ci: use the same single branch-aware build workflow as dev

Replace the four per-variant prod workflows (and the leftover dev workflow)
with the shared .gitea/workflows/build.yml. Main builds on new tags or manual
dispatch; dev pushes build the dev channel. Identical file on both branches.

.gitea/workflows/build-dev.yml

@@ -1,91 +0,0 @@
-name: Build Dev ISOs
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - dev
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave-dev
-    extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
-jobs:
-  build-dev-kiosk:
-    runs-on: orion-lxc
-    steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-      - name: Checkout dev branch
-        run: git checkout dev
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-      - name: Build dev kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
-      - name: Rename dev kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-kiosk-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-      - name: Copy dev kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-      - name: Cleanup
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-
-  build-dev-android:
-    runs-on: orion-lxc
-    steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-      - name: Checkout dev branch
-        run: git checkout dev
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-      - name: Build dev android ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
-      - name: Rename dev android ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-android-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-      - name: Copy dev android ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-      - name: Cleanup
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-
-  build-dev-commercial:
-    runs-on: orion-lxc
-    steps:
-      - name: Clone Repository
-        run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-      - name: Checkout dev branch
-        run: git checkout dev
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-      - name: Build dev commercial ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
-      - name: Rename dev commercial ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-commercial-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-      - name: Copy dev commercial ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-      - name: Cleanup
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"

.gitea/workflows/build-prod-android.yml

@@ -1,42 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
-
-jobs:
-  build-android:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build android kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.android-iso.config.system.build.isoImage
-
-      - name: Rename android kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-android-iso-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "ANDROID_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy android kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup android kiosk ISO
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}"

.gitea/workflows/build-prod-commercial.yml

@@ -1,42 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
-
-jobs:
-  build-commercial:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build commercial kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.commercial-iso.config.system.build.isoImage
-
-      - name: Rename commercial kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-commercial-iso-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "COMMERCIAL_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy commercial kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup commercial kiosk ISO
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}"

.gitea/workflows/build-prod-kiosk.yml

@@ -1,42 +0,0 @@
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA=
-
-jobs:
-  build-kiosk:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build kiosk ISO
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.kiosk-iso.config.system.build.isoImage
-
-      - name: Rename kiosk ISO
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-home-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy kiosk ISO to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup kiosk ISO
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}"

.gitea/workflows/build-prod-rpi.yml

@@ -1,39 +0,0 @@
-on:
-  workflow_dispatch:
-
-env:
-  NIX_CONFIG: |
-    extra-substituters = https://attic.radiantwavetech.com/radiantwave https://nixos-raspberrypi.cachix.org
-    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
-
-jobs:
-  build-rpi:
-    runs-on: orion-lxc
-
-    steps:
-      - name: Checkout
-        run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
-
-      - name: Prepare output directory
-        run: mkdir -p /var/lib/gitea-runner/radiantwave
-
-      - name: Build Raspberry Pi image
-        run: |
-          export NIXPKGS_ALLOW_UNFREE=1
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix build -L --impure .#nixosConfigurations.radiantwavekiosk-rpi.config.system.build.sdImage
-
-      - name: Rename Raspberry Pi image
-        run: |
-          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
-          FILENAME="radiantwave-rpi-${ISO_DATE}.img.zst"
-          cp -L result/sd-image/*.img.zst "/var/lib/gitea-runner/radiantwave/${FILENAME}"
-          echo "RPI_IMAGE_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
-
-      - name: Copy Raspberry Pi image to fileserver
-        run: |
-          scp "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}" \
-            157.245.124.103:/mnt/infrastructure_data/files/images/
-
-      - name: Cleanup Raspberry Pi image
-        run: rm -f "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}"

.gitea/workflows/build.yml

@@ -0,0 +1,150 @@
+# One build workflow for every branch — do not add per-branch copies.
+#
+# The branch/ref selects the channel, nothing else does: the flake's `channel`
+# block picks the app input, Attic repo, and upgrade ref, so the same config
+# names build dev images on `dev` and prod images on `main`. This file itself
+# is identical on both branches.
+#
+# Trigger model:
+#   * push to `dev`   -> build every development image
+#   * new git tag     -> build every production image (tags live on main)
+#   * manual dispatch -> build the channel of the selected branch
+#
+# Hardware variants come from an include-matrix:
+#   ISO variants  -> .config.system.build.isoImage (storeContents pulls in the closure)
+#   Raspberry Pi  -> .config.system.build.sdImage
+# `orion-lxc` emulates aarch64-linux, so the Pi build runs alongside the rest.
+name: Build Kiosk Images
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev
+    tags:
+      - "*"
+
+env:
+  # Both channel caches plus the Raspberry Pi cachix, so a build can substitute
+  # from whichever channel the checked-out ref selects.
+  NIX_CONFIG: |
+    extra-substituters = https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev https://nixos-raspberrypi.cachix.org
+    extra-trusted-public-keys = radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=
+
+jobs:
+  build:
+    name: ${{ matrix.label }}
+    runs-on: orion-lxc
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: kiosk
+            system: kiosk-iso
+            target: isoImage
+            outdir: iso
+            ext: iso
+            arch: x86_64-linux
+            manifest: manifest.json
+          - label: commercial
+            system: commercial-iso
+            target: isoImage
+            outdir: iso
+            ext: iso
+            arch: x86_64-linux
+            manifest: manifest.json
+          - label: android
+            system: android-iso
+            target: isoImage
+            outdir: iso
+            ext: iso
+            arch: x86_64-linux
+            manifest: manifest.json
+          - label: rpi
+            system: radiantwavekiosk-rpi
+            target: sdImage
+            outdir: sd-image
+            ext: img.zst
+            arch: aarch64-linux
+            manifest: aarch64-manifest.json
+
+    steps:
+      - name: Clone repository
+        run: |
+          rm -rf ./* ./.[!.]* 2>/dev/null || true
+          ref="${GITHUB_REF#refs/heads/}"
+          ref="${ref#refs/tags/}"
+          git clone --depth 1 --branch "$ref" \
+            ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
+          git log --oneline -1
+
+      - name: Determine channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          CHANNEL=$(nix eval --impure --raw .#channelName)
+          if [ "$CHANNEL" = "radiantwave" ]; then LABEL=prod; else LABEL=dev; fi
+          echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
+          echo "CHANNEL_LABEL=$LABEL" >> "$GITHUB_ENV"
+          echo "Building the '$CHANNEL' channel ($LABEL)"
+
+      # Production only: fail fast unless the baked closure is exactly what
+      # RadiantWave CI published to Attic. The dev channel churns on every
+      # dispatch, so this is skipped there.
+      - name: Verify baked baseline matches the published channel
+        run: |
+          set -euo pipefail
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+
+          if [ "$CHANNEL" != "radiantwave" ]; then
+            echo "channel '$CHANNEL' is not production; skipping baseline preflight"
+            exit 0
+          fi
+
+          VERSION=$(nix eval --impure --raw .#channelVersion)
+          ATTIC=$(nix eval --impure --raw .#channelAtticUrl)
+          MANIFEST_URL="$(nix eval --impure --raw .#channelManifestDir)/${{ matrix.manifest }}"
+          BASELINE=$(nix eval --impure --raw .#baselineOutPaths.${{ matrix.arch }})
+
+          MANIFEST=$(curl -fsSL "$MANIFEST_URL")
+          PUB_VERSION=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).version')
+          PUB_PATH=$(MANIFEST="$MANIFEST" nix eval --impure --raw --expr '(builtins.fromJSON (builtins.getEnv "MANIFEST")).storePath')
+
+          echo "channel version : $VERSION"
+          echo "manifest version: $PUB_VERSION"
+          echo "baseline path   : $BASELINE"
+          echo "manifest path   : $PUB_PATH"
+
+          if [ "$VERSION" != "$PUB_VERSION" ]; then
+            echo "ERROR: channel.appVersion '$VERSION' != published manifest version '$PUB_VERSION'."
+            exit 1
+          fi
+          if [ "$BASELINE" != "$PUB_PATH" ]; then
+            echo "ERROR: baseline '$BASELINE' is not the published closure '$PUB_PATH'."
+            echo "       Run 'nix flake update radiantwave' so the pinned input resolves to the released commit."
+            exit 1
+          fi
+          HASH=$(basename "$BASELINE" | cut -d- -f1)
+          if ! curl -fsS -o /dev/null "$ATTIC/${HASH}.narinfo"; then
+            echo "ERROR: $BASELINE is not in $ATTIC; the image would compile RadiantWave from source."
+            exit 1
+          fi
+
+      - name: Prepare output directory
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
+
+      - name: Build ${{ matrix.label }}
+        run: |
+          export NIXPKGS_ALLOW_UNFREE=1
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          nix build -L --impure \
+            ".#nixosConfigurations.${{ matrix.system }}.config.system.build.${{ matrix.target }}"
+
+      - name: Publish ${{ matrix.label }}
+        run: |
+          ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
+          FILENAME="radiantwave-${{ matrix.label }}-${CHANNEL_LABEL}-${ISO_DATE}.${{ matrix.ext }}"
+          cp -L result/${{ matrix.outdir }}/*.${{ matrix.ext }} \
+            "/var/lib/gitea-runner/radiantwave/${FILENAME}"
+          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
+          rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"

AGENTS.md

@@ -10,10 +10,14 @@ Hosted on Gitea: `https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig`
 
 Two branches — `main` (prod) and `dev`. There are **no `-dev` configs**: each hardware target has exactly one config, and the branch selects its channel via the single `channel` block at the top of `flake.nix`:
 
-- `main`: `channel.appInput = radiantwave` (main), `atticRepo = "radiantwave"`, `gitRef = ""` (default branch).
-- `dev`: `channel.appInput = radiantwave-dev`, `atticRepo = "radiantwave-dev"`, `gitRef = "?ref=dev"`.
+- `main`: `channel.appInput = radiantwave` (pinned to tag `1.8`), `atticRepo = "radiantwave"`, `gitRef = ""` (default branch), `appVersion = "1.8"`.
+- `dev`: `channel.appInput = radiantwave-dev`, `atticRepo = "radiantwave-dev"`, `gitRef = "?ref=dev"`, `appVersion = <dev fingerprint>`.
 
-Everything downstream (the configs, ISOs, updater module, autoUpgrade refs) reads from `channel`, so a `dev`→`main` merge carries your changes automatically — no copying between sibling configs. To flip a channel, change only those three `channel` values. When merging, reconcile just this one block.
+Everything downstream (the configs, ISOs, updater module, autoUpgrade refs) reads from `channel`, so a `dev`→`main` merge carries your changes automatically — no copying between sibling configs. To flip a channel, change only those four `channel` values. When merging, reconcile just this one block.
+
+`channel.appVersion` is applied to the baked app via `appPackage = system: channel.appInput.packages.${system}.default.override { version = channel.appVersion; }`. RadiantWave's own flake only injects its version from the ambient `APP_VERSION` env var on impure evals, so pure evals (local `nix build`, `build-rpi.sh`) fall back to `0.1.0`. Declaring the version here keeps local and CI builds correct without `--impure`. Bump `appVersion` whenever the pinned input changes (release tag on `main`, short commit hash on `dev`).
+
+The baked baseline must be **byte-identical to the closure RadiantWave CI publishes to Attic** — that is what lets the ISO/`sdImage` substitute RadiantWave instead of compiling it from source, and makes the first live update a no-op. The prod workflows assert this in "Verify baked baseline matches the published channel": it compares `channelVersion` to the manifest's `version`, `baselineOutPaths.<system>` to the manifest's `storePath`, and confirms that store path exists in the channel's Attic cache. If it fails, the usual cause is a **moved release tag**: `radiantwave` is pinned by tag ref in `flake.lock`, so re-tagging `1.8` (as happened when it moved from `34c72b5` to `a5a6b5b`) leaves the lock on the old commit until you run `nix flake update radiantwave`. The RadiantWave flake also includes `.gitea/` in the app source, so its CI workflow changes alter the derivation hash.
 
 Both gitea repos are public: all git access is plain HTTPS (`git+https://...`), no SSH keys or access tokens on the kiosks. Don't reintroduce `git+ssh` URLs in flake/upgrade refs.
 
@@ -42,10 +46,10 @@ One config per hardware target. Dev/prod is the branch, not the config — see `
 
 | Name | Target hardware | Disk device | App input |
 |---|---|---|---|
-| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | `radiantwave` (main) |
-| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | `radiantwave` (main) |
-| `radiantwavekiosk-android` | Intel NUC 14, rotated display | `/dev/nvme0n1` | `radiantwave` (main) |
-| `radiantwavekiosk-rpi` | Raspberry Pi 5 (SD image) | — | `radiantwave` (main) |
+| `radiantwavekiosk` | Intel NUC 14 (NVMe) | `/dev/nvme0n1` | `radiantwave` (tag 1.8) |
+| `radiantwavekiosk-commercial` | Commercial HW (SATA) | `/dev/sda` | `radiantwave` (tag 1.8) |
+| `radiantwavekiosk-android` | Intel NUC 14, rotated display | `/dev/nvme0n1` | `radiantwave` (tag 1.8) |
+| `radiantwavekiosk-rpi` | Raspberry Pi 5 (SD image) | — | `radiantwave` (tag 1.8) |
 
 On the `dev` branch, the same four configs use `radiantwave-dev` and track `?ref=dev`.
 
@@ -86,18 +90,19 @@ Regenerate when major hardware changes, not on a schedule — reports are snapsh
 
 ## CI (Gitea)
 
-`.gitea/workflows/build-*.yml` — all triggered by `workflow_dispatch` on the `build-server` runner. They only **build and publish** what is committed. `flake.lock` is updated manually: commit an updated lock (e.g. after `nix flake update radiantwave-dev`) and dispatching the workflow is the release trigger.
+`.gitea/workflows/build-*.yml` — all triggered by `workflow_dispatch` on the `build-server` runner. They only **build and publish** what is committed. `flake.lock` is updated manually: commit an updated lock (e.g. after `nix flake update radiantwave-dev`) and dispatching the workflow is the release trigger. The prod workflows run a "Verify baked baseline matches the published channel" preflight that fails the build if the baked closure diverges from the channel manifest or is missing from Attic (see the `channel` block and `baselineOutPaths` in `flake.nix`).
 
 ## Important gotchas
 
 - **Disk device differs by variant**: `disk-config.nix` uses `/dev/nvme0n1`, `commercial-disk-config.nix` uses `/dev/sda`. `mkIso` pairs each ISO with the correct layout automatically — keep new ISOs paired correctly.
 - **Changing a config name** requires updating that config's `upgradeFlakeRef` in `flake.nix` (it embeds the name).
-- **The `channel` block is the dev/prod toggle** in `flake.nix` — `appInput`, `atticRepo`, `gitRef`. When merging `dev`→`main`, keep this block's values for the target branch; only this block differs between branches.
+- **The `channel` block is the dev/prod toggle** in `flake.nix` — `appInput`, `atticRepo`, `gitRef`, `appVersion`. When merging `dev`→`main`, keep this block's values for the target branch; only this block differs between branches.
 - **`rotated_display.nix` uses `mkForce`** on `loginShellInit` — it replaces the entire kiosk startup script from `configuration.nix`; don't edit both.
 - **Auto-update**: `system.autoUpgrade` runs every 10 min (`*:00/10`) with `--refresh`, operation `switch`, no auto-reboot. A `radiantwave-backup` rsync runs before each attempt. The health-check/rollback service is written but commented out in `configuration.nix`.
+- **Live app updater**: each config's `radiantwaveUpdaterModule` points at a per-arch manifest — x86 uses `<repo>/manifest.json`, RPi uses `<repo>/aarch64-manifest.json` (via the `manifestFile` arg). A 2-min timer polls it and fetches the announced closure from the channel's Attic repo. RPi live updates require RadiantWave CI to publish both an aarch64 closure and `aarch64-manifest.json`; until then the RPi stays on the baked baseline.
 - **No binary cache**: kiosks fetch from cache.nixos.org only and compile RadiantWave itself from source during upgrades. Attic integration was planned (see `PLAN-update-system.md`) but never wired; the old netrc/JWT setup has been removed.
 - **Secrets**: none in-tree anymore (gitea repos are public). If either repo goes private, re-add auth via `nix.settings.access-tokens` in `configuration.nix`.
-- **Flake inputs**: `radiantwave` tracks main, `radiantwave-dev` tracks `?ref=dev`. The `channel` block picks which one the configs consume. Updating them independently is intentional.
+- **Flake inputs**: `radiantwave` is pinned to tag `1.8` (`?ref=refs/tags/1.8`); `radiantwave-dev` tracks `?ref=dev`. The `channel` block picks which one the configs consume. Bump the pinned tag and `channel.appVersion` together. **Tag refs are live**: if RadiantWave force-moves a tag, the lock keeps the old commit until `nix flake update radiantwave`, so the baked baseline silently diverges from the published channel (the CI preflight catches this).
 - **SSH keys on machines are inbound-only** (`authorizedKeys` for admin access); outbound git is HTTPS. The root key in `zero-touch-installer.nix` must stay in sync with `myKey` in `configuration.nix`.
 
 ## File map

configuration.nix

@@ -1,7 +1,7 @@
-{ config, pkgs, radiantwave, upgradeFlakeRef, radiantwavePlymouth, ... }:
+{ config, pkgs, radiantwaveApp, upgradeFlakeRef, radiantwavePlymouth, ... }:
 
 let
-  radiantApp = radiantwave.packages.${pkgs.system}.default;
+  radiantApp = radiantwaveApp;
   # When the live-updater module is enabled, RadiantWave launches through the
   # mutable /var/lib/radiantwave/current
   # pointer so it can be swapped without a full nixos-rebuild. Otherwise it

flake.lock

@@ -220,16 +220,16 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1787675420,
-        "narHash": "sha256-2Hq9IcgdDXQc2uQ4yC/5NZVjcZaFCcVS78vj+ee+y/Q=",
-        "ref": "main",
-        "rev": "43cd93bbd7dde69c55c00a28c1691e1a192eda39",
-        "revCount": 47,
+        "lastModified": 1791050336,
+        "narHash": "sha256-sb/cDFS55qodbU6GEydhyRyW8VBTGg110ejSXVNd2OY=",
+        "ref": "refs/tags/1.8",
+        "rev": "a5a6b5bef07fffb5ec9597e577e6fb8a4b2a0108",
+        "revCount": 87,
         "type": "git",
         "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
       },
       "original": {
-        "ref": "main",
+        "ref": "refs/tags/1.8",
         "type": "git",
         "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
       }

flake.nix

@@ -4,7 +4,7 @@
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "nixpkgs";
     nixos-facter-modules.url = "github:numtide/nixos-facter-modules";
-    radiantwave.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=main";
+    radiantwave.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=refs/tags/1.8";
     radiantwave-dev.url = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git?ref=dev";
     nixos-raspberrypi.url = "github:nvmd/nixos-raspberrypi/main";
   };
@@ -62,28 +62,64 @@
       # this channel, so a `dev`-to-`main` merge carries your changes with it
       # automatically. There are no more `-dev` sibling configs to copy.
       #
-      #   main: appInput = radiantwave (main), atticRepo = "radiantwave",
-      #         gitRef = "" (default branch)
-      #   dev:  appInput = radiantwave-dev,   atticRepo = "radiantwave-dev",
-      #         gitRef = "?ref=dev"
+      #   main: appInput = radiantwave (tag 1.8), atticRepo = "radiantwave",
+      #         gitRef = "", appVersion = "1.8"
+      #   dev:  appInput = radiantwave-dev,       atticRepo = "radiantwave-dev",
+      #         gitRef = "?ref=dev", appVersion = <dev fingerprint>
       #
-      # To flip branches, change ONLY these three values (then push/merge).
+      # To flip branches, change ONLY these four values (then push/merge).
       channel = {
-        appInput = radiantwave-dev;                                    # dev
-        atticRepo = "radiantwave-dev";                                 # dev
-        gitRef = "?ref=dev";                                           # dev
+        appInput = radiantwave;                                        # main
+        atticRepo = "radiantwave";                                     # main
+        gitRef = "";                                                   # main
+        appVersion = "1.8";                                            # main
+      };
+
+      # Exposed so CI (see .gitea/workflows/build-prod-*.yml) and humans can
+      # verify which channel this checkout resolves to. On `main` this must be
+      # "radiantwave"; on `dev` it must be "radiantwave-dev". The prod
+      # workflows fail fast if this isn't the production channel, so a merge
+      # that brings a dev-pointing channel block into `main` breaks the build
+      # instead of silently shipping dev builds as prod ISOs.
+      channelName = if channel.appInput == radiantwave then "radiantwave" else "radiantwave-dev";
+
+      # Channel metadata exposed for CI preflight (see .gitea/workflows/build-*).
+      # `channelVersion` must equal the version RadiantWave CI publishes in the
+      # channel manifest; `baselineOutPaths` must equal the manifest's
+      # `storePath`. When they do, the ISO bakes exactly the closure already in
+      # Attic, so the app is substituted (never compiled locally) and the first
+      # live update is a no-op. A mismatch means either the pinned input is
+      # stale (as when the release tag moves) or channel.appVersion drifted.
+      channelVersion = channel.appVersion;
+      channelAtticUrl = "https://attic.radiantwavetech.com/${channel.atticRepo}";
+      channelManifestDir = "https://files.radiantwavetech.com/${channel.atticRepo}";
+      baselineOutPaths = {
+        x86_64-linux = (appPackage "x86_64-linux").outPath;
+        aarch64-linux = (appPackage "aarch64-linux").outPath;
+      };
+
+      # The App package, pinned to the channel's declared version. RadiantWave's
+      # own flake only injects its version from the ambient APP_VERSION env var
+      # on impure evals; pure evals (local `nix build`, build-rpi.sh) fall back
+      # to its 0.1.0 default. Overriding the version here makes the baked
+      # baseline correct regardless of eval purity, and matches the Attic
+      # closure when RadiantWave CI built it with the same version string.
+      appPackage = system: channel.appInput.packages.${system}.default.override {
+        version = channel.appVersion;
       };
 
       # Live app-update side channel. The manifest is served by the
       # fileserver; closures are fetched (never built) from the channel's
       # Attic cache. `repo` selects the channel — "radiantwave" (main) or
-      # "radiantwave-dev" (dev). All variants follow this same update
-      # procedure; only the channel differs.
-      radiantwaveUpdaterModule = { repo, baseline }: {
+      # "radiantwave-dev" (dev) — and `manifestFile` selects the per-arch
+      # manifest (default "manifest.json"; Raspberry Pi uses
+      # "aarch64-manifest.json"). All variants follow this same update
+      # procedure; only the channel/arch differ.
+      radiantwaveUpdaterModule = { repo, baseline, manifestFile ? "manifest.json" }: {
         services.radiantwaveUpdater = {
           enable = true;
           baselinePackage = baseline;
-          manifestUrl = "https://files.radiantwavetech.com/${repo}/manifest.json";
+          manifestUrl = "https://files.radiantwavetech.com/${repo}/${manifestFile}";
           atticUrl = "https://attic.radiantwavetech.com/${repo}";
         };
       };
@@ -100,8 +136,8 @@
           inherit system;
 
           specialArgs = {
-            inherit radiantwave;
-            inherit upgradeFlakeRef;
+            inherit radiantwave upgradeFlakeRef;
+            radiantwaveApp = appPackage system;
             radiantwavePlymouth = mkRadiantwavePlymouth;
           };
 
@@ -137,10 +173,12 @@
           specialArgs = {
             inherit radiantwave upgradeFlakeRef;
             inherit nixos-raspberrypi;
+            radiantwaveApp = appPackage "aarch64-linux";
             radiantwavePlymouth = mkRadiantwavePlymouth;
           };
 
           modules = [
+            { nixpkgs.config.allowUnfree = true; }
             ({ ... }: {
               imports = with nixos-raspberrypi.nixosModules; [
                 sd-image
@@ -201,6 +239,8 @@
         };
     in
     {
+      inherit channelName channelVersion channelAtticUrl channelManifestDir baselineOutPaths;
+
       packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;
@@ -222,7 +262,7 @@
           diskModule = ./disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk";
           extraModules = [
-            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.x86_64-linux.default; })
+            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = appPackage "x86_64-linux"; })
           ];
         };
         radiantwavekiosk-commercial = mkKioskSystem {
@@ -232,7 +272,7 @@
           diskModule = ./commercial-disk-config.nix;
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-commercial";
           extraModules = [
-            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.x86_64-linux.default; })
+            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = appPackage "x86_64-linux"; })
           ];
         };
         # Rotated screen for android-style displays.
@@ -244,7 +284,7 @@
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-android";
           extraModules = [
             ./rotated_display.nix
-            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.x86_64-linux.default; })
+            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = appPackage "x86_64-linux"; })
           ];
         };
         # Raspberry Pi 5.
@@ -253,7 +293,11 @@
           hostName = "radiantwavekiosk-rpi";
           upgradeFlakeRef = "git+https://gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git${channel.gitRef}#radiantwavekiosk-rpi";
           extraModules = [
-            (radiantwaveUpdaterModule { repo = channel.atticRepo; baseline = channel.appInput.packages.aarch64-linux.default; })
+            (radiantwaveUpdaterModule {
+              repo = channel.atticRepo;
+              baseline = appPackage "aarch64-linux";
+              manifestFile = "aarch64-manifest.json";
+            })
           ];
         };
 

rotated_display.nix

@@ -1,6 +1,13 @@
-{ pkgs, radiantwave, ...}:
+{ config, pkgs, radiantwaveApp, ...}:
 let
-  radiantApp = radiantwave.packages.${pkgs.system}.default;
+  radiantApp = radiantwaveApp;
+  # Match configuration.nix: when the live updater is enabled, launch through
+  # the mutable /var/lib/radiantwave/current pointer so Android kiosks receive
+  # app updates instead of always running the baked baseline.
+  launchBin =
+    if config.services.radiantwaveUpdater.enable or false
+    then "/var/lib/radiantwave/current/bin/radiantwave"
+    else "${radiantApp}/bin/radiantwave";
   kioskscript = pkgs.writeShellScript "kiosk-start" ''
     # Wait for the Wayland display to be ready
     for i in {1..10}; do
@@ -13,7 +20,7 @@ let
     OUTPUT=$(${pkgs.wlr-randr}/bin/wlr-randr | grep -m1 '^\S' | awk '{print $1}')
     echo "Rotating output: $OUTPUT" >> /tmp/kiosk.log
     ${pkgs.wlr-randr}/bin/wlr-randr --output "$OUTPUT" --transform 90 >> /tmp/kiosk.log 2>&1 || echo "wlr-randr failed" >> /tmp/kiosk.log
-    exec ${radiantApp}/bin/radiantwave -d -s
+    exec ${launchBin} -d -s
   '';
 in
 {