fix(disk): explicit all-plain partition layout (VM-verified) + bib raw output dir fix

[dx4homelab]

Stacked on #3. Merge #3 first; this retargets to main automatically.

This PR replaced its own original approach. It started as an LVM-root layout. That was built, loop-mounted, confirmed byte-correct — and does not boot. Three variants were tried; the history below is kept because the failure modes are non-obvious and each one costs a reflash to rediscover.

Two changes

1. An explicit all-plain partition layout in iso/disk.toml, verified by booting it in a VM.
2. A Justfile fix so a failed mv can no longer leave a previous build's disk.raw in place.

Why there is no LVM in the boot path

FCOS/uCore cannot carry a boot-critical filesystem on LVM. Three attempts, all of which built cleanly and passed loop-mount inspection:

1 — root on an LV. The initramfs has no LVM support whatsoever:

dracut modules present : crypt, dm      <-- no lvm
lvm files in initramfs : none

FCOS locates root by LABEL; with no way to activate the VG the label never appears:

dev-disk-by-label-root.device: Job ... failed with result 'timeout'
Started emergency.service - Emergency Shell

rd.lvm.lv= does not help — there is no LVM tooling in the initramfs to act on the karg.

2 — root plain, /boot omitted. bib only auto-creates /boot "when the root partition is on an LVM logical volume", and customizations.disk gives you exactly what you declare:

error: grub_search_label:527: no such device: boot.
error: grub_loader_boot:196: you need to load the kernel first.
grub>

3 — root plain + /boot + /var on an LV. Boots into the real root, then:

Timed out waiting for device dev-...-<var LV fs UUID>
Dependency failed for var.mount - /var

The image ships lvm2-monitor, lvm2-lvmpolld, lvm-devices-import and coreos-populate-lvmdevices, but no activation unit — no lvm2-activation*, no lvm2-pvscan@. And coreos-populate-lvmdevices cannot help: it declares RequiresMountsFor=/var/lib, so it needs /var mounted, which is the very thing blocked. Circular.

The layout that ships

1M bios_grub | 200M ESP | 1G xfs /boot (label boot) | 20G xfs / (label root)

Mirrors what already runs on z170asrock. Root is the last partition, so it grows with a plain growpart <disk> <n> && xfs_growfs /. /boot is declared explicitly because the baked grub.cfg does search --label boot.

VM verification

qemu + OVMF, emulated NVMe (so the device is nvme0n1, matching the server), COW overlay over the real disk.raw grown to 4 TiB so the GPT-alt-header-not-at-end condition matches a real dd:

GRUB loaded the kernel from /boot
initramfs found /dev/disk/by-label/root; XFS (nvme0n1p4) mounted
ostree-prepare-root: composefs mounted successfully
reached "localhost login:"  — no emergency mode
nvme_core.default_ps_max_latency_us=0 present in the running cmdline

Two benign messages: failed to create symbolic link '/var/log' (present in every boot, including working ones) and zincati.service failing (no Ignition config in a bare VM; uCore uses rpm-ostreed-automatic anyway).

Justfile: bib raw output lands in output/image, not output/raw

The post-build step cleared output/${type} before mv -f. bib's subdir name does not track --type:

--type	actual dir
iso	bootiso (already special-cased)
raw	image ← the bug
qcow2	qcow2

So output/image was never cleared, mv failed with cannot overwrite 'output/image': Directory not empty, and the recipe exited 1 while leaving the previous build's disk.raw in place. A July 21 image survived a July 29 build this way and was nearly verified as if it were new. Replaced with an explicit type→dir mapping.

LVM is not abandoned — just moved out of the boot path

Per-app LVs created after install, mounted under /var/lib/<app> with nofail,x-systemd.device-timeout=30 so a problem degrades instead of hanging a headless box. That is all the snapshot→ZFS workflow needs:

xfs_freeze -f /var/lib/<app>
lvcreate -s -L <cow> -n <app>-snap vg4data/<app>
xfs_freeze -u /var/lib/<app>
mount -o ro,nouuid /dev/vg4data/<app>-snap /mnt/snap
rsync -aHAX --delete /mnt/snap/ /var/mnt/<pool>/backup/<app>/
zfs snapshot <pool>/backup/<app>@<stamp>
umount /mnt/snap && lvremove -f vg4data/<app>-snap

Standing rule added to the file

Always VM-boot a change to disk.toml before writing it to hardware. All three failures above passed loop-mount inspection. Byte-correct on disk is not the same as bootable.

🤖 Generated with Claude Code

[dx4homelab]

Superseded by #5 — this PR was auto-closed by GitHub when its base branch feat/nvme-apst-karg-mechanism was deleted while merging #3. Closed PRs cannot be retargeted or reopened, so the work continues in #5 with identical content, rebased onto main.