Fresh-VM timeline explained: on run 1 virt-manager installs AFTER the
niri module's prereq check ran (menu dispatch order), so the group add
was evaluated against a package state that did not include it yet. A
second run 'fixed' it — matching the observed behavior.
- New ensure_libvirt_group runs in the Summary section, seeing the FINAL
package state; menu/module-time check kept as an early pass.
- pkg_installed is AND-semantics (all must be installed); the gate needs
OR. New pkg_installed_any helper; both gates switched to it.
- Also fixed a set -e trap: '$done_any && ok' returned 1 (killing the
script) when no optional tools were picked — replaced with an if.
All four gate cases harness-proven: virt-only, menu-pick, no-virt,
already-in-group.
Fresh-VM repro: user in yuri+wheel with virt-manager installed. Gate was
'pkg_installed libvirt', but virt-manager does NOT require the 'libvirt'
metapkg (verified vs F44 package page: requires libvirt-glib etc., client
side only) — so the usermod never fired.
Gate now: libvirt OR libvirt-daemon OR libvirt-daemon-driver-qemu OR
virt-manager packages, or an existing /usr/sbin/libvirtd binary.
Pathfinder