updates

docs/current-work.md

@@ -54,6 +54,8 @@ The unedited `~/sync/notes/setup-todo.md` remains an idea inbox, not authorizati
   Validation prepares upstream devenv's import-from-derivation dependencies before
   read-only flake checking, accepts the repository's declared official cache, and
   reports interruption concisely. Full builds still include the tools-only shell.
+  The devenv cache is now in persistent NixOS Nix settings; the flake cache hint
+  was removed.
 
 ## Decisions/provisioning still needed
 
@@ -113,11 +115,11 @@ repeat full builds for documentation-only handoff edits.
 
 The final diff was reviewed for correctness, integration and Ponytail complexity.
 Desktop/capability moves and repository wiring had no material findings. The review
-removed the speculative Kubernetes login interpreter and kept the devenv cache at
-flake scope instead of granting it machine-wide trust. The remaining Python has a
-concrete role: in-memory concurrent secret loading with completeness checks, one-time
-encrypted credential reshaping, dynamic OBS rclone configuration, or pre-existing
-dictation/transcription behavior.
+removed the speculative Kubernetes login interpreter. The devenv cache was later
+moved from flake scope to machine-wide Nix settings at the user's request. The
+remaining Python has a concrete role: in-memory concurrent secret loading with
+completeness checks, one-time encrypted credential reshaping, dynamic OBS rclone
+configuration, or pre-existing dictation/transcription behavior.
 
 The user checkpoint is still required before this pass is complete. The implementation
 was committed as `5748b34` after the initial foundation commit `f164d8b`. Later