diff --git a/.envrc b/.envrc
index d7340b3..df41b25 100644
--- a/.envrc
+++ b/.envrc
@@ -1,39 +1,58 @@
 #!/usr/bin/env bash
 # https://direnv.net/man/direnv-stdlib.1.html
 
+# for when i spawn a bunch of tabs
+if command -v git-wait >/dev/null; then
+  git() { git-wait "$@"; }
+fi
+
 # TODO:
 # git config --local core.hooksPath "$PWD"/.githooks
 
 # ensure (dirty) updated flake lock
 # TODO: cache this on gitea? Run in background?
-test -d .direnv || mkdir -p .direnv
 now="$(date +%Y-%m-%d)"
-if ! test -s .direnv/pull-date || test "$now" != "$(cat .direnv/pull-date)"; then
-  git reset flake.lock
-  git restore flake.lock
-  git pull --rebase --autostash
-  grep -q "^=======" flake.lock && { git reset flake.lock; rm flake.lock; }
+if [[ ! -d .direnv/tmp ]]; then
+  mkdir -p .direnv/tmp
+elif command -v find >/dev/null; then
+  find .direnv/tmp/ -mindepth 1 -maxdepth 1 -type d -and ! -newermt "4 hours ago" -delete
+fi
+if [[ ! -s .direnv/pull-date || "$now" != "$(cat .direnv/pull-date)" ]]; then
+  tmp=$(mktemp -p .direnv/tmp -d)
+  trap 'rm -rf "$tmp" >&/dev/null' ERR EXIT RETURN
+  if ! $GIT diff --exit-code --quiet HEAD -- flake.lock >&/dev/null; then
+    cp flake.lock "$tmp"/dirty-flake.lock
+    $GIT reset -- flake.lock
+    $GIT restore -- flake.lock
+    cp flake.lock "$tmp"/clean-flake.lock # we could instead preserve the current $GIT rev
+  fi
+  $GIT pull --rebase --autostash
+  if grep -q "^=======" flake.lock; then
+    # TODO: can this happen anymore?
+    $GIT reset -- flake.lock
+    rm flake.lock # restore?
+    $GIT checkout -- flake.lock
+  elif [[ -s "$tmp"/clean-flake.lock ]] && ! diff -q "$tmp"/clean-flake.lock flake.lock >&/dev/null; then
+    cp "$tmp"/flake-dirty.lock flake.lock
+  fi
   # nix flake update
   nix eval --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
     | jq .[] -r \
     | grep -v '^nixpkgs-expensive$' \
-    |  nix flake update
-  echo "$now" > .direnv/pull-date
+    | nix flake update # --output-lock-file "$tmp"/new-flake.lock
+  printf "%s\n" "$now" > .direnv/pull-date
 fi
 
 # source env
-if ! test -f .remote.toml; then
+if [[ ! -f .remote.toml ]]; then
   use flake .#envrc-local
 else
   use flake .#envrc-remote
-  echo
-  just remote-current
-  just remote-list
-  echo
+  printf "\n"
+  just motd
+  printf "\n"
 fi
 
-if rg 'TODO' -q ; then
-  echo "There are $(rg 'TODO' | wc -l ) 'TODO'"
-fi
+unset -f git
 
 export QEMU_NET_OPTS="hostfwd=tcp::10022-:22,hostfwd=tcp::10080-:80,hostfwd=tcp::10443-:443"
diff --git a/justfile b/justfile
index 454d11c..fa8fdda 100644
--- a/justfile
+++ b/justfile
@@ -1,3 +1,4 @@
+export GUM_CHOOSE_HEIGHT := "15"
 export GUM_FILTER_HEIGHT := "15"
 
 #export hosts_nixos := `2>/dev/null nix eval .\#nixosConfigurations --apply builtins.attrNames --json`
@@ -21,22 +22,22 @@ update:
   git pull --rebase --autostash
   nix flake update --commit-lock-file
   @mkdir -p .direnv/
-  @echo "$(date +%Y-%m-%d)" > .direnv/pull-date
+  @printf "%s\n" "$(date +%Y-%m-%d)" > .direnv/pull-date
 
 @update-select:
   git reset flake.lock
   git restore flake.lock
   nix eval .#inputs --apply builtins.attrNames --json 2>/dev/null \
-    | (echo --commit-lock-file; jq '.[]' -r | tr '0123456789' '9876543210' | sort | tr '0123456789' '9876543210' | grep -v "^self$") \
-    | gum choose --no-limit --height=15 \
+    | (printf "%s\n" --commit-lock-file; jq '.[]' -r | tr '0123456789' '9876543210' | sort | tr '0123456789' '9876543210' | grep -v "^self$") \
+    | gum choose --no-limit \
     | xargs nix flake update
   git add flake.lock
 
-#build hostname=`if test -z "${IS_REMOTE_ENV:-}"; then just _a_host_timeout; else echo; fi`:
+#build hostname=`if test -z "${IS_REMOTE_ENV:-}"; then just _a_host_timeout; else printf "\n"; fi`:
 build hostname="":
   nixos-rebuild build --accept-flake-config --show-trace --flake .#"{{hostname}}"
 
-#build-no-remote-builders hostname=`if test -z "$IS_REMOTE_ENV"; then just _a_host_timeout; else echo; fi`:
+#build-no-remote-builders hostname=`if test -z "$IS_REMOTE_ENV"; then just _a_host_timeout; else printf "\n"; fi`:
 build-no-remote-builders hostname="":
   nixos-rebuild build --accept-flake-config --show-trace --flake .#"{{hostname}}" --builders ""
 
@@ -62,15 +63,15 @@ boot-and-reboot:
 
 push hostname=`just _a_host` cmd=`gum choose test switch boot --header "Select mode..."`:
   nixos-rebuild build --flake .#{{hostname}}
-  @echo pushing...
-  NIX_NO_NOM=1 nixos-rebuild {{cmd}} --flake .#{{hostname}} --target-host root@$(nix eval .#nixosConfigurations.{{hostname}}.config.networking.fqdn --json | jq . -r) --use-substitutes
-  #NIX_NO_NOM=1 NIX_SSHOPTS="-tt" nixos-rebuild {{cmd}} --flake .#{{hostname}} --use-remote-sudo --target-host $(nix eval .#nixosReports.{{hostname}}.fqdn --json | jq . -r) --use-substitutes
+  @printf "%s\n" pushing...
+  NIX_NO_NOM=1 nixos-rebuild {{cmd}} --flake .#{{hostname}} --target-host root@$(nix eval .#nixosConfigurations."{{hostname}}".config.networking.fqdn --json | jq . -r) --use-substitutes
+  #NIX_NO_NOM=1 NIX_SSHOPTS="-tt" nixos-rebuild {{cmd}} --flake .#"{{hostname}}" --use-remote-sudo --target-host $(nix eval .#nixosReports."{{hostname}}".fqdn --json | jq . -r) --use-substitutes
 
 inspect:
   nix run -- nixpkgs#nix-inspect -p .
 
 inspect-config host=`just _a_host` prefix="":
-  nix run -- nixpkgs#nix-inspect  -e '(builtins.getFlake "'"$PWD"'").nixosConfigurations.{{host}}.config{{ if prefix == "" { "" } else { "." + prefix } }}'
+  nix run -- nixpkgs#nix-inspect  -e '(builtins.getFlake "'"$PWD"'").nixosConfigurations."{{host}}".config{{ if prefix == "" { "" } else { "." + prefix } }}'
 
 @_a_host:
   hostnames="$(nix eval .#nixosConfigurations --apply builtins.attrNames --json 2>/dev/null | jq '.[]' -r)"; \
@@ -99,13 +100,21 @@ inspect-config host=`just _a_host` prefix="":
   gum <<<"$hostnames" filter --placeholder "Pick a host..." --no-limit
 
 @remote-current:
-  >&2 echo Current remote: $(remote-host)
+  # printf "%s\n" "Current remote: $(remote-host)" # slow
+  printf "%s\n" "Current remote: $(tomlq <.remote.toml '.hosts | to_entries[] | select(.value.default==true) | .value.host' -r)"
 
 @remote-list:
   tomlq <.remote.toml '.hosts | to_entries[] | "remote-set \(.key+1) # -> \(.value.host)"' -r
 
-@remote-set remote=`just remote-current && just _a_remote_label`:
-  remote-set {{remote}}
+@remote-set remote=`just remote-current >&2 && just _a_remote_label`:
+  remote-set "{{remote}}"
+
+@motd: remote-current remote-list
+  printf "\n"; \
+  todos=$(rg 'TODO' | wc -l); \
+  if [[ "$todos" -gt 10 ]]; then \
+    printf "%s\n" "There are $todos 'TODO's"; \
+  fi
 
 @_a_remote_label:
   just remote-list | gum filter --placeholder "Pick a remote..." | cut -d' ' -f2
@@ -128,6 +137,7 @@ inspect-config host=`just _a_host` prefix="":
 @_remote_label_from_fqdn hostname=`just _a_fqdn`:
   tomlq <.remote.toml '.hosts | to_entries[] | select(.value.host == "{{ hostname }}") | .key+1' -r
 
+# TODO: 'tmux new $cmd \; set-option destroy-unattached' instead of NIX_NO_NOM
 @remote-mprocs +$cmd=`printf "just %s\n" $(just --summary --unsorted) | gum filter --placeholder "Pick a recipie..."`:
   just _some_remote_labels | sed -E 's/(.*)/remote --label="\1" "env NIX_NO_NOM=1 $cmd"/g' | xargs -d'\n' mprocs