Point the rc ISO's [omarchy] repo at the rc channel

The Arch base repos already come from rc-mirror.omarchy.org, but
[omarchy] still pointed at edge — a leftover from when release
candidates published there. RCs now publish to the dedicated rc
channel on pkgs.omarchy.org, so an rc ISO built against edge would
install the previous release instead of the candidate.

.gitignore

@@ -1 +1,2 @@
 release/**
+vm-saves/**

README.md

@@ -1,21 +1,19 @@
 # Omarchy ISO
 
-The Omarchy ISO streamlines [the installation of Omarchy](https://learn.omacom.io/2/the-omarchy-manual/50/getting-started). It includes the [Omarchy Configurator](https://github.com/omacom-io/omarchy-configurator) as a front-end to archinstall and automatically launches the [Omarchy Installer](https://github.com/basecamp/omarchy) after base arch has been setup.
+The Omarchy ISO streamlines [the installation of Omarchy](https://learn.omacom.io/2/the-omarchy-manual/50/getting-started). It includes the Omarchy Configurator as a front-end to archinstall and automatically launches the [Omarchy Installer](https://github.com/basecamp/omarchy) after base arch has been setup.
 
 ## Downloading the latest ISO
 
-[Download Omarchy Online ISO](https://iso.omarchy.org/omarchy-online.iso) (1.4GB)
+See the ISO link on [omarchy.org](https://omarchy.org).
 
 ## Creating the ISO
 
-Run `./bin/omarchy-iso-make` and the output goes into `./release`.
+Run `./bin/omarchy-iso-make` and the output goes into `./release`. You can build from your local `$OMARCHY_PATH` for testing with `--local-source`, from the dev branch with `--dev`, or from the quattro branch with `--quattro`. The dev and quattro builds use the edge package mirror.
 
 ### Environment Variables
 
 You can customize the repositories used during the build process by passing in variables:
 
-- `OMARCHY_CONFIGURATOR_REPO` - GitHub repository for the configurator (default: `omacom-io/omarchy-configurator`)
-- `OMARCHY_CONFIGURATOR_REF` - Git ref (branch/tag) for the configurator (default: `master`)
 - `OMARCHY_INSTALLER_REPO` - GitHub repository for the installer (default: `basecamp/omarchy`)
 - `OMARCHY_INSTALLER_REF` - Git ref (branch/tag) for the installer (default: `master`)
 
@@ -30,7 +28,7 @@ Run `./bin/omarchy-iso-boot [release/omarchy.iso]`.
 
 ## Signing the ISO
 
-Run `./bin/omarchy-iso-sign [gpg-user] [release/omarchy.iso]`.
+Run `./bin/omarchy-iso-sign [release/omarchy.iso]`. The signing key is retrieved from the shared Omarchy vault with the 1Password CLI.
 
 ## Uploading the ISO
 
@@ -38,4 +36,4 @@ Run `./bin/omarchy-iso-upload [release/omarchy.iso]`. This requires you've confi
 
 ## Full release of the ISO
 
-Run `./bin/omarchy-iso-make` to create, test, sign, and upload the ISO in one flow.
+Run `./bin/omarchy-iso-release VERSION` to create, test, sign, and upload the ISO in one flow. Add `--rc` to release an RC build instead.

bin/omarchy-iso-boot

@@ -2,18 +2,43 @@
 
 set -e
 
+ISO="$1"
+REUSE="$2"
+
 if [ $# -eq 0 ]; then
+  ISO=$(ls -t release/*.iso 2>/dev/null | gum choose --header "Select ISO to boot")
+  if gum confirm --default=false "Reuse existing disk?"; then
+    REUSE="reuse"
+  fi
+fi
+
+if [ -z "$ISO" ]; then
   echo "Usage: omarchy-iso-boot [release/omarchy.iso] [reuse]"
+  echo "  SSH available at: ssh -p 2222 root@localhost (after installing openssh)"
   exit 1
 fi
 
-if ! pacman -Q qemu-full >/dev/null || ! pacman -Q edk2-ovmf >/dev/null; then
-  sudo pacman -S --noconfirm --needed --quiet qemu-full edk2-ovmf
+omarchy-pkg-add qemu-full edk2-ovmf
+
+if [[ -z ${WAYLAND_DISPLAY:-} && -z ${DISPLAY:-} ]]; then
+  while IFS='=' read -r name value; do
+    case "$name" in
+      WAYLAND_DISPLAY|DISPLAY|XAUTHORITY|XDG_SESSION_TYPE)
+        export "$name=$value"
+        ;;
+    esac
+  done < <(systemctl --user show-environment 2>/dev/null || true)
+fi
+
+if [[ -z ${WAYLAND_DISPLAY:-} && -z ${DISPLAY:-} ]]; then
+  echo "Unable to find a graphical session for QEMU." >&2
+  echo "Run omarchy-iso-boot from the Omarchy desktop session." >&2
+  exit 1
 fi
 
 DISK="/tmp/omarchy-iso-boot.qcow2"
-if [[ ! -f $DISK || $2 != "reuse" ]]; then
-  qemu-img create -f qcow2 "$DISK" 20G
+if [[ ! -f $DISK || $REUSE != "reuse" ]]; then
+  qemu-img create -f qcow2 "$DISK" 40G
   cp /usr/share/edk2/x64/OVMF_VARS.4m.fd /tmp/OVMF_VARS.4m.fd
 fi
 
@@ -26,10 +51,11 @@ qemu-system-x86_64 \
   -drive if=pflash,format=raw,file=/tmp/OVMF_VARS.4m.fd \
   -drive file="$DISK",format=qcow2,if=none,id=drive0 \
   -device virtio-blk-pci,drive=drive0,bootindex=1 \
-  -drive file="$1",media=cdrom,if=none,format=raw,id=cdrom0 \
+  -drive file="$ISO",media=cdrom,if=none,format=raw,id=cdrom0 \
   -device ide-cd,drive=cdrom0,bootindex=2 \
   -device virtio-vga-gl \
-  -display gtk,gl=on \
+  -display sdl,gl=on \
   -usb -device usb-tablet \
-  -netdev user,id=net0 \
-  -device virtio-net-pci,netdev=net0
+  -netdev user,id=net0,hostfwd=tcp::2222-:22 \
+  -device virtio-net-pci,netdev=net0 \
+  -boot menu=on

bin/omarchy-iso-configurator

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+cleanup() {
+  [[ -n "${mock_omarchy_install:-}" ]] && rm -rf "$(dirname "$mock_omarchy_install")"
+}
+trap cleanup EXIT
+
+if [[ -z "${OMARCHY_INSTALL:-}" ]]; then
+  if [[ -r /root/omarchy/install/helpers/all.sh ]]; then
+    export OMARCHY_INSTALL=/root/omarchy/install
+  else
+    mock_root="$(mktemp -d)"
+    mock_omarchy_install="$mock_root/install"
+    mkdir -p "$mock_omarchy_install/helpers"
+    cat >"$mock_omarchy_install/helpers/all.sh" <<'EOF'
+PADDING_LEFT=0
+PADDING_LEFT_SPACES=""
+clear_logo() { clear; }
+EOF
+    export OMARCHY_INSTALL="$mock_omarchy_install"
+  fi
+fi
+
+exec bash "$repo_root/configs/airootfs/root/configurator" dry "$@"

bin/omarchy-iso-make

@@ -4,18 +4,9 @@
 set -e
 
 # Parse command line arguments
-BUILD_MODE="offline"
 NO_CACHE=""
 while [[ $# -gt 0 ]]; do
   case $1 in
-  --online)
-    BUILD_MODE="online"
-    shift
-    ;;
-  --offline)
-    BUILD_MODE="offline"
-    shift
-    ;;
   --no-cache)
     NO_CACHE=1
     shift
@@ -24,14 +15,37 @@ while [[ $# -gt 0 ]]; do
     NO_BOOT_OFFER=1
     shift
     ;;
+  --local-source)
+    LOCAL_SOURCE=1
+    OMARCHY_MIRROR=edge
+    shift
+    ;;
+  --dev)
+    OMARCHY_INSTALLER_REF=dev
+    OMARCHY_MIRROR=edge
+    shift
+    ;;
+  --quattro)
+    OMARCHY_INSTALLER_REF=quattro
+    OMARCHY_MIRROR=edge
+    shift
+    ;;
+  --rc)
+    OMARCHY_MIRROR=rc
+    OMARCHY_INSTALLER_REF=rc
+    shift
+    ;;
   *)
     echo "Unknown option: $1"
-    echo "Usage: $0 [--online|--offline] [--no-cache] [--no-boot-offer]"
+    echo "Usage: $0 [--no-cache] [--no-boot-offer] [--local-source] [--dev] [--quattro] [--rc]"
     exit 1
     ;;
   esac
 done
 
+# Clear out old packages
+sudo rm -rf /var/cache/pacman/pkg/*
+
 # Ensure we have the submodule checked out
 git submodule update --init --recursive --jobs=8
 
@@ -41,22 +55,18 @@ BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
 BUILD_RELEASE_PATH="$BUILD_ROOT/release"
 mkdir -p "$BUILD_RELEASE_PATH"
 
-OMARCHY_CONFIGURATOR_REPO="${OMARCHY_CONFIGURATOR_REPO:-omacom-io/omarchy-configurator}"
-OMARCHY_CONFIGURATOR_REF="${OMARCHY_CONFIGURATOR_REF:-master}"
-
 OMARCHY_INSTALLER_REPO="${OMARCHY_INSTALLER_REPO:-basecamp/omarchy}"
 OMARCHY_INSTALLER_REF="${OMARCHY_INSTALLER_REF:-master}"
-OMARCHY_INSTALLER_URL="${OMARCHY_INSTALLER_URL:-https://omarchy.org/install}"
+OMARCHY_MIRROR="${OMARCHY_MIRROR:-stable}"
 
 DOCKER_ARGS=(
   --rm
   --privileged
-  -e "OMARCHY_CONFIGURATOR_REPO=$OMARCHY_CONFIGURATOR_REPO"
-  -e "OMARCHY_CONFIGURATOR_REF=$OMARCHY_CONFIGURATOR_REF"
   -e "OMARCHY_INSTALLER_REPO=$OMARCHY_INSTALLER_REPO"
   -e "OMARCHY_INSTALLER_REF=$OMARCHY_INSTALLER_REF"
-  -e "OMARCHY_INSTALLER_URL=$OMARCHY_INSTALLER_URL"
-  -e "OMARCHY_BUILD_MODE=$BUILD_MODE"
+  -e "OMARCHY_MIRROR=$OMARCHY_MIRROR"
+  -e "HOST_UID=$(id -u)"
+  -e "HOST_GID=$(id -g)"
   -v "$BUILD_RELEASE_PATH/:/out/"
   -v "$BUILD_ROOT/$BUILD_SCRIPT:/$BUILD_SCRIPT:ro"
   -v "$BUILD_ROOT/archiso:/archiso:ro"
@@ -64,17 +74,20 @@ DOCKER_ARGS=(
   -v "$BUILD_ROOT/configs:/configs:ro"
 )
 
+# Use local source of Omarchy from $OMARCHY_PATH instead of git checkout
+if [[ -n "${LOCAL_SOURCE-}" ]]; then
+  DOCKER_ARGS+=(-v "$OMARCHY_PATH:/omarchy:ro")
+fi
+
 # Use local pacman cache if you already have one on host to speed up repeat runs
 if [ -d "/var/cache/pacman/pkg" ]; then
   DOCKER_ARGS+=(-v "/var/cache/pacman/pkg:/var/cache/pacman/pkg")
 fi
 
-# Mount the build cache directory where packages are downloaded for the offline repo
-# Only applicable for offline builds and when --no-cache is not specified
-if [[ "$BUILD_MODE" == "offline" && -z "$NO_CACHE" ]]; then
-  # using a dated dir on the host to refresh daily if building multiple times
-  BUILD_DATE=$(date +%Y-%m-%d)
-  OFFLINE_REPO_BUILD_CACHE_DIR="$HOME/.cache/omarchy/iso_${BUILD_DATE}/airootfs/var/cache/omarchy"
+# Mount the build cache directory where packages are downloaded. Channels use
+# different package snapshots and must never share an offline mirror cache.
+if [[ -z "$NO_CACHE" ]]; then
+  OFFLINE_REPO_BUILD_CACHE_DIR="$HOME/.cache/omarchy/iso_${OMARCHY_MIRROR}/airootfs/var/cache/omarchy"
   mkdir -p "$OFFLINE_REPO_BUILD_CACHE_DIR"
   # Mount to /var/cache/airootfs/var/cache/omarchy since that's where repo packages go in the ISO
   DOCKER_ARGS+=(-v "$OFFLINE_REPO_BUILD_CACHE_DIR:/var/cache/airootfs/var/cache/omarchy")

bin/omarchy-iso-make-dev

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-OMARCHY_INSTALLER_REF=dev \
-  OMARCHY_INSTALL_URL=https://omarchy.org/install-dev \
-  omarchy-iso-make

bin/omarchy-iso-rclone-config

@@ -0,0 +1,16 @@
+#!/bin/bash
+omarchy-pkg-add rclone
+mkdir -p ~/.config/rclone
+
+access_key=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/access_key_id" --account Omarchy)
+secret_access_key=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/secret_access_key" --account Omarchy)
+endpoint=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/endpoint" --account Omarchy)
+
+cat > ~/.config/rclone/rclone.conf << EOF
+[Omarchy]
+type = s3
+provider = Cloudflare
+access_key_id = $access_key
+secret_access_key = $secret_access_key
+endpoint = $endpoint
+EOF

bin/omarchy-iso-release

@@ -1,30 +1,62 @@
 #!/bin/bash
 
+MAKE_ARGS=()
+INSTALLER_REF=master
+RELEASE_SUFFIX=""
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+  --no-make)
+    MAKE_ARGS+=("$1")
+    shift
+    ;;
+  --rc)
+    MAKE_ARGS+=("$1")
+    INSTALLER_REF=rc
+    RELEASE_SUFFIX="-rc"
+    shift
+    ;;
+  -*)
+    echo "Unknown option: $1"
+    echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
+    exit 1
+    ;;
+  *)
+    if [[ -n "${BUILD_VERSION-}" ]]; then
+      echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
+      exit 1
+    fi
+    BUILD_VERSION="$1"
+    shift
+    ;;
+  esac
+done
+
+if [[ -z "${BUILD_VERSION-}" ]]; then
+  echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
+  exit 1
+fi
+
 BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
 BUILD_RELEASE_PATH="$BUILD_ROOT/release"
 
 # Make ISOs
-if [[ $1 != "--no-make" ]]; then
-  echo -e "\e[32mMaking master ISO\e[0m"
-  OMARCHY_INSTALLER_REF=master omarchy-iso-make --no-boot-offer
-  echo -e "\e[32m\nMaking dev ISO\e[0m"
-  OMARCHY_INSTALLER_REF=dev OMARCHY_INSTALL_URL=https://omarchy.org/install-dev omarchy-iso-make --no-boot-offer
+if [[ ! " ${MAKE_ARGS[*]} " =~ " --no-make " ]]; then
+  echo -e "\e[32mMaking $INSTALLER_REF ISO\e[0m"
+  omarchy-iso-make --no-cache --no-boot-offer "${MAKE_ARGS[@]}"
 else
   echo -e "\e[31mSkipping remaking ISOs\e[0m"
 fi
 
-# Sign and upload master ISO
-latest_master_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-master.iso | head -n1)
-release_master_iso="$BUILD_RELEASE_PATH/omarchy-online.iso"
-cp "$latest_master_iso" "$release_master_iso"
-echo -e "\e[32mSigning master ISO\e[0m"
-omarchy-iso-sign "$release_master_iso"
-omarchy-iso-upload "$release_master_iso"
+# Sign and upload ISO
+latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-"$INSTALLER_REF".iso | head -n1)
+release_iso="$BUILD_RELEASE_PATH/omarchy-$BUILD_VERSION$RELEASE_SUFFIX.iso"
+cp "$latest_iso" "$release_iso"
 
-# Sign and upload dev ISO
-latest_dev_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-dev.iso | head -n1)
-release_dev_iso="$BUILD_RELEASE_PATH/omarchy-online-dev.iso"
-cp "$latest_dev_iso" "$release_dev_iso"
-echo -e "\e[32mSigning dev ISO\e[0m"
-omarchy-iso-sign "$release_dev_iso"
-omarchy-iso-upload "$release_dev_iso"
+echo -e "\e[32mSigning $INSTALLER_REF ISO\e[0m"
+omarchy-iso-sign "$release_iso"
+
+iso_sha=$(sha256sum "$release_iso")
+echo -e "\e[32mSHA256 for $INSTALLER_REF ISO: $iso_sha\e[0m"
+
+omarchy-iso-upload "$release_iso"

bin/omarchy-iso-sign

@@ -1,14 +1,48 @@
 #!/bin/bash
 
-if [ $# -eq 0 ]; then
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
   echo "usage: omarchy-iso-sign [release/omarchy.iso]"
   exit 1
 fi
 
-if ! pacman -Q gnupg >/dev/null; then
-  sudo pacman -s --noconfirm --needed --quiet gnupg
-  echo "you'll need to generate a new key with: gpg --full-generate-key"
+iso="$1"
+key_ref="op://Shared/Omarchy GPG Private Key/omarchy-private.asc"
+
+if [[ ! -f $iso ]]; then
+  echo "ISO not found: $iso" >&2
+  exit 1
 fi
 
-gnupg_user_key=$(gpg --list-secret-keys --keyid-format=long | awk '/^[[:space:]]/{print $1; exit}')
-gpg --local-user "$gnupg_user_key" --output $1.sig --detach-sig $1
+if ! command -v op >/dev/null; then
+  echo "1Password CLI is required to retrieve the signing key." >&2
+  exit 1
+fi
+
+if ! pacman -Q gnupg >/dev/null 2>&1; then
+  sudo pacman -S --noconfirm --needed --quiet gnupg
+fi
+
+gnupg_home="$(mktemp -d)"
+chmod 700 "$gnupg_home"
+trap 'rm -rf "$gnupg_home"' EXIT
+
+op read "$key_ref" --account Omarchy |
+  gpg --batch --homedir "$gnupg_home" --import >/dev/null
+
+signing_key="$(
+  gpg --batch --homedir "$gnupg_home" --with-colons --list-secret-keys |
+    awk -F: '$1 == "fpr" { print $10; exit }'
+)"
+
+if [[ -z $signing_key ]]; then
+  echo "No private signing key found in $key_ref" >&2
+  exit 1
+fi
+
+gpg --batch --yes \
+  --homedir "$gnupg_home" \
+  --local-user "$signing_key" \
+  --output "$iso.sig" \
+  --detach-sig "$iso"

bin/omarchy-iso-upload

@@ -6,9 +6,12 @@ if [ $# -eq 0 ]; then
 fi
 
 if [[ ! -f ~/.config/rclone/rclone.conf ]]; then
-  echo "You must first configure rclone with the R2 credentials: rclone config"
+  echo "You must first configure rclone with the R2 credentials: omarchy-iso-rclone-config"
   exit 1
 fi
 
 rclone copy $1 Omarchy:omarchy/ -P
-rclone copy $1.sig Omarchy:omarchy/ -P
+
+if [[ -f $1.sig ]]; then
+  rclone copy $1.sig Omarchy:omarchy/ -P
+fi

bin/omarchy-vm

@@ -0,0 +1,111 @@
+#!/bin/bash
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+VM_DIR="$(dirname "$SCRIPT_DIR")/vm-saves"
+TMP_DISK="/tmp/omarchy-iso-boot.qcow2"
+TMP_OVMF="/tmp/OVMF_VARS.4m.fd"
+
+mkdir -p "$VM_DIR"
+
+save_vm() {
+  local name="$1"
+
+  if [[ -z "$name" ]]; then
+    name=$(gum input --placeholder "Enter VM snapshot name")
+    [[ -z "$name" ]] && exit 1
+  fi
+
+  if [[ ! -f "$TMP_DISK" || ! -f "$TMP_OVMF" ]]; then
+    echo "Error: No active VM found in /tmp"
+    echo "Boot a VM first with: omarchy-iso-boot [iso]"
+    exit 1
+  fi
+
+  local vm_path="$VM_DIR/$name"
+
+  if [[ -d "$vm_path" ]]; then
+    if ! gum confirm "VM '$name' exists. Overwrite?"; then
+      exit 0
+    fi
+  fi
+
+  mkdir -p "$vm_path"
+
+  echo "Saving VM snapshot '$name'..."
+  cp "$TMP_DISK" "$vm_path/omarchy-iso-boot.qcow2"
+  cp "$TMP_OVMF" "$vm_path/OVMF_VARS.4m.fd"
+
+  gum style --foreground 212 "✓ Saved to $vm_path"
+}
+
+list_vms() {
+  if [[ ! -d "$VM_DIR" ]] || [[ -z "$(ls -A "$VM_DIR")" ]]; then
+    echo "No VM snapshots found"
+    return 1
+  fi
+
+  echo "Available VM snapshots:"
+  for vm in "$VM_DIR"/*; do
+    [[ -d "$vm" ]] && echo "  • $(basename "$vm")"
+  done
+}
+
+boot_vm() {
+  local name="$1"
+
+  if [[ -z "$(ls -A "$VM_DIR" 2>/dev/null)" ]]; then
+    echo "No VM snapshots available"
+    exit 1
+  fi
+
+  if [[ -z "$name" ]]; then
+    name=$(ls -1 "$VM_DIR" | gum choose --header "Select VM to boot:")
+    [[ -z "$name" ]] && exit 0
+  fi
+
+  local vm_path="$VM_DIR/$name"
+
+  if [[ ! -d "$vm_path" ]]; then
+    echo "Error: VM '$name' not found"
+    list_vms
+    exit 1
+  fi
+
+  if [[ -f "$TMP_DISK" ]] && ! gum confirm "Override existing /tmp VM?"; then
+    exit 0
+  fi
+
+  echo "Copying VM '$name' to /tmp..."
+  cp "$vm_path/omarchy-iso-boot.qcow2" "$TMP_DISK"
+  cp "$vm_path/OVMF_VARS.4m.fd" "$TMP_OVMF"
+
+  gum style --foreground 212 "✓ VM ready. Booting..."
+
+  exec omarchy-iso-boot /dev/null reuse
+}
+
+case "${1:-}" in
+  save)
+    save_vm "$2"
+    ;;
+  boot)
+    boot_vm "$2"
+    ;;
+  list)
+    list_vms
+    ;;
+  *)
+    gum style --border rounded --padding "0 1" --border-foreground 212 \
+      "$(gum style --bold 'omarchy-vm') - VM snapshot manager" \
+      "" \
+      "$(gum style --foreground 245 'Commands:')" \
+      "  save [name]  Save current VM from /tmp" \
+      "  boot [name]  Boot saved VM (interactive if no name)" \
+      "  list         List available VMs" \
+      "" \
+      "$(gum style --foreground 245 'Current VMs:')"
+    list_vms 2>/dev/null || echo "  None"
+    ;;
+esac

builder/archinstall.packages

@@ -0,0 +1,14 @@
+alsa-firmware
+amd-ucode
+base
+base-devel
+efibootmgr
+intel-ucode
+linux-firmware
+linux
+limine
+omarchy-keyring
+openssh
+pipewire
+snapper
+sof-firmware

builder/build-iso.sh

@@ -2,98 +2,46 @@
 
 set -e
 
-# Build mode: offline (default) or online                                                                                                         │ │
-OMARCHY_BUILD_MODE="${OMARCHY_BUILD_MODE:-offline}"
-
-# Note that these are packages installed to the Arch container
-# used to build the ISO.
+# Note that these are packages installed to the Arch container used to build the ISO.
 pacman-key --init
 pacman --noconfirm -Sy archlinux-keyring
-pacman --noconfirm -Sy archiso git python-pip sudo base-devel jq
+pacman --noconfirm -Sy archiso git sudo base-devel jq grub
 
+# Pre-import the omarchy signing key so pacman can verify packages without a keyserver lookup
+pacman-key --add /builder/omarchy.gpg
+pacman-key --lsign-key 40DFB630FF42BCFFB047046CF0134EE680CAC571
+
+# Install omarchy-keyring for package verification during build
+pacman --config /configs/pacman-online-${OMARCHY_MIRROR}.conf --noconfirm -Sy omarchy-keyring
+pacman-key --populate omarchy
+
+# Setup build locations
 build_cache_dir="/var/cache"
 offline_mirror_dir="$build_cache_dir/airootfs/var/cache/omarchy/mirror/offline"
-offline_ruby_dir="$build_cache_dir/airootfs/var/cache/omarchy/ruby"
-
-# We need to fiddle with pip settings
-# in order to install to the correct place
-# as well as ignore some errors to make this less verbose
-export PIP_ROOT="$build_cache_dir/airootfs/"
-export PIP_ROOT_USER_ACTION="ignore"
-export PIP_NO_WARN_SCRIPT_LOCATION=1
-export PIP_BREAK_SYSTEM_PACKAGES=1
-
-# These packages will be installed **into** the ISO, and
-# won't be available to either archinstall or omarchy installer.
-python_packages=(
-  terminaltexteffects
-)
-arch_packages=(
-  git
-  gum
-  jq
-  openssl
-  plymouth
-  tzupdate # This is technically an AUR package
-)
-
-prepare_offline_mirror() {
-  # Certain packages in omarchy.packages are AUR packages.
-  # These needs to be pre-built and placed in https://pkgs.omarchy.org/$arch
-  echo "Reading and combining packages from all package files..."
-
-  # Combine all packages into one array
-  # Start with base ISO packages (including our arch_packages already appended)
-  all_packages=($(cat "$build_cache_dir/packages.x86_64"))
-
-  # Add packages from the omarchy installer's unified package list
-  all_packages+=($(grep -v '^#' "$build_cache_dir/airootfs/root/omarchy/install/omarchy-base.packages" | grep -v '^$'))
-  all_packages+=($(grep -v '^#' "$build_cache_dir/airootfs/root/omarchy/install/omarchy-other.packages" | grep -v '^$'))
-
-  # Add archinstall needed packages
-  all_packages+=($(grep -v '^#' /builder/packages/archinstall.packages | grep -v '^$'))
-
-  if [ ${#all_packages[@]} -gt 0 ]; then
-    mkdir -p /tmp/offlinedb
-
-    # Download all the packages to the offline mirror inside the ISO
-    echo "Downloading all packages (including AUR) to offline mirror: ${all_packages[@]}"
-    pacman --config /configs/pacman-online.conf \
-      --noconfirm -Syw "${all_packages[@]}" \
-      --cachedir $offline_mirror_dir/ \
-      --dbpath /tmp/offlinedb
-
-    repo-add --new "$offline_mirror_dir/offline.db.tar.gz" "$offline_mirror_dir/"*.pkg.tar.zst
-
-    rm "$build_cache_dir/airootfs/etc/pacman.d/hooks/uncomment-mirrors.hook"
-  fi
-}
-
-disable_reflector() {
-  # Avoid using reflector for mirror identification as we are relying on the global CDN
-  rm "$build_cache_dir/airootfs/etc/systemd/system/multi-user.target.wants/reflector.service"
-  rm -rf "$build_cache_dir/airootfs/etc/systemd/system/reflector.service.d"
-  rm -rf "$build_cache_dir/airootfs/etc/xdg/reflector"
-}
-
-#######################
-# Build process start
-#######################
-
 mkdir -p $build_cache_dir/
 mkdir -p $offline_mirror_dir/
-mkdir -p $offline_ruby_dir/
 
 # We base our ISO on the official arch ISO (releng) config
 cp -r /archiso/configs/releng/* $build_cache_dir/
 rm "$build_cache_dir/airootfs/etc/motd"
-disable_reflector
+
+# Avoid using reflector for mirror identification as we are relying on the global CDN
+rm -rf "$build_cache_dir/airootfs/etc/systemd/system/multi-user.target.wants/reflector.service"
+rm -rf "$build_cache_dir/airootfs/etc/systemd/system/reflector.service.d"
+rm -rf "$build_cache_dir/airootfs/etc/xdg/reflector"
 
 # Bring in our configs
 cp -r /configs/* $build_cache_dir/
 
-# Clone Omarchy itself
-git clone -b $OMARCHY_INSTALLER_REF https://github.com/$OMARCHY_INSTALLER_REPO.git "$build_cache_dir/airootfs/root/omarchy"
+# Persist OMARCHY_MIRROR so it's available at install time
+echo "$OMARCHY_MIRROR" > "$build_cache_dir/airootfs/root/omarchy_mirror"
+
+# Setup Omarchy itself
+if [[ -d /omarchy ]]; then
+  cp -rp /omarchy "$build_cache_dir/airootfs/root/omarchy"
+else
+  git clone -b $OMARCHY_INSTALLER_REF https://github.com/$OMARCHY_INSTALLER_REPO.git "$build_cache_dir/airootfs/root/omarchy"
+fi
 
 # Make log uploader available in the ISO too
 mkdir -p "$build_cache_dir/airootfs/usr/local/bin/"
@@ -103,55 +51,56 @@ cp "$build_cache_dir/airootfs/root/omarchy/bin/omarchy-upload-log" "$build_cache
 mkdir -p "$build_cache_dir/airootfs/usr/share/plymouth/themes/omarchy"
 cp -r "$build_cache_dir/airootfs/root/omarchy/default/plymouth/"* "$build_cache_dir/airootfs/usr/share/plymouth/themes/omarchy/"
 
-# Download the configurator
-mkdir -p "$build_cache_dir/airootfs/root"
-curl -fsSL -o "$build_cache_dir/airootfs/root/configurator" \
-  "https://raw.githubusercontent.com/$OMARCHY_CONFIGURATOR_REPO/$OMARCHY_CONFIGURATOR_REF/configurator"
+# Download and verify Node.js binary for offline installation
+NODE_DIST_URL="https://nodejs.org/dist/latest"
 
-if [ "$OMARCHY_BUILD_MODE" = "online" ]; then
-  echo "$OMARCHY_INSTALLER_REPO" >$build_cache_dir/airootfs/root/omarchy_installer_repo.txt
-  echo "$OMARCHY_INSTALLER_REF" >$build_cache_dir/airootfs/root/omarchy_installer_ref.txt
-  echo "$OMARCHY_INSTALLER_URL" >$build_cache_dir/airootfs/root/omarchy_installer_url.txt
-  echo "online" >$build_cache_dir/airootfs/root/omarchy_install_mode.txt
-else
-  echo "offline" >$build_cache_dir/airootfs/root/omarchy_install_mode.txt
-fi
+# Get checksums and parse filename and SHA
+NODE_SHASUMS=$(curl -fsSL "$NODE_DIST_URL/SHASUMS256.txt")
+NODE_FILENAME=$(echo "$NODE_SHASUMS" | grep "linux-x64.tar.gz" | awk '{print $2}')
+NODE_SHA=$(echo "$NODE_SHASUMS" | grep "linux-x64.tar.gz" | awk '{print $1}')
+
+# Download the tarball
+curl -fsSL "$NODE_DIST_URL/$NODE_FILENAME" -o "/tmp/$NODE_FILENAME"
+
+# Verify SHA256 checksum
+echo "$NODE_SHA /tmp/$NODE_FILENAME" | sha256sum -c - || {
+    echo "ERROR: Node.js checksum verification failed!"
+    exit 1
+}
+
+# Copy to ISO
+mkdir -p "$build_cache_dir/airootfs/opt/packages/"
+cp "/tmp/$NODE_FILENAME" "$build_cache_dir/airootfs/opt/packages/"
 
 # Add our additional packages to packages.x86_64
+arch_packages=(linux-t2 git gum jq openssl plymouth tzupdate omarchy-keyring lvm2 cryptsetup parted)
 printf '%s\n' "${arch_packages[@]}" >>"$build_cache_dir/packages.x86_64"
 
-if [ "$OMARCHY_BUILD_MODE" = "offline" ]; then
-  prepare_offline_mirror
+# Build list of all the packages needed for the offline mirror
+all_packages=($(cat "$build_cache_dir/packages.x86_64"))
+all_packages+=($(grep -v '^#' "$build_cache_dir/airootfs/root/omarchy/install/omarchy-base.packages" | grep -v '^$'))
+all_packages+=($(grep -v '^#' "$build_cache_dir/airootfs/root/omarchy/install/omarchy-other.packages" | grep -v '^$'))
+all_packages+=($(grep -v '^#' /builder/archinstall.packages | grep -v '^$'))
 
-  # Download Ruby tarball if not already cached
-  ruby_tarball="ruby-3.4.5-rails-8.0.2.1-x86_64.tar.gz"
-  if [ ! -f "$offline_ruby_dir/$ruby_tarball" ]; then
-    echo "Downloading Ruby tarball..."
-    curl -fsSL -o "$offline_ruby_dir/$ruby_tarball" \
-      "https://pkgs.omarchy.org/ruby/$ruby_tarball"
-  else
-    echo "Ruby tarball already cached, skipping download"
-  fi
+# Download all the packages to the offline mirror inside the ISO
+mkdir -p /tmp/offlinedb
+pacman --config /configs/pacman-online-${OMARCHY_MIRROR}.conf --noconfirm -Syw "${all_packages[@]}" --cachedir $offline_mirror_dir/ --dbpath /tmp/offlinedb
+repo-add --new "$offline_mirror_dir/offline.db.tar.gz" "$offline_mirror_dir/"*.pkg.tar.zst
 
-  # Create a symlink to the offline mirror instead of duplicating it.
-  # mkarchiso needs packages at /var/cache/omarchy/mirror/offline in the container,
-  # but they're actually in $build_cache_dir/airootfs/var/cache/omarchy/mirror/offline
-  mkdir -p /var/cache/omarchy/mirror
-  ln -s "$offline_mirror_dir" "/var/cache/omarchy/mirror/offline"
-fi
+# Create a symlink to the offline mirror instead of duplicating it.
+# mkarchiso needs packages at /var/cache/omarchy/mirror/offline in the container,
+# but they're actually in $build_cache_dir/airootfs/var/cache/omarchy/mirror/offline
+mkdir -p /var/cache/omarchy/mirror
+ln -s "$offline_mirror_dir" "/var/cache/omarchy/mirror/offline"
 
-# Install Python packages for the installer into the ISO
-# file system.
-pip install "${python_packages[@]}"
-
-if [ "$OMARCHY_BUILD_MODE" = "online" ]; then
-  # Copy the online version so we use it for build and ISO boot
-  cp $build_cache_dir/pacman-online.conf $build_cache_dir/pacman.conf
-fi
-
-# Copy the pacman.conf to the ISO's /etc directory so the live environment uses our
-# same config when booted
-cp $build_cache_dir/pacman.conf "$build_cache_dir/airootfs/etc/pacman.conf"
+# Copy the offline pacman.conf to the ISO's /etc directory so the live environment uses our
+# same config when booted. 
+cp $build_cache_dir/pacman-offline.conf "$build_cache_dir/airootfs/etc/pacman.conf"
 
 # Finally, we assemble the entire ISO
 mkarchiso -v -w "$build_cache_dir/work/" -o "/out/" "$build_cache_dir/"
+
+# Fix ownership of output files to match host user
+if [ -n "$HOST_UID" ] && [ -n "$HOST_GID" ]; then
+    chown -R "$HOST_UID:$HOST_GID" /out/
+fi

builder/omarchy.gpg

@@ -0,0 +1,13 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaLAsIhYJKwYBBAHaRw8BAQdAYmKmrWMlfpdIPh3QzvEMzzxdNd/kqDl/Bj8H
+mCavKji0Gk9tYXJjaHkgPHBrZ3NAb21hcmNoeS5vcmc+iJAEExYKADgWIQRA37Yw
+/0K8/7BHBGzwE07mgMrFcQUCaLAsIgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIX
+gAAKCRDwE07mgMrFcRF2AQCjjvjgju/kowkN69nenqqRnE+v2MrHmWh2wU0ugIt9
+3gD/bXGugWc5J1vqoT+5aCnJAtfRRmHEfsrAiFgjduB+VA24OARosCwiEgorBgEE
+AZdVAQUBAQdAJoU73WdgxE/pEYK5ofyRvQDs1IFRdfJHV9j4Jm+tuDUDAQgHiHgE
+GBYKACAWIQRA37Yw/0K8/7BHBGzwE07mgMrFcQUCaLAsIgIbDAAKCRDwE07mgMrF
+cYXsAQC5eBEGK0xKsGwtnDDVeNAapx32dpvLgJ94W4DtIpdLlwEA85cSsTiBMuGy
+6kwYmHzqw7oFx3VYGXdMNl0SMKzvJA4=
+=G7wU
+-----END PGP PUBLIC KEY BLOCK-----

builder/packages/archinstall.packages

@@ -1,40 +0,0 @@
-nano
-vim
-openssh
-htop
-wireless_tools
-wpa_supplicant
-smartmontools
-xdg-utils
-dunst
-kitty
-dolphin
-wofi
-qt5-wayland
-qt6-wayland
-polkit-kde-agent
-grim
-xorg-server
-xorg-xinit
-mesa
-xf86-video-amdgpu
-xf86-video-ati
-xf86-video-nouveau
-libva-mesa-driver
-libva-intel-driver
-vulkan-radeon
-vulkan-intel
-vulkan-nouveau
-sddm
-efibootmgr
-intel-media-driver
-amd-ucode
-intel-ucode
-sof-firmware
-base
-base-devel
-linux-firmware
-linux
-limine
-pipewire
-snapper

configs/airootfs/etc/mkinitcpio.conf.d/archiso.conf

@@ -1,2 +1,2 @@
 # Configuration for archiso with Plymouth
-HOOKS=(base udev plymouth modconf archiso archiso_loop_mnt archiso_pxe_common archiso_pxe_nbd archiso_pxe_http archiso_pxe_nfs archiso_kms block filesystems keyboard)
+HOOKS=(base udev microcode modconf kms memdisk archiso archiso_loop_mnt archiso_pxe_common archiso_pxe_nbd archiso_pxe_http archiso_pxe_nfs plymouth block filesystems keyboard)

configs/airootfs/etc/mkinitcpio.d/linux.preset

@@ -0,0 +1,9 @@
+# mkinitcpio preset file for the 'linux' package on archiso
+
+PRESETS=('archiso')
+
+ALL_kver='/boot/vmlinuz-linux-t2'
+archiso_config='/etc/mkinitcpio.conf.d/archiso.conf'
+
+archiso_image="/boot/initramfs-linux-t2.img"
+

configs/airootfs/etc/modprobe.d/blacklist-panther-lake-audio.conf

@@ -0,0 +1,14 @@
+# Fix Panther Lake audio: blacklist SOF modules that conflict with HDA drivers
+# (prevents boot issues on Dell XPS 2026 and similar Panther Lake systems)
+blacklist snd_sof_pci_intel_ptl
+blacklist snd_sof_pci_intel_lnl
+blacklist snd_sof_pci_intel_mtl
+blacklist snd_sof_intel_hda_generic
+blacklist snd_sof_intel_hda_common
+blacklist snd_sof_intel_hda
+blacklist snd_sof_pci
+blacklist snd_sof
+blacklist soundwire_intel
+blacklist snd_soc_cs35l56_sdw
+blacklist snd_soc_cs35l56
+blacklist snd_soc_skl_hda_dsp

configs/airootfs/root/.automated_script.sh

@@ -1,6 +1,48 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+use_omarchy_helpers() {
+  export OMARCHY_PATH="/root/omarchy"
+  export OMARCHY_INSTALL="/root/omarchy/install"
+  export OMARCHY_INSTALL_LOG_FILE="/var/log/omarchy-install.log"
+  export OMARCHY_MIRROR="$(cat /root/omarchy_mirror)"
+  source /root/omarchy/install/helpers/all.sh
+}
+
+run_configurator() {
+  set_tokyo_night_colors
+  ./configurator
+  export OMARCHY_USER="$(jq -r '.users[0].username' user_credentials.json)"
+}
+
+install_arch() {
+  clear_logo
+  gum style --foreground 3 --padding "1 0 0 $PADDING_LEFT" "Installing..."
+  echo
+
+  touch /var/log/omarchy-install.log
+
+  start_log_output
+
+  # Set CURRENT_SCRIPT for the trap to display better when nothing is returned for some reason
+  CURRENT_SCRIPT="install_base_system"
+  install_base_system > >(sed -u 's/\x1b\[[0-9;]*[a-zA-Z]//g' >>/var/log/omarchy-install.log) 2>&1
+  unset CURRENT_SCRIPT
+  stop_log_output
+}
+
+install_omarchy() {
+  chroot_bash -lc "sudo pacman -S --noconfirm --needed gum" >/dev/null
+  chroot_bash -lc "source /home/$OMARCHY_USER/.local/share/omarchy/install.sh"
+
+  configure_login_for_unencrypted_install
+
+  # Reboot if requested by installer
+  if [[ -f /mnt/var/tmp/omarchy-install-completed ]]; then
+    reboot
+  fi
+}
+
 # Set Tokyo Night color scheme for the terminal
 set_tokyo_night_colors() {
   if [[ $(tty) == "/dev/tty"* ]]; then
@@ -28,32 +70,84 @@ set_tokyo_night_colors() {
   fi
 }
 
-run_configurator() {
-  set -euo pipefail
+install_disk() {
+  jq -er 'first(.disk_config.device_modifications[]? | select(.wipe == true) | .device)' user_configuration.json
+}
 
-  # Check if this is an online or offline build
-  if [ "${OMARCHY_INSTALL_MODE:-offline}" = "online" ]; then
-    ./configurator
-  else
-    NETWORK_NOT_NEEDED=true ./configurator
+cleanup_install_disk() {
+  local disk="$1"
+
+  if [[ -z "$disk" || ! -b "$disk" ]]; then
+    echo "Could not determine install disk for cleanup" >&2
+    return 1
   fi
 
-  # Get username from installer config for reliable error recovery
-  export OMARCHY_USER="$(jq -r '.users[0].username' user_credentials.json)"
+  echo "Cleaning up existing holders on install disk: $disk"
+
+  # Ensure that no mounts exist from past install attempts.
+  findmnt -R /mnt >/dev/null && umount -R /mnt || true
+
+  # Turn off swap and unmount anything backed by the selected disk, including
+  # device-mapper children from a previous install. Active LVM/swap holders can
+  # prevent the kernel from re-reading the partition table after archinstall
+  # wipes and recreates it.
+  while read -r dev; do
+    [[ -b "$dev" ]] || continue
+
+    swapoff "$dev" 2>/dev/null || true
+
+    while read -r target; do
+      [[ -n "$target" ]] || continue
+      umount "$target" 2>/dev/null || true
+    done < <(findmnt -rn -S "$dev" -o TARGET 2>/dev/null || true)
+  done < <(lsblk -rnpo PATH "$disk")
+
+  # Deactivate any LVM volume groups whose physical volumes live on the selected
+  # disk. This is the common case when replacing Fedora/Alma/RHEL installs.
+  while read -r dev type; do
+    [[ "$type" == "disk" || "$type" == "part" || "$type" == "crypt" ]] || continue
+
+    while read -r vg; do
+      [[ -n "$vg" ]] || continue
+      vgchange -an "$vg" 2>/dev/null || true
+    done < <(pvs --noheadings -o vg_name "$dev" 2>/dev/null | awk '{$1=$1; print}' | sort -u)
+  done < <(lsblk -rnpo PATH,TYPE "$disk")
+
+  # Close any LUKS mappings stacked on the selected disk after filesystems and
+  # swap have been released.
+  while read -r dev type; do
+    [[ "$type" == "crypt" ]] || continue
+    cryptsetup close "$dev" 2>/dev/null || true
+  done < <(lsblk -rnpo PATH,TYPE "$disk")
+
+  blockdev --flushbufs "$disk" 2>/dev/null || true
+  partprobe "$disk" 2>/dev/null || true
+  udevadm settle || true
 }
 
 install_base_system() {
-  set -euo pipefail
-
   # Initialize and populate the keyring
   pacman-key --init
   pacman-key --populate archlinux
+  pacman-key --populate omarchy
 
   # Sync the offline database so pacman can find packages
   pacman -Sy --noconfirm
 
-  # Ensure that no mounts exist from past install attempts
-  findmnt -R /mnt >/dev/null && umount -R /mnt
+  cleanup_install_disk "$(install_disk)"
+
+  # Workarounds for archinstall 4.2 regressions under Python 3.14:
+  # 1. sync_log_to_install_medium: `self.target / absolute_logfile` drops
+  #    self.target because the RHS is absolute, so Path.copy() raises EINVAL
+  #    (source == target).
+  # 2. _add_limine_bootloader: `Path.copy(efi_dir_path)` raises IsADirectoryError
+  #    because 3.14's Path.copy treats target as a literal path, not a directory
+  #    (shutil.copy used to auto-append the source filename).
+  sed -i \
+    -e 's|logfile_target = self\.target / absolute_logfile$|logfile_target = self.target / absolute_logfile.relative_to("/")|' \
+    -e 's|(limine_path / file)\.copy(efi_dir_path)|(limine_path / file).copy(efi_dir_path / file)|' \
+    -e "s|(limine_path / 'limine-bios.sys')\.copy(boot_limine_path)|(limine_path / 'limine-bios.sys').copy(boot_limine_path / 'limine-bios.sys')|" \
+    /usr/lib/python3.14/site-packages/archinstall/lib/installer.py
 
   # Install using files generated by the ./configurator
   # Skip NTP and WKD sync since we're offline (keyring is pre-populated in ISO)
@@ -62,7 +156,26 @@ install_base_system() {
     --creds user_credentials.json \
     --silent \
     --skip-ntp \
-    --skip-wkd
+    --skip-wkd \
+    --skip-wifi-check
+
+  # Archinstall unmounts the ESP when it finishes. Omarchy's boot finalizer
+  # needs the generated Limine config and EFI artifacts available under /boot.
+  if ! mountpoint -q /mnt/boot; then
+    arch-chroot /mnt mount /boot
+  fi
+
+  # The installed fstab keeps the ESP root-only, but Omarchy finalization runs
+  # as the target user and must discover the Limine config before using sudo to
+  # replace it. Temporarily allow reads and directory traversal during install.
+  boot_device=$(findmnt -nro SOURCE --target /mnt/boot)
+  umount /mnt/boot
+  mount -t vfat -o rw,fmask=0022,dmask=0022 "$boot_device" /mnt/boot
+
+  if ! arch-chroot -u "$OMARCHY_USER" /mnt test -x /boot; then
+    echo "Target user cannot access the mounted ESP" >&2
+    return 1
+  fi
 
   # After archinstall sets up the base system but before our installer runs,
   # we need to ensure the offline pacman.conf is in place
@@ -72,9 +185,9 @@ install_base_system() {
   mkdir -p /mnt/var/cache/omarchy/mirror/offline
   mount --bind /var/cache/omarchy/mirror/offline /mnt/var/cache/omarchy/mirror/offline
 
-  # Mount the ruby directory so it's accessible in the chroot
-  mkdir -p /mnt/var/cache/omarchy/ruby
-  mount --bind /var/cache/omarchy/ruby /mnt/var/cache/omarchy/ruby
+  # Mount the packages dir so it's accessible in the chroot
+  mkdir -p /mnt/opt/packages
+  mount --bind /opt/packages /mnt/opt/packages
 
   # No need to ask for sudo during the installation (omarchy itself responsible for removing after install)
   mkdir -p /mnt/etc/sudoers.d
@@ -90,65 +203,62 @@ EOF
   cp -r /root/omarchy /mnt/home/$OMARCHY_USER/.local/share/
 
   chown -R 1000:1000 /mnt/home/$OMARCHY_USER/.local/
-  # Ensure all scripts in bin directories are executable
+
+  # Ensure all necessary scripts are executable
   find /mnt/home/$OMARCHY_USER/.local/share/omarchy -type f -path "*/bin/*" -exec chmod +x {} \;
-  # Ensure boot.sh is executable
   chmod +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/boot.sh 2>/dev/null || true
+  find /mnt/home/$OMARCHY_USER/.local/share/omarchy/default/waybar -type f -name "*.sh" -exec chmod +x {} \; 2>/dev/null || true
+}
+
+configure_login_for_unencrypted_install() {
+  if [[ $(<user_encrypt_installation.txt) != "false" ]]; then
+    return
+  fi
+
+  # Unencrypted installs must stop at SDDM so the user password is entered
+  # before reaching the desktop. Omarchy's normal encrypted path may autologin
+  # because the disk password was already entered at boot.
+  #
+  # Keep the Omarchy SDDM theme and seed SDDM's last user/session state so
+  # first boot looks like the SDDM screen shown after logging out of Omarchy.
+  mkdir -p /mnt/etc/sddm.conf.d
+  rm -f /mnt/etc/sddm.conf.d/autologin.conf
+  cat >/mnt/etc/sddm.conf.d/99-omarchy-login.conf <<EOF
+[Theme]
+Current=omarchy
+
+[Users]
+RememberLastUser=true
+RememberLastSession=true
+EOF
+
+  mkdir -p /mnt/var/lib/sddm
+  cat >/mnt/var/lib/sddm/state.conf <<EOF
+[Last]
+Session=omarchy.desktop
+User=$OMARCHY_USER
+EOF
+
+  rm -f /mnt/etc/systemd/system/getty@tty1.service.d/autologin.conf
+  arch-chroot /mnt chown sddm:sddm /var/lib/sddm /var/lib/sddm/state.conf >/dev/null 2>&1 || true
+  arch-chroot /mnt systemctl enable sddm.service >/dev/null 2>&1 || true
 }
 
 chroot_bash() {
   HOME=/home/$OMARCHY_USER \
     arch-chroot -u $OMARCHY_USER /mnt/ \
     env OMARCHY_CHROOT_INSTALL=1 \
-    OMARCHY_INSTALL_MODE="${OMARCHY_INSTALL_MODE:-offline}" \
     OMARCHY_USER_NAME="$(<user_full_name.txt)" \
     OMARCHY_USER_EMAIL="$(<user_email_address.txt)" \
+    OMARCHY_MIRROR="$OMARCHY_MIRROR" \
     USER="$OMARCHY_USER" \
     HOME="/home/$OMARCHY_USER" \
-    OMARCHY_REPO="$(<omarchy_installer_repo.txt)" \
-    OMARCHY_REF="$(<omarchy_installer_ref.txt)" \
     /bin/bash "$@"
 }
 
 if [[ $(tty) == "/dev/tty1" ]]; then
-  # Set log file to pull from in trap
-  export OMARCHY_INSTALL_LOG_FILE="/var/log/omarchy-install.log"
-  export OMARCHY_PATH="/root/omarchy"
-  export OMARCHY_INSTALL="/root/omarchy/install"
-
-  # Set install mode based on build mode file, default to offline
-  if [ -f /root/omarchy_install_mode.txt ]; then
-    export OMARCHY_INSTALL_MODE="$(cat /root/omarchy_install_mode.txt)"
-  else
-    export OMARCHY_INSTALL_MODE="offline"
-  fi
-
-  source "$OMARCHY_INSTALL/preflight/set-size-vars.sh"
-  source "$OMARCHY_INSTALL/helpers/logo.sh"
-  source "$OMARCHY_INSTALL/preflight/gum.sh"
-  source "$OMARCHY_INSTALL/helpers/tail-log-output.sh"
-  source "$OMARCHY_INSTALL/helpers/trap-errors.sh"
-
-  set_tokyo_night_colors
-
+  use_omarchy_helpers
   run_configurator
-
-  clear_logo
-
-  gum style --foreground 3 --padding "1 0 0 $PADDING_LEFT" "Installing Omarchy..."
-
-  touch "$OMARCHY_INSTALL_LOG_FILE"
-
-  start_log_output
-  install_base_system 2>&1 | sed -u 's/\x1b\[[0-9;]*[a-zA-Z]//g' >>"$OMARCHY_INSTALL_LOG_FILE"
-  cleanup
-
-  # Get username from the config file after installation
-  OMARCHY_USER="$(jq -r '.users[0].username' user_credentials.json)"
-
-  # Install gum early so we have it for formatting
-  chroot_bash -lc "sudo pacman -S --noconfirm --needed gum" >/dev/null
-
-  # Run Omarchy installer directly (skip boot.sh since it would try to clone again)
-  chroot_bash -lc "source /home/$OMARCHY_USER/.local/share/omarchy/install.sh || bash"
+  install_arch
+  install_omarchy
 fi

configs/airootfs/root/configurator

@@ -0,0 +1,510 @@
+#!/bin/bash
+
+# Rely on Omarchy for styling and error handling
+source "$OMARCHY_INSTALL/helpers/all.sh"
+
+# Ensure tzupdate is available for guessing timezone
+command -v tzupdate >/dev/null || sudo pacman -Sy --noconfirm tzupdate
+
+abort() {
+  gum style "${1:-Aborted installation}"
+  echo
+  gum style "You can retry later by running: ./.automated_script.sh"
+  exit 1
+}
+
+step() {
+  clear_logo
+  echo
+  gum style "$1"
+  echo
+}
+
+notice() {
+  clear_logo
+  echo
+  gum spin --spinner "pulse" --title "$1" -- sleep "${2:-2}"
+  echo
+}
+
+# STEP 1: KEYBOARD LAYOUT
+
+keyboard_form() {
+  step "Let's setup your machine..."
+  keyboards=$'Azerbaijani|azerty
+Belarusian|by
+Belgian|be-latin1
+Bosnian|ba
+Bulgarian|bg-cp1251
+Croatian|croat
+Czech|cz
+Danish|dk-latin1
+Dutch|nl
+English (UK)|uk
+English (US)|us
+English (US, Dvorak)|dvorak
+English (US, Colemak)|colemak
+Estonian|et
+Finnish|fi
+French|fr
+French (Canada)|cf
+French (Switzerland)|fr_CH
+Georgian|ge
+German|de
+German (Switzerland)|de_CH-latin1
+Greek|gr
+Hebrew|il
+Hungarian|hu
+Icelandic|is-latin1
+Irish|ie
+Italian|it
+Japanese|jp106
+Kazakh|kazakh
+Khmer (Cambodia)|khmer
+Kyrgyz|kyrgyz
+Lao|la-latin1
+Latvian|lv
+Lithuanian|lt
+Macedonian|mk-utf
+Norwegian|no-latin1
+Polish|pl
+Portuguese|pt-latin1
+Portuguese (Brazil)|br-abnt2
+Romanian|ro
+Russian|ru
+Serbian|sr-latin
+Slovak|sk-qwertz
+Slovenian|slovene
+Spanish|es
+Spanish (Latin American)|la-latin1
+Swedish|sv-latin1
+Tajik|tj_alt-UTF8
+Turkish|trq
+Ukrainian|ua'
+  choice=$(printf '%s\n' "$keyboards" | cut -d'|' -f1 | gum choose --height 10 --selected "English (US)" --header "Select keyboard layout") || abort
+  keyboard=$(printf '%s\n' "$keyboards" | awk -F'|' -v c="$choice" '$1==c{print $2; exit}')
+
+  # Only attempt to load keyboard layout if we're on a real console
+  # loadkeys only works on Linux virtual consoles (tty), not in terminal emulators
+  if [[ $(tty 2>/dev/null) == "/dev/tty"* ]]; then
+    loadkeys "$keyboard" 2>/dev/null
+  fi
+}
+
+keyboard_form
+
+# STEP 2: USER
+
+user_form() {
+  step "Let's setup your user account..."
+
+  while true; do
+    username=$(gum input --placeholder "Alphanumeric without spaces (like dhh)" --prompt.foreground="#845DF9" --prompt "Username> ") || abort
+
+    if [[ "$username" =~ ^[a-z_][a-z0-9_-]*[$]?$ ]]; then
+      break
+    else
+      notice "Username must be alphanumeric with no spaces" 1
+    fi
+  done
+
+  while true; do
+    password=$(gum input --placeholder "Used for user + root, and disk encryption when enabled" --prompt.foreground="#845DF9" --password --prompt "Password> ") || abort
+    password_confirmation=$(gum input --placeholder "Must match the password you just typed" --prompt.foreground="#845DF9" --password --prompt "Confirm> ") || abort
+
+    if [[ -n "$password" && "$password" == "$password_confirmation" ]]; then
+      break
+    elif [[ -z "$password" ]]; then
+      notice "Your password can't be blank!" 1
+    else
+      notice "Passwords didn't match!" 1
+    fi
+  done
+
+  # Hash the password using yescrypt
+  password_hash=$(printf '%s' "$password" | openssl passwd -6 -stdin)
+
+  full_name=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Full name> ")
+  email_address=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Email address> ")
+
+  while true; do
+    hostname=$(gum input --placeholder "Letters, digits, and dashes (or return for 'omarchy')" --prompt.foreground="#845DF9" --prompt "Hostname> ")
+
+    if [[ "$hostname" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$ ]]; then
+      break
+    elif [[ -z $hostname ]]; then
+      hostname="omarchy"
+      break
+    else
+      notice "Hostname must be 1-63 letters, digits, or dashes, and cannot start or end with a dash" 1
+    fi
+  done
+
+  # Pick timezone
+  geo_guessed_timezone=$(tzupdate -p 2>/dev/null)
+
+  if [[ -n $geo_guessed_timezone ]]; then
+    timezone=$(timedatectl list-timezones | gum choose --height 10 --selected "$geo_guessed_timezone" --header "Timezone") || abort
+  else
+    timezone=$(timedatectl list-timezones | gum filter --height 10 --header "Timezone") || abort
+  fi
+}
+
+user_form
+
+while true; do
+  # Add manual padding since gum table -p doesn't respect padding
+  echo -e "Field,Value
+Username,$username
+Password,$(printf "%${#password}s" | tr ' ' '*')
+Full name,${full_name:-[Skipped]}
+Email address,${email_address:-[Skipped]}
+Hostname,$hostname
+Timezone,$timezone
+Keyboard,$keyboard" |
+    gum table -s "," -p | sed "s/^/${PADDING_LEFT_SPACES}/"
+
+  echo
+  if gum confirm --negative "No, change it" "Does this look right?"; then
+    break
+  else
+    keyboard_form
+    user_form
+  fi
+done
+
+# STEP 3: DISK
+
+get_disk_info() {
+  local device="$1"
+  local size vendor model label
+
+  # Get basic disk information
+  size=$(lsblk -dno SIZE "$device" 2>/dev/null)
+  vendor=$(lsblk -dno VENDOR "$device" 2>/dev/null | sed 's/ *$//')
+  model=$(lsblk -dno MODEL "$device" 2>/dev/null | sed 's/ *$//')
+
+  # Combine vendor and model, avoiding duplication
+  label=""
+  if [[ -n $vendor && -n $model ]]; then
+    if [[ $model == *$vendor* ]]; then
+      label="$model"
+    else
+      label="$vendor $model"
+    fi
+  elif [[ -n $model ]]; then
+    label="$model"
+  elif [[ -n $vendor ]]; then
+    label="$vendor"
+  fi
+
+  # Format display string
+  local display="$device"
+  [[ -n $size ]] && display="$display ($size)"
+  [[ -n $label ]] && display="$display - $label"
+
+  # Append compact partition summary
+  local part_summary
+  part_summary=$(lsblk -nro TYPE,NAME,FSTYPE,MOUNTPOINT "$device" 2>/dev/null | \
+    awk '$1=="part" { printf "%s%s%s", s, ($3==""?"unknown":$3), ($4==""?"":"("$4")"); s=", " }')
+  [[ -n $part_summary ]] && display+=" [$part_summary]"
+
+  echo "$display"
+}
+
+get_root_disk() {
+  local device="$1"
+  local parent
+
+  [[ -n $device ]] || return 1
+
+  # /run/archiso/bootmnt usually resolves to the boot partition, but the
+  # installer picker works with whole disks. Walk back to the parent disk so
+  # the install media itself never shows up as a wipe target.
+  device=$(readlink -f "$device" 2>/dev/null || printf "%s\n" "$device")
+
+  while true; do
+    parent=$(lsblk -dno PKNAME "$device" 2>/dev/null | tail -n1)
+    [[ -n $parent ]] || break
+    device="/dev/$parent"
+  done
+
+  if [[ $(lsblk -dno TYPE "$device" 2>/dev/null) == "disk" ]]; then
+    printf "%s\n" "$device"
+  fi
+}
+
+disk_form() {
+  step "Let's select where to install Omarchy..."
+
+  # Don't offer the install media as an option (Arch ISO mounts it here)
+  local boot_source
+  local exclude_disk
+  boot_source=$(findmnt -no SOURCE /run/archiso/bootmnt 2>/dev/null || true)
+  exclude_disk=$(get_root_disk "$boot_source")
+
+  # List all installable disks, excluding the boot device if present
+  local available_disks
+  available_disks=$(
+    lsblk -dpno NAME,TYPE |
+      awk '$2=="disk"{print $1}' |
+      grep -E '/dev/(sd|hd|vd|nvme|mmcblk|xv)' |
+      { if [[ -n "$exclude_disk" ]]; then grep -Fvx "$exclude_disk"; else cat; fi; }
+  )
+
+  # Get available disks and format them with info
+  local disk_options=""
+  while IFS= read -r device; do
+    if [[ -n "$device" ]]; then
+      disk_info=$(get_disk_info "$device")
+      disk_options="$disk_options$disk_info"$'\n'
+    fi
+  done <<<"$available_disks"
+
+  selected_display=$(echo "$disk_options" | gum choose --header "Select install disk") || abort
+  disk=$(echo "$selected_display" | awk '{print $1}')
+}
+
+disk_form
+
+confirm_disk_overwrite() {
+  local mode="encrypted"
+  local affirmative confirm_status
+
+  while true; do
+    clear_logo
+    echo
+    gum style "Everything will be overwritten. There is no recovery possible."
+
+    if [[ $mode == "encrypted" ]]; then
+      gum style --foreground 8 "Press Ctrl+C for unencrypted install."
+      affirmative="Yes, install"
+    else
+      affirmative="Yes, install without encryption"
+    fi
+
+    echo
+    gum confirm --affirmative "$affirmative" --negative "No, change it" "Confirm overwriting ${disk}"
+    confirm_status=$?
+
+    case $confirm_status in
+      0)
+        [[ $mode == "encrypted" ]] && encrypt_installation=true || encrypt_installation=false
+        return 0
+        ;;
+      1)
+        return 1
+        ;;
+      130)
+        [[ $mode == "encrypted" ]] && mode="unencrypted" || mode="encrypted"
+        ;;
+      *)
+        abort
+        ;;
+    esac
+  done
+}
+
+while ! confirm_disk_overwrite; do
+  disk_form
+done
+
+clear
+
+# Save user full name and email address, so the autostart can
+# set them as OMARCHY_USER_NAME and OMARCHY_USER_EMAIL
+echo "$full_name" >user_full_name.txt
+echo "$email_address" >user_email_address.txt
+
+# Escape username and password for safe inclusion
+password_escaped=$(echo -n "$password" | jq -Rsa)
+password_hash_escaped=$(echo -n "$password_hash" | jq -Rsa)
+username_escaped=$(echo -n "$username" | jq -Rsa)
+
+if [[ $encrypt_installation == true ]]; then
+  credentials_encryption_line="    \"encryption_password\": $password_escaped,"
+else
+  credentials_encryption_line=""
+fi
+
+cat <<-_EOF_ >user_credentials.json
+{
+$credentials_encryption_line
+    "root_enc_password": $password_hash_escaped,
+    "users": [
+        {
+            "enc_password": $password_hash_escaped,
+            "groups": [],
+            "sudo": true,
+            "username": $username_escaped
+        }
+    ]
+}
+_EOF_
+
+printf '%s\n' "$encrypt_installation" >user_encrypt_installation.txt
+
+# Setup partition layout
+disk_size=$(lsblk -bdno SIZE "$disk")
+mib=$((1024 * 1024))
+gib=$((mib * 1024))
+disk_size_in_mib=$((disk_size / mib * mib)) # Rounds to nearest MiB
+
+gpt_backup_reserve=$((mib))
+boot_partition_start=$((mib))
+boot_partition_size=$((2 * gib))
+
+main_partition_start=$((boot_partition_size + boot_partition_start))
+main_partition_size=$((disk_size_in_mib - main_partition_start - gpt_backup_reserve))
+
+# Detect T2 Mac and set appropriate kernel
+if lspci -nn 2>/dev/null | grep -q "106b:180[12]"; then
+  kernel_choice="linux-t2"
+else
+  kernel_choice="linux"
+fi
+
+if [[ $encrypt_installation == true ]]; then
+  disk_encryption_config=$(cat <<-_EOF_
+,
+        "disk_encryption": {
+            "encryption_type": "luks",
+            "lvm_volumes": [],
+            "iter_time": 2000,
+            "partitions": [ "8c2c2b92-1070-455d-b76a-56263bab24aa" ],
+            "encryption_password": $password_escaped
+        }
+_EOF_
+)
+else
+  disk_encryption_config=""
+fi
+
+cat <<-_EOF_ >user_configuration.json
+{
+    "app_config": null,
+    "archinstall-language": "English",
+    "auth_config": {},
+    "audio_config": { "audio": "pipewire" },
+    "bootloader": "Limine",
+    "custom_commands": [],
+    "disk_config": {
+        "btrfs_options": { 
+          "snapshot_config": {
+            "type": "Snapper"
+          }
+        },
+        "config_type": "default_layout",
+        "device_modifications": [
+            {
+                "device": "$disk",
+                "partitions": [
+                    {
+                        "btrfs": [],
+                        "dev_path": null,
+                        "flags": [ "boot", "esp" ],
+                        "fs_type": "fat32",
+                        "mount_options": [],
+                        "mountpoint": "/boot",
+                        "obj_id": "ea21d3f2-82bb-49cc-ab5d-6f81ae94e18d",
+                        "size": {
+                            "sector_size": { "unit": "B", "value": 512 },
+                            "unit": "B",
+                            "value": $boot_partition_size
+                        },
+                        "start": {
+                            "sector_size": { "unit": "B", "value": 512 },
+                            "unit": "B",
+                            "value": $boot_partition_start
+                        },
+                        "status": "create",
+                        "type": "primary"
+                    },
+                    {
+                        "btrfs": [
+                            { "mountpoint": "/", "name": "@" },
+                            { "mountpoint": "/home", "name": "@home" },
+                            { "mountpoint": "/var/log", "name": "@log" },
+                            { "mountpoint": "/var/cache/pacman/pkg", "name": "@pkg" }
+                        ],
+                        "dev_path": null,
+                        "flags": [],
+                        "fs_type": "btrfs",
+                        "mount_options": [ "compress=zstd" ],
+                        "mountpoint": null,
+                        "obj_id": "8c2c2b92-1070-455d-b76a-56263bab24aa",
+                        "size": {
+                            "sector_size": { "unit": "B", "value": 512 },
+                            "unit": "B",
+                            "value": $main_partition_size
+                        },
+                        "start": {
+                            "sector_size": { "unit": "B", "value": 512 },
+                            "unit": "B",
+                            "value": $main_partition_start
+                        },
+                        "status": "create",
+                        "type": "primary"
+                    }
+                ],
+                "wipe": true
+            }
+        ]$disk_encryption_config
+    },
+    "hostname": "$hostname",
+    "kernels": [ "$kernel_choice" ],
+    "network_config": { "type": "iso" },
+    "ntp": true,
+    "parallel_downloads": 8,
+    "script": null,
+    "services": [],
+    "swap": true,
+    "timezone": "$timezone",
+    "locale_config": {
+        "kb_layout": "$keyboard",
+        "sys_enc": "UTF-8",
+        "sys_lang": "en_US.UTF-8"
+    },
+    "mirror_config": {
+        "custom_repositories": [],
+        "custom_servers": [
+            {"url": "https://mirror.omarchy.org/\$repo/os/\$arch"},
+            {"url": "https://mirror.rackspace.com/archlinux/\$repo/os/\$arch"},
+            {"url": "https://geo.mirror.pkgbuild.com/\$repo/os/\$arch"}
+        ],
+        "mirror_regions": {},
+        "optional_repositories": []
+    },
+    "packages": [
+        "base-devel",
+        "git",
+        "omarchy-keyring",
+        "snapper"
+    ],
+    "profile_config": {
+        "gfx_driver": null,
+        "greeter": null,
+        "profile": {}
+    },
+    "version": "3.0.9"
+}
+_EOF_
+
+if [[ $1 == "dry" ]]; then
+  echo -e "User Configuration:"
+  cat user_configuration.json
+
+  echo -e "\n\nUser Credentials:"
+  cat user_credentials.json
+
+  echo -e "\n\nUser Full Name:"
+  cat user_full_name.txt
+
+  echo -e "\nUser Email Address:"
+  cat user_email_address.txt
+
+  echo -e "\nDisk Encryption:"
+  cat user_encrypt_installation.txt
+
+  rm user_configuration.json user_credentials.json user_full_name.txt user_email_address.txt user_encrypt_installation.txt
+fi

configs/efiboot/loader/entries/01-archiso-x86_64-linux.conf

@@ -1,5 +1,5 @@
-title    Arch Linux install medium (x86_64, UEFI)
+title    Omarchy (x86_64, UEFI)
 sort-key 01
-linux    /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux
-initrd   /%INSTALL_DIR%/boot/x86_64/initramfs-linux.img
-options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash
+linux    /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
+initrd   /%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
+options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash xe.enable_panel_replay=0

configs/grub/grub.cfg

@@ -9,11 +9,12 @@ insmod exfat
 insmod udf
 
 # Use graphics-mode output
+insmod font
 if loadfont "${prefix}/fonts/unicode.pf2" ; then
     insmod all_video
     set gfxmode="auto"
     terminal_input console
-    terminal_output console
+    terminal_output gfxterm
 fi
 
 # Enable serial console
@@ -51,16 +52,16 @@ timeout_style=hidden
 
 # Menu entries
 
-menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
+menuentry "Omarchy (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash xe.enable_panel_replay=0
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
 }
 
-menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
+menuentry "Omarchy with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on xe.enable_panel_replay=0
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
 }
 
 
@@ -103,6 +104,3 @@ menuentry 'System restart' --class reboot --class restart {
 }
 
 
-# GRUB init tune for accessibility
-play 600 988 1 1319 4
-

configs/grub/loopback.cfg

@@ -0,0 +1,80 @@
+# https://www.supergrubdisk.org/wiki/Loopback.cfg
+
+# Search for the ISO volume
+search --no-floppy --set=archiso_img_dev --file "${iso_path}"
+probe --set archiso_img_dev_uuid --fs-uuid "${archiso_img_dev}"
+
+# Get a human readable platform identifier
+if [ "${grub_platform}" == 'efi' ]; then
+    archiso_platform='UEFI'
+    if [ "${grub_cpu}" == 'x86_64' ]; then
+        archiso_platform="x64 ${archiso_platform}"
+    elif [ "${grub_cpu}" == 'i386' ]; then
+        archiso_platform="IA32 ${archiso_platform}"
+    else
+        archiso_platform="${grub_cpu} ${archiso_platform}"
+    fi
+elif [ "${grub_platform}" == 'pc' ]; then
+    archiso_platform='BIOS'
+else
+    archiso_platform="${grub_cpu} ${grub_platform}"
+fi
+
+# Set default menu entry
+default=archlinux
+timeout=0
+timeout_style=hidden
+
+
+# Menu entries
+
+menuentry "Omarchy (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" quiet splash xe.enable_panel_replay=0
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
+}
+
+menuentry "Omarchy with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
+    set gfxpayload=keep
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on xe.enable_panel_replay=0
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
+}
+
+
+if [ "${grub_platform}" == 'efi' -a "${grub_cpu}" == 'x86_64' -a -f '/boot/memtest86+/memtest.efi' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest.efi
+    }
+fi
+if [ "${grub_platform}" == 'pc' -a -f '/boot/memtest86+/memtest' ]; then
+    menuentry 'Run Memtest86+ (RAM test)' --class memtest86 --class memtest --class gnu --class tool {
+        set gfxpayload=800x600,1024x768
+        linux /boot/memtest86+/memtest
+    }
+fi
+if [ "${grub_platform}" == 'efi' ]; then
+    if [ "${grub_cpu}" == 'x86_64' -a -f '/shellx64.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellx64.efi
+        }
+    elif [ "${grub_cpu}" == "i386" -a -f '/shellia32.efi' ]; then
+        menuentry 'UEFI Shell' --class efi {
+            chainloader /shellia32.efi
+        }
+    fi
+
+    menuentry 'UEFI Firmware Settings' --id 'uefi-firmware' {
+        fwsetup
+    }
+fi
+
+menuentry 'System shutdown' --class shutdown --class poweroff {
+    echo 'System shutting down...'
+    halt
+}
+
+menuentry 'System restart' --class reboot --class restart {
+    echo 'System rebooting...'
+    reboot
+}

configs/pacman-online-edge.conf

@@ -15,26 +15,20 @@ LocalFileSigLevel = Optional
 
 [core]
 Server = https://mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [extra]
 Server = https://mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [multilib]
 Server = https://mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
 SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/$arch
+Server = https://pkgs.omarchy.org/edge/$arch
 
 [arch-mact2]
-Server = https://mirror.omarchy.org/$repo/$arch
+Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
 SigLevel = Never

configs/pacman-online-rc.conf

@@ -0,0 +1,34 @@
+#
+# /etc/pacman.conf
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+
+[core]
+Server = https://rc-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Server = https://rc-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Server = https://rc-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[omarchy]
+SigLevel = Optional TrustAll
+Server = https://pkgs.omarchy.org/rc/$arch
+
+[arch-mact2]
+Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
+SigLevel = Never

configs/pacman-online-stable.conf

@@ -0,0 +1,34 @@
+#
+# /etc/pacman.conf
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+
+[core]
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[omarchy]
+SigLevel = Optional TrustAll
+Server = https://pkgs.omarchy.org/stable/$arch
+
+[arch-mact2]
+Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
+SigLevel = Never

configs/profiledef.sh

@@ -2,17 +2,15 @@
 # shellcheck disable=SC2034
 
 iso_name="omarchy"
-iso_label="ARCH_$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y%m)"
+iso_label="OMARCHY_$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y%m)"
 iso_publisher="Omarchy <https://omarchy.org>"
 iso_application="Omarchy Installer"
 iso_version="$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y.%m.%d)"
 install_dir="arch"
 buildmodes=('iso')
-bootmodes=('bios.syslinux.mbr' 'bios.syslinux.eltorito'
-  'uefi-ia32.systemd-boot.esp' 'uefi-x64.systemd-boot.esp'
-  'uefi-ia32.systemd-boot.eltorito' 'uefi-x64.systemd-boot.eltorito')
+bootmodes=('bios.syslinux' 'uefi.grub')
 arch="x86_64"
-pacman_conf="pacman.conf"
+pacman_conf="pacman-offline.conf"
 airootfs_image_type="squashfs"
 airootfs_image_tool_options=('-comp' 'xz' '-Xbcj' 'x86' '-b' '1M' '-Xdict-size' '1M')
 bootstrap_tarball_compression=('zstd' '-c' '-T0' '--auto-threads=logical' '--long' '-19')
@@ -24,6 +22,5 @@ file_permissions=(
   ["/usr/local/bin/choose-mirror"]="0:0:755"
   ["/root/configurator"]="0:0:755"
   ["/var/cache/omarchy/mirror/offline/"]="0:0:775"
-  ["/usr/bin/tte"]="0:0:755"
   ["/usr/local/bin/omarchy-upload-log"]="0:0:755"
 )

configs/syslinux/archiso_head.cfg

@@ -0,0 +1,28 @@
+SERIAL 0 115200
+UI vesamenu.c32
+MENU TITLE Omarchy
+MENU BACKGROUND splash.png
+
+MENU WIDTH 78
+MENU MARGIN 4
+MENU ROWS 7
+MENU VSHIFT 10
+MENU TABMSGROW 14
+MENU CMDLINEROW 14
+MENU HELPMSGROW 16
+MENU HELPMSGENDROW 29
+
+# Refer to https://wiki.syslinux.org/wiki/index.php/Comboot/menu.c32
+
+MENU COLOR border       30;44   #40ffffff #a0000000 std
+MENU COLOR title        1;36;44 #9033ccff #a0000000 std
+MENU COLOR sel          7;37;40 #e0ffffff #20ffffff all
+MENU COLOR unsel        37;44   #50ffffff #a0000000 std
+MENU COLOR help         37;40   #c0ffffff #a0000000 std
+MENU COLOR timeout_msg  37;40   #80ffffff #00000000 std
+MENU COLOR timeout      1;37;40 #c0ffffff #00000000 std
+MENU COLOR msg07        37;40   #90ffffff #a0000000 std
+MENU COLOR tabmsg       31;40   #30ffffff #00000000 std
+
+MENU CLEAR
+MENU IMMEDIATE

configs/syslinux/archiso_pxe-linux.cfg

@@ -0,0 +1,32 @@
+LABEL arch64_nbd
+TEXT HELP
+Boot the Omarchy install medium using NBD.
+It allows you to install Omarchy or perform system maintenance.
+ENDTEXT
+MENU LABEL Omarchy install medium (x86_64, NBD)
+LINUX ::/%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
+INITRD ::/%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% archiso_nbd_srv=${pxeserver} cms_verify=y
+SYSAPPEND 3
+
+LABEL arch64_nfs
+TEXT HELP
+Boot the Omarchy live medium using NFS.
+It allows you to install Omarchy or perform system maintenance.
+ENDTEXT
+MENU LABEL Omarchy install medium (x86_64, NFS)
+LINUX ::/%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
+INITRD ::/%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
+APPEND archisobasedir=%INSTALL_DIR% archiso_nfs_srv=${pxeserver}:/run/archiso/bootmnt cms_verify=y
+SYSAPPEND 3
+
+LABEL arch64_http
+TEXT HELP
+Boot the Omarchy live medium using HTTP.
+It allows you to install Omarchy or perform system maintenance.
+ENDTEXT
+MENU LABEL Omarchy install medium (x86_64, HTTP)
+LINUX ::/%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
+INITRD ::/%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
+APPEND archisobasedir=%INSTALL_DIR% archiso_http_srv=http://${pxeserver}/ cms_verify=y
+SYSAPPEND 3

configs/syslinux/archiso_pxe.cfg

@@ -0,0 +1,5 @@
+INCLUDE archiso_head.cfg
+
+INCLUDE archiso_pxe-linux.cfg
+
+INCLUDE archiso_tail.cfg

configs/syslinux/archiso_sys-linux.cfg

@@ -0,0 +1,20 @@
+LABEL arch64
+TEXT HELP
+Boot the Omarchy install medium on BIOS.
+It allows you to install Omarchy or perform system maintenance.
+ENDTEXT
+MENU LABEL Omarchy install medium (x86_64, BIOS)
+LINUX /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
+INITRD /%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash xe.enable_panel_replay=0
+
+# Accessibility boot option
+LABEL arch64speech
+TEXT HELP
+Boot the Omarchy install medium on BIOS with speakup screen reader.
+It allows you to install Omarchy or perform system maintenance with speech feedback.
+ENDTEXT
+MENU LABEL Omarchy install medium (x86_64, BIOS) with ^speech
+LINUX /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
+INITRD /%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on xe.enable_panel_replay=0

configs/syslinux/archiso_sys.cfg

@@ -0,0 +1,8 @@
+INCLUDE archiso_head.cfg
+
+DEFAULT arch64
+TIMEOUT 150
+
+INCLUDE archiso_sys-linux.cfg
+
+INCLUDE archiso_tail.cfg

configs/syslinux/archiso_tail.cfg

@@ -0,0 +1,35 @@
+LABEL existing
+TEXT HELP
+Boot an existing operating system.
+Press TAB to edit the disk and partition number to boot.
+ENDTEXT
+MENU LABEL Boot existing OS
+COM32 chain.c32
+APPEND hd0 0
+
+# https://www.memtest.org/
+LABEL memtest
+MENU LABEL Run Memtest86+ (RAM test)
+LINUX /boot/memtest86+/memtest
+
+# https://wiki.syslinux.org/wiki/index.php/Hdt_(Hardware_Detection_Tool)
+LABEL hdt
+MENU LABEL Hardware Information (HDT)
+COM32 hdt.c32
+APPEND modules_alias=hdt/modalias.gz pciids=hdt/pciids.gz
+
+LABEL reboot
+TEXT HELP
+Reboot computer.
+The computer's firmware must support APM.
+ENDTEXT
+MENU LABEL Reboot
+COM32 reboot.c32
+
+LABEL poweroff
+TEXT HELP
+Power off computer.
+The computer's firmware must support APM.
+ENDTEXT
+MENU LABEL Power Off
+COM32 poweroff.c32

configs/syslinux/syslinux.cfg

@@ -0,0 +1,11 @@
+DEFAULT select
+
+LABEL select
+COM32 whichsys.c32
+APPEND -pxe- pxe -sys- sys -iso- sys
+
+LABEL pxe
+CONFIG archiso_pxe.cfg
+
+LABEL sys
+CONFIG archiso_sys.cfg

plans/aarch64-support.md

@@ -0,0 +1,178 @@
+# Plan: aarch64 (Generic UEFI ARM64) build for omarchy-iso
+
+## Context
+
+omarchy-iso currently produces a single x86_64 Arch Linux live ISO. The build is x86-baked from top to bottom — profile arch, package list filename, microcode, kernel choice (`linux-t2`), bootloader configs (BIOS syslinux + UEFI GRUB), squashfs BCJ filter, Node.js download URL, QEMU smoke-test, release filename, and CI runner.
+
+Target: a parallel **generic UEFI aarch64** ISO — boots on Ampere servers, AWS Graviton VMs, Snapdragon X laptops, ARM dev kits. Anything that exposes vanilla UEFI + ACPI. Apple Silicon (Asahi) and SBCs (U-Boot/rpi-firmware) are out of scope.
+
+**Assumption:** cross-repo dependencies are someone else's problem to land first. This plan only covers omarchy-iso. The hard prerequisites are listed up front so it's clear what blocks the first green build.
+
+---
+
+## Hard prerequisites (NOT in this plan, but block any green build)
+
+These exist outside omarchy-iso. Flagged for visibility — without them, nothing here boots:
+
+1. **aarch64 base packages must exist somewhere we can pacman from.** Vanilla Arch (`geo.mirror.pkgbuild.com`) is x86_64-only — there is no `core/os/aarch64`. The realistic source is **Arch Linux ARM** (`mirror.archlinuxarm.org`) for `core`/`extra`/`alarm`/`aur`. Decision required: target Arch Linux ARM as the aarch64 base distribution.
+2. **`pkgs.omarchy.org/{stable,edge}/aarch64/`** must serve a real repo. Probed today, both return 404. omarchy-pkgs already has multi-arch build support per its README, so this is a publish step, not a port.
+3. **Omarchy installer guard** at `~/.local/share/omarchy/install/preflight/guard.sh:25` hard-aborts on `uname -m != x86_64`. Must be relaxed to allow aarch64 (or scoped behind a flag).
+4. **archinstall + Limine** must work end-to-end on aarch64. archinstall supports it; Limine supports aarch64 UEFI. Worth a manual verification before committing to this bootloader path on ARM.
+
+---
+
+## Approach
+
+Add an `--arch aarch64` flag to `bin/omarchy-iso-make`. Branch on it everywhere x86_64 is currently assumed. Don't fork the profile directory — overlay arch-specific files at build time so the two architectures share one source of truth.
+
+Output artifact naming already uses no arch suffix until release-time renaming, so two parallel builds coexist cleanly.
+
+---
+
+## Concrete changes
+
+### 1. Build entrypoint — `bin/omarchy-iso-make`
+
+- Add `--arch x86_64|aarch64` flag (default `x86_64` for backward compat).
+- Pass `OMARCHY_ARCH` env var into the container.
+- Switch the docker image / platform per arch:
+  - x86_64: `archlinux/archlinux:latest` (unchanged)
+  - aarch64: `archlinuxarm/archlinuxarm:latest` (or `menci/archlinuxarm` — pick whichever publishes a recent multi-arch image), with `--platform linux/arm64`. Native arm64 host preferred; QEMU emulation works but is slow.
+- Don't change pacman cache mount on the host: pacman keeps per-arch subdirs, so the cache is safe to share.
+
+### 2. Profile — `configs/profiledef.sh`
+
+Change `arch` and the squashfs BCJ filter at runtime. Either:
+- Keep one `profiledef.sh` and have `builder/build-iso.sh` `sed` the arch line + BCJ filter (`x86` → `arm`) before `mkarchiso` runs, **or**
+- Source `OMARCHY_ARCH` directly inside `profiledef.sh` (mkarchiso sources this file with bash, so env access is fine).
+
+`bootmodes` also needs to drop `bios.syslinux` for aarch64 (BIOS boot is x86-only) — `bootmodes=('uefi.grub')` on ARM.
+
+### 3. Build script — `builder/build-iso.sh`
+
+- **Line 56–57**: Node.js URL grep. Branch on `OMARCHY_ARCH`:
+  - `x86_64` → `linux-x64.tar.gz`
+  - `aarch64` → `linux-arm64.tar.gz`
+- **Line 73**: package additions. Drop `linux-t2` for aarch64 (T2-only x86 kernel) — use plain `linux`. Write to `packages.${OMARCHY_ARCH}` instead of hardcoded `packages.x86_64`.
+- **Line 77**: read same `packages.${OMARCHY_ARCH}` for offline mirror enumeration.
+- **archiso releng overlay** (`cp -r /archiso/configs/releng/*`): the upstream `releng` profile ships only `packages.x86_64`. For aarch64, copy `packages.x86_64` to `packages.aarch64` and prune obviously x86-only entries (`memtest86+`, `intel-ucode`, `amd-ucode`, `edk2-shell` x64 binary, `syslinux`). Land this as a small fixup step in `build-iso.sh` rather than a full fork of `releng`.
+
+### 4. archinstall package list — `builder/archinstall.packages`
+
+Drop microcode for aarch64 — `intel-ucode` and `amd-ucode` don't exist for ARM. Either:
+- Two lists (`archinstall.packages.x86_64`, `archinstall.packages.aarch64`), or
+- One list with sentinel comments and a filter step in `build-iso.sh:80` that drops microcode lines when `OMARCHY_ARCH=aarch64`.
+
+The second is less duplication for one-line drift.
+
+### 5. Bootloader configs
+
+aarch64 has no BIOS — only UEFI. Drop the syslinux path entirely on ARM.
+
+- **Skip on aarch64**: `configs/syslinux/*` (BIOS syslinux), `configs/grub/*` references to `shellx64.efi`/`shellia32.efi` (lines 81–85 of `grub.cfg`).
+- **`configs/efiboot/loader/loader.conf`**: change `default 01-archiso-x86_64-linux.conf` to a per-arch entry. Either two loader.conf files (selected by build-iso.sh) or rename the entry generically (`01-archiso-linux.conf`) and keep one file.
+- **`configs/efiboot/loader/entries/01-archiso-x86_64-linux.conf`**: produce an aarch64 sibling (`01-archiso-aarch64-linux.conf`) at build time — same template, drop microcode initrd lines, swap title. The kernel/initrd paths use `%ARCH%` already in `grub.cfg` but are hardcoded `x86_64` in this file (line 3–4).
+- **`configs/grub/grub.cfg` and `loopback.cfg`**: remove or guard the x86_64 conditionals. The `%ARCH%` placeholder gets substituted by mkarchiso from `profiledef.sh:arch`, so the kernel/initrd paths flip automatically. Manually-written `grub_cpu == 'x86_64'` blocks (lines 34–39, 68, 81–85) should drop on aarch64 builds — easiest done with a build-time sed for the aarch64 path, or by extracting them into a separate `grub-x86_64.cfg.fragment` only included on x86 builds.
+
+The cleanest cut: keep one `grub.cfg` shared, strip the x86 shell/memtest fragments at build time when `OMARCHY_ARCH=aarch64`. Don't fork the file.
+
+### 6. mkinitcpio preset — `configs/airootfs/etc/mkinitcpio.d/linux.preset`
+
+References `vmlinuz-linux-t2` and `initramfs-linux-t2.img` (lines 5, 8). For aarch64, swap to `vmlinuz-linux` / `initramfs-linux.img`. Generate the file at build time from a template, keyed on arch.
+
+### 7. Configurator — `configs/airootfs/root/configurator`
+
+Lines 320–325:
+```bash
+if lspci -nn 2>/dev/null | grep -q "106b:180[12]"; then
+  kernel_choice="linux-t2"
+else
+  kernel_choice="linux"
+fi
+```
+T2 detection is harmless on aarch64 (`lspci` returns no match), so `kernel_choice` falls through to `linux`. **No change strictly required**, but clearer to wrap the lspci probe in `[[ $(uname -m) == "x86_64" ]]` so the intent reads correctly. Cheap.
+
+The archinstall JSON's `mirror_config.custom_servers` (lines 422–424) points at `mirror.omarchy.org`, `mirror.rackspace.com/archlinux`, `geo.mirror.pkgbuild.com` — none of these serve aarch64. For aarch64 the list must be `mirror.archlinuxarm.org` and friends. Branch the JSON template on `OMARCHY_ARCH` (or `uname -m` at runtime, since this file runs on the live ISO).
+
+### 8. pacman configs — `configs/pacman-online-{stable,rc,edge,offline}.conf`
+
+The `$arch` placeholder is pacman-resolved (matches `Architecture = auto`), so `https://stable-mirror.omarchy.org/$repo/os/$arch` adapts automatically — **as long as the mirror serves aarch64**. The omarchy mirror is the bottleneck (prerequisite #2). The `arch-mact2` repo is x86-only by definition; gate it behind arch on aarch64 builds (drop the section).
+
+### 9. Smoke-test scripts — `bin/omarchy-iso-boot`, `bin/omarchy-vm`
+
+Detect arch from the ISO filename (or accept a flag) and switch:
+- x86_64: `qemu-system-x86_64`, `/usr/share/edk2/x64/OVMF_CODE.4m.fd` + `OVMF_VARS.4m.fd` (unchanged).
+- aarch64: `qemu-system-aarch64`, `-machine virt -cpu max`, `/usr/share/edk2/aarch64/QEMU_CODE.fd` + `QEMU_VARS.fd` (Arch package: `edk2-armvirt`).
+
+Both scripts hardcode the OVMF path; small, mechanical fix.
+
+### 10. Release script — `bin/omarchy-iso-release:52`
+
+```bash
+latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-"$INSTALLER_REF".iso | head -n1)
+```
+Hardcoded `x86_64` glob. Take an arch arg, or do `*${OMARCHY_ARCH}-${INSTALLER_REF}.iso`. The ISO filename already contains arch (set by archiso from `profiledef.sh`), so this just needs the glob parameterized.
+
+### 11. CI — `.github/workflows/nightly-build.yml`
+
+Add a matrix:
+```yaml
+strategy:
+  matrix:
+    arch: [x86_64, aarch64]
+    include:
+      - arch: x86_64
+        runner: ubuntu-latest
+      - arch: aarch64
+        runner: ubuntu-24.04-arm   # GitHub-hosted ARM runner, GA
+```
+Pass `--arch ${{ matrix.arch }}` to the build. Upload artifacts named per-arch.
+
+If GitHub-hosted ARM runners aren't available on this org's plan, fall back to QEMU emulation on `ubuntu-latest` (slow, ~3-4× build time) or self-hosted.
+
+---
+
+## Files to modify (summary)
+
+Code:
+- `bin/omarchy-iso-make` — add `--arch` flag, branch docker image/platform
+- `bin/omarchy-iso-boot` — branch QEMU binary + OVMF path
+- `bin/omarchy-vm` — same as iso-boot
+- `bin/omarchy-iso-release` — parameterize ISO glob
+- `builder/build-iso.sh` — main branching: Node.js URL, package list filename, releng overlay fixups, kernel package
+- `builder/archinstall.packages` — filter microcode on aarch64 (sentinel comments + filter step)
+- `configs/profiledef.sh` — env-driven `arch` + BCJ filter + bootmodes
+- `configs/efiboot/loader/loader.conf` — per-arch default entry
+- `configs/efiboot/loader/entries/01-archiso-x86_64-linux.conf` — generate aarch64 sibling at build time
+- `configs/grub/grub.cfg`, `loopback.cfg` — strip x86-only fragments on aarch64
+- `configs/airootfs/etc/mkinitcpio.d/linux.preset` — template by arch (drop linux-t2 on aarch64)
+- `configs/airootfs/root/configurator` — branch archinstall JSON mirror list on `uname -m`; optionally guard lspci T2 probe
+- `.github/workflows/nightly-build.yml` — matrix x86_64/aarch64
+
+No new files unless we go the dual-list route on archinstall.packages or efiboot loader entries; preferred path is build-time templating to keep one source of truth.
+
+---
+
+## Verification
+
+**Local (host is x86_64):**
+1. `bin/omarchy-iso-make --arch x86_64` — must produce a byte-similar ISO to today's nightly (smoke test for regressions in the refactor).
+2. `bin/omarchy-iso-make --arch aarch64` — succeeds (slow under QEMU binfmt; expect 30-60 min).
+3. `bin/omarchy-iso-boot release/omarchy-*-aarch64-*.iso` — boots to the configurator under `qemu-system-aarch64 -machine virt`. Walk through the picker, confirm archinstall lays down a working system, reboot into the installed system.
+4. Live-iso shell: `pacman -Sy && pacman -Si linux` returns an aarch64 package from `mirror.archlinuxarm.org`.
+
+**On real hardware (post green QEMU run):**
+- AWS Graviton VM (`c7g.medium`, dd ISO to a volume, attach as boot) — fastest cloud check, no hardware needed.
+- One physical ARM64 UEFI box if available (Ampere dev kit, Snapdragon X laptop, etc.) — the long pole.
+
+**CI:**
+- Both matrix legs go green on a manual `workflow_dispatch` before merging.
+- Nightly produces both ISOs as artifacts.
+
+---
+
+## Open risks (call out before implementation)
+
+1. **mkarchiso on aarch64 is less-trodden ground.** It accepts `arch="aarch64"`, but the upstream Arch project doesn't dogfood it. Expect to file/patch around small bugs in archiso's helper scripts. Keep the archiso submodule pin tight so a regression doesn't surprise nightly.
+2. **Limine + LUKS + Btrfs + Snapper on aarch64** — every one of these works individually on ARM, but the combination is what omarchy ships. Worth one manual end-to-end pass before declaring done.
+3. **Apple T2 / linux-t2 / `arch-mact2` repo** are silently dropped on aarch64; users mistakenly trying to install the aarch64 ISO on a T2 Mac will get an obviously-wrong result. The configurator could refuse to install when arch mismatch is detected, but that's outside this plan.

plans/consumer-secure-boot.md

@@ -0,0 +1,395 @@
+# Consumer Secure Boot Plan: Microsoft Shim + MOK + UKI
+
+## Goal
+
+Support Omarchy installs on consumer laptops that ship with UEFI Secure Boot enabled and trust the Microsoft UEFI CA, without requiring users to disable Secure Boot.
+
+This plan targets normal consumer hardware, especially Windows dual-boot machines. OEM-controlled hardware with Omarchy-owned firmware keys is a separate path.
+
+## Core Architecture
+
+Use a Microsoft-signed first-stage shim, then boot only signed Omarchy-controlled artifacts.
+
+```text
+Firmware Secure Boot
+  -> Microsoft-signed Omarchy shim
+    -> MokManager when key enrollment is pending
+    -> signed second-stage boot manager
+      -> signed Unified Kernel Image (UKI)
+        -> encrypted Omarchy root
+```
+
+For the installed OS, use machine-local Machine Owner Key (MOK) signing for UKIs generated during install and later kernel updates.
+
+## Why MOK For Installed Systems
+
+Omarchy's installed UKI is machine-specific because it includes or depends on install-time data such as:
+
+- Kernel command line for encrypted root.
+- Initramfs generated for the installed system.
+- Kernel package version selected at install or update time.
+
+We must not ship Omarchy's private release signing key on the ISO or installed system. Therefore:
+
+1. The official ISO is signed by Omarchy release infrastructure.
+2. During install, generate a machine-local Secure Boot keypair.
+3. Enroll the public certificate through MokManager.
+4. Sign installed UKIs and update-generated UKIs with the local private key.
+5. Store the local private key only on the encrypted installed root, never on the ESP.
+
+This preserves offline tamper resistance for `/boot` while avoiding any central private key on user machines.
+
+## Scope Constraints
+
+- UEFI only.
+- Microsoft UEFI CA trust path only for consumer machines.
+- No custom firmware key enrollment for v1 consumer installs.
+- No TPM auto-unlock for Omarchy root in v1.
+- No attempt to modify Windows BitLocker protectors or TPM ownership.
+- Secure Boot mode uses signed UKIs only; no unsigned external kernel, initramfs, or command line files.
+- Secure Boot mode may use a different boot manager than the current Limine path until Limine has a proven verified-boot story.
+
+## Bootloader Decision
+
+Signing Limine as an EFI binary is not sufficient if Limine can then boot unsigned kernels, initrds, or configs. For v1 Secure Boot support, use a boot path with a small, enforceable verification surface:
+
+```text
+shim -> systemd-boot -> signed UKI
+```
+
+Policy:
+
+- Keep Limine as the normal non-Secure-Boot bootloader unless we later prove Limine enforces signed payloads correctly.
+- Use systemd-boot only for Secure Boot installs if that is the fastest reliable path.
+- Boot only UKIs with embedded command line and initramfs.
+- Disable or avoid unsigned boot entry editing in Secure Boot mode.
+
+If later validation proves Limine can enforce signed payloads behind shim, this plan can swap the second stage while keeping the shim, MOK, UKI, and signing architecture.
+
+## Required Artifacts
+
+### Omarchy Shim Artifacts
+
+These are release artifacts, not generated on normal developer machines:
+
+- `shimx64.efi`, signed by Microsoft UEFI CA.
+- `mmx64.efi` / MokManager artifact compatible with the shim.
+- Optional `fbx64.efi` fallback artifact if needed by the selected shim packaging.
+- Shim SBAT metadata owned by Omarchy.
+- Omarchy public release certificate embedded in shim.
+
+Do not depend on another distribution's shim as a permanent product strategy. Omarchy needs its own shim submission, SBAT identity, revocation path, and release process.
+
+### Omarchy Signing Material
+
+Release infrastructure owns:
+
+- Omarchy Secure Boot release private key, stored offline or in an HSM-backed CI secret store.
+- Omarchy Secure Boot release public certificate, embedded in shim and shipped for verification.
+
+Installed systems own:
+
+- Machine-local MOK private key, stored on encrypted root with `0600` permissions.
+- Machine-local MOK public certificate, enrolled through MokManager.
+
+Private keys must never be committed to this repo.
+
+## Build-Time Flow
+
+Add a Secure Boot-capable ISO build mode.
+
+```text
+bin/omarchy-iso-make --secure-boot
+```
+
+Build behavior:
+
+1. Add Microsoft-signed Omarchy shim artifacts to the ISO UEFI boot path.
+2. Build the live environment boot payload as a UKI.
+3. Sign the live UKI with the Omarchy release key in official builds.
+4. Sign any second-stage EFI binary with the Omarchy release key.
+5. Assert that every Secure Boot UEFI entry uses the signed shim path.
+6. Assert that no unsigned kernel/initramfs path is offered in Secure Boot UEFI mode.
+
+Local developer builds should support a dev-signing mode for QEMU validation:
+
+```text
+OMARCHY_SECURE_BOOT_SIGNING_MODE=dev
+```
+
+Dev mode creates local test keys and is only expected to boot in QEMU firmware enrolled with those test keys. It must not be presented as Microsoft Secure Boot compatible.
+
+## Installed-System Flow
+
+When the live installer detects Secure Boot enabled:
+
+1. Show a Secure Boot explanation before disk mutation.
+2. If Windows is detected, warn the user to suspend BitLocker and have the recovery key available.
+3. Install Omarchy's shim to its own ESP directory, for example `EFI/Omarchy`.
+4. Do not modify `EFI/Microsoft`.
+5. Generate a machine-local MOK keypair under the installed encrypted root.
+6. Build an installed UKI with embedded kernel, initramfs, command line, and OS release data.
+7. Sign the installed UKI with the machine-local MOK private key.
+8. Sign the selected second-stage boot manager with the machine-local MOK private key, unless it is release-signed and expected to remain static.
+9. Schedule public certificate enrollment with `mokutil --import`.
+10. Tell the user they must complete MokManager enrollment on the next reboot.
+11. Preserve current firmware boot order by default on dual-boot machines.
+
+Expected first reboot sequence after install:
+
+```text
+Firmware -> Omarchy shim -> MokManager -> user enrolls Omarchy machine key -> reboot -> Omarchy shim -> signed boot manager -> signed UKI -> LUKS unlock
+```
+
+## Kernel Update Flow
+
+Secure Boot installs need deterministic UKI regeneration and signing after kernel or initramfs changes.
+
+Add a target-system hook that:
+
+1. Regenerates the initramfs.
+2. Rebuilds the UKI.
+3. Signs the UKI with the machine-local MOK private key.
+4. Writes it atomically to the ESP.
+5. Keeps at least one previously booted signed UKI as fallback.
+
+Failure policy:
+
+- If signing fails, do not replace the currently bootable UKI.
+- If ESP space is low, keep the current UKI and fail loudly.
+- If the local signing key is missing, block the update from producing an unsigned boot artifact.
+
+## File Changes
+
+### `bin/omarchy-iso-make`
+
+Add flags:
+
+```text
+--secure-boot       build Secure Boot-capable ISO flavor
+--secure-boot-dev   build with local test keys for QEMU only
+```
+
+Pass mode and signing configuration into the Docker build environment.
+
+### `builder/build-iso.sh`
+
+Add Secure Boot build support:
+
+- Copy shim artifacts into the UEFI boot path.
+- Build live UKI.
+- Sign live UKI and second-stage EFI artifact.
+- Fail official Secure Boot builds if release signing material is unavailable.
+- Write `/root/omarchy_secure_boot_mode` into the live environment.
+- Assert that Secure Boot boot entries do not point at unsigned payloads.
+
+### `builder/secure-boot/`
+
+Add non-secret Secure Boot build inputs:
+
+- Public release certificate.
+- SBAT template.
+- Artifact manifest with expected shim/MokManager checksums.
+- Developer test-key generation script for QEMU only.
+
+Do not store private keys in this directory.
+
+### `configs/airootfs/root/configurator`
+
+Add Secure Boot detection and UX:
+
+- Detect UEFI Secure Boot state through efivars and/or `mokutil --sb-state`.
+- Detect Windows through ESP vendor paths and partition metadata.
+- Warn about BitLocker recovery risk when Windows is present.
+- Explain one-time MokManager enrollment.
+- Write `secure_boot.sh` with simple shell state for `.automated_script.sh`.
+
+Example state:
+
+```bash
+SECURE_BOOT_ENABLED=true
+SECURE_BOOT_INSTALL=true
+SECURE_BOOT_BOOTLOADER=systemd-boot
+SECURE_BOOT_UKI=true
+SECURE_BOOT_MOK_COMMON_NAME="Omarchy Machine Owner Key"
+```
+
+### `configs/airootfs/root/.automated_script.sh`
+
+Add Secure Boot install support:
+
+- Source `secure_boot.sh` after configurator runs.
+- Install the Secure Boot boot path when `SECURE_BOOT_INSTALL=true`.
+- Generate machine-local MOK keypair in the installed encrypted root.
+- Build and sign UKI.
+- Schedule MOK enrollment with `mokutil --import`.
+- Install kernel-update hooks for UKI rebuild/signing.
+- Preserve dual-boot firmware boot order unless explicitly promoted.
+
+### Target System Files
+
+Add installed files similar to:
+
+```text
+/etc/omarchy/secure-boot.conf
+/etc/kernel/cmdline
+/etc/pacman.d/hooks/90-omarchy-uki.hook
+/usr/local/sbin/omarchy-build-uki
+/usr/local/sbin/omarchy-sign-uki
+/boot/EFI/Omarchy/shimx64.efi
+/boot/EFI/Omarchy/mmx64.efi
+/boot/EFI/Omarchy/systemd-bootx64.efi
+/boot/EFI/Linux/omarchy-linux.efi
+/boot/EFI/Linux/omarchy-linux-fallback.efi
+```
+
+Exact paths can change during implementation, but signed boot artifacts must stay under Omarchy-owned ESP directories.
+
+## Package Requirements
+
+Live ISO and installed Secure Boot path need tools for:
+
+- Building UKIs.
+- Signing PE/COFF EFI binaries.
+- Importing MOK certificates.
+- Inspecting Secure Boot state.
+
+Candidate packages:
+
+```text
+sbsigntools
+efitools
+mokutil
+openssl
+systemd
+```
+
+Validate Arch package availability before implementation. Do not assume an official Arch `shim-signed` package exists.
+
+## Dual-Boot Policy
+
+On Windows dual-boot machines:
+
+- Never modify Windows boot files.
+- Never clear or change TPM state.
+- Never change BitLocker protectors.
+- Preserve existing firmware default boot order by default.
+- Warn that adding a boot entry or changing ESP contents can trigger BitLocker recovery.
+- Recommend suspending BitLocker from Windows before install and resuming it after both OSes boot.
+
+If the user chooses to make Omarchy first in boot order, capture the old `BootOrder` and provide rollback guidance.
+
+## Security Model
+
+Protected against:
+
+- Offline replacement of unsigned kernels on the ESP.
+- Offline modification of initramfs or kernel command line when UKI signature verification is enforced.
+- Accidental boot of unsigned Omarchy boot payloads in Secure Boot mode.
+
+Not protected against in v1:
+
+- A compromised running root user signing malicious future UKIs with the local MOK key.
+- Evil-maid attacks that trick the user into enrolling a malicious MOK.
+- Attacks requiring TPM-measured boot or remote attestation.
+
+Mitigations:
+
+- Store local private key only on encrypted root.
+- Make MokManager enrollment instructions explicit and brand-specific.
+- Display expected certificate fingerprint before reboot.
+- Keep release signing key outside shipped media.
+- Keep SBAT metadata current for revocation response.
+
+## QEMU Validation
+
+Use QEMU with OVMF Secure Boot enabled and test keys enrolled.
+
+Test matrix:
+
+1. Secure Boot ISO boots with test shim/test db in OVMF.
+2. Unsigned live UKI fails to boot.
+3. Tampered live UKI fails to boot.
+4. Secure Boot install completes to empty disk.
+5. First installed boot enters MokManager enrollment flow.
+6. After MOK enrollment, installed Omarchy boots and prompts for LUKS unlock.
+7. Tampered installed UKI fails to boot.
+8. Kernel update regenerates and signs a new UKI.
+9. Failed signing leaves previous UKI bootable.
+10. Dual-boot disk with Windows-style ESP preserves `EFI/Microsoft` and boot order.
+
+QEMU cannot fully prove Microsoft production trust. Hardware validation is required with firmware that trusts Microsoft UEFI CA and has Secure Boot enabled.
+
+## Hardware Validation
+
+Minimum hardware tests:
+
+1. Microsoft Secure Boot enabled laptop boots official Secure Boot ISO.
+2. Windows dual-boot install preserves Windows boot.
+3. BitLocker-suspended install avoids recovery prompt after resuming BitLocker.
+4. BitLocker-active install warning is visible before any disk mutation.
+5. Installed Omarchy boots only after MOK enrollment.
+6. Secure Boot remains enabled after install.
+7. Kernel update boots with newly signed UKI.
+8. Manually tampered UKI is rejected.
+9. Firmware boot order is preserved unless user opted to promote Omarchy.
+
+## Rollout Plan
+
+### Phase 1: Research And Decisions
+
+- Confirm shim submission requirements and timeline.
+- Confirm selected second-stage boot manager.
+- Confirm UKI generation mechanism on Arch.
+- Confirm package availability for signing and MOK workflows.
+- Decide local MOK key storage and update-hook policy.
+
+### Phase 2: Dev Secure Boot In QEMU
+
+- Add dev keys and QEMU OVMF Secure Boot harness.
+- Build a dev-signed live UKI.
+- Boot ISO in QEMU with test keys.
+- Prove unsigned and tampered payload rejection.
+
+### Phase 3: Installed UKI + MOK Flow
+
+- Generate local MOK key during install.
+- Build and sign installed UKI.
+- Schedule MokManager enrollment.
+- Boot installed system in QEMU after enrollment.
+- Add kernel update hook and fallback UKI handling.
+
+### Phase 4: Official Shim And Release Signing
+
+- Build Omarchy shim with SBAT metadata and embedded release cert.
+- Submit shim artifacts for Microsoft signing.
+- Integrate signed shim artifacts into official build pipeline.
+- Add release signing with HSM/offline key handling.
+
+### Phase 5: Consumer Dual-Boot UX
+
+- Add Secure Boot and BitLocker warnings to configurator.
+- Preserve Windows boot order by default.
+- Add MOK enrollment instructions and certificate fingerprint display.
+- Validate on real Windows hardware.
+
+## Acceptance Criteria
+
+- Official Secure Boot ISO boots on Microsoft Secure Boot hardware without disabling Secure Boot.
+- Secure Boot install does not ship or expose Omarchy release private keys.
+- Installed Omarchy boots through shim after MOK enrollment.
+- Installed Omarchy root remains LUKS-encrypted and passphrase-unlocked.
+- Kernel updates produce signed UKIs automatically.
+- Tampered UKIs fail to boot.
+- Windows ESP contents are preserved.
+- Windows boot order is preserved by default.
+- Secure Boot mode never offers an unsigned kernel/initramfs boot entry.
+
+## Open Questions
+
+- Whether v1 should use systemd-boot, GRUB, or a verified Limine configuration as the second stage.
+- Whether the local MOK private key should be encrypted with a user-supplied passphrase or stored root-only on encrypted root.
+- How to support signed out-of-tree kernel modules, especially proprietary GPU drivers or DKMS packages.
+- How snapshot booting should work when each bootable kernel must be a signed UKI.
+- Whether official builds should always be Secure Boot-capable or ship a separate Secure Boot ISO flavor.
+- What user-facing recovery path should exist if MOK enrollment is skipped or fails.

plans/dual-boot.md

@@ -0,0 +1,158 @@
+# Dual-Boot Installation Support for Omarchy ISO
+
+## Context
+
+Currently, the Omarchy installer wipes the entire selected disk (`"wipe": true`) and creates two partitions: a 2GB FAT32 ESP and a LUKS-encrypted Btrfs root. This means users must dedicate an entire disk to Omarchy. Adding dual-boot support lets users install alongside an existing OS (typically Windows) while keeping the Omarchy partition encrypted.
+
+## Core Approach: `pre_mounted_config`
+
+**Do our own partitioning, then hand off to archinstall for package installation only.**
+
+archinstall's `manual_partitioning` mode has a long history of bugs with existing partitions and LUKS (archinstall issues #998, #2072, #2444). Instead, we:
+
+1. Detect existing partitions and free space ourselves (with `sgdisk`/`parted`)
+2. Create the LUKS partition and Btrfs subvolumes ourselves (with `cryptsetup`/`mkfs.btrfs`)
+3. Mount everything at `/mnt/archinstall`
+4. Tell archinstall to use `"config_type": "pre_mounted_config"` — it installs packages into our pre-mounted tree and does zero disk operations
+5. Handle encryption config (crypttab, mkinitcpio hooks, bootloader cmdline) in post-install
+
+The existing full-disk path stays completely unchanged. Dual-boot is a parallel code path.
+
+## Implementation Guardrails
+
+- **Run target changes in chroot** — all target-system commands (`mkinitcpio -P`, `limine-scan`, bootloader config updates) must run via `arch-chroot "$INSTALL_ROOT" ...`
+- **Edit target files under `$INSTALL_ROOT` only** — write `mkinitcpio` hook config, `limine.conf`, `crypttab`, and related files in `$INSTALL_ROOT/etc` and `$INSTALL_ROOT/boot` (never in the live environment root)
+- **Settle kernel partition state** — after creating the new partition, run `partprobe "$DISK"` and `udevadm settle` before `cryptsetup` to avoid device-node races
+- **Deterministic fstab** — always generate `/etc/fstab` for dual-boot with overwrite semantics (e.g., `genfstab -U "$INSTALL_ROOT" > "$INSTALL_ROOT/etc/fstab"`) to avoid duplicate entries on retries
+- **Hook compatibility** — when updating mkinitcpio hooks, add `encrypt` for busybox initramfs or `sd-encrypt` for systemd initramfs; never assume one universally
+- **Safe rollback on failure** — on any dual-boot setup failure: unmount mounts, close LUKS mapping, and surface recovery guidance; optionally delete the just-created partition only if it was created in this run
+
+## Scope Constraints
+
+- **UEFI/GPT only** — dual-boot on MBR/BIOS is too fragile; those users get full-disk only
+- **No auto-shrinking** — users must free up space from their existing OS first (e.g., Windows Disk Management). Too risky to shrink partitions automatically
+- **Minimum 20GB free space** required for Omarchy
+
+## User Flow
+
+```
+Select disk → Detect layout →
+
+  If disk has existing OS + ESP + ≥20GB free space:
+    "How would you like to install?"
+      → "Install alongside Windows (use 85GB free space)"
+      → "Erase entire disk"
+
+  If disk is empty or no free space:
+    Existing "Confirm overwriting" flow (unchanged)
+```
+
+## File Changes
+
+### 1. `configs/airootfs/root/configurator`
+
+**Add after disk selection (line 233), before config generation:**
+
+- `detect_disk_layout()` — examines selected disk for:
+  - GPT partition table (required for dual-boot)
+  - Existing ESP partition (via `lsblk` PARTTYPE matching EFI GUID)
+  - Free unallocated space (via `sgdisk -F`/`-E` or `parted print free`)
+  - OS detection for installer UX warnings/prompts (not boot correctness): mount ESP read-only, check common vendor paths like `EFI/Microsoft`, `EFI/systemd`, `EFI/ubuntu`, `EFI/fedora`, `EFI/GRUB`
+
+- `install_mode_form()` — shows gum choose with dual-boot vs erase options when conditions are met. Sets `DUAL_BOOT=true/false`.
+
+**Generate different JSON when `DUAL_BOOT=true`:**
+
+```json
+{
+    "disk_config": {
+        "config_type": "pre_mounted_config",
+        "mountpoint": "/mnt/archinstall"
+    }
+}
+```
+
+No `device_modifications`, no `disk_encryption`, no `btrfs_options` — we handle all of that ourselves. Everything else (hostname, kernels, packages, etc.) stays the same.
+
+**Write `install_mode.sh`** alongside the other config files:
+
+```bash
+DUAL_BOOT=true
+DISK=/dev/nvme0n1
+ESP_PARTITION=/dev/nvme0n1p1
+```
+
+### 2. `configs/airootfs/root/.automated_script.sh`
+
+**Source `install_mode.sh`** in `run_configurator()` if it exists.
+
+**Add `setup_dual_boot_partitions()`** — runs before archinstall when `DUAL_BOOT=true`:
+
+1. Select the largest contiguous free region and run `sgdisk` to create new partition there (type 8309 = Linux LUKS)
+2. `partprobe "$DISK"` + `udevadm settle` so new partition node is present
+3. `cryptsetup luksFormat` + `luksOpen` with user's password
+4. `mkfs.btrfs` on `/dev/mapper/omarchy_root`
+5. Create Btrfs subvolumes: `@`, `@home`, `@log`, `@pkg`
+6. Mount subvolumes at `/mnt/archinstall` with `compress=zstd`
+7. Mount existing ESP (untouched) at `/mnt/archinstall/boot`
+8. Generate target `/etc/fstab` from mounted filesystems before post-install steps
+
+**Add `configure_dual_boot_post_install()`** — runs after archinstall:
+
+1. Write `/etc/crypttab` entry using LUKS UUID/PARTUUID (stable identifier), e.g. `omarchy_root UUID=<luks-uuid> none luks,discard`
+2. Update mkinitcpio hooks before `filesystems`: `encrypt` (busybox) or `sd-encrypt` (systemd)
+3. Regenerate initramfs with `arch-chroot "$INSTALL_ROOT" mkinitcpio -P`
+4. Configure Limine kernel cmdline to match initramfs mode:
+   - busybox `encrypt`: `cryptdevice=UUID=<uuid>:omarchy_root root=/dev/mapper/omarchy_root`
+   - systemd `sd-encrypt`: `rd.luks.name=<uuid>=omarchy_root root=/dev/mapper/omarchy_root` (or equivalent `rd.luks.uuid=` form)
+5. Run `arch-chroot "$INSTALL_ROOT" limine-scan` to detect other OS boot entries (Windows, etc.)
+6. Preserve current firmware default boot order unless user explicitly chooses to make Limine first (capture and restore `BootOrder` if `efibootmgr` side effects reorder entries)
+
+**Use `$INSTALL_ROOT` variable** — defaults to `/mnt` for full-disk, `/mnt/archinstall` for dual-boot. Post-install steps (offline mirror bind-mount, sudoers, omarchy copy) reference this instead of hardcoded `/mnt`.
+
+### 3. `builder/build-iso.sh` + `builder/archinstall.packages`
+
+Add `parted` to packages available in the live ISO (needed for free space detection).
+
+## Bootloader Coexistence
+
+Limine installs to `ESP/EFI/arch-limine/` and registers via `efibootmgr`. This sits alongside:
+- Windows Boot Manager at `ESP/EFI/Microsoft/Boot/bootmgfw.efi`
+- Any other bootloader in its own ESP subdirectory
+
+`limine-scan` auto-detects other UEFI boot entries and adds them to `limine.conf`. Users can choose OS at boot.
+
+**Boot order policy**: creating a new EFI entry must not silently change the current default boot target. Keep existing firmware boot order by default and only promote Limine when user opts in.
+
+Implementation note: when registering Limine with `efibootmgr`, do not pass reorder flags by default; if firmware still changes order, explicitly restore prior `BootOrder` unless the user opted to promote Limine.
+
+**ESP size note**: Windows typically creates a 100-260MB ESP. This is enough for Limine + kernel + initramfs, but Snapper boot snapshots (which copy kernels to ESP) will be limited or disabled.
+
+**ESP free-space threshold**:
+- If ESP has `<100MB` free at install time: show a strong warning (do not block install)
+- If ESP has `<64MB` free: hide dual-boot option and require full-disk install (or user frees space first)
+
+**BitLocker warning**: If Windows is detected, show a warning about having the BitLocker recovery key ready, since modifying ESP/UEFI entries can trigger recovery.
+
+## Edge Cases
+
+| Scenario | Behavior |
+|----------|----------|
+| Disk is empty | Full-disk install only (current behavior) |
+| Existing OS but no free space | Full-disk install only, with note to free space first |
+| Free space < 20GB | Dual-boot option not shown |
+| MBR/BIOS disk | Dual-boot option not shown |
+| ESP < 100MB free after mount | Warn user; continue allowed |
+| ESP < 64MB free after mount | Dual-boot option not shown |
+| Multiple free regions | Use largest contiguous region |
+| Partitioning/setup failure mid-run | Cleanup mounts/LUKS and abort safely |
+
+## Verification
+
+1. **Regression**: Full-disk install in VM with empty disk — must work identically to today
+2. **Dual-boot with Windows**: VM with Windows installed + 40GB free space — detect Windows, install alongside, both OSes boot
+3. **Dual-boot with Linux**: VM with another Linux + free space — similar test
+4. **No free space**: VM with fully partitioned disk — dual-boot option should not appear
+5. **Encryption**: After dual-boot install, verify LUKS unlock prompt at boot and encrypted root
+6. **Initramfs mode**: Validate both busybox and systemd hook paths boot correctly (`encrypt` vs `sd-encrypt`)
+7. **Boot order**: Verify existing default UEFI entry remains unchanged unless user opted to promote Limine

plans/oem-install.md

@@ -0,0 +1,224 @@
+# OEM Install + First-Boot Setup Plan
+
+## Goal
+
+Create a second ISO flavor for OEM preloading that is installed to internal storage at factory time, then boots into customer setup on first power-on (no external media required), and ends in a fully encrypted Omarchy install.
+
+## Product Requirements
+
+- Factory can preload one image to internal disk.
+- Customer first boot launches setup flow automatically (already works: `.automated_script.sh` runs configurator on tty1).
+- Customer chooses credentials/settings.
+- Final installed OS uses full-disk encryption (LUKS) with customer password (already works: configurator collects password and passes it to archinstall as `encryption_password`).
+- Existing consumer ISO behavior remains unchanged.
+
+---
+
+## Chosen Architecture
+
+### Bootstrapping model
+- OEM devices ship with an OEM bootstrap ISO image written to internal disk.
+- On first boot, `copytoram=y` kernel arg loads the live environment into RAM, freeing the internal disk.
+- Bootstrap environment launches existing configurator + installer.
+- Installer performs a fresh install to internal disk with LUKS encryption enabled.
+- Bootstrap environment is overwritten during install.
+
+### Recovery model: zero-recovery
+- No permanent recovery partition.
+- Simplest and strongest security story.
+- Recovery requires external reinstall media.
+
+---
+
+## Non-Goals
+
+- No on-device recovery workflow.
+- No changes to normal installer UX outside explicit OEM mode checks and warnings.
+- No factory credential provisioning.
+
+---
+
+## Repo Implementation Plan
+
+## 1) Add OEM build mode
+
+### Files
+- `bin/omarchy-iso-make`
+- `builder/build-iso.sh`
+
+### Changes
+- Add CLI flag `--oem` to `bin/omarchy-iso-make`.
+- Pass `OMARCHY_MODE=oem` into Docker build env (default `normal`).
+- In `builder/build-iso.sh`, write mode marker `/root/omarchy_mode` containing `oem` or `normal` (same pattern as `omarchy_mirror`).
+- Keep OEM on current boot stack (`uefi.grub` + `bios.syslinux`); do not add or depend on systemd-boot paths.
+- When `OMARCHY_MODE=oem`, inject `copytoram=y` into all shipped OEM boot entry points before `mkarchiso` runs:
+  - `grub/grub.cfg`: append to `linux` cmdline entries.
+  - `grub/loopback.cfg`: append to `linux` cmdline entries.
+  - `syslinux/archiso_sys-linux.cfg`: append to `APPEND` lines.
+- When `OMARCHY_MODE=oem`, remove accessibility/speakup boot entries:
+  - `grub/grub.cfg`: remove `archlinux-accessibility` menuentry.
+  - `grub/loopback.cfg`: remove `archlinux-accessibility` menuentry.
+  - `syslinux/archiso_sys-linux.cfg`: remove `arch64speech` label block.
+- When `OMARCHY_MODE=oem`, override `iso_application` in `profiledef.sh` to `"Omarchy OEM Installer"`.
+- Rename output ISO with `-oem` suffix (in addition to existing `-$OMARCHY_INSTALLER_REF` suffix).
+
+### Hardening
+- Add post-injection build assertion that fails build if any expected boot config does not contain `copytoram=y`.
+- Add post-injection build assertion that fails build if any OEM boot config still contains accessibility/speakup entries.
+- Make injection idempotent (do not duplicate `copytoram=y` if already present).
+
+### Acceptance criteria
+- `./bin/omarchy-iso-make --oem` builds successfully.
+- OEM ISO boot entries contain `copytoram=y` in all supported boot paths.
+- OEM ISO does not expose accessibility/speakup boot entries.
+- Normal build output and behavior remain unchanged.
+
+### Suggested verification commands
+- `bsdtar -xOf out/<iso>.iso boot/grub/grub.cfg | rg copytoram=y`
+- `bsdtar -xOf out/<iso>.iso boot/grub/loopback.cfg | rg copytoram=y`
+- `bsdtar -xOf out/<iso>.iso boot/syslinux/archiso_sys-linux.cfg | rg copytoram=y`
+- `bsdtar -xOf out/<iso>.iso boot/grub/grub.cfg | rg 'accessibility|speakup'` (should return no matches)
+- `bsdtar -xOf out/<iso>.iso boot/syslinux/archiso_sys-linux.cfg | rg 'speech|accessibility'` (should return no matches)
+
+---
+
+## 2) Add OEM safety guardrails
+
+### Why
+OEM image boots from internal disk and later wipes that same disk. Live environment must be fully in RAM before install begins.
+
+### File
+- `configs/airootfs/root/.automated_script.sh`
+
+### Changes
+- Before `run_configurator`, if `/root/omarchy_mode` is `oem`:
+  - Verify `/proc/cmdline` contains `copytoram=y`; abort with clear actionable error if missing.
+  - Verify factory hardware minimum using `MemTotal`:
+    - Require `MemTotal >= 8 GiB`.
+    - Abort with clear error if below minimum.
+  - Verify runtime memory safety using `MemAvailable`:
+    - Minimum threshold: `1.5 x ISO size + 1 GiB`.
+    - Abort with clear error if below threshold.
+  - Verify runtime state indicates live root is in RAM (for example, expected archiso runtime mounts present and boot media not actively mounted as install target path).
+
+### Acceptance criteria
+- OEM mode aborts safely if `copytoram=y` missing from cmdline.
+- OEM mode aborts safely if `MemTotal < 8 GiB`.
+- OEM mode aborts safely if `MemAvailable` below threshold.
+- OEM mode aborts safely if runtime state does not confirm RAM-backed live environment.
+
+### Error message requirements
+- State exactly what failed.
+- State why install is blocked.
+- Provide next step (reboot using proper OEM media or use external recovery media).
+
+---
+
+## 3) OEM disk warning
+
+### Why
+With `copytoram=y`, archiso copies squashfs to RAM and releases boot device. Existing configurator call `findmnt -no SOURCE /run/archiso/bootmnt` may return empty, so exclusion filter is skipped and all physical disks are shown, including former boot disk. No disk selection logic change is required.
+
+OEM mode still needs an unmistakable warning before destructive install proceeds.
+
+### File
+- `configs/airootfs/root/configurator`
+
+### Changes
+- Read mode from `/root/omarchy_mode`.
+- If mode is `oem`, add OEM-specific warning text before existing destructive confirmation.
+- Upgrade confirmation in OEM mode to explicit typed confirmation (for example: `YES, WIPE DISK`) while preserving existing normal-mode flow.
+
+### Acceptance criteria
+- Normal ISO behavior is unchanged.
+- OEM ISO shows OEM-specific warning before disk wipe confirmation.
+- OEM typed confirmation is required before destructive action.
+- In VM with `copytoram=y`, former boot disk appears in disk list without exclusion-logic changes.
+
+---
+
+## 4) Documentation
+
+### File
+- `README.md`
+
+### Changes
+- Document `--oem` build flag and resulting artifact naming.
+- Document factory workflow: writing OEM ISO to internal disk and expected first-boot UX.
+- Document failure and recovery behavior:
+  - Missing `copytoram=y`, `MemTotal < 8 GiB`, or low `MemAvailable` causes safe abort.
+  - Interrupted/failed install requires external reinstall media.
+- Add short operator checklist for manufacturing line validation.
+
+---
+
+## 5) Validation
+
+### VM test matrix
+1. Build OEM ISO.
+2. Write OEM ISO to virtual disk (not external media emulation).
+3. Boot from virtual disk and verify:
+   - `/proc/cmdline` contains `copytoram=y`.
+   - Guardrail checks pass in healthy case.
+   - OEM boot menu does not include accessibility/speech entries.
+4. Complete setup flow on first boot.
+5. Install to same disk.
+6. Reboot into installed OS.
+7. Verify encryption:
+   - `lsblk` shows crypt mapping.
+   - `cryptsetup status` reports active LUKS device.
+   - Boot requires unlock passphrase.
+8. Validate OEM warning + typed confirmation appears and gates destructive action.
+
+### Boot path coverage
+- UEFI + GRUB path.
+- BIOS/syslinux path (if still shipped).
+
+### Hardware test matrix
+- UEFI test on at least two hardware families (Intel + AMD).
+- Confirm no external media required.
+- Confirm first boot starts setup automatically.
+
+### Negative tests
+- OEM boot without `copytoram=y` -> safe abort with clear error.
+- `MemTotal < 8 GiB` -> safe abort with clear error.
+- Low `MemAvailable` -> safe abort with clear error.
+- Runtime state not RAM-backed -> safe abort with clear error.
+- Power interruption before installer starts -> deterministic reboot behavior.
+- Power interruption during install -> recovery requires external media (documented).
+
+---
+
+## 6) Security hardening checklist
+
+- No factory credentials exist; customer sets all passwords at first boot.
+- Clear shell history and transient setup artifacts at end of install.
+- Verify no secrets in logs shipped to customer.
+- Regenerate host identity on first installed boot as needed:
+  - `machine-id`
+  - SSH host keys (if installed/enabled)
+- Keep package signature verification and keyring handling intact.
+
+---
+
+## Rollout Plan
+
+1. Implement OEM build flag, mode marker, boot config injection, and build assertions.
+2. Implement copytoram, memory, and runtime-state guardrails in `.automated_script.sh`.
+3. Add OEM warning text and typed destructive confirmation in configurator.
+4. Add docs and operator checklist.
+5. Run VM matrix, including negative tests.
+6. Run hardware matrix.
+7. Cut first OEM preproduction release for manufacturing pilot.
+
+---
+
+## Definition of Done
+
+- `--oem` build exists and is documented.
+- Device preloaded with OEM image boots directly to setup.
+- Setup installs to internal disk without external media.
+- Final installed system is LUKS-encrypted with customer-owned passphrase.
+- OEM safety guardrails fail closed with actionable errors.
+- Existing non-OEM ISO behavior remains unchanged.
+- VM and hardware QA matrix pass.

plans/protected-partition-install.md

@@ -0,0 +1,643 @@
+# Protected Partition Install Plan: Dual-Boot + Restore
+
+## Goal
+
+Implement one shared non-destructive install path that supports both:
+
+- Dual-boot installs alongside an existing OS.
+- OEM/restore installs from a permanent internal restore partition set.
+
+Beyond install: every standalone Omarchy machine — whether OEM-provisioned or installed from the consumer ISO onto an empty disk — exposes a "factory reset" command that durably stages the next boot into the on-disk restore partition set. The installed-OS command leaves the machine as though it had just been prepared to boot from restore; the restore environment owns the destructive wipe/reinstall flow. Dual-boot installs do not get factory reset (no room for a restore partition set).
+
+The current full-disk install path remains unchanged until the protected-partition path is proven. The protected path does its own partitioning, encryption, filesystems, mounts, and boot configuration, then hands a prepared mount tree to archinstall with `pre_mounted_config`.
+
+## Core Architecture
+
+Use a single installer engine with multiple partition policies.
+
+```text
+full_disk        existing archinstall default_layout + wipe:true path
+dual_boot        protect existing OS partitions, reuse existing ESP, add Omarchy LUKS root
+restore_install  protect restore partition set, create/recreate installed ESP + Omarchy LUKS root
+```
+
+The key rule: protected modes must never pass the whole disk to archinstall with `wipe: true`.
+
+## Why This Combines Both Features
+
+Dual-boot and restore installs are the same technical problem:
+
+1. Detect disk layout.
+2. Identify protected partitions.
+3. Create or format only explicitly writable Omarchy partitions.
+4. Set up encrypted root manually.
+5. Mount a complete install tree manually.
+6. Run archinstall only as a package/base-system installer.
+7. Configure encryption, fstab, initramfs, and bootloader after archinstall.
+
+Only the partition policy differs.
+
+## Scope Constraints
+
+- UEFI/GPT only for `dual_boot` and `restore_install` v1.
+- Existing BIOS/syslinux ISO behavior stays available for normal full-disk installs.
+- No automatic shrinking of existing partitions.
+- Dual-boot requires pre-existing free space.
+- Restore install requires a detected Omarchy restore partition set.
+- Installed Omarchy root is encrypted with LUKS.
+- Restore partitions are not encrypted unless a later product requirement demands it.
+- Restore payload partitions are normally left unmounted in the installed OS and mounted read-only by the restore environment. A separate restore state partition is the only restore-owned partition mounted read-write for reset triggers and recovery logs.
+- Swap matches the current full-disk install: zram for memory pressure, plus a Btrfs swapfile in a dedicated `NODATACOW` `/swap` subvolume sized to RAM for hibernation. The subvolume, swapfile, `resume` mkinitcpio hook, and `resume=<dev> resume_offset=<offset>` Limine cmdline drop-in are created post-install by Omarchy's existing `omarchy-hibernation-setup`. Protected modes must not break this: the `encrypt`/`sd-encrypt` hook must precede `resume` in mkinitcpio so the swapfile is reachable after LUKS unlock, and Limine must honor `/etc/limine-entry-tool.d/*.conf` drop-ins so the post-install hook can append resume parameters. No swap partition.
+
+## Partition Policies
+
+### Full Disk
+
+Current behavior:
+
+```text
+p1  installed ESP   FAT32  2G
+p2  installed root  LUKS   rest of disk
+```
+
+Implementation stays on archinstall `default_layout` with `wipe: true` for now.
+
+Phase 7 replaces this with a layout that mirrors `restore_install`:
+
+```text
+p1  restore ESP        FAT32   protected after install
+p2  restore payload    ext4    protected after install, read-only payload
+p3  restore state      ext4    protected after install, writable trigger/log state
+p4  installed ESP      FAT32   writable
+p5  installed root     LUKS    writable
+```
+
+Rationale: factory reset requires an on-disk restore partition set. Making this the default for standalone installs gives every consumer machine the same self-recovery capability OEM-provisioned machines get. The legacy two-partition layout becomes opt-in (e.g. `--no-restore`) for users who explicitly want the disk space back.
+
+### Dual Boot
+
+Example target disk before install:
+
+```text
+p1  existing ESP       FAT32   protected, reused as /efi
+p2  Windows MSR        MSR     protected
+p3  Windows            NTFS    protected
+    free space                 writable region
+```
+
+After install:
+
+```text
+p1  existing ESP       FAT32   protected, mounted as /efi during install
+p2  Windows MSR        MSR     protected
+p3  Windows            NTFS    protected
+p4  Omarchy root       LUKS    new encrypted Btrfs root
+```
+
+Policy:
+
+- Protect all existing partitions.
+- Reuse the existing ESP only for Omarchy boot files under `EFI/Omarchy`. Do not write top-level `vmlinuz-*`, `initramfs-*`, or vendor-looking paths on a shared ESP.
+- Mount the shared ESP at `/efi`, keep `/boot` on the encrypted root, and install an Omarchy-owned kernel/initramfs sync hook that copies boot artifacts into `/efi/EFI/Omarchy` after kernel or initramfs updates.
+- Refuse to install if the existing ESP is below 200 MB total or has less than 150 MB free. Warn below 300 MB total or below 200 MB free. These thresholds size for one Omarchy kernel + initramfs + Limine alongside a typical vendor loader; revisit if the Omarchy initramfs grows materially. Free space must be measured from the mounted ESP, not inferred from partition size.
+- Create one new LUKS partition in the largest single contiguous free region of at least 40 GB. Refuse otherwise. Do not stitch across multiple non-contiguous regions.
+- Preserve current firmware boot order unless the user explicitly opts to make Omarchy first.
+- Abort with a clear error if any Windows partition is detected as BitLocker/FVE, including suspended BitLocker. Do not proceed past detection. Adding a new partition to a disk with a BitLocker-protected volume changes the firmware/boot environment enough that Windows can demand the recovery key on next boot — and many users do not have it. The error message must instruct the user to turn off BitLocker from inside Windows and wait for decryption to complete, then reboot into the Omarchy installer and retry. Do not offer an "I have my recovery key, continue anyway" override in v1; users who really want it can fully disable BitLocker themselves.
+- Warn if non-BitLocker Windows is detected, since boot order changes can still surprise users.
+
+### Restore Install
+
+Recommended factory disk image layout:
+
+```text
+p1  restore ESP        FAT32   protected, boots restore environment
+p2  restore payload    ext4    protected, contains live installer/offline payload
+p3  restore state      ext4    protected from formatting, writable reset trigger/log state
+p4  installed ESP      FAT32   writable, created/recreated by installer
+p5  installed root     LUKS    writable, created/recreated by installer
+```
+
+Policy:
+
+- Protect restore ESP, restore payload, and restore state partitions from delete/format operations. Only the restore state partition is mounted read-write, and only for trigger files and logs.
+- On first boot, create installed ESP and installed root in remaining disk space.
+- On reinstall, format the installed Omarchy partitions in place by default. Only delete and recreate them when their geometry no longer matches policy (e.g. the disk was resized). Format-in-place preserves PARTUUIDs, keeps NVRAM entries valid, and avoids touching the partition table.
+- Set installed Omarchy first in boot order after successful install.
+- Keep restore boot available as firmware fallback and as a boot menu entry.
+- Require `copytoram=y` before mutating the internal disk from restore mode.
+
+Use separate restore and installed ESPs for v1. A shared ESP saves space but makes restore easier to break during normal bootloader maintenance or reinstall.
+
+## Restore Image Provisioning
+
+Create a factory artifact separate from the normal consumer ISO:
+
+```text
+omarchy-restore.img.zst
+```
+
+Factory provisioning writes this image to the internal disk once:
+
+```bash
+zstd -dc omarchy-restore.img.zst | dd of=/dev/nvme0n1 bs=16M status=progress conv=fsync
+```
+
+The restore image should contain:
+
+- A restore ESP with `EFI/BOOT/BOOTX64.EFI` fallback boot path.
+- A restore payload partition labeled `OMARCHY_RESTORE`.
+- A small restore state partition labeled `OMARCHY_STATE` for reset triggers and recovery logs.
+- The archiso live environment payload, offline package mirror, configurator, and installer scripts.
+- A boot entry that passes `omarchy.mode=restore copytoram=y`.
+- Boot configuration that locates the restore payload by stable label/UUID, not by transient disk name.
+- A signed manifest covering the archiso payload and offline mirror. The verification public key must be shipped outside the mutable restore payload, such as in the restore boot environment and installed reset tool package.
+
+The factory flasher must verify the integrity of `omarchy-restore.img.zst` before writing. The on-disk restore environment must verify its signed payload manifest at boot before mutating the internal disk. A plain checksum stored on the same writable disk is not sufficient. Without a signed manifest, a tampered or corrupted restore image silently destroys the user's data the next time they invoke "factory reset."
+
+On first restore boot:
+
+1. Bind the candidate restore disk to the actual boot source (`/run/archiso/bootmnt`, kernel command line, or equivalent). Do not select an arbitrary disk just because it has matching labels; cloned restore images can have duplicate labels and UUIDs.
+2. Move the backup GPT header to the real end of disk with `sgdisk -e` if the factory image was written to a larger disk. This relocates the header only — existing partitions are not grown. The newly-available space at the end of the disk is what installed ESP and installed root consume.
+3. On first boot only, randomize the GPT disk GUID, partition GUIDs/PARTUUIDs, and filesystem UUIDs for restore-owned partitions before generating any NVRAM entries, fstab entries, or installer state. Labels may remain stable; UUIDs must not stay cloned across machines.
+4. Detect and protect restore partitions by the newly-randomized PARTUUIDs.
+5. Create installed ESP and installed root in remaining space.
+6. Continue through the shared protected install path.
+
+## Factory Reset
+
+Goal: an installed Omarchy machine that has a restore partition set (any standalone install — `restore_install` today, `full_disk` after Phase 7) exposes a user-facing factory reset command that prepares the device to boot from internal restore without external media. After the next restore boot, the restore environment returns the device to a fresh-install state.
+
+### User Flow
+
+1. User runs `omarchy-factory-reset` from a terminal with sudo. (A GUI entry under Settings is deferred to a follow-up.)
+2. The command prints which partitions will be destroyed (installed ESP, installed root) and which will be preserved (restore ESP, restore payload, restore state), by stable identifier, and asks the user to type a confirmation phrase. The typed-phrase gate is intentional friction; no `--yes` shortcut in v1.
+3. On confirmation, the command writes a trigger file to the restore state partition, verifies or recreates the restore boot entry, and sets `BootNext` via `efibootmgr` to that restore entry.
+4. The command exits only after the trigger file is fsynced, the restore state partition is unmounted, and `BootNext` is confirmed. At that point the installed-OS side is complete: the machine has been left as though it had just been prepared to boot from the restore partition.
+5. The user reboots when ready. A later GUI may offer a "reboot now" action, but rebooting is a convenience after the staged state is durable, not part of the safety-critical mutation.
+6. The restore environment detects the trigger on boot, verifies the signed restore payload manifest, writes a reset-in-progress marker to restore state, and temporarily sets persistent `BootOrder` to restore first before mutating installed partitions.
+7. The restore environment runs the existing `restore_install` reinstall path — format installed ESP, LUKS-format installed root, run the standard install flow — non-interactively, then deletes the trigger and reset-in-progress marker.
+8. On install completion, the restore environment restores persistent `BootOrder` to installed Omarchy first, restore second, sets `BootNext` to the installed Omarchy entry, and reboots.
+9. The user lands in a fresh installed Omarchy. Normal persistent `BootOrder` (Omarchy first, restore second) has been restored.
+
+User data on installed ESP and installed root is destroyed. Restore ESP, restore payload, and restore state are protected from destructive operations throughout. The restore payload is the source of truth for the rebuild; restore state contains only trigger and recovery state.
+
+### Trigger Mechanism
+
+Use a flag file on the restore state partition rather than NVRAM variables or the restore payload. NVRAM is fragile across firmware updates, and the restore payload should stay immutable/read-only so signed manifest verification remains meaningful.
+
+- Path: `<restore-state-mount>/.omarchy-factory-reset`
+- Contents: timestamp, hostname at trigger time, optional reason. Plain text, one `key=value` per line.
+- The installed-OS command mounts the restore state partition by `OMARCHY_STATE` label, writes the flag, fsync, and unmounts. It may mount the restore payload read-only only long enough to verify the signed manifest before triggering.
+- The restore environment checks for the flag at boot. If present, it runs the reset flow non-interactively and deletes the flag on success. If absent, restore boot behaves normally (manual install/repair menu).
+- The flag must be deleted before reboot. Otherwise the machine resets itself in a loop.
+
+### Boot Order
+
+`efibootmgr --bootnext <restore-entry>` is one-shot — it takes effect on the next boot only, then NVRAM reverts to the existing `BootOrder`. This is what we want before the destructive phase: if the reset is interrupted before restore boot, the next normal boot still tries the installed Omarchy first.
+
+After the restore environment accepts the trigger and before it wipes installed partitions, it must temporarily set persistent `BootOrder` to restore first, installed Omarchy second. This prevents a power loss during reinstall from leaving firmware stuck on a half-written installed ESP. On successful reinstall, the restore environment deletes the reset-in-progress marker, restores persistent `BootOrder` to installed Omarchy first and restore second, then sets `BootNext` to the installed Omarchy entry to land the user in their fresh OS.
+
+If the installed OS cannot write and confirm `BootNext`, the staging command must remove any trigger it wrote and abort; a manual reinstall can still proceed through the firmware boot menu, but `omarchy-factory-reset` has not successfully prepared the machine. If the restore environment cannot set temporary restore-first `BootOrder` for an unattended reset, abort before destructive operations; manual reinstall can still proceed with an explicit warning.
+
+### Safety
+
+The factory reset command is a staging tool, not the destructive installer. It must:
+
+- Require root and refuse to run otherwise.
+- Refuse to run if no complete restore partition set is detected (restore ESP, restore payload, restore state), e.g. on a dual-boot machine or a `--no-restore` full-disk install.
+- Refuse to run if the signed restore payload manifest check fails — a corrupt restore is not recoverable from inside the running OS, and triggering a reset would brick the machine.
+- Verify the restore boot entry exists in NVRAM before triggering; if not, repopulate it from `EFI/BOOT/BOOTX64.EFI` fallback or abort with a message.
+- Confirm `BootNext` points to the restore boot entry before exiting, so the system is actually prepared to boot restore.
+- Print a final pre-confirmation list of partitions that will be destroyed, by stable identifier, so the user sees exactly what they are committing to.
+
+The restore environment, when running due to the trigger flag, must still apply every guard from the Safety Model. The trigger is permission to run the reinstall flow, not permission to skip safety checks.
+
+### File Changes for Factory Reset
+
+- Ship `omarchy-factory-reset` on the installed system. Source location depends on Omarchy's package boundary — either as part of the Omarchy package on the offline mirror, or copied from the live ISO into the installed system during install. Pick one consistent approach during implementation.
+- Restore state must be mountable read-write from the installed OS by an admin via `OMARCHY_STATE`. Restore payload should only be mounted read-only for manifest verification via `OMARCHY_RESTORE`.
+
+## Safety Model
+
+Protected installs must use stable identifiers, not only `/dev/nvme0n1pX` names.
+
+Track:
+
+```text
+protected partition PARTUUIDs
+restore state PARTUUID
+writable partition PARTUUIDs
+selected disk ID
+install mode
+install root
+```
+
+Every destructive operation must call a guard first:
+
+```text
+assert_writable_partition <partition>
+assert_not_protected <partition>
+```
+
+Guarded operations include:
+
+- `sgdisk --delete`
+- `sgdisk --new`
+- `wipefs`
+- `mkfs.fat`
+- `mkfs.btrfs`
+- `cryptsetup luksFormat`
+- partition table rewrites
+
+In restore mode, also assert:
+
+- `/proc/cmdline` contains `copytoram=y`.
+- The restore payload is not mounted read-write from the target disk at mutation time.
+- Restore ESP, restore payload, and restore state partitions are detected and marked protected from delete/format operations.
+- The installed target partitions do not overlap protected partition ranges.
+
+### Power Loss Recovery
+
+A torn install must be recoverable on next boot rather than leaving the disk in a state that needs manual intervention.
+
+- After partition table changes but before LUKS format: the new partition exists but holds no recognizable filesystem or LUKS header. On the next install boot, treat any writable partition without a valid header as discardable and re-run the format step.
+- After LUKS format but before archinstall completes: the LUKS header exists but no working OS is installed. On the next boot from restore or ISO, offer to wipe and retry rather than attempting to resume.
+- During archinstall: same as above. Resuming partway through a torn pacstrap is more brittle than restarting it.
+
+In dual-boot mode, "wipe and retry" applies only to the writable Omarchy partition. Protected partitions must be re-verified by PARTUUID before any retry runs — power loss does not unlock protected ranges.
+
+## Installer State Contract
+
+The configurator writes `install_mode.sh` for `.automated_script.sh` to source.
+
+Example dual-boot state:
+
+```bash
+INSTALL_MODE=dual_boot
+INSTALL_ROOT=/mnt/archinstall
+DISK=/dev/nvme0n1
+BOOT_PARTITION=/dev/nvme0n1p1
+ROOT_PARTITION=/dev/nvme0n1p4
+PROTECTED_PARTUUIDS="1111-2222 3333-4444 5555-6666"
+WRITABLE_PARTUUIDS="7777-8888"
+PROMOTE_OMARCHY_BOOT=false
+```
+
+Example restore state:
+
+```bash
+INSTALL_MODE=restore_install
+INSTALL_ROOT=/mnt/archinstall
+DISK=/dev/nvme0n1
+RESTORE_ESP_PARTITION=/dev/nvme0n1p1
+RESTORE_PAYLOAD_PARTITION=/dev/nvme0n1p2
+RESTORE_STATE_PARTITION=/dev/nvme0n1p3
+INSTALLED_ESP_PARTITION=/dev/nvme0n1p4
+ROOT_PARTITION=/dev/nvme0n1p5
+PROTECTED_PARTUUIDS="1111-2222 3333-4444 5555-6666"
+WRITABLE_PARTUUIDS="7777-8888 9999-aaaa"
+PROMOTE_OMARCHY_BOOT=true
+```
+
+Keep this file simple shell, generated only by our configurator, and quote values safely.
+
+Restore mode uses `INSTALLED_ESP_PARTITION` (distinct from `RESTORE_ESP_PARTITION`) because two ESPs are present. It also tracks `RESTORE_STATE_PARTITION` separately because that partition is writable state but protected from delete/format operations. Dual-boot mode keeps `BOOT_PARTITION` since only one ESP exists and is unambiguous.
+
+## Archinstall Config
+
+Protected modes generate this disk config and explicitly disable archinstall bootloader writes:
+
+```json
+{
+    "bootloader": null,
+    "disk_config": {
+        "config_type": "pre_mounted_config",
+        "mountpoint": "/mnt/archinstall"
+    }
+}
+```
+
+Do not include `device_modifications`, `disk_encryption`, or `btrfs_options` in protected modes. The installer handles those before and after archinstall. If archinstall does not accept `"bootloader": null`, Phase 2a must identify the supported equivalent; protected mode must not proceed while archinstall can write boot files or NVRAM entries independently.
+
+Full-disk mode keeps the existing generated `default_layout` config.
+
+**Verify before Phase 2b.** Under `pre_mounted_config`, archinstall still tends to run `genfstab`, write a bootloader, and may write `/etc/crypttab`. The plan currently assumes archinstall acts only as a base-system installer in protected mode; this needs to be confirmed on a throwaway VM. Once confirmed, decide for each step (fstab, crypttab, bootloader, initramfs, kernel cmdline) whether the manual steps below run *instead of* archinstall's behavior, *after* archinstall has had its turn, or with archinstall's step disabled in config. The bootloader outcome is a hard gate: protected mode must have a confirmed way to prevent archinstall from writing Limine files or NVRAM entries. Do not start writing the manual pre/post steps until this is resolved — the unknown sits underneath every downstream step.
+
+## File Changes
+
+### `configs/airootfs/root/configurator`
+
+Add shared detection and policy selection:
+
+- `detect_disk_layout` finds GPT state, partitions, partition ranges, filesystem labels, ESPs, ESP free space, and free regions.
+- `detect_existing_os` mounts ESP read-only and checks known vendor paths like `EFI/Microsoft`, `EFI/ubuntu`, `EFI/fedora`, `EFI/GRUB`, and `EFI/systemd`.
+- `detect_bitlocker` checks every Windows/basic-data candidate partition on the selected disk for BitLocker. Use `blkid -o value -s TYPE`; BitLocker volumes report `BitLocker` rather than `ntfs`. As a backup, read 8 bytes at offset 3 of the partition — BitLocker volumes contain `-FVE-FS-` instead of `NTFS    `. If any partition reports BitLocker, the dual-boot path aborts before any disk mutation with the message described in the dual-boot policy.
+- `detect_restore_layout` finds `OMARCHY_RESTORE` and `OMARCHY_STATE` partitions and validates the restore ESP/payload/state set.
+- `find_free_regions` finds unallocated GPT space using `sgdisk` or `parted`. Selection rule: pick the largest single contiguous region of at least 40 GB. Do not concatenate non-contiguous regions.
+- `install_mode_form` chooses between full disk, dual boot, and restore install based on context.
+
+User flow:
+
+```text
+Normal ISO boot:
+  select disk
+  detect layout
+  if existing OS/install is detected:
+    show detected installs and disk layout summary
+    always offer "Exclusive install (erase disk)" using the existing full-disk `wipe: true` path
+    if existing ESP + enough free space + guardrails pass:
+      also offer "Install alongside"
+    else:
+      show why "Install alongside" is unavailable (for example: no ESP, no suitable free space, BitLocker/FVE, ESP too small)
+  else:
+    keep current erase-disk flow
+
+Restore boot:
+  detect restore disk automatically
+  show first-install or reinstall warning
+  protect restore ESP/payload/state partitions
+  create/recreate installed partitions only
+```
+
+Generated files:
+
+- `user_credentials.json`
+- `user_configuration.json`
+- `user_full_name.txt`
+- `user_email_address.txt`
+- `install_mode.sh`
+
+### `configs/airootfs/root/.automated_script.sh`
+
+Add shared protected install functions:
+
+- Source `install_mode.sh` after configurator runs.
+- Set `INSTALL_ROOT=/mnt/archinstall` for all modes, including full-disk. A single mount root avoids subtle bugs in code touched by both paths and removes one branch from every post-install step.
+- Before changing the mount root, grep the live ISO and post-install scripts for hardcoded `/mnt` references and produce an explicit list of call sites. Update each one consciously rather than via a global rename.
+- Add `setup_protected_partitions` before archinstall.
+- Add `configure_protected_post_install` after archinstall.
+- Add cleanup trap for mounts, LUKS mappings, and temporary directories.
+
+Protected pre-install steps:
+
+1. Verify mode-specific guardrails.
+2. Create writable partitions if needed.
+3. Run `partprobe "$DISK"` and `udevadm settle`.
+4. Format installed ESP when policy requires it.
+5. `cryptsetup luksFormat` the root partition.
+6. `cryptsetup open` root as `omarchy_root`.
+7. `mkfs.btrfs /dev/mapper/omarchy_root`.
+8. Create Btrfs subvolumes `@`, `@home`, `@log`, and `@pkg`.
+9. Mount subvolumes at `$INSTALL_ROOT` with `compress=zstd`.
+10. Mount ESP at `$INSTALL_ROOT/efi`; keep `$INSTALL_ROOT/boot` as a normal directory on encrypted root.
+11. Generate deterministic fstab with overwrite semantics.
+
+Protected post-install steps:
+
+1. Configure root unlock for the initramfs hook actually in use. Root unlock is driven by initramfs + kernel cmdline, not by `/etc/crypttab`:
+   - `encrypt` hook: kernel cmdline `cryptdevice=UUID=<luks-uuid>:omarchy_root root=/dev/mapper/omarchy_root`. No crypttab entry needed for root.
+   - `sd-encrypt` hook: write `/etc/crypttab.initramfs` (not `/etc/crypttab`) with the LUKS UUID, and pass `rd.luks.name=<luks-uuid>=omarchy_root root=/dev/mapper/omarchy_root` on the kernel cmdline.
+2. Update mkinitcpio hooks for the initramfs mode actually present.
+3. Regenerate initramfs in chroot with `mkinitcpio -P`.
+4. Install an Omarchy-owned kernel/initramfs sync hook that copies boot artifacts from `/boot` to `/efi/EFI/Omarchy` after kernel or initramfs updates.
+5. Run the initial boot artifact sync before writing Limine config.
+6. Configure Limine kernel cmdline for encrypted root per the hook chosen above, pointing at namespaced artifacts under `EFI/Omarchy`.
+7. Install or update Limine on the selected installed ESP.
+8. Run `limine-scan` in chroot when appropriate.
+9. Apply mode-specific boot order policy.
+10. Leave swapfile creation, `resume` hook, and `resume=` cmdline injection to Omarchy's existing `omarchy-hibernation-setup` post-install hook. Verify `/etc/limine-entry-tool.d/` drop-ins are honored by the Limine config layout written here so that hook works unchanged.
+
+### `builder/archinstall.packages`
+
+Ensure the live environment has the tools needed for protected installs:
+
+- `parted`
+- `gptfdisk`
+- `btrfs-progs`
+- `cryptsetup`
+- `dosfstools`
+- `efibootmgr`
+- `mtools`
+
+`efibootmgr` already exists in this file, but keep it explicit in the protected-install dependency checklist.
+
+### `builder/build-iso.sh`
+
+Add build-time mode support:
+
+- Persist `/root/omarchy_mode` as `normal`, `dual_boot_capable`, or `restore`.
+- For restore builds, inject `copytoram=y omarchy.mode=restore` into restore boot entries.
+- For restore builds, assert boot entries contain `copytoram=y`.
+- For normal ISO builds, keep existing behavior except adding dual-boot capability.
+
+### `bin/omarchy-iso-make`
+
+Add optional build flags:
+
+```text
+--restore-image   build omarchy-restore.img.zst factory artifact
+```
+
+Keep the existing ISO output path unchanged unless a restore image is explicitly requested.
+
+## Bootloader Policy
+
+### Default Boot Target
+
+For any standalone install (full-disk or restore_install, with or without a restore partition set), installed Omarchy is the default boot target. The persistent `BootOrder` after every successful install or factory reset is:
+
+1. Installed Omarchy
+2. Restore (when a restore partition set exists)
+3. Firmware fallback
+
+The user should never have to pick Omarchy from a boot menu under normal operation. Restore is reachable but never default. Boot-menu entries inside Limine for restore/reinstall are convenience; they do not replace this NVRAM ordering.
+
+`BootNext` is used only for one-shot transitions (factory reset trigger, post-reset return to installed Omarchy) and must not be used to make Omarchy "stickily" default — that's the job of `BootOrder`. The only temporary exception is an in-progress factory reset: after the restore environment accepts the trigger and before it mutates installed partitions, restore becomes the persistent first boot target until reinstall succeeds.
+
+For dual-boot, the previous OS's firmware order is preserved unless the user explicitly opts to make Omarchy first. Dual-boot is the only mode where Omarchy may not be the firmware default.
+
+### Dual Boot
+
+- Install Omarchy boot files under `EFI/Omarchy` on the shared ESP.
+- Do not overwrite existing vendor directories.
+- Preserve firmware default boot order unless user opts in.
+- Run `limine-scan` so Windows/Linux entries are discoverable from Omarchy's menu. Verify on a real Windows + Linux dual-boot before depending on this — Limine's auto-detection is less battle-tested than GRUB's. If it does not pick them up cleanly, fall back to the firmware boot menu and document the limitation rather than hand-writing entries.
+- BitLocker is handled at detection time by aborting the install (see Dual Boot policy). The bootloader path therefore only ever sees Windows volumes with BitLocker fully off/decrypted.
+
+### Restore Install
+
+- Installed Omarchy gets its own ESP and boot entry.
+- Restore ESP keeps `EFI/BOOT/BOOTX64.EFI` fallback path.
+- After successful install, write `BootOrder` as installed Omarchy first, restore second. Do not reorder on every boot — only after install or factory reset.
+- Add a restore/reinstall entry to the installed Limine menu if it can be done cleanly.
+- If NVRAM writes fail, rely on fallback boot paths and show a warning. The user can still recover via firmware boot menu.
+
+## Rollout Plan
+
+### Phase 1: Refactor Without Behavior Change
+
+- Introduce `INSTALL_MODE=full_disk`.
+- Introduce `$INSTALL_ROOT` and update post-install paths.
+- Keep existing full-disk JSON and archinstall behavior.
+- Add tests or dry-run checks for config generation.
+
+### Phase 2a: Archinstall pre_mounted_config Spike
+
+Single-purpose spike on a throwaway VM. No production code changes.
+
+- Drive archinstall with a hand-crafted mount tree and `pre_mounted_config`.
+- Record exactly what archinstall does: fstab generation, crypttab writes, bootloader install, initramfs regeneration, kernel cmdline writes.
+- Prove the protected-mode config disables archinstall bootloader and NVRAM writes, or document the supported replacement setting. This is a release blocker for Phase 2b.
+- Decide whether the manual fstab/Limine/initramfs steps in this plan run before, after, or instead of archinstall's own steps.
+- Update this plan with the answers before Phase 2b begins. The downstream design depends on this; do not skip.
+
+### Phase 2b: Shared Protected Install Engine
+
+- Add `pre_mounted_config` generation.
+- Add manual LUKS, Btrfs, subvolume, mount, fstab, and cleanup logic.
+- Add encrypted boot post-install configuration.
+- Add namespaced ESP boot artifact sync under `EFI/Omarchy`.
+- Keep it behind internal mode switches until validated.
+
+### Phase 3: Dual-Boot UI and Policy
+
+- Add disk layout detection.
+- When another install is detected, show an install-mode choice instead of assuming dual boot: "Install alongside" when eligible, and "Exclusive install (erase disk)" using the existing full-disk `wipe: true` path.
+- If another install is detected but dual boot is not eligible, explain why and still offer the exclusive install path.
+- Add Windows/BitLocker warnings.
+- Validate alongside Windows and Linux.
+
+### Phase 4: Restore Install Policy
+
+- Add restore layout detection.
+- Add restore partition set protection.
+- Add first-install and reinstall flows.
+- Validate that restore ESP, payload, and state survive installation and later reinstall.
+
+### Phase 5: Restore Factory Image
+
+- Build `omarchy-restore.img.zst`.
+- Add factory flashing instructions or a dedicated factory flasher ISO/PXE workflow.
+- Validate first boot from internal disk with no external media.
+- Sign `omarchy-restore.img.zst` and the restore payload manifest. Verify in the factory flasher and at restore boot before any disk mutation.
+- Add first-boot UUID randomization for cloned restore images before generating installed boot entries or state.
+- Decide on Secure Boot before this phase ships. Shipping with SB disabled is a non-starter for some buyers, and BitLocker (when present on a dual-boot machine restored later) reseals against firmware state. Either implement a signed shim/Limine path, or commit to "SB off" with a documented rationale and a way for the user to flip it on later if they have keys.
+
+### Phase 6: Factory Reset
+
+- Implement `omarchy-factory-reset` as the installed-OS staging command: write and fsync the trigger flag, verify/recreate the restore boot entry, set and confirm `BootNext`, then leave the machine ready to boot restore.
+- Wire the restore environment to detect the trigger flag and run the reinstall flow non-interactively.
+- Set `BootNext` for one-shot transitions and temporary restore-first persistent `BootOrder` during the destructive reset window.
+- Validate on `restore_install` machines first (the flow already has a restore partition set).
+
+### Phase 7: Restore Partition for Standalone Installs
+
+- Extend the standalone full-disk install path to create restore ESP + restore payload + restore state + installed ESP + installed root, mirroring the `restore_install` layout.
+- Populate restore payload at install time from the live ISO offline mirror.
+- Add `--no-restore` opt-out for users who explicitly want the legacy two-partition layout.
+- After this phase, every consumer install gets factory reset by default.
+
+## Acceptance Criteria
+
+- Full-disk install behavior remains unchanged through Phase 6. Phase 7 changes the default layout to include a restore partition set; legacy layout remains available via `--no-restore`.
+- Dual-boot install preserves existing OS partitions.
+- Dual-boot install creates encrypted Omarchy root in free space.
+- When another install is detected, the installer offers the current exclusive full-disk wipe path and only offers dual boot when guardrails pass.
+- Dual-boot install writes Omarchy boot artifacts only under `EFI/Omarchy` on a shared ESP and leaves existing vendor paths untouched.
+- Dual-boot install aborts cleanly when BitLocker/FVE is detected, including suspended BitLocker, before any disk mutation, with an actionable message.
+- Restore install preserves restore ESP, restore payload, and restore state partitions.
+- Restore install creates or recreates only installed Omarchy partitions.
+- Protected modes never generate archinstall config with `wipe: true`.
+- Protected modes prevent archinstall from independently writing boot files or NVRAM entries.
+- Protected modes abort before destructive operations if a target partition is protected.
+- Restore payload integrity is verified with a signed manifest before any restore-triggered disk mutation.
+- Installed Omarchy boots and requires LUKS unlock.
+- Installed Omarchy is the default firmware boot target for any standalone install (full-disk or restore_install).
+- Restore boot remains available after first install but is never the default.
+- Reinstall from restore works without external media.
+- `omarchy-factory-reset` from the installed OS leaves the machine staged exactly like a freshly prepared restore-boot device: trigger flag durable on restore state, restore boot entry present, and `BootNext` pointing at restore. No installed partitions are destroyed before the next restore boot.
+- A subsequent restore boot from that staged state wipes installed partitions, reinstalls a fresh Omarchy, and lands the user back in the installed OS without external media. Restore ESP, payload, and state partitions survive intact.
+- Factory reset refuses to run when no complete restore partition set is present (e.g. dual-boot, `--no-restore` install).
+
+## Validation Matrix
+
+### Regression
+
+1. Full-disk UEFI install on empty disk.
+2. Current normal ISO boot menu and default install behavior.
+3. Existing offline package installation flow.
+
+### Dual Boot
+
+1. Windows + free space + existing ESP (BitLocker off).
+2. Windows + BitLocker enabled — installer must abort before any disk mutation with a clear "turn off BitLocker and wait for decryption" message.
+3. Windows + BitLocker suspended — installer must still abort, because v1 treats any BitLocker/FVE signature as unsafe.
+4. Linux distro + free space + existing ESP.
+5. GPT disk with no free space.
+6. ESP below total-size warning threshold.
+7. ESP below total-size minimum threshold.
+8. ESP large enough by total size but below free-space minimum.
+9. Multiple free regions; choose largest suitable region.
+10. Firmware boot order preservation.
+
+### Restore
+
+1. Factory image written to larger virtual disk.
+2. First boot from internal restore ESP.
+3. First install randomizes cloned disk/partition/filesystem UUIDs before creating installed boot entries.
+4. First install creates installed ESP/root and preserves restore ESP, payload, and state.
+5. Installed OS boots with encrypted root.
+6. Installed Omarchy is the firmware default; restore is reachable but not default.
+7. Restore boot still works after installed OS exists.
+8. Reinstall formats only the installed Omarchy partitions in place; PARTUUIDs unchanged.
+9. Restore mode without `copytoram=y` aborts before disk mutation.
+10. Missing restore payload or restore state aborts before disk mutation.
+11. NVRAM boot entry write failure still leaves fallback boot path usable.
+
+### Factory Reset
+
+1. `omarchy-factory-reset` from installed OS leaves the system staged for restore boot: trigger flag durable on restore state, restore boot entry present, and `BootNext` confirmed.
+2. No installed partitions are destroyed before the staged system actually boots into restore.
+3. Booting into restore from the staged state reinstalls and returns to a fresh installed Omarchy as the default-booted OS.
+4. Trigger flag is deleted before the post-reset reboot. Machine does not loop.
+5. Reset interrupted between trigger and restore boot: next normal boot still goes to installed Omarchy (because `BootNext` is one-shot).
+6. Reset interrupted during reinstall (power loss): persistent temporary restore-first `BootOrder` boots restore again and re-runs the flow from the trigger flag/reset-in-progress state.
+7. Reset refused when no complete restore partition set is detected.
+8. Reset refused when signed restore payload verification fails.
+9. Reset refused when running without root.
+10. Reset refused when restore boot entry is missing from NVRAM and cannot be repopulated from fallback.
+
+### Negative Safety Tests
+
+1. Attempt to format protected restore ESP.
+2. Attempt to format protected restore payload.
+3. Attempt to format protected restore state.
+4. Attempt to format existing Windows partition in dual-boot mode.
+5. Partition overlap with protected range.
+6. Power loss before partition creation.
+7. Power loss after partition creation but before archinstall.
+8. Power loss during archinstall.
+
+## Open Questions
+
+- Restore payload size: full offline mirror versus smaller network-capable restore image. Affects whether the consumer ISO's restore-partition default in Phase 7 is feasible at typical disk sizes.
+- Restore update strategy after devices ship.
+- Whether restore should also expose diagnostics / log upload alongside factory reset.
+- Whether factory reset should preserve `/home` user data optionally, or always wipe. v1 always wipes (simpler, matches user expectation of "factory reset"); a "keep my files" variant could land later.
+
+Resolved:
+
+- User-facing reset staging command: yes, `omarchy-factory-reset` (Phase 6).
+- Secure Boot: promoted to Phase 5 decision gate.
+- Btrfs subvolume layout: protected modes use the current full-disk layout, `@`, `@home`, `@log`, and `@pkg`. The `/swap` subvolume for hibernation is created post-install by `omarchy-hibernation-setup` and is not predeclared at install time.
+
+## Definition of Done
+
+- One shared protected-partition implementation supports both dual-boot and restore install policies.
+- Full-disk installs remain stable through Phase 6 and gain a default restore partition set in Phase 7.
+- Dual-boot users can install alongside existing OSes without data loss.
+- OEM devices can boot internal restore on first power-on, install Omarchy, and retain restore for future reinstall.
+- All destructive operations are guarded by protected partition checks.
+- Installed Omarchy is the firmware default boot target on every standalone install.
+- `omarchy-factory-reset` stages any standalone install to boot internal restore without external media; the restore-triggered reinstall returns the user to a fresh installed Omarchy.
+- VM and hardware validation matrices pass.