Tell BitLocker users to decrypt, not suspend

The free-space install detects BitLocker by the -FVE-FS- signature at
offset 3, and suspending BitLocker leaves that signature in place: the
volume stays encrypted, it just gains a clear-key protector. So the old
message sent users to do something that could never let the install
proceed. Aborting on a suspended volume is deliberate, so only the
wording needed fixing.

Fixes #99

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

builder/build-iso.sh

@@ -117,7 +117,7 @@ cp "/tmp/$NODE_FILENAME" "$build_cache_dir/airootfs/opt/packages/"
 # The selected omarchy-settings package is needed here so its post_install hook
 # drops Omarchy's plymouthd.conf into /etc/plymouth before mkarchiso builds the
 # live initramfs.
-arch_packages=(linux-t2 git gum jq openssl plymouth ttfx tzupdate omarchy-keyring "$OMARCHY_SETTINGS_PACKAGE" lvm2 cryptsetup parted)
+arch_packages=(linux-t2 git gum jq openssl plymouth python-terminaltexteffects tzupdate omarchy-keyring "$OMARCHY_SETTINGS_PACKAGE" lvm2 cryptsetup parted)
 printf '%s\n' "${arch_packages[@]}" >> "$build_cache_dir/packages.x86_64"
 
 # The live ISO boots linux-t2 (see airootfs/etc/mkinitcpio.d/linux-t2.preset), so

configs/airootfs/etc/modprobe.d/blacklist-applesmc.conf

@@ -1,3 +0,0 @@
-# linux-t2 ships for every machine, and on a pre-T2 Mac its applesmc oopses
-# registering the keyboard-backlight LED, wedging udev. Nothing here needs the SMC.
-blacklist applesmc

configs/airootfs/root/configurator

@@ -121,42 +121,36 @@ greeter() {
 
   # ColorShift the logo: a green base (indexed color 2) with a cyan accent (6)
   # drifting through, settling on green. Indexed ANSI colors, not hex — the
-  # framebuffer console can't render truecolor faithfully (it crushes the
+  # framebuffer console can't render tte's truecolor faithfully (it crushes the
   # palette to a muddy lavender), but the 16 indexed colors map to the Tokyo
-  # Night palette and render true. --xterm-colors is what keeps them indexed:
+  # Night palette and render true. One long-running invocation (many cycles) so
-  # ttfx resolves even indexed stops to truecolor otherwise, which would put the
+  # it never restarts — a restart is what flashed. The effect reads from
-  # settle color out of step with the `gum style --foreground 2` logo underneath.
+  # /dev/null so it never swallows the Return; --reuse-canvas paints upward from
-  # One long-running invocation (many cycles) so it never restarts — a restart is
+  # the saved cursor, anchored one row below the logo.
-  # what flashed. The effect reads from /dev/null so it never swallows the
+  if command -v tte >/dev/null 2>&1; then
-  # Return; --reuse-canvas paints upward from the saved cursor, anchored one row
+    printf '\033[%d;1H\0337' "$((logo_row + logo_h))"
-  # below the logo.
+    # Run tte directly (not inside a `while` subshell) so $anim is tte's own
-  printf '\033[%d;1H\0337' "$((logo_row + logo_h))"
+    # PID: killing a wrapping subshell would orphan tte, which then keeps
-  # Run ttfx directly (not inside a `while` subshell) so $anim is ttfx's own
+    # painting the logo over the keyboard step. --cycles is high enough that it
-  # PID: killing a wrapping subshell would orphan ttfx, which then keeps
+    # never ends on its own before Return.
-  # painting the logo over the keyboard step. --cycles is high enough that it
+    tte -i "$LOGO_PATH" \
-  # never ends on its own before Return.
+      --canvas-width "$cols" \
-  # Two columns narrower than the console: ttfx centers its text two columns
+      --anchor-text c \
-  # right of plain centering, so a full-width canvas would sit the animated
+      --frame-rate 60 \
-  # logo a column off the gum-drawn one underneath it.
+      --reuse-canvas \
-  ttfx -i "$LOGO_PATH" \
+      colorshift \
-    --canvas-width "$((cols > 2 ? cols - 2 : cols))" \
+      --gradient-stops 2 10 6 10 \
-    --anchor-text c \
+      --gradient-frames 3 \
-    --frame-rate 60 \
+      --cycles 1000 \
-    --reuse-canvas \
+      --final-gradient-stops 2 \
-    --xterm-colors \
+      </dev/null >/dev/tty 2>/dev/null &
-    colorshift \
+    anim=$!
-    --gradient-stops 2 10 6 10 \
+  fi
-    --gradient-frames 3 \
-    --cycles 1000 \
-    --final-gradient-stops 2 \
-    </dev/null >/dev/tty 2>/dev/null &
-  anim=$!
 
   IFS= read -r _ </dev/tty || true
-  # Tolerate ttfx's kill signal in `wait` so a future `set -e` here can't abort.
+  # Tolerate tte's kill signal in `wait` so a future `set -e` here can't abort.
-  kill "$anim" 2>/dev/null
+  [[ -n ${anim:-} ]] && { kill "$anim" 2>/dev/null; wait "$anim" 2>/dev/null || true; }
-  wait "$anim" 2>/dev/null || true
+  # tte leaves the tty in raw/no-echo mode when killed; restore it or the gum
-  # ttfx leaves the tty in raw/no-echo mode when killed; restore it or the gum
   # prompts in the keyboard step that follows silently die.
   stty sane </dev/tty 2>/dev/null || true
   # Reset the screen so the leftover animation frame doesn't linger under the
@@ -193,16 +187,20 @@ notice() {
 # STEP 1: KEYBOARD LAYOUT
 
 keyboard_form() {
-  # Ctrl+C is the hidden entry into deferred provisioning, offered on every
+  # The Ctrl+C hint sits directly under the header (no blank line between),
-  # visit: the user step unwinds back here and nothing is on disk yet. Callers
+  # matching the disk-overwrite screen's unencrypted offer. Ctrl+C on the first
-  # re-check defer_provisioning after this returns.
+  # screen is the hidden entry into deferred provisioning; $1 is "true" only for that first
+  # invocation, so the review-loop re-edit can't flip a user install into it.
+  local allow_defer_provisioning="${1:-false}"
   local status
 
   while true; do
     clear_logo
     echo
     say "Let's setup your machine..."
-    say --foreground 8 "Press Ctrl+C to prepare this machine for another owner."
+    if $allow_defer_provisioning; then
+      say --foreground 8 "Press Ctrl+C to prepare this machine for another owner."
+    fi
     echo
 
     omarchy_prompt_keyboard && status=0 || status=$?
@@ -211,7 +209,7 @@ keyboard_form() {
     # Esc means "back", and nothing precedes the first screen, so re-ask.
     ((status == OMARCHY_FORM_BACK)) && continue
 
-    if ((status == OMARCHY_FORM_SIGNAL)); then
+    if $allow_defer_provisioning && ((status == OMARCHY_FORM_SIGNAL)); then
       if confirm_prepare_for_another_owner; then
         defer_provisioning=true
         return 0
@@ -262,8 +260,6 @@ user_form() {
   omarchy_prompt_timezone || return $?
 }
 
-# Returns 0 on confirmed account details, or as soon as the keyboard screen
-# arms deferred provisioning.
 user_step() {
   local status
 
@@ -275,7 +271,6 @@ user_step() {
       # keeps its long-standing behaviour of ending the install.
       ((status == OMARCHY_FORM_BACK)) || abort
       keyboard_form
-      $defer_provisioning && return 0
       continue
     fi
 
@@ -295,7 +290,6 @@ Keyboard,$keyboard" |
       break
     else
       keyboard_form
-      $defer_provisioning && return 0
     fi
   done
 }
@@ -938,7 +932,7 @@ confirm_disk_overwrite() {
 # Decide what and how to install: sets install_target (full_disk|free_space),
 # install_target and encrypt_installation. Nothing is written to disk yet —
 # the user step runs between this and the execution below. (deferred provisioning never
-# reaches here; it's armed by Ctrl+C on the keyboard screen and goes straight to
+# reaches here; it's armed by Ctrl+C on the first screen and goes straight to
 # disk selection.)
 select_installation() {
   local full_disk_only
@@ -992,14 +986,7 @@ wait_for_stable_terminal
 
 greeter
 
-keyboard_form
+keyboard_form true
-
-# Normal install: keyboard (loaded above, so the LUKS passphrase is typed under
-# the right layout) → user → disk → install mode. The user step can unwind to
-# the keyboard screen and arm deferral there, hence the second check.
-if ! $defer_provisioning; then
-  user_step
-fi
 
 if $defer_provisioning; then
   # Deferred provisioning: no user setup, and the keyboard is deferred to the machine's first
@@ -1025,6 +1012,10 @@ if $defer_provisioning; then
   done
   install_target="full_disk"
 else
+  # Normal install: keyboard (done above) → user → disk → install mode. The
+  # keyboard chosen above is already loaded, so the LUKS passphrase entered in
+  # the user step is typed under the right layout.
+  user_step
   disk_form
   select_installation
 fi

configs/airootfs/usr/local/bin/omarchy-install-dashboard

@@ -123,16 +123,7 @@ repeat() {
 
 logo_width() {
   if [[ -f $LOGO_PATH ]]; then
-    # The logo is drawn in box-drawing glyphs, three bytes each in UTF-8, so
+    awk '{ if (length > max) max = length } END { print max+0 }' "$LOGO_PATH"
-    # awk's `length` returns 197 rather than 81 unless the locale happens to be
-    # UTF-8 — and a width wider than the console makes left_padding clamp to
-    # zero, which puts the logo flush left. Count bytes deliberately (LC_ALL=C)
-    # and drop the continuation bytes instead, so the answer is columns in every
-    # locale rather than only in the ones that have a charset.
-    LC_ALL=C awk '
-      { gsub(/[\200-\277]/, ""); if (length > max) max = length }
-      END { print max+0 }
-    ' "$LOGO_PATH"
   else
     printf '81\n'
   fi
@@ -151,18 +142,8 @@ LOGO_HEIGHT="$(logo_height)"
 (( LOGO_WIDTH > 0 )) || LOGO_WIDTH=81
 (( LOGO_HEIGHT > 0 )) || LOGO_HEIGHT=1
 CONTENT_WIDTH="$LOGO_WIDTH"
-# Rows the progress screen occupies: logo, blank, title, blank, bar, blank, tip.
-PROGRESS_HEIGHT=$((LOGO_HEIGHT + 6))
-TOP_ROW=1
 DYNAMIC_ROW=$((LOGO_HEIGHT + 3))
-LAST_SIZE=""
 LAST_PM=10
-# The finish screen mirrors the greeter's frame — logo, blank, one line, gap,
-# one button — so the last thing the installer shows matches the first. It runs
-# one row taller: `gum confirm` always paints prompt/blank/button and clears all
-# three, so the button cannot sit closer than two rows under a title we drew.
-FINISH_HEIGHT=$((LOGO_HEIGHT + 5))
-FINISH_TOP_ROW=2
 
 # ── Install progress ─────────────────────────────────────────────────────────
 #
@@ -408,40 +389,15 @@ current_tip() {
   printf '%s' "${tips[$(( (NOW - DASH_T0) / 8 % ${#tips[@]} ))]}"
 }
 
-# Vertically center a block of the given height, echoing the row it starts on.
-# Both screens here center the way the configurator's greeter centers its
-# welcome, so the install opens, runs, and closes on the same composition
-# rather than stacking each frame from row one.
-centered_top_row() {
-  local height="$1" rows top
-  rows="$(term_size)"
-  rows="${rows%% *}"
-  [[ $rows =~ ^[0-9]+$ ]] || rows=24
-  top=$(( (rows - height) / 2 ))
-  (( top < 0 )) && top=0
-  printf '%d' "$(( top + 1 ))"
-}
-
-measure_progress_layout() {
-  LAST_SIZE="$(term_size)"
-  TOP_ROW="$(centered_top_row "$PROGRESS_HEIGHT")"
-  DYNAMIC_ROW=$(( TOP_ROW + LOGO_HEIGHT + 1 ))
-}
-
 render_static() {
-  measure_progress_layout
+  printf '%s' "$CLEAR"
-  printf '%s%s%d;1H' "$CLEAR" "$CSI" "$TOP_ROW"
+  blank_line
   render_logo
   blank_line
 }
 
 render_dynamic() {
   local pm
-  # The console can still resize under us (the framebuffer settles late in VMs).
-  # Horizontal padding is recomputed every frame anyway, but the logo is drawn
-  # once, so redraw the static half at the new center rather than leave the
-  # centered layout stranded against a stale geometry.
-  [[ "$(term_size)" == "$LAST_SIZE" ]] || render_static
   set_now
   install_progress
   pm=$PROGRESS_PM
@@ -496,45 +452,30 @@ render_finish() {
   local duration effect_canvas_width
   duration="$(install_duration || true)"
   duration="${duration:-Complete}"
-  # ttfx centers its text two columns right of plain centering, so hand it a
-  # canvas two columns narrower and the animated logo lands exactly on the
-  # static one left_padding already drew. Otherwise the logo jumps a column
-  # sideways when the effect starts and again when it ends.
   effect_canvas_width="$(term_cols)"
-  (( effect_canvas_width > 2 )) && effect_canvas_width=$((effect_canvas_width - 2))
+  (( effect_canvas_width > 1 )) && effect_canvas_width=$((effect_canvas_width - 1))
-
-  # Set before anything that can fail, so reboot_prompt still lands on the
-  # button row even if the logo or the effect below never renders.
-  FINISH_TOP_ROW="$(centered_top_row "$FINISH_HEIGHT")"
 
   {
-    printf '%s%s%s%d;1H' "$SHOW_CURSOR" "$CLEAR" "$CSI" "$FINISH_TOP_ROW"
+    printf '%s%s' "$SHOW_CURSOR" "$CLEAR"
+    blank_line
     render_logo
     blank_line
     center "Installed Omarchy in ${duration}" "$CONTENT_WIDTH"
     blank_line
   } >"$TTY_PATH"
 
-  if [[ -f $LOGO_PATH ]]; then
+  if command -v tte >/dev/null 2>&1 && command -v timeout >/dev/null 2>&1 && [[ -f $LOGO_PATH ]]; then
-    # Reuse mode restores a saved cursor before moving up over its input. Save
+    # TTE reuse mode restores a saved cursor before moving up over its input.
-    # this anchor so the effect redraws the same logo rows shown above.
+    # Save this anchor so the effect redraws the same logo rows shown above.
-    printf '%s%d;1H\0337' "$CSI" "$((FINISH_TOP_ROW + LOGO_HEIGHT))" >"$TTY_PATH"
+    printf '%s%d;1H\0337' "$CSI" "$((LOGO_HEIGHT + 2))" >"$TTY_PATH"
-    # Laseretch runs ~4s at 260fps, so the 8s cap is a stuck-process guard rather
+    timeout 8s tte -i "$LOGO_PATH" \
-    # than a trim. --xterm-colors keeps the whole effect in the 256-index palette
-    # the way the greeter does, since the console reduces indexed codes well and
-    # truecolor ones badly, and it settles on indexed 2 — the green gum already
-    # drew the logo in above, so the send-off ends on the frame it started from
-    # instead of recoloring it. The laser and sparks keep their own hot palette.
-    timeout 8s ttfx -i "$LOGO_PATH" \
       --canvas-width "$effect_canvas_width" \
       --anchor-text c \
       --frame-rate 260 \
       --reuse-canvas \
-      --xterm-colors \
       laseretch \
-      --final-gradient-stops 2 \
+      >"$TTY_PATH" 2>/dev/null || true
-      >"$TTY_PATH" 2>/dev/null || dashboard_log "logo effect skipped (ttfx exited $?)"
+    printf '%s%d;1H' "$CSI" "$((LOGO_HEIGHT + 8))" >"$TTY_PATH"
-    printf '%s%d;1H' "$CSI" "$((FINISH_TOP_ROW + LOGO_HEIGHT + 5))" >"$TTY_PATH"
   fi
 }
 
@@ -545,10 +486,8 @@ reboot_prompt() {
   # applies, so setting both stops on the finish screen without a keyboard.
   interactive || return 0
 
-  # gum paints its prompt row at the cursor and the button two rows under it, so
+  # Position the cursor one blank line below the title so the button sits right there.
-  # anchor on the row right below the title to put the button as close to it as
+  printf '%s%d;1H%s' "$CSI" "$((LOGO_HEIGHT + 5))" "$CLEAR_LINE" >"$TTY_PATH"
-  # gum allows. FINISH_HEIGHT budgets for the same three rows.
-  printf '%s%d;1H%s' "$CSI" "$((FINISH_TOP_ROW + LOGO_HEIGHT + 2))" "$CLEAR_LINE" >"$TTY_PATH"
 
   prompt_pad=$(( ( $(term_cols) - 18 ) / 2 ))
   (( prompt_pad < 0 )) && prompt_pad=0

configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py

@@ -11,7 +11,7 @@ Phase ordering (full-disk and protected/pre-mounted):
                              base install, early Omarchy packages, Limine setup,
                              useradd, runtime Omarchy packages, fstab
     configure_hibernation  → root-owned swap/resume drop-ins
-    run_system_finalizer   → arch-chroot root omarchy-apply-system, including Snapper
+    run_system_finalizer   → arch-chroot root omarchy-setup-system, including Snapper
     finalize_limine_boot   → final Limine config/UKI build after hardware drop-ins
     run_chroot_finalizer   → arch-chroot -u user omarchy-provision-user
     configure_login        → sddm state + encrypted-install autologin
@@ -598,7 +598,7 @@ DEFERRED_BOOT_HOOKS = (
 # limine-entry-tool's 90-mkinitcpio-install.hook triggers on usr/lib/firmware/*,
 # usr/src/*/dkms.conf and usr/lib/modules/*/pkgbase, and anything but a
 # usr/lib/modules path makes it rebuild the initramfs and UKI for EVERY
-# installed kernel. omarchy-apply-system's hardware scripts routinely install
+# installed kernel. omarchy-setup-system's hardware scripts routinely install
 # such packages (sof-firmware on Intel audio, nvidia-open-dkms, linux-ptl on
 # Panther Lake, linux-t2 on Macs), so the phase can pay for several full UKI
 # builds. finalize_limine_boot runs limine-update right after, which pipes
@@ -1005,7 +1005,7 @@ def _debug_run(ctx: InstallContext, cmd: list[str]) -> None:
 #  1. point the target at the offline pacman.conf
 #  2. bind-mount the offline mirror + /opt/packages into /mnt for target pacman
 #     and bundled language runtimes
-#  3. arch-chroot as root → omarchy-apply-system --first-install
+#  3. arch-chroot as root → omarchy-setup-system --first-install
 #  4. arch-chroot as user → omarchy-provision-user --first-install
 # ─────────────────────────────────────────────────────────────────────────────
 
@@ -1137,9 +1137,9 @@ def _run_target_setup_command(ctx: InstallContext, cmd: list[str], *, user: str
 
 def run_system_finalizer(ctx: InstallContext) -> None:
     if ctx.defer_provisioning:
-        cmd = ["/usr/bin/omarchy-apply-system", "--defer-provisioning", "--first-install"]
+        cmd = ["/usr/bin/omarchy-setup-system", "--defer-provisioning", "--first-install"]
     else:
-        cmd = ["/usr/bin/omarchy-apply-system", "--install-user", ctx.username, "--first-install"]
+        cmd = ["/usr/bin/omarchy-setup-system", "--install-user", ctx.username, "--first-install"]
 
     _mask_mkinitcpio_pacman_hooks(ctx, ctx.target, TARGET_DEFERRED_BOOT_HOOKS)
     try: