Getting closer. I switched the theme to Adwaita, same thing. However, restarting lightdm from a TTY before logging in let the “first” login succeed, so I’m back to thinking this is due to a “missing” $HOME when the service first starts (my $HOME is on a ZFS volume). This might be something to do with using DKMS for the ZFS kernel module.
Let’s try adding zfs to the initramfs modules…
Edit: nope, same thing. Let me try overriding lightdm.service's After.