feat(rdp): configurable GRD max-framerate and stability fixes

ansible/roles/developer_core/tasks/main.yml

@@ -61,11 +61,6 @@
     file: openvpn.yml
   tags: ['openvpn', 'vpn']
 
-- name: Install NetBird CLI
-  ansible.builtin.include_tasks:
-    file: netbird.yml
-  tags: ['netbird', 'remote']
-
 - name: Install Claude Code CLI
   ansible.builtin.include_tasks:
     file: claude.yml

ansible/roles/developer_core/tasks/rust.yml

@@ -222,3 +222,81 @@
   environment: "{{ cargo_env }}"
   become: "{{ ansible_facts['distribution'] != 'MacOSX' }}"
   become_user: "{{ actual_user if ansible_facts['distribution'] != 'MacOSX' else omit }}"
+
+- name: Install sccache (shared compilation cache)
+  ansible.builtin.command:
+    cmd: cargo install sccache --locked
+    creates: "{{ user_home }}/.cargo/bin/sccache"
+  environment: "{{ cargo_env }}"
+  become: "{{ ansible_facts['distribution'] != 'MacOSX' }}"
+  become_user: "{{ actual_user if ansible_facts['distribution'] != 'MacOSX' else omit }}"
+
+- name: Install cargo-sweep (build artifact cleanup)
+  ansible.builtin.command:
+    cmd: cargo install cargo-sweep --locked
+    creates: "{{ user_home }}/.cargo/bin/cargo-sweep"
+  environment: "{{ cargo_env }}"
+  become: "{{ ansible_facts['distribution'] != 'MacOSX' }}"
+  become_user: "{{ actual_user if ansible_facts['distribution'] != 'MacOSX' else omit }}"
+
+# ============================================================
+# mold linker — 5-10x faster linking for incremental builds
+# Native x86_64 builds only. Cross-compilation uses BFD.
+# ============================================================
+
+- name: Install mold linker (Ubuntu)
+  ansible.builtin.apt:
+    name: mold
+    state: present
+  when: ansible_facts['distribution'] == 'Ubuntu'
+
+- name: Install mold linker (Fedora)
+  ansible.builtin.dnf:
+    name: mold
+    state: present
+  when: ansible_facts['distribution'] == 'Fedora'
+
+- name: Install mold linker via Homebrew (macOS)
+  community.general.homebrew:
+    name: mold
+    state: present
+  become: false
+  environment: "{{ homebrew_env }}"
+  when: ansible_facts['distribution'] == 'MacOSX'
+
+# ============================================================
+# Global Cargo configuration
+# Sets sccache as rustc-wrapper, mold as linker, jobs = 8
+# Per-project .cargo/config.toml files override where needed.
+# ============================================================
+
+- name: Create global Cargo config (Linux)
+  ansible.builtin.blockinfile:
+    path: "{{ user_home }}/.cargo/config.toml"
+    create: true
+    owner: "{{ actual_user }}"
+    group: "{{ actual_user }}"
+    mode: '0644'
+    marker: "# {mark} MANAGED BY DFE-DEVELOPER — build optimisation"
+    block: |
+      [build]
+      jobs = 8
+      rustc-wrapper = "sccache"
+
+      [target.x86_64-unknown-linux-gnu]
+      linker = "clang"
+      rustflags = ["-C", "link-arg=-fuse-ld=mold"]
+  when: ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
+
+- name: Create global Cargo config (macOS)
+  ansible.builtin.blockinfile:
+    path: "{{ user_home }}/.cargo/config.toml"
+    create: true
+    mode: '0644'
+    marker: "# {mark} MANAGED BY DFE-DEVELOPER — build optimisation"
+    block: |
+      [build]
+      jobs = 8
+      rustc-wrapper = "sccache"
+  become: false
+  when: ansible_facts['distribution'] == 'MacOSX'

ansible/roles/developer_core/tasks/verify.yml

@@ -100,21 +100,6 @@
   failed_when: verify_openvpn.rc != 0
   when: ansible_facts['distribution'] == 'MacOSX'
 
-- name: Verify NetBird CLI (Linux)
-  ansible.builtin.command: netbird version
-  register: verify_netbird
-  changed_when: false
-  failed_when: verify_netbird.rc != 0
-  when: ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
-
-- name: Verify NetBird CLI (macOS)
-  ansible.builtin.command: netbird version
-  environment: "{{ homebrew_env }}"
-  register: verify_netbird
-  changed_when: false
-  failed_when: verify_netbird.rc != 0
-  when: ansible_facts['distribution'] == 'MacOSX'
-
 - name: Verify Claude Code CLI (Linux)
   ansible.builtin.command: "{{ user_home }}/.local/bin/claude --version"
   register: verify_claude
@@ -226,7 +211,6 @@
       - semantic-release: {{ verify_semrel.stdout | default('installed') }}
       - Linear CLI: {{ verify_linear.stdout | default('installed') }}
       - OpenVPN: {{ verify_openvpn.stdout | default('skipped (install failed - manual install required)') }}
-      - NetBird CLI: {{ verify_netbird.stdout | default('installed') }}
       - Claude Code CLI: {{ verify_claude.stdout | default('installed') }}
       - Gitleaks: {{ verify_gitleaks.stdout | default('installed') }}
       - act: {{ verify_act.stdout | default('installed') }}

ansible/roles/rdp/defaults/main.yml

@@ -7,6 +7,11 @@
 rdp_username: "hyperi"
 rdp_password: "hyperi"
 
-# Display refresh rate (Hz) - lower values reduce software encoding CPU load
-# Only relevant for VMs using software RFX encoding (no VA-API H.264)
-rdp_refresh_rate: 30
+# FreeRDP library version to pin (Ubuntu only)
+# ubuntu0.3 is broken (heap corruption). Base 3.16.0+dfsg-2 is known-good.
+# See ~/RDP-FREERDP-FIX.md for details.
+freerdp_pin_version: "3.16.0+dfsg-2ubuntu0.4"
+
+# Patched GRD version with configurable max-framerate gsettings key
+# Stock GRD 49.0 hardcodes 60fps. This build reads from gsettings.
+grd_patched_version: "49.0-0ubuntu1.1hyperi1"

ansible/roles/rdp/files/dconf-rdp-performance

@@ -4,3 +4,8 @@
 
 [org/gnome/desktop/interface]
 enable-animations=false
+
+[org/gnome/desktop/remote-desktop/rdp]
+# Cap PipeWire screencast framerate to reduce software encoding load.
+# Requires patched GRD with max-framerate gsettings key.
+max-framerate=uint32 30

ansible/roles/rdp/files/pin-freerdp

@@ -0,0 +1,13 @@
+# Pin FreeRDP libs — prevent apt upgrade from installing broken versions
+# ubuntu0.3 confirmed broken (heap corruption in handover daemon)
+# ubuntu0.4 confirmed stable (2026-03-25)
+# Base 3.16.0+dfsg-2 is the known-good fallback
+# See ~/RDP-FREERDP-FIX.md for details
+#
+# To downgrade if current version breaks:
+#   sudo apt install libfreerdp3-3=3.16.0+dfsg-2 libwinpr3-3=3.16.0+dfsg-2 libfreerdp-server3-3=3.16.0+dfsg-2 libfreerdp-client3-3=3.16.0+dfsg-2 libfreerdp-shadow3-3=3.16.0+dfsg-2 libfreerdp-shadow-subsystem3-3=3.16.0+dfsg-2 libfreerdp-server-proxy3-3=3.16.0+dfsg-2
+#   Then update Pin: version below to 3.16.0+dfsg-2
+
+Package: libfreerdp3-3 libwinpr3-3 libfreerdp-server3-3 libfreerdp-client3-3 libfreerdp-shadow3-3 libfreerdp-shadow-subsystem3-3 libfreerdp-server-proxy3-3 freerdp3-dev
+Pin: version {{ freerdp_pin_version }}
+Pin-Priority: 1001

ansible/roles/rdp/files/rdp-nice-limits.conf

@@ -0,0 +1,6 @@
+# Allow desktop users to run processes with elevated priority (Nice=-10)
+# Required for gnome-remote-desktop-handover systemd user service
+# The Nice=-10 drop-in on the handover service is ignored without this
+# Managed by Ansible (dfe-developer rdp role)
+*               soft    nice            -10
+*               hard    nice            -10

ansible/roles/rdp/tasks/freerdp_pin.yml

@@ -0,0 +1,13 @@
+---
+# Pin FreeRDP libraries to prevent apt upgrades from breaking RDP handover
+# ubuntu0.3 caused heap corruption in gnome-remote-desktop-handover
+# See ~/RDP-FREERDP-FIX.md for details
+
+- name: Deploy FreeRDP apt pin (Ubuntu)
+  ansible.builtin.template:
+    src: ../files/pin-freerdp
+    dest: /etc/apt/preferences.d/pin-freerdp
+    mode: '0644'
+  when:
+    - ansible_facts['distribution'] == 'Ubuntu'
+    - has_gnome