chore(flake): bump maestro to 1f543d1

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

flake.lock

@@ -22,11 +22,11 @@
     },
     "agent-skills": {
       "locked": {
-        "lastModified": 1787576215,
-        "narHash": "sha256-x1ftVVEcq8p6phZEl4NC4F3RcPqpgx6wEMODMI5QHN8=",
+        "lastModified": 1787942450,
+        "narHash": "sha256-2L/uAPWl5EygFNjh4rx7saTqKnK51sYNgUyZOW6FkIk=",
         "ref": "refs/heads/main",
-        "rev": "0900e5fea1245c7d5e962e48a809ff7481c87f95",
-        "revCount": 99,
+        "rev": "d1a198ab8b2df1442dc2cae7347e5abd9c9a0051",
+        "revCount": 108,
         "type": "git",
         "url": "https://git.naps.pt/yolo/agent-skills.git"
       },
@@ -754,11 +754,11 @@
         "process-compose-flake": "process-compose-flake"
       },
       "locked": {
-        "lastModified": 1787610419,
-        "narHash": "sha256-YRDvlaiEOpzRC5JHMlm/S39EGfrGsD4kmEWwnyHz4Tg=",
+        "lastModified": 1788210196,
+        "narHash": "sha256-Bj7cv0bzl5SpoqZENqadtqyFkeG3nMP6/RzNE1JXZLU=",
         "ref": "refs/heads/main",
-        "rev": "80a93999051d41b29544258dca272d40f3fc0c98",
-        "revCount": 443,
+        "rev": "1f543d16d17f27250811d0ec14946b2a78bfd1e9",
+        "revCount": 506,
         "type": "git",
         "url": "https://git.naps.pt/naps62/maestro.git"
       },

home/yolo/services.nix

@@ -26,19 +26,13 @@ in
   ];
 
   # maestro's and rev's units come from their flake modules, not from the
-  # hand-written set below. 8081, not 8080: aoe-web already has that port on
-  # this host. There is no auth layer, so 0.0.0.0 is only safe behind the LAN
-  # perimeter.
+  # hand-written set below.
+  #
+  # settings stays empty on purpose: ~/.config/maestro/config.toml is a
+  # hand-edited plain file, not nix-generated (module skips it iff `{}`).
   services.maestro = {
     enable = true;
     web.enable = true;
-    settings = {
-      daemon.bind_addr = "127.0.0.1:7070";
-      web = {
-        bind_addr = "0.0.0.0:8081";
-        daemon_url = "http://127.0.0.1:7070";
-      };
-    };
   };
 
   # Everything under ~, three levels deep — the worktrees live at

hosts/yolo/default.nix

@@ -30,11 +30,20 @@
   # this VM has a real 8G swap partition, and the host manages its own memory.
   zramSwap.enable = lib.mkForce false;
 
-  # The only out-of-band way in. `vga: virtio-gl` renders through a GL context
-  # with no QEMU console surface, so noVNC and screendump both go dark; this
-  # pairs with the VM's serial0 socket to keep `qm terminal` working. Listed
-  # last so it wins /dev/console and gets the getty.
   boot.kernelParams = [
+    # When the host pages this VM's memory out, KVM's async page fault parks
+    # the faulting task in an uninterruptible wait instead of stalling the
+    # whole vCPU. If the "page ready" wakeup is ever dropped, that task is
+    # wedged forever and SIGKILL cannot touch it — it took out maestro-web,
+    # nix activation generators and a dozen agent sessions, a few per day,
+    # until a reboot. Disabling async PF makes host page-ins stall the vCPU
+    # synchronously: slower under host memory pressure, but nothing hangs.
+    "no-kvmapf"
+
+    # The only out-of-band way in. `vga: virtio-gl` renders through a GL
+    # context with no QEMU console surface, so noVNC and screendump both go
+    # dark; this pairs with the VM's serial0 socket to keep `qm terminal`
+    # working. Listed last so it wins /dev/console and gets the getty.
     "console=tty1"
     "console=ttyS0,115200"
   ];