Merge dev into main: Bug Fix - ScheduleManager startup self-deadlock

Bug Fix: ScheduleManager::start() held mutex_ and then called loadCache(), which re-locks the same non-recursive mutex. Whenever a schedule cache file was present (the normal state for a provisioned kiosk), this self-deadlocked and blocked SDL_AppInit before the first frame was presented, so the kiosk booted to a black screen showing only the compositor cursor.

Narrow the lock scope so loadCache() acquires mutex_ itself, and add a regression test that starts with a cached payload present.

.gitea/workflows/build.yml

@@ -1,12 +1,7 @@
 name: build
 
 on:
-  # Manual dispatch: always builds the `dev` branch (regardless of the ref
-  # selected when dispatching) and publishes to the dev Attic cache + dev
-  # live-update manifest. Version fingerprint = short commit hash.
   workflow_dispatch:
-  # Any new tag: builds the tagged revision and publishes a release to the
-  # release Attic cache + production live-update manifest. Version = the tag.
   push:
     tags: ['*']
 
@@ -14,14 +9,9 @@ jobs:
   nix-build:
     runs-on: orion-lxc
     steps:
-      # actions/checkout@v4 is unreliable on host-mode runners (its files are
-      # copied into the workspace instead of the repo), so clone explicitly.
-      # A manual dispatch always clones `dev`; a tag push clones the tag. A full
-      # clone (no --depth) lets `git describe --tags` resolve the real tag.
       - name: Checkout
         run: |
           rm -rf ./* ./.[!.]* 2>/dev/null || true
-          git config --global http.extraheader "Authorization: token ${{ github.token }}"
           REF="${{ gitea.ref_name }}"
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             REF=dev
@@ -40,9 +30,6 @@ jobs:
           git describe --tags --always 2>&1 || true
           test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
 
-      # Dev builds fingerprint as the short commit hash; releases report the
-      # tag. Persisted via GITHUB_ENV so the impure nix eval below reads it via
-      # builtins.getEnv.
       - name: Compute version
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
@@ -51,18 +38,13 @@ jobs:
             echo "APP_VERSION=$(git describe --tags --always)" >> "$GITHUB_ENV"
           fi
 
-      # checks is keyed per-system (checks.<system>.default); nix build's
+      # ---- x86_64 (native) ----
-      # #attr shorthand can't resolve it, so resolve the current system inline.
+      - name: Build package (x86_64)
-      # --impure lets the flake read APP_VERSION via builtins.getEnv
-      # (pure evals always get the package defaults).
-      - name: Build package
         run: |
           nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
             --impure --out-link result-pkg
 
-      # The offline test suite runs in the check derivation's checkPhase.
+      - name: Build + offline test suite (x86_64)
-      # This is a separate build/output from the package itself.
-      - name: Build + offline test suite
         run: |
           nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
             --impure --out-link result-checks
@@ -80,14 +62,25 @@ jobs:
             ./build/test_license_service
           '
 
-      # Manual dispatch -> dev cache; tag push -> release cache.
+      # ---- aarch64 (emulated via host binfmt_misc/qemu-user) ----
+      - name: Build package (aarch64)
+        run: |
+          nix build -L ".#packages.aarch64-linux.default" \
+            --impure --out-link result-pkg-aarch64
+
+      - name: Build + offline test suite (aarch64)
+        run: |
+          nix build -L ".#checks.aarch64-linux.default" \
+            --impure --out-link result-checks-aarch64
+
+      # ---- Publish (only reached if every build/test above passed) ----
       - name: Push to Attic dev cache
         if: github.event_name == 'workflow_dispatch'
         env:
           ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
         run: |
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave-dev ./result-pkg
+          attic push radiantwave:radiantwave-dev ./result-pkg ./result-pkg-aarch64
 
       - name: Push to Attic release cache
         if: github.event_name != 'workflow_dispatch'
@@ -95,28 +88,22 @@ jobs:
           ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_PROD }}
         run: |
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave ./result-pkg
+          attic push radiantwave:radiantwave ./result-pkg ./result-pkg-aarch64
 
-      # Publish the manifest kiosks poll for live app updates. `storePath`
+      - name: Publish manifests
-      # must match exactly the closure pushed to the matching Attic cache above
-      # (readlink resolves the result-pkg out-link symlink to its real
-      # /nix/store path), so a kiosk can `nix copy --from` it without ever
-      # building from source. Upload mirrors the ISO scp pattern to the
-      # fileserver via the build-server's `radiantwave-infra` SSH alias.
-      - name: Publish dev manifest
-        if: github.event_name == 'workflow_dispatch'
         run: |
-          STOREPATH=$(readlink -f ./result-pkg)
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$STOREPATH" > manifest.json
+            DEST=radiantwave-dev
-          cat manifest.json
+          else
-          scp manifest.json \
+            DEST=radiantwave
-            nclack@157.245.124.103:/mnt/infrastructure_data/files/radiantwave-dev/manifest.json
+          fi
 
-      - name: Publish release manifest
+          X86_PATH=$(readlink -f ./result-pkg)
-        if: github.event_name != 'workflow_dispatch'
+          ARM_PATH=$(readlink -f ./result-pkg-aarch64)
-        run: |
+
-          STOREPATH=$(readlink -f ./result-pkg)
+          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$X86_PATH" > manifest.json
-          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$STOREPATH" > manifest.json
+          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$ARM_PATH" > aarch64-manifest.json
-          cat manifest.json
+          cat manifest.json aarch64-manifest.json
-          scp manifest.json \
+
-            nclack@157.245.124.103:/mnt/infrastructure_data/files/radiantwave/manifest.json
+          scp manifest.json aarch64-manifest.json \
+            nclack@157.245.124.103:/mnt/infrastructure_data/files/$DEST/

.gitignore

@@ -33,3 +33,8 @@ Thumbs.db
 
 # Compiled binary
 bin/
+
+# Emacs
+*~
+\#*\#
+.#*

src/schedule/schedule_manager.cpp

@@ -87,16 +87,20 @@ void ScheduleManager::refreshOnce() {
 
 void ScheduleManager::start(db::DatabaseManager& db, const std::string& timezone,
                             std::function<void()> onChanged) {
-    std::lock_guard<std::mutex> lock(mutex_);
+    {
-    if (started_) return;
+        std::lock_guard<std::mutex> lock(mutex_);
-    started_ = true;
+        if (started_) return;
-    db_ = &db;
+        started_ = true;
-    timezone_ = timezone;
+        db_ = &db;
-    onChanged_ = std::move(onChanged);
+        timezone_ = timezone;
-    licenseKey_ = db.getKV(db::KV_LICENSE_KEY);
+        onChanged_ = std::move(onChanged);
-    enabled_ = true; // config supplies the toggle via setEnabled()
+        licenseKey_ = db.getKV(db::KV_LICENSE_KEY);
+        enabled_ = true; // config supplies the toggle via setEnabled()
+    }
 
-    // Offline first: load any cached payload immediately.
+    // Offline first: load any cached payload immediately. Called outside the
+    // lock because loadCache() acquires mutex_ itself; holding it here would
+    // self-deadlock on the non-recursive mutex when a cache file exists.
     loadCache();
 
     stop_.store(false);

tests/test_schedule_engine.cpp

@@ -297,6 +297,34 @@ TEST(ScheduleManagerTest, OfflineFallsBackToCache) {
     radiantwave::sync::schedule_cache::clear();
 }
 
+// Regression: start() must not deadlock when a cache file is present. It used
+// to hold mutex_ and then call loadCache(), which re-locked the same
+// non-recursive mutex (self-deadlock), blocking SDL_AppInit before the first
+// frame was ever presented — the kiosk sat on a black screen.
+TEST(ScheduleManagerTest, StartWithCachedPayloadDoesNotDeadlock) {
+    const std::string dir = tempCacheDir();
+    setenv("HOME", dir.c_str(), 1);
+
+    SchedulePayload p = dailyPayload();
+    ASSERT_TRUE(radiantwave::sync::schedule_cache::write(p, "\"cached\""));
+
+    const std::string dbPath =
+        (std::filesystem::temp_directory_path() / "rw_schedule_start_test.db")
+            .string();
+    std::filesystem::remove(dbPath);
+    radiantwave::db::DatabaseManager db;
+    ASSERT_TRUE(db.initialize(dbPath));
+
+    radiantwave::schedule::ScheduleManager manager;
+    manager.start(db, "UTC");
+    EXPECT_TRUE(manager.hasSchedule());
+    manager.shutdown();
+
+    db.close();
+    std::filesystem::remove(dbPath);
+    radiantwave::sync::schedule_cache::clear();
+}
+
 // ─── Phase 5: consume real Portal-generated payloads ───────────────────
 //
 // These fixtures were captured from a running Portal (GET