docs: update README with feature overview and module structure

Add Java extension support and configure multiple JDK runtimes.
Introduce a wrapped VS Code package that includes JDK 25 in the PATH
to support the Red Hat Java language server.

Switch from using `programs.vscode.userSettings` to a manually managed
`settings.json` file via `home.file`. This allows the settings file to
be writable by external tools like `kilo-code` at runtime while
preserving them across Nix configuration switches by using `force = false`.

docs/README.md

@@ -17,16 +17,26 @@ How to work on it: [conventions.md](./conventions.md).
 
 Each machine: `modules/hosts/<name>/default.nix` → `nixosConfigurations.<name>`, real config in `*Configuration` + optional `_private/` and `_services/`.
 
+## Features at a glance
+
+- **Users catalog** — one catalog in `modules/system/users.nix`, pick who exists on a host with `chiasson.users.enabled = [ "example" ]`, override per host. Home Manager wires itself from the same list.
+- **SSH + Bitwarden (rbw) keys** — one ed25519 keypair per catalog user, private key in Bitwarden, public key in `modules/ssh/inventory.nix`. Outbound SSH uses a `.pub` filter against the rbw agent; inbound `authorized_keys` are generated from the same inventory. [Full wiring in conventions.md](./conventions.md#ssh-model).
+- **Wisdom modules** — Home Manager slices in `modules/wisdom/` auto-catalog via `lib.wisdomCatalogExtraModules` (defined in `modules/desktop/options.nix`). The baseline `wisdom` module handles git identity + shared tools; all other `wisdom*` exports are pulled in once per user through `desktopHomeBase` → `chiasson.users.extraModules.olivier`. Hosts only flip `chiasson.home.<category>.<slice>.enable` — no manual imports in `home.nix`. Categories include `apps` (spotify, discord, localsend), `browsers` (chrome, edge, zen, …), `editors` (cursor, vscode, obsidian, …), `shells` (bash, fish, oh-my-posh, yazi), `desktop` (gtk-qt-theming, screenshot), and `terminals` (kitty). Trivial single-package slices can be written with the `lib.wisdomSlice` helper instead of repeating the `root`/`cfg` + `mkIf` boilerplate.
+- **Wallpapers from a dedicated repo** — `modules/desktop/wallpapers.nix` pins `inputs.wallpapers` into the store and exposes it as `CHIASSON_NIX_WALLPAPERS` and `/etc/wallpapers`. Override `chiasson.desktop.wallpapers.source` if needed.
+- **Private host data** — import-tree skips `_private/` globally, so machine-only files (firmware quirks, display configs, service tweaks) live next to the host module without leaking elsewhere.
+
 ## Deploy / rebuild
 
-Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops).
+Remote builds use the `builder` user (`systemDeployBuilder`, wired through `client-services` on desktops/laptops/tablets).
 
 Fleet deploy is [Navi](https://github.com/cafkafk/navi) — config in `modules/deploy/navi.nix`, outputs `flake.navi` / `flake.naviHive`.
 
 ```bash
-nix develop          # devShell has navi + hints
+nix develop          # devShell has navi + just + hints
+just                  # list local helpers like `sync-dms`
 navi apply --on <host>
 navi apply-local --node 14900k --sudo   # this machine, if hostname matches
+navi tui                  # interactive fleet dashboard
 ```
 
 Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
@@ -37,11 +47,11 @@ Plain rebuild still works: `sudo nixos-rebuild switch --flake .#<host>`.
 modules/
   hosts/<host>/     # per-machine composition
   system/           # nixosModules.system aggregate
-  desktop/          # GUI stack
+  desktop/          # GUI stack (niri, hyprland, plasma, DMS)
   wisdom/           # HM modules (exports still named wisdom*)
   ssh/              # inbound NixOS + outbound HM
   deploy/           # navi hive
-  lib/              # pure helpers → flake.lib
+  patches/          # one-off patches (yt-dlp, t2fanrd, …)
 ```
 
 Machine-only stuff lives in `hosts/<host>/_private/` — import-tree skips `_private/` globally, so those files only get pulled in where you import them.

docs/conventions.md

@@ -174,7 +174,7 @@ The integration block at the bottom of `modules/system/users.nix` turns the cata
 
 **New HM slice:** add `modules/wisdom/.../foo.nix` exporting `flake.homeManagerModules.wisdomFoo` (import-tree picks it up; `wisdomCatalogExtraModules` includes every `wisdom*` export). Every `wisdom*` slice auto-catalogs — including the bash shell — so the root module no longer manually `imports` it. Gate packages on `chiasson.home.*.enable`, and set the slice's own `enable` default with `mkEnableOption "…" // { default = true/false }` in that same module — defaults live with the option that owns them, not in a shared defaults file. Hosts flip toggles in `home.nix`. Upstream HM deps stay imported unconditionally — use `mkIf` on `cfg.enable` for config (never `config`-dependent `imports`; that recurses).
 
-**Trivial single-package slice:** use `self.lib.wisdomSimpleSlice { path = "a.b"; default = true/false; description = "…"; packages = pkgs: [ … ]; }` instead of the `root`/`cfg` + `mkIf (root.enable && cfg.enable)` boilerplate. `packages` is a `pkgs -> [ drv ]` function responsible for its own `availableOn`/platform gating. Several such slices may share one `simple.nix` in their category dir (each still exporting its own `wisdom*` module), rather than one file per slice.
+**Trivial single-package slice:** use `self.lib.wisdomSlice { path = "a.b"; default = true/false; description = "…"; packages = pkgs: [ … ]; }` instead of the `root`/`cfg` + `mkIf (root.enable && cfg.enable)` boilerplate. `packages` is a `pkgs -> [ drv ]` function responsible for its own `availableOn`/platform gating. Several such slices may share one `simple.nix` in their category dir (each still exporting its own `wisdom*` module), rather than one file per slice.
 
 **Derivations:** `let` inside a fragment, or `flake.packages` / `flake.lib` — not a bare `mkDerivation` file import-tree will try to load.
 

modules/desktop/options.nix

@@ -11,7 +11,7 @@
     in
     map (name: self.homeManagerModules.${name}) names;
 
-  flake.lib.wisdomSimpleSlice =
+  flake.lib.wisdomSlice =
     { path, default, description, packages }:
     { config, lib, pkgs, ... }:
     let

modules/hosts/14900k/_private/displays.nix

@@ -1,25 +1,15 @@
 # Monitor layout for 14900k.
-# NVIDIA (default): DP-3 ultrawide, HDMI-A-3 + DP-4 side/top stack; DP-2 virtual 4K when streamingDisplay enabled.
-# Intel iGPU (gpu passthru): DP-1 ultrawide, HDMI-A-2 Samsung to the left.
-# Niri: `extraSettings` (KDL via `extraConfig`, other wrapper-modules keys) + `extraBinds` (merged keybinds).
-# Hyprland: `chiasson.desktop.hyprland.settings` (merged in HM when `chiasson.desktop.hyprland.enable`).
+# NVIDIA (default): DP-3 ultrawide, HDMI-A-3 + DP-4 stack; DP-2 virtual 4K when streamingDisplay is on.
+# Intel iGPU (gpu passthru): DP-1 ultrawide, HDMI-A-2 to the left.
+# Niri uses `extraSettings.extraConfig`; Hyprland uses `chiasson.desktop.hyprland.settings`.
 
 #TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
 { config, lib, ... }:
 let
+  streamingDisplay = config.chiasson.system.streamingDisplay;
   gpuPassthru = config.chiasson.system.gpuPassthru.enable;
-  streamingDisplay = config.chiasson.system.streamingDisplay.enable or false;
-  streamingCfg = config.chiasson.system.streamingDisplay or { };
-
-  virtualOutputNiri =
-    lib.optionalString streamingDisplay ''
-      output "${streamingCfg.connector}" {
-          mode "${streamingCfg.mode}"
-          scale ${toString (streamingCfg.niriScale or 1.0)}
-          position ${streamingCfg.niriPosition}
-      }
-    '';
 
+  # Niri outputs: a static block per GPU layout, plus the optional virtual 4K panel.
   niriOutputs =
     (if gpuPassthru then
       ''
@@ -54,48 +44,30 @@ let
             position x=0 y=-1080
         }
       '')
-    + virtualOutputNiri;
-
-  virtualOutputHyprland =
-    lib.optionalString streamingDisplay
-      "${streamingCfg.connector}, ${streamingCfg.mode}, 7680x0, ${toString (streamingCfg.niriScale or 1.0)}";
+    + lib.optionalString streamingDisplay.enable ''
+        output "${streamingDisplay.connector}" {
+            mode "${streamingDisplay.mode}"
+            scale ${toString streamingDisplay.niriScale}
+            position ${streamingDisplay.niriPosition}
+        }
+      '';
 
+  # Hyprland monitor strings, with the virtual panel appended when enabled.
   hyprlandMonitors =
     (if gpuPassthru then
-      [
-        "DP-1, 2560x1080@144, 0x0, 1"
-        "HDMI-A-2, 1920x1080@60, -1920x0, 1"
-      ]
+      [ "DP-1, 2560x1080@144, 0x0, 1" "HDMI-A-2, 1920x1080@60, -1920x0, 1" ]
     else
-      [
-        "DP-3, 2560x1080@144, 0x0, 1"
-        "DP-4, 1920x1080@144, 0x-1080, 1"
-        "HDMI-A-3, 1920x1080@60, -1920x0, 1"
-      ])
-    ++ lib.optional streamingDisplay virtualOutputHyprland;
+      [ "DP-3, 2560x1080@144, 0x0, 1" "DP-4, 1920x1080@144, 0x-1080, 1" "HDMI-A-3, 1920x1080@60, -1920x0, 1" ])
+    ++ lib.optional streamingDisplay.enable "${streamingDisplay.connector}, ${streamingDisplay.mode}, 7680x0, ${toString streamingDisplay.niriScale}";
 
   hyprlandWorkspaces =
     if gpuPassthru then
-      [
-        "1, monitor:DP-1, default:true"
-        "2, monitor:DP-1"
-        "3, monitor:DP-1"
-        "4, monitor:HDMI-A-2, default:true"
-        "5, monitor:HDMI-A-2"
-        "6, monitor:HDMI-A-2"
-      ]
+      [ "1, monitor:DP-1, default:true" "2, monitor:DP-1" "3, monitor:DP-1"
+        "4, monitor:HDMI-A-2, default:true" "5, monitor:HDMI-A-2" "6, monitor:HDMI-A-2" ]
     else
-      [
-        "1, monitor:DP-3, default:true"
-        "2, monitor:DP-3"
-        "3, monitor:DP-3"
-        "4, monitor:HDMI-A-3, default:true"
-        "5, monitor:HDMI-A-3"
-        "6, monitor:HDMI-A-3"
-        "7, monitor:DP-4"
-        "8, monitor:DP-4"
-        "9, monitor:DP-4"
-      ];
+      [ "1, monitor:DP-3, default:true" "2, monitor:DP-3" "3, monitor:DP-3"
+        "4, monitor:HDMI-A-3, default:true" "5, monitor:HDMI-A-3" "6, monitor:HDMI-A-3"
+        "7, monitor:DP-4" "8, monitor:DP-4" "9, monitor:DP-4" ];
 in
 {
   chiasson.desktop.niri.extraSettings = {
@@ -103,10 +75,7 @@ in
   };
 
   chiasson.desktop.niri.extraBinds."XF86Tools".spawn = [
-    "wpctl"
-    "set-mute"
-    "@DEFAULT_AUDIO_SOURCE@"
-    "toggle"
+    "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle"
   ];
 
   chiasson.desktop.hyprland.settings = lib.mkIf config.chiasson.desktop.hyprland.enable {

modules/hosts/14900k/_private/media-disk.nix

@@ -1,9 +1,5 @@
 # Extra local disks. Declared here, not in hardware.nix (hardware.nix is generated).
 { config, lib, ... }:
-let
-  # Stable UID so NTFS `uid=` matches `users.users.olivier` (override if your account is not 1000).
-  olivierUid = config.users.users.olivier.uid or 1000;
-in
 {
   users.users.olivier.uid = lib.mkDefault 1000;
   # LABEL="MediaLibrary" (btrfs on sda1 by UUID). No subvol=@ — this disk has no @ subvolume.
@@ -33,15 +29,4 @@ in
   # LABEL="Deep Storage Unit". Owner olivier, group nfsmedia (990) so:
   # - local logins write as user 1000 (owner rwx);
   # - NFS (all_squash → uid/gid 990) matches group 990 → rwx (see jellyfin-nfs-export).
-  #fileSystems."/mnt/test" = {
-  #  device = "/dev/disk/by-uuid/BC12E55E12E51DE0";
-  #  fsType = "ntfs-3g";
-  #  options = [
-  #    "rw"
-  #    "force"
-  #    "uid=${toString olivierUid}"
-  #    "gid=990"
-  #    "umask=0002"
-  #  ];
-  #};
 }

modules/hosts/14900k/_private/streaming-display.nix

@@ -1,14 +1,12 @@
 # Headless 4K virtual output for Sunshine → Moonlight on a client TV.
 #
-# NVIDIA proprietary driver: both kernel params are required —
+# NVIDIA: force-enable a spare DRM connector with a custom EDID via kernel params:
 #   video=<connector>:e              force-enables the connector
 #   drm.edid_firmware=<connector>:…  loads modes from the EDID blob
 #
-# Pick a connector that is disconnected on the host (check after boot):
-#   grep -H . /sys/class/drm/card*-*/status
-#
-# Reboot after changing connector or EDID. 4K@60 is realistic on RTX 2070;
-# 4K@120 on a sink-less connector needs driver patches (see NVIDIA issue #1184).
+# Capture is pinned to the connector by name (Sunshine `output_name`), which is
+# stable across reboots/hotplug — unlike a numeric monitor index.
+# Reboot after changing connector or EDID. 4K@60 is realistic on RTX 2070.
 { config, lib, pkgs, ... }:
 let
   cfg = config.chiasson.system.streamingDisplay;
@@ -16,14 +14,13 @@ let
   edidFirmware = pkgs.runCommand "sunshine-virtual-4k-edid" {
     nativeBuildInputs = [ pkgs.python3 ];
   } ''
-    ${pkgs.python3}/bin/python3 ${./generate-virtual-edid.py} $TMPDIR/${cfg.edidFileName}
     mkdir -p $out/lib/firmware/edid
-    cp $TMPDIR/${cfg.edidFileName} $out/lib/firmware/edid/${cfg.edidFileName}
+    ${pkgs.python3}/bin/python3 ${./generate-virtual-edid.py} $out/lib/firmware/edid/${cfg.edidFileName}
   '';
 
-  # Sunshine 2025.924 wlr capture only accepts a numeric monitor index (not "DP-2").
-  # If the index drifts after hotplug, check:
-  #   journalctl --user -u sunshine -b | rg 'Monitor [0-9]+ is'
+  # On stream start: scale + focus the virtual 4K output so streamed windows
+  # land there. Capture is pinned to the connector via Sunshine `output_name`,
+  # so no fragile numeric-index detection is needed.
   streamDisplayUp = pkgs.writeShellScriptBin "stream-display-up" ''
     ${pkgs.niri}/bin/niri msg output ${cfg.connector} scale ${toString cfg.niriScale}
     ${pkgs.niri}/bin/niri msg action focus-monitor ${cfg.connector}
@@ -87,18 +84,6 @@ in
       default = "DP-3";
       description = "Niri monitor to refocus when a Moonlight session ends.";
     };
-
-    sunshineOutputIndex = lib.mkOption {
-      type = lib.types.str;
-      default = "3";
-      example = "3";
-      description = ''
-        Wayland/wlr monitor index for Sunshine `output_name`. Sunshine 2025.924 ignores
-        connector strings like `DP-2` and falls back to monitor 0 (your primary).
-        Find the index with:
-        `journalctl --user -u sunshine -b | rg "Monitor [0-9]+ is ${cfg.connector}"`
-      '';
-    };
   };
 
   config = lib.mkIf cfg.enable (lib.mkMerge [
@@ -118,7 +103,11 @@ in
     (lib.mkIf config.chiasson.system.gaming.sunshine.enable {
       services.sunshine.settings = {
         capture = "wlr";
-        output_name = cfg.sunshineOutputIndex;
+        # Pin capture to the virtual display by connector name (stable across
+        # reboots/hotplug). A numeric index drifted to the ultrawide before.
+        output_name = cfg.connector;
+        # RTX 2070 has no AV1 NVENC; avoid probing av1_nvenc.
+        encoder = "hevc_nvenc,h264_nvenc";
         global_prep_cmd = "[{\"do\":\"${streamDisplayUp}/bin/stream-display-up\",\"undo\":\"${streamDisplayDown}/bin/stream-display-down\"}]";
       };
     })

modules/hosts/14900k/default.nix

@@ -4,8 +4,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "14900k";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules."14900kConfiguration"

modules/hosts/14900k/home.nix

@@ -22,6 +22,14 @@
               spotify.openDiscoveryFirewall = true;
               pokeclicker.enable = true;
             };
+
+            editors.vscode = {
+              enable = true;
+              extensions = with pkgs.vscode-extensions; [
+                alefragnani.project-manager
+                johnpapa.vscode-peacock
+              ];
+            };
           };
         }
       ];

modules/hosts/ideapad/configuration.nix

@@ -42,12 +42,7 @@
       # rebuilds Mobile NixOS' script-loader against the patched mruby.
       chiasson.system.ideapadMrubyOverlay.enable = true;
 
-      # Wi-Fi modem (qcom-wcn3990) + Bluetooth (QCA crnv32) need binary blobs.
-      nixpkgs.config.allowUnfreePredicate =
-        pkg: builtins.elem (lib.getName pkg) [
-          "chromeos-sc7180-unredistributable-firmware"
-          "chromeos-sc7180-unredistributable-firmware-zstd"
-        ];
+      # Wi-Fi modem (qcom-wcn3990) + Bluetooth (QCA crnv32) need binary blobs
       hardware.firmware = [ pkgs.chromeos-sc7180-unredistributable-firmware ];
       hardware.enableRedistributableFirmware = true;
 

modules/hosts/ideapad/default.nix

@@ -4,8 +4,6 @@
     system = "aarch64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "ideapad";
-      system = "aarch64-linux";
     };
     modules = [
       self.nixosModules.ideapadConfiguration

modules/hosts/nix-server/_services/nixdesk-nfs-client.nix

@@ -1,35 +0,0 @@
-# NFS mounts of nixdesk (14900k) bulk storage for nix-server. Exports live in
-#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
-#
-# Jellyfin library paths (see also services/jellyfin.nix):
-#   Movies → /mnt/nixdesk-jellyfin/movies
-#   Shows  → /mnt/nixdesk-jellyfin/tv
-#
-# If you see "Stale file handle" under /mnt after changing exports or fsid on nixdesk, drop the
-# old client mount and let automount reattach, e.g.:
-#   sudo umount -l /mnt/nixdesk-jellyfin
-#   ls /mnt/nixdesk-jellyfin
-# (or reboot nix-server.)
-{ ... }:
-let
-  nfsExportHost = "192.168.2.25";
-  # nfsvers+tcp: predictable Linux↔Linux; lookupcache=none: fewer stale dentries after export changes.
-  nfsClientOpts = [
-    "rw"
-    "noatime"
-    "nofail"
-    "_netdev"
-    "nfsvers=3"
-    "tcp"
-    "lookupcache=none"
-    "x-systemd.automount"
-    "x-systemd.idle-timeout=3600"
-  ];
-in
-{
-  fileSystems."/mnt/nixdesk-jellyfin" = {
-    device = "${nfsExportHost}:/mnt/deep/jellyfin";
-    fsType = "nfs";
-    options = nfsClientOpts;
-  };
-}

modules/hosts/nix-server/default.nix

@@ -3,8 +3,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "nix-server";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.nix-serverConfiguration

modules/hosts/r5500/_services/nixdesk-nfs-client.nix

@@ -1,28 +0,0 @@
-# NFS mounts of nixdesk (14900k) bulk storage for r5500. Exports live in
-#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
-#
-# Jellyfin library paths:
-#   Movies → /mnt/nixdesk-jellyfin/movies
-#   Shows  → /mnt/nixdesk-jellyfin/tv
-{ ... }:
-let
-  nfsExportHost = "192.168.2.25";
-  nfsClientOpts = [
-    "rw"
-    "noatime"
-    "nofail"
-    "_netdev"
-    "nfsvers=3"
-    "tcp"
-    "lookupcache=none"
-    "x-systemd.automount"
-    "x-systemd.idle-timeout=3600"
-  ];
-in
-{
-  fileSystems."/mnt/nixdesk-jellyfin" = {
-    device = "${nfsExportHost}:/mnt/deep/jellyfin";
-    fsType = "nfs";
-    options = nfsClientOpts;
-  };
-}

modules/hosts/r5500/configuration.nix

@@ -17,7 +17,7 @@
         ./_private/media-disk.nix
         ./_private/media-paths.nix
         ./_services/docker-media.nix
-        ./_services/nixdesk-nfs-client.nix
+        self.nixosModules.nixdeskJellyfin
         ./_services/jellyfin.nix
         ./_services/sonarr.nix
         ./_services/radarr.nix

modules/hosts/r5500/default.nix

@@ -3,8 +3,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "r5500";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.r5500Configuration

modules/hosts/t2mbp/default.nix

@@ -4,8 +4,6 @@
     system = "x86_64-linux";
     specialArgs = {
       inherit self inputs;
-      host = "t2mbp";
-      system = "x86_64-linux";
     };
     modules = [
       self.nixosModules.t2mbpConfiguration

modules/hosts/t2mbp/home.nix

@@ -1,7 +1,7 @@
 { self, inputs, ... }:
 {
   flake.nixosModules.t2mbpHome =
-    { self, ... }:
+    { self, pkgs, ... }:
     {
       imports = [ self.nixosModules.desktopHomeBase ];
 
@@ -14,6 +14,14 @@
               discord.enable = true;
               pokeclicker.enable = true;
             };
+
+            editors.vscode = {
+              enable = true;
+              extensions = with pkgs.vscode-extensions; [
+                alefragnani.project-manager
+                johnpapa.vscode-peacock
+              ];
+            };
           };
         }
       ];

modules/hosts/uConsole/default.nix

@@ -4,8 +4,6 @@
     specialArgs = inputs // {
       inherit self;
       inputs = inputs;
-      host = "uConsole";
-      system = "aarch64-linux";
     };
     trustCaches = false;
     modules = [

modules/hosts/uConsole/home.nix

@@ -1,13 +1,21 @@
 { self, inputs, ... }:
 {
   flake.nixosModules.uConsoleHome =
-    { self, ... }:
+    { self, pkgs, ... }:
     {
       imports = [ self.nixosModules.desktopHomeBase ];
 
       chiasson.users.extraModules.olivier = [
         {
           chiasson.home.hardware.uconsoleGamepad.enable = true;
+
+          chiasson.home.editors.vscode = {
+            enable = true;
+            extensions = with pkgs.vscode-extensions; [
+              alefragnani.project-manager
+              johnpapa.vscode-peacock
+            ];
+          };
         }
       ];
     };

modules/system/gaming.nix

@@ -17,10 +17,9 @@
         ++ lib.optionals pkgs.stdenv.isx86_64 [ heroic ];
 
       steamExtraPkgs =
-        if !cfg.steam.steamTinkerLaunch.enable then
-          [ ]
-        else
-          lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.steamtinkerlaunch) pkgs.steamtinkerlaunch;
+        lib.optional (cfg.steam.steamTinkerLaunch.enable && lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.steamtinkerlaunch) pkgs.steamtinkerlaunch;
+
+      launcherSet = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
     in
     {
       options.chiasson.system.gaming = {
@@ -194,11 +193,11 @@
           ];
         }
         (lib.mkIf (cfg.launchers.forUsers == null) {
-          environment.systemPackages = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
+          environment.systemPackages = launcherSet;
         })
         (lib.mkIf (cfg.launchers.forUsers != null) {
           users.users = lib.genAttrs cfg.launchers.forUsers (_: {
-            packages = launcherPkgs ++ steamExtraPkgs ++ cfg.launchers.extraPackages;
+            packages = launcherSet;
           });
         })
       ]);

modules/system/nfs/default.nix

@@ -0,0 +1,38 @@
+# NFS mount of nixdesk (14900k) bulk storage for clients. Exports live in
+#   modules/hosts/14900k/_private/jellyfin-nfs-export.nix
+#
+# Jellyfin library paths (see also jellyfin.nix):
+#   Movies → /mnt/nixdesk-jellyfin/movies
+#   Shows  → /mnt/nixdesk-jellyfin/tv
+#
+# If you see "Stale file handle" under /mnt after changing exports or fsid on nixdesk, drop the
+# old client mount and let automount reattach, e.g.:
+#   sudo umount -l /mnt/nixdesk-jellyfin
+#   ls /mnt/nixdesk-jellyfin
+{ ... }:
+{
+  flake.nixosModules.nixdeskJellyfin =
+    { lib, ... }:
+    let
+      nfsExportHost = "192.168.2.25";
+      # nfsvers+tcp: predictable Linux↔Linux; lookupcache=none: fewer stale dentries after export changes.
+      nfsClientOpts = [
+        "rw"
+        "noatime"
+        "nofail"
+        "_netdev"
+        "nfsvers=3"
+        "tcp"
+        "lookupcache=none"
+        "x-systemd.automount"
+        "x-systemd.idle-timeout=3600"
+      ];
+    in
+    {
+      fileSystems."/mnt/nixdesk-jellyfin" = {
+        device = "${nfsExportHost}:/mnt/deep/jellyfin";
+        fsType = "nfs";
+        options = nfsClientOpts;
+      };
+    };
+}

modules/wisdom/apps/localsend.nix

@@ -1,4 +1,4 @@
-{ ... }: {
+{ self, ... }: {
   flake.nixosModules.systemLocalsend =
     { config, lib, ... }:
     let
@@ -19,25 +19,10 @@
       };
     };
 
-  flake.homeManagerModules.wisdomAppsLocalsend =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.apps.localsend;
-    in
-    {
-      options.chiasson.home.apps.localsend = {
-        enable = lib.mkEnableOption ''
-          LocalSend client; open the firewall on NixOS with `system.localsend` if you want inbound.
-        '' // {
-          default = true;
-        };
-
-        package = lib.mkPackageOption pkgs "localsend" { };
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [ cfg.package ];
-      };
-    };
+  flake.homeManagerModules.wisdomAppsLocalsend = self.lib.wisdomSlice {
+    path = "apps.localsend";
+    default = true;
+    description = "LocalSend client; open the firewall on NixOS with `system.localsend` if you want inbound.";
+    packages = pkgs: [ pkgs.localsend ];
+  };
 }

modules/wisdom/apps/pokeclicker/default.nix

@@ -1,18 +1,8 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomAppsPokeclicker =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.apps.pokeclicker;
-      pokeclickerPkg = pkgs.callPackage ./package { };
-    in
-    {
-      options.chiasson.home.apps.pokeclicker.enable = lib.mkEnableOption "PokéClicker desktop (Farigh fork .deb → nix)." // {
-        default = false;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = [ pokeclickerPkg ];
-      };
-    };
+{ self, ... }: {
+  flake.homeManagerModules.wisdomAppsPokeclicker = self.lib.wisdomSlice {
+    path = "apps.pokeclicker";
+    default = false;
+    description = "PokéClicker desktop (Farigh fork .deb → nix).";
+    packages = pkgs: [ (pkgs.callPackage ./package { }) ];
+  };
 }

modules/wisdom/browsers/chrome.nix

@@ -1,5 +1,5 @@
 { self, ... }: {
-  flake.homeManagerModules.wisdomBrowsersChrome = self.lib.wisdomSimpleSlice {
+  flake.homeManagerModules.wisdomBrowsersChrome = self.lib.wisdomSlice {
     path = "browsers.chrome";
     default = false;
     description = "Chrome (unfree, needs `allowUnfree`); skipped if nixpkgs has no build for this platform.";

modules/wisdom/browsers/edge.nix

@@ -1,5 +1,5 @@
 { self, ... }: {
-  flake.homeManagerModules.wisdomBrowsersEdge = self.lib.wisdomSimpleSlice {
+  flake.homeManagerModules.wisdomBrowsersEdge = self.lib.wisdomSlice {
     path = "browsers.edge";
     default = false;
     description = "Edge (unfree); skipped if unavailable on this platform.";

modules/wisdom/browsers/flow.nix

@@ -1,31 +1,31 @@
-{ ... }: {
-  flake.homeManagerModules.wisdomBrowsersFlow =
-    { config, lib, pkgs, ... }:
-    let
-      root = config.chiasson.home;
-      cfg = config.chiasson.home.browsers.flow;
+{ self, ... }: {
+  flake.homeManagerModules.wisdomBrowsersFlow = self.lib.wisdomSlice {
+    path = "browsers.flow";
+    default = false;
+    description = "[Flow](https://github.com/MultiboxLabs/flow-browser) — upstream AppImage wrapped for NixOS.";
+    packages =
+      pkgs:
+      let
+        pname = "flow-browser";
+        version = "0.11.0";
 
-      flow-browser =
-        let
-          pname = "flow-browser";
-          version = "0.11.0";
+        suffix = if pkgs.stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64";
 
-          suffix = if pkgs.stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64";
+        hash =
+          if pkgs.stdenv.hostPlatform.isAarch64 then
+            "sha256-rTRKbNyVRJAw7ZyDR6kx+XJ4rWmErZqA0b6LP9t5eOA="
+          else
+            "sha256-/Tca4uUBfgbZQEeXdYkCz6CWxqvCl40CQpACFry1k9s=";
 
-          hash =
-            if pkgs.stdenv.hostPlatform.isAarch64 then
-              "sha256-rTRKbNyVRJAw7ZyDR6kx+XJ4rWmErZqA0b6LP9t5eOA="
-            else
-              "sha256-/Tca4uUBfgbZQEeXdYkCz6CWxqvCl40CQpACFry1k9s=";
+        src = pkgs.fetchurl {
+          url = "https://github.com/MultiboxLabs/flow-browser/releases/download/v${version}/flow-browser-${version}-${suffix}.AppImage";
+          inherit hash;
+        };
 
-          src = pkgs.fetchurl {
-            url = "https://github.com/MultiboxLabs/flow-browser/releases/download/v${version}/flow-browser-${version}-${suffix}.AppImage";
-            inherit hash;
-          };
-
-          appimageContents = pkgs.appimageTools.extractType2 { inherit pname version src; };
-        in
-        pkgs.appimageTools.wrapType2 {
+        appimageContents = pkgs.appimageTools.extractType2 { inherit pname version src; };
+      in
+      [
+        (pkgs.appimageTools.wrapType2 {
           inherit pname version src;
 
           nativeBuildInputs = [ pkgs.makeWrapper ];
@@ -45,25 +45,13 @@
           meta = {
             description = "Chromium-based browser (upstream AppImage)";
             homepage = "https://github.com/MultiboxLabs/flow-browser";
-            license = lib.licenses.gpl3Plus;
-            sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+            license = pkgs.lib.licenses.gpl3Plus;
+            sourceProvenance = with pkgs.lib.sourceTypes; [ binaryNativeCode ];
             platforms = [ "x86_64-linux" "aarch64-linux" ];
             mainProgram = pname;
             maintainers = [ ];
           };
-        };
-    in
-    {
-      options.chiasson.home.browsers.flow.enable = lib.mkEnableOption ''
-        [Flow](https://github.com/MultiboxLabs/flow-browser) — upstream AppImage wrapped for NixOS.
-      '' // {
-        default = false;
-      };
-
-      config = lib.mkIf (root.enable && cfg.enable) {
-        home.packages = lib.optional (
-          lib.meta.availableOn pkgs.stdenv.hostPlatform flow-browser
-        ) flow-browser;
-      };
-    };
+        })
+      ];
+  };
 }

modules/wisdom/editors/kate.nix

@@ -1,5 +1,5 @@
 { self, ... }: {
-  flake.homeManagerModules.wisdomEditorsKate = self.lib.wisdomSimpleSlice {
+  flake.homeManagerModules.wisdomEditorsKate = self.lib.wisdomSlice {
     path = "editors.kate";
     default = false;
     description = "Kate.";

modules/wisdom/editors/obsidian.nix

@@ -1,5 +1,5 @@
 { self, ... }: {
-  flake.homeManagerModules.wisdomEditorsObsidian = self.lib.wisdomSimpleSlice {
+  flake.homeManagerModules.wisdomEditorsObsidian = self.lib.wisdomSlice {
     path = "editors.obsidian";
     default = true;
     description = "Obsidian (unfree); skipped if unavailable here.";

modules/wisdom/editors/vscode.nix

@@ -0,0 +1,100 @@
+# Visual Studio Code (Microsoft build, unfree). Default extensions + settings shared by all
+# hosts; per-host extras (peacock, comment-anchors, project-manager) go via
+# `chiasson.home.editors.vscode.extensions`.
+{ self, ... }: {
+  flake.homeManagerModules.wisdomEditorsVscode =
+    { config, lib, pkgs, ... }:
+    let
+      root = config.chiasson.home;
+      cfg = config.chiasson.home.editors.vscode;
+
+      defaultExtensions = with pkgs.vscode-extensions; [
+        jnoortheen.nix-ide
+        yzhang.markdown-all-in-one
+        esbenp.prettier-vscode
+        vscjava.vscode-java-pack
+        redhat.java
+      ];
+
+      # Wrap VS Code so a JDK is on PATH — the Red Hat Java language server (and
+      # other extension-bundled JVMs) need `java` to run, independent of the
+      # per-project `java.configuration.runtimes` setting.
+      vscodeWithJdk = pkgs.symlinkJoin {
+        name = "vscode-with-jdk";
+        paths = [ pkgs.vscode ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        postBuild = ''
+          wrapProgram "$out/bin/code" \
+            --prefix PATH : "${pkgs.jdk25}/bin"
+        '';
+      };
+
+      coreSettings = {
+        "nix.enableLanguageServer" = true;
+        "nix.serverPath" = "nixd";
+        "nix.serverSettings" = {
+          nixd = {
+            formatting = {
+              command = "nixfmt";
+            };
+          };
+        };
+        "diffEditor.ignoreTrimWhitespace" = false;
+        "chat.disableAIFeatures" = true;
+
+        "java.configuration.runtimes" = [
+          {
+            name = "JavaSE-21";
+            path = "${pkgs.jdk21}/lib/openjdk";
+          }
+          {
+            name = "JavaSE-25";
+            path = "${pkgs.jdk25}/lib/openjdk";
+            default = true;
+          }
+        ];
+      };
+
+      # Seed a *writable* settings.json (not a store symlink) so extensions like
+      # kilo-code can edit it at runtime. `force = false` in the config means HM
+      # only writes it when absent, preserving kilo's later edits across `switch`.
+      settingsJson = pkgs.writeText "vscode-user-settings" (
+        builtins.toJSON coreSettings
+      );
+    in
+    {
+      options.chiasson.home.editors.vscode = {
+        enable = lib.mkEnableOption ''
+          Visual Studio Code (Microsoft build; needs `nixpkgs.config.allowUnfree`). Core
+          extensions (nix-ide, markdown-all-in-one, prettier) + nixd/nixfmt settings are included.
+        '' // {
+          default = false;
+        };
+
+        extensions = lib.mkOption {
+          type = lib.types.listOf lib.types.package;
+          default = [ ];
+          description = ''
+            Extra extensions not wanted on every host (e.g. peacock, comment-anchors,
+            project-manager). Per-host via `chiasson.users.extraModules`.
+          '';
+        };
+      };
+
+      config = lib.mkIf (root.enable && cfg.enable) {
+        home.packages = [ ];
+
+        # Writable, seed-once user settings (kilo-code can append to it).
+        home.file.".config/Code/User/settings.json" = {
+          source = settingsJson;
+          force = false;
+        };
+
+        programs.vscode = {
+          enable = true;
+          package = vscodeWithJdk;
+          extensions = defaultExtensions ++ cfg.extensions;
+        };
+      };
+    };
+  }