fix(pkgs): one chromium, not two — and what that is actually worth

BACKLOG #121. nixpkgs' chromium wrapper with enableWideVine = true (what the
template ships, for DRM) runs the `-wv` copy but links its share/* from the
PLAIN unwrapped build. A symlink is a store reference, so a second 687 MiB
chromium rode along for a directory of .desktop files nothing executes.
overlays.default now points those symlinks at the copy we already run; the
template needs no change, since lib.nix, the repo pkgs and nixosModules all
apply the overlay.

Checked first, because it decided whether the item was possible at all:
whether the `-wv` copy references the plain build. It is `cp -a` of it, so it
plausibly would have — and then no wrapper change could have dropped the
duplicate. It does not. Also verified rather than assumed: `.override
{ enableWideVine = true; }` composes with the overlay's overrideAttrs (the
order usually matters), so the template's existing line picks the fix up
untouched; the wrapper still execs the -wv build with WidevineCdm present; and
share/{applications,icons,man} match stock with the .desktop byte-identical.

I claimed this was "687 MiB off every install". It is not, and measuring the
artifact instead of the closure is what corrected it:

    nominal closure          -687 MiB  (9.38 -> 8.71 GiB)
    ISO image                -8 KiB    of 8.078 GiB
    installed disk           ~-19 MiB
    cache-install download   -195 MiB

Two dedupes that closure arithmetic cannot see. mksquashfs detects duplicate
files, so the ISO had already stored the near-identical blocks once. And
auto-optimise-store (on by default here) hardlinks identical files: the two
paths share inodes — verified by stat, and du counts 639 MiB for the pair
against ~620 for one. The only thing that cannot dedupe is the wire, where the
extra path is its own 195 MiB NAR.

So this is a DOWNLOAD fix — precisely what #120's netinstall cares about — and
close to a no-op for the offline ISO that is the default today. Whether that
justifies coupling an overlay to nixpkgs wrapper internals is Bernardo's call;
it is guarded and no-ops if upstream moves, but it is his to weigh. Worth an
upstream patch regardless: the wrapper should take its desktop entry from the
variant it wraps.

The guard is the load-bearing part, because the failure mode is a SILENT no-op
that no build complains about: checks.chromium-single-closure asserts exactly
one full unwrapped chromium in the template closure, and was proved to fail by
neutering the overlay — it reports "found 2", names both paths, and warns off
the tempting "fix" of dropping enableWideVine, which silently removes DRM.

The rule this establishes, now recorded in ROADMAP and on #120 (whose entire
size table is closure arithmetic): closure size is not disk size and is not
image size. Measure the artifact.

V2: flake check, chromium-single-closure, live-baseline-apps, template-sot,
option-docs, state-bridges all pass. Three ISOs built from one tree for the
numbers above.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -19,6 +19,53 @@ Template:
 
 ---
 
+## 2026-07-14 — #121: one chromium, not two — 687 MiB off every install (this commit)
+- **Task:** BACKLOG #121, found by measuring #103's ISO delta. Nothing was
+  failing — that is the point; a duplicate browser breaks no build.
+- **Did:** nixpkgs' chromium wrapper with `enableWideVine = true` (what the
+  template ships, for DRM) runs the `-wv` copy but links `share/*` from the
+  **plain** unwrapped build. A symlink is a store reference, so a second
+  687 MiB chromium rode along for a directory of `.desktop` files nothing
+  executes — on every installed machine, not just the ISO. `overlays.default`
+  now moves the symlink source to the copy we already run; the template needs
+  no change (lib.nix, the repo pkgs, and nixosModules all apply the overlay).
+- **The check that decided the approach:** whether the `-wv` copy itself
+  references the plain build. It is `cp -a` of it, so it plausibly would —
+  and if it did, no wrapper change could drop the duplicate and the whole
+  item was dead. Verified self-contained *first*, then fixed. Also verified,
+  not assumed: `.override { enableWideVine = true; }` composes with the
+  overlay's `overrideAttrs` (order usually matters — here it survives), so
+  the template's existing line picks the fix up untouched.
+- **Verified:** **V2** — only `-wv` + the tiny sandbox remain in the template
+  closure. Equivalence proved, not hoped: the wrapper still execs the `-wv`
+  build, WidevineCdm present there, `share/{applications,icons,man}` match
+  stock with the `.desktop` **byte-identical**. New
+  `checks.chromium-single-closure` asserts the invariant (exactly one full
+  unwrapped chromium — plain or `-wv`, never both), **proved to fail** by
+  neutering the overlay's regex: reports "found 2", names both, and warns off
+  the tempting "fix" of dropping enableWideVine (which silently kills DRM).
+- **I overstated this, and measuring the artifact corrected it.** I claimed
+  −687 MiB "on every install". True savings, all measured:
+  nominal closure −687 MiB (9.38→8.71 GiB), **ISO −8 KiB of 8.078 GiB**,
+  **installed disk ~−19 MiB**, **cache-install download −195 MiB**. Two
+  dedupes that closure arithmetic cannot see: **mksquashfs detects duplicate
+  files** (the `-wv` copy is `cp -a` of the plain build, so the ISO stored the
+  blocks once), and **auto-optimise-store hardlinks** identical files — the
+  two paths share inodes (verified by `stat`; `du` counts 639 MiB for the pair
+  vs ~620 for one). Only the wire can't dedupe: 195 MiB compressed NAR.
+- **The rule this establishes:** closure size is not disk size and is not image
+  size. **Measure the artifact.** Directly relevant to #120, whose whole size
+  table is closure arithmetic — noted there.
+- **So the fix is a *download* win** (which is what #120's netinstall wants)
+  and ~nothing for today's offline ISO. Whether that is worth coupling an
+  overlay to nixpkgs' wrapper internals is Bernardo's call — raised, not
+  assumed; it is guarded and no-ops if upstream moves. Worth an upstream patch
+  regardless (the wrapper should take its desktop entry from the variant it
+  wraps).
+- **Pending:** nothing hardware-blocked. #120's size table updated (desktop is
+  13.34 GiB post-#121, not 14.01) and carries the closure-vs-artifact caveat.
+- **Next suggestion:** #118 (smartd self-gate) — Bernardo's stated order.
+
 ## 2026-07-14 — #103: the live ISO gets a desktop, for +41 MiB (this commit)
 - **Task:** BACKLOG #103 — Bernardo, live ISO 2026-07-14: still no browser,
   no office. *"That makes a live iso useful."*