkForce "JetBrains Mono 12";
          modi = "drun";
          show-icons = false;
        };
+
+        theme.window = {
+          border = hm.config.lib.formats.rasi.mkLiteral "2px";
+          border-color = hm.config.lib.formats.rasi.mkLiteral "#FFFFFF";
+          border-radius = hm.config.lib.formats.rasi.mkLiteral "8px";
+        };
+      };
    };

-      # The launcher and the session menu, kept next to the tool they drive.
-      # $mod is defined by the compositor config these binds share.
-      /*
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod, R, exec, ${pkgs.rofi}/bin/rofi -show drun"
-        "$mod SHIFT, X, exec, ${powerMenu}"
-      ];
-      */
+    registry.keybind.${config.networking.hostName} = {
+      rofi-launcher = {
+        keys = "SUPER + R";
+        action = {
+          kind = "exec";
+          command = "${lib.getExe pkgs.rofi} -show drun";
+        };
+      };
+
+      rofi-power-menu = {
+        keys = "SUPER + SHIFT + X";
+        action = {
+          kind = "exec";
+          command = "${powerMenu}";
+        };
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/waybar.nix
+++ b/configs/nixos/modules/desktop/session/waybar.nix
@@ -6,97 +6,19 @@
 }:
 # Waybar: a top status bar reading system state at a glance.
 let
-  vpnClient = config.modules.network.vpn-client;
-
-  # A Nerd Font Private-Use-Area codepoint as a literal character, decoded
-  # through JSON so the glyph survives as bytes rather than an editor paste.
-  g = code: builtins.fromJSON ''"\u${code}"'';
-  user = config.user.name;
-
-  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
-
-  # Renders and toggles mako's do-not-disturb mode.
-  # With no mako daemon answering, the status reads "notifications on", keeping
-  # the widget inert rather than broken.
-  dndStatus = pkgs.writeShellScript "waybar-dnd-status" ''
-    if ${pkgs.mako}/bin/makoctl mode 2>/dev/null | ${pkgs.gnugrep}/bin/grep -qx dnd; then
-      printf '{"text":"${g "f1f6"}","tooltip":"Do not disturb: on","class":"dnd"}\n'
-    else
-      printf '{"text":"${g "f0f3"}","tooltip":"Notifications on","class":"active"}\n'
-    fi
-  '';
-
-  dndToggle = pkgs.writeShellScript "waybar-dnd-toggle" ''
-    ${pkgs.mako}/bin/makoctl mode -t dnd >/dev/null 2>&1
-    ${pkgs.procps}/bin/pkill -RTMIN+8 waybar
-  '';
-
-  # Lit while a wf-recorder capture is running.
-  # Empty text collapses the widget when idle, so it shows nothing until then.
-  recStatus = pkgs.writeShellScript "waybar-recording-status" ''
-    if ${pkgs.procps}/bin/pgrep -x wf-recorder >/dev/null; then
-      printf '{"text":"${g "f03d"}","tooltip":"Recording","class":"recording"}\n'
-    else
-      printf '{"text":"","class":"idle"}\n'
-    fi
-  '';
-
-  idleLockStatus = pkgs.writeShellScript "waybar-idle-lock-status" ''
-    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet lockscreen-idle-inhibit.service; then
-      printf '{"text":"${sleepOffIcon}","tooltip":"Idle locking inhibited","class":"inhibited"}\n'
-    else
-      printf '{"text":"","class":"idle"}\n'
-    fi
-  '';
-
-  vpnStatus = pkgs.writeShellScript "waybar-vpn-status" ''
-    interface=${lib.escapeShellArg vpnClient.interface}
-
-    if ! ${pkgs.iproute2}/bin/ip link show dev "$interface" >/dev/null 2>&1; then
-      printf '{"text":"","class":"idle"}\n'
-      exit 0
-    fi
-
-    ipaddr=$(${pkgs.iproute2}/bin/ip -4 -o addr show dev "$interface" | ${pkgs.gawk}/bin/awk '{ print $4; exit }')
-
-    ${pkgs.jq}/bin/jq -cn \
-      --arg text "󰲝" \
-      --arg tooltip "VPN $interface: ''${ipaddr:-no IPv4}" \
-      --arg class "active" \
-      '{ text: $text, tooltip: $tooltip, class: $class }'
-  '';
-
-  networkStatus = pkgs.writeShellScript "waybar-network-status" ''
-    active=$(
-      ${pkgs.networkmanager}/bin/nmcli -t -f DEVICE,TYPE,STATE,CONNECTION device status \
-        | ${pkgs.gawk}/bin/awk -F: '$3 == "connected" && $2 != "loopback" { print; exit }'
+  moduleNames =
+    position:
+    map (entry: entry.name) (
+      lib.sort (left: right: left.module.order < right.module.order) (
+        lib.filter (entry: entry.module.position == position) moduleEntries
      )
+    );

-    if [ -z "$active" ]; then
-      ${pkgs.jq}/bin/jq -cn \
-        --arg text "${g "f127"} off" \
-        --arg tooltip "Network disconnected" \
-        --arg class "disconnected" \
-        '{ text: $text, tooltip: $tooltip, class: $class }'
-      exit 0
-    fi
+  moduleEntries = lib.mapAttrsToList (name: module: {
+    inherit name module;
+  }) modules;

-    IFS=: read -r device type _state connection <<< "$active"
-
-    case "$type" in
-      wifi) icon="${g "f1eb"}" ;;
-      ethernet) icon="LAN" ;;
-      *) icon="NET" ;;
-    esac
-
-    ipaddr=$(${pkgs.iproute2}/bin/ip -4 -o addr show dev "$device" | ${pkgs.gawk}/bin/awk '{ print $4; exit }')
-
-    ${pkgs.jq}/bin/jq -cn \
-      --arg text "$icon $connection" \
-      --arg tooltip "$device: ''${ipaddr:-no IPv4}" \
-      --arg class "$type" \
-      '{ text: $text, tooltip: $tooltip, class: $class }'
-  '';
+  modules = lib.attrByPath [ config.networking.hostName ] { } config.registry.waybar;
 in
 {
  options.modules.desktop.session.waybar.enable = lib.mkEnableOption "the Waybar status bar";
@@ -106,64 +28,35 @@ in
    # codepoints Stylix's monospace font does not carry.
    fonts.packages = [ pkgs.nerd-fonts.symbols-only ];

-    home-manager.users.${user}.programs.waybar = {
+    home-manager.users.${config.user.name}.programs.waybar = {
      enable = true;
+      package = pkgs.alexion.waybar;

      # A user service bound to graphical-session.target, which uwsm activates,
      # so the bar comes up with the session and no compositor exec-once.
      systemd.enable = true;

-      style = ''
-        .modules-right {
-          margin-right: 8px;
-        }
-
-        #custom-dnd {
-          margin-right: 8px;
-        }
-      '';
-
-      settings.mainBar = {
+      settings.mainBar = lib.mkMerge [
+        {
          layer = "top";
          position = "top";
          height = 30;
          spacing = 8;
+          margin-right = 8;

-        modules-left = [ "hyprland/workspaces" ];
-        modules-center = [ "clock" ];
-        modules-right = [
-          "custom/recording"
-          "custom/idle-lock"
-          "mpris"
-          "wireplumber"
-        ]
-        ++ lib.optional vpnClient.enable "custom/vpn"
-        ++ [
-          "custom/network"
-          "battery"
-          "custom/dnd"
+          modules-left = moduleNames "left";
+          modules-center = moduleNames "center";
+          modules-right = moduleNames "right";
+        }
+        (lib.mapAttrs (_name: module: module.settings) modules)
      ];
-
-        # Per-application icons for the windows on each workspace, mapped from
-        # window class with a neutral glyph for anything unlisted.
-        "hyprland/workspaces" = {
-          on-click = "activate";
-          format = "{id} {windows}";
-          format-window-separator = " ";
-          window-rewrite-default = g "f2d0";
-          window-rewrite = {
-            "class<com.mitchellh.ghostty>" = g "f120";
-            "class<.*[Ff]irefox.*>" = g "f269";
-            "class<chromium.*>" = g "f268";
-            "class<[Cc]ode>" = g "f121";
-            "class<obsidian>" = g "f02d";
-            "class<[Ss]ignal>" = g "f4ad";
-            "class<[Ss]team>" = g "f1b6";
-            "class<[Vv]esktop>" = g "f1ff";
-          };
    };

+    registry.waybar.${config.networking.hostName} = {
      clock = {
+        position = "center";
+        order = 10;
+        settings = {
          format = "{:%a %d %b  %H:%M}";
          tooltip-format = "<tt>{calendar}</tt>";
          calendar = {
@@ -172,77 +65,6 @@ in
            format.today = "<b><u>{}</u></b>";
          };
        };
-
-        mpris = {
-          format = "${g "f001"} {title}";
-          format-paused = "${g "f04c"} {title}";
-          max-length = 40;
-          on-click = "play-pause";
-          on-scroll-up = "next";
-          on-scroll-down = "previous";
-        };
-
-        wireplumber = {
-          format = "{icon} {volume}%";
-          format-muted = "${g "f026"} muted";
-          format-icons = [
-            (g "f026")
-            (g "f027")
-            (g "f028")
-          ];
-          on-click = "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-        };
-
-        "custom/vpn" = {
-          return-type = "json";
-          exec = "${vpnStatus}";
-          interval = 5;
-        };
-
-        "custom/network" = {
-          return-type = "json";
-          exec = "${networkStatus}";
-          interval = 5;
-        };
-
-        battery = {
-          format = "{icon} {capacity}%";
-          format-charging = "${g "f0e7"} {capacity}%";
-          format-icons = [
-            (g "f244")
-            (g "f243")
-            (g "f242")
-            (g "f241")
-            (g "f240")
-          ];
-          states = {
-            warning = 20;
-            critical = 10;
-          };
-        };
-
-        "custom/dnd" = {
-          return-type = "json";
-          exec = "${dndStatus}";
-          on-click = "${dndToggle}";
-          interval = "once";
-          signal = 8;
-        };
-
-        # Recording state has no event to hook, so the widget samples the
-        # wf-recorder process once a second.
-        "custom/recording" = {
-          return-type = "json";
-          exec = "${recStatus}";
-          interval = 1;
-        };
-
-        "custom/idle-lock" = {
-          return-type = "json";
-          exec = "${idleLockStatus}";
-          interval = "once";
-          signal = 9;
-        };
      };
    };
  };
--- a/configs/nixos/modules/desktop/utilities/audio.nix
+++ b/configs/nixos/modules/desktop/utilities/audio.nix
@@ -1,5 +1,30 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  util,
+  ...
+}:
 # PipeWire as the desktop audio server.
+let
+  volumeKey = keys: command: {
+    inherit keys;
+    repeating = true;
+    action = {
+      kind = "exec";
+      command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --output-volume ${command}";
+    };
+  };
+
+  mediaKey = keys: command: {
+    inherit keys;
+    locked = true;
+    action = {
+      kind = "exec";
+      command = "${lib.getExe pkgs.playerctl} ${command}";
+    };
+  };
+in
 {
  options.modules.desktop.utilities.audio.enable = lib.mkEnableOption "the PipeWire audio server";

@@ -12,5 +37,50 @@
      alsa.enable = true;
      pulse.enable = true;
    };
+
+    registry.keybind.${config.networking.hostName} = {
+      volume-up = volumeKey "XF86AudioRaiseVolume" "raise --max-volume 100";
+      volume-down = volumeKey "XF86AudioLowerVolume" "lower";
+      mute = {
+        keys = "XF86AudioMute";
+        locked = true;
+        action = {
+          kind = "exec";
+          command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --output-volume mute-toggle";
+        };
+      };
+
+      media-play = mediaKey "XF86AudioPlay" "play-pause";
+      media-next = mediaKey "XF86AudioNext" "next";
+      media-previous = mediaKey "XF86AudioPrev" "previous";
+    };
+
+    registry.waybar.${config.networking.hostName} = {
+      mpris = {
+        order = 30;
+        settings = {
+          format = "${util.glyph "f001"} {title}";
+          format-paused = "${util.glyph "f04c"} {title}";
+          max-length = 40;
+          on-click = "play-pause";
+          on-scroll-up = "next";
+          on-scroll-down = "previous";
+        };
+      };
+
+      wireplumber = {
+        order = 40;
+        settings = {
+          format = "{icon} {volume}%";
+          format-muted = "${util.glyph "f026"} muted";
+          format-icons = [
+            (util.glyph "f026")
+            (util.glyph "f027")
+            (util.glyph "f028")
+          ];
+          on-click = "${lib.getExe' pkgs.wireplumber "wpctl"} set-mute @DEFAULT_AUDIO_SINK@ toggle";
+        };
+      };
+    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/clipboard.nix
+++ b/configs/nixos/modules/desktop/utilities/clipboard.nix
@@ -6,21 +6,15 @@
 }:
 # Clipboard history: cliphist records every copy, picked back through rofi.
 let
-  user = config.user.name;
-
-  cliphist = "${pkgs.cliphist}/bin/cliphist";
-  rofi = "${pkgs.rofi}/bin/rofi";
-  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
-
  # The picker reuses the themed rofi, so history looks like every other menu
  # the launcher drives.
  # decode is needed because list emits id-prefixed lines rather than the copied
  # bytes, so the chosen id has to be resolved back before it can be re-copied.
  picker = pkgs.writeShellScript "clipboard-picker" ''
-    ${cliphist} list \
-      | ${rofi} -dmenu -i -p Clipboard \
-      | ${cliphist} decode \
-      | ${wl-copy}
+    ${lib.getExe pkgs.cliphist} list \
+      | ${lib.getExe pkgs.rofi} -dmenu -i -p Clipboard \
+      | ${lib.getExe pkgs.cliphist} decode \
+      | ${lib.getExe' pkgs.wl-clipboard "wl-copy"}
  '';
 in
 {
@@ -28,7 +22,7 @@ in
    lib.mkEnableOption "cliphist clipboard history";

  config = lib.mkIf config.modules.desktop.utilities.clipboard.enable {
-    home-manager.users.${user} = {
+    home-manager.users.${config.user.name} = {
      # wl-copy and wl-paste on PATH, so the shell can pipe into and out of the
      # clipboard.
      # The watchers and picker above reach wl-clipboard by store path, so this
@@ -38,13 +32,14 @@ in
      # Two watchers record text and images to history, bound to the graphical
      # session so uwsm starts and stops them with it.
      services.cliphist.enable = true;
+    };

-      # $mod is defined by the compositor config these binds share.
-      /*
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod SHIFT, V, exec, ${picker}"
-      ];
-      */
+    registry.keybind.${config.networking.hostName}.clipboard-history = {
+      keys = "SUPER + SHIFT + V";
+      action = {
+        kind = "exec";
+        command = "${picker}";
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/osd.nix
+++ b/configs/nixos/modules/desktop/utilities/osd.nix
@@ -5,9 +5,6 @@
  ...
 }:
 # SwayOSD: a transient on-screen popup for volume and brightness changes.
-let
-  user = config.user.name;
-in
 {
  options.modules.desktop.utilities.osd.enable =
    lib.mkEnableOption "the SwayOSD volume and brightness popup";
@@ -19,21 +16,41 @@ in
    # group write, so the server dims the panel without root.
    # Membership below grants the running session that access.
    services.udev.packages = [ pkgs.swayosd ];
-    users.users.${user}.extraGroups = [ "video" ];
+    users.users.${config.user.name}.extraGroups = [ "video" ];

    # The server draws the popups, so it runs for the whole graphical session.
    # It binds to the target uwsm activates.
-    home-manager.users.${user}.systemd.user.services.swayosd = {
+    home-manager.users.${config.user.name}.systemd.user.services.swayosd = {
      Unit = {
        Description = "SwayOSD on-screen display server";
        PartOf = [ "graphical-session.target" ];
        After = [ "graphical-session.target" ];
      };
      Service = {
-        ExecStart = "${pkgs.swayosd}/bin/swayosd-server";
+        ExecStart = lib.getExe' pkgs.swayosd "swayosd-server";
        Restart = "on-failure";
      };
      Install.WantedBy = [ "graphical-session.target" ];
    };
+
+    registry.keybind.${config.networking.hostName} = {
+      brightness-up = {
+        keys = "XF86MonBrightnessUp";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --brightness raise";
+        };
+      };
+
+      brightness-down = {
+        keys = "XF86MonBrightnessDown";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${lib.getExe' pkgs.swayosd "swayosd-client"} --brightness lower";
+        };
+      };
+    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/recording.nix
+++ b/configs/nixos/modules/desktop/utilities/recording.nix
@@ -2,41 +2,44 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Keybound screen recording: pick a region, then toggle a video-only capture.
 let
-  user = config.user.name;
+  # A single key starts and stops recording.
+  # Waybar refreshes on state changes instead of polling.
+  recordingToggle = pkgs.writeShellScript "screen-record-toggle" ''
+    refresh_waybar() {
+      ${lib.getExe' pkgs.procps "pkill"} -RTMIN+10 waybar >/dev/null 2>&1 || true
+    }

-  slurp = "${pkgs.slurp}/bin/slurp";
-  wf-recorder = "${pkgs.wf-recorder}/bin/wf-recorder";
-  notify-send = "${pkgs.libnotify}/bin/notify-send";
-  pgrep = "${pkgs.procps}/bin/pgrep";
-  pkill = "${pkgs.procps}/bin/pkill";
-  date = "${pkgs.coreutils}/bin/date";
-  mkdir = "${pkgs.coreutils}/bin/mkdir";
-  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";
-
-  # A single key both starts and stops.
-  # A running wf-recorder is stopped with SIGINT so it finalises the file.
-  # Otherwise slurp picks a region and wf-recorder runs in the foreground until
-  # that stop arrives, so this instance lives for the whole recording and then
-  # reports it saved.
-  # No -a means no audio is captured.
-  toggle = pkgs.writeShellScript "screen-record-toggle" ''
-    if ${pgrep} -x wf-recorder >/dev/null; then
-      ${pkill} -INT -x wf-recorder
+    if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
+      ${lib.getExe' pkgs.procps "pkill"} -INT -x wf-recorder
      exit 0
    fi

-    region=$(${slurp}) || exit 0
-    dir="$(${xdgUserDir} VIDEOS)/Recordings"
-    ${mkdir} -p "$dir"
-    file="$dir/recording-$(${date} +%Y%m%d-%H%M%S).mp4"
+    region=$(${lib.getExe pkgs.slurp}) || exit 0
+    dir="$(${lib.getExe' pkgs.xdg-user-dirs "xdg-user-dir"} VIDEOS)/Recordings"
+    ${lib.getExe' pkgs.coreutils "mkdir"} -p "$dir"
+    file="$dir/recording-$(${lib.getExe' pkgs.coreutils "date"} +%Y%m%d-%H%M%S).mp4"

-    ${notify-send} -a "Screen recording" "Recording started" "Region capture, no audio."
-    ${wf-recorder} -g "$region" -f "$file"
-    ${notify-send} -a "Screen recording" "Recording saved" "$file"
+    ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording started" "Region capture, no audio."
+    ${lib.getExe pkgs.wf-recorder} -g "$region" -f "$file" &
+    recorder=$!
+    refresh_waybar
+    wait "$recorder" || true
+    refresh_waybar
+    ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording saved" "$file"
+  '';
+
+  # Empty text collapses the widget when recording is idle.
+  recordingStatus = pkgs.writeShellScript "waybar-recording-status" ''
+    if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
+      printf '{"text":"${util.glyph "f03d"}","tooltip":"Recording","class":"recording"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
+    fi
  '';
 in
 {
@@ -44,13 +47,22 @@ in
    lib.mkEnableOption "wf-recorder screen recording";

  config = lib.mkIf config.modules.desktop.utilities.recording.enable {
-    home-manager.users.${user} = {
-      # $mod is defined by the compositor config these binds share.
-      /*
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod SHIFT, R, exec, ${toggle}"
-      ];
-      */
+    registry.keybind.${config.networking.hostName}.recording-toggle = {
+      keys = "SUPER + SHIFT + R";
+      action = {
+        kind = "exec";
+        command = "${recordingToggle}";
+      };
+    };
+
+    registry.waybar.${config.networking.hostName}."custom/recording" = {
+      order = 10;
+      settings = {
+        return-type = "json";
+        exec = "${recordingStatus}";
+        interval = "once";
+        signal = 10;
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/screenshot.nix
+++ b/configs/nixos/modules/desktop/utilities/screenshot.nix
@@ -7,26 +7,26 @@
 # Keyboard-driven screenshots copy to the clipboard before Satty opens for
 # annotation. Satty copies annotated screenshots when it saves them.
 let
-  user = config.user.name;
-
-  grimblast = "${pkgs.grimblast}/bin/grimblast";
-  satty = "${pkgs.satty}/bin/satty";
-  tee = "${pkgs.coreutils}/bin/tee";
-  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
-  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";
+  screenshotKey = keys: target: {
+    inherit keys;
+    action = {
+      kind = "exec";
+      command = "${capture target}";
+    };
+  };

  # Copy the original screenshot before Satty opens.
  # Satty copies and saves annotated screenshots when the user presses Enter.
  capture =
    target:
    pkgs.writeShellScript "screenshot-${target}" ''
-      dir="$(${xdgUserDir} PICTURES)/Screenshots"
-      mkdir -p "$dir"
-      ${grimblast} save ${target} - \
-        | ${tee} >(${wl-copy}) \
-        | ${satty} --filename - \
+      dir="$(${lib.getExe' pkgs.xdg-user-dirs "xdg-user-dir"} PICTURES)/Screenshots"
+      ${lib.getExe' pkgs.coreutils "mkdir"} -p "$dir"
+      ${lib.getExe pkgs.grimblast} save ${target} - \
+        | ${lib.getExe' pkgs.coreutils "tee"} >(${lib.getExe' pkgs.wl-clipboard "wl-copy"}) \
+        | ${lib.getExe pkgs.satty} --filename - \
          --output-filename "$dir/screenshot-%Y%m%d-%H%M%S.png" \
-          --copy-command ${wl-copy} \
+          --copy-command ${lib.getExe' pkgs.wl-clipboard "wl-copy"} \
          --save-after-copy \
          --early-exit \
          --actions-on-enter save-to-clipboard
@@ -37,27 +37,21 @@ in
    lib.mkEnableOption "screenshots via grimblast and satty";

  config = lib.mkIf config.modules.desktop.utilities.screenshot.enable {
-    home-manager.users.${user} = {
+    home-manager.users.${config.user.name} = {
      # satty is a one-shot annotation surface, so float it rather than letting
      # it claim a tile in the layout.
-      # windowrule v3 syntax: space-separated field/value tokens, comma
-      # separated, with matchers under a match: prefix and effects bare.
-      /*
-      wayland.windowManager.hyprland.settings.windowrule = [
-        "float 1, match:class ^(com\\.gabm\\.satty)$"
+      wayland.windowManager.hyprland.settings.window_rule = [
+        {
+          match.class = "^(com\\.gabm\\.satty)$";
+          float = true;
+        }
      ];
-      */
+    };

-      # Print with plain/Shift/Ctrl for region/window/full.
-      # Super+L is already the hjkl focus and movement bind, so screenshots take
-      # the Print key instead.
-      /*
-      wayland.windowManager.hyprland.settings.bind = [
-        ", Print, exec, ${capture "area"}"
-        "SHIFT, Print, exec, ${capture "active"}"
-        "CTRL, Print, exec, ${capture "screen"}"
-      ];
-      */
+    registry.keybind.${config.networking.hostName} = {
+      screenshot-area = screenshotKey "Print" "area";
+      screenshot-active = screenshotKey "SHIFT + Print" "active";
+      screenshot-screen = screenshotKey "CTRL + Print" "screen";
    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/theming.nix
+++ b/configs/nixos/modules/desktop/utilities/theming.nix
@@ -6,15 +6,13 @@
 }:
 # Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
 let
-
  # A single static Nord wallpaper, drawn as a vertical gradient across the
  # Polar Night shades so it needs no committed binary and no network fetch.
  wallpaper = pkgs.runCommand "nord-wallpaper.png" { } ''
-    ${pkgs.imagemagick}/bin/magick \
+    ${lib.getExe pkgs.imagemagick} \
      -size 2560x1440 gradient:'#2E3440'-'#3B4252' \
      "$out"
  '';
-  user = config.user.name;
 in
 {
  options.modules.desktop.utilities.theming.enable =
@@ -59,7 +57,7 @@ in
      };
    };

-    home-manager.users.${user} = {
+    home-manager.users.${config.user.name} = {
      # Stylix drives the cursor through home-manager's pointer-cursor config,
      # whose generation must be switched on explicitly.
      home.pointerCursor.enable = true;
@@ -68,5 +66,10 @@ in
      # base16 mapping Stylix would apply, so its target stays off.
      stylix.targets.nixvim.enable = false;
    };
+
+    registry.env.${config.networking.hostName} = {
+      HYPRCURSOR_THEME = config.stylix.cursor.name;
+      HYPRCURSOR_SIZE = toString config.stylix.cursor.size;
+    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/userdirs.nix
+++ b/configs/nixos/modules/desktop/utilities/userdirs.nix
@@ -1,14 +1,27 @@
 { config, lib, ... }:
-# Declares the XDG user directories, so a tool that queries them lands in a
-# well-known folder a host can relocate from one place.
+# Declares XDG user directories, so tools that query them use predictable
+# folders a host can relocate from one place.
 let
-  user = config.user.name;
+  homeDirectory = "/home/${config.user.name}";
 in
 {
  options.modules.desktop.utilities.userdirs.enable = lib.mkEnableOption "XDG user directories";

  config = lib.mkIf config.modules.desktop.utilities.userdirs.enable {
-    # Write ~/.config/user-dirs.dirs from the option defaults.
-    home-manager.users.${user}.xdg.userDirs.enable = true;
+    home-manager.users.${config.user.name}.xdg.userDirs = {
+      enable = true;
+      createDirectories = true;
+      setSessionVariables = true;
+
+      desktop = "${homeDirectory}/.ignoreme";
+      documents = "${homeDirectory}/docs";
+      download = "${homeDirectory}/dwn";
+      music = "${homeDirectory}/mus";
+      pictures = "${homeDirectory}/pic";
+      publicShare = "${homeDirectory}/.ignoreme";
+      templates = "${homeDirectory}/.ignoreme";
+      videos = "${homeDirectory}/vid";
+      projects = "${homeDirectory}/.ignoreme";
+    };
  };
 }
--- a/configs/nixos/modules/host/default.nix
+++ b/configs/nixos/modules/host/default.nix
@@ -53,6 +53,7 @@ in
        home.username = config.user.name;
        home.homeDirectory = "/home/${config.user.name}";
        home.stateVersion = config.system.stateVersion;
+        home.sessionVariables = lib.attrByPath [ config.networking.hostName ] { } config.registry.env;
        home.packages = with pkgs; [
          eza
          unzip
--- a/configs/nixos/modules/host/zfs.nix
+++ b/configs/nixos/modules/host/zfs.nix
@@ -5,7 +5,7 @@
 }:
 # Imports existing ZFS pools that hold durable service state.
 let
-  cfg = config.modules.host.zfs; # NOLINT(let_order)
+  cfg = config.modules.host.zfs;
 in
 {
  options.modules.host.zfs = {
--- a/configs/nixos/modules/network/default.nix
+++ b/configs/nixos/modules/network/default.nix
@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  util,
+  ...
+}:
+# NetworkManager-managed networking.
+let
+  networkStatus = pkgs.writeShellScript "waybar-network-status" ''
+    active=$(
+      ${lib.getExe' pkgs.networkmanager "nmcli"} -t -f DEVICE,TYPE,STATE,CONNECTION device status \
+        | ${lib.getExe' pkgs.gawk "awk"} -F: '$3 == "connected" && $2 != "loopback" { print; exit }'
+    )
+
+    if [ -z "$active" ]; then
+      ${lib.getExe pkgs.jq} -cn \
+        --arg text "${util.glyph "f127"} off" \
+        --arg tooltip "Network disconnected" \
+        --arg class "disconnected" \
+        '{ text: $text, tooltip: $tooltip, class: $class }'
+      exit 0
+    fi
+
+    IFS=: read -r device type _state connection <<< "$active"
+
+    case "$type" in
+      wifi) icon="${util.glyph "f1eb"}" ;;
+      ethernet) icon="LAN" ;;
+      *) icon="NET" ;;
+    esac
+
+    ipaddr=$(${lib.getExe' pkgs.iproute2 "ip"} -4 -o addr show dev "$device" | ${lib.getExe' pkgs.gawk "awk"} '{ print $4; exit }')
+
+    ${lib.getExe pkgs.jq} -cn \
+      --arg text "$icon $connection" \
+      --arg tooltip "$device: ''${ipaddr:-no IPv4}" \
+      --arg class "$type" \
+      '{ text: $text, tooltip: $tooltip, class: $class }'
+  '';
+in
+{
+  options.modules.network.enable = lib.mkEnableOption "NetworkManager-managed networking";
+
+  config = lib.mkIf config.modules.network.enable {
+    networking.networkmanager.enable = true;
+
+    registry.waybar.${config.networking.hostName}."custom/network" = {
+      order = 60;
+      settings = {
+        return-type = "json";
+        exec = "${networkStatus}";
+        interval = 5;
+      };
+    };
+  };
+}
--- a/configs/nixos/modules/network/ssh.nix
+++ b/configs/nixos/modules/network/ssh.nix
@@ -7,19 +7,17 @@
 # Configures inbound and outbound SSH access.
 let
  cfg = config.modules.network.ssh;
-  user = config.user.name; # NOLINT(let_order)
+  user = config.user.name;

-  # NOLINT(let_order)
  workstationNames = [
    "neogaia"
    "zeus"
  ];
  serverNames = [ "pikachu" ];

-  isWorkstation = lib.elem config.networking.hostName workstationNames; # NOLINT(let_order)
-  isServer = lib.elem config.networking.hostName serverNames; # NOLINT(let_order)
+  isWorkstation = lib.elem config.networking.hostName workstationNames;
+  isServer = lib.elem config.networking.hostName serverNames;

-  # NOLINT(let_order)
  clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
  hostKeysFor =
    host:
@@ -28,7 +26,6 @@ let
      (../../hosts + "/${host}/ssh_host_rsa_key.pub")
    ];

-  # NOLINT(let_order)
  managedTargets = lib.genAttrs (workstationNames ++ serverNames) (name: {
    hostName = registry.address.${name}.self;
    clientKey = clientKeyFor name;
@@ -48,7 +45,6 @@ let
    };
  };

-  # NOLINT(let_order)
  mkTarget = name: target: {
    hostName = target.hostName or name;
    user = target.user or user;
@@ -57,15 +53,14 @@ let
    clientKey = target.clientKey or null;
    hostKeys = target.hostKeys or [ ];
  };
-  targets = lib.mapAttrs mkTarget (managedTargets // extraTargets); # NOLINT(let_order)
+  targets = lib.mapAttrs mkTarget (managedTargets // extraTargets);

-  clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names); # NOLINT(let_order)
-  # NOLINT(let_order)
+  clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names);
  defaultAuthorizedKeys = lib.flatten (
    clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
  );

-  outboundTargetNames = # NOLINT(let_order)
+  outboundTargetNames =
    let
      groupTargets =
        if isServer then
--- a/configs/nixos/modules/network/vlans.nix
+++ b/configs/nixos/modules/network/vlans.nix
@@ -6,7 +6,7 @@
 }:
 # Configures bridges for tagged VLANs on a physical interface that uses DHCP.
 let
-  cfg = config.modules.network.vlans; # NOLINT(let_order)
+  cfg = config.modules.network.vlans;
 in
 {
  options.modules.network.vlans = {
--- a/configs/nixos/modules/network/vpn-client.nix
+++ b/configs/nixos/modules/network/vpn-client.nix
@@ -1,10 +1,34 @@
 {
  config,
  lib,
+  pkgs,
+  util,
  ...
 }:
 let
-  cfg = config.modules.network.vpn-client; # NOLINT(let_order)
+  cfg = config.modules.network.vpn-client;
+
+  vpnIcon = util.glyph [
+    "db83"
+    "dc9d"
+  ];
+
+  vpnStatus = pkgs.writeShellScript "waybar-vpn-status" ''
+    interface=${lib.escapeShellArg cfg.interface}
+
+    if ! ${lib.getExe' pkgs.iproute2 "ip"} link show dev "$interface" >/dev/null 2>&1; then
+      printf '{"text":"","class":"idle"}\n'
+      exit 0
+    fi
+
+    ipaddr=$(${lib.getExe' pkgs.iproute2 "ip"} -4 -o addr show dev "$interface" | ${lib.getExe' pkgs.gawk "awk"} '{ print $4; exit }')
+
+    ${lib.getExe pkgs.jq} -cn \
+      --arg text "${vpnIcon}" \
+      --arg tooltip "VPN $interface: ''${ipaddr:-no IPv4}" \
+      --arg class "active" \
+      '{ text: $text, tooltip: $tooltip, class: $class }'
+  '';
 in
 {
  options.modules.network.vpn-client = {
@@ -57,6 +81,15 @@ in
      vpn-off = "sudo systemctl stop 'wireguard-${cfg.interface}*.service' wireguard-${cfg.interface}.target";
    };

+    registry.waybar.${config.networking.hostName}."custom/vpn" = {
+      order = 50;
+      settings = {
+        return-type = "json";
+        exec = "${vpnStatus}";
+        interval = 5;
+      };
+    };
+
    systemd.targets."wireguard-${cfg.interface}".wantedBy = lib.mkForce [ ];

    networking.wireguard.interfaces.${cfg.interface} = {
--- a/configs/nixos/modules/services/actualbudget.nix
+++ b/configs/nixos/modules/services/actualbudget.nix
@@ -1,62 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.modules.services.actualbudget; # NOLINT(let_order)
-in
-{
-  options.modules.services.actualbudget = {
-    enable = lib.mkEnableOption "Actual Budget";
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 5006;
-      description = "Port Actual Budget listens on.";
-    };
-
-    dataDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/data";
-      description = "Directory where Actual Budget stores server and user files.";
-    };
-
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "actual";
-      description = "User account that runs Actual Budget.";
-    };
-
-    group = lib.mkOption {
-      type = lib.types.str;
-      default = "storage";
-      description = "Group account that owns Actual Budget's writable state.";
-    };
-
-  };
-
-  config = lib.mkMerge [
-    {
-      registry."stable-uid".${config.networking.hostName}.actualbudget = 20001;
-    }
-
-    (lib.mkIf cfg.enable {
-      users.users.${cfg.user} = {
-        isSystemUser = true;
-        uid = config.registry."stable-uid".${config.networking.hostName}.actualbudget;
-        inherit (cfg) group;
-      };
-
-      services.actual = {
-        enable = true;
-        openFirewall = true;
-        inherit (cfg) user;
-        inherit (cfg) group;
-        settings = {
-          inherit (cfg) port dataDir;
-        };
-      };
-    })
-  ];
-}
--- a/configs/nixos/modules/services/adguardhome.nix
+++ b/configs/nixos/modules/services/adguardhome.nix
@@ -0,0 +1,277 @@
+{ config, lib, ... }:
+let
+  cfg = config.modules.services.adguardhome;
+in
+{
+  options.modules.services.adguardhome = {
+    enable = lib.mkEnableOption "AdGuard Home";
+
+    adminPasswordHash = lib.mkOption {
+      type = lib.types.str;
+      description = "Bcrypt verifier for the AdGuard Home administrator password.";
+    };
+
+    reverseProxyAddress = lib.mkOption {
+      type = lib.types.str;
+      description = "IP address of the guest that handles internal HTTP requests.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.adguardhome = {
+      enable = true;
+      mutableSettings = false;
+      openFirewall = true;
+      settings = {
+        http = {
+          pprof = {
+            port = 6060;
+            enabled = false;
+          };
+          address = "0.0.0.0:80";
+          session_ttl = "720h";
+        };
+        users = [
+          {
+            name = config.user.name;
+            password = cfg.adminPasswordHash;
+          }
+        ];
+        auth_attempts = 5;
+        block_auth_min = 15;
+        http_proxy = "";
+        language = "";
+        theme = "auto";
+
+        dns = {
+          bind_hosts = [ "0.0.0.0" ];
+          port = 53;
+          anonymize_client_ip = false;
+          ratelimit = 20;
+          ratelimit_subnet_len_ipv4 = 24;
+          ratelimit_subnet_len_ipv6 = 56;
+          ratelimit_whitelist = [ ];
+          refuse_any = true;
+          upstream_dns = [
+            "https://dns.cloudflare.com/dns-query"
+            "tls://1.1.1.1"
+            "https://dns.google/dns-query"
+            "tls://8.8.8.8"
+            "https://dns10.quad9.net/dns-query"
+            "tls://9.9.9.9"
+          ];
+          upstream_dns_file = "";
+          bootstrap_dns = [
+            "9.9.9.10"
+            "149.112.112.10"
+            "2620:fe::10"
+            "2620:fe::fe:10"
+          ];
+          fallback_dns = [ ];
+          upstream_mode = "parallel";
+          fastest_timeout = "1s";
+          allowed_clients = [ ];
+          disallowed_clients = [ ];
+          blocked_hosts = [
+            "version.bind"
+            "id.server"
+            "hostname.bind"
+          ];
+          trusted_proxies = [
+            "127.0.0.0/8"
+            "::1/128"
+          ];
+          cache_enabled = true;
+          cache_size = 4194304;
+          cache_ttl_min = 0;
+          cache_ttl_max = 0;
+          cache_optimistic = false;
+          cache_optimistic_answer_ttl = "30s";
+          cache_optimistic_max_age = "12h";
+          bogus_nxdomain = [ ];
+          aaaa_disabled = false;
+          enable_dnssec = false;
+          edns_client_subnet = {
+            custom_ip = "";
+            enabled = false;
+            use_custom = false;
+          };
+          max_goroutines = 300;
+          handle_ddr = true;
+          ipset = [ ];
+          ipset_file = "";
+          bootstrap_prefer_ipv6 = false;
+          upstream_timeout = "10s";
+          private_networks = [ ];
+          use_private_ptr_resolvers = true;
+          local_ptr_upstreams = [ ];
+          use_dns64 = false;
+          dns64_prefixes = [ ];
+          serve_http3 = false;
+          use_http3_upstreams = false;
+          serve_plain_dns = true;
+          hostsfile_enabled = true;
+          pending_requests.enabled = true;
+        };
+
+        tls = {
+          enabled = false;
+          server_name = "";
+          force_https = false;
+          port_https = 443;
+          port_dns_over_tls = 853;
+          port_dns_over_quic = 853;
+          port_dnscrypt = 0;
+          dnscrypt_config_file = "";
+          allow_unencrypted_doh = false;
+          certificate_chain = "";
+          private_key = "";
+          certificate_path = "";
+          private_key_path = "";
+          strict_sni_check = false;
+        };
+
+        querylog = {
+          dir_path = "";
+          ignored = [ ];
+          interval = "2160h";
+          size_memory = 1000;
+          enabled = true;
+          ignored_enabled = false;
+          file_enabled = true;
+        };
+
+        statistics = {
+          dir_path = "";
+          ignored = [ ];
+          interval = "24h";
+          enabled = true;
+          ignored_enabled = false;
+        };
+
+        filters = [
+          {
+            enabled = true;
+            url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt";
+            name = "AdGuard DNS filter";
+            id = 1;
+          }
+          {
+            enabled = false;
+            url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt";
+            name = "AdAway Default Blocklist";
+            id = 2;
+          }
+        ];
+        whitelist_filters = [ ];
+        user_rules = [ ];
+
+        dhcp = {
+          enabled = false;
+          interface_name = "";
+          local_domain_name = "lan";
+          dhcpv4 = {
+            gateway_ip = "";
+            subnet_mask = "";
+            range_start = "";
+            range_end = "";
+            lease_duration = 86400;
+            icmp_timeout_msec = 1000;
+            options = [ ];
+          };
+          dhcpv6 = {
+            range_start = "";
+            lease_duration = 86400;
+            ra_slaac_only = false;
+            ra_allow_slaac = false;
+          };
+        };
+
+        filtering = {
+          blocking_ipv4 = "";
+          blocking_ipv6 = "";
+          blocked_services = {
+            schedule.time_zone = "Local";
+            ids = [ ];
+          };
+          protection_disabled_until = null;
+          safe_search = {
+            enabled = false;
+            bing = true;
+            duckduckgo = true;
+            ecosia = true;
+            google = true;
+            pixabay = true;
+            yandex = true;
+            youtube = true;
+          };
+          blocking_mode = "default";
+          parental_block_host = "family-block.dns.adguard.com";
+          safebrowsing_block_host = "standard-block.dns.adguard.com";
+          rewrites = [
+            {
+              domain = "*.home";
+              answer = "10.23.20.32";
+              enabled = true;
+            }
+            {
+              domain = "*.alexion.dev";
+              answer = cfg.reverseProxyAddress;
+              enabled = true;
+            }
+            {
+              domain = "home";
+              answer = cfg.reverseProxyAddress;
+              enabled = true;
+            }
+          ];
+          safe_fs_patterns = [ "/opt/AdGuardHome/userfilters/*" ];
+          safebrowsing_cache_size = 1048576;
+          safesearch_cache_size = 1048576;
+          parental_cache_size = 1048576;
+          cache_time = 30;
+          filters_update_interval = 24;
+          blocked_response_ttl = 10;
+          filtering_enabled = true;
+          rewrites_enabled = true;
+          parental_enabled = false;
+          safebrowsing_enabled = false;
+          protection_enabled = true;
+        };
+
+        clients = {
+          runtime_sources = {
+            whois = true;
+            arp = true;
+            rdns = true;
+            dhcp = true;
+            hosts = true;
+          };
+          persistent = [ ];
+        };
+
+        log = {
+          enabled = true;
+          file = "";
+          max_backups = 0;
+          max_size = 100;
+          max_age = 3;
+          compress = false;
+          local_time = false;
+          verbose = false;
+        };
+
+        os = {
+          group = "";
+          user = "";
+          rlimit_nofile = 0;
+        };
+      };
+    };
+
+    networking.firewall = {
+      allowedTCPPorts = [ 53 ];
+      allowedUDPPorts = [ 53 ];
+    };
+  };
+}
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty.nix
@@ -2,16 +2,105 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 let
-  cfg = config.modules.services.copyparty; # NOLINT(let_order)
+  cfg = config.modules.services.copyparty;

-  volumeType = lib.types.submodule {
+  accountName = config.user.name;
+
+  serviceGroup = "storage";
+
+  serviceStateDir = "/var/lib/copyparty";
+
+  serviceUser = "copyparty";
+
+  writableVolumes = lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes);
+
+  port = 3923;
+  defaultAccess = {
+    A = [ accountName ];
+  };
+
+  defaultWritableFlags = {
+    d2d = true;
+    d2t = true;
+    dthumb = true;
+  };
+
+  credentialHash = builtins.substring 0 16 (builtins.hashString "sha256" accountName);
+
+  credentialName = "password-${credentialHash}";
+
+  passwordPlaceholder = "@COPYPARTY_PASSWORD_${credentialHash}@";
+
+  globalSettings = {
+    i = "0.0.0.0";
+    usernames = true;
+    "http-only" = true;
+    "no-crt" = true;
+    "no-thumb" = true;
+    "no-snap" = true;
+    "no-rescan" = true;
+    "ses-db" = "${serviceStateDir}/sessions.db";
+    "chpw-db" = "${serviceStateDir}/chpw.json";
+    "shr-db" = "${serviceStateDir}/shares.db";
+  }
+  // lib.optionalAttrs cfg.reverseProxy.enable {
+    rproxy = 1;
+    "xff-hdr" = "x-forwarded-for";
+  };
+
+  globalExtraConfig = lib.optionalString cfg.reverseProxy.enable (
+    lib.concatMapStringsSep "\n" (source: "xff-src: ${source}") cfg.reverseProxy.trustedSources
+  );
+
+  volumeFlags =
+    flags:
+    lib.optionalAttrs (flags != { }) (
+      {
+        chmod_d = "2770";
+        chmod_f = "660";
+      }
+      // flags
+    );
+
+  renderedVolumes = lib.mapAttrs (_urlPath: volume: {
+    inherit (volume) path;
+    access = if volume.readOnly then { r = [ accountName ]; } else defaultAccess // volume.access;
+    flags = volumeFlags (lib.optionalAttrs (!volume.readOnly) defaultWritableFlags // volume.flags);
+  }) cfg.volumes;
+
+  configText = util.formats.copyparty.render {
+    inherit globalExtraConfig;
+    accounts.${accountName} = passwordPlaceholder;
+    global = globalSettings;
+    volumes = renderedVolumes;
+  };
+
+  configFile = pkgs.writeText "copyparty.conf" configText;
+
+  replacePassword = ''
+    ${lib.getExe pkgs.replace-secret} ${lib.escapeShellArg passwordPlaceholder} "$CREDENTIALS_DIRECTORY/${credentialName}" /run/copyparty/copyparty.conf
+  '';
+in
+{
+  options.modules.services.copyparty = {
+    enable = lib.mkEnableOption "Copyparty";
+
+    passwordFile = lib.mkOption {
+      type = lib.types.str;
+      description = "Sets the runtime file that contains the Copyparty account password.";
+    };
+
+    volumes = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
          options = {
            path = lib.mkOption {
-        type = lib.types.str;
-        description = "Filesystem path served by this volume.";
+              type = lib.types.externalPath;
+              description = "Sets the filesystem path served by this volume.";
            };

            access = lib.mkOption {
@@ -20,129 +109,28 @@ let
              example = {
                A = [ "alexion" ];
              };
-        description = "Copyparty access map from permission string to account names.";
+              description = "Maps Copyparty permission strings to account names.";
            };

            readOnly = lib.mkOption {
              type = lib.types.bool;
              default = false;
-        description = "Serve this volume read-only.";
+              description = "Serves this volume read-only.";
            };

            flags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        example = [ "dthumb" ];
-        description = "Copyparty volume flags.";
-      };
-    };
-  };
-
-  configScript = pkgs.writeShellScript "copyparty-config" ''
-    set -eu
-
-    umask 077
-    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
-
-    cat > /run/copyparty/copyparty.conf <<EOF
-    [global]
-      p: ${toString cfg.port}
-      usernames
-      http-only
-      no-crt
-      no-thumb
-      no-snap
-      no-rescan
-      ses-db: ${cfg.stateDir}/sessions.db
-      chpw-db: ${cfg.stateDir}/chpw.json
-      shr-db: ${cfg.stateDir}/shares.db
-    ${renderedReverseProxy}
-    [accounts]
-      ${cfg.accountName}: $password
-
-    ${renderedVolumes}
-    EOF
-  '';
-  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
-
-  hasFlag =
-    name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
-
-  defaultPermissionFlags =
-    flags:
-    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
-    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
-
-  renderFlags =
-    flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
-
-  renderVolume = urlPath: volume: ''
-    [${urlPath}]
-      ${volume.path}
-      accs:
-    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
-    ${lib.optionalString (volume.flags != [ ]) ''
-        flags:
-      ${renderFlags volume.flags}
-    ''}
-  '';
-
-  renderTrustedSource = source: "  xff-src: ${source}";
-
-  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
-      rproxy: 1
-      xff-hdr: x-forwarded-for
-    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
-  '';
-
-  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
-
-in
-{
-  options.modules.services.copyparty = {
-    enable = lib.mkEnableOption "Copyparty";
-
-    package = lib.mkPackageOption pkgs "copyparty-min" { };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 3923;
-      description = "Port Copyparty listens on.";
-    };
-
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "copyparty";
-      description = "User account that runs Copyparty.";
-    };
-
-    group = lib.mkOption {
-      type = lib.types.str;
-      default = "storage";
-      description = "Group account that owns Copyparty's writable state and served files.";
-    };
-
-    accountName = lib.mkOption {
-      type = lib.types.str;
-      default = "alexion";
-      description = "Copyparty account name configured for password authentication.";
-    };
-
-    passwordFile = lib.mkOption {
-      type = lib.types.path;
-      description = "Runtime file containing the Copyparty account password.";
-    };
-
-    stateDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/copyparty";
-      description = "Directory where Copyparty stores service state.";
-    };
-
-    volumes = lib.mkOption {
-      type = lib.types.attrsOf volumeType;
+              type = lib.types.attrs;
              default = { };
-      description = "Copyparty volumes keyed by their URL path.";
+              example = {
+                dthumb = true;
+              };
+              description = "Sets Copyparty volume flags.";
+            };
+          };
+        }
+      );
+      default = { };
+      description = "Defines Copyparty volumes by URL path.";
    };

    reverseProxy = {
@@ -151,7 +139,7 @@ in
      trustedSources = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
-        description = "IP ranges that may supply Copyparty's forwarded client IP header.";
+        description = "Lists proxy sources that can set Copyparty's forwarded client IP header.";
      };
    };
  };
@@ -173,46 +161,49 @@ in
        }
      ];

-      users.users.${cfg.user} = {
+      users.users.${serviceUser} = {
        isSystemUser = true;
        uid = config.registry."stable-uid".${config.networking.hostName}.copyparty;
-        inherit (cfg) group;
-        home = cfg.stateDir;
+        group = serviceGroup;
+        home = serviceStateDir;
      };

      systemd.services.copyparty = {
        description = "Copyparty file server";
        after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          ${lib.getExe' pkgs.coreutils "install"} -m 600 ${configFile} /run/copyparty/copyparty.conf
+          ${replacePassword}
+        '';
        serviceConfig = {
          ReloadSignal = "SIGUSR1";
          Type = "simple";
-          User = cfg.user;
-          Group = cfg.group;
-          WorkingDirectory = cfg.stateDir;
+          User = serviceUser;
+          Group = serviceGroup;
+          WorkingDirectory = serviceStateDir;
          Environment = [
-            "HOME=${cfg.stateDir}"
-            "XDG_CONFIG_HOME=${cfg.stateDir}"
+            "HOME=${serviceStateDir}"
+            "XDG_CONFIG_HOME=${serviceStateDir}"
          ];
          StateDirectory = "copyparty";
          RuntimeDirectory = "copyparty";
          RuntimeDirectoryMode = "0700";
-          LoadCredential = [ "password:${cfg.passwordFile}" ];
-          ExecStartPre = configScript;
-          ExecStart = "${lib.getExe cfg.package} -c /run/copyparty/copyparty.conf";
+          LoadCredential = [ "${credentialName}:${cfg.passwordFile}" ];
+          ExecStart = "${lib.getExe pkgs.copyparty-min} -c /run/copyparty/copyparty.conf";
          Restart = "on-failure";
          NoNewPrivileges = true;
          PrivateTmp = true;
          ProtectSystem = "strict";
          ProtectHome = true;
          ReadWritePaths = [
-            cfg.stateDir
+            serviceStateDir
          ]
-          ++ map (volume: volume.path) (lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes));
+          ++ map (volume: volume.path) writableVolumes;
        };
      };

-      networking.firewall.allowedTCPPorts = [ cfg.port ];
+      networking.firewall.allowedTCPPorts = [ port ];
    })
  ];
 }
--- a/configs/nixos/modules/services/games/palworld.nix
+++ b/configs/nixos/modules/services/games/palworld.nix
@@ -92,33 +92,33 @@
      startScript = pkgs.writeShellScript "palworld-start" ''
        set -eu

-        ${pkgs.coreutils}/bin/install -d \
+        ${lib.getExe' pkgs.coreutils "install"} -d \
          -m 0770 \
          ${lib.escapeShellArg service.stateDir} \
          ${lib.escapeShellArg (builtins.dirOf savedDir)}

        if [ -L ${lib.escapeShellArg savedDir} ]; then
-          current_target="$(${pkgs.coreutils}/bin/readlink ${lib.escapeShellArg savedDir})"
+          current_target="$(${lib.getExe' pkgs.coreutils "readlink"} ${lib.escapeShellArg savedDir})"
          if [ "$current_target" != ${lib.escapeShellArg service.stateDir} ]; then
-            ${pkgs.coreutils}/bin/rm ${lib.escapeShellArg savedDir}
+            ${lib.getExe' pkgs.coreutils "rm"} ${lib.escapeShellArg savedDir}
          fi
        fi

        if [ -d ${lib.escapeShellArg savedDir} ] && [ ! -L ${lib.escapeShellArg savedDir} ]; then
-          if ${pkgs.findutils}/bin/find ${lib.escapeShellArg service.stateDir} -mindepth 1 -maxdepth 1 | ${pkgs.gnugrep}/bin/grep -q .; then
-            ${pkgs.coreutils}/bin/rm -rf ${lib.escapeShellArg savedDir}
+          if ${lib.getExe' pkgs.findutils "find"} ${lib.escapeShellArg service.stateDir} -mindepth 1 -maxdepth 1 | ${lib.getExe' pkgs.gnugrep "grep"} -q .; then
+            ${lib.getExe' pkgs.coreutils "rm"} -rf ${lib.escapeShellArg savedDir}
          else
-            ${pkgs.coreutils}/bin/cp -a ${lib.escapeShellArg savedDir}/. ${lib.escapeShellArg service.stateDir}/
-            ${pkgs.coreutils}/bin/rm -rf ${lib.escapeShellArg savedDir}
+            ${lib.getExe' pkgs.coreutils "cp"} -a ${lib.escapeShellArg savedDir}/. ${lib.escapeShellArg service.stateDir}/
+            ${lib.getExe' pkgs.coreutils "rm"} -rf ${lib.escapeShellArg savedDir}
          fi
        fi

        if [ ! -e ${lib.escapeShellArg savedDir} ]; then
-          ${pkgs.coreutils}/bin/ln -s ${lib.escapeShellArg service.stateDir} ${lib.escapeShellArg savedDir}
+          ${lib.getExe' pkgs.coreutils "ln"} -s ${lib.escapeShellArg service.stateDir} ${lib.escapeShellArg savedDir}
        fi

-        password="$(${pkgs.coreutils}/bin/tr -d '\n' < ${lib.escapeShellArg service.passwordFile})"
-        admin_password="$(${pkgs.coreutils}/bin/tr -d '\n' < ${lib.escapeShellArg service.adminPasswordFile})"
+        password="$(${lib.getExe' pkgs.coreutils "tr"} -d '\n' < ${lib.escapeShellArg service.passwordFile})"
+        admin_password="$(${lib.getExe' pkgs.coreutils "tr"} -d '\n' < ${lib.escapeShellArg service.adminPasswordFile})"

        exec ./PalServer.sh \
          "$@" \
@@ -145,9 +145,12 @@
        ]
        ++ lib.optional service.publicLobby "-publiclobby"
        ++ lib.optionals (service.publicIP != null) [ "-publicip=${service.publicIP}" ]
-        ++ lib.optional service.rcon.enable "-rcon";
+        ++ lib.optionals service.rcon.enable [
+          "-rcon"
+          "-RCONPort=${toString service.rcon.port}"
+        ];
        udpPorts = [ service.port ];
-        tcpPorts = [ service.port ];
+        tcpPorts = lib.optional service.rcon.enable service.rcon.port;
      };
    }
  );
--- a/configs/nixos/modules/services/games/valheim.nix
+++ b/configs/nixos/modules/services/games/valheim.nix
@@ -51,7 +51,7 @@
      startScript = pkgs.writeShellScript "valheim-start" ''
        set -eu

-        password="$(${pkgs.coreutils}/bin/tr -d '\n' < ${lib.escapeShellArg service.passwordFile})"
+        password="$(${lib.getExe' pkgs.coreutils "tr"} -d '\n' < ${lib.escapeShellArg service.passwordFile})"
        exec ./valheim_server.x86_64 "$@" -password "$password"
      '';
    in
--- a/configs/nixos/modules/services/homepage.nix
+++ b/configs/nixos/modules/services/homepage.nix
@@ -5,7 +5,7 @@
  ...
 }:
 let
-  cfg = config.modules.services.homepage; # NOLINT(let_order)
+  cfg = config.modules.services.homepage;

  derivedAllowedHosts = lib.unique (
    lib.optional (selfRoute != null) selfRoute.domain
@@ -111,7 +111,8 @@ let
    let
      sectionOrder = sectionOrderByTab.${tab} or [ ];
    in
-    sectionOrder ++ lib.filter (section: !lib.elem section sectionOrder) (lib.attrNames sections);
+    lib.filter (section: lib.hasAttr section sections) sectionOrder
+    ++ lib.filter (section: !lib.elem section sectionOrder) (lib.attrNames sections);

 in
 {
--- a/configs/nixos/modules/services/navidrome.nix
+++ b/configs/nixos/modules/services/navidrome.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.modules.services.navidrome; # NOLINT(let_order)
+  cfg = config.modules.services.navidrome;
 in
 {
  options.modules.services.navidrome = {
--- a/configs/nixos/modules/services/reverse-proxy.nix
+++ b/configs/nixos/modules/services/reverse-proxy.nix
@@ -40,43 +40,14 @@ let
      proxy_pass ${stream.address}:${toString stream.port};
    }
  '') generatedUdpStreams;
-  generatedVirtualHosts =
-    if duplicateDomainMessages != [ ] then
-      throw (builtins.head duplicateDomainMessages)
-    else
-      lib.listToAttrs generatedVirtualHostList;
+  generatedVirtualHosts = lib.listToAttrs generatedVirtualHostList;

-  duplicateDomainMessages = lib.concatLists (
-    lib.mapAttrsToList (
-      domain: virtualHosts:
-      if lib.length virtualHosts > 1 then
-        [
-          "duplicate route domain ${domain} in ${
-            lib.concatMapStringsSep " and " (
-              virtualHost: mkRegistryPath virtualHost.registryName virtualHost.host virtualHost.entry
-            ) virtualHosts
-          }"
-        ]
-      else
-        [ ]
-    ) virtualHostsByDomain
-  );
-
-  virtualHostsByDomain = lib.foldl' (
-    acc: virtualHost:
-    acc
-    // {
-      ${virtualHost.name} = (acc.${virtualHost.name} or [ ]) ++ [ virtualHost ];
-    }
-  ) { } generatedVirtualHostList;
-
-  generatedVirtualHostList = generatedHttpsVirtualHostList ++ generatedHttpVirtualHostList;
-
-  generatedHttpsVirtualHostList = lib.concatLists (
+  # Route registry validation already requires unique domains.
+  generatedVirtualHostList = lib.concatLists (
    lib.mapAttrsToList (
      host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "https") (
-        lib.filterAttrs (_entry: route: route.protocol == "https") routes
+      lib.mapAttrsToList (entry: route: mkVirtualHost host entry route.protocol) (
+        lib.filterAttrs (_entry: route: route.protocol != "udp") routes
      )
    ) registry.route
  );
@@ -93,8 +64,6 @@ let
      inherit (route) port;
    in
    {
-      inherit host entry;
-      registryName = "route";
      name = route.domain;
      value = {
        forceSSL = !isHttp;
@@ -102,21 +71,15 @@ let
        extraConfig = lib.optionalString (route.clientMaxBodySize != null) ''
          client_max_body_size ${route.clientMaxBodySize};
        '';
-        locations."/".proxyPass = mkBackend address port;
+        locations."/" = {
+          proxyPass = mkBackend address port;
+          proxyWebsockets = true;
+        };
      };
    };

  mkBackend = address: port: "http://${address}:${toString port}";

-  generatedHttpVirtualHostList = lib.concatLists (
-    lib.mapAttrsToList (
-      host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "http") (
-        lib.filterAttrs (_entry: route: route.protocol == "http") routes
-      )
-    ) registry.route
-  );
-
  mkRegistryPath =
    registryName: host: entry:
    "registry.${registryName}.${host}.${entry}";
--- a/configs/nixos/modules/services/romm.nix
+++ b/configs/nixos/modules/services/romm.nix
@@ -0,0 +1,68 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.modules.services.romm;
+in
+{
+  options.modules.services.romm = {
+    enable = lib.mkEnableOption "RomM";
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      default = "/run/secrets/romm.env";
+      readOnly = true;
+      description = "Path to RomM's environment file.";
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      registry."stable-uid".${config.networking.hostName} = {
+        romm = 20005;
+        "redis-romm" = 20006;
+      };
+    }
+
+    (lib.mkIf cfg.enable {
+      networking.firewall.allowedTCPPorts = [ 80 ];
+
+      services.romm = {
+        enable = true;
+        package = pkgs.alexion.romm;
+        group = "storage";
+        database.createLocally = true;
+        redis.createLocally = true;
+        watcher.enable = true;
+        extraEnvironment = {
+          HASHEOUS_API_ENABLED = "true";
+          PLAYMATCH_API_ENABLED = "true";
+          ROM_CONVERTO_ENABLED = "false";
+        };
+        inherit (cfg) environmentFile;
+      };
+
+      systemd.services.romm-worker.serviceConfig.ExecStart =
+        lib.mkForce "${lib.getExe' config.services.romm.package "romm-worker"} scans";
+
+      systemd.tmpfiles.settings."10-romm"."${config.services.romm.dataDir}/config/config.yml"."L+".argument =
+        toString (
+          (pkgs.formats.yaml { }).generate "romm-config.yml" {
+            emulatorjs.auto_save_sync = false;
+            filesystem.structure = {
+              default = "roms/{platform}/{game}";
+              firmware = "bios/{platform}";
+            };
+          }
+        );
+
+      users.users = {
+        romm.uid = config.registry."stable-uid".${config.networking.hostName}.romm;
+        redis-romm.uid = config.registry."stable-uid".${config.networking.hostName}."redis-romm";
+      };
+    })
+  ];
+}
--- a/configs/nixos/modules/services/steamcmd.nix
+++ b/configs/nixos/modules/services/steamcmd.nix
@@ -15,9 +15,9 @@
    };

    serviceName = lib.mkOption {
-      type = lib.types.str;
+      type = lib.types.strMatching "[a-z0-9][a-z0-9-]*";
      example = "valheim";
-      description = "Name of the systemd service that runs the game server.";
+      description = "Lowercase systemd service basename for the game server.";
    };

    appId = lib.mkOption {
@@ -87,7 +87,7 @@
        prepareScript = pkgs.writeShellScript "steamcmd-${service.serviceName}-prepare" ''
          set -eu

-          ${pkgs.coreutils}/bin/install -d \
+          ${lib.getExe' pkgs.coreutils "install"} -d \
            -o ${user} \
            -g ${group} \
            -m 0770 \
@@ -155,7 +155,7 @@
            wantedBy = lib.mkIf service.autoStart [ "multi-user.target" ];
            serviceConfig = {
              Type = "oneshot";
-              ExecStart = "${pkgs.systemd}/bin/systemctl --no-block start ${service.serviceName}.service";
+              ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --no-block start ${service.serviceName}.service";
            };
          };

--- a/configs/nixos/modules/shell/bazel.nix
+++ b/configs/nixos/modules/shell/bazel.nix
@@ -5,14 +5,11 @@
  ...
 }:
 # Bazel for the primary user's shell environment.
-let
-  user = config.user.name;
-in
 {
  options.modules.shell.bazel.enable =
    lib.mkEnableOption "Bazel for the primary user's shell environment";

  config = lib.mkIf config.modules.shell.bazel.enable {
-    home-manager.users.${user}.home.packages = [ pkgs.bazel ];
+    home-manager.users.${config.user.name}.home.packages = [ pkgs.bazel ];
  };
 }
--- a/configs/nixos/modules/shell/direnv/default.nix
+++ b/configs/nixos/modules/shell/direnv/default.nix
@@ -1,25 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-# direnv for the primary user, configured through home-manager.
-let
-  user = config.user.name;
-in
-{
-  options.modules.shell.direnv.enable =
-    lib.mkEnableOption "direnv for the primary user, with nix-direnv shell caching";
-
-  config = lib.mkIf config.modules.shell.direnv.enable {
-    home-manager.users.${user}.programs.direnv = {
-      enable = true;
-      silent = true;
-
-      # nix-direnv caches the evaluated shell so re-entering a directory is instant
-      # instead of re-running `nix develop`, and adds the `use flake` stdlib helper.
-      nix-direnv.enable = true;
-      stdlib = builtins.readFile ./repo-flake.sh;
-    };
-  };
-}
--- a/configs/nixos/modules/shell/direnv/repo-flake.sh
+++ b/configs/nixos/modules/shell/direnv/repo-flake.sh
@@ -1,33 +0,0 @@
-if declare -f use_flake >/dev/null; then
-  __dotfiles_use_flake_definition="$(declare -f use_flake)"
-  eval "${__dotfiles_use_flake_definition/use_flake/__dotfiles_nix_direnv_use_flake}"
-  unset __dotfiles_use_flake_definition
-
-  use_flake() {
-    local flake_expr="${1:-.}"
-
-    if [[ "$flake_expr" == //* ]]; then
-      local git_root
-      if ! git_root="$(git rev-parse --show-toplevel 2>/dev/null)"; then
-        log_error 'use flake // requires a Git repository'
-        return 1
-      fi
-
-      local flake_suffix="${flake_expr#//}"
-      if [[ -n "$flake_suffix" && "$flake_suffix" != \#* && "$flake_suffix" != /* ]]; then
-        flake_expr="path:${git_root}/${flake_suffix}"
-      else
-        flake_expr="path:${git_root}${flake_suffix}"
-      fi
-
-      shift
-      __dotfiles_nix_direnv_use_flake "$flake_expr" "$@"
-      return
-    fi
-
-    __dotfiles_nix_direnv_use_flake "$@"
-  }
-else
-  log_error 'nix-direnv must define use_flake before the // wrapper loads'
-  return 1
-fi
--- a/configs/nixos/modules/shell/fish/default.nix
+++ b/configs/nixos/modules/shell/fish/default.nix
@@ -6,7 +6,7 @@
 }:
 # fish for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.fish; # NOLINT(let_order)
+  cfg = config.modules.shell.fish;
  commandsOf = shortcuts: lib.mapAttrs (_name: shortcut: shortcut.command) shortcuts;
  shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
  user = config.user.name;
--- a/configs/nixos/modules/shell/fish/functions/deploy-to.fish
+++ b/configs/nixos/modules/shell/fish/functions/deploy-to.fish
@@ -47,6 +47,8 @@ or begin
    return $status
 end

+set remote_nar
+
 if test (count $missing_paths) -gt 0
    set nar_file (mktemp --suffix=.nar)
    or return $status
@@ -70,26 +72,23 @@ if test (count $missing_paths) -gt 0
        return $scp_status
    end

-    echo "deploy-to: importing closure on $host" >&2
-    ssh -t $host "sudo sh -c 'nix-store --import < $remote_nar' && rm -f $remote_nar"
-    or begin
-        echo "deploy-to: closure import failed for $host" >&2
-        return $status
-    end
+    echo "deploy-to: importing the closure, recording $system_path, and activating it on $host" >&2
 else
    echo "deploy-to: $host already has the full closure for $system_path" >&2
+    echo "deploy-to: recording $system_path and activating it on $host" >&2
 end

-echo "deploy-to: recording $system_path as the system profile on $host" >&2
-ssh -t $host sudo nix-env --profile /nix/var/nix/profiles/system --set $system_path
-or begin
-    echo "deploy-to: system profile update failed for $host" >&2
-    return $status
-end
+set remote_script (
+    string join '; ' \
+        'system_path=$1' \
+        'remote_nar=$2' \
+        'if test -n "$remote_nar"; then nix-store --import < "$remote_nar"; rm -f "$remote_nar"; fi' \
+        'nix-env --profile /nix/var/nix/profiles/system --set "$system_path"' \
+        '"$system_path/bin/switch-to-configuration" switch'
+)

-echo "deploy-to: activating $system_path on $host" >&2
-ssh -t $host sudo "$system_path/bin/switch-to-configuration" switch
+ssh -t $host sudo sh -e -c (string escape -- $remote_script) sh (string escape -- $system_path $remote_nar)
 or begin
-    echo "deploy-to: activation failed for $host" >&2
+    echo "deploy-to: deployment failed for $host" >&2
    return $status
 end
--- a/configs/nixos/modules/shell/nvim/default.nix
+++ b/configs/nixos/modules/shell/nvim/default.nix
@@ -24,6 +24,9 @@ in
    home-manager.users.${user} = hm: {
      programs.nixvim = {
        enable = true;
+
+        # Aligns Nixvim plugins with this flake's `Nixpkgs`.
+        # `nixpkgs.useGlobalPackages` prevents Home Manager from creating a separate package set.
        nixpkgs.useGlobalPackages = true;

        extraPackages = with pkgs; [
--- a/configs/nixos/modules/shell/pi/default.nix
+++ b/configs/nixos/modules/shell/pi/default.nix
@@ -12,18 +12,14 @@ let
  piDir = "${config.users.users.${user}.home}/.pi/agent";
 in
 {
-  options.modules.shell.pi = {
-    enable = lib.mkEnableOption "Pi, a terminal coding agent, configured through home-manager";
-  };
+  options.modules.shell.pi.enable =
+    lib.mkEnableOption "Pi, a terminal coding agent, configured through home-manager";

  config = lib.mkIf config.modules.shell.pi.enable {
    home-manager.users.${user} = {
      programs.pi-coding-agent = {
        enable = true;
-        package = pkgs.pi-coding-agent.overrideAttrs {
-          src = ../../../../../third_party/pi;
-          patches = [ ];
-        };
+        package = pkgs.alexion.pi-coding-agent;

        settings = {
          defaultProvider = "openai-codex";
--- a/configs/nixos/modules/shell/python.nix
+++ b/configs/nixos/modules/shell/python.nix
@@ -13,9 +13,8 @@ in
    lib.mkEnableOption "Python tools for the primary user's shell environment";

  config = lib.mkIf config.modules.shell.python.enable {
-    home-manager.users.${user}.home = {
-      sessionVariables.PYTHON_TOOLCHAIN_ROOT = "${pkgs.python3}";
-      packages = [ pkgs.python3 ];
-    };
+    registry.env.${config.networking.hostName}.PYTHON_TOOLCHAIN_ROOT = "${pkgs.python3}";
+
+    home-manager.users.${user}.home.packages = [ pkgs.python3 ];
  };
 }
--- a/configs/nixos/modules/shell/rust.nix
+++ b/configs/nixos/modules/shell/rust.nix
@@ -23,9 +23,9 @@ in
    lib.mkEnableOption "Rust tools for the primary user's shell environment";

  config = lib.mkIf config.modules.shell.rust.enable {
-    home-manager.users.${user} = {
-      home.sessionVariables.RUST_TOOLCHAIN_ROOT = "${toolchain}";
+    registry.env.${config.networking.hostName}.RUST_TOOLCHAIN_ROOT = "${toolchain}";

+    home-manager.users.${user} = {
      home.packages = [
        toolchain
        pkgs.rust-analyzer
--- a/configs/nixos/registry/env.nix
+++ b/configs/nixos/registry/env.nix
@@ -0,0 +1,4 @@
+{ lib, ... }:
+{
+  type = lib.types.str;
+}
--- a/configs/nixos/registry/keybind.nix
+++ b/configs/nixos/registry/keybind.nix
@@ -53,6 +53,13 @@
        example = true;
      };

+      locked = lib.mkOption {
+        description = "Allows the keybind action while the session is locked.";
+        type = lib.types.bool;
+        default = false;
+        example = true;
+      };
+
      action = lib.mkOption {
        description = "Declares the action this keybind runs.";
        type = lib.types.submodule {
--- a/configs/nixos/registry/stable-uid.nix
+++ b/configs/nixos/registry/stable-uid.nix
@@ -12,7 +12,7 @@ let

 in
 {
-  # Next stable UID: 20005
+  # Next stable UID: 20007

  type = lib.types.ints.positive;

--- a/configs/nixos/registry/waybar.nix
+++ b/configs/nixos/registry/waybar.nix
@@ -0,0 +1,29 @@
+{ lib, ... }:
+{
+  type = lib.types.submodule {
+    options = {
+      position = lib.mkOption {
+        type = lib.types.enum [
+          "left"
+          "center"
+          "right"
+        ];
+        default = "right";
+        description = "Selects the Waybar section that shows the module.";
+      };
+
+      order = lib.mkOption {
+        type = lib.types.int;
+        default = 100;
+        example = 50;
+        description = "Sorts the module within its Waybar section.";
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.attrsOf lib.types.anything;
+        default = { };
+        description = "Sets the Waybar module configuration.";
+      };
+    };
+  };
+}
--- a/configs/nixos/registry/window-icon.nix
+++ b/configs/nixos/registry/window-icon.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+{
+
+  type = lib.types.submodule {
+    options = {
+      class = lib.mkOption {
+        description = "Matches the window class reported by the compositor.";
+        type = lib.types.str;
+        example = ".*[Ff]irefox.*";
+      };
+
+      icon = lib.mkOption {
+        description = "Sets the icon shown for matching windows.";
+        type = lib.types.str;
+        example = "";
+      };
+    };
+  };
+}
--- a/configs/nixos/secrets/pikachu.yaml
+++ b/configs/nixos/secrets/pikachu.yaml
@@ -6,6 +6,17 @@ services:
        lastfm:
            api-key: ENC[AES256_GCM,data:Zb0I5TpdEqOxLAD6ed2XywFGZp7dfY69vcGiWOUJkJQ=,iv:pO53pHr09jWfzJyTsQbTHtzTmiQ9+RQkDwZJmInIiX8=,tag:io9jkSN7TF2I8+qlSymaYw==,type:str]
            secret: ENC[AES256_GCM,data:rKhd9i0/tbJlXhc9Wf81IDydjpD8khSdwJEEMK260E4=,iv:btBXWBKJp9br5a3yZsRVegN8Ytzc45Qbk2iNlPbENkQ=,tag:LUbu+6gxfqQvVpddZto7Tg==,type:str]
+    romm:
+        igdb:
+            client-id: ENC[AES256_GCM,data:tme7NzzbOlCmkMwVObWz793mOsCyVIzSjGoFvxpe,iv:5aOMvsDi8Z9aBymbqhbK79X4kJsqaET1y2Py6YUZZ/U=,tag:ih3GghlxiLsVyeTJoqU9/Q==,type:str]
+            client-secret: ENC[AES256_GCM,data:AqF7B9VaxM/X3sRqY6C5JVWPWqgRIoqy09P9ZUFj,iv:D+vDPUuGGdzKYnTVTRkI9TV/EOJgVECIeNDt9g8NGl0=,tag:MRaTT7TdEZSd+98xthVw1A==,type:str]
+        retroachievements:
+            api-key: ENC[AES256_GCM,data:LMzETQCMi9Ib783W0BZDe2PaSUSTVM5a61502RtZLg8=,iv:Hf5nBoVtZdJszQuc2n0LVNMtJCCpJrh40y4g+l+az70=,tag:esfKLpI1W8BG3Pfsg3xxKQ==,type:str]
+        steamgriddb:
+            api-key: ENC[AES256_GCM,data:+kBRieIB/dHbvQLbH2gQTQh2j6DQhybVWEGkSCRZrZY=,iv:3h6dhfiV7HfaZhMv93x8+7F3utzYG6fIbTDScA14PVI=,tag:Wo24YnvsIxe7iMRLyxrj2w==,type:str]
+        screenscraper:
+            user: ENC[AES256_GCM,data:7hGcFF4xqg==,iv:SFOdYej94Thfn+Te0kXsC9Kq568A1dsnaR+JB90MgBQ=,tag:inIWuFY7f5Tvv8EyV71dYA==,type:str]
+            password: ENC[AES256_GCM,data:eUWwDDQUSytm/6QZlG5XjbSi41nsBQbm4w==,iv:82S2a3rAVjaF0CXcjXUXErNHMY7MEkjpDL7EVX9cIHw=,tag:uGuVJCv8ThsaNnA0C0WR2Q==,type:str]
 sops:
    age:
        - enc: |
@@ -26,7 +37,7 @@ sops:
            dyjzy0/9Ui1IIXH36AImO5hiEZcrGePV2qPLLQc7ZLngC1jlJuEKJA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
-    lastmodified: "2026-09-12T22:54:25Z"
-    mac: ENC[AES256_GCM,data:4R3a0ytf4i8aM8iBQ9vRC/q+hvtjLrCTNgbpCB5DbqBMBYmhtGsBmO/0i1yT0N4tydyLaGOMkNfuuuVi3ASLEOKnViy9w3uD9IN0F79W4f2vguWUVIp/T8skvN9wbV9o9xd0LkJzmeVVgzb1H6HKw+rTGjbquleoIHEBDcDDM+k=,iv:0NlckMXlS+idY6UGBF+F0KFLt+pzD7Q/YEQOdXraAYg=,tag:JBBQduV8uhnKz9gPf6HfAQ==,type:str]
+    lastmodified: "2026-10-20T01:27:06Z"
+    mac: ENC[AES256_GCM,data:NCt6e/ctZwaBADfrhu1RXtILlClbHEqOAnIu8rE/zMPSwMIPB/kTtfd/ujf+1iRszoHaX4Se1xc0wz1th6NVToFVNarxBBgTk4JMUU8gdMweOjmwlh3GXU3ZcYY/xAXxWF1hxyXSEW78j3S2844H9XXENAq/Bf3mjdCYQ/qr/d4=,iv:4nFyBSmRvF4zSAwvL+xccMwtWrVbHtFKNoTb7f3rSH4=,tag:eCV/7P0TjyMZXKcWBUPXQA==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.13.3
--- a/docs/.obsidian/app.json
+++ b/docs/.obsidian/app.json
@@ -5,7 +5,7 @@
  "livePreview": false,
  "readableLineLength": false,
  "strictLineBreaks": true,
-  "propertiesInDocument": "hidden",
+  "propertiesInDocument": "visible",
  "showLineNumber": true,
  "autoPairMarkdown": false,
  "useTab": false,
--- a/docs/.obsidian/community-plugins.json
+++ b/docs/.obsidian/community-plugins.json
@@ -5,5 +5,6 @@
  "obsidian-style-settings",
  "custom-font-loader",
  "obsidian-icon-folder",
-  "table-editor-obsidian"
+  "table-editor-obsidian",
+  "obsidian-linter"
 ]
--- a/docs/.obsidian/graph.json
+++ b/docs/.obsidian/graph.json
@@ -28,6 +28,20 @@
        "rgb": 5366249
      }
    },
+    {
+      "query": "path:\"03 wrk/tasks\"[\"status\":open]",
+      "color": {
+        "a": 1,
+        "rgb": 14725458
+      }
+    },
+    {
+      "query": "path:\"03 wrk/tasks\" [\"status\":closed]",
+      "color": {
+        "a": 1,
+        "rgb": 11657298
+      }
+    },
    {
      "query": "path:\"03 wrk\"  ",
      "color": {
@@ -60,6 +74,6 @@
  "repelStrength": 20,
  "linkStrength": 1,
  "linkDistance": 250,
-  "scale": 0.3645607001522557,
+  "scale": 0.16202697784544698,
  "close": false
 }
--- a/docs/.obsidian/plugins/obsidian-linter/data.json
+++ b/docs/.obsidian/plugins/obsidian-linter/data.json
@@ -0,0 +1,326 @@
+{
+  "ruleConfigs": {
+    "add-blank-line-after-yaml": {
+      "enabled": true
+    },
+    "dedupe-yaml-array-values": {
+      "enabled": true,
+      "dedupe-alias-key": true,
+      "dedupe-tag-key": true,
+      "dedupe-array-keys": true,
+      "ignore-keys": []
+    },
+    "escape-yaml-special-characters": {
+      "enabled": true,
+      "try-to-escape-single-line-arrays": true
+    },
+    "force-yaml-escape": {
+      "enabled": true,
+      "force-yaml-escape-keys": []
+    },
+    "format-tags-in-yaml": {
+      "enabled": true
+    },
+    "format-yaml-array": {
+      "enabled": true,
+      "alias-key": true,
+      "tag-key": true,
+      "default-array-keys": true,
+      "force-single-line-array-style": [],
+      "force-multi-line-array-style": []
+    },
+    "insert-yaml-attributes": {
+      "enabled": true,
+      "text-to-insert": []
+    },
+    "move-inline-fields-to-yaml": {
+      "enabled": true,
+      "how-to-handle-full-line-fields": "Move and remove",
+      "how-to-handle-bracketed-fields": "Leave in place",
+      "how-to-handle-existing-keys": "Skip",
+      "inline-keys-to-ignore": []
+    },
+    "move-tags-to-yaml": {
+      "enabled": true,
+      "how-to-handle-existing-tags": "Nothing",
+      "tags-to-ignore": []
+    },
+    "remove-yaml-keys": {
+      "enabled": true,
+      "yaml-keys-to-remove": []
+    },
+    "sort-yaml-array-values": {
+      "enabled": true,
+      "sort-alias-key": true,
+      "sort-tag-key": true,
+      "sort-array-keys": true,
+      "ignore-keys": [],
+      "sort-order": "Ascending Alphabetical"
+    },
+    "yaml-key-sort": {
+      "enabled": true,
+      "yaml-key-priority-sort-order": [
+        "aliases",
+        "date-created",
+        "date-modified"
+      ],
+      "priority-keys-at-start-of-yaml": true,
+      "yaml-sort-order-for-other-keys": "None"
+    },
+    "yaml-timestamp": {
+      "enabled": true,
+      "date-created": true,
+      "date-created-key": "date-created",
+      "date-created-source-of-truth": "file system",
+      "date-modified": true,
+      "date-modified-key": "date-modified",
+      "date-modified-source-of-truth": "file system",
+      "format": "YYYY-MM-DD HH:mm",
+      "convert-to-utc": false,
+      "update-on-file-contents-updated": "after 5 seconds"
+    },
+    "yaml-title": {
+      "enabled": false,
+      "title-key": "title",
+      "mode": "first-h1-or-filename-if-h1-missing"
+    },
+    "yaml-title-alias": {
+      "enabled": true,
+      "preserve-existing-alias-section-style": true,
+      "keep-alias-that-matches-the-filename": false,
+      "use-yaml-key-to-keep-track-of-old-filename-or-heading": false,
+      "alias-helper-key": "linter-yaml-title-alias",
+      "remove-alias-if-empty": true
+    },
+    "capitalize-headings": {
+      "enabled": true,
+      "style": "Title Case",
+      "ignore-case-words": [],
+      "lowercase-words": [],
+      "starting-word-ignore-characters": "'\"(‘“-",
+      "ending-word-ignore-characters": ".?!,:;'\")”’0123456789-",
+      "ignore-words": []
+    },
+    "file-name-heading": {
+      "enabled": true
+    },
+    "header-increment": {
+      "enabled": true,
+      "start-at-h2": false
+    },
+    "headings-start-line": {
+      "enabled": true
+    },
+    "remove-trailing-punctuation-in-heading": {
+      "enabled": true,
+      "punctuation-to-remove": ".,;:!。，；：！"
+    },
+    "footnote-after-punctuation": {
+      "enabled": true
+    },
+    "move-footnotes-to-the-bottom": {
+      "enabled": true,
+      "include-blank-line-between-footnotes": false
+    },
+    "re-index-footnotes": {
+      "enabled": true
+    },
+    "auto-correct-common-misspellings": {
+      "enabled": true,
+      "ignore-words": [],
+      "skip-words-with-multiple-capitals": true,
+      "extra-auto-correct-files": []
+    },
+    "blockquote-style": {
+      "enabled": true,
+      "style": "space"
+    },
+    "convert-bullet-list-markers": {
+      "enabled": true
+    },
+    "default-language-for-code-fences": {
+      "enabled": true,
+      "default-language": ""
+    },
+    "emphasis-style": {
+      "enabled": true,
+      "style": "consistent"
+    },
+    "no-bare-urls": {
+      "enabled": true,
+      "no-bare-uris": true
+    },
+    "ordered-list-style": {
+      "enabled": true,
+      "number-style": "ascending",
+      "list-end-style": ".",
+      "preserve-start": false
+    },
+    "proper-ellipsis": {
+      "enabled": true
+    },
+    "quote-style": {
+      "enabled": true,
+      "single-quote-enabled": true,
+      "single-quote-style": "''",
+      "double-quote-enabled": true,
+      "double-quote-style": "\"\""
+    },
+    "remove-consecutive-list-markers": {
+      "enabled": true
+    },
+    "remove-empty-list-markers": {
+      "enabled": true
+    },
+    "remove-hyphenated-line-breaks": {
+      "enabled": true
+    },
+    "remove-multiple-spaces": {
+      "enabled": true
+    },
+    "strong-style": {
+      "enabled": true,
+      "style": "consistent"
+    },
+    "two-spaces-between-lines-with-content": {
+      "enabled": false,
+      "line-break-indicator": "  "
+    },
+    "unordered-list-style": {
+      "enabled": true,
+      "list-style": "consistent"
+    },
+    "align-table-columns": {
+      "enabled": true
+    },
+    "compact-yaml": {
+      "enabled": true,
+      "inner-new-lines": false
+    },
+    "consecutive-blank-lines": {
+      "enabled": true
+    },
+    "convert-spaces-to-tabs": {
+      "enabled": true,
+      "tabsize": 4
+    },
+    "empty-line-around-blockquotes": {
+      "enabled": true
+    },
+    "empty-line-around-code-fences": {
+      "enabled": true
+    },
+    "empty-line-around-horizontal-rules": {
+      "enabled": true
+    },
+    "empty-line-around-math-blocks": {
+      "enabled": true
+    },
+    "empty-line-around-tables": {
+      "enabled": true
+    },
+    "heading-blank-lines": {
+      "enabled": true,
+      "bottom": true,
+      "empty-line-after-yaml": true
+    },
+    "line-break-at-document-end": {
+      "enabled": true
+    },
+    "move-math-block-indicators-to-their-own-line": {
+      "enabled": true
+    },
+    "paragraph-blank-lines": {
+      "enabled": true
+    },
+    "remove-empty-lines-between-list-markers-and-checklists": {
+      "enabled": true
+    },
+    "remove-link-spacing": {
+      "enabled": true
+    },
+    "remove-space-around-characters": {
+      "enabled": true,
+      "include-fullwidth-forms": true,
+      "include-cjk-symbols-and-punctuation": true,
+      "include-dashes": true,
+      "other-symbols": ""
+    },
+    "remove-space-before-or-after-characters": {
+      "enabled": true,
+      "characters-to-remove-space-before": ",!?;:).’”]",
+      "characters-to-remove-space-after": "¿¡‘“(["
+    },
+    "space-after-list-markers": {
+      "enabled": true
+    },
+    "space-between-chinese-japanese-or-korean-and-english-or-numbers": {
+      "enabled": true,
+      "english-symbols-punctuation-before": "-+;:'\"°%$)]",
+      "english-symbols-punctuation-after": "-+'\"([¥$"
+    },
+    "trailing-spaces": {
+      "enabled": true,
+      "two-space-line-break": false
+    },
+    "add-blockquote-indentation-on-paste": {
+      "enabled": true
+    },
+    "prevent-double-checklist-indicator-on-paste": {
+      "enabled": true
+    },
+    "prevent-double-list-item-indicator-on-paste": {
+      "enabled": true
+    },
+    "proper-ellipsis-on-paste": {
+      "enabled": true
+    },
+    "remove-hyphens-on-paste": {
+      "enabled": true
+    },
+    "remove-leading-or-trailing-whitespace-on-paste": {
+      "enabled": true
+    },
+    "remove-leftover-footnotes-from-quote-on-paste": {
+      "enabled": true
+    },
+    "remove-multiple-blank-lines-on-paste": {
+      "enabled": true
+    }
+  },
+  "lintOnSave": true,
+  "recordLintOnSaveLogs": false,
+  "displayChanged": true,
+  "suppressMessageWhenNoChange": true,
+  "enableDiffPreviewView": true,
+  "suppressLintAllFilesConfirmationModal": false,
+  "suppressLintAllFilesInFolderConfirmationModal": false,
+  "lintOnFileChange": false,
+  "displayLintOnFileChangeNotice": false,
+  "settingsConvertedToConfigKeyValues": true,
+  "textAreaSettingsConvertedToListItemSettings": true,
+  "defaultArrayStyleMovedToCommonStyles": true,
+  "additionalFileExtensions": [],
+  "foldersToIgnore": [
+    "99 meta/templates"
+  ],
+  "filesToIgnore": [
+    {
+      "label": "todo",
+      "match": "TODO.md",
+      "flags": "i"
+    }
+  ],
+  "linterLocale": "system-default",
+  "logLevel": "ERROR",
+  "lintCommands": [],
+  "customRegexes": [],
+  "commonStyles": {
+    "aliasArrayStyle": "multi-line",
+    "tagArrayStyle": "single-line",
+    "defaultArrayStyle": "multi-line",
+    "minimumNumberOfDollarSignsToBeAMathBlock": 2,
+    "escapeCharacter": "\"",
+    "removeUnnecessaryEscapeCharsForMultiLineArrays": true
+  }
+}
--- a/docs/.obsidian/plugins/obsidian-linter/default-misspellings.md
+++ b/docs/.obsidian/plugins/obsidian-linter/default-misspellings.md
--- a/docs/.obsidian/plugins/obsidian-linter/main.js
+++ b/docs/.obsidian/plugins/obsidian-linter/main.js
--- a/docs/.obsidian/plugins/obsidian-linter/manifest.json
+++ b/docs/.obsidian/plugins/obsidian-linter/manifest.json
@@ -0,0 +1,11 @@
+{
+  "id": "obsidian-linter",
+  "name": "Linter",
+  "version": "1.34.1",
+  "minAppVersion": "1.13.0",
+  "description": "Formats and styles your notes. It can be used to format YAML tags, aliases, arrays, and metadata; footnotes; headings; spacing; math blocks; regular markdown contents like list, italics, and bold styles; and more with the use of custom rule options as well.",
+  "author": "Victor Tao",
+  "authorUrl": "https://github.com/platers",
+  "helpUrl": "https://platers.github.io/obsidian-linter/",
+  "isDesktopOnly": false
+}
--- a/docs/.obsidian/plugins/obsidian-linter/styles.css
+++ b/docs/.obsidian/plugins/obsidian-linter/styles.css
@@ -0,0 +1 @@
+.linter-no-border{border:none}.linter-border-bottom{border-bottom:1px solid var(--background-modifier-border);border-top:0;margin-bottom:.75em}.custom-row-description{margin-top:0}.modal-warn,.search-zero-state{font-weight:700}.modal-heading,.search-zero-state{text-align:center}.confirm-modal-checkbox-container{align-items:center;display:flex;gap:6px;margin-top:8px}.disabled-list-entry{color:var(--text-faint)}.linter-diff-preview-view{display:flex;flex-direction:column;height:100%;min-width:0;overflow:hidden}.linter-diff-preview-empty{color:var(--text-muted);padding:16px}.linter-diff-preview-header{align-items:flex-start;border-bottom:1px solid var(--background-modifier-border);display:flex;flex:0 0 auto;gap:12px;justify-content:space-between;padding:12px 14px}.linter-diff-preview-title-group{min-width:0}.linter-diff-preview-header h3{font-size:var(--font-ui-medium);line-height:1.3;margin:0 0 6px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.linter-diff-preview-actions{display:flex;flex:0 0 auto;gap:8px}.linter-diff-preview-body{flex:1 1 auto;min-height:0;overflow:auto;padding:12px 14px 16px}.linter-diff-preview-view .linter-diff-summary{color:var(--text-normal);display:inline-block;font-size:var(--font-ui-small);margin:0 0 10px;padding:5px 8px}.linter-diff-preview-view .linter-diff,.linter-diff-preview-view .linter-diff-summary{background:var(--background-secondary);border:1px solid var(--background-modifier-border);border-radius:6px}.linter-diff-preview-view .linter-diff{font-family:var(--font-monospace);font-size:var(--font-smaller);line-height:1.45;margin:0;overflow:hidden;padding:6px 0}.linter-diff-preview-view .linter-diff-line{display:grid;grid-template-columns:26px minmax(0,1fr);min-height:20px;padding:1px 10px 1px 0}.linter-diff-preview-view .linter-diff-marker{color:var(--text-muted);padding-right:8px;text-align:right;user-select:none}.linter-diff-preview-view .linter-diff-text{min-width:0;overflow-wrap:anywhere;white-space:pre-wrap}.linter-diff-preview-view .linter-diff-skip{border-bottom:1px solid var(--background-modifier-border);border-top:1px solid var(--background-modifier-border);color:var(--text-faint);font-family:var(--font-interface);font-size:var(--font-ui-smaller);padding:4px 12px;text-align:center}.linter-diff-preview-view .linter-diff-added{background:rgba(var(--color-green-rgb),.12);color:var(--text-normal)}.linter-diff-preview-view .linter-diff-removed{background:rgba(var(--color-red-rgb),.12);color:var(--text-normal)}.linter-diff-preview-view .linter-diff-context{color:var(--text-muted)}
--- a/docs/.obsidian/workspace.json
+++ b/docs/.obsidian/workspace.json
@@ -4,21 +4,21 @@
    "type": "split",
    "children": [
      {
-        "id": "6d9088d392cb8604",
+        "id": "81c4860f495113bf",
        "type": "tabs",
        "children": [
          {
-            "id": "22a4c1f201a1b00e",
+            "id": "daab69fc3faab88f",
            "type": "leaf",
            "state": {
              "type": "markdown",
              "state": {
-                "file": "00 INBOX/ai/valheim-items.md",
-                "mode": "preview",
+                "file": "00 INBOX/credits.md",
+                "mode": "source",
                "source": true
              },
              "icon": "lucide-file",
-              "title": "valheim-items"
+              "title": "credits"
            }
          }
        ]
@@ -91,7 +91,7 @@
            "state": {
              "type": "localgraph",
              "state": {
-                "file": "00 INBOX/ai/valheim-items.md",
+                "file": "00 INBOX/credits.md",
                "options": {
                  "collapse-filter": true,
                  "search": "",
@@ -115,7 +115,7 @@
                  "linkStrength": 1,
                  "linkDistance": 250,
                  "scale": 0.6666666666666666,
-                  "close": true
+                  "close": false
                }
              },
              "icon": "lucide-git-fork",
@@ -184,20 +184,6 @@
              "title": "tag"
            }
          },
-          {
-            "id": "8918bf52a32e4a8e",
-            "type": "leaf",
-            "state": {
-              "type": "all-properties",
-              "state": {
-                "sortOrder": "frequency",
-                "showSearch": false,
-                "searchQuery": ""
-              },
-              "icon": "lucide-ghost",
-              "title": "all-properties"
-            }
-          },
          {
            "id": "c10908b3bd97f5fa",
            "type": "leaf",
@@ -231,43 +217,43 @@
      "table-editor-obsidian:Advanced Tables Toolbar": false
    }
  },
-  "active": "22a4c1f201a1b00e",
+  "active": "daab69fc3faab88f",
  "lastOpenFiles": [
-    "00 INBOX/ai/hyprland-lua-migration-plan.md",
-    "00 INBOX/ai/deadnix-architecture.md",
-    "00 INBOX/ai/valheim-items.md",
-    "TODO.md",
+    "00 INBOX/ai/tldr-design.md",
+    "00 INBOX/ai/caps-escape-design.md",
    "AGENTS.md",
+    "00 INBOX/ai/tldr-design-tree.md",
+    "00 INBOX/ai/grill-skill-design.md",
+    "03 wrk/tasks/0012-gitea-axi-pr-merge-guardrail.md",
+    "03 wrk/tasks/0011-gitea-axi-rust-migration.md",
+    "00 INBOX/ai/gitea-axi-pr-merge-guardrail.md",
+    "00 INBOX/ai/gitea-axi-rust-migration.md",
    "00 INBOX/valheim progression.md",
+    "03 wrk/tasks/0010-fix-main-monitor-detection.md",
+    "00 INBOX/credits.md",
+    "03 wrk/tasks/0009-bazel-project-scaffolding.md",
+    "03 wrk/tasks/0005-rust-cli-scaffolding.md",
+    "03 wrk/tasks/0008-vim-obsidian-markdown-renderer.md",
+    "03 wrk/tasks/0002-nixos-refactor.md",
+    "TODO.md",
    "technical-writing.md",
-    "rust-module-prototype.md",
-    "00 INBOX/ai/statix-architecture.md",
-    "00 INBOX/ai/nix-statix-deadnix-rules.md",
+    "dictionary.md",
+    "03 wrk/tasks/0007-obsidian-source-notes.md",
+    "03 wrk/tasks/0004-dictionary-cli.md",
+    "03 wrk/tasks/0006-wallpaper-randomizer.md",
+    "03 wrk/tasks/0003-whisper-dictation.md",
+    "03 wrk/monorepo.md",
+    "03 wrk/tasks/0001-todo-cli.md",
+    "03 wrk/productivity.md",
+    "03 wrk/tasks",
    "00 INBOX/let order name resolution.md~",
-    "00 INBOX/nix name resolution.md",
-    "00 INBOX/let order name resolution.md",
    "00 INBOX/nix name resolution.md~",
    "TODO.md~",
-    "00 INBOX/ai/xatu-rule-implementation-order.md",
-    "00 INBOX/ai/xatu-architecture-design.md",
-    "00 INBOX/ai/nix-style-linter-plan.md",
-    "00 INBOX/ai/nix-style-guide-agent-customization.md",
-    "00 INBOX/ai/game-guest-readiness-plan.md",
-    "00 INBOX/ai/xatu-node-rule-static-dispatch-plan.md",
-    "00 INBOX/ai/nix-style-linter-pr-1-vendor-rnix.md",
-    "00 INBOX/ai/nix-style-linter-pr-3-let-order.md",
-    "00 INBOX/ai/nix-style-linter-pr-2-scaffold-cli.md",
-    "00 INBOX/ai/homepage-pikachu-setup-plan.md",
-    "00 INBOX/ai/source-driven-remote-deploy-plan.md",
-    "00 INBOX/ai/monorepo-work-report.md",
-    "00 INBOX/ai/clew-ast-exploration.md",
-    "00 INBOX/ai/steamcmd servers.md",
    "00 INBOX/ai/clew-ast-exploration.md~",
    "03 wrk/machoke.md~",
    "03 wrk/falinks.md~",
    "99 meta/attachments/bases/unlinked mentions.base",
    "00 INBOX/ai",
-    "03 wrk/ai",
-    "99 meta/Untitled"
+    "03 wrk/ai"
  ]
 }
--- a/INBOX/ai/adguard-pikachu-migration-design-tree.md
+++ b/INBOX/ai/adguard-pikachu-migration-design-tree.md
@@ -0,0 +1,110 @@
+# AdGuard migration to Pikachu: design tree
+
+## Research facts
+
+- The pinned Nixpkgs revision provides `adguardhome` version `0.107.79`.
+- NixOS provides the `services.adguardhome` module.
+- The module runs AdGuard Home as a hardened dynamic systemd user.
+- It stores state in `/var/lib/AdGuardHome`.
+- It grants `CAP_NET_BIND_SERVICE` for DNS port 53.
+- It grants `CAP_NET_RAW` when AdGuard Home DHCP is enabled.
+- The module supports an arbitrary YAML configuration through `settings`.
+- The module supports fully declarative operation with `mutableSettings = false`.
+- In fully declarative operation, the module replaces `/var/lib/AdGuardHome/AdGuardHome.yaml` on each service start.
+- Fully declarative operation requires `dns.bootstrap_dns` as a list.
+- Declarative settings pass an AdGuard configuration check during the build.
+- `mutableSettings = true` merges declared settings into UI changes at service start.
+- `mutableSettings = false` replaces the state configuration on every service start.
+- `openFirewall` opens only the web interface port.
+- The migration must explicitly open DNS ports 53/TCP and 53/UDP when clients need them.
+- Pikachu has address `10.23.10.102` on its untagged network.
+- Pikachu carries VLAN 20 and creates bridge `br-vlan20`.
+- The guest framework runs each guest in its own systemd-nspawn container.
+- Each guest attaches to a host VLAN bridge and receives an address through DHCP.
+- Pikachu currently configures only VLAN 20 for guests.
+- The repository has no AdGuard configuration, Proxmox inventory, or DHCP-provider configuration.
+- The current DHCP provider remains unestablished.
+- The current Proxmox AdGuard container uses MAC `bc:24:11:91:60:bf`.
+- The current Proxmox AdGuard container uses address `10.23.20.33` on VLAN 20.
+- This environment has no Proxmox SSH target or local Proxmox control utility.
+- The current AdGuard configuration listens on all guest addresses at DNS port 53.
+- The current AdGuard configuration has no allowed-client or disallowed-client restrictions.
+- The current AdGuard configuration uses Cloudflare, Google, and Quad9 encrypted upstreams in parallel.
+- The current AdGuard configuration disables DNSSEC.
+- The current AdGuard configuration defines three local rewrites.
+- The repository configures no host backup system or monitoring system.
+- Hosts update through explicit `nixos-rebuild switch --flake` commands.
+- The working tree has unrelated operator changes.
+
+## Service tradeoffs
+
+| Service | NixOS support | Domain filtering | Administration UI | DHCP | Encrypted DNS | Main tradeoff |
+| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
+| AdGuard Home | `services.adguardhome`; checked YAML and mutable or immutable state | Native block lists, rules, and per-client policy | Native | Native | Upstream and client-facing encrypted DNS | Direct migration with the closest state and feature match. UI state conflicts with fully declarative operation unless configuration is immutable. |
+| Blocky | `services.blocky`; checked declarative YAML | Native lists, allow lists, rewrites, and per-client groups | No UI; REST API and metrics only | No | Encrypted upstreams and client-facing DoH, DoT, and DoQ | Strong Git-managed configuration and low operational surface. It lacks an interactive administration interface and DHCP. |
+| Pi-hole | `services.pihole-ftl` plus `services.pihole-web`; declarative TOML, lists, and dashboard | Native gravity lists, allow lists, regex rules, and groups | Native | Native | Use a companion for encrypted upstream DNS | Familiar filtering product with a dashboard. The migration changes product data and uses more coupled services. |
+| Technitium DNS Server | `services.technitium-dns-server`; service and firewall options only | Native block lists and DNS applications | Native | Native | Upstream and client-facing encrypted DNS | Broadest DNS feature set, including authoritative DNS. NixOS does not expose its runtime configuration declaratively. |
+| Unbound | `services.unbound`; structured server and free-form settings | Local zones or response-policy zones require custom policy management | No | No | DNS-over-TLS support | Mature validating recursive resolver. Filtering and user operations require separate design. |
+| dnscrypt-proxy | `services.dnscrypt-proxy`; declarative TOML | Local block and allow rules, without a list-management UI | No | No | Encrypted upstream DNS, including DNSCrypt and DoH | Strong upstream privacy and resolver selection. It is not a full network filtering appliance. |
+| Knot Resolver | `services.kresd`; structured listener settings and extra Lua | Custom policy modules | No | No | Client-facing DoH and TLS listeners | Flexible high-performance recursive resolver. Filtering requires resolver expertise and custom policy. |
+| SmartDNS | `services.smartdns`; free-form settings | Domain and address rules | No NixOS-integrated UI | No | Encrypted upstream and client-facing DNS | Optimizes upstream selection and latency. It offers less complete filtering management than dedicated blockers. |
+
+`Native` means that the product provides the feature without a companion service.
+
+## Decision tree
+
+- **D1 — DNS service product** [settled]
+  - Retain AdGuard Home on Pikachu.
+    - Constraint: Preserve AdGuard Home as the DNS service product.
+    - **D2A — AdGuard Home role** [settled]
+      - Provides DNS filtering and resolution only.
+      - Constraint: The existing DHCP provider continues to assign addresses and DHCP options.
+    - **D3A — Execution placement** [settled]
+      - Runs in a dedicated guest on Pikachu's existing VLAN 20.
+      - Constraint: Isolate AdGuard Home from the Pikachu host.
+    - **D4A — Guest network identity** [settled]
+      - Reuses MAC `bc:24:11:91:60:bf` and address `10.23.20.33` on VLAN 20.
+      - Constraint: Stop the Proxmox container before the guest starts.
+    - **D5A — Network exposure** [settled]
+      - Listens on all guest addresses at port 53.
+      - Accepts requests from every reachable internal device.
+    - **D6A — Resolver policy** [settled]
+      - Preserves the existing upstream resolvers and parallel resolver mode.
+      - Preserves disabled DNSSEC and the three local rewrites.
+    - **D7A — Configuration authority** [settled]
+      - Uses fully declarative Nix configuration.
+      - Constraint: Set `services.adguardhome.mutableSettings = false`.
+      - Constraint: Declare `dns.bootstrap_dns` as a list.
+      - Constraint: Web UI changes do not persist.
+      - Constraint: Match existing service behavior except for the administrator password.
+    - **D8A — Migration data** [settled]
+      - Migrate functional DNS configuration only.
+      - Constraint: Do not migrate query history or statistics.
+    - **D9A — Operations** [settled]
+      - Declares a newly generated bcrypt verifier in Nix.
+      - Constraint: Keep the plaintext password outside the repository and Nix store.
+      - Constraint: The verifier is readable from the Nix store.
+    - **D10A — Cutover and rollback** [settled]
+      - Uses a planned atomic cutover with rollback.
+      - Stop the Proxmox container before starting the guest.
+      - Validate the guest before restoring the Proxmox container during rollback.
+    - **D11A — Runtime-state backup** [settled]
+      - Do not back up rebuildable AdGuard Home runtime state.
+    - **D12A — Monitoring** [settled]
+      - Do not add DNS availability monitoring.
+    - **D13A — Upgrade ownership** [settled]
+      - The normal flake update and explicit NixOS rebuild workflow owns upgrades.
+  - Replace AdGuard Home. [not selected]
+    - **D2B — Replacement product** [not applicable]
+      - Choose Blocky, Pi-hole, Technitium, or a composed resolver.
+
+## Frontier
+
+None.
+
+## Sources
+
+- Pinned Nixpkgs module: `nixos/modules/services/networking/adguardhome.nix`.
+- Pinned Nixpkgs modules: `blocky.nix`, `pihole-ftl.nix`, `pihole-web.nix`, `technitium-dns-server.nix`, `unbound.nix`, `dnscrypt-proxy.nix`, `knot-resolver.nix`, and `smartdns.nix`.
+- AdGuard Home README, release `v0.107.79`.
+- Technitium DNS Server README, current upstream.
--- a/INBOX/ai/caps-escape-design.md
+++ b/INBOX/ai/caps-escape-design.md
@@ -0,0 +1,39 @@
+# Caps Escape Design
+
+## Facts
+
+- Commit `250b0b71f` removed `services.xserver.xkb.options` from the shared host module.
+- The removed option was `caps:escape_shifted_capslock`.
+- That XKB option maps Caps Lock to Escape.
+- Shift+Caps Lock still enables Caps Lock.
+- The shared host module configures Neogaia, Zeus, and Pikachu.
+- Zeus has QMK firmware that provides equivalent keyboard behavior.
+- Neogaia and Zeus enable `modules.host.cachyos` and `modules.desktop`.
+- Pikachu enables neither module.
+- `configs/nixos/hosts/neogaia/default.nix` directly sets Neogaia-specific hardware, networking, desktop application, and Waybar settings.
+- The current configuration has no Caps Lock or Escape remapping.
+- This session runs on Zeus, not Neogaia.
+
+## Design Tree
+
+- Restore Caps Lock behavior
+  - Scope the configuration
+    - Configure Neogaia only. ✓
+  - Select the mapping behavior.
+    - Restore `caps:escape_shifted_capslock`. ✓
+    - Set `services.xserver.xkb.options` in `configs/nixos/hosts/neogaia/default.nix`. ✓
+  - Define validation for Neogaia.
+    - Run static checks and manually verify both keys after deployment. ✓
+    - Stop after source and static validation. ✓
+
+## Settled Decisions
+
+1. Configure the mapping on Neogaia only.
+2. Restore `caps:escape_shifted_capslock`.
+3. Set `services.xserver.xkb.options` directly in Neogaia's host configuration.
+4. Run static checks and manually verify both keys on Neogaia after deployment.
+5. Stop after source and static validation.
+
+## Frontier
+
+None.
--- a/INBOX/ai/deadnix-architecture.md
+++ b/INBOX/ai/deadnix-architecture.md
@@ -1,304 +0,0 @@
-# Deadnix Architecture
-
-## Purpose
-
-This note explains how `deadnix` finds unused Nix code.
-It focuses on architecture, not whether each check belongs in our linter.
-
-Use this note when deciding whether our linter needs scope analysis.
-
-## What Deadnix Is
-
-`deadnix` is a dead-code scanner for Nix.
-It finds bindings that introduce names which no live code uses.
-
-It is not a general style linter.
-It does not have many independent rules.
-It implements one analysis family: unused declarations.
-
-Like `statix`, it parses source text with `rnix`.
-It does not evaluate Nix.
-It does not import files.
-It reasons over local syntax and local scope only.
-
-## Minimal Dead-Code Vocabulary
-
- A binding introduces a name.
- A scope defines where introduced names are visible.
- A use is an identifier occurrence that refers to a binding.
- Shadowing happens when an inner scope reuses an outer name.
- Dead code is a binding that no live code uses.
- A fixed point is the final result after repeated analysis no longer changes.
-
-Dead-code analysis needs more state than a simple syntax lint.
-It must know which names a scope introduces and where those names can be used.
-
-## Component Map
-
-`deadnix` has fewer layers than `statix`.
-The command-line entry point, file walk, parsing, analysis, reporting, and editing live in one small tool.
-
-The important concepts are separate modules:
-
- settings control analysis options;
- scopes describe where names are introduced;
- bindings describe individual declared names;
- usage search answers whether a name appears in a live body;
- dead-code results connect a binding to its scope;
- reports render findings;
- edits remove or rename unused declarations.
-
-## Main Pipeline
-
-```mermaid
-flowchart TD
-    A[Parse CLI options] --> B[Collect input files]
-    B --> C[Read each file]
-    C --> D[Parse with rnix]
-    D --> E[Skip file on parse errors]
-    D --> F[Run dead-code analysis]
-    F --> G[Print reports unless quiet]
-    G --> H[Apply edits when --edit is set]
-    H --> I[Exit 1 when --fail and findings exist]
-```
-
-The CLI accepts files or directories.
-Directory mode walks `.nix` files.
-Hidden files require an explicit option.
-Excludes filter paths before analysis.
-
-The tool skips dead-code diagnostics when a file has parse errors.
-It reports parse errors to the user and continues with other files.
-
-## Analysis Settings
-
-The analysis has four important switches.
-
-`no_lambda_arg` disables checks for single lambda arguments.
-This can avoid noise when an API requires an argument name.
-
-`no_lambda_pattern_names` disables checks for names in attribute-set function patterns.
-This matters for `callPackage`-style code, where argument names can be external API.
-
-`no_underscore` ignores bindings that start with `_`.
-This treats `_name` as an intentional unused placeholder.
-
-`warn_used_underscore` reports underscore-prefixed bindings that code actually uses.
-This enforces the convention that `_name` means unused.
-
-These settings are architecture-relevant because dead-code policy depends on API context.
-A repository linter needs a way to express that context.
-
-## Scope Model
-
-`deadnix` recognizes four scope types.
-
-### Lambda pattern scope
-
-A lambda pattern is a function argument written as an attribute set pattern.
-It can introduce field names and an optional alias for the whole argument set.
-
-Example shape:
-
-```nix
-args @ { pkgs, lib, ... }: body
-```
-
-This scope can introduce `args`, `pkgs`, and `lib`.
-
-### Lambda argument scope
-
-A single lambda argument introduces one name.
-
-Example shape:
-
-```nix
-pkgs: body
-```
-
-This scope introduces `pkgs`.
-
-### Let scope
-
-A `let` expression introduces bindings and inherited names.
-Those names are available in binding expressions and in the body.
-
-Example shape:
-
-```nix
-let
-  inherit (pkgs) hello;
-  value = hello;
-in
-  value
-```
-
-This scope introduces `hello` and `value`.
-
-### Recursive attribute-set scope
-
-A `rec` attribute set introduces names that sibling attributes can reference.
-`deadnix` models this scope, but treats its bindings as non-removable.
-
-That conservative choice avoids deleting public-looking attributes from recursive sets.
-
-## Binding Model
-
-A binding stores three facts.
-
-It stores the identifier name.
-It stores the syntax node that declared the name.
-It stores whether the binding is mortal.
-
-A mortal binding can become a dead-code finding.
-A non-mortal binding participates in name lookup but will not be removed.
-
-Single lambda arguments that already start with `_` are non-mortal.
-Recursive attribute-set bindings are also non-mortal.
-
-A binding also checks for the `deadnix: skip` pragma.
-The pragma applies to a nearby following declaration.
-The scanner searches backward from the declaration and stops after a blank-line boundary.
-
-## Usage Search
-
-Usage search asks whether a given name appears inside a syntax subtree.
-
-The search is scope-aware.
-When it enters a child scope that binds the same name, it stops following that branch.
-That prevents an inner binding from counting as a use of an outer binding.
-
-Attribute paths get special handling.
-Ordinary attribute keys do not count as uses.
-Dynamic or string attribute names can contain expressions, so the search looks inside those parts.
-
-`inherit` also gets special handling.
-A scope can inherit names from an outer scope.
-The analysis checks whether the inherited expression uses the searched name.
-
-## Fixed-Point Analysis
-
-`deadnix` repeats the scan until the result set stops changing.
-
-This matters because dead code can depend on other dead code.
-A binding can appear used during the first pass because another binding references it.
-If the referring binding is dead, the referenced binding is also dead.
-
-The loop tracks dead declaration nodes.
-During later scans, uses inside already-dead bodies do not keep other bindings alive.
-
-This fixed-point loop is the central architectural difference from simple local syntax lints.
-It makes dead-code results transitive.
-
-## Reporting Model
-
-A result stores the scope and binding for one finding.
-The display text combines both parts.
-Examples include unused lambda pattern, unused lambda argument, and unused let binding.
-
-Human output uses `ariadne`.
-The reporter groups ranges by line and labels the exact binding names.
-It uses different colors for different scope kinds.
-
-JSON output exists behind a feature flag.
-It emits file, message, line, column, and end column.
-
-`NO_COLOR` disables colored human output.
-
-## Edit Model
-
-`deadnix --edit` converts findings into text edits.
-Each edit has a start offset, end offset, and replacement string.
-
-The edit behavior depends on scope kind.
-
-For unused lambda pattern names, it removes the name and nearby comma or whitespace.
-For unused pattern aliases, it removes the alias syntax.
-For unused lambda arguments, it renames the argument with an underscore prefix.
-For unused `let` assignments, it deletes the assignment.
-For unused inherited names, it deletes only the inherited name.
-
-After those edits, it parses the edited source again.
-Then it removes empty `let in` constructs and empty `inherit` statements.
-
-This cleanup pass prevents the first edit batch from leaving invalid or useless scaffolding.
-
-## Error Handling
-
-If a path cannot be stated or read, the CLI reports the file error and continues.
-If a file has parse errors, the CLI reports those errors and skips dead-code analysis for that file.
-
-The `--fail` flag changes exit status when findings exist.
-Without `--fail`, findings do not make the command fail.
-
-This design separates report generation from CI policy.
-
-## Architectural Strengths
-
-The scope model is explicit.
-Each scope type declares which bindings it introduces and where those bindings are visible.
-
-The fixed-point loop catches transitive dead code.
-A binding used only by dead code also becomes dead.
-
-The usage search handles shadowing.
-That prevents common false positives in nested functions and nested `let` expressions.
-
-The edit model is tied to analysis results.
-It knows whether a binding came from a lambda, pattern, `let`, or `inherit`.
-
-The tool has few moving parts.
-That makes the analysis easy to follow compared to a general multi-rule linter.
-
-## Architectural Limits
-
-`deadnix` does not evaluate Nix.
-It cannot know which names external callers depend on.
-This matters for module arguments, package function arguments, and public attribute sets.
-
-It has global switches rather than project-specific rule contexts.
-For example, all lambda pattern names can be checked or skipped.
-The tool does not know that one directory contains `callPackage` functions.
-
-The analysis is local to one file.
-It cannot see that another file imports a function and relies on its argument names.
-
-The fixer performs text edits with byte ranges.
-It must handle punctuation and whitespace carefully.
-Pattern edits are harder than simple assignment deletion.
-
-The tool has one analysis family.
-It is not a framework for many unrelated rules.
-
-## Lessons for Our Linter
-
-Dead-code checks need a scope pass.
-A per-node rule interface is not enough when a diagnostic depends on name visibility.
-
-Represent scopes explicitly.
-Each scope type should provide introduced bindings and visible bodies.
-
-Track shadowing before reporting unused names.
-A text search for an identifier is not sufficient.
-
-Use fixed-point analysis for transitive dead code.
-One pass misses names used only by dead declarations.
-
-Separate policy from mechanics.
-The mechanics can find unused names.
-Repository policy decides whether module arguments, package arguments, or underscore names count.
-
-Treat autofix as scope-specific.
-Removing a pattern name is not the same operation as deleting a `let` assignment.
-
-Run cleanup after edits.
-Dead-code fixes can create empty `let` expressions and empty `inherit` statements.
-
-## Open Design Questions for Our Linter
-
- Should dead-code analysis be part of `nix-style-linter`, or a separate command?
- Should policy vary by path, file kind, or suppression comment?
- Should recursive attribute-set members ever become removable findings?
- Should underscore names mean ignored, or should used underscore names be errors?
- Should the linter report unused names without offering autofix first?
- Should cleanup rules run as ordinary rules or as a post-fix pass?
--- a/INBOX/ai/hyprland-lua-migration-plan.md
+++ b/INBOX/ai/hyprland-lua-migration-plan.md
@@ -1,102 +0,0 @@
-# Hyprland Lua Migration Plan
-
-## Problem Statement
-
-The Hyprland compositor config uses Home Manager's hyprlang output.
-Hyprland deprecates hyprlang for the main compositor config.
-The repository needs to generate a Lua config without changing desktop behavior.
-
-## Solution
-
-Keep the config owned by Nix and Home Manager.
-Switch the Hyprland Home Manager config output to Lua.
-Convert only the settings whose shape changes under Lua.
-
-This is not a desktop redesign.
-The change preserves the current monitors, binds, window rules, environment variables, and UWSM startup.
-
-## User Stories
-
-1. As the operator, I want Hyprland to load `hyprland.lua`, so that startup no longer warns about hyprlang deprecation.
-
-2. As the operator, I want existing keyboard binds to keep working, so that the desktop behavior stays unchanged.
-
-3. As the operator, I want host monitor layout to stay unchanged, so that the physical display setup does not move.
-
-4. As the operator, I want session environment variables to stay in the compositor config, so that Wayland and cursor behavior stays unchanged.
-
-5. As the operator, I want auxiliary module binds to keep working, so that launcher, lock, screenshot, clipboard, notifications, and recording flows stay usable.
-
-## Implementation Decisions
-
-1. Use Home Manager's Lua config generator.
-   Set the Hyprland config type to Lua and keep package ownership unchanged.
-
-2. Keep ordinary compositor options declarative in Nix.
-   Move input, general, decoration, xwayland, animation, and layout settings into the Lua config structure.
-
-3. Remove hyprlang-only variables from generated config.
-   Keep modifier and terminal values as Nix locals or helper inputs.
-
-4. Add minimal local helpers for Lua calls.
-   Use helpers only for repeated bind, dispatcher, command, environment, and rule shapes.
-
-5. Convert all bind strings to Lua bind call data.
-   Preserve key combinations, dispatchers, commands, repeat behavior, and locked-session behavior.
-
-6. Convert contributed binds in their owning modules.
-   Keep each bind near the module that owns the tool it launches.
-
-7. Convert monitor strings to Lua monitor records.
-   Preserve output names, modes, positions, scale values, and rotation.
-
-8. Convert the screenshot window rule to the Lua rule shape.
-   Preserve the Satty class matcher and floating behavior.
-
-9. Convert environment strings to Lua environment calls.
-   Preserve the Wayland flag and cursor variables.
-
-10. Delete or update comments that describe hyprlang syntax.
-    Keep comments that explain behavior or non-obvious invariants.
-
-## Testing Decisions
-
-1. Run the repository Nix formatting and style checks for modified Nix files.
-
-2. Evaluate or build the affected host configuration.
-   This proves Home Manager accepts the Lua settings structure.
-
-3. Confirm the generated config file uses Lua.
-   The expected output is `hyprland.lua`, not `hyprland.conf`.
-
-4. Verify Hyprland accepts the generated Lua config.
-   Use Hyprland config verification when the installed build supports it.
-   Otherwise reload the compositor and inspect errors.
-
-5. Smoke test the changed desktop surface.
-   Test one bind from each source area after reload.
-
-6. Check the explicit monitor layout on the host that declares it.
-   Confirm resolution, position, scale, and rotation stayed unchanged.
-
-## Out of Scope
-
- Do not split the config into Lua modules.
- Do not hand-write a full Lua config.
- Do not add new Hyprland behavior.
- Do not change UWSM startup.
- Do not redesign binds, monitor layout, or visual settings.
- Do not change hyprlock, hypridle, waybar, mako, or rofi settings beyond their Hyprland binds.
-
-## Further Notes
-
-Home Manager documents `configType = "lua"` for Hyprland.
-It maps settings to `hl.*` calls.
-It supports `_args` for multi-argument calls.
-It supports raw Lua expressions with `lib.generators.mkLuaInline`.
-
-The riskiest parts are binds, monitor declarations, and window rules.
-Those parts changed shape more than scalar config sections.
-
-Assumption: the pinned Home Manager input contains the documented Lua Hyprland generator.
-Validate this during the configuration build.
--- a/INBOX/ai/nixos-agents-style-scope-design-tree.md
+++ b/INBOX/ai/nixos-agents-style-scope-design-tree.md
@@ -0,0 +1,130 @@
+# NixOS AGENTS and style-skill scope design tree
+
+This tree reviews `configs/nixos/AGENTS.md`.
+It decides which instructions belong in Nix style rules.
+
+## Known facts
+
+- `configs/nixos/AGENTS.md` has 70 lines.
+- Each frontier question quotes the complete instruction under review.
+- This review decides instruction placement only.
+- It supplies guidance for desktop, Firefox, Neovim, AI tooling, and NixOS gotchas.
+- The `/review` prompt loads `nix-style` for Nix files.
+- `nix-style` loads every rule under `src/skills/style/nix/rules/`.
+- The current Nix rules cover Nix syntax and flake structure.
+- `configs/nixos/AGENTS.md` includes a guest-module ownership rule.
+- The RomM session missed that ownership rule during implementation.
+- `registry.window-icon` exists in `configs/nixos/registry/window-icon.nix`.
+- Desktop application modules declare window classes and rendered icons in that registry.
+- Hyprland reads the registry to generate workspace icon mappings.
+- The AGENTS instruction named the registry after its introduction on 2026-10-11.
+- The `class` option describes its window-class match.
+- The `icon` option describes a string icon value.
+- The registry schema does not document the rendered-string requirement or the class-discovery command.
+- Hyprland renders `config.registry.env` as its `env` configuration.
+- The `env` registry replaced direct Hyprland environment declarations in commit `370cab8f8`.
+- `configs/nixos/modules/desktop/apps/r2modman.nix` enables a graphical application without a `registry.window-icon` declaration.
+- The current registry modules already validate value uniqueness and field combinations.
+- They do not validate required producer declarations.
+- The registry collector is specific to the NixOS dotfiles configuration.
+- A non-discoverable environment fact records local behavior that configuration, source code, and normal tool help do not reveal.
+- The current instruction groups are:
+  - Desktop: window icons, Hyprland environment variables, and cursor settings.
+  - Firefox: search-engine declarations and extension-storage compatibility.
+  - Neovim: Nixvim package-set selection.
+  - AI tooling: Herdr key names and Pi configuration locations.
+  - Gotchas: registry APIs, guest boundaries, SOPS ownership, guest mounts, deployment, DNS, hardware, module paths, and host commands.
+
+## Decision tree
+
+- Instruction review
+  - Settled: Review each complete instruction in source order.
+  - Registry conventions
+    - Settled: Create `src/skills/style/nix/rules/dotfiles.md`.
+    - Graphical application icon instruction
+      - Settled: Move the complete instruction to `src/skills/style/nix/rules/dotfiles.md`.
+    - Hyprland session environment instruction
+      - Settled: Remove it because `registry.env` superseded it.
+    - Firefox search-engine instruction
+      - Settled: Remove it because the Firefox module documents the configuration.
+    - Firefox extension-storage instruction
+      - Settled: Move it to a comment above `extensions.settings` in `modules/desktop/apps/firefox.nix`.
+    - Neovim package-set instruction
+      - Settled: Move it to a comment above `nixpkgs.useGlobalPackages` in `modules/shell/nvim/default.nix`.
+    - Herdr key-name instruction
+      - Settled: Remove it.
+    - Pi extension location instruction
+      - Settled: Remove it. It recorded a completed migration from NixOS-managed sources.
+    - Pi generated-settings instruction
+      - Settled: Remove it because the Pi module documents the managed boundary.
+    - Library-function qualification instruction
+      - Settled: Generalize it and move it to `src/skills/style/nix/rules/general.md`.
+    - Guest ownership instruction
+      - Settled: Move it to `src/skills/style/nix/rules/dotfiles.md`.
+    - SOPS guest-owner instruction
+      - Settled: Move it to `src/skills/style/nix/rules/dotfiles.md`.
+    - Nested guest-mount instruction
+      - Settled: Remove it because the example describes no active layout.
+    - `deploy-to` instruction
+      - Settled: Remove it. Agents cannot complete its remote sudo steps.
+    - Pikachu deploy-closure instruction
+      - Settled: Remove it because `deploy-to` encodes the required import path.
+    - Public-DNS instruction
+      - Settled: Remove it.
+    - Hardware-configuration instruction
+      - Settled: Remove it because the root auto-generated-file rule owns the policy.
+    - Chaotic-cache instruction
+      - Settled: Remove it because `modules.host.cachyos.enable` owns the cache configuration.
+    - Module-relative-path instruction
+      - Settled: Remove it because Nix evaluation reports invalid paths.
+    - Pikachu `uptime` instruction
+      - Settled: Remove it because the command exposes its supported options.
+    - Guest-ACME-evaluation instruction
+      - Settled: Remove it because current direct guest evaluation succeeds.
+    - systemd executable instruction
+      - Settled: Remove it because `general.md` already requires `lib.getExe'` for non-main executables.
+
+## Frontier
+
+The frontier is empty.
+
+## Shared understanding
+
+Remove these instructions from `configs/nixos/AGENTS.md`:
+
+- Hyprland session environment
+- Firefox search engines
+- Herdr shifted punctuation
+- Pi extension source location
+- Pi managed settings
+- Nested guest mounts
+- `deploy-to` behavior
+- Pikachu deploy closures
+- Public DNS boundary
+- Hardware configuration
+- Chaotic cache selection
+- Module-relative paths
+- Pikachu boot time
+- Guest ACME evaluation
+- systemd executable selection
+
+Move these instructions intact to `src/skills/style/nix/rules/dotfiles.md`:
+
+- Graphical application icons
+- Guest ownership
+- SOPS guest ownership
+
+Move the generalized library-function qualification convention to
+`src/skills/style/nix/rules/general.md`.
+
+Move these instructions to code comments:
+
+- Firefox extension storage: above `extensions.settings` in
+  `configs/nixos/modules/desktop/apps/firefox.nix`
+- Nixvim package set: above `nixpkgs.useGlobalPackages` in
+  `configs/nixos/modules/shell/nvim/default.nix`
+
+The review does not decide how to restore the auto-generated status of
+`configs/nixos/hosts/pikachu/hardware-configuration.nix`.
+
+The operator confirmed this design and authorized the edits.
--- a/INBOX/ai/romm-migration-design-tree.md
+++ b/INBOX/ai/romm-migration-design-tree.md
@@ -0,0 +1,106 @@
+# RomM migration design tree
+
+## Known facts
+
+- RomM is listed under the Pikachu and Pichu Proxmox migration.
+- Pikachu already runs VLAN 20 guests with persistent storage.
+- Nixpkgs provides a tested `services.romm` module at version 5.2.0.
+- `services.romm.dataDir` defaults to `/var/lib/romm`.
+- RomM stores the game library below `/var/lib/romm/library`.
+- RomM stores saves, states, user-uploaded screenshots, and profile avatars below `/var/lib/romm/assets/users/<user-id>/`.
+- RomM derives `<user-id>` from its database ID, so it is not a stable configured username.
+- RomM stores scraped covers and provider-sourced game screenshots below `/var/lib/romm/resources/roms/<platform-id>/<rom-id>/`.
+- RomM 5.4.0 exists upstream but Nixpkgs does not package it.
+- RomM 5.3.0 requires an explicit library-structure declaration in `config.yml`.
+- The 5.4.0 package phase must add the Structure A declaration for `roms/{platform}/{game}` and `bios/{platform}`.
+- RomM 5.4.0 can modify ROM files in place only when library conversion is explicitly enabled.
+- RomM 5.3.0 identifies hashed ROMs by CRC, MD5, and SHA-1 after a scan.
+- RomM 5.3.0 matches moved or renamed hashed ROMs to their existing database records.
+- This migration is a fresh installation.
+- The new library will receive selected ROMs from the old installation.
+- Copyparty serves `/pikachu/media` as its writable `/media` volume.
+
+## Decision tree
+
+- RomM deployment
+  - Target location
+    - Settled: Deploy a dedicated guest on Pikachu.
+    - Package source
+      - Settled: Start with Nixpkgs's RomM 5.2.0 package.
+      - Settled: Package RomM 5.4.0 locally as follow-up work.
+    - Persistent storage
+      - Settled: Use `/var/lib/romm` in the guest.
+      - Settled: Mount `/pikachu/data/romm` at `/var/lib/romm`.
+      - Settled: Mount the ROM library separately at `/var/lib/romm/library`.
+      - Settled: Mount user assets separately for Copyparty browsing.
+      - Settled: Keep scraped resources in `/pikachu/data/romm`.
+      - Settled: Mount `/pikachu/media/games/emulation/roms` at `/var/lib/romm/library/roms`.
+      - Settled: Mount `/pikachu/media/games/emulation/bios` at `/var/lib/romm/library/bios`.
+      - Settled: Mount `/pikachu/media/games/emulation/users` at `/var/lib/romm/assets/users`.
+      - Settled: Mount `/pikachu/data/romm/postgresql` at `/var/lib/postgresql`.
+      - Settled: Mount `/pikachu/data/romm/redis` at `/var/lib/redis-romm`.
+    - Guest networking
+      - Settled: Follow the standard guest-provisioning protocol, including its VLAN 20 DHCP reservation.
+    - Public route
+      - Settled: Retain the old installation's public domain.
+    - Metadata and authentication secrets
+      - Settled: Configure IGDB, ScreenScraper, and SteamGridDB.
+      - Settled: Use RomM's default metadata and artwork priority.
+      - Settled: Manage the 5.4.0 `config.yml` declaratively with Nix.
+      - Settled: Use RomM's default region and English-language priority.
+    - Save synchronization
+      - Settled: Disable automatic browser save synchronization in 5.4.0.
+    - Authentication
+      - Settled: Use RomM's built-in accounts initially.
+      - Deferred: Configure RomM as an OpenID Connect client after an identity provider exists.
+    - ROM selection and import
+      - Settled: The operator manually selects and copies ROMs after deployment.
+      - Settled: Do not create automatic import tooling or a ROM manifest.
+    - Capacity and service limits
+      - Settled: Limit the guest to `4G` memory, `200%` CPU, and `512` tasks.
+    - Library scanning
+      - Settled: Enable the filesystem watcher for library changes.
+    - Cutover and retirement
+      - Out of scope: The operator manages the old installation and public-domain cutover outside this monorepo.
+  - Work phases
+    - Settled: Create a RomM guest module with Nixpkgs's package in [[0014-romm-guest]].
+    - Settled: Package RomM 5.4.0 locally and reuse `services.romm` in [[0015-romm-5-4-package]].
+    - Settled: Move selected ROMs after the service deployment is ready in [[0016-romm-manual-rom-migration]].
+
+## Settled decisions
+
+- **Migration model:** Start with a fresh RomM installation.
+- **Data scope:** Copy selected ROMs from the old installation.
+- **Old application state:** Do not migrate the database, users, sessions, or job queue.
+- **Deployment target:** Deploy a dedicated guest on Pikachu.
+- **Initial package:** Use Nixpkgs's RomM 5.2.0 package.
+- **Package follow-up:** Package RomM 5.4.0 locally.
+- **Work phases:** Deploy the guest, update the package, then import selected ROMs.
+- **Guest data directory:** Use RomM's default `/var/lib/romm`.
+- **Host application data:** Mount `/pikachu/data/romm` at `/var/lib/romm`.
+- **ROM library:** Mount it separately at `/var/lib/romm/library`.
+- **Storage classification:** Preserve the distinction between application data and browsable media.
+- **User assets:** Mount `/pikachu/media/games/emulation/users` at `/var/lib/romm/assets/users` to expose saves, states, user-uploaded screenshots, and profile avatars through Copyparty.
+- **ROM paths:** Mount `/pikachu/media/games/emulation/roms` and `/pikachu/media/games/emulation/bios` at the corresponding children of `/var/lib/romm/library`.
+- **Guest networking:** Follow the standard guest-provisioning protocol.
+- **Public route:** Retain the old installation's public domain.
+- **Metadata providers:** Configure IGDB, ScreenScraper, and SteamGridDB in both package phases.
+- **Metadata priority:** Use RomM's default metadata and artwork priority.
+- **RomM configuration:** Manage the required 5.4.0 `config.yml` declaratively with Nix.
+- **Scan region and language priority:** Use RomM's defaults.
+- **Initial authentication:** Use RomM's built-in accounts.
+- **OIDC follow-up:** Track it in [[0013-oidc-provider]].
+- **ROM migration:** The operator manually selects and copies ROMs after deployment.
+- **Guest limits:** Cap the guest at `4G` memory, `200%` CPU, and `512` tasks.
+- **Library watcher:** Enable the filesystem watcher.
+- **PostgreSQL:** Mount `/pikachu/data/romm/postgresql` at `/var/lib/postgresql`.
+- **Redis:** Mount `/pikachu/data/romm/redis` at `/var/lib/redis-romm`.
+- **Browser save synchronization:** Disable it in 5.4.0 until browser emulation is needed.
+
+## Frontier
+
+No in-scope decisions remain.
+
+## Next question
+
+None. Present the settled design for confirmation before implementation.
--- a/INBOX/ai/tldr-design-tree.md
+++ b/INBOX/ai/tldr-design-tree.md
@@ -0,0 +1,36 @@
+# TL;DR command design tree
+
+This tree reviews the implementation decisions in `tldr-design.md`.
+
+## Settled decisions
+
+- **Command form and scope:** Add the project prompt template `.pi/prompts/tldr.md`.
+- **Explicit source interface:** Interpret command arguments as a free-form source request.
+- **Default source:** Summarize the preceding agent response when no source request exists.
+- **Summary shape:** Produce a compact summary without a fixed format.
+- **Unavailable or unclear sources:** Add no special handling policy.
+
+## Decision tree
+
+- Command behavior
+  - Source selection
+    - Settled: Use the preceding agent response without arguments.
+    - Settled: Interpret arguments as a free-form source request.
+  - Output
+    - Settled: Produce a compact summary without a fixed format.
+    - Summary language
+      - Settled: Do not prescribe a language policy.
+  - Error behavior
+    - Settled: Add no special handling policy for unavailable or unclear sources.
+
+## Frontier
+
+The frontier is empty.
+
+## Shared understanding pending confirmation
+
+The project gets a `/tldr` prompt command in `.pi/prompts/tldr.md`.
+Without arguments, it summarizes the preceding agent response.
+With arguments, it interprets them as a free-form source request.
+It produces a compact summary with no fixed format or language policy.
+The prompt adds no special policy for unavailable or unclear sources.
--- a/INBOX/ai/tldr-design.md
+++ b/INBOX/ai/tldr-design.md
@@ -0,0 +1,39 @@
+# TL;DR command design
+
+## Goal
+
+Add a Pi command that summarizes the preceding agent response by default.
+An explicit command argument identifies the source to summarize.
+
+## Decision tree
+
+- Command form and scope
+  - Settled: Create a project prompt template at `.pi/prompts/tldr.md`.
+  - Command interface
+    - Settled: Pass arguments through as a free-form source request.
+    - Default source selection
+      - Settled: Summarize the preceding agent response when no source request exists.
+      - Summary format and length
+        - Settled: Use a compact, format-free summary.
+        - Ambiguous-source behavior
+          - Settled: Add no special handling policy.
+
+## Settled decisions
+
+- **Q1 — Command form and scope:** Create a project prompt template.
+- **Q2 — Explicit source interface:** Accept a free-form source request.
+- **Default source selection:** Summarize the preceding agent response when the command has no arguments.
+- **Q3 — Summary shape:** Use a compact, format-free summary.
+- **Q4 — Unavailable source:** Add no special handling policy.
+
+## Frontier
+
+The frontier is empty.
+
+## Shared understanding pending confirmation
+
+The project gets a `/tldr` prompt command in `.pi/prompts/tldr.md`.
+Without arguments, it summarizes the preceding agent response.
+With arguments, it interprets them as a free-form source request.
+It produces a compact summary with no fixed format.
+The prompt adds no special policy for unavailable or unclear sources.
--- a/INBOX/credits.md
+++ b/INBOX/credits.md
@@ -0,0 +1,14 @@
+---
+aliases:
+  - Credits
+date-created: 2026-10-17 18:08
+date-modified: 2026-10-17 23:33
+---
+
+# Credits
+
+| Path                                | Original                                                                                | Notes |   |
+|-------------------------------------|-----------------------------------------------------------------------------------------|-------|---|
+| `//src/skills/agent-writing-skills` | <https://github.com/mattpocock/skills/tree/main/skills/productivity/writing-for-agents> |       |   |
+| `//src/skills/retrospect`           | <https://github.com/mattpocock/skills/tree/main/skills/engineering/retro>               |       |   |
+|                                     |                                                                                         |       |   |
--- a/wrk/dotfiles.md
+++ b/wrk/dotfiles.md
@@ -0,0 +1,8 @@
+---
+aliases:
+  - Dotfiles
+date-created: 2026-10-14 16:27
+date-modified: 2026-10-14 16:28
+---
+
+# Dotfiles
--- a/wrk/monorepo.md
+++ b/wrk/monorepo.md
@@ -0,0 +1,8 @@
+---
+aliases:
+  - Monorepo
+date-created: 2026-10-14 22:51
+date-modified: 2026-10-14 22:54
+---
+
+# Monorepo
--- a/wrk/productivity.md
+++ b/wrk/productivity.md
@@ -0,0 +1,8 @@
+---
+aliases:
+  - Productivity
+date-created: 2026-10-14 16:32
+date-modified: 2026-10-14 16:33
+---
+
+# Productivity
--- a/wrk/tasks/0001-todo-cli.md
+++ b/wrk/tasks/0001-todo-cli.md
@@ -0,0 +1,16 @@
+---
+aliases:
+  - "0001"
+  - TODO CLI
+date-created: 2026-10-14 00:49
+date-modified: 2026-10-14 22:52
+status: open
+area: "[[productivity]]"
+blocked-by:
+  - "[[0005-rust-cli-scaffolding]]"
+subtasks: []
+---
+
+# TODO CLI
+
+Write a TODO CLI that enforces the task workflow in this vault deterministically. This allows agents to participate in task management with minimal cost instead of relying on markdown generation and parsing arbitrary metadata while maintaining human readability.
--- a/wrk/tasks/0002-nixos-refactor.md
+++ b/wrk/tasks/0002-nixos-refactor.md
@@ -0,0 +1,103 @@
+---
+aliases:
+  - "0002"
+  - NixOS Refactor
+date-created: 2026-10-14 16:07
+date-modified: 2026-10-19 16:44
+status: closed
+area: "[[dotfiles]]"
+blocked-by: []
+subtasks: []
+---
+
+# NixOS Refactor
+
+Complete the remaining Nix refactor work.
+
+## Files
+
+- [x] `flake.nix`
+- [x] `src/flake/default.nix`
+- [x] `src/flake/formatter.nix`
+- [x] `src/flake/apps.nix`
+- [x] `src/dotfiles/default.nix`
+- [x] `src/dotfiles/util.nix`
+- [x] `src/dotfiles/registry.nix`
+- [x] `src/dotfiles/registry/schema.nix`
+- [x] `src/dotfiles/registry/validation.nix`
+- [x] `configs/nixos/registry/address.nix`
+- [>] `configs/nixos/registry/homepage.nix`
+- [x] `configs/nixos/registry/route.nix`
+- [x] `configs/nixos/registry/shell-shortcut.nix`
+- [x] `configs/nixos/registry/stable-uid.nix`
+- [x] `configs/nixos/modules/default.nix`
+- [x] `configs/nixos/modules/host.nix`
+- [x] `configs/nixos/modules/guest.nix`
+- [x] `configs/nixos/modules/monorepo.nix`
+- [x] `configs/nixos/modules/zfs.nix`
+- [x] `configs/nixos/modules/network/ssh.nix`
+- [x] `configs/nixos/modules/network/vlans.nix`
+- [x] `configs/nixos/modules/network/vpn-client.nix`
+- [x] `configs/nixos/modules/desktop/default.nix`
+- [x] `configs/nixos/modules/desktop/apps/alacritty.nix`
+- [x] `configs/nixos/modules/desktop/apps/firefox.nix`
+- [x] `configs/nixos/modules/desktop/apps/ghostty.nix`
+- [x] `configs/nixos/modules/desktop/apps/obsidian.nix`
+- [x] `configs/nixos/modules/desktop/apps/r2modman.nix`
+- [x] `configs/nixos/modules/desktop/apps/signal.nix`
+- [x] `configs/nixos/modules/desktop/apps/steam.nix`
+- [x] `configs/nixos/modules/desktop/apps/vencord.nix`
+- [x] `configs/nixos/modules/desktop/session/hyprland/default.nix`
+- [x] `configs/nixos/modules/desktop/session/hyprland/hypridle.nix`
+- [x] `configs/nixos/modules/desktop/session/hyprland/hyprlock.nix`
+- [x] `configs/nixos/modules/desktop/session/login.nix`
+- [x] `configs/nixos/modules/desktop/session/mako.nix`
+- [x] `configs/nixos/modules/desktop/session/portals.nix`
+- [x] `configs/nixos/modules/desktop/session/rofi.nix`
+- [x] `configs/nixos/modules/desktop/session/waybar.nix`
+- [x] `configs/nixos/modules/desktop/utilities/audio.nix`
+- [x] `configs/nixos/modules/desktop/utilities/clipboard.nix`
+- [x] `configs/nixos/modules/desktop/utilities/osd.nix`
+- [x] `configs/nixos/modules/desktop/utilities/recording.nix`
+- [x] `configs/nixos/modules/desktop/utilities/screenshot.nix`
+- [x] `configs/nixos/modules/desktop/utilities/theming.nix`
+- [x] `configs/nixos/modules/desktop/utilities/userdirs.nix`
+- [x] `configs/nixos/modules/services/actualbudget.nix`
+- [x] `configs/nixos/modules/services/copyparty.nix`
+- [x] `configs/nixos/modules/services/homepage.nix`
+- [x] `configs/nixos/modules/services/navidrome.nix`
+- [x] `configs/nixos/modules/services/reverse-proxy.nix`
+- [x] `configs/nixos/modules/services/steamcmd.nix`
+- [x] `configs/nixos/modules/services/games/palworld.nix`
+- [x] `configs/nixos/modules/services/games/valheim.nix`
+- [x] `configs/nixos/modules/shell/bazel.nix`
+- [x] `configs/nixos/modules/shell/direnv/default.nix`
+- [x] `configs/nixos/modules/shell/fish/default.nix`
+- [x] `configs/nixos/modules/shell/gitea-axi.nix`
+- [x] `configs/nixos/modules/shell/git.nix`
+- [x] `configs/nixos/modules/shell/herdr.nix`
+- [x] `configs/nixos/modules/shell/nvim/default.nix`
+- [x] `configs/nixos/modules/shell/omp.nix`
+- [x] `configs/nixos/modules/shell/pi/default.nix`
+- [x] `configs/nixos/modules/shell/python.nix`
+- [x] `configs/nixos/modules/shell/rust.nix`
+- [x] `configs/nixos/modules/shell/tmux/default.nix`
+- [x] `configs/nixos/modules/shell/yazi.nix`
+- [x] `src/dotfiles/guests.nix`
+- [x] `configs/nixos/guests/actualbudget.nix`
+- [x] `configs/nixos/guests/copyparty.nix`
+- [x] `configs/nixos/guests/homepage.nix`
+- [x] `configs/nixos/guests/navidrome.nix`
+- [x] `configs/nixos/guests/palworld.nix`
+- [x] `configs/nixos/guests/reverse-proxy.nix`
+- [x] `configs/nixos/guests/valheim.nix`
+- [x] `src/dotfiles/hosts.nix`
+- [x] `configs/nixos/hosts/neogaia/default.nix`
+- [x] `configs/nixos/hosts/neogaia/disk.nix`
+- [x] `configs/nixos/hosts/neogaia/hardware-configuration.nix`
+- [x] `configs/nixos/hosts/pikachu/default.nix`
+- [x] `configs/nixos/hosts/pikachu/disk.nix`
+- [x] `configs/nixos/hosts/pikachu/hardware-configuration.nix`
+- [x] `configs/nixos/hosts/zeus/default.nix`
+- [x] `configs/nixos/hosts/zeus/disk.nix`
+- [x] `configs/nixos/hosts/zeus/hardware-configuration.nix`
--- a/wrk/tasks/0003-whisper-dictation.md
+++ b/wrk/tasks/0003-whisper-dictation.md
@@ -0,0 +1,37 @@
+---
+aliases:
+  - "0003"
+  - Whisper dictation
+date-created: 2026-10-14 16:31
+date-modified: 2026-10-14 16:33
+status: open
+area: "[[productivity]]"
+blocked-by:
+  - "[[0002-nixos-refactor]]"
+subtasks: []
+---
+
+# Whisper dictation
+
+Provide reliable local dictation on Zeus.
+
+## Prototype findings
+
+- `hyprwhspr-rs` provides PipeWire capture, local `whisper.cpp` transcription, clipboard copying, and Hyprland integration.
+- The prototype used `small.en` from `~/dwn/ggml-small.en.bin`.
+- The initial CPU prototype transcribed accurately but added about 2.3 seconds after a 2.9-second recording.
+- Vulkan acceleration uses `whisper-cpp-vulkan` and `gpu_layers = 999`.
+- `SUPER + ALT + D` starts recording on press and stops recording on release.
+- Hyprland Lua represents release bindings with `hl.bind(..., { release = true })`.
+- `hyprwhspr-rs` uses Hyprland's removed `sendshortcut` dispatcher for automatic paste.
+- Its virtual-keyboard fallback can drop modifiers and insert only `v`.
+- Treat the prototype configuration as disposable because it no longer works reliably.
+
+## Completion
+
+- [ ] Choose a maintained local speech-to-text backend.
+- [ ] Record microphone audio through PipeWire.
+- [ ] Transcribe locally with GPU acceleration when available.
+- [ ] Insert transcribed text reliably into the focused application.
+- [ ] Copy transcribed text to the clipboard.
+- [ ] Test dictation with representative technical speech.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
alexion	0166547091	feat(steam): configure Quest VR streaming	2026-10-21 19:27:57 -04:00
alexion	1a2a4bd2bd	feat(nixos): migrate AdGuard to Pikachu	2026-10-21 18:51:29 -04:00
alexion	94eb132962	fix(shell): reuse sudo session during deployment	2026-10-21 17:03:42 -04:00
alexion	8e01e1621b	fix(nixos): add RomM Homepage entry	2026-10-21 14:33:36 -04:00
alexion	b4e74fc5b2	feat(zeus): add RetroArch	2026-10-21 12:05:28 -04:00
alexion	bbac95cac0	feat(romm): enable Playmatch metadata	2026-10-21 00:21:07 -04:00
alexion	e5bacc53be	feat(romm): enable Hasheous metadata	2026-10-21 00:19:48 -04:00
alexion	5f52a78efa	fix(romm): run scan queue workers	2026-10-21 00:15:47 -04:00
alexion	dc210d4985	fix(romm): remove upload size limit	2026-10-21 00:07:59 -04:00
alexion	2237c3eea3	fix(reverse-proxy): forward WebSocket upgrades	2026-10-21 00:07:01 -04:00
alexion	771a0df831	feat(romm): package version 5.4.0	2026-10-21 00:01:31 -04:00
alexion	cfa01fb550	fix(grill): clarify decision planning	2026-10-20 20:35:35 -04:00
alexion	7186d6a3a7	refactor(nixos): scope agent guidance	2026-10-20 04:40:14 -04:00
alexion	c836396cbe	docs(tasks): close RomM guest task	2026-10-19 23:36:01 -04:00
alexion	3493519085	feat(nixos): deploy RomM guest	2026-10-19 23:35:07 -04:00
alexion	f160fd15a2	fix(neogaia): restore Caps Escape swap	2026-10-19 20:41:12 -04:00
alexion	f1a93199c7	docs: plan RomM migration	2026-10-19 20:04:50 -04:00
alexion	591144df33	docs(tasks): close NixOS refactor task	2026-10-19 16:45:48 -04:00
alexion	d7760ef84d	docs(tasks): track gitea-axi packaging migration	2026-10-19 16:45:48 -04:00
alexion	042238476a	feat(pi): add tldr prompt command	2026-10-19 16:04:30 -04:00
alexion	e41b8e3eb4	docs: capture agent workflow decisions	2026-10-19 02:41:41 -04:00
alexion	63017f8e33	feat(skills): add grill skill	2026-10-19 02:32:34 -04:00
alexion	52f31fd44d	docs(tasks): add Gitea Axi tasks	2026-10-18 15:44:55 -04:00
alexion	898a6df333	fix(skills): clarify skill guidance	2026-10-18 15:40:23 -04:00
alexion	5a5543633c	fix(agents): preserve review-only requests	2026-10-18 15:05:55 -04:00
alexion	9c501a79ad	feat(skills): add retrospective skill	2026-10-18 14:51:59 -04:00
alexion	30e5b1e677	docs: add project task notes	2026-10-18 01:16:20 -04:00
alexion	45a840002f	refactor(skills): remove redundant skills	2026-10-17 22:04:31 -04:00
alexion	a9db1f8b7c	feat(skills): add agent writing guide	2026-10-17 22:04:31 -04:00
alexion	dcc4efcc75	fix(rofi): migrate Home Manager options	2026-10-15 18:16:47 -04:00
alexion	a23a317335	build(nix): update flake inputs	2026-10-15 18:16:47 -04:00
alexion	6e545c0a15	build(pi): integrate vendored Pi 1.3.0	2026-10-15 18:05:57 -04:00
alexion	6081e3e325	chore(vendor): import pi 1.3.0 Imported as a linear vendor commit so forge rebases do not replay the upstream root tree. git-subtree-dir: third_party/pi git-subtree-split: 71023aec1546d6d677a65669c5665c0927ce0dd0	2026-10-15 17:58:48 -04:00
alexion	719370c8f7	refactor(bazel): inline the primary user	2026-10-15 14:23:18 -04:00
alexion	2b4e66a75c	fix(palworld): configure the RCON port	2026-10-15 14:18:27 -04:00
alexion	c44769ff70	refactor(steamcmd): constrain service names	2026-10-15 14:13:07 -04:00
alexion	1397576538	refactor(reverse-proxy): simplify virtual host generation	2026-10-15 13:57:45 -04:00
alexion	5fbe1850e0	docs(tasks): organize task areas	2026-10-14 18:18:18 -04:00
alexion	57bb21af1a	feat(vault): add task workflow	2026-10-14 01:24:22 -04:00
alexion	ffc40e547b	feat(skills): add Conventional Commits skill	2026-10-13 22:49:44 -04:00
alexion	55f61f71d8	refactor(natu): remove custom Nix linter	2026-10-13 21:59:41 -04:00
alexion	08563c6769	refactor(nixos): remove unused direnv module	2026-10-13 21:50:37 -04:00
alexion	8462b3a5a8	refactor(copyparty): separate deployment and service policy Move Copyparty rendering into shared dotfiles utilities, keep guest wiring focused on host/container plumbing, and let the service module derive effective volume policy.	2026-10-13 20:33:25 -04:00
alexion	d0872e7d8c	fix(homepage): skip empty ordered sections	2026-10-12 11:50:27 -04:00
alexion	9be9ad7675	refactor(actualbudget): remove unused service	2026-10-12 11:40:05 -04:00
alexion	5ee328cdf8	refactor(flake): centralize custom packages	2026-10-12 11:34:18 -04:00
alexion	6532a822cd	feat(userdirs): configure preferred directories	2026-10-11 22:54:11 -04:00
alexion	20a3990979	refactor(theming): simplify stylix module	2026-10-11 22:43:35 -04:00
alexion	b7ab518f58	refactor(screenshot): simplify capture bindings	2026-10-11 22:40:44 -04:00
alexion	3f1e34ef95	refactor(recording): signal status updates	2026-10-11 22:37:30 -04:00
alexion	d0abfc1625	refactor(osd): move volume bindings to audio	2026-10-11 22:33:32 -04:00
alexion	031090e4ea	fix(waybar): use Lua dispatch build	2026-10-11 22:12:17 -04:00
alexion	2edad6c5df	refactor(clipboard): simplify picker wiring	2026-10-11 21:36:54 -04:00
alexion	1d5acc09c6	refactor(audio): simplify media controls	2026-10-11 21:30:21 -04:00
alexion	ee29e53f7c	refactor(waybar): register owned modules	2026-10-11 21:07:35 -04:00
alexion	3c9d0ec886	refactor(nix): share glyph decoding helper	2026-10-11 21:07:35 -04:00
alexion	f0c5544b10	refactor(waybar): register workspace window icons	2026-10-11 18:23:41 -04:00
alexion	4dd0a5a4f5	feat(rofi): increase launcher contrast	2026-10-11 17:49:05 -04:00
alexion	a4a795f7ee	refactor(mako): use executable helper for history	2026-10-11 17:40:56 -04:00
alexion	ecdf877308	refactor(login): use configured uwsm executable	2026-10-11 17:39:37 -04:00
alexion	d1face10ec	refactor(nix): apply executable helper rules	2026-10-11 17:38:15 -04:00
alexion	337d9a2014	docs(nix-style): add package command rules	2026-10-11 17:38:15 -04:00
alexion	f059068873	refactor(hyprlock): inline command paths	2026-10-11 17:25:18 -04:00
alexion	7662c04cda	fix(hypridle): use Lua dpms dispatcher	2026-10-11 17:22:05 -04:00
alexion	33128fc3c7	feat(hyprland): migrate desktop utility bindings	2026-10-11 16:58:27 -04:00
alexion	68415ad47e	fix(hyprland): place Zeus primary monitor at origin	2026-10-11 16:56:03 -04:00
alexion	6b7201e6fa	feat(hyprland): migrate session feature bindings	2026-10-11 16:52:29 -04:00
alexion	4360f4863b	feat(hyprland): migrate hardware key bindings	2026-10-11 16:40:07 -04:00
alexion	370cab8f83	feat(hyprland): render session env registry	2026-10-11 16:34:52 -04:00
alexion	e74a08b853	feat(dotfiles): add session env registry	2026-10-11 16:30:00 -04:00
				`@@ -0,0 +1 @@`
				.linter-no-border{border:none}.linter-border-bottom{border-bottom:1px solid var(--background-modifier-border);border-top:0;margin-bottom:.75em}.custom-row-description{margin-top:0}.modal-warn,.search-zero-state{font-weight:700}.modal-heading,.search-zero-state{text-align:center}.confirm-modal-checkbox-container{align-items:center;display:flex;gap:6px;margin-top:8px}.disabled-list-entry{color:var(--text-faint)}.linter-diff-preview-view{display:flex;flex-direction:column;height:100%;min-width:0;overflow:hidden}.linter-diff-preview-empty{color:var(--text-muted);padding:16px}.linter-diff-preview-header{align-items:flex-start;border-bottom:1px solid var(--background-modifier-border);display:flex;flex:0 0 auto;gap:12px;justify-content:space-between;padding:12px 14px}.linter-diff-preview-title-group{min-width:0}.linter-diff-preview-header h3{font-size:var(--font-ui-medium);line-height:1.3;margin:0 0 6px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.linter-diff-preview-actions{display:flex;flex:0 0 auto;gap:8px}.linter-diff-preview-body{flex:1 1 auto;min-height:0;overflow:auto;padding:12px 14px 16px}.linter-diff-preview-view .linter-diff-summary{color:var(--text-normal);display:inline-block;font-size:var(--font-ui-small);margin:0 0 10px;padding:5px 8px}.linter-diff-preview-view .linter-diff,.linter-diff-preview-view .linter-diff-summary{background:var(--background-secondary);border:1px solid var(--background-modifier-border);border-radius:6px}.linter-diff-preview-view .linter-diff{font-family:var(--font-monospace);font-size:var(--font-smaller);line-height:1.45;margin:0;overflow:hidden;padding:6px 0}.linter-diff-preview-view .linter-diff-line{display:grid;grid-template-columns:26px minmax(0,1fr);min-height:20px;padding:1px 10px 1px 0}.linter-diff-preview-view .linter-diff-marker{color:var(--text-muted);padding-right:8px;text-align:right;user-select:none}.linter-diff-preview-view .linter-diff-text{min-width:0;overflow-wrap:anywhere;white-space:pre-wrap}.linter-diff-preview-view .linter-diff-skip{border-bottom:1px solid var(--background-modifier-border);border-top:1px solid var(--background-modifier-border);color:var(--text-faint);font-family:var(--font-interface);font-size:var(--font-ui-smaller);padding:4px 12px;text-align:center}.linter-diff-preview-view .linter-diff-added{background:rgba(var(--color-green-rgb),.12);color:var(--text-normal)}.linter-diff-preview-view .linter-diff-removed{background:rgba(var(--color-red-rgb),.12);color:var(--text-normal)}.linter-diff-preview-view .linter-diff-context{color:var(--text-muted)}