fix(live): mask systemd-localed — the session-killer storm's single source (#258)

Re-test WITHOUT o-tiling (zz4 verified in-VM) crashed gnome-shell again at
the same install phase — SIGABRT this time — so the extension was an
amplifier, not the trigger. Both runs show anaconda's localization tasks
flapping the LIVE system's X11 layout via locale1 seconds before the shell
dies (SEGV in update_clock/g_settings_get_enum under the GSettings change
storm, then ABRT). localed is useless in a throwaway live: in-session layout
switching goes through gnome-shell input-sources, and the target's keyboard
is written via --root. Mask it (dbus-activated — disable is not enough) so
the storm cannot start; incident note extended with part 3.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: daniel-g-carrasco

docs/notes/2026-07-04-live-session-crash-during-install.md

@@ -82,6 +82,26 @@ Follow-up hardening shipped with this note:
   installed disk — the truncated-install sensor, cause-agnostic.
 - This also most likely explains CyberOto's original broken-flatpaks report.
 
+## Part 3 — re-test WITHOUT o-tiling: the shell still dies → localed masked
+
+Re-test on the fixed fast ISO (zz4 confirmed in-VM: o-tiling not loaded, zero
+global.log errors) ended the same way: session gone at the end of the
+install, new gnome-shell coredump — this time **SIGABRT** (21:40:05). So
+o-tiling was an incidental amplifier, not the trigger: gnome-shell 50.2 dies
+under Anaconda's configuration-phase GSettings storm on its own. The storm's
+single source is anaconda's localization tasks driving the LIVE system's
+locale1 (X11 layout flapping in the journal both runs).
+
+Mitigation shipped: the live env now **masks systemd-localed.service**. It is
+useless in a throwaway live (in-session layout switching goes through
+gnome-shell input-sources, not locale1; the target's keyboard is written via
+--root), and with locale1 unreachable the storm cannot start. The o-tiling
+console.log hotfix remains correct on its own merits.
+
+Upstream: gnome-shell/gnome-desktop crash reproduced twice with different
+signals (SEGV in update_clock/g_settings_get_enum, then ABRT) — worth filing
+with both coredumps if masking confirms the trigger.
+
 ## Lessons
 
 - "Logout at end of install" had TWO distinct root causes months apart

live-env/src/build.sh

@@ -459,6 +459,21 @@ OVERRIDE
 # Recompile schemas in case the profile/installer added overrides.
 glib-compile-schemas /usr/share/glib-2.0/schemas || true
 
+# MASK systemd-localed in the LIVE env (2026-07-04 incident, part 3 — the
+# root trigger). During Anaconda's configuration phase its localization
+# tasks drive the LIVE system's locale1: the journal shows the X11 layout
+# flapping ('us' → '' → 'us' → '') seconds before gnome-shell dies — first
+# run SIGSEGV in update_clock/g_settings_get_enum (use-after-free under the
+# resulting GSettings change storm), re-test WITHOUT o-tiling SIGABRT at the
+# same phase. Shell dead on Wayland = whole session gone mid-install, and
+# anaconda (which stops when its WebUI viewer disappears) truncates the
+# %post chain — the broken-flatpaks-on-first-boot P0. localed is useless in
+# a throwaway live: in-session layout switching goes through gnome-shell's
+# input-sources (gsettings), not locale1, and the TARGET's keyboard config
+# is written via --root by anaconda. Mask (not disable: it's dbus-activated)
+# so the storm source cannot start at all.
+systemctl mask systemd-localed.service
+
 # Disable services that must not run inside the LIVE session. Margine is
 # Bluefin-DX-based, so it carries the ublue/brew/flatpak-preinstall units
 # plus rpm-ostree timers — all of which are meaningless (or harmful) in a