Fix fresh Gentoo package resolution and record Stock VM validation

README.md

@@ -24,7 +24,9 @@ My personal Gentoo restoration kit, mainly for my own devices:
 - Binaries preferred, with a small deliberate source-build list.
 - A Bubble Tea chooser with a final preview, conflict prompts and backups.
 
-Package and boot actions still need a first run on a fresh Gentoo installation.
+The Stock preset has been installed in a fresh Gentoo QEMU/KVM guest: packages,
+config restoration and Plasma Login Manager login passed. Custom kernels,
+automatic bootloader deployment and optional setups still need full runtime checks.
 
 ## Screenshots
 

docs/boot.md

@@ -72,7 +72,9 @@ live under `/var/lib/Fiw-Gentoo-Dots`. No existing disk partition is formatted.
 Automatic deployment currently supports amd64 UEFI, GPT ESPs, plain ext4/Btrfs
 roots and unsigned boot. Encrypted, UKI-only, BIOS and signing workflows can
 keep their existing loader. Secure Boot being active stops unsigned deployment
-before changes. Full boot execution on a fresh installation remains unverified.
+before changes. A fresh ext4 QEMU/KVM guest booted the binary kernel with a
+separately provisioned UEFI GRUB loader. The automatic deployment and kernel
+update hooks described here still need end-to-end boot checks.
 
 `optional/fiw-cachy-patch` refreshes the custom kernel patch; it does not select
 a bootloader. See the [helper list](scripts.md) before using it.

docs/setup.md

@@ -65,6 +65,10 @@ recommended. Skipping a dependency also skips requested packages needing it.
 A package report records requested, skipped and missing packages. There is a
 final package confirmation before live Portage configuration changes.
 
+Binary packages retain the binhost's USE settings; required dependency flags
+are still checked. The preview includes dependency updates and replacements,
+such as adding Steam's 32-bit libraries to a fresh multilib installation.
+
 Read-only resolution and an export are available separately:
 
 ```sh
@@ -141,10 +145,13 @@ firmware choices and kernel update integration. Other layouts can keep their
 existing loader.
 
 The optional [TideWM recipe](tidewm.md) follows the audited upstream master
-branch and uses the normal compile-or-skip prompt. End-to-end package and
-boot execution on a fresh Gentoo
-installation remains unverified; development checks used temporary homes,
-staged Portage configuration and mocked system commands.
+branch and uses the normal compile-or-skip prompt. The Stock package installation completed in a fresh ext4 Gentoo QEMU/KVM guest
+(539 package steps, no missing selected packages). Config restoration, conflict
+handling, backups, the bundled chooser and Plasma Login Manager login were
+checked there, along with portable terminal configs and optional service enabling.
+The guest booted a binary kernel using a separately provisioned UEFI GRUB loader.
+Automatic bootloader deployment, custom Ryzen kernel builds, Btrfs, TideWM,
+optional Flatpak installation and physical GPU behaviour remain unverified.
 
 Do not publish the private original fiw-gentoo archive. It has different
 history and host-specific files.

lib/rice.py

@@ -341,7 +341,7 @@ def root_files(selection, repo_location=None):
         result['etc/portage/sets/fiw-dots-' + group] = '\n'.join(packages) + '\n'
     result['etc/portage/sets/fiw-dots'] = '\n'.join('@fiw-dots-' + g for g in package_map(selection)) + '\n'
     result['etc/portage/fiw-dots.conf'] += '\n# Persist the selected binary/source policy for later emerge operations.\n'
-    result['etc/portage/fiw-dots.conf'] += 'EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS} --getbinpkg ' + ' '.join('--usepkg-exclude=' + atom for atom in source_policy(selection)) + '"\n'
+    result['etc/portage/fiw-dots.conf'] += 'EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS} --getbinpkg --usepkg --binpkg-respect-use=n --with-bdeps=n ' + ' '.join('--usepkg-exclude=' + atom for atom in source_policy(selection)) + '"\n'
     result['etc/portage/repos.conf/fiw-dots.conf'] = '[fiw-dots]\nlocation = ' + str(repo_location or REPO / 'overlay') + '\npriority = 40\nauto-sync = no\n'
     for name in required_repositories(selection):
         if not existing_repository(name):
@@ -425,16 +425,20 @@ def source_builds(output):
     values = set(re.findall(r'^\[ebuild[^\]]*\]\s+(?:\([^)]*\)\s+)?([^\s:]+)', output, re.M))
     # Dedicated -bin ebuilds install upstream binaries; these do not require
     # compiling the application just because Portage labels them "ebuild".
-    # This released Plasma widget installs QML/scripts without a compile phase.
-    no_compile = {'kde-misc/apdatifier-gentoo'}
+    # These install upstream binaries or QML rather than compile applications.
+    no_compile = {'app-editors/vscode', 'media-sound/spotify',
+                  'games-util/steam-launcher', 'kde-misc/apdatifier-gentoo'}
     return {value for value in values if not cp_from_cpv(value).endswith('-bin')
+            and not value.startswith(('acct-user/', 'acct-group/', 'virtual/'))
             and cp_from_cpv(value) not in no_compile}
 
 
 def resolve(stage, selection, packages, execute=False):
     exclusions = ' '.join(source_policy(selection))
     command = ['emerge', '--config-root=' + str(stage), '--color=n', '--getbinpkg', '--usepkg',
-               '--usepkg-exclude=' + exclusions, '--autounmask=n', '--noreplace']
+               '--binpkg-respect-use=n', '--with-bdeps=n',
+               '--usepkg-exclude=' + exclusions, '--autounmask=n',
+               '--update', '--deep', '--newuse', '--backtrack=100']
     if not execute:
         command += ['--pretend']
     env = dict(os.environ, EMERGE_DEFAULT_OPTS='')
@@ -455,6 +459,8 @@ def install_packages(selection):
         raise RuntimeError('No packages selected')
     with tempfile.TemporaryDirectory(prefix='fiw-dots-portage-') as temp:
         stage = Path(temp)
+        # Portage evaluates ebuild metadata as its unprivileged user.
+        stage.chmod(0o755)
         shutil.copytree('/etc/portage', stage / 'etc/portage', symlinks=True,
                         ignore=shutil.ignore_patterns('gnupg'))
         profile = stage / 'etc/portage/make.profile'
@@ -577,6 +583,7 @@ def check_packages(selection):
     requested = list(dict.fromkeys(p for values in package_map(selection).values() for p in values))
     with tempfile.TemporaryDirectory(prefix='fiw-dots-check-') as temp:
         stage = Path(temp)
+        stage.chmod(0o755)
         shutil.copytree('/etc/portage', stage / 'etc/portage', symlinks=True,
                         ignore=shutil.ignore_patterns('gnupg'))
         profile = stage / 'etc/portage/make.profile'

portage/fiw-apps/package.use/binhost

@@ -1 +1 @@
-media-libs/opencv -vaapi VIDEO_CARDS: intel CPU_FLAGS_X86: -* avx avx2 f16c fma3 popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3
+media-libs/opencv -vaapi VIDEO_CARDS: intel CPU_FLAGS_X86: -* sse sse2

portage/fiw-apps/package.use/media

@@ -1,3 +1,4 @@
 media-video/obs-studio browser websocket nvenc v4l
 media-video/ffmpeg opus nvenc lame theora xvid vpx
 app-arch/7zip rar
+dev-libs/libdbusmenu gtk3

portage/fiw-ryzen/package.use/cpu-flags

@@ -1 +1,2 @@
 */* CPU_FLAGS_X86: aes avx avx2 avx512_bf16 avx512_bitalg avx512_vbmi2 avx512_vnni avx512_vp2intersect avx512_vpopcntdq avx512bw avx512cd avx512dq avx512f avx512ifma avx512vbmi avx512vl avx_vnni bmi1 bmi2 f16c fma3 mmx mmxext pclmul popcnt rdrand sha sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 vpclmulqdq
+media-libs/opencv CPU_FLAGS_X86: -* avx avx2 f16c fma3 popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3

portage/gaming/package.use/steam-abi32

@@ -65,6 +65,7 @@ virtual/zlib abi_x86_32
 x11-drivers/nvidia-drivers abi_x86_32
 x11-libs/cairo abi_x86_32
 x11-libs/libdrm abi_x86_32
+x11-libs/libpciaccess abi_x86_32
 x11-libs/libX11 abi_x86_32
 x11-libs/libXau abi_x86_32
 x11-libs/libxcb abi_x86_32