pika-orch-incus-cleanup-3

The RemoteLinuxVmIncusMode enum (Transfer / SingleHostShared) and all supporting code are deleted:

• The incus_mode field is removed from RemoteLinuxVmContext (executor.rs:83).
• The remote_incus_closure_dir field is removed — it was only used by the transfer path to track Nix store closure state.
• The PIKACI_REMOTE_LINUX_VM_INCUS_MODE environment variable, its default constant, the remote_linux_vm_incus_mode() parser, and the remote_linux_vm_incus_mode_label() helper are all deleted.
• In remote_linux_vm_context(), the match on backend to determine incus_mode is removed; the context is now constructed unconditionally without a mode field.

This is the foundational change — every subsequent diff hunk in executor.rs follows from the removal of this branching point.

Seven functions are deleted in a single contiguous block (~280 lines):

1. build_remote_incus_run_command — assembled the runuser -u pikaci / timeout guest command string.
2. build_remote_incus_prepare_script — generated the multi-hundred-line bash heredoc that was pushed into the guest to create /usr/local/bin/pikaci-incus-run, set up symlinks, ownership, and environment variables.
3. build_remote_incus_transfer_workspace_finalize_command — produced the mount --bind / mount -o remount,bind,ro sequence for read-only workspace remounting.
4. import_remote_path_closure_into_incus — ran nix-store --export | nix-store --import to push a Nix closure into the guest.
5. import_remote_incus_closures — orchestrated closure imports for workspace-deps and workspace-build, then wrote guest-store-paths.json.
6. prepare_remote_incus_guest_filesystem — resolved real paths and called the prepare script inside the guest via incus exec.
7. stage_snapshot_into_incus_guest — used incus file push -r to copy the snapshot directory tree into the guest.
8. finalize_remote_incus_transfer_workspace — executed the finalize mount command.

All of this per-job guest setup is now the responsibility of the image-owned pikaci-incus-run binary and the virtiofs device mounts configured before launch.

ensure_remote_incus_runtime is simplified from a mode-dispatching orchestrator to a linear sequence:

1. Log message no longer mentions mode — just configure remote Linux VM backend 'incus' on {host}.
2. reset_remote_linux_vm_artifacts is called unconditionally (was gated on SingleHostShared).
3. configure_remote_incus_single_host_shared_devices is renamed to configure_remote_incus_devices and called unconditionally.
4. After starting the instance, the function returns immediately after wait_for_remote_incus_instance — no more post-boot preparation steps. The guest image's own pikaci-incus-run handles everything after boot.

build_remote_incus_launch_command now accepts a &JobSpec parameter and constructs the launch command as:

sudo incus exec --project {project} {instance} -- \
  env \
  PIKACI_INCUS_GUEST_COMMAND={compiled_command} \
  PIKACI_INCUS_TIMEOUT_SECS={timeout} \
  PIKACI_INCUS_RUN_AS_ROOT={0|1} \
  /run/current-system/sw/bin/pikaci-incus-run

Key design points:

• The binary path is now the NixOS system-profile path /run/current-system/sw/bin/pikaci-incus-run (constant REMOTE_LINUX_VM_INCUS_RUN_BINARY) rather than the old /usr/local/bin/pikaci-incus-run that was written by the prepare script.
• The guest command, timeout, and privilege level are passed as env vars, making the launch contract declarative.
• The call site in spawn_remote_linux_vm_process is updated to pass job to the Incus branch.

Four constants are replaced with three:

The mount paths now match the guest filesystem layout directly — no more symlinks from /mnt/pikaci-* to /workspace/snapshot or /staged/linux-rust/*. The host /nix/store mount (pikaci-nix-store) is removed entirely because the guest image now carries its own runtime dependencies.

The renamed configure_remote_incus_devices function (formerly configure_remote_incus_single_host_shared_devices) configures three virtiofs devices instead of four, all using the new path constants.

The ensure_remote_linux_vm_directories function's mkdir -p command drops from 7 directories to 6. The removed directory is remote_incus_closure_dir which stored guest-store-paths.json for the transfer path. The conditional if [ ! -e ... ] guards for workspace-deps and workspace-build symlinks remain unchanged.

Five new Nix let-bindings define the guest interpreter paths:

guestSystemBin = "/run/current-system/sw/bin";
guestBash = "${guestSystemBin}/bash";
guestBashShebang = "#!${guestBash}";
guestNode = "${guestSystemBin}/node";
guestPython = "${guestSystemBin}/python3";

Every write_wrapper call and every heredoc cat >"$out/bin/..." block that previously used #!${pkgs.bash}/bin/bash (which resolves to a /nix/store/...-bash-5.x/bin/bash path) now uses ${guestBashShebang} instead. Similarly, the ${pkgs.python3}/bin/python3 reference in the fixture-relay-smoke test is replaced with ${guestPython}.

This is what makes the host /nix/store mount unnecessary — the staged wrappers no longer contain /nix/store paths that would need to exist in the guest.

The stagedRuntimeEnv block is rewritten:

Removed:

• host_store_root variable and the ${staged_runtime_ld//\/nix\/store/$host_store_root} rewrite. This was the core indirection: when the host /nix/store was mounted at /mnt/pikaci-nix-store, the variable would rewrite all Nix store paths to point through the mount. No longer needed because the image carries the required libraries.
• Separate staged_postgres_bin rewriting — PostgreSQL is now on PATH directly.

Added:

• PATH now includes ${pkgs.postgresql}/bin and the guest system bin directory directly.
• Conditional /run/opengl-driver/lib inclusion in LD_LIBRARY_PATH for GPU-enabled lanes.
• LIBCLANG_PATH export for bindgen-dependent crates.

The LD_LIBRARY_PATH still uses the Nix-evaluated makeLibraryPath output (which contains /nix/store/... paths), but these paths now exist in the guest image's own Nix store rather than being rewritten through a host mount.

The run-rmp-init-smoke-ci wrapper was previously created with pkgs.writeShellScript, which implicitly uses the build-time bash path as the shebang. It is now created with pkgs.writeTextFile { executable = true; } and installed via install -Dm555.

This fixes two issues:

1. The shebang is now the explicit guest-local #!/run/current-system/sw/bin/bash rather than a /nix/store/...-bash/bin/bash path.
2. Using writeTextFile with executable = true ensures the file is materialized as a proper executable in the Nix store, avoiding a mode-preservation issue where writeShellScript + cp could lose the executable bit in certain realization contexts.

The script body itself is unchanged in logic — it still creates a temporary RMP project, runs cargo build --offline, and validates the smoke test.

The Incus VM image Nix expression is updated so that pikaci-incus-run is part of the NixOS system profile, available at /run/current-system/sw/bin/pikaci-incus-run. This is the counterpart to the executor change: where the executor previously wrote the run script into /usr/local/bin/ via the prepare-script heredoc, the image now owns the binary.

The image also needs to include the runtime dependencies (bash, node, python3, PostgreSQL, etc.) in its system profile so that the guest-local paths referenced by the staged wrappers resolve correctly.

The migration plan is updated in several areas:

1. Phase B description: "transfer the workspace snapshot" becomes "mount the prepared workspace snapshot".
2. Proof status: References to transfer mode measurements (155s pika-actionlint, 67s pika-doc-contracts) are removed. The transfer fallback via PIKACI_REMOTE_LINUX_VM_INCUS_MODE=transfer is no longer mentioned as an option.
3. Architecture description: Updated to describe "one shared-mount Incus path rather than a mode split" with virtiofs mounts at their final guest paths.
4. Guest contract: New paragraph documents that the image owns the mounted-path layout and pikaci-incus-run owns the guest env/log/result contract.
5. Host /nix/store: Documented that staged Linux runtime no longer depends on a mounted host /nix/store seam, with details about how staged wrappers now use guest-local interpreters.
6. Closing summary: Updated to note the guest runtime is "owned by the Incus image plus staged payloads, not by an executor-mounted host /nix/store".

The test module is significantly cleaned up:

New helpers:

• sample_shell_job(command) — creates a minimal JobSpec with a shell command.
• sample_remote_context(backend) — creates a RemoteLinuxVmContext without the deleted incus_mode and remote_incus_closure_dir fields.

These replace ~25-line inline struct literals that were duplicated across multiple tests.

Deleted tests:

• remote_linux_incus_transfer_finalize_remounts_read_only_workspace — tested the deleted transfer finalize command.
• remote_linux_incus_single_host_prepare_script_avoids_snapshot_staging_copy — tested the deleted prepare script in shared mode.
• remote_linux_incus_transfer_prepare_script_keeps_guest_store_paths — tested the deleted prepare script in transfer mode.
• remote_linux_incus_mode_env_accepts_single_host_shared — tested the deleted mode parser.
• remote_linux_incus_mode_defaults_to_single_host_shared — tested the deleted mode default.
• with_incus_mode_env helper — no longer needed.

Updated tests:

• remote_linux_incus_launch_uses_incus_exec_runner — now asserts on env, PIKACI_INCUS_GUEST_COMMAND=, PIKACI_INCUS_TIMEOUT_SECS=120, PIKACI_INCUS_RUN_AS_ROOT=0, and the new binary path.
• remote_linux_incus_read_only_disk_device_uses_virtiofs_bus (renamed from ..._single_host_shared_...) — uses sample_remote_context and the new mount path constant.
• ensure_remote_linux_vm_directories_skips_existing_staged_output_symlinks — updated context construction and mkdir assertion to match 6 directories instead of 7.