Point package managers at China mirrors on cn installs

npm, PyPI and uv, Go, rustup and crates.io, RubyGems and Bundler,
and Maven reach their registries slowly or not at all from China.
On a cn install, link the profile's environment, cargo and gem
drop-ins into place. A regular file the admin wrote is never
replaced; the install fails instead.

AGENTS.md

@@ -96,6 +96,11 @@ Exceptions are allowed for migration and package-helper scripts where the helper
 - Do not add `aliases` to new menu entries. Aliases are reserved for
   established alternate names users already type, kept for compatibility.
 
+# Region
+
+- `/etc/omarchy/region` holds the region the installer derived from the timezone (`cn`); no file means Global. The profile lives in `default/regions/cn/`, its contract in `docs/regions.md`.
+- `install/config/region.sh` links the `cn` developer mirrors into `/etc` and `/.cargo` and refuses to replace a regular file it did not create.
+
 # Config Structure
 
 - `config/` - default configs copied to `~/.config/`

bin/omarchy-apply-pacman

@@ -0,0 +1,77 @@
+#!/bin/bash
+
+# omarchy:summary=Restore channel and regional pacman defaults in an installed target
+# omarchy:args=<stable|rc|edge> [target-root] | --render <stable|rc|edge> <output-dir> [target-root]
+# omarchy:requires-sudo=true
+# omarchy:hidden=true
+
+set -euo pipefail
+
+usage() {
+  echo "Usage: omarchy-apply-pacman <stable|rc|edge> [target-root]" >&2
+  echo "       omarchy-apply-pacman --render <stable|rc|edge> <output-dir> [target-root]" >&2
+  exit 1
+}
+
+# --render only builds the two files, so an unprivileged caller can hand root
+# nothing but plain copies of the finished result.
+render_dir=""
+if [[ ${1:-} == "--render" ]]; then
+  (( $# == 3 || $# == 4 )) || usage
+  channel="$2"
+  render_dir="$3"
+  [[ -d $render_dir ]] || { echo "Render directory not found: $render_dir" >&2; exit 1; }
+  etc="${4:-/}/etc"
+else
+  (( $# >= 1 && $# <= 2 )) || usage
+  channel="$1"
+  etc="${2:-/}/etc"
+fi
+
+case "$channel" in
+  stable|rc|edge) ;;
+  *) echo "Invalid pacman channel: $channel" >&2; exit 1 ;;
+esac
+
+# The ISO writes this plain-text marker before target finalization. Missing
+# markers keep existing installations global; never source it as shell code.
+region=global
+if [[ -e $etc/omarchy/region ]]; then
+  region=$(<"$etc/omarchy/region")
+fi
+case "$region" in
+  global|cn) ;;
+  *) echo "Unsupported region: $region (expected global or cn)" >&2; exit 1 ;;
+esac
+
+# Build both files before replacing either. Explicit refreshes retain backups;
+# ordinary updates do not call this command or enforce regional defaults.
+if [[ -n $render_dir ]]; then
+  staging="$render_dir"
+else
+  staging=$(mktemp -d)
+  trap 'rm -rf "$staging"' EXIT
+fi
+cp "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" "$staging/pacman.conf"
+if [[ $region == "global" ]]; then
+  cp "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" "$staging/mirrorlist"
+else
+  profile="$OMARCHY_PATH/default/regions/$region/pacman"
+  printf '\n' >> "$staging/pacman.conf"
+  cat "$profile/pacman.conf.append" >> "$staging/pacman.conf"
+  # pacman tries servers in order, so the regional mirror leads and the
+  # channel's own mirror stays as the fallback.
+  cat "$profile/mirrorlist-$channel.prepend" "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" > "$staging/mirrorlist"
+fi
+
+if [[ -z $render_dir ]]; then
+  mkdir -p "$etc/pacman.d"
+  for file in pacman.conf pacman.d/mirrorlist; do
+    if [[ -e $etc/$file ]]; then
+      cp -f "$etc/$file" "$etc/$file.bak"
+    fi
+  done
+  # Copying over an existing file keeps its owner and mode, as refresh always has.
+  cp -f "$staging/pacman.conf" "$etc/pacman.conf"
+  cp -f "$staging/mirrorlist" "$etc/pacman.d/mirrorlist"
+fi

bin/omarchy-channel-set

@@ -47,9 +47,31 @@ validate_dev_checkout() {
   fi
 }
 
+# The dev channel refreshes pacman with the checkout's own tools. A checkout
+# without this machine's region profile would silently drop its repositories.
+validate_dev_region() {
+  local checkout="$1" region_file="${OMARCHY_REGION_FILE:-/etc/omarchy/region}" region=global
+
+  [[ -f $region_file ]] && region=$(<"$region_file")
+  [[ $region == "global" ]] && return 0
+
+  # The refresh after linking needs a runnable helper and every fragment, not
+  # just a directory with the region's name: dev refreshes edge, and leaving
+  # dev later refreshes stable or rc with this checkout's tools.
+  local profile="$checkout/default/regions/$region/pacman" fragment supported=true
+  [[ -x $checkout/bin/omarchy-apply-pacman ]] || supported=false
+  for fragment in pacman.conf.append mirrorlist-stable.prepend mirrorlist-rc.prepend mirrorlist-edge.prepend; do
+    [[ -r $profile/$fragment ]] || supported=false
+  done
+  if ! $supported; then
+    fail "$checkout does not support the '$region' region, so switching would drop its package repositories. Check out a branch with default/regions/$region, or remove $region_file to use global defaults."
+  fi
+}
+
 link_dev_checkout() {
   local checkout="$1" required
   [[ -d $checkout/.git ]] || git clone https://github.com/omacom/omarchy.git "$checkout"
+  validate_dev_region "$checkout"
 
   # Check the destination before changing /etc/omarchy.conf or sudo's path.
   # An existing checkout is not pulled automatically and may predate this policy.

bin/omarchy-refresh-pacman

@@ -30,11 +30,25 @@ if [[ $channel != "stable" && $channel != "rc" && $channel != "edge" ]]; then
   exit 2
 fi
 
+# Render the channel templates plus this machine's regional additions as the
+# caller, so root only copies finished files. The scratch directory goes on
+# every exit, including a failed render, a refused sudo prompt, or a signal;
+# revoking the sudo timestamp stays the last thing the exit path does.
+rendered=$(mktemp -d)
+cleanup_refresh() {
+  local status=$?
+  rm -rf "$rendered"
+  omarchy_security_exit_with_revoked_sudo "$status"
+}
+trap cleanup_refresh EXIT
+"$OMARCHY_PATH/bin/omarchy-apply-pacman" --render "$channel" "$rendered"
+
 sudo cp -f /etc/pacman.conf /etc/pacman.conf.bak
 sudo cp -f /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.bak
 echo "Setting channel to $channel"
-sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
-sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist
+sudo cp -f "$rendered/pacman.conf" /etc/pacman.conf
+sudo cp -f "$rendered/mirrorlist" /etc/pacman.d/mirrorlist
+rm -rf "$rendered"
 
 # Allow user customization of /etc/pacman.conf before the upgrade runs, so
 # custom repositories and IgnorePkg entries shape the downgrade-capable

default/regions/cn/cargo.toml

@@ -0,0 +1,5 @@
+[source.crates-io]
+replace-with = "aliyun"
+
+[source.aliyun]
+registry = "sparse+https://mirrors.aliyun.com/crates.io-index/"

default/regions/cn/environment.conf

@@ -0,0 +1,8 @@
+NPM_CONFIG_REGISTRY=https://registry.npmmirror.com
+PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/
+UV_DEFAULT_INDEX=https://mirrors.aliyun.com/pypi/simple/
+GOPROXY=https://mirrors.aliyun.com/goproxy/,direct
+RUSTUP_DIST_SERVER=https://mirrors.aliyun.com/rustup
+RUSTUP_UPDATE_ROOT=https://mirrors.aliyun.com/rustup/rustup
+BUNDLE_MIRROR__ALL=https://mirrors.aliyun.com/rubygems/
+MAVEN_ARGS=--global-settings /usr/share/omarchy/default/regions/cn/maven-settings.xml

default/regions/cn/gemrc

@@ -0,0 +1,3 @@
+---
+:sources:
+- https://mirrors.aliyun.com/rubygems/

default/regions/cn/maven-settings.xml

@@ -0,0 +1,9 @@
+<settings>
+  <mirrors>
+    <mirror>
+      <id>aliyun</id>
+      <mirrorOf>central</mirrorOf>
+      <url>https://maven.aliyun.com/repository/public</url>
+    </mirror>
+  </mirrors>
+</settings>

default/regions/cn/packages

@@ -0,0 +1,2 @@
+# Installed from the ISO's offline repository before enabling ArchLinuxCN.
+archlinuxcn-keyring

default/regions/cn/pacman/mirrorlist-edge.prepend

@@ -0,0 +1 @@
+Server = https://mirror.omarchy.cn/$repo/os/$arch

default/regions/cn/pacman/mirrorlist-rc.prepend

@@ -0,0 +1 @@
+Server = https://rc-mirror.omarchy.cn/$repo/os/$arch

default/regions/cn/pacman/mirrorlist-stable.prepend

@@ -0,0 +1 @@
+Server = https://stable-mirror.omarchy.cn/$repo/os/$arch

default/regions/cn/pacman/pacman.conf.append

@@ -0,0 +1,2 @@
+[archlinuxcn]
+Server = https://mirrors.ustc.edu.cn/archlinuxcn/$arch

default/regions/cn/timezones

@@ -0,0 +1,9 @@
+# Installs in these timezones get this region. The installer's timezone list
+# includes tzdata's backward-compatible names, so they are listed too.
+Asia/Shanghai
+Asia/Urumqi
+Asia/Chongqing
+Asia/Chungking
+Asia/Harbin
+Asia/Kashgar
+PRC

docs/regions.md

@@ -0,0 +1,47 @@
+# Regional defaults
+
+Regions customize bootstrap defaults independently of update channels and of the installer's language. Country identifiers are lowercase, officially assigned ISO 3166-1 alpha-2 codes. `global` is a reserved value for no country-specific additions. Only implemented profiles are accepted; currently `global` and `cn`.
+
+## Runtime configuration
+
+The ISO installer writes the region it derived to `/etc/omarchy/region` before target finalization. It is plain text, not executable configuration, owned by root and world-readable (`0644`), because refresh renders as the calling user. A missing file means `global`; an unsupported value is an error.
+
+`omarchy-apply-pacman <stable|rc|edge> [target-root]` restores the selected channel's two pacman templates, appends the region's `pacman.conf.append` to `pacman.conf`, and puts the region's `mirrorlist-<channel>.prepend` ahead of the channel's mirrorlist. Both files are generated before either live file is replaced. Existing files are backed up with `.bak`. Dev uses the edge pacman channel, as before.
+
+Both installation finalization and `omarchy-refresh-pacman` use this command. Explicit refreshes and channel changes restore regional defaults; ordinary updates do not enforce them. The existing `pre-refresh-pacman` user hook runs after regeneration and before the update, so users can maintain overrides there. Switching to the dev channel refuses a checkout that lacks this machine's region profile, because that checkout's own refresh would otherwise drop the regional repositories. Users can edit the files directly or set the region to `global` before a refresh to stop applying regional repository defaults. This does not uninstall packages or rewrite anything in existing home directories.
+
+Refresh renders both files as the calling user and gives root only the finished copies, so the sudo boundary stays command-scoped. That boundary does not defend against other code already running as the same user: such code could change the rendered files while refresh waits for the password, as it could alter that user's own environment in other ways.
+
+The China profile puts Omarchy's China replica of the channel's Arch mirror first (`stable-mirror.omarchy.cn`, `rc-mirror.omarchy.cn`, or `mirror.omarchy.cn` for edge and dev) and keeps the channel's `.org` mirror as the fallback. pacman tries servers in order and moves to the next one when a download fails, including a 404. After three failed downloads from one server, it skips that server for the rest of the transaction. It also takes the package databases from the first server that answers, without comparing them, so the China replicas must carry complete, current metadata. The profile also adds the ArchLinuxCN community repository from USTC's mirror, run by the University of Science and Technology of China. It does not change the `[omarchy]` package repository. ArchLinuxCN is rolling and built against current Arch, while stable and RC are snapshots, so its packages can need newer libraries than a stable machine has.
+
+## Profile layout
+
+Each profile lives in `default/regions/<code>/`:
+
+- `timezones`: the timezones that select this region, one per line, with blank lines and `#` comments allowed. List tzdata's backward-compatible names too, since the installer's timezone list includes them. A timezone may belong to at most one profile.
+- `packages`: additional target packages, in the same format. Every ISO carries every profile's packages in its offline repository; the installer installs them only on targets in that region. A package named `<name>-keyring` is the profile's trust anchor: the builder installs it through Arch's existing trust chain, and a regional target populates the `<name>` keyring.
+- `pacman/`: `pacman.conf.append`, added after the channel's `pacman.conf`, and one `mirrorlist-<channel>.prepend` per channel (`stable`, `rc`, `edge`), placed ahead of the channel's mirrorlist so the regional mirror is tried first.
+
+## ISO installer contract
+
+There is one ISO for every region. The companion `omarchy-iso` repository reads the profiles from the runtime it bundles, so a region and its repository defaults can never disagree.
+
+- **Build:** every profile's `packages` go into the offline repository, but not into the base package list. The builder adds each profile's community repository to its writable online config to download them; it does not change its Arch channel mirrors.
+- **Install:** the installer maps the timezone the user picked to a region through the `timezones` files; a timezone no profile lists means `global`. It shows the result on the summary screen. Unattended installs can set the region explicitly instead. For a regional install it installs the profile's packages from the offline repository and writes `/etc/omarchy/region`; the runtime finalizer then applies the fragments.
+- **Deferred installs** have no timezone until first boot, so they are `global` unless the unattended configuration sets a region.
+
+For China, the builder installs `archlinuxcn-keyring` using the existing Arch trust chain before downloading ArchLinuxCN packages. Signature or keyring failures abort the build; no unverified keyserver trust or online signature bypass is added. On a China target the installer installs the keyring from the offline repository, then initializes and populates it before the online repositories are enabled. Global targets never populate ArchLinuxCN's keys. The ISO's existing offline repository verification policy is unchanged.
+
+## Scope of the China profile
+
+The China profile provides repository defaults and developer mirrors. Language is a separate installer choice, not part of a region: a Chinese speaker outside China keeps global mirrors, and a China install in English still gets the regional ones.
+
+## Developer mirrors
+
+The `cn` profile also points the common package managers at mirrors inside China: `environment.conf` (npm, PyPI and uv, Go, rustup, Bundler, and Maven through `MAVEN_ARGS`), `cargo.toml` for crates.io, `gemrc` for RubyGems, and `maven-settings.xml`, which Maven reads in place. During installation `install/config/region.sh` links the first three to `/etc/environment.d/90-omarchy-china.conf`, `/.cargo/config.toml` and `/etc/gemrc` when the marker says `cn`. It refuses to replace a regular file it did not create. The environment reaches sessions started after login.
+
+## Remaining release validation
+
+Unit tests cover region/channel independence, the timezone mapping, generated pacman contents, repeat application, and refresh ordering; refresh itself is exercised only inside the sudo-boundary sandbox. They do not establish live mirror availability, real package trust, or successful offline installation. Before distribution, build from matching local checkouts on an x86_64 builder and run the disposable-VM acceptance workflow in `agents/skills/acceptance-tests.md`.
+
+The acceptance run must install without network access in both directions: a non-China timezone must produce pacman files byte for byte identical to the channel templates, and `Asia/Shanghai` must produce the China profile, boot to a new user, and keep the regional mirrors, repository, marker, and keyring trust through `stable`, `rc`, and `edge` refreshes.

install/config/all.sh

@@ -1,3 +1,4 @@
+run_logged "$OMARCHY_INSTALL/config/region.sh"
 run_logged "$OMARCHY_INSTALL/config/theme-system.sh"
 run_logged "$OMARCHY_INSTALL/config/browser-policy.sh"
 run_logged "$OMARCHY_INSTALL/config/increase-lockout-limit.sh"

install/config/region.sh

@@ -0,0 +1,33 @@
+cn_links=(
+  "environment.conf /etc/environment.d/90-omarchy-china.conf"
+  "cargo.toml /.cargo/config.toml"
+  "gemrc /etc/gemrc"
+)
+
+# The installer writes the marker from the timezone.
+region=global
+if [[ -e /etc/omarchy/region ]]; then
+  region=$(</etc/omarchy/region)
+fi
+
+case $region in
+global) ;;
+cn)
+  for link in "${cn_links[@]}"; do
+    read -r _ target <<<"$link"
+    if [[ -e $target && ! -L $target ]]; then
+      echo "Refusing to replace $target, which Omarchy did not create" >&2
+      exit 1
+    fi
+  done
+  for link in "${cn_links[@]}"; do
+    read -r source target <<<"$link"
+    mkdir -p "${target%/*}"
+    ln -sfn "$OMARCHY_PATH/default/regions/cn/$source" "$target"
+  done
+  ;;
+*)
+  echo "Unknown region: $region" >&2
+  exit 1
+  ;;
+esac

install/post-install/pacman.sh

@@ -1,7 +1,6 @@
 # Configure pacman after package installation completes. Offline target package
 # installs use the live ISO's offline pacman.conf until this final restore.
-cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
-cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-${OMARCHY_MIRROR:-stable}" /etc/pacman.d/mirrorlist
+"$OMARCHY_PATH/bin/omarchy-apply-pacman" "${OMARCHY_MIRROR:-stable}"
 
 # Wait for CUPS to own the file, the way omarchy-settings does, so pacman does
 # not turn the override into a .pacnew during ISO package installation.

test/shell.d/channel-sudo-boundary-test.sh

@@ -6,6 +6,7 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 source "$SHELL_TEST_DIR/fixtures/sudo-boundary-test.sh"
 copy_boundary_file bin/omarchy-channel-set
 copy_boundary_file bin/omarchy-refresh-pacman
+copy_boundary_file bin/omarchy-apply-pacman
 copy_boundary_file bin/omarchy-update
 export OMARCHY_UPDATE_LOGGED=1
 

test/shell.d/channel-test.sh

@@ -113,6 +113,7 @@ run_channel() {
   : >"$log_file"
   OMARCHY_CHANNEL_TEST_LOG="$log_file" \
     OMARCHY_PATH="${OMARCHY_TEST_PATH:-$package_root}" \
+    OMARCHY_REGION_FILE="${OMARCHY_TEST_REGION_FILE:-$test_tmp/no-region}" \
     HOME="$test_tmp/home" \
     PATH="$stub_bin:$ROOT/bin:$PATH" \
     "${OMARCHY_TEST_PATH:-$package_root}/bin/omarchy-channel-set" "$@"
@@ -190,6 +191,58 @@ fi
 assert_log_line $'link\t'"$checkout"$'\t--no-reboot' "switching back to dev links ~/omarchy"
 pass "switching back to dev reuses the existing ~/omarchy checkout"
 
+printf 'cn\n' >"$test_tmp/region"
+if OMARCHY_TEST_REGION_FILE="$test_tmp/region" run_channel dev >"$test_tmp/region.out" 2>"$test_tmp/region.err"; then
+  fail "dev refuses a checkout without this machine's region"
+fi
+grep -q "does not support the 'cn' region" "$test_tmp/region.err" || fail "dev explains the missing region" "$(cat "$test_tmp/region.err")"
+if grep -Eq $'^(link|refresh)\t' "$log_file"; then
+  fail "dev refuses before linking or refreshing pacman" "$(cat "$log_file")"
+fi
+pass "dev refuses a checkout without the region before touching pacman"
+
+# A directory with the region's name, or a helper that cannot run, is not
+# support: the refresh after linking would fail with dev already linked.
+mkdir -p "$checkout/default/regions/cn"
+touch "$checkout/bin/omarchy-apply-pacman"
+chmod +x "$checkout/bin/omarchy-apply-pacman"
+if OMARCHY_TEST_REGION_FILE="$test_tmp/region" run_channel dev >"$test_tmp/region.out" 2>"$test_tmp/region.err"; then
+  fail "dev refuses an empty region profile"
+fi
+if grep -Eq $'^(link|refresh)\t' "$log_file"; then
+  fail "dev refuses an empty region profile before linking or refreshing pacman" "$(cat "$log_file")"
+fi
+mkdir -p "$checkout/default/regions/cn/pacman"
+cn_fragments=(pacman.conf.append mirrorlist-stable.prepend mirrorlist-rc.prepend mirrorlist-edge.prepend)
+for missing in "${cn_fragments[@]}"; do
+  for fragment in "${cn_fragments[@]}"; do
+    if [[ $fragment == "$missing" ]]; then
+      rm -f "$checkout/default/regions/cn/pacman/$fragment"
+    else
+      touch "$checkout/default/regions/cn/pacman/$fragment"
+    fi
+  done
+  if OMARCHY_TEST_REGION_FILE="$test_tmp/region" run_channel dev >"$test_tmp/region.out" 2>"$test_tmp/region.err"; then
+    fail "dev refuses a region profile without $missing"
+  fi
+  if grep -Eq $'^(link|refresh)\t' "$log_file"; then
+    fail "dev refuses a profile without $missing before linking or refreshing pacman" "$(cat "$log_file")"
+  fi
+done
+touch "${cn_fragments[@]/#/$checkout/default/regions/cn/pacman/}"
+chmod -x "$checkout/bin/omarchy-apply-pacman"
+if OMARCHY_TEST_REGION_FILE="$test_tmp/region" run_channel dev >"$test_tmp/region.out" 2>"$test_tmp/region.err"; then
+  fail "dev refuses a checkout whose pacman helper cannot run"
+fi
+if grep -Eq $'^(link|refresh)\t' "$log_file"; then
+  fail "dev refuses incomplete region support before linking or refreshing pacman" "$(cat "$log_file")"
+fi
+pass "dev refuses a region profile missing any fragment or a helper that cannot run"
+
+chmod +x "$checkout/bin/omarchy-apply-pacman"
+OMARCHY_TEST_REGION_FILE="$test_tmp/region" run_channel dev
+assert_log_line $'refresh\tedge' "dev proceeds with a checkout that supports the region"
+
 current_channel() {
   OMARCHY_TEST_VERSION_CHANNEL="$1" \
     OMARCHY_TEST_PACKAGES="$2" \

test/shell.d/fixtures/sudo-boundary-test.sh

@@ -9,7 +9,11 @@ export SUDO_TEST_LOG="$boundary_tmp/events"
 export SUDO_TEST_CACHE="$boundary_tmp/cache"
 export OMARCHY_PATH="$SUDO_TEST_ROOT"
 export SUDO_TEST_HOME="$boundary_tmp/home"
-mkdir -p "$SUDO_TEST_HOME"
+# The machine the render reads its region marker from. It starts global; a test
+# writes etc/omarchy/region here to model a regional install, never the host's.
+export SUDO_TEST_TARGET="$boundary_tmp/target"
+export OMARCHY_REGION_FILE="$SUDO_TEST_TARGET/etc/omarchy/region"
+mkdir -p "$SUDO_TEST_HOME" "$SUDO_TEST_TARGET/etc"
 mkdir -p "$SUDO_TEST_ROOT/bin" "$SUDO_TEST_ROOT/mock" "$SUDO_TEST_ROOT/default/omarchy/sudo-no-update"
 : >"$SUDO_TEST_LOG"
 
@@ -24,6 +28,10 @@ s=(source/name).read_text().replace('$HOME', '$SUDO_TEST_HOME')
 for command in ['sudo','pkexec','pacman','omarchy-pkg-missing','systemd-inhibit','setpriv','snapper']:
  s=s.replace('/usr/bin/'+command, str(target/'mock'/command))
 s=s.replace('PATH=/usr/bin:/usr/sbin:/bin:/sbin', 'PATH="'+str(target/'bin')+':/usr/bin:/usr/sbin:/bin:/sbin"')
+if name.name == 'omarchy-apply-pacman':
+ render_etc='etc="${4:-/}/etc"'
+ assert s.count(render_etc)==1, 'render target lookup moved'
+ s=s.replace(render_etc, 'etc="${4:-$SUDO_TEST_TARGET}/etc"')
 p.write_text(s)
 p.chmod((source/name).stat().st_mode & 0o777)
 PY

test/shell.d/region-pacman-test.sh

@@ -0,0 +1,141 @@
+#!/bin/bash
+
+set -euo pipefail
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+scratch=$(mktemp -d)
+trap 'rm -rf "$scratch"' EXIT
+export OMARCHY_PATH="$ROOT"
+export TARGET_ROOT="$scratch/target root"
+mkdir -p "$TARGET_ROOT/etc/omarchy"
+
+apply() { "$ROOT/bin/omarchy-apply-pacman" "$1" "$TARGET_ROOT"; }
+
+for channel in stable rc edge; do
+  apply "$channel"
+  cmp "$ROOT/default/pacman/pacman-$channel.conf" "$TARGET_ROOT/etc/pacman.conf"
+  cmp "$ROOT/default/pacman/mirrorlist-$channel" "$TARGET_ROOT/etc/pacman.d/mirrorlist"
+done
+pass "missing region preserves all global channel templates byte for byte"
+
+chmod 600 "$TARGET_ROOT/etc/pacman.conf"
+apply stable
+[[ $(stat -c %a "$TARGET_ROOT/etc/pacman.conf") == 600 ]] || fail "refresh keeps a customized pacman.conf mode"
+chmod 644 "$TARGET_ROOT/etc/pacman.conf"
+pass "refresh keeps existing config file modes"
+
+printf 'cn\n' > "$TARGET_ROOT/etc/omarchy/region"
+for channel in stable rc edge; do
+  case "$channel" in
+    stable) host=stable-mirror.omarchy ;;
+    rc) host=rc-mirror.omarchy ;;
+    edge) host=mirror.omarchy ;;
+  esac
+  apply "$channel"
+  expected=$(printf 'Server = https://%s.cn/$repo/os/$arch\nServer = https://%s.org/$repo/os/$arch' "$host" "$host")
+  [[ $(<"$TARGET_ROOT/etc/pacman.d/mirrorlist") == "$expected" ]] || fail "$channel mirror order and variables"
+  {
+    cat "$ROOT/default/pacman/pacman-$channel.conf"
+    printf '\n[archlinuxcn]\nServer = https://mirrors.ustc.edu.cn/archlinuxcn/$arch\n'
+  } > "$scratch/expected.conf"
+  cmp "$scratch/expected.conf" "$TARGET_ROOT/etc/pacman.conf"
+  apply "$channel"
+  cmp "$TARGET_ROOT/etc/pacman.conf.bak" "$TARGET_ROOT/etc/pacman.conf"
+  cmp "$TARGET_ROOT/etc/pacman.d/mirrorlist.bak" "$TARGET_ROOT/etc/pacman.d/mirrorlist"
+done
+pass "China puts its channel mirror first, keeps the global one as fallback, and is idempotent"
+
+cp "$TARGET_ROOT/etc/pacman.conf" "$scratch/before.conf"
+cp "$TARGET_ROOT/etc/pacman.d/mirrorlist" "$scratch/before.mirrors"
+for region in '' CN chn zz '../cn' '$(touch NEVER_EXECUTE)'; do
+  printf '%s\n' "$region" > "$TARGET_ROOT/etc/omarchy/region"
+  if apply stable > "$scratch/error" 2>&1; then
+    fail "invalid region accepted: $region"
+  fi
+  cmp "$scratch/before.conf" "$TARGET_ROOT/etc/pacman.conf"
+  cmp "$scratch/before.mirrors" "$TARGET_ROOT/etc/pacman.d/mirrorlist"
+done
+pass "unsupported and malformed regions fail before replacing either config"
+
+printf 'cn\n' > "$TARGET_ROOT/etc/omarchy/region"
+mkdir -p "$scratch/incomplete/default/regions/cn/pacman"
+cp -a "$ROOT/default/pacman" "$scratch/incomplete/default/"
+cp "$ROOT/default/regions/cn/pacman/pacman.conf.append" "$scratch/incomplete/default/regions/cn/pacman/"
+if OMARCHY_PATH="$scratch/incomplete" apply stable > "$scratch/error" 2>&1; then
+  fail "incomplete region profile accepted"
+fi
+cmp "$scratch/before.conf" "$TARGET_ROOT/etc/pacman.conf"
+cmp "$scratch/before.mirrors" "$TARGET_ROOT/etc/pacman.d/mirrorlist"
+pass "missing fragment cannot leave a half-generated config"
+
+# Refresh renders these files unprivileged and hands root plain copies; its
+# privileged path is covered in the sudo-boundary sandbox, never on the host.
+cp "$TARGET_ROOT/etc/pacman.conf" "$scratch/before.conf"
+mkdir -p "$scratch/rendered"
+"$ROOT/bin/omarchy-apply-pacman" --render rc "$scratch/rendered" "$TARGET_ROOT"
+rg -qxF 'Server = https://pkgs.omarchy.org/rc/$arch' "$scratch/rendered/pacman.conf"
+rg -qxF '[archlinuxcn]' "$scratch/rendered/pacman.conf"
+[[ $(<"$scratch/rendered/mirrorlist") == $'Server = https://rc-mirror.omarchy.cn/$repo/os/$arch\nServer = https://rc-mirror.omarchy.org/$repo/os/$arch' ]] ||
+  fail "render puts the regional channel mirror first"
+cmp "$scratch/before.conf" "$TARGET_ROOT/etc/pacman.conf"
+pass "render builds the regional channel files without touching the target"
+
+if "$ROOT/bin/omarchy-apply-pacman" --render dev "$scratch/rendered" "$TARGET_ROOT" > "$scratch/error" 2>&1; then
+  fail "render accepts a nonexistent dev pacman template"
+fi
+pass "render rejects channels without pacman templates"
+
+printf 'global\n' > "$TARGET_ROOT/etc/omarchy/region"
+apply stable
+cmp "$ROOT/default/pacman/pacman-stable.conf" "$TARGET_ROOT/etc/pacman.conf"
+cmp "$ROOT/default/pacman/mirrorlist-stable" "$TARGET_ROOT/etc/pacman.d/mirrorlist"
+pass "users can opt out of regional repository defaults"
+
+# The shipped China profile is repository defaults only. Language, locale, and
+# input methods follow the installer's language choice, not the region.
+python3 - <<'PY'
+import os
+from pathlib import Path
+
+region = Path(os.environ["ROOT"]) / "default/regions/cn"
+packages = {line.strip() for line in (region / "packages").read_text().splitlines() if line.strip() and not line.startswith("#")}
+assert packages == {"archlinuxcn-keyring"}, packages
+assert not (region / "skel").exists()
+PY
+pass "China profile adds only its repository keyring"
+
+# The installer derives the region from the chosen timezone, so every profile
+# needs a mapping, and no timezone may select two regions.
+python3 - <<'PY'
+import os
+from pathlib import Path
+
+zoneinfo = Path("/usr/share/zoneinfo")
+owners = {}
+for profile in sorted((Path(os.environ["ROOT"]) / "default/regions").iterdir()):
+    lines = (profile / "timezones").read_text().splitlines()
+    zones = [line.strip() for line in lines if line.strip() and not line.startswith("#")]
+    assert zones, f"{profile.name} maps no timezones"
+    for zone in zones:
+        assert zone not in owners, f"{zone} maps to {owners[zone]} and {profile.name}"
+        owners[zone] = profile.name
+        if zoneinfo.is_dir():
+            assert (zoneinfo / zone).is_file(), f"{profile.name} lists unknown timezone {zone}"
+
+# The installer offers tzdata's backward-compatible names too, so China
+# covers every name that links to its two zones and nothing else.
+# Without tzdata.zi (minimal containers) only the canonical zones can be
+# checked, so completeness is enforced where the host has the link table.
+china = {zone for zone, region in owners.items() if region == "cn"}
+expected = {"Asia/Shanghai", "Asia/Urumqi"}
+tzdata = zoneinfo / "tzdata.zi"
+if tzdata.is_file():
+    for line in tzdata.read_text().splitlines():
+        fields = line.split()
+        if len(fields) == 3 and fields[0] == "L" and fields[1] in {"Asia/Shanghai", "Asia/Urumqi"}:
+            expected.add(fields[2])
+    assert china == expected, (china, expected)
+else:
+    assert expected <= china, (china, expected)
+PY
+pass "region profiles map each timezone to at most one region"

test/shell.d/region-refresh-boundary-test.sh

@@ -0,0 +1,101 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+source "$SHELL_TEST_DIR/fixtures/sudo-boundary-test.sh"
+copy_boundary_file bin/omarchy-refresh-pacman
+copy_boundary_file bin/omarchy-apply-pacman
+for file in default/pacman/pacman-rc.conf default/pacman/mirrorlist-rc \
+  default/regions/cn/pacman/pacman.conf.append default/regions/cn/pacman/mirrorlist-rc.prepend; do
+  copy_boundary_file "$file"
+done
+
+# A sandboxed China machine: the render reads this region marker, never the
+# host's /etc/omarchy/region.
+mkdir -p "$SUDO_TEST_TARGET/etc/omarchy"
+printf 'cn\n' >"$SUDO_TEST_TARGET/etc/omarchy/region"
+
+# cp still logs its step, but now really copies, so the rendered files exist.
+# Root's copies into /etc land in a capture directory instead of the host.
+export SUDO_TEST_CAPTURE="$boundary_tmp/capture"
+rm "$SUDO_TEST_ROOT/bin/cp"
+cat >"$SUDO_TEST_ROOT/bin/cp" <<'STUB'
+#!/bin/bash
+set -euo pipefail
+printf 'step:cp %s\n' "$*" >>"$SUDO_TEST_LOG"
+destination=${!#}
+if [[ $destination == /etc/* ]]; then
+  source=${*: -2:1}
+  [[ $source == /etc/* ]] && exit 0
+  /usr/bin/mkdir -p "$SUDO_TEST_CAPTURE${destination%/*}"
+  exec /usr/bin/cp "$source" "$SUDO_TEST_CAPTURE$destination"
+fi
+exec /usr/bin/cp "$@"
+STUB
+chmod +x "$SUDO_TEST_ROOT/bin/cp"
+
+# Regional rendering must stay unprivileged: root only copies finished files,
+# exactly as the channel refresh did before regions existed.
+reset_boundary
+"$SUDO_TEST_ROOT/bin/omarchy-refresh-pacman" rc >"$boundary_tmp/output" 2>&1 || fail "refresh failed" "$(<"$boundary_tmp/output")"
+assert_boundary_cold "regional refresh"
+python3 - "$SUDO_TEST_LOG" "$SUDO_TEST_ROOT" <<'PY'
+import re
+import sys
+events = open(sys.argv[1]).read().splitlines()
+root = sys.argv[2]
+render = [i for i, e in enumerate(events) if e.startswith('step:cp ' + root + '/default/pacman/pacman-rc.conf ')]
+assert len(render) == 1, events
+rendered = events[render[0]].split()[-1].rsplit('/', 1)[0]
+copies = [i for i, e in enumerate(events) if e.startswith('sudo -N cp ')]
+assert [events[i] for i in copies[2:]] == [
+    f'sudo -N cp -f {rendered}/pacman.conf /etc/pacman.conf',
+    f'sudo -N cp -f {rendered}/mirrorlist /etc/pacman.d/mirrorlist',
+], events
+assert not any(e.startswith('sudo ') and 'omarchy-apply-pacman' in e for e in events), events
+assert render[0] < copies[0], events
+transaction = next(i for i, e in enumerate(events) if e.startswith('step:pacman '))
+assert max(copies) < transaction, events
+PY
+{
+  cat "$ROOT/default/pacman/pacman-rc.conf"
+  printf '\n'
+  cat "$ROOT/default/regions/cn/pacman/pacman.conf.append"
+} >"$boundary_tmp/expected-pacman.conf"
+cat "$ROOT/default/regions/cn/pacman/mirrorlist-rc.prepend" "$ROOT/default/pacman/mirrorlist-rc" >"$boundary_tmp/expected-mirrorlist"
+cmp -s "$boundary_tmp/expected-pacman.conf" "$SUDO_TEST_CAPTURE/etc/pacman.conf" ||
+  fail "root installs the rendered China pacman.conf" "$(diff "$boundary_tmp/expected-pacman.conf" "$SUDO_TEST_CAPTURE/etc/pacman.conf" 2>&1)"
+cmp -s "$boundary_tmp/expected-mirrorlist" "$SUDO_TEST_CAPTURE/etc/pacman.d/mirrorlist" ||
+  fail "root installs the rendered China mirrorlist" "$(diff "$boundary_tmp/expected-mirrorlist" "$SUDO_TEST_CAPTURE/etc/pacman.d/mirrorlist" 2>&1)"
+pass "refresh renders regional config unprivileged and gives root only plain copies"
+
+reset_boundary
+if "$SUDO_TEST_ROOT/bin/omarchy-refresh-pacman" dev >"$boundary_tmp/output" 2>&1; then
+  fail "refresh accepts an invalid channel"
+fi
+if grep -Eq '^(sudo -N cp |step:pacman )' "$SUDO_TEST_LOG"; then
+  fail "invalid channel reached privileged work" "$(<"$SUDO_TEST_LOG")"
+fi
+pass "failed refresh does not proceed to privileged copies or a package update"
+
+# A failed render still removes its scratch directory and exits cold.
+reset_boundary
+mv "$SUDO_TEST_ROOT/bin/omarchy-apply-pacman" "$boundary_tmp/omarchy-apply-pacman"
+cat >"$SUDO_TEST_ROOT/bin/omarchy-apply-pacman" <<'STUB'
+#!/bin/bash
+: >"$3/pacman.conf"
+exit 1
+STUB
+chmod +x "$SUDO_TEST_ROOT/bin/omarchy-apply-pacman"
+mkdir -p "$boundary_tmp/scratch"
+if TMPDIR="$boundary_tmp/scratch" "$SUDO_TEST_ROOT/bin/omarchy-refresh-pacman" rc >"$boundary_tmp/output" 2>&1; then
+  fail "refresh succeeds after a failed render"
+fi
+mv "$boundary_tmp/omarchy-apply-pacman" "$SUDO_TEST_ROOT/bin/omarchy-apply-pacman"
+[[ -z $(ls -A "$boundary_tmp/scratch") ]] || fail "failed render leaves its scratch directory" "$(ls -AR "$boundary_tmp/scratch")"
+if grep -Eq '^(sudo -N cp |step:pacman )' "$SUDO_TEST_LOG"; then
+  fail "failed render reached privileged work" "$(<"$SUDO_TEST_LOG")"
+fi
+assert_boundary_cold "failed render"
+pass "failed render removes its scratch directory and exits cold"

test/shell.d/region-test.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+test_tmp=$(mktemp -d)
+trap 'rm -rf "$test_tmp"' EXIT
+
+region_setup="$test_tmp/region.sh"
+root="$test_tmp/root"
+sed -e "s|/etc/|$root/etc/|g" -e "s| /\.cargo/| $root/.cargo/|g" "$ROOT/install/config/region.sh" >"$region_setup"
+export OMARCHY_PATH="$ROOT"
+mkdir -p "$root/etc/omarchy"
+
+bash -e "$region_setup"
+[[ -z $(find "$root" -type l) ]] || fail "no marker links nothing"
+pass "no marker installs Global"
+
+echo cn >"$root/etc/omarchy/region"
+bash -e "$region_setup"
+for link in "environment.conf etc/environment.d/90-omarchy-china.conf" "cargo.toml .cargo/config.toml" "gemrc etc/gemrc"; do
+  read -r source target <<<"$link"
+  [[ $(readlink "$root/$target") == "$ROOT/default/regions/cn/$source" ]] || fail "China links /$target to the shipped $source"
+done
+bash -e "$region_setup"
+pass "the cn marker links the developer mirror drop-ins, again without error"
+
+rm "$root/etc/gemrc"
+echo ":sources: []" >"$root/etc/gemrc"
+if output=$(bash -e "$region_setup" 2>&1); then
+  fail "China refuses to replace an admin's /etc/gemrc" "$output"
+fi
+[[ $output == "Refusing to replace $root/etc/gemrc, which Omarchy did not create" && $(<"$root/etc/gemrc") == ":sources: []" ]] ||
+  fail "China names the file it refuses to replace and leaves it" "$output"
+rm "$root/etc/gemrc"
+pass "region setup never replaces mirror config Omarchy did not create"
+
+echo mars >"$root/etc/omarchy/region"
+if output=$(bash -e "$region_setup" 2>&1); then
+  fail "an unknown region fails" "$output"
+fi
+[[ $output == "Unknown region: mars" ]] || fail "region setup names the unknown region" "$output"
+pass "region setup rejects an unknown region"
+
+grep -qx 'run_logged "$OMARCHY_INSTALL/config/region.sh"' "$ROOT/install/config/all.sh" || fail "the install runs region setup"
+pass "the install runs region setup"

test/shell.d/update-hook-security-test.sh

@@ -6,6 +6,7 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 source "$SHELL_TEST_DIR/fixtures/sudo-boundary-test.sh"
 copy_boundary_file bin/omarchy-update
 copy_boundary_file bin/omarchy-refresh-pacman
+copy_boundary_file bin/omarchy-apply-pacman
 # Replace the step symlink, preserving the real fixture dispatcher.
 rm "$SUDO_TEST_ROOT/bin/omarchy-update-aur-pkgs"
 copy_boundary_file bin/omarchy-update-aur-pkgs