Merge branch 'pr-14399' into omarchycn

# Conflicts:
#	bin/omarchy-refresh-pacman
#	install/post-install/pacman.sh

bin/omarchy-apply-pacman

@@ -0,0 +1,73 @@
+#!/bin/bash
+
+# omarchy:summary=Restore channel and regional pacman defaults in an installed target
+# omarchy:args=<stable|rc|edge> [target-root] | --render <stable|rc|edge> <output-dir> [target-root]
+# omarchy:requires-sudo=true
+# omarchy:hidden=true
+
+set -euo pipefail
+
+usage() {
+  echo "Usage: omarchy-apply-pacman <stable|rc|edge> [target-root]" >&2
+  echo "       omarchy-apply-pacman --render <stable|rc|edge> <output-dir> [target-root]" >&2
+  exit 1
+}
+
+# --render only builds the two files, so an unprivileged caller can hand root
+# nothing but plain copies of the finished result.
+render_dir=""
+if [[ ${1:-} == "--render" ]]; then
+  (( $# == 3 || $# == 4 )) || usage
+  channel="$2"
+  render_dir="$3"
+  [[ -d $render_dir ]] || { echo "Render directory not found: $render_dir" >&2; exit 1; }
+  etc="${4:-/}/etc"
+else
+  (( $# >= 1 && $# <= 2 )) || usage
+  channel="$1"
+  etc="${2:-/}/etc"
+fi
+
+case "$channel" in
+  stable|rc|edge) ;;
+  *) echo "Invalid pacman channel: $channel" >&2; exit 1 ;;
+esac
+
+# The ISO writes this plain-text marker before target finalization. Missing
+# markers keep existing installations global; never source it as shell code.
+region=global
+if [[ -e $etc/omarchy/region ]]; then
+  region=$(<"$etc/omarchy/region")
+fi
+case "$region" in
+  global|cn) ;;
+  *) echo "Unsupported region: $region (expected global or cn)" >&2; exit 1 ;;
+esac
+
+# Build both files before replacing either. Explicit refreshes retain backups;
+# ordinary updates do not call this command or enforce regional defaults.
+if [[ -n $render_dir ]]; then
+  staging="$render_dir"
+else
+  staging=$(mktemp -d)
+  trap 'rm -rf "$staging"' EXIT
+fi
+cp "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" "$staging/pacman.conf"
+cp "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" "$staging/mirrorlist"
+if [[ $region != "global" ]]; then
+  profile="$OMARCHY_PATH/default/regions/$region/pacman"
+  printf '\n' >> "$staging/pacman.conf"
+  cat "$profile/pacman.conf.append" >> "$staging/pacman.conf"
+  cat "$profile/mirrorlist.append" >> "$staging/mirrorlist"
+fi
+[[ -z $render_dir ]] || exit 0
+
+mkdir -p "$etc/pacman.d"
+for file in pacman.conf pacman.d/mirrorlist; do
+  if [[ -e $etc/$file ]]; then
+    cp -f "$etc/$file" "$etc/$file.bak"
+  fi
+done
+# Copying over an existing file keeps its owner and mode, as refresh always has.
+cp -f "$staging/pacman.conf" "$etc/pacman.conf"
+cp -f "$staging/mirrorlist" "$etc/pacman.d/mirrorlist"

bin/omarchy-channel-set

@@ -47,9 +47,26 @@ validate_dev_checkout() {
   fi
 }
 
+# The dev channel refreshes pacman with the checkout's own tools. A checkout
+# without this machine's region profile would silently drop its repositories.
+validate_dev_region() {
+  local checkout="$1" region_file="${OMARCHY_REGION_FILE:-/etc/omarchy/region}" region=global
+
+  [[ -f $region_file ]] && region=$(<"$region_file")
+  [[ $region == "global" ]] && return 0
+
+  # The refresh after linking needs a runnable helper and both fragments, not
+  # just a directory with the region's name.
+  local profile="$checkout/default/regions/$region/pacman"
+  if [[ ! -x $checkout/bin/omarchy-apply-pacman || ! -r $profile/pacman.conf.append || ! -r $profile/mirrorlist.append ]]; then
+    fail "$checkout does not support the '$region' region, so switching would drop its package repositories. Check out a branch with default/regions/$region, or remove $region_file to use global defaults."
+  fi
+}
+
 link_dev_checkout() {
   local checkout="$1" required
   [[ -d $checkout/.git ]] || git clone https://github.com/omacom/omarchy.git "$checkout"
+  validate_dev_region "$checkout"
 
   # Check the destination before changing /etc/omarchy.conf or sudo's path.
   # An existing checkout is not pulled automatically and may predate this policy.

bin/omarchy-provision-owner

@@ -16,6 +16,7 @@ set -euo pipefail
 PROVISIONING_DIR=/var/lib/omarchy/provisioning
 OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
 LOG_FILE=/var/log/omarchy-provision-owner.log
+REGION_MARKER=/etc/omarchy/region
 
 if (( EUID != 0 )); then
   echo "Error: omarchy-provision-owner must run as root" >&2
@@ -650,7 +651,21 @@ user_form() {
   omarchy_prompt_hostname || return $?
 
   step "Let's set your timezone..."
-  omarchy_prompt_timezone || return $?
+  omarchy_prompt_timezone "$(region_timezone)" || return $?
+}
+
+# The zone a region profile preselects when there is no geo guess, which is
+# every offline first boot. Reads the marker omarchy-apply-pacman reads; global,
+# missing, or malformed regions offer nothing.
+region_timezone() {
+  local region=global profile
+  if [[ -r $REGION_MARKER ]]; then
+    region=$(<"$REGION_MARKER")
+  fi
+  profile="$OMARCHY_PATH/default/regions/$region/timezone"
+  if [[ $region =~ ^[a-z]{2}$ && -r $profile ]]; then
+    head -n 1 "$profile"
+  fi
 }
 
 confirm_form() {

bin/omarchy-refresh-pacman

@@ -30,16 +30,25 @@ if [[ $channel != "stable" && $channel != "rc" && $channel != "edge" ]]; then
   exit 2
 fi
 
+# Render the channel templates plus this machine's regional additions as the
+# caller, so root only copies finished files. The scratch directory goes on
+# every exit, including a failed render, a refused sudo prompt, or a signal;
+# revoking the sudo timestamp stays the last thing the exit path does.
+rendered=$(mktemp -d)
+cleanup_refresh() {
+  local status=$?
+  rm -rf "$rendered"
+  omarchy_security_exit_with_revoked_sudo "$status"
+}
+trap cleanup_refresh EXIT
+"$OMARCHY_PATH/bin/omarchy-apply-pacman" --render "$channel" "$rendered"
+
 sudo cp -f /etc/pacman.conf /etc/pacman.conf.bak
 sudo cp -f /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.bak
 echo "Setting channel to $channel"
-sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
-sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist
-region=$(omarchy-region)
-if [[ $region == "China" ]]; then
-  echo "Adding China mirrors"
-  sudo sed -i -f "$OMARCHY_PATH/default/region/china/pacman.sed" /etc/pacman.conf /etc/pacman.d/mirrorlist
-fi
+sudo cp -f "$rendered/pacman.conf" /etc/pacman.conf
+sudo cp -f "$rendered/mirrorlist" /etc/pacman.d/mirrorlist
+rm -rf "$rendered"
 
 # Allow user customization of /etc/pacman.conf before the upgrade runs, so
 # custom repositories and IgnorePkg entries shape the downgrade-capable