updates

docs/current-work.md

@@ -56,6 +56,14 @@ The unedited `~/sync/notes/setup-todo.md` remains an idea inbox, not authorizati
   reports interruption concisely. Full builds still include the tools-only shell.
   The devenv cache is now in persistent NixOS Nix settings; the flake cache hint
   was removed.
+- Noctalia tracks upstream's `cachix` branch with its own nixpkgs pin; persistent
+  Nix settings include the official cache and signing key. The existing 5.2.1
+  commit is unchanged. Its resulting x86_64 package has a matching signed cache
+  entry; the previous package with our nixpkgs pin returned 404. No build or
+  activation was run. For the first activation, pass the cache URL and key from
+  `modules/capabilities/nix.nix` as `extra-substituters` and
+  `extra-trusted-public-keys` options to `nh os switch`; afterward Nix uses the
+  persistent settings.
 
 ## Decisions/provisioning still needed