Revert "Exclude install media from disk picker (#73)"

This reverts commit eadb1c05d4.

README.md

@@ -8,7 +8,7 @@ See the ISO link on [omarchy.org](https://omarchy.org).
 
 ## Creating the ISO
 
-Run `./bin/omarchy-iso-make` and the output goes into `./release`.
+Run `./bin/omarchy-iso-make` and the output goes into `./release`. You can build from your local $OMARCHY_PATH for testing by using `--local-source` or from a checkout of the dev branch (instead of master) by using `--dev`.
 
 ### Environment Variables
 
@@ -36,4 +36,4 @@ Run `./bin/omarchy-iso-upload [release/omarchy.iso]`. This requires you've confi
 
 ## Full release of the ISO
 
-Run `./bin/omarchy-iso-release` to create, test, sign, and upload the ISO in one flow.
+Run `./bin/omarchy-iso-release VERSION` to create, test, sign, and upload the ISO in one flow. Add `--rc` to release an RC build instead.

bin/omarchy-iso-boot

@@ -2,19 +2,27 @@
 
 set -e
 
+ISO="$1"
+REUSE="$2"
+
 if [ $# -eq 0 ]; then
+  ISO=$(ls -t release/*.iso 2>/dev/null | gum choose --header "Select ISO to boot")
+  if gum confirm --default=false "Reuse existing disk?"; then
+    REUSE="reuse"
+  fi
+fi
+
+if [ -z "$ISO" ]; then
   echo "Usage: omarchy-iso-boot [release/omarchy.iso] [reuse]"
   echo "  SSH available at: ssh -p 2222 root@localhost (after installing openssh)"
   exit 1
 fi
 
-if ! pacman -Q qemu-full >/dev/null || ! pacman -Q edk2-ovmf >/dev/null; then
-  sudo pacman -S --noconfirm --needed --quiet qemu-full edk2-ovmf
-fi
+omarchy-pkg-add qemu-full edk2-ovmf
 
 DISK="/tmp/omarchy-iso-boot.qcow2"
-if [[ ! -f $DISK || $2 != "reuse" ]]; then
-  qemu-img create -f qcow2 "$DISK" 20G
+if [[ ! -f $DISK || $REUSE != "reuse" ]]; then
+  qemu-img create -f qcow2 "$DISK" 40G
   cp /usr/share/edk2/x64/OVMF_VARS.4m.fd /tmp/OVMF_VARS.4m.fd
 fi
 
@@ -27,7 +35,7 @@ qemu-system-x86_64 \
   -drive if=pflash,format=raw,file=/tmp/OVMF_VARS.4m.fd \
   -drive file="$DISK",format=qcow2,if=none,id=drive0 \
   -device virtio-blk-pci,drive=drive0,bootindex=1 \
-  -drive file="$1",media=cdrom,if=none,format=raw,id=cdrom0 \
+  -drive file="$ISO",media=cdrom,if=none,format=raw,id=cdrom0 \
   -device ide-cd,drive=cdrom0,bootindex=2 \
   -device virtio-vga-gl \
   -display gtk,gl=on \

bin/omarchy-iso-make

@@ -15,14 +15,32 @@ while [[ $# -gt 0 ]]; do
     NO_BOOT_OFFER=1
     shift
     ;;
+  --local-source)
+    LOCAL_SOURCE=1
+    OMARCHY_MIRROR=edge
+    shift
+    ;;
+  --dev)
+    OMARCHY_INSTALLER_REF=dev
+    OMARCHY_MIRROR=edge
+    shift
+    ;;
+  --rc)
+    OMARCHY_MIRROR=rc
+    OMARCHY_INSTALLER_REF=rc
+    shift
+    ;;
   *)
     echo "Unknown option: $1"
-    echo "Usage: $0 [--no-cache] [--no-boot-offer]"
+    echo "Usage: $0 [--no-cache] [--no-boot-offer] [--local-source] [--dev] [--rc]"
     exit 1
     ;;
   esac
 done
 
+# Clear out old packages
+sudo rm -rf /var/cache/pacman/pkg/*
+
 # Ensure we have the submodule checked out
 git submodule update --init --recursive --jobs=8
 
@@ -34,12 +52,14 @@ mkdir -p "$BUILD_RELEASE_PATH"
 
 OMARCHY_INSTALLER_REPO="${OMARCHY_INSTALLER_REPO:-basecamp/omarchy}"
 OMARCHY_INSTALLER_REF="${OMARCHY_INSTALLER_REF:-master}"
+OMARCHY_MIRROR="${OMARCHY_MIRROR:-stable}"
 
 DOCKER_ARGS=(
   --rm
   --privileged
   -e "OMARCHY_INSTALLER_REPO=$OMARCHY_INSTALLER_REPO"
   -e "OMARCHY_INSTALLER_REF=$OMARCHY_INSTALLER_REF"
+  -e "OMARCHY_MIRROR=$OMARCHY_MIRROR"
   -e "HOST_UID=$(id -u)"
   -e "HOST_GID=$(id -g)"
   -v "$BUILD_RELEASE_PATH/:/out/"
@@ -49,6 +69,11 @@ DOCKER_ARGS=(
   -v "$BUILD_ROOT/configs:/configs:ro"
 )
 
+# Use local source of Omarchy from $OMARCHY_PATH instead of git checkout
+if [[ -n "${LOCAL_SOURCE-}" ]]; then
+  DOCKER_ARGS+=(-v "$OMARCHY_PATH:/omarchy:ro")
+fi
+
 # Use local pacman cache if you already have one on host to speed up repeat runs
 if [ -d "/var/cache/pacman/pkg" ]; then
   DOCKER_ARGS+=(-v "/var/cache/pacman/pkg:/var/cache/pacman/pkg")

bin/omarchy-iso-make-dev

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-OMARCHY_INSTALLER_REF=dev omarchy-iso-make

bin/omarchy-iso-rclone-config

@@ -0,0 +1,16 @@
+#!/bin/bash
+omarchy-pkg-add rclone
+mkdir -p ~/.config/rclone
+
+access_key=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/access_key_id" --account Omarchy)
+secret_access_key=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/secret_access_key" --account Omarchy)
+endpoint=$(op read "op://Shared/Cloudflare Buckets/iso.omarchy.org/endpoint" --account Omarchy)
+
+cat > ~/.config/rclone/rclone.conf << EOF
+[Omarchy]
+type = s3
+provider = Cloudflare
+access_key_id = $access_key
+secret_access_key = $secret_access_key
+endpoint = $endpoint
+EOF

bin/omarchy-iso-release

@@ -1,38 +1,62 @@
 #!/bin/bash
 
-if [ $# -eq 0 ]; then
-  echo "Usage: omarchy-iso-release [version]"
+MAKE_ARGS=()
+INSTALLER_REF=master
+RELEASE_SUFFIX=""
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+  --no-make)
+    MAKE_ARGS+=("$1")
+    shift
+    ;;
+  --rc)
+    MAKE_ARGS+=("$1")
+    INSTALLER_REF=rc
+    RELEASE_SUFFIX="-rc"
+    shift
+    ;;
+  -*)
+    echo "Unknown option: $1"
+    echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
+    exit 1
+    ;;
+  *)
+    if [[ -n "${BUILD_VERSION-}" ]]; then
+      echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
+      exit 1
+    fi
+    BUILD_VERSION="$1"
+    shift
+    ;;
+  esac
+done
+
+if [[ -z "${BUILD_VERSION-}" ]]; then
+  echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
   exit 1
 fi
 
 BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
 BUILD_RELEASE_PATH="$BUILD_ROOT/release"
-BULD_VERSION="$1"
 
 # Make ISOs
-if [[ $1 != "--no-make" ]]; then
-  echo -e "\e[32mMaking master ISO\e[0m"
-  OMARCHY_INSTALLER_REF=master omarchy-iso-make --no-cache --no-boot-offer
-
-  echo -e "\e[32m\nMaking dev ISO\e[0m"
-
-  OMARCHY_INSTALLER_REF=dev omarchy-iso-make --no-cache --no-boot-offer
+if [[ ! " ${MAKE_ARGS[*]} " =~ " --no-make " ]]; then
+  echo -e "\e[32mMaking $INSTALLER_REF ISO\e[0m"
+  omarchy-iso-make --no-cache --no-boot-offer "${MAKE_ARGS[@]}"
 else
   echo -e "\e[31mSkipping remaking ISOs\e[0m"
 fi
 
-# Sign and upload master ISO
-latest_master_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-master.iso | head -n1)
-release_master_iso="$BUILD_RELEASE_PATH/omarchy-$BULD_VERSION.iso"
-cp "$latest_master_iso" "$release_master_iso"
-echo -e "\e[32mSigning master ISO\e[0m"
-omarchy-iso-sign "$release_master_iso"
-omarchy-iso-upload "$release_master_iso"
+# Sign and upload ISO
+latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-"$INSTALLER_REF".iso | head -n1)
+release_iso="$BUILD_RELEASE_PATH/omarchy-$BUILD_VERSION$RELEASE_SUFFIX.iso"
+cp "$latest_iso" "$release_iso"
 
-# Sign and upload dev ISO
-latest_dev_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-dev.iso | head -n1)
-release_dev_iso="$BUILD_RELEASE_PATH/omarchy-$BULD_VERSION-dev.iso"
-cp "$latest_dev_iso" "$release_dev_iso"
-echo -e "\e[32mSigning dev ISO\e[0m"
-omarchy-iso-sign "$release_dev_iso"
-omarchy-iso-upload "$release_dev_iso"
+echo -e "\e[32mSigning $INSTALLER_REF ISO\e[0m"
+omarchy-iso-sign "$release_iso"
+
+iso_sha=$(sha256sum "$release_iso")
+echo -e "\e[32mSHA256 for $INSTALLER_REF ISO: $iso_sha\e[0m"
+
+omarchy-iso-upload "$release_iso"

bin/omarchy-iso-sign

@@ -7,7 +7,7 @@ fi
 
 if ! pacman -Q gnupg >/dev/null; then
   sudo pacman -S --noconfirm --needed --quiet gnupg
-  echo "you'll need to generate a new key with: gpg --full-generate-key"
+  echo "You'll need to import key with: gpg --import path/to/signing-key.asc"
 fi
 
 gnupg_user_key=$(gpg --list-secret-keys --keyid-format=long | awk '/^[[:space:]]/{print $1; exit}')

bin/omarchy-iso-upload

@@ -6,7 +6,7 @@ if [ $# -eq 0 ]; then
 fi
 
 if [[ ! -f ~/.config/rclone/rclone.conf ]]; then
-  echo "You must first configure rclone with the R2 credentials: rclone config"
+  echo "You must first configure rclone with the R2 credentials: omarchy-iso-rclone-config"
   exit 1
 fi
 

builder/archinstall.packages

@@ -7,6 +7,7 @@ intel-ucode
 linux-firmware
 linux
 limine
+omarchy-keyring
 openssh
 pipewire
 snapper

builder/build-iso.sh

@@ -7,6 +7,11 @@ pacman-key --init
 pacman --noconfirm -Sy archlinux-keyring
 pacman --noconfirm -Sy archiso git sudo base-devel jq grub
 
+# Install omarchy-keyring for package verification during build
+# The [omarchy] repo is defined in /configs/pacman-online.conf with SigLevel = Optional TrustAll
+pacman --config /configs/pacman-online-${OMARCHY_MIRROR}.conf --noconfirm -Sy omarchy-keyring
+pacman-key --populate omarchy
+
 # Setup build locations
 build_cache_dir="/var/cache"
 offline_mirror_dir="$build_cache_dir/airootfs/var/cache/omarchy/mirror/offline"
@@ -18,15 +23,22 @@ cp -r /archiso/configs/releng/* $build_cache_dir/
 rm "$build_cache_dir/airootfs/etc/motd"
 
 # Avoid using reflector for mirror identification as we are relying on the global CDN
-rm "$build_cache_dir/airootfs/etc/systemd/system/multi-user.target.wants/reflector.service"
+rm -rf "$build_cache_dir/airootfs/etc/systemd/system/multi-user.target.wants/reflector.service"
 rm -rf "$build_cache_dir/airootfs/etc/systemd/system/reflector.service.d"
 rm -rf "$build_cache_dir/airootfs/etc/xdg/reflector"
 
 # Bring in our configs
 cp -r /configs/* $build_cache_dir/
 
-# Clone Omarchy itself
-git clone -b $OMARCHY_INSTALLER_REF https://github.com/$OMARCHY_INSTALLER_REPO.git "$build_cache_dir/airootfs/root/omarchy"
+# Persist OMARCHY_MIRROR so it's available at install time
+echo "$OMARCHY_MIRROR" > "$build_cache_dir/airootfs/root/omarchy_mirror"
+
+# Setup Omarchy itself
+if [[ -d /omarchy ]]; then
+  cp -rp /omarchy "$build_cache_dir/airootfs/root/omarchy"
+else
+  git clone -b $OMARCHY_INSTALLER_REF https://github.com/$OMARCHY_INSTALLER_REPO.git "$build_cache_dir/airootfs/root/omarchy"
+fi
 
 # Make log uploader available in the ISO too
 mkdir -p "$build_cache_dir/airootfs/usr/local/bin/"
@@ -58,7 +70,7 @@ mkdir -p "$build_cache_dir/airootfs/opt/packages/"
 cp "/tmp/$NODE_FILENAME" "$build_cache_dir/airootfs/opt/packages/"
 
 # Add our additional packages to packages.x86_64
-arch_packages=(linux-t2 git gum jq openssl plymouth tzupdate)
+arch_packages=(linux-t2 git gum jq openssl plymouth tzupdate omarchy-keyring)
 printf '%s\n' "${arch_packages[@]}" >>"$build_cache_dir/packages.x86_64"
 
 # Build list of all the packages needed for the offline mirror
@@ -69,7 +81,7 @@ all_packages+=($(grep -v '^#' /builder/archinstall.packages | grep -v '^$'))
 
 # Download all the packages to the offline mirror inside the ISO
 mkdir -p /tmp/offlinedb
-pacman --config /configs/pacman-online.conf --noconfirm -Syw "${all_packages[@]}" --cachedir $offline_mirror_dir/ --dbpath /tmp/offlinedb
+pacman --config /configs/pacman-online-${OMARCHY_MIRROR}.conf --noconfirm -Syw "${all_packages[@]}" --cachedir $offline_mirror_dir/ --dbpath /tmp/offlinedb
 repo-add --new "$offline_mirror_dir/offline.db.tar.gz" "$offline_mirror_dir/"*.pkg.tar.zst
 
 # Create a symlink to the offline mirror instead of duplicating it.
@@ -78,9 +90,9 @@ repo-add --new "$offline_mirror_dir/offline.db.tar.gz" "$offline_mirror_dir/"*.p
 mkdir -p /var/cache/omarchy/mirror
 ln -s "$offline_mirror_dir" "/var/cache/omarchy/mirror/offline"
 
-# Copy the pacman.conf to the ISO's /etc directory so the live environment uses our
-# same config when booted
-cp $build_cache_dir/pacman.conf "$build_cache_dir/airootfs/etc/pacman.conf"
+# Copy the offline pacman.conf to the ISO's /etc directory so the live environment uses our
+# same config when booted. 
+cp $build_cache_dir/pacman-offline.conf "$build_cache_dir/airootfs/etc/pacman.conf"
 
 # Finally, we assemble the entire ISO
 mkarchiso -v -w "$build_cache_dir/work/" -o "/out/" "$build_cache_dir/"

configs/airootfs/etc/modprobe.d/blacklist-panther-lake-audio.conf

@@ -0,0 +1,14 @@
+# Fix Panther Lake audio: blacklist SOF modules that conflict with HDA drivers
+# (prevents boot issues on Dell XPS 2026 and similar Panther Lake systems)
+blacklist snd_sof_pci_intel_ptl
+blacklist snd_sof_pci_intel_lnl
+blacklist snd_sof_pci_intel_mtl
+blacklist snd_sof_intel_hda_generic
+blacklist snd_sof_intel_hda_common
+blacklist snd_sof_intel_hda
+blacklist snd_sof_pci
+blacklist snd_sof
+blacklist soundwire_intel
+blacklist snd_soc_cs35l56_sdw
+blacklist snd_soc_cs35l56
+blacklist snd_soc_skl_hda_dsp

configs/airootfs/root/.automated_script.sh

@@ -5,6 +5,7 @@ use_omarchy_helpers() {
   export OMARCHY_PATH="/root/omarchy"
   export OMARCHY_INSTALL="/root/omarchy/install"
   export OMARCHY_INSTALL_LOG_FILE="/var/log/omarchy-install.log"
+  export OMARCHY_MIRROR="$(cat /root/omarchy_mirror)"
   source /root/omarchy/install/helpers/all.sh
 }
 
@@ -22,7 +23,11 @@ install_arch() {
   touch /var/log/omarchy-install.log
 
   start_log_output
-  install_base_system 2>&1 | sed -u 's/\x1b\[[0-9;]*[a-zA-Z]//g' >>/var/log/omarchy-install.log
+
+  # Set CURRENT_SCRIPT for the trap to display better when nothing is returned for some reason
+  CURRENT_SCRIPT="install_base_system"
+  install_base_system > >(sed -u 's/\x1b\[[0-9;]*[a-zA-Z]//g' >>/var/log/omarchy-install.log) 2>&1
+  unset CURRENT_SCRIPT
   stop_log_output
 }
 
@@ -67,6 +72,7 @@ install_base_system() {
   # Initialize and populate the keyring
   pacman-key --init
   pacman-key --populate archlinux
+  pacman-key --populate omarchy
 
   # Sync the offline database so pacman can find packages
   pacman -Sy --noconfirm
@@ -74,6 +80,19 @@ install_base_system() {
   # Ensure that no mounts exist from past install attempts
   findmnt -R /mnt >/dev/null && umount -R /mnt
 
+  # Workarounds for archinstall 4.2 regressions under Python 3.14:
+  # 1. sync_log_to_install_medium: `self.target / absolute_logfile` drops
+  #    self.target because the RHS is absolute, so Path.copy() raises EINVAL
+  #    (source == target).
+  # 2. _add_limine_bootloader: `Path.copy(efi_dir_path)` raises IsADirectoryError
+  #    because 3.14's Path.copy treats target as a literal path, not a directory
+  #    (shutil.copy used to auto-append the source filename).
+  sed -i \
+    -e 's|logfile_target = self\.target / absolute_logfile$|logfile_target = self.target / absolute_logfile.relative_to("/")|' \
+    -e 's|(limine_path / file)\.copy(efi_dir_path)|(limine_path / file).copy(efi_dir_path / file)|' \
+    -e "s|(limine_path / 'limine-bios.sys')\.copy(boot_limine_path)|(limine_path / 'limine-bios.sys').copy(boot_limine_path / 'limine-bios.sys')|" \
+    /usr/lib/python3.14/site-packages/archinstall/lib/installer.py
+
   # Install using files generated by the ./configurator
   # Skip NTP and WKD sync since we're offline (keyring is pre-populated in ISO)
   archinstall \
@@ -81,7 +100,8 @@ install_base_system() {
     --creds user_credentials.json \
     --silent \
     --skip-ntp \
-    --skip-wkd
+    --skip-wkd \
+    --skip-wifi-check
 
   # After archinstall sets up the base system but before our installer runs,
   # we need to ensure the offline pacman.conf is in place
@@ -114,6 +134,8 @@ EOF
   find /mnt/home/$OMARCHY_USER/.local/share/omarchy -type f -path "*/bin/*" -exec chmod +x {} \;
   chmod +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/boot.sh 2>/dev/null || true
   chmod +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/default/waybar/indicators/screen-recording.sh 2>/dev/null || true
+  chmod +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/default/waybar/indicators/idle.sh 2>/dev/null || true
+  chmod +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/default/waybar/indicators/notification-silencing.sh 2>/dev/null || true
 }
 
 chroot_bash() {
@@ -122,6 +144,7 @@ chroot_bash() {
     env OMARCHY_CHROOT_INSTALL=1 \
     OMARCHY_USER_NAME="$(<user_full_name.txt)" \
     OMARCHY_USER_EMAIL="$(<user_email_address.txt)" \
+    OMARCHY_MIRROR="$OMARCHY_MIRROR" \
     USER="$OMARCHY_USER" \
     HOME="/home/$OMARCHY_USER" \
     /bin/bash "$@"

configs/airootfs/root/configurator

@@ -121,7 +121,7 @@ user_form() {
   done
 
   # Hash the password using yescrypt
-  password_hash=$(openssl passwd -6 "$password")
+  password_hash=$(printf '%s' "$password" | openssl passwd -6 -stdin)
 
   full_name=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Full name> ")
   email_address=$(gum input --placeholder "Used for git authentication (hit return to skip)" --prompt.foreground="#845DF9" --prompt "Email address> ")
@@ -176,16 +176,37 @@ done
 
 get_disk_info() {
   local device="$1"
-  local size model
+  local size vendor model label
 
   # Get basic disk information
   size=$(lsblk -dno SIZE "$device" 2>/dev/null)
-  model=$(lsblk -dno MODEL "$device" 2>/dev/null | sed 's/^[[:space:]]*//' | sed 's/[[:space:]]*$//')
+  vendor=$(lsblk -dno VENDOR "$device" 2>/dev/null | sed 's/ *$//')
+  model=$(lsblk -dno MODEL "$device" 2>/dev/null | sed 's/ *$//')
+
+  # Combine vendor and model, avoiding duplication
+  label=""
+  if [[ -n $vendor && -n $model ]]; then
+    if [[ $model == *$vendor* ]]; then
+      label="$model"
+    else
+      label="$vendor $model"
+    fi
+  elif [[ -n $model ]]; then
+    label="$model"
+  elif [[ -n $vendor ]]; then
+    label="$vendor"
+  fi
 
   # Format display string
   local display="$device"
-  [[ -n "$size" ]] && display="$display ($size)"
-  [[ -n "$model" ]] && display="$display - $model"
+  [[ -n $size ]] && display="$display ($size)"
+  [[ -n $label ]] && display="$display - $label"
+
+  # Append compact partition summary
+  local part_summary
+  part_summary=$(lsblk -nro TYPE,NAME,FSTYPE,MOUNTPOINT "$device" 2>/dev/null | \
+    awk '$1=="part" { printf "%s%s%s", s, ($3==""?"unknown":$3), ($4==""?"":"("$4")"); s=", " }')
+  [[ -n $part_summary ]] && display+=" [$part_summary]"
 
   echo "$display"
 }
@@ -383,7 +404,8 @@ cat <<-_EOF_ >user_configuration.json
     },
     "packages": [
         "base-devel",
-        "git"
+        "git",
+        "omarchy-keyring"
     ],
     "profile_config": {
         "gfx_driver": null,

configs/efiboot/loader/entries/01-archiso-x86_64-linux.conf

@@ -2,4 +2,4 @@ title    Omarchy (x86_64, UEFI)
 sort-key 01
 linux    /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
 initrd   /%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
-options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash
+options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash xe.enable_panel_replay=0

configs/grub/grub.cfg

@@ -54,13 +54,13 @@ timeout_style=hidden
 
 menuentry "Omarchy (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash xe.enable_panel_replay=0
     initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
 }
 
 menuentry "Omarchy with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on xe.enable_panel_replay=0
     initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
 }
 

configs/grub/loopback.cfg

@@ -30,13 +30,13 @@ timeout_style=hidden
 
 menuentry "Omarchy (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" quiet splash
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" quiet splash xe.enable_panel_replay=0
     initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
 }
 
 menuentry "Omarchy with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-t2 archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on xe.enable_panel_replay=0
     initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-t2.img
 }
 

configs/pacman-online-edge.conf

@@ -15,25 +15,19 @@ LocalFileSigLevel = Optional
 
 [core]
 Server = https://mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [extra]
 Server = https://mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [multilib]
 Server = https://mirror.omarchy.org/$repo/os/$arch
-Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
-Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
 Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
 SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/$arch
+Server = https://pkgs.omarchy.org/edge/$arch
 
 [arch-mact2]
 Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release

configs/pacman-online-rc.conf

@@ -0,0 +1,34 @@
+#
+# /etc/pacman.conf
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+
+[core]
+Server = https://rc-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Server = https://rc-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Server = https://rc-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[omarchy]
+SigLevel = Optional TrustAll
+Server = https://pkgs.omarchy.org/edge/$arch
+
+[arch-mact2]
+Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
+SigLevel = Never

configs/pacman-online-stable.conf

@@ -0,0 +1,34 @@
+#
+# /etc/pacman.conf
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+
+[core]
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Server = https://stable-mirror.omarchy.org/$repo/os/$arch
+Include = /etc/pacman.d/mirrorlist
+
+[omarchy]
+SigLevel = Optional TrustAll
+Server = https://pkgs.omarchy.org/stable/$arch
+
+[arch-mact2]
+Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release
+SigLevel = Never

configs/profiledef.sh

@@ -10,7 +10,7 @@ install_dir="arch"
 buildmodes=('iso')
 bootmodes=('bios.syslinux' 'uefi.grub')
 arch="x86_64"
-pacman_conf="pacman.conf"
+pacman_conf="pacman-offline.conf"
 airootfs_image_type="squashfs"
 airootfs_image_tool_options=('-comp' 'xz' '-Xbcj' 'x86' '-b' '1M' '-Xdict-size' '1M')
 bootstrap_tarball_compression=('zstd' '-c' '-T0' '--auto-threads=logical' '--long' '-19')

configs/syslinux/archiso_sys-linux.cfg

@@ -6,7 +6,7 @@ ENDTEXT
 MENU LABEL Omarchy install medium (x86_64, BIOS)
 LINUX /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
 INITRD /%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
-APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% quiet splash xe.enable_panel_replay=0
 
 # Accessibility boot option
 LABEL arch64speech
@@ -17,4 +17,4 @@ ENDTEXT
 MENU LABEL Omarchy install medium (x86_64, BIOS) with ^speech
 LINUX /%INSTALL_DIR%/boot/x86_64/vmlinuz-linux-t2
 INITRD /%INSTALL_DIR%/boot/x86_64/initramfs-linux-t2.img
-APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
+APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on xe.enable_panel_replay=0

plans/dual-boot.md

@@ -0,0 +1,158 @@
+# Dual-Boot Installation Support for Omarchy ISO
+
+## Context
+
+Currently, the Omarchy installer wipes the entire selected disk (`"wipe": true`) and creates two partitions: a 2GB FAT32 ESP and a LUKS-encrypted Btrfs root. This means users must dedicate an entire disk to Omarchy. Adding dual-boot support lets users install alongside an existing OS (typically Windows) while keeping the Omarchy partition encrypted.
+
+## Core Approach: `pre_mounted_config`
+
+**Do our own partitioning, then hand off to archinstall for package installation only.**
+
+archinstall's `manual_partitioning` mode has a long history of bugs with existing partitions and LUKS (archinstall issues #998, #2072, #2444). Instead, we:
+
+1. Detect existing partitions and free space ourselves (with `sgdisk`/`parted`)
+2. Create the LUKS partition and Btrfs subvolumes ourselves (with `cryptsetup`/`mkfs.btrfs`)
+3. Mount everything at `/mnt/archinstall`
+4. Tell archinstall to use `"config_type": "pre_mounted_config"` — it installs packages into our pre-mounted tree and does zero disk operations
+5. Handle encryption config (crypttab, mkinitcpio hooks, bootloader cmdline) in post-install
+
+The existing full-disk path stays completely unchanged. Dual-boot is a parallel code path.
+
+## Implementation Guardrails
+
+- **Run target changes in chroot** — all target-system commands (`mkinitcpio -P`, `limine-scan`, bootloader config updates) must run via `arch-chroot "$INSTALL_ROOT" ...`
+- **Edit target files under `$INSTALL_ROOT` only** — write `mkinitcpio` hook config, `limine.conf`, `crypttab`, and related files in `$INSTALL_ROOT/etc` and `$INSTALL_ROOT/boot` (never in the live environment root)
+- **Settle kernel partition state** — after creating the new partition, run `partprobe "$DISK"` and `udevadm settle` before `cryptsetup` to avoid device-node races
+- **Deterministic fstab** — always generate `/etc/fstab` for dual-boot with overwrite semantics (e.g., `genfstab -U "$INSTALL_ROOT" > "$INSTALL_ROOT/etc/fstab"`) to avoid duplicate entries on retries
+- **Hook compatibility** — when updating mkinitcpio hooks, add `encrypt` for busybox initramfs or `sd-encrypt` for systemd initramfs; never assume one universally
+- **Safe rollback on failure** — on any dual-boot setup failure: unmount mounts, close LUKS mapping, and surface recovery guidance; optionally delete the just-created partition only if it was created in this run
+
+## Scope Constraints
+
+- **UEFI/GPT only** — dual-boot on MBR/BIOS is too fragile; those users get full-disk only
+- **No auto-shrinking** — users must free up space from their existing OS first (e.g., Windows Disk Management). Too risky to shrink partitions automatically
+- **Minimum 20GB free space** required for Omarchy
+
+## User Flow
+
+```
+Select disk → Detect layout →
+
+  If disk has existing OS + ESP + ≥20GB free space:
+    "How would you like to install?"
+      → "Install alongside Windows (use 85GB free space)"
+      → "Erase entire disk"
+
+  If disk is empty or no free space:
+    Existing "Confirm overwriting" flow (unchanged)
+```
+
+## File Changes
+
+### 1. `configs/airootfs/root/configurator`
+
+**Add after disk selection (line 233), before config generation:**
+
+- `detect_disk_layout()` — examines selected disk for:
+  - GPT partition table (required for dual-boot)
+  - Existing ESP partition (via `lsblk` PARTTYPE matching EFI GUID)
+  - Free unallocated space (via `sgdisk -F`/`-E` or `parted print free`)
+  - OS detection for installer UX warnings/prompts (not boot correctness): mount ESP read-only, check common vendor paths like `EFI/Microsoft`, `EFI/systemd`, `EFI/ubuntu`, `EFI/fedora`, `EFI/GRUB`
+
+- `install_mode_form()` — shows gum choose with dual-boot vs erase options when conditions are met. Sets `DUAL_BOOT=true/false`.
+
+**Generate different JSON when `DUAL_BOOT=true`:**
+
+```json
+{
+    "disk_config": {
+        "config_type": "pre_mounted_config",
+        "mountpoint": "/mnt/archinstall"
+    }
+}
+```
+
+No `device_modifications`, no `disk_encryption`, no `btrfs_options` — we handle all of that ourselves. Everything else (hostname, kernels, packages, etc.) stays the same.
+
+**Write `install_mode.sh`** alongside the other config files:
+
+```bash
+DUAL_BOOT=true
+DISK=/dev/nvme0n1
+ESP_PARTITION=/dev/nvme0n1p1
+```
+
+### 2. `configs/airootfs/root/.automated_script.sh`
+
+**Source `install_mode.sh`** in `run_configurator()` if it exists.
+
+**Add `setup_dual_boot_partitions()`** — runs before archinstall when `DUAL_BOOT=true`:
+
+1. Select the largest contiguous free region and run `sgdisk` to create new partition there (type 8309 = Linux LUKS)
+2. `partprobe "$DISK"` + `udevadm settle` so new partition node is present
+3. `cryptsetup luksFormat` + `luksOpen` with user's password
+4. `mkfs.btrfs` on `/dev/mapper/omarchy_root`
+5. Create Btrfs subvolumes: `@`, `@home`, `@log`, `@pkg`
+6. Mount subvolumes at `/mnt/archinstall` with `compress=zstd`
+7. Mount existing ESP (untouched) at `/mnt/archinstall/boot`
+8. Generate target `/etc/fstab` from mounted filesystems before post-install steps
+
+**Add `configure_dual_boot_post_install()`** — runs after archinstall:
+
+1. Write `/etc/crypttab` entry using LUKS UUID/PARTUUID (stable identifier), e.g. `omarchy_root UUID=<luks-uuid> none luks,discard`
+2. Update mkinitcpio hooks before `filesystems`: `encrypt` (busybox) or `sd-encrypt` (systemd)
+3. Regenerate initramfs with `arch-chroot "$INSTALL_ROOT" mkinitcpio -P`
+4. Configure Limine kernel cmdline to match initramfs mode:
+   - busybox `encrypt`: `cryptdevice=UUID=<uuid>:omarchy_root root=/dev/mapper/omarchy_root`
+   - systemd `sd-encrypt`: `rd.luks.name=<uuid>=omarchy_root root=/dev/mapper/omarchy_root` (or equivalent `rd.luks.uuid=` form)
+5. Run `arch-chroot "$INSTALL_ROOT" limine-scan` to detect other OS boot entries (Windows, etc.)
+6. Preserve current firmware default boot order unless user explicitly chooses to make Limine first (capture and restore `BootOrder` if `efibootmgr` side effects reorder entries)
+
+**Use `$INSTALL_ROOT` variable** — defaults to `/mnt` for full-disk, `/mnt/archinstall` for dual-boot. Post-install steps (offline mirror bind-mount, sudoers, omarchy copy) reference this instead of hardcoded `/mnt`.
+
+### 3. `builder/build-iso.sh` + `builder/archinstall.packages`
+
+Add `parted` to packages available in the live ISO (needed for free space detection).
+
+## Bootloader Coexistence
+
+Limine installs to `ESP/EFI/arch-limine/` and registers via `efibootmgr`. This sits alongside:
+- Windows Boot Manager at `ESP/EFI/Microsoft/Boot/bootmgfw.efi`
+- Any other bootloader in its own ESP subdirectory
+
+`limine-scan` auto-detects other UEFI boot entries and adds them to `limine.conf`. Users can choose OS at boot.
+
+**Boot order policy**: creating a new EFI entry must not silently change the current default boot target. Keep existing firmware boot order by default and only promote Limine when user opts in.
+
+Implementation note: when registering Limine with `efibootmgr`, do not pass reorder flags by default; if firmware still changes order, explicitly restore prior `BootOrder` unless the user opted to promote Limine.
+
+**ESP size note**: Windows typically creates a 100-260MB ESP. This is enough for Limine + kernel + initramfs, but Snapper boot snapshots (which copy kernels to ESP) will be limited or disabled.
+
+**ESP free-space threshold**:
+- If ESP has `<100MB` free at install time: show a strong warning (do not block install)
+- If ESP has `<64MB` free: hide dual-boot option and require full-disk install (or user frees space first)
+
+**BitLocker warning**: If Windows is detected, show a warning about having the BitLocker recovery key ready, since modifying ESP/UEFI entries can trigger recovery.
+
+## Edge Cases
+
+| Scenario | Behavior |
+|----------|----------|
+| Disk is empty | Full-disk install only (current behavior) |
+| Existing OS but no free space | Full-disk install only, with note to free space first |
+| Free space < 20GB | Dual-boot option not shown |
+| MBR/BIOS disk | Dual-boot option not shown |
+| ESP < 100MB free after mount | Warn user; continue allowed |
+| ESP < 64MB free after mount | Dual-boot option not shown |
+| Multiple free regions | Use largest contiguous region |
+| Partitioning/setup failure mid-run | Cleanup mounts/LUKS and abort safely |
+
+## Verification
+
+1. **Regression**: Full-disk install in VM with empty disk — must work identically to today
+2. **Dual-boot with Windows**: VM with Windows installed + 40GB free space — detect Windows, install alongside, both OSes boot
+3. **Dual-boot with Linux**: VM with another Linux + free space — similar test
+4. **No free space**: VM with fully partitioned disk — dual-boot option should not appear
+5. **Encryption**: After dual-boot install, verify LUKS unlock prompt at boot and encrypted root
+6. **Initramfs mode**: Validate both busybox and systemd hook paths boot correctly (`encrypt` vs `sd-encrypt`)
+7. **Boot order**: Verify existing default UEFI entry remains unchanged unless user opted to promote Limine

plans/oem-install.md

@@ -0,0 +1,224 @@
+# OEM Install + First-Boot Setup Plan
+
+## Goal
+
+Create a second ISO flavor for OEM preloading that is installed to internal storage at factory time, then boots into customer setup on first power-on (no external media required), and ends in a fully encrypted Omarchy install.
+
+## Product Requirements
+
+- Factory can preload one image to internal disk.
+- Customer first boot launches setup flow automatically (already works: `.automated_script.sh` runs configurator on tty1).
+- Customer chooses credentials/settings.
+- Final installed OS uses full-disk encryption (LUKS) with customer password (already works: configurator collects password and passes it to archinstall as `encryption_password`).
+- Existing consumer ISO behavior remains unchanged.
+
+---
+
+## Chosen Architecture
+
+### Bootstrapping model
+- OEM devices ship with an OEM bootstrap ISO image written to internal disk.
+- On first boot, `copytoram=y` kernel arg loads the live environment into RAM, freeing the internal disk.
+- Bootstrap environment launches existing configurator + installer.
+- Installer performs a fresh install to internal disk with LUKS encryption enabled.
+- Bootstrap environment is overwritten during install.
+
+### Recovery model: zero-recovery
+- No permanent recovery partition.
+- Simplest and strongest security story.
+- Recovery requires external reinstall media.
+
+---
+
+## Non-Goals
+
+- No on-device recovery workflow.
+- No changes to normal installer UX outside explicit OEM mode checks and warnings.
+- No factory credential provisioning.
+
+---
+
+## Repo Implementation Plan
+
+## 1) Add OEM build mode
+
+### Files
+- `bin/omarchy-iso-make`
+- `builder/build-iso.sh`
+
+### Changes
+- Add CLI flag `--oem` to `bin/omarchy-iso-make`.
+- Pass `OMARCHY_MODE=oem` into Docker build env (default `normal`).
+- In `builder/build-iso.sh`, write mode marker `/root/omarchy_mode` containing `oem` or `normal` (same pattern as `omarchy_mirror`).
+- Keep OEM on current boot stack (`uefi.grub` + `bios.syslinux`); do not add or depend on systemd-boot paths.
+- When `OMARCHY_MODE=oem`, inject `copytoram=y` into all shipped OEM boot entry points before `mkarchiso` runs:
+  - `grub/grub.cfg`: append to `linux` cmdline entries.
+  - `grub/loopback.cfg`: append to `linux` cmdline entries.
+  - `syslinux/archiso_sys-linux.cfg`: append to `APPEND` lines.
+- When `OMARCHY_MODE=oem`, remove accessibility/speakup boot entries:
+  - `grub/grub.cfg`: remove `archlinux-accessibility` menuentry.
+  - `grub/loopback.cfg`: remove `archlinux-accessibility` menuentry.
+  - `syslinux/archiso_sys-linux.cfg`: remove `arch64speech` label block.
+- When `OMARCHY_MODE=oem`, override `iso_application` in `profiledef.sh` to `"Omarchy OEM Installer"`.
+- Rename output ISO with `-oem` suffix (in addition to existing `-$OMARCHY_INSTALLER_REF` suffix).
+
+### Hardening
+- Add post-injection build assertion that fails build if any expected boot config does not contain `copytoram=y`.
+- Add post-injection build assertion that fails build if any OEM boot config still contains accessibility/speakup entries.
+- Make injection idempotent (do not duplicate `copytoram=y` if already present).
+
+### Acceptance criteria
+- `./bin/omarchy-iso-make --oem` builds successfully.
+- OEM ISO boot entries contain `copytoram=y` in all supported boot paths.
+- OEM ISO does not expose accessibility/speakup boot entries.
+- Normal build output and behavior remain unchanged.
+
+### Suggested verification commands
+- `bsdtar -xOf out/<iso>.iso boot/grub/grub.cfg | rg copytoram=y`
+- `bsdtar -xOf out/<iso>.iso boot/grub/loopback.cfg | rg copytoram=y`
+- `bsdtar -xOf out/<iso>.iso boot/syslinux/archiso_sys-linux.cfg | rg copytoram=y`
+- `bsdtar -xOf out/<iso>.iso boot/grub/grub.cfg | rg 'accessibility|speakup'` (should return no matches)
+- `bsdtar -xOf out/<iso>.iso boot/syslinux/archiso_sys-linux.cfg | rg 'speech|accessibility'` (should return no matches)
+
+---
+
+## 2) Add OEM safety guardrails
+
+### Why
+OEM image boots from internal disk and later wipes that same disk. Live environment must be fully in RAM before install begins.
+
+### File
+- `configs/airootfs/root/.automated_script.sh`
+
+### Changes
+- Before `run_configurator`, if `/root/omarchy_mode` is `oem`:
+  - Verify `/proc/cmdline` contains `copytoram=y`; abort with clear actionable error if missing.
+  - Verify factory hardware minimum using `MemTotal`:
+    - Require `MemTotal >= 8 GiB`.
+    - Abort with clear error if below minimum.
+  - Verify runtime memory safety using `MemAvailable`:
+    - Minimum threshold: `1.5 x ISO size + 1 GiB`.
+    - Abort with clear error if below threshold.
+  - Verify runtime state indicates live root is in RAM (for example, expected archiso runtime mounts present and boot media not actively mounted as install target path).
+
+### Acceptance criteria
+- OEM mode aborts safely if `copytoram=y` missing from cmdline.
+- OEM mode aborts safely if `MemTotal < 8 GiB`.
+- OEM mode aborts safely if `MemAvailable` below threshold.
+- OEM mode aborts safely if runtime state does not confirm RAM-backed live environment.
+
+### Error message requirements
+- State exactly what failed.
+- State why install is blocked.
+- Provide next step (reboot using proper OEM media or use external recovery media).
+
+---
+
+## 3) OEM disk warning
+
+### Why
+With `copytoram=y`, archiso copies squashfs to RAM and releases boot device. Existing configurator call `findmnt -no SOURCE /run/archiso/bootmnt` may return empty, so exclusion filter is skipped and all physical disks are shown, including former boot disk. No disk selection logic change is required.
+
+OEM mode still needs an unmistakable warning before destructive install proceeds.
+
+### File
+- `configs/airootfs/root/configurator`
+
+### Changes
+- Read mode from `/root/omarchy_mode`.
+- If mode is `oem`, add OEM-specific warning text before existing destructive confirmation.
+- Upgrade confirmation in OEM mode to explicit typed confirmation (for example: `YES, WIPE DISK`) while preserving existing normal-mode flow.
+
+### Acceptance criteria
+- Normal ISO behavior is unchanged.
+- OEM ISO shows OEM-specific warning before disk wipe confirmation.
+- OEM typed confirmation is required before destructive action.
+- In VM with `copytoram=y`, former boot disk appears in disk list without exclusion-logic changes.
+
+---
+
+## 4) Documentation
+
+### File
+- `README.md`
+
+### Changes
+- Document `--oem` build flag and resulting artifact naming.
+- Document factory workflow: writing OEM ISO to internal disk and expected first-boot UX.
+- Document failure and recovery behavior:
+  - Missing `copytoram=y`, `MemTotal < 8 GiB`, or low `MemAvailable` causes safe abort.
+  - Interrupted/failed install requires external reinstall media.
+- Add short operator checklist for manufacturing line validation.
+
+---
+
+## 5) Validation
+
+### VM test matrix
+1. Build OEM ISO.
+2. Write OEM ISO to virtual disk (not external media emulation).
+3. Boot from virtual disk and verify:
+   - `/proc/cmdline` contains `copytoram=y`.
+   - Guardrail checks pass in healthy case.
+   - OEM boot menu does not include accessibility/speech entries.
+4. Complete setup flow on first boot.
+5. Install to same disk.
+6. Reboot into installed OS.
+7. Verify encryption:
+   - `lsblk` shows crypt mapping.
+   - `cryptsetup status` reports active LUKS device.
+   - Boot requires unlock passphrase.
+8. Validate OEM warning + typed confirmation appears and gates destructive action.
+
+### Boot path coverage
+- UEFI + GRUB path.
+- BIOS/syslinux path (if still shipped).
+
+### Hardware test matrix
+- UEFI test on at least two hardware families (Intel + AMD).
+- Confirm no external media required.
+- Confirm first boot starts setup automatically.
+
+### Negative tests
+- OEM boot without `copytoram=y` -> safe abort with clear error.
+- `MemTotal < 8 GiB` -> safe abort with clear error.
+- Low `MemAvailable` -> safe abort with clear error.
+- Runtime state not RAM-backed -> safe abort with clear error.
+- Power interruption before installer starts -> deterministic reboot behavior.
+- Power interruption during install -> recovery requires external media (documented).
+
+---
+
+## 6) Security hardening checklist
+
+- No factory credentials exist; customer sets all passwords at first boot.
+- Clear shell history and transient setup artifacts at end of install.
+- Verify no secrets in logs shipped to customer.
+- Regenerate host identity on first installed boot as needed:
+  - `machine-id`
+  - SSH host keys (if installed/enabled)
+- Keep package signature verification and keyring handling intact.
+
+---
+
+## Rollout Plan
+
+1. Implement OEM build flag, mode marker, boot config injection, and build assertions.
+2. Implement copytoram, memory, and runtime-state guardrails in `.automated_script.sh`.
+3. Add OEM warning text and typed destructive confirmation in configurator.
+4. Add docs and operator checklist.
+5. Run VM matrix, including negative tests.
+6. Run hardware matrix.
+7. Cut first OEM preproduction release for manufacturing pilot.
+
+---
+
+## Definition of Done
+
+- `--oem` build exists and is documented.
+- Device preloaded with OEM image boots directly to setup.
+- Setup installs to internal disk without external media.
+- Final installed system is LUKS-encrypted with customer-owned passphrase.
+- OEM safety guardrails fail closed with actionable errors.
+- Existing non-OEM ISO behavior remains unchanged.
+- VM and hardware QA matrix pass.