update

THIS is what caused issues with greetd, nothing kernel related

flake.lock

@@ -109,11 +109,11 @@
     "cachyos-kernel": {
       "flake": false,
       "locked": {
-        "lastModified": 1776608760,
+        "lastModified": 1776881435,
-        "narHash": "sha256-ehDv8bF7k/2Kf4b8CCoSm51U/MOoFuLsRXqe5wZ57sE=",
+        "narHash": "sha256-j8AobLjMzeKJugseObrVC4O5k7/aZCWoft2sCS3jWYs=",
         "owner": "CachyOS",
         "repo": "linux-cachyos",
-        "rev": "7e06e29005853bbaaa3b1c1067f915d6e0db728a",
+        "rev": "1c61dfd1c3ad7762faa0db8b06c6af6c59cc4340",
         "type": "github"
       },
       "original": {
@@ -125,11 +125,11 @@
     "cachyos-kernel-patches": {
       "flake": false,
       "locked": {
-        "lastModified": 1776792814,
+        "lastModified": 1777002108,
-        "narHash": "sha256-39dlIhz9KxUNQFxGpE9SvCviaOWAivdW0XJM8RnPNmg=",
+        "narHash": "sha256-PIZCIf6xUTOUqLFbEGH0mSwu2O/YfeAmYlgdAbP4dhs=",
         "owner": "CachyOS",
         "repo": "kernel-patches",
-        "rev": "d7d558d0b2e239e27b40bcf1af6fe12e323aa391",
+        "rev": "46476ae2538db486462aef8a9de37d19030cdaf2",
         "type": "github"
       },
       "original": {
@@ -222,11 +222,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776967792,
+        "lastModified": 1777138175,
-        "narHash": "sha256-O3YfkXQz8P2kec6Ani8fmuXvuXRAyl5/qPdt0kDNFWk=",
+        "narHash": "sha256-UrexPU1xQ/qB0qCjuTeljQOCDmjeCNuipZMBv3FyoJM=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "0041dd571ebebe8fa779b940fb13b6d447a48b87",
+        "rev": "d7d0c87d15148472eef847dfe298095ef4298dc1",
         "type": "github"
       },
       "original": {
@@ -266,11 +266,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1776916994,
+        "lastModified": 1777089773,
-        "narHash": "sha256-FgqUwRZ2bwbE5w1bCUv9MB3gvwqZ4oEyCgZ6z/6jdTY=",
+        "narHash": "sha256-ZIlNuebeWTncyl7mcV9VbceSLAaZki+UeXLPQG959xI=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "a2236006e5c70e2fc06e9acb016b1ac9c0fd5935",
+        "rev": "402ba229617a12d918c2a887a4c83a9a24f9a36c",
         "type": "gitlab"
       },
       "original": {
@@ -484,11 +484,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776964438,
+        "lastModified": 1777151655,
-        "narHash": "sha256-AF0cby9Xuijr5qaFpYKbm1mExV956Hk233bel6QxpFw=",
+        "narHash": "sha256-Th3a5OZyEy4kCoyLfefnt+2dwRIrFQqYgMsayF9qzFw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e09259dd2e147d35ef889784b51e89b0a10ffe15",
+        "rev": "6f59831b23d03bbf4fbd13ad167ae25da294cc14",
         "type": "github"
       },
       "original": {
@@ -564,11 +564,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776962372,
+        "lastModified": 1777132364,
-        "narHash": "sha256-Y2imW4kyIhupx8myNSeNCzDbEx2X+h+AmhNjWXA/7Yw=",
+        "narHash": "sha256-qK6A0xRDAgLf8DUHpDWpVL6NcWi4IhoVClcov+GjLP0=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "ee3a1184a978e311194a2d3d352c5e6aba67a4b5",
+        "rev": "7ae8615cc307c282555b025f88e0c8d7c185bcbf",
         "type": "github"
       },
       "original": {
@@ -631,11 +631,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776955347,
+        "lastModified": 1777066729,
-        "narHash": "sha256-VCPA/1RWMZggfXjpMcEMC2QfDrYp6eHgqvsPfDSKGSI=",
+        "narHash": "sha256-f+a+ikbq0VS6RQFf+A6EuVnsWYn2RR3ggRJNkzZgMto=",
         "owner": "TheTom",
         "repo": "llama-cpp-turboquant",
-        "rev": "67559e580b10e4e47e9a6fd6218873997976886d",
+        "rev": "11a241d0db78a68e0a5b99fe6f36de6683100f6a",
         "type": "github"
       },
       "original": {
@@ -657,11 +657,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1776966087,
+        "lastModified": 1777154498,
-        "narHash": "sha256-P+39paxTvpYiMv5wqGKte7YbmxJKoihcXssV1IhkSAo=",
+        "narHash": "sha256-700kin0o6CoNWkg2w5+2hV1wxECeoMRCQjOerBlWleA=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "547d51c282c15a7c9b86c8388a1adb1695b1df59",
+        "rev": "013ae4bdac7d0f968174d660aeb0760a025f09d0",
         "type": "github"
       },
       "original": {
@@ -704,11 +704,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1776879043,
+        "lastModified": 1777130270,
-        "narHash": "sha256-M9RjuowtoqQbFRdQAm2P6GjFwgHjRcnWYcB7ChSjDms=",
+        "narHash": "sha256-AgOIR3O+hLkTe/spgYjp0knc37iy/A5DqGRY+8DP3LE=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "535ebbe038039215a5d1c6c0c67f833409a5be96",
+        "rev": "e43ef13f23c2c7ae5b10e842745cb345faff4f40",
         "type": "github"
       },
       "original": {
@@ -737,11 +737,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1776853441,
+        "lastModified": 1777115961,
-        "narHash": "sha256-mSxfoEs7DiDhMCBzprI/1K7UXzMISuGq0b7T06LVJXE=",
+        "narHash": "sha256-ehSMsSpE+0k8r+2Vseu8kangsYxToZv3vinynsDp9zs=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "74d2b18603366b98ec9045ecf4a632422f472365",
+        "rev": "8ed0da44d974c32c6877d2f4630c314da0717ecb",
         "type": "github"
       },
       "original": {
@@ -761,11 +761,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776796985,
+        "lastModified": 1777140538,
-        "narHash": "sha256-cNFg3H09sBZl1v9ds6PDHfLCUTDJbefGMSv+WxFs+9c=",
+        "narHash": "sha256-2y5SwHxTOwEdr8WZv1IGBVoJM47YcomfoxFnZj9TgN0=",
         "owner": "xddxdd",
         "repo": "nix-cachyos-kernel",
-        "rev": "ac5956bbceb022998fc1dd0001322f10ef1e6dda",
+        "rev": "ce6083d35e50516dd6eb6156d0cbda67baed9117",
         "type": "github"
       },
       "original": {
@@ -846,11 +846,11 @@
         "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1776915193,
+        "lastModified": 1777001712,
-        "narHash": "sha256-bYyOT3OIWIKvDV+pOVd0hdCEG8orf85QX4b21LWUSEs=",
+        "narHash": "sha256-9JX9msZU1NvHzjKM24PRorP76Ge8GBy6LAkJKA21mlY=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "40c972ce0f45b8c05bf245d5065647b17552312c",
+        "rev": "394d3bfd943458baf29e4798bc9b256d824a3bb9",
         "type": "github"
       },
       "original": {
@@ -861,11 +861,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1776830795,
+        "lastModified": 1776983936,
-        "narHash": "sha256-PAfvLwuHc1VOvsLcpk6+HDKgMEibvZjCNvbM1BJOA7o=",
+        "narHash": "sha256-ZOQyNqSvJ8UdrrqU1p7vaFcdL53idK+LOM8oRWEWh6o=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "72674a6b5599e844c045ae7449ba91f803d44ebc",
+        "rev": "2096f3f411ce46e88a79ae4eafcfc9df8ed41c61",
         "type": "github"
       },
       "original": {
@@ -877,11 +877,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776548001,
+        "lastModified": 1776877367,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
         "type": "github"
       },
       "original": {
@@ -991,11 +991,11 @@
         "noctalia-qs": "noctalia-qs"
       },
       "locked": {
-        "lastModified": 1776888984,
+        "lastModified": 1777079905,
-        "narHash": "sha256-Up2F/eoMuPUsZnPVYdH5TMHe1TBP2Ue1QuWd0vWZoxY=",
+        "narHash": "sha256-TvYEXwkZnRFQRuFyyqTNSfPnU2tMdhtiBOXSk2AWLJA=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "2c1808f9f8937fc0b82c54af513f7620fec56d71",
+        "rev": "a50c92167c8d438000270f7eca36f6eea74f388e",
         "type": "github"
       },
       "original": {
@@ -1133,11 +1133,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776914043,
+        "lastModified": 1777086717,
-        "narHash": "sha256-qug5r56yW1qOsjSI99l3Jm15JNT9CvS2otkXNRNtrPI=",
+        "narHash": "sha256-vEl3cGHRxEFdVNuP9PbrhAWnmU98aPOLGy9/1JXzSuM=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
+        "rev": "3be56bd430bfd65d3c468a50626c3a601c7dee03",
         "type": "github"
       },
       "original": {
@@ -1190,11 +1190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776912132,
+        "lastModified": 1777000965,
-        "narHash": "sha256-UDR6PtHacMhAQJ8SPNbPROaxbtl2Pgjww0TzipTsTZE=",
+        "narHash": "sha256-xcrhVgfI13s1WH4hg5MLL83zAp6/htfF8Pjw4RPiKM8=",
         "owner": "nix-community",
         "repo": "srvos",
-        "rev": "e9ff039a72ff2c06271d5002eb431c443abf69fa",
+        "rev": "7ae6f096b2ffbd25d17da8a4d0fe299a164c4eac",
         "type": "github"
       },
       "original": {
@@ -1356,11 +1356,11 @@
     "trackerlist": {
       "flake": false,
       "locked": {
-        "lastModified": 1776895782,
+        "lastModified": 1777154980,
-        "narHash": "sha256-iHdp9lRoV3ejsTC96z7Pns/JvQKWyp+V0fdVcVOv8Xw=",
+        "narHash": "sha256-zEJCVDBjo0SDlYOnkfi9o6lJWpMfmmR6Oh67RPybbqI=",
         "owner": "ngosang",
         "repo": "trackerslist",
-        "rev": "e1a89caab7d4c5af3870a49ddc494cda745b236e",
+        "rev": "9599dfb9be9d899bb5abd40a5dc53e5c5be90fd4",
         "type": "github"
       },
       "original": {
@@ -1524,11 +1524,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776922304,
+        "lastModified": 1777138694,
-        "narHash": "sha256-T1r7GWzeqX0C6YauIMN6D0sdr5voDAPMg8jvn59Wm7g=",
+        "narHash": "sha256-yjAFuyqQyOtQ5entLYmSRf/1L0kuSDWQndS2QNBLQlc=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "91cc9ed57a893b2e944de60812511f05fd408ce6",
+        "rev": "5ceb2bfc5671bfca6b1b363669309d6871043d66",
         "type": "github"
       },
       "original": {

flake.nix

@@ -376,6 +376,7 @@
       nixosConfigurations = {
         mreow = mkDesktopHost "mreow";
         yarn = mkDesktopHost "yarn";
+        patiodeck = mkDesktopHost "patiodeck";
         muffin = muffinHost;
       };
 

home/progs/noctalia.nix

@@ -32,6 +32,7 @@
       };
       wallpaper = {
         enabled = true;
+        skipStartupTransition = true;
       };
     };
   };

home/progs/pi.nix

@@ -37,8 +37,21 @@ let
 in
 {
   home.packages = [
+    # `bun2nix.hook` sets `patchPhase = bunPatchPhase`, which only runs `patchShebangs` and
+    # silently ignores the standard `patches` attribute. Apply patches via `prePatch` instead
+    # so they actually take effect. Tracking: nothing upstream yet.
     (inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.omp.overrideAttrs (old: {
-      patches = (old.patches or [ ]) ++ [ ];
+      prePatch =
+        (old.prePatch or "")
+        + ''
+          # 0001 — retry without strict tools when DeepSeek (via OpenRouter) rejects strict-mode
+          #        `anyOf` nullable unions with `Invalid tool parameters schema : field \`anyOf\`:
+          #        missing field \`type\``.
+          patch -p1 < ${../../patches/omp/0001-openai-completions-retry-without-strict-on-deepseek-openrouter.patch}
+          # 0002 — require `reasoning_content` for OpenRouter reasoning models so DeepSeek V4 Pro
+          #        et al. accept follow-up requests in thinking mode.
+          patch -p1 < ${../../patches/omp/0002-openai-completions-stub-reasoning-content-for-openrouter.patch}
+        '';
     }))
   ];
 

home/progs/steam-shortcuts.nix

@@ -0,0 +1,29 @@
+# Declarative non-Steam game shortcuts for the Steam library.
+# Add entries to the `shortcuts` list to have them appear in Steam's UI.
+{
+  pkgs,
+  inputs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    inputs.json2steamshortcut.homeModules.default
+  ];
+
+  services.steam-shortcuts = {
+    enable = true;
+    overwriteExisting = true;
+    steamUserId = lib.strings.toInt (
+      lib.strings.trim (builtins.readFile ../../secrets/home/steam-user-id)
+    );
+    shortcuts = [
+      {
+        AppName = "Prism Launcher";
+        Exe = "${pkgs.prismlauncher}/bin/prismlauncher";
+        Icon = "${pkgs.prismlauncher}/share/icons/hicolor/scalable/apps/org.prismlauncher.PrismLauncher.svg";
+        Tags = [ "Game" ];
+      }
+    ];
+  };
+}

hosts/patiodeck/default.nix

@@ -0,0 +1,38 @@
+{
+  username,
+  inputs,
+  site_config,
+  ...
+}:
+{
+  imports = [
+    ../../modules/desktop-common.nix
+    ../../modules/desktop-jovian.nix
+    ./disk.nix
+    ./impermanence.nix
+
+    inputs.impermanence.nixosModules.impermanence
+  ];
+
+  networking.hostId = "a1b2c3d4";
+
+  # SSH for remote management from laptop
+  services.openssh = {
+    enable = true;
+    ports = [ 22 ];
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "yes";
+    };
+  };
+
+  users.users.${username}.openssh.authorizedKeys.keys = [
+    site_config.ssh_keys.laptop
+  ];
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    site_config.ssh_keys.laptop
+  ];
+
+  jovian.devices.steamdeck.enable = true;
+}

hosts/patiodeck/disk.nix

@@ -0,0 +1,52 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              type = "EF00";
+              size = "500M";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            nix = {
+              size = "200G";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/nix";
+              };
+            };
+            persistent = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "f2fs";
+                mountpoint = "/persistent";
+              };
+            };
+          };
+        };
+      };
+    };
+    nodev = {
+      "/" = {
+        fsType = "tmpfs";
+        mountOptions = [
+          "defaults"
+          "size=2G"
+          "mode=755"
+        ];
+      };
+    };
+  };
+
+  fileSystems."/persistent".neededForBoot = true;
+  fileSystems."/nix".neededForBoot = true;
+}

hosts/patiodeck/home.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ../../home/profiles/gui.nix
+    ../../home/profiles/desktop.nix
+    ../../home/progs/steam-shortcuts.nix
+  ];
+}

hosts/patiodeck/impermanence.nix

@@ -0,0 +1,48 @@
+{
+  username,
+  ...
+}:
+{
+  environment.persistence."/persistent" = {
+    hideMounts = true;
+    directories = [
+      "/var/log"
+      "/var/lib/systemd/coredump"
+      "/var/lib/nixos"
+      "/var/lib/systemd/timers"
+      # agenix identity sealed by the TPM
+      {
+        directory = "/var/lib/agenix";
+        mode = "0700";
+        user = "root";
+        group = "root";
+      }
+    ];
+
+    files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+      "/etc/machine-id"
+    ];
+
+    users.root = {
+      files = [
+        ".local/share/fish/fish_history"
+      ];
+    };
+  };
+
+  # bind mount home directory from persistent storage
+  fileSystems."/home/${username}" = {
+    device = "/persistent/home/${username}";
+    fsType = "none";
+    options = [ "bind" ];
+    neededForBoot = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /etc 755 root"
+  ];
+}

hosts/yarn/default.nix

@@ -1,5 +1,4 @@
 {
-  config,
   pkgs,
   lib,
   username,
@@ -10,13 +9,13 @@
 {
   imports = [
     ../../modules/desktop-common.nix
+    ../../modules/desktop-jovian.nix
     ../../modules/no-rgb.nix
     ./disk.nix
     ./impermanence.nix
     ./vr.nix
 
     inputs.impermanence.nixosModules.impermanence
-    inputs.jovian-nixos.nixosModules.default
   ];
 
   fileSystems."/media/games" = {
@@ -83,145 +82,6 @@
 
   systemd.services.lactd.serviceConfig.ExecStartPre = "${lib.getExe pkgs.bash} -c \"sleep 3s\"";
 
-  # root-level service that applies a pending update. Triggered by
+  # yarn is not a Steam Deck
-  # steamos-update (via systemctl start) when the user accepts an update.
+  jovian.devices.steamdeck.enable = false;
-  # Runs as root so it can write the system profile and boot entry.
-  systemd.services.pull-update-apply = {
-    description = "Apply pending NixOS update pulled from binary cache";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = pkgs.writeShellScript "pull-update-apply" ''
-        set -uo pipefail
-        export PATH=${
-          pkgs.lib.makeBinPath [
-            pkgs.curl
-            pkgs.coreutils
-            pkgs.nix
-          ]
-        }
-
-        STORE_PATH=$(curl -sf --max-time 30 "${site_config.binary_cache.url}/deploy/yarn" || true)
-        if [ -z "$STORE_PATH" ]; then
-          echo "server unreachable"
-          exit 1
-        fi
-
-        CURRENT=$(readlink -f /nix/var/nix/profiles/system)
-        if [ "$CURRENT" = "$STORE_PATH" ]; then
-          echo "already up to date: $STORE_PATH"
-          exit 0
-        fi
-
-        echo "applying $STORE_PATH (was $CURRENT)"
-        nix-store -r --add-root /nix/var/nix/gcroots/pull-update-apply-latest --indirect "$STORE_PATH" \
-          || { echo "fetch failed"; exit 1; }
-        nix-env -p /nix/var/nix/profiles/system --set "$STORE_PATH" \
-          || { echo "profile set failed"; exit 1; }
-        "$STORE_PATH/bin/switch-to-configuration" boot \
-          || { echo "boot entry failed"; exit 1; }
-        echo "update applied; reboot required"
-      '';
-    };
-  };
-
-  # Allow primary user to start pull-update-apply.service without a password
-  security.polkit.extraConfig = ''
-    polkit.addRule(function(action, subject) {
-      if (action.id == "org.freedesktop.systemd1.manage-units" &&
-          action.lookup("unit") == "pull-update-apply.service" &&
-          subject.user == "${username}") {
-        return polkit.Result.YES;
-      }
-    });
-  '';
-
-  nixpkgs.config.allowUnfreePredicate =
-    pkg:
-    builtins.elem (lib.getName pkg) [
-      "steamdeck-hw-theme"
-      "steam-jupiter-unwrapped"
-      "steam"
-      "steam-original"
-      "steam-unwrapped"
-      "steam-run"
-    ];
-
-  # Override jovian-stubs to disable steamos-update kernel check
-  # This prevents Steam from requesting reboots for "system updates"
-  # Steam client updates will still work normally
-  nixpkgs.overlays = [
-    (
-      final: prev:
-      let
-        deploy-url = "${site_config.binary_cache.url}/deploy/yarn";
-
-        steamos-update-script = final.writeShellScript "steamos-update" ''
-          export PATH=${
-            final.lib.makeBinPath [
-              final.curl
-              final.coreutils
-              final.systemd
-            ]
-          }
-
-          STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)
-
-          if [ -z "$STORE_PATH" ]; then
-            >&2 echo "[steamos-update] server unreachable"
-            exit 7
-          fi
-
-          CURRENT=$(readlink -f /nix/var/nix/profiles/system)
-          if [ "$CURRENT" = "$STORE_PATH" ]; then
-            >&2 echo "[steamos-update] no update available"
-            exit 0
-          fi
-
-          # check-only mode: just report that an update exists
-          if [ "''${1:-}" = "check" ] || [ "''${1:-}" = "--check-only" ]; then
-            >&2 echo "[steamos-update] update available"
-            exit 0
-          fi
-
-          # apply: trigger the root-running systemd service to install the update
-          >&2 echo "[steamos-update] applying update..."
-          if systemctl start --wait pull-update-apply.service; then
-            >&2 echo "[steamos-update] update installed, reboot to apply"
-            exit 0
-          else
-            >&2 echo "[steamos-update] apply failed; see 'journalctl -u pull-update-apply'"
-            exit 1
-          fi
-        '';
-      in
-      {
-        # Only replace holo-update (and its steamos-update alias) with our
-        # binary-cache pull script. All other stubs (pkexec, sudo,
-        # holo-reboot, holo-select-branch, …) come from upstream unchanged.
-        jovian-stubs = prev.jovian-stubs.overrideAttrs (old: {
-          buildCommand = (old.buildCommand or "") + ''
-            install -D -m 755 ${steamos-update-script} $out/bin/holo-update
-            install -D -m 755 ${steamos-update-script} $out/bin/steamos-update
-          '';
-        });
-      }
-    )
-  ];
-
-  jovian = {
-    devices.steamdeck.enable = false;
-    steam = {
-      enable = true;
-      autoStart = true;
-      desktopSession = "niri";
-      user = username;
-    };
-  };
-
-  # Jovian-NixOS requires sddm
-  # https://github.com/Jovian-Experiments/Jovian-NixOS/commit/52f140c07493f8bb6cd0773c7e1afe3e1fd1d1fa
-  services.displayManager.sddm.wayland.enable = true;
-
-  # Disable gamescope from common.nix to avoid conflict with jovian-nixos
-  programs.gamescope.enable = lib.mkForce false;
 }

hosts/yarn/home.nix

@@ -1,15 +1,12 @@
 {
   pkgs,
-  inputs,
-  lib,
-  config,
   ...
 }:
 {
   imports = [
     ../../home/profiles/gui.nix
     ../../home/profiles/desktop.nix
-    inputs.json2steamshortcut.homeModules.default
+    ../../home/progs/steam-shortcuts.nix
   ];
 
   home.packages = with pkgs; [
@@ -27,20 +24,4 @@
       obs-pipewire-audio-capture
     ];
   };
-
-  services.steam-shortcuts = {
-    enable = true;
-    overwriteExisting = true;
-    steamUserId = lib.strings.toInt (
-      lib.strings.trim (builtins.readFile ../../secrets/home/steam-user-id)
-    );
-    shortcuts = [
-      {
-        AppName = "Prism Launcher";
-        Exe = "${pkgs.prismlauncher}/bin/prismlauncher";
-        Icon = "${pkgs.prismlauncher}/share/icons/hicolor/scalable/apps/org.prismlauncher.PrismLauncher.svg";
-        Tags = [ "Game" ];
-      }
-    ];
-  };
 }

hosts/yarn/impermanence.nix

@@ -29,6 +29,12 @@
       "/etc/ssh/ssh_host_rsa_key.pub"
       "/etc/machine-id"
     ];
+
+    users.root = {
+      files = [
+        ".local/share/fish/fish_history"
+      ];
+    };
   };
 
   # Bind mount entire home directory from persistent storage

modules/common.nix

@@ -58,8 +58,6 @@
     ];
   };
 
-  services.kmscon.enable = true;
-
   environment.systemPackages = with pkgs; [
     doas-sudo-shim
   ];

modules/desktop-jovian.nix

@@ -0,0 +1,40 @@
+# Jovian-NixOS deck-mode configuration shared by all hosts running Steam
+# in gamescope (yarn, patiodeck). Host-specific settings (like
+# jovian.devices.steamdeck.enable) stay in the host's default.nix.
+{
+  lib,
+  username,
+  inputs,
+  ...
+}:
+{
+  imports = [
+    ./desktop-steam-update.nix
+    inputs.jovian-nixos.nixosModules.default
+  ];
+
+  nixpkgs.config.allowUnfreePredicate =
+    pkg:
+    builtins.elem (lib.getName pkg) [
+      "steamdeck-hw-theme"
+      "steam-jupiter-unwrapped"
+      "steam"
+      "steam-original"
+      "steam-unwrapped"
+      "steam-run"
+    ];
+
+  jovian.steam = {
+    enable = true;
+    autoStart = true;
+    desktopSession = "niri";
+    user = username;
+  };
+
+  # jovian overrides the display manager; sddm is required
+  services.displayManager.sddm.wayland.enable = true;
+
+  # desktop-common.nix enables programs.gamescope which conflicts with
+  # jovian's own gamescope wrapper
+  programs.gamescope.enable = lib.mkForce false;
+}

modules/desktop-steam-update.nix

@@ -0,0 +1,122 @@
+# Binary-cache update mechanism for Jovian-NixOS desktops.
+#
+# Replaces the upstream holo-update/steamos-update stubs with a script that
+# checks the private binary cache for a newer system closure, and provides a
+# root-level systemd service to apply it. Steam's deck UI calls
+# `steamos-update check` periodically; exit 7 = no update, exit 0 = update
+# applied or available.
+#
+# The deploy endpoint is ${binary_cache_url}/deploy/${hostname} — a plain
+# text file containing the /nix/store path of the latest closure, published
+# by CI after a successful build.
+{
+  pkgs,
+  lib,
+  hostname,
+  username,
+  site_config,
+  ...
+}:
+let
+  deploy-url = "${site_config.binary_cache.url}/deploy/${hostname}";
+
+  steamos-update-script = pkgs.writeShellScript "steamos-update" ''
+    export PATH=${
+      lib.makeBinPath [
+        pkgs.curl
+        pkgs.coreutils
+        pkgs.systemd
+      ]
+    }
+
+    STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)
+
+    if [ -z "$STORE_PATH" ]; then
+      >&2 echo "[steamos-update] server unreachable"
+      exit 7
+    fi
+
+    CURRENT=$(readlink -f /nix/var/nix/profiles/system)
+    if [ "$CURRENT" = "$STORE_PATH" ]; then
+      >&2 echo "[steamos-update] no update available"
+      exit 7
+    fi
+
+    # check-only mode: just report that an update exists
+    if [ "''${1:-}" = "check" ] || [ "''${1:-}" = "--check-only" ]; then
+      >&2 echo "[steamos-update] update available"
+      exit 0
+    fi
+
+    # apply: trigger the root-running systemd service to install the update
+    >&2 echo "[steamos-update] applying update..."
+    if systemctl start --wait pull-update-apply.service; then
+      >&2 echo "[steamos-update] update installed, reboot to apply"
+      exit 0
+    else
+      >&2 echo "[steamos-update] apply failed; see 'journalctl -u pull-update-apply'"
+      exit 1
+    fi
+  '';
+in
+{
+  nixpkgs.overlays = [
+    (_final: prev: {
+      jovian-stubs = prev.jovian-stubs.overrideAttrs (old: {
+        buildCommand = (old.buildCommand or "") + ''
+          install -D -m 755 ${steamos-update-script} $out/bin/holo-update
+          install -D -m 755 ${steamos-update-script} $out/bin/steamos-update
+        '';
+      });
+    })
+  ];
+
+  systemd.services.pull-update-apply = {
+    description = "Apply pending NixOS update pulled from binary cache";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = pkgs.writeShellScript "pull-update-apply" ''
+        set -uo pipefail
+        export PATH=${
+          lib.makeBinPath [
+            pkgs.curl
+            pkgs.coreutils
+            pkgs.nix
+          ]
+        }
+
+        STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)
+        if [ -z "$STORE_PATH" ]; then
+          echo "server unreachable"
+          exit 1
+        fi
+
+        CURRENT=$(readlink -f /nix/var/nix/profiles/system)
+        if [ "$CURRENT" = "$STORE_PATH" ]; then
+          echo "already up to date: $STORE_PATH"
+          exit 0
+        fi
+
+        echo "applying $STORE_PATH (was $CURRENT)"
+        nix-store -r --add-root /nix/var/nix/gcroots/pull-update-apply-latest --indirect "$STORE_PATH" \
+          || { echo "fetch failed"; exit 1; }
+        nix-env -p /nix/var/nix/profiles/system --set "$STORE_PATH" \
+          || { echo "profile set failed"; exit 1; }
+        "$STORE_PATH/bin/switch-to-configuration" boot \
+          || { echo "boot entry failed"; exit 1; }
+        echo "update applied; reboot required"
+      '';
+    };
+  };
+
+  # allow the primary user to trigger pull-update-apply without a password
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id == "org.freedesktop.systemd1.manage-units" &&
+          action.lookup("unit") == "pull-update-apply.service" &&
+          subject.user == "${username}") {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+}

patches/omp/0001-openai-completions-retry-without-strict-on-deepseek-openrouter.patch

@@ -0,0 +1,126 @@
+Subject: [PATCH] fix(openai-completions): retry without strict tools for DeepSeek-via-OpenRouter anyOf rejections
+
+The retry-on-strict-tool-error path in openai-completions failed to recover when
+DeepSeek (and similar backends fronted by OpenRouter) reject strict-mode tool
+schemas with errors of the form:
+
+  Invalid tool parameters schema : field `anyOf`: missing field `type`
+
+Two reasons:
+
+1. Retry only triggered in "all_strict" mode. OpenRouter defaults to "mixed"
+   (per-tool strict), so the early return prevented retry.
+2. The error-message regex required "strict" near "tool". DeepSeek's message
+   never mentions "strict".
+
+Fix:
+- Allow retry whenever any tool was sent with strict (i.e. mode != "none").
+- Recognize "Invalid tool parameters" in the regex.
+
+Includes a regression test reproducing the exact DeepSeek error body via
+OpenRouter mixed-strict mode.
+
+Applies cleanly against v14.2.1.
+
+---
+diff --git a/packages/ai/src/providers/openai-completions.ts b/packages/ai/src/providers/openai-completions.ts
+index e58189607..3c20631c1 100644
+--- a/packages/ai/src/providers/openai-completions.ts
++++ b/packages/ai/src/providers/openai-completions.ts
+@@ -1245,7 +1245,10 @@ function shouldRetryWithoutStrictTools(
+ 	toolStrictMode: AppliedToolStrictMode,
+ 	tools: Tool[] | undefined,
+ ): boolean {
+-	if (!tools || tools.length === 0 || toolStrictMode !== "all_strict") {
++	// Retry whenever any tool was sent with `strict: true`. OpenRouter routes to underlying
++	// providers (e.g. DeepSeek) whose schema validators reject the strict-mode `anyOf` shape
++	// even when omp emitted strict per-tool ("mixed"), not just provider-wide ("all_strict").
++	if (!tools || tools.length === 0 || toolStrictMode === "none") {
+ 		return false;
+ 	}
+ 	const status = extractHttpStatusFromError(error) ?? capturedErrorResponse?.status;
+@@ -1255,7 +1258,14 @@ function shouldRetryWithoutStrictTools(
+ 	const messageParts = [error instanceof Error ? error.message : undefined, capturedErrorResponse?.bodyText]
+ 		.filter((value): value is string => typeof value === "string" && value.trim().length > 0)
+ 		.join("\n");
+-	return /wrong_api_format|mixed values for 'strict'|tool[s]?\b.*strict|\bstrict\b.*tool/i.test(messageParts);
++	// Patterns:
++	// - `wrong_api_format`, `mixed values for 'strict'`: OpenAI rejecting mixed strict flags.
++	// - `tool ... strict` / `strict ... tool`: generic strict-tool complaints.
++	// - `Invalid tool parameters schema`: DeepSeek (via OpenRouter) rejecting strict-mode
++	//   nullable unions because their validator demands `type` alongside `anyOf`.
++	return /wrong_api_format|mixed values for 'strict'|tool[s]?\b.*strict|\bstrict\b.*tool|invalid tool parameters/i.test(
++		messageParts,
++	);
+ }
+ 
+ function mapStopReason(reason: ChatCompletionChunk.Choice["finish_reason"] | string): {
+diff --git a/packages/ai/test/openai-tool-strict-mode.test.ts b/packages/ai/test/openai-tool-strict-mode.test.ts
+index 2bf17e6d8..24d5a09d5 100644
+--- a/packages/ai/test/openai-tool-strict-mode.test.ts
++++ b/packages/ai/test/openai-tool-strict-mode.test.ts
+@@ -231,6 +231,64 @@ describe("OpenAI tool strict mode", () => {
+ 		expect(result.content).toContainEqual({ type: "text", text: "Hello" });
+ 		expect(strictFlags).toEqual([[true], [false]]);
+ 	});
++	it("retries with non-strict tool schemas when OpenRouter backend rejects strict anyOf nullable unions", async () => {
++		// Reproduces deepseek/deepseek-v4-pro via OpenRouter rejecting the strict-mode schema with:
++		//   400 Provider returned error
++		//   {"error":{"message":"Invalid tool parameters schema : field `anyOf`: missing field `type`",...}}
++		// OpenRouter is in mixed-strict mode by default (per-tool strict), so the original retry condition
++		// (only "all_strict") prevented recovery. The retry now triggers whenever any tool sent strict=true.
++		const model = getBundledModel("openrouter", "deepseek/deepseek-v3.2") as Model<"openai-completions">;
++		const strictFlags: boolean[][] = [];
++		global.fetch = Object.assign(
++			async (_input: string | URL | Request, init?: RequestInit): Promise<Response> => {
++				const bodyText = typeof init?.body === "string" ? init.body : "";
++				const payload = JSON.parse(bodyText) as {
++					tools?: Array<{ function?: { strict?: boolean } }>;
++				};
++				strictFlags.push((payload.tools ?? []).map(tool => tool.function?.strict === true));
++				if (strictFlags.length === 1) {
++					return new Response(
++						JSON.stringify({
++							error: {
++								message: "Invalid tool parameters schema : field `anyOf`: missing field `type`",
++								type: "invalid_request_error",
++								param: null,
++								code: "invalid_request_error",
++							},
++						}),
++						{
++							status: 400,
++							headers: { "content-type": "application/json" },
++						},
++					);
++				}
++				return createSseResponse([
++					{
++						id: "chatcmpl-or",
++						object: "chat.completion.chunk",
++						created: 0,
++						model: model.id,
++						choices: [{ index: 0, delta: { content: "Hello" } }],
++					},
++					{
++						id: "chatcmpl-or",
++						object: "chat.completion.chunk",
++						created: 0,
++						model: model.id,
++						choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
++					},
++					"[DONE]",
++				]);
++			},
++			{ preconnect: originalFetch.preconnect },
++		);
++
++		const result = await streamOpenAICompletions(model, testContext, { apiKey: "test-key" }).result();
++		expect(result.stopReason).toBe("stop");
++		expect(result.content).toContainEqual({ type: "text", text: "Hello" });
++		expect(strictFlags).toEqual([[true], [false]]);
++	});
++
+ 
+ 	it("sends strict=true for openai-responses tool schemas on OpenAI", async () => {
+ 		const model = getBundledModel("openai", "gpt-5-mini") as Model<"openai-responses">;

patches/omp/0002-openai-completions-stub-reasoning-content-for-openrouter.patch

@@ -0,0 +1,233 @@
+Subject: [PATCH] fix(openai-completions): require `reasoning_content` for OpenRouter reasoning models
+
+DeepSeek V4 Pro (and similar reasoning models reached via OpenRouter) reject
+multi-turn requests in thinking mode with:
+
+  400 The `reasoning_content` in the thinking mode must be passed back to
+  the API.
+
+omp's existing kimi placeholder injection (`requiresReasoningContentForToolCalls`)
+covered this requirement only for `thinkingFormat === "openai"`. OpenRouter
+sets `thinkingFormat === "openrouter"`, so the gate never fired even though
+the underlying providers behind OpenRouter (DeepSeek, Kimi, etc.) all enforce
+the same invariant.
+
+This patch:
+
+1. Extends `requiresReasoningContentForToolCalls` detection: any
+   reasoning-capable model fronted by OpenRouter now sets the flag.
+2. Extends the placeholder gate in `convertMessages` to accept
+   `thinkingFormat === "openrouter"` alongside `"openai"`.
+
+Cross-provider continuations are the dominant trigger: a conversation warmed
+up by Anthropic Claude (whose reasoning is redacted/encrypted on the wire)
+followed by a switch to DeepSeek V4 Pro via OpenRouter. omp cannot
+synthesize plaintext `reasoning_content` from Anthropic's encrypted blocks,
+so the placeholder satisfies DeepSeek's validator without fabricating a
+reasoning trace. Real captured reasoning, when present, short-circuits the
+placeholder via `hasReasoningField` and survives intact.
+
+Side benefit: also closes a latent gap where Kimi-via-OpenRouter
+(`thinkingFormat === "openrouter"`) had the compat flag set but the
+placeholder gate silently rejected it.
+
+Regression tests cover:
+  - compat flag detection on OpenRouter reasoning models
+  - opt-out for non-reasoning OpenRouter models
+  - cross-provider redacted-thinking placeholder
+  - Kimi-via-OpenRouter placeholder firing
+  - real reasoning preserved over the placeholder
+
+Applies cleanly on top of patch 0001.
+
+---
+diff --git a/packages/ai/src/providers/openai-completions-compat.ts b/packages/ai/src/providers/openai-completions-compat.ts
+--- a/packages/ai/src/providers/openai-completions-compat.ts
++++ b/packages/ai/src/providers/openai-completions-compat.ts
+@@ -105,7 +105,14 @@
+ 					? "qwen"
+ 					: "openai",
+ 		reasoningContentField: "reasoning_content",
+-		requiresReasoningContentForToolCalls: isKimiModel,
++		// Backends that 400 follow-up requests when prior assistant tool-call turns lack `reasoning_content`:
++		//   - Kimi: documented invariant on its native API and via OpenCode-Go.
++		//   - Any reasoning-capable model reached through OpenRouter: DeepSeek V4 Pro and similar enforce
++		//     this server-side whenever the request is in thinking mode. We can't translate Anthropic's
++		//     redacted/encrypted reasoning into DeepSeek's plaintext form, so cross-provider continuations
++		//     rely on a placeholder — see `convertMessages` for the placeholder injection.
++		requiresReasoningContentForToolCalls:
++			isKimiModel || ((provider === "openrouter" || baseUrl.includes("openrouter.ai")) && Boolean(model.reasoning)),
+ 		requiresAssistantContentForToolCalls: isKimiModel,
+ 		openRouterRouting: undefined,
+ 		vercelGatewayRouting: undefined,
+diff --git a/packages/ai/src/providers/openai-completions.ts b/packages/ai/src/providers/openai-completions.ts
+--- a/packages/ai/src/providers/openai-completions.ts
++++ b/packages/ai/src/providers/openai-completions.ts
+@@ -1059,12 +1059,21 @@
+ 				(assistantMsg as any).reasoning_content !== undefined ||
+ 				(assistantMsg as any).reasoning !== undefined ||
+ 				(assistantMsg as any).reasoning_text !== undefined;
+-			if (
+-				toolCalls.length > 0 &&
++			// Inject a `reasoning_content` placeholder on assistant tool-call turns when the backend
++			// rejects history without it. The compat flag captures the rule:
++			//   - Kimi (native or via OpenCode-Go): chat completion endpoint demands the field.
++			//   - Reasoning models reached through OpenRouter (e.g. DeepSeek V4 Pro): the underlying
++			//     provider's thinking-mode validator demands it on every prior assistant turn. omp
++			//     cannot synthesize real reasoning when the conversation was warmed up by another
++			//     provider whose reasoning is redacted/encrypted (Anthropic) or simply absent, so we
++			//     emit a placeholder. Real captured reasoning, when present, is preserved earlier via
++			//     the `thinkingSignature` echo path and short-circuits via `hasReasoningField`.
++			// `thinkingFormat` is gated to formats that consume the field (openai/openrouter chat
++			// completions); formats with their own conventions (zai, qwen) are excluded.
++			const stubsReasoningContent =
+ 				compat.requiresReasoningContentForToolCalls &&
+-				compat.thinkingFormat === "openai" &&
+-				!hasReasoningField
+-			) {
++				(compat.thinkingFormat === "openai" || compat.thinkingFormat === "openrouter");
++			if (toolCalls.length > 0 && stubsReasoningContent && !hasReasoningField) {
+ 				const reasoningField = compat.reasoningContentField ?? "reasoning_content";
+ 				(assistantMsg as any)[reasoningField] = ".";
+ 			}
+diff --git a/packages/ai/test/openai-completions-compat.test.ts b/packages/ai/test/openai-completions-compat.test.ts
+--- a/packages/ai/test/openai-completions-compat.test.ts
++++ b/packages/ai/test/openai-completions-compat.test.ts
+@@ -367,4 +367,137 @@
+ 		const compat = detectCompat(model);
+ 		expect(compat.requiresReasoningContentForToolCalls).toBe(true);
+ 	});
++
++	it("requires reasoning_content for tool calls on reasoning-capable models via OpenRouter", () => {
++		const model: Model<"openai-completions"> = {
++			...(getBundledModel("openrouter", "deepseek/deepseek-v3.2") as Model<"openai-completions">),
++			reasoning: true,
++		};
++		const compat = detectCompat(model);
++		expect(compat.thinkingFormat).toBe("openrouter");
++		expect(compat.requiresReasoningContentForToolCalls).toBe(true);
++	});
++
++	it("does not require reasoning_content for non-reasoning OpenRouter models", () => {
++		const model: Model<"openai-completions"> = {
++			...(getBundledModel("openrouter", "deepseek/deepseek-v3.2") as Model<"openai-completions">),
++			reasoning: false,
++		};
++		const compat = detectCompat(model);
++		expect(compat.requiresReasoningContentForToolCalls).toBe(false);
++	});
++
++	it("injects reasoning_content placeholder for OpenRouter reasoning models lacking captured reasoning", () => {
++		// Reproduces the failing path from real usage: a conversation generated under Anthropic Claude (whose
++		// reasoning is redacted/encrypted) is continued with deepseek/deepseek-v4-pro via OpenRouter. The
++		// prior assistant turns persist as ThinkingContent blocks with empty `thinking` text plus an opaque
++		// Anthropic signature cookie. omp cannot translate that into DeepSeek's plain-text `reasoning_content`,
++		// so the empty thinking block is filtered out and the placeholder fires — satisfying DeepSeek's
++		// thinking-mode validator without fabricating a reasoning trace.
++		const model: Model<"openai-completions"> = {
++			...(getBundledModel("openrouter", "deepseek/deepseek-v3.2") as Model<"openai-completions">),
++			reasoning: true,
++		};
++		const compat = detectCompat(model);
++		const toolCallMessage: AssistantMessage = {
++			role: "assistant",
++			content: [
++				// Anthropic-style redacted thinking block: empty text plus opaque signature.
++				// `thinking.trim().length === 0` filters this out before the signature echo can fire.
++				{ type: "thinking", thinking: "", thinkingSignature: "Ep4CClkIDRgCKkDOpaqueAnthropicCookie" },
++				{ type: "toolCall", id: "call_anth_to_ds", name: "web_search", arguments: { query: "hi" } },
++			],
++			api: model.api,
++			provider: model.provider,
++			model: model.id,
++			usage: {
++				input: 0,
++				output: 0,
++				cacheRead: 0,
++				cacheWrite: 0,
++				totalTokens: 0,
++				cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
++			},
++			stopReason: "toolUse",
++			timestamp: Date.now(),
++		};
++		const messages = convertMessages(model, { messages: [toolCallMessage] }, compat);
++		const assistant = messages.find(m => m.role === "assistant");
++		expect(assistant).toBeDefined();
++		expect(Reflect.get(assistant as object, "reasoning_content")).toBe(".");
++	});
++
++	it("injects reasoning_content placeholder for kimi-k2-5 via OpenRouter (closes the kimi-via-openrouter gap)", () => {
++		// Before this fix, `requiresReasoningContentForToolCalls` was true for Kimi via OpenRouter but the
++		// stub gate only fired when `thinkingFormat === "openai"`. OpenRouter sets thinkingFormat="openrouter",
++		// so the stub silently never fired and Kimi-via-OpenRouter conversations 400'd the same way.
++		const model: Model<"openai-completions"> = {
++			...getBundledModel("openai", "gpt-4o-mini"),
++			api: "openai-completions",
++			provider: "openrouter",
++			baseUrl: "https://openrouter.ai/api/v1",
++			id: "moonshotai/kimi-k2-5",
++			reasoning: true,
++		};
++		const compat = detectCompat(model);
++		const toolCallMessage: AssistantMessage = {
++			role: "assistant",
++			content: [
++				{ type: "toolCall", id: "call_kimi_or", name: "web_search", arguments: { query: "hi" } },
++			],
++			api: model.api,
++			provider: model.provider,
++			model: model.id,
++			usage: {
++				input: 0,
++				output: 0,
++				cacheRead: 0,
++				cacheWrite: 0,
++				totalTokens: 0,
++				cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
++			},
++			stopReason: "toolUse",
++			timestamp: Date.now(),
++		};
++		const messages = convertMessages(model, { messages: [toolCallMessage] }, compat);
++		const assistant = messages.find(m => m.role === "assistant");
++		expect(assistant).toBeDefined();
++		expect(Reflect.get(assistant as object, "reasoning_content")).toBe(".");
++	});
++
++	it("preserves real captured reasoning over the placeholder when the assistant has non-empty thinking", () => {
++		// Sanity check: the placeholder must not overwrite real reasoning. When the prior assistant turn was
++		// generated by the same provider and surfaces plaintext reasoning, the existing thinkingSignature
++		// echo path sets `reasoning_content` first, and `hasReasoningField` short-circuits the stub.
++		const model: Model<"openai-completions"> = {
++			...(getBundledModel("openrouter", "deepseek/deepseek-v3.2") as Model<"openai-completions">),
++			reasoning: true,
++		};
++		const compat = detectCompat(model);
++		const toolCallMessage: AssistantMessage = {
++			role: "assistant",
++			content: [
++				{ type: "thinking", thinking: "Step 1: read the file. Step 2: search.", thinkingSignature: "reasoning_content" },
++				{ type: "toolCall", id: "call_real", name: "web_search", arguments: { query: "hi" } },
++			],
++			api: model.api,
++			provider: model.provider,
++			model: model.id,
++			usage: {
++				input: 0,
++				output: 0,
++				cacheRead: 0,
++				cacheWrite: 0,
++				totalTokens: 0,
++				cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
++			},
++			stopReason: "toolUse",
++			timestamp: Date.now(),
++		};
++		const messages = convertMessages(model, { messages: [toolCallMessage] }, compat);
++		const assistant = messages.find(m => m.role === "assistant");
++		expect(assistant).toBeDefined();
++		expect(Reflect.get(assistant as object, "reasoning_content")).toBe("Step 1: read the file. Step 2: search.");
++	});
++
+ });

services/ssh.nix

@@ -27,7 +27,6 @@
 
   users.users.${username}.openssh.authorizedKeys.keys = [
     site_config.ssh_keys.laptop
-    site_config.ssh_keys.desktop
   ];
 
   # used for deploying configs to server

site-config.nix

@@ -57,7 +57,6 @@ rec {
   # hosts/yarn/default.nix. Rotating a key means changing it here, nowhere else.
   ssh_keys = {
     laptop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH";
-    desktop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBJjT5QZ3zRDb+V6Em20EYpSEgPW5e/U+06uQGJdraxi";
     ci_deploy = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5ZYN6idL/w/mUIfPOH1i+Q/SQXuzAMQUEuWpipx1Pc ci-deploy@muffin";
   };
 }