Merge quattro and route refreshes through omarchy-update-pacman

Upstream now runs every Omarchy-owned pacman transaction through the
hidden omarchy-update-pacman helper so a mid-transaction systemd reexec
cannot kill it. Keep the deferred pre-refresh-pacman hook and the
command-scoped sudo wrapper, and call the helper from the refresh and
channel commands; the wrapper still applies to the helper's own sudo.

The sudo boundary fixture copies the helper into its root and runs a
systemd-run stand-in that execs the wrapped pacman step in place.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

migrations/1788848726.sh

@@ -0,0 +1,21 @@
+echo "Retire the stock user icon font missed by the Quattro upgrade"
+
+legacy_font="$HOME/.local/share/fonts/omarchy.ttf"
+
+# The upgrader treated this as ~/.config/omarchy.ttf and left the old family
+# registered alongside the packaged font. Preserve custom fonts and symlinks.
+if [[ -f $legacy_font && ! -L $legacy_font ]]; then
+  legacy_hash=$(sha256sum "$legacy_font")
+  if [[ ${legacy_hash%% *} == "e55e67119e82f56f92d90cbf54b7ccc1b2946b32c535a29370439d7ef5215966" ]]; then
+    if [[ ! -f /usr/share/fonts/omarchy/omarchy.ttf ]]; then
+      echo "Packaged Omarchy icon font is missing; keeping the legacy font." >&2
+      exit 1
+    fi
+
+    rm "$legacy_font"
+  fi
+fi
+
+# Also refresh on retries after removal succeeded but the cache refresh failed.
+# The normal update restarts the shell, which reloads Qt's font database.
+fc-cache -f

migrations/1788862626.sh

@@ -0,0 +1,20 @@
+echo "Expose the Elgato Cam Link 4K as a 16:9 virtual camera"
+
+if omarchy-hw-elgato-camlink-4k; then
+  source "$OMARCHY_PATH/install/hardware/fix-elgato-camlink-4k.sh"
+
+  sudo systemctl daemon-reload
+  sudo udevadm control --reload
+
+  # Re-run the rules for the Cam Link that is plugged in now so it gets hidden
+  # and relayed right away. The user ACL from its first plug survives a
+  # re-trigger, so drop it here; a replug or reboot does the same on its own.
+  sudo udevadm trigger --action=add --subsystem-match=video4linux
+  sudo udevadm settle
+  [[ -e /dev/camlink4k ]] && sudo setfacl -b /dev/camlink4k
+
+  # The trigger only starts the relay when the rule is new to the device.
+  # Start it outright so a failed module build or loopback surfaces here,
+  # with the raw camera hidden, rather than passing silently.
+  sudo systemctl start v4l2-relayd@camlink.service
+fi

migrations/1788941927.sh

@@ -0,0 +1,5 @@
+echo "Install basecamp (basecamp-cli) via mise wrapper"
+
+if [[ ! -f $HOME/.local/state/omarchy/preinstalls-removed ]]; then
+  omarchy-mise-install github:basecamp/basecamp-cli basecamp
+fi

migrations/1789091250.sh

@@ -0,0 +1,4 @@
+echo "Activate the Omarchy theme for existing T3 Code installs"
+
+omarchy-pkg-present t3code-bin || exit 0
+omarchy-install-ai-t3-code

migrations/1789095456.sh

@@ -0,0 +1,99 @@
+echo "Remove automatic project bin directories from PATH"
+
+work_dir="$HOME/Work"
+mise_config="$work_dir/.mise.toml"
+# install/user/mise-work.sh as shipped in Omarchy 4.0.3.
+stock_sha="bd04f191d63bbde86920f44f76f0989fad980afc84e268e8474c201ec7149245"
+cwd_bin='\{\{[[:space:]]*cwd[[:space:]]*\}\}/bin'
+unsafe_path="^[[:space:]]*_[.]path[[:space:]]*=[[:space:]]*(\"$cwd_bin\"|'$cwd_bin')[[:space:]]*(#.*)?$"
+env_section='^[[:space:]]*\[[[:space:]]*env[[:space:]]*\][[:space:]]*(#.*)?$'
+any_section='^[[:space:]]*\[\[?.*\]\]?[[:space:]]*(#.*)?$'
+
+remove_empty_work_dir=false
+if [[ ! -e $work_dir ]]; then
+  mkdir -p "$work_dir"
+  remove_empty_work_dir=true
+fi
+
+was_ignored=false
+if [[ -d $work_dir ]]; then
+  mise_state_dir=${MISE_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/mise}
+  ignored_configs_dir="$mise_state_dir/ignored-configs"
+  work_target=$(readlink -m "$work_dir")
+  config_path_target="$work_target/.mise.toml"
+  config_target=$(readlink -m "$mise_config")
+
+  if [[ -d $ignored_configs_dir ]]; then
+    for ignored_entry in "$ignored_configs_dir"/*; do
+      [[ -L $ignored_entry ]] || continue
+      ignored_target=$(readlink "$ignored_entry")
+      if [[ $ignored_target == $work_target || $ignored_target == $config_path_target || $ignored_target == $config_target ]]; then
+        was_ignored=true
+        break
+      fi
+    done
+  fi
+
+  if [[ $was_ignored == "false" ]]; then
+    # Normal Mise trust is recorded against the config-root directory, while
+    # paranoid trust is recorded against the file and its contents. Stage an
+    # empty, inert config when the legacy file is gone so either trust mode can
+    # resolve and revoke the original grant.
+    remove_empty_mise_config=false
+    if [[ ! -e $mise_config && ! -L $mise_config ]]; then
+      if (set -o noclobber; : >"$mise_config") 2>/dev/null; then
+        remove_empty_mise_config=true
+      fi
+    fi
+
+    untrust_target="$work_dir"
+    if [[ -f $mise_config ]]; then
+      untrust_target="$mise_config"
+    fi
+
+    if mise trust --untrust "$untrust_target"; then
+      :
+    else
+      if [[ $remove_empty_mise_config == "true" ]]; then
+        rm -f -- "$mise_config"
+      fi
+      exit 1
+    fi
+
+    if [[ $remove_empty_mise_config == "true" ]]; then
+      rm -f -- "$mise_config"
+    fi
+  fi
+fi
+
+if [[ -f $mise_config ]]; then
+  if [[ ! -L $mise_config && $(sha256sum "$mise_config" | cut -d ' ' -f 1) == $stock_sha ]]; then
+    rm -f -- "$mise_config"
+  else
+    unsafe_env_paths=$(sed -n -E "\\%$env_section%,\\%$any_section% { \\%$unsafe_path%p; }" "$mise_config")
+    if [[ -n $unsafe_env_paths ]]; then
+      backup=$(mktemp "$mise_config.bak.XXXXXX")
+      cp -p -- "$mise_config" "$backup"
+      sed --follow-symlinks -i -E "\\%$env_section%,\\%$any_section% { \\%$unsafe_path%d; }" "$mise_config"
+
+      printf '\n%s\n' \
+        "Automatic project bin directories were removed from your Mise PATH." \
+        "Your other Mise settings were preserved."
+      printf '\nBackup saved to:\n  %s\n' "$backup"
+    fi
+  fi
+fi
+
+if [[ -f $mise_config ]]; then
+  if [[ $was_ignored == "true" ]]; then
+    printf '\n%s\n' "This custom config remains ignored by Mise."
+  else
+    printf '\n%s\n  %s\n' \
+      "Mise trust for this custom config was revoked. Review it before trusting it again:" \
+      "mise trust $mise_config"
+  fi
+fi
+
+if [[ $remove_empty_work_dir == "true" ]]; then
+  rmdir "$work_dir" 2>/dev/null || true
+fi

migrations/1789130779.sh

@@ -0,0 +1,9 @@
+echo "Keep the KEF LSX II LT USB sink from suspending"
+
+conf="wireplumber/wireplumber.conf.d/kef-lsx-no-suspend.conf"
+
+if [[ ! -f "$HOME/.config/$conf" ]]; then
+  omarchy-refresh-config "$conf"
+  # WirePlumber only reads conf.d at startup; restart it if it is running.
+  systemctl --user try-restart wireplumber.service 2>/dev/null || true
+fi

migrations/1789294350.sh

@@ -0,0 +1,11 @@
+echo "Switch TCP congestion control to BBR with fq pacing"
+
+# Boot applies the shipped file regardless; this only makes new connections
+# use BBR now. Setting the sysctls autoloads tcp_bbr and sch_fq. Qdiscs
+# already attached to interfaces stay until they are recreated, normally at
+# reboot.
+if [[ $(sysctl -n net.ipv4.tcp_congestion_control) == "bbr" && $(sysctl -n net.core.default_qdisc) == "fq" ]]; then
+  exit 0
+fi
+
+sudo sysctl -p /etc/sysctl.d/99-omarchy-sysctl.conf >/dev/null || omarchy-state set reboot-required

migrations/1789310715.sh

@@ -0,0 +1,5 @@
+echo "Install cf (Cloudflare CLI) via mise wrapper"
+
+if [[ ! -f $HOME/.local/state/omarchy/preinstalls-removed ]]; then
+  omarchy-mise-install npm:cf cf
+fi

migrations/1789325478.sh

@@ -0,0 +1,44 @@
+echo "Install the Omarchy kernel and make it the first Limine boot entry"
+
+# linux-omarchy is an x86_64 kernel. T2 Macs must keep their specialized kernel,
+# including when other kernels are installed or the running T2 package is gone.
+[[ $(uname -m) == "x86_64" ]] || exit 0
+running_kernel=$(uname -r)
+if omarchy-pkg-present linux-t2 || [[ ${running_kernel,,} == *-t2* ]]; then
+  exit 0
+fi
+
+limine_conf="${OMARCHY_KERNEL_LIMINE_CONF:-/etc/default/limine}"
+rebuild_marker="${OMARCHY_KERNEL_REBUILD_MARKER:-/var/lib/omarchy/migrations/1789325478}"
+kernel="linux-omarchy"
+
+# Completion is machine-wide even though migrations run once per user. Leave
+# the old kernel installed so it remains available if the new one cannot boot.
+# The new filename and marker also reach users who completed 1789095456.
+[[ ! -e $rebuild_marker ]] || exit 0
+omarchy-pkg-add "$kernel" "$kernel-headers"
+
+# /etc/default/limine has priority over every drop-in, including old Dell
+# settings and customized package files whose updates landed in a .pacnew.
+# Set the exact kernel first: linux-omarchy-* only matches its older variants.
+# Preserve unrelated settings, especially the root filesystem's kernel cmdline.
+sudo mkdir -p "$(dirname "$limine_conf")"
+sudo touch "$limine_conf"
+sudo sed -i -E '/^[[:space:]]*BOOT_ORDER[[:space:]]*=/d' "$limine_conf"
+printf '\n%s\n' 'BOOT_ORDER="linux-omarchy, linux-omarchy-*, *, *fallback, Snapshots"' | sudo tee -a "$limine_conf" >/dev/null
+
+# Package hooks ran before the config repair. Rebuild the new kernel's image
+# and boot entry explicitly, including on retries after a failed rebuild.
+sudo limine-mkinitcpio "$kernel"
+
+# limine-mkinitcpio can return success after skipping a failed kernel build.
+# Do not mark the migration complete unless the new kernel is in the menu.
+if ! sudo limine-entry-tool --tree | grep -E "(^|[^[:alnum:]_-])$kernel([^[:alnum:]_-]|$)" >/dev/null; then
+  echo "The Omarchy kernel has no Limine boot entry; rerun omarchy-migrate after fixing the boot image build." >&2
+  exit 1
+fi
+
+# Keeping the running kernel installed prevents the updater from detecting a
+# kernel replacement, so request the reboot explicitly.
+omarchy-state set reboot-required
+sudo install -Dm644 /dev/null "$rebuild_marker"

migrations/1789444024.sh

@@ -0,0 +1,10 @@
+echo "Install missing headers for the Omarchy or T2 kernel"
+
+# Fresh ISO installs mark earlier migrations complete, so the kernel migration
+# cannot repair headers omitted by those installers. Package installation is
+# idempotent when another user has already applied this repair.
+for kernel in linux-omarchy linux-t2; do
+  if omarchy-pkg-present "$kernel"; then
+    omarchy-pkg-add "$kernel-headers"
+  fi
+done