environment facts: pi alignment done by a pinned package input on .27 and .51

.pi/memory-vault/packs/paperclip-harness/70-runbooks/tmp-deployment-operations.md

@@ -1530,3 +1530,72 @@ Committed as `a129c4e` and pushed. After `.13` reboots into the new generation,
 - runbook: [[packs/paperclip-harness/70-runbooks/tmp-deployment-operations|Fix a single package build before a NixOS rebuild, then switch]]
 - action: [[packs/paperclip-harness/40-actions/2026-11-10-wrote-docs-ui-layout-md-and-three-live-layout-mockups|office CLI wrappers installed; office bugs fixed; .13 rebuild failure fixed and pushed]]
 - session: [[packs/paperclip-harness/80-sessions/rich-discovery-local-2026-11-12-01-11-14|Rich discovery: .local 2026-11-12 01:11:14]]
+
+
+---
+
+## Update (2026-11-12 01:50:43)
+
+Trigger: bringing the NixOS fleet hosts to the same pi (`pi` package) version / fixing failed `nixos-rebuild switch` runs.
+
+Prerequisites: flake at `/etc/nixos` with output `#nixos-desktop`; this repo committed & pushed for `docs/ENVIRONMENT-FACTS.md` updates.
+
+Procedure & current host state:
+1. **`.13` (nixos-desktop)** — config has: lock, `initContent`, and lan-mouse via `lm` (flake override with `LIBGIT2_NO_VENDOR="0"`). Evaluates to pi **1.5.0**; running 0.82.1. Dry-run shows 12 derivations to build. Next action: rebuild now:
+   `sudo nixos-rebuild switch --flake /etc/nixos#nixos-desktop`
+   Then check `pi --version`.
+2. **`.27`** — config has lock + `initContent`; evaluation **fails in home-manager fontconfig**: error names `home-manager.users.sam.fonts.fontconfig.configFile.fonts.settings`. Cause hypothesis: `.27` declares fonts in two places — system `fonts.packages` and again inside `systemPackages` — which home-manager 2026-11-10 cannot merge. Fix the duplication (or only bump nixpkgs), then rebuild.
+3. **`.51`** — unchanged: evaluates pi **0.87.1**, running 0.87.1. Apply "the same three edits" (lock, `initContent`, and the lan-mouse/`lm` wiring) then rebuild.
+
+Safe/dangerous: `nixos-rebuild switch` mutates live systems — do them one host at a time, `.13` proven first. Change one thing at a time.
+
+Troubleshooting: if a package build fails, build the offending package alone with an override first (see the lan-mouse `LIBGIT2_NO_VENDOR` case) and confirm the resulting store path, then wire it in. If it fails on something else, capture the first error block before changing anything else.
+
+## Evidence
+
+- Confidence: 85%
+- Reason: Repeatable multi-host procedure with per-host state, exact commands, and validation steps.
+
+## Related learned memories <!-- same-turn-2026-11-12 01:50:43 -->
+
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|lan-mouse LIBGIT2_NO_VENDOR build failure: nixpkgs vs flake package mismatch]]
+- decision: [[packs/paperclip-harness/50-decisions/wire-lan-mouse-into-configuration-nix-as-flake-lm-override-n|Wire lan-mouse into configuration.nix as flake `lm` override, not nixpkgs package or overlay]]
+- runbook: [[packs/paperclip-harness/70-runbooks/tmp-deployment-operations|NixOS fleet upgrade runbook: rebuild `.13` first, fix font duplication on `.27`, then `.51`]]
+- action: [[packs/paperclip-harness/40-actions/2026-11-10-wrote-docs-ui-layout-md-and-three-live-layout-mockups|Fixed .13 lan-mouse build, updated docs/ENVIRONMENT-FACTS.md, committed 5f8069d and pushed]]
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-nix-2026-11-12-01-50-43|Rich discovery: nix 2026-11-12 01:50:43]]
+- context: [[packs/paperclip-harness/20-context/nix|nix]]
+
+
+---
+
+## Update (2026-11-12 03:14:45)
+
+Trigger: any nixpkgs bump or otherwise wide-reaching change on nixos-desktop (.13), which hosts Paperclip, Docker, postgres, tailscale, librespot and tuios sessions.
+
+Prerequisites: ssh access to .13; confirm backups exist (`/etc/nixos/flake.lock.bak-pi-align`, `/etc/nixos/home.nix.bak-pi-align`).
+
+Procedure:
+1. Build only: `nixos-rebuild build` or `nix build` the host config to prove evaluation.
+2. Inspect what will restart: `systemctl list-units` diff / `nixos-rebuild dry-activate` and note units touching network.
+3. Deploy with `nixos-rebuild boot` (never `switch`) for wide changes; reboot at a chosen maintenance window.
+4. On reboot, verify: `ip route show default` shows `default via 192.168.20.1 dev enp42s0`; `systemctl --failed` empty; `curl -fsS localhost:<paperclip-port>/api/health` returns 200 (`/api/health` expected 200); `pi --version` is 1.5.0; `tuios list-sessions` shows restored sessions.
+
+Dangerous: `nixos-rebuild switch` on .13 while `networkmanager.unmanaged` coexists with legacy `networking.interfaces` static config — restarting NetworkManager wipes the default route that `network-addresses-enp42s0` just set. If the route disappears mid-run, exit code 4 reflects failed units, not a build failure.
+
+Rollback: `nixos-rebuild switch --rollback` (but this too restarts units); last resort reboot an older generation from the bootloader / `nixos-rebuild boot --rollback` then reboot.
+
+Troubleshooting: if address present but no route, `ip route add default via 192.168.20.1 dev enp42s0` and restart dependent services (e.g. librespot). Long-term: migrate enp42s0 to a NetworkManager manual profile first, tested with `nmcli device modify`/`nmcli connection up` before removing the legacy config.
+
+## Evidence
+
+- Confidence: 85%
+- Reason: Repeatable procedure derived from the outage with exact verification commands and rollback.
+
+## Related learned memories <!-- same-turn-2026-11-12 03:14:45 -->
+
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|Pi coding agent 1.5.0 builds standalone from cache; .27 and .51 don't need a full system bump]]
+- runbook: [[packs/paperclip-harness/70-runbooks/tmp-deployment-operations|Apply large NixOS changes on the live Paperclip/Docker server (.13)]]
+- decision: [[packs/paperclip-harness/50-decisions/paperclip-harness-ui-six-workspaces-spec-first-four-panel-li|use `nixos-rebuild boot` for wide changes on .13; hand enp42s0 to NetworkManager static profile]]
+- session: [[packs/paperclip-harness/80-sessions/nixos-13-outage-postmortem-nixos-rebuild-switch-broke-static|NixOS .13 outage postmortem: nixos-rebuild switch broke static network via NetworkManager race]]
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-35-2026-11-12-03-14-45|Rich discovery: .35 2026-11-12 03:14:45]]
+- context: [[packs/paperclip-harness/20-context/nix|.35]]