fix(waybar): restore workspace clicks

refactor(clipboard): simplify picker wiring
refactor(audio): simplify media controls
2026-10-11 21:43:20 -04:00 · 2026-10-11 21:36:54 -04:00 · 2026-10-11 21:30:21 -04:00 · 2026-10-11 21:07:35 -04:00 · 2026-10-11 21:07:35 -04:00 · 2026-10-11 18:23:41 -04:00
1616 changed files with 360045 additions and 3508 deletions
--- a/.pi/prompts/review-nix.md
+++ b/.pi/prompts/review-nix.md
@@ -1,31 +0,0 @@
---
-description: Review Nix changes against repository Nix style rules
-argument-hint: "[target]"
---
-
-Use the `nix-style` skill.
-Audit ${ARGUMENTS:-the staged diff} for violations of the repository Nix style rules.
-
-Report only actionable findings.
-Order findings by severity.
-Do not report preferences unless a loaded rule states them.
-
-Use this format for each finding:
-
-```text
-`code-path:line`
-> `smallest reviewed-code excerpt that shows the violation`
-
-`rule-file:line`: Finding title.
-Summary: why the code breaks the rule
-Fix: suggested fix
-```
-
-Keep the code excerpt to one to three lines when possible.
-Use a longer excerpt only when the violation needs surrounding context.
-Use `...` to omit unrelated lines from a multi-line excerpt.
-Use a skill-relative rule citation, such as `let.md:7`.
-Make the fix direct.
-Do not include alternatives when one fix best follows the cited rule.
-
-It is acceptable to report no findings when the reviewed Nix already follows the loaded rules.
--- a/.pi/prompts/review.md
+++ b/.pi/prompts/review.md
@@ -0,0 +1,52 @@
+---
+description: Review changes against repository style rules
+argument-hint: "[target]"
+---
+
+Review target: `${ARGUMENTS:-the staged diff}`.
+Audit the target for violations of the repository style rules.
+
+Choose skills from the reviewed files:
+
+- Use the `nix-style` skill for `*.nix` files.
+- Use the `rust-style` skill for `*.rs` files.
+- Use the `build-style` skill for `Cargo.toml` files.
+- Use the `build-style` skill for Bazel `BUILD` files.
+
+If the target includes multiple matching file types, use all matching skills.
+If the target is a diff, choose skills from the changed files.
+Do not use a style skill when no reviewed file matches it.
+
+For every reviewed `*.nix` file, run:
+
+```bash
+bazel run //src/natu:natu -- <reviewed-nix-paths>
+```
+
+Pass every reviewed Nix path to Natu.
+Report every Natu diagnostic as an actionable finding.
+
+Report only actionable findings.
+Order findings by severity.
+Do not report preferences unless a loaded rule states them.
+
+Use this format for each finding:
+
+```text
+`code-path:line`
+> `smallest reviewed-code excerpt that shows the violation`
+
+`skill::rule-file:line`: Finding title.
+Summary: why the code breaks the rule
+Fix: suggested fix
+```
+
+Keep the code excerpt to one to three lines when possible.
+Use a longer excerpt only when the violation needs surrounding context.
+Use `...` to omit unrelated lines from a multi-line excerpt.
+Use a style-skill rule citation in the form `skill::rule-file:line`.
+Cite Natu diagnostics as `natu::<rule-id>`.
+Make the fix direct.
+Do not include alternatives when one fix best follows the cited rule.
+
+It is acceptable to report no findings when the target follows the loaded rules.
--- a/.pi/skills/build-style
+++ b/.pi/skills/build-style
@@ -0,0 +1 @@
+../../src/skills/style/build
--- a/.pi/skills/craft-skill
+++ b/.pi/skills/craft-skill
@@ -0,0 +1 @@
+../../src/skills/craft-skill
--- a/.pi/skills/nix-style
+++ b/.pi/skills/nix-style
@@ -1 +1 @@
-../../src/skills/nix-style
+../../src/skills/style/nix
--- a/.pi/skills/rust-style
+++ b/.pi/skills/rust-style
@@ -0,0 +1 @@
+../../src/skills/style/rust
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -96,11 +96,22 @@
 - `rules_rust` `rust_test` targets cannot set both `crate` and `srcs`.
  Use one input style per test target.
 - Rust tests in this monorepo live in separate `*_test.rs` files, not inline `#[cfg(test)]` modules.
+- `rnix::ast::HasEntry::entries()` includes assignments and `inherit` statements.
+  Use `attrpath_values()` when code needs only assignment entries.
 - Ariadne Rust tests are declared in Bazel `BUILD` files; do not add `[[test]]` entries to
  `src/ariadne/Cargo.toml` unless explicitly requested.
 - In this monorepo, "dotfiles" refers to the dotfiles/NixOS configuration under `src/dotfiles/` and `configs/nixos/`.
 - The flake does not currently define `formatter.x86_64-linux`.
  Do not use `nix fmt` as a validation command until a formatter is added.
+- The `fix` app passes its current directory to Deadnix.
+  Run `nix run .#fix` from the repository root so path exclusions match.
+- During the Nix refactor, address each issue that comes up by adding either a Natu rule or a new Nix style rule.
+- Git pathspec searches started in a subdirectory default to that subtree.
+  Use `git -C <repository-root>` or top-anchored pathspecs for repository-wide history searches.
+- A `**/*.nix` Git pathspec does not include Nix files directly in its starting directory.
+  Include both `*.nix` and `**/*.nix`, or use a recursive `*.nix` pathspec, when linting every Nix file.
+- Nix `let` bindings are recursive; their source order does not determine binding availability.
+  Treat Natu `let_order` as a readability rule, not an evaluation dependency.
 - Ariadne extraction must preserve the game-root season prefix for archived source.
  Different game installs can contain compiled scripts with the same internal path.
 - Clew owns Ren'Py extraction, preparation, and compiled-script AST export. Ariadne owns analysis over Clew-produced data.
@@ -114,3 +125,4 @@
  Do not use `git subtree add` or `git subtree pull` for Pi PR branches.
  Gitea rebases the synthetic upstream root commit without the `third_party/pi` prefix.
  Preserve `git-subtree-dir` and `git-subtree-split` trailers on Pi vendor commits.
+- The default Pi model for NixOS user configuration is set in `configs/nixos/modules/shell/pi/default.nix`, not in vendored Pi source.
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,15 @@
 # It is not intended for manual editing.
 version = 4

+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -57,15 +66,22 @@ name = "ariadne"
 version = "0.1.0"
 dependencies = [
 "clap",
+ "monorepo",
 "serde",
 "serde_json",
 ]

 [[package]]
-name = "clap"
-version = "4.6.6"
+name = "autocfg"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "clap"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -73,9 +89,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
 "anstream",
 "anstyle",
@@ -85,21 +101,21 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.6",
 ]

 [[package]]
 name = "clap_lex"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"

 [[package]]
 name = "colorchoice"
@@ -107,6 +123,41 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"

+[[package]]
+name = "countme"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
+
+[[package]]
+name = "googletest"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b5e2f2b556b7b90297a5a35c8267dd43a537923d2b329beefdba2b4ec19d94"
+dependencies = [
+ "googletest_macro",
+ "num-traits",
+ "regex",
+ "rustversion",
+]
+
+[[package]]
+name = "googletest_macro"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ae6abc96141edd26bf5aeec0f119c129c44de3ced09e5073711a02cb74725d0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -135,6 +186,31 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

+[[package]]
+name = "monorepo"
+version = "0.1.0"
+
+[[package]]
+name = "natu"
+version = "0.1.0"
+dependencies = [
+ "clap",
+ "googletest",
+ "monorepo",
+ "rnix",
+ "rowan",
+ "status",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "once_cell_polyfill"
 version = "1.70.2"
@@ -159,6 +235,68 @@ dependencies = [
 "proc-macro2",
 ]

+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "rnix"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c163bd17372eecdf10d351c34584b7de7c1a33be4e92a32f3fb3f5a7fe3f579b"
+dependencies = [
+ "rowan",
+]
+
+[[package]]
+name = "rowan"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417a3a9f582e349834051b8a10c8d71ca88da4211e4093528e36b9845f6b5f21"
+dependencies = [
+ "countme",
+ "hashbrown",
+ "rustc-hash",
+ "text-size",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
 [[package]]
 name = "serde"
 version = "1.0.229"
@@ -186,7 +324,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -202,6 +340,10 @@ dependencies = [
 "zmij",
 ]

+[[package]]
+name = "status"
+version = "0.1.0"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -210,9 +352,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

 [[package]]
 name = "syn"
-version = "3.0.5"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -220,10 +362,27 @@ dependencies = [
 ]

 [[package]]
-name = "unicode-ident"
-version = "1.0.24"
+name = "syn"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "text-size"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"

 [[package]]
 name = "utf8parse"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,5 +2,18 @@
 members = [
    "src/ariadne",
    "src/machoke",
+    "src/monorepo",
+    "src/status",
+    "src/natu",
 ]
 resolver = "3"
+
+[workspace.dependencies]
+clap = "4"
+googletest = "0.14"
+monorepo = { path = "src/monorepo" }
+rnix = "=0.14.0"
+rowan = "0.16"
+serde = "1.0"
+serde_json = "1.0"
+status = { path = "src/status" }
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -14,4 +14,5 @@ rust = use_extension("//bazel:rust.bzl", "rust")
 use_repo(rust, "rust")

 register_toolchains("@python//:python")
+
 register_toolchains("@rust//:rust")
--- a/configs/nixos/AGENTS.md
+++ b/configs/nixos/AGENTS.md
@@ -2,10 +2,10 @@

 ## Desktop

- TODO: Verify this path after the NixOS configuration is migrated.
-  When adding a graphical application, add a `window-rewrite` icon mapping in `modules/desktop/session/waybar.nix`.
+- When adding a graphical application, register its workspace icon in `registry.window-icon`.
  The workspace indicator uses this mapping to show an application icon instead of the generic default glyph.
  Match the mapping on the window class.
+  Store the icon as the rendered string.
  Run `hyprctl clients -j | jq -r '.[].class' | sort -u` to list classes in the running session.
 - TODO: Verify this path after the NixOS configuration is migrated.
  Set Hyprland session environment variables in `modules/desktop/session/hyprland/default.nix` with `env = KEY,VALUE`.
@@ -40,6 +40,8 @@

 ## Gotchas

+- `configs/nixos/registry/stable-uid.nix` receives library functions through `lib`.
+  Qualify its library calls with `lib.`.
 - Guest modules are host-agnostic wiring, while host files own deployment-specific service configuration such as served volumes and host paths.
  For example, `guests/copyparty.nix` should expose options and translate them into guest mounts/service settings, while `hosts/pikachu/default.nix` chooses `/inbox`, `/media`, and their backing paths.
  Guest addresses and routes are host-level configuration because a guest module can be used on multiple hosts.
@@ -50,8 +52,8 @@
  directories already exist inside the read-only source.
  For aggregate Copyparty volumes such as `/srv` with nested `/srv/inbox`, keep the guest bind mount
  writable and enforce read-only behavior through Copyparty access plus service `ReadWritePaths`.
- `deploy-to` builds from the source checkout and activates an imported closure on the target.
-  Do not rely on a target-local monorepo checkout for remote deployment.
+- `deploy-to` builds from the source checkout, records the imported closure as the target system profile,
+  and activates it. Do not rely on a target-local monorepo checkout for remote deployment.
 - On Pikachu, `nix copy --to ssh://pikachu` accepted a small `nix store add-file` probe,
  but rejected locally built system paths that lacked trusted signatures.
  Use a sudo `nix-store --import` path for unsigned deploy closures.
@@ -59,3 +61,7 @@
  Do not describe NixOS route choices as public-DNS management.
 - Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.
  Generate it on the target system or live ISO, then stage it before evaluating the flake.
+- Configure the Chaotic Nyx cache only on hosts that select `linuxPackages_cachyos` (currently Neogaia
+  and Zeus), not in the generic host module.
+- Module-relative paths resolve from the module file. Update them when moving a module into a subdirectory.
+- On Pikachu, `uptime` does not support `-s`. Use `who -b` to report the boot time.
--- a/configs/nixos/guests/actualbudget.nix
+++ b/configs/nixos/guests/actualbudget.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.actualbudget;
+  cfg = config.guests.actualbudget; # NOLINT(let_order)
  dataDir = "/data";
 in
 {
--- a/configs/nixos/guests/copyparty.nix
+++ b/configs/nixos/guests/copyparty.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.copyparty;
+  cfg = config.guests.copyparty; # NOLINT(let_order)

  volumeType = lib.types.submodule {
    options = {
--- a/configs/nixos/guests/homepage.nix
+++ b/configs/nixos/guests/homepage.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.homepage;
+  cfg = config.guests.homepage; # NOLINT(let_order)
  environmentFile = "/run/secrets/homepage.env";
 in
 {
--- a/configs/nixos/guests/palworld.nix
+++ b/configs/nixos/guests/palworld.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.palworld;
+  cfg = config.guests.palworld; # NOLINT(let_order)
  steamDir = "/data/steamcmd";
  installDir = "/data/server";
  stateDir = "/data/state";
--- a/configs/nixos/guests/valheim.nix
+++ b/configs/nixos/guests/valheim.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.guests.valheim;
+  cfg = config.guests.valheim; # NOLINT(let_order)
  steamDir = "/data/steamcmd";
  installDir = "/data/server";
  stateDir = "/data/state";
--- a/configs/nixos/hosts/neogaia/default.nix
+++ b/configs/nixos/hosts/neogaia/default.nix
@@ -1,6 +1,6 @@
 {
  inputs,
-  pkgs,
+  util,
  ...
 }:
 # neogaia — Dell XPS 13 9380 laptop.
@@ -13,10 +13,9 @@
    ./disk.nix
  ];

-  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+  modules.host.cachyos.enable = true;

-  # So wifi can be joined from the console.
-  networking.networkmanager.enable = true;
+  modules.network.enable = true;

  registry.address.neogaia.self = "10.23.50.146";

@@ -28,15 +27,9 @@
    peer = {
      publicKey = "sGEkSD+gEdIMXi4PBN3AhwHGc4tWMtcjOIey3s7yb3I=";
      endpoint = "100.0.90.192:51820";
-      allowedIPs = [ "10.23.0.0/16" ];
    };
  };

-  registry.shell-shortcut.neogaia = {
-    vpn-on = "sudo systemctl start wireguard-wg-home.target";
-    vpn-off = "sudo systemctl stop 'wireguard-wg-home*.service' wireguard-wg-home.target";
-  };
-
  modules.monorepo.enable = true;
  modules.shell.herdr.enable = true;
  modules.shell.gitea-axi.enable = true;
@@ -47,4 +40,23 @@
  modules.desktop.apps.obsidian.enable = true;
  modules.desktop.apps.steam.enable = true;

+  registry.waybar.neogaia.battery = {
+    order = 70;
+    settings = {
+      format = "{icon} {capacity}%";
+      format-charging = "${util.glyph "f0e7"} {capacity}%";
+      format-icons = [
+        (util.glyph "f244")
+        (util.glyph "f243")
+        (util.glyph "f242")
+        (util.glyph "f241")
+        (util.glyph "f240")
+      ];
+      states = {
+        warning = 20;
+        critical = 10;
+      };
+    };
+  };
+
 }
--- a/configs/nixos/hosts/neogaia/ssh_user_ed25519_key.pub
+++ b/configs/nixos/hosts/neogaia/ssh_user_ed25519_key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -15,52 +15,15 @@

  hardware.cpu.intel.updateMicrocode = true;

-  systemd.network = {
-    enable = true;
-    netdevs = {
-      "40-br-vlan20".netdevConfig = {
-        Name = "br-vlan20";
-        Kind = "bridge";
-      };
-      "40-vlan20" = {
-        netdevConfig = {
-          Name = "vlan20";
-          Kind = "vlan";
-        };
-        vlanConfig.Id = 20;
-      };
-    };
-
-    networks = {
-      "10-uplink" = {
-        matchConfig = {
-          Name = "enp2s0";
-          MACAddress = "78:55:36:07:af:49";
-        };
-        networkConfig.DHCP = "yes";
-        vlan = [ "vlan20" ];
-        linkConfig.RequiredForOnline = "routable";
-      };
-      "40-vlan20" = {
-        matchConfig.Name = "vlan20";
-        networkConfig.Bridge = "br-vlan20";
-        linkConfig.RequiredForOnline = "no";
-      };
-      "40-br-vlan20" = {
-        matchConfig.Name = "br-vlan20";
-        linkConfig.RequiredForOnline = "no";
-      };
-    };
+  modules.network.vlans = {
+    interface = "enp2s0";
+    ids = [ 20 ];
  };
-  networking.useDHCP = false;
-
-  modules.network.vlans.ids = [ 20 ];

  boot.zfs.forceImportRoot = false;

-  modules.zfs = {
+  modules.host.zfs = {
    enable = true;
-    hostId = "2346edbd";
    pools.pikachu = { };
  };

@@ -78,7 +41,8 @@
      enable = true;
      route = {
        domain = "valheim.alexion.dev";
-        udp.ports = [
+        protocol = "udp";
+        ports = [
          config.guests.valheim.port
          (config.guests.valheim.port + 1)
        ];
@@ -101,7 +65,8 @@
      enable = true;
      route = {
        domain = "palworld.alexion.dev";
-        udp.ports = [ config.guests.palworld.port ];
+        protocol = "udp";
+        ports = [ config.guests.palworld.port ];
      };
    };
  };
@@ -116,6 +81,7 @@
      enable = true;
      route = {
        domain = "budget.alexion.dev";
+        protocol = "https";
        port = 5006;
      };
    };
@@ -132,6 +98,7 @@
      enable = true;
      route = {
        domain = "music.alexion.dev";
+        protocol = "https";
        port = 4533;
      };
    };
@@ -152,7 +119,8 @@
      enable = true;
      route = {
        domain = "home";
-        http.port = 8082;
+        protocol = "http";
+        port = 8082;
      };
    };
  };
@@ -167,7 +135,9 @@
      enable = true;
      route = {
        domain = "files.alexion.dev";
+        protocol = "https";
        port = 3923;
+        clientMaxBodySize = "1g";
      };
      trustedSources = [ "${registry.address.${config.networking.hostName}."reverse-proxy"}/32" ];
    };
@@ -180,7 +150,7 @@
      };
      "/inbox" = {
        hostPath = "/pikachu/__inbox";
-        path = "/srv/inbox";
+        path = "/pikachu/__inbox";
        access.A = [ "alexion" ];
        flags = [
          "d2d"
@@ -190,7 +160,7 @@
      };
      "/media" = {
        hostPath = "/pikachu/media";
-        path = "/srv/media";
+        path = "/pikachu/media";
        access.A = [ "alexion" ];
        flags = [
          "d2d"
@@ -198,6 +168,13 @@
          "dthumb"
        ];
      };
+      "/opds" = {
+        hostPath = "/pikachu/data/opds";
+        path = "/pikachu/data/opds";
+        access.r = [ "alexion" ];
+        readOnly = true;
+        flags = [ "opds" ];
+      };
    };
  };

--- a/configs/nixos/hosts/pikachu/ssh_user_ed25519_key.pub
+++ b/configs/nixos/hosts/pikachu/ssh_user_ed25519_key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNqJIC6VRXyvrNf3n9su9KdPCikC3CjK/QrCK2reHdB alexion@pikachu
--- a/configs/nixos/hosts/zeus/default.nix
+++ b/configs/nixos/hosts/zeus/default.nix
@@ -1,7 +1,6 @@
 {
  config,
  lib,
-  pkgs,
  ...
 }:
 # zeus — Ryzen desktop with AMD graphics.
@@ -15,14 +14,19 @@

  nixpkgs.hostPlatform = "x86_64-linux";

-  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+  modules.host.cachyos.enable = true;

  hardware.graphics = {
    enable = true;
    enable32Bit = true;
  };

-  networking.networkmanager.enable = true;
+  modules.network.enable = true;
+
+  services.logind.settings.Login = {
+    HandlePowerKey = "ignore";
+    HandlePowerKeyLongPress = "ignore";
+  };

  registry.address.zeus.self = "10.23.50.221";

@@ -39,13 +43,25 @@

  modules.desktop.enable = true;
  modules.desktop.apps.obsidian.enable = true;
+  modules.desktop.apps.r2modman.enable = true;
  modules.desktop.apps.signal.enable = true;
  modules.desktop.apps.steam.enable = true;
  modules.desktop.apps.vencord.enable = true;

  home-manager.users.${config.user.name}.wayland.windowManager.hyprland.settings.monitor = [
-    "HDMI-A-1,1920x1080@120,0x0,1,transform,3"
-    "DP-3,2560x1440@239.96,1080x0,1"
+    {
+      output = "HDMI-A-1";
+      mode = "1920x1080@120";
+      position = "-1080x0";
+      scale = 1;
+      transform = 3;
+    }
+    {
+      output = "DP-3";
+      mode = "2560x1440@239.96";
+      position = "0x0";
+      scale = 1;
+    }
  ];

 }
--- a/configs/nixos/hosts/zeus/ssh_user_ed25519_key.pub
+++ b/configs/nixos/hosts/zeus/ssh_user_ed25519_key.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRBcHHuubptXCdvED/p2dR3MpjGN/AimqLasLY5984G alexion@zeus
--- a/configs/nixos/modules/default.nix
+++ b/configs/nixos/modules/default.nix
@@ -1,14 +1,10 @@
 {
  config,
  lib,
-  pkgs,
  inputs,
  ...
 }:
 # The shared foundation for every host and guest.
-let
-  stateVersion = "26.05";
-in
 {
  imports = [ inputs.home-manager.nixosModules.home-manager ];

@@ -17,14 +13,14 @@ in
      type = lib.types.str;
      default = "alexion";
      description = ''
-        Primary interactive user for this system.
-        This drives the system account and Home Manager user together.
+        Names the primary user account.
+        Host configuration uses this name for the Home Manager user.
      '';
    };
  };

  config = {
-    system.stateVersion = stateVersion;
+    system.stateVersion = "26.05";

    nixpkgs.config.allowUnfree = true;
    nix.settings.experimental-features = [
@@ -42,66 +38,7 @@ in

    users.groups.storage.gid = 10000;

-    security.sudo.extraConfig = ''
-      Defaults env_keep += "EDITOR VISUAL"
-    '';
-
    time.timeZone = "America/New_York";
    i18n.defaultLocale = "en_GB.UTF-8";
-
-    home-manager = {
-      useGlobalPkgs = true;
-      useUserPackages = true;
-      users.${config.user.name} = {
-        home.username = config.user.name;
-        home.homeDirectory = "/home/${config.user.name}";
-        home.stateVersion = stateVersion;
-        home.packages = with pkgs; [
-          eza
-          wget
-        ];
-      };
-    };
-
-    registry.shell-shortcut.${config.networking.hostName} = {
-      ls = {
-        command = "eza -alg --color=always --group-directories-first --icons=always";
-        abbreviation = false;
-      };
-      ll = {
-        command = "eza -lg --color=always --group-directories-first --icons=always";
-        abbreviation = false;
-      };
-      lt = {
-        command = "eza -aT -I '.git' --color=always --group-directories-first --icons=always";
-        abbreviation = false;
-      };
-      ".." = "cd ..";
-      "..." = "cd ../..";
-      "...." = "cd ../../..";
-
-      cp = "cp -v";
-      tarnow = "tar -acf ";
-      untar = "tar -zxvf ";
-      wget = "wget -c ";
-      grep = "grep --color=auto";
-      fgrep = "fgrep --color=auto";
-      egrep = "egrep --color=auto";
-      jctl = "journalctl -p 3 -xb";
-
-      update = "sudo nixos-rebuild switch --flake .#${config.networking.hostName}";
-      cleanup = "sudo nix-collect-garbage -d";
-      sops-host = {
-        command = "sudo --preserve-env=EDITOR,VISUAL env SOPS_AGE_KEY_FILE=/var/lib/sops-nix/key.txt nix shell nixpkgs#sops nixpkgs#neovim -c sops";
-        abbreviation = false;
-      };
-    };
-
-    modules.shell.fish.enable = lib.mkDefault true;
-    modules.shell.fish.defaultShell = lib.mkDefault true;
-    modules.shell.tmux.enable = lib.mkDefault true;
-    modules.shell.nvim.enable = lib.mkDefault true;
-    modules.shell.git.enable = lib.mkDefault true;
-    modules.shell.yazi.enable = lib.mkDefault true;
  };
 }
--- a/configs/nixos/modules/desktop/apps/alacritty.nix
+++ b/configs/nixos/modules/desktop/apps/alacritty.nix
@@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-# Alacritty as the desktop terminal.
-let
-  cfg = config.modules.desktop.apps.alacritty;
-  user = config.user.name;
-in
-{
-  options.modules.desktop.apps.alacritty.enable =
-    lib.mkEnableOption "Alacritty as the desktop terminal";
-
-  config = lib.mkIf cfg.enable {
-    home-manager.users.${user}.home.packages = [ pkgs.alacritty ];
-  };
-}
--- a/configs/nixos/modules/desktop/apps/firefox.nix
+++ b/configs/nixos/modules/desktop/apps/firefox.nix
@@ -3,13 +3,12 @@
  inputs,
  lib,
  pkgs,
+  util,
  ...
 }:
-# Firefox as the desktop browser: stock mainline, hardened and de-monetized by policy.
+# Configures Firefox as the desktop browser.
 let
-  cfg = config.modules.desktop.apps.firefox;
-  user = config.user.name;
-  firefoxAddons = inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system};
+  cfg = config.modules.desktop.apps.firefox; # NOLINT(let_order)
 in
 {
  options.modules.desktop.apps.firefox = {
@@ -19,19 +18,25 @@ in
      type = lib.types.str;
      default = "1.0";
      description = ''
-        Firefox UI and page scale, passed to `layout.css.devPixelsPerPx`.
-        Override it on hosts that need a larger browser scale, such as small
-        high-DPI laptop panels.
+        Scales Firefox UI and page content.
+
+        Sets `layout.css.devPixelsPerPx`.
+        Use a larger value for high-DPI displays.
      '';
    };
  };

  config = lib.mkIf cfg.enable {
-    home-manager.users.${user} = hm: {
+    registry.window-icon.${config.networking.hostName}.firefox = {
+      class = ".*[Ff]irefox.*";
+      icon = util.glyph "f269";
+    };
+
+    home-manager.users.${config.user.name} = hm: {
      programs.firefox = {
        enable = true;

-        # Enterprise policies: enforced and unchangeable from the browser UI.
+        # Applies policies that users cannot change in Firefox.
        policies = {
          DisableTelemetry = true;
          DisableFirefoxStudies = true;
@@ -40,7 +45,7 @@ in
          DontCheckDefaultBrowser = true;
          DisableFirefoxAccounts = true;

-          # Strip the monetized surfaces from the new-tab page.
+          # Removes sponsored content from the new-tab page.
          FirefoxHome = {
            SponsoredTopSites = false;
            SponsoredPocket = false;
@@ -49,23 +54,19 @@ in
        };

        profiles.default = {
-          isDefault = true;
-
          extensions = {
-            packages = with firefoxAddons; [
+            packages = with inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system}; [
              ublock-origin
              proton-pass
              sponsorblock
            ];

-            # The Nord chrome theme is a declared extension setting, so home-manager
-            # owns the extension-settings store, overwriting runtime changes to it.
+            # Home Manager overwrites Nord theme changes made in Firefox.
            force = true;
          };

-          # Stylix's Nord mapping paints the selected address-bar result a
-          # near-white grey, leaving its light text unreadable. Darken that one
-          # highlight to the Nord selection grey, from the same scheme.
+          # Stylix uses a near-white selection background.
+          # Use the Nord selection color because its text stays readable.
          extensions.settings."FirefoxColor@mozilla.com".settings.theme.colors.popup_highlight =
            let
              c = hm.config.lib.stylix.colors;
@@ -77,32 +78,26 @@ in
            };

          settings = {
-            # Scale the UI and page by a fixed factor.
-            # Left at auto (-1), Firefox reads the panel's 1.5x and inflates its
-            # whole chrome while point-sized apps stay put.
-            # A shade under that brings it into line without dropping to true
-            # 1:1, which reads too small at this DPI.
            "layout.css.devPixelsPerPx" = cfg.uiScale;

-            # Auto-enable the sideloaded Firefox Color add-on carrying the Nord
-            # chrome theme, which Firefox otherwise leaves disabled.
+            # Enables Firefox Color after Firefox sideloads the add-on.
            "extensions.autoDisableScopes" = 0;

-            # Sponsored surfaces the policies above do not reach.
+            # Removes sponsored content outside Firefox policies.
            "browser.urlbar.suggest.quicksuggest.sponsored" = false;
            "browser.newtabpage.activity-stream.showSponsored" = false;
            "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
          };

          search = {
-            # Declaring search overwrites Firefox's own engine list wholesale,
-            # so engines added later in the UI do not survive a rebuild.
+            # Home Manager replaces the engine list when this setting is enabled.
+            # Engines added in Firefox do not survive a rebuild.
            force = true;
            default = "ddg";

-            # The general-purpose commercial engines, hidden to leave a lean
-            # DuckDuckGo-and-Wikipedia list. They stay reachable through bangs.
-            # An engine carrying only metaData is treated as a builtin.
+            # Hides commercial search engines.
+            # Bangs still reach these engines.
+            # Entries with only `metaData` configure Firefox built-in engines.
            engines = {
              google.metaData.hidden = true;
              bing.metaData.hidden = true;
@@ -114,8 +109,7 @@ in
        };
      };

-      # Nord chrome for the one profile, applied through the Stylix-managed
-      # Firefox Color add-on that colorTheme enables.
+      # Applies the Nord theme through Stylix's Firefox Color add-on.
      stylix.targets.firefox = {
        enable = true;
        profileNames = [ "default" ];
@@ -133,8 +127,8 @@ in
        };
      };

-      # Firefox writes profiles.ini itself on first launch, so home-manager is
-      # told to own the file rather than fail activation refusing to clobber it.
+      # Firefox creates `profiles.ini` on its first launch.
+      # Force replacement during Home Manager activation.
      home.file."${hm.config.programs.firefox.configPath}/profiles.ini".force = true;
    };
  };
--- a/configs/nixos/modules/desktop/apps/ghostty.nix
+++ b/configs/nixos/modules/desktop/apps/ghostty.nix
@@ -2,17 +2,30 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Ghostty as the desktop terminal.
 let
-  cfg = config.modules.desktop.apps.ghostty;
  user = config.user.name;
 in
 {
  options.modules.desktop.apps.ghostty.enable = lib.mkEnableOption "Ghostty as the desktop terminal";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.ghostty.enable {
+    registry.keybind.${config.networking.hostName}.ghostty = {
+      keys = "SUPER + Return";
+      action = {
+        kind = "exec";
+        command = lib.getExe pkgs.ghostty;
+      };
+    };
+
+    registry.window-icon.${config.networking.hostName}.ghostty = {
+      class = "com.mitchellh.ghostty";
+      icon = util.glyph "f120";
+    };
+
    home-manager.users.${user}.home.packages = [ pkgs.ghostty ];
  };
 }
--- a/configs/nixos/modules/desktop/apps/obsidian.nix
+++ b/configs/nixos/modules/desktop/apps/obsidian.nix
@@ -2,18 +2,23 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Obsidian as the desktop note-taking vault.
 let
-  cfg = config.modules.desktop.apps.obsidian;
  user = config.user.name;
 in
 {
  options.modules.desktop.apps.obsidian.enable =
    lib.mkEnableOption "Obsidian as the desktop note-taking vault";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.obsidian.enable {
    home-manager.users.${user}.home.packages = [ pkgs.obsidian ];
+
+    registry.window-icon.${config.networking.hostName}.obsidian = {
+      class = "obsidian";
+      icon = util.glyph "f02d";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/apps/r2modman.nix
+++ b/configs/nixos/modules/desktop/apps/r2modman.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# r2modman, a Thunderstore mod manager.
+let
+  user = config.user.name;
+in
+{
+  options.modules.desktop.apps.r2modman.enable =
+    lib.mkEnableOption "r2modman, a Thunderstore mod manager";
+
+  config = lib.mkIf config.modules.desktop.apps.r2modman.enable {
+    home-manager.users.${user}.home.packages = [ pkgs.r2modman ];
+  };
+}
--- a/configs/nixos/modules/desktop/apps/signal.nix
+++ b/configs/nixos/modules/desktop/apps/signal.nix
@@ -2,17 +2,22 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Signal desktop messenger.
 let
-  cfg = config.modules.desktop.apps.signal;
  user = config.user.name;
 in
 {
  options.modules.desktop.apps.signal.enable = lib.mkEnableOption "Signal desktop messenger";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.signal.enable {
    home-manager.users.${user}.home.packages = [ pkgs.signal-desktop ];
+
+    registry.window-icon.${config.networking.hostName}.signal = {
+      class = "[Ss]ignal";
+      icon = util.glyph "f4ad";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/apps/steam.nix
+++ b/configs/nixos/modules/desktop/apps/steam.nix
@@ -2,16 +2,14 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Steam game launcher and runtime integration.
-let
-  cfg = config.modules.desktop.apps.steam;
-in
 {
  options.modules.desktop.apps.steam.enable = lib.mkEnableOption "Steam game launcher";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.steam.enable {
    programs.gamemode.enable = true;

    programs.steam = {
@@ -26,5 +24,10 @@ in
    environment.systemPackages = [
      pkgs.gamescope
    ];
+
+    registry.window-icon.${config.networking.hostName}.steam = {
+      class = "[Ss]team";
+      icon = util.glyph "f1b6";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/apps/vencord.nix
+++ b/configs/nixos/modules/desktop/apps/vencord.nix
@@ -2,18 +2,23 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Vesktop, a Discord client with Vencord built in.
 let
-  cfg = config.modules.desktop.apps.vencord;
  user = config.user.name;
 in
 {
  options.modules.desktop.apps.vencord.enable =
    lib.mkEnableOption "Vesktop, a Discord client with Vencord built in";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.vencord.enable {
    home-manager.users.${user}.home.packages = [ pkgs.vesktop ];
+
+    registry.window-icon.${config.networking.hostName}.vesktop = {
+      class = "[Vv]esktop";
+      icon = util.glyph "f1ff";
+    };
  };
 }
--- a/configs/nixos/modules/desktop/default.nix
+++ b/configs/nixos/modules/desktop/default.nix
@@ -1,14 +1,11 @@
 { config, lib, ... }:
 # The desktop aggregator: one flag brings up the whole graphical session.
-let
-  cfg = config.modules.desktop;
-in
 {
  options.modules.desktop.enable = lib.mkEnableOption "the keyboard-driven Hyprland desktop";

  # Each piece is turned on at default priority, so a host can still override
  # any one of them while the single flag above enables the whole desktop.
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.enable {
    modules.desktop.apps.firefox.enable = lib.mkDefault true;
    modules.desktop.apps.ghostty.enable = lib.mkDefault true;
    modules.desktop.session.hyprland.enable = lib.mkDefault true;
@@ -26,5 +23,6 @@ in
    modules.desktop.utilities.screenshot.enable = lib.mkDefault true;
    modules.desktop.utilities.theming.enable = lib.mkDefault true;
    modules.desktop.utilities.userdirs.enable = lib.mkDefault true;
+    registry.env.${config.networking.hostName}.NIXOS_OZONE_WL = "1";
  };
 }
--- a/configs/nixos/modules/desktop/session/hyprland/default.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/default.nix
@@ -1,41 +1,15 @@
 {
  config,
  lib,
-  pkgs,
+  util,
  ...
 }:
 # The Hyprland compositor.
-let
-  cfg = config.modules.desktop.session.hyprland;
-  user = config.user.name;
-  cursor = config.stylix.cursor;
-
-  # Numbered-workspace switch and move for 1..9, the operator's i3 muscle memory.
-  workspaceBinds = lib.concatMap (n: [
-    "$mod, ${toString n}, workspace, ${toString n}"
-    "$mod SHIFT, ${toString n}, movetoworkspace, ${toString n}"
-  ]) (lib.range 1 9);
-
-  # Flip the tiling strategy between the two built-in layouts, since neither a
-  # dispatcher nor a keyword toggles it on its own.
-  toggleLayout = pkgs.writeShellScript "hypr-toggle-layout" ''
-    if [ "$(hyprctl getoption -j general:layout | ${pkgs.jq}/bin/jq -r .str)" = dwindle ]; then
-      hyprctl keyword general:layout master
-    else
-      hyprctl keyword general:layout dwindle
-    fi
-  '';
-in
 {
-  options.modules.desktop.session.hyprland = {
-    enable = lib.mkEnableOption "the Hyprland compositor";
+  options.modules.desktop.session.hyprland.enable = lib.mkEnableOption "the Hyprland compositor";

-    blur = lib.mkEnableOption ''
-      window blur. Off by default as the single biggest battery cost on a
-      laptop, left on for a host with the headroom to spend it'';
-  };
+  config = lib.mkIf config.modules.desktop.session.hyprland.enable {

-  config = lib.mkIf cfg.enable {
    # This program integration owns the session, portals, and polkit, launched
    # through the universal Wayland session manager.
    programs.hyprland = {
@@ -43,7 +17,7 @@ in
      withUWSM = true;
    };

-    home-manager.users.${user}.wayland.windowManager.hyprland = {
+    home-manager.users.${config.user.name}.wayland.windowManager.hyprland = {
      enable = true;

      # One package drives the whole session, so there is never a version split.
@@ -55,135 +29,216 @@ in
      # uwsm owns the systemd graphical-session targets.
      systemd.enable = false;

-      # Write the native hyprlang hyprland.conf, whose variable and bind syntax
-      # the settings below are expressed in.
-      configType = "hyprlang";
+      # Write the native Lua Hyprland config. Home Manager renders the Nix
+      # settings below as hl.* calls.
+      configType = "lua";

      settings = {
-        "$mod" = "SUPER";
-        "$terminal" = "ghostty";
-
-        # Session variables handed to the compositor directly.
-        # UWSM launches the session without the shell profile that would carry
-        # them, so a variable the compositor or its children must see is set
-        # here rather than through home-manager's sessionVariables.
-        env = [
-          # Chromium and Electron apps read this to select native Wayland;
-          # nixpkgs wrappers (Obsidian's included) gate their Wayland flags on
-          # it, so without it they run under XWayland and blur at this DPI.
-          "NIXOS_OZONE_WL,1"
-        ]
-        # Bibata ships XCursor only.
-        # The hyprcursor variables name the same theme, which Hyprland
-        # resolves through its XCursor fallback.
-        ++ lib.optionals (cursor != null) [
-          "XCURSOR_THEME,${cursor.name}"
-          "XCURSOR_SIZE,${toString cursor.size}"
-          "HYPRCURSOR_THEME,${cursor.name}"
-          "HYPRCURSOR_SIZE,${toString cursor.size}"
-        ];
-
-        input = {
-          kb_layout = "us";
-          # Caps is a second Escape.
-          # Shift+Caps still toggles a real CapsLock.
-          kb_options = "caps:escape_shifted_capslock";
-          # Snappy key repeat.
-          repeat_delay = 250;
-          repeat_rate = 45;
-          accel_profile = "flat";
-          touchpad = {
-            natural_scroll = true;
-            tap-to-click = true;
-            disable_while_typing = true;
+        config = {
+          input = {
+            kb_layout = config.services.xserver.xkb.layout;
+            repeat_delay = 250;
+            repeat_rate = 45;
+            accel_profile = "flat";
+            touchpad = {
+              natural_scroll = true;
+              tap_to_click = true;
+              disable_while_typing = true;
+            };
          };
+
+          general = {
+            gaps_in = 4;
+            gaps_out = 8;
+            border_size = 2;
+            layout = "dwindle";
+          };
+
+          decoration = {
+            rounding = 6;
+            blur.enabled = false;
+          };
+
+          xwayland.force_zero_scaling = true;
+
+          dwindle.preserve_split = true;
        };

-        general = {
-          gaps_in = 4;
-          gaps_out = 8;
-          border_size = 2;
-          layout = "dwindle";
-        };
-
-        decoration = {
-          rounding = 6;
-          blur.enabled = cfg.blur;
-        };
-
-        # XWayland clients render at the panel's native resolution instead of
-        # being raster-scaled by the compositor at the fractional monitor scale.
-        xwayland.force_zero_scaling = true;
-
-        animations = {
-          enabled = true;
-          bezier = [ "ease, 0.25, 0.1, 0.25, 1.0" ];
-          # Durations are in centiseconds.
-          # Short values keep the motion subtle.
-          animation = [
-            "windows, 1, 3, ease"
-            "fade, 1, 3, ease"
-            # Layer surfaces like the launcher fade in a touch quicker than windows.
-            "layersIn, 1, 2, ease"
-            "fadeLayersIn, 1, 2, ease"
-            "workspaces, 1, 3, ease"
-            "border, 1, 3, ease"
+        env = lib.mapAttrsToList (name: value: {
+          _args = [
+            name
+            value
          ];
+        }) (lib.attrByPath [ config.networking.hostName ] { } config.registry.env);
+
+        bind = lib.mapAttrsToList (_name: keybind: {
+          _args = [
+            keybind.keys
+            (lib.generators.mkLuaInline (
+              {
+                exec = "hl.dsp.exec_cmd(${lib.generators.toLua { } keybind.action.command})";
+                focus = "hl.dsp.focus(${
+                  lib.generators.toLua { } { inherit (keybind.action) direction workspace; }
+                })";
+                "move-window" = "hl.dsp.window.move(${
+                  lib.generators.toLua { } { inherit (keybind.action) direction workspace; }
+                })";
+                "resize-window" = "hl.dsp.window.resize(${
+                  lib.generators.toLua { } (
+                    {
+                      down = {
+                        x = 0;
+                        y = 10;
+                        relative = true;
+                      };
+                      left = {
+                        x = -10;
+                        y = 0;
+                        relative = true;
+                      };
+                      right = {
+                        x = 10;
+                        y = 0;
+                        relative = true;
+                      };
+                      up = {
+                        x = 0;
+                        y = -10;
+                        relative = true;
+                      };
+                    }
+                    .${keybind.action.direction}
+                  )
+                })";
+                "toggle-floating" = ''hl.dsp.window.float({ action = "toggle" })'';
+                "toggle-fullscreen" = "hl.dsp.window.fullscreen()";
+                "close-window" = "hl.dsp.window.close()";
+              }
+              .${keybind.action.kind}
+            ))
+          ]
+          ++ lib.optional keybind.repeating {
+            repeating = true;
+          }
+          ++ lib.optional keybind.locked {
+            locked = true;
+          };
+        }) (lib.attrByPath [ config.networking.hostName ] { } config.registry.keybind);
+      };
+    };
+    registry.keybind.${config.networking.hostName} = lib.mkMerge [
+      # Generate numeric workspace keybinds.
+      (lib.listToAttrs (
+        lib.concatMap (workspace: [
+          {
+            name = "hyprland-workspace-${toString workspace}";
+            value = {
+              keys = "SUPER + ${toString workspace}";
+              action = {
+                kind = "focus";
+                inherit workspace;
+              };
+            };
+          }
+          {
+            name = "hyprland-move-to-workspace-${toString workspace}";
+            value = {
+              keys = "SUPER + SHIFT + ${toString workspace}";
+              action = {
+                kind = "move-window";
+                inherit workspace;
+              };
+            };
+          }
+        ]) (lib.range 1 9)
+      ))
+
+      # Generate directional keybinds.
+      (lib.listToAttrs (
+        lib.concatMap
+          (
+            { direction, key }:
+            [
+              {
+                name = "hyprland-focus-${direction}";
+                value = {
+                  keys = "SUPER + ${key}";
+                  action = {
+                    kind = "focus";
+                    inherit direction;
+                  };
+                };
+              }
+              {
+                name = "hyprland-move-${direction}";
+                value = {
+                  keys = "SUPER + SHIFT + ${key}";
+                  action = {
+                    kind = "move-window";
+                    inherit direction;
+                  };
+                };
+              }
+              {
+                name = "hyprland-resize-${direction}";
+                value = {
+                  keys = "SUPER + ALT + ${key}";
+                  repeating = true;
+                  action = {
+                    kind = "resize-window";
+                    inherit direction;
+                  };
+                };
+              }
+            ]
+          )
+          [
+            {
+              key = "H";
+              direction = "left";
+            }
+            {
+              key = "J";
+              direction = "down";
+            }
+            {
+              key = "K";
+              direction = "up";
+            }
+            {
+              key = "L";
+              direction = "right";
+            }
+          ]
+      ))
+      {
+        hyprland-toggle-floating = {
+          keys = "SUPER + Space";
+          action.kind = "toggle-floating";
        };

-        dwindle = {
-          preserve_split = true;
+        hyprland-toggle-fullscreen = {
+          keys = "SUPER + F";
+          action.kind = "toggle-fullscreen";
        };

-        bind = [
-          "$mod, Return, exec, $terminal"
+        hyprland-close-window = {
+          keys = "SUPER + SHIFT + Q";
+          action.kind = "close-window";
+        };
+      }
+    ];

-          # Move focus.
-          "$mod, H, movefocus, l"
-          "$mod, J, movefocus, d"
-          "$mod, K, movefocus, u"
-          "$mod, L, movefocus, r"
-
-          # Move the window within the layout.
-          "$mod SHIFT, H, movewindow, l"
-          "$mod SHIFT, J, movewindow, d"
-          "$mod SHIFT, K, movewindow, u"
-          "$mod SHIFT, L, movewindow, r"
-
-          # Resize the active window.
-          "$mod ALT, H, resizeactive, -40 0"
-          "$mod ALT, J, resizeactive, 0 40"
-          "$mod ALT, K, resizeactive, 0 -40"
-          "$mod ALT, L, resizeactive, 40 0"
-
-          "$mod, Space, togglefloating,"
-          "$mod, F, fullscreen,"
-          # togglesplit is a dwindle layout message, reached through layoutmsg.
-          "$mod, T, layoutmsg, togglesplit"
-          "$mod SHIFT, T, exec, ${toggleLayout}"
-          "$mod SHIFT, Q, killactive,"
-          "$mod CTRL, Q, forcekillactive,"
-        ]
-        ++ workspaceBinds;
-
-        # Volume and brightness keys repeat while held, each raising a popup
-        # through the OSD client.
-        # Volume is capped at 100 percent.
-        # The client floors brightness so a full hold cannot black the screen out.
-        binde = [
-          ", XF86AudioRaiseVolume, exec, ${pkgs.swayosd}/bin/swayosd-client --output-volume raise --max-volume 100"
-          ", XF86AudioLowerVolume, exec, ${pkgs.swayosd}/bin/swayosd-client --output-volume lower"
-          ", XF86MonBrightnessUp, exec, ${pkgs.swayosd}/bin/swayosd-client --brightness raise"
-          ", XF86MonBrightnessDown, exec, ${pkgs.swayosd}/bin/swayosd-client --brightness lower"
-        ];
-
-        # Mute and media transport still fire while the session is locked.
-        bindl = [
-          ", XF86AudioMute, exec, ${pkgs.swayosd}/bin/swayosd-client --output-volume mute-toggle"
-          ", XF86AudioPlay, exec, ${pkgs.playerctl}/bin/playerctl play-pause"
-          ", XF86AudioNext, exec, ${pkgs.playerctl}/bin/playerctl next"
-          ", XF86AudioPrev, exec, ${pkgs.playerctl}/bin/playerctl previous"
-        ];
+    registry.waybar.${config.networking.hostName}."hyprland/workspaces" = {
+      position = "left";
+      order = 10;
+      settings = {
+        format = "{id} {windows}";
+        format-window-separator = " ";
+        window-rewrite-default = util.glyph "f2d0";
+        window-rewrite = lib.mapAttrs' (
+          _name: windowIcon: lib.nameValuePair "class<${windowIcon.class}>" windowIcon.icon
+        ) (lib.attrByPath [ config.networking.hostName ] { } config.registry.window-icon);
      };
    };
  };
--- a/configs/nixos/modules/desktop/session/hyprland/hypridle.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/hypridle.nix
@@ -5,62 +5,34 @@
  ...
 }:
 # hypridle: idle-triggered locking and display power management.
-let
-  cfg = config.modules.desktop.session.hyprland.hypridle;
-  user = config.user.name;
-
-  hyprctl = "${config.programs.hyprland.package}/bin/hyprctl";
-  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
-
-  # The guard drops the call when a locker is already up, so no idle trigger
-  # stacks a second hyprlock over the first.
-  lockCmd = "${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}";
-in
 {
-  options.modules.desktop.session.hyprland.hypridle = {
-    enable = lib.mkEnableOption "hypridle idle management";
+  options.modules.desktop.session.hyprland.hypridle.enable =
+    lib.mkEnableOption "hypridle idle management";

-    lockTimeout = lib.mkOption {
-      type = lib.types.ints.positive;
-      default = 300;
-      description = "Seconds of inactivity before the screen locks.";
-    };
-
-    screenOffTimeout = lib.mkOption {
-      type = lib.types.ints.positive;
-      default = 360;
-      description = "Seconds of inactivity before the displays are powered off.";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.hyprland.hypridle.enable {
    # Closing the lid suspends, and every suspend locks first through the
    # before_sleep_cmd below, so the lid always lands at a locked screen.
    services.logind.settings.Login.HandleLidSwitch = "suspend";

-    home-manager.users.${user}.services.hypridle = {
+    home-manager.users.${config.user.name}.services.hypridle = {
      enable = true;

      settings = {
        general = {
-          lock_cmd = lockCmd;
+          # The guard drops the call when a locker is already up, so no idle
+          # trigger stacks a second hyprlock over the first.
+          lock_cmd = "${lib.getExe' pkgs.procps "pidof"} hyprlock || ${lib.getExe pkgs.hyprlock}";
          before_sleep_cmd = "loginctl lock-session";
-          # Waking restores the displays the screen-off listener may have cut.
-          after_sleep_cmd = "${hyprctl} dispatch dpms on";
+          # Waking pokes the compositor in case firmware leaves displays dark.
+          after_sleep_cmd = "${lib.getExe' config.programs.hyprland.package "hyprctl"} dispatch 'hl.dsp.dpms({ action = \"enable\" })'";
        };

        listener = [
          # Lock on idle.
          {
-            timeout = cfg.lockTimeout;
+            timeout = 300;
            on-timeout = "loginctl lock-session";
          }
-          # Power the displays off a little later, restoring them on any activity.
-          {
-            timeout = cfg.screenOffTimeout;
-            on-timeout = "${hyprctl} dispatch dpms off";
-            on-resume = "${hyprctl} dispatch dpms on";
-          }
        ];
      };
    };
--- a/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix
@@ -2,45 +2,54 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # The lock screen: a hyprlock session-lock surface the compositor owns.
 let
-  cfg = config.modules.desktop.session.hyprland.hyprlock;
-  user = config.user.name;
-
-  # The hyprlock this module installs, used by the lock keybind below.
-  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
-
-  sleepIcon = builtins.fromJSON ''"\udb81\udcb2"'';
-  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
+  sleepIcon = util.glyph [
+    "db81"
+    "dcb2"
+  ];
+  sleepOffIcon = util.glyph [
+    "db81"
+    "dcb3"
+  ];

  idleLockToggle = pkgs.writeShellScript "lockscreen-idle-inhibit-toggle" ''
    unit=lockscreen-idle-inhibit.service

    refresh_waybar() {
-      ${pkgs.procps}/bin/pkill -RTMIN+9 waybar >/dev/null 2>&1 || true
+      ${lib.getExe' pkgs.procps "pkill"} -RTMIN+9 waybar >/dev/null 2>&1 || true
    }

-    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet "$unit"; then
-      ${pkgs.systemd}/bin/systemctl --user stop "$unit"
+    if ${lib.getExe' pkgs.systemd "systemctl"} --user is-active --quiet "$unit"; then
+      ${lib.getExe' pkgs.systemd "systemctl"} --user stop "$unit"
      refresh_waybar
-      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepIcon}"
+      ${lib.getExe' pkgs.swayosd "swayosd-client"} --custom-message "${sleepIcon}"
      exit 0
    fi

-    if ${pkgs.systemd}/bin/systemd-run \
+    if ${lib.getExe' pkgs.systemd "systemd-run"} \
      --user \
      --collect \
      --unit=lockscreen-idle-inhibit \
      --description="Disable idle-triggered screen locking" \
-      ${pkgs.systemd}/bin/systemd-inhibit \
+      ${lib.getExe' pkgs.systemd "systemd-inhibit"} \
      --what=idle \
      --who=lockscreen-hotkey \
      --why="lock screen disabled by hotkey" \
-      ${pkgs.coreutils}/bin/sleep infinity >/dev/null; then
+      ${lib.getExe' pkgs.coreutils "sleep"} infinity >/dev/null; then
      refresh_waybar
-      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepOffIcon}"
+      ${lib.getExe' pkgs.swayosd "swayosd-client"} --custom-message "${sleepOffIcon}"
+    fi
+  '';
+
+  idleLockStatus = pkgs.writeShellScript "waybar-idle-lock-status" ''
+    if ${lib.getExe' pkgs.systemd "systemctl"} --user is-active --quiet lockscreen-idle-inhibit.service; then
+      printf '{"text":"${sleepOffIcon}","tooltip":"Idle locking inhibited","class":"inhibited"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
    fi
  '';
 in
@@ -48,8 +57,8 @@ in
  options.modules.desktop.session.hyprland.hyprlock.enable =
    lib.mkEnableOption "the hyprlock lock screen";

-  config = lib.mkIf cfg.enable {
-    home-manager.users.${user} = {
+  config = lib.mkIf config.modules.desktop.session.hyprland.hyprlock.enable {
+    home-manager.users.${config.user.name} = {
      # Colors and the lock-screen background come from Stylix's hyprlock target,
      # so only geometry and behaviour are set here.
      programs.hyprlock = {
@@ -82,14 +91,36 @@ in
          };
        };
      };
+    };

-      # Lock on Super+X.
-      # The guard drops the keypress when a locker is already up, so a second
-      # hyprlock never stacks over the first.
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod, X, exec, ${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}"
-        "$mod CTRL, X, exec, ${idleLockToggle}"
-      ];
+    registry.keybind.${config.networking.hostName} = {
+      hyprlock-lock = {
+        keys = "SUPER + X";
+        action = {
+          kind = "exec";
+          # The guard drops the call when a locker is already up, so no manual
+          # trigger stacks a second hyprlock over the first.
+          command = "${lib.getExe' pkgs.procps "pidof"} hyprlock || ${lib.getExe pkgs.hyprlock}";
+        };
+      };
+
+      hyprlock-toggle-idle-inhibit = {
+        keys = "SUPER + CTRL + X";
+        action = {
+          kind = "exec";
+          command = "${idleLockToggle}";
+        };
+      };
+    };
+
+    registry.waybar.${config.networking.hostName}."custom/idle-lock" = {
+      order = 20;
+      settings = {
+        return-type = "json";
+        exec = "${idleLockStatus}";
+        interval = "once";
+        signal = 9;
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/login.nix
+++ b/configs/nixos/modules/desktop/session/login.nix
@@ -6,19 +6,20 @@
 }:
 # Text login: greetd running the tuigreet greeter, which starts the session
 # through the universal Wayland session manager.
-let
-  cfg = config.modules.desktop.session.login;
-in
 {
  options.modules.desktop.session.login.enable =
    lib.mkEnableOption "greetd with the tuigreet text greeter";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.login.enable {
    services.greetd = {
      enable = true;
-      settings.default_session.command =
-        "${lib.getExe pkgs.tuigreet} --time --remember "
-        + "--cmd 'uwsm start -e -D Hyprland hyprland.desktop'";
+      settings.default_session.command = lib.escapeShellArgs [
+        (lib.getExe pkgs.tuigreet)
+        "--time"
+        "--remember"
+        "--cmd"
+        "${lib.getExe config.programs.uwsm.package} start -e -D Hyprland hyprland.desktop"
+      ];
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/mako.nix
+++ b/configs/nixos/modules/desktop/session/mako.nix
@@ -2,20 +2,29 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # mako as the notification daemon: toasts, a do-not-disturb mode, and history recall.
 let
-  cfg = config.modules.desktop.session.mako;
-  user = config.user.name;
+  dndStatus = pkgs.writeShellScript "waybar-dnd-status" ''
+    if ${lib.getExe' pkgs.mako "makoctl"} mode 2>/dev/null | ${lib.getExe pkgs.gnugrep} -qx dnd; then
+      printf '{"text":"${util.glyph "f1f6"}","tooltip":"Do not disturb: on","class":"dnd"}\n'
+    else
+      printf '{"text":"${util.glyph "f0f3"}","tooltip":"Notifications on","class":"active"}\n'
+    fi
+  '';

-  makoctl = "${pkgs.mako}/bin/makoctl";
+  dndToggle = pkgs.writeShellScript "waybar-dnd-toggle" ''
+    ${lib.getExe' pkgs.mako "makoctl"} mode -t dnd >/dev/null 2>&1
+    ${lib.getExe' pkgs.procps "pkill"} -RTMIN+8 waybar
+  '';
 in
 {
  options.modules.desktop.session.mako.enable = lib.mkEnableOption "the mako notification daemon";

-  config = lib.mkIf cfg.enable {
-    home-manager.users.${user} = {
+  config = lib.mkIf config.modules.desktop.session.mako.enable {
+    home-manager.users.${config.user.name} = {
      # Colors and the popup font come from Stylix's mako target, so only
      # behaviour is set here.
      services.mako = {
@@ -32,13 +41,25 @@ in
          "mode=dnd".invisible = true;
        };
      };
+    };

-      # Recall the last notification from history, keyboard-only like the rest
-      # of the session.
-      # $mod is defined by the compositor config these binds share.
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod, N, exec, ${makoctl} restore"
-      ];
+    registry.keybind.${config.networking.hostName}.mako-history = {
+      keys = "SUPER + N";
+      action = {
+        kind = "exec";
+        command = "${lib.getExe' pkgs.mako "makoctl"} restore";
+      };
+    };
+
+    registry.waybar.${config.networking.hostName}."custom/dnd" = {
+      order = 80;
+      settings = {
+        return-type = "json";
+        exec = "${dndStatus}";
+        on-click = "${dndToggle}";
+        interval = "once";
+        signal = 8;
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/portals.nix
+++ b/configs/nixos/modules/desktop/session/portals.nix
@@ -1,13 +1,10 @@
 { config, lib, ... }:
 # XDG desktop portal routing for in-app screen sharing and file dialogs.
-let
-  cfg = config.modules.desktop.session.portals;
-in
 {
  options.modules.desktop.session.portals.enable =
    lib.mkEnableOption "XDG desktop portals for in-app screen sharing and file dialogs";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.portals.enable {
    # The backend packages arrive with the compositor, so only the routing is set
    # here.
    # Screen sharing, screenshots, and global shortcuts need the compositor's
--- a/configs/nixos/modules/desktop/session/rofi.nix
+++ b/configs/nixos/modules/desktop/session/rofi.nix
@@ -6,31 +6,29 @@
 }:
 # rofi as the desktop launcher and dmenu-style menu frontend.
 let
-  cfg = config.modules.desktop.session.rofi;
-  user = config.user.name;
-
  # A session menu built on the same themed rofi, so the power actions look
  # like every other menu the launcher drives.
  powerMenu = pkgs.writeShellScript "rofi-power-menu" ''
    chosen=$(printf '%s\n' Lock Suspend 'Log out' Reboot 'Shut down' \
-      | ${pkgs.rofi}/bin/rofi -dmenu -i -p Power)
+      | ${lib.getExe pkgs.rofi} -dmenu -i -p Power)
    case "$chosen" in
-      Lock) ${pkgs.systemd}/bin/loginctl lock-session ;;
-      Suspend) ${pkgs.systemd}/bin/systemctl suspend ;;
-      'Log out') ${pkgs.systemd}/bin/loginctl terminate-session "$XDG_SESSION_ID" ;;
-      Reboot) ${pkgs.systemd}/bin/systemctl reboot ;;
-      'Shut down') ${pkgs.systemd}/bin/systemctl poweroff ;;
+      Lock) ${lib.getExe' pkgs.systemd "loginctl"} lock-session ;;
+      Suspend) ${lib.getExe' pkgs.systemd "systemctl"} suspend ;;
+      'Log out') ${lib.getExe' pkgs.systemd "loginctl"} terminate-session "$XDG_SESSION_ID" ;;
+      Reboot) ${lib.getExe' pkgs.systemd "systemctl"} reboot ;;
+      'Shut down') ${lib.getExe' pkgs.systemd "systemctl"} poweroff ;;
    esac
  '';
 in
 {
  options.modules.desktop.session.rofi.enable = lib.mkEnableOption "the rofi launcher";

-  config = lib.mkIf cfg.enable {
-    home-manager.users.${user} = {
-      # No theme is set here: Stylix's rofi target supplies the Nord one.
+  config = lib.mkIf config.modules.desktop.session.rofi.enable {
+    home-manager.users.${config.user.name} = hm: {
+      # Stylix supplies the Nord theme.
      programs.rofi = {
        enable = true;
+        font = lib.mkForce "JetBrains Mono 12";

        # Application launch is the only mode, kept minimal so the prompt opens
        # as fast as rofi can read the desktop entries.
@@ -39,14 +37,31 @@ in
          modi = "drun";
          show-icons = false;
        };
+
+        theme.window = {
+          border = hm.config.lib.formats.rasi.mkLiteral "2px";
+          border-color = hm.config.lib.formats.rasi.mkLiteral "#FFFFFF";
+          border-radius = hm.config.lib.formats.rasi.mkLiteral "8px";
+        };
+      };
+    };
+
+    registry.keybind.${config.networking.hostName} = {
+      rofi-launcher = {
+        keys = "SUPER + R";
+        action = {
+          kind = "exec";
+          command = "${lib.getExe pkgs.rofi} -show drun";
+        };
      };

-      # The launcher and the session menu, kept next to the tool they drive.
-      # $mod is defined by the compositor config these binds share.
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod, R, exec, ${pkgs.rofi}/bin/rofi -show drun"
-        "$mod SHIFT, X, exec, ${powerMenu}"
-      ];
+      rofi-power-menu = {
+        keys = "SUPER + SHIFT + X";
+        action = {
+          kind = "exec";
+          command = "${powerMenu}";
+        };
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/session/waybar.nix
+++ b/configs/nixos/modules/desktop/session/waybar.nix
@@ -6,165 +6,56 @@
 }:
 # Waybar: a top status bar reading system state at a glance.
 let
-  cfg = config.modules.desktop.session.waybar;
-  vpnClient = config.modules.network.vpn-client;
-  user = config.user.name;
+  moduleNames =
+    position:
+    map (entry: entry.name) (
+      lib.sort (left: right: left.module.order < right.module.order) (
+        lib.filter (entry: entry.module.position == position) moduleEntries
+      )
+    );

-  # A Nerd Font Private-Use-Area codepoint as a literal character, decoded
-  # through JSON so the glyph survives as bytes rather than an editor paste.
-  g = code: builtins.fromJSON ''"\u${code}"'';
-  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
+  moduleEntries = lib.mapAttrsToList (name: module: {
+    inherit name module;
+  }) modules;

-  # Renders and toggles mako's do-not-disturb mode.
-  # With no mako daemon answering, the status reads "notifications on", keeping
-  # the widget inert rather than broken.
-  dndStatus = pkgs.writeShellScript "waybar-dnd-status" ''
-    if ${pkgs.mako}/bin/makoctl mode 2>/dev/null | ${pkgs.gnugrep}/bin/grep -qx dnd; then
-      printf '{"text":"${g "f1f6"}","tooltip":"Do not disturb: on","class":"dnd"}\n'
-    else
-      printf '{"text":"${g "f0f3"}","tooltip":"Notifications on","class":"active"}\n'
-    fi
-  '';
-
-  dndToggle = pkgs.writeShellScript "waybar-dnd-toggle" ''
-    ${pkgs.mako}/bin/makoctl mode -t dnd >/dev/null 2>&1
-    ${pkgs.procps}/bin/pkill -RTMIN+8 waybar
-  '';
-
-  # Lit while a wf-recorder capture is running.
-  # Empty text collapses the widget when idle, so it shows nothing until then.
-  recStatus = pkgs.writeShellScript "waybar-recording-status" ''
-    if ${pkgs.procps}/bin/pgrep -x wf-recorder >/dev/null; then
-      printf '{"text":"${g "f03d"}","tooltip":"Recording","class":"recording"}\n'
-    else
-      printf '{"text":"","class":"idle"}\n'
-    fi
-  '';
-
-  idleLockStatus = pkgs.writeShellScript "waybar-idle-lock-status" ''
-    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet lockscreen-idle-inhibit.service; then
-      printf '{"text":"${sleepOffIcon}","tooltip":"Idle locking inhibited","class":"inhibited"}\n'
-    else
-      printf '{"text":"","class":"idle"}\n'
-    fi
-  '';
-
-  vpnStatus = pkgs.writeShellScript "waybar-vpn-status" ''
-    interface=${lib.escapeShellArg vpnClient.interface}
-
-    if ! ${pkgs.iproute2}/bin/ip link show dev "$interface" >/dev/null 2>&1; then
-      printf '{"text":"","class":"idle"}\n'
-      exit 0
-    fi
-
-    ipaddr=$(${pkgs.iproute2}/bin/ip -4 -o addr show dev "$interface" | ${pkgs.gawk}/bin/awk '{ print $4; exit }')
-
-    ${pkgs.jq}/bin/jq -cn \
-      --arg text "󰲝" \
-      --arg tooltip "VPN $interface: ''${ipaddr:-no IPv4}" \
-      --arg class "active" \
-      '{ text: $text, tooltip: $tooltip, class: $class }'
-  '';
-
-  networkStatus = pkgs.writeShellScript "waybar-network-status" ''
-    active=$(
-      ${pkgs.networkmanager}/bin/nmcli -t -f DEVICE,TYPE,STATE,CONNECTION device status \
-        | ${pkgs.gawk}/bin/awk -F: '$3 == "connected" && $2 != "loopback" { print; exit }'
-    )
-
-    if [ -z "$active" ]; then
-      ${pkgs.jq}/bin/jq -cn \
-        --arg text "${g "f127"} off" \
-        --arg tooltip "Network disconnected" \
-        --arg class "disconnected" \
-        '{ text: $text, tooltip: $tooltip, class: $class }'
-      exit 0
-    fi
-
-    IFS=: read -r device type _state connection <<< "$active"
-
-    case "$type" in
-      wifi) icon="${g "f1eb"}" ;;
-      ethernet) icon="LAN" ;;
-      *) icon="NET" ;;
-    esac
-
-    ipaddr=$(${pkgs.iproute2}/bin/ip -4 -o addr show dev "$device" | ${pkgs.gawk}/bin/awk '{ print $4; exit }')
-
-    ${pkgs.jq}/bin/jq -cn \
-      --arg text "$icon $connection" \
-      --arg tooltip "$device: ''${ipaddr:-no IPv4}" \
-      --arg class "$type" \
-      '{ text: $text, tooltip: $tooltip, class: $class }'
-  '';
+  modules = lib.attrByPath [ config.networking.hostName ] { } config.registry.waybar;
 in
 {
  options.modules.desktop.session.waybar.enable = lib.mkEnableOption "the Waybar status bar";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.waybar.enable {
    # A symbols font backs the module glyphs, so pango falls back to it for the
    # codepoints Stylix's monospace font does not carry.
    fonts.packages = [ pkgs.nerd-fonts.symbols-only ];

-    home-manager.users.${user}.programs.waybar = {
+    home-manager.users.${config.user.name}.programs.waybar = {
      enable = true;

      # A user service bound to graphical-session.target, which uwsm activates,
      # so the bar comes up with the session and no compositor exec-once.
      systemd.enable = true;

-      style = ''
-        .modules-right {
-          margin-right: 8px;
+      settings.mainBar = lib.mkMerge [
+        {
+          layer = "top";
+          position = "top";
+          height = 30;
+          spacing = 8;
+          margin-right = 8;
+
+          modules-left = moduleNames "left";
+          modules-center = moduleNames "center";
+          modules-right = moduleNames "right";
        }
+        (lib.mapAttrs (_name: module: module.settings) modules)
+      ];
+    };

-        #custom-dnd {
-          margin-right: 8px;
-        }
-      '';
-
-      settings.mainBar = {
-        layer = "top";
-        position = "top";
-        height = 30;
-        spacing = 8;
-
-        modules-left = [ "hyprland/workspaces" ];
-        modules-center = [ "clock" ];
-        modules-right = [
-          "custom/recording"
-          "custom/idle-lock"
-          "mpris"
-          "wireplumber"
-        ]
-        ++ lib.optional vpnClient.enable "custom/vpn"
-        ++ [
-          "custom/network"
-          "battery"
-          "custom/dnd"
-        ];
-
-        # Per-application icons for the windows on each workspace, mapped from
-        # window class with a neutral glyph for anything unlisted.
-        "hyprland/workspaces" = {
-          on-click = "activate";
-          format = "{id} {windows}";
-          format-window-separator = " ";
-          window-rewrite-default = g "f2d0";
-          window-rewrite = {
-            "class<Alacritty>" = g "f120";
-            "class<com.mitchellh.ghostty>" = g "f120";
-            "class<.*[Ff]irefox.*>" = g "f269";
-            "class<chromium.*>" = g "f268";
-            "class<[Cc]ode>" = g "f121";
-            "class<obsidian>" = g "f02d";
-            "class<[Ss]ignal>" = g "f4ad";
-            "class<[Ss]team>" = g "f1b6";
-            "class<[Vv]esktop>" = g "f1ff";
-          };
-        };
-
-        clock = {
+    registry.waybar.${config.networking.hostName} = {
+      clock = {
+        position = "center";
+        order = 10;
+        settings = {
          format = "{:%a %d %b  %H:%M}";
          tooltip-format = "<tt>{calendar}</tt>";
          calendar = {
@@ -173,77 +64,6 @@ in
            format.today = "<b><u>{}</u></b>";
          };
        };
-
-        mpris = {
-          format = "${g "f001"} {title}";
-          format-paused = "${g "f04c"} {title}";
-          max-length = 40;
-          on-click = "play-pause";
-          on-scroll-up = "next";
-          on-scroll-down = "previous";
-        };
-
-        wireplumber = {
-          format = "{icon} {volume}%";
-          format-muted = "${g "f026"} muted";
-          format-icons = [
-            (g "f026")
-            (g "f027")
-            (g "f028")
-          ];
-          on-click = "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-        };
-
-        "custom/vpn" = {
-          return-type = "json";
-          exec = "${vpnStatus}";
-          interval = 5;
-        };
-
-        "custom/network" = {
-          return-type = "json";
-          exec = "${networkStatus}";
-          interval = 5;
-        };
-
-        battery = {
-          format = "{icon} {capacity}%";
-          format-charging = "${g "f0e7"} {capacity}%";
-          format-icons = [
-            (g "f244")
-            (g "f243")
-            (g "f242")
-            (g "f241")
-            (g "f240")
-          ];
-          states = {
-            warning = 20;
-            critical = 10;
-          };
-        };
-
-        "custom/dnd" = {
-          return-type = "json";
-          exec = "${dndStatus}";
-          on-click = "${dndToggle}";
-          interval = "once";
-          signal = 8;
-        };
-
-        # Recording state has no event to hook, so the widget samples the
-        # wf-recorder process once a second.
-        "custom/recording" = {
-          return-type = "json";
-          exec = "${recStatus}";
-          interval = 1;
-        };
-
-        "custom/idle-lock" = {
-          return-type = "json";
-          exec = "${idleLockStatus}";
-          interval = "once";
-          signal = 9;
-        };
      };
    };
  };
--- a/configs/nixos/modules/desktop/utilities/audio.nix
+++ b/configs/nixos/modules/desktop/utilities/audio.nix
@@ -1,12 +1,25 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  util,
+  ...
+}:
 # PipeWire as the desktop audio server.
 let
-  cfg = config.modules.desktop.utilities.audio;
+  mediaKey = keys: command: {
+    inherit keys;
+    locked = true;
+    action = {
+      kind = "exec";
+      command = "${lib.getExe pkgs.playerctl} ${command}";
+    };
+  };
 in
 {
  options.modules.desktop.utilities.audio.enable = lib.mkEnableOption "the PipeWire audio server";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.audio.enable {
    # Realtime scheduling for the audio threads, so playback survives load.
    security.rtkit.enable = true;

@@ -15,5 +28,39 @@ in
      alsa.enable = true;
      pulse.enable = true;
    };
+
+    registry.keybind.${config.networking.hostName} = {
+      media-play = mediaKey "XF86AudioPlay" "play-pause";
+      media-next = mediaKey "XF86AudioNext" "next";
+      media-previous = mediaKey "XF86AudioPrev" "previous";
+    };
+
+    registry.waybar.${config.networking.hostName} = {
+      mpris = {
+        order = 30;
+        settings = {
+          format = "${util.glyph "f001"} {title}";
+          format-paused = "${util.glyph "f04c"} {title}";
+          max-length = 40;
+          on-click = "play-pause";
+          on-scroll-up = "next";
+          on-scroll-down = "previous";
+        };
+      };
+
+      wireplumber = {
+        order = 40;
+        settings = {
+          format = "{icon} {volume}%";
+          format-muted = "${util.glyph "f026"} muted";
+          format-icons = [
+            (util.glyph "f026")
+            (util.glyph "f027")
+            (util.glyph "f028")
+          ];
+          on-click = "${lib.getExe' pkgs.wireplumber "wpctl"} set-mute @DEFAULT_AUDIO_SINK@ toggle";
+        };
+      };
+    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/clipboard.nix
+++ b/configs/nixos/modules/desktop/utilities/clipboard.nix
@@ -6,30 +6,23 @@
 }:
 # Clipboard history: cliphist records every copy, picked back through rofi.
 let
-  cfg = config.modules.desktop.utilities.clipboard;
-  user = config.user.name;
-
-  cliphist = "${pkgs.cliphist}/bin/cliphist";
-  rofi = "${pkgs.rofi}/bin/rofi";
-  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
-
  # The picker reuses the themed rofi, so history looks like every other menu
  # the launcher drives.
  # decode is needed because list emits id-prefixed lines rather than the copied
  # bytes, so the chosen id has to be resolved back before it can be re-copied.
  picker = pkgs.writeShellScript "clipboard-picker" ''
-    ${cliphist} list \
-      | ${rofi} -dmenu -i -p Clipboard \
-      | ${cliphist} decode \
-      | ${wl-copy}
+    ${lib.getExe pkgs.cliphist} list \
+      | ${lib.getExe pkgs.rofi} -dmenu -i -p Clipboard \
+      | ${lib.getExe pkgs.cliphist} decode \
+      | ${lib.getExe' pkgs.wl-clipboard "wl-copy"}
  '';
 in
 {
  options.modules.desktop.utilities.clipboard.enable =
    lib.mkEnableOption "cliphist clipboard history";

-  config = lib.mkIf cfg.enable {
-    home-manager.users.${user} = {
+  config = lib.mkIf config.modules.desktop.utilities.clipboard.enable {
+    home-manager.users.${config.user.name} = {
      # wl-copy and wl-paste on PATH, so the shell can pipe into and out of the
      # clipboard.
      # The watchers and picker above reach wl-clipboard by store path, so this
@@ -39,11 +32,14 @@ in
      # Two watchers record text and images to history, bound to the graphical
      # session so uwsm starts and stops them with it.
      services.cliphist.enable = true;
+    };

-      # $mod is defined by the compositor config these binds share.
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod SHIFT, V, exec, ${picker}"
-      ];
+    registry.keybind.${config.networking.hostName}.clipboard-history = {
+      keys = "SUPER + SHIFT + V";
+      action = {
+        kind = "exec";
+        command = "${picker}";
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/osd.nix
+++ b/configs/nixos/modules/desktop/utilities/osd.nix
@@ -6,14 +6,60 @@
 }:
 # SwayOSD: a transient on-screen popup for volume and brightness changes.
 let
-  cfg = config.modules.desktop.utilities.osd;
  user = config.user.name;
 in
 {
  options.modules.desktop.utilities.osd.enable =
    lib.mkEnableOption "the SwayOSD volume and brightness popup";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.osd.enable {
+    registry.keybind.${config.networking.hostName} = {
+      volume-up = {
+        keys = "XF86AudioRaiseVolume";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume raise --max-volume 100";
+        };
+      };
+
+      volume-down = {
+        keys = "XF86AudioLowerVolume";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume lower";
+        };
+      };
+
+      brightness-up = {
+        keys = "XF86MonBrightnessUp";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --brightness raise";
+        };
+      };
+
+      brightness-down = {
+        keys = "XF86MonBrightnessDown";
+        repeating = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --brightness lower";
+        };
+      };
+
+      mute = {
+        keys = "XF86AudioMute";
+        locked = true;
+        action = {
+          kind = "exec";
+          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume mute-toggle";
+        };
+      };
+    };
+
    environment.systemPackages = [ pkgs.swayosd ];

    # The udev rule chgrps each backlight's brightness node to `video` and adds
--- a/configs/nixos/modules/desktop/utilities/recording.nix
+++ b/configs/nixos/modules/desktop/utilities/recording.nix
@@ -2,22 +2,11 @@
  config,
  lib,
  pkgs,
+  util,
  ...
 }:
 # Keybound screen recording: pick a region, then toggle a video-only capture.
 let
-  cfg = config.modules.desktop.utilities.recording;
-  user = config.user.name;
-
-  slurp = "${pkgs.slurp}/bin/slurp";
-  wf-recorder = "${pkgs.wf-recorder}/bin/wf-recorder";
-  notify-send = "${pkgs.libnotify}/bin/notify-send";
-  pgrep = "${pkgs.procps}/bin/pgrep";
-  pkill = "${pkgs.procps}/bin/pkill";
-  date = "${pkgs.coreutils}/bin/date";
-  mkdir = "${pkgs.coreutils}/bin/mkdir";
-  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";
-
  # A single key both starts and stops.
  # A running wf-recorder is stopped with SIGINT so it finalises the file.
  # Otherwise slurp picks a region and wf-recorder runs in the foreground until
@@ -25,31 +14,51 @@ let
  # reports it saved.
  # No -a means no audio is captured.
  toggle = pkgs.writeShellScript "screen-record-toggle" ''
-    if ${pgrep} -x wf-recorder >/dev/null; then
-      ${pkill} -INT -x wf-recorder
+    if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
+      ${lib.getExe' pkgs.procps "pkill"} -INT -x wf-recorder
      exit 0
    fi

-    region=$(${slurp}) || exit 0
-    dir="$(${xdgUserDir} VIDEOS)/Recordings"
-    ${mkdir} -p "$dir"
-    file="$dir/recording-$(${date} +%Y%m%d-%H%M%S).mp4"
+    region=$(${lib.getExe pkgs.slurp}) || exit 0
+    dir="$(${lib.getExe' pkgs.xdg-user-dirs "xdg-user-dir"} VIDEOS)/Recordings"
+    ${lib.getExe' pkgs.coreutils "mkdir"} -p "$dir"
+    file="$dir/recording-$(${lib.getExe' pkgs.coreutils "date"} +%Y%m%d-%H%M%S).mp4"

-    ${notify-send} -a "Screen recording" "Recording started" "Region capture, no audio."
-    ${wf-recorder} -g "$region" -f "$file"
-    ${notify-send} -a "Screen recording" "Recording saved" "$file"
+    ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording started" "Region capture, no audio."
+    ${lib.getExe pkgs.wf-recorder} -g "$region" -f "$file"
+    ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording saved" "$file"
+  '';
+
+  # Lit while a wf-recorder capture is running.
+  # Empty text collapses the widget when idle, so it shows nothing until then.
+  recordingStatus = pkgs.writeShellScript "waybar-recording-status" ''
+    if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
+      printf '{"text":"${util.glyph "f03d"}","tooltip":"Recording","class":"recording"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
+    fi
  '';
 in
 {
  options.modules.desktop.utilities.recording.enable =
    lib.mkEnableOption "wf-recorder screen recording";

-  config = lib.mkIf cfg.enable {
-    home-manager.users.${user} = {
-      # $mod is defined by the compositor config these binds share.
-      wayland.windowManager.hyprland.settings.bind = [
-        "$mod SHIFT, R, exec, ${toggle}"
-      ];
+  config = lib.mkIf config.modules.desktop.utilities.recording.enable {
+    registry.keybind.${config.networking.hostName}.recording-toggle = {
+      keys = "SUPER + SHIFT + R";
+      action = {
+        kind = "exec";
+        command = "${toggle}";
+      };
+    };
+
+    registry.waybar.${config.networking.hostName}."custom/recording" = {
+      order = 10;
+      settings = {
+        return-type = "json";
+        exec = "${recordingStatus}";
+        interval = 1;
+      };
    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/screenshot.nix
+++ b/configs/nixos/modules/desktop/utilities/screenshot.nix
@@ -4,25 +4,26 @@
  pkgs,
  ...
 }:
-# Keyboard-driven screenshots that open in satty for annotation, then land in
-# both the clipboard and a dated file.
+# Keyboard-driven screenshots copy to the clipboard before Satty opens for
+# annotation. Satty copies annotated screenshots when it saves them.
 let
-  cfg = config.modules.desktop.utilities.screenshot;
  user = config.user.name;

  grimblast = "${pkgs.grimblast}/bin/grimblast";
  satty = "${pkgs.satty}/bin/satty";
+  tee = "${pkgs.coreutils}/bin/tee";
  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";

-  # satty's copy action also saves, so one keystroke lands the shot in both the
-  # clipboard and a file.
+  # Copy the original screenshot before Satty opens.
+  # Satty copies and saves annotated screenshots when the user presses Enter.
  capture =
    target:
    pkgs.writeShellScript "screenshot-${target}" ''
      dir="$(${xdgUserDir} PICTURES)/Screenshots"
      mkdir -p "$dir"
      ${grimblast} save ${target} - \
+        | ${tee} >(${wl-copy}) \
        | ${satty} --filename - \
          --output-filename "$dir/screenshot-%Y%m%d-%H%M%S.png" \
          --copy-command ${wl-copy} \
@@ -35,24 +36,43 @@ in
  options.modules.desktop.utilities.screenshot.enable =
    lib.mkEnableOption "screenshots via grimblast and satty";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.screenshot.enable {
+    registry.keybind.${config.networking.hostName} = {
+      screenshot-area = {
+        keys = "Print";
+        action = {
+          kind = "exec";
+          command = "${capture "area"}";
+        };
+      };
+
+      screenshot-active = {
+        keys = "SHIFT + Print";
+        action = {
+          kind = "exec";
+          command = "${capture "active"}";
+        };
+      };
+
+      screenshot-screen = {
+        keys = "CTRL + Print";
+        action = {
+          kind = "exec";
+          command = "${capture "screen"}";
+        };
+      };
+    };
+
    home-manager.users.${user} = {
      # satty is a one-shot annotation surface, so float it rather than letting
      # it claim a tile in the layout.
-      # windowrule v3 syntax: space-separated field/value tokens, comma
-      # separated, with matchers under a match: prefix and effects bare.
-      wayland.windowManager.hyprland.settings.windowrule = [
-        "float 1, match:class ^(com\\.gabm\\.satty)$"
+      wayland.windowManager.hyprland.settings.window_rule = [
+        {
+          match.class = "^(com\\.gabm\\.satty)$";
+          float = true;
+        }
      ];

-      # Print with plain/Shift/Ctrl for region/window/full.
-      # Super+L is already the hjkl focus and movement bind, so screenshots take
-      # the Print key instead.
-      wayland.windowManager.hyprland.settings.bind = [
-        ", Print, exec, ${capture "area"}"
-        "SHIFT, Print, exec, ${capture "active"}"
-        "CTRL, Print, exec, ${capture "screen"}"
-      ];
    };
  };
 }
--- a/configs/nixos/modules/desktop/utilities/theming.nix
+++ b/configs/nixos/modules/desktop/utilities/theming.nix
@@ -6,8 +6,6 @@
 }:
 # Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
 let
-  cfg = config.modules.desktop.utilities.theming;
-  user = config.user.name;

  # A single static Nord wallpaper, drawn as a vertical gradient across the
  # Polar Night shades so it needs no committed binary and no network fetch.
@@ -16,12 +14,13 @@ let
      -size 2560x1440 gradient:'#2E3440'-'#3B4252' \
      "$out"
  '';
+  user = config.user.name;
 in
 {
  options.modules.desktop.utilities.theming.enable =
    lib.mkEnableOption "Nord theming of the graphical layer via Stylix";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.theming.enable {
    stylix = {
      enable = true;

@@ -59,6 +58,10 @@ in
        };
      };
    };
+    registry.env.${config.networking.hostName} = {
+      HYPRCURSOR_THEME = config.stylix.cursor.name;
+      HYPRCURSOR_SIZE = toString config.stylix.cursor.size;
+    };

    home-manager.users.${user} = {
      # Stylix drives the cursor through home-manager's pointer-cursor config,
--- a/configs/nixos/modules/desktop/utilities/userdirs.nix
+++ b/configs/nixos/modules/desktop/utilities/userdirs.nix
@@ -2,13 +2,12 @@
 # Declares the XDG user directories, so a tool that queries them lands in a
 # well-known folder a host can relocate from one place.
 let
-  cfg = config.modules.desktop.utilities.userdirs;
  user = config.user.name;
 in
 {
  options.modules.desktop.utilities.userdirs.enable = lib.mkEnableOption "XDG user directories";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.userdirs.enable {
    # Write ~/.config/user-dirs.dirs from the option defaults.
    home-manager.users.${user}.xdg.userDirs.enable = true;
  };
--- a/configs/nixos/modules/guest.nix
+++ b/configs/nixos/modules/guest.nix
@@ -1,12 +1,9 @@
 { config, lib, ... }:
-let
-  cfg = config.modules.guest;
-in
 {
-  options.modules.guest.enable = lib.mkEnableOption "nested-guest base configuration";
+  options.modules.guest.enable = lib.mkEnableOption "nested guest configuration";

-  config = lib.mkIf cfg.enable {
-    modules.network.ssh.enable = lib.mkDefault true;
+  config = lib.mkIf config.modules.guest.enable {
+    modules.network.ssh.enable = lib.mkDefault false;
    modules.network.ssh.hostKeys.restore = lib.mkDefault false;
  };
 }
--- a/configs/nixos/modules/host.nix
+++ b/configs/nixos/modules/host.nix
@@ -1,52 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.modules.host;
-  inherit (config) user;
-  hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
-  passwordSecret = "${user.name}-password";
-in
-{
-  options.modules.host.enable = lib.mkEnableOption "physical-host base configuration";
-
-  config = lib.mkIf cfg.enable {
-    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
-    nix.settings.extra-trusted-public-keys = [
-      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
-    ];
-
-    nix.gc.automatic = true;
-    nix.gc.dates = "Mon 03:15";
-    nix.gc.options = "--delete-older-than 30d";
-
-    nix.optimise.automatic = true;
-    nix.optimise.dates = [ "Thu 03:45" ];
-
-    boot.loader.systemd-boot.enable = true;
-    boot.loader.systemd-boot.configurationLimit = 15;
-    boot.loader.efi.canTouchEfiVariables = true;
-
-    hardware.enableRedistributableFirmware = true;
-    zramSwap.enable = true;
-
-    modules.network.ssh.enable = true;
-    modules.network.ssh.hostKeys.sopsFile = hostSecrets;
-    modules.network.ssh.userKey.sopsFile = hostSecrets;
-
-    services.xserver.xkb.layout = "us";
-    services.xserver.xkb.options = "caps:escape_shifted_capslock";
-    console.useXkbConfig = true;
-
-    sops.defaultSopsFile = ../secrets/shared.yaml;
-    sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-    sops.age.sshKeyPaths = [ ];
-    sops.gnupg.sshKeyPaths = [ ];
-
-    users.mutableUsers = false;
-    sops.secrets.${passwordSecret}.neededForUsers = true;
-    users.users.${user.name}.hashedPasswordFile = config.sops.secrets.${passwordSecret}.path;
-  };
-}
--- a/configs/nixos/modules/host/cachyos.nix
+++ b/configs/nixos/modules/host/cachyos.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.modules.host.cachyos.enable = lib.mkEnableOption "the CachyOS kernel";
+
+  config = lib.mkIf config.modules.host.cachyos.enable {
+    boot.kernelPackages = pkgs.linuxPackages_cachyos;
+
+    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
+    nix.settings.extra-trusted-public-keys = [
+      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
+    ];
+  };
+}
--- a/configs/nixos/modules/host/default.nix
+++ b/configs/nixos/modules/host/default.nix
@@ -0,0 +1,106 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  hostSecrets = ../../secrets + "/${config.networking.hostName}.yaml";
+in
+{
+  options.modules.host.enable = lib.mkEnableOption "physical host configuration";
+
+  config = lib.mkIf config.modules.host.enable {
+    nix.gc.automatic = true;
+    nix.gc.dates = "Mon 03:15";
+    nix.gc.options = "--delete-older-than 30d";
+
+    nix.optimise.automatic = true;
+    nix.optimise.dates = [ "Thu 03:45" ];
+
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.systemd-boot.configurationLimit = 15;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    hardware.enableRedistributableFirmware = true;
+    zramSwap.enable = true;
+
+    modules.network.ssh.enable = true;
+    modules.network.ssh.hostKeys.sopsFile = hostSecrets;
+    modules.network.ssh.userKey.sopsFile = hostSecrets;
+
+    services.xserver.xkb.layout = "us";
+    console.useXkbConfig = true;
+
+    sops.defaultSopsFile = ../../secrets/shared.yaml;
+    sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+    sops.age.sshKeyPaths = [ ];
+    sops.gnupg.sshKeyPaths = [ ];
+
+    users.mutableUsers = false;
+    sops.secrets."${config.user.name}-password".neededForUsers = true;
+    users.users.${config.user.name}.hashedPasswordFile =
+      config.sops.secrets."${config.user.name}-password".path;
+
+    security.sudo.extraConfig = ''
+      Defaults env_keep += "EDITOR VISUAL"
+    '';
+
+    home-manager = {
+      useGlobalPkgs = true;
+      useUserPackages = true;
+      users.${config.user.name} = {
+        home.username = config.user.name;
+        home.homeDirectory = "/home/${config.user.name}";
+        home.stateVersion = config.system.stateVersion;
+        home.sessionVariables = lib.attrByPath [ config.networking.hostName ] { } config.registry.env;
+        home.packages = with pkgs; [
+          eza
+          unzip
+          wget
+        ];
+      };
+    };
+
+    registry.shell-shortcut.${config.networking.hostName} = {
+      ls = {
+        command = "eza -alg --color=always --group-directories-first --icons=always";
+        abbreviation = false;
+      };
+      ll = {
+        command = "eza -lg --color=always --group-directories-first --icons=always";
+        abbreviation = false;
+      };
+      lt = {
+        command = "eza -aT -I '.git' --color=always --group-directories-first --icons=always";
+        abbreviation = false;
+      };
+      ".." = "cd ..";
+      "..." = "cd ../..";
+      "...." = "cd ../../..";
+
+      cp = "cp -v";
+      tarnow = "tar -acf ";
+      untar = "tar -zxvf ";
+      wget = "wget -c ";
+      grep = "grep --color=auto";
+      fgrep = "fgrep --color=auto";
+      egrep = "egrep --color=auto";
+      jctl = "journalctl -p 3 -xb";
+
+      update = "sudo nixos-rebuild switch --flake .#${config.networking.hostName}";
+      cleanup = "sudo nix-collect-garbage -d";
+      sops-host = {
+        command = "sudo --preserve-env=EDITOR,VISUAL env SOPS_AGE_KEY_FILE=/var/lib/sops-nix/key.txt nix shell nixpkgs#sops nixpkgs#neovim -c sops";
+        abbreviation = false;
+      };
+    };
+
+    modules.shell.fish.enable = lib.mkDefault true;
+    modules.shell.fish.defaultShell = lib.mkDefault true;
+    modules.shell.tmux.enable = lib.mkDefault true;
+    modules.shell.nvim.enable = lib.mkDefault true;
+    modules.shell.git.enable = lib.mkDefault true;
+    modules.shell.yazi.enable = lib.mkDefault true;
+  };
+}
--- a/configs/nixos/modules/host/zfs.nix
+++ b/configs/nixos/modules/host/zfs.nix
@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  ...
+}:
+# Imports existing ZFS pools that hold durable service state.
+let
+  cfg = config.modules.host.zfs; # NOLINT(let_order)
+in
+{
+  options.modules.host.zfs = {
+    enable = lib.mkEnableOption "ZFS pool imports for durable service state";
+
+    pools = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.attrsOf lib.types.path);
+      default = { };
+      example = lib.literalExpression ''
+        {
+          tank = {
+            media = "/srv/media";
+            downloads = "/srv/downloads";
+          };
+        }
+      '';
+      description = ''
+        Lists pools that NixOS imports at boot.
+        Maps each dataset name to its mount point.
+        NixOS does not create or destroy these pools during rebuilds.
+        An empty map imports the pool without declaring file systems.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.supportedFilesystems = [ "zfs" ];
+
+    # This module derives a stable host ID from the configured hostname.
+    networking.hostId = builtins.substring 0 8 (
+      builtins.hashString "sha256" config.networking.hostName
+    );
+
+    boot.zfs.extraPools = lib.attrNames cfg.pools;
+
+    fileSystems = lib.mkMerge (
+      lib.mapAttrsToList (
+        pool: mounts:
+        lib.mapAttrs' (
+          dataset: mountpoint:
+          lib.nameValuePair mountpoint {
+            device = "${pool}/${dataset}";
+            fsType = "zfs";
+          }
+        ) mounts
+      ) cfg.pools
+    );
+  };
+}
--- a/configs/nixos/modules/monorepo.nix
+++ b/configs/nixos/modules/monorepo.nix
@@ -4,13 +4,10 @@
  ...
 }:
 # Tools for developing this monorepo.
-let
-  cfg = config.modules.monorepo;
-in
 {
  options.modules.monorepo.enable = lib.mkEnableOption "tools for developing this monorepo";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.monorepo.enable {
    modules.shell.bazel.enable = true;
    modules.shell.python.enable = true;
    modules.shell.rust.enable = true;
--- a/configs/nixos/modules/network/default.nix
+++ b/configs/nixos/modules/network/default.nix
@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  util,
+  ...
+}:
+# NetworkManager-managed networking.
+let
+  networkStatus = pkgs.writeShellScript "waybar-network-status" ''
+    active=$(
+      ${lib.getExe' pkgs.networkmanager "nmcli"} -t -f DEVICE,TYPE,STATE,CONNECTION device status \
+        | ${lib.getExe' pkgs.gawk "awk"} -F: '$3 == "connected" && $2 != "loopback" { print; exit }'
+    )
+
+    if [ -z "$active" ]; then
+      ${lib.getExe pkgs.jq} -cn \
+        --arg text "${util.glyph "f127"} off" \
+        --arg tooltip "Network disconnected" \
+        --arg class "disconnected" \
+        '{ text: $text, tooltip: $tooltip, class: $class }'
+      exit 0
+    fi
+
+    IFS=: read -r device type _state connection <<< "$active"
+
+    case "$type" in
+      wifi) icon="${util.glyph "f1eb"}" ;;
+      ethernet) icon="LAN" ;;
+      *) icon="NET" ;;
+    esac
+
+    ipaddr=$(${lib.getExe' pkgs.iproute2 "ip"} -4 -o addr show dev "$device" | ${lib.getExe' pkgs.gawk "awk"} '{ print $4; exit }')
+
+    ${lib.getExe pkgs.jq} -cn \
+      --arg text "$icon $connection" \
+      --arg tooltip "$device: ''${ipaddr:-no IPv4}" \
+      --arg class "$type" \
+      '{ text: $text, tooltip: $tooltip, class: $class }'
+  '';
+in
+{
+  options.modules.network.enable = lib.mkEnableOption "NetworkManager-managed networking";
+
+  config = lib.mkIf config.modules.network.enable {
+    networking.networkmanager.enable = true;
+
+    registry.waybar.${config.networking.hostName}."custom/network" = {
+      order = 60;
+      settings = {
+        return-type = "json";
+        exec = "${networkStatus}";
+        interval = 5;
+      };
+    };
+  };
+}
--- a/configs/nixos/modules/network/ssh.nix
+++ b/configs/nixos/modules/network/ssh.nix
@@ -4,344 +4,208 @@
  registry,
  ...
 }:
-# SSH on this machine, in both directions.
+# Configures inbound and outbound SSH access.
 let
  cfg = config.modules.network.ssh;
-  user = config.user.name;
+  user = config.user.name; # NOLINT(let_order)

-  inherit (lib)
-    concatLists
-    concatStringsSep
-    elem
-    filter
-    genAttrs
-    hasAttr
-    imap0
-    listToAttrs
-    mapAttrs
-    mapAttrsToList
-    mkIf
-    mkMerge
-    mkOption
-    nameValuePair
-    optional
-    optionalAttrs
-    types
-    unique
-    ;
+  # NOLINT(let_order)
+  workstationNames = [
+    "neogaia"
+    "zeus"
+  ];
+  serverNames = [ "pikachu" ];

-  hostKeySecret = type: "ssh-host-${type}-key";
-  userKeySecret = "ssh-user-ed25519-key";
+  isWorkstation = lib.elem config.networking.hostName workstationNames; # NOLINT(let_order)
+  isServer = lib.elem config.networking.hostName serverNames; # NOLINT(let_order)

-  targetType = types.submodule (
-    { name, ... }:
-    {
-      options = {
-        hostName = mkOption {
-          type = types.str;
-          default = name;
-          description = ''
-            The network address OpenSSH connects to for this target.
-          '';
-        };
+  # NOLINT(let_order)
+  clientKeyFor = host: builtins.readFile (../../hosts + "/${host}/ssh_user_ed25519_key.pub");
+  hostKeysFor =
+    host:
+    map builtins.readFile [
+      (../../hosts + "/${host}/ssh_host_ed25519_key.pub")
+      (../../hosts + "/${host}/ssh_host_rsa_key.pub")
+    ];

-        user = mkOption {
-          type = types.str;
-          default = config.user.name;
-          description = ''
-            The remote login name OpenSSH uses for this target.
-          '';
-        };
+  # NOLINT(let_order)
+  managedTargets = lib.genAttrs (workstationNames ++ serverNames) (name: {
+    hostName = registry.address.${name}.self;
+    clientKey = clientKeyFor name;
+    hostKeys = hostKeysFor name;
+  });

-        port = mkOption {
-          type = types.port;
-          default = 22;
-          description = ''
-            The TCP port OpenSSH uses for this target.
-          '';
-        };
+  extraTargets = {
+    # TODO: Pin Gitea's host key after migrating it from Proxmox.
+    gitea = {
+      hostName = "git.alexion.dev";
+      port = 2022;
+      user = "gitea";
+      aliases = [
+        "gitea"
+        "git.alexion.dev"
+      ];
+    };
+  };

-        aliases = mkOption {
-          type = types.listOf types.str;
-          default = [ name ];
-          description = ''
-            Host patterns written into the generated OpenSSH client block.
-          '';
-        };
-
-        clientKey = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = ''
-            The public key this target offers when it connects outward.
-            Other machines admit this key according to the host groups below.
-          '';
-        };
-
-        hostKeys = mkOption {
-          type = types.listOf types.str;
-          default = [ ];
-          description = ''
-            The public keys this target presents when it accepts inbound SSH.
-            These keys generate system-wide known-host entries.
-          '';
-        };
-      };
-    }
-  );
-
-  keyWithoutComment = key: concatStringsSep " " (lib.take 2 (lib.splitString " " key));
-
-  targetNamesIn = names: filter (name: hasAttr name cfg.targets) names;
-
-  workstationNames = targetNamesIn cfg.hosts.workstations;
-  serverNames = targetNamesIn cfg.hosts.servers;
-
-  clientKeysFor = names: filter (key: key != null) (map (name: cfg.targets.${name}.clientKey) names);
-
-  currentHost = config.networking.hostName;
-  isServer = elem currentHost cfg.hosts.servers;
-  isWorkstation = elem currentHost cfg.hosts.workstations;
+  # NOLINT(let_order)
+  mkTarget = name: target: {
+    hostName = target.hostName or name;
+    user = target.user or user;
+    port = target.port or 22;
+    aliases = target.aliases or [ name ];
+    clientKey = target.clientKey or null;
+    hostKeys = target.hostKeys or [ ];
+  };
+  targets = lib.mapAttrs mkTarget (managedTargets // extraTargets); # NOLINT(let_order)

+  clientKeysFor = names: lib.filter (key: key != null) (map (name: targets.${name}.clientKey) names); # NOLINT(let_order)
+  # NOLINT(let_order)
  defaultAuthorizedKeys = lib.flatten (
-    clientKeysFor workstationNames ++ optional isServer (clientKeysFor serverNames)
+    clientKeysFor workstationNames ++ lib.optional isServer (clientKeysFor serverNames)
  );

-  outboundTargetNames =
+  outboundTargetNames = # NOLINT(let_order)
    let
      groupTargets =
        if isServer then
-          [ "gitea" ] ++ cfg.hosts.servers
+          builtins.attrNames extraTargets ++ serverNames
        else if isWorkstation then
-          [ "gitea" ] ++ cfg.hosts.servers ++ cfg.hosts.workstations
+          builtins.attrNames extraTargets ++ serverNames ++ workstationNames
        else
-          [ "gitea" ];
+          builtins.attrNames extraTargets;
    in
-    filter (name: name != currentHost) (targetNamesIn groupTargets);
+    lib.filter (name: name != config.networking.hostName) groupTargets;

-  sshSettingsFor =
-    name:
-    let
-      target = cfg.targets.${name};
-    in
-    {
-      header = "Host ${concatStringsSep " " target.aliases}";
-      HostName = target.hostName;
-      User = target.user;
-    }
-    // optionalAttrs (target.port != 22) { Port = target.port; };
-
-  knownHostNamesFor =
-    target:
-    let
-      names = unique (target.aliases ++ [ target.hostName ]);
-      withPort = name: if target.port == 22 then name else "[${name}]:${toString target.port}";
-    in
-    map withPort names;
-
-  knownHosts = listToAttrs (
-    concatLists (
-      mapAttrsToList (
+  knownHosts = lib.listToAttrs (
+    lib.concatLists (
+      lib.mapAttrsToList (
        targetName: target:
-        imap0 (
+        lib.imap0 (
          i: key:
-          nameValuePair "${targetName}-${toString i}" {
+          lib.nameValuePair "${targetName}-${toString i}" {
            hostNames = knownHostNamesFor target;
            publicKey = keyWithoutComment key;
          }
        ) target.hostKeys
-      ) cfg.targets
+      ) targets
    )
  );
+  knownHostNamesFor =
+    target:
+    let
+      withPort = name: if target.port == 22 then name else "[${name}]:${toString target.port}";
+      names = lib.unique (target.aliases ++ [ target.hostName ]);
+    in
+    map withPort names;
+
+  keyWithoutComment = key: lib.concatStringsSep " " (lib.take 2 (lib.splitString " " key));
+
+  sshSettingsFor =
+    name:
+    let
+      target = targets.${name};
+    in
+    {
+      header = "Host ${lib.concatStringsSep " " target.aliases}";
+      HostName = target.hostName;
+      User = target.user;
+    }
+    // lib.optionalAttrs (target.port != 22) { Port = target.port; };
+
+  hostKeySecret = type: "ssh-host-${type}-key";
+  hostKeyTypes = [
+    "ed25519"
+    "rsa"
+  ];
+  userKeySecret = "ssh-user-ed25519-key";
+
 in
 {
  options.modules.network.ssh = {
-    enable = lib.mkEnableOption "the OpenSSH daemon, with host keys restored from secrets";
+    enable = lib.mkEnableOption "the OpenSSH daemon";

-    hosts = {
-      servers = mkOption {
-        type = types.listOf types.str;
-        default = [ "pikachu" ];
-        description = ''
-          Hosts that serve durable services.
-          They admit workstation keys and server keys, and they receive aliases for other servers and the forge.
-        '';
-      };
-
-      workstations = mkOption {
-        type = types.listOf types.str;
-        default = [
-          "neogaia"
-          "zeus"
-        ];
-        description = ''
-          Hosts the operator works from.
-          Their keys are admitted by every host, and they receive aliases for the whole fleet and the forge.
-        '';
-      };
-    };
-
-    targets = mkOption {
-      type = types.attrsOf targetType;
-      default = {
-        gitea = {
-          hostName = "git.alexion.dev";
-          port = 2022;
-          user = "gitea";
-          aliases = [
-            "gitea"
-            "git.alexion.dev"
-          ];
-        };
-
-        neogaia = {
-          hostName = registry.address.neogaia.self;
-          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia";
-          hostKeys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS+wp7K123+4BT6G4f954R6WyrbWveY7VlpoBUf6I5p neogaia"
-            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCo2wWUKxyAS4J5TqbWf8glDhJvS5XmdRqFhMeJwG3pOB+4AccZ1T8LU7ZN+RjtRi3j2qXBJvIHuzhtQNtmT59TxocvfobYiqOgJpvVO5K6yD8ZoUJs6ziDkIduI9w9mdRIESoi+dBbVu8n24r61cKDVh+jWX+yjzkOcWcOzqDyQhhkjqblZ1WMAdujEMuEPvif1i2LCxStUaZqRGcx09m/ME2fYcaJrpuxxxvX2+CPJNicoo6Rx9i7ZjAoNuvH+jui4KT62DzlQtQtCl2CFUOM0gCPSa+MbNQ9elfHPvGzEcwOIMo2cuy9KURUkQu+sAgaG8S1PEniDDTecskHtuRdmPZawnQGpIhzo919Q6wUgjT8scK4mmSXRWmGmkMt0GNA2tfj5tDks6r5Q8XsYqtWs4rsOEvfmxVSdM771w+fqDBAil99Jsh0ksPK9+Bwgg8cMDzLLFDn8JA5y2G1HocMMom+u5DYKwPXEKnCILkasB8y24+O3PhSu1EuWw277w6EUEXvU03rCf0Ak/ULjxp9a00EGlloEwSmFI7Aub9XHDr87IdbGInEn+PMqyBYADiN+3h6nE2JO+nMa6i/CHdebmT+T7YJvuTKHD9sjFmQsYaghlq03DZrhHcm4hgUvE1dqGojHrhk/WgA3EWTWtK/+BP0Vy2jXaaz+qAx+EGnhQ== neogaia"
-          ];
-        };
-
-        zeus = {
-          hostName = registry.address.zeus.self;
-          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRBcHHuubptXCdvED/p2dR3MpjGN/AimqLasLY5984G alexion@zeus";
-          hostKeys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ4GBPt966LR4LpmXgiMMkepIqNIlXTUBh4zdNeek/lN root@zeus"
-            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3xOxGAJCG9PE0FVufgJX9VRO64IUUlRGHSOfYfAI4Mit46xKsr7z/OvqPPE9z8rOIcVPbLkc/mkMuHbDgolleunAFCIeuIIYpkL4o4/TZECh9BtN2WdPhjcD7S0rV+rR7p24Qy5bTCSwZmsQq8QxHTVPjjBngtPGRSpKVrZAuHCcdCJ13hBWAvnaav5KysKC89nMj/7FIh02v8kipGfq5LGCZ20Qp2lmv2DS24NhBPXzcw8pLN47I5GYVkZh/0RWOByteo3eXtKCF+JCwfUPCTP+zHGD+1tbO8//B2fkt3Pe9lUrn5eM2ZnX1emXSWfQng3cMqkftzWqvBwv0sSDU+9YV6H2Ury+GrrfukpBtQVe9PQcBWqbRPhxuagncR+af/tx0ZohZS0t74m3WgLtZ4r2mpTZS4oBmRsfvWzMFGSgwtva+3Y+NsLjPPM1Cz5Dn05JJlidzcABfsUg2H23vkmO2otaQI01dUni+szlRn4w6sVyxNcvY2fQGjmt9k7jmVI5D2A3yl+OLJguAAlw3ia335X1tNUG8FoI/VyZNhOckIihmbTtihNIg37Ro4yiuPRhnUWFvg2hcBCa9hzNP7XDUPnoCRQyJ4adQHQA/x4Kh+HJ6pZqtGcdqU80fzmWtrLkWG6v5/NRKs6soYDup7oQIKbJo9TtXvqtzmVmovQ== root@zeus"
-          ];
-        };
-
-        pikachu = {
-          hostName = registry.address.pikachu.self;
-          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNqJIC6VRXyvrNf3n9su9KdPCikC3CjK/QrCK2reHdB alexion@pikachu";
-          hostKeys = [
-            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu"
-            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy/riwm7dflA3mT+3a0/2CIoS2LbAsK/vn35kOoNeuzn0yhiF+imexP6tkB3S2t+H5ybRzkbbuNZcynFfeCqthFc8kvbdCnt8Diqoeg96fZ6ecvh5QE5yH9op8534EySetZ/exakFLnF+6EiWMuWUW3DFwsc2kcgDJObqSE8gTx/d7JK953MiTFmSJBFyg1RtQ3ZnMT+iCrvY2dyCLQai7VeF8koVKF2c0leAq2Hc75rb/L9md8MoJa64iPiz7hwTCin3xoFyaY/5hNVvyqFd5PivgR69gLdJkuVsUYO2mJzhur8cYmJD+pGjJ0U45hyE9TMrCFjeJHHuvSt3+2kph62wv95jLNk0WmMlwgyunISxENCSVVtNYdBMXhUh8VhEAW17QpVUg9EnPvxOdTKEjrvfOZYASWUa51JKbgBgexVgFbxdjDZR88DZa31AVBts/cx/59gXTUahFXMYLdZgssx+5uibZQWnvCyfUV9WLbfmK1lgL6hzReg1VkQ87iGr6skjtQYemJxRaFNA1+Q5f3kmG3KncuK/594a3qXYP4gC6A2blf8om1YZ4aXXh6f+GFKLjoEw1vvM2rJ+rjzfymwDX+pxVQ9L13OEtVZc9Ez76pOkbm1hqdbL0gY45+0cpxodhWV0wMQJBDXL1MHP8qcs+/vw0GxVK5l1SnWBGlw== root@pikachu"
-          ];
-        };
-      };
-      description = ''
-        SSH targets known to the fleet.
-        The inventory holds connection details plus public keys used for authorization and host verification.
-      '';
-    };
-
-    extraAuthorizedKeys = mkOption {
-      type = types.listOf types.str;
-      default = [ ];
-      description = ''
-        Additional client public keys admitted by this host.
-      '';
-    };
-
-    authorizedKeys = mkOption {
-      type = types.nullOr (types.listOf types.str);
-      default = null;
-      description = ''
-        Complete override for client public keys admitted by this host.
-        Leave null to derive access from `modules.network.ssh.hosts` and `modules.network.ssh.targets`.
-      '';
-    };
-
-    extraSettings = mkOption {
-      type = types.attrsOf types.anything;
-      default = { };
-      description = ''
-        Additional OpenSSH client settings merged into the generated Home Manager configuration.
-      '';
-    };
-
-    hostKeys.restore = mkOption {
-      type = types.bool;
+    hostKeys.restore = lib.mkOption {
+      type = lib.types.bool;
      default = true;
      description = ''
-        Restore the host keys from secrets rather than letting the daemon generate its own.
-        A machine with its own identity keeps its fingerprint across a reimage by restoring committed keys.
-        A guest carries no host identity, so it turns this off and presents a self-generated key instead.
+        Restores host keys from secrets.
+        Preserves the fingerprint across reimages.
+        Guests disable this option and generate their own host keys.
      '';
    };

-    hostKeys.sopsFile = mkOption {
-      type = types.nullOr types.path;
+    hostKeys.sopsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
      default = null;
      description = ''
-        Encrypted file holding this host's SSH host private keys, one entry per key type, named `ssh-host-<type>-key`.
-        Required when `restore` is on.
+        Sets encrypted file that contains host private keys.
+        Names each secret `ssh-host-<type>-key`.
+        Requires a value when `restore` is enabled.
      '';
    };

-    hostKeys.types = mkOption {
-      type = types.listOf types.str;
-      default = [
-        "ed25519"
-        "rsa"
-      ];
-      description = ''
-        Key types to restore, naming both the entries read from the encrypted file and the algorithms the daemon offers.
-      '';
-    };
-
-    userKey.sopsFile = mkOption {
-      type = types.nullOr types.path;
+    userKey.sopsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
      default = null;
      description = ''
-        Encrypted file holding this machine's SSH client private key, under the entry `ssh-user-ed25519-key`.
-        Left unset on a machine that authenticates to no remote server, such as a guest.
+        Sets encrypted file that contains the SSH client private key.
+        Names the secret `ssh-user-ed25519-key`.
+        Guests leave this unset because they do not authenticate to remote servers.
      '';
    };
  };

-  config = mkIf cfg.enable (mkMerge [
-    {
-      services.openssh.enable = true;
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        services.openssh.enable = true;

-      users.users.${user}.openssh.authorizedKeys.keys =
-        if cfg.authorizedKeys != null then
-          cfg.authorizedKeys
-        else
-          defaultAuthorizedKeys ++ cfg.extraAuthorizedKeys;
+        users.users.${user}.openssh.authorizedKeys.keys = defaultAuthorizedKeys;

-      programs.ssh.knownHosts = knownHosts;
+        programs.ssh.knownHosts = knownHosts;

-      home-manager.users.${user}.programs.ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-        settings =
-          mapAttrs (name: _: sshSettingsFor name) (genAttrs outboundTargetNames (name: name))
-          // cfg.extraSettings;
-      };
-    }
+        home-manager.users.${user}.programs.ssh = {
+          enable = true;
+          enableDefaultConfig = false;
+          settings = lib.mapAttrs (name: _: sshSettingsFor name) (
+            lib.genAttrs outboundTargetNames (name: name)
+          );
+        };
+      }

-    (mkIf cfg.hostKeys.restore {
-      assertions = [
-        {
-          assertion = cfg.hostKeys.sopsFile != null;
-          message = "modules.network.ssh.hostKeys.restore requires modules.network.ssh.hostKeys.sopsFile to name the encrypted host keys.";
-        }
-      ];
+      (lib.mkIf cfg.hostKeys.restore {
+        assertions = [
+          {
+            assertion = cfg.hostKeys.sopsFile != null;
+            message = "Set `modules.network.ssh.hostKeys.sopsFile` when host-key restoration is enabled.";
+          }
+        ];

-      sops.secrets = genAttrs (map hostKeySecret cfg.hostKeys.types) (_: {
-        inherit (cfg.hostKeys) sopsFile;
-        mode = "0400";
-        restartUnits = [ "sshd.service" ];
-      });
+        sops.secrets = lib.genAttrs (map hostKeySecret hostKeyTypes) (_: {
+          inherit (cfg.hostKeys) sopsFile;
+          mode = "0400";
+          restartUnits = [ "sshd.service" ];
+        });

-      services.openssh.hostKeys = [ ];
-      services.openssh.extraConfig = concatStringsSep "" (
-        map (type: "HostKey ${config.sops.secrets.${hostKeySecret type}.path}\n") cfg.hostKeys.types
-      );
-    })
+        services.openssh.hostKeys = [ ];
+        services.openssh.extraConfig = lib.concatStringsSep "" (
+          map (type: "HostKey ${config.sops.secrets.${hostKeySecret type}.path}\n") hostKeyTypes
+        );
+      })

-    (mkIf (cfg.userKey.sopsFile != null) {
-      sops.secrets.${userKeySecret} = {
-        inherit (cfg.userKey) sopsFile;
-        mode = "0400";
-        owner = user;
-      };
+      (lib.mkIf (cfg.userKey.sopsFile != null) {
+        sops.secrets.${userKeySecret} = {
+          inherit (cfg.userKey) sopsFile;
+          mode = "0400";
+          owner = user;
+        };

-      home-manager.users.${user}.programs.ssh.settings."*".IdentityFile =
-        config.sops.secrets.${userKeySecret}.path;
-    })
-  ]);
+        home-manager.users.${user}.programs.ssh.settings."*" = {
+          IdentityFile = config.sops.secrets.${userKeySecret}.path;
+          IdentitiesOnly = true;
+        };
+      })
+    ]
+  );
 }
--- a/configs/nixos/modules/network/vlans.nix
+++ b/configs/nixos/modules/network/vlans.nix
@@ -4,24 +4,17 @@
  util,
  ...
 }:
-# The host networking foundation: per-VLAN bridges over a tagged trunk.
+# Configures bridges for tagged VLANs on a physical interface that uses DHCP.
 let
-  cfg = config.modules.network.vlans;
-
-  inherit (util) bridgeName;
-
-  vlanName = id: "${cfg.trunk}.${toString id}";
+  cfg = config.modules.network.vlans; # NOLINT(let_order)
 in
 {
  options.modules.network.vlans = {
-    enable = lib.mkEnableOption "host VLAN bridges over a tagged trunk";
-
-    trunk = lib.mkOption {
+    interface = lib.mkOption {
      type = lib.types.str;
      example = "enp1s0";
      description = ''
-        Physical interface that carries 802.1Q-tagged traffic for every VLAN.
-        Each declared VLAN attaches to its own bridge.
+        Names the physical interface that carries untagged DHCP traffic and tagged VLANs.
      '';
    };

@@ -34,67 +27,37 @@ in
        30
      ];
      description = ''
-        Tagged VLAN ids to materialize.
-        Each id N creates one bridge named `br-vlanN`.
+        Creates bridges for the specified tagged VLAN IDs.
+
+        VLAN ID N creates bridge `br-vlanN`.
      '';
    };
-
-    management = {
-      vlan = lib.mkOption {
-        type = lib.types.nullOr (lib.types.ints.between 1 4094);
-        default = null;
-        description = ''
-          VLAN whose bridge carries the host's own management address.
-          The value must be one of `ids`.
-          Left null, the host takes no address on any bridge.
-        '';
-      };
-
-      address = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        example = "10.0.10.2/24";
-        description = ''
-          Host static management address in CIDR form.
-          Left null, the host takes its management address by DHCP.
-        '';
-      };
-    };
  };

-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.management.vlan == null || lib.elem cfg.management.vlan cfg.ids;
-        message = "modules.network.vlans.management.vlan (${toString cfg.management.vlan}) must name one of modules.network.vlans.ids.";
-      }
-      {
-        assertion = cfg.management.address == null || cfg.management.vlan != null;
-        message = "modules.network.vlans.management.address needs modules.network.vlans.management.vlan to say which bridge carries it.";
-      }
-    ];
-
-    # networkd owns these interfaces so NetworkManager does not contend for them.
-    networking.networkmanager.unmanaged = [
-      "interface-name:${cfg.trunk}"
-    ]
-    ++ map (id: "interface-name:${bridgeName id}") cfg.ids
-    ++ map (id: "interface-name:${vlanName id}") cfg.ids;
+  config = lib.mkIf (cfg.ids != [ ]) {
+    networking = {
+      useDHCP = false;
+      networkmanager.unmanaged = [
+        "interface-name:${cfg.interface}"
+      ]
+      ++ map (id: "interface-name:${util.bridgeName id}") cfg.ids
+      ++ map (id: "interface-name:vlan${toString id}") cfg.ids;
+    };

    systemd.network = {
      enable = true;

      netdevs = lib.mkMerge (
        map (id: {
-          "40-${bridgeName id}" = {
+          "40-${util.bridgeName id}" = {
            netdevConfig = {
-              Name = bridgeName id;
+              Name = util.bridgeName id;
              Kind = "bridge";
            };
          };
-          "40-${vlanName id}" = {
+          "40-vlan${toString id}" = {
            netdevConfig = {
-              Name = vlanName id;
+              Name = "vlan${toString id}";
              Kind = "vlan";
            };
            vlanConfig.Id = id;
@@ -104,37 +67,25 @@ in

      networks = lib.mkMerge (
        [
-          # The trunk carries only tagged frames and takes no address.
          {
-            "30-${cfg.trunk}" = {
-              matchConfig.Name = cfg.trunk;
-              networkConfig.LinkLocalAddressing = "no";
-              linkConfig.RequiredForOnline = "no";
-              vlan = map vlanName cfg.ids;
+            "10-${cfg.interface}" = {
+              matchConfig.Name = cfg.interface;
+              networkConfig.DHCP = "yes";
+              vlan = map (id: "vlan${toString id}") cfg.ids;
+              linkConfig.RequiredForOnline = "routable";
            };
          }
        ]
        ++ map (id: {
-          # Enslaved to its bridge, carrying no address itself.
-          "40-${vlanName id}" = {
-            matchConfig.Name = vlanName id;
-            networkConfig.Bridge = bridgeName id;
+          "40-vlan${toString id}" = {
+            matchConfig.Name = "vlan${toString id}";
+            networkConfig.Bridge = util.bridgeName id;
+            linkConfig.RequiredForOnline = "no";
+          };
+          "40-${util.bridgeName id}" = {
+            matchConfig.Name = util.bridgeName id;
            linkConfig.RequiredForOnline = "no";
          };
-          # The management bridge carries the host address.
-          # Other bridges provide L2 segments for guests.
-          "40-${bridgeName id}" = lib.mkMerge [
-            {
-              matchConfig.Name = bridgeName id;
-              linkConfig.RequiredForOnline = "no";
-            }
-            (lib.mkIf (cfg.management.vlan == id) (
-              if cfg.management.address == null then
-                { networkConfig.DHCP = "yes"; }
-              else
-                { address = [ cfg.management.address ]; }
-            ))
-          ];
        }) cfg.ids
      );
    };
--- a/configs/nixos/modules/network/vpn-client.nix
+++ b/configs/nixos/modules/network/vpn-client.nix
@@ -1,10 +1,34 @@
 {
  config,
  lib,
+  pkgs,
+  util,
  ...
 }:
 let
-  cfg = config.modules.network.vpn-client;
+  cfg = config.modules.network.vpn-client; # NOLINT(let_order)
+
+  vpnIcon = util.glyph [
+    "db83"
+    "dc9d"
+  ];
+
+  vpnStatus = pkgs.writeShellScript "waybar-vpn-status" ''
+    interface=${lib.escapeShellArg cfg.interface}
+
+    if ! ${lib.getExe' pkgs.iproute2 "ip"} link show dev "$interface" >/dev/null 2>&1; then
+      printf '{"text":"","class":"idle"}\n'
+      exit 0
+    fi
+
+    ipaddr=$(${lib.getExe' pkgs.iproute2 "ip"} -4 -o addr show dev "$interface" | ${lib.getExe' pkgs.gawk "awk"} '{ print $4; exit }')
+
+    ${lib.getExe pkgs.jq} -cn \
+      --arg text "${vpnIcon}" \
+      --arg tooltip "VPN $interface: ''${ipaddr:-no IPv4}" \
+      --arg class "active" \
+      '{ text: $text, tooltip: $tooltip, class: $class }'
+  '';
 in
 {
  options.modules.network.vpn-client = {
@@ -13,61 +37,31 @@ in
    interface = lib.mkOption {
      type = lib.types.str;
      default = "wg-home";
-      description = "WireGuard interface name.";
+      description = "Names the WireGuard interface.";
    };

    address = lib.mkOption {
      type = lib.types.str;
      example = "10.23.100.3/32";
-      description = "Client tunnel address in CIDR notation.";
-    };
-
-    privateKeySecret = lib.mkOption {
-      type = lib.types.str;
-      default = "wireguard-home-private-key";
-      description = "SOPS secret containing the WireGuard client private key.";
-    };
-
-    autoStart = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = "Whether to start the VPN tunnel during boot.";
-    };
-
-    mtu = lib.mkOption {
-      type = lib.types.nullOr lib.types.int;
-      default = 1280;
-      description = "Tunnel MTU, or null to use the WireGuard default.";
+      description = "Sets the client tunnel address in CIDR notation.";
    };

    sopsFile = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
-      description = "Encrypted secrets file that contains privateKeySecret.";
+      description = "Names the encrypted file that contains the WireGuard private key.";
    };

    peer = {
      publicKey = lib.mkOption {
        type = lib.types.str;
-        description = "WireGuard public key for the remote peer.";
+        description = "Sets the WireGuard public key for the remote peer.";
      };

      endpoint = lib.mkOption {
        type = lib.types.str;
        example = "203.0.113.10:51820";
-        description = "WireGuard endpoint for the remote peer.";
-      };
-
-      allowedIPs = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ "10.23.0.0/16" ];
-        description = "Routes to send through the VPN tunnel.";
-      };
-
-      persistentKeepalive = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = 25;
-        description = "Persistent keepalive interval in seconds, or null to disable it.";
+        description = "Sets the WireGuard endpoint for the remote peer.";
      };
    };
  };
@@ -76,30 +70,39 @@ in
    assertions = [
      {
        assertion = cfg.sopsFile != null;
-        message = "modules.network.vpn-client.sopsFile must name the encrypted secrets file containing the WireGuard private key.";
+        message = "Set modules.network.vpn-client.sopsFile when the VPN client is enabled.";
      }
    ];

-    sops.secrets.${cfg.privateKeySecret}.sopsFile = cfg.sopsFile;
+    sops.secrets.wireguard-home-private-key.sopsFile = cfg.sopsFile;

-    systemd.targets."wireguard-${cfg.interface}" = lib.mkIf (!cfg.autoStart) {
-      wantedBy = lib.mkForce [ ];
+    registry.shell-shortcut.${config.networking.hostName} = {
+      vpn-on = "sudo systemctl start wireguard-${cfg.interface}.target";
+      vpn-off = "sudo systemctl stop 'wireguard-${cfg.interface}*.service' wireguard-${cfg.interface}.target";
    };

+    registry.waybar.${config.networking.hostName}."custom/vpn" = {
+      order = 50;
+      settings = {
+        return-type = "json";
+        exec = "${vpnStatus}";
+        interval = 5;
+      };
+    };
+
+    systemd.targets."wireguard-${cfg.interface}".wantedBy = lib.mkForce [ ];
+
    networking.wireguard.interfaces.${cfg.interface} = {
      ips = [ cfg.address ];
-      inherit (cfg) mtu;
-      privateKeyFile = config.sops.secrets.${cfg.privateKeySecret}.path;
+      mtu = 1280;
+      privateKeyFile = config.sops.secrets.wireguard-home-private-key.path;

      peers = [
-        (
-          {
-            inherit (cfg.peer) publicKey endpoint allowedIPs;
-          }
-          // lib.optionalAttrs (cfg.peer.persistentKeepalive != null) {
-            inherit (cfg.peer) persistentKeepalive;
-          }
-        )
+        {
+          inherit (cfg.peer) publicKey endpoint;
+          allowedIPs = [ "10.23.0.0/16" ];
+          persistentKeepalive = 25;
+        }
      ];
    };
  };
--- a/configs/nixos/modules/services/actualbudget.nix
+++ b/configs/nixos/modules/services/actualbudget.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.modules.services.actualbudget;
+  cfg = config.modules.services.actualbudget; # NOLINT(let_order)
 in
 {
  options.modules.services.actualbudget = {
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty.nix
@@ -5,7 +5,7 @@
  ...
 }:
 let
-  cfg = config.modules.services.copyparty;
+  cfg = config.modules.services.copyparty; # NOLINT(let_order)

  volumeType = lib.types.submodule {
    options = {
@@ -38,6 +38,31 @@ let
    };
  };

+  configScript = pkgs.writeShellScript "copyparty-config" ''
+    set -eu
+
+    umask 077
+    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
+
+    cat > /run/copyparty/copyparty.conf <<EOF
+    [global]
+      p: ${toString cfg.port}
+      usernames
+      http-only
+      no-crt
+      no-thumb
+      no-snap
+      no-rescan
+      ses-db: ${cfg.stateDir}/sessions.db
+      chpw-db: ${cfg.stateDir}/chpw.json
+      shr-db: ${cfg.stateDir}/shares.db
+    ${renderedReverseProxy}
+    [accounts]
+      ${cfg.accountName}: $password
+
+    ${renderedVolumes}
+    EOF
+  '';
  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";

  hasFlag =
@@ -72,31 +97,6 @@ let

  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);

-  configScript = pkgs.writeShellScript "copyparty-config" ''
-    set -eu
-
-    umask 077
-    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
-
-    cat > /run/copyparty/copyparty.conf <<EOF
-    [global]
-      p: ${toString cfg.port}
-      usernames
-      http-only
-      no-crt
-      no-thumb
-      no-snap
-      no-rescan
-      ses-db: ${cfg.stateDir}/sessions.db
-      chpw-db: ${cfg.stateDir}/chpw.json
-      shr-db: ${cfg.stateDir}/shares.db
-    ${renderedReverseProxy}
-    [accounts]
-      ${cfg.accountName}: $password
-
-    ${renderedVolumes}
-    EOF
-  '';
 in
 {
  options.modules.services.copyparty = {
--- a/configs/nixos/modules/services/homepage.nix
+++ b/configs/nixos/modules/services/homepage.nix
@@ -5,44 +5,31 @@
  ...
 }:
 let
-  cfg = config.modules.services.homepage;
+  cfg = config.modules.services.homepage; # NOLINT(let_order)

-  mkRegistryPath =
-    registryName: host: entry:
-    "registry.${registryName}.${host}.${entry}";
-
-  homepageEntries = lib.concatLists (
-    lib.mapAttrsToList (
-      host: entries:
-      lib.mapAttrsToList (entry: homepage: {
-        inherit host entry homepage;
-        composite = registry.join host entry;
-      }) entries
-    ) registry.homepage
+  derivedAllowedHosts = lib.unique (
+    lib.optional (selfRoute != null) selfRoute.domain
+    ++ lib.optionals (selfAddress != null) [
+      selfAddress
+      "${selfAddress}:${toString cfg.listenPort}"
+    ]
  );
+  selfRoute = selfEntry.route or null;

-  mkHref =
-    item:
-    if item.homepage.href != null then
-      item.homepage.href
-    else if (item.composite.route or null) != null then
-      if item.composite.route.port != null then
-        "https://${item.composite.route.domain}"
-      else if item.composite.route.http.port != null then
-        "http://${item.composite.route.domain}"
-      else
-        throw "${mkRegistryPath "homepage" item.host item.entry} needs href or a matching TCP route entry"
-    else
-      throw "${mkRegistryPath "homepage" item.host item.entry} needs href or a matching route entry";
+  selfEntry = registry.join cfg.hostName cfg.entryName;
+  selfAddress = selfEntry.address or null;
+  homepageServices = map mkTab (lib.filter (tab: lib.hasAttr tab entriesByTab) orderedTabs);

-  mkServiceAttrs =
-    item:
-    lib.filterAttrs (_: value: value != null) {
-      href = mkHref item;
-      inherit (item.homepage) description icon;
+  mkTab =
+    tab:
+    let
+      sections = entriesByTab.${tab};
+    in
+    {
+      ${tab} = map (section: { ${section} = sections.${section}; }) (orderedSections tab sections);
    };

-  sortedEntries = lib.sort (left: right: left.homepage.name < right.homepage.name) homepageEntries;
+  entriesByTab = lib.foldl' insertEntry { } sortedEntries;

  insertEntry =
    acc: item:
@@ -55,7 +42,19 @@ let
      };
    };

-  entriesByTab = lib.foldl' insertEntry { } sortedEntries;
+  sortedEntries = lib.sort (left: right: left.homepage.name < right.homepage.name) homepageEntries;
+
+  homepageEntries = lib.concatLists (
+    lib.mapAttrsToList (
+      host: entries:
+      lib.mapAttrsToList (entry: homepage: {
+        inherit host entry homepage;
+        composite = registry.join host entry;
+      }) entries
+    ) registry.homepage
+  );
+
+  orderedTabs = tabOrder ++ lib.filter (tab: !lib.elem tab tabOrder) (lib.attrNames entriesByTab);

  tabOrder = [
    "Apps"
@@ -63,7 +62,30 @@ let
    "System"
  ];

-  orderedTabs = tabOrder ++ lib.filter (tab: !lib.elem tab tabOrder) (lib.attrNames entriesByTab);
+  mkRegistryPath =
+    registryName: host: entry:
+    "registry.${registryName}.${host}.${entry}";
+
+  mkHref =
+    item:
+    if item.homepage.href != null then
+      item.homepage.href
+    else if (item.composite.route or null) != null then
+      if item.composite.route.protocol == "https" then
+        "https://${item.composite.route.domain}"
+      else if item.composite.route.protocol == "http" then
+        "http://${item.composite.route.domain}"
+      else
+        throw "${mkRegistryPath "homepage" item.host item.entry} needs href or a matching HTTP route entry"
+    else
+      throw "${mkRegistryPath "homepage" item.host item.entry} needs href or a matching route entry";
+
+  mkServiceAttrs =
+    item:
+    lib.filterAttrs (_: value: value != null) {
+      href = mkHref item;
+      inherit (item.homepage) description icon;
+    };

  sectionOrderByTab = {
    Apps = [
@@ -91,28 +113,6 @@ let
    in
    sectionOrder ++ lib.filter (section: !lib.elem section sectionOrder) (lib.attrNames sections);

-  mkTab =
-    tab:
-    let
-      sections = entriesByTab.${tab};
-    in
-    {
-      ${tab} = map (section: { ${section} = sections.${section}; }) (orderedSections tab sections);
-    };
-
-  homepageServices = map mkTab (lib.filter (tab: lib.hasAttr tab entriesByTab) orderedTabs);
-
-  selfEntry = registry.join cfg.hostName cfg.entryName;
-  selfAddress = selfEntry.address or null;
-  selfRoute = selfEntry.route or null;
-
-  derivedAllowedHosts = lib.unique (
-    lib.optional (selfRoute != null) selfRoute.domain
-    ++ lib.optionals (selfAddress != null) [
-      selfAddress
-      "${selfAddress}:${toString cfg.listenPort}"
-    ]
-  );
 in
 {
  options.modules.services.homepage = {
--- a/configs/nixos/modules/services/navidrome.nix
+++ b/configs/nixos/modules/services/navidrome.nix
@@ -4,7 +4,7 @@
  ...
 }:
 let
-  cfg = config.modules.services.navidrome;
+  cfg = config.modules.services.navidrome; # NOLINT(let_order)
 in
 {
  options.modules.services.navidrome = {
--- a/configs/nixos/modules/services/reverse-proxy.nix
+++ b/configs/nixos/modules/services/reverse-proxy.nix
@@ -5,63 +5,46 @@
  ...
 }:
 let
-  cfg = config.modules.services.reverse-proxy;

-  mkRegistryPath =
-    registryName: host: entry:
-    "registry.${registryName}.${host}.${entry}";
+  generatedUdpStreams = lib.concatLists (
+    lib.mapAttrsToList (
+      host: routes:
+      lib.concatLists (
+        lib.mapAttrsToList (
+          entry: route: lib.optionals (route.protocol == "udp") (map (mkUdpStream host entry) route.ports)
+        ) routes
+      )
+    ) registry.route
+  );

-  mkBackend = address: port: "http://${address}:${toString port}";
-
-  mkVirtualHost =
-    host: entry: mode:
+  mkUdpStream =
+    host: entry: port:
    let
-      compositeEntry = registry.join host entry;
-      inherit (compositeEntry) route;
      address =
        compositeEntry.address
          or (throw "no matching entry in registry.address for ${mkRegistryPath "route" host entry}");
-      isHttp = mode == "http";
-      port = if isHttp then route.http.port else route.port;
+      compositeEntry = registry.join host entry;
    in
    {
-      inherit host entry;
-      registryName = "route";
-      name = route.domain;
-      value = {
-        forceSSL = !isHttp;
-        enableACME = !isHttp;
-        locations."/".proxyPass = mkBackend address port;
-      };
+      inherit
+        host
+        entry
+        port
+        address
+        ;
    };

-  generatedHttpsVirtualHostList = lib.concatLists (
-    lib.mapAttrsToList (
-      host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "https") (
-        lib.filterAttrs (_entry: route: route.port != null) routes
-      )
-    ) registry.route
-  );
-
-  generatedHttpVirtualHostList = lib.concatLists (
-    lib.mapAttrsToList (
-      host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "http") (
-        lib.filterAttrs (_entry: route: route.http.port != null) routes
-      )
-    ) registry.route
-  );
-
-  generatedVirtualHostList = generatedHttpsVirtualHostList ++ generatedHttpVirtualHostList;
-
-  virtualHostsByDomain = lib.foldl' (
-    acc: virtualHost:
-    acc
-    // {
-      ${virtualHost.name} = (acc.${virtualHost.name} or [ ]) ++ [ virtualHost ];
+  generatedStreamConfig = lib.concatMapStringsSep "\n" (stream: ''
+    server {
+      listen ${toString stream.port} udp;
+      proxy_pass ${stream.address}:${toString stream.port};
    }
-  ) { } generatedVirtualHostList;
+  '') generatedUdpStreams;
+  generatedVirtualHosts =
+    if duplicateDomainMessages != [ ] then
+      throw (builtins.head duplicateDomainMessages)
+    else
+      lib.listToAttrs generatedVirtualHostList;

  duplicateDomainMessages = lib.concatLists (
    lib.mapAttrsToList (
@@ -79,51 +62,72 @@ let
    ) virtualHostsByDomain
  );

-  generatedVirtualHosts =
-    if duplicateDomainMessages != [ ] then
-      throw (builtins.head duplicateDomainMessages)
-    else
-      lib.listToAttrs generatedVirtualHostList;
+  virtualHostsByDomain = lib.foldl' (
+    acc: virtualHost:
+    acc
+    // {
+      ${virtualHost.name} = (acc.${virtualHost.name} or [ ]) ++ [ virtualHost ];
+    }
+  ) { } generatedVirtualHostList;

-  mkUdpStream =
-    host: entry: port:
-    let
-      compositeEntry = registry.join host entry;
-      address =
-        compositeEntry.address
-          or (throw "no matching entry in registry.address for ${mkRegistryPath "route" host entry}");
-    in
-    {
-      inherit
-        host
-        entry
-        port
-        address
-        ;
-    };
+  generatedVirtualHostList = generatedHttpsVirtualHostList ++ generatedHttpVirtualHostList;

-  generatedUdpStreams = lib.concatLists (
+  generatedHttpsVirtualHostList = lib.concatLists (
    lib.mapAttrsToList (
      host: routes:
-      lib.concatLists (
-        lib.mapAttrsToList (entry: route: map (mkUdpStream host entry) route.udp.ports) routes
+      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "https") (
+        lib.filterAttrs (_entry: route: route.protocol == "https") routes
      )
    ) registry.route
  );

-  generatedStreamConfig = lib.concatMapStringsSep "\n" (stream: ''
-    server {
-      listen ${toString stream.port} udp;
-      proxy_pass ${stream.address}:${toString stream.port};
-    }
-  '') generatedUdpStreams;
+  mkVirtualHost =
+    host: entry: mode:
+    let
+      isHttp = mode == "http";
+      address =
+        compositeEntry.address
+          or (throw "no matching entry in registry.address for ${mkRegistryPath "route" host entry}");
+      compositeEntry = registry.join host entry;
+      inherit (compositeEntry) route;
+      inherit (route) port;
+    in
+    {
+      inherit host entry;
+      registryName = "route";
+      name = route.domain;
+      value = {
+        forceSSL = !isHttp;
+        enableACME = !isHttp;
+        extraConfig = lib.optionalString (route.clientMaxBodySize != null) ''
+          client_max_body_size ${route.clientMaxBodySize};
+        '';
+        locations."/".proxyPass = mkBackend address port;
+      };
+    };
+
+  mkBackend = address: port: "http://${address}:${toString port}";
+
+  generatedHttpVirtualHostList = lib.concatLists (
+    lib.mapAttrsToList (
+      host: routes:
+      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "http") (
+        lib.filterAttrs (_entry: route: route.protocol == "http") routes
+      )
+    ) registry.route
+  );
+
+  mkRegistryPath =
+    registryName: host: entry:
+    "registry.${registryName}.${host}.${entry}";
+
 in
 {
  options.modules.services.reverse-proxy = {
    enable = lib.mkEnableOption "the public edge reverse proxy";
  };

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.services.reverse-proxy.enable {
    networking.firewall.allowedTCPPorts = [
      80
      443
--- a/configs/nixos/modules/services/steamcmd.nix
+++ b/configs/nixos/modules/services/steamcmd.nix
@@ -80,10 +80,10 @@

    (lib.mkIf config.modules.services.steamcmd.enable (
      let
-        service = config.modules.services.steamcmd;
-        user = "steamcmd";
        group = "storage";

+        service = config.modules.services.steamcmd;
+        user = "steamcmd";
        prepareScript = pkgs.writeShellScript "steamcmd-${service.serviceName}-prepare" ''
          set -eu

--- a/configs/nixos/modules/shell/bazel.nix
+++ b/configs/nixos/modules/shell/bazel.nix
@@ -6,14 +6,13 @@
 }:
 # Bazel for the primary user's shell environment.
 let
-  cfg = config.modules.shell.bazel;
  user = config.user.name;
 in
 {
  options.modules.shell.bazel.enable =
    lib.mkEnableOption "Bazel for the primary user's shell environment";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.bazel.enable {
    home-manager.users.${user}.home.packages = [ pkgs.bazel ];
  };
 }
--- a/configs/nixos/modules/shell/direnv/default.nix
+++ b/configs/nixos/modules/shell/direnv/default.nix
@@ -5,14 +5,13 @@
 }:
 # direnv for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.direnv;
  user = config.user.name;
 in
 {
  options.modules.shell.direnv.enable =
    lib.mkEnableOption "direnv for the primary user, with nix-direnv shell caching";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.direnv.enable {
    home-manager.users.${user}.programs.direnv = {
      enable = true;
      silent = true;
--- a/configs/nixos/modules/shell/fish/default.nix
+++ b/configs/nixos/modules/shell/fish/default.nix
@@ -6,14 +6,10 @@
 }:
 # fish for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.fish;
-  user = config.user.name;
-  shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
-  envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;
+  cfg = config.modules.shell.fish; # NOLINT(let_order)
  commandsOf = shortcuts: lib.mapAttrs (_name: shortcut: shortcut.command) shortcuts;
-  exportEnvVar = name: value: ''
-    set -gx ${name} ${lib.escapeShellArg value}
-  '';
+  shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
+  user = config.user.name;
 in
 {
  options.modules.shell.fish = {
@@ -106,9 +102,7 @@ in
        };

        # Rendered by home-manager into ~/.config/fish/config.fish.
-        interactiveShellInit = lib.concatStringsSep "\n" (
-          (lib.mapAttrsToList exportEnvVar envVars) ++ [ (builtins.readFile ./config.fish) ]
-        );
+        interactiveShellInit = builtins.readFile ./config.fish;
      };
    };
  };
--- a/configs/nixos/modules/shell/fish/functions/deploy-to.fish
+++ b/configs/nixos/modules/shell/fish/functions/deploy-to.fish
@@ -80,6 +80,13 @@ else
    echo "deploy-to: $host already has the full closure for $system_path" >&2
 end

+echo "deploy-to: recording $system_path as the system profile on $host" >&2
+ssh -t $host sudo nix-env --profile /nix/var/nix/profiles/system --set $system_path
+or begin
+    echo "deploy-to: system profile update failed for $host" >&2
+    return $status
+end
+
 echo "deploy-to: activating $system_path on $host" >&2
 ssh -t $host sudo "$system_path/bin/switch-to-configuration" switch
 or begin
--- a/configs/nixos/modules/shell/git.nix
+++ b/configs/nixos/modules/shell/git.nix
@@ -5,14 +5,13 @@
 }:
 # git for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.git;
  user = config.user.name;
 in
 {
  options.modules.shell.git.enable =
    lib.mkEnableOption "git for the primary user, carrying the operator's commit identity";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.git.enable {
    home-manager.users.${user}.programs.git = {
      enable = true;

--- a/configs/nixos/modules/shell/gitea-axi.nix
+++ b/configs/nixos/modules/shell/gitea-axi.nix
@@ -6,14 +6,13 @@
 }:
 # gitea-axi for the primary user, installed through its own home-manager module.
 let
-  cfg = config.modules.shell.gitea-axi;
  user = config.user.name;
 in
 {
  options.modules.shell.gitea-axi.enable =
    lib.mkEnableOption "gitea-axi, an agent-ergonomic CLI for Gitea issues and pull requests";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.gitea-axi.enable {
    home-manager.sharedModules = [ inputs.gitea-axi.homeModules.default ];
    home-manager.users.${user}.programs.gitea-axi.enable = true;
  };
--- a/configs/nixos/modules/shell/herdr.nix
+++ b/configs/nixos/modules/shell/herdr.nix
@@ -6,14 +6,13 @@
 }:
 # Herdr, a terminal multiplexer for coding agents.
 let
-  cfg = config.modules.shell.herdr;
  user = config.user.name;
 in
 {
  options.modules.shell.herdr.enable =
    lib.mkEnableOption "Herdr, a terminal multiplexer for coding agents";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.herdr.enable {
    registry.shell-shortcut.${config.networking.hostName}.hs = "herdr --session";

    home-manager.users.${user} = lib.mkMerge [
--- a/configs/nixos/modules/shell/nvim/default.nix
+++ b/configs/nixos/modules/shell/nvim/default.nix
@@ -7,14 +7,13 @@
 }:
 # Neovim for the primary user, configured declaratively through nixvim.
 let
-  cfg = config.modules.shell.nvim;
  user = config.user.name;
 in
 {
  options.modules.shell.nvim.enable =
    lib.mkEnableOption "Neovim, configured declaratively via nixvim";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.nvim.enable {
    registry.shell-shortcut.${config.networking.hostName} = {
      vi = "nvim";
      vim = "nvim";
@@ -32,6 +31,7 @@ in
          ripgrep # backs the picker's live grep
          fd # backs the picker's file finder
          wl-clipboard # provides a non-blocking clipboard provider on Wayland
+          nixd # provides Nix language-server support
        ];

        globals.mapleader = " ";
@@ -189,6 +189,8 @@ in
              installRustc = false;
              installRustfmt = false;
            };
+
+            servers.nixd.enable = true;
          };

          gitsigns = {
--- a/configs/nixos/modules/shell/omp.nix
+++ b/configs/nixos/modules/shell/omp.nix
@@ -6,7 +6,6 @@
 }:
 # Oh My Pi, installed alongside upstream Pi as the `omp` command.
 let
-  cfg = config.modules.shell.omp;
  user = config.user.name;
 in
 {
@@ -14,7 +13,7 @@ in
    enable = lib.mkEnableOption "Oh My Pi, a batteries-included fork of Pi";
  };

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.omp.enable {
    home-manager.users.${user}.home.packages = [ pkgs.omp ];
  };
 }
--- a/configs/nixos/modules/shell/pi/default.nix
+++ b/configs/nixos/modules/shell/pi/default.nix
@@ -8,28 +8,26 @@
 # home-manager, which ships the package and manages global settings.
 # The login credential is left unmanaged, so it survives rebuilds.
 let
-  cfg = config.modules.shell.pi;
  user = config.user.name;
  piDir = "${config.users.users.${user}.home}/.pi/agent";
-  vendoredPi = pkgs.pi-coding-agent.overrideAttrs {
-    src = ../../../../../third_party/pi;
-    patches = [ ];
-  };
 in
 {
  options.modules.shell.pi = {
    enable = lib.mkEnableOption "Pi, a terminal coding agent, configured through home-manager";
  };

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.pi.enable {
    home-manager.users.${user} = {
      programs.pi-coding-agent = {
        enable = true;
-        package = vendoredPi;
+        package = pkgs.pi-coding-agent.overrideAttrs {
+          src = ../../../../../third_party/pi;
+          patches = [ ];
+        };

        settings = {
          defaultProvider = "openai-codex";
-          defaultModel = "gpt-5.5";
+          defaultModel = "gpt-5.6-terra";
          defaultThinkingLevel = "medium";
          theme = "dark";
          enableInstallTelemetry = false;
--- a/configs/nixos/modules/shell/python.nix
+++ b/configs/nixos/modules/shell/python.nix
@@ -6,15 +6,14 @@
 }:
 # Python tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.python;
  user = config.user.name;
 in
 {
  options.modules.shell.python.enable =
    lib.mkEnableOption "Python tools for the primary user's shell environment";

-  config = lib.mkIf cfg.enable {
-    registry.env-var.${config.networking.hostName}.PYTHON_TOOLCHAIN_ROOT = "${pkgs.python3}";
+  config = lib.mkIf config.modules.shell.python.enable {
+    registry.env.${config.networking.hostName}.PYTHON_TOOLCHAIN_ROOT = "${pkgs.python3}";

    home-manager.users.${user}.home.packages = [ pkgs.python3 ];
  };
--- a/configs/nixos/modules/shell/rust.nix
+++ b/configs/nixos/modules/shell/rust.nix
@@ -6,8 +6,6 @@
 }:
 # Rust tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.rust;
-  user = config.user.name;
  toolchain = pkgs.symlinkJoin {
    name = "rust-toolchain";
    paths = with pkgs; [
@@ -18,13 +16,14 @@ let
      rustfmt
    ];
  };
+  user = config.user.name;
 in
 {
  options.modules.shell.rust.enable =
    lib.mkEnableOption "Rust tools for the primary user's shell environment";

-  config = lib.mkIf cfg.enable {
-    registry.env-var.${config.networking.hostName}.RUST_TOOLCHAIN_ROOT = "${toolchain}";
+  config = lib.mkIf config.modules.shell.rust.enable {
+    registry.env.${config.networking.hostName}.RUST_TOOLCHAIN_ROOT = "${toolchain}";

    home-manager.users.${user} = {
      home.packages = [
--- a/configs/nixos/modules/shell/tmux/default.nix
+++ b/configs/nixos/modules/shell/tmux/default.nix
@@ -6,13 +6,12 @@
 # tmux for the primary user, configured through home-manager.
 # Settings without a home-manager option are read from ./extra.conf.
 let
-  cfg = config.modules.shell.tmux;
  user = config.user.name;
 in
 {
  options.modules.shell.tmux.enable = lib.mkEnableOption "tmux, configured via home-manager";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.tmux.enable {
    registry.shell-shortcut.${config.networking.hostName}.tmx = "tmux new-session -A -s";

    home-manager.users.${user}.programs.tmux = {
--- a/configs/nixos/modules/shell/yazi.nix
+++ b/configs/nixos/modules/shell/yazi.nix
@@ -6,13 +6,12 @@
 }:
 # Yazi, a terminal file manager.
 let
-  cfg = config.modules.shell.yazi;
  user = config.user.name;
 in
 {
  options.modules.shell.yazi.enable = lib.mkEnableOption "Yazi, a terminal file manager";

-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.yazi.enable {
    home-manager.users.${user}.programs.yazi = {
      enable = true;
      enableFishIntegration = true;
--- a/configs/nixos/modules/zfs.nix
+++ b/configs/nixos/modules/zfs.nix
@@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-# The host-level ZFS pool import: durable service state a host mounts, never rebuilds.
-let
-  cfg = config.modules.zfs;
-in
-{
-  options.modules.zfs = {
-    enable = lib.mkEnableOption "importing durable ZFS pools that hold service state";
-
-    hostId = lib.mkOption {
-      type = lib.types.strMatching "[0-9a-f]{8}";
-      example = "deadbeef";
-      description = ''
-        This host's 8-hex-digit ZFS host id, written to `networking.hostId`. ZFS
-        stamps an imported pool with the importing host's id, so a pool still
-        held by another machine is refused rather than silently dual-mounted. It
-        must be fixed for the machine and distinct across machines that can reach
-        the same pool.
-      '';
-    };
-
-    pools = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.attrsOf lib.types.path);
-      default = { };
-      example = lib.literalExpression ''
-        {
-          tank = {
-            media = "/srv/media";
-            downloads = "/srv/downloads";
-          };
-        }
-      '';
-      description = ''
-        The ZFS pools to import at boot, keyed by pool name, each pool mapping a
-        dataset path relative to it to that dataset's mountpoint. A pool is
-        durable state imported as it stands, never created or destroyed by a
-        rebuild, so a service's data survives any rebuild or reimage. A pool
-        with an empty map is still imported, leaving each dataset to its own ZFS
-        `mountpoint` property.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # The ZFS stack in the kernel and boot, needed even where the root filesystem is another kind.
-    boot.supportedFilesystems = [ "zfs" ];
-
-    # ZFS refuses to import a pool without a host id to stamp its ownership onto.
-    networking.hostId = cfg.hostId;
-
-    # The declared pools are imported at boot, distinct from any pool backing the root filesystem.
-    boot.zfs.extraPools = lib.attrNames cfg.pools;
-
-    # Each declared dataset is mounted at its host path as a native ZFS filesystem.
-    fileSystems = lib.mkMerge (
-      lib.mapAttrsToList (
-        pool: mounts:
-        lib.mapAttrs' (
-          dataset: mountpoint:
-          lib.nameValuePair mountpoint {
-            device = "${pool}/${dataset}";
-            fsType = "zfs";
-          }
-        ) mounts
-      ) cfg.pools
-    );
-  };
-}
--- a/configs/nixos/registry/address.nix
+++ b/configs/nixos/registry/address.nix
@@ -1,10 +1,10 @@
-{ lib, ... }:
+{ lib, util, ... }:
 {
  type = lib.types.str;

  checks = [
    {
-      assertion = lib.registry.predicates.uniqueValue (entry: entry.value);
+      assertion = util.registry.predicates.uniqueValue (entry: entry.value);
      message = "Address registry values must be unique.";
    }
  ];
--- a/configs/nixos/registry/env-var.nix
+++ b/configs/nixos/registry/env-var.nix
--- a/configs/nixos/registry/homepage.nix
+++ b/configs/nixos/registry/homepage.nix
@@ -5,40 +5,40 @@
      tab = lib.mkOption {
        type = lib.types.str;
        example = "Apps";
-        description = "Homepage tab that contains this entry.";
+        description = "Groups the entry in a Homepage tab.";
      };

      section = lib.mkOption {
        type = lib.types.str;
        example = "Media";
-        description = "Homepage section that contains this entry.";
+        description = "Groups the entry in a Homepage section.";
      };

      name = lib.mkOption {
        type = lib.types.str;
        example = "Navidrome";
-        description = "Homepage display name for this entry.";
+        description = "Sets the display name in Homepage.";
      };

      description = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        example = "Music";
-        description = "Homepage description for this entry.";
+        description = "Sets the description in Homepage.";
      };

      icon = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        example = "navidrome.png";
-        description = "Homepage icon for this entry.";
+        description = "Sets the icon in Homepage.";
      };

      href = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = null;
        example = "https://music.alexion.dev";
-        description = "Homepage link override for this entry.";
+        description = "Overrides the generated Homepage link.";
      };
    };
  };
--- a/configs/nixos/registry/keybind.nix
+++ b/configs/nixos/registry/keybind.nix
@@ -0,0 +1,112 @@
+{ lib, util, ... }:
+{
+  checks = [
+    {
+      assertion = util.registry.predicates.uniquePerHost (entry: entry.value.keys);
+      message = "Desktop keybinds must use unique key chords per host.";
+    }
+    {
+      assertion =
+        entries:
+        lib.all (
+          entry:
+          (entry.value.action.kind == "exec" && entry.value.action.command != null)
+          || (
+            builtins.elem entry.value.action.kind [
+              "focus"
+              "move-window"
+            ]
+            && lib.xor (entry.value.action.direction != null) (entry.value.action.workspace != null)
+          )
+          || (
+            entry.value.action.kind == "resize-window"
+            && entry.value.action.direction != null
+            && entry.value.action.workspace == null
+          )
+          || (
+            builtins.elem entry.value.action.kind [
+              "toggle-floating"
+              "toggle-fullscreen"
+              "close-window"
+            ]
+            && entry.value.action.command == null
+            && entry.value.action.direction == null
+            && entry.value.action.workspace == null
+          )
+        ) entries;
+      message = "Desktop keybind actions must set the fields their kind requires.";
+    }
+  ];
+
+  type = lib.types.submodule {
+    options = {
+      keys = lib.mkOption {
+        description = "Sets the key chord for this desktop keybind.";
+        type = lib.types.str;
+        example = "SUPER + Return";
+      };
+
+      repeating = lib.mkOption {
+        description = "Repeats the keybind action while the key chord is held.";
+        type = lib.types.bool;
+        default = false;
+        example = true;
+      };
+
+      locked = lib.mkOption {
+        description = "Allows the keybind action while the session is locked.";
+        type = lib.types.bool;
+        default = false;
+        example = true;
+      };
+
+      action = lib.mkOption {
+        description = "Declares the action this keybind runs.";
+        type = lib.types.submodule {
+          options = {
+            kind = lib.mkOption {
+              description = "Selects the keybind action kind.";
+              type = lib.types.enum [
+                "exec"
+                "focus"
+                "move-window"
+                "resize-window"
+                "toggle-floating"
+                "toggle-fullscreen"
+                "close-window"
+              ];
+            };
+
+            command = lib.mkOption {
+              description = "Command executed by an exec keybind.";
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              example = "ghostty";
+            };
+
+            direction = lib.mkOption {
+              description = "Direction targeted by a keybind action.";
+              type = lib.types.nullOr (
+                lib.types.enum [
+                  "down"
+                  "left"
+                  "right"
+                  "up"
+                ]
+              );
+              default = null;
+              example = "left";
+            };
+
+            workspace = lib.mkOption {
+              description = "Workspace targeted by a keybind action.";
+              type = lib.types.nullOr lib.types.int;
+              default = null;
+              example = 1;
+            };
+          };
+        };
+      };
+    };
+  };
+}
--- a/configs/nixos/registry/route.nix
+++ b/configs/nixos/registry/route.nix
@@ -1,22 +1,39 @@
-{ lib, ... }:
+{ lib, util, ... }:
 {
  checks = [
    {
-      assertion = lib.registry.predicates.uniqueValue (entry: entry.value.domain);
+      assertion = util.registry.predicates.uniqueValue (entry: entry.value.domain);
      message = "Route domains must be unique.";
    }
    {
      assertion =
        entries:
-        lib.registry.predicates.uniqueValue (entry: entry.value) (
-          lib.concatMap (entry: map (port: entry // { value = port; }) entry.value.udp.ports) entries
+        util.registry.predicates.uniqueValue (entry: entry.value) (
+          lib.concatMap (entry: map (port: entry // { value = port; }) entry.value.ports) entries
        );
      message = "Route UDP ports must be unique.";
    }
    {
      assertion =
-        entries: lib.all (entry: entry.value.port == null || entry.value.http.port == null) entries;
-      message = "Route entries must not set both port and http.port.";
+        entries:
+        lib.all (entry: entry.value.port != null && entry.value.ports == [ ]) (
+          lib.filter (entry: entry.value.protocol != "udp") entries
+        );
+      message = "HTTP and HTTPS routes must set port and not ports.";
+    }
+    {
+      assertion =
+        entries:
+        lib.all (entry: entry.value.port == null && entry.value.ports != [ ]) (
+          lib.filter (entry: entry.value.protocol == "udp") entries
+        );
+      message = "UDP routes must set ports and not port.";
+    }
+    {
+      assertion =
+        entries:
+        lib.all (entry: entry.value.protocol != "udp" || entry.value.clientMaxBodySize == null) entries;
+      message = "UDP routes must not set clientMaxBodySize.";
    }
  ];

@@ -25,31 +42,40 @@
      domain = lib.mkOption {
        type = lib.types.str;
        example = "files.alexion.dev";
-        description = "Domain served by this route entry.";
+        description = "Records the public domain for this route.";
+      };
+
+      protocol = lib.mkOption {
+        type = lib.types.enum [
+          "http"
+          "https"
+          "udp"
+        ];
+        description = "Selects the public protocol for this route.";
      };

      port = lib.mkOption {
        type = lib.types.nullOr lib.types.port;
        default = null;
        example = 3923;
-        description = "HTTPS backend TCP port served by the matching address registry entry.";
+        description = "Sets the HTTP backend port for an HTTP or HTTPS route.";
      };

-      http.port = lib.mkOption {
-        type = lib.types.nullOr lib.types.port;
-        default = null;
-        example = 8082;
-        description = "HTTP backend TCP port served by the matching address registry entry.";
-      };
-
-      udp.ports = lib.mkOption {
+      ports = lib.mkOption {
        type = lib.types.listOf lib.types.port;
        default = [ ];
        example = [
          2456
          2457
        ];
-        description = "UDP ports served by the matching address registry entry.";
+        description = "Sets the UDP ports for a UDP route.";
+      };
+
+      clientMaxBodySize = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "1g";
+        description = "Maximum HTTP request body the reverse proxy accepts.";
      };
    };
  };
--- a/configs/nixos/registry/shell-shortcut.nix
+++ b/configs/nixos/registry/shell-shortcut.nix
@@ -1,21 +1,20 @@
 { lib, ... }:
-let
-  entryType = lib.types.submodule {
-    options = {
-      command = lib.mkOption {
-        type = lib.types.str;
-        example = "nvim";
-        description = "Command expanded by this shell shortcut.";
-      };
-
-      abbreviation = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = "Whether fish realizes this shell shortcut as an abbreviation instead of an alias.";
-      };
-    };
-  };
-in
 {
-  type = lib.types.coercedTo lib.types.str (command: { inherit command; }) entryType;
+  type = lib.types.coercedTo lib.types.str (command: { inherit command; }) (
+    lib.types.submodule {
+      options = {
+        command = lib.mkOption {
+          type = lib.types.str;
+          example = "nvim";
+          description = "Sets the command expanded by this shortcut.";
+        };
+
+        abbreviation = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Uses a Fish abbreviation instead of an alias.";
+        };
+      };
+    }
+  );
 }
--- a/configs/nixos/registry/stable-uid.nix
+++ b/configs/nixos/registry/stable-uid.nix
@@ -1,33 +1,25 @@
 { lib, ... }:
 let
-  inherit (lib)
-    filterAttrs
-    groupBy
-    mapAttrs
-    unique
-    ;
-
-  serviceNamesByUid =
-    entries:
-    mapAttrs (_uid: uidEntries: unique (map (entry: entry.entry) uidEntries)) (
-      groupBy (entry: toString entry.value) entries
-    );
-
  duplicateUids =
    entries:
-    filterAttrs (_uid: serviceNames: builtins.length serviceNames > 1) (serviceNamesByUid entries);
+    lib.filterAttrs (_uid: entryNames: builtins.length entryNames > 1) (entryNamesByUid entries);
+
+  entryNamesByUid =
+    entries:
+    lib.mapAttrs (_uid: uidEntries: lib.unique (map (entry: entry.entry) uidEntries)) (
+      lib.groupBy (entry: toString entry.value) entries
+    );

 in
 {
  # Next stable UID: 20005
-  replicate = true;

  type = lib.types.ints.positive;

  checks = [
    {
      assertion = entries: duplicateUids entries == { };
-      message = "Stable UID allocations must be unique.";
+      message = "Multiple entries use the same stable UID.";
    }
  ];
 }
--- a/configs/nixos/registry/waybar.nix
+++ b/configs/nixos/registry/waybar.nix
@@ -0,0 +1,29 @@
+{ lib, ... }:
+{
+  type = lib.types.submodule {
+    options = {
+      position = lib.mkOption {
+        type = lib.types.enum [
+          "left"
+          "center"
+          "right"
+        ];
+        default = "right";
+        description = "Selects the Waybar section that shows the module.";
+      };
+
+      order = lib.mkOption {
+        type = lib.types.int;
+        default = 100;
+        example = 50;
+        description = "Sorts the module within its Waybar section.";
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.attrsOf lib.types.anything;
+        default = { };
+        description = "Sets the Waybar module configuration.";
+      };
+    };
+  };
+}
--- a/configs/nixos/registry/window-icon.nix
+++ b/configs/nixos/registry/window-icon.nix
@@ -0,0 +1,19 @@
+{ lib, ... }:
+{
+
+  type = lib.types.submodule {
+    options = {
+      class = lib.mkOption {
+        description = "Matches the window class reported by the compositor.";
+        type = lib.types.str;
+        example = ".*[Ff]irefox.*";
+      };
+
+      icon = lib.mkOption {
+        description = "Sets the icon shown for matching windows.";
+        type = lib.types.str;
+        example = "";
+      };
+    };
+  };
+}
--- a/docs/.obsidian/workspace.json
+++ b/docs/.obsidian/workspace.json
@@ -4,41 +4,21 @@
    "type": "split",
    "children": [
      {
-        "id": "e581539f950ca1bd",
+        "id": "6d9088d392cb8604",
        "type": "tabs",
        "children": [
          {
-            "id": "0c587e5452c16787",
+            "id": "22a4c1f201a1b00e",
            "type": "leaf",
            "state": {
              "type": "markdown",
              "state": {
-                "file": "TODO.md",
-                "mode": "source",
+                "file": "00 INBOX/ai/valheim-items.md",
+                "mode": "preview",
                "source": true
              },
              "icon": "lucide-file",
-              "title": "TODO"
-            }
-          }
-        ]
-      },
-      {
-        "id": "72e6501450a46859",
-        "type": "tabs",
-        "children": [
-          {
-            "id": "06bc3d52246b600b",
-            "type": "leaf",
-            "state": {
-              "type": "markdown",
-              "state": {
-                "file": "00 INBOX/ai/steamcmd servers.md",
-                "mode": "source",
-                "source": true
-              },
-              "icon": "lucide-file",
-              "title": "steamcmd servers"
+              "title": "valheim-items"
            }
          }
        ]
@@ -111,7 +91,7 @@
            "state": {
              "type": "localgraph",
              "state": {
-                "file": "TODO.md",
+                "file": "00 INBOX/ai/valheim-items.md",
                "options": {
                  "collapse-filter": true,
                  "search": "",
@@ -134,7 +114,7 @@
                  "repelStrength": 10,
                  "linkStrength": 1,
                  "linkDistance": 250,
-                  "scale": 1,
+                  "scale": 0.6666666666666666,
                  "close": true
                }
              },
@@ -251,43 +231,43 @@
      "table-editor-obsidian:Advanced Tables Toolbar": false
    }
  },
-  "active": "0c587e5452c16787",
+  "active": "22a4c1f201a1b00e",
  "lastOpenFiles": [
-    "00 INBOX/how to setup a steamcmd server.md",
-    "00 INBOX/ai/steamcmd servers.md",
-    "03 wrk/ariadne.md",
-    "00 INBOX/ai/ariadne-cli-skeleton.md",
-    "00 INBOX/ai/ariadne-project-goals.md",
+    "00 INBOX/ai/hyprland-lua-migration-plan.md",
+    "00 INBOX/ai/deadnix-architecture.md",
+    "00 INBOX/ai/valheim-items.md",
    "TODO.md",
-    "00 INBOX/ai/dictionary-cli.md",
-    "00 INBOX/ai/dictionary-skill.md",
-    "03 wrk/falinks.md",
-    "03 wrk/machoke.md",
-    "00 INBOX/home assistant agent integration.md",
-    "02 notes/falinks public surfaces.md",
-    "03 wrk/machoke.md~",
-    "02 notes/machoke public surface.md",
-    "03 wrk/falinks.md~",
-    "99 meta/templates/checkmark.md",
    "AGENTS.md",
+    "00 INBOX/valheim progression.md",
+    "technical-writing.md",
+    "rust-module-prototype.md",
+    "00 INBOX/ai/statix-architecture.md",
+    "00 INBOX/ai/nix-statix-deadnix-rules.md",
+    "00 INBOX/let order name resolution.md~",
+    "00 INBOX/nix name resolution.md",
+    "00 INBOX/let order name resolution.md",
+    "00 INBOX/nix name resolution.md~",
+    "TODO.md~",
+    "00 INBOX/ai/xatu-rule-implementation-order.md",
+    "00 INBOX/ai/xatu-architecture-design.md",
+    "00 INBOX/ai/nix-style-linter-plan.md",
+    "00 INBOX/ai/nix-style-guide-agent-customization.md",
+    "00 INBOX/ai/game-guest-readiness-plan.md",
+    "00 INBOX/ai/xatu-node-rule-static-dispatch-plan.md",
+    "00 INBOX/ai/nix-style-linter-pr-1-vendor-rnix.md",
+    "00 INBOX/ai/nix-style-linter-pr-3-let-order.md",
+    "00 INBOX/ai/nix-style-linter-pr-2-scaffold-cli.md",
+    "00 INBOX/ai/homepage-pikachu-setup-plan.md",
+    "00 INBOX/ai/source-driven-remote-deploy-plan.md",
+    "00 INBOX/ai/monorepo-work-report.md",
+    "00 INBOX/ai/clew-ast-exploration.md",
+    "00 INBOX/ai/steamcmd servers.md",
+    "00 INBOX/ai/clew-ast-exploration.md~",
+    "03 wrk/machoke.md~",
+    "03 wrk/falinks.md~",
    "99 meta/attachments/bases/unlinked mentions.base",
-    "99 meta/templates/note.md",
-    "AGENTS.md.md",
    "00 INBOX/ai",
    "03 wrk/ai",
-    "03 wrk/brain.md",
-    "01 sources/second brain setup for doing.md",
-    "00 INBOX/ai/hoopa design rewrite proposal 2.md",
-    "00 INBOX/ai/hoopa decisions.md",
-    "00 INBOX/ai/second brain setup for doing.md",
-    "00 INBOX/ai/hoopa design rewrite proposal.md",
-    "00 INBOX/ai/hoopa design review findings.md",
-    "00 INBOX/ai/hoopa follow up decisions.md",
-    "01 sources/obsidian and ai were made for each other.md",
-    "99 meta/Untitled",
-    "03 wrk",
-    "02 notes",
-    "01 sources",
-    "30 wrk"
+    "99 meta/Untitled"
  ]
 }
--- a/INBOX/ai/deadnix-architecture.md
+++ b/INBOX/ai/deadnix-architecture.md
@@ -0,0 +1,304 @@
+# Deadnix Architecture
+
+## Purpose
+
+This note explains how `deadnix` finds unused Nix code.
+It focuses on architecture, not whether each check belongs in our linter.
+
+Use this note when deciding whether our linter needs scope analysis.
+
+## What Deadnix Is
+
+`deadnix` is a dead-code scanner for Nix.
+It finds bindings that introduce names which no live code uses.
+
+It is not a general style linter.
+It does not have many independent rules.
+It implements one analysis family: unused declarations.
+
+Like `statix`, it parses source text with `rnix`.
+It does not evaluate Nix.
+It does not import files.
+It reasons over local syntax and local scope only.
+
+## Minimal Dead-Code Vocabulary
+
+- A binding introduces a name.
+- A scope defines where introduced names are visible.
+- A use is an identifier occurrence that refers to a binding.
+- Shadowing happens when an inner scope reuses an outer name.
+- Dead code is a binding that no live code uses.
+- A fixed point is the final result after repeated analysis no longer changes.
+
+Dead-code analysis needs more state than a simple syntax lint.
+It must know which names a scope introduces and where those names can be used.
+
+## Component Map
+
+`deadnix` has fewer layers than `statix`.
+The command-line entry point, file walk, parsing, analysis, reporting, and editing live in one small tool.
+
+The important concepts are separate modules:
+
+- settings control analysis options;
+- scopes describe where names are introduced;
+- bindings describe individual declared names;
+- usage search answers whether a name appears in a live body;
+- dead-code results connect a binding to its scope;
+- reports render findings;
+- edits remove or rename unused declarations.
+
+## Main Pipeline
+
+```mermaid
+flowchart TD
+    A[Parse CLI options] --> B[Collect input files]
+    B --> C[Read each file]
+    C --> D[Parse with rnix]
+    D --> E[Skip file on parse errors]
+    D --> F[Run dead-code analysis]
+    F --> G[Print reports unless quiet]
+    G --> H[Apply edits when --edit is set]
+    H --> I[Exit 1 when --fail and findings exist]
+```
+
+The CLI accepts files or directories.
+Directory mode walks `.nix` files.
+Hidden files require an explicit option.
+Excludes filter paths before analysis.
+
+The tool skips dead-code diagnostics when a file has parse errors.
+It reports parse errors to the user and continues with other files.
+
+## Analysis Settings
+
+The analysis has four important switches.
+
+`no_lambda_arg` disables checks for single lambda arguments.
+This can avoid noise when an API requires an argument name.
+
+`no_lambda_pattern_names` disables checks for names in attribute-set function patterns.
+This matters for `callPackage`-style code, where argument names can be external API.
+
+`no_underscore` ignores bindings that start with `_`.
+This treats `_name` as an intentional unused placeholder.
+
+`warn_used_underscore` reports underscore-prefixed bindings that code actually uses.
+This enforces the convention that `_name` means unused.
+
+These settings are architecture-relevant because dead-code policy depends on API context.
+A repository linter needs a way to express that context.
+
+## Scope Model
+
+`deadnix` recognizes four scope types.
+
+### Lambda pattern scope
+
+A lambda pattern is a function argument written as an attribute set pattern.
+It can introduce field names and an optional alias for the whole argument set.
+
+Example shape:
+
+```nix
+args @ { pkgs, lib, ... }: body
+```
+
+This scope can introduce `args`, `pkgs`, and `lib`.
+
+### Lambda argument scope
+
+A single lambda argument introduces one name.
+
+Example shape:
+
+```nix
+pkgs: body
+```
+
+This scope introduces `pkgs`.
+
+### Let scope
+
+A `let` expression introduces bindings and inherited names.
+Those names are available in binding expressions and in the body.
+
+Example shape:
+
+```nix
+let
+  inherit (pkgs) hello;
+  value = hello;
+in
+  value
+```
+
+This scope introduces `hello` and `value`.
+
+### Recursive attribute-set scope
+
+A `rec` attribute set introduces names that sibling attributes can reference.
+`deadnix` models this scope, but treats its bindings as non-removable.
+
+That conservative choice avoids deleting public-looking attributes from recursive sets.
+
+## Binding Model
+
+A binding stores three facts.
+
+It stores the identifier name.
+It stores the syntax node that declared the name.
+It stores whether the binding is mortal.
+
+A mortal binding can become a dead-code finding.
+A non-mortal binding participates in name lookup but will not be removed.
+
+Single lambda arguments that already start with `_` are non-mortal.
+Recursive attribute-set bindings are also non-mortal.
+
+A binding also checks for the `deadnix: skip` pragma.
+The pragma applies to a nearby following declaration.
+The scanner searches backward from the declaration and stops after a blank-line boundary.
+
+## Usage Search
+
+Usage search asks whether a given name appears inside a syntax subtree.
+
+The search is scope-aware.
+When it enters a child scope that binds the same name, it stops following that branch.
+That prevents an inner binding from counting as a use of an outer binding.
+
+Attribute paths get special handling.
+Ordinary attribute keys do not count as uses.
+Dynamic or string attribute names can contain expressions, so the search looks inside those parts.
+
+`inherit` also gets special handling.
+A scope can inherit names from an outer scope.
+The analysis checks whether the inherited expression uses the searched name.
+
+## Fixed-Point Analysis
+
+`deadnix` repeats the scan until the result set stops changing.
+
+This matters because dead code can depend on other dead code.
+A binding can appear used during the first pass because another binding references it.
+If the referring binding is dead, the referenced binding is also dead.
+
+The loop tracks dead declaration nodes.
+During later scans, uses inside already-dead bodies do not keep other bindings alive.
+
+This fixed-point loop is the central architectural difference from simple local syntax lints.
+It makes dead-code results transitive.
+
+## Reporting Model
+
+A result stores the scope and binding for one finding.
+The display text combines both parts.
+Examples include unused lambda pattern, unused lambda argument, and unused let binding.
+
+Human output uses `ariadne`.
+The reporter groups ranges by line and labels the exact binding names.
+It uses different colors for different scope kinds.
+
+JSON output exists behind a feature flag.
+It emits file, message, line, column, and end column.
+
+`NO_COLOR` disables colored human output.
+
+## Edit Model
+
+`deadnix --edit` converts findings into text edits.
+Each edit has a start offset, end offset, and replacement string.
+
+The edit behavior depends on scope kind.
+
+For unused lambda pattern names, it removes the name and nearby comma or whitespace.
+For unused pattern aliases, it removes the alias syntax.
+For unused lambda arguments, it renames the argument with an underscore prefix.
+For unused `let` assignments, it deletes the assignment.
+For unused inherited names, it deletes only the inherited name.
+
+After those edits, it parses the edited source again.
+Then it removes empty `let in` constructs and empty `inherit` statements.
+
+This cleanup pass prevents the first edit batch from leaving invalid or useless scaffolding.
+
+## Error Handling
+
+If a path cannot be stated or read, the CLI reports the file error and continues.
+If a file has parse errors, the CLI reports those errors and skips dead-code analysis for that file.
+
+The `--fail` flag changes exit status when findings exist.
+Without `--fail`, findings do not make the command fail.
+
+This design separates report generation from CI policy.
+
+## Architectural Strengths
+
+The scope model is explicit.
+Each scope type declares which bindings it introduces and where those bindings are visible.
+
+The fixed-point loop catches transitive dead code.
+A binding used only by dead code also becomes dead.
+
+The usage search handles shadowing.
+That prevents common false positives in nested functions and nested `let` expressions.
+
+The edit model is tied to analysis results.
+It knows whether a binding came from a lambda, pattern, `let`, or `inherit`.
+
+The tool has few moving parts.
+That makes the analysis easy to follow compared to a general multi-rule linter.
+
+## Architectural Limits
+
+`deadnix` does not evaluate Nix.
+It cannot know which names external callers depend on.
+This matters for module arguments, package function arguments, and public attribute sets.
+
+It has global switches rather than project-specific rule contexts.
+For example, all lambda pattern names can be checked or skipped.
+The tool does not know that one directory contains `callPackage` functions.
+
+The analysis is local to one file.
+It cannot see that another file imports a function and relies on its argument names.
+
+The fixer performs text edits with byte ranges.
+It must handle punctuation and whitespace carefully.
+Pattern edits are harder than simple assignment deletion.
+
+The tool has one analysis family.
+It is not a framework for many unrelated rules.
+
+## Lessons for Our Linter
+
+Dead-code checks need a scope pass.
+A per-node rule interface is not enough when a diagnostic depends on name visibility.
+
+Represent scopes explicitly.
+Each scope type should provide introduced bindings and visible bodies.
+
+Track shadowing before reporting unused names.
+A text search for an identifier is not sufficient.
+
+Use fixed-point analysis for transitive dead code.
+One pass misses names used only by dead declarations.
+
+Separate policy from mechanics.
+The mechanics can find unused names.
+Repository policy decides whether module arguments, package arguments, or underscore names count.
+
+Treat autofix as scope-specific.
+Removing a pattern name is not the same operation as deleting a `let` assignment.
+
+Run cleanup after edits.
+Dead-code fixes can create empty `let` expressions and empty `inherit` statements.
+
+## Open Design Questions for Our Linter
+
+- Should dead-code analysis be part of `nix-style-linter`, or a separate command?
+- Should policy vary by path, file kind, or suppression comment?
+- Should recursive attribute-set members ever become removable findings?
+- Should underscore names mean ignored, or should used underscore names be errors?
+- Should the linter report unused names without offering autofix first?
+- Should cleanup rules run as ordinary rules or as a post-fix pass?
--- a/INBOX/ai/hyprland-lua-migration-plan.md
+++ b/INBOX/ai/hyprland-lua-migration-plan.md
@@ -0,0 +1,102 @@
+# Hyprland Lua Migration Plan
+
+## Problem Statement
+
+The Hyprland compositor config uses Home Manager's hyprlang output.
+Hyprland deprecates hyprlang for the main compositor config.
+The repository needs to generate a Lua config without changing desktop behavior.
+
+## Solution
+
+Keep the config owned by Nix and Home Manager.
+Switch the Hyprland Home Manager config output to Lua.
+Convert only the settings whose shape changes under Lua.
+
+This is not a desktop redesign.
+The change preserves the current monitors, binds, window rules, environment variables, and UWSM startup.
+
+## User Stories
+
+1. As the operator, I want Hyprland to load `hyprland.lua`, so that startup no longer warns about hyprlang deprecation.
+
+2. As the operator, I want existing keyboard binds to keep working, so that the desktop behavior stays unchanged.
+
+3. As the operator, I want host monitor layout to stay unchanged, so that the physical display setup does not move.
+
+4. As the operator, I want session environment variables to stay in the compositor config, so that Wayland and cursor behavior stays unchanged.
+
+5. As the operator, I want auxiliary module binds to keep working, so that launcher, lock, screenshot, clipboard, notifications, and recording flows stay usable.
+
+## Implementation Decisions
+
+1. Use Home Manager's Lua config generator.
+   Set the Hyprland config type to Lua and keep package ownership unchanged.
+
+2. Keep ordinary compositor options declarative in Nix.
+   Move input, general, decoration, xwayland, animation, and layout settings into the Lua config structure.
+
+3. Remove hyprlang-only variables from generated config.
+   Keep modifier and terminal values as Nix locals or helper inputs.
+
+4. Add minimal local helpers for Lua calls.
+   Use helpers only for repeated bind, dispatcher, command, environment, and rule shapes.
+
+5. Convert all bind strings to Lua bind call data.
+   Preserve key combinations, dispatchers, commands, repeat behavior, and locked-session behavior.
+
+6. Convert contributed binds in their owning modules.
+   Keep each bind near the module that owns the tool it launches.
+
+7. Convert monitor strings to Lua monitor records.
+   Preserve output names, modes, positions, scale values, and rotation.
+
+8. Convert the screenshot window rule to the Lua rule shape.
+   Preserve the Satty class matcher and floating behavior.
+
+9. Convert environment strings to Lua environment calls.
+   Preserve the Wayland flag and cursor variables.
+
+10. Delete or update comments that describe hyprlang syntax.
+    Keep comments that explain behavior or non-obvious invariants.
+
+## Testing Decisions
+
+1. Run the repository Nix formatting and style checks for modified Nix files.
+
+2. Evaluate or build the affected host configuration.
+   This proves Home Manager accepts the Lua settings structure.
+
+3. Confirm the generated config file uses Lua.
+   The expected output is `hyprland.lua`, not `hyprland.conf`.
+
+4. Verify Hyprland accepts the generated Lua config.
+   Use Hyprland config verification when the installed build supports it.
+   Otherwise reload the compositor and inspect errors.
+
+5. Smoke test the changed desktop surface.
+   Test one bind from each source area after reload.
+
+6. Check the explicit monitor layout on the host that declares it.
+   Confirm resolution, position, scale, and rotation stayed unchanged.
+
+## Out of Scope
+
+- Do not split the config into Lua modules.
+- Do not hand-write a full Lua config.
+- Do not add new Hyprland behavior.
+- Do not change UWSM startup.
+- Do not redesign binds, monitor layout, or visual settings.
+- Do not change hyprlock, hypridle, waybar, mako, or rofi settings beyond their Hyprland binds.
+
+## Further Notes
+
+Home Manager documents `configType = "lua"` for Hyprland.
+It maps settings to `hl.*` calls.
+It supports `_args` for multi-argument calls.
+It supports raw Lua expressions with `lib.generators.mkLuaInline`.
+
+The riskiest parts are binds, monitor declarations, and window rules.
+Those parts changed shape more than scalar config sections.
+
+Assumption: the pinned Home Manager input contains the documented Lua Hyprland generator.
+Validate this during the configuration build.
--- a/INBOX/ai/valheim-items.md
+++ b/INBOX/ai/valheim-items.md
@@ -0,0 +1,939 @@
+# Valheim craft and build checklist
+
+This checklist groups craftable inventory items and non-structural build pieces by biome progression.
+It excludes floors, walls, roofs, beams, poles, stairs, doors, gates, windows, and generic structure pieces.
+Biome placement uses the earliest ordinary unlock from recipe materials or required stations.
+
+## Meadows
+
+### Buildables
+
+- [x] Workbench
+- [x] Chopping Block
+- [x] Tanning Rack
+- [x] Cooking Station
+- [x] Beehive
+- [x] Bed
+- [x] Chest
+- [x] Sign
+- [x] Campfire
+- [x] Standing Wood Torch
+- [x] Deer Rug
+- [x] Mysterious Rock
+- [x] Wood Stack
+- [x] Stone Pile
+- [x] Flint Pile
+
+### Equipment and inventory
+
+#### Weapons and tools
+
+- [x] Stone Axe
+- [x] Flint Axe
+- [x] Early Axes
+- [x] Club
+- [x] Torch
+- [x] Flint Spear
+- [x] Flint Knife
+- [x] Crude Bow
+- [x] Hoe
+- [x] Antler Pickaxe
+
+#### Armor
+
+- [x] Rag Tunic
+- [x] Rag Pants
+- [x] Leather Helmet
+- [x] Leather Tunic
+- [x] Leather Pants
+- [x] Deer Hide Cape
+
+#### Shields
+
+- [x] Wood Shield
+- [x] Wood Tower Shield
+- [x] Bone Tower Shield
+
+#### Ammunition
+
+- [x] Wood Arrow
+- [x] Fire Arrow
+- [x] Flinthead Arrow
+
+#### Utility
+
+- [x] Tankard
+
+#### Fireworks
+
+- [ ] Red fireworks
+- [ ] Yellow fireworks
+
+### Food, mead, and bait
+
+- [x] Grilled neck tail
+- [ ] Cooked boar meat
+- [x] Honey
+- [x] Cooked deer meat
+- [x] Whole roasted Meadow boar
+
+## Black Forest
+
+### Buildables
+
+- [x] Adze
+- [x] Cauldron
+- [x] Mead Ketill
+- [x] Fermenter
+- [x] Forge
+- [x] Forge Cooler
+- [x] Anvils
+- [x] Smelter
+- [x] Charcoal Kiln
+- [ ] Barrel
+- [ ] Stool
+- [ ] Wood Chair
+- [ ] Sitting Log
+- [ ] Wood Bench
+- [x] Table
+- [x] Item Stand — vertical
+- [x] Item Stand — horizontal
+- [ ] Cartography Table
+- [ ] Barber Station
+- [ ] Archery Target
+- [ ] T.W.I.G.
+- [ ] Wood Dragon Adornment
+- [ ] Sconce
+- [ ] Fey Lights
+- [ ] Flower Garland
+- [x] Bearskin Rug
+- [ ] Black Banner
+- [ ] Blue Banner
+- [ ] White and Red Striped Banner
+- [ ] Yellow Banner
+- [ ] Purple Banner
+- [ ] Finewood Stack
+- [ ] Corewood Stack
+- [x] Coal Pile
+- [x] Bone Stack
+- [x] Coin Stack
+- [x] Coin Pile
+- [x] Tin Stack
+- [x] Copper Stack
+- [x] Bronze Stack
+- [x] Cart
+- [x] Portal
+- [ ] Sharp Stakes
+- [ ] Ward
+
+### Equipment and inventory
+
+#### Weapons and tools
+
+- [x] Bronze Axe
+- [x] Bronze Pickaxe
+- [x] Cultivator
+- [x] Butcher Knife
+- [x] Wooden Sword
+- [x] Stagbreaker
+- [x] Bronze Mace
+- [x] Bronze Sword
+- [x] Bronze Spear
+- [x] Bronze Atgeir
+- [x] Copper Knife
+- [x] Paws of the Bear
+- [x] Finewood Bow
+
+#### Armor
+
+- [x] Troll Leather Helmet
+- [x] Troll Leather Tunic
+- [x] Troll Leather Pants
+- [x] Troll Hide Cape
+- [x] Headdress of the Bear
+- [x] Patterns of the Bear
+- [x] Loincloth of the Bear
+- [x] Bronze Helmet
+- [x] Bronze Plate Cuirass
+- [x] Bronze Plate Leggings
+- [x] Celebratory Cap
+
+#### Shield
+
+- [x] Bronze Buckler
+
+#### Ammunition
+
+- [x] Bronzehead Arrow
+
+#### Trinkets
+
+- [x] Heart of the Forest
+- [x] Bronze Pendant
+
+#### Utility
+
+- [x] Mead Horn of Odin
+
+#### Fireworks
+
+- [ ] Blue fireworks
+- [ ] Cyan fireworks
+
+### Food, mead, and bait
+
+- [ ] Carrot
+- [ ] Boar jerky
+- [ ] Cooked bear meat
+- [ ] Minced meat sauce
+- [ ] Queen's jam
+- [ ] Carrot soup
+- [ ] Deer stew
+- [ ] Pulled Bear
+- [ ] Black Forest buffet platter
+- [ ] Mead base: Minor healing `[INFERENCE]`
+- [ ] Minor healing mead `[INFERENCE]`
+- [ ] Mead base: Minor stamina `[INFERENCE]`
+- [ ] Minor stamina mead `[INFERENCE]`
+- [ ] Mead base: Poison resistance `[INFERENCE]`
+- [ ] Poison resistance mead `[INFERENCE]`
+- [ ] Mead base: Tasty `[INFERENCE]`
+- [ ] Tasty mead `[INFERENCE]`
+- [ ] Mead base: Vananidir `[INFERENCE]`
+- [ ] Draught of Vananidir `[INFERENCE]`
+- [ ] Mead base: Ratatosk `[INFERENCE]`
+- [ ] Tonic of Ratatosk `[INFERENCE]`
+- [ ] Mead base: Troll endurance `[INFERENCE]`
+- [ ] Mead of Troll endurance `[INFERENCE]`
+- [ ] Mossy fishing bait
+
+## Ocean
+
+### Buildables
+
+- [ ] Raft
+- [ ] Karve
+- [ ] Longship
+
+### Equipment and inventory
+
+#### Weapons and tools
+
+- [ ] Abyssal Razor
+- [ ] Abyssal Harpoon
+
+#### Trinket
+
+- [ ] Fins of Destiny
+
+### Food, mead, and bait
+
+- [ ] Cooked serpent meat `[INFERENCE]`
+- [ ] Serpent stew `[INFERENCE]`
+- [ ] Sailor's bounty
+- [ ] Heavy fishing bait
+
+## Swamp
+
+### Buildables
+
+- [ ] Birds' Nest
+- [ ] Spice Rack
+- [ ] Stonecutter
+- [ ] Food Preparation Table
+- [ ] Iron Cooking Station
+- [ ] Forge Bellows
+- [ ] Grinding Wheel
+- [ ] Smith's Anvil
+- [ ] Forge Tool Rack
+- [ ] Obliterator
+- [ ] Bonfire
+- [ ] Hearth
+- [ ] Hanging Brazier
+- [ ] Standing Iron Torch
+- [ ] Standing Blue-burning Iron Torch
+- [ ] Standing Green-burning Iron Torch
+- [ ] Resin Candle
+- [ ] Reinforced Chest
+- [ ] Personal Chest
+- [ ] Armour Stand
+- [ ] Raven Throne
+- [ ] Red Banner
+- [ ] Green Banner
+- [ ] Iron Stack
+- [ ] Iron Fire Pit
+
+### Equipment and inventory
+
+#### Weapons and tools
+
+- [ ] Iron Axe
+- [ ] Iron Pickaxe
+- [ ] Battleaxe
+- [ ] Iron Mace
+- [ ] Iron Sledge
+- [ ] Iron Sword
+- [ ] Ancient Bark Spear
+- [ ] Iron Atgeir
+- [ ] Huntsman Bow
+
+#### Armor
+
+- [ ] Root Mask
+- [ ] Root Harnesk
+- [ ] Root Leggings
+- [ ] Iron Helmet
+- [ ] Iron Scale Mail
+- [ ] Iron Greaves
+
+#### Shields
+
+- [ ] Banded Shield
+- [ ] Shield of Roots
+- [ ] Iron Buckler
+- [ ] Iron Tower Shield
+- [ ] Serpent Scale Shield
+
+#### Ammunition
+
+- [ ] Ironhead Arrow
+
+#### Bombs
+
+- [ ] Ooze Bomb
+- [ ] Blob Bomb: Poison
+- [ ] Blob Bomb: Elite poison
+
+#### Fishing bait
+
+- [ ] Mossy Fishing Bait
+- [ ] Sticky Fishing Bait
+- [ ] Heavy Fishing Bait
+
+#### Trinkets
+
+- [ ] Iron Brooch
+- [ ] Nimble Anklet
+
+#### Utility
+
+- [ ] Horn of Celebration
+
+#### Fireworks
+
+- [ ] Green fireworks
+- [ ] Purple fireworks
+
+### Food, mead, and bait
+
+- [ ] Cooked fish
+- [ ] Muckshake
+- [ ] Turnip stew
+- [ ] Sausages
+- [ ] Black soup
+- [ ] Swamp dweller's delight
+- [ ] Mead base: Frost resistance `[INFERENCE]`
+- [ ] Frost resistance mead `[INFERENCE]`
+- [ ] Mead base: Medium healing `[INFERENCE]`
+- [ ] Medium healing mead `[INFERENCE]`
+- [ ] Sticky fishing bait
+
+## Mountain
+
+### Buildables
+
+- [ ] Tool Shelf
+- [ ] Butcher's Table
+- [ ] Dragon Bed
+- [ ] Stone Throne
+- [ ] Standing Brazier
+- [ ] Blue Standing Brazier
+- [ ] Wolf Rug
+- [ ] Treasure Chest
+- [ ] Silver Stack
+
+### Equipment and inventory
+
+#### Weapons and tools
+
+- [ ] Crystal Battleaxe
+- [ ] Frostner
+- [ ] Silver Sword
+- [ ] Fang Spear
+- [ ] Silver Knife
+- [ ] Flesh Rippers
+- [ ] Draugr Fang
+- [ ] Scythe
+
+#### Armor
+
+- [ ] Fenris Hood
+- [ ] Fenris Coat
+- [ ] Fenris Leggings
+- [ ] Drake Helmet
+- [ ] Wolf Hide Chestpiece
+- [ ] Wolf Hide Trousers
+- [ ] Wolf Fur Cape
+
+#### Shield
+
+- [ ] Silver Shield
+
+#### Ammunition
+
+- [ ] Silver Arrow
+- [ ] Obsidian Arrow
+- [ ] Poison Arrow
+- [ ] Frost Arrow
+
+#### Bomb
+
+- [ ] Blob Bomb: Frost
+
+#### Fishing bait
+
+- [ ] Cold Fishing Bait
+- [ ] Frosty Fishing Bait
+
+#### Trinkets
+
+- [ ] Wolf Sight
+- [ ] Crystal Heart
+
+### Food, mead, and bait
+
+- [ ] Onion
+- [ ] Cooked wolf meat
+- [ ] Wolf jerky
+- [ ] Onion soup
+- [ ] Wolf skewer
+- [ ] Eyescream
+- [ ] Hearty Mountain logger's stew
+- [ ] Mead base: Animal whispers `[INFERENCE]`
+- [ ] Brew of animal whispers `[INFERENCE]`
+- [ ] Cold fishing bait
+- [ ] Frosty fishing bait `[INFERENCE]`
+
+## Plains
+
+### Buildables
+
+- [ ] Artisan Table
+- [ ] Blast Furnace
+- [ ] Spinning Wheel
+- [ ] Windmill
+- [ ] Stone Oven
+- [ ] Pots and Pans
+- [ ] Darkwood Chair
+- [ ] Long Heavy Table
+- [ ] Round Table
+- [ ] Hot Tub
+- [ ] Black Metal Chest
+- [ ] Lox Rug
+- [ ] Straw
+- [ ] Red Jute Carpet
+- [ ] Red Jute Curtain
+- [ ] Raven Adornment
+- [ ] Wolf Adornment
+- [ ] Blue, Red and White Banner
+- [ ] White and Blue Striped Banner
+- [ ] Orange Banner
+- [ ] White Banner
+- [ ] Black Metal Stack
+
+### Equipment and inventory
+
+#### Weapons and tools
+
+- [ ] Black Metal Axe
+- [ ] Black Metal Battleaxe
+- [ ] Porcupine
+- [ ] Black Metal Sword
+- [ ] Black Metal Atgeir
+- [ ] Black Metal Knife
+- [ ] Vilebone Maulclaws
+
+#### Armor
+
+- [ ] Padded Helmet
+- [ ] Padded Cuirass
+- [ ] Padded Greaves
+- [ ] Linen Cape
+- [ ] Lox Cape
+- [ ] Lox Fur Hood
+- [ ] Lox Fur Jacket
+- [ ] Lox Fur Trousers
+- [ ] Vilebone Visage
+- [ ] Vilebone Cage
+- [ ] Vilebone Drapes
+
+#### Shields
+
+- [ ] Black Metal Shield
+- [ ] Black Metal Tower Shield
+
+#### Ammunition
+
+- [ ] Needle Arrow
+- [ ] Wooden Missile
+- [ ] Black Metal Missile
+
+#### Bomb
+
+- [ ] Blob Bomb: Tar
+
+#### Fishing bait
+
+- [ ] Stingy Fishing Bait
+- [ ] Misty Fishing Bait
+
+#### Trinkets
+
+- [ ] Bracelets of the Brave
+- [ ] Evasion Mantle
+
+#### Accessories and utility
+
+- [ ] Wisplight
+- [ ] Lox Saddle
+
+### Food, mead, and bait
+
+- [ ] Cooked egg
+- [ ] Cooked chicken meat
+- [ ] Cooked lox meat
+- [ ] Fish wraps
+- [ ] Lox meat pie
+- [ ] Blood pudding
+- [ ] Bread
+- [ ] Frosted sweetbread
+- [ ] Plains pie picnic
+- [ ] Barley wine base: Fire resistance `[INFERENCE]`
+- [ ] Fire resistance barley wine `[INFERENCE]`
+- [ ] Mead base: Medium stamina `[INFERENCE]`
+- [ ] Medium stamina mead `[INFERENCE]`
+- [ ] Mead base: Berserkir `[INFERENCE]`
+- [ ] Berserkir mead `[INFERENCE]`
+- [ ] Mead base: Anti-sting `[INFERENCE]`
+- [ ] Anti-sting concoction `[INFERENCE]`
+- [ ] Stingy fishing bait
+- [ ] Misty fishing bait `[INFERENCE]`
+
+## Mistlands
+
+### Buildables
+
+- [ ] Wisp Fountain
+- [ ] Artisan Press
+- [ ] Mortar and Pestle
+- [ ] Black Forge
+- [ ] Black Forge Cooler
+- [ ] Vice
+- [ ] Galdr Table
+- [ ] Rune Table
+- [ ] Unfading Candles
+- [ ] Sap Extractor
+- [ ] Eitr Refinery
+- [ ] Dvergr Wall Lantern
+- [ ] Dvergr Pole Lantern
+- [ ] Wisp Torch
+- [ ] Black Marble Bench
+- [ ] Black Marble Table
+- [ ] Black Marble Throne
+- [ ] Hare Rug
+- [ ] Blue Jute Carpet
+- [ ] Blue Jute Curtain
+- [ ] Blue Jute Drapes
+- [ ] Yggdrasil Wood Stack
+- [ ] Black Marble Pile
+- [ ] Dvergr Sharp Stakes
+- [ ] Trap
+- [ ] Ballista
+
+### Equipment and inventory
+
+#### Weapons and tools
+
+- [ ] Jotun Bane
+- [ ] Skull Splittur
+- [ ] Demolisher
+- [ ] Mistwalker
+- [ ] Krom
+- [ ] Carapace Spear
+- [ ] Himminafl
+- [ ] Skoll and Hati
+- [ ] Spinesnap
+- [ ] Arbalest
+- [ ] Staff of Frost
+- [ ] Staff of Embers
+- [ ] Staff of Protection
+- [ ] Dead Raiser
+- [ ] Black Metal Pickaxe
+- [ ] Dvergr Lantern
+
+#### Armor
+
+- [ ] Carapace Helmet
+- [ ] Carapace Breastplate
+- [ ] Carapace Greaves
+- [ ] Eitr-weave Hood
+- [ ] Eitr-weave Robe
+- [ ] Eitr-weave Trousers
+- [ ] Feather Cape
+
+#### Shields
+
+- [ ] Carapace Shield
+- [ ] Carapace Buckler
+
+#### Ammunition
+
+- [ ] Carapace Arrow
+- [ ] Bone Bolt
+- [ ] Iron Bolt
+- [ ] Black Metal Bolt
+- [ ] Carapace Bolt
+
+#### Bomb
+
+- [ ] Bile Bomb
+
+#### Trinkets
+
+- [ ] Pulsating Earrings
+- [ ] Resounding Shackle
+
+#### Utility
+
+- [ ] Sealbreaker
+
+### Food, mead, and bait
+
+- [ ] Magecap
+- [ ] Jotun puffs
+- [ ] Cooked seeker meat
+- [ ] Cooked hare meat
+- [ ] Meat platter
+- [ ] Honey glazed chicken
+- [ ] Misthare supreme
+- [ ] Salad
+- [ ] Mushroom omelette
+- [ ] Fish 'n' bread
+- [ ] Stuffed mushroom
+- [ ] Yggdrasil porridge
+- [ ] Seeker aspic
+- [ ] Mushrooms galore á la Mistlands
+- [ ] Mead base: Major healing `[INFERENCE]`
+- [ ] Major healing mead `[INFERENCE]`
+- [ ] Mead base: Lingering stamina `[INFERENCE]`
+- [ ] Lingering stamina mead `[INFERENCE]`
+- [ ] Mead base: Minor eitr `[INFERENCE]`
+- [ ] Minor eitr mead `[INFERENCE]`
+- [ ] Mead base: Lightfoot `[INFERENCE]`
+- [ ] Lightfoot mead `[INFERENCE]`
+
+## Ashlands
+
+### Buildables
+
+- [ ] Rolling Pins and Cutting Boards
+- [ ] Metal Cutter
+- [ ] Gem Cutter
+- [ ] Feathery Wreath
+- [ ] Eternal Pyre
+- [ ] Shield Generator
+- [ ] Ashwood Bed
+- [ ] Ashwood Bench
+- [ ] Bone Throne
+- [ ] Grausten Chest
+- [ ] Small Green Pot
+- [ ] Medium Green Pot
+- [ ] Large Green Pot
+- [ ] Lava Lantern
+- [ ] Asksvin Rug
+- [ ] Asksvin Skeleton
+- [ ] Ashwood Stack
+- [ ] Grausten Pile
+- [ ] Flametal Stack
+- [ ] Pile of Skulls
+- [ ] Portal Stone
+- [ ] Drakkar
+- [ ] Battering Ram
+- [ ] Catapult
+
+### Equipment and inventory
+
+#### Weapons
+
+- [ ] Berserkir Axes
+- [ ] Bleeding Berserkir Axes
+- [ ] Thundering Berserkir Axes
+- [ ] Primal Berserkir Axes
+- [ ] Flametal Mace
+- [ ] Bloodgeon
+- [ ] Storm Star
+- [ ] Klossen
+- [ ] Nidhögg
+- [ ] Nidhögg the Bleeding
+- [ ] Nidhögg the Thundering
+- [ ] Nidhögg the Primal
+- [ ] Dyrnwyn
+- [ ] Slayer
+- [ ] Brutal Slayer
+- [ ] Scourging Slayer
+- [ ] Primal Slayer
+- [ ] Splitnir
+- [ ] Splitnir the Bleeding
+- [ ] Splitnir the Storming
+- [ ] Splitnir the Primal
+- [ ] Ash Fang
+- [ ] Blood Fang
+- [ ] Storm Fang
+- [ ] Root Fang
+- [ ] Ripper
+- [ ] Wound Ripper
+- [ ] Storm Ripper
+- [ ] Root Ripper
+- [ ] Staff of Fracturing
+- [ ] Dundr
+- [ ] Staff of the Wild
+- [ ] Trollstav
+
+#### Armor
+
+- [ ] Hood of Embla
+- [ ] Robes of Embla
+- [ ] Trousers of Embla
+- [ ] Hood of Ask
+- [ ] Breastplate of Ask
+- [ ] Trousers of Ask
+- [ ] Flametal Helmet
+- [ ] Flametal Breastplate
+- [ ] Flametal Greaves
+- [ ] Asksvin Cloak
+- [ ] Ashen Cape
+
+#### Shields
+
+- [ ] Flametal Shield
+- [ ] Flametal Tower Shield
+
+#### Ammunition
+
+- [ ] Charred Arrow
+- [ ] Charred Bolt
+- [ ] Flametal Missile
+- [ ] Grausten Payload
+- [ ] Explosive Payload
+
+#### Bombs
+
+- [ ] Smoke Bomb
+- [ ] Basalt Bomb
+- [ ] Blob Bomb: Lava
+
+#### Fishing bait
+
+- [ ] Hot Fishing Bait
+
+#### Trinkets
+
+- [ ] Jörmundling
+- [ ] Brimstone
+
+#### Utility
+
+- [ ] Asksvin Saddle
+- [ ] Bell
+
+### Food, mead, and bait
+
+- [ ] Vineberry cluster
+- [ ] Cooked asksvin tail
+- [ ] Cooked volture meat
+- [ ] Cooked bonemaw meat
+- [ ] Fiery svinstew
+- [ ] Mashed meat
+- [ ] Piquant pie
+- [ ] Spicy marmalade
+- [ ] Scorching medley
+- [ ] Roasted crust pie
+- [ ] Sizzling berry broth
+- [ ] Sparkling shroomshake
+- [ ] Marinated greens
+- [ ] Ashlands gourmet bowl
+- [ ] Mead base: Lingering health `[INFERENCE]`
+- [ ] Lingering healing mead `[INFERENCE]`
+- [ ] Mead base: Lingering eitr `[INFERENCE]`
+- [ ] Lingering eitr mead `[INFERENCE]`
+- [ ] Hot fishing bait
+
+## Deep North
+
+### Buildables
+
+- [ ] Eternal Pyre
+- [ ] Frigid Kiln
+- [ ] Frost Foundry
+- [ ] Smith's Aprons
+- [ ] Smoker
+- [ ] Standing Loom
+- [ ] Timberwood Drawbridge
+- [ ] Antler Throne
+- [ ] Carved Bench
+- [ ] Carved Chair
+- [ ] Hooded Lantern
+- [ ] Long Carved Table
+- [ ] Moose Hide Carpet
+- [ ] Sealskin Rug
+- [ ] Snow Lantern
+- [ ] Square Carved Table
+- [ ] Wardrobe
+- [ ] Bloodgold Stack
+- [ ] Timberwood Stack
+- [ ] Oat Straw `[INFERENCE]`
+- [ ] Seed Kale
+- [ ] Timberwood Sapling
+
+### Equipment and inventory
+
+#### Equipment and inventory
+
+- [ ] Nord Atgeir
+- [ ] Nord Axe
+- [ ] Nord Bow
+- [ ] Nord Crossbow
+- [ ] Nord Dagger
+- [ ] Nord Greataxe
+- [ ] Nord Greatsword
+- [ ] Nord Knucklechains
+- [ ] Nord Mace
+- [ ] Nord Sledge
+- [ ] Nord Spear
+- [ ] Nord Sword
+- [ ] Frostfire Atgeir
+- [ ] Frostfire Axe
+- [ ] Frostfire Bow
+- [ ] Frostfire Crossbow
+- [ ] Frostfire Dagger
+- [ ] Frostfire Greataxe
+- [ ] Frostfire Greatsword
+- [ ] Frostfire Knucklechains
+- [ ] Frostfire Mace
+- [ ] Frostfire Sledge
+- [ ] Frostfire Spear
+- [ ] Frostfire Sword
+- [ ] Thunderblood Atgeir
+- [ ] Thunderblood Axe
+- [ ] Thunderblood Bow
+- [ ] Thunderblood Crossbow
+- [ ] Thunderblood Dagger
+- [ ] Thunderblood Greataxe
+- [ ] Thunderblood Greatsword
+- [ ] Thunderblood Knucklechains
+- [ ] Thunderblood Mace
+- [ ] Thunderblood Sledge
+- [ ] Thunderblood Spear
+- [ ] Thunderblood Sword
+- [ ] Echo Spike
+- [ ] Lightning Strike
+- [ ] Northern Vengeance
+- [ ] Spirit Caller
+- [ ] Nord Buckler
+- [ ] Nord Greatshield
+- [ ] Nord Shield
+- [ ] Helmet of the Protector
+- [ ] Breastplate of the Protector
+- [ ] Trousers of the Protector
+- [ ] Hood of the Vanguard
+- [ ] Chestpiece of the Vanguard
+- [ ] Trousers of the Vanguard
+- [ ] Headdress of the Caller
+- [ ] Robes of the Caller
+- [ ] Trousers of the Caller
+- [ ] Cape of the Caller
+- [ ] Moose Hide Cape
+- [ ] Crown of Valheim `[INFERENCE]`
+- [ ] Fishing Hat
+- [ ] Neckstabber `[INFERENCE]`
+- [ ] Witch Crown
+- [ ] Snow Shovel
+- [ ] Intricate Key
+- [ ] Moose Saddle `[INFERENCE]`
+- [ ] Bloodgold Arrow
+- [ ] Bloodgold Bolt
+- [ ] Bloodgold Missile
+- [ ] Bloodgold Payload
+- [ ] Blob Bomb: Pulp `[INFERENCE]`
+- [ ] Ember Charge
+- [ ] Snowball
+
+### Food, mead, and bait
+
+- [ ] Baked Poteitr
+- [ ] Cooked Moose Meat
+- [ ] Cooked Seal Blubber `[INFERENCE]`
+- [ ] Fish Soup `[INFERENCE]`
+- [ ] Kale *(also the cultivator crop piece; listed once)*
+- [ ] Kale Chips `[INFERENCE]`
+- [ ] Lingonberries
+- [ ] Lingonberry Juice
+- [ ] Luminous Larva
+- [ ] Meat In Bread
+- [ ] Meatballs and Poteitr
+- [ ] Oat Milk `[INFERENCE]`
+- [ ] Oatmeal
+- [ ] Oats `[INFERENCE]`
+- [ ] Oven Pancake
+- [ ] Pancakes
+- [ ] Poteitr `[INFERENCE]`
+- [ ] Seal Meat Soup
+- [ ] Smoked Fish
+- [ ] Smoked Moose Meat
+- [ ] Northern Morning Fare
+- [ ] Oat Flour `[INFERENCE]`
+- [ ] Oven Pancake Batter
+- [ ] Raw Kale Chips `[INFERENCE]`
+- [ ] Unbaked Poteitr
+- [ ] Frosty fishing bait
+
+## Seasonal
+
+### Buildables
+
+- [ ] Maypole
+- [ ] Jack-o-turnip
+- [ ] Mistletoe
+- [ ] Yule Tree
+- [ ] Yule Wreath
+- [ ] Yule Garland
+- [ ] Yuleklapp — small
+- [ ] Yuleklapp — medium
+- [ ] Yuleklapp — large
+
+### Equipment and inventory
+
+#### Armor
+
+- [ ] Midsummer Crown
+- [ ] Pointy Hat
+
+## Sources
+
+The Valheim Wiki gives most current lists and progression tables.
+Deep North names use the 1.0 notes and game-derived catalogs when Wiki pages lag release data.
+
+- https://valheim.wiki/w/Weapons
+- https://valheim.wiki/w/Armor
+- https://valheim.wiki/w/Tools
+- https://valheim.wiki/w/Accessories
+- https://valheim.wiki/w/Trinkets
+- https://valheim.wiki/w/Food
+- https://valheim.wiki/w/Mead
+- https://valheim.wiki/w/Bait
+- https://valheim.wiki/w/Building
+- https://valheim.wiki/w/Deep_North
+- https://www.valheimgame.com/news/valheim-1-0-has-arrived-/
+- https://www.valheimplanner.com/recipes/
+- https://www.valheimplanner.com/build/
+- https://www.valheimplanner.com/food/
--- a/progression.md
+++ b/progression.md
@@ -0,0 +1,267 @@
+---
+date-created: 2026-09-23 07:13
+---
+
+# Valheim Progression
+
+## Notation & Terms
+| Notation  | Meaning                                                            |
+| --------- | ------------------------------------------------------------------ |
+| A <- B    | A can be OBTAINED from/through B                                   |
+| A <- B{x} | A can be purchased from B for x coins                              |
+| A => B    | A DISCOVERS/UNLOCKS B in-game                                      |
+| A -> B    | A is REQUIRED to make/do B                                         |
+| A ~> B    | A is an UPGRADE for B                                              |
+| ![B] A    | Completion objective of B category                                 |
+| A @ B     | A is FOUND/LOCATED at/in B                                         |
+| ^ A#B     | A is an alternative method for B                                   |
+| ? A       | Open question about A                                              |
+| x A       | A is prohibited/illegal method                                     |
+| A + B     | A AND B                                                            |
+| A \| B    | A OR B                                                             |
+| \* A      | A is available from the START / has no progression prerequisites   |
+| A[n]      | A at QUALITY/LEVEL n                                               |
+| A$n       | A with CAPABILITY tier n (higher tiers satisfy lower requirements) |
+|           |                                                                    |
+
+- [farm]: a deliberately constructed setup that repeatedly produces a resource or creature drop more efficiently/reliably than ordinary gathering, though it may require consumable inputs or periodic maintenance.
+- [build]: furniture, whether functional or decorative only.
+- [craft]: craft the item
+
+## Notes
+
+![farm] Greydwarf Farm
+
+Hanging Brazier + Forge[1] + Greydwarf Nest -> Greydwarf Farm
+
+Bronze + Coal + Chain + Forge[1] + Hammer => Hanging Brazier
+
+Bronze{5} + Coal{2} + Chain{1} @ Forge[1] -> Hanging Brazier
+
+Copper + Tin + Forge[1] => Bronze
+
+Copper{2} + Tin{1} @ Forge[1] -> Bronze
+
+Copper Ore{1} + Coal{2} @ Smelter -> Copper
+
+Copper Ore <- Mine Copper Deposit
+
+Copper Deposit + Pickaxe$0 -> Mine Copper Deposit
+
+Copper Deposit @ Black Forest
+
+* Black Forest
+
+Antler Pickaxe -> Pickaxe$0
+
+Wood + Hard Antler + Workbench[1] => Antler Pickaxe
+
+Wood{10} + Hard Antler{1} @ Workbench[1] -> Antler Pickaxe
+
+* Wood
+
+Hard Antler <- Kill Eikthyr
+
+Summon Eikthyr -> Kill Eikthyr
+
+Deer Trophy{2} @ Eikthyr Forsaken Altar -> Summon Eikthyr
+
+Deer Trophy <- Deer
+
+Deer @ Meadows
+
+Deer @ Black Forest
+
+Eikthyr Forsaken Altar @ Meadows
+
+Wood + Hammer => Workbench[1]
+
+Wood{10} -> Workbench[1]
+
+Wood + Stone => Hammer
+
+Wood{3} + Stone{2} -> Hammer
+
+* Stone
+
+Wood @ Charcoal Kiln -> Coal
+
+Stone + Surtling Core + Workbench[1] + Hammer => Charcoal Kiln
+
+Stone{20} + Surtling Core{5} @ Workbench[1] -> Charcoal Kiln
+
+Surtling Core @ Burial Chambers
+
+Burial Chambers @ Black Forest
+
+Stone + Surtling Core + Workbench[1] + Hammer => Smelter
+
+Stone{20} + Surtling Core{5} @ Workbench[1] -> Smelter
+
+Tin Ore{1} + Coal{2} @ Smelter -> Tin
+
+Tin Ore <- Mine Tin Deposit
+
+Tin Deposit + Pickaxe$0 -> Mine Tin Deposit
+
+Tin Deposit @ Black Forest
+
+Stone + Coal + Wood + Copper + Workbench[1] + Hammer => Forge[1]
+
+Stone{4} + Coal{4} + Wood{10} + Copper{6} @ Workbench[1] -> Forge[1]
+
+Chain @ Sunken Crypts
+
+Swamp Key -> Sunken Crypts
+
+Swamp Key <- Kill Elder
+
+Summon Elder -> Kill Elder
+
+Ancient Seed{3} @ Elder Forsaken Altar -> Summon Elder
+
+Ancient Seed <- Greydwarf Nest
+
+Elder Forsaken Altar @ Black Forest
+
+Sunken Crypts @ Swamp
+
+* Swamp
+
+Greydwarf Nest @ Black Forest
+
+![build] Hearth
+
+Stone + Stonecutter[1] + Hammer => Hearth
+
+Stone{15} @ Stonecutter[1] -> Hearth
+
+Wood + Iron + Stone + Workbench[1] + Hammer => Stonecutter[1]
+
+Wood{10} + Iron{2} + Stone{4} @ Workbench[1] -> Stonecutter[1]
+
+Scrap Iron{1} + Coal{2} @ Smelter -> Iron
+
+Scrap Iron <- Sunken Crypts
+
+Scrap Iron <- Mine Muddy Scrap Pile
+
+Muddy Scrap Pile + Pickaxe$0 -> Mine Muddy Scrap Pile
+
+Muddy Scrap Pile @ Sunken Crypts
+
+![build] Iron Cooking Station
+
+Iron + Chain + Forge[1] + Hammer => Iron Cooking Station
+
+Iron{3} + Chain{3} @ Forge[1] -> Iron Cooking Station
+
+![build] Obliterator
+
+Iron + Copper + Thunder Stone + Forge[1] + Hammer => Obliterator
+
+Iron{8} + Copper{4} + Thunder Stone{1} @ Forge[1] -> Obliterator
+
+Thunder Stone <- Haldor{50}
+
+Haldor @ Black Forest
+
+Coins <- Troll
+
+Troll @ Black Forest
+
+Coins @ Burial Chambers
+
+Coins @ Troll Cave
+
+Troll Cave @ Black Forest
+
+Coins @ Sunken Crypts
+
+![craft] Iron Greaves
+
+Iron + Deer Hide + Forge[2] => Iron Greaves
+
+Iron{20} + Deer Hide{2} @ Forge[2] -> Iron Greaves
+
+![craft] Iron Scale Mail
+
+Iron + Deer Hide + Forge[2] => Iron Scale Mail
+
+Iron{20} + Deer Hide{2} @ Forge[2] -> Iron Scale Mail
+
+![build] Forge Tool Rack
+
+Forge Tool Rack ~> Forge
+
+Iron + Wood + Workbench[1] + Hammer => Forge Tool Rack
+
+Iron{15} + Wood{10} @ Workbench[1] -> Forge Tool Rack
+
+![build] Cauldron
+
+Tin + Forge[1] + Hammer => Cauldron
+
+Tin{10} @ Forge[1] -> Cauldron
+
+![build] Mysterious Rock
+
+Rock + Coal + Hammer => Mysterious Rock
+
+Rock{1} + Coal{1} -> Mysterious Rock
+
+Rock @ Black Forest
+
+Rock @ Meadows
+
+Rock @ Swamp
+
+![build] Chopping Block
+
+Chopping Block ~> Workbench
+
+Wood + Flint + Workbench[1] + Hammer => Chopping Block
+
+Wood{10} + Flint{10} @ Workbench[1] -> Chopping Block
+
+![build] Tanning Rack
+
+Tanning Rack ~> Workbench
+
+Wood + Flint + Leather Scraps + Deer Hide + Workbench[1] + Hammer => Tanning Rack
+
+Wood{10} + Flint{15} + Leather Scraps{20} + Deer Hide{5} @ Workbench[1] -> Tanning Rack
+
+* Flint
+
+Leather Scraps <- Boar
+
+Boar @ Meadows
+
+Deer Hide <- Deer
+
+![build] Adze
+
+Adze ~> Workbench
+
+Finewood + Bronze + Forge[1] + Hammer => Adze
+
+Finewood{10} + Bronze{3} @ Forge[1] -> Adze
+
+Finewood <- Chop Birch
+
+Birch + Axe[2] -> Chop Birch
+
+Birch @ Meadows
+
+Bronze Axe -> Axe[2]
+
+Finewood <- Chop Oak
+
+Oak + Axe[2] -> Chop Oak
+
+Oak @ Meadows
+
+Wood + Bronze + Leather Scraps + Forge[1] => Bronze Axe
+
+Wood{4} + Bronze{8} + Leather Scraps{2} @ Forge[1] -> Bronze Axe
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -3,6 +3,8 @@
 - machoke
 - falinks
 - dotfiles
+- natu
+- nix-style / refactor

 # project ideas

@@ -19,6 +21,10 @@
 - vim-obsidian-markdown
 - dictionary cli tool
 - kitchen.md
+- Rust project creator
+- random number generator utility
+- reading material helper
+- valheim progression DSL + graph

 # migration

@@ -95,46 +101,58 @@
        - https://www.youtube.com/watch?v=kzcI5F4tGiU
        - https://www.youtube.com/watch?v=iKwPaB5TUdI
        - https://www.youtube.com/watch?v=A-CtdQFRX64
+- natu literature
+    - https://rust-analyzer.github.io/book/contributing/syntax.html?utm_source=chatgpt.com
+    - https://github.com/dotnet/roslyn/blob/main/docs/compilers/Design/Red-Green%20Trees.md?utm_source=chatgpt.com
+    - https://github.com/rust-analyzer/rowan/blob/master/examples/s_expressions.rs?utm_source=chatgpt.com
+    - https://dl.acm.org/doi/10.1145/964001.964011
+    - https://web.cecs.pdx.edu/~apt/esop15.pdf?utm_source=chatgpt.com
+    - https://www.researchgate.net/publication/2377179_Efficient_and_flexible_incremental_parsing?utm_source=chatgpt.com

 # tech debt

 - better remote deployment
 - expose remote deployment as a flake app, replacing the Fish-only `deploy-to` workflow
 - centralize shared system group names, starting with the `storage` group
+- Investigate Rust Bazel target structure.
+  Prefer clear per-file dependency edges, but `rust_library` maps each target to a crate.
+  Decide whether wrapper rules or another pattern can improve graph clarity without forcing artificial crate boundaries.

 ## nix refactor

 Review Nix files in entrypoint order:

 - [x] `flake.nix`
- [ ] `src/dotfiles/default.nix`
- [ ] `src/dotfiles/util.nix`
- [ ] `src/dotfiles/formatter.nix`
- [ ] `src/dotfiles/apps.nix`
- [ ] `src/dotfiles/registry.nix`
- [ ] `configs/nixos/registry/address.nix`
- [ ] `configs/nixos/registry/env-var.nix`
- [ ] `configs/nixos/registry/homepage.nix`
- [ ] `configs/nixos/registry/route.nix`
- [ ] `configs/nixos/registry/shell-shortcut.nix`
- [ ] `configs/nixos/registry/stable-uid.nix`
- [ ] `src/dotfiles/modules.nix`
- [ ] `configs/nixos/modules/default.nix`
- [ ] `configs/nixos/modules/host.nix`
- [ ] `configs/nixos/modules/guest.nix`
- [ ] `configs/nixos/modules/monorepo.nix`
- [ ] `configs/nixos/modules/zfs.nix`
- [ ] `configs/nixos/modules/network/ssh.nix`
- [ ] `configs/nixos/modules/network/vlans.nix`
- [ ] `configs/nixos/modules/network/vpn-client.nix`
- [ ] `configs/nixos/modules/desktop/default.nix`
- [ ] `configs/nixos/modules/desktop/apps/alacritty.nix`
- [ ] `configs/nixos/modules/desktop/apps/firefox.nix`
- [ ] `configs/nixos/modules/desktop/apps/ghostty.nix`
- [ ] `configs/nixos/modules/desktop/apps/obsidian.nix`
- [ ] `configs/nixos/modules/desktop/apps/signal.nix`
- [ ] `configs/nixos/modules/desktop/apps/steam.nix`
- [ ] `configs/nixos/modules/desktop/apps/vencord.nix`
+- [x] `src/flake/default.nix`
+- [x] `src/flake/formatter.nix`
+- [x] `src/flake/apps.nix`
+- [x] `src/dotfiles/default.nix`
+- [x] `src/dotfiles/util.nix`
+- [x] `src/dotfiles/registry.nix`
+- [x] `src/dotfiles/registry/schema.nix`
+- [x] `src/dotfiles/registry/validation.nix`
+- [x] `configs/nixos/registry/address.nix`
+- [>] `configs/nixos/registry/homepage.nix`
+- [x] `configs/nixos/registry/route.nix`
+- [x] `configs/nixos/registry/shell-shortcut.nix`
+- [x] `configs/nixos/registry/stable-uid.nix`
+- [x] `configs/nixos/modules/default.nix`
+- [x] `configs/nixos/modules/host.nix`
+- [x] `configs/nixos/modules/guest.nix`
+- [x] `configs/nixos/modules/monorepo.nix`
+- [x] `configs/nixos/modules/zfs.nix`
+- [x] `configs/nixos/modules/network/ssh.nix`
+- [x] `configs/nixos/modules/network/vlans.nix`
+- [x] `configs/nixos/modules/network/vpn-client.nix`
+- [x] `configs/nixos/modules/desktop/default.nix`
+- [x] `configs/nixos/modules/desktop/apps/alacritty.nix`
+- [x] `configs/nixos/modules/desktop/apps/firefox.nix`
+- [x] `configs/nixos/modules/desktop/apps/ghostty.nix`
+- [x] `configs/nixos/modules/desktop/apps/obsidian.nix`
+- [x] `configs/nixos/modules/desktop/apps/r2modman.nix`
+- [x] `configs/nixos/modules/desktop/apps/signal.nix`
+- [x] `configs/nixos/modules/desktop/apps/steam.nix`
+- [x] `configs/nixos/modules/desktop/apps/vencord.nix`
 - [ ] `configs/nixos/modules/desktop/session/hyprland/default.nix`
 - [ ] `configs/nixos/modules/desktop/session/hyprland/hypridle.nix`
 - [ ] `configs/nixos/modules/desktop/session/hyprland/hyprlock.nix`
--- a/flake.nix
+++ b/flake.nix
@@ -2,13 +2,13 @@
  description = "alexion.dev";

  inputs = {
-    # Base nixpkgs channel.
+    # Provides the base nixpkgs channel.
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";

-    # Fresher packages, reachable per-package as `unstable.<name>`.
+    # Provides newer packages through `unstable.<name>`.
    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";

-    # Latest stable release, reachable per-package as `stable.<name>`.
+    # Provides the latest stable release through `stable.<name>`.
    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-26.05";

    home-manager = {
@@ -16,70 +16,71 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # Signed AMO extensions, pinned by version and hash.
+    # Provides signed AMO extensions pinned by version and hash.
    firefox-addons = {
      url = "gitlab:rycee/nur-expressions?dir=pkgs/firefox-addons";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # Follows our nixpkgs so its plugins build against the same package set.
+    # Uses this flake's nixpkgs so plugins build against the same package set.
    nixvim = {
      url = "github:nix-community/nixvim";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # Declarative disk partitioning.
-    # Each host declares its own layout.
+    # Configures declarative disk partitioning.
+    # Each host declares its layout.
    disko = {
      url = "github:nix-community/disko";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # Upstream per-machine hardware profiles.
-    # Each host imports its own.
+    # Provides upstream hardware profiles for each machine.
+    # Each host imports its profile.
    nixos-hardware = {
      url = "github:NixOS/nixos-hardware";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # Decrypts committed secrets at activation, from an age identity on the host.
+    # Decrypts committed secrets at activation with an age identity on the host.
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # Themes the graphical layer from one base16 scheme.
-    # Follows our nixpkgs so it themes the same package set the host builds.
+    # Themes the graphical layer with one base16 scheme.
+    # Uses this flake's nixpkgs so it themes the host package set.
    stylix = {
      url = "github:danth/stylix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # TODO: deprecate / remove
-    # Agent-ergonomic CLI for Gitea, with a home-manager module for the agent context.
+    # TODO: Deprecate and remove this input.
+    # Provides a Gitea CLI for agents.
+    # Its Home Manager module configures agent context.
    gitea-axi = {
      url = "git+https://git.alexion.dev/alexion/gitea-axi";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # Repository formatter and Nix lint wiring.
+    # Configures the repository formatter and Nix linter.
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    # CachyOS kernel and binary cache.
-    # This must not follow this flake's nixpkgs because Chaotic builds against its own pinned package set.
-    # Its cache serves the kernel only when the overlay stays on the cache-friendly path.
+    # Provides the CachyOS kernel and binary cache.
+    # Uses its pinned package set because Chaotic builds against it.
+    # Its cache serves the kernel only when the overlay uses the cache-friendly path.
    chaotic.url = "github:chaotic-cx/nyx/nyxpkgs-unstable";
  };

  outputs =
    { self, nixpkgs, ... }@inputs:
-    import ./src/dotfiles {
+    import ./src/flake {
      inherit inputs self;
      inherit (nixpkgs) lib;
-      root = ./configs/nixos;
+      root = ./.;
      system = "x86_64-linux";
    };
 }
--- a/src/ariadne/BUILD
+++ b/src/ariadne/BUILD
@@ -4,8 +4,8 @@ rust_library(
    name = "ariadne_lib",
    crate_name = "ariadne",
    srcs = [
+        "ariadne.rs",
        "clew.rs",
-        "lib.rs",
        "pipeline.rs",
    ],
    deps = [
@@ -17,9 +17,10 @@ rust_library(
 rust_binary(
    name = "ariadne",
    crate_name = "ariadne_cli",
-    srcs = ["main.rs"],
+    srcs = ["ariadne_main.rs"],
    deps = [
        ":ariadne_lib",
+        "//src/monorepo:monorepo",
        "//third_party/crates:clap",
    ],
 )
--- a/src/ariadne/Cargo.toml
+++ b/src/ariadne/Cargo.toml
@@ -4,13 +4,14 @@ version = "0.1.0"
 edition = "2024"

 [lib]
-path = "lib.rs"
+path = "ariadne.rs"

 [[bin]]
 name = "ariadne"
-path = "main.rs"
+path = "ariadne_main.rs"

 [dependencies]
-clap = { version = "4", features = ["derive"] }
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
+clap = { workspace = true, features = ["derive"] }
+monorepo = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
--- a/src/ariadne/ariadne.rs
+++ b/src/ariadne/ariadne.rs
--- a/src/ariadne/ariadne_main.rs
+++ b/src/ariadne/ariadne_main.rs
@@ -17,7 +17,7 @@ struct Args {
 impl From<Args> for ariadne::Config {
    fn from(args: Args) -> Self {
        ariadne::Config {
-            output_dir: resolve_workspace_path(args.output_dir),
+            output_dir: monorepo::workspace::resolve_workspace_path(args.output_dir),
            force: args.force,
            target_stage: args.target_stage,
        }
@@ -32,19 +32,6 @@ fn parse_stage(value: &str) -> Result<ariadne::pipeline::Stage, String> {
        .ok_or_else(|| format!("unknown stage: {value}"))
 }

-// TODO: Move this into a shared Rust utility crate.
-fn resolve_workspace_path(path: PathBuf) -> PathBuf {
-    if path.is_absolute() {
-        return path;
-    }
-
-    if let Some(workspace) = std::env::var_os("BUILD_WORKSPACE_DIRECTORY") {
-        return PathBuf::from(workspace).join(path);
-    }
-
-    path
-}
-
 fn main() -> ariadne::Result<()> {
    let config: ariadne::Config = Args::parse().into();
    ariadne::run(&config)
--- a/src/dotfiles/AGENTS.md
+++ b/src/dotfiles/AGENTS.md
@@ -2,6 +2,8 @@

 ## Gotchas

+- `src/dotfiles/guests.nix` does not accept a `lib` argument.
+  Do not pass `lib` when importing it.
 - The registry collector reads only top-level host `config.registry` declarations.
  Registry declarations inside guest interiors live under `config.containers.<guest>.config.registry`.
  The collected registry does not include those guest-interior declarations.
--- a/src/dotfiles/default.nix
+++ b/src/dotfiles/default.nix
@@ -3,34 +3,8 @@
  inputs,
  self,
  root,
-  system,
 }:
 let
-  util = import ./util.nix { inherit lib; };
-
-  registry = import ./registry.nix {
-    inherit lib;
-    hosts = self.nixosConfigurations;
-    root = root + "/registry";
-  };
-
-  modules = import ./modules.nix {
-    inherit util;
-    root = root + "/modules";
-  };
-
-  guestModules = import ./guests.nix {
-    inherit
-      inputs
-      lib
-      registry
-      specialArgs
-      util
-      ;
-    repositoryModules = modules;
-    root = root + "/guests";
-  };
-
  specialArgs = {
    inherit
      inputs
@@ -40,31 +14,36 @@ let
    registry = registry.collected;
  };

-in
-{
-  formatter.${system} =
-    (import ./formatter.nix {
-      inherit inputs system;
-    }).config.build.wrapper;
+  util = import ./util.nix { inherit lib; };

-  apps.${system} = import ./apps.nix {
-    inherit
-      inputs
-      lib
-      system
-      ;
-    formatter = self.formatter.${system};
+  registry = import ./registry.nix {
+    inherit lib util;
+    hosts = self.nixosConfigurations;
+    root = root + "/registry";
  };

-  nixosConfigurations = import ./hosts.nix {
+  # TODO: Refactor guest-module composition.
+  guestModules = import ./guests.nix {
    inherit
      inputs
-      lib
+      registry
      specialArgs
-      guestModules
+      util
      ;
-    registryModule = registry.module;
    repositoryModules = modules;
-    root = root + "/hosts";
+    root = root + "/guests";
  };
+  modules.imports = util.collectNixFiles (root + "/modules");
+
+in
+import ./hosts.nix {
+  inherit
+    inputs
+    lib
+    specialArgs
+    guestModules
+    ;
+  registryModule = registry.module;
+  repositoryModules = modules;
+  root = root + "/hosts";
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
alexion	c053846adb	fix(waybar): restore workspace clicks	2026-10-11 21:43:20 -04:00
alexion	2edad6c5df	refactor(clipboard): simplify picker wiring	2026-10-11 21:36:54 -04:00
alexion	1d5acc09c6	refactor(audio): simplify media controls	2026-10-11 21:30:21 -04:00
alexion	ee29e53f7c	refactor(waybar): register owned modules	2026-10-11 21:07:35 -04:00
alexion	3c9d0ec886	refactor(nix): share glyph decoding helper	2026-10-11 21:07:35 -04:00
alexion	f0c5544b10	refactor(waybar): register workspace window icons	2026-10-11 18:23:41 -04:00
alexion	4dd0a5a4f5	feat(rofi): increase launcher contrast	2026-10-11 17:49:05 -04:00
alexion	a4a795f7ee	refactor(mako): use executable helper for history	2026-10-11 17:40:56 -04:00
alexion	ecdf877308	refactor(login): use configured uwsm executable	2026-10-11 17:39:37 -04:00
alexion	d1face10ec	refactor(nix): apply executable helper rules	2026-10-11 17:38:15 -04:00
alexion	337d9a2014	docs(nix-style): add package command rules	2026-10-11 17:38:15 -04:00
alexion	f059068873	refactor(hyprlock): inline command paths	2026-10-11 17:25:18 -04:00
alexion	7662c04cda	fix(hypridle): use Lua dpms dispatcher	2026-10-11 17:22:05 -04:00
alexion	33128fc3c7	feat(hyprland): migrate desktop utility bindings	2026-10-11 16:58:27 -04:00
alexion	68415ad47e	fix(hyprland): place Zeus primary monitor at origin	2026-10-11 16:56:03 -04:00
alexion	6b7201e6fa	feat(hyprland): migrate session feature bindings	2026-10-11 16:52:29 -04:00
alexion	4360f4863b	feat(hyprland): migrate hardware key bindings	2026-10-11 16:40:07 -04:00
alexion	370cab8f83	feat(hyprland): render session env registry	2026-10-11 16:34:52 -04:00
alexion	e74a08b853	feat(dotfiles): add session env registry	2026-10-11 16:30:00 -04:00
alexion	250b0b71f9	feat(hyprland): migrate static Lua compositor settings	2026-10-11 16:24:48 -04:00
alexion	10299cec19	refactor(hyprland): place keybind definitions after config	2026-10-11 16:00:38 -04:00
alexion	91654b3068	feat(hyprland): add remaining window actions	2026-10-11 15:58:50 -04:00
alexion	be9c3c07a3	feat(hyprland): add window resize binds	2026-10-11 15:00:03 -04:00
alexion	a8bd4bf4cf	feat(hyprland): add window movement binds	2026-10-11 14:52:39 -04:00
alexion	a2fc568704	feat(hyprland): add directional focus binds	2026-10-11 12:58:56 -04:00
alexion	0bf5ebae87	feat(hyprland): add workspace focus keybinds	2026-10-10 17:02:20 -04:00
alexion	fddec14128	refactor(hyprland): move terminal keybind into registry	2026-10-10 15:41:32 -04:00
alexion	85fadc5bfc	feat(hyprland): start lua config migration	2026-10-10 13:57:33 -04:00
alexion	3992030949	docs: update notes	2026-10-10 11:06:05 -04:00
alexion	c8a596aa39	fix(hyprland): stop idle dpms poweroff	2026-10-10 08:29:01 -04:00
alexion	4908c4751f	refactor(nixos): simplify Firefox configuration	2026-10-07 22:57:25 -04:00
alexion	79c56dfb1c	refactor(nixos): remove Alacritty module	2026-10-07 22:53:09 -04:00
alexion	7140b6d258	refactor(nixos): simplify VPN client configuration	2026-10-07 22:44:45 -04:00
alexion	f173887228	refactor(nixos): consolidate VLAN networking	2026-10-07 21:29:52 -04:00
alexion	3a487050fd	refactor(nixos): simplify SSH configuration	2026-10-07 20:27:48 -04:00
alexion	65c84f5b39	docs(nixos): clarify host module options	2026-10-07 18:20:53 -04:00
alexion	b3c4903c82	fix(fish): persist remote system deployments	2026-10-07 17:43:20 -04:00
alexion	ec1c0fba56	refactor(nixos): organize host modules	2026-10-07 16:59:03 -04:00
alexion	1f2f1a79ad	refactor(nixos): derive ZFS host IDs	2026-10-07 16:51:56 -04:00
alexion	46a47fa061	feat(nixos): configure route body limits	2026-10-06 22:54:58 -04:00
alexion	8d357e960b	feat(nixos): add unzip to host profiles	2026-10-06 22:45:49 -04:00
alexion	f48bac5ec1	refactor(nixos): inline module enable conditions	2026-10-06 22:26:47 -04:00
alexion	d53246caf0	docs(nixos): clarify guest option	2026-10-06 22:24:00 -04:00
alexion	92f7f0542d	docs(nixos): clarify host option	2026-10-06 22:22:32 -04:00
alexion	4f7fbef35b	feat(nixos): encapsulate CachyOS kernel configuration	2026-10-06 19:42:52 -04:00
alexion	c7c3257b9d	docs(nixos): clarify primary user option	2026-10-06 19:12:58 -04:00
alexion	7d37b92e17	refactor(nixos): scope user profile to hosts	2026-10-05 23:15:01 -04:00
alexion	9ece182099	refactor(nixos): disable guest SSH by default	2026-10-05 23:05:55 -04:00
alexion	9aea13b8c2	refactor(dotfiles): inline module imports	2026-10-05 00:28:34 -04:00
alexion	369c7512c6	refactor(nixos): clarify stable UID validation	2026-10-05 00:26:28 -04:00
alexion	8c91a210b2	docs(nixos): clarify registry option descriptions	2026-10-05 00:13:31 -04:00
alexion	d602581a99	refactor(nixos): inline shell shortcut type	2026-10-05 00:11:51 -04:00
alexion	c3a6271582	refactor(nixos): model route protocols explicitly	2026-10-05 00:09:09 -04:00
alexion	a7db0b745c	refactor(nixos): use Home Manager session variables	2026-10-04 22:22:55 -04:00
alexion	4a8e8920ea	refactor(dotfiles): clarify registry validation	2026-10-04 22:01:03 -04:00
alexion	3e9295134e	feat(natu): detect redundant let expressions	2026-10-04 21:23:35 -04:00
alexion	c91094234f	refactor(natu): remove single-use binding rule	2026-10-04 14:08:13 -04:00
alexion	11b490d1e8	chore: apply generic updates	2026-10-04 13:56:23 -04:00
alexion	43b5d07a27	revert(nixos): undo bad system update Restore the pre-update Pi packaging and Rofi option from PR 124 after the associated deployment exposed a performance regression. Refs: `1b4dc7762`	2026-10-04 13:50:10 -04:00
alexion	1b4dc77627	fix(nixos): build vendored pi independently	2026-10-03 07:57:41 -04:00
alexion	1cbdcee8ac	feat(natu): ignore imported let bindings	2026-10-01 21:54:09 -04:00
alexion	3fbb0aca32	refactor(dotfiles): remove registry replication	2026-10-01 21:50:58 -04:00
alexion	87776c8994	chore(dotfiles): defer registry binding findings	2026-09-30 11:28:29 -04:00
alexion	17597526c5	refactor(dotfiles): inline MAC octet helper	2026-09-30 11:22:38 -04:00
alexion	14c9a418b6	feat(natu): support preceding suppressions	2026-09-30 11:03:32 -04:00
alexion	589e37f52e	refactor(dotfiles): inline host configurations	2026-09-30 10:46:20 -04:00
alexion	78492739f3	feat(natu): detect single-use let bindings	2026-09-30 10:43:05 -04:00
alexion	2265dfc558	feat(natu): lint redundant parameter forwarding	2026-09-30 00:19:27 -04:00
alexion	becbb50491	docs(nix): clarify completed Nix prose	2026-09-29 22:59:14 -04:00
alexion	54335ead82	refactor(dotfiles): inline registry definitions	2026-09-29 20:16:15 -04:00
alexion	16c69e01e1	refactor(dotfiles): inline registry options	2026-09-29 00:27:15 -04:00
alexion	5af563d70f	refactor(dotfiles): split registry responsibilities	2026-09-27 23:31:44 -04:00
alexion	0e5731145e	feat(natu): lint direct listToAttrs maps	2026-09-27 18:05:16 -04:00
alexion	b6469567e1	fix(zeus): ignore power button presses	2026-09-27 14:47:00 -04:00
alexion	8f0837a4b5	feat(desktop): copy screenshots before annotation	2026-09-27 10:09:17 -04:00
alexion	0937f15260	fix(dotfiles): qualify stable UID helpers	2026-09-27 10:09:17 -04:00
alexion	61efef1a7d	fix(dotfiles): stop passing unused guest libraries	2026-09-27 10:07:57 -04:00
alexion	8eabdee2a0	docs(nix-style): allow general basename use	2026-09-27 09:42:50 -04:00
alexion	43b3ff4b09	refactor(dotfiles): centralize Nix file names	2026-09-27 09:39:10 -04:00
alexion	3b2d16743e	refactor(dotfiles): share Nix file discovery	2026-09-26 23:49:03 -04:00
alexion	11d11c7c02	feat(style-nix): require shared file discovery	2026-09-26 23:49:03 -04:00
alexion	869d6a2cbd	feat(review): run natu for Nix targets	2026-09-26 23:49:03 -04:00
alexion	e5b76515f1	refactor(nix): order let bindings	2026-09-26 23:43:45 -04:00
alexion	324d40c85d	style(nixos): suppress cfg order findings	2026-09-26 23:32:34 -04:00
alexion	dd82367dcb	feat(natu): support inline suppressions	2026-09-26 23:30:01 -04:00
alexion	ac5cc8d659	fix(natu): preserve NixOS cfg bindings	2026-09-26 23:24:54 -04:00
alexion	5e5c3e2534	feat(natu): report expected let order	2026-09-26 23:20:00 -04:00
alexion	09a2093f90	feat(nvim): enable nixd	2026-09-26 22:36:03 -04:00
alexion	8000367613	refactor(dotfiles): order let bindings	2026-09-26 21:04:57 -04:00
alexion	38dff04ece	fix(natu): resolve inherited attributes	2026-09-26 20:27:48 -04:00
alexion	0c1a1c1ffa	refactor(natu): rename xatu	2026-09-26 20:12:57 -04:00
alexion	27d9194ac3	feat(xatu): check let binding order	2026-09-26 20:06:14 -04:00
alexion	c4ea12b3ce	feat(xatu): add scope graph	2026-09-26 20:05:59 -04:00
alexion	16ce11fc52	chore(valheim): select butter-chicken world	2026-09-26 13:40:57 -04:00
alexion	a73636a84f	feat(zeus): install r2modman	2026-09-25 13:21:40 -04:00
alexion	80db2b61e6	chore: update	2026-09-24 23:11:47 -04:00
alexion	7cc066b55d	chore(nixos): update Pi default model	2026-09-24 23:10:12 -04:00
alexion	74e7d2d211	feat(skills): enable craft skill repo-wide	2026-09-23 23:38:30 -04:00
alexion	98d734e977	docs: add valheim progression note	2026-09-23 09:51:55 -04:00
alexion	dda05559a5	feat(nixos): add copyparty opds volume	2026-09-20 20:38:15 -04:00
alexion	594877c4ba	fix(nixos): mirror copyparty volume paths	2026-09-20 12:14:45 -04:00
alexion	f9aff6839e	feat(xatu): add manual inherit from lint	2026-09-19 23:30:56 -04:00
alexion	4b7d3834ab	feat(xatu): add manual inherit lint	2026-09-19 21:27:23 -04:00
alexion	213cd84642	refactor(xatu): narrow lint rule set	2026-09-19 20:17:24 -04:00
alexion	6e19169e11	feat(xatu): report empty let expressions	2026-09-19 18:25:25 -04:00
alexion	be8744795c	feat(xatu): report unquoted URI literals	2026-09-19 17:51:46 -04:00
alexion	ad00301ac9	docs(rust-style): order declarations by dependency	2026-09-19 17:38:09 -04:00
alexion	87dc93513b	feat(xatu): set CLI exit statuses	2026-09-19 17:06:11 -04:00
alexion	58f2350d5f	fix(xatu): ignore testdata directories	2026-09-19 16:49:50 -04:00
alexion	4b9beae501	refactor(flake): split root output wiring	2026-09-19 16:19:55 -04:00
alexion	addcf7ca8e	feat(xatu): report deprecated toPath calls	2026-09-19 15:17:38 -04:00
alexion	6887b104d6	build(rust): vendor googletest crate	2026-09-19 14:53:22 -04:00
alexion	a6fe84190e	test(xatu): cover future sight findings	2026-09-18 23:25:00 -04:00
alexion	1fa3962fed	refactor(xatu): return structured reports	2026-09-18 22:43:17 -04:00
alexion	113018a62c	feat(xatu): reject files with parse errors	2026-09-18 21:14:00 -04:00
alexion	11f1eba26f	feat(xatu): add lint architecture	2026-09-18 20:57:39 -04:00
alexion	d974a46211	chore(vendor): remove unused anyhow crate	2026-09-17 15:14:18 -04:00
alexion	6b29f2c2b9	feat(status): add error context	2026-09-17 15:07:14 -04:00
alexion	49cf043035	feat(status): add status type	2026-09-17 14:57:50 -04:00
alexion	37539682d4	chore(vendor): add anyhow crate	2026-09-17 14:13:23 -04:00
alexion	7a3a3d6b90	feat(xatu): scaffold source collection	2026-09-17 14:09:47 -04:00
alexion	87916a8e17	docs(skills): add build style skill	2026-09-17 12:45:29 -04:00
alexion	498d0dd467	docs: update project todo list	2026-09-17 09:57:17 -04:00
alexion	b4b77faaa9	refactor(rust): align workspace with style rules	2026-09-17 09:57:11 -04:00
alexion	cf9a671fb8	feat(skills): add style review workflow	2026-09-17 09:56:58 -04:00
alexion	247712582a	chore: remove unused Rust projects	2026-09-17 01:14:58 -04:00
alexion	ddc7952399	feat(xatu): scaffold project Add the Xatu Rust package as a minimal hello-world skeleton with Cargo workspace metadata and Bazel library, binary, and test targets. Include the Statix and Deadnix evaluation notes so the new linter work starts with the prior rule and architecture research.	2026-09-17 00:26:12 -04:00
alexion	885124c240	feat(nix): lint let binding order	2026-09-16 18:13:35 -04:00
alexion	7b09cea3af	feat(nix): add style linter scaffold	2026-09-16 16:03:59 -04:00
alexion	82ad65a3a4	build(rust): vendor rnix parser crate	2026-09-16 15:51:43 -04:00
alexion	cbdf482422	refactor(dotfiles): order default let bindings	2026-09-16 14:50:19 -04:00
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNqJIC6VRXyvrNf3n9su9KdPCikC3CjK/QrCK2reHdB alexion@pikachu`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIRBcHHuubptXCdvED/p2dR3MpjGN/AimqLasLY5984G alexion@zeus`