diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 000000000..a0c334857
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,5 @@
+[profile.dev]
+# Full file/line backtraces, no per-variable debug info. ~20-30% faster
+# builds and much faster macOS link. Need lldb locals? Override per-shell:
+# CARGO_PROFILE_DEV_DEBUG=2
+debug = "line-tables-only"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0fb34ad2..1b9dcd657 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,10 @@ on:
     branches: [main, release]
   pull_request:
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 env:
   CARGO_TERM_COLOR: always
   PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.cache/ms-playwright
@@ -81,6 +85,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           save-if: ${{ github.event_name != 'pull_request' }}
@@ -102,6 +107,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: desktop/src-tauri
@@ -264,6 +270,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: |
@@ -474,7 +481,8 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
-          channel: stable
+          flutter-version: 3.41.7  # keep in sync with hermit pin (bin/.flutter-3.41.7.pkg)
+          cache: true
       - name: Install dependencies
         run: cd mobile && flutter pub get
       - name: Format check
@@ -547,8 +555,10 @@ jobs:
       - name: Build server binaries
         env:
           TARGET: ${{ matrix.target }}
+          # PRs: compile + build-script gate only (no codegen/link). Main: full link gate.
+          CARGO_CMD: ${{ github.event_name == 'pull_request' && 'check' || 'build' }}
         run: |
-          cross build --release --target "$TARGET" \
+          cross "$CARGO_CMD" --release --target "$TARGET" \
             -p buzz-relay \
             -p buzz-acp \
             -p buzz-agent \
diff --git a/.gitignore b/.gitignore
index 9a7436439..8bb65d1e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,7 +12,8 @@
 
 # Editor / IDE
 .idea/
-.vscode/
+.vscode/*
+!.vscode/settings.json
 *.swp
 *.swo
 *~
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 000000000..c39504ebc
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+  "rust-analyzer.cargo.targetDir": true
+}
diff --git a/Cargo.toml b/Cargo.toml
index d73562580..c6dd71349 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -119,13 +119,19 @@ buzz-media = { path = "crates/buzz-media" }
 buzz-sdk = { path = "crates/buzz-sdk" }
 buzz-ws-client = { path = "crates/buzz-ws-client" }
 
-# CI profile — release-grade codegen for the relay so e2e tests hit a
-# realistic binary, not an unoptimised debug build.  Inherits `release`
-# defaults (opt-level 3, no debug-assertions) but keeps incremental
-# compilation enabled and avoids LTO so the build stays fast.
+# CI profile — builds the relay for desktop e2e. Dependencies keep full
+# release optimization (warm from main's cache; they carry the runtime hot
+# path: tokio/sqlx/axum). Workspace crates build at opt-level 1 — enough for
+# stable e2e timing (PR #307 flakiness was opt-0 + debug-assertions) at
+# roughly half the codegen cost. `incremental` is irrelevant in CI:
+# rust-cache exports CARGO_INCREMENTAL=0 and never caches member artifacts.
 [profile.ci]
 inherits = "release"
 lto = false
+opt-level = 1
+
+[profile.ci.package."*"]
+opt-level = 3
 
 # Sprig profile — optimized for deploy-anywhere Sprig release artifacts.
 # Sprig is distributed over the network and installed on fresh hosts, so binary
diff --git a/lefthook.yml b/lefthook.yml
index 87a1ef4b4..1ee6fcbf4 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -20,10 +20,6 @@ pre-commit:
 pre-push:
   parallel: true
   commands:
-    rust-clippy:
-      run: just clippy
-    desktop-tauri-clippy:
-      run: just desktop-tauri-clippy
     rust-tests:
       run: just test-unit
     desktop-test: