refactor(s390x): export rustc-symlink overlay + add formatter; refresh pins

Lift the s390x rustc symlink_file patch overlay into overlays.s390xRustcSymlink
so nixos-ci consumes one definition (patch travels with it) instead of
duplicating it. Add nixfmt-rfc-style formatter. Refresh fleet-pins + parity
inputs to HEAD so the lock collapses to a single nixpkgs (1c3fe55).

flake.lock

@@ -161,11 +161,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779533061,
+        "lastModified": 1780368078,
-        "narHash": "sha256-orWNYXtYURhEj3X4+xGMAhaEcKRvwXqTtJ8x2jV/M+Q=",
+        "narHash": "sha256-tLzA5XveUF4PfuKNz3KuhmVhuME3PX5zvtFa17hhQPU=",
         "ref": "refs/heads/main",
-        "rev": "b818e345ec4470e4b3e335bd2f864183c512116d",
+        "rev": "1626405d46ff3595b91c9e2d3ed9399f67c18b83",
-        "revCount": 13,
+        "revCount": 15,
         "type": "git",
         "url": "https://git.oleks.space/oleks/fleet-pins"
       },
@@ -201,6 +201,10 @@
           "fleet-pins",
           "nixpkgs"
         ],
+        "nixpkgs-mermaid-gpu": [
+          "fleet-pins",
+          "nixpkgs"
+        ],
         "nixpkgs-micron": [
           "fleet-pins",
           "nixpkgs"
@@ -211,11 +215,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776894566,
+        "lastModified": 1780368078,
-        "narHash": "sha256-oD0s9bTy8piFts/RcZhibytVoSu42/mItsvxH2icGMc=",
+        "narHash": "sha256-tLzA5XveUF4PfuKNz3KuhmVhuME3PX5zvtFa17hhQPU=",
         "ref": "main",
-        "rev": "1550e5be0e89a6a1b084a5662ad37b35b6905e49",
+        "rev": "1626405d46ff3595b91c9e2d3ed9399f67c18b83",
-        "revCount": 10,
+        "revCount": 15,
         "type": "git",
         "url": "https://git.oleks.space/oleks/fleet-pins"
       },
@@ -287,17 +291,17 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771848320,
+        "lastModified": 1777268161,
-        "narHash": "sha256-ppefbuGh9S1W3gNCvMPhsadn6FvshqaJAYRk1/N2JGY=",
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       }
     },
@@ -328,11 +332,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780472546,
+        "lastModified": 1780602315,
-        "narHash": "sha256-cx+821qtyNZNe9t3ab8qImmeg/rxVzPpZIS45SflrI0=",
+        "narHash": "sha256-msVp9pBMP+I/n0+GGADG1XQembM3F19fUIh79rxqkgs=",
         "ref": "refs/heads/main",
-        "rev": "d265a79ddb84b297364e6cc3638c9f6b5dc583d7",
+        "rev": "089bd03264d848f8391d9d53d79da0fd97ed1857",
-        "revCount": 10,
+        "revCount": 13,
         "type": "git",
         "url": "https://git.oleks.space/oleks/parity-lib"
       },

flake.nix

@@ -165,6 +165,27 @@
         };
       };
 
+      # Rustc bootstrap: symlink_file panics with "File exists" during
+      # s390x cross-compilation. Multiple call sites use t!(symlink_file(...)).
+      # Patch the symlink_file method body to remove an existing dest first.
+      # Exported as overlays.s390xRustcSymlink so nixos-ci consumes this single
+      # definition (and the patch travels with it) instead of duplicating it.
+      s390xRustcSymlinkOverlay =
+        final: prev:
+        let
+          patchedRustcUnwrapped = prev.rustc-unwrapped.overrideAttrs (old: {
+            patches = (old.patches or [ ]) ++ [
+              ./patches/rustc-symlink-file-eexist.patch
+            ];
+          });
+        in
+        {
+          rustc-unwrapped = patchedRustcUnwrapped;
+          rustc = prev.rustc.override {
+            rustc-unwrapped = patchedRustcUnwrapped;
+          };
+        };
+
       # Overlays needed for s390x cross-compilation of attic-client
       s390xOverlays = [
         # OpenSSL s390x assembly uses z10 instructions (cijne) that the
@@ -222,25 +243,8 @@
             });
           };
         })
-        # Rustc bootstrap: symlink_file panics with "File exists" during
+        # Rustc symlink_file "File exists" fix (defined + exported above).
-        # s390x cross-compilation. Multiple call sites use t!(symlink_file(...)).
+        s390xRustcSymlinkOverlay
-        # Patch the symlink_file method body to remove existing dest first.
-        (
-          final: prev:
-          let
-            patchedRustcUnwrapped = prev.rustc-unwrapped.overrideAttrs (old: {
-              patches = (old.patches or [ ]) ++ [
-                ./patches/rustc-symlink-file-eexist.patch
-              ];
-            });
-          in
-          {
-            rustc-unwrapped = patchedRustcUnwrapped;
-            rustc = prev.rustc.override {
-              rustc-unwrapped = patchedRustcUnwrapped;
-            };
-          }
-        )
       ];
 
       # Native builds
@@ -255,6 +259,8 @@
             default = packages.hello-world;
           };
 
+          formatter = pkgs.nixfmt-rfc-style;
+
           devShells.default = pkgs.mkShell {
             name = "oleks-hub-shell";
             buildInputs = [ self.packages.${system}.default ];
@@ -326,6 +332,9 @@
         default = final: _prev: mkPackages final;
         gcc15-fixes = import ./overlays/gcc15-fixes.nix;
         hyprspace = hyprspaceOverlay;
+        # Single home for the s390x rustc symlink_file patch overlay so
+        # consumers (nixos-ci) don't re-declare it + the patch file.
+        s390xRustcSymlink = s390xRustcSymlinkOverlay;
       };
 
       # `nix run .#<app>` — local-parity entrypoints (emmett#44, cluster#192,

scripts/update-gitea-local-fork.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# Update flow for gitea-local-fork driven by passthru.updateScript.
+# Invoked by `nix-update --use-update-script gitea-local-fork`.
+#
+# Source fork:    /home/oleks/projects/gitea
+# Source remote:  https://git.oleks.space/oleks/gitea.git (named `oleks` locally)
+# Tracked branch: oleks/main  (formerly `feat/projects-api`, renamed 2026-05-13)
+#
+# nix-update with --version=branch=X constructs the new version as
+# `<latest-tag>-unstable-<date>` where <latest-tag> is the most recent
+# tag on the remote. If we leave an old `v1.26.0-unstable-<date>` tag
+# from a previous run on the gitea fork, nix-update will pick that
+# as <latest-tag> and we end up with double suffixes. So:
+#
+#   0. Delete any prior `*-unstable-*` tag on the gitea fork (local + remote).
+#   1. Run nix-update default flow: it now sees only clean semver tags
+#      (v1.26.0 etc.), constructs `1.26.0-unstable-<commit-date>`.
+#   2. Tag the gitea fork at the new rev with v<version>, push the tag.
+#   3. Commit flake-hub's package.nix change, push to origin.
+
+set -euo pipefail
+
+FLAKE_HUB="${FLAKE_HUB:-$HOME/projects/nix-customs/flake-hub}"
+GITEA_REPO="${GITEA_REPO:-$HOME/projects/gitea}"
+PKG_FILE="$FLAKE_HUB/packages/gitea-local-fork.nix"
+
+log() { printf '\033[1;36m==>\033[0m %s\n' "$*"; }
+
+# ── 0. Wipe prior unstable tags from gitea fork ───────────────────────────
+cd "$GITEA_REPO"
+log "Cleaning up previous unstable tags on gitea fork (so nix-update sees only clean semver tags)"
+mapfile -t PREV_TAGS < <(git ls-remote --tags oleks 'refs/tags/v*-unstable-*' \
+    | awk '{print $2}' \
+    | sed 's|refs/tags/||;s|\^{}$||' \
+    | sort -u)
+for tag in "${PREV_TAGS[@]}"; do
+    [ -z "$tag" ] && continue
+    log "  deleting $tag"
+    git tag -d "$tag" 2>/dev/null || true
+    git push oleks ":refs/tags/$tag" 2>/dev/null || true
+done
+
+# ── 1. nix-update default flow ────────────────────────────────────────────
+# Also normalize the in-file version to its bare semver baseline so
+# nix-update doesn't see a stale unstable suffix from the local file.
+cd "$FLAKE_HUB"
+log "Normalizing in-file version baseline"
+sed -i -E 's/(version = "[^"]+?)-unstable-[0-9]{4}-[0-9]{2}-[0-9]{2}"/\1"/' "$PKG_FILE"
+
+log "Running nix-update against oleks/main tip on the gitea fork"
+nix run nixpkgs#nix-update -- \
+    --flake gitea-local-fork \
+    --version=branch=main \
+    --build
+
+# ── 2. Tag gitea fork ─────────────────────────────────────────────────────
+NEW_REV=$(grep -oP 'rev = "\K[a-f0-9]{40}' "$PKG_FILE" | head -1)
+NEW_VER=$(grep -oP 'version = "\K[^"]+' "$PKG_FILE" | head -1)
+TAG="v${NEW_VER}"
+log "New version: $NEW_VER (rev ${NEW_REV:0:12})"
+
+cd "$GITEA_REPO"
+if git rev-parse --verify --quiet "refs/tags/$TAG" >/dev/null; then
+    log "Tag $TAG already exists locally — skipping"
+else
+    log "Tagging gitea fork: $TAG at ${NEW_REV:0:12}"
+    git -c commit.gpgsign=false tag -a "$TAG" "$NEW_REV" \
+        -m "Pinned by nix-customs/flake-hub gitea-local-fork derivation"
+fi
+log "Pushing tag to oleks remote"
+git push oleks "$TAG" 2>/dev/null || log "  tag already on remote"
+
+# ── 3. Commit + push flake-hub changes ────────────────────────────────────
+cd "$FLAKE_HUB"
+if git diff --quiet -- "$PKG_FILE"; then
+    log "flake-hub: no changes to commit"
+else
+    log "flake-hub: committing version + hashes bump"
+    git -c commit.gpgsign=false add "$PKG_FILE"
+    git -c commit.gpgsign=false commit -m "gitea-local-fork: refresh to $NEW_VER
+
+Pin to gitea fork rev ${NEW_REV:0:12} (tag $TAG).
+Refreshed by nix-update via passthru.updateScript."
+fi
+
+if git rev-parse '@{u}' >/dev/null 2>&1; then
+    log "flake-hub: pushing"
+    git push
+else
+    log "flake-hub: no upstream tracking — skipping push"
+fi
+
+log "Done. New version $NEW_VER live at:"
+log "  gitea tag: https://git.oleks.space/oleks/gitea/src/tag/$TAG"
+log "  derivation: $PKG_FILE"