docs: update README with feature overview and module structure

Add Java extension support and configure multiple JDK runtimes.
Introduce a wrapped VS Code package that includes JDK 25 in the PATH
to support the Red Hat Java language server.

Switch from using `programs.vscode.userSettings` to a manually managed
`settings.json` file via `home.file`. This allows the settings file to
be writable by external tools like `kilo-code` at runtime while
preserving them across Nix configuration switches by using `force = false`.

docs/README.md

@@ -17,16 +17,26 @@ How to work on it: [conventions.md](./conventions.md).
 
 Each machine: `modules/hosts/<name>/default.nix` → `nixosConfigurations.<name>`, real config in `*Configuration` + optional `_private/` and `_services/`.
 
+## Features at a glance
+
+- **Users catalog** — one catalog in `modules/system/users.nix`, pick who exists on a host with `chiasson.users.enabled = [ "example" ]`, override per host. Home Manager wires itself from the same list.
+- **SSH + Bitwarden (rbw) keys** — one ed25519 keypair per catalog user, private key in Bitwarden, public key in `modules/ssh/inventory.nix`. Outbound SSH uses a `.pub` filter against the rbw agent; inbound `authorized_keys` are generated from the same inventory. [Full wiring in conventions.md](./conventions.md#ssh-model).
+- **Wisdom modules** — Home Manager slices in `modules/wisdom/` auto-catalog via `lib.wisdomCatalogExtraModules` (defined in `modules/desktop/options.nix`). The baseline `wisdom` module handles git identity + shared tools; all other `wisdom*` exports are pulled in once per user through `desktopHomeBase` → `chiasson.users.extraModules.olivier`. Hosts only flip `chiasson.home.<category>.<slice>.enable` — no manual imports in `home.nix`. Categories include `apps` (spotify, discord, localsend), `browsers` (chrome, edge, zen, …), `editors` (cursor, vscode, obsidian, …), `shells` (bash, fish, oh-my-posh, yazi), `desktop` (gtk-qt-theming, screenshot), and `terminals` (kitty). Trivial single-package slices can be written with the `lib.wisdomSlice` helper instead of repeating the `root`/`cfg` + `mkIf` boilerplate.
+- **Wallpapers from a dedicated repo** — `modules/desktop/wallpapers.nix` pins `inputs.wallpapers` into the store and exposes it as `CHIASSON_NIX_WALLPAPERS` and `/etc/wallpapers`. Override `chiasson.desktop.wallpapers.source` if needed.
+- **Private host data** — import-tree skips `_private/` globally, so machine-only files (firmware quirks, display configs, service tweaks) live next to the host module without leaking elsewhere.
+
 ## Deploy / rebuild
 
-Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops).
+Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops/laptops/tablets).
 
 Fleet deploy is [Navi](https://github.com/cafkafk/navi) — config in `modules/deploy/navi.nix`, outputs `flake.navi` / `flake.naviHive`.
 
 ```bash
-nix develop          # devShell has navi + hints
+nix develop          # devShell has navi + just + hints
+just                  # list local helpers like `sync-dms`
 navi apply --on <host>
 navi apply-local --node 14900k --sudo   # this machine, if hostname matches
+navi tui                  # interactive fleet dashboard
 ```
 
 Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
@@ -37,11 +47,11 @@ Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
 modules/
   hosts/<host>/     # per-machine composition
   system/           # nixosModules.system aggregate
-  desktop/          # GUI stack
+  desktop/          # GUI stack (niri, hyprland, plasma, DMS)
   wisdom/           # HM modules (exports still named wisdom*)
   ssh/              # inbound NixOS + outbound HM
   deploy/           # navi hive
-  lib/              # pure helpers → flake.lib
+  patches/          # one-off patches (yt-dlp, t2fanrd, …)
 ```
 
 Machine-only stuff lives in `hosts/<host>/_private/` — import-tree skips `_private/` globally, so those files only get pulled in where you import them.

docs/conventions.md

@@ -172,7 +172,9 @@ The integration block at the bottom of `modules/system/users.nix` turns the cata
 
 **New NixOS leaf:** export `flake.nixosModules.whatever`, wire from `system/default.nix` or `desktop/default.nix` if it's global, or only from a host `configuration.nix` if it's not. `nix flake check`. Git-add new paths if eval uses the git tree.
 
-**New HM slice:** add `modules/wisdom/.../foo.nix` exporting `flake.homeManagerModules.wisdomFoo` (import-tree picks it up; `wisdomCatalogExtraModules` includes every `wisdom*` export except `wisdom` / `wisdomShellBash`). Gate packages on `chiasson.home.*.enable`, and set the slice's own `enable` default (`mkEnableOption "…" // { default = true/false }`) in that same module — defaults live with the option that owns them, not in a shared defaults file. Hosts flip toggles in `home.nix`. Upstream HM deps stay imported unconditionally — use `mkIf` on `cfg.enable` for config (never `config`-dependent `imports`; that recurses).
+**New HM slice:** add `modules/wisdom/.../foo.nix` exporting `flake.homeManagerModules.wisdomFoo` (import-tree picks it up; `wisdomCatalogExtraModules` includes every `wisdom*` export). Every `wisdom*` slice auto-catalogs — including the bash shell — so the root module no longer manually `imports` it. Gate packages on `chiasson.home.*.enable`, and set the slice's own `enable` default with `mkEnableOption "…" // { default = true/false }` in that same module — defaults live with the option that owns them, not in a shared defaults file. Hosts flip toggles in `home.nix`. Upstream HM deps stay imported unconditionally — use `mkIf` on `cfg.enable` for config (never `config`-dependent `imports`; that recurses).
+
+**Trivial single-package slice:** use `self.lib.wisdomSlice { path = "a.b"; default = true/false; description = "…"; packages = pkgs: [ … ]; }` instead of the `root`/`cfg` + `mkIf (root.enable && cfg.enable)` boilerplate. `packages` is a `pkgs -> [ drv ]` function responsible for its own `availableOn`/platform gating. Several such slices may share one `simple.nix` in their category dir (each still exporting its own `wisdom*` module), rather than one file per slice.
 
 **Derivations:** `let` inside a fragment, or `flake.packages` / `flake.lib` — not a bare `mkDerivation` file import-tree will try to load.
 

modules/desktop/options.nix

@@ -1,19 +1,38 @@
-{ lib, ... }: {
-  # Resolve `wisdom*` HM slices for NixOS `extraModules` (`self` is not an HM specialArg).
-  # Slices are gated by `chiasson.home.*.enable`; hosts only flip toggles in `home.nix`.
-  # Lives here (not `modules/lib/`) because `hosts/desktop-home-base.nix` consumes it and
-  # fragment eval order requires the definition to sort before `hosts/`.
+{ lib, ... }:
+{
   flake.lib.wisdomCatalogExtraModules =
     self:
     let
       names = lib.sort builtins.lessThan (
-        lib.filter (n: lib.hasPrefix "wisdom" n && n != "wisdom" && n != "wisdomShellBash") (
+        lib.filter (n: lib.hasPrefix "wisdom" n && n != "wisdom") (
           builtins.attrNames self.homeManagerModules
         )
       );
     in
     map (name: self.homeManagerModules.${name}) names;
 
+  flake.lib.wisdomSlice =
+    { path, default, description, packages }:
+    { config, lib, pkgs, ... }:
+    let
+      segs = lib.splitString "." path;
+      optPath = [
+        "chiasson"
+        "home"
+      ]
+      ++ segs
+      ++ [ "enable" ];
+      root = config.chiasson.home;
+      cfg = lib.getAttrFromPath segs root;
+      enabled = lib.getAttrFromPath optPath config;
+    in
+    {
+      options = lib.setAttrByPath optPath (lib.mkEnableOption description // { inherit default; });
+      config = lib.mkIf (root.enable && enabled) {
+        home.packages = lib.filter (lib.meta.availableOn pkgs.stdenv.hostPlatform) (packages pkgs);
+      };
+    };
+
   flake.nixosModules.desktopOptions =
     { config, options, lib, pkgs, self, inputs, ... }:
     let

modules/hosts/14900k/_private/displays.nix

@@ -1,25 +1,15 @@
 # Monitor layout for 14900k.
-# NVIDIA (default): DP-3 ultrawide, HDMI-A-3 + DP-4 side/top stack; DP-2 virtual 4K when streamingDisplay enabled.
-# Intel iGPU (gpu passthru): DP-1 ultrawide, HDMI-A-2 Samsung to the left.
-# Niri: `extraSettings` (KDL via `extraConfig`, other wrapper-modules keys) + `extraBinds` (merged keybinds).
-# Hyprland: `chiasson.desktop.hyprland.settings` (merged in HM when `chiasson.desktop.hyprland.enable`).
+# NVIDIA (default): DP-3 ultrawide, HDMI-A-3 + DP-4 stack; DP-2 virtual 4K when streamingDisplay is on.
+# Intel iGPU (gpu passthru): DP-1 ultrawide, HDMI-A-2 to the left.
+# Niri uses `extraSettings.extraConfig`; Hyprland uses `chiasson.desktop.hyprland.settings`.
 
 #TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
 { config, lib, ... }:
 let
+  streamingDisplay = config.chiasson.system.streamingDisplay;
   gpuPassthru = config.chiasson.system.gpuPassthru.enable;
-  streamingDisplay = config.chiasson.system.streamingDisplay.enable or false;
-  streamingCfg = config.chiasson.system.streamingDisplay or { };
-
-  virtualOutputNiri =
-    lib.optionalString streamingDisplay ''
-      output "${streamingCfg.connector}" {
-          mode "${streamingCfg.mode}"
-          scale ${toString (streamingCfg.niriScale or 1.0)}
-          position ${streamingCfg.niriPosition}
-      }
-    '';
 
+  # Niri outputs: a static block per GPU layout, plus the optional virtual 4K panel.
   niriOutputs =
     (if gpuPassthru then
       ''
@@ -54,48 +44,30 @@ let
             position x=0 y=-1080
         }
       '')
-    + virtualOutputNiri;
-
-  virtualOutputHyprland =
-    lib.optionalString streamingDisplay
-      "${streamingCfg.connector}, ${streamingCfg.mode}, 7680x0, ${toString (streamingCfg.niriScale or 1.0)}";
+    + lib.optionalString streamingDisplay.enable ''
+        output "${streamingDisplay.connector}" {
+            mode "${streamingDisplay.mode}"
+            scale ${toString streamingDisplay.niriScale}
+            position ${streamingDisplay.niriPosition}
+        }
+      '';
 
+  # Hyprland monitor strings, with the virtual panel appended when enabled.
   hyprlandMonitors =
     (if gpuPassthru then
-      [
-        "DP-1, 2560x1080@144, 0x0, 1"
-        "HDMI-A-2, 1920x1080@60, -1920x0, 1"
-      ]
+      [ "DP-1, 2560x1080@144, 0x0, 1" "HDMI-A-2, 1920x1080@60, -1920x0, 1" ]
     else
-      [
-        "DP-3, 2560x1080@144, 0x0, 1"
-        "DP-4, 1920x1080@144, 0x-1080, 1"
-        "HDMI-A-3, 1920x1080@60, -1920x0, 1"
-      ])
-    ++ lib.optional streamingDisplay virtualOutputHyprland;
+      [ "DP-3, 2560x1080@144, 0x0, 1" "DP-4, 1920x1080@144, 0x-1080, 1" "HDMI-A-3, 1920x1080@60, -1920x0, 1" ])
+    ++ lib.optional streamingDisplay.enable "${streamingDisplay.connector}, ${streamingDisplay.mode}, 7680x0, ${toString streamingDisplay.niriScale}";
 
   hyprlandWorkspaces =
     if gpuPassthru then
-      [
-        "1, monitor:DP-1, default:true"
-        "2, monitor:DP-1"
-        "3, monitor:DP-1"
-        "4, monitor:HDMI-A-2, default:true"
-        "5, monitor:HDMI-A-2"
-        "6, monitor:HDMI-A-2"
-      ]
+      [ "1, monitor:DP-1, default:true" "2, monitor:DP-1" "3, monitor:DP-1"
+        "4, monitor:HDMI-A-2, default:true" "5, monitor:HDMI-A-2" "6, monitor:HDMI-A-2" ]
     else
-      [
-        "1, monitor:DP-3, default:true"
-        "2, monitor:DP-3"
-        "3, monitor:DP-3"
-        "4, monitor:HDMI-A-3, default:true"
-        "5, monitor:HDMI-A-3"
-        "6, monitor:HDMI-A-3"
-        "7, monitor:DP-4"
-        "8, monitor:DP-4"
-        "9, monitor:DP-4"
-      ];
+      [ "1, monitor:DP-3, default:true" "2, monitor:DP-3" "3, monitor:DP-3"
+        "4, monitor:HDMI-A-3, default:true" "5, monitor:HDMI-A-3" "6, monitor:HDMI-A-3"
+        "7, monitor:DP-4" "8, monitor:DP-4" "9, monitor:DP-4" ];
 in
 {
   chiasson.desktop.niri.extraSettings = {
@@ -103,10 +75,7 @@ in
   };
 
   chiasson.desktop.niri.extraBinds."XF86Tools".spawn = [
-    "wpctl"
-    "set-mute"
-    "@DEFAULT_AUDIO_SOURCE@"
-    "toggle"
+    "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle"
   ];
 
   chiasson.desktop.hyprland.settings = lib.mkIf config.chiasson.desktop.hyprland.enable {

modules/hosts/14900k/_private/media-disk.nix

@@ -1,9 +1,5 @@
 # Extra local disks. Declared here, not in hardware.nix (hardware.nix is generated).
 { config, lib, ... }:
-let
-  # Stable UID so NTFS `uid=` matches `users.users.olivier` (override if your account is not 1000).
-  olivierUid = config.users.users.olivier.uid or 1000;
-in
 {
   users.users.olivier.uid = lib.mkDefault 1000;
   # LABEL="MediaLibrary" (btrfs on sda1 by UUID). No subvol=@ — this disk has no @ subvolume.
@@ -33,15 +29,4 @@ in
   # LABEL="Deep Storage Unit". Owner olivier, group nfsmedia (990) so:
   # - local logins write as user 1000 (owner rwx);
   # - NFS (all_squash → uid/gid 990) matches group 990 → rwx (see jellyfin-nfs-export).
-  #fileSystems."/mnt/test" = {
-  #  device = "/dev/disk/by-uuid/BC12E55E12E51DE0";
-  #  fsType = "ntfs-3g";
-  #  options = [
-  #    "rw"
-  #    "force"
-  #    "uid=${toString olivierUid}"
-  #    "gid=990"
-  #    "umask=0002"
-  #  ];
-  #};
 }

modules/hosts/14900k/_private/streaming-display.nix

@@ -1,14 +1,12 @@
 # Headless 4K virtual output for Sunshine → Moonlight on a client TV.
 #
-# NVIDIA proprietary driver: both kernel params are required —
+# NVIDIA: force-enable a spare DRM connector with a custom EDID via kernel params:
 #   video=<connector>:e              force-enables the connector
 #   drm.edid_firmware=<connector>:…  loads modes from the EDID blob
 #
-# Pick a connector that is disconnected on the host (check after boot):
-#   grep -H . /sys/class/drm/card*-*/status
-#
-# Reboot after changing connector or EDID. 4K@60 is realistic on RTX 2070;
-# 4K@120 on a sink-less connector needs driver patches (see NVIDIA issue #1184).
+# Capture is pinned to the connector by name (Sunshine `output_name`), which is
+# stable across reboots/hotplug — unlike a numeric monitor index.
+# Reboot after changing connector or EDID. 4K@60 is realistic on RTX 2070.
 { config, lib, pkgs, ... }:
 let
   cfg = config.chiasson.system.streamingDisplay;
@@ -16,14 +14,13 @@ let
   edidFirmware = pkgs.runCommand "sunshine-virtual-4k-edid" {
     nativeBuildInputs = [ pkgs.python3 ];
   } ''
-    ${pkgs.python3}/bin/python3 ${./generate-virtual-edid.py} $TMPDIR/${cfg.edidFileName}
     mkdir -p $out/lib/firmware/edid
-    cp $TMPDIR/${cfg.edidFileName} $out/lib/firmware/edid/${cfg.edidFileName}
+    ${pkgs.python3}/bin/python3 ${./generate-virtual-edid.py} $out/lib/firmware/edid/${cfg.edidFileName}
   '';
 
-  # Sunshine 2025.924 wlr capture only accepts a numeric monitor index (not "DP-2").
-  # If the index drifts after hotplug, check:
-  #   journalctl --user -u sunshine -b | rg 'Monitor [0-9]+ is'
+  # On stream start: scale + focus the virtual 4K output so streamed windows
+  # land there. Capture is pinned to the connector via Sunshine `output_name`,
+  # so no fragile numeric-index detection is needed.
   streamDisplayUp = pkgs.writeShellScriptBin "stream-display-up" ''
     ${pkgs.niri}/bin/niri msg output ${cfg.connector} scale ${toString cfg.niriScale}
     ${pkgs.niri}/bin/niri msg action focus-monitor ${cfg.connector}
@@ -87,18 +84,6 @@ in
       default = "DP-3";
       description = "Niri monitor to refocus when a Moonlight session ends.";
     };
-
-    sunshineOutputIndex = lib.mkOption {
-      type = lib.types.str;
-      default = "3";
-      example = "3";
-      description = ''
-        Wayland/wlr monitor index for Sunshine `output_name`. Sunshine 2025.924 ignores
-        connector strings like `DP-2` and falls back to monitor 0 (your primary).
-        Find the index with:
-        `journalctl --user -u sunshine -b | rg "Monitor [0-9]+ is ${cfg.connector}"`
-      '';
-    };
   };
 
   config = lib.mkIf cfg.enable (lib.mkMerge [
@@ -118,7 +103,11 @@ in
     (lib.mkIf config.chiasson.system.gaming.sunshine.enable {
       services.sunshine.settings = {
         capture = "wlr";
-        output_name = cfg.sunshineOutputIndex;
+        # Pin capture to the virtual display by connector name (stable across
+        # reboots/hotplug). A numeric index drifted to the ultrawide before.
+        output_name = cfg.connector;
+        # RTX 2070 has no AV1 NVENC; avoid probing av1_nvenc.
+        encoder = "hevc_nvenc,h264_nvenc";
         global_prep_cmd = "[{\"do\":\"${streamDisplayUp}/bin/stream-display-up\",\"undo\":\"${streamDisplayDown}/bin/stream-display-down\"}]";
       };
     })

modules/hosts/14900k/default.nix

@@ -4,8 +4,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "14900k";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules."14900kConfiguration"

modules/hosts/14900k/home.nix

@@ -22,6 +22,14 @@
               spotify.openDiscoveryFirewall = true;
               pokeclicker.enable = true;
             };
+
+            editors.vscode = {
+              enable = true;
+              extensions = with pkgs.vscode-extensions; [
+                alefragnani.project-manager
+                johnpapa.vscode-peacock
+              ];
+            };
           };
         }
       ];

modules/hosts/ideapad/configuration.nix

@@ -42,12 +42,7 @@
       # rebuilds Mobile NixOS' script-loader against the patched mruby.
       chiasson.system.ideapadMrubyOverlay.enable = true;
 
-      # Wi-Fi modem (qcom-wcn3990) + Bluetooth (QCA crnv32) need binary blobs.
-      nixpkgs.config.allowUnfreePredicate =
-        pkg: builtins.elem (lib.getName pkg) [
-          "chromeos-sc7180-unredistributable-firmware"
-          "chromeos-sc7180-unredistributable-firmware-zstd"
-        ];
+      # Wi-Fi modem (qcom-wcn3990) + Bluetooth (QCA crnv32) need binary blobs
       hardware.firmware = [ pkgs.chromeos-sc7180-unredistributable-firmware ];
       hardware.enableRedistributableFirmware = true;
 

modules/hosts/ideapad/default.nix

@@ -4,8 +4,6 @@
     system = "aarch64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "ideapad";
-      system = "aarch64-linux";
     };
     modules = [
       self.nixosModules.ideapadConfiguration

modules/hosts/nix-server/_services/nixdesk-nfs-client.nix

@@ -1,35 +0,0 @@
-# NFS mounts of nixdesk (14900k) bulk storage for nix-server. Exports live in
-#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
-#
-# Jellyfin library paths (see also services/jellyfin.nix):
-#   Movies → /mnt/nixdesk-jellyfin/movies
-#   Shows  → /mnt/nixdesk-jellyfin/tv
-#
-# If you see "Stale file handle" under /mnt after changing exports or fsid on nixdesk, drop the
-# old client mount and let automount reattach, e.g.:
-#   sudo umount -l /mnt/nixdesk-jellyfin
-#   ls /mnt/nixdesk-jellyfin
-# (or reboot nix-server.)
-{ ... }:
-let
-  nfsExportHost = "192.168.2.25";
-  # nfsvers+tcp: predictable Linux↔Linux; lookupcache=none: fewer stale dentries after export changes.
-  nfsClientOpts = [
-    "rw"
-    "noatime"
-    "nofail"
-    "_netdev"
-    "nfsvers=3"
-    "tcp"
-    "lookupcache=none"
-    "x-systemd.automount"
-    "x-systemd.idle-timeout=3600"
-  ];
-in
-{
-  fileSystems."/mnt/nixdesk-jellyfin" = {
-    device = "${nfsExportHost}:/mnt/deep/jellyfin";
-    fsType = "nfs";
-    options = nfsClientOpts;
-  };
-}

modules/hosts/nix-server/default.nix

@@ -3,8 +3,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "nix-server";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.nix-serverConfiguration

modules/hosts/r5500/_services/nixdesk-nfs-client.nix

@@ -1,28 +0,0 @@
-# NFS mounts of nixdesk (14900k) bulk storage for r5500. Exports live in
-#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
-#
-# Jellyfin library paths:
-#   Movies → /mnt/nixdesk-jellyfin/movies
-#   Shows  → /mnt/nixdesk-jellyfin/tv
-{ ... }:
-let
-  nfsExportHost = "192.168.2.25";
-  nfsClientOpts = [
-    "rw"
-    "noatime"
-    "nofail"
-    "_netdev"
-    "nfsvers=3"
-    "tcp"
-    "lookupcache=none"
-    "x-systemd.automount"
-    "x-systemd.idle-timeout=3600"
-  ];
-in
-{
-  fileSystems."/mnt/nixdesk-jellyfin" = {
-    device = "${nfsExportHost}:/mnt/deep/jellyfin";
-    fsType = "nfs";
-    options = nfsClientOpts;
-  };
-}

modules/hosts/r5500/configuration.nix

@@ -17,7 +17,7 @@
         ./_private/media-disk.nix
         ./_private/media-paths.nix
         ./_services/docker-media.nix
-        ./_services/nixdesk-nfs-client.nix
+        self.nixosModules.nixdeskJellyfin
         ./_services/jellyfin.nix
         ./_services/sonarr.nix
         ./_services/radarr.nix

modules/hosts/r5500/default.nix

@@ -3,8 +3,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "r5500";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.r5500Configuration

modules/hosts/t2mbp/default.nix

@@ -4,8 +4,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "t2mbp";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.t2mbpConfiguration

modules/hosts/t2mbp/home.nix

@@ -1,7 +1,7 @@
 { self, inputs, ... }:
 {
   flake.nixosModules.t2mbpHome =
-    { self, ... }:
+    { self, pkgs, ... }:
     {
       imports = [ self.nixosModules.desktopHomeBase ];
 
@@ -14,6 +14,14 @@
               discord.enable = true;
               pokeclicker.enable = true;
             };
+
+            editors.vscode = {
+              enable = true;
+              extensions = with pkgs.vscode-extensions; [
+                alefragnani.project-manager
+                johnpapa.vscode-peacock
+              ];
+            };
           };
         }
       ];

modules/hosts/uConsole/default.nix

@@ -4,8 +4,6 @@
     specialArgs = inputs // {
       inherit self;
       inputs = inputs;
-      host = "uConsole";
-      system = "aarch64-linux";
     };
     trustCaches = false;
     modules = [

modules/hosts/uConsole/home.nix

@@ -1,13 +1,21 @@
 { self, inputs, ... }:
 {
   flake.nixosModules.uConsoleHome =
-    { self, ... }:
+    { self, pkgs, ... }:
     {
       imports = [ self.nixosModules.desktopHomeBase ];
 
       chiasson.users.extraModules.olivier = [
         {
           chiasson.home.hardware.uconsoleGamepad.enable = true;
+
+          chiasson.home.editors.vscode = {
+            enable = true;
+            extensions = with pkgs.vscode-extensions; [
+              alefragnani.project-manager
+              johnpapa.vscode-peacock
+            ];
+          };
         }
       ];
     };

modules/system/gaming.nix

@@ -17,10 +17,9 @@
         ++ lib.optionals pkgs.stdenv.isx86_64 [ heroic ];
 
       steamExtraPkgs =
-        if !cfg.steam.steamTinkerLaunch.enable then
-          [ ]
-        else
-          lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.steamtinkerlaunch) pkgs.steamtinkerlaunch;
+        lib.optional (cfg.steam.steamTinkerLaunch.enable && lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.steamtinkerlaunch) pkgs.steamtinkerlaunch;
+
+      launcherSet = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
     in
     {
       options.chiasson.system.gaming = {
@@ -194,11 +193,11 @@
           ];
         }
         (lib.mkIf (cfg.launchers.forUsers == null) {
-          environment.systemPackages = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
+          environment.systemPackages = launcherSet;
         })
         (lib.mkIf (cfg.launchers.forUsers != null) {
           users.users = lib.genAttrs cfg.launchers.forUsers (_: {
-            packages = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
+            packages = launcherSet;
           });
         })
       ]);

modules/system/nfs/default.nix

@@ -0,0 +1,38 @@
+# NFS mount of nixdesk (14900k) bulk storage for clients. Exports live in
+#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
+#
+# Jellyfin library paths (see also jellyfin.nix):
+#   Movies → /mnt/nixdesk-jellyfin/movies
+#   Shows  → /mnt/nixdesk-jellyfin/tv
+#
+# If you see "Stale file handle" under /mnt after changing exports or fsid on nixdesk, drop the
+# old client mount and let automount reattach, e.g.:
+#   sudo umount -l /mnt/nixdesk-jellyfin
+#   ls /mnt/nixdesk-jellyfin
+{ ... }:
+{
+  flake.nixosModules.nixdeskJellyfin =
+    { lib, ... }:
+    let
+      nfsExportHost = "192.168.2.25";
+      # nfsvers+tcp: predictable Linux↔Linux; lookupcache=none: fewer stale dentries after export changes.
+      nfsClientOpts = [
+        "rw"
+        "noatime"
+        "nofail"
+        "_netdev"
+        "nfsvers=3"
+        "tcp"
+        "lookupcache=none"
+        "x-systemd.automount"
+        "x-systemd.idle-timeout=3600"
+      ];
+    in
+    {
+      fileSystems."/mnt/nixdesk-jellyfin" = {
+        device = "${nfsExportHost}:/mnt/deep/jellyfin";
+        fsType = "nfs";
+        options = nfsClientOpts;
+      };
+    };
+}

modules/wisdom/apps/localsend.nix

@@ -1,4 +1,4 @@
-{ ... }: {
+{ self, ... }: {
   flake.nixosModules.systemLocalsend =
     { config, lib, ... }:
     let
@@ -19,25 +19,10 @@
       };
     };
 
-  flake.homeManagerModules.wisdomAppsLocalsend =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.apps.localsend;
-    in
-    {
-      options.chiasson.home.apps.localsend = {
-        enable = lib.mkEnableOption ''
-          LocalSend client; open the firewall on NixOS with `system.localsend` if you want inbound.
-        '' // {
+  flake.homeManagerModules.wisdomAppsLocalsend = self.lib.wisdomSlice {
+    path = "apps.localsend";
     default = true;
-        };
-
-        package = lib.mkPackageOption pkgs "localsend" { };
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [ cfg.package ];
-      };
+    description = "LocalSend client; open the firewall on NixOS with `system.localsend` if you want inbound.";
+    packages = pkgs: [ pkgs.localsend ];
   };
 }

modules/wisdom/apps/pokeclicker/default.nix

@@ -1,18 +1,8 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomAppsPokeclicker =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.apps.pokeclicker;
-      pokeclickerPkg = pkgs.callPackage ./package { };
-    in
-    {
-      options.chiasson.home.apps.pokeclicker.enable = lib.mkEnableOption "PokéClicker desktop (Farigh fork .deb → nix)." // {
+{ self, ... }: {
+  flake.homeManagerModules.wisdomAppsPokeclicker = self.lib.wisdomSlice {
+    path = "apps.pokeclicker";
     default = false;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [ pokeclickerPkg ];
-      };
+    description = "PokéClicker desktop (Farigh fork .deb → nix).";
+    packages = pkgs: [ (pkgs.callPackage ./package { }) ];
   };
 }

modules/wisdom/browsers/chrome.nix

@@ -1,21 +1,8 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomBrowsersChrome =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.browsers.chrome;
-    in
-    {
-      options.chiasson.home.browsers.chrome.enable = lib.mkEnableOption ''
-        Chrome (unfree, needs `allowUnfree`); skipped if nixpkgs has no build for this platform.
-      '' // {
+{ self, ... }: {
+  flake.homeManagerModules.wisdomBrowsersChrome = self.lib.wisdomSlice {
+    path = "browsers.chrome";
     default = false;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.google-chrome
-        ) pkgs.google-chrome;
-      };
+    description = "Chrome (unfree, needs `allowUnfree`); skipped if nixpkgs has no build for this platform.";
+    packages = pkgs: [ pkgs.google-chrome ];
   };
 }

modules/wisdom/browsers/chromium-hevc.nix

@@ -5,25 +5,43 @@
       cfg = config.chiasson.system.chromiumHevc;
     in
     {
-      options.chiasson.system.chromiumHevc.enable = lib.mkEnableOption ''
+      options.chiasson.system.chromiumHevc = {
+        enable = lib.mkEnableOption ''
           VA-API packages for Chromium HEVC (Intel iHD + optional NVIDIA nvidia-vaapi-driver).
           Pair with `wisdomBrowsersChromiumHevc` on the user side.
         '';
 
+        gpu = lib.mkOption {
+          type = lib.types.enum [
+            "intel"
+            "nvidia"
+          ];
+          default = "intel";
+          description = ''
+            VA-API stack for the `*-hevc` browser launchers. Use **intel** for Jellyfin
+            (Chromium + nvidia-vaapi-driver is unsupported upstream and fails with
+            `failed Initialize()ing the frame pool` in Jellyfin). **nvidia** adds the
+            nvidia-vaapi-driver and keep renderD129 + VaapiOnNvidiaGPUs for experiments only.
+          '';
+        };
+      };
+
       config = lib.mkIf cfg.enable {
         hardware.graphics.enable = lib.mkDefault true;
         hardware.graphics.extraPackages = lib.mkAfter (
-          with pkgs;
-          [ nvidia-vaapi-driver ]
+          lib.optionals (cfg.gpu == "nvidia") [
+            pkgs.nvidia-vaapi-driver
+          ]
         );
       };
     };
 
   flake.homeManagerModules.wisdomBrowsersChromiumHevc =
-    { config, lib, pkgs, ... }:
+    { config, lib, pkgs, osConfig ? { }, ... }:
     let
       root = config.chiasson.home;
       cfg = config.chiasson.home.browsers.chromiumHevc;
+      gpu = lib.attrByPath [ "chiasson" "system" "chromiumHevc" "gpu" ] "intel" osConfig;
 
       browserCatalog = {
         "google-chrome" = {
@@ -53,7 +71,6 @@
         intel = {
           driver = "iHD";
           drmDevice = "/dev/dri/renderD128";
-          nvdBackend = "direct";
           enableFeatures = [
             "VaapiVideoDecodeLinuxGL"
             "VaapiVideoDecoder"
@@ -69,7 +86,6 @@
         nvidia = {
           driver = "nvidia";
           drmDevice = "/dev/dri/renderD129";
-          nvdBackend = "direct";
           enableFeatures = [
             "VaapiVideoDecoder"
             "VaapiIgnoreDriverChecks"
@@ -85,21 +101,17 @@
         };
       };
 
-      activeGpu = gpuProfiles.${cfg.vaapi.gpu};
-
-      mkChromiumHevc =
-        packageName:
-        let
-          spec = browserCatalog.${packageName};
-          browser = spec.package;
-          launcherName = spec.launcher;
+      activeGpu = gpuProfiles.${gpu};
       enableFeatures = lib.concatStringsSep "," activeGpu.enableFeatures;
       disableFeatures = lib.concatStringsSep "," activeGpu.disableFeatures;
-          desktopItem = pkgs.makeDesktopItem {
-            name = launcherName;
+
+      mkDesktopItem =
+        spec:
+        pkgs.makeDesktopItem {
+          name = spec.launcher;
           desktopName = spec.desktopName;
           genericName = "Web Browser";
-            exec = "${launcherName} %U";
+          exec = "${spec.launcher} %U";
           icon = spec.icon;
           categories = [
             "Network"
@@ -113,6 +125,14 @@
             "x-scheme-handler/https"
           ];
         };
+
+      mkChromiumHevc =
+        packageName:
+        let
+          spec = browserCatalog.${packageName};
+          browser = spec.package;
+          launcherName = spec.launcher;
+          desktopItem = mkDesktopItem spec;
         in
         pkgs.runCommand launcherName
           {
@@ -126,7 +146,7 @@
             makeWrapper ${browser}/bin/${spec.binary} $out/bin/${launcherName} \
               --set LIBVA_DRIVER_NAME ${lib.escapeShellArg activeGpu.driver} \
               --set LIBVA_DRM_DEVICE ${lib.escapeShellArg activeGpu.drmDevice} \
-              --set NVD_BACKEND ${lib.escapeShellArg activeGpu.nvdBackend} \
+              --set NVD_BACKEND direct \
               --add-flags "--enable-features=${enableFeatures}" \
               --add-flags "--disable-features=${disableFeatures}" \
               ${lib.concatMapStringsSep " " (a: "--add-flags ${lib.escapeShellArg a}") cfg.extraCommandLineArgs}
@@ -136,50 +156,30 @@
           '';
 
       selectedPackages = lib.filter (
-        name:
-        let
-          spec = browserCatalog.${name};
-        in
-        lib.meta.availableOn pkgs.stdenv.hostPlatform spec.package
+        name: lib.meta.availableOn pkgs.stdenv.hostPlatform browserCatalog.${name}.package
       ) cfg.packages;
 
       wrappers = map mkChromiumHevc selectedPackages;
     in
     {
       options.chiasson.home.browsers.chromiumHevc = {
-        enable = lib.mkEnableOption ''
+        enable =
+          lib.mkEnableOption ''
             `google-chrome-hevc`: Chromium with VA-API HEVC for Jellyfin / MSE playback.
 
-          Default GPU is **Intel** (`vaapi.gpu = "intel"`): Chromium + NVIDIA VA-API is
-          unsupported upstream (`nvidia-vaapi-driver` README) and fails with
-          `failed Initialize()ing the frame pool` in Jellyfin.
-
+            GPU stack comes from `chiasson.system.chromiumHevc.gpu` (default **intel**).
             Requires `chiasson.system.chromiumHevc.enable` on NixOS.
-        '' // {
+          ''
+          // {
             default = true;
           };
 
         packages = lib.mkOption {
-          type = lib.types.listOf (
-            lib.types.enum (lib.attrNames browserCatalog)
-          );
+          type = lib.types.listOf (lib.types.enum (lib.attrNames browserCatalog));
           default = if pkgs.stdenv.hostPlatform.isAarch64 then [ "chromium" ] else [ "google-chrome" ];
           description = "Chromium-based browsers to wrap.";
         };
 
-        vaapi.gpu = lib.mkOption {
-          type = lib.types.enum [
-            "intel"
-            "nvidia"
-          ];
-          default = "intel";
-          description = ''
-            VA-API stack for `google-chrome-hevc`. Use **intel** for Jellyfin (Chromium +
-            nvidia-vaapi-driver is unsupported and hits frame-pool init errors). **nvidia**
-            keeps renderD129 + VaapiOnNvidiaGPUs for experiments only.
-          '';
-        };
-
         extraCommandLineArgs = lib.mkOption {
           type = lib.types.listOf lib.types.str;
           default = [ ];

modules/wisdom/browsers/edge.nix

@@ -1,19 +1,8 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomBrowsersEdge =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.browsers.edge;
-    in
-    {
-      options.chiasson.home.browsers.edge.enable = lib.mkEnableOption "Edge (unfree); skipped if unavailable on this platform." // {
+{ self, ... }: {
+  flake.homeManagerModules.wisdomBrowsersEdge = self.lib.wisdomSlice {
+    path = "browsers.edge";
     default = false;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.microsoft-edge
-        ) pkgs.microsoft-edge;
-      };
+    description = "Edge (unfree); skipped if unavailable on this platform.";
+    packages = pkgs: [ pkgs.microsoft-edge ];
   };
 }

modules/wisdom/browsers/flow.nix

@@ -1,11 +1,10 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomBrowsersFlow =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.browsers.flow;
-
-      flow-browser =
+{ self, ... }: {
+  flake.homeManagerModules.wisdomBrowsersFlow = self.lib.wisdomSlice {
+    path = "browsers.flow";
+    default = false;
+    description = "[Flow](https://github.com/MultiboxLabs/flow-browser) — upstream AppImage wrapped for NixOS.";
+    packages =
+      pkgs:
       let
         pname = "flow-browser";
         version = "0.11.0";
@@ -25,7 +24,8 @@
 
         appimageContents = pkgs.appimageTools.extractType2 { inherit pname version src; };
       in
-        pkgs.appimageTools.wrapType2 {
+      [
+        (pkgs.appimageTools.wrapType2 {
           inherit pname version src;
 
           nativeBuildInputs = [ pkgs.makeWrapper ];
@@ -45,25 +45,13 @@
           meta = {
             description = "Chromium-based browser (upstream AppImage)";
             homepage = "https://github.com/MultiboxLabs/flow-browser";
-            license = lib.licenses.gpl3Plus;
-            sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+            license = pkgs.lib.licenses.gpl3Plus;
+            sourceProvenance = with pkgs.lib.sourceTypes; [ binaryNativeCode ];
             platforms = [ "x86_64-linux" "aarch64-linux" ];
             mainProgram = pname;
             maintainers = [ ];
           };
-        };
-    in
-    {
-      options.chiasson.home.browsers.flow.enable = lib.mkEnableOption ''
-        [Flow](https://github.com/MultiboxLabs/flow-browser) — upstream AppImage wrapped for NixOS.
-      '' // {
-        default = false;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform flow-browser
-        ) flow-browser;
-      };
+        })
+      ];
   };
 }

modules/wisdom/default.nix

@@ -1,22 +1,21 @@
 # HM side of the flake; option tree is `chiasson.home.*` (docs/conventions.md).
 { self, inputs, ... }: {
-  # Root module: chiasson.home.enable + bash. Other `wisdom*` slices auto-wire via
-  # `lib.wisdomCatalogExtraModules`; hosts flip `chiasson.home.*.enable` rather than re-importing.
+  # Root module: chiasson.home.enable + git identity. Other `wisdom*` slices (including
+  # the bash shell) auto-wire via `lib.wisdomCatalogExtraModules`; hosts flip
+  # `chiasson.home.*.enable` rather than re-importing.
   flake.homeManagerModules.wisdom =
     { config, lib, pkgs, ... }:
     let
       cfg = config.chiasson.home;
     in
     {
-      imports = [
-        self.homeManagerModules.wisdomShellBash
-      ];
-
       options.chiasson.home = {
-        enable = lib.mkEnableOption ''
+        enable =
+          lib.mkEnableOption ''
             HM profile root for this flake (bash on by default). Desktop hosts use
             `lib.wisdomCatalogExtraModules` once per user and flip `chiasson.home.*.enable` on the host.
-        '' // {
+          ''
+          // {
             default = true;
           };
 
@@ -29,7 +28,8 @@
         };
       };
 
-      config = lib.mkIf cfg.enable (lib.mkMerge [
+      config = lib.mkIf cfg.enable (
+        lib.mkMerge [
           { home.packages = cfg.extraPackages; }
 
           # Base git identity + encryption/player tools shared by every HM user.
@@ -41,8 +41,12 @@
                 email = "olivierchiasson@hotmail.fr";
               };
             };
-          home.packages = [ pkgs.git-crypt pkgs.feishin ];
+            home.packages = [
+              pkgs.git-crypt
+              pkgs.feishin
+            ];
           }
-      ]);
+        ]
+      );
     };
 }

modules/wisdom/editors/kate.nix

@@ -1,19 +1,8 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomEditorsKate =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.editors.kate;
-    in
-    {
-      options.chiasson.home.editors.kate.enable = lib.mkEnableOption "Kate." // {
+{ self, ... }: {
+  flake.homeManagerModules.wisdomEditorsKate = self.lib.wisdomSlice {
+    path = "editors.kate";
     default = false;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.kdePackages.kate
-        ) pkgs.kdePackages.kate;
-      };
+    description = "Kate.";
+    packages = pkgs: [ pkgs.kdePackages.kate ];
   };
 }

modules/wisdom/editors/obsidian.nix

@@ -1,21 +1,8 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomEditorsObsidian =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.editors.obsidian;
-    in
-    {
-      options.chiasson.home.editors.obsidian.enable = lib.mkEnableOption ''
-        Obsidian (unfree); skipped if unavailable here.
-      '' // {
+{ self, ... }: {
+  flake.homeManagerModules.wisdomEditorsObsidian = self.lib.wisdomSlice {
+    path = "editors.obsidian";
     default = true;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.obsidian
-        ) pkgs.obsidian;
-      };
+    description = "Obsidian (unfree); skipped if unavailable here.";
+    packages = pkgs: [ pkgs.obsidian ];
   };
 }

modules/wisdom/editors/vscode.nix

@@ -0,0 +1,100 @@
+# Visual Studio Code (Microsoft build, unfree). Default extensions + settings shared by all
+# hosts; per-host extras (peacock, comment-anchors, project-manager) go via
+# `chiasson.home.editors.vscode.extensions`.
+{ self, ... }: {
+  flake.homeManagerModules.wisdomEditorsVscode =
+    { config, lib, pkgs, ... }:
+    let
+      root = config.chiasson.home;
+      cfg = config.chiasson.home.editors.vscode;
+
+      defaultExtensions = with pkgs.vscode-extensions; [
+        jnoortheen.nix-ide
+        yzhang.markdown-all-in-one
+        esbenp.prettier-vscode
+        vscjava.vscode-java-pack
+        redhat.java
+      ];
+
+      # Wrap VS Code so a JDK is on PATH — the Red Hat Java language server (and
+      # other extension-bundled JVMs) need `java` to run, independent of the
+      # per-project `java.configuration.runtimes` setting.
+      vscodeWithJdk = pkgs.symlinkJoin {
+        name = "vscode-with-jdk";
+        paths = [ pkgs.vscode ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        postBuild = ''
+          wrapProgram "$out/bin/code" \
+            --prefix PATH : "${pkgs.jdk25}/bin"
+        '';
+      };
+
+      coreSettings = {
+        "nix.enableLanguageServer" = true;
+        "nix.serverPath" = "nixd";
+        "nix.serverSettings" = {
+          nixd = {
+            formatting = {
+              command = "nixfmt";
+            };
+          };
+        };
+        "diffEditor.ignoreTrimWhitespace" = false;
+        "chat.disableAIFeatures" = true;
+
+        "java.configuration.runtimes" = [
+          {
+            name = "JavaSE-21";
+            path = "${pkgs.jdk21}/lib/openjdk";
+          }
+          {
+            name = "JavaSE-25";
+            path = "${pkgs.jdk25}/lib/openjdk";
+            default = true;
+          }
+        ];
+      };
+
+      # Seed a *writable* settings.json (not a store symlink) so extensions like
+      # kilo-code can edit it at runtime. `force = false` in the config means HM
+      # only writes it when absent, preserving kilo's later edits across `switch`.
+      settingsJson = pkgs.writeText "vscode-user-settings" (
+        builtins.toJSON coreSettings
+      );
+    in
+    {
+      options.chiasson.home.editors.vscode = {
+        enable = lib.mkEnableOption ''
+          Visual Studio Code (Microsoft build; needs `nixpkgs.config.allowUnfree`). Core
+          extensions (nix-ide, markdown-all-in-one, prettier) + nixd/nixfmt settings are included.
+        '' // {
+          default = false;
+        };
+
+        extensions = lib.mkOption {
+          type = lib.types.listOf lib.types.package;
+          default = [ ];
+          description = ''
+            Extra extensions not wanted on every host (e.g. peacock, comment-anchors,
+            project-manager). Per-host via `chiasson.users.extraModules`.
+          '';
+        };
+      };
+
+      config = lib.mkIf (root.enable && cfg.enable) {
+        home.packages = [ ];
+
+        # Writable, seed-once user settings (kilo-code can append to it).
+        home.file.".config/Code/User/settings.json" = {
+          source = settingsJson;
+          force = false;
+        };
+
+        programs.vscode = {
+          enable = true;
+          package = vscodeWithJdk;
+          extensions = defaultExtensions ++ cfg.extensions;
+        };
+      };
+    };
+  }