From 5e5ceae108d9b0e03e69cb6771d8ba264319c24b Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Sun, 1 Nov 2026 11:52:08 +0800
Subject: [PATCH] docs(nixpak): record slicer runtime validation

---
 hardening/README.md                   |  9 ++++++---
 hardening/tests/runtime-validation.md | 13 +++++++++++--
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/hardening/README.md b/hardening/README.md
index 9b6ea548..25e2e7c1 100644
--- a/hardening/README.md
+++ b/hardening/README.md
@@ -62,13 +62,16 @@ All browsers get read-only NSS certificates, printing, native notifications and
   XDG Camera/ScreenCast portal path used here, so granting camera or screen-capture access would
   require widening the sandbox with raw `/dev/video*` or direct PipeWire access. We choose not to
   grant that privilege.
+- Bambu Studio's nixpkgs build omits the `device_page` frontend bundle, so filament management is
+  unavailable. Its MakerWorld sidebar entry also requires the upstream `firstguide.finish = "true"`
+  workaround; the startup splash may render black under XWayland.
 
 ## Validation
 
 - Passed: `just fmt`, `just test`, `ai-niri` build, `shoukei-niri` eval and all wrapper builds.
-- Interactive validation passed for Firefox, Chrome, Chromium, Brave Origin, Edge, QQ, Telegram and
-  Zoom. Chromium's host-loopback/personal-file exception and the Brave/Edge no-media policy are
-  intentional.
+- Interactive validation passed for Firefox, Chrome, Chromium, Brave Origin, Edge, QQ, Telegram,
+  Zoom, Bambu Studio and OrcaSlicer. Chromium's host-loopback/personal-file exception and the
+  Brave/Edge no-media policy are intentional.
 - Chromium smoke test passed: renderer sandbox, environment clearing, bind scope, disposable-profile
   persistence and loopback policy.
 - WeChat uses the native nixpkgs-patched package with nixpak as the only bwrap layer. Build/policy
diff --git a/hardening/tests/runtime-validation.md b/hardening/tests/runtime-validation.md
index 105e9bcf..e354df91 100644
--- a/hardening/tests/runtime-validation.md
+++ b/hardening/tests/runtime-validation.md
@@ -24,8 +24,8 @@ Nixpak wrappers are accepted in three layers:
 | WeChat (native nixpak) | Pass         | Interactive Wayland validation pending                            |
 | Foliate                | Pass         | Interactive validation pending                                    |
 | Krita                  | Pass         | Interactive validation pending                                    |
-| Bambu Studio           | Pass         | Interactive validation pending                                    |
-| OrcaSlicer             | Pass         | Interactive validation pending                                    |
+| Bambu Studio           | Pass         | Interactive pass; device_page/filament UI unavailable in nixpkgs  |
+| OrcaSlicer             | Pass         | Interactive pass; blank WebKit home page fixed                    |
 
 Intentional exceptions:
 
@@ -37,6 +37,15 @@ Intentional exceptions:
   the XDG Camera/ScreenCast portal path used here, so enabling them would require granting raw video
   devices or the direct PipeWire socket. We deliberately do not grant those privileges.
 
+Known packaging limitations:
+
+- **Bambu Studio:** the nixpkgs build removes the `device_page` frontend build, so
+  `share/BambuStudio/web/device_page/dist` is missing and filament management cannot load.
+- **Bambu Studio:** the MakerWorld sidebar entry requires `firstguide.finish = "true"` in
+  `BambuStudio.conf`; the upstream guide writes `"1"` while the web-view code only accepts `"true"`.
+- **Bambu Studio:** the startup splash can render black under XWayland. This is cosmetic; the main
+  UI renders normally.
+
 ## Browser smoke test
 
 Build a wrapper from the locked inputs: