fix(pkgs): one chromium, not two — and what that is actually worth

BACKLOG #121. nixpkgs' chromium wrapper with enableWideVine = true (what the
template ships, for DRM) runs the `-wv` copy but links its share/* from the
PLAIN unwrapped build. A symlink is a store reference, so a second 687 MiB
chromium rode along for a directory of .desktop files nothing executes.
overlays.default now points those symlinks at the copy we already run; the
template needs no change, since lib.nix, the repo pkgs and nixosModules all
apply the overlay.

Checked first, because it decided whether the item was possible at all:
whether the `-wv` copy references the plain build. It is `cp -a` of it, so it
plausibly would have — and then no wrapper change could have dropped the
duplicate. It does not. Also verified rather than assumed: `.override
{ enableWideVine = true; }` composes with the overlay's overrideAttrs (the
order usually matters), so the template's existing line picks the fix up
untouched; the wrapper still execs the -wv build with WidevineCdm present; and
share/{applications,icons,man} match stock with the .desktop byte-identical.

I claimed this was "687 MiB off every install". It is not, and measuring the
artifact instead of the closure is what corrected it:

    nominal closure          -687 MiB  (9.38 -> 8.71 GiB)
    ISO image                -8 KiB    of 8.078 GiB
    installed disk           ~-19 MiB
    cache-install download   -195 MiB

Two dedupes that closure arithmetic cannot see. mksquashfs detects duplicate
files, so the ISO had already stored the near-identical blocks once. And
auto-optimise-store (on by default here) hardlinks identical files: the two
paths share inodes — verified by stat, and du counts 639 MiB for the pair
against ~620 for one. The only thing that cannot dedupe is the wire, where the
extra path is its own 195 MiB NAR.

So this is a DOWNLOAD fix — precisely what #120's netinstall cares about — and
close to a no-op for the offline ISO that is the default today. Whether that
justifies coupling an overlay to nixpkgs wrapper internals is Bernardo's call;
it is guarded and no-ops if upstream moves, but it is his to weigh. Worth an
upstream patch regardless: the wrapper should take its desktop entry from the
variant it wraps.

The guard is the load-bearing part, because the failure mode is a SILENT no-op
that no build complains about: checks.chromium-single-closure asserts exactly
one full unwrapped chromium in the template closure, and was proved to fail by
neutering the overlay — it reports "found 2", names both paths, and warns off
the tempting "fix" of dropping enableWideVine, which silently removes DRM.

The rule this establishes, now recorded in ROADMAP and on #120 (whose entire
size table is closure arithmetic): closure size is not disk size and is not
image size. Measure the artifact.

V2: flake check, chromium-single-closure, live-baseline-apps, template-sot,
option-docs, state-bridges all pass. Three ISOs built from one tree for the
numbers above.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flake.nix

@@ -94,6 +94,42 @@
         # Includes nomarchy-what-changed (generation readability, #82).
         nomarchy-lifecycle = final.callPackage ./pkgs/nomarchy-lifecycle { };
         pam-fprint-grosshack = final.callPackage ./pkgs/pam-fprint-grosshack { };
+
+        # One chromium, not two (ROADMAP § one chromium, not two, #121).
+        # Upstream nixpkgs bug, worth a patch there: in
+        # pkgs/applications/networking/browsers/chromium/default.nix the
+        # wrapper runs the `-wv` copy when enableWideVine is set, but still
+        # links its share/ from the PLAIN unwrapped build:
+        #     for f in '${chromium.browser}'/share/*; do ln -s …
+        # A symlink is a store reference, so that retains a whole second
+        # 687 MiB chromium for a directory of .desktop files nothing runs —
+        # on every machine the template installs, not just the live ISO.
+        #
+        # Safe because the `-wv` copy is `cp -a` of the browser and is
+        # self-contained: verified it does NOT reference the plain build (had
+        # it done so, no wrapper change could drop the duplicate), and its
+        # share/ is byte-identical, .desktop included. So share moves to the
+        # copy we already run and nothing else changes.
+        #
+        # Both paths are read back out of the wrapper's own buildCommand, so
+        # this knows nothing about nixpkgs internals beyond those two
+        # strings. If upstream restructures either, the match returns null
+        # and this becomes a NO-OP rather than a broken build — and
+        # checks.chromium-single-closure is what fails, loudly, instead of
+        # the duplicate quietly returning. With enableWideVine = false the
+        # two paths are the same and the substitution is identity, so the
+        # plain package is untouched.
+        chromium = prev.chromium.overrideAttrs (old:
+          let
+            wv    = builtins.match ".*makeWrapper \"([^\"]+)/libexec/chromium/chromium\".*" old.buildCommand;
+            plain = builtins.match ".*for f in '([^']+)'/share/\\*.*" old.buildCommand;
+          in
+          prev.lib.optionalAttrs (wv != null && plain != null) {
+            buildCommand = builtins.replaceStrings
+              [ "'${builtins.head plain}'/share/" ]
+              [ "'${builtins.head wv}'/share/" ]
+              old.buildCommand;
+          });
       };
 
       nixosModules.nomarchy = {
@@ -559,6 +595,43 @@
           # sheet to ✖/exit-1 and names the unit; with the failure
           # cleared it reports healthy/exit-0. Minimal node (just the
           # package) — the disk/flake/snapper checks self-skip in a VM.
+          # One chromium, not two (ROADMAP § one chromium, not two, #121).
+          # The overlay's wrapper fix is a substitution into a string
+          # nixpkgs owns: if upstream restructures that buildCommand, the
+          # match returns null, the fix silently becomes a no-op and 687 MiB
+          # of duplicate browser quietly returns to every install. Nothing
+          # about that breaks a build — which is exactly why it needs a
+          # check. Asserts the invariant, not the mechanism: the closure the
+          # template installs carries exactly ONE full unwrapped chromium
+          # (plain OR -wv, never both; the tiny -sandbox output is a separate
+          # path and is expected).
+          chromium-single-closure =
+            let
+              hm = downstream.homeConfigurations.me.activationPackage;
+              ci = pkgs.closureInfo { rootPaths = [ hm ]; };
+            in
+            pkgs.runCommand "nomarchy-chromium-single-closure"
+              { nativeBuildInputs = [ pkgs.gnugrep ]; }
+              ''
+                set -euo pipefail
+                # Full browser builds only: -sandbox is a few KB and legitimate.
+                full=$(grep -E 'chromium-unwrapped-[0-9.]+(-wv)?$' ${ci}/store-paths || true)
+                n=$(printf '%s' "$full" | grep -c . || true)
+                if [ "$n" != 1 ]; then
+                  echo "chromium-single-closure: expected exactly 1 full unwrapped chromium, found $n:"
+                  printf '%s\n' "$full"
+                  echo
+                  echo "If this is 2, the enableWideVine wrapper is retaining the plain"
+                  echo "build for its share/* symlinks again — the overlay fix in"
+                  echo "flake.nix (ROADMAP § one chromium, not two, #121) has stopped"
+                  echo "matching upstream's buildCommand. Do NOT 'fix' it by dropping"
+                  echo "enableWideVine: that silently removes DRM playback."
+                  exit 1
+                fi
+                echo "chromium-single-closure: ok — one chromium ($full)"
+                touch $out
+              '';
+
           # Live-ISO baseline apps (ROADMAP § live-ISO baseline apps, #103).
           # The live session shipped no
           # browser and no office for as long as it existed — the thing a user