fix(installer): declare extra LUKS devices for multi-disk boot

A multi-disk install builds one LUKS container per drive joined into a
single multi-device BTRFS (-d single -m raid1). nixos-generate-config
only emits boot.initrd.luks.devices for the main drive — every subvolume
mounts through /dev/mapper/crypted_main, so the other members are
invisible to it. The installed system then unlocked only the main drive,
the array never assembled, and boot hung. Invisible single-disk, fatal
multi-disk (matches a real-hardware report).

generate_flake_config now writes, into hardware-selection.nix, a
boot.initrd.luks.devices entry for each extra drive (UUID resolved via
disko's partlabel; mapper name mirrors disko-config.nix's sanitize) and
re-asserts the x-systemd.requires= mount options disko sets but which
nixos-generate-config strips.

Verified end-to-end in a 3-disk UEFI QEMU VM: reproduced the bug, applied
the fix, ran a real nixos-install onto the array, and rebooted from the
disks — one passphrase unlocked all three containers, the 3-device BTRFS
assembled, and the system reached login.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/MIGRATION.md

@@ -269,6 +269,20 @@ The ISO autologins to a Hyprland live session that points you at:
 After install, the system at `/etc/nixos/` is the same shape this guide
 produces by hand.
 
+**Multi-disk (BTRFS RAID) caveat.** If you select more than one target drive,
+disko builds a multi-device BTRFS spanning one LUKS container per disk. The
+extra containers are invisible to `nixos-generate-config` (every subvolume
+mounts via the *main* `/dev/mapper/crypted_main`, so it only ever emits a
+`boot.initrd.luks.devices` entry for the main drive). The installer therefore
+writes the missing entries — plus the `x-systemd.requires=` mount options that
+make systemd-initrd wait for every member — into `hardware-selection.nix`.
+If you hand-write a multi-disk flake instead of using the installer, you must
+add, for each extra drive, `boot.initrd.luks.devices."<mapper>".device =
+"/dev/disk/by-uuid/<luks-partition-uuid>";` (mapper name = `crypted_` + the
+device path with `/` and `-` replaced by `_`, e.g. `/dev/sdb` →
+`crypted__dev_sdb`); without it the array can't be assembled and the system
+hangs at boot.
+
 ---
 
 ## Verification (in-place migration)

docs/ROADMAP.md

@@ -177,6 +177,8 @@ Pillar is **done** when every component has had a live VM pass and the roadmap c
 
 (Move items here when they land — keep them brief, link the commit/PR.)
 
+- _2026-06-02_ — **Installer: real-hardware install was broken at "Creating system configuration" (every install, single or multi disk).** `generate_state` evaluates `lib/state-schema.nix` by calling `builtins.getFlake "$NOMARCHY_REPO"` to load `nixpkgs.lib`, with `NOMARCHY_REPO=/etc/nomarchy`. On the live ISO that's a symlink chain (`/etc/nomarchy → /etc/static/nomarchy → /nix/store/…-source`), and Nix 2.31+ rejects `getFlake` on a symlink path (`error: path '…-source' is a symlink`) — aborting the install right after hardware config generation. Reproduced the exact error in a live VM (Nix 2.31.4). **Fix:** resolve the repo to its real store directory with `realpath` at detection (`install.sh:261`). The dev-checkout branch already used `realpath`, so only the live-ISO path was affected. Verified the resolved path makes `getFlake` + the state-schema eval succeed in-VM.
+- _2026-06-02_ — **Installer: multi-disk LUKS installs could not boot.** disko correctly builds a multi-device BTRFS (`-d single -m raid1`) across one LUKS container per disk, but `nixos-generate-config` only emits `boot.initrd.luks.devices` for the *main* drive (every subvolume mounts via `/dev/mapper/crypted_main`; the other members are invisible through the device-mapper path it traces). The installed system unlocked only the main drive, the array never assembled, and boot hung — invisible single-disk, fatal multi-disk (matches a real-hardware report). It also dropped the `x-systemd.requires=` mount options disko sets. **Fix:** `generate_flake_config` now writes the missing `boot.initrd.luks.devices.<mapper>` entries (UUID via the disko partlabel) and re-asserts the `x-systemd.requires=` options for every BTRFS mount into `hardware-selection.nix`. **Verified end-to-end:** booted a 3-disk (1 main + 2 extra) UEFI QEMU VM, ran the exact disko + `nixos-generate-config` path to confirm the bug, applied the fix, did a real minimal `nixos-install` onto the array, and rebooted from the disks — the system unlocked all three containers with a single passphrase (systemd-initrd caches it), assembled the 3-device BTRFS, and reached login (`btrfs filesystem show / → Total devices 3`). `docs/MIGRATION.md` updated with the hand-written-flake caveat.
 - _2026-05-31_ — **Ironclad: Overlap & Conflict Proofing complete.** Verified that manual Nix overrides in `home.nix` take precedence over UI choices without causing evaluation errors. **Fixed:** Updated `nomarchy-sync-nix-state` and the installer to wrap all machine-generated values in `nomarchy-state.nix` with `lib.mkDefault`. This ensures a user can manually set `nomarchy.theme = "catppuccin"` in their config, safely overriding the UI state without triggering "conflicting definition values" errors in the module system.
 - _2026-05-31_ — **Ironclad: Input Method (Fcitx5) Functional Pass complete.** Verified that non-ASCII input (Pinyin/Mozc) is functional in the live VM. **Fixed:** Enabled `i18n.inputMethod.fcitx5.waylandFrontend = true` in `core/system/input-method.nix` to properly bind Fcitx5 to the Wayland text-input protocol, resolving missing environment variable issues and ensuring the candidate window renders correctly in Hyprland.
 - _2026-05-31_ — **Ironclad: Multi-Monitor Integrity complete.** Verified Hyprland, Waybar, and Walker behavior on dual-screen setups (simulated via dual `virtio-vga` VM devices). **Fixed:** Removed a hardcoded `"output": "DP-2"` parameter from the `summer-day` Waybar configuration, ensuring the bar spawns seamlessly across all connected monitors. Confirmed Walker inherently follows the active monitor as expected.

installer/install.sh

@@ -257,9 +257,14 @@ check_environment() {
     fi
     success "UEFI boot detected"
 
-    # Find Nomarchy repo
+    # Find Nomarchy repo. Resolve symlinks: on the live ISO /etc/nomarchy is a
+    # symlink chain (/etc/nomarchy -> /etc/static/nomarchy -> /nix/store/…-source).
+    # `builtins.getFlake` (used below to load nixpkgs.lib for the state-schema
+    # eval) rejects a symlink path with "path '…-source' is a symlink" on Nix
+    # 2.31+, which aborted every real-hardware install at "Creating system
+    # configuration". Pass it the resolved store directory instead.
     if [[ -d "/etc/nomarchy" ]]; then
-        NOMARCHY_REPO="/etc/nomarchy"
+        NOMARCHY_REPO="$(realpath /etc/nomarchy)"
     elif [[ -d "$(dirname "$0")/.." ]] && [[ -f "$(dirname "$0")/../flake.nix" ]]; then
         NOMARCHY_REPO="$(realpath "$(dirname "$0")/..")"
     fi
@@ -1462,6 +1467,42 @@ generate_flake_config() {
         impermanence_opt=$'nomarchy.system.impermanence.enable = true;\n  nomarchy.system.impermanence.mainLuksName = "'"$_main_luks_name"$'";\n  nomarchy.system.impermanence.user = "'"$USERNAME"$'";'
     fi
 
+    # Multi-disk LUKS unlock. `nixos-generate-config` only emits a
+    # boot.initrd.luks.devices entry for the container that backs a
+    # fileSystems device — and every subvolume mount points at the main
+    # /dev/mapper/crypted_main. The extra drives in a multi-disk BTRFS array
+    # are members of that filesystem but are invisible through the
+    # device-mapper path it traces, so it never declares them. Without the
+    # entries below, initrd unlocks only the main drive, the multi-device
+    # BTRFS can never be assembled, and the installed system hangs at boot
+    # (the failure is invisible single-disk and only bites multi-disk
+    # hardware). We also re-assert the x-systemd.requires mount options disko
+    # set on every BTRFS mount (installer/disko-config.nix) but which
+    # nixos-generate-config drops — they make systemd-initrd wait for ALL
+    # members before mounting. Drive→mapper/partlabel naming mirrors
+    # disko-config.nix's `sanitize` (replace '/' and '-' with '_').
+    local EXTRA_LUKS_OPTS=""
+    local _ld=($TARGET_DRIVE)
+    if (( ${#_ld[@]} > 1 )); then
+        local _luks_lines="" _requires="" _i _extra _san _mapper _partlabel _uuid
+        for (( _i=1; _i<${#_ld[@]}; _i++ )); do
+            _extra="${_ld[$_i]}"
+            _san="${_extra//\//_}"; _san="${_san//-/_}"   # /dev/sdb -> _dev_sdb
+            _mapper="crypted_${_san}"
+            _partlabel="disk-extra_${_san}-luks"
+            _uuid=$(blkid -s UUID -o value "/dev/disk/by-partlabel/$_partlabel")
+            _luks_lines+=$'\n'"  boot.initrd.luks.devices.\"$_mapper\".device = \"/dev/disk/by-uuid/$_uuid\";"
+            _luks_lines+=$'\n'"  boot.initrd.luks.devices.\"$_mapper\".allowDiscards = true;"
+            _requires+=" \"x-systemd.requires=/dev/mapper/$_mapper\""
+        done
+        # BTRFS subvolume mountpoints — must match installer/disko-config.nix.
+        local _mp _fs_lines=""
+        for _mp in / /persist /home /nix /var/log /.snapshots; do
+            _fs_lines+=$'\n'"  fileSystems.\"$_mp\".options = [$_requires ];"
+        done
+        EXTRA_LUKS_OPTS="$_luks_lines"$'\n'"$_fs_lines"
+    fi
+
     local PROFILE_SYSTEM_OPTS=""
     local PROFILE_HOME_PACKAGES=""
 
@@ -1584,7 +1625,7 @@ FLAKE_EOF
   imports = [
     $HARDWARE_MODULES
   ];
-  $NOMARCHY_HW_OPTS
+  $NOMARCHY_HW_OPTS$EXTRA_LUKS_OPTS
 }
 EOF