Fix audio: pin system volume to 100% before RadiantWave launches

configuration.nix

@@ -11,7 +11,7 @@ in
 
   # Included packages
   environment.systemPackages = [
-    pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite
+    pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite pkgs.wireplumber
     radiantApp
   ];
 
@@ -102,6 +102,9 @@ in
       export WLR_RENDERER=pixman
       export WLR_NO_HARDWARE_CURSORS=1
 
+      # Pin system audio to 100% and unmute before launching RadiantWave
+      ${pkgs.systemd}/bin/systemctl --user start radiantwave-audio-init.service || true
+
       exec dbus-run-session cage -- /run/current-system/sw/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
     fi
   '';
@@ -111,6 +114,30 @@ in
   ############################################################
 
   services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
+
+  # --- Pin system audio to 100% before RadiantWave launches ---
+  # User unit (PipeWire runs per-user in the kiosk session), owned by this
+  # system config. Ordered after PipeWire/WirePlumber; the retry loop covers
+  # default-sink readiness at boot. RadiantWave's loginShellInit waits on this
+  # before exec'ing cage.
+  systemd.user.services.radiantwave-audio-init = {
+    description = "Pin system audio volume to 100% and unmute";
+    after = [ "pipewire.service" "wireplumber.service" ];
+    wants = [ "pipewire.service" "wireplumber.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+    };
+    script = ''
+      for i in {1..30}; do
+        if ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 1.0 2>/dev/null; then
+          break
+        fi
+        sleep 1
+      done
+      ${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ 0 2>/dev/null || true
+    '';
+  };
+
   services.seatd.enable = true;
   services.openssh.enable = true;
   services.openssh.settings.PermitRootLogin = "prohibit-password";