Merge branch 'dev' into main

Local verification checklists kept alongside the checkout; not configuration.

.gitignore

@@ -4,3 +4,5 @@ build/out/
 .direnv
 wifi-psk.txt
 *.qcow2
+VERIFY-DEV.md
+VERIFY-PROD.md

configuration.nix

@@ -1,15 +1,10 @@
 { config, pkgs, radiantwaveApp, upgradeFlakeRef, radiantwavePlymouth, ... }:
 
 let
+  # The published app is a store path with context (builtins.storePath in
+  # flake.nix), so Nix substitutes it from the channel's Attic cache and the
+  # system closure depends on it.
   radiantApp = radiantwaveApp;
-  # The published app arrives as a bare store-path string (from the channel
-  # manifest, see flake.nix). Wrap it in a derivation built with this system's
-  # pkgs so it can live in environment.systemPackages; the wrapper is a symlink
-  # farm and the real closure is substituted from the channel's Attic cache.
-  radiantAppPackage = pkgs.symlinkJoin {
-    name = "radiantwave-published";
-    paths = [ radiantApp ];
-  };
   # When the live-updater module is enabled, RadiantWave launches through the
   # mutable /var/lib/radiantwave/current
   # pointer so it can be swapped without a full nixos-rebuild. Otherwise it
@@ -40,7 +35,7 @@ in
   # Included packages
   environment.systemPackages = [
     pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite pkgs.wireplumber
-    radiantAppPackage
+    radiantApp
   ];
 
   # This populates the EFI partition and tells the NUC how to start NixOS.

flake.nix

@@ -67,8 +67,8 @@
       # not built or pinned by this repo; each channel's published manifest is
       # the single source of truth (see `publishedApp` below).
       channel = {
-        atticRepo = "radiantwave-dev";                                 # dev
+        atticRepo = "radiantwave";                                     # main
-        gitRef = "?ref=dev";                                           # dev
+        gitRef = "";                                                   # main
       };
 
       # Exposed so CI (see .gitea/workflows/build.yml) and humans can verify
@@ -93,11 +93,17 @@
           url = "${channelManifestDir}/${manifestFile}";
         }));
 
-      # The published closure as a plain store-path string. configuration.nix
+      # The published closure as a plain store-path string. Used for the
-      # wraps it in a symlinkJoin so it can live in environment.systemPackages
+      # updater's runtime baseline pointer (a plain string; the closure itself
-      # (a bare string there would be coerced with builtins.storePath, which
+      # is pulled in via publishedApp below).
-      # requires the closure to already be local at eval time).
+      publishedPath = manifestFile: (manifestFor manifestFile).storePath;
-      publishedApp = manifestFile: (manifestFor manifestFile).storePath;
+
+      # The published closure as a real store-path dependency.
+      # builtins.storePath makes the derivation depend on this exact path and
+      # substitute it from the channel's Attic cache (configured as a trusted
+      # substituter), so the app is never compiled from source. The closure
+      # itself is not fetched by this repository; RadiantWave CI publishes it.
+      publishedApp = manifestFile: builtins.storePath (publishedPath manifestFile);
 
       # Live app-update side channel. The manifest is served by the
       # fileserver; closures are fetched (never built) from the channel's
@@ -249,7 +255,7 @@
           diskModule = ./disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk";
           extraModules = [
-            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedApp "manifest.json"; })
+            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedPath "manifest.json"; })
           ];
         };
         radiantwavekiosk-commercial = mkKioskSystem {
@@ -258,7 +264,7 @@
           diskModule = ./commercial-disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-commercial";
           extraModules = [
-            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedApp "manifest.json"; })
+            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedPath "manifest.json"; })
           ];
         };
         # Rotated screen for android-style displays.
@@ -269,7 +275,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-android";
           extraModules = [
             ./rotated_display.nix
-            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedApp "manifest.json"; })
+            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = publishedPath "manifest.json"; })
           ];
         };
         # Raspberry Pi 5.
@@ -279,7 +285,7 @@
           extraModules = [
             (radiantwaveUpdaterModule {
               repo = channel.atticRepo;
-              baseline = publishedApp "aarch64-manifest.json";
+              baseline = publishedPath "aarch64-manifest.json";
               manifestFile = "aarch64-manifest.json";
             })
           ];