Add kernel-7 audio diagnostics and verify SOF/UCM completeness

- Add alsa-ucm-conf to installed packages.list (already in live-desktop.list)
- Create KERNEL7_AUDIO_XPS9700.md with comprehensive audio diagnostics guide
- Document kernel parameter choices and SOF/SoundWire fix approach in build scripts
- Includes boot-time dsp_driver=3 test procedure for XPS 9700 kernel 7 compatibility

.gitignore

@@ -12,9 +12,7 @@ id_ovh*
 authorized_keys
 
 # ── Generated build staging (build-iso.sh populates this at build time) ─
-build/includes/
-build/live-includes/
-build/first-login.sh
+build/*
 
 # ── Build artifacts ────────────────────────────────────────────────────
 out/

Makefile

@@ -15,7 +15,7 @@ PROJECT_DIR := $(CURDIR)
 OUT         := $(PROJECT_DIR)/out
 SECRETS     := $(PROJECT_DIR)/secrets.env
 
-.PHONY: all iso live test test-disk test-iso qemu shellcheck clean distclean check-secrets check-docker
+.PHONY: all iso live live-qemu test test-disk test-iso qemu shellcheck clean distclean check-secrets check-docker
 
 all: iso
 
@@ -32,6 +32,11 @@ iso: check-secrets check-docker
 live: check-secrets check-docker
 	$(PROJECT_DIR)/iso/build-live-iso.sh
 
+# Launch the live ISO in QEMU with 12 GB RAM so nix packages fit in the tmpfs.
+# The live session is a pure-RAM tmpfs overlay; Cinnamon + nix need ~7-8 GB total.
+live-qemu:
+	$(PROJECT_DIR)/tests/launch-live-qemu.sh
+
 test-iso: check-secrets check-docker
 	REBUILD_ISO=1 $(PROJECT_DIR)/tests/run-qemu-test.sh
 

config/install.conf

@@ -7,7 +7,7 @@ HOSTNAME="xps9700"
 USERNAME="moze"
 USER_FULLNAME="moze"
 USER_UID="1000"
-USER_GROUPS="wheel,docker,video,audio,input,plugdev,network,kvm,users"
+USER_GROUPS="wheel,docker,video,audio,input,plugdev,network,kvm,users,bluetooth"
 DEFAULT_SHELL="/bin/bash"
 
 # ---------- Locale ----------
@@ -78,6 +78,7 @@ NIX_USER_PACKAGES=(
   "nixpkgs#google-chrome"
   "nixpkgs#mission-center"
   "nixpkgs#vscode"
+  "nixpkgs#fastfetch"
 )
 
 # ---------- Cinnamon customization ----------

config/profiles/mainline-niri/customizations/niri.sh

@@ -47,10 +47,9 @@ prefer-no-csd
 
 spawn-at-startup "swaybg" "-i" "/usr/share/backgrounds/void-installer/pxfuel.jpg"
 spawn-at-startup "mako"
-spawn-at-startup "nm-applet" "--indicator"
-spawn-at-startup "blueman-applet"
 spawn-at-startup "/usr/libexec/polkit-gnome-authentication-agent-1"
-spawn-at-startup "noctalia-shell"
+spawn-at-startup "sh" "-c" "command -v gnome-keyring-daemon >/dev/null 2>&1 && gnome-keyring-daemon --start --components=secrets,pkcs11 >/dev/null 2>&1; true"
+spawn-at-startup "sh" "-c" "i=0; while [ \$i -lt 30 ] && ! dbus-send --system --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.bluez >/dev/null 2>&1; do sleep 1; i=\$((i+1)); done; exec noctalia-shell"
 
 cursor {
     xcursor-theme "Bibata-Modern-Ice"
@@ -59,7 +58,7 @@ cursor {
 
 binds {
     Mod+T          { spawn "alacritty"; }
-    Mod+D          { spawn "fuzzel"; }
+    Mod+D          { spawn "sh" "-c" "quickshell msg -c noctalia-shell launcher toggle"; }
     Mod+Q          { close-window; }
     Mod+Shift+E    { quit; }
     Print          { screenshot; }
@@ -99,9 +98,74 @@ export MOZ_ENABLE_WAYLAND=1
 export _JAVA_AWT_WM_NONREPARENTING=1
 export XDG_CURRENT_DESKTOP=niri
 export XDG_SESSION_TYPE=wayland
+export GTK_USE_PORTAL=1
+export ELECTRON_OZONE_PLATFORM_HINT=auto
 EOF
     chmod 0644 "$TARGET/etc/profile.d/wayland.sh"
     log "wayland environment installed at /etc/profile.d/wayland.sh"
+
+    # Expose nix .desktop files and icons (installed via first-boot-nix)
+    cat > "$TARGET/etc/profile.d/nix-xdg.sh" <<'NIXEOF'
+# Add nix profile share directory so launchers and icon themes pick up nix apps.
+if [[ -d "${HOME:-}/.nix-profile/share" ]]; then
+    case ":${XDG_DATA_DIRS:-}:" in
+        *":$HOME/.nix-profile/share:"*) ;;
+        *) export XDG_DATA_DIRS="$HOME/.nix-profile/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" ;;
+    esac
+fi
+NIXEOF
+    chmod 0644 "$TARGET/etc/profile.d/nix-xdg.sh"
+
+    # /etc/environment: baseline XDG_DATA_DIRS loaded by pam_env for ALL session
+    # types (TTY login, greetd). The nix profile share path must be absolute here
+    # because pam_env does not expand $HOME when the key uses = (not DEFAULT=).
+    # The installed user's home is /home/$USERNAME, so we hardcode it.
+    cat > "$TARGET/etc/environment" <<ENVEOF
+XDG_DATA_DIRS=/home/${USERNAME}/.nix-profile/share:/usr/local/share:/usr/share
+QT_QPA_PLATFORM=wayland;xcb
+GDK_BACKEND=wayland,x11
+MOZ_ENABLE_WAYLAND=1
+LIBSEAT_BACKEND=logind
+GTK_USE_PORTAL=1
+ELECTRON_OZONE_PLATFORM_HINT=auto
+ENVEOF
+    log "/etc/environment written with XDG_DATA_DIRS for nix profile"
+
+    # dconf system keyfile: GTK dark theme reported to all apps via xdg-portal
+    install -d -m 0755 "$TARGET/etc/dconf/db/local.d"
+    install -d -m 0755 "$TARGET/etc/dconf/profile"
+    cat > "$TARGET/etc/dconf/db/local.d/01-dark-theme" <<'EOF'
+[org/gnome/desktop/interface]
+color-scheme='prefer-dark'
+gtk-theme='Gruvbox-Dark'
+icon-theme='Gruvbox-Plus-Dark'
+cursor-theme='Bibata-Modern-Ice'
+cursor-size=24
+EOF
+    echo 'user-db:user
+system-db:local' > "$TARGET/etc/dconf/profile/user"
+    run_chroot "dconf update 2>/dev/null || true"
+    log "dconf dark theme profile installed"
+}
+
+_niri_write_session_wrapper() {
+    local TARGET="$1"
+    # Create /usr/local/bin/niri-session: sources /etc/profile before exec'ing
+    # niri --session so that all /etc/profile.d/* scripts (nix paths,
+    # XDG_DATA_DIRS with ~/.nix-profile/share, wayland env, etc.) are in effect
+    # for the compositor and every app it spawns.
+    install -d -m 0755 "$TARGET/usr/local/bin"
+    cat > "$TARGET/usr/local/bin/niri-session" <<'EOF'
+#!/bin/bash
+# niri-session — wrapper started by greetd/tuigreet.
+# Sources /etc/profile so that all /etc/profile.d/* scripts run
+# (nix paths, wayland env, XDG_DATA_DIRS with ~/.nix-profile/share, etc.)
+# before handing off to the compositor.
+[ -f /etc/profile ] && . /etc/profile
+exec niri --session "$@"
+EOF
+    chmod 0755 "$TARGET/usr/local/bin/niri-session"
+    log "niri-session wrapper installed at /usr/local/bin/niri-session"
 }
 
 _niri_setup_greetd() {
@@ -143,7 +207,122 @@ EOF
     fi
 }
 
-_niri_write_kdl    "$TARGET"
-_niri_write_env    "$TARGET"
-_niri_setup_greetd "$TARGET"
-_niri_install_noctalia "$TARGET"
+_niri_write_portal_config() {
+    local TARGET="$1"
+    # Tell xdg-desktop-portal to route all portals through the GTK backend when
+    # running under niri.  Without this the dispatcher has no match for
+    # XDG_CURRENT_DESKTOP=niri and file-picker / open-with calls fail silently.
+    install -d -m 0755 "$TARGET/etc/xdg/xdg-desktop-portal"
+    cat > "$TARGET/etc/xdg/xdg-desktop-portal/niri-portals.conf" <<'EOF'
+[preferred]
+default=gtk
+org.freedesktop.impl.portal.FileChooser=gtk
+org.freedesktop.impl.portal.AppChooser=gtk
+org.freedesktop.impl.portal.OpenURI=gtk
+org.freedesktop.impl.portal.Print=gtk
+org.freedesktop.impl.portal.Screenshot=gtk
+org.freedesktop.impl.portal.Inhibit=gtk
+org.freedesktop.impl.portal.Notification=gtk
+org.freedesktop.impl.portal.Settings=gtk
+EOF
+    log "niri portal config installed (gtk backend for all portals)"
+}
+
+_niri_write_sound_udev_rules() {
+    local TARGET="$1"
+    # PCM/control nodes are created root:root on some kernels before the audio
+    # group is provisioned. This persistent rule ensures correct ownership.
+    install -d -m 0755 "$TARGET/etc/udev/rules.d"
+    cat > "$TARGET/etc/udev/rules.d/70-sound-perms.rules" <<'EOF'
+# Allow the audio group to access ALSA PCM and control devices.
+SUBSYSTEM=="sound", GROUP="audio", MODE="0660"
+EOF
+    log "sound udev rules installed"
+}
+
+_niri_write_noctalia_defaults() {
+    local TARGET="$1"
+    # Write a baseline noctalia settings.json into skel so every new user
+    # (including the installed user) gets the correct wallpaper directory,
+    # dark mode, and Gruvbox colour scheme out of the box.
+    local skel_noc="$TARGET/etc/skel/.config/noctalia"
+    install -d -m 0755 "$skel_noc"
+    cat > "$skel_noc/settings.json" <<NOCEOF
+{
+    "appLauncher": {
+        "iconMode": "apps",
+        "sortByMostUsed": true,
+        "showCategories": true,
+        "viewMode": "grid",
+        "pinnedApps": [],
+        "terminalCommand": "alacritty -e",
+        "density": "default",
+        "position": "center"
+    },
+    "colorSchemes": {
+        "darkMode": true,
+        "predefinedScheme": "Gruvbox",
+        "generationMethod": "tonal-spot",
+        "manualSunrise": "06:30",
+        "manualSunset": "18:30",
+        "monitorForColors": ""
+    },
+    "wallpaper": {
+        "enabled": true,
+        "directory": "/usr/share/backgrounds/void-installer",
+        "fillMode": "crop",
+        "fillColor": "#000000",
+        "automationEnabled": false,
+        "favorites": [],
+        "hideWallpaperFilenames": false,
+        "linkLightAndDarkWallpapers": true,
+        "monitorDirectories": [],
+        "enableMultiMonitorDirectories": false
+    }
+}
+NOCEOF
+    chmod 0644 "$skel_noc/settings.json"
+    # Mirror into installed user's home
+    install -d -m 0755 "$TARGET/home/$USERNAME/.config/noctalia"
+    cp "$skel_noc/settings.json" "$TARGET/home/$USERNAME/.config/noctalia/settings.json"
+    run_chroot "chown -R $USERNAME:$USERNAME /home/$USERNAME/.config/noctalia" || true
+    log "noctalia default settings installed (wallpaper dir + Gruvbox dark)"
+}
+
+_niri_set_default_browser() {
+    local TARGET="$1"
+    # System-wide MIME defaults: google-chrome (installed via nix) as the
+    # default browser for http/https/html.  Written to /etc/xdg/mimeapps.list
+    # (system default, read before ~/.config/mimeapps.list) and also into skel
+    # so the user-level entry is set from first login.
+    install -d -m 0755 "$TARGET/etc/xdg"
+    cat > "$TARGET/etc/xdg/mimeapps.list" <<'EOF'
+[Default Applications]
+text/html=google-chrome.desktop
+x-scheme-handler/http=google-chrome.desktop
+x-scheme-handler/https=google-chrome.desktop
+x-scheme-handler/about=google-chrome.desktop
+x-scheme-handler/unknown=google-chrome.desktop
+application/pdf=google-chrome.desktop
+application/xhtml+xml=google-chrome.desktop
+application/xml=google-chrome.desktop
+EOF
+    # Also set in user skel so ~/.config/mimeapps.list is populated on first login
+    install -d -m 0755 "$TARGET/etc/skel/.config"
+    cp "$TARGET/etc/xdg/mimeapps.list" "$TARGET/etc/skel/.config/mimeapps.list"
+    # Mirror into installed user home
+    install -d -m 0755 "$TARGET/home/$USERNAME/.config"
+    cp "$TARGET/etc/xdg/mimeapps.list" "$TARGET/home/$USERNAME/.config/mimeapps.list"
+    run_chroot "chown $USERNAME:$USERNAME /home/$USERNAME/.config/mimeapps.list" || true
+    log "google-chrome set as default browser (mimeapps.list)"
+}
+
+_niri_write_kdl             "$TARGET"
+_niri_write_env             "$TARGET"
+_niri_write_session_wrapper "$TARGET"
+_niri_write_portal_config   "$TARGET"
+_niri_write_sound_udev_rules "$TARGET"
+_niri_setup_greetd          "$TARGET"
+_niri_install_noctalia      "$TARGET"
+_niri_write_noctalia_defaults "$TARGET"
+_niri_set_default_browser     "$TARGET"

config/profiles/mainline-niri/packages.list

@@ -4,6 +4,7 @@
 # --- base / boot ---
 base-system
 linux-mainline
+linux-mainline-headers
 linux-firmware
 linux-firmware-network
 intel-ucode
@@ -49,6 +50,7 @@ openssh
 iwd
 nftables
 chrony
+wireless-regdb
 
 # --- audio (pipewire stack) ---
 pipewire
@@ -56,7 +58,9 @@ wireplumber
 alsa-pipewire
 pavucontrol
 alsa-utils
+alsa-ucm-conf
 playerctl
+sof-firmware
 
 # --- graphics / wayland ---
 wayland
@@ -70,12 +74,10 @@ libxkbcommon
 
 # --- nvidia (PRIME offload) ---
 nvidia
-nvidia-libs-32bit
 nvidia-vaapi-driver
 
 # --- niri compositor + wayland ecosystem ---
 niri
-fuzzel
 mako
 swaybg
 swayidle
@@ -89,6 +91,12 @@ xdg-desktop-portal-wlr
 polkit-gnome
 brightnessctl
 
+# --- file manager ---
+nautilus
+
+# --- keyring (Chrome / VSCode secret storage) ---
+gnome-keyring
+
 # --- noctalia shell runtime deps (noctalia-shell itself is installed in
 #     niri.sh from the third-party XBPS repo at universalrepo.r1xelelo.workers.dev).
 ImageMagick
@@ -110,10 +118,12 @@ gvfs-smb
 file-roller
 gnome-keyring
 seahorse
-network-manager-applet
 blueman
 bluez
 
+# --- bluetooth audio ---
+bluez-alsa
+
 # --- display manager ---
 # niri can be launched directly via TTY (`niri-session`) or via a wayland-aware
 # greeter. We use greetd + tuigreet — lighter than lightdm under wayland.
@@ -170,9 +180,6 @@ system-config-printer
 sane
 simple-scan
 
-# --- bluetooth audio ---
-bluez-alsa
-
 # --- backups / snapshots ---
 timeshift
 grub-btrfs

config/profiles/mainline-niri/packages.live-desktop.list

@@ -0,0 +1,126 @@
+# Packages included in the LIVE desktop ISO squashfs for the mainline-niri profile.
+# Lines beginning with '#' or empty are skipped.
+# noctalia-shell comes from the third-party repo added by build-niri-live-iso.sh.
+
+# --- base / boot ---
+base-system
+linux-mainline
+linux-mainline-headers
+# Kernel 6 (stable) included for dual-boot menu entry fallback.
+linux
+linux-headers
+linux-firmware
+linux-firmware-network
+intel-ucode
+dracut
+
+# --- core userspace ---
+sudo
+bash
+bash-completion
+git
+curl
+wget
+vim
+nano
+htop
+tmux
+unzip
+zip
+xz
+rsync
+pciutils
+usbutils
+lsof
+file
+which
+man-pages
+mdocml
+ca-certificates
+xtools
+gptfdisk
+parted
+btrfs-progs
+dosfstools
+efibootmgr
+
+# --- networking ---
+NetworkManager
+NetworkManager-openvpn
+openssh
+iwd
+chrony
+wireless-regdb
+
+# --- audio (pipewire stack) ---
+pipewire
+wireplumber
+alsa-pipewire
+pavucontrol
+alsa-utils
+alsa-ucm-conf
+playerctl
+sof-firmware
+
+# --- Wayland session ---
+mesa-dri
+niri
+xwayland-satellite
+elogind
+seatd
+dbus
+
+# --- nvidia PRIME (from nonfree repo) ---
+nvidia
+nvidia-vaapi-driver
+
+# --- display manager ---
+greetd
+tuigreet
+
+# --- terminal + launcher ---
+alacritty
+
+# --- notification + background ---
+mako
+swaybg
+
+# --- bluetooth ---
+bluez
+blueman
+
+# --- polkit (auth dialogs) ---
+polkit
+polkit-gnome
+
+# --- noctalia-shell runtime deps ---
+brightnessctl
+ImageMagick
+python3
+upower
+power-profiles-daemon
+wl-clipboard
+zenity
+
+# --- XDG portals ---
+xdg-desktop-portal
+xdg-desktop-portal-gtk
+xdg-desktop-portal-gnome
+xdg-utils
+xdg-user-dirs
+
+# --- file manager ---
+nautilus
+
+# --- keyring (Chrome / VSCode secret storage) ---
+gnome-keyring
+
+# --- nix (for prebaked packages — spotify, discord, google-chrome, vscode, fastfetch, etc.) ---
+nix
+
+# --- noctalia-shell (from noctalia third-party XBPS repo) ---
+noctalia-shell
+
+# --- fonts ---
+noto-fonts-ttf
+noto-fonts-emoji

config/profiles/stable-cinnamon/packages.list

@@ -50,6 +50,7 @@ iwd
 wpa_supplicant
 nftables
 chrony
+wireless-regdb
 
 # --- audio ---
 pipewire
@@ -57,6 +58,7 @@ wireplumber
 alsa-pipewire
 pavucontrol
 alsa-utils
+sof-firmware
 
 # --- graphics / xorg ---
 xorg-minimal

config/profiles/stable-cinnamon/packages.live-desktop.list

@@ -15,6 +15,7 @@ sudo
 bash
 bash-completion
 git
+zenity
 curl
 wget
 vim
@@ -46,6 +47,7 @@ openssh
 iwd
 wpa_supplicant
 chrony
+wireless-regdb
 
 # --- audio ---
 pipewire
@@ -53,6 +55,7 @@ wireplumber
 alsa-pipewire
 pavucontrol
 alsa-utils
+sof-firmware
 
 # --- graphics / xorg ---
 xorg-minimal
@@ -114,6 +117,9 @@ gtk-engine-murrine
 dconf
 dconf-editor
 
+# --- code editors / dev tools ---
+vscode
+
 # --- media / utilities ---
 vlc
 flameshot

docs/KERNEL7_AUDIO_XPS9700.md

@@ -0,0 +1,122 @@
+# Kernel 7 Audio Troubleshooting for Dell XPS 17 9700
+
+## Symptom
+On the Niri live ISO booting kernel 7, audio shows only HDMI devices and "Dummy Output" in `wpctl status`. Internal speakers and headphone jack do not appear.
+
+## Root Cause
+The XPS 17 9700 is a Dell SoundWire platform requiring **SOF + SoundWire** for internal audio on modern Linux kernels. The issue is **not** PipeWire misconfiguration. Common causes are:
+
+1. Kernel driver stack selection issue (wrong path selected at boot)
+2. Missing or mismatched SOF firmware/topology
+3. Missing or mismatched `sof-soundwire` UCM profiles
+4. A kernel SoundWire regression
+
+## Diagnostic Steps
+
+### 1. Verify the driver stack is loading
+Boot into the live ISO and check which driver is active:
+
+```bash
+# Should show SOF driver for internal audio
+lsmod | grep -E '^sof|^snd_sof'
+
+# Should show the SoundWire machine driver
+lsmod | grep -E 'sof_sdw|sof.*mach'
+
+# Check kernel logs for SoundWire errors
+sudo dmesg | grep -Ei 'soundwire|sdw|sof.*error|topology.*-22'
+```
+
+### 2. Test explicit SOF driver selection
+If internal audio is missing, the kernel's auto-detection may have selected the wrong path. At the GRUB/boot menu, edit the kernel command line and add:
+
+```
+snd-intel-dspcfg.dsp_driver=3
+```
+
+This explicitly forces SOF (value `3`) for the audio stack. Options are:
+- `0`: auto (kernel's default)
+- `1`: legacy HDA
+- `3`: SOF (correct for this laptop)
+- `4`: AVS
+
+Then boot and re-check:
+```bash
+wpctl status
+```
+
+### 3. Verify package completeness
+Ensure the live image has the required audio support packages:
+
+```bash
+xbps-query -l | grep -E '^ii.*sof-firmware|alsa-ucm-conf|alsa-utils'
+```
+
+Expected output should include:
+- `sof-firmware` (Sound Open Firmware binaries and topology)
+- `alsa-ucm-conf` (Use Case Manager profiles for `sof-soundwire`)
+- `alsa-utils` (ALSA utilities and initial mixer state)
+
+### 4. Check PipeWire/WirePlumber state
+Once the kernel exposes the internal audio devices (they should appear in `wpctl status`), verify PipeWire is reading them correctly:
+
+```bash
+# List all devices seen by PipeWire
+pw-cli ls Device
+
+# Check WirePlumber's ALSA monitor for errors
+journalctl -u wireplumber.service -n 50
+
+# Manually re-scan if needed
+pw-cli list-objects Module | grep monitor
+```
+
+## If It Still Fails
+
+### Check for a kernel regression
+Recent kernel versions 6.9 and 6.10 had SoundWire regressions affecting XPS-series Dell laptops. These were fixed in:
+- 6.9.x (fixed in 6.9 stable releases)
+- 6.10.11+
+
+If kernel 7.x shows the same symptoms, check the [SOF upstream issues](https://github.com/thesofproject/linux/issues) for similar reports.
+
+### Compare against a known-good kernel
+If kernel 7 still fails with `dsp_driver=3`:
+1. Boot with the fallback kernel 6 (available in the Niri live ISO GRUB menu)
+2. Test audio on kernel 6
+3. If audio works on kernel 6 but not kernel 7, there is likely a kernel-7-specific regression
+
+Report findings to:
+- [SOF upstream](https://github.com/thesofproject/linux/issues)
+- [Void Linux](https://github.com/void-linux/void-packages)
+
+### Manual ALSA routing (for microphone issues)
+If speakers work but the internal microphone does not, manually set the mic input mux:
+
+```bash
+amixer --card 1 set 'rt715 ADC 24 Mux' 'DMIC3'
+```
+
+Then persist the state:
+```bash
+sudo alsactl store
+```
+
+## References
+
+- [ArchWiki: Dell XPS 17 (9700)](https://wiki.archlinux.org/title/Dell_XPS_17_(9700))
+- [ArchWiki: Sound Open Firmware](https://wiki.archlinux.org/title/Sound_Open_Firmware)
+- [SOF upstream issue 4999: 6.8.9→6.9.0 regression](https://github.com/thesofproject/linux/issues/4999)
+- [Kernel docs: intel-dsp-config](https://github.com/torvalds/linux/blob/master/sound/hda/core/intel-dsp-config.c)
+- [XPS 9700 Ubuntu fix guide](https://askubuntu.com/questions/1270442/no-sound-on-xps-17-9700)
+
+## Live ISO Packages
+
+The mainline-niri Niri live ISO includes:
+- `sof-firmware`: Intel SOF binary and topology files
+- `alsa-ucm-conf`: ALSA Use Case Manager profiles, including `sof-soundwire`
+- `pipewire` and `wireplumber`: Session and policy management
+- `linux-mainline`: Kernel 7.x with SOF support
+- `linux`: Kernel 6.x fallback entry in GRUB
+
+The build ensures both kernels are available to test audio driver behavior across kernel versions.

docs/LIVE_ISO.md

@@ -85,44 +85,74 @@ The `/etc/lightdm/.session` file (content: `cinnamon`) is read by the hook to se
 
 ## Nix Integration
 
-### Daemon mode (not single-user)
-The Void `nix` xbps package ships `nix-daemon` with a runit service at `/etc/sv/nix-daemon`. The daemon puts its socket at:
-```
-/var/nix/daemon-socket/socket
+### Prebake architecture (packages baked into squashfs)
+Nix packages are **pre-installed at ISO build time** inside the Docker container and the entire `/nix` store is rsynced into the squashfs overlay. This means packages are available immediately on boot — no downloads, no tmpfs space pressure.
+
+**Why not install at first login?** The live system mounts squashfs + tmpfs overlay. Installing ~4 GB of nix packages at runtime fills the tmpfs overlay and causes out-of-space failures. Baking them into squashfs sidesteps this completely.
+
+### Build-time nix install (inside Docker, single-user)
+Docker runs as root. Nix is installed in single-user mode (no daemon, no nixbld group):
+```sh
+mkdir -m 0755 -p /nix
+export NIX_CONFIG="build-users-group = "   # suppress nixbld group requirement
+curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+source /root/.nix-profile/etc/profile.d/nix.sh
+export PATH="/root/.nix-profile/bin:$PATH"
+NIXPKGS_ALLOW_UNFREE=1 nix profile add \
+    --extra-experimental-features "nix-command flakes" --impure \
+    nixpkgs#spotify nixpkgs#discord ...
 ```
 
-We use daemon mode (not single-user) because `/nix/store` stays root-owned. The live user is granted trust via `nix.conf`:
+The full `/nix` directory is then staged into the squashfs overlay:
+```sh
+rsync -a /nix/ "$INCLUDE_DIR/nix/"
+```
+
+### Nix prebake cache
+To avoid re-downloading packages on every build, the nix store is cached at:
+```
+cache/nix-prebake/<md5-of-package-list>/
+```
+If the cache exists and the package list md5 matches, the build restores from cache instead of re-running `nix profile add`. Cache is ~5 GB. Subsequent builds with an unchanged package list complete the nix step in ~1 minute instead of ~20 minutes.
+
+### Current packages (NIX_USER_PACKAGES in build-live-iso.sh)
+- `nixpkgs#google-chrome` — replaces chromium (removed from xbps packages)
+- `nixpkgs#spotify`
+- `nixpkgs#discord`
+- `nixpkgs#localsend`
+- `nixpkgs#mission-center`
+- `nixpkgs#vscode`
+
+### XDG / PATH setup for live user
+For Cinnamon to find nix `.desktop` files and for terminals to find nix binaries:
+- `/etc/environment`: `XDG_DATA_DIRS=/home/live/.nix-profile/share:/usr/local/share:/usr/share`
+- `/etc/profile.d/nix-prebaked.sh`: adds nix profile to `PATH` for terminal sessions
+- `/etc/skel/.nix-profile` → symlink to the pre-baked store profile, copied to `/home/live/` when the live user is created by the dracut hook
+
+### Live system nix-daemon (daemon mode)
+On the **booted live system**, the Void `nix` xbps package provides `nix-daemon` as a runit service. `/nix/store` stays root-owned; the live user is granted trust via `nix.conf`:
 ```
 experimental-features = nix-command flakes
 sandbox = false
 auto-optimise-store = true
 trusted-users = root live
 ```
+The daemon socket is at `/var/nix/daemon-socket/socket` (Void's path, not the upstream default `/nix/var/nix/daemon-socket/socket`).
 
-`sandbox = false` is required because the live system has no `nixbld` users and no user namespaces in the dracut initramfs environment.
-
-### Package list
-`/usr/local/libexec/nix-packages.list` is written at ISO build time from `NIX_USER_PACKAGES` in `config/install.conf`. At first login, `first-login.sh` reads this file and runs `nix profile install --impure` with `NIXPKGS_ALLOW_UNFREE=1`.
-
-Current packages:
-- `nixpkgs#google-chrome`
-- `nixpkgs#spotify`
-- `nixpkgs#discord`
-- `nixpkgs#localsend`
-- `nixpkgs#mission-center`
+`sandbox = false` is required — no `nixbld` users exist in the dracut initramfs environment.
 
 ### postinstall.sh socket path (installed system)
-In the **installed system** (not live), `installer/lib/postinstall.sh` polls for the nix-daemon socket. The correct path is:
+In the **installed system** (not live), `installer/lib/postinstall.sh` polls for the nix-daemon socket at:
 ```
 /var/nix/daemon-socket/socket
 ```
-Not `/nix/var/nix/daemon-socket/socket` (upstream Nix default) — Void's package uses `/var/nix/`.
+Not `/nix/var/nix/daemon-socket/socket` — Void's package uses `/var/nix/`.
 
 ---
 
 ## dconf / Theme
 
-The Gruvbox-Dark GTK theme and Cinnamon dconf settings are pre-applied via a system-db. The dconf binary database must be compiled at **ISO build time**, not at runtime.
+Cinnamon settings (theme, keyboard layout, dark mode, etc.) are pre-applied via a dconf system-db. The binary database is compiled at **ISO build time** inside the Docker container.
 
 ### Build-time compilation
 `iso/_inner-build-live.sh` runs inside the Debian Docker container. The Dockerfile installs `dconf-cli` for this step. The correct Debian `dconf-cli` API is:
@@ -143,20 +173,47 @@ system-db:local
 ```
 Without this file, the compiled system-db is ignored and Cinnamon shows a black wallpaper with default GTK theme.
 
+### System DB keyfile (`/etc/dconf/db/local.d/00-cinnamon`)
+Built by `iso/build-live-iso.sh` from config values. Relevant excerpts:
+```ini
+[org/gnome/desktop/input-sources]
+sources=[('xkb', 'ch+fr_nodeadkeys')]
+
+[org/gnome/desktop/interface]
+color-scheme='prefer-dark'
+```
+The `KEYMAP` variable comes from `config/install.conf` as `ch-fr_nodeadkeys` (vconsole dash format). The system DB uses XKB plus format. The substitution `${KEYMAP//-/+}` handles this conversion at build time.
+
+### dconf lock file (critical for keyboard)
+A lock file at `/etc/dconf/db/local.d/locks/keyboard` lists:
+```
+/org/gnome/desktop/input-sources/sources
+```
+This makes the keyboard setting **non-writable from the user session** — `gsettings set org.gnome.desktop.input-sources sources ...` silently does nothing when this lock is in place. The correct value must be set in the system DB itself (see above). Do not attempt to override the keyboard via `gsettings` from `apply-live-settings.sh` or any autostart script.
+
+### Keyboard format: vconsole (dash) vs XKB (plus)
+- mklive.sh `-k` flag accepts vconsole format: `ch-fr_nodeadkeys` (dash-separated)
+- XKB / gsettings / dconf uses plus format: `ch+fr_nodeadkeys`
+- Bash substitution: `${KEYMAP//-/+}` converts vconsole → XKB
+- `KEYMAP` is defined in `config/install.conf` in vconsole (dash) format
+
 ---
 
-## First-Login Setup (`installer/first-login.sh`)
+## First-Login Setup (`apply-live-settings.sh`)
 
-Runs once via XDG autostart (`~/.config/autostart/void-live-first-login.desktop`) when Cinnamon first loads. Installs:
+A lightweight XDG autostart script runs once when Cinnamon first loads and applies theme/UX settings via `gsettings`. It does **not** install packages (packages are pre-baked into squashfs).
 
-1. **Claude Code** — official installer from `https://claude.ai/install.sh`
-2. **Nix user packages** — from `/usr/local/libexec/nix-packages.list`
-3. **NVM + Node LTS**
-4. **VS Code extensions** — from `/etc/installer-vscode-extensions.txt`
+**Location in ISO:** `/usr/local/libexec/apply-live-settings.sh`  
+**Autostart:** `/etc/xdg/autostart/void-live-settings.desktop` (only in Cinnamon: `OnlyShowIn=X-Cinnamon`)  
+**Idempotency guard:** creates `~/.void-live-settings-done` on success
 
-Idempotent: creates `~/.first-login-done` on success. Logs to `~/.first-login.log`.
+Settings applied:
+- GTK/icon/cursor theme (Gruvbox-Dark)
+- Cinnamon shell theme
+- Wallpaper
+- Default terminal (alacritty)
 
-The script does NOT use `set -u` because `nvm.sh` references unbound variables.
+The script waits for `DBUS_SESSION_BUS_ADDRESS` to be set before calling `gsettings`. It does **not** set keyboard layout — that is locked in the dconf system DB (see dconf section above).
 
 ---
 
@@ -164,19 +221,45 @@ The script does NOT use `set -u` because `nvm.sh` references unbound variables.
 
 ```
 iso/build-live-iso.sh        (host — stages overlay, builds Docker image if needed)
-  └─ Docker: void-installer-builder:latest
+  └─ Docker: void-installer-builder:latest  (debian:stable-slim)
        └─ iso/_inner-build-live.sh
-            ├─ dconf compile  (pre-bakes system-db)
-            └─ void-mklive/mklive.sh -a x86_64 -r <repo> -I <include_dir> ...
-                 └─ squashfs + GRUB + ISO 9660
+            ├─ nix prebake: install packages into /nix, rsync to $INCLUDE_DIR/nix/
+            │   └─ cache/nix-prebake/<md5>/ used if package list unchanged
+            ├─ dconf compile  (compiles system-db binary from keyfile)
+            ├─ void-mklive/mklive.sh -a x86_64 -r <repo> -I <include_dir> ...
+            │    └─ squashfs (xz) + GRUB + ISO 9660
+            └─ chown -R $HOST_UID:$HOST_GID $INCLUDE_DIR  (fix Docker root ownership)
 ```
 
-Output: `out/void-live-stable.iso` (~2.9 GB)
+Output: `out/void-live-stable.iso` (~4.8 GB, xz-compressed squashfs ~22 GB uncompressed)
+
+### Docker UID/GID ownership fix
+Docker runs as root. Without remediation, files created inside the container (especially the ~5 GB nix store) are owned by `root` on the host, causing `rm -rf build/live-includes` to fail with `Permission denied` on the next build.
+
+**Fix in `_inner-build-live.sh`** (end of script):
+```sh
+# Fix ownership so host user can clean up on next build
+if [[ -n "${HOST_UID:-}" && "$HOST_UID" != "0" ]]; then
+    chmod -R u+w "$INCLUDE_DIR" 2>/dev/null || true
+    chown -R "${HOST_UID}:${HOST_GID}" "$INCLUDE_DIR" 2>/dev/null || true
+fi
+```
+`HOST_UID` and `HOST_GID` are passed via `docker run -e HOST_UID=$(id -u) -e HOST_GID=$(id -g)`.
+
+**Belt-and-suspenders guard in `build-live-iso.sh`** (before `rm -rf $INCLUDE_DIR`):
+```sh
+chmod -R u+w "$INCLUDE_DIR/nix" 2>/dev/null || sudo rm -rf "$INCLUDE_DIR/nix"
+```
+
+**Emergency manual cleanup:** `sudo rm -rf build/live-includes/nix`
+
+### Dockerfile dependencies
+`iso/Dockerfile` (based on `debian:stable-slim`) installs: `bash git curl ca-certificates xz-utils tar patch python3 mtools xorriso squashfs-tools dosfstools e2fsprogs kmod dconf-cli rsync`. The `rsync` package is required for nix store staging.
 
 ### Build artifacts that must NOT be committed
-- `build/live-includes/` — generated staging tree (hundreds of binary assets)
+- `build/live-includes/` — generated staging tree (hundreds of binary assets, nix store)
 - `out/` — ISO output
-- `cache/` — cloned void-mklive, xbps package cache
+- `cache/` — cloned void-mklive, xbps/nix package cache
 
 ---
 
@@ -200,12 +283,50 @@ Use `nix profile add` instead. `nix profile install` is an alias that emits a wa
 **Cause:** QEMU's user-mode DNS proxy may not forward queries correctly depending on the host network configuration.  
 **Workaround for QEMU testing:** `echo nameserver 8.8.8.8 > /etc/resolv.conf`. This is not needed on real hardware.
 
+### Docker root-owned files break next build
+**Symptom:** `rm -rf build/live-includes` or `rm -rf build/live-includes/nix` fails with `Permission denied` at the start of a rebuild.  
+**Cause:** Docker runs as root. The ~5 GB nix store rsynced into `build/live-includes/nix/` is owned by `root:root` on the host.  
+**Fix:** `_inner-build-live.sh` now `chown -R $HOST_UID:$HOST_GID $INCLUDE_DIR` at the end of each Docker run. `HOST_UID`/`HOST_GID` are passed as env vars. See Build Pipeline section.  
+**Emergency cleanup:** `sudo rm -rf build/live-includes/nix`
+
+### dconf lock file silently blocks `gsettings set`
+**Symptom:** `gsettings set org.gnome.desktop.input-sources sources "[('xkb', 'ch+fr_nodeadkeys')]"` runs without error but the keyboard layout is not applied.  
+**Cause:** `/etc/dconf/db/local.d/locks/keyboard` locks the `input-sources` key. Any `gsettings set` targeting a locked key is silently ignored in the user session.  
+**Fix:** Set the correct value in the system dconf DB keyfile at ISO build time. Do not attempt to set it from an autostart script.
+
+### Keyboard format mismatch (vconsole dash vs XKB plus)
+**Symptom:** Keyboard layout reverts to US QWERTY even though `KEYMAP=ch-fr_nodeadkeys` is set.  
+**Cause:** mklive.sh accepts the vconsole format (`ch-fr_nodeadkeys`, dash-separated). XKB / dconf uses plus format (`ch+fr_nodeadkeys`). Passing the vconsole string directly to the dconf system DB or to `gsettings` sets an unknown layout that falls back to US.  
+**Fix:** In `build-live-iso.sh`, use `${KEYMAP//-/+}` when writing the dconf keyfile:
+```ini
+[org/gnome/desktop/input-sources]
+sources=[('xkb', 'ch+fr_nodeadkeys')]   # generated as: ${KEYMAP//-/+}
+```
+
 ---
 
+## QEMU Testing
+
+### Quick launch
+```bash
+bash tests/launch-live-qemu.sh
+# or via Makefile:
+make live-qemu
+```
+
+### What `launch-live-qemu.sh` does
+- RAM: 12288 MB, 4 CPUs, KVM acceleration
+- Device: `virtio-vga` with `display gtk,gl=off` (no hardware GL)
+- Searches `out/void-live-stable*.iso` for the ISO
+- Serial console socket: `out/live-serial.sock`
+- Monitor socket: `out/qemu-monitor.sock`
+- Credentials: `live`/`voidlinux` (desktop), `root`/`voidlinux` (TTY)
+
+### Manual launch (if needed)
 ```bash
 cp /usr/share/OVMF/OVMF_VARS.fd out/OVMF_VARS.live.fd
 qemu-system-x86_64 -name void-live-test -machine q35,accel=kvm:tcg -cpu max \
-  -m 4096 -smp 4 \
+  -m 12288 -smp 4 \
   -drive "if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE.fd" \
   -drive "if=pflash,format=raw,file=out/OVMF_VARS.live.fd" \
   -cdrom out/void-live-stable.iso -boot order=d,menu=off \
@@ -215,12 +336,20 @@ qemu-system-x86_64 -name void-live-test -machine q35,accel=kvm:tcg -cpu max \
   -device virtio-vga -display gtk,gl=off &
 ```
 
-Serial console access (root shell for diagnostics):
+### Serial console access (Python)
 ```python
-import socket, time
+import socket
 s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
 s.connect('out/live-serial.sock')
 # send commands, read output
 ```
 
-GPU in QEMU: `virtio-vga` is detected as virtual → `modesetting + LIBGL_ALWAYS_SOFTWARE=1`.
+### GPU in QEMU
+`virtio-vga` is detected as a virtual GPU by `live-setup.sh` → writes `modesetting + AccelMethod none` xorg conf, sets `LIBGL_ALWAYS_SOFTWARE=1` in `/etc/profile.d/live-env.sh`.
+
+### Verifying keyboard layout (in live session)
+```bash
+DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus \
+  gsettings get org.gnome.desktop.input-sources sources
+# expected: [('xkb', 'ch+fr_nodeadkeys')]
+```

installer/first-login.sh

@@ -2,7 +2,7 @@
 # First-login one-shot setup for the user.
 # Installs: Claude Code, NVM + node LTS, VS Code extensions,
 #           and (if NIX_PACKAGES_FILE is present) nix user packages
-#           (google-chrome, spotify, discord, localsend, mission-center).
+#           (google-chrome, spotify, discord, localsend, mission-center, vscode).
 # Idempotent: creates ~/.first-login-done marker on success.
 
 # NOTE: do NOT use `set -u` here — nvm.sh references unbound vars.
@@ -23,53 +23,65 @@ if ! curl -fsSL --max-time 3 --connect-timeout 3 -o /dev/null https://api.github
     exit 0
 fi
 
-# --- Claude Code (official native installer) ---
 mkdir -p "$HOME/.local/bin"
 export PATH="$HOME/.local/bin:$PATH"
+
+# --- Claude Code (official native installer) ---
 if ! command -v claude >/dev/null 2>&1 && [[ ! -x "$HOME/.local/bin/claude" ]]; then
     echo "==> installing Claude Code via official installer"
     curl -fsSL https://claude.ai/install.sh | bash || {
         echo "!! claude install failed"; }
 fi
 
-# --- Nix user packages (google-chrome, spotify, discord, etc.) ---
+# --- Nix user packages (google-chrome, spotify, discord, vscode, etc.) ---
 # Present when running from the live ISO (written by build-live-iso.sh).
 # In the installed system the packages come from first-boot-nix.sh instead.
+# NOTE: nix packages are intentionally skipped in the live session — they
+# can total 3-4 GB which exceeds the tmpfs overlay on typical hardware.
+# They will be installed on the first login after the system is installed.
 NIX_PACKAGES_FILE="${NIX_PACKAGES_FILE:-/usr/local/libexec/nix-packages.list}"
 if [[ -r "$NIX_PACKAGES_FILE" ]] && command -v nix >/dev/null 2>&1; then
-    echo "==> installing nix user packages from $NIX_PACKAGES_FILE"
+    remaining=$(df -k /nix 2>/dev/null | awk 'NR==2{print $4}')
+    # Require at least 4GB free in /nix before attempting package install
+    if [[ -n "$remaining" && "$remaining" -lt 4194304 ]]; then
+        echo "==> skipping nix packages in live session (only ${remaining}KB free in /nix)"
+        echo "    packages will be installed on first login after installation"
+    else
+        echo "==> installing nix user packages from $NIX_PACKAGES_FILE"
 
-    # Source nix profile.d scripts so PATH and env are set.
-    for f in /etc/profile.d/nix*.sh; do
-        # shellcheck disable=SC1090
-        [[ -r "$f" ]] && . "$f"
-    done
+        # Source nix profile.d scripts so PATH and env are set.
+        for f in /etc/profile.d/nix*.sh; do
+            # shellcheck disable=SC1090
+            [[ -r "$f" ]] && . "$f"
+        done
 
-    # Guard: nix-env --switch-profile creates a circular symlink when given
-    # ~/.nix-profile as the target (it points to itself).  Remove it so
-    # 'nix profile add' can initialise a clean profile.
-    if [[ -L "$HOME/.nix-profile" ]]; then
-        _target=$(readlink "$HOME/.nix-profile")
-        if [[ "$_target" == ".nix-profile" || "$_target" == "$HOME/.nix-profile" ]]; then
-            echo "    removing circular .nix-profile symlink"
-            rm -f "$HOME/.nix-profile"
+        # Guard: nix-env --switch-profile creates a circular symlink when given
+        # ~/.nix-profile as the target (it points to itself).  Remove it so
+        # 'nix profile add' can initialise a clean profile.
+        if [[ -L "$HOME/.nix-profile" ]]; then
+            _target=$(readlink "$HOME/.nix-profile")
+            if [[ "$_target" == ".nix-profile" || "$_target" == "$HOME/.nix-profile" ]]; then
+                echo "    removing circular .nix-profile symlink"
+                rm -f "$HOME/.nix-profile"
+            fi
+            unset _target
         fi
-        unset _target
-    fi
 
-    # D-Bus session is available when autostarted from Cinnamon.
-    if [[ -z "${DBUS_SESSION_BUS_ADDRESS:-}" ]]; then
-        eval "$(dbus-launch --sh-syntax 2>/dev/null)" || true
-    fi
+        # D-Bus session is available when autostarted from Cinnamon.
+        if [[ -z "${DBUS_SESSION_BUS_ADDRESS:-}" ]]; then
+            eval "$(dbus-launch --sh-syntax 2>/dev/null)" || true
+        fi
 
-    export NIXPKGS_ALLOW_UNFREE=1
+        export NIXPKGS_ALLOW_UNFREE=1
+        export NIX_REMOTE=local
 
-    mapfile -t pkgs < <(grep -vE '^\s*(#|$)' "$NIX_PACKAGES_FILE")
-    if [[ ${#pkgs[@]} -gt 0 ]]; then
-        echo "    packages: ${pkgs[*]}"
-        # 'nix profile install' is deprecated as of nix 2.x — use 'nix profile add'
-        nix profile add --impure "${pkgs[@]}" 2>&1 || {
-            echo "!! nix profile add failed (partial install may have succeeded)"; }
+        mapfile -t pkgs < <(grep -vE '^\s*(#|$)' "$NIX_PACKAGES_FILE")
+        if [[ ${#pkgs[@]} -gt 0 ]]; then
+            echo "    packages: ${pkgs[*]}"
+            # 'nix profile install' is deprecated as of nix 2.x — use 'nix profile add'
+            nix profile add --impure "${pkgs[@]}" 2>&1 || {
+                echo "!! nix profile add failed (partial install may have succeeded)"; }
+        fi
     fi
 fi
 

installer/install.sh

@@ -98,7 +98,7 @@ main() {
     configure_nvidia_prime
     configure_zram
     configure_nix
-    install_vscode_real
+    [[ "${DESKTOP:-cinnamon}" != "niri" ]] && install_vscode_real
     install_customizations
     enable_services
     install_grub

installer/lib/grub.sh

@@ -18,7 +18,7 @@ install_grub() {
 GRUB_DEFAULT=0
 GRUB_TIMEOUT=5
 GRUB_DISTRIBUTOR="Void"
-GRUB_CMDLINE_LINUX_DEFAULT="loglevel=4 nvidia-drm.modeset=1"
+GRUB_CMDLINE_LINUX_DEFAULT="loglevel=4 nvidia-drm.modeset=1 rd.driver.blacklist=nouveau modprobe.blacklist=nouveau btusb.enable_autosuspend=0"
 GRUB_CMDLINE_LINUX=""
 GRUB_DISABLE_OS_PROBER=false
 GRUB_TERMINAL_OUTPUT="gfxterm"

installer/lib/postinstall.sh

@@ -88,6 +88,25 @@ EOF
     fi
     chmod 440 "$TARGET/etc/sudoers.d/10-wheel"
 
+    # git: GUI askpass so prompts work without a controlling terminal
+    install -d -m 0755 "$TARGET/usr/local/bin"
+    cat > "$TARGET/usr/local/bin/git-askpass" <<'EOF'
+#!/bin/sh
+for cmd in zenity qarma; do
+    command -v "$cmd" >/dev/null 2>&1 || continue
+    case "$1" in
+        *[Uu]sername*) exec "$cmd" --entry   --title="Git Credentials" --text="$1" ;;
+        *)             exec "$cmd" --password --title="Git Credentials" --text="$1" ;;
+    esac
+done
+printf '%s' "$1" >&2; read -r answer; printf '%s\n' "$answer"
+EOF
+    chmod 0755 "$TARGET/usr/local/bin/git-askpass"
+    cat > "$TARGET/etc/gitconfig" <<'EOF'
+[core]
+	askPass = /usr/local/bin/git-askpass
+EOF
+
     ok "user '$USERNAME' created and added to: $USER_GROUPS"
 }
 
@@ -141,7 +160,19 @@ Section "OutputClass"
 EndSection
 EOF
 
-    # 2) Modules to load early for KMS.
+    # 2) Blacklist nouveau so it doesn't grab the GPU before nvidia loads.
+    install -d -m 0755 "$TARGET/etc/modprobe.d"
+    cat > "$TARGET/etc/modprobe.d/blacklist-nouveau.conf" <<'EOF'
+blacklist nouveau
+options nouveau modeset=0
+EOF
+
+    # btusb USB autosuspend causes firmware download failures on Intel BT.
+    cat > "$TARGET/etc/modprobe.d/btusb-quirks.conf" <<'EOF'
+options btusb enable_autosuspend=0
+EOF
+
+    # 3) Modules to load early for KMS.
     install -d -m 0755 "$TARGET/etc/modules-load.d"
     cat > "$TARGET/etc/modules-load.d/nvidia.conf" <<'EOF'
 nvidia
@@ -150,7 +181,7 @@ nvidia_uvm
 nvidia_drm
 EOF
 
-    # 3) Wrapper script + desktop file: run any app on NVIDIA via `prime-run`.
+    # 4) Wrapper script + desktop file: run any app on NVIDIA via `prime-run`.
     install -d -m 0755 "$TARGET/usr/local/bin"
     cat > "$TARGET/usr/local/bin/prime-run" <<'EOF'
 #!/bin/sh
@@ -162,10 +193,11 @@ exec env __NV_PRIME_RENDER_OFFLOAD=1 \
 EOF
     chmod 0755 "$TARGET/usr/local/bin/prime-run"
 
-    # 4) Make sure dracut picks up nvidia modules.
+    # 5) dracut: include nvidia modules in initramfs; explicitly omit nouveau.
     install -d -m 0755 "$TARGET/etc/dracut.conf.d"
     cat > "$TARGET/etc/dracut.conf.d/10-nvidia.conf" <<'EOF'
 add_drivers+=" nvidia nvidia_modeset nvidia_uvm nvidia_drm "
+omit_drivers+=" nouveau "
 EOF
 
     ok "NVIDIA PRIME offload configured (use 'prime-run <app>')"
@@ -206,13 +238,12 @@ mark=/var/lib/first-boot-nix.done
 [[ -f "\$mark" ]] && exit 0
 
 # Wait for nix-daemon to be available.
-# The Void xbps nix package puts the socket at /var/nix/daemon-socket/socket.
 for _ in \$(seq 1 60); do
-    [[ -S /var/nix/daemon-socket/socket ]] && break
+    [[ -S /nix/var/nix/daemon-socket/socket ]] && break
     sleep 2
 done
 
-if [[ ! -S /var/nix/daemon-socket/socket ]]; then
+if [[ ! -S /nix/var/nix/daemon-socket/socket ]]; then
     echo "nix-daemon not available; aborting first-boot nix install" >&2
     exit 0
 fi
@@ -230,6 +261,12 @@ touch "\$mark"
 EOF
     chmod 0755 "$TARGET/usr/local/libexec/first-boot-nix.sh"
 
+    # Persistent nixpkgs config so the installed user can install unfree packages
+    # without needing to export NIXPKGS_ALLOW_UNFREE=1 every time.
+    install -d -m 0755 "$TARGET/home/$USERNAME/.config/nixpkgs"
+    echo '{ allowUnfree = true; }' > "$TARGET/home/$USERNAME/.config/nixpkgs/config.nix"
+    run_chroot "chown -R $USERNAME:$USERNAME /home/$USERNAME/.config/nixpkgs"
+
     # runit one-shot service.
     install -d -m 0755 "$TARGET/etc/sv/first-boot-nix"
     cat > "$TARGET/etc/sv/first-boot-nix/run" <<'EOF'
@@ -312,10 +349,8 @@ enable_services() {
     local enabled=(
         dbus
         NetworkManager
-        lightdm
         polkitd
         docker
-        bluetoothd
         acpid
         tlp
         elogind
@@ -326,6 +361,14 @@ enable_services() {
         cupsd
         cups-browsed
     )
+
+    # Display manager: greetd for wayland/niri, lightdm for cinnamon.
+    if [[ "${DESKTOP:-cinnamon}" == "niri" ]]; then
+        enabled+=(greetd bluetoothd)
+    else
+        enabled+=(lightdm bluetoothd)
+    fi
+
     [[ "${SSHD_ENABLE:-no}" == "yes" ]] && enabled+=(sshd)
 
     for svc in "${enabled[@]}"; do

iso/Dockerfile

@@ -10,7 +10,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
         bash git curl ca-certificates xz-utils tar patch python3 \
         mtools xorriso squashfs-tools dosfstools e2fsprogs \
-        kmod dconf-cli \
+        kmod dconf-cli rsync openssl \
     && rm -rf /var/lib/apt/lists/*
 
 # xbps-static is downloaded into /cache by the host script and added to PATH

iso/_inner-build-live.sh

@@ -27,17 +27,109 @@ command -v xbps-install.static >/dev/null \
 
 mkdir -p "$(dirname "$OUT_ISO")"
 
-# Compile dconf system-db inside the include dir so it ships compiled.
-# Debian's dconf-cli provides 'dconf compile <output_db> <keyfile_dir>'.
-if command -v dconf >/dev/null 2>&1 && [[ -d "$INCLUDE_DIR/etc/dconf/db/local.d" ]]; then
-    dconf compile "$INCLUDE_DIR/etc/dconf/db/local" \
-                  "$INCLUDE_DIR/etc/dconf/db/local.d" 2>/dev/null \
-    && echo "dconf: compiled system-db/local" \
-    || echo "dconf: compile failed (non-fatal)"
+# Compile dconf system-db using Void's own dconf binary (inside the Void
+# rootfs chroot via mklive's -x postsetup hook). This guarantees the GVDB
+# binary is produced by the exact same dconf/glib version that runs on the
+# live system — no cross-distro format mismatch possible.
+# (We do NOT pre-compile with Debian's dconf here; that caused silent failures
+#  when the GVDB format differed between the host and Void's glib.)
+_DCONF_POSTSETUP="$(mktemp -p "$MKLIVE_DIR" postsetup-dconf.XXXXX.sh)"
+cat > "$_DCONF_POSTSETUP" <<'PSEOF'
+#!/bin/bash
+# Postsetup script: compile dconf system-db AND user skel db with Void's own binary.
+ROOTFS="$1"
+if [[ -x "$ROOTFS/usr/bin/dconf" ]] && [[ -d "$ROOTFS/etc/dconf/db/local.d" ]]; then
+    # 1. Compile system-db (read by all users via /etc/dconf/profile/user)
+    chroot "$ROOTFS" dconf compile /etc/dconf/db/local /etc/dconf/db/local.d \
+        && echo "postsetup: system-db compiled ($(chroot "$ROOTFS" dconf --version 2>/dev/null))" \
+        || echo "postsetup: system-db compile failed (non-fatal)"
+    # 2. Compile a USER dconf db directly into /etc/skel/.config/dconf/user.
+    #    dracut's adduser.sh copies skel → /home/live on first boot, so the live
+    #    user starts with the keyboard in their OWN user db — no dependency on
+    #    dconf profile/system-db loading order.
+    mkdir -p "$ROOTFS/etc/skel/.config/dconf"
+    chroot "$ROOTFS" dconf compile /etc/skel/.config/dconf/user /etc/dconf/db/local.d \
+        && echo "postsetup: skel user dconf db compiled" \
+        || echo "postsetup: skel user dconf db compile failed (non-fatal)"
+else
+    echo "postsetup: dconf or keyfile dir not found in rootfs — skipping dconf compile"
 fi
+PSEOF
+chmod +x "$_DCONF_POSTSETUP"
 
 cd "$MKLIVE_DIR"
 
+# ── Pre-bake nix packages ────────────────────────────────────────────────
+# Install the nix user packages inside the Docker container and bake the
+# resulting /nix store directly into the squashfs overlay.  The live session
+# then boots with all apps already present — no network downloads needed.
+#
+# The store is cached at /cache/nix-prebake; only rebuilt when the package
+# list changes (checked via an md5 key file).
+if [[ -n "${NIX_PACKAGES_PREBAKE:-}" ]]; then
+    echo ">>> pre-baking nix packages"
+    read -r -a _NIX_PKGS <<< "$NIX_PACKAGES_PREBAKE"
+
+    _NIX_CACHE="$CACHE_DIR/nix-prebake"
+    _CACHE_KEY="$_NIX_CACHE/.done.$(printf '%s\n' "${_NIX_PKGS[@]}" | sort | md5sum | cut -c1-8)"
+
+    mkdir -p "$_NIX_CACHE"
+
+    if [[ -f "$_CACHE_KEY" ]] && [[ -d "$_NIX_CACHE/store" ]] && [[ -f "$_NIX_CACHE/.profile-path" ]]; then
+        echo "    restoring cached nix store ($(du -sh "$_NIX_CACHE/store" 2>/dev/null | cut -f1))"
+        mkdir -p /nix
+        rsync -a "$_NIX_CACHE/" /nix/ 2>&1 | tail -1
+    else
+        echo "    installing nix (single-user, no-daemon)..."
+        rm -rf /nix ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
+        # Pre-create /nix as root so the installer doesn't try 'sudo mkdir'
+        # (sudo isn't installed in this Docker container).
+        mkdir -m 0755 -p /nix
+        # Disable build-users-group so nix doesn't complain about missing nixbld group.
+        export NIX_CONFIG="build-users-group = "
+        curl -fsSL https://nixos.org/nix/install | \
+            NIX_INSTALLER_TRUST_INSTALLER=1 sh -s -- --no-daemon --no-channel-add
+        # shellcheck disable=SC1091
+        . /root/.nix-profile/etc/profile.d/nix.sh 2>/dev/null || true
+        # Explicitly add nix to PATH in case the profile script didn't export it
+        export PATH="/root/.nix-profile/bin:/nix/var/nix/profiles/default/bin:$PATH"
+
+        export NIXPKGS_ALLOW_UNFREE=1
+        echo "    nix profile install: ${_NIX_PKGS[*]}"
+        nix profile add --extra-experimental-features "nix-command flakes" \
+            --impure "${_NIX_PKGS[@]}" 2>&1
+
+        # Save the profile store path so we can restore from cache next time
+        readlink -f /root/.nix-profile > "$_NIX_CACHE/.profile-path"
+
+        # Cache the full /nix store
+        rsync -a /nix/ "$_NIX_CACHE/" 2>&1 | tail -1
+        touch "$_CACHE_KEY"
+        echo "    cached nix store: $(du -sh "$_NIX_CACHE/store" 2>/dev/null | cut -f1)"
+    fi
+
+    # Stage the nix store into the squashfs overlay
+    echo "    staging /nix into overlay ($(du -sh /nix/store 2>/dev/null | cut -f1))"
+    mkdir -p "$INCLUDE_DIR/nix"
+    rsync -a /nix/ "$INCLUDE_DIR/nix/" 2>&1 | tail -1
+    # Single-user nix: the live user (uid 1000) must own the store to create lock files and new paths.
+    chown -R 1000:1000 "$INCLUDE_DIR/nix"
+
+    # /etc/skel/.nix-profile → the pre-baked store profile path.
+    # dracut's adduser.sh runs 'useradd -m' which copies skel → /home/live,
+    # so the live user gets a ready nix profile from the squashfs store.
+    _STORE_PROFILE=$(cat "$_NIX_CACHE/.profile-path" 2>/dev/null \
+        || readlink -f /root/.nix-profile 2>/dev/null || echo "")
+    if [[ -n "$_STORE_PROFILE" && -d "$_STORE_PROFILE" ]]; then
+        mkdir -p "$INCLUDE_DIR/etc/skel"
+        ln -sf "$_STORE_PROFILE" "$INCLUDE_DIR/etc/skel/.nix-profile"
+        echo "    skel/.nix-profile → $_STORE_PROFILE"
+    else
+        echo "    WARNING: could not determine nix store profile path"
+    fi
+fi
+# ── end nix prebake ──────────────────────────────────────────────────────
+
 _cleanup_mklive_builds() {
     local d sub
     for d in "$MKLIVE_DIR"/mklive-build.*/; do
@@ -63,6 +155,13 @@ trap _cleanup_mklive_builds EXIT
     -p "$ISO_PKGS" \
     -I "$INCLUDE_DIR" \
     -C "${BOOT_CMDLINE:-}" \
+    -x "$_DCONF_POSTSETUP" \
     -o "$OUT_ISO"
 
-chown "$(stat -c '%u:%g' "$PROJECT_DIR")" "$OUT_ISO" "${OUT_ISO}".* 2>/dev/null || true
+# ownership of OUT_ISO is fixed unconditionally below with the include dir
+
+# Fix ownership of include dir so the host user can clean up without sudo.
+# u+rwX: sets read+write on all, execute only on directories (capital X).
+chmod -R u+rwX "$INCLUDE_DIR" 2>/dev/null || true
+chown -R "${HOST_UID:-1000}:${HOST_GID:-1000}" "$INCLUDE_DIR" 2>/dev/null || true
+chown -R "${HOST_UID:-1000}:${HOST_GID:-1000}" "$OUT_ISO" "${OUT_ISO}".*  2>/dev/null || true

iso/_inner-build-niri-live.sh

@@ -0,0 +1,270 @@
+#!/bin/bash
+# Runs INSIDE the docker container (as root). Invoked by iso/build-niri-live-iso.sh.
+# Niri/Wayland variant: nix prebake (shared cache with Cinnamon), adds noctalia repo.
+# Expects the project bind-mounted at /work and the cache at /cache.
+#
+# Required env (set by build-niri-live-iso.sh):
+#   ARCH, REPO_URL, KEYMAP, LOCALE, ISO_PKGS, ISO_TITLE, OUT_ISO_REL,
+#   INCLUDE_DIR_REL, NIX_PACKAGES_PREBAKE (optional)
+
+set -Eeuo pipefail
+
+: "${ARCH:?}"; : "${REPO_URL:?}"; : "${KEYMAP:?}"; : "${LOCALE:?}"
+: "${ISO_PKGS:?}"; : "${ISO_TITLE:?}"; : "${OUT_ISO_REL:?}"
+: "${INCLUDE_DIR_REL:?}"
+
+CACHE_DIR=/cache
+PROJECT_DIR=/work
+MKLIVE_DIR="$CACHE_DIR/void-mklive-niri"  # separate clone — avoids race with Cinnamon parallel build
+INCLUDE_DIR="$PROJECT_DIR/$INCLUDE_DIR_REL"
+OUT_ISO="$PROJECT_DIR/$OUT_ISO_REL"
+
+# Third-party Void repo that ships noctalia-shell + noctalia-qs.
+NOCTALIA_REPO="${NOCTALIA_REPO:-https://universalrepo.r1xelelo.workers.dev/void}"
+
+export PATH="$CACHE_DIR/xbps-static/usr/bin:$PATH"
+
+[[ -d "$MKLIVE_DIR" ]]  || { echo "ERROR: $MKLIVE_DIR missing"; exit 1; }
+[[ -d "$INCLUDE_DIR" ]] || { echo "ERROR: $INCLUDE_DIR missing"; exit 1; }
+command -v xbps-install.static >/dev/null \
+    || { echo "ERROR: xbps-install.static not on PATH"; exit 1; }
+
+mkdir -p "$(dirname "$OUT_ISO")"
+
+# ── Audio and Theme Support ──────────────────────────────────────────────
+# The Niri live ISO includes:
+# 1. sof-firmware: Intel Sound Open Firmware (required for modern Intel audio)
+# 2. alsa-ucm-conf: ALSA Use Case Manager profiles (sof-soundwire for SoundWire hardware)
+# 3. Removed forced audio kernel parameters: The kernel auto-selects SOF/HDA/AVS
+#    based on hardware IDs. Forced parameters (snd-intel-dspcfg.dsp_driver=1)
+#    broke audio on SoundWire platforms like XPS 9700.
+#    See iso/build-niri-live-iso.sh (BOOT_CMDLINE) and docs/KERNEL7_AUDIO_XPS9700.md
+# 4. Dark theme dconf database: Compiled here during ISO build.
+
+# Compile dconf system-db using Void's own dconf binary inside the target
+# rootfs. The Niri live builder writes /etc/dconf/db/local.d/01-dark-theme,
+# but the live system will not report the dark theme unless the GVDB is
+# compiled into /etc/dconf/db/local (and into skel for the live user).
+_DCONF_POSTSETUP="$(mktemp -p "$MKLIVE_DIR" postsetup-dconf.XXXXX.sh)"
+cat > "$_DCONF_POSTSETUP" <<'PSEOF'
+#!/bin/bash
+ROOTFS="$1"
+if [[ -x "$ROOTFS/usr/bin/dconf" ]] && [[ -d "$ROOTFS/etc/dconf/db/local.d" ]]; then
+    chroot "$ROOTFS" dconf compile /etc/dconf/db/local /etc/dconf/db/local.d \
+        && echo "postsetup: system-db compiled ($(chroot "$ROOTFS" dconf --version 2>/dev/null))" \
+        || echo "postsetup: system-db compile failed (non-fatal)"
+    mkdir -p "$ROOTFS/etc/skel/.config/dconf"
+    chroot "$ROOTFS" dconf compile /etc/skel/.config/dconf/user /etc/dconf/db/local.d \
+        && echo "postsetup: skel user dconf db compiled" \
+        || echo "postsetup: skel user dconf db compile failed (non-fatal)"
+else
+    echo "postsetup: dconf or keyfile dir not found in rootfs - skipping dconf compile"
+fi
+PSEOF
+chmod +x "$_DCONF_POSTSETUP"
+
+cd "$MKLIVE_DIR"
+
+# ── Pre-bake nix packages ────────────────────────────────────────────────
+# Shared with the Cinnamon build — same cache dir, same store.
+if [[ -n "${NIX_PACKAGES_PREBAKE:-}" ]]; then
+    echo ">>> pre-baking nix packages"
+    read -r -a _NIX_PKGS <<< "$NIX_PACKAGES_PREBAKE"
+
+    _NIX_CACHE="$CACHE_DIR/nix-prebake"
+    _CACHE_KEY="$_NIX_CACHE/.done.$(printf '%s\n' "${_NIX_PKGS[@]}" | sort | md5sum | cut -c1-8)"
+
+    mkdir -p "$_NIX_CACHE"
+
+    if [[ -f "$_CACHE_KEY" ]] && [[ -d "$_NIX_CACHE/store" ]] && [[ -f "$_NIX_CACHE/.profile-path" ]]; then
+        echo "    restoring cached nix store ($(du -sh "$_NIX_CACHE/store" 2>/dev/null | cut -f1))"
+        mkdir -p /nix
+        rsync -a "$_NIX_CACHE/" /nix/ 2>&1 | tail -1
+    else
+        echo "    installing nix (single-user, no-daemon)..."
+        rm -rf /nix ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
+        mkdir -m 0755 -p /nix
+        export NIX_CONFIG="build-users-group = "
+        curl -fsSL https://nixos.org/nix/install | \
+            NIX_INSTALLER_TRUST_INSTALLER=1 sh -s -- --no-daemon --no-channel-add
+        # shellcheck disable=SC1091
+        . /root/.nix-profile/etc/profile.d/nix.sh 2>/dev/null || true
+        export PATH="/root/.nix-profile/bin:/nix/var/nix/profiles/default/bin:$PATH"
+
+        export NIXPKGS_ALLOW_UNFREE=1
+        echo "    nix profile install: ${_NIX_PKGS[*]}"
+        nix profile add --extra-experimental-features "nix-command flakes" \
+            --impure "${_NIX_PKGS[@]}" 2>&1
+
+        readlink -f /root/.nix-profile > "$_NIX_CACHE/.profile-path"
+        rsync -a /nix/ "$_NIX_CACHE/" 2>&1 | tail -1
+        touch "$_CACHE_KEY"
+        echo "    cached nix store: $(du -sh "$_NIX_CACHE/store" 2>/dev/null | cut -f1)"
+    fi
+
+    echo "    staging /nix into overlay ($(du -sh /nix/store 2>/dev/null | cut -f1))"
+    mkdir -p "$INCLUDE_DIR/nix"
+    rsync -a /nix/ "$INCLUDE_DIR/nix/" 2>&1 | tail -1
+    # Single-user nix: the live user (uid 1000) must own the store to create lock files and new paths.
+    chown -R 1000:1000 "$INCLUDE_DIR/nix"
+
+    _STORE_PROFILE=$(cat "$_NIX_CACHE/.profile-path" 2>/dev/null \
+        || readlink -f /root/.nix-profile 2>/dev/null || echo "")
+    if [[ -n "$_STORE_PROFILE" && -d "$_STORE_PROFILE" ]]; then
+        mkdir -p "$INCLUDE_DIR/etc/skel"
+        ln -sf "$_STORE_PROFILE" "$INCLUDE_DIR/etc/skel/.nix-profile"
+        echo "    skel/.nix-profile → $_STORE_PROFILE"
+    fi
+fi
+# ── end nix prebake ──────────────────────────────────────────────────────
+
+# ── Noctalia: build a locally SIGNED XBPS repo ───────────────────────────
+# noctalia-qs has a broken .sig2 on the CDN (RSA signature not valid).
+# noctalia-shell's CDN key import also fails intermittently (EAGAIN).
+# Solution: download both .xbps archives directly (no sig check), create a
+# LOCAL SIGNED repo with a fresh keypair, register our public key in
+# mklive/keys/ so copy_void_keys pre-trusts it in the rootfs.
+# Our local signed repo gets HIGHEST priority (-r last = prepended first),
+# so xbps resolves and verifies both packages against our trusted key.
+echo ">>> building local signed noctalia XBPS repo (CDN .sig2 workaround)"
+_NOC_LOCAL="/tmp/noctalia-local"
+_NOC_HOME="/tmp/noc-sign-home"
+_ARCH="${ARCH:-x86_64}"
+mkdir -p "$_NOC_LOCAL" "$_NOC_HOME"
+export HOME="$_NOC_HOME"
+
+# Discover exact package versions from CDN repodata (try multiple User-Agents).
+# Falls back to versions confirmed by previous build errors.
+_NOC_VERS=$(python3 - <<'PYEOF' 2>/dev/null
+import urllib.request, plistlib, tarfile, io, sys, os
+repo = os.environ.get("NOCTALIA_REPO", "https://universalrepo.r1xelelo.workers.dev/void")
+arch = os.environ.get("ARCH", "x86_64")
+want = {"noctalia-qs", "noctalia-shell"}
+found = {}
+for ua in ("curl/8.0", "xbps/0.59.2", "Mozilla/5.0 (X11; Linux x86_64)"):
+    try:
+        req = urllib.request.Request(f"{repo}/{arch}-repodata", headers={"User-Agent": ua})
+        data = urllib.request.urlopen(req, timeout=15).read()
+        tf = tarfile.open(fileobj=io.BytesIO(data))
+        idx = plistlib.loads(tf.extractfile("index.plist").read())
+        # index.plist keys are package names; pkgver field holds the versioned name
+        for pkgname, meta in idx.items():
+            if isinstance(meta, dict) and pkgname in want:
+                found[pkgname] = meta.get("pkgver", pkgname)
+        if len(found) >= len(want):
+            break
+    except Exception:
+        pass
+# Fallback to versions confirmed by last build errors
+defaults = {"noctalia-qs": "noctalia-qs-0.0.12_0", "noctalia-shell": "noctalia-shell-4.7.6_1"}
+for pkg, ver in defaults.items():
+    if pkg not in found:
+        found[pkg] = ver
+for ver in found.values():
+    print(ver)
+PYEOF
+)
+
+# Download both .xbps archives directly (curl never checks .sig2)
+for _ver in $_NOC_VERS; do
+    _fname="${_ver}.${_ARCH}.xbps"
+    # Clear any cached bad sig2 from a previous failed build
+    rm -f "$CACHE_DIR/xbps-niri-pkgs/${_ver}"* 2>/dev/null || true
+    if [[ ! -f "$_NOC_LOCAL/$_fname" ]]; then
+        echo "    downloading $_fname ..."
+        curl -fsSL "$NOCTALIA_REPO/$_fname" -o "$_NOC_LOCAL/$_fname" \
+            || { echo "    WARNING: failed to download $_fname"; rm -f "$_NOC_LOCAL/$_fname"; }
+    else
+        echo "    cached: $_fname"
+    fi
+done
+
+# Build index
+xbps-rindex.static -a "$_NOC_LOCAL"/*.xbps
+
+# Generate RSA keypair. xbps-rindex requires --privkey passed explicitly.
+mkdir -p "$_NOC_HOME/.xbps-sign"
+openssl genrsa -out "$_NOC_HOME/.xbps-sign/privkey.pem" 4096 2>/dev/null
+[[ -s "$_NOC_HOME/.xbps-sign/privkey.pem" ]] \
+    || { echo "ERROR: openssl genrsa failed"; exit 1; }
+
+_NOC_PRIVKEY="$_NOC_HOME/.xbps-sign/privkey.pem"
+
+# Sign repodata then each package (separate calls — xbps-rindex restriction).
+xbps-rindex.static --sign --privkey "$_NOC_PRIVKEY" \
+    --signedby "noctalia-local" "$_NOC_LOCAL"
+for _pkg in "$_NOC_LOCAL"/*.xbps; do
+    xbps-rindex.static --sign-pkg --privkey "$_NOC_PRIVKEY" \
+        --signedby "noctalia-local" "$_pkg"
+done
+
+# Register public key in mklive/keys/ so copy_void_keys installs it in the rootfs.
+# xbps fingerprint = MD5 of DER-encoded public key, formatted as aa:bb:cc:...
+openssl rsa -in "$_NOC_PRIVKEY" \
+    -pubout -outform DER -out "$_NOC_HOME/pubkey.der" 2>/dev/null
+_FINGERPRINT=$(md5sum "$_NOC_HOME/pubkey.der" \
+    | cut -d' ' -f1 | sed 's/../&:/g; s/:$//')
+# The plist <data> field = base64 of the PEM public key (headers included)
+_PUBKEY_B64=$(openssl rsa -in "$_NOC_PRIVKEY" \
+    -pubout 2>/dev/null | base64 -w 0)
+cat > "$MKLIVE_DIR/keys/$_FINGERPRINT.plist" <<KEOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <key>public-key</key>
+        <data>$_PUBKEY_B64</data>
+        <key>public-key-size</key>
+        <integer>4096</integer>
+        <key>signature-by</key>
+        <string>noctalia-local</string>
+</dict>
+</plist>
+KEOF
+echo "    local signed noctalia repo ready — key: $_FINGERPRINT"
+unset HOME
+# ── end noctalia local repo ───────────────────────────────────────────────
+
+_cleanup_mklive_builds() {
+    local d sub
+    for d in "$MKLIVE_DIR"/mklive-build.*/; do
+        [[ -d "$d" ]] || continue
+        for sub in tmp-rootfs/sys tmp-rootfs/proc tmp-rootfs/dev tmp-rootfs/run \
+                   image/rootfs/sys image/rootfs/proc image/rootfs/dev image/rootfs/run; do
+            [[ -d "$d$sub" ]] && umount -R --lazy "$d$sub" 2>/dev/null || true
+        done
+        rm -rf "$d" 2>/dev/null || true
+    done
+}
+trap _cleanup_mklive_builds EXIT
+
+# mklive prepends -r args: LAST -r = HIGHEST priority.
+# Our local signed repo is last so xbps resolves noctalia-* from it.
+# -v linux-mainline: makes mainline (kernel 7) the PRIMARY boot kernel;
+#   mklive.sh sets KERNELVERSION from it and ignores the linux metapackage.
+#   The plain 'linux' (kernel 6) in ISO_PKGS still gets installed and the
+#   secondary-kernel loop in mklive.sh builds its initramfs + boot entry.
+./mklive.sh \
+    -a "$ARCH" \
+    -r "$REPO_URL" \
+    -r "${REPO_URL%/current}/current/nonfree" \
+    -r "$NOCTALIA_REPO" \
+    -r "$_NOC_LOCAL" \
+    -c "$CACHE_DIR/xbps-niri-pkgs" \
+    -H "$CACHE_DIR/xbps-host-pkgs" \
+    -k "$KEYMAP" \
+    -l "$LOCALE" \
+    -T "$ISO_TITLE" \
+    -v linux-mainline \
+    -p "$ISO_PKGS" \
+    -I "$INCLUDE_DIR" \
+    -x "$_DCONF_POSTSETUP" \
+    -x "$PROJECT_DIR/iso/postsetup-nvidia.sh" \
+    -C "${BOOT_CMDLINE:-}" \
+    -o "$OUT_ISO"
+
+# Fix ownership so the host user can clean up without sudo.
+# u+rwX: sets read+write on all, execute only on directories (capital X).
+chmod -R u+rwX "$INCLUDE_DIR" 2>/dev/null || true
+chown -R "${HOST_UID:-1000}:${HOST_GID:-1000}" "$INCLUDE_DIR" 2>/dev/null || true
+chown -R "${HOST_UID:-1000}:${HOST_GID:-1000}" "$OUT_ISO" "${OUT_ISO}".* 2>/dev/null || true

iso/_inner-build.sh

@@ -47,6 +47,7 @@ trap _cleanup_mklive_builds EXIT
 ./mklive.sh \
     -a "$ARCH" \
     -r "$REPO_URL" \
+    -r "${REPO_URL%/current}/current/nonfree" \
     -c "$CACHE_DIR/xbps-live-pkgs" \
     -H "$CACHE_DIR/xbps-host-pkgs" \
     -k "$KEYMAP" \
@@ -54,6 +55,7 @@ trap _cleanup_mklive_builds EXIT
     -T "$ISO_TITLE" \
     -p "$ISO_PKGS" \
     -I "$INCLUDE_DIR" \
+    -x "$PROJECT_DIR/iso/postsetup-nvidia.sh" \
     -C "${BOOT_CMDLINE:-}" \
     -o "$OUT_ISO"
 

iso/build-live-iso.sh

@@ -66,6 +66,8 @@ fi
 
 # 3) build includes overlay
 echo ">>> staging live includes overlay at $INCLUDE_DIR"
+# The nix store (staged by Docker/root) uses 444/555 permissions — chmod first.
+chmod -R u+rwX "$INCLUDE_DIR" 2>/dev/null || true
 rm -rf "$INCLUDE_DIR"
 mkdir -p "$INCLUDE_DIR"
 
@@ -88,7 +90,7 @@ LIVE_USER="${USERNAME:-live}"
 LIVE_USER="${USERNAME:-live}"
 
 # Extra groups (dracut only adds audio,video,wheel)
-for g in plugdev input network docker; do
+for g in plugdev input network docker bluetooth; do
     groupadd -f "$g" 2>/dev/null || true
     usermod -aG "$g" "$LIVE_USER" 2>/dev/null || true
 done
@@ -105,6 +107,7 @@ if [ -x /usr/bin/nix ]; then
     install -d -m 0755 /etc/nix
     cat > /etc/nix/nix.conf <<NIXCONF
 experimental-features = nix-command flakes
+build-users-group =
 sandbox = false
 auto-optimise-store = true
 trusted-users = root $LIVE_USER
@@ -132,6 +135,17 @@ if [ -f /etc/nsswitch.conf ]; then
     echo "live-setup: removed mdns from nsswitch.conf (hosts line)"
 fi
 
+# ── Timezone ──────────────────────────────────────────────────────────────
+ln -sf /usr/share/zoneinfo/Europe/Zurich /etc/localtime 2>/dev/null || true
+echo "live-setup: timezone set to Europe/Zurich"
+
+# ── Fix sound device permissions ───────────────────────────────────────────
+# PCM/control nodes may be root:root at early boot before the audio group
+# exists.  Re-apply correct ownership so PipeWire/ALSA can open the devices.
+chown root:audio /dev/snd/pcmC* /dev/snd/controlC* /dev/snd/hwC* 2>/dev/null || true
+chmod 660 /dev/snd/pcmC* /dev/snd/controlC* /dev/snd/hwC* 2>/dev/null || true
+udevadm trigger --subsystem-match=sound 2>/dev/null || true
+
 # ── DNS: ensure a working nameserver is configured ───────────────────────
 # NetworkManager will overwrite resolv.conf once DHCP completes.
 # If the DHCP-provided nameserver is broken (e.g. QEMU's 10.0.2.3), add
@@ -261,6 +275,16 @@ chmod 0755 "$INCLUDE_DIR/etc/runit/2"
 
 install -d -m 0755 "$INCLUDE_DIR/etc/runit/runsvdir/default"
 
+# Write all repos to xbps.d so they persist in the live squashfs.
+# The nonfree repo is needed for nvidia and other proprietary drivers.
+install -d -m 0755 "$INCLUDE_DIR/etc/xbps.d"
+cat > "$INCLUDE_DIR/etc/xbps.d/00-void-repos.conf" <<EOF
+repository=${REPO_URL:-https://repo-default.voidlinux.org/current}
+repository=${REPO_URL%/current}/current/nonfree
+repository=${REPO_URL%/current}/current/multilib
+repository=${REPO_URL%/current}/current/multilib/nonfree
+EOF
+
 # ── 3b) LightDM autologin ───────────────────────────────────────────────
 install -d -m 0755 "$INCLUDE_DIR/etc/lightdm"
 # .session file: read by the vmklive dracut hook (display-manager-autologin.sh)
@@ -286,7 +310,7 @@ EOF
 
 install -d -m 0755 "$INCLUDE_DIR/etc/runit/runsvdir/default"
 # Enable services for the live session.
-for svc in dbus NetworkManager lightdm nix-daemon; do
+for svc in dbus NetworkManager lightdm bluetoothd; do
     ln -sf "/etc/sv/$svc" "$INCLUDE_DIR/etc/runit/runsvdir/default/$svc" 2>/dev/null || true
 done
 
@@ -408,7 +432,10 @@ picture-uri='file:///usr/share/backgrounds/void-installer/${WALLPAPER_FILE}'
 picture-options='zoom'
 
 [org/gnome/desktop/input-sources]
-sources=[('xkb', 'ch+fr')]
+sources=[('xkb', '${KEYMAP//-/+}')]
+
+[org/gnome/desktop/interface]
+color-scheme='prefer-dark'
 
 [org/cinnamon/desktop/default-applications/terminal]
 exec='alacritty'
@@ -485,58 +512,244 @@ Extensions=any;
 Dependencies=/usr/local/bin/code-open;
 EOF
 
-# ── 3f) first-login autostart + profile.d for the live user ─────────────
+# ── 3f) Live session baked-in configuration ──────────────────────────────
+# No first-login script. Everything is baked in at build time.
+# The apply-settings script runs once at first Cinnamon login to apply
+# gsettings (100% reliable vs dconf system-db binary format variations).
+install -d -m 0755 "$INCLUDE_DIR/usr/local/libexec"
 install -d -m 0755 "$INCLUDE_DIR/etc/xdg/autostart"
+
+# Keep first-login.sh available for MANUAL use (Claude, NVM installs) but
+# do NOT autostart it. User can run it from a terminal if needed.
 if [[ -r "$OVERLAY/first-login.sh" ]]; then
-    install -d -m 0755 "$INCLUDE_DIR/usr/local/libexec"
     install -m 0755 "$OVERLAY/first-login.sh" "$INCLUDE_DIR/usr/local/libexec/first-login.sh"
-    cat > "$INCLUDE_DIR/etc/xdg/autostart/void-live-first-login.desktop" <<EOF
+fi
+
+# apply-settings.sh: runs once at first Cinnamon login, applies theme/wallpaper/
+# terminal via gsettings (writes to user dconf db — always works).
+cat > "$INCLUDE_DIR/usr/local/libexec/apply-live-settings.sh" <<EOF
+#!/bin/bash
+# Baked live-session settings. Runs once at first Cinnamon login.
+DONE="\$HOME/.void-live-settings-done"
+[[ -f "\$DONE" ]] && exit 0
+
+# Wait for D-Bus session bus (LightDM autologin starts it, be safe)
+for _i in \$(seq 15); do
+    [[ -n "\${DBUS_SESSION_BUS_ADDRESS:-}" ]] && break
+    eval "\$(dbus-launch --sh-syntax 2>/dev/null)" || true
+    sleep 0.3
+done
+
+# GTK / Cinnamon DE theme
+gsettings set org.cinnamon.desktop.interface gtk-theme    '${GTK_THEME}'
+gsettings set org.cinnamon.desktop.interface icon-theme   '${ICON_THEME}'
+gsettings set org.gnome.desktop.interface    cursor-theme '${CURSOR_THEME}'
+gsettings set org.cinnamon.theme name                     '${GTK_THEME}'
+
+# Wallpaper (first .jpg found in the backgrounds dir)
+_WP=\$(ls /usr/share/backgrounds/void-installer/*.jpg 2>/dev/null | head -1 || echo '')
+[[ -n "\$_WP" ]] && gsettings set org.cinnamon.desktop.background picture-uri "file://\$_WP"
+[[ -n "\$_WP" ]] && gsettings set org.gnome.desktop.background    picture-uri "file://\$_WP"
+
+# Default terminal
+gsettings set org.cinnamon.desktop.default-applications.terminal exec     '${DEFAULT_TERMINAL:-alacritty}'
+gsettings set org.cinnamon.desktop.default-applications.terminal exec-arg '-e'
+gsettings set org.gnome.desktop.default-applications.terminal    exec     '${DEFAULT_TERMINAL:-alacritty}'
+gsettings set org.gnome.desktop.default-applications.terminal    exec-arg '-e'
+
+# Keyboard layout — set explicitly via gsettings (belt-and-suspenders alongside
+# the user dconf db pre-baked in /etc/skel at build time).
+gsettings set org.gnome.desktop.input-sources sources "[('xkb', '${KEYMAP//-/+}')]"
+
+touch "\$DONE"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/libexec/apply-live-settings.sh"
+
+cat > "$INCLUDE_DIR/etc/xdg/autostart/void-live-settings.desktop" <<'DESK'
 [Desktop Entry]
 Type=Application
-Name=Void Live First-Login Setup
-Exec=/usr/local/libexec/first-login.sh
+Name=Void Live Apply Settings
+Exec=/usr/local/libexec/apply-live-settings.sh
 NoDisplay=true
 X-GNOME-Autostart-enabled=true
 OnlyShowIn=X-Cinnamon;
+DESK
+
+# /etc/environment: XDG_DATA_DIRS includes the pre-baked nix profile so that
+# Cinnamon's app menu picks up .desktop files from the nix store without
+# requiring any PATH tricks in the graphical session.
+cat > "$INCLUDE_DIR/etc/environment" <<'ENVEOF'
+XDG_DATA_DIRS=/home/live/.nix-profile/share:/usr/local/share:/usr/share
+ENVEOF
+
+# ── Timezone ──────────────────────────────────────────────────────────────
+ln -sf /usr/share/zoneinfo/Europe/Zurich "$INCLUDE_DIR/etc/localtime"
+cat > "$INCLUDE_DIR/etc/rc.conf" <<'RCEOF'
+KEYMAP="ch"
+HARDWARECLOCK="UTC"
+TIMEZONE="Europe/Zurich"
+RCEOF
+
+# ── Sound device udev rules ──────────────────────────────────────────────
+# PCM/control nodes are created root:root at early boot before the audio group
+# is provisioned; this rule ensures correct ownership on every boot.
+install -d -m 0755 "$INCLUDE_DIR/etc/udev/rules.d"
+cat > "$INCLUDE_DIR/etc/udev/rules.d/70-sound-perms.rules" <<'EOF'
+SUBSYSTEM=="sound", GROUP="audio", MODE="0660"
 EOF
+
+# ── NVIDIA PRIME overlay ────────────────────────────────────────────────
+# Blacklist nouveau — the live-setup.sh PRIME detection block already writes
+# Xorg config, but the kernel must also not load nouveau.
+install -d -m 0755 "$INCLUDE_DIR/etc/modprobe.d"
+cat > "$INCLUDE_DIR/etc/modprobe.d/blacklist-nouveau.conf" <<'EOF'
+blacklist nouveau
+options nouveau modeset=0
+EOF
+cat > "$INCLUDE_DIR/etc/modprobe.d/btusb-quirks.conf" <<'EOF'
+options btusb enable_autosuspend=0
+EOF
+install -d -m 0755 "$INCLUDE_DIR/etc/modules-load.d"
+cat > "$INCLUDE_DIR/etc/modules-load.d/nvidia.conf" <<'EOF'
+nvidia
+nvidia_modeset
+nvidia_uvm
+nvidia_drm
+EOF
+install -d -m 0755 "$INCLUDE_DIR/etc/dracut.conf.d"
+cat > "$INCLUDE_DIR/etc/dracut.conf.d/10-nvidia.conf" <<'EOF'
+add_drivers+=" nvidia nvidia_modeset nvidia_uvm nvidia_drm "
+omit_drivers+=" nouveau "
+EOF
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/prime-run" <<'EOF'
+#!/bin/sh
+exec env __NV_PRIME_RENDER_OFFLOAD=1 \
+         __VK_LAYER_NV_optimus=NVIDIA_only \
+         __GLX_VENDOR_LIBRARY_NAME=nvidia \
+         "$@"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/prime-run"
+
+# /etc/profile.d: PATH for interactive terminals (alacritty, etc.)
+install -d -m 0755 "$INCLUDE_DIR/etc/profile.d"
+cat > "$INCLUDE_DIR/etc/profile.d/nix-prebaked.sh" <<'NIXEOF'
+# Pre-baked nix profile — set up PATH for interactive shells.
+if [[ -d "${HOME:-}/.nix-profile/bin" ]]; then
+    case ":$PATH:" in
+        *":$HOME/.nix-profile/bin:"*) ;;
+        *) export PATH="$HOME/.nix-profile/bin:$PATH" ;;
+    esac
 fi
+export NIXPKGS_ALLOW_UNFREE=1
+# Pre-baked nix is single-user (no daemon) — bypass daemon connection attempt
+export NIX_REMOTE=local
+# Flake commands ignore NIXPKGS_ALLOW_UNFREE unless --impure is passed.
+# Wrap nix so interactive installs work without extra flags.
+nix() { command nix "$@" --impure; }
+export -f nix
+NIXEOF
+
+
+
+# ── 3f-ins) Void Linux installer in live image ───────────────────────────
+# install.sh uses INSTALLER_DIR=$(dirname $0)/lib for its libraries, so we
+# keep the script and lib/ together under /usr/local/lib/void-installer/.
+# SHARE_DIR (/usr/local/share/installer) holds config, packages, profiles.
+install -d -m 0755 "$INCLUDE_DIR/usr/local/lib/void-installer/lib"
+install -d -m 0755 "$INCLUDE_DIR/usr/local/share/installer"
+install -m 0755 "$PROJECT_DIR/installer/install.sh" "$INCLUDE_DIR/usr/local/lib/void-installer/install.sh"
+for f in "$PROJECT_DIR/installer/lib/"*.sh; do
+    install -m 0755 "$f" "$INCLUDE_DIR/usr/local/lib/void-installer/lib/$(basename "$f")"
+done
+# Config and packages — read by install.sh via SHARE_DIR
+install -m 0644 "$PROJECT_DIR/config/install.conf" "$INCLUDE_DIR/usr/local/share/installer/install.conf"
+install -m 0644 "$PROJECT_DIR/config/profiles/stable-cinnamon/packages.list" "$INCLUDE_DIR/usr/local/share/installer/packages.list"
+# Profiles directory (profile.conf + per-profile packages.list)
+if [[ -d "$PROJECT_DIR/config/profiles" ]]; then
+    cp -r "$PROJECT_DIR/config/profiles" "$INCLUDE_DIR/usr/local/share/installer/profiles"
+fi
+# Thin wrapper so the user can type `void-install` from anywhere
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/void-install" <<'WRAPEOF'
+#!/bin/sh
+exec /usr/local/lib/void-installer/install.sh "$@"
+WRAPEOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/void-install"
+# Secrets: read from secrets.env at build time, baked as /etc/installer-secrets.env
+# (the file is .gitignored; if absent the installer prompts interactively)
+_SECRETS_SRC="${SECRETS_ENV:-$PROJECT_DIR/secrets.env}"
+if [[ -r "$_SECRETS_SRC" ]]; then
+    install -d -m 0755 "$INCLUDE_DIR/etc"
+    install -m 0600 "$_SECRETS_SRC" "$INCLUDE_DIR/etc/installer-secrets.env"
+    echo "    baked installer secrets from $_SECRETS_SRC"
+else
+    echo "    WARNING: no secrets.env found — installer will prompt for passwords at runtime"
+fi
+# Desktop launcher — opens alacritty running void-install as root (live user
+# has passwordless sudo configured by mklive).
+install -d -m 0755 "$INCLUDE_DIR/usr/share/applications"
+cat > "$INCLUDE_DIR/usr/share/applications/void-installer.desktop" <<'DESKEOF'
+[Desktop Entry]
+Version=1.0
+Type=Application
+Name=Install Void Linux
+Comment=Install Void Linux to this machine
+Exec=alacritty --title "Void Linux Installer" -e sudo /usr/local/bin/void-install
+Icon=system-software-install
+Terminal=false
+Categories=System;
+StartupNotify=true
+DESKEOF
 
 install -d -m 0755 "$INCLUDE_DIR/etc/profile.d"
-cat > "$INCLUDE_DIR/etc/profile.d/local-bin.sh" <<'EOF'
+cat >> "$INCLUDE_DIR/etc/profile.d/nix-prebaked.sh" <<'EOF'
 case ":$PATH:" in
     *":$HOME/.local/bin:"*) ;;
     *) export PATH="$HOME/.local/bin:$PATH" ;;
 esac
 EOF
 
-# ── 3f-bis) Nix user packages list for first-login.sh ───────────────────
-# Write NIX_USER_PACKAGES (from install.conf) as a plain list so
-# first-login.sh can read it without sourcing install.conf.
+# nix-packages.list: kept so first-login.sh can still be run manually
 install -d -m 0755 "$INCLUDE_DIR/usr/local/libexec"
 {
-    for pkg in "${NIX_USER_PACKAGES[@]}"; do
-        echo "$pkg"
-    done
+    for pkg in "${NIX_USER_PACKAGES[@]}"; do echo "$pkg"; done
 } > "$INCLUDE_DIR/usr/local/libexec/nix-packages.list"
-# Also set the env var so first-login.sh knows where to find it.
 cat > "$INCLUDE_DIR/etc/profile.d/nix-packages-path.sh" <<'EOF'
 export NIX_PACKAGES_FILE=/usr/local/libexec/nix-packages.list
 EOF
 
-# ── 3g) Live-session skel: pre-wire .bash_profile for first-login ────────
+# nixpkgs config: allow unfree packages for all users
+install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/nixpkgs"
+echo '{ allowUnfree = true; }' > "$INCLUDE_DIR/etc/skel/.config/nixpkgs/config.nix"
+
+# git: GUI askpass so prompts work without a controlling terminal
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/git-askpass" <<'EOF'
+#!/bin/sh
+for cmd in zenity qarma; do
+    command -v "$cmd" >/dev/null 2>&1 || continue
+    case "$1" in
+        *[Uu]sername*) exec "$cmd" --entry   --title="Git Credentials" --text="$1" ;;
+        *)             exec "$cmd" --password --title="Git Credentials" --text="$1" ;;
+    esac
+done
+printf '%s' "$1" >&2; read -r answer; printf '%s\n' "$answer"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/git-askpass"
+cat > "$INCLUDE_DIR/etc/gitconfig" <<'EOF'
+[core]
+	askPass = /usr/local/bin/git-askpass
+EOF
+
+# ── 3g) Skel: .bash_profile sources .bashrc only (no first-login autorun) ──
 install -d -m 0755 "$INCLUDE_DIR/etc/skel"
 cat > "$INCLUDE_DIR/etc/skel/.bash_profile" <<'EOF'
 # Source .bashrc for interactive login shells.
 [[ -f ~/.bashrc ]] && . ~/.bashrc
-
-# Auto-run user environment setup on first interactive login.
-if [[ -z "$_FIRST_LOGIN_RAN" && -x /usr/local/libexec/first-login.sh \
-      && ! -f "$HOME/.first-login-done" ]]; then
-    export _FIRST_LOGIN_RAN=1
-    /usr/local/libexec/first-login.sh 2>&1 | tee -a "$HOME/.first-login.log"
-fi
 EOF
 
+
 # 4) build Docker image
 echo ">>> building docker image $DOCKER_IMAGE"
 if "$DOCKER" buildx version >/dev/null 2>&1; then
@@ -553,7 +766,7 @@ TS="$(date -u +%Y%m%d)"
 OUT_ISO="${OUTPUT_ISO:-$OUT_DIR/void-live-stable-${TS}.iso}"
 # live.user=live → vmklive dracut hook creates user 'live' (default would be 'anon')
 # console=ttyS0 → serial output for QEMU/real hardware debugging
-BOOT_CMDLINE="${BOOT_CMDLINE:-live.user=${LIVE_USER} console=tty0 console=ttyS0,115200}"
+BOOT_CMDLINE="${BOOT_CMDLINE:-live.user=${LIVE_USER} console=tty0 console=ttyS0,115200 nvidia-drm.modeset=1 rd.driver.blacklist=nouveau modprobe.blacklist=nouveau btusb.enable_autosuspend=0}"
 
 echo ">>> running mklive.sh inside docker — output: $OUT_ISO"
 "$DOCKER" run --rm --privileged \
@@ -568,6 +781,7 @@ echo ">>> running mklive.sh inside docker — output: $OUT_ISO"
     -e OUT_ISO_REL="${OUT_ISO#$PROJECT_DIR/}" \
     -e BOOT_CMDLINE="${BOOT_CMDLINE:-}" \
     -e INCLUDE_DIR_REL="${INCLUDE_DIR#$PROJECT_DIR/}" \
+    -e NIX_PACKAGES_PREBAKE="${NIX_USER_PACKAGES[*]}" \
     -e HOST_UID="$(id -u)" \
     -e HOST_GID="$(id -g)" \
     "$DOCKER_IMAGE" \

iso/build-niri-live-iso.sh

@@ -0,0 +1,895 @@
+#!/bin/bash
+# Build a niri/Wayland LIVE desktop ISO (mainline-niri profile).
+#
+# Boots directly into a niri session with noctalia-shell as user 'live'
+# (no password). agetty autologin on tty1 → .bash_profile → dbus-run-session niri.
+# All themes, wallpapers, and the
+# void-installer are pre-baked into the squashfs.
+#
+# Requires (host): bash, git, curl, docker, and Bibata-Modern-Ice cursor
+# installed at /usr/share/icons/Bibata-Modern-Ice.
+#
+# Usage:
+#   iso/build-niri-live-iso.sh
+#   OUTPUT_ISO=/path/to/output.iso iso/build-niri-live-iso.sh
+
+set -Eeuo pipefail
+
+PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CACHE_DIR="${CACHE_DIR:-$PROJECT_DIR/cache}"
+OUT_DIR="${OUT_DIR:-$PROJECT_DIR/out}"
+BUILD_DIR="${BUILD_DIR:-$PROJECT_DIR/build}"
+INCLUDE_DIR="$BUILD_DIR/niri-live-includes"
+MKLIVE_DIR="$CACHE_DIR/void-mklive-niri"  # separate clone — avoids race with Cinnamon parallel build
+MKLIVE_REPO="${MKLIVE_REPO:-https://github.com/void-linux/void-mklive.git}"
+MKLIVE_REF="${MKLIVE_REF:-master}"
+PATCH_DIR="$PROJECT_DIR/iso/patches"
+DOCKER_IMAGE="${DOCKER_IMAGE:-void-installer-builder:latest}"
+DOCKER="${DOCKER:-docker}"
+LIVE_USER="${LIVE_USER:-live}"
+
+# shellcheck disable=SC1091
+source "$PROJECT_DIR/config/install.conf"
+
+# Load niri profile settings (KERNEL_PKG, GTK_THEME, CURSOR_THEME, etc.)
+# shellcheck disable=SC1091
+source "$PROJECT_DIR/config/profiles/mainline-niri/profile.conf"
+
+command -v "$DOCKER" >/dev/null \
+    || { echo "ERROR: '$DOCKER' not in PATH"; exit 1; }
+"$DOCKER" info >/dev/null 2>&1 \
+    || { echo "ERROR: '$DOCKER' daemon unreachable"; exit 1; }
+
+mkdir -p "$CACHE_DIR" "$OUT_DIR" "$BUILD_DIR"
+
+# 1) clone + patch mklive (shared with Cinnamon build)
+if [[ ! -d "$MKLIVE_DIR/.git" ]]; then
+    echo ">>> cloning void-mklive"
+    git clone --depth=1 --branch "$MKLIVE_REF" "$MKLIVE_REPO" "$MKLIVE_DIR"
+fi
+if compgen -G "$PATCH_DIR/*.patch" >/dev/null; then
+    echo ">>> resetting + applying iso/patches/"
+    ( cd "$MKLIVE_DIR" && git checkout -- . )
+    for p in "$PATCH_DIR"/*.patch; do
+        echo "    $(basename "$p")"
+        ( cd "$MKLIVE_DIR" && patch -p1 --silent < "$p" )
+    done
+fi
+
+# 2) xbps-static (shared cache)
+XBPS_STATIC_DIR="$CACHE_DIR/xbps-static"
+if [[ ! -x "$XBPS_STATIC_DIR/usr/bin/xbps-install.static" ]]; then
+    echo ">>> downloading xbps-static"
+    mkdir -p "$XBPS_STATIC_DIR"
+    curl -fsSL "https://repo-default.voidlinux.org/static/xbps-static-latest.x86_64-musl.tar.xz" \
+        | tar xJf - -C "$XBPS_STATIC_DIR"
+fi
+
+# 3) build includes overlay (separate dir from Cinnamon build)
+echo ">>> staging niri live includes overlay at $INCLUDE_DIR"
+# The nix store (staged by Docker/root) uses 444/555 permissions — chmod first.
+chmod -R u+rwX "$INCLUDE_DIR" 2>/dev/null || true
+rm -rf "$INCLUDE_DIR"
+mkdir -p "$INCLUDE_DIR"
+
+install -d -m 0755 "$INCLUDE_DIR/etc"
+
+# ── 3a) greetd config (fallback TUI on tty2) + agetty autologin on tty1 ─
+# greetd's initial_session is not used: its PAM session setup fails silently
+# in the live environment (pam_elogind ENOSYS, missing D-Bus session bus).
+# Instead we autologin via agetty on tty1 and launch niri from .bash_profile.
+install -d -m 0755 "$INCLUDE_DIR/etc/greetd"
+cat > "$INCLUDE_DIR/etc/greetd/config.toml" <<'EOF'
+[terminal]
+vt = 2
+
+[default_session]
+command = "tuigreet --time --greeting 'Void Linux Live (niri)' --cmd niri-session"
+user = "_greeter"
+EOF
+
+# agetty-tty1 autologin: override conf so agetty-tty1 (mklive's default sv)
+# automatically logs in the live user on tty1 without racing with a custom sv.
+install -d -m 0755 "$INCLUDE_DIR/etc/sv/agetty-tty1"
+cat > "$INCLUDE_DIR/etc/sv/agetty-tty1/conf" <<EOF
+if [ -x /sbin/agetty -o -x /bin/agetty ]; then
+        if [ "\${tty}" = "tty1" ]; then
+                GETTY_ARGS="--noclear --autologin ${LIVE_USER}"
+        fi
+fi
+
+BAUD_RATE=38400
+TERM_NAME=linux
+EOF
+
+# ── 3b) xbps repo configuration ─────────────────────────────────────────
+# Write all repos into xbps.d so they are available in the live session
+# (not just at build time). The nonfree repo is needed for nvidia et al.
+install -d -m 0755 "$INCLUDE_DIR/etc/xbps.d"
+cat > "$INCLUDE_DIR/etc/xbps.d/00-void-repos.conf" <<EOF
+repository=${REPO_URL:-https://repo-default.voidlinux.org/current}
+repository=${REPO_URL%/current}/current/nonfree
+repository=${REPO_URL%/current}/current/multilib
+repository=${REPO_URL%/current}/current/multilib/nonfree
+EOF
+cat > "$INCLUDE_DIR/etc/xbps.d/10-noctalia.conf" <<'EOF'
+repository=https://universalrepo.r1xelelo.workers.dev/void
+EOF
+
+# ── 3c) live-setup.sh (runs from runit/2 before any service starts) ────
+install -d -m 0755 "$INCLUDE_DIR/etc/runit"
+cat > "$INCLUDE_DIR/etc/runit/live-setup.sh" <<'SV_EOF'
+#!/bin/sh
+# Niri live session setup. Runs from /etc/runit/2 before services start.
+
+LIVE_USER="${USERNAME:-live}"
+[ -f /etc/default/live.conf ] && . /etc/default/live.conf
+LIVE_USER="${LIVE_USER:-live}"
+
+# Extra groups (dracut only adds audio,video,wheel)
+for g in plugdev input network video audio _seatd bluetooth; do
+    groupadd -f "$g" 2>/dev/null || true
+    usermod -aG "$g" "$LIVE_USER" 2>/dev/null || true
+done
+
+install -d -m 0755 /etc/sudoers.d
+printf '%s ALL=(ALL) NOPASSWD: ALL\n' "$LIVE_USER" > /etc/sudoers.d/live
+chmod 0440 /etc/sudoers.d/live
+
+# nsswitch: remove mdns (library absent on Void; causes DNS lookup hangs)
+if [ -f /etc/nsswitch.conf ]; then
+    sed -i '/^hosts:/s/mdns[^ ]* *//g' /etc/nsswitch.conf
+fi
+
+# Fallback DNS (QEMU's 10.0.2.3 is unreliable; NM will overwrite once DHCP settles)
+if ! grep -q '^nameserver' /etc/resolv.conf 2>/dev/null || \
+   grep -q '^nameserver 10\.0\.2\.3' /etc/resolv.conf 2>/dev/null; then
+    printf 'nameserver 8.8.8.8\nnameserver 1.1.1.1\n' > /etc/resolv.conf
+fi
+
+# Ensure XDG_RUNTIME_DIR exists for the live user (greetd + elogind handle
+# this normally, but set it here as a safety net).
+XDG_RUN="/run/user/$(id -u "$LIVE_USER" 2>/dev/null || echo 1000)"
+install -d -m 0700 "$XDG_RUN" 2>/dev/null || true
+chown "$LIVE_USER" "$XDG_RUN" 2>/dev/null || true
+
+# Fix sound device permissions — PCM/control nodes are created root:root during
+# early boot before the audio group is guaranteed to exist.  Re-apply the correct
+# ownership now that the group is present, then trigger udev to re-evaluate the
+# sound subsystem so the persistent 70-sound-perms.rules rule is applied too.
+chown root:audio /dev/snd/pcmC* /dev/snd/controlC* /dev/snd/hwC* 2>/dev/null || true
+chmod 660 /dev/snd/pcmC* /dev/snd/controlC* /dev/snd/hwC* 2>/dev/null || true
+udevadm trigger --subsystem-match=sound 2>/dev/null || true
+
+# Timezone
+ln -sf /usr/share/zoneinfo/Europe/Zurich /etc/localtime 2>/dev/null || true
+
+echo "niri live-setup: done (user=$LIVE_USER)"
+SV_EOF
+chmod 0755 "$INCLUDE_DIR/etc/runit/live-setup.sh"
+
+# runit/2: standard Void runit stage 2 — runs live-setup then hands off to runsvdir
+cat > "$INCLUDE_DIR/etc/runit/2" <<'SV_EOF'
+#!/bin/sh
+PATH=/usr/bin:/usr/sbin
+
+# Live session setup: groups, sudo, DNS
+[ -x /etc/runit/live-setup.sh ] && /etc/runit/live-setup.sh
+
+# Select runlevel from cmdline (default: default)
+runlevel=default
+for arg in $(cat /proc/cmdline); do
+    if [ -d /etc/runit/runsvdir/"$arg" ]; then
+        runlevel="$arg"
+    fi
+done
+
+[ -x /etc/rc.local ] && /etc/rc.local
+
+runsvchdir "${runlevel}"
+mkdir -p /run/runit/runsvdir
+ln -sf /etc/runit/runsvdir/current /run/runit/runsvdir/current
+
+exec env - PATH=$PATH \
+    runsvdir -P /run/runit/runsvdir/current \
+    'log: ...........................................................................................................................................................................................................................................................................................................................................................................................................'
+SV_EOF
+chmod 0755 "$INCLUDE_DIR/etc/runit/2"
+
+# Enable services for the niri live session
+install -d -m 0755 "$INCLUDE_DIR/etc/runit/runsvdir/default"
+
+# Custom elogind sv: uses correct binary path and waits for dbus socket before
+# starting (prevents "elogind is already running" spam from rapid runit restarts).
+install -d -m 0755 "$INCLUDE_DIR/etc/sv/elogind"
+cat > "$INCLUDE_DIR/etc/sv/elogind/run" <<'EOF'
+#!/bin/sh
+exec 2>&1
+
+# Helper: is elogind's login1 D-Bus name already registered on the system bus?
+_login1_on_dbus() {
+    dbus-send --system --print-reply --dest=org.freedesktop.DBus \
+        /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner \
+        string:org.freedesktop.login1 >/dev/null 2>&1
+}
+
+# Helper: is elogind process alive via its PID file?
+_elogind_alive() {
+    for _pf in /run/elogind.pid /run/elogind/elogind.pid; do
+        [ -f "$_pf" ] && kill -0 "$(cat "$_pf" 2>/dev/null)" 2>/dev/null && return 0
+    done
+    return 1
+}
+
+# If elogind is already running (process alive or D-Bus name taken), yield
+# permanently so runit does not spam restarts.
+if _elogind_alive || _login1_on_dbus; then
+    echo "elogind-sv: already running — yielding to avoid restart spam"
+    exec tail -f /dev/null
+fi
+
+# Wait for dbus socket — poll every second, up to 30s
+i=0
+while [ $i -lt 30 ] && [ ! -S /run/dbus/system_bus_socket ]; do
+    sleep 1; i=$((i+1))
+done
+
+exec /usr/libexec/elogind/elogind.wrapper
+EOF
+chmod 0755 "$INCLUDE_DIR/etc/sv/elogind/run"
+
+# finish: rate-limit restarts; if the run was very short (elogind crashed or
+# reported "already running" before our detection), back off longer.
+cat > "$INCLUDE_DIR/etc/sv/elogind/finish" <<'EOF'
+#!/bin/sh
+# $1=exitcode, $2=signal (or -1)
+exitcode="$1"
+# Non-zero exit with no signal = elogind bailed out (e.g. "already running").
+# Sleep longer to avoid log spam; next run will yield via the D-Bus/PID check.
+if [ "$exitcode" != "0" ] && [ "$2" = "-1" ]; then
+    sleep 10
+else
+    sleep 3
+fi
+EOF
+chmod 0755 "$INCLUDE_DIR/etc/sv/elogind/finish"
+
+for svc in dbus elogind NetworkManager bluetoothd sshd; do
+    ln -sf "/etc/sv/$svc" "$INCLUDE_DIR/etc/runit/runsvdir/default/$svc"
+done
+
+# ── 3d) Wayland environment ─────────────────────────────────────────────
+install -d -m 0755 "$INCLUDE_DIR/etc/profile.d"
+cat > "$INCLUDE_DIR/etc/profile.d/wayland.sh" <<'EOF'
+# Wayland defaults (mainline-niri live session)
+export QT_QPA_PLATFORM="wayland;xcb"
+export GDK_BACKEND="wayland,x11"
+export MOZ_ENABLE_WAYLAND=1
+export _JAVA_AWT_WM_NONREPARENTING=1
+export XDG_CURRENT_DESKTOP=niri
+export XDG_SESSION_TYPE=wayland
+# Use elogind's logind backend — works correctly on Void/runit via audit session IDs
+export LIBSEAT_BACKEND=logind
+# Force GTK apps (and Electron/VSCode) to use XDG portal file dialogs
+export GTK_USE_PORTAL=1
+export ELECTRON_OZONE_PLATFORM_HINT=auto
+EOF
+chmod 0644 "$INCLUDE_DIR/etc/profile.d/wayland.sh"
+
+# Nix profile.d: adds ~/.nix-profile/bin to PATH for interactive shells
+cat > "$INCLUDE_DIR/etc/profile.d/nix-prebaked.sh" <<'EOF'
+# Pre-baked nix profile — expose nix package binaries
+if [[ -d "${HOME:-}/.nix-profile/bin" ]]; then
+    case ":$PATH:" in
+        *":$HOME/.nix-profile/bin:"*) ;;
+        *) export PATH="$HOME/.nix-profile/bin:$PATH" ;;
+    esac
+fi
+# Expose nix .desktop files and icons to XDG-compliant launchers/shells
+if [[ -d "${HOME:-}/.nix-profile/share" ]]; then
+    case ":${XDG_DATA_DIRS:-}:" in
+        *":$HOME/.nix-profile/share:"*) ;;
+        *) export XDG_DATA_DIRS="$HOME/.nix-profile/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" ;;
+    esac
+fi
+export NIXPKGS_ALLOW_UNFREE=1
+# Pre-baked nix is single-user (no daemon) — bypass daemon connection attempt
+export NIX_REMOTE=local
+# Flake commands ignore NIXPKGS_ALLOW_UNFREE unless --impure is passed.
+# Wrap nix so interactive installs work without extra flags.
+nix() { command nix "$@" --impure; }
+export -f nix
+EOF
+chmod 0644 "$INCLUDE_DIR/etc/profile.d/nix-prebaked.sh"
+
+# Nix daemon config (trusted live user so nix commands work without root)
+install -d -m 0755 "$INCLUDE_DIR/etc/nix"
+cat > "$INCLUDE_DIR/etc/nix/nix.conf" <<EOF
+experimental-features = nix-command flakes
+build-users-group =
+sandbox = false
+auto-optimise-store = true
+trusted-users = root ${LIVE_USER}
+max-jobs = 2
+http-connections = 10
+EOF
+
+# nixpkgs config: allow unfree packages for all users
+install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/nixpkgs"
+echo '{ allowUnfree = true; }' > "$INCLUDE_DIR/etc/skel/.config/nixpkgs/config.nix"
+
+# git: GUI askpass so prompts work without a controlling terminal
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/git-askpass" <<'EOF'
+#!/bin/sh
+for cmd in zenity qarma; do
+    command -v "$cmd" >/dev/null 2>&1 || continue
+    case "$1" in
+        *[Uu]sername*) exec "$cmd" --entry   --title="Git Credentials" --text="$1" ;;
+        *)             exec "$cmd" --password --title="Git Credentials" --text="$1" ;;
+    esac
+done
+printf '%s' "$1" >&2; read -r answer; printf '%s\n' "$answer"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/git-askpass"
+cat > "$INCLUDE_DIR/etc/gitconfig" <<'EOF'
+[core]
+	askPass = /usr/local/bin/git-askpass
+EOF
+
+# ── 3e) niri config.kdl in /etc/skel ───────────────────────────────────
+# dracut's adduser.sh copies skel → /home/live, so the live user gets a
+# ready niri config without any first-boot setup step.
+
+# Pre-bake SSH authorized_keys from host so passwordless SSH just works in QEMU tests.
+if _HOST_PUBKEY=$(ssh-add -L 2>/dev/null | head -1) && [ -n "$_HOST_PUBKEY" ]; then
+    install -d -m 0700 "$INCLUDE_DIR/etc/skel/.ssh"
+    echo "$_HOST_PUBKEY" > "$INCLUDE_DIR/etc/skel/.ssh/authorized_keys"
+    chmod 0600 "$INCLUDE_DIR/etc/skel/.ssh/authorized_keys"
+fi
+KEYMAP_XKB_LAYOUT="${KEYMAP%%-*}"           # ch-fr_nodeadkeys → ch
+KEYMAP_XKB_VARIANT="${KEYMAP#*-}"           # ch-fr_nodeadkeys → fr_nodeadkeys
+KEYMAP_XKB_VARIANT="${KEYMAP_XKB_VARIANT//_nodeadkeys/}"  # strip trailing _nodeadkeys
+
+install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/niri"
+cat > "$INCLUDE_DIR/etc/skel/.config/niri/config.kdl" <<EOF
+// niri config — generated by void-installer (mainline-niri live session).
+input {
+    keyboard {
+        xkb {
+            layout "${KEYMAP_XKB_LAYOUT}"
+            variant "${KEYMAP_XKB_VARIANT}"
+        }
+    }
+    touchpad {
+        tap
+        natural-scroll
+        dwt
+    }
+    mouse {
+        accel-speed 0.0
+    }
+}
+
+layout {
+    gaps 12
+    center-focused-column "never"
+    preset-column-widths {
+        proportion 0.33333
+        proportion 0.5
+        proportion 0.66667
+    }
+    default-column-width { proportion 0.5; }
+    focus-ring {
+        width 2
+        active-color "#fabd2f"
+        inactive-color "#3c3836"
+    }
+    border { off; }
+}
+
+prefer-no-csd
+
+cursor {
+    xcursor-theme "${CURSOR_THEME:-Bibata-Modern-Ice}"
+    xcursor-size 24
+}
+
+// Audio / screen session services — started by niri as the live user
+spawn-at-startup "pipewire"
+spawn-at-startup "pipewire-pulse"
+// Keep WirePlumber running: wait for the PipeWire socket then start it,
+// restart on any crash or pipewire restart (e.g. after package installs).
+spawn-at-startup "sh" "-c" "while true; do while [ ! -S /run/user/\$(id -u)/pipewire-0 ]; do sleep 0.2; done; wireplumber; sleep 1; done"
+
+// Background, notifications and auth
+spawn-at-startup "swaybg" "-i" "/usr/share/backgrounds/void-installer/pxfuel.jpg" "-m" "fill"
+spawn-at-startup "mako"
+spawn-at-startup "/usr/libexec/polkit-gnome-authentication-agent-1"
+
+// noctalia-shell — wait for org.bluez before launching so the BT module
+// initialises correctly (bluetoothd may not be on D-Bus yet at this point).
+spawn-at-startup "sh" "-c" "i=0; while [ \$i -lt 30 ] && ! dbus-send --system --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.bluez >/dev/null 2>&1; do sleep 1; i=\$((i+1)); done; exec quickshell -c noctalia-shell"
+
+// First-login setup: installs Claude Code (and NVM) once, then closes
+spawn-at-startup "sh" "-c" "[ -f ~/.first-login-done ] || alacritty -T 'Void Setup' -e /usr/local/libexec/first-login.sh"
+
+binds {
+    Mod+T          { spawn "alacritty"; }
+    Mod+D          { spawn "sh" "-c" "quickshell msg -c noctalia-shell launcher toggle"; }
+    Mod+Q          { close-window; }
+    Mod+Shift+E    { quit; }
+    Print          { screenshot; }
+    Mod+H          { focus-column-left; }
+    Mod+L          { focus-column-right; }
+    Mod+J          { focus-window-down; }
+    Mod+K          { focus-window-up; }
+    Mod+Shift+H    { move-column-left; }
+    Mod+Shift+L    { move-column-right; }
+    Mod+1          { focus-workspace 1; }
+    Mod+2          { focus-workspace 2; }
+    Mod+3          { focus-workspace 3; }
+    Mod+4          { focus-workspace 4; }
+    Mod+Shift+1    { move-column-to-workspace 1; }
+    Mod+Shift+2    { move-column-to-workspace 2; }
+    XF86AudioRaiseVolume { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%+"; }
+    XF86AudioLowerVolume { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%-"; }
+    XF86AudioMute        { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle"; }
+    XF86MonBrightnessUp   { spawn "brightnessctl" "set" "+5%"; }
+    XF86MonBrightnessDown { spawn "brightnessctl" "set" "5%-"; }
+}
+EOF
+
+# ── 3f) Themes / icons / wallpapers overlay ─────────────────────────────
+echo ">>> staging niri customizations overlay"
+OVERLAY="$INCLUDE_DIR/etc/installer-overlay"
+install -d -m 0755 "$OVERLAY" "$OVERLAY/wallpapers" \
+                   "$OVERLAY/themes" "$OVERLAY/icons"
+
+# Wallpapers
+WP_SRC="${WALLPAPERS_SRC:-$HOME/Scaricati}"
+shopt -s nullglob
+for f in "$WP_SRC"/pxfuel*.jpg; do
+    install -m 0644 "$f" "$OVERLAY/wallpapers/$(basename "$f")"
+done
+shopt -u nullglob
+echo "    wallpapers: $(ls "$OVERLAY/wallpapers" 2>/dev/null | wc -l) file(s)"
+
+# Gruvbox GTK theme (for GTK apps running under niri)
+THEME_CACHE="$CACHE_DIR/gruvbox-gtk-theme"
+THEME_BUILD="$CACHE_DIR/gruvbox-gtk-built"
+if [[ ! -d "$THEME_CACHE/.git" ]]; then
+    git clone --depth=1 https://github.com/Fausto-Korpsvart/Gruvbox-GTK-Theme.git "$THEME_CACHE" || true
+fi
+if [[ -x "$THEME_CACHE/themes/install.sh" && ! -d "$THEME_BUILD" ]]; then
+    echo "    building gruvbox themes"
+    install -d -m 0755 "$THEME_BUILD"
+    "$DOCKER" run --rm \
+        -v "$THEME_CACHE":/src \
+        -v "$THEME_BUILD":/out \
+        debian:stable-slim sh -c '
+            export DEBIAN_FRONTEND=noninteractive
+            apt-get update -qq >/dev/null
+            apt-get install -y --no-install-recommends sassc bash >/dev/null
+            cd /src/themes && bash install.sh -d /out -t default -c dark -s standard
+        ' || true
+fi
+if [[ -d "$THEME_BUILD" ]]; then
+    for d in "$THEME_BUILD"/Gruvbox-Dark*; do
+        [[ -d "$d" ]] && cp -a "$d" "$OVERLAY/themes/$(basename "$d")"
+    done
+    echo "    themes: $(ls "$OVERLAY/themes" 2>/dev/null | wc -l) variant(s)"
+fi
+
+# Gruvbox Plus icons
+ICON_CACHE="$CACHE_DIR/gruvbox-plus-icons"
+if [[ ! -d "$ICON_CACHE/.git" ]]; then
+    git clone --depth=1 https://github.com/SylEleuth/gruvbox-plus-icon-pack.git "$ICON_CACHE" || true
+fi
+if [[ -d "$ICON_CACHE/Gruvbox-Plus-Dark" ]]; then
+    cp -a "$ICON_CACHE/Gruvbox-Plus-Dark" "$OVERLAY/icons/Gruvbox-Plus-Dark"
+    echo "    icons: Gruvbox-Plus-Dark"
+fi
+
+# Bibata cursor
+BIBATA_SRC="${BIBATA_SRC:-/usr/share/icons/Bibata-Modern-Ice}"
+if [[ -d "$BIBATA_SRC" ]]; then
+    cp -a "$BIBATA_SRC" "$OVERLAY/icons/Bibata-Modern-Ice"
+    echo "    cursor: Bibata-Modern-Ice"
+fi
+
+# first-login.sh — deployed by _deploy_first_login() to the installed system.
+[[ -r "$PROJECT_DIR/installer/first-login.sh" ]] && \
+    install -m 0755 "$PROJECT_DIR/installer/first-login.sh" "$OVERLAY/first-login.sh"
+
+# Claude Code config + auth tokens from host (deployed to the installed system).
+CLAUDE_SRC="${CLAUDE_SRC:-$HOME/.claude}"
+[[ -d "$CLAUDE_SRC" ]] && { cp -a "$CLAUDE_SRC" "$OVERLAY/claude"; echo "    claude: ~/.claude bundled"; }
+[[ -r "${HOME}/.claude.json" ]] && install -m 0600 "${HOME}/.claude.json" "$OVERLAY/claude.json"
+
+# VS Code user config + extension list from host.
+VSCODE_SRC="${VSCODE_USER_SRC:-$HOME/.config/Code/User}"
+install -d -m 0755 "$OVERLAY/vscode-user"
+if [[ -d "$VSCODE_SRC" ]]; then
+    for f in settings.json keybindings.json; do
+        [[ -r "$VSCODE_SRC/$f" ]] && install -m 0644 "$VSCODE_SRC/$f" "$OVERLAY/vscode-user/$f"
+    done
+    [[ -d "$VSCODE_SRC/snippets" ]] && cp -a "$VSCODE_SRC/snippets" "$OVERLAY/vscode-user/snippets"
+    command -v code >/dev/null 2>&1 && \
+        code --list-extensions > "$OVERLAY/vscode-extensions.txt" 2>/dev/null || true
+    echo "    vscode-user: staged from $VSCODE_SRC"
+fi
+
+# Copy wallpapers and assets into usr/share (rootfs overlay)
+install -d -m 0755 "$INCLUDE_DIR/usr/share/backgrounds/void-installer"
+cp -a "$OVERLAY/wallpapers"/. "$INCLUDE_DIR/usr/share/backgrounds/void-installer/" 2>/dev/null || true
+
+install -d -m 0755 "$INCLUDE_DIR/usr/share/themes"
+[[ -d "$OVERLAY/themes" ]] && cp -a "$OVERLAY/themes"/. "$INCLUDE_DIR/usr/share/themes/" 2>/dev/null || true
+
+install -d -m 0755 "$INCLUDE_DIR/usr/share/icons"
+[[ -d "$OVERLAY/icons" ]] && cp -a "$OVERLAY/icons"/. "$INCLUDE_DIR/usr/share/icons/" 2>/dev/null || true
+
+# ── 3g) GTK settings + dark theme dconf ────────────────────────────────
+# Write GTK2/3/4 settings to skel so the live user picks them up.
+install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/gtk-3.0"
+install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/gtk-4.0"
+
+# dconf system keyfile: ensures GTK dark theme is reported to all apps via
+# xdg-desktop-portal-gtk regardless of whether the user has a dconf DB yet.
+install -d -m 0755 "$INCLUDE_DIR/etc/dconf/db/local.d"
+install -d -m 0755 "$INCLUDE_DIR/etc/dconf/profile"
+cat > "$INCLUDE_DIR/etc/dconf/db/local.d/01-dark-theme" <<'EOF'
+[org/gnome/desktop/interface]
+color-scheme='prefer-dark'
+gtk-theme='${GTK_THEME}'
+icon-theme='${ICON_THEME}'
+cursor-theme='${CURSOR_THEME:-Bibata-Modern-Ice}'
+cursor-size=24
+EOF
+sed -i "s/'\${GTK_THEME}'/'${GTK_THEME}'/; s/'\${ICON_THEME}'/'${ICON_THEME}'/; s/'\${CURSOR_THEME:-Bibata-Modern-Ice}'/'${CURSOR_THEME:-Bibata-Modern-Ice}'/" \
+    "$INCLUDE_DIR/etc/dconf/db/local.d/01-dark-theme"
+printf 'user-db:user\nsystem-db:local\n' > "$INCLUDE_DIR/etc/dconf/profile/user"
+
+cat > "$INCLUDE_DIR/etc/skel/.config/gtk-3.0/settings.ini" <<EOF
+[Settings]
+gtk-theme-name=${GTK_THEME}
+gtk-icon-theme-name=${ICON_THEME}
+gtk-cursor-theme-name=${CURSOR_THEME:-Bibata-Modern-Ice}
+gtk-cursor-theme-size=24
+gtk-font-name=Noto Sans 11
+EOF
+
+cp "$INCLUDE_DIR/etc/skel/.config/gtk-3.0/settings.ini" \
+   "$INCLUDE_DIR/etc/skel/.config/gtk-4.0/settings.ini"
+
+install -d -m 0755 "$INCLUDE_DIR/etc/skel"
+cat > "$INCLUDE_DIR/etc/skel/.gtkrc-2.0" <<EOF
+gtk-theme-name="${GTK_THEME}"
+gtk-icon-theme-name="${ICON_THEME}"
+gtk-cursor-theme-name="${CURSOR_THEME:-Bibata-Modern-Ice}"
+gtk-cursor-theme-size=24
+gtk-font-name="Noto Sans 11"
+EOF
+
+# XDG_DATA_DIRS: include the pre-baked nix profile share dir so launchers
+# and icon themes pick up nix-installed apps on first boot.
+# /etc/environment is loaded by pam_env for ALL session types (tty autologin
+# and greetd), so this is the most reliable place to set this baseline.
+cat > "$INCLUDE_DIR/etc/environment" <<ENVEOF
+XDG_DATA_DIRS=/home/${LIVE_USER}/.nix-profile/share:/usr/local/share:/usr/share
+QT_QPA_PLATFORM=wayland;xcb
+GDK_BACKEND=wayland,x11
+MOZ_ENABLE_WAYLAND=1
+LIBSEAT_BACKEND=logind
+GTK_USE_PORTAL=1
+ELECTRON_OZONE_PLATFORM_HINT=auto
+ENVEOF
+
+# ── noctalia default settings ─────────────────────────────────────────────
+# Baseline settings.json placed in skel so the live user (and any installed
+# user whose home is created from skel) starts with:
+#   - correct wallpaper directory pointing at the baked-in backgrounds
+#   - Gruvbox dark colour scheme
+#   - real app icons (iconMode=apps) instead of tabler monochrome icons
+install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config/noctalia"
+cat > "$INCLUDE_DIR/etc/skel/.config/noctalia/settings.json" <<NOCEOF
+{
+    "appLauncher": {
+        "iconMode": "apps",
+        "sortByMostUsed": true,
+        "showCategories": true,
+        "viewMode": "grid",
+        "pinnedApps": [],
+        "terminalCommand": "alacritty -e",
+        "density": "default",
+        "position": "center"
+    },
+    "colorSchemes": {
+        "darkMode": true,
+        "predefinedScheme": "Gruvbox",
+        "generationMethod": "tonal-spot",
+        "manualSunrise": "06:30",
+        "manualSunset": "18:30",
+        "monitorForColors": ""
+    },
+    "wallpaper": {
+        "enabled": true,
+        "directory": "/usr/share/backgrounds/void-installer",
+        "fillMode": "crop",
+        "fillColor": "#000000",
+        "automationEnabled": false,
+        "favorites": [],
+        "hideWallpaperFilenames": false,
+        "linkLightAndDarkWallpapers": true,
+        "monitorDirectories": [],
+        "enableMultiMonitorDirectories": false
+    }
+}
+NOCEOF
+
+# ── Default browser: google-chrome (nix) ──────────────────────────────────
+# System-wide MIME defaults so chrome is the default browser from first boot.
+# Written to /etc/xdg/mimeapps.list (system default) and skel.
+install -d -m 0755 "$INCLUDE_DIR/etc/xdg"
+cat > "$INCLUDE_DIR/etc/xdg/mimeapps.list" <<'EOF'
+[Default Applications]
+text/html=google-chrome.desktop
+x-scheme-handler/http=google-chrome.desktop
+x-scheme-handler/https=google-chrome.desktop
+x-scheme-handler/about=google-chrome.desktop
+x-scheme-handler/unknown=google-chrome.desktop
+application/pdf=google-chrome.desktop
+application/xhtml+xml=google-chrome.desktop
+application/xml=google-chrome.desktop
+EOF
+install -d -m 0755 "$INCLUDE_DIR/etc/skel/.config"
+cp "$INCLUDE_DIR/etc/xdg/mimeapps.list" "$INCLUDE_DIR/etc/skel/.config/mimeapps.list"
+
+# ── Portal backend configuration for niri ─────────────────────────────────
+# Without this, xdg-desktop-portal doesn't know which backend to use for
+# XDG_CURRENT_DESKTOP=niri, causing file-picker / portal calls to fail.
+install -d -m 0755 "$INCLUDE_DIR/etc/xdg/xdg-desktop-portal"
+cat > "$INCLUDE_DIR/etc/xdg/xdg-desktop-portal/niri-portals.conf" <<'EOF'
+[preferred]
+default=gtk
+org.freedesktop.impl.portal.FileChooser=gtk
+org.freedesktop.impl.portal.AppChooser=gtk
+org.freedesktop.impl.portal.OpenURI=gtk
+org.freedesktop.impl.portal.Print=gtk
+org.freedesktop.impl.portal.Screenshot=gtk
+org.freedesktop.impl.portal.Inhibit=gtk
+org.freedesktop.impl.portal.Notification=gtk
+org.freedesktop.impl.portal.Settings=gtk
+EOF
+
+# ── Sound device udev rules ────────────────────────────────────────
+# PCM/control nodes are created root:root at early boot before the audio
+# group is provisioned; this rule ensures correct ownership on every boot.
+install -d -m 0755 "$INCLUDE_DIR/etc/udev/rules.d"
+cat > "$INCLUDE_DIR/etc/udev/rules.d/70-sound-perms.rules" <<'EOF'
+# Allow the audio group to access ALSA PCM and control devices.
+SUBSYSTEM=="sound", GROUP="audio", MODE="0660"
+EOF
+
+# ── Timezone ──────────────────────────────────────────────────────────
+# Create the /etc/localtime symlink and rc.conf TIMEZONE setting so the live
+# session starts in the correct timezone without requiring a user step.
+ln -sf /usr/share/zoneinfo/Europe/Zurich "$INCLUDE_DIR/etc/localtime"
+cat > "$INCLUDE_DIR/etc/rc.conf" <<'RCEOF'
+KEYMAP="ch"
+HARDWARECLOCK="UTC"
+TIMEZONE="Europe/Zurich"
+RCEOF
+
+# ── NVIDIA PRIME overlay ────────────────────────────────────────────────
+echo ">>> staging NVIDIA PRIME overlay"
+
+# Blacklist nouveau — prevents the open-source driver from grabbing the GPU
+# before the proprietary nvidia driver.
+install -d -m 0755 "$INCLUDE_DIR/etc/modprobe.d"
+cat > "$INCLUDE_DIR/etc/modprobe.d/blacklist-nouveau.conf" <<'EOF'
+blacklist nouveau
+options nouveau modeset=0
+EOF
+
+# Intel BT on this platform suffers firmware download failures when USB
+# autosuspend is active for the btusb adapter.
+cat > "$INCLUDE_DIR/etc/modprobe.d/btusb-quirks.conf" <<'EOF'
+options btusb enable_autosuspend=0
+EOF
+
+# Load nvidia modules early so the DRM device node exists before niri starts.
+install -d -m 0755 "$INCLUDE_DIR/etc/modules-load.d"
+cat > "$INCLUDE_DIR/etc/modules-load.d/nvidia.conf" <<'EOF'
+nvidia
+nvidia_modeset
+nvidia_uvm
+nvidia_drm
+EOF
+
+# dracut: include nvidia modules in initramfs; omit nouveau.
+install -d -m 0755 "$INCLUDE_DIR/etc/dracut.conf.d"
+cat > "$INCLUDE_DIR/etc/dracut.conf.d/10-nvidia.conf" <<'EOF'
+add_drivers+=" nvidia nvidia_modeset nvidia_uvm nvidia_drm "
+omit_drivers+=" nouveau "
+EOF
+
+# Xorg output-class configs: intel=modesetting (primary), nvidia=PRIME offload.
+# Needed by xwayland-satellite for X11 clients running under niri.
+install -d -m 0755 "$INCLUDE_DIR/etc/X11/xorg.conf.d"
+cat > "$INCLUDE_DIR/etc/X11/xorg.conf.d/10-intel.conf" <<'EOF'
+Section "OutputClass"
+    Identifier "intel"
+    MatchDriver "i915"
+    Driver "modesetting"
+EndSection
+EOF
+cat > "$INCLUDE_DIR/etc/X11/xorg.conf.d/20-nvidia.conf" <<'EOF'
+Section "OutputClass"
+    Identifier "nvidia"
+    MatchDriver "nvidia-drm"
+    Driver "nvidia"
+    Option "AllowEmptyInitialConfiguration"
+    Option "PrimaryGPU" "no"
+    ModulePath "/usr/lib/nvidia/xorg"
+    ModulePath "/usr/lib/xorg/modules"
+EndSection
+EOF
+
+# prime-run: launch any app on the NVIDIA dGPU via PRIME render-offload.
+cat > "$INCLUDE_DIR/usr/local/bin/prime-run" <<'EOF'
+#!/bin/sh
+# Run a program on the NVIDIA dGPU via PRIME render offload.
+exec env __NV_PRIME_RENDER_OFFLOAD=1 \
+         __VK_LAYER_NV_optimus=NVIDIA_only \
+         __GLX_VENDOR_LIBRARY_NAME=nvidia \
+         "$@"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/prime-run"
+
+# ── 3g2) niri-session wrapper ─────────────────────────────────────────────
+# greetd/tuigreet starts niri-session (not niri --session directly) so that
+# /etc/profile is sourced first, ensuring /etc/profile.d/* scripts run and
+# XDG_DATA_DIRS gets ~/.nix-profile/share prepended for the compositor and
+# all apps it spawns (noctalia-shell, fuzzel, etc.).
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/niri-session" <<'EOF'
+#!/bin/bash
+# niri-session — wrapper started by greetd/tuigreet.
+# Sources /etc/profile so that all /etc/profile.d/* scripts run
+# (nix paths, wayland env, XDG_DATA_DIRS with ~/.nix-profile/share, etc.)
+# before handing off to the compositor.
+[ -f /etc/profile ] && . /etc/profile
+exec niri --session "$@"
+EOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/niri-session"
+
+# ── 3h) .bash_profile: source .bashrc + launch niri on tty1 ───────────
+# agetty autologin on tty1 runs a login shell; .bash_profile execs niri
+# via dbus-run-session so it gets a D-Bus session bus.
+cat > "$INCLUDE_DIR/etc/skel/.bash_profile" <<'EOF'
+[[ -f ~/.bashrc ]] && . ~/.bashrc
+if [[ "$(tty)" == /dev/tty1 ]] && [[ -z "$WAYLAND_DISPLAY" ]] && [[ -z "$NIRI_SOCKET" ]]; then
+    # Wrap niri startup: start GNOME Keyring daemon first (inside the D-Bus session)
+    # so Chrome/VSCode/apps can store secrets via org.freedesktop.secrets.
+    exec dbus-run-session -- sh -c '
+        if command -v gnome-keyring-daemon >/dev/null 2>&1; then
+            eval "$(gnome-keyring-daemon --start --components=secrets,pkcs11 2>/dev/null)" || true
+            export GNOME_KEYRING_CONTROL GNOME_KEYRING_PID SSH_AUTH_SOCK
+        fi
+        exec niri --session
+    '
+fi
+EOF
+
+# ── 3i) Void Linux installer baked in ───────────────────────────────────
+install -d -m 0755 "$INCLUDE_DIR/usr/local/lib/void-installer/lib"
+install -d -m 0755 "$INCLUDE_DIR/usr/local/share/installer"
+install -m 0755 "$PROJECT_DIR/installer/install.sh" \
+    "$INCLUDE_DIR/usr/local/lib/void-installer/install.sh"
+for f in "$PROJECT_DIR/installer/lib/"*.sh; do
+    install -m 0755 "$f" \
+        "$INCLUDE_DIR/usr/local/lib/void-installer/lib/$(basename "$f")"
+done
+install -m 0644 "$PROJECT_DIR/config/install.conf" \
+    "$INCLUDE_DIR/usr/local/share/installer/install.conf"
+install -m 0644 "$PROJECT_DIR/config/profiles/mainline-niri/packages.list" \
+    "$INCLUDE_DIR/usr/local/share/installer/packages.list"
+if [[ -d "$PROJECT_DIR/config/profiles" ]]; then
+    cp -r "$PROJECT_DIR/config/profiles" \
+        "$INCLUDE_DIR/usr/local/share/installer/profiles"
+fi
+
+install -d -m 0755 "$INCLUDE_DIR/usr/local/bin"
+cat > "$INCLUDE_DIR/usr/local/bin/void-install" <<'WRAPEOF'
+#!/bin/sh
+exec /usr/local/lib/void-installer/install.sh "$@"
+WRAPEOF
+chmod 0755 "$INCLUDE_DIR/usr/local/bin/void-install"
+
+# first-login.sh at /usr/local/libexec: available in the live session and
+# deployed by _deploy_first_login() to the installed system via the overlay.
+install -d -m 0755 "$INCLUDE_DIR/usr/local/libexec"
+install -m 0755 "$PROJECT_DIR/installer/first-login.sh" \
+    "$INCLUDE_DIR/usr/local/libexec/first-login.sh"
+
+# nix-packages.list: tells first-login.sh which nix packages to install.
+# In the live session these are already prebaked; in the installed system the
+# first-boot-nix runit service handles them, so this is informational only.
+{
+    printf '# Nix user packages\n'
+    printf '%s\n' "${NIX_USER_PACKAGES[@]}"
+} > "$INCLUDE_DIR/usr/local/libexec/nix-packages.list"
+
+_SECRETS_SRC="${SECRETS_ENV:-$PROJECT_DIR/secrets.env}"
+if [[ -r "$_SECRETS_SRC" ]]; then
+    install -d -m 0755 "$INCLUDE_DIR/etc"
+    install -m 0600 "$_SECRETS_SRC" "$INCLUDE_DIR/etc/installer-secrets.env"
+    echo "    baked installer secrets from $_SECRETS_SRC"
+else
+    echo "    WARNING: no secrets.env found — installer will prompt at runtime"
+fi
+
+install -d -m 0755 "$INCLUDE_DIR/usr/share/applications"
+cat > "$INCLUDE_DIR/usr/share/applications/void-installer.desktop" <<'DESKEOF'
+[Desktop Entry]
+Version=1.0
+Type=Application
+Name=Install Void Linux
+Comment=Install Void Linux to this machine
+Exec=alacritty --title "Void Linux Installer" -e sudo /usr/local/bin/void-install
+Icon=system-software-install
+Terminal=false
+Categories=System;
+StartupNotify=true
+DESKEOF
+
+# 4) build Docker image (reuse the same image as Cinnamon build)
+echo ">>> building docker image $DOCKER_IMAGE"
+if "$DOCKER" buildx version >/dev/null 2>&1; then
+    "$DOCKER" build -t "$DOCKER_IMAGE" "$PROJECT_DIR/iso"
+else
+    DOCKER_BUILDKIT=0 "$DOCKER" build -t "$DOCKER_IMAGE" "$PROJECT_DIR/iso"
+fi
+
+# 5) packages + output filename
+ISO_PKGS=$(grep -vE '^\s*(#|$)' \
+    "$PROJECT_DIR/config/profiles/mainline-niri/packages.live-desktop.list" \
+    | tr '\n' ' ')
+TS="$(date -u +%Y%m%d)"
+OUT_ISO="${OUTPUT_ISO:-$OUT_DIR/void-live-niri-${TS}.iso}"
+
+# BOOT_CMDLINE notes (kernel audio, GPU, Bluetooth, etc.):
+# • NO forced audio kernel parameters: Removed snd-intel-dspcfg.dsp_driver=1 and snd_hda_intel.dmic_detect=0
+#   because they forced legacy HDA mode, blocking SOF/SoundWire on hardware that needs it (e.g., XPS 9700).
+#   The kernel auto-selects the correct driver (0=auto, 3=SOF, 4=AVS) based on hardware IDs.
+#   Users can override at boot with "snd-intel-dspcfg.dsp_driver=3" if needed.
+#   See docs/KERNEL7_AUDIO_XPS9700.md for diagnostics.
+# • nvidia-drm.modeset=1: Required for nvidia GPU to use atomic mode-setting on Wayland (Niri).
+# • blacklist nouveau: nvidia GPU needs proprietary driver, not nouveau.
+# • btusb.enable_autosuspend=0: Prevent Bluetooth headset dropouts when idle.
+BOOT_CMDLINE="${BOOT_CMDLINE:-live.user=${LIVE_USER} console=tty0 console=ttyS0,115200 nvidia-drm.modeset=1 rd.driver.blacklist=nouveau modprobe.blacklist=nouveau btusb.enable_autosuspend=0}"
+
+echo ">>> running mklive.sh inside docker — output: $OUT_ISO"
+"$DOCKER" run --rm --privileged \
+    -v "$PROJECT_DIR:/work:rw" \
+    -v "$CACHE_DIR:/cache:rw" \
+    -e ARCH="${ARCH:-x86_64}" \
+    -e REPO_URL="${REPO_URL:-https://repo-default.voidlinux.org/current}" \
+    -e KEYMAP="${KEYMAP:-us}" \
+    -e LOCALE="${LOCALE:-en_US.UTF-8}" \
+    -e ISO_PKGS="$ISO_PKGS" \
+    -e ISO_TITLE="Void Live (niri / noctalia-shell)" \
+    -e OUT_ISO_REL="${OUT_ISO#$PROJECT_DIR/}" \
+    -e BOOT_CMDLINE="${BOOT_CMDLINE:-}" \
+    -e INCLUDE_DIR_REL="${INCLUDE_DIR#$PROJECT_DIR/}" \
+    -e NIX_PACKAGES_PREBAKE="${NIX_USER_PACKAGES[*]}" \
+    -e HOST_UID="$(id -u)" \
+    -e HOST_GID="$(id -g)" \
+    "$DOCKER_IMAGE" \
+    bash /work/iso/_inner-build-niri-live.sh
+
+echo
+echo ">>> Niri live ISO built: $OUT_ISO"
+sha256sum "$OUT_ISO" | tee "${OUT_ISO}.sha256" || true

iso/patches/0003-dual-kernel-simplified-menu.patch

@@ -0,0 +1,161 @@
+--- a/mklive.sh	2026-04-25 21:08:53.137743383 +0200
++++ b/mklive.sh	2026-04-25 21:25:02.321939679 +0200
+@@ -211,7 +211,7 @@
+ copy_include_directories() {
+     for includedir in "${INCLUDE_DIRS[@]}"; do
+         info_msg "=> copying include directory '$includedir' ..."
+-        find "$includedir" -mindepth 1 -maxdepth 1 -exec cp -rfpPv {} "$ROOTFS"/ \;
++        rsync -aHX "$includedir"/ "$ROOTFS"/
+     done
+ }
+ 
+@@ -229,6 +229,41 @@
+ 		i686*|x86_64*) cp "$ROOTFS/boot/vmlinuz-$KERNELVERSION" "$BOOT_DIR"/vmlinuz ;;
+ 		aarch64*) cp "$ROOTFS/boot/vmlinux-$KERNELVERSION" "$BOOT_DIR"/vmlinux ;;
+ 	esac
++
++    # Generate boot files for secondary kernels installed alongside KERNELVERSION.
++    SECONDARY_BOOT_KERNELS=()
++    for _kdir in "$ROOTFS/usr/lib/modules"/*/; do
++        [[ -d "${_kdir}/kernel" ]] || continue
++        # Strip trailing slash before extracting basename (glob */ appends /)
++        _kver="${_kdir%/}"; _kver="${_kver##*/}"
++        [[ "$_kver" == "$KERNELVERSION" ]] && continue
++        info_msg "Secondary kernel ${_kver}: generating live initramfs..."
++        chroot "$ROOTFS" env -i /usr/bin/dracut -N --"${INITRAMFS_COMPRESSION}" \
++            --add-drivers "ahci" --force-add "vmklive autoinstaller" --omit systemd \
++            "/boot/initrd-${_kver}" "${_kver}" || {
++            echo "WARNING: dracut failed for secondary kernel ${_kver} — skipping"
++            continue
++        }
++        mv "$ROOTFS/boot/initrd-${_kver}" "$BOOT_DIR/initrd-${_kver}"
++        case "$TARGET_ARCH" in
++            i686*|x86_64*)
++                if [[ -f "$ROOTFS/boot/vmlinuz-${_kver}" ]]; then
++                    cp "$ROOTFS/boot/vmlinuz-${_kver}" "$BOOT_DIR/vmlinuz-${_kver}"
++                else
++                    echo "WARNING: vmlinuz-${_kver} not found — skipping secondary kernel"
++                    rm -f "$BOOT_DIR/initrd-${_kver}"; continue
++                fi ;;
++            aarch64*)
++                if [[ -f "$ROOTFS/boot/vmlinux-${_kver}" ]]; then
++                    cp "$ROOTFS/boot/vmlinux-${_kver}" "$BOOT_DIR/vmlinux-${_kver}"
++                else
++                    echo "WARNING: vmlinux-${_kver} not found — skipping secondary kernel"
++                    rm -f "$BOOT_DIR/initrd-${_kver}"; continue
++                fi ;;
++        esac
++        SECONDARY_BOOT_KERNELS+=("${_kver}")
++        info_msg "Secondary kernel ${_kver}: boot files staged"
++    done
+ }
+ 
+ array_contains() {
+@@ -273,6 +308,17 @@
+         -e "s|@@BOOT_CMDLINE@@|${BOOT_CMDLINE}|" \
+         "$ISOLINUX_DIR"/isolinux.cfg
+ 
++    # Append entries for secondary kernels (standard boot only).
++    for _skver in "${SECONDARY_BOOT_KERNELS[@]+"${SECONDARY_BOOT_KERNELS[@]}"}"; do
++        cat >> "$ISOLINUX_DIR"/isolinux.cfg << SEOF
++
++LABEL linux-${_skver%%_*}
++MENU LABEL ${BOOT_TITLE} ${_skver} ${TARGET_ARCH}
++KERNEL /boot/vmlinuz-${_skver}
++APPEND initrd=/boot/initrd-${_skver} root=live:CDLABEL=VOID_LIVE init=/sbin/init ro rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 vconsole.unicode=1 vconsole.keymap=${KEYMAP} locale.LANG=${LOCALE} ${BOOT_CMDLINE}
++SEOF
++    done
++
+     # include memtest86+
+     if [ -e "$VOIDTARGETDIR"/boot/memtest86+/memtest.bin ]; then
+         cp "$VOIDTARGETDIR"/boot/memtest86+/memtest.bin "$BOOT_DIR"
+@@ -290,15 +336,16 @@
+     esac
+ 
+     write_entry() {
+-        local entrytitle="$1" id="$2" cmdline="$3" dtb="$4" hotkey="$5"
++        local entrytitle="$1" id="$2" cmdline="$3" dtb="$4" hotkey="$5" \
++              kimg="${6:-${KERNEL_IMG}}" kidrd="${7:-initrd}"
+         cat << EOF >> "$GRUB_DIR"/grub_void.cfg
+ menuentry "${entrytitle}" --id "${id}" ${hotkey:+--hotkey $hotkey} {
+     set gfxpayload="keep"
+-    linux (\${voidlive})/boot/${KERNEL_IMG} \\
++    linux (\${voidlive})/boot/${kimg} \\
+         root=live:CDLABEL=VOID_LIVE ro init=/sbin/init \\
+         rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 gpt add_efi_memmap \\
+         vconsole.unicode=1 vconsole.keymap=${KEYMAP} locale.LANG=${LOCALE} ${cmdline}
+-    initrd (\${voidlive})/boot/initrd
++    initrd (\${voidlive})/boot/${kidrd}
+ EOF
+         if [ -n "${dtb}" ]; then
+             printf '    devicetree (${voidlive})/boot/dtbs/%s\n' "${dtb}" >> "$GRUB_DIR"/grub_void.cfg
+@@ -311,23 +358,25 @@
+ 
+         ENTRY_TITLE="${BOOT_TITLE} ${KERNELVERSION} ${title_sfx}(${TARGET_ARCH})"
+ 
++        # Standard boot only — failsafe/RAM/speech variants removed.
+         write_entry "${ENTRY_TITLE}" "linux${id_sfx}" \
+             "$BOOT_CMDLINE $cmdline" "$dtb"
+-        write_entry "${ENTRY_TITLE} (RAM)" "linuxram${id_sfx}" \
+-            "rd.live.ram $BOOT_CMDLINE $cmdline" "$dtb"
+-        write_entry "${ENTRY_TITLE} (graphics disabled)" "linuxnogfx${id_sfx}" \
+-            "nomodeset $BOOT_CMDLINE $cmdline" "$dtb"
+-        write_entry "${ENTRY_TITLE} with speech" "linuxa11y${id_sfx}" \
+-            "live.accessibility live.autologin $BOOT_CMDLINE $cmdline" "$dtb" 's'
+-        write_entry "${ENTRY_TITLE} with speech (RAM)" "linuxa11yram${id_sfx}" \
+-            "live.accessibility live.autologin rd.live.ram $BOOT_CMDLINE $cmdline" "$dtb" 'r'
+-        write_entry "${ENTRY_TITLE} with speech (graphics disabled)" "linuxa11ynogfx${id_sfx}" \
+-            "live.accessibility live.autologin nomodeset $BOOT_CMDLINE $cmdline" "$dtb" 'g'
+ 
+     }
+ 
+     write_entries
+ 
++    # Secondary kernel entries (standard boot only).
++    for _skver in "${SECONDARY_BOOT_KERNELS[@]+"${SECONDARY_BOOT_KERNELS[@]}"}";
++    do
++        case "$TARGET_ARCH" in
++            i686*|x86_64*) _skimg="vmlinuz-${_skver}" ;;
++            aarch64*)       _skimg="vmlinux-${_skver}" ;;
++        esac
++        write_entry "${BOOT_TITLE} ${_skver} (${TARGET_ARCH})" \
++            "linux-${_skver%%_*}" "$BOOT_CMDLINE" "" "" "${_skimg}" "initrd-${_skver}"
++    done
++
+     for platform in "${PLATFORMS[@]}"; do
+         (
+             . "platforms/${platform}.sh"
+--- a/isolinux/isolinux.cfg.in	2026-04-25 21:08:53.137743383 +0200
++++ b/isolinux/isolinux.cfg.in	2026-04-25 21:13:05.897818309 +0200
+@@ -25,31 +25,6 @@
+ KERNEL /boot/vmlinuz
+ APPEND initrd=/boot/initrd root=live:CDLABEL=VOID_LIVE init=/sbin/init ro rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 vconsole.unicode=1 vconsole.keymap=@@KEYMAP@@ locale.LANG=@@LOCALE@@ @@BOOT_CMDLINE@@
+ 
+-LABEL linuxram
+-MENU LABEL @@BOOT_TITLE@@ @@KERNVER@@ @@ARCH@@ (RAM)
+-KERNEL /boot/vmlinuz
+-APPEND initrd=/boot/initrd root=live:CDLABEL=VOID_LIVE init=/sbin/init ro rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 vconsole.unicode=1 vconsole.keymap=@@KEYMAP@@ locale.LANG=@@LOCALE@@ @@BOOT_CMDLINE@@ rd.live.ram
+-
+-LABEL linuxnogfx
+-MENU LABEL @@BOOT_TITLE@@ @@KERNVER@@ @@ARCH@@ (graphics disabled)
+-KERNEL /boot/vmlinuz
+-APPEND initrd=/boot/initrd root=live:CDLABEL=VOID_LIVE init=/sbin/init ro rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 vconsole.unicode=1 vconsole.keymap=@@KEYMAP@@ locale.LANG=@@LOCALE@@ @@BOOT_CMDLINE@@ nomodeset
+-
+-LABEL linuxa11y
+-MENU LABEL @@BOOT_TITLE@@ @@KERNVER@@ @@ARCH@@ with ^speech
+-KERNEL /boot/vmlinuz
+-APPEND initrd=/boot/initrd root=live:CDLABEL=VOID_LIVE init=/sbin/init ro rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 vconsole.unicode=1 vconsole.keymap=@@KEYMAP@@ locale.LANG=@@LOCALE@@ @@BOOT_CMDLINE@@ live.accessibility live.autologin
+-
+-LABEL linuxa11yram
+-MENU LABEL @@BOOT_TITLE@@ @@KERNVER@@ @@ARCH@@ with speech (^RAM)
+-KERNEL /boot/vmlinuz
+-APPEND initrd=/boot/initrd root=live:CDLABEL=VOID_LIVE init=/sbin/init ro rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 vconsole.unicode=1 vconsole.keymap=@@KEYMAP@@ locale.LANG=@@LOCALE@@ @@BOOT_CMDLINE@@ live.accessibility live.autologin rd.live.ram
+-
+-LABEL linuxa11ynogfx
+-MENU LABEL @@BOOT_TITLE@@ @@KERNVER@@ @@ARCH@@ with speech (^graphics disabled)
+-KERNEL /boot/vmlinuz
+-APPEND initrd=/boot/initrd root=live:CDLABEL=VOID_LIVE init=/sbin/init ro rd.luks=0 rd.md=0 rd.dm=0 loglevel=4 vconsole.unicode=1 vconsole.keymap=@@KEYMAP@@ locale.LANG=@@LOCALE@@ @@BOOT_CMDLINE@@ live.accessibility live.autologin nomodeset
+-
+ LABEL c
+ MENU LABEL Boot first HD found by BIOS
+ COM32 chain.c32

iso/postsetup-nvidia.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+# void-mklive postsetup hook (-x flag).
+#
+# Runs AFTER copy_include_directories (overlay applied) but BEFORE
+# generate_initramfs (boot initramfs).  The xbps initramfs-regenerate trigger
+# fires during install_packages — BEFORE the overlay — so the squashfs rootfs's
+# own /boot/initramfs-KVER.img is missing our etc/dracut.conf.d/10-nvidia.conf.
+#
+# This script re-runs dracut inside the rootfs chroot for every installed kernel
+# so the squashfs initramfs:
+#   • includes nvidia.ko (add_drivers from 10-nvidia.conf)
+#   • excludes nouveau.ko (omit_drivers from 10-nvidia.conf)
+#
+# $1 = absolute path to the rootfs directory being built.
+
+set -euo pipefail
+
+ROOTFS="$1"
+
+if [[ ! -d "$ROOTFS/usr/lib/modules" ]]; then
+    echo "[postsetup-nvidia] no modules dir — skipping"
+    exit 0
+fi
+
+if [[ ! -x "$ROOTFS/usr/bin/dracut" ]]; then
+    echo "[postsetup-nvidia] dracut not in rootfs — skipping"
+    exit 0
+fi
+
+if [[ ! -f "$ROOTFS/etc/dracut.conf.d/10-nvidia.conf" ]]; then
+    echo "[postsetup-nvidia] WARNING: 10-nvidia.conf not found in rootfs overlay — skipping"
+    exit 0
+fi
+
+# Mount pseudo-filesystems needed by dracut inside the chroot.
+_umount_pseudo() {
+    for f in dev proc sys; do
+        [[ -d "$ROOTFS/$f" ]] && \
+            { umount -R -f "$ROOTFS/$f" 2>/dev/null || umount -R -l "$ROOTFS/$f" 2>/dev/null || true; }
+    done
+}
+trap _umount_pseudo EXIT
+
+for f in dev proc sys; do
+    mkdir -p "$ROOTFS/$f"
+    mount --rbind "/$f" "$ROOTFS/$f"
+done
+
+echo "[postsetup-nvidia] regenerating initramfs with nvidia config"
+echo "[postsetup-nvidia] 10-nvidia.conf:"
+sed 's/^/    /' "$ROOTFS/etc/dracut.conf.d/10-nvidia.conf"
+
+found=0
+for kdir in "$ROOTFS/usr/lib/modules"/*/; do
+    [[ -d "${kdir}/kernel" ]] || continue
+    # Strip trailing slash before extracting basename (glob */ appends /)
+    kver="${kdir%/}"; kver="${kver##*/}"
+    found=1
+
+    # Verify nvidia.ko is present for this kernel version.
+    nv_ko=$(find "$ROOTFS/usr/lib/modules/$kver" -name 'nvidia.ko' -o -name 'nvidia.ko.zst' 2>/dev/null | head -1)
+    if [[ -z "$nv_ko" ]]; then
+        echo "[postsetup-nvidia] WARNING: nvidia.ko not found for kernel $kver — initramfs regeneration skipped"
+        continue
+    fi
+    echo "[postsetup-nvidia] kernel $kver: nvidia.ko at ${nv_ko#"$ROOTFS"}"
+
+    echo "[postsetup-nvidia] running dracut --force for $kver ..."
+    chroot "$ROOTFS" env -i PATH=/usr/sbin:/usr/bin:/sbin:/bin \
+        /usr/bin/dracut --force \
+        "/boot/initramfs-${kver}.img" \
+        "$kver" 2>&1 | grep -v '^$' | tail -5 || {
+        echo "[postsetup-nvidia] WARNING: dracut failed for $kver — continuing"
+        continue
+    }
+
+    sz=$(ls -lh "$ROOTFS/boot/initramfs-${kver}.img" 2>/dev/null | awk '{print $5}')
+    echo "[postsetup-nvidia] done: /boot/initramfs-${kver}.img ($sz)"
+done
+
+[[ "$found" -eq 1 ]] || echo "[postsetup-nvidia] WARNING: no kernels found in rootfs"
+echo "[postsetup-nvidia] complete"

tests/debug-qemu.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Like interactive-qemu.sh but logs serial console to /tmp/qemu-serial.log
+# for post-boot log inspection. Uses the niri ISO by default.
+set -Eeuo pipefail
+PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUT_DIR="$PROJECT_DIR/out"
+ISO="${ISO:-$(ls -t "$OUT_DIR"/void-live-niri-*.iso 2>/dev/null | head -1 || true)}"
+DISK="${DISK:-$OUT_DIR/test-disk.img}"
+RAM_MB="${RAM_MB:-6144}"
+SMP="${SMP:-4}"
+
+OVMF_CODE="${OVMF_CODE:-/usr/share/OVMF/OVMF_CODE.fd}"
+OVMF_VARS_TPL="${OVMF_VARS_TPL:-/usr/share/OVMF/OVMF_VARS.fd}"
+[[ -r "$OVMF_CODE" ]] || { echo "no OVMF — install ovmf"; exit 1; }
+[[ -r "$ISO" ]] || { echo "no ISO at $ISO"; exit 1; }
+
+if [[ ! -f "$DISK" ]]; then
+    "$PROJECT_DIR/tests/make-test-disk.sh" "$DISK"
+fi
+VARS="$OUT_DIR/OVMF_VARS.debug.fd"
+[[ -f "$VARS" ]] || cp "$OVMF_VARS_TPL" "$VARS"
+
+SERIAL_PORT="${SERIAL_PORT:-4444}"
+echo ">>> serial console → TCP port $SERIAL_PORT  (connect: socat -,raw,echo=0 TCP:127.0.0.1:$SERIAL_PORT)"
+echo ">>> ISO: $ISO"
+
+exec qemu-system-x86_64 \
+    -name void-niri-debug \
+    -machine q35,accel=kvm:tcg -cpu max \
+    -m "$RAM_MB" -smp "$SMP" \
+    -drive "if=pflash,format=raw,readonly=on,file=$OVMF_CODE" \
+    -drive "if=pflash,format=raw,file=$VARS" \
+    -drive "if=virtio,file=$DISK,format=raw,cache=none" \
+    -cdrom "$ISO" \
+    -boot menu=on \
+    -netdev user,id=n0,hostfwd=tcp:127.0.0.1:2222-:22 \
+    -device virtio-net-pci,netdev=n0 \
+    -serial "tcp::${SERIAL_PORT},server,nowait" \
+    -device virtio-gpu-gl -display gtk,gl=on

tests/launch-live-qemu.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+# Launch the live desktop ISO under QEMU for interactive testing.
+# Uses 12 GB RAM so nix packages (~4 GB) can install into the tmpfs overlay.
+#
+# Usage:
+#   bash tests/launch-live-qemu.sh                  # uses out/void-live-stable.iso
+#   ISO=out/my.iso bash tests/launch-live-qemu.sh
+#   RAM_MB=16384 bash tests/launch-live-qemu.sh     # override RAM
+
+set -Eeuo pipefail
+
+PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUT_DIR="$PROJECT_DIR/out"
+
+ISO="${ISO:-$(ls -t "$OUT_DIR"/void-live-stable*.iso 2>/dev/null | head -1 || true)}"
+[[ -r "$ISO" ]] || { echo "no ISO found — run 'make live' first"; exit 1; }
+
+RAM_MB="${RAM_MB:-12288}"   # 12 GB: Cinnamon ~2.5GB + nix store ~4GB + headroom
+SMP="${SMP:-4}"
+
+OVMF_CODE="${OVMF_CODE:-}"
+OVMF_VARS_TPL="${OVMF_VARS_TPL:-}"
+for c in /usr/share/OVMF/OVMF_CODE.fd /usr/share/edk2-ovmf/x64/OVMF_CODE.fd \
+         /usr/share/edk2/x64/OVMF_CODE.fd /usr/share/qemu/OVMF_CODE.fd; do
+    [[ -z "$OVMF_CODE" && -r "$c" ]] && OVMF_CODE="$c"
+done
+for v in /usr/share/OVMF/OVMF_VARS.fd /usr/share/edk2-ovmf/x64/OVMF_VARS.fd \
+         /usr/share/edk2/x64/OVMF_VARS.fd /usr/share/qemu/OVMF_VARS.fd; do
+    [[ -z "$OVMF_VARS_TPL" && -r "$v" ]] && OVMF_VARS_TPL="$v"
+done
+[[ -r "$OVMF_CODE"     ]] || { echo "OVMF_CODE not found — install ovmf"; exit 1; }
+[[ -r "$OVMF_VARS_TPL" ]] || { echo "OVMF_VARS not found — install ovmf"; exit 1; }
+
+VARS="$OUT_DIR/OVMF_VARS.live.fd"
+[[ -f "$VARS" ]] || cp "$OVMF_VARS_TPL" "$VARS"
+
+mkdir -p "$OUT_DIR"
+
+echo ">>> launching live ISO: $ISO"
+echo "    RAM: ${RAM_MB} MB  CPUs: $SMP"
+echo "    serial: $OUT_DIR/live-serial.sock"
+echo "    monitor: $OUT_DIR/qemu-monitor.sock"
+
+exec qemu-system-x86_64 \
+    -name void-live-test \
+    -machine q35,accel=kvm:tcg \
+    -cpu max \
+    -m "$RAM_MB" \
+    -smp "$SMP" \
+    -drive "if=pflash,format=raw,readonly=on,file=$OVMF_CODE" \
+    -drive "if=pflash,format=raw,file=$VARS" \
+    -cdrom "$ISO" \
+    -boot order=d,menu=off \
+    -netdev user,id=n0 \
+    -device virtio-net-pci,netdev=n0 \
+    -serial "unix:$OUT_DIR/live-serial.sock,server,nowait" \
+    -monitor "unix:$OUT_DIR/qemu-monitor.sock,server,nowait" \
+    -device virtio-vga \
+    -display gtk,gl=off