Add Simplified Chinese as a system language

The installer asks for the language before the keyboard, and Setup > Language (omarchy language en|zh) switches it later. Under zh_CN the menu reads its labels from omarchy-menu.zh-cn.jsonc, the shell from I18nZh.js through I18n.tr, and notifications are worded by their sender through omarchy-text, which reads the same table. User text is never translated.
Fully revert USB and Thunderbolt device approval (#15091 )
2026-10-12 02:56:40 -04:00 · 2026-10-12 01:20:01 -04:00 · 2026-10-11 22:07:57 +02:00 · 2026-10-11 22:02:37 +02:00 · 2026-10-11 21:39:17 +02:00 · 2026-10-11 23:03:30 +09:00
434 changed files with 21417 additions and 3079 deletions
@@ -63,6 +63,30 @@ guidance does not drift from the router.
 - `$OMARCHY_PATH` is set at the top level by the uwsm session environment and is always available to Omarchy runtime code.
 - Commands in `bin/` and Quickshell QML should rely on `$OMARCHY_PATH` / `Quickshell.env("OMARCHY_PATH")`; do not derive fallback paths from `HOME`, `Quickshell.shellDir`, or re-export/default `OMARCHY_PATH` manually.

+# Platforms
+
+Omarchy runs on x86 and aarch64 (ARM). A platform name is the CPU architecture, then a hardware family only when that family needs handling of its own:
+
+- `x86` - every x86_64 machine
+- `aarch64` - every ARM machine without a family of its own (Snapdragon laptops, Raspberry Pis and ARM VMs today)
+- `aarch64-apple` - Apple Silicon Macs
+
+A new family is named `aarch64-<family>` (e.g. `aarch64-qualcomm`, `aarch64-n1x`) and is added only once it needs code of its own, so `aarch64*` always means ARM. `omarchy-hw-platform` prints the most specific name. Use these exact names wherever a platform is named: package lists, pacman template directories, image manifests, dispatch registration, tests and docs. Never introduce `generic`, `arm64`, `apple-silicon` or other spellings; the old `apple-silicon`, `generic-aarch64` and `generic` are read only for compatibility with older image builders.
+
+Ask a helper; don't read `uname -m` or the device tree in feature code:
+
+- `omarchy-hw-x86` / `omarchy-hw-aarch64` - the CPU architecture. Use them for binary and ABI availability: a package with no aarch64 build, an x86 guest VM, multilib.
+- `omarchy-hw-aarch64-apple` (and later `omarchy-hw-aarch64-<family>`) - built on `omarchy-hw-platform`, image-build aware. Use them for hardware behaviour. `omarchy-hw-apple-silicon` is a hidden alias kept for the omarchy-mac packages; don't use it in new code.
+
+Where platform code lives:
+
+- Packages: `install/omarchy-base.packages` for everyone, `install/omarchy-aarch64.packages` for every ARM machine, `install/omarchy-<platform>.packages` for one family, and base packages with no aarch64 build in `install/omarchy-x86_64-only.packages`. `omarchy-pkg-defaults` composes them.
+- Pacman templates: `default/pacman/` for x86, `default/pacman/<platform>/` for each ARM platform.
+- Hardware setup: `install/hardware/<vendor-or-family>/`, gated by a predicate. `install/hardware/apple/` holds Intel Mac quirks; Apple Silicon's own setup ships in the omarchy-mac packages.
+- Boot chains Omarchy can't drive generically: a platform package behind `omarchy-lifecycle-dispatch` ([`docs/lifecycle-dispatch.md`](docs/lifecycle-dispatch.md)). Platforms that boot Limine with UKIs like x86 keep the generic path.
+
+The experience should be the same on every platform. When a package or feature is missing or broken on one, the default is to get it fixed upstream (an aarch64 build, a bug report, a patch to the maintainer) and leave the gap visible meanwhile, not to paper over it. When asked for a platform workaround, say so and propose the upstream fix first. Hiding a menu entry or skipping a package is fine only for things that can't exist there (an x86 guest VM, an x86-only proprietary binary). Alternative packages and platform-only replacements are a last resort, used only when upstream can't or won't fix it, with the reason written next to the code.
+
 # Privileged Commands

 - Follow the "Privilege Escalation" section of `default/agents/skills/omarchy/SKILL.md`. It draws the
@@ -80,7 +104,7 @@ Use these instead of raw shell commands:

 - `omarchy-cmd-missing` / `omarchy-cmd-present` - check for commands
 - `omarchy-pkg-missing` / `omarchy-pkg-present` - check for packages (don't use these if you can just use `omarchy-pkg-add`/`omarchy-pkg-drop`)
- `omarchy-pkg-add` - install packages (handles both pacman and AUR)
+- `omarchy-pkg-add` - install packages from the configured pacman repos, Omarchy's included; use `omarchy-pkg-aur-add` for AUR packages
 - `omarchy-pkg-drop` - remove packages; use this instead of raw `pacman -R*`
 - `omarchy-notification-send` - send desktop notifications; do not call `notify-send` directly
 - `omarchy-hw-asus-rog` - detect ASUS ROG hardware (and similar `hw-*` commands)
@@ -89,6 +113,10 @@ Commands installed by Omarchy's default package set are runtime invariants. Invo

 Exceptions are allowed for migration and package-helper scripts where the helper may not be available yet, where the helper itself is being implemented, or where direct package-manager behavior is required.

+# Background Work
+
+- Long-running code (the shell, daemons, watchers) reacts to events instead of polling with a timer. Polling is the last resort, for state with no change signal; [`agents/skills/shell-dev.md`](agents/skills/shell-dev.md) lists the event sources and the push-refresh pattern.
+
 # Menu

 - The menu definition lives in `default/omarchy/omarchy-menu.jsonc`;
@@ -96,13 +124,9 @@ Exceptions are allowed for migration and package-helper scripts where the helper
 - Do not add `aliases` to new menu entries. Aliases are reserved for
  established alternate names users already type, kept for compatibility.

-# Region
+# Language

- `/etc/omarchy/region` holds `cn`; no file means Global. `omarchy-region` prints the region and switches it (`omarchy region cn|global`); the profile lives in `default/regions/cn/`, its contract in `docs/regions.md`, user-facing docs in `manual/52-china.md`.
- `install/config/region.sh` is the one system leaf for both the ISO install (the `/etc/omarchy/region` marker the installer derives from the timezone) and the runtime switch (`OMARCHY_REGION`): the region file and the profile drop-ins it symlinks. Input methods are not part of a region: the installer's keyboard choice and `omarchy-setup-input` own them (`docs/input-methods.md`).
- `omarchy-apply-pacman` renders pacman for every caller: the channel templates, the profile's `pacman/mirrorlist-<channel>.prepend` ahead of the mirrorlist, and its `pacman.conf.append`. Nothing in `omarchy update` or migrations may change the region or `/etc/locale.conf`.
- Language is separate from region: `omarchy-language en|zh` (Setup > Language) owns `LANG` in `/etc/locale.conf`, the installer sets it from its first screen, and nothing keyed by region touches it.
- China-only menu rows carry `"when":"[[ \"$(omarchy-region)\" == \"China\" ]]"` on every row, not only the submenu, because search checks each row's own guard.
+- `omarchy-language en|zh` (Setup > Language) owns `LANG` in `/etc/locale.conf`; the installer sets it from its first screen. Nothing in `omarchy update` or migrations may change `/etc/locale.conf`.
 - Chinese menu labels live in `default/omarchy/omarchy-menu.zh-cn.jsonc`, merged when `LANG` starts with `zh_CN`; give a new menu row with translatable words a label there.
 - Shell text goes through `I18n.tr("English %1", arg)` from `qs.Commons`, with its Chinese in `shell/Commons/I18nZh.js` keyed by the English. Notifications and OSD messages are worded by their sender with `omarchy-text "English %1" "$arg"` (Python: `text()`, QML: `I18n.tr`), which reads the same table; the shell shows them as given, so user text is never translated. `test/shell.d/shell-i18n-test.sh` fails on a missing entry.

@@ -71,7 +71,6 @@ The manual lives in [`manual/`](manual/), which is its authoritative source.
 - [Omarchy on...](manual/49-omarchy-on.md)
 - [Dual Boot Install](manual/50-dual-boot-install.md)
 - [Unattended Installs](manual/51-unattended-installs.md)
- [China](manual/52-china.md)

 ## License

@@ -12,6 +12,8 @@ commands and reusable setup leaves:
 - avoid `exit` in sourced setup scripts unless intentionally aborting setup.
 - use `$OMARCHY_INSTALL` and `$OMARCHY_PATH` instead of hard-coded Omarchy paths.
 - keep root-scoped hardware setup under `install/hardware/` and orchestrate it through `install/hardware/all.sh`.
+- in an image build every `run_logged` leaf in `install/hardware/all.sh` is queued and runs on the machine's first boot instead (`bin/omarchy-provision-hardware`, see `docs/file-layout.md`), possibly offline, using packages already in the image, and before any user exists; keep those leaves idempotent and put nothing but `run_logged` lines in `all.sh`.
+- gate platform-specific setup on a predicate built on `omarchy-hw-platform` (`omarchy-hw-aarch64-apple`), not on `uname -m`; architecture checks (`omarchy-hw-x86`, `omarchy-hw-aarch64`) are only for ABI, binary availability or a repository's `$arch`. Platform names and where platform code lives are in the Platforms section of `AGENTS.md`.
 - keep every per-user setup leaf under `install/user/` (including `install/user/hardware/` and `install/user/first-run/`) so it is clear what must run for each user.
 - The base install supplies matching kernel headers before hardware setup. DKMS installers should install their driver packages and assume the headers exist.
 - prefer helper commands for package and command checks where available.
@@ -42,6 +42,17 @@ Wrap every user-visible string in `I18n.tr()` (`import qs.Commons`) and add its
  bar widgets register one target each — `omarchy.indicators`,
  `omarchy.system-update`, `omarchy.clock`. There is no `bar` target.

+## Keeping state current without polling
+
+The shell runs all day on battery, and a widget is built once per monitor, so a `Timer` that starts a `Process` costs that process times the number of monitors, every tick, forever. Don't poll for state that only changes through known events. Pick the first of these that fits:
+
+- A native Quickshell service that signals on change: `UPower` and `PowerProfiles` (`Quickshell.Services.UPower`), `Hyprland` and each workspace's `lastIpcObject`, `Pipewire`, `Mpris`, `SystemTray`, `Notifications`.
+- An event stream the shell already runs, such as the Hyprland IPC events or the long-running `pactl subscribe` in `Commons/UntypedInput.qml`. Extend it rather than starting a second one.
+- A file watch: `FileView` with `watchChanges`, or the directory watch in `plugins/bar/Bar.qml`, when the state lives in a file the user can read.
+- A push from the command that changes the state. If only Omarchy commands change it, have them call `omarchy-shell -q <target> refresh` after the change, the way `omarchy-reminder` and `omarchy-sudo-passwordless` do. When the change happens later, without a command running (an expiry, say), schedule the refresh with a transient `systemd-run --user --on-active=…` timer. A root-owned timer cannot reach the user's shell.
+
+Polling is the last resort, kept for state with no change signal at all (a remote API, say). Then gate the timer on the panel being open where you can, pick the longest interval the UI can tolerate, and put the poll in one shared service rather than in a per-monitor widget. Never poll a privileged probe: every `sudo -n` can write to the auth log.
+
 ## Editing widget files with glyphs

 Widget files in `shell/plugins/bar/widgets/` contain Nerd Font glyphs as raw
@@ -2,6 +2,7 @@
 Version=1.0
 Name=Basecamp
 Exec=omarchy-launch-webapp https://launchpad.37signals.com
+StartupWMClass=chrome-launchpad.37signals.com__-Default
 Terminal=false
 Type=Application
 Icon=basecamp
@@ -2,6 +2,7 @@
 Version=1.0
 Name=Discord
 Exec=omarchy-launch-webapp https://discord.com/channels/@me
+StartupWMClass=chrome-discord.com__channels_@me-Default
 Terminal=false
 Type=Application
 Icon=omarchy-discord
@@ -2,6 +2,7 @@
 Version=1.0
 Name=Google Contacts
 Exec=omarchy-launch-webapp https://contacts.google.com/
+StartupWMClass=chrome-contacts.google.com__-Default
 Terminal=false
 Type=Application
 Icon=google-contacts
@@ -2,6 +2,7 @@
 Version=1.0
 Name=Google Maps
 Exec=omarchy-launch-webapp https://maps.google.com
+StartupWMClass=chrome-maps.google.com__-Default
 Terminal=false
 Type=Application
 Icon=google-maps
@@ -2,6 +2,7 @@
 Version=1.0
 Name=Google Messages
 Exec=omarchy-launch-webapp https://messages.google.com/web/conversations
+StartupWMClass=chrome-messages.google.com__web_conversations-Default
 Terminal=false
 Type=Application
 Icon=google-messages
@@ -2,6 +2,7 @@
 Version=1.0
 Name=Google Photos
 Exec=omarchy-launch-webapp https://photos.google.com/
+StartupWMClass=chrome-photos.google.com__-Default
 Terminal=false
 Type=Application
 Icon=google-photos
@@ -2,6 +2,7 @@
 Version=1.0
 Name=WhatsApp
 Exec=omarchy-launch-webapp https://web.whatsapp.com/
+StartupWMClass=chrome-web.whatsapp.com__-Default
 Terminal=false
 Type=Application
 Icon=whatsapp
@@ -2,6 +2,7 @@
 Version=1.0
 Name=X
 Exec=omarchy-launch-webapp https://x.com/
+StartupWMClass=chrome-x.com__-Default
 Terminal=false
 Type=Application
 Icon=x
@@ -2,6 +2,7 @@
 Version=1.0
 Name=YouTube
 Exec=omarchy-launch-webapp https://youtube.com/
+StartupWMClass=chrome-youtube.com__-Default
 Terminal=false
 Type=Application
 Icon=youtube
@@ -75,7 +75,6 @@ GROUP_DESCRIPTIONS[plymouth]="Plymouth boot theme management"
 GROUP_DESCRIPTIONS[power]="Power supply detection"
 GROUP_DESCRIPTIONS[powerprofiles]="Power profile management"
 GROUP_DESCRIPTIONS[refresh]="Reset config to defaults"
-GROUP_DESCRIPTIONS[region]="Region-specific package sources and setup"
 GROUP_DESCRIPTIONS[reinstall]="Reinstall and reset workflows"
 GROUP_DESCRIPTIONS[reminder]="Desktop notification reminders"
 GROUP_DESCRIPTIONS[remove]="Removal workflows"
@@ -19,6 +19,9 @@ for diagnostics or after hardware/package updates.

 --defer-provisioning runs without an install user (deferred-provisioning installs create the user at
 first boot); group grants are recorded in /var/lib/omarchy/provisioning/groups.
+
+In an image build (/var/lib/omarchy/image/target exists) nothing runs here: every step is queued
+for omarchy-provision-hardware on the machine's first boot.
 USAGE
 }

@@ -66,10 +69,21 @@ else
 fi

 export OMARCHY_INSTALL_USER="$install_user"
+# Only omarchy-provision-hardware runs steps as an image's first boot.
+unset OMARCHY_IMAGE_DEFERRED_HARDWARE
 export OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
 export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$OMARCHY_PATH/install}"
 export OMARCHY_INSTALL_LOG_FILE="${OMARCHY_INSTALL_LOG_FILE:-/var/log/omarchy-install.log}"
 export PATH="$OMARCHY_PATH/bin:$PATH"

 source "$OMARCHY_INSTALL/helpers/logging.sh"
-source "$OMARCHY_INSTALL/hardware/all.sh"
+source "$OMARCHY_INSTALL/helpers/image-target.sh"
+
+omarchy_image_init
+omarchy_image_lock
+if omarchy_image_manifest_present; then
+  omarchy_image_read_manifest
+  omarchy_image_defer_hardware
+else
+  source "$OMARCHY_INSTALL/hardware/all.sh"
+fi
@@ -1,77 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Restore channel and regional pacman defaults in an installed target
-# omarchy:args=<stable|rc|edge> [target-root] | --render <stable|rc|edge> <output-dir> [target-root]
-# omarchy:requires-sudo=true
-# omarchy:hidden=true
-
-set -euo pipefail
-
-usage() {
-  echo "Usage: omarchy-apply-pacman <stable|rc|edge> [target-root]" >&2
-  echo "       omarchy-apply-pacman --render <stable|rc|edge> <output-dir> [target-root]" >&2
-  exit 1
-}
-
-# --render only builds the two files, so an unprivileged caller can hand root
-# nothing but plain copies of the finished result.
-render_dir=""
-if [[ ${1:-} == "--render" ]]; then
-  (( $# == 3 || $# == 4 )) || usage
-  channel="$2"
-  render_dir="$3"
-  [[ -d $render_dir ]] || { echo "Render directory not found: $render_dir" >&2; exit 1; }
-  etc="${4:-/}/etc"
-else
-  (( $# >= 1 && $# <= 2 )) || usage
-  channel="$1"
-  etc="${2:-/}/etc"
-fi
-
-case "$channel" in
-  stable|rc|edge) ;;
-  *) echo "Invalid pacman channel: $channel" >&2; exit 1 ;;
-esac
-
-# The ISO writes this plain-text marker before target finalization. Missing
-# markers keep existing installations global; never source it as shell code.
-region=global
-if [[ -e $etc/omarchy/region ]]; then
-  region=$(<"$etc/omarchy/region")
-fi
-case "$region" in
-  global|cn) ;;
-  *) echo "Unsupported region: $region (expected global or cn)" >&2; exit 1 ;;
-esac
-
-# Build both files before replacing either. Explicit refreshes retain backups;
-# ordinary updates do not call this command or enforce regional defaults.
-if [[ -n $render_dir ]]; then
-  staging="$render_dir"
-else
-  staging=$(mktemp -d)
-  trap 'rm -rf "$staging"' EXIT
-fi
-cp "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" "$staging/pacman.conf"
-if [[ $region == "global" ]]; then
-  cp "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" "$staging/mirrorlist"
-else
-  profile="$OMARCHY_PATH/default/regions/$region/pacman"
-  printf '\n' >> "$staging/pacman.conf"
-  cat "$profile/pacman.conf.append" >> "$staging/pacman.conf"
-  # pacman tries servers in order, so the regional mirror leads and the
-  # channel's own mirror stays as the fallback.
-  cat "$profile/mirrorlist-$channel.prepend" "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" > "$staging/mirrorlist"
-fi
-
-if [[ -z $render_dir ]]; then
-  mkdir -p "$etc/pacman.d"
-  for file in pacman.conf pacman.d/mirrorlist; do
-    if [[ -e $etc/$file ]]; then
-      cp -f "$etc/$file" "$etc/$file.bak"
-    fi
-  done
-  # Copying over an existing file keeps its owner and mode, as refresh always has.
-  cp -f "$staging/pacman.conf" "$etc/pacman.conf"
-  cp -f "$staging/mirrorlist" "$etc/pacman.d/mirrorlist"
-fi
@@ -15,6 +15,14 @@ fi
 wpctl set-default "$node_id" 2>/dev/null || true
 pactl set-default-source "$source_name" 2>/dev/null || true

-pactl list short source-outputs 2>/dev/null | awk '{ print $1 }' | while read -r output; do
+# A filter's own capture (the input half of a filter chain, loopback or echo
+# canceller, which PipeWire joins to its output by node.link-group) is the
+# processing, not an app: moving it would feed the filter from the new input, or
+# from its own output. pactl translates the listing, so it is read in the C
+# locale.
+LC_ALL=C pactl list source-outputs 2>/dev/null | awk '
+  /^Source Output #/ { if (id != "" && !filter) print id; id = substr($3, 2); filter = 0 }
+  /^[[:space:]]*node\.link-group = / { filter = 1 }
+  END { if (id != "" && !filter) print id }' | while read -r output; do
  [[ -n $output ]] && pactl move-source-output "$output" "$source_name" 2>/dev/null || true
 done
@@ -1,14 +1,27 @@
 #!/bin/bash

-# omarchy:summary=Print PulseAudio sink availability for the shell
+# omarchy:summary=Print PulseAudio sink or source availability for the shell
 # omarchy:group=audio
+# omarchy:args=[sources]
+
+# With "sources", print source availability instead: a jack input such as a
+# headset microphone reports its port unavailable while nothing is plugged in.
+# pactl translates the listing ("not available" too), so it is read in the C
+# locale.
+kind=sinks
+header="Sink #"
+if [[ ${1:-} == "sources" ]]; then
+  kind=sources
+  header="Source #"
+fi

 # A speaker tuning is a virtual sink in front of the real speakers. Both exist
 # in the graph, but selecting the physical one would only bypass the tuning, so
 # report it unavailable and keep it out of the output list.
-fronted="$(omarchy-audio-tuning fronted-sink 2>/dev/null || true)"
+fronted=""
+[[ $kind == sinks ]] && fronted="$(omarchy-audio-tuning fronted-sink 2>/dev/null || true)"

-pactl list sinks 2>/dev/null | awk -v fronted="$fronted" '
+LC_ALL=C pactl list "$kind" 2>/dev/null | awk -v fronted="$fronted" -v header="$header" '
  function emit_sink() {
    if (name == "") return
    if (fronted != "" && name == fronted) {
@@ -18,7 +31,7 @@ pactl list sinks 2>/dev/null | awk -v fronted="$fronted" '
    print name "\t" ((port_count == 0 || available) ? 1 : 0)
  }

-  /^Sink #/ {
+  index($0, header) == 1 {
    emit_sink()
    name = ""
    in_ports = 0
@@ -2,7 +2,7 @@

 # omarchy:summary=Configure the bar and its widget layout
 # omarchy:group=bar
-# omarchy:args=use <id> | reset | defaults | position <top|bottom|left|right> | transparent <true|false|toggle> | put <id> [placement] | move <id> [placement] | set <id> <key> <value> [--json] [placement]
+# omarchy:args=use <id> | reset | defaults | position [top|bottom|left|right] | background [opaque|glassy|none|cycle] | put <id> [placement] | move <id> [placement] | set <id> <key> <value> [--json] [placement] | get <id> <key>
 # omarchy:examples=omarchy bar use local.neon-bar | omarchy bar put omarchy.keyboard-layout --after omarchy.clock | omarchy bar move omarchy.clock --section center --index 0 | omarchy bar set omarchy.clock format HH:mm

 set -euo pipefail
@@ -16,13 +16,19 @@ Usage: omarchy bar <command> [args...]
  use <id>                             Use a bar option as the active bar
  reset                                Return to the built-in Omarchy bar
  defaults                             Restore the default bar and service widgets
-  position <top|bottom|left|right>     Bar position
-  transparent <true|false|toggle>      Bar transparency
+  position [top|bottom|left|right]     Bar position; prints the current one
+                                       when given none
+  background [opaque|glassy|none|cycle]
+                                       Bar background: glassy shows what is
+                                       behind the bar blurred, cycle steps
+                                       none, glassy, opaque; prints the
+                                       current one when given none
  put <id> [placement]                 Put a widget on the bar, leaving one
                                       that is already there where it is
  move <id> [placement]                Move a widget within or between sections
  set <id> <key> <value> [--json] [placement]
                                       Set a per-widget option
+  get <id> <key>                       Print a per-widget option

 Placement:
  --section <left|center|right>        Target section
@@ -192,30 +198,92 @@ cmd_defaults() {
  " \
    --slurpfile defaults "$DEFAULTS_FILE" \
    --argjson widgets "$optional_widgets"
+  sync_glass || fail "could not change the blur behind the bar"
  echo "Restored the default Omarchy bar"
 }

 cmd_position() {
-  local position="${1:-}"
-  [[ -n $position ]] || fail "position is required"
+  if (( $# == 0 )); then
+    jq -r '.bar.position // "top"' "$(source_file)"
+    return
+  fi
+
+  local position="$1"
  (( $# == 1 )) || fail "position takes a single value"
  [[ $position =~ ^(top|bottom|left|right)$ ]] || fail "position must be top, bottom, left, or right"
  commit "$NORMALIZE | .bar.position = \$position" --arg position "$position"
  echo "Bar position set to $position"
 }

+# The bar background is opaque, glassy, or none. A shell.json from before it
+# had one says transparent instead, which is none, and setting a background
+# drops it.
+current_background() {
+  jq -r '.bar.background // (if .bar.transparent == true then "none" else "opaque" end)' "$(source_file)"
+}
+
+cmd_background() {
+  if (( $# == 0 )); then
+    current_background
+    return
+  fi
+
+  local background="$1"
+  (( $# == 1 )) || fail "background takes a single value"
+  [[ $background =~ ^(opaque|glassy|none|cycle)$ ]] || fail "background must be opaque, glassy, none, or cycle"
+
+  if [[ $background == "cycle" ]]; then
+    # Each step changes the bar by one degree: clear, then glassy, then opaque.
+    case $(current_background) in
+      none) background="glassy" ;;
+      glassy) background="opaque" ;;
+      *) background="none" ;;
+    esac
+  fi
+
+  local previous
+  previous=$(current_background)
+  commit "$NORMALIZE | .bar.background = \$background | del(.bar.transparent)" --arg background "$background"
+  if ! sync_glass; then
+    commit "$NORMALIZE | .bar.background = \$background | del(.bar.transparent)" --arg background "$previous"
+    fail "could not change the blur behind the bar"
+  fi
+  echo "Bar background set to $background"
+}
+
+# The older on/off form of the background, kept for scripts and dotfiles:
+# transparent is none, and not transparent is opaque.
 cmd_transparent() {
  local transparent="${1:-}"
  [[ -n $transparent ]] || fail "transparent is required"
  (( $# == 1 )) || fail "transparent takes a single value"
  [[ $transparent =~ ^(true|false|toggle)$ ]] || fail "transparent must be true, false, or toggle"
  if [[ $transparent == "toggle" ]]; then
-    commit "$NORMALIZE | .bar.transparent = (.bar.transparent != true)"
-    echo "Bar transparency toggled"
-  else
-    commit "$NORMALIZE | .bar.transparent = \$transparent" --argjson transparent "$transparent"
-    echo "Bar transparency set to $transparent"
+    [[ $(current_background) == "none" ]] && transparent="false" || transparent="true"
  fi
+  if [[ $transparent == "true" ]]; then
+    cmd_background none
+  else
+    cmd_background opaque
+  fi
+}
+
+# Hyprland blurs behind the bar only while the bar-glassy toggle is on, so it
+# follows the bar background, reloading Hyprland only when it changes. The
+# toggle sits where Hyprland reads it, under XDG_STATE_HOME.
+sync_glass() {
+  local dir="${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/toggles/hypr"
+  local flag="$dir/bar-glassy.lua"
+
+  if [[ $(current_background) == "glassy" ]]; then
+    [[ ! -f $flag ]] || return 0
+    mkdir -p "$dir" && cp "$OMARCHY_PATH/default/hypr/toggles/bar-glassy.lua" "$flag" || return 1
+  else
+    [[ -f $flag ]] || return 0
+    rm -f "$flag" || return 1
+  fi
+
+  hyprctl reload >/dev/null 2>&1 || true
 }

 bar_widget_default_section() {
@@ -363,6 +431,21 @@ cmd_set() {
  echo "Set $key on $id"
 }

+# Prints the option from the first instance of the widget on the bar, raw for a
+# string and as JSON otherwise, and fails when no instance sets it.
+cmd_get() {
+  local id="${1:-}"
+  local key="${2:-}"
+  [[ -n $id ]] || fail "get requires a widget id"
+  [[ -n $key ]] || fail "get requires a setting key"
+  (( $# == 2 )) || fail "get takes a widget id and a setting key"
+
+  jq -e -r --arg id "$id" --arg key "$key" '
+    first(.bar.layout[]?[]? | select(.id == $id) | .[$key] | select(. != null))
+    | if type == "string" then . else tojson end
+  ' "$(source_file)" 2>/dev/null || exit 1
+}
+
 # --------------------------------------------------------------------- dispatch

 command="${1:-}"
@@ -385,6 +468,14 @@ case "$command" in
  transparent)
    cmd_transparent "$@"
    ;;
+  background)
+    cmd_background "$@"
+    ;;
+  # Internal: the shell runs this when it loads a bar background, so one set
+  # by editing shell.json gets its blur too.
+  sync-glass)
+    sync_glass || fail "could not change the blur behind the bar"
+    ;;
  put)
    cmd_put "$@"
    ;;
@@ -394,6 +485,9 @@ case "$command" in
  set)
    cmd_set "$@"
    ;;
+  get)
+    cmd_get "$@"
+    ;;
  -h | --help | help | "")
    usage
    ;;
@@ -2,10 +2,16 @@

 # omarchy:summary=Returns true if a battery is present on the system.

-for bat in /sys/class/power_supply/BAT*; do
-  [[ -r $bat/present ]] &&
-  [[ $(cat $bat/present) == "1" ]] &&
-  [[ $(cat $bat/type) == "Battery" ]] &&
+# Not every battery is called BAT*: Apple Silicon reports macsmc-battery and
+# some Framework and Chromebook firmware CMB0, so decide by type, not by name.
+power_supply_path="${OMARCHY_POWER_SUPPLY_PATH:-/sys/class/power_supply}"
+
+for bat in "$power_supply_path"/*; do
+  [[ -r $bat/present && $(<"$bat/present") == "1" ]] || continue
+  [[ -r $bat/type && $(<"$bat/type") == "Battery" ]] || continue
+  # A wireless mouse or keyboard registers a Battery too, scoped Device. The
+  # one that powers the machine is scoped System, or unscoped on older drivers.
+  [[ -r $bat/scope && $(<"$bat/scope") == "Device" ]] && continue
  exit 0
 done

@@ -18,11 +18,23 @@ case "${1:-}" in
    ;;
 esac

-battery=$(upower -e 2>/dev/null | grep BAT | head -n 1)
+# UPower names the device after the sysfs entry, and only some kernels call
+# that BAT*: Apple Silicon reports battery_macsmc_battery. Match on the class,
+# then take the first one that powers the machine: a wireless mouse or keyboard
+# is a battery_ device too, and UPower marks it "power supply: no".
+battery=""
+battery_info=""
+while read -r candidate; do
+  [[ -n $candidate ]] || continue
+  candidate_info=$(upower -i "$candidate" 2>/dev/null) || continue
+  if grep -qE '^\s*power supply:\s+yes' <<<"$candidate_info"; then
+    battery=$candidate
+    battery_info=$candidate_info
+    break
+  fi
+done < <(upower -e 2>/dev/null | grep '/battery_')
 [[ -z $battery ]] && exit 0

-battery_info=$(upower -i "$battery")
-
 percentage=$(awk '/percentage/ { print int($2); exit }' <<<"$battery_info")
 capacity=$(awk '/energy-full:/ { printf "%d", $2; exit }' <<<"$battery_info")
 time_remaining=$(awk '/time to (empty|full)/ {
@@ -56,7 +68,10 @@ elif [[ -r $battery_path/current_now && -r $battery_path/voltage_now ]]; then
    'BEGIN { print microamps * microvolts / 1000000000000 }')
 fi

+# Some kernels sign power_now by direction (negative while discharging on
+# Apple Silicon); the state field already says which way it flows.
 power_rate=$(awk -v rate="${power_rate_raw:-0}" 'BEGIN {
+  if (rate < 0) rate = -rate
  rounded = sprintf("%.1f", rate)
  sub(/\.0$/, "", rounded)
  print rounded
@@ -65,8 +80,12 @@ state=$(awk '/state/ { print $2; exit }' <<<"$battery_info")
 threshold_start=$(awk '/charge-start-threshold:/ { gsub(/%/, "", $2); print int($2); exit }' <<<"$battery_info")
 threshold_end=$(awk '/charge-end-threshold:/ { gsub(/%/, "", $2); print int($2); exit }' <<<"$battery_info")

-[[ -z $threshold_end ]] && threshold_end=$(cat "$power_supply_path"/BAT*/charge_control_end_threshold 2>/dev/null | head -1)
-[[ -z $threshold_start ]] && threshold_start=$(cat "$power_supply_path"/BAT*/charge_control_start_threshold 2>/dev/null | head -1)
+# Read the thresholds from the battery UPower resolved rather than a BAT* glob,
+# which misses every battery with another name.
+[[ -n $threshold_end || ! -r $battery_path/charge_control_end_threshold ]] || threshold_end=$(<"$battery_path/charge_control_end_threshold")
+[[ -n $threshold_start || ! -r $battery_path/charge_control_start_threshold ]] || threshold_start=$(<"$battery_path/charge_control_start_threshold")
+[[ -n $threshold_end ]] || threshold_end=$(cat "$power_supply_path"/BAT*/charge_control_end_threshold 2>/dev/null | head -1)
+[[ -n $threshold_start ]] || threshold_start=$(cat "$power_supply_path"/BAT*/charge_control_start_threshold 2>/dev/null | head -1)

 ac_online=false
 for supply in "$power_supply_path"/*; do
@@ -107,7 +126,9 @@ if [[ $shell_output == "true" ]]; then
  printf 'size\t%s\n' "${capacity}Wh"
  printf 'time\t%s\n' "$time_remaining"

-  cycles=$(cat "$power_supply_path"/BAT*/cycle_count 2>/dev/null | head -1)
+  cycles=""
+  [[ ! -r $battery_path/cycle_count ]] || cycles=$(<"$battery_path/cycle_count")
+  [[ -n $cycles ]] || cycles=$(cat "$power_supply_path"/BAT*/cycle_count 2>/dev/null | head -1)

  [[ -n $cycles ]] && printf 'cycles\t%s\n' "$cycles"

@@ -40,7 +40,30 @@ use_apple_display() {
 }

 use_ddc_display() {
-  [[ -n $monitor ]] && ! monitor_is_internal
+  [[ -n $monitor ]] && ! monitor_is_internal && monitor_may_have_ddc
+}
+
+# A platform whose display driver registers no DDC channel says so in its
+# displays.conf (see docs/file-layout.md): there a probe finds only unrelated
+# I2C buses, slowly, so only a connector with a ddc node is probed. Everywhere
+# else every external monitor is.
+monitor_may_have_ddc() {
+  local displays_conf=/usr/share/omarchy-platform/displays.conf directive argument
+  [[ -r $displays_conf ]] || return 0
+
+  while IFS=$' \t\r' read -r directive argument || [[ -n $directive ]]; do
+    if [[ $directive == "ddc-require-connector-ddc" && -z $argument ]]; then
+      compgen -G "/sys/class/drm/card*-$monitor/ddc" >/dev/null
+      return
+    fi
+  done <"$displays_conf"
+  return 0
+}
+
+# The kernel backlight is the built-in panel's, so an external monitor without
+# DDC fails rather than dimming the panel.
+use_backlight_display() {
+  [[ -z $monitor ]] || monitor_is_internal
 }

 if (( $# == 0 )); then
@@ -50,6 +73,8 @@ if (( $# == 0 )); then
  elif use_ddc_display; then
    omarchy-brightness-display-ddc "$monitor"
    exit
+  elif ! use_backlight_display; then
+    exit 1
  fi

  device="$(omarchy-hw-display)" || exit 1
@@ -85,6 +110,8 @@ if use_apple_display; then
 elif use_ddc_display; then
  brightness="$(omarchy-brightness-display-ddc "$monitor" "$step")" || exit 1
  (( no_osd )) || omarchy-osd -i brightness -p "$brightness"
+elif ! use_backlight_display; then
+  exit 1
 else
  # Current device highlighted
  device="$(omarchy-hw-display)" || exit 1
@@ -2,7 +2,7 @@

 # omarchy:summary=Start or stop screen recording
 # omarchy:group=capture
-# omarchy:args=[--fullscreen] [--with-desktop-audio] [--with-microphone-audio] [--with-webcam] [--webcam-device=<device>] [--webcam-size=<small|medium|large>] [--resolution=<size>] [--stop-recording]
+# omarchy:args=[--fullscreen] [--with-desktop-audio] [--with-microphone-audio] [--with-webcam] [--webcam-device=<device>] [--webcam-size=<small|medium|large>] [--resolution=<size>] [--stop-recording] [--status]
 # omarchy:examples=omarchy screenrecord | omarchy capture screenrecording --with-desktop-audio
 # omarchy:aliases=omarchy screenrecord
 #
@@ -14,19 +14,20 @@
 # DMA-BUF modifier import on some configurations, leaving recording unable to
 # start.
 #
-# Env: OMARCHY_SCREENRECORD_DEBUG=true appends gpu-screen-recorder's stderr (and
-# the picker target it was launched with) to
-# $XDG_RUNTIME_DIR/omarchy-screenrecord.log so users can attach a log when
-# reporting capture failures.
+# Env: OMARCHY_SCREENRECORD_DEBUG=true appends the recorder's stderr (and the
+# picker target it was launched with) to $XDG_RUNTIME_DIR/omarchy-screenrecord.log
+# so users can attach a log when reporting capture failures.
+#
+# Backend: gpu-screen-recorder. Where it is not installed, or it exits before
+# the recording starts (it knows only NVIDIA, AMD, Intel and Broadcom GPUs, and
+# aborts on others such as Apple Silicon's), wf-recorder records instead when
+# it is installed. wf-recorder encodes on the CPU and captures one audio
+# device, so desktop and microphone audio together go through a temporary null
+# sink. Portal capture and --resolution are gpu-screen-recorder only.

 [[ -f ~/.config/user-dirs.dirs ]] && source ~/.config/user-dirs.dirs
 OUTPUT_DIR="${OMARCHY_SCREENRECORD_DIR:-${XDG_VIDEOS_DIR:-$HOME/Videos}}"

-if [[ ! -d $OUTPUT_DIR ]]; then
-  omarchy-notification-send -u critical -t 3000 "$(omarchy-text "Screen recording directory does not exist: %1" "$OUTPUT_DIR")"
-  exit 1
-fi
-
 DESKTOP_AUDIO="false"
 MICROPHONE_AUDIO="false"
 WEBCAM="false"
@@ -35,6 +36,7 @@ WEBCAM_SIZE="medium"
 RESOLUTION=""
 FULLSCREEN="false"
 STOP_RECORDING="false"
+STATUS="false"
 # Both of these live in the per-user runtime directory, which is 0700. What
 # RECORDING_FILE holds is read back on stop and used as a path -- ffmpeg writes
 # beside it, `mv` replaces it, and `rm -f` deletes its preview -- so a name in
@@ -46,6 +48,17 @@ STOP_RECORDING="false"
 RUNTIME_DIR="${XDG_RUNTIME_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/omarchy}"
 RECORDING_FILE="$RUNTIME_DIR/omarchy-screenrecord-filename"
 REGION_FILE="$RUNTIME_DIR/omarchy-screenrecord-region"
+# The recorder's pid, so stop and status act on that process alone.
+REC_PID_FILE="$RUNTIME_DIR/omarchy-screenrecord-pid"
+# The PulseAudio module ids of a combined-audio null sink, for cleanup.
+PA_MODULES_FILE="$RUNTIME_DIR/omarchy-screenrecord-pa-modules"
+# Present while a start holds the lock; another toggle or stop then leaves
+# CANCEL_FILE for that start instead of queueing behind its picker or recorder.
+STARTING_FILE="$RUNTIME_DIR/omarchy-screenrecord-starting"
+CANCEL_FILE="$RUNTIME_DIR/omarchy-screenrecord-cancel"
+# How long a recorder may take to create its file, except through the portal,
+# whose picker waits on the user.
+READY_TIMEOUT_TICKS=75
 LOG_FILE=$([[ ${OMARCHY_SCREENRECORD_DEBUG:-false} == "true" ]] && echo "$RUNTIME_DIR/omarchy-screenrecord.log" || echo "/dev/null")

 for arg in "$@"; do
@@ -58,6 +71,7 @@ for arg in "$@"; do
  --resolution=*) RESOLUTION="${arg#*=}" ;;
  --fullscreen) FULLSCREEN="true" ;;
  --stop-recording) STOP_RECORDING="true" ;;
+  --status) STATUS="true" ;;
  esac
 done

@@ -69,6 +83,13 @@ small | medium | large) ;;
  ;;
 esac

+# --status only answers whether our recording runs, for the bar and the menu, so
+# it needs no recordings directory and never notifies.
+if [[ $STATUS != "true" && ! -d $OUTPUT_DIR ]]; then
+  omarchy-notification-send -u critical -t 3000 "$(omarchy-text "Screen recording directory does not exist: %1" "$OUTPUT_DIR")"
+  exit 1
+fi
+
 start_webcam_overlay() {
  cleanup_webcam

@@ -99,7 +120,7 @@ start_webcam_overlay() {
    '--vf=lavfi=[crop=ih*8/9:ih]' \
    --title="WebcamOverlay" --wayland-app-id="WebcamOverlay-$WEBCAM_SIZE" \
    --no-border --no-audio --no-osc --osd-level=0 \
-    --really-quiet &>/dev/null &
+    --really-quiet 9>&- &>/dev/null &

  # The move has to settle before gpu-screen-recorder starts, or the camera is
  # recorded sliding into its corner. Waiting for the map is what the blind
@@ -153,12 +174,134 @@ select_capture_target() {
  echo "region:${BASH_REMATCH[3]}x${BASH_REMATCH[4]}+${BASH_REMATCH[1]}+${BASH_REMATCH[2]}"
 }

-start_screenrecording() {
-  mkdir -p "$RUNTIME_DIR" || return 1
-  # XDG_STATE_HOME may be outside a private home; protect existing fallbacks too.
-  if [[ -z ${XDG_RUNTIME_DIR:-} ]]; then
-    chmod 700 "$RUNTIME_DIR" || return 1
+# gpu-screen-recorder first, then wf-recorder, of those installed. The base
+# packages carry gpu-screen-recorder, but an architecture may build none.
+recorder_backends() {
+  local backend found=false
+
+  for backend in gpu-screen-recorder wf-recorder; do
+    if omarchy-cmd-present "$backend"; then
+      echo "$backend"
+      found=true
+    fi
+  done
+
+  # Neither installed: fail the way a missing gpu-screen-recorder always has.
+  $found || echo gpu-screen-recorder
+}
+
+# wf-recorder records a single audio device. Map the desktop/mic flags onto one:
+# desktop -> default sink monitor, mic -> default source. When both are requested,
+# route them through a throwaway null sink so a single track carries both; the
+# module ids are saved to PA_MODULES_FILE so stop can unload them. A requested
+# source that can't be recorded is left out with a notification naming it, and
+# the recording carries whichever source remains.
+wf_audio_device() {
+  local sink="" source="" m
+  [[ $DESKTOP_AUDIO == "true" ]] && sink=$(pactl get-default-sink 2>/dev/null)
+  [[ $MICROPHONE_AUDIO == "true" ]] && source=$(pactl get-default-source 2>/dev/null)
+
+  if [[ -n $sink && -n $source ]]; then
+    if m=$(pactl load-module module-null-sink sink_name=omarchy_screenrec sink_properties=device.description=omarchy_screenrec 2>/dev/null); then
+      echo "$m" >"$PA_MODULES_FILE"
+      if m=$(pactl load-module module-loopback source="${sink}.monitor" sink=omarchy_screenrec latency_msec=20 2>/dev/null); then
+        echo "$m" >>"$PA_MODULES_FILE"
+      else
+        sink=""
+      fi
+      if m=$(pactl load-module module-loopback source="$source" sink=omarchy_screenrec latency_msec=20 2>/dev/null); then
+        echo "$m" >>"$PA_MODULES_FILE"
+      else
+        source=""
+      fi
+      if [[ -n $sink && -n $source ]]; then
+        echo "omarchy_screenrec.monitor"
+        return
+      fi
+      wf_audio_cleanup
+    else
+      # No device to mix into: desktop audio records alone, as it always has.
+      source=""
+    fi
  fi
+
+  [[ $DESKTOP_AUDIO == "true" && -z $sink ]] && wf_audio_unavailable desktop
+  [[ $MICROPHONE_AUDIO == "true" && -z $source ]] && wf_audio_unavailable microphone
+  if [[ -n $sink ]]; then
+    echo "${sink}.monitor"
+  elif [[ -n $source ]]; then
+    echo "$source"
+  fi
+}
+
+wf_audio_unavailable() {
+  local audio
+  audio=$(omarchy-text "$1")
+  omarchy-notification-send -u critical -t 5000 "$(omarchy-text "Recording without %1 audio" "$audio")" "$(omarchy-text "The %1 audio could not be added to this recording." "$audio")" >/dev/null 2>&1
+}
+
+wf_audio_cleanup() {
+  [[ -f $PA_MODULES_FILE ]] || return
+  # Unload in reverse so the loopbacks drop before the null sink they feed.
+  tac "$PA_MODULES_FILE" 2>/dev/null | while read -r m; do
+    [[ -n $m ]] && pactl unload-module "$m" 2>/dev/null
+  done
+  rm -f "$PA_MODULES_FILE"
+}
+
+# Launches wf-recorder for the given picker target, backgrounded, with REC_PID set.
+launch_wf_recorder() {
+  local target=$1 filename=$2
+  local geom_args=()
+
+  case $target in
+  monitor:*)
+    geom_args=(-o "${target#monitor:}")
+    ;;
+  region:*)
+    # region:WxH+X+Y (logical coords) -> wf-recorder -g "X,Y WxH" (same space).
+    [[ ${target#region:} =~ ^([0-9]+)x([0-9]+)\+(-?[0-9]+)\+(-?[0-9]+)$ ]] || return 1
+    geom_args=(-g "${BASH_REMATCH[3]},${BASH_REMATCH[4]} ${BASH_REMATCH[1]}x${BASH_REMATCH[2]}")
+    ;;
+  *)
+    return 1
+    ;;
+  esac
+
+  local audio_args=() dev
+  dev=$(wf_audio_device)
+  [[ -n $dev ]] && audio_args=(--audio="$dev")
+
+  # -r 60 caps the framerate: capturing a 120 Hz panel at its native rate makes
+  # needlessly large files. -R 48000 keeps the AAC track at 48 kHz rather than
+  # following a sink that advertises 96 kHz into a file many players, and some
+  # speaker DSPs, play as silence.
+  wf-recorder "${geom_args[@]}" -r 60 -R 48000 "${audio_args[@]}" -f "$filename" 9>&- 2>>"$LOG_FILE" &
+  REC_PID=$!
+}
+
+start_cancelled() {
+  [[ -e $CANCEL_FILE ]]
+}
+
+# Stops a recorder this start launched: TERM, two seconds to exit, then KILL.
+end_launched_recorder() {
+  local pid=$1 waited=0 state
+  kill "$pid" 2>/dev/null
+  while (( waited++ < 20 )); do
+    state=$(<"/proc/$pid/stat") 2>/dev/null || break
+    state=${state##*) }
+    [[ ${state:0:1} != "Z" ]] || break
+    sleep 0.1
+  done
+  kill -KILL "$pid" 2>/dev/null
+  wait "$pid" 2>/dev/null
+}
+
+start_screenrecording() {
+  # A pid left by a recording that ended without a stop would otherwise hide
+  # this one from the toggle until it has started and saved its own.
+  rm -f "$REC_PID_FILE"
  local capture_args=()
  local target

@@ -174,6 +317,7 @@ start_screenrecording() {
    capture_args=(-w portal -s "${RESOLUTION:-$(default_resolution)}")
  else
    target=$(select_capture_target) || return 1
+    start_cancelled && return 1

    case $target in
    monitor:*)
@@ -187,50 +331,101 @@ start_screenrecording() {
  fi

  [[ $WEBCAM == "true" ]] && start_webcam_overlay "$target"
+  start_cancelled && return 1

  local filename="$OUTPUT_DIR/screenrecording-$(date +'%Y-%m-%d_%H-%M-%S').mp4"
-  local audio_devices=""
-  local audio_args=()
+  local backend pid=""

-  [[ $DESKTOP_AUDIO == "true" ]] && audio_devices+="default_output"
+  for backend in $(recorder_backends); do
+    [[ $backend == "wf-recorder" && $target == "portal" ]] && continue
+    echo "===== $(date '+%F %T') args: $* backend: $backend target: $target =====" >>"$LOG_FILE"

-  if [[ $MICROPHONE_AUDIO == "true" ]]; then
-    # Merge audio tracks into one - separate tracks only play one at a time in most players
-    [[ -n $audio_devices ]] && audio_devices+="|"
-    audio_devices+="default_input"
-  fi
+    if [[ $backend == "wf-recorder" ]]; then
+      launch_wf_recorder "$target" "$filename" || continue
+      pid=$REC_PID
+    else
+      local audio_devices=""
+      local audio_args=()

-  [[ -n $audio_devices ]] && audio_args+=(-a "$audio_devices" -ac aac)
+      [[ $DESKTOP_AUDIO == "true" ]] && audio_devices+="default_output"

-  echo "===== $(date '+%F %T') args: $* target: $target =====" >>"$LOG_FILE"
-  gpu-screen-recorder "${capture_args[@]}" -k auto -f 60 -fm cfr -fallback-cpu-encoding yes -o "$filename" "${audio_args[@]}" 2>>"$LOG_FILE" &
-  local pid=$!
+      if [[ $MICROPHONE_AUDIO == "true" ]]; then
+        # Merge audio tracks into one - separate tracks only play one at a time in most players
+        [[ -n $audio_devices ]] && audio_devices+="|"
+        audio_devices+="default_input"
+      fi

-  while kill -0 $pid 2>/dev/null && [[ ! -f $filename ]]; do
-    sleep 0.2
+      [[ -n $audio_devices ]] && audio_args+=(-a "$audio_devices" -ac aac)
+
+      gpu-screen-recorder "${capture_args[@]}" -k auto -f 60 -fm cfr -fallback-cpu-encoding yes -o "$filename" "${audio_args[@]}" 9>&- 2>>"$LOG_FILE" &
+      pid=$!
+    fi
+
+    local ticks=0
+    while kill -0 $pid 2>/dev/null && [[ ! -f $filename ]]; do
+      start_cancelled && break
+      if [[ $target != "portal" ]] && (( ++ticks > READY_TIMEOUT_TICKS )); then
+        end_launched_recorder "$pid"
+        wf_audio_cleanup
+        rm -f "$filename"
+        continue 2
+      fi
+      sleep 0.2
+    done
+
+    if start_cancelled; then
+      end_launched_recorder "$pid"
+      wf_audio_cleanup
+      rm -f "$filename"
+      return 1
+    fi
+
+    if kill -0 $pid 2>/dev/null; then
+      echo "$pid" >"$REC_PID_FILE"
+      echo "$filename" >"$RECORDING_FILE"
+      toggle_screenrecording_indicator
+      return 0
+    fi
+
+    wf_audio_cleanup
+    rm -f "$filename"
  done

-  if kill -0 $pid 2>/dev/null; then
-    echo "$filename" >"$RECORDING_FILE"
-    toggle_screenrecording_indicator
-  fi
+  return 1
 }

+# Selects the recorder this script started, by the pid it saved. A saved pid
+# that is no longer a recorder is a recording that ended without a stop, so
+# nothing of ours is recording and no other recorder is touched. Without a
+# saved pid (a recording started before the pid was saved), every recorder the
+# user runs counts, as for the bar indicator and the menu.
+select_recorder() {
+  RECORDER=()
+  [[ -f $REC_PID_FILE ]] || return 0
+
+  local pid
+  pid=$(<"$REC_PID_FILE")
+  [[ $pid =~ ^[0-9]+$ ]] && omarchy-capture-screenrecording-process --pid "$pid" || return 1
+  RECORDER=(--pid "$pid")
+}
+
+# Stops the recorder screenrecording_active selected.
 stop_screenrecording() {
-  pkill -SIGINT -f "^gpu-screen-recorder" # SIGINT required to save video properly
+  omarchy-capture-screenrecording-process "${RECORDER[@]}" --signal INT # SIGINT required to save video properly

  # Wait a maximum of 5 seconds to finish before hard killing
  local count=0
-  while pgrep -f "^gpu-screen-recorder" >/dev/null && ((count < 50)); do
+  while omarchy-capture-screenrecording-process "${RECORDER[@]}" && ((count < 50)); do
    sleep 0.1
    count=$((count + 1))
  done

  toggle_screenrecording_indicator
  cleanup_webcam
+  wf_audio_cleanup

-  if pgrep -f "^gpu-screen-recorder" >/dev/null; then
-    pkill -9 -f "^gpu-screen-recorder"
+  if omarchy-capture-screenrecording-process "${RECORDER[@]}"; then
+    omarchy-capture-screenrecording-process "${RECORDER[@]}" --signal KILL
    omarchy-notification-send -u critical -t 5000 "$(omarchy-text "Screen recording error")" "$(omarchy-text "Recording process had to be force-killed. Video may be corrupted.")"
  else
    finalize_recording
@@ -251,10 +446,10 @@ stop_screenrecording() {
    (
      sleep 2
      rm -f "$preview"
-    ) &
+    ) 9>&- &
  fi

-  rm -f "$RECORDING_FILE"
+  rm -f "$RECORDING_FILE" "$REC_PID_FILE"
 }

 toggle_screenrecording_indicator() {
@@ -262,7 +457,14 @@ toggle_screenrecording_indicator() {
 }

 screenrecording_active() {
-  pgrep -f "^gpu-screen-recorder" >/dev/null
+  if select_recorder && omarchy-capture-screenrecording-process "${RECORDER[@]}"; then
+    return 0
+  else
+    if [[ -f $REC_PID_FILE ]]; then
+      wf_audio_cleanup
+    fi
+    return 1
+  fi
 }

 finalize_recording() {
@@ -283,7 +485,10 @@ finalize_recording() {
    # Hard-mute the first 400ms to drop the PipeWire capture-open pop (a near-clipping
    # transient around 130-200ms that a gentle fade-in can't attenuate enough), then a
    # 50ms fade avoids a click at the boundary before loudnorm normalizes the rest.
-    args+=(-af "volume=enable='lt(t,0.4)':volume=0,afade=t=in:st=0.4:d=0.05,loudnorm=I=-14:TP=-1.5:LRA=11")
+    #
+    # loudnorm declares 192 kHz output, so without -ar the AAC encoder writes
+    # 96 kHz from a 48 kHz recording.
+    args+=(-ar 48000 -af "volume=enable='lt(t,0.4)':volume=0,afade=t=in:st=0.4:d=0.05,loudnorm=I=-14:TP=-1.5:LRA=11")
  fi

  local processed="${latest%.mp4}-processed.mp4"
@@ -294,10 +499,66 @@ finalize_recording() {
  fi
 }

-if screenrecording_active; then
-  stop_screenrecording
-elif [[ $STOP_RECORDING == "true" ]]; then
-  exit 1
-else
-  start_screenrecording || cleanup_webcam
+mkdir -p "$RUNTIME_DIR" || exit 1
+# XDG_STATE_HOME may be outside a private home; protect existing fallbacks too.
+if [[ -z ${XDG_RUNTIME_DIR:-} ]]; then
+  chmod 700 "$RUNTIME_DIR" || exit 1
 fi
+
+# Serialize changes to the recorder and its files; background children close 9.
+# A busy status query stays read-only so a picker cannot stall the bar.
+{
+  if [[ $STATUS == "true" ]]; then
+    if flock -n 9; then
+      screenrecording_active
+    else
+      select_recorder && omarchy-capture-screenrecording-process "${RECORDER[@]}"
+    fi
+  else
+    # A start still in its picker or waiting on its recorder is cancelled, not
+    # queued behind: that toggle would otherwise begin another recording.
+    # The start reads CANCEL_FILE only after it removes STARTING_FILE, so a
+    # request left while STARTING_FILE stands is always seen. One that finds it
+    # gone waits its turn, and a request the start used up by then is done.
+    if ! flock -w 1 9; then
+      touch "$CANCEL_FILE"
+      # A start that was killed leaves its marker: it counts only while that
+      # start still runs.
+      starter=""
+      [[ -r $STARTING_FILE ]] && starter=$(<"$STARTING_FILE")
+      if [[ $starter =~ ^[0-9]+$ ]] && kill -0 "$starter" 2>/dev/null; then
+        exit 0
+      fi
+      flock 9 || exit 1
+      [[ -e $CANCEL_FILE ]] || exit 0
+      rm -f "$CANCEL_FILE"
+    fi
+    if screenrecording_active; then
+      stop_screenrecording
+    elif [[ $STOP_RECORDING == "true" ]]; then
+      exit 1
+    else
+      rm -f "$CANCEL_FILE"
+      echo $$ >"$STARTING_FILE"
+      if start_screenrecording; then
+        rm -f "$STARTING_FILE"
+        # Cancelled while the recording was being saved as started.
+        if start_cancelled; then
+          end_launched_recorder "$(<"$REC_PID_FILE")"
+          wf_audio_cleanup
+          cleanup_webcam
+          rm -f "$(<"$RECORDING_FILE")" "$REC_PID_FILE" "$RECORDING_FILE"
+          toggle_screenrecording_indicator
+          rm -f "$CANCEL_FILE"
+        fi
+        # A request after that check is left for its requester, who stops this
+        # recording once it has the lock.
+      else
+        rm -f "$STARTING_FILE"
+        wf_audio_cleanup
+        cleanup_webcam
+        rm -f "$CANCEL_FILE"
+      fi
+    fi
+  fi
+} 9>>"$RUNTIME_DIR/omarchy-screenrecord.lock"
@@ -0,0 +1,72 @@
+#!/bin/bash
+
+# omarchy:summary=Check or signal the current user's recording processes
+# omarchy:args=[--pid <pid>] [--signal INT|KILL]
+# omarchy:hidden=true
+
+usage() {
+  echo "Usage: omarchy-capture-screenrecording-process [--pid <pid>]... [--signal INT|KILL]" >&2
+  exit 2
+}
+
+proc_root=${OMARCHY_PROC_ROOT:-/proc}
+wanted=" "
+signal=""
+
+while (($#)); do
+  case $1 in
+    --pid)
+      # Compare textually first: bash arithmetic wraps values past 64 bits.
+      [[ ${2-} =~ ^0*([0-9]+)$ ]] || usage
+      pid=${BASH_REMATCH[1]}
+      ((${#pid} <= 10 && 10#$pid <= 4194304)) || usage
+      wanted+="$((10#$pid)) "
+      shift 2
+      ;;
+    --signal)
+      [[ ${2-} == "INT" || ${2-} == "KILL" ]] || usage
+      signal=$2
+      shift 2
+      ;;
+    *)
+      usage
+      ;;
+  esac
+done
+
+is_recorder() {
+  local exe
+  exe=$(readlink "$proc_root/$1/exe" 2>/dev/null) || return 1
+  # Linux appends this when an upgrade unlinks a still-running executable.
+  exe=${exe% (deleted)}
+  exe=${exe##*/}
+  [[ $exe == "gpu-screen-recorder" || $exe == "wf-recorder" ]]
+}
+
+# Linux truncates a process name to 15 characters: gpu-screen-recorder runs as
+# gpu-screen-reco, which any executable sharing that prefix also matches, and a
+# process can rename itself, so the executable path confirms each candidate.
+matched=()
+while read -r pid; do
+  if [[ $wanted == " " || $wanted == *" $pid "* ]] && is_recorder "$pid"; then
+    matched+=("$pid")
+  fi
+done < <(pgrep -u "$UID" -x 'gpu-screen-reco(rder)?|wf-recorder')
+
+if ((${#matched[@]} == 0)); then
+  exit 1
+fi
+
+if [[ -n $signal ]]; then
+  delivered=0
+  for pid in "${matched[@]}"; do
+    # The pid can be reused between discovery and kill; re-checking exe here narrows that window.
+    if is_recorder "$pid" && kill "-$signal" "$pid" 2>/dev/null; then
+      delivered=1
+    fi
+  done
+  # A recorder that exits before its signal has stopped anyway; fail only if none was signalled.
+  ((delivered)) || exit 1
+fi
+
+exit 0
@@ -47,31 +47,9 @@ validate_dev_checkout() {
  fi
 }

-# The dev channel refreshes pacman with the checkout's own tools. A checkout
-# without this machine's region profile would silently drop its repositories.
-validate_dev_region() {
-  local checkout="$1" region_file="${OMARCHY_REGION_FILE:-/etc/omarchy/region}" region=global
-
-  [[ -f $region_file ]] && region=$(<"$region_file")
-  [[ $region == "global" ]] && return 0
-
-  # The refresh after linking needs a runnable helper and every fragment, not
-  # just a directory with the region's name: dev refreshes edge, and leaving
-  # dev later refreshes stable or rc with this checkout's tools.
-  local profile="$checkout/default/regions/$region/pacman" fragment supported=true
-  [[ -x $checkout/bin/omarchy-apply-pacman ]] || supported=false
-  for fragment in pacman.conf.append mirrorlist-stable.prepend mirrorlist-rc.prepend mirrorlist-edge.prepend; do
-    [[ -r $profile/$fragment ]] || supported=false
-  done
-  if ! $supported; then
-    fail "$checkout does not support the '$region' region, so switching would drop its package repositories. Check out a branch with default/regions/$region, or remove $region_file to use global defaults."
-  fi
-}
-
 link_dev_checkout() {
  local checkout="$1" required
  [[ -d $checkout/.git ]] || git clone https://github.com/omacom/omarchy.git "$checkout"
-  validate_dev_region "$checkout"

  # Check the destination before changing /etc/omarchy.conf or sudo's path.
  # An existing checkout is not pulled automatically and may predate this policy.
@@ -82,6 +60,23 @@ link_dev_checkout() {
    fi
  done

+  # The checkout's own channel refresh runs next, from its own templates.
+  if [[ ! -f $checkout/${templates#"$OMARCHY_PATH"/}/pacman-$pacman_channel.conf ||
+    ! -f $checkout/${templates#"$OMARCHY_PATH"/}/mirrorlist-$pacman_channel ]]; then
+    fail "Update the checkout before switching to dev; it has no $pacman_channel templates for $platform."
+  fi
+
+  # On aarch64 one from before it had platform templates would replace this
+  # machine's repositories with x86's.
+  if [[ $platform != "x86" ]]; then
+    for required in bin/omarchy-hw-platform install/helpers/pacman.sh; do
+      if [[ ! -f $checkout/$required || ! -r $checkout/$required ||
+        ( $required == "bin/omarchy-hw-platform" && ! -x $checkout/$required ) ]]; then
+        fail "Update the checkout before switching to dev; on $platform it needs $required for this machine's repositories."
+      fi
+    done
+  fi
+
  omarchy-dev-link "$checkout" --no-reboot
 }

@@ -124,9 +119,6 @@ case "$channel" in
    packages=(omarchy-dev omarchy-settings-dev)
    ;;
  dev)
-    confirm_dev || { echo "Cancelled."; exit 0; }
-    dev_checkout="$HOME/omarchy"
-    validate_dev_checkout "$dev_checkout"
    pacman_channel=edge
    packages=(omarchy-dev omarchy-settings-dev)
    ;;
@@ -137,6 +129,20 @@ case "$channel" in
    ;;
 esac

+# A channel this machine's platform has no templates for is refused before
+# anything changes (install/helpers/pacman.sh).
+source "$OMARCHY_PATH/install/helpers/pacman.sh"
+platform=$(omarchy-hw-platform) || fail "Cannot tell this machine's platform; nothing changed."
+templates=$(omarchy_pacman_templates "$platform") || exit 1
+[[ -f $templates/pacman-$pacman_channel.conf && -f $templates/mirrorlist-$pacman_channel ]] ||
+  fail "Omarchy has no $pacman_channel channel for $platform; nothing changed."
+
+if [[ $channel == "dev" ]]; then
+  confirm_dev || { echo "Cancelled."; exit 0; }
+  dev_checkout="$HOME/omarchy"
+  validate_dev_checkout "$dev_checkout"
+fi
+
 # A failure past this point leaves the channel switch half-applied, so say how
 # to pick it back up rather than dying silently under set -e.
 trap 'echo -e "\nThe channel switch did not complete. Review the error above, then rerun: omarchy-channel-set '"$channel"'" >&2' ERR
@@ -1,32 +1,432 @@
 #!/bin/bash

-# omarchy:summary=Set a new encryption password for a drive selected.
+# omarchy:summary=Set a new password for an encrypted drive
 # omarchy:requires-sudo=true

-encrypted_drives=$(blkid -t TYPE=crypto_LUKS -o device)
+# Changes a drive's LUKS key and nothing else. For the disk holding /, the new
+# key must open the disk and the old one must not before the change counts. The
+# journal records only the disk's UUID, key slots and phase, so a change that
+# stops part way is finished by the next run. A platform whose boot checks prove
+# the disk's key slots records the owner's new one before the run finishes.
+
+# Passwords live in variables; never trace them.
+set +x
+
+REKEY_STATE=${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/drive-password.state
+source "$OMARCHY_PATH/install/provisioning/luks-rekey.sh"
+
+# The LUKS partition beneath /, or nothing when / is not encrypted. Fails when
+# it cannot tell, including a crypt layer whose LUKS partition lsblk cannot name.
+root_luks_device() {
+  local root_source ancestry device
+  root_source=$(findmnt -no SOURCE /) && [[ -n $root_source ]] || return 1
+  ancestry=$(lsblk -nsrpo NAME,TYPE,FSTYPE "${root_source%%[*}") || return 1
+  device=$(awk '$3 == "crypto_LUKS" { print $1; exit }' <<<"$ancestry")
+  if [[ -n $device ]]; then
+    readlink -f "$device"
+  elif awk '$2 == "crypt" { found = 1 } END { exit !found }' <<<"$ancestry"; then
+    return 1
+  fi
+}
+
+# Every LUKS device, from udev's probe as root_luks_device reads it. An
+# unprivileged blkid only reads /run/blkid, empty until root runs blkid. lsblk
+# repeats a device under each parent (RAID members), so each is listed once.
+luks_drives() {
+  lsblk -nrpo NAME,FSTYPE | awk '$2 == "crypto_LUKS" && !seen[$1]++ { print $1 }'
+}
+
+# Every cryptsetup call holds the disk lock, so one left running by a run that
+# was killed finishes before the next run looks at the drive.
+
+# Print the key slot the password opens. Returns 2 when it opens none, and
+# another failure when the drive cannot be checked. cryptsetup open tries
+# enrolled tokens (TPM2, FIDO2, keyring) before the key and reports a token's
+# slot whatever key it was given, so allow only a token type no token has.
+drive_key_slot() {
+  local drive=$1 password=$2 out status=0
+  out=$(printf '%s' "$password" | sudo flock "$disk_lock" env LC_ALL=C cryptsetup open --test-passphrase --verbose --token-type passphrase-only --key-file - "$drive" 2>&1) || status=$?
+  (( status == 0 )) || return "$status"
+  grep -o 'Key slot [0-9]* unlocked' <<<"$out" | grep -o '[0-9]*' | head -1
+}
+
+# The enabled key slots, comma-separated. A luks2-keyring token under "Tokens:"
+# looks like a keyslot, so read only the keyslot section.
+drive_slots() {
+  local dump
+  dump=$(sudo flock "$disk_lock" cryptsetup luksDump "$1") || return 1
+  awk '
+    /^[^ \t]/ { keyslots = ($0 == "Keyslots:") }
+    keyslots && /^ +[0-9]+: luks2/ { sub(":", "", $1); print $1 }
+    /^Key Slot [0-9]+: ENABLED/ { sub(":", "", $3); print $3 }' <<<"$dump" | paste -sd, -
+}
+
+# The key slots other than FOUND that the password also opens, comma-separated,
+# or nothing. Fails when a slot cannot be checked.
+other_key_slots() {
+  local drive=$1 password=$2 found=$3 slots slot status
+  local -a others=()
+  slots=$(drive_slots "$drive") || return 1
+  for slot in ${slots//,/ }; do
+    [[ $slot != "$found" ]] || continue
+    status=0
+    printf '%s' "$password" | sudo flock "$disk_lock" cryptsetup open --test-passphrase --token-type passphrase-only --key-slot "$slot" --key-file - "$drive" >/dev/null 2>&1 || status=$?
+    if (( status == 0 )); then
+      others+=("$slot")
+    elif (( status != 2 )); then
+      return 1
+    fi
+  done
+  local IFS=,
+  printf '%s' "${others[*]}"
+}
+
+kill_slot() {
+  local drive=$1 password=$2 slot=$3
+  printf '%s' "$password" | sudo flock "$disk_lock" cryptsetup luksKillSlot -q --key-file - "$drive" "$slot"
+}
+
+# luksChangeKey writes the new key before it retires the old one (LUKS2 swaps
+# them in one header update), so a failure that leaves the new key unable to
+# open the drive changed nothing: that returns 2. One that stops in between
+# leaves both keys, so the old key is retired here until it opens nothing.
+# Sets new_slot.
+change_luks_key() {
+  local drive=$1 current=$2 new=$3 old_slot=$4 remains attempt status
+  local -a pbkdf=(--iter-time 2000)
+
+  echo "Changing full-disk encryption password for $drive"
+  if sudo flock "$disk_lock" cryptsetup isLuks --type luks2 "$drive"; then
+    pbkdf+=(--pbkdf argon2id)
+  fi
+  # Both keys travel over stdin, the current one on the first line.
+  printf '%s\n%s' "$current" "$new" |
+    sudo flock "$disk_lock" bash -c 'IFS= read -r current; drive=$1; shift; exec cryptsetup luksChangeKey "$@" --key-file <(printf "%s" "$current") "$drive" <(cat)' bash "$drive" "${pbkdf[@]}"
+
+  new_slot=$(drive_key_slot "$drive" "$new") || return
+  for (( attempt = 0; attempt < 8; attempt++ )); do
+    status=0
+    remains=$(drive_key_slot "$drive" "$current") || status=$?
+    (( status == 2 )) && return 0
+    (( status == 0 )) && [[ $remains != "$new_slot" ]] || return 1
+    kill_slot "$drive" "$new" "$remains" || return 1
+  done
+  return 1
+}
+
+# The entrypoint that records the system disk's key slots for the platform's
+# boot checks, or nothing where none does. A machine without its platform's
+# boot package at all (dispatch exit 3) predates it, and nothing checks its
+# slots. Fails with the dispatcher's message otherwise, such as a boot package
+# too old to ship luks-slots.
+slot_recorder() {
+  local out status=0
+  out=$("$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" --resolve luks-slots 2>&1) || status=$?
+  if (( status == 0 )); then
+    printf '%s' "$out"
+  elif (( status != 3 )); then
+    printf '%s\n' "$out" >&2
+    return 1
+  fi
+}
+
+# Refuse a current password that opens any slot but the owner's where the
+# platform records the slots: on a disk an earlier setup gave a second key (a
+# recovery key), changing that one would leave the owner's password as it was.
+# luks-slots --owner prints the recorded slot (0), or exits 4 when no owner slot
+# is recorded, as on a Mac set up before its boot package recorded slots; any
+# other status is a failure the entrypoint explains, and stops the change.
+# Where nothing is recorded, a password that opens the disk's only key slot is
+# the owner's, and the change records its new slot (unrecorded_owner).
+owner_slot_matches() {
+  local slot=$1 recorder owner errors reason status=0
+  recorder=$(slot_recorder) || return 1
+  [[ -n $recorder ]] || return 0
+  errors=$(mktemp) || return 1
+  owner=$(sudo "$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" luks-slots --owner 2>"$errors") || status=$?
+  reason=$(<"$errors")
+  rm -f "$errors"
+  if (( status == 4 )); then
+    only_key_slot "$slot" || return 1
+    unrecorded_owner=1
+    return 0
+  elif (( status != 0 )); then
+    echo "Could not read which key slot holds the system disk password: ${reason:-luks-slots --owner exited $status}"
+    return 1
+  elif [[ ! $owner =~ ^[0-9]+$ ]]; then
+    echo "Could not read which key slot holds the system disk password: the platform's boot package named '$owner', which is not a key slot."
+    return 1
+  fi
+  if [[ $owner != "$slot" ]]; then
+    echo "That password opens another key slot on the system disk, such as a recovery key from an earlier setup. Enter the system disk password."
+    return 1
+  fi
+}
+
+# With no owner slot recorded, the password must open the system disk's one key
+# slot: with more keys there is no telling which is the owner's, and recording
+# only the owner's would fail the platform's boot check, which wants every kept
+# slot recorded. Says how to settle it.
+only_key_slot() {
+  local slot=$1 slots others
+  slots=$(drive_slots "$root_drive") || { echo "Could not read the key slots of $root_drive."; return 1; }
+  [[ $slots != "$slot" ]] || return 0
+  others=$(tr ',' '\n' <<<"$slots" | grep -vx -- "$slot" | paste -sd, -)
+  echo "No key slot is recorded as the system disk password's, and $root_drive has keys in slots $slots, so which one is yours can't be told. The password you entered opens slot $slot."
+  if [[ $others =~ ^[0-9]+$ ]]; then
+    echo "If that password is yours and slot $others holds a recovery key you keep, record both: sudo omarchy-lifecycle-dispatch luks-slots owner=$slot recovery=$others"
+    echo "Otherwise remove the key you don't use: sudo cryptsetup luksKillSlot $root_drive <slot>"
+  else
+    echo "Remove the keys you don't use: sudo cryptsetup luksKillSlot $root_drive <slot>"
+  fi
+  echo "Then run omarchy-drive-password again."
+  return 1
+}
+
+# Record the slot the owner's password opens now; a no-op where nothing does.
+record_owner_slot() {
+  local recorder
+  recorder=$(slot_recorder) || return 1
+  [[ -z $recorder ]] || sudo "$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" luks-slots "owner=$1"
+}
+
+# Phase luks: the key change may or may not have landed. Phase record: the new
+# key alone opens the recorded slot, which the boot checks still need.
+change_system_password() {
+  local current=$1 new=$2 old_slot=$3 slots status=0
+
+  slots=$(drive_slots "$root_drive")
+  if [[ ,$slots, != *",$old_slot,"* ]]; then
+    echo "Could not read the key slots of $root_drive."
+    return 1
+  fi
+  # A disk taken as the owner's for holding one key must still hold only it.
+  if (( unrecorded_owner )) && [[ $slots != "$old_slot" ]]; then
+    echo "The key slots of $root_drive changed while you entered the new password. Run omarchy-drive-password again."
+    return 1
+  fi
+  mkdir -p "${REKEY_STATE%/*}" &&
+    rekey_state_put uuid "$root_uuid" old_slot "$old_slot" slots "$slots" checked 1 phase luks || return 1
+
+  change_luks_key "$root_drive" "$current" "$new" "$old_slot" || status=$?
+  if (( status == 2 )); then
+    rm -f "$REKEY_STATE"
+    echo "The disk password did not change."
+    return 1
+  elif (( status != 0 )); then
+    echo "Could not confirm the disk password change. Run omarchy-drive-password again to finish."
+    return 1
+  fi
+  rekey_state_put slot "$new_slot" phase record || return 1
+
+  if ! record_owner_slot "$new_slot"; then
+    echo "Could not record the new key slot for the boot checks. Run omarchy-drive-password again to finish."
+    return 1
+  fi
+  rm -f "$REKEY_STATE"
+}
+
+# A journal left on this system's disk by a change that stopped part way.
+change_pending() {
+  local phase uuid
+  phase=$(rekey_state_get phase) || return 1
+  uuid=$(rekey_state_get uuid)
+  if [[ $phase == "luks" || $phase == "record" || $phase == "accounts" ]] && [[ -n $uuid && $uuid == "$root_uuid" ]]; then
+    return 0
+  fi
+  rm -f "$REKEY_STATE"
+  return 1
+}
+
+# Settle the disk on the password it opens with now, then record its slot.
+# Before the change was confirmed that is the old key (removing the slot the
+# change added, if any) or the new key in the one slot the change added
+# (retiring the old slot); after, only the confirmed slot. Any other key on the
+# disk, such as a recovery passphrase, is refused, and so is a disk that gained
+# more than one slot since.
+finish_interrupted_change() {
+  local phase old_slot slots slot header password opened now added extra count=0 status=0
+
+  phase=$(rekey_state_get phase)
+  # Earlier versions named the confirmed phase "accounts".
+  [[ $phase != "accounts" ]] || phase=record
+  old_slot=$(rekey_state_get old_slot)
+  slots=$(rekey_state_get slots)
+  slot=$(rekey_state_get slot)
+
+  if [[ $phase == "luks" && ! ( $old_slot =~ ^[0-9]+$ && ,$slots, == *",$old_slot,"* ) ]] ||
+    [[ $phase == "record" && ! $slot =~ ^[0-9]+$ ]]; then
+    echo "$REKEY_STATE is unreadable. Remove it once the disk opens with only the password you want."
+    return 1
+  fi
+
+  # Earlier versions journaled the change without checking that the old
+  # password opened one slot alone (checked=1), so with other slots on the disk
+  # a copy of it may have outlived the change. No password entered now can show
+  # which slot was whose, so the owner settles that by hand.
+  if [[ -z $(rekey_state_get checked) ]]; then
+    now=$(drive_slots "$root_drive") || { echo "Could not read the key slots of $root_drive."; return 1; }
+    if [[ $now == *,* ]]; then
+      echo "The last password change for $root_drive was started by an earlier version of omarchy-drive-password, and the disk has key slots $now, so it may still hold a copy of the old password."
+      echo "Settle it by hand, in this order:"
+      echo "1. Find the slot the password you want to keep opens, and keep it: sudo cryptsetup open --test-passphrase --token-type passphrase-only --verbose $root_drive names it. If only the old password opens the disk, that is the one you keep."
+      echo "2. If the password you keep is not the old one, check each other slot with the old password (sudo cryptsetup open --test-passphrase --token-type passphrase-only --key-slot <slot> $root_drive) and remove each one it opens (sudo cryptsetup luksKillSlot $root_drive <slot>). Never remove the slot from step 1."
+      if [[ -n $(slot_recorder 2>/dev/null) ]]; then
+        echo "3. Record the slots you kept for the boot checks: sudo omarchy-lifecycle-dispatch luks-slots owner=<slot> recovery=<slot>, with an empty recovery= when no recovery key is left."
+      fi
+      echo "Then remove $REKEY_STATE, and run omarchy-drive-password again if the disk should still take a new password."
+      return 1
+    fi
+  fi
+
+  echo "The last password change for $root_drive stopped part way."
+  if [[ $phase == "record" ]]; then
+    header="New encryption password"
+  else
+    header="Encryption password that opens $root_drive now (the new one if the change went through)"
+  fi
+  password=$(gum input --password --header "$header") || return 1
+
+  opened=$(drive_key_slot "$root_drive" "$password") || status=$?
+  if (( status != 0 && status != 2 )); then
+    echo "Could not check the password against $root_drive."
+    return 1
+  fi
+
+  if [[ $phase == "luks" && -n $opened ]]; then
+    now=$(drive_slots "$root_drive") || { echo "Could not read the key slots of $root_drive."; return 1; }
+    for extra in ${now//,/ }; do
+      if [[ ,$slots, != *",$extra,"* ]]; then
+        added=$extra
+        count=$(( count + 1 ))
+      fi
+    done
+    if (( count > 1 )); then
+      echo "The key slots of $root_drive changed since the interrupted change. Finish it by hand."
+      return 1
+    fi
+
+    if [[ $opened == "$old_slot" ]]; then
+      [[ -z $added ]] || kill_slot "$root_drive" "$password" "$added" || return 1
+    elif [[ -n $added && $opened == "$added" ]]; then
+      if [[ ,$now, == *",$old_slot,"* ]]; then
+        kill_slot "$root_drive" "$password" "$old_slot" || return 1
+      fi
+    else
+      opened=""
+    fi
+    [[ -z $opened ]] || rekey_state_put slot "$opened" phase record || return 1
+  elif [[ $phase == "record" && $opened != "$slot" ]]; then
+    opened=""
+  fi
+
+  if [[ -z $opened ]]; then
+    echo "That password does not finish the change on $root_drive. Run omarchy-drive-password again to finish."
+    return 1
+  fi
+
+  if ! record_owner_slot "$opened"; then
+    echo "Could not record the key slot for the boot checks. Run omarchy-drive-password again to finish."
+    return 1
+  fi
+  rm -f "$REKEY_STATE"
+  echo "$root_drive now opens with the password you entered, and the change is settled."
+}
+
+change_selected_drive() {
+  local encrypted_drives drive current old_slot others new_password confirmation status=0 system_drive=false
+
+  encrypted_drives=$(luks_drives)
+  if [[ -z $encrypted_drives ]]; then
+    echo "No encrypted drives available."
+    return 1
+  fi

-if [[ -n $encrypted_drives ]]; then
  if (( $(wc -l <<<"$encrypted_drives") == 1 )); then
-    drive_to_change="$encrypted_drives"
+    drive="$encrypted_drives"
  else
-    drive_to_change="$(omarchy-drive-select "$encrypted_drives")"
+    drive="$(omarchy-drive-select "$encrypted_drives")"
  fi

-  if [[ -n $drive_to_change ]]; then
-    new_password=$(gum input --password --header "New encryption password") || exit 1
-    [[ -n $new_password ]] || { echo "Password cannot be empty."; exit 1; }
-
-    confirmation=$(gum input --password --header "Confirm new encryption password") || exit 1
-    [[ $new_password == "$confirmation" ]] || { echo "Passwords do not match."; exit 1; }
-
-    echo "Changing full-disk encryption password for $drive_to_change"
-    # The new key travels over stdin and reaches cryptsetup as a keyfile via
-    # <(cat), leaving the tty free for the current-passphrase prompt.
-    printf "%s" "$new_password" | sudo bash -c 'exec cryptsetup luksChangeKey --pbkdf argon2id --iter-time 2000 "$1" <(cat) </dev/tty' bash "$drive_to_change"
-  else
+  if [[ -z $drive ]]; then
    echo "No drive selected."
+    return 0
  fi
+
+  if [[ -n $root_drive && $(readlink -f "$drive") == "$root_drive" ]]; then
+    system_drive=true
+    drive=$root_drive
+  fi
+
+  current=$(gum input --password --header "Current encryption password") || return 1
+  old_slot=$(drive_key_slot "$drive" "$current") || status=$?
+  if (( status == 2 )); then
+    echo "That password does not open $drive."
+    return 1
+  elif (( status != 0 )); then
+    echo "Could not check the password against $drive."
+    return 1
+  fi
+  if [[ $system_drive == "true" ]]; then
+    owner_slot_matches "$old_slot" || { echo "The system disk password did not change."; return 1; }
+    # An interrupted change is finished from the one slot the password opened;
+    # another copy of it would outlive the change.
+    others=$(other_key_slots "$drive" "$current" "$old_slot") || { echo "Could not check the key slots of $drive."; return 1; }
+    if [[ -n $others ]]; then
+      echo "That password also opens key slot $others on $drive. Remove the extra copy first (sudo cryptsetup luksKillSlot $drive <slot>), then run omarchy-drive-password again."
+      if [[ -n $(slot_recorder 2>/dev/null) ]]; then
+        echo "Then record the slots you keep for the boot checks: sudo omarchy-lifecycle-dispatch luks-slots owner=<slot> recovery=<slot>, with an empty recovery= when no recovery key is left."
+      fi
+      echo "The system disk password did not change."
+      return 1
+    fi
+  fi
+
+  new_password=$(gum input --password --header "New encryption password") || return 1
+  [[ -n $new_password ]] || { echo "Password cannot be empty."; return 1; }
+
+  confirmation=$(gum input --password --header "Confirm new encryption password") || return 1
+  [[ $new_password == "$confirmation" ]] || { echo "Passwords do not match."; return 1; }
+  [[ $new_password != "$current" ]] || { echo "The new password is the current one."; return 1; }
+  # Its slot is how the change is followed, so it must not open one already.
+  status=0
+  drive_key_slot "$drive" "$new_password" >/dev/null || status=$?
+  if (( status == 0 )); then
+    echo "That password already opens a key slot on $drive. Choose another."
+    return 1
+  elif (( status != 2 )); then
+    echo "Could not check the password against $drive."
+    return 1
+  fi
+  status=0
+
+  if [[ $system_drive == "true" ]]; then
+    change_system_password "$current" "$new_password" "$old_slot"
+  else
+    change_luks_key "$drive" "$current" "$new_password" "$old_slot" || status=$?
+    if (( status == 2 )); then
+      echo "The password of $drive did not change."
+      return 1
+    elif (( status != 0 )); then
+      echo "Could not confirm the password change on $drive."
+      return 1
+    fi
+  fi
+}
+
+disk_lock=${REKEY_STATE%/*}/drive-password.disk.lock
+mkdir -p "${REKEY_STATE%/*}" && touch "$disk_lock" && exec {lock_fd}>"${REKEY_STATE%/*}/drive-password.lock" && flock -n "$lock_fd" ||
+  { echo "Another drive password change is running."; exit 1; }
+
+unrecorded_owner=0
+root_drive=$(root_luks_device) || { echo "Could not tell which drive holds the system."; exit 1; }
+root_uuid=""
+if [[ -n $root_drive ]]; then
+  root_uuid=$(lsblk -dno UUID "$root_drive") && [[ -n $root_uuid ]] || { echo "Could not read the UUID of $root_drive."; exit 1; }
+fi
+
+if change_pending; then
+  finish_interrupted_change
 else
-  echo "No encrypted drives available."
-  exit 1
+  change_selected_drive
 fi
@@ -13,6 +13,12 @@ for arg in "$@"; do
  esac
 done

+# Resume is Limine-oriented and hibernate is unreliable on Asahi.
+if omarchy-hw-aarch64-apple; then
+  echo "Skipping hibernation setup (not supported on Apple Silicon)"
+  exit 0
+fi
+
 if [[ ! -f /sys/power/image_size ]]; then
  echo -e "Hibernation is not supported on your system" >&2
  exit 0
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+# omarchy:summary=Detect whether the CPU is aarch64 (every ARM machine, Apple Silicon included).
+
+[[ $(uname -m) == "aarch64" ]]
@@ -0,0 +1,17 @@
+#!/bin/bash -p
+
+# omarchy:summary=Detect whether the computer is an Apple Silicon Mac.
+
+# Callers run this by absolute path, from systemd and from the shell, so use the
+# detector shipped beside it rather than whichever one PATH finds. -p keeps a
+# root caller's exported functions out, so a launch without it is refused, and
+# nothing here searches PATH.
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup." >&2
+  exit 126
+fi
+
+dir=${BASH_SOURCE[0]%/*}
+[[ $dir != "${BASH_SOURCE[0]}" ]] || dir=.
+platform=$("$dir/omarchy-hw-platform") || exit 1
+[[ $platform == "aarch64-apple" ]]
@@ -0,0 +1,15 @@
+#!/bin/bash -p
+
+# omarchy:summary=Detect whether the computer is an Apple Silicon Mac (the old name of omarchy-hw-aarch64-apple).
+# omarchy:hidden=true
+
+# Kept while omarchy-mac's packages and units still call it by this name. Like
+# the predicate it runs, it refuses a launch without -p and searches no PATH.
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup." >&2
+  exit 126
+fi
+
+dir=${BASH_SOURCE[0]%/*}
+[[ $dir != "${BASH_SOURCE[0]}" ]] || dir=.
+exec "$dir/omarchy-hw-aarch64-apple"
@@ -5,14 +5,48 @@

 backlight_path="${OMARCHY_BACKLIGHT_PATH:-/sys/class/backlight}"

+# The platform package may name backlights to skip and to prefer (see
+# docs/file-layout.md).
+displays_conf=/usr/share/omarchy-platform/displays.conf
+skips=()
+prefers=()
+if [[ -r $displays_conf ]]; then
+  # \r in IFS: a file saved with CRLF line ends reads the same.
+  while IFS=$' \t\r' read -r directive argument extra || [[ -n $directive ]]; do
+    [[ -n $argument && -z $extra && $argument != */* && $argument != . && $argument != .. ]] || continue
+    case $directive in
+    backlight-skip) skips+=("$argument") ;;
+    backlight-prefer) prefers+=("$argument") ;;
+    esac
+  done <"$displays_conf"
+fi
+
+usable() {
+  local skip
+  # The Touch Bar on T2 Macs registers a backlight that never drives the display panel.
+  [[ -n $1 && $1 != appletb_backlight ]] || return 1
+  for skip in "${skips[@]}"; do
+    # shellcheck disable=SC2053 # a skip is a glob
+    [[ $1 == $skip ]] && return 1
+  done
+  return 0
+}
+
 # Start with the first possible output, then refine to the most likely given an order heuristic.
-# Glob the candidates in the loop list: [[ ]] does not do pathname expansion.
-# The Touch Bar on T2 Macs registers a backlight that never drives the display panel.
-device="$(ls -1 "$backlight_path" 2>/dev/null | grep -vx appletb_backlight | head -n1)"
+device=""
+while IFS= read -r name; do
+  if usable "$name"; then
+    device="$name"
+    break
+  fi
+done < <(ls -1 "$backlight_path" 2>/dev/null)
+
 # gmux comes first: apple-gmux only registers when the kernel has already picked it, and on
-# dual-GPU Macs the GPU's own PWM stops driving the panel once that GPU suspends.
-for candidate in "$backlight_path"/gmux_backlight "$backlight_path"/amdgpu_bl* "$backlight_path"/intel_backlight "$backlight_path"/acpi_video*; do
-  if [[ -e $candidate ]]; then
+# dual-GPU Macs the GPU's own PWM stops driving the panel once that GPU suspends. The
+# platform's preferred backlights follow, then the GPU and ACPI ones.
+# Glob the candidates in the loop list: [[ ]] does not do pathname expansion.
+for candidate in "$backlight_path"/gmux_backlight "${prefers[@]/#/$backlight_path/}" "$backlight_path"/amdgpu_bl* "$backlight_path"/intel_backlight "$backlight_path"/acpi_video*; do
+  if [[ -e $candidate ]] && usable "${candidate##*/}"; then
    device="${candidate##*/}"
    break
  fi
@@ -2,15 +2,39 @@

 # omarchy:summary=Returns true when running on a laptop (has a lid or laptop chassis).

+acpi_lid="${OMARCHY_ACPI_LID_PATH:-/proc/acpi/button/lid}"
+input_class="${OMARCHY_INPUT_CLASS_PATH:-/sys/class/input}"
+dmi_chassis="${OMARCHY_DMI_CHASSIS_TYPE_PATH:-/sys/class/dmi/id/chassis_type}"
+
+shopt -s nullglob
+acpi_states=("$acpi_lid"/*/state)
+input_switches=("$input_class"/*/capabilities/sw)
+shopt -u nullglob
+
 # A lid switch is the definitive signal for clamshell-capable hardware.
-for state in /proc/acpi/button/lid/*/state; do
+for state in "${acpi_states[@]}"; do
  [[ -e $state ]] && exit 0
 done

+# Without an ACPI lid (Apple Silicon, for one), any input device that reports a
+# lid switch (SW_LID, bit 0 of its switch capabilities, the last word of the
+# bitmap) counts. The switch's name varies: Apple's SMC input device carries
+# the same name on a Mac mini, where it reports no lid.
+for switches in "${input_switches[@]}"; do
+  [[ -r $switches ]] || continue
+  read -r -a words <"$switches" || true
+  (( ${#words[@]} )) || continue
+  word=${words[-1]}
+  [[ $word =~ ^[0-9a-fA-F]+$ ]] || continue
+  (( 16#$word & 1 )) && exit 0
+done
+
 # Fall back to the DMI chassis type for laptops that don't expose an ACPI lid
 # button. 8=Portable 9=Laptop 10=Notebook 14=Sub Notebook 30=Tablet
 # 31=Convertible 32=Detachable.
-case $(< /sys/class/dmi/id/chassis_type 2>/dev/null) in
+chassis_type=""
+read -r chassis_type <"$dmi_chassis" 2>/dev/null || true
+case $chassis_type in
 8 | 9 | 10 | 14 | 30 | 31 | 32) exit 0 ;;
 esac

@@ -3,9 +3,45 @@
 # omarchy:summary=Returns true when the laptop lid is closed
 # omarchy:hidden=true

-for state in /proc/acpi/button/lid/*/state; do
-  [[ -r $state ]] || continue
-  [[ $(< "$state") == *"closed"* ]] && exit 0
-done
+acpi_lid="${OMARCHY_ACPI_LID_PATH:-/proc/acpi/button/lid}"
+input_class="${OMARCHY_INPUT_CLASS_PATH:-/sys/class/input}"
+
+shopt -s nullglob
+acpi_states=("$acpi_lid"/*/state)
+input_switches=("$input_class"/*/capabilities/sw)
+shopt -u nullglob
+
+# An input device that reports a lid switch: SW_LID, bit 0 of the last word
+# of its switch bitmap.
+has_lid_switch() {
+  local switches word
+  local -a words
+
+  for switches in "${input_switches[@]}"; do
+    [[ -r $switches ]] || continue
+    read -r -a words <"$switches" || true
+    (( ${#words[@]} )) || continue
+    word=${words[-1]}
+    [[ $word =~ ^[0-9a-fA-F]+$ ]] || continue
+    (( 16#$word & 1 )) && return 0
+  done
+  return 1
+}
+
+if (( ${#acpi_states[@]} )); then
+  # An ACPI lid reports its own state.
+  for state in "${acpi_states[@]}"; do
+    [[ -r $state ]] || continue
+    [[ $(<"$state") == *"closed"* ]] && exit 0
+  done
+elif has_lid_switch; then
+  # Elsewhere (Apple Silicon's SMC, for one) only logind reads the switch. Ask
+  # it only then: it answers "open" when it tracks no lid. This runs in sudo's
+  # and polkit's PAM stack where fingerprint login is set up, so a stalled
+  # logind must not hold up every sudo.
+  lid_state=$(busctl --timeout=2 get-property org.freedesktop.login1 \
+    /org/freedesktop/login1 org.freedesktop.login1.Manager LidClosed 2>/dev/null)
+  [[ $lid_state == "b true" ]] && exit 0
+fi

 exit 1
@@ -0,0 +1,202 @@
+#!/bin/bash -p
+
+# omarchy:summary=Print the hardware platform: x86, aarch64 or aarch64-apple.
+
+# Platform names are the CPU architecture, then the hardware family when it
+# needs handling of its own: x86, aarch64 (every ARM machine without one) and
+# aarch64-apple (Apple Silicon). A later family is aarch64-<family>, so
+# "aarch64*" always means ARM (AGENTS.md, Platforms).
+#
+# ARM laptops have no DMI, so the board identity is the root node of the device
+# tree the firmware hands the kernel: "apple,<model>" from Asahi's m1n1 on every
+# Apple Silicon Mac, "qcom,<soc>" on Snapdragon laptops, which are plain aarch64
+# here and must never pass for a Mac. Each compatible string is a NUL-separated
+# list, and only a token's vendor prefix counts.
+#
+# An image is built away from the machine it will run on, so while this root is
+# being built rather than booted, the image-target manifest the builder wrote
+# names the platform and the build host's device tree is never read.
+#
+# Fixture roots let unprivileged tests fake the device tree, PID 1 and the image
+# root. Naming any of them makes the whole view a fixture: nothing live is read,
+# not even the device tree when only the image root is named. A privileged
+# caller must not let its environment pick the platform at all.
+# Privileged mode (-p) keeps exported functions and BASH_ENV out of this shell,
+# so a launch without it is refused. Root then starts over in an empty
+# environment and reads only the live paths with a fixed PATH.
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup." >&2
+  exit 126
+fi
+
+if (( EUID == 0 )) && [[ ${1:-} != --clean-environment ]]; then
+  exec /usr/bin/env -i PATH=/usr/bin /bin/bash -p -- "${BASH_SOURCE[0]}" --clean-environment "$@"
+fi
+
+if (( EUID == 0 )); then
+  export PATH=/usr/bin
+  fixtures=""
+else
+  fixtures=${OMARCHY_PROC_ROOT:-}${OMARCHY_SYS_ROOT:-}${OMARCHY_IMAGE_ROOT:-}
+fi
+
+if [[ -z $fixtures ]]; then
+  proc=/proc
+  sources=(/proc/device-tree/compatible /sys/firmware/devicetree/base/compatible)
+  image_root=""
+  image_dir=/var/lib/omarchy/image
+  image_owner=0
+else
+  proc=${OMARCHY_PROC_ROOT:-}
+  sources=()
+  [[ -z ${OMARCHY_PROC_ROOT:-} ]] || sources+=("$OMARCHY_PROC_ROOT/device-tree/compatible")
+  [[ -z ${OMARCHY_SYS_ROOT:-} ]] || sources+=("$OMARCHY_SYS_ROOT/firmware/devicetree/base/compatible")
+  image_root=${OMARCHY_IMAGE_ROOT:-}
+  image_dir=${image_root:+$image_root/var/lib/omarchy/image}
+  image_owner=$EUID
+fi
+manifest=$image_dir/target
+
+contradiction() {
+  echo "Error: contradictory platform identity: $1" >&2
+  exit 1
+}
+
+if ! machine=$(uname -m) || [[ -z $machine ]]; then
+  echo "Error: cannot read the CPU architecture" >&2
+  exit 1
+fi
+
+# A booted system is one systemd runs as PID 1 from this root. An image build
+# is told apart by what it shows: no /run/systemd/system (a root with a /run of
+# its own), PID 1's root being another (a chroot on the build host, even with
+# the host's /run bound in, as arch-chroot does), or PID 1 being something other
+# than systemd (a PID namespace whose PID 1 is the build). What cannot be seen,
+# such as PID 1's root to a normal user or /proc/1 behind hidepid, never makes a
+# build: a booted system always answers from its hardware, so a build runs as
+# root. A caller in a private PID namespace looks like a build too, so nothing
+# that asks the detector runs with PrivatePIDs=.
+booted() {
+  local comm
+
+  [[ -d $image_root/run/systemd/system ]] || return 1
+  if [[ -n $proc && -e $proc/1/root ]]; then
+    [[ $proc/1/root -ef $image_root/ ]] || return 1
+  fi
+  if [[ -n $proc && -r $proc/1/comm ]]; then
+    read -r comm <"$proc/1/comm" && [[ $comm == "systemd" ]] || return 1
+  fi
+}
+
+# Owned by root (the test's own user for a fixture), not a symlink, and not
+# writable by anyone else.
+trusted() {
+  local owner mode
+
+  [[ -e $1 && ! -L $1 ]] || return 1
+  read -r owner mode < <(stat -c '%u %a' -- "$1") || return 1
+  [[ $owner =~ ^[0-9]+$ && $mode =~ ^[0-7]+$ ]] && (( owner == image_owner && (8#$mode & 8#022) == 0 ))
+}
+
+# The manifest: format=1, platform= one of the platform names, comments and
+# unknown keys ignored, and any other line refused. Image builders written before
+# the names settled say apple-silicon, generic-aarch64 or generic, which still
+# read as aarch64-apple, aarch64 and x86. The detector reads it itself, so it
+# stands alone wherever a package ships a copy of it.
+image_platform() {
+  local line key value format="" platform=""
+
+  if [[ ! -d $image_dir || ! -f $manifest ]] || ! trusted "$image_dir" || ! trusted "$manifest"; then
+    echo "Error: the image manifest $manifest is not a root-owned regular file" >&2
+    return 1
+  fi
+
+  while IFS= read -r line || [[ -n $line ]]; do
+    [[ -n $line && $line != \#* ]] || continue
+    if [[ $line != *=* ]]; then
+      echo "Error: the image manifest $manifest is malformed: $line" >&2
+      return 1
+    fi
+    key=${line%%=*}
+    value=${line#*=}
+    case $key in
+      format) format=$value ;;
+      platform) platform=$value ;;
+    esac
+  done <"$manifest"
+
+  if [[ $format != "1" ]]; then
+    echo "Error: the image manifest $manifest is not format=1" >&2
+    return 1
+  fi
+  case $platform in
+    apple-silicon) platform=aarch64-apple ;;
+    generic-aarch64) platform=aarch64 ;;
+    generic) platform=x86 ;;
+  esac
+  if [[ ! $platform =~ ^(x86|aarch64|aarch64-apple)$ ]]; then
+    echo "Error: the image manifest $manifest names no known platform: ${platform:-none}" >&2
+    return 1
+  fi
+
+  echo "$platform"
+}
+
+if [[ -n $image_dir ]] && [[ -e $manifest || -L $manifest ]] && ! booted; then
+  platform=$(image_platform) || exit 1
+  if [[ $platform == "x86" ]]; then
+    [[ $machine != "aarch64" ]] || contradiction "$manifest names $platform hardware but the CPU is $machine"
+  else
+    [[ $machine == "aarch64" ]] || contradiction "$manifest names $platform hardware but the CPU is $machine"
+  fi
+  echo "$platform"
+  exit 0
+fi
+
+vendor=""
+vendor_source=""
+for source in "${sources[@]}"; do
+  [[ -r $source ]] || continue
+
+  apple=0
+  qcom=0
+  mapfile -d '' -t tokens <"$source"
+  for token in "${tokens[@]}"; do
+    [[ $token == "apple,"* ]] && apple=1
+    [[ $token == "qcom,"* ]] && qcom=1
+  done
+
+  if (( apple && qcom )); then
+    contradiction "$source names both Apple and Qualcomm hardware"
+  elif (( apple )); then
+    found=apple
+  elif (( qcom )); then
+    found=qcom
+  else
+    found=none
+  fi
+
+  if [[ -n $vendor && $vendor != "$found" ]]; then
+    contradiction "$vendor_source says $vendor but $source says $found"
+  fi
+  vendor=$found
+  vendor_source=$source
+done
+
+case $vendor in
+  apple | qcom)
+    [[ $machine == "aarch64" ]] || contradiction "$vendor_source names $vendor hardware but the CPU is $machine"
+    if [[ $vendor == "apple" ]]; then
+      echo aarch64-apple
+    else
+      echo aarch64
+    fi
+    ;;
+  *)
+    if [[ $machine == "aarch64" ]]; then
+      echo aarch64
+    else
+      echo x86
+    fi
+    ;;
+esac
@@ -2,5 +2,30 @@

 # omarchy:summary=Print the detected Hyprland touchpad or trackpad device name

-device=$(hyprctl devices -j | jq -r '[.mice[] | .name | select(test("touchpad|trackpad"; "i"))] | first // empty')
+mice=$(hyprctl devices -j | jq -r '.mice[].name')
+device=$(grep -iE -m1 'touchpad|trackpad' <<<"$mice")
+
+# Some touchpads carry neither word (Apple Silicon's is "apple-mtp-multi-touch"),
+# so ask udev which mouse is one. The name alone can't say: some touchscreens'
+# mouse interfaces are called multi-touch too.
+if [[ -z $device ]]; then
+  input_class="${OMARCHY_INPUT_CLASS_PATH:-/sys/class/input}"
+  for event in "$input_class"/event*; do
+    [[ -r $event/device/name ]] || continue
+    # Hyprland's name for a device: the kernel's, lowercased, with spaces,
+    # commas and newlines as dashes, and -1, -2 and so on after a name another
+    # device already took.
+    name=$(<"$event/device/name")
+    name=${name,,}
+    name=${name//[ ,$'\n']/-}
+    udevadm info --query=property "$event" 2>/dev/null | grep -Fxq 'ID_INPUT_TOUCHPAD=1' || continue
+    while IFS= read -r mouse; do
+      if [[ $mouse == "$name" || ( $mouse == "$name"-* && ${mouse#"$name"-} =~ ^[0-9]+$ ) ]]; then
+        device=$mouse
+        break 2
+      fi
+    done <<<"$mice"
+  done
+fi
+
 [[ -n $device ]] && echo "$device"
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+# omarchy:summary=Detect whether the CPU is x86_64.
+
+[[ $(uname -m) == "x86_64" ]]
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# omarchy:summary=Show or set window corners: theme, sharp, or rounded
+# omarchy:args=[theme|sharp|rounded]
+# omarchy:examples=omarchy hyprland corners | omarchy hyprland corners rounded
+
+TOGGLES_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/toggles/hypr"
+
+# Sharp and rounded are toggle files loaded after every theme, so they override
+# the corners of whichever theme is current. Theme removes both.
+if (( $# == 0 )); then
+  if [[ -f $TOGGLES_DIR/corners-sharp.lua ]]; then
+    echo "sharp"
+  elif [[ -f $TOGGLES_DIR/corners-rounded.lua ]]; then
+    echo "rounded"
+  else
+    echo "theme"
+  fi
+  exit 0
+fi
+
+case $1 in
+  theme) LABEL=$(omarchy-text "Corners follow the theme") ;;
+  sharp) LABEL=$(omarchy-text "Sharp corners for all themes") ;;
+  rounded) LABEL=$(omarchy-text "Rounded corners for all themes") ;;
+  *)
+    echo "Usage: omarchy-hyprland-corners [theme|sharp|rounded]" >&2
+    exit 1
+    ;;
+esac
+
+# Save the new choice before dropping the old one, so a failed save keeps it.
+if [[ $1 != "theme" ]]; then
+  mkdir -p "$TOGGLES_DIR" && cp "$OMARCHY_PATH/default/hypr/toggles/corners-$1.lua" "$TOGGLES_DIR/corners-$1.lua" || exit 1
+fi
+for mode in sharp rounded; do
+  [[ $mode == "$1" ]] || rm -f "$TOGGLES_DIR/corners-$mode.lua" || exit 1
+done
+
+hyprctl reload >/dev/null || exit 1
+omarchy-notification-send -g 󰘇 "$LABEL"
@@ -10,6 +10,7 @@ sync_clamshell() {
  (
    flock -n 9 || exit 0
    omarchy-hyprland-monitor-clamshell
+    omarchy-system-lid-inhibit
  ) 9>"$LOCK"
 }

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# omarchy:summary=Returns true when the compositor holds a session lock no other locker is alive to own
+# omarchy:args=<own-pid>
+# omarchy:hidden=true
+
+# Hyprland lets any client take over a held lock (misc:allow_session_lock_restore),
+# so a shell that recovers a lock it merely sees can take the live lock screen of
+# another shell, and strand it when it exits. A lock is stranded only while no
+# other Quickshell or hyprlock is running; until then the answer is undetermined,
+# so the caller keeps asking until that locker exits or it gives up.
+#
+# Exits 0 stranded, 1 unlocked, 2 undetermined. The caller passes its own pid,
+# as a crash re-execs the shell in place.
+omarchy-hyprland-session-locked || exit
+
+if pgrep -u "$UID" -x 'quickshell|qs|hyprlock' | grep -qvxF "$1"; then
+  exit 2
+fi
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# omarchy:summary=Show or set how see-through windows are: opaque, transparent, or glassy
+# omarchy:args=[opaque|transparent|glassy]
+# omarchy:examples=omarchy hyprland window transparency | omarchy hyprland window transparency glassy
+
+TOGGLES_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/toggles/hypr"
+
+# Opaque and glassy are toggle files loaded after every theme: opaque makes the
+# windows Omarchy makes transparent solid, and glassy blurs what is behind any
+# see-through window and gives terminals a see-through background. Transparent,
+# the default, removes both.
+current_mode() {
+  if [[ -f $TOGGLES_DIR/window-opaque.lua ]]; then
+    echo "opaque"
+  elif [[ -f $TOGGLES_DIR/window-glassy.lua ]]; then
+    echo "glassy"
+  else
+    echo "transparent"
+  fi
+}
+
+# Save the new choice before dropping the old one, so a failed save keeps it.
+save_mode() {
+  if [[ $1 != "transparent" ]]; then
+    mkdir -p "$TOGGLES_DIR" && cp "$OMARCHY_PATH/default/hypr/toggles/window-$1.lua" "$TOGGLES_DIR/window-$1.lua" || return 1
+  fi
+  local mode
+  for mode in opaque glassy; do
+    [[ $mode == "$1" ]] || rm -f "$TOGGLES_DIR/window-$mode.lua" || return 1
+  done
+}
+
+if (( $# == 0 )); then
+  current_mode
+  exit 0
+fi
+
+case $1 in
+  opaque) LABEL=$(omarchy-text "Opaque windows") ;;
+  transparent) LABEL=$(omarchy-text "Transparent windows") ;;
+  glassy) LABEL=$(omarchy-text "Glassy windows") ;;
+  *)
+    echo "Usage: omarchy-hyprland-window-transparency [opaque|transparent|glassy]" >&2
+    exit 1
+    ;;
+esac
+
+# A theme switch renders the next theme's terminal files from the saved choice
+# and then replaces the current theme, so the choice and the glass written into
+# the current theme are changed under its lock, or the switch could drop them.
+exec 9>"${XDG_RUNTIME_DIR:-/tmp}/omarchy-theme-set.lock"
+flock 9
+
+# A choice whose glass cannot be written is taken back, so the saved choice
+# is always the one on screen.
+previous=$(current_mode)
+save_mode "$1" || exit 1
+if ! omarchy-theme-set-glass; then
+  save_mode "$previous"
+  omarchy-theme-set-glass
+  exit 1
+fi
+flock -u 9
+
+hyprctl reload >/dev/null || exit 1
+omarchy-restart-terminal
+omarchy-theme-set-foot
+omarchy-restart-btop
+omarchy-notification-send -g 󰂵 "$LABEL"
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# omarchy:summary=Print the layout of a workspace: dwindle, scrolling, or floating
+# omarchy:args=[workspace-id]
+
+if [[ -n $1 ]]; then
+  WORKSPACE_ID=$1
+  TILED_LAYOUT=$(hyprctl workspaces -j | jq -r --arg id "$WORKSPACE_ID" 'first(.[] | select((.id | tostring) == $id) | .tiledLayout) // empty')
+else
+  read -r WORKSPACE_ID TILED_LAYOUT < <(hyprctl activeworkspace -j | jq -r '"\(.id) \(.tiledLayout // "")"')
+fi
+
+MODES_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/workspace-layouts"
+
+# Hyprland only reports the tiled layout, and floating is not one, so the mode is
+# read back from the file omarchy-hyprland-workspace-layout-toggle wrote. Files
+# saved before floating existed name no mode, and a workspace without a mode of
+# its own follows the default layout.
+if [[ $WORKSPACE_ID =~ ^[0-9]+$ ]] && (( WORKSPACE_ID >= 1 )); then
+  MODE=$(sed -n 's/.*mode = "\([a-z]*\)".*/\1/p' "$MODES_DIR/$WORKSPACE_ID.lua" 2>/dev/null)
+
+  if [[ -z $MODE && -f $MODES_DIR/default.lua ]]; then
+    MODE=$(omarchy-hyprland-workspace-layout-default)
+  fi
+fi
+
+MODE=${MODE:-$TILED_LAYOUT}
+echo "${MODE:-dwindle}"
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# omarchy:summary=Show or set the layout of workspaces without one of their own: dwindle, scrolling, or floating
+# omarchy:args=[dwindle|scrolling|floating]
+# omarchy:examples=omarchy hyprland workspace layout default | omarchy hyprland workspace layout default scrolling
+
+MODES_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/workspace-layouts"
+DEFAULT_FILE="$MODES_DIR/default.lua"
+
+# Without a saved default, Hyprland's own layout is the default, which the
+# user's looknfeel may have set.
+if (( $# == 0 )); then
+  MODE=$(sed -n 's/.*default = "\([a-z]*\)".*/\1/p' "$DEFAULT_FILE" 2>/dev/null)
+  [[ -n $MODE ]] || MODE=$(hyprctl getoption general.layout -j 2>/dev/null | jq -r '.str // empty')
+  echo "${MODE:-dwindle}"
+  exit 0
+fi
+
+case $1 in
+  dwindle) LABEL=tiling ;;
+  scrolling | floating) LABEL=$1 ;;
+  *)
+    echo "Usage: omarchy-hyprland-workspace-layout-default [dwindle|scrolling|floating]" >&2
+    exit 1
+    ;;
+esac
+
+# Saved even for dwindle, so the choice also wins over a layout set in the
+# user's own looknfeel. Workspaces given a layout with Super + L keep theirs.
+mkdir -p "$MODES_DIR"
+printf 'o.workspace_mode({ default = "%s" })\n' "$1" >"$DEFAULT_FILE"
+
+hyprctl reload >/dev/null
+omarchy-shell -q omarchy.workspaces refresh
+omarchy-notification-send -g 󱂬 "$(omarchy-text "New workspaces use the %1 layout" "$LABEL")"
@@ -1,21 +1,69 @@
 #!/bin/bash

-# omarchy:summary=Toggle the layout on the current active workspace between dwindle and scrolling
+# omarchy:summary=Cycle the current active workspace through the dwindle, scrolling, and floating layouts
+# omarchy:args=[back]
+
+DIRECTION=${1:-next}
+if [[ $DIRECTION != "next" && $DIRECTION != "back" ]]; then
+  echo "Usage: omarchy-hyprland-workspace-layout-toggle [back]" >&2
+  exit 1
+fi

 ACTIVE_WORKSPACE=$(hyprctl activeworkspace -j | jq -r '.id')
-[[ $ACTIVE_WORKSPACE =~ ^-?[0-9]+$ ]] || exit 1
-CURRENT_LAYOUT=$(hyprctl activeworkspace -j | jq -r '.tiledLayout')
-LAYOUTS_DIR="$HOME/.local/state/omarchy/workspace-layouts"
-LAYOUT_FILE="$LAYOUTS_DIR/$ACTIVE_WORKSPACE.lua"
+# Named workspaces report a negative id, and Hyprland reads a leading "-" as a
+# selector relative to the current workspace: targeting one lands on workspace 1
+# and reconfigures that instead.
+[[ $ACTIVE_WORKSPACE =~ ^[0-9]+$ ]] || exit 1
+MODES_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/workspace-layouts"
+MODE_FILE="$MODES_DIR/$ACTIVE_WORKSPACE.lua"

-case "$CURRENT_LAYOUT" in
-  dwindle) NEW_LAYOUT=scrolling ;;
-  *) NEW_LAYOUT=dwindle ;;
-esac
+CURRENT_MODE=$(omarchy-hyprland-workspace-layout-current)

-mkdir -p "$LAYOUTS_DIR"
-printf 'hl.workspace_rule({ workspace = "%s", layout = "%s" })\n' "$ACTIVE_WORKSPACE" "$NEW_LAYOUT" >"$LAYOUT_FILE"
+if [[ $DIRECTION == "back" ]]; then
+  case "$CURRENT_MODE" in
+    dwindle) NEW_MODE=floating ;;
+    floating) NEW_MODE=scrolling ;;
+    *) NEW_MODE=dwindle ;;
+  esac
+else
+  case "$CURRENT_MODE" in
+    dwindle) NEW_MODE=scrolling ;;
+    scrolling) NEW_MODE=floating ;;
+    *) NEW_MODE=dwindle ;;
+  esac
+fi

-hyprctl eval "hl.workspace_rule({ workspace = \"$ACTIVE_WORKSPACE\", layout = \"$NEW_LAYOUT\" })" >/dev/null 2>&1 || \
-  hyprctl keyword workspace "$ACTIVE_WORKSPACE, layout:$NEW_LAYOUT"
-omarchy-notification-send -g 󱂬 "$(omarchy-text "Workspace layout set to %1" "$NEW_LAYOUT")"
+APPLY="o.workspace_mode({ workspace = \"$ACTIVE_WORKSPACE\", mode = \"$NEW_MODE\" })"
+
+# Saving a mode that did not apply would leave the file naming one layout while
+# the screen shows another, and restore it at the next login.
+APPLIED=0
+if hyprctl eval "$APPLY" >/dev/null 2>&1; then
+  APPLIED=1
+fi
+
+if (( ! APPLIED )); then
+  omarchy-notification-send -g 󱂬 "$(omarchy-text "Workspace layout needs a Hyprland reload")"
+elif [[ $NEW_MODE == "$(omarchy-hyprland-workspace-layout-default)" ]] && rm -f "$MODE_FILE"; then
+  # Cycled onto the default, a workspace goes back to following it, so a later
+  # change of the default reaches it too.
+  omarchy-notification-send -g 󱂬 "$(omarchy-text "Workspace layout set to %1" "$NEW_MODE")"
+elif mkdir -p "$MODES_DIR" && printf '%s\n' "$APPLY" >"$MODE_FILE"; then
+  omarchy-notification-send -g 󱂬 "$(omarchy-text "Workspace layout set to %1" "$NEW_MODE")"
+else
+  # The mode is on screen but nothing will bring it back, and the next press
+  # reads the mode from this file, so say so rather than counting it as set.
+  omarchy-notification-send -g 󱂬 "$(omarchy-text "Workspace layout set to %1 but could not be saved" "$NEW_MODE")"
+fi
+
+# The bar shows the focused workspace's layout.
+if (( APPLIED )); then
+  omarchy-shell -q omarchy.workspaces refresh
+fi
+
+# Titlebars and shadows are set up while the config loads, and only
+# when something floats, so the first floating workspace needs a reload to get
+# them. Once the titlebar plugin is in, later ones have them already.
+if (( APPLIED )) && [[ $NEW_MODE == "floating" ]] && ! hyprctl plugin list -j 2>/dev/null | jq -e 'any(.[]?; .name == "hyprbars")' >/dev/null 2>&1; then
+  hyprctl reload >/dev/null
+fi
@@ -1,9 +1,22 @@
 #!/bin/bash

-# omarchy:summary=Configure or inspect the input method selected at installation
-# omarchy:args=<status|configure [--seed|--defaults] [none|mozc|hangul|pinyin|chewing]>
+# omarchy:summary=Configure, inspect, or switch input methods
+# omarchy:args=<status|cycle [back]|configure --seed|--defaults>
 # omarchy:hidden=true

 set -euo pipefail

-python "$OMARCHY_PATH/default/input-methods/configure.py" "$@"
+if [[ ${1:-} == "cycle" ]]; then
+  direction=${2:-next}
+  if [[ $direction != "next" && $direction != "back" ]]; then
+    echo "Usage: omarchy-input-method cycle [back]" >&2
+    exit 1
+  fi
+  # The shell's reader retains a choice made while nothing has focus.
+  if [[ $(omarchy-shell shell cycleInput "$direction") != "ok" ]]; then
+    echo "The shell's input reader is not running" >&2
+    exit 1
+  fi
+else
+  /usr/bin/python3 "$OMARCHY_PATH/default/input-methods/configure.py" "$@"
+fi
@@ -8,6 +8,8 @@ set -e

 source "$OMARCHY_PATH/install/helpers/browser-policy.sh"

+opt_path="${OMARCHY_OPT_PATH:-/opt}"
+
 setup_chromium_policy_directory() {
  browser_policy_setup_dir "$1"
 }
@@ -17,6 +19,17 @@ announce_browser_installed() {
  echo "$1 browser installed. Make it the default via Setup > Defaults > Browser."
 }

+# The widevine package registers its CDM for Chromium and Firefox only; Brave
+# looks for one in its own install directory.
+link_widevine_cdm() {
+  local cdm="$opt_path/WidevineCdm/chromium"
+  local install_dir="$opt_path/$1"
+
+  if [[ -d $cdm && -d $install_dir && ! -e $install_dir/WidevineCdm ]]; then
+    as_root ln -sfn "$cdm" "$install_dir/WidevineCdm"
+  fi
+}
+
 copy_chromium_flags() {
  mkdir -p ~/.config
  cp -f "$OMARCHY_PATH/config/chromium-flags.conf" "$1"
@@ -37,6 +50,7 @@ chromium)
  setup_chromium_policy_directory /etc/chromium/policies/managed
  copy_chromium_flags ~/.config/chromium-flags.conf
  omarchy-theme-set-browser
+  omarchy-lifecycle-dispatch post-install chromium
  announce_browser_installed "Chromium"
  ;;
 chrome)
@@ -46,6 +60,7 @@ chrome)
  setup_chromium_policy_directory /etc/opt/chrome/policies/managed
  copy_chromium_flags ~/.config/chrome-flags.conf
  omarchy-theme-set-browser
+  omarchy-lifecycle-dispatch post-install chrome
  announce_browser_installed "Chrome"
  ;;
 edge)
@@ -55,6 +70,7 @@ edge)
  setup_chromium_policy_directory /etc/opt/edge/policies/managed
  copy_chromium_flags ~/.config/microsoft-edge-stable-flags.conf
  omarchy-theme-set-browser
+  omarchy-lifecycle-dispatch post-install edge
  announce_browser_installed "Edge"
  ;;
 brave)
@@ -63,7 +79,9 @@ brave)

  setup_chromium_policy_directory /etc/brave/policies/managed
  copy_chromium_flags ~/.config/brave-flags.conf
+  link_widevine_cdm brave-bin
  omarchy-theme-set-browser
+  omarchy-lifecycle-dispatch post-install brave
  announce_browser_installed "Brave"
  ;;
 brave-origin)
@@ -72,7 +90,9 @@ brave-origin)

  setup_chromium_policy_directory /etc/brave/policies/managed
  copy_chromium_flags ~/.config/brave-origin-flags.conf
+  link_widevine_cdm brave-origin-bin
  omarchy-theme-set-browser
+  omarchy-lifecycle-dispatch post-install brave-origin
  announce_browser_installed "Brave Origin"
  ;;
 firefox)
@@ -81,6 +101,7 @@ firefox)

  browser_policy_setup_firefox_distribution /usr/lib/firefox/distribution
  setup_firefox_wayland
+  omarchy-lifecycle-dispatch post-install firefox
  announce_browser_installed "Firefox"
  ;;
 zen)
@@ -89,6 +110,7 @@ zen)

  browser_policy_setup_firefox_distribution /opt/zen-browser/distribution
  setup_firefox_wayland
+  omarchy-lifecycle-dispatch post-install zen
  announce_browser_installed "Zen"
  ;;
 *)
@@ -92,6 +92,9 @@ phoenix)
  ;;
 rust)
  echo -e "Installing Rust...\n"
+  # Crates that generate C bindings with bindgen, including Ruby gems built
+  # with rb-sys, load libclang from clang.
+  omarchy-pkg-add clang
  bash -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y
  ;;
 java)
@@ -5,6 +5,8 @@

 set -e

+voxtype_lib_path="${OMARCHY_VOXTYPE_LIB_PATH:-/usr/lib/voxtype}"
+
 if omarchy-cmd-missing voxtype; then
  if gum confirm "Install Voxtype + AI model (~150MB) to enable dictation?"; then
    omarchy-pkg-add wtype voxtype-bin
@@ -17,7 +19,8 @@ config_home="${XDG_CONFIG_HOME:-$HOME/.config}"
 mkdir -p "$config_home/voxtype"
 if [[ ! -e $config_home/voxtype/config.toml ]]; then
  cp "$OMARCHY_PATH/default/voxtype/config.toml" "$config_home/voxtype/"
-  if omarchy-hw-vulkan; then
+  # A Vulkan runtime is not enough: aarch64 voxtype-bin ships no Vulkan backend.
+  if omarchy-hw-vulkan && [[ -x $voxtype_lib_path/voxtype-vulkan ]]; then
    voxtype setup gpu --enable || true
  fi
 fi
@@ -15,6 +15,7 @@ echo "Installing Steam..."
 # GPU.
 omarchy-install-gaming-gpu-lib32
 omarchy-pkg-add steam
+omarchy-lifecycle-dispatch post-install steam

 echo ""
 echo "Steam will start automatically now. This might take a while..."
@@ -15,17 +15,15 @@ if gum confirm "Are you sure you want to restore all preinstalled web apps, TUI
    aether \
    cliamp \
    libreoffice-fresh \
-    xournalpp \
    pinta \
    obsidian \
-    obs-studio \
-    kdenlive \
    moonlight-qt \
    omacut \
    monologue \
    omacalc \
    omawrite \
-    hype; then
+    hype \
+    signed; then
    echo -e "\nPreinstalls are still marked as removed. Fix the errors above and try again."
    exit 1
  fi
@@ -0,0 +1,200 @@
+#!/bin/bash -p
+
+# omarchy:summary=Run a fixed lifecycle operation through the platform's own packages
+# omarchy:args=[--resolve] <operation> [arguments...]
+# omarchy:requires-sudo=true
+# omarchy:hidden=true
+
+# Provisioning, factory reset, update, boot, system and user setup and app
+# installs call a fixed set of operations here. A platform that needs its own
+# handling registers directories of root-owned entrypoints below; on every other
+# platform each operation is a no-op and the caller keeps its generic path. The
+# contract is docs/lifecycle-dispatch.md.
+#
+# --resolve prints the entrypoint an operation would run, or nothing when it is
+# a no-op here, so a caller can choose between a platform implementation and
+# its own generic path.
+#
+# Root runs this from provisioning, factory reset and update, and it decides
+# what runs as root. -p keeps a root caller's environment from running code in
+# this shell before the first line (bash then ignores BASH_ENV and exported
+# functions), so a launch without it is refused.
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup." >&2
+  exit 126
+fi
+
+set -euo pipefail
+
+operations=(
+  provision-prepare provision-commit provision-verify
+  reset-prepare reset-verify reset-commit reset-rollback
+  update-verify update-takeover
+  luks-slots
+  setup-boot setup-system setup-user
+  post-install pre-remove
+)
+
+# Run as the user, never as root, with that user's session.
+user_operations=(setup-user post-install pre-remove)
+
+usage() {
+  echo "Usage: omarchy-lifecycle-dispatch [--resolve] <operation> [arguments...]" >&2
+  echo "Operations: ${operations[*]}" >&2
+  exit 2
+}
+
+listed() {
+  local item=$1 candidate
+  shift
+  for candidate in "$@"; do
+    [[ $candidate == "$item" ]] && return 0
+  done
+  return 1
+}
+
+resolve=0
+if [[ ${1:-} == "--resolve" ]]; then
+  resolve=1
+  shift
+fi
+operation=${1:-}
+[[ -n $operation ]] || usage
+shift
+listed "$operation" "${operations[@]}" || usage
+
+# A privileged caller must not let its environment choose what runs as root:
+# root resolves only the fixed paths below, and the detector beside this file
+# ignores its fixture roots. Fixture roots exist for unprivileged tests.
+fixed_path=/usr/local/sbin:/usr/local/bin:/usr/bin
+detect=("$(PATH=$fixed_path dirname -- "${BASH_SOURCE[0]}")/omarchy-hw-platform")
+if (( EUID == 0 )); then
+  export PATH=$fixed_path
+  detect=(/usr/bin/env -i PATH="$fixed_path" "${detect[@]}")
+  root=""
+else
+  root=${OMARCHY_LIFECYCLE_ROOT:-}
+  root=${root%/}
+  if [[ -n $root && $root != /* ]]; then
+    echo "Error: OMARCHY_LIFECYCLE_ROOT must be an absolute path" >&2
+    exit 1
+  fi
+fi
+
+if ! platform=$("${detect[@]}"); then
+  echo "Error: cannot determine the hardware platform for $operation" >&2
+  exit 1
+fi
+
+# x86 and plain aarch64 machines (Snapdragon laptops among them) have no
+# registered package: every operation is a no-op there and callers keep their
+# generic path.
+# Apple Silicon's boot operations belong to omarchy-mac-boot, and its system and
+# user setup and app-install hooks to omarchy-mac (both omacom/omarchy-mac-pkgs).
+# Provisioning and factory reset have no other path on a Mac, only update-verify
+# checks what an update left in its boot chain, its boot checks prove the kept
+# LUKS slots that luks-slots records, and hardware setup has no other way to run
+# the Mac's boot setup (setup-boot), so those operations are required. So is
+# update-takeover: the Mac boot chain and its image own files no package does,
+# and a Mac whose boot package can't vouch for a takeover keeps them. Setup and
+# the app-install hooks are optional: a Mac without omarchy-mac keeps Omarchy's
+# generic setup and installs. Moving an operation to required also changes
+# apple_optional in test/shell.d/lifecycle-dispatch-test.sh and the Apple column
+# and registration table in docs/lifecycle-dispatch.md.
+case $platform:$operation in
+  aarch64-apple:setup-system | aarch64-apple:setup-user | aarch64-apple:post-install | aarch64-apple:pre-remove)
+    implementation=/usr/lib/omarchy/mac
+    package=omarchy-mac
+    required=()
+    ;;
+  aarch64-apple:*)
+    implementation=/usr/lib/omarchy/mac-boot
+    package=omarchy-mac-boot
+    required=(
+      provision-prepare provision-commit provision-verify
+      reset-prepare reset-verify reset-commit reset-rollback
+      update-verify update-takeover
+      luks-slots
+      setup-boot
+    )
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+
+# Checked once the platform registers the operation, so an installer run with
+# sudo still works where the hook is a no-op.
+if listed "$operation" "${user_operations[@]}" && (( EUID == 0 )); then
+  echo "Error: $operation runs as the user, never as root" >&2
+  exit 1
+fi
+
+# Every path from the entrypoint up to / (or the fixture root) must be a real
+# file or directory owned by root, or by the unprivileged caller inside a
+# fixture root, and writable by nobody else.
+trusted() {
+  local path=$1 top=${root:-/} owner mode
+
+  [[ -f $path && -x $path ]] || return 1
+  while true; do
+    [[ ! -L $path ]] || return 1
+    read -r owner mode < <(stat -c '%u %a' -- "$path") || return 1
+    if (( owner != 0 )); then
+      [[ -n $root ]] && (( EUID != 0 && owner == EUID )) || return 1
+    fi
+    (( (8#$mode & 8#022) == 0 )) || return 1
+    [[ $path != "$top" ]] || return 0
+    [[ $path != "/" ]] || return 1
+    path=$(dirname -- "$path")
+  done
+}
+
+entrypoint=$root$implementation/$operation
+
+# The package's own pacman record tells a machine without it from one whose
+# copy predates the operation.
+installed_version() {
+  local record
+  for record in "$root/var/lib/pacman/local/$package"-[0-9]*/; do
+    [[ -d $record ]] || continue
+    record=${record%/}
+    printf '%s\n' "${record##*/"$package"-}"
+    return 0
+  done
+  return 1
+}
+
+# 3 is a machine without the platform's boot package at all, which a caller may
+# tell apart from a failure; 1 is everything else.
+if [[ ! -e $entrypoint && ! -L $entrypoint ]]; then
+  if listed "$operation" "${required[@]}"; then
+    if version=$(installed_version); then
+      echo "Error: $operation on $platform needs $implementation/$operation, which $package $version does not provide; update $package" >&2
+      exit 1
+    fi
+    echo "Error: $operation on $platform needs $package, which provides $implementation/$operation; it is not installed" >&2
+    exit 3
+  fi
+  exit 0
+fi
+
+if ! trusted "$entrypoint"; then
+  echo "Error: refusing $implementation/$operation: it must be a root-owned executable file in root-owned directories, writable by no one else" >&2
+  exit 1
+fi
+
+if (( resolve )); then
+  printf '%s\n' "$entrypoint"
+  exit 0
+fi
+
+# A user operation also gets the user's home and session, when there is one,
+# and nothing else.
+environment=(PATH="$fixed_path")
+if listed "$operation" "${user_operations[@]}"; then
+  for name in HOME USER XDG_CONFIG_HOME XDG_STATE_HOME XDG_RUNTIME_DIR DBUS_SESSION_BUS_ADDRESS WAYLAND_DISPLAY OMARCHY_PATH; do
+    [[ -z ${!name:-} ]] || environment+=("$name=${!name}")
+  done
+fi
+exec /usr/bin/env -i "${environment[@]}" "$entrypoint" "$@"
@@ -9,12 +9,25 @@ declare -A LUA_BIND_KEY_MAP
 declare -A LUA_BIND_DISPATCHER_MAP
 declare -A LUA_BIND_ARG_MAP

+# A platform package can name keys the way its keyboards print them: one
+# "<keysym> <name>" per line (on a MacBook, XF86MonBrightnessUp is F2), in the
+# fixed platform root, which no environment variable moves.
+key_names_file=/usr/share/omarchy-platform/key-names
+
 # Hyprland reports XKB keycodes for code: bindings. Resolve them to symbols
 # via the compiled keymap, with a small fallback for common keys so the menu
 # remains readable if xkbcli cannot resolve a symbol.
 parse_keycodes() {
-  awk '
+  awk -v key_names="$key_names_file" '
    BEGIN {
+      while ((getline line < key_names) > 0) {
+        # Blanks around a line and a CRLF line end read the same, as in
+        # displays.conf.
+        gsub(/^[ \t\r]+|[ \t\r]+$/, "", line)
+        if (split(line, name_parts, /[ \t]+/) == 2 && name_parts[1] ~ /^[A-Za-z0-9_]+$/ && name_parts[2] ~ /^[A-Za-z0-9_]+$/) key_name[name_parts[1]] = name_parts[2]
+      }
+      close(key_names)
+
      split("10=1 11=2 12=3 13=4 14=5 15=6 16=7 17=8 18=9 19=0 20=MINUS 21=EQUAL 59=COMMA 60=PERIOD 61=SLASH", fallbacks, " ")
      for (i in fallbacks) {
        separator = index(fallbacks[i], "=")
@@ -59,6 +72,13 @@ parse_keycodes() {
        symbol = mouse_symbol[code]
        if (symbol == "") symbol = "mouse:" code
        sub("mouse:" code, symbol)
+      } else if ((first = index($0, ",")) > 0) {
+        # Only the key (the second field) is renamed: the description, the
+        # dispatcher and its argument are left as they are.
+        rest = substr($0, first + 1)
+        second = index(rest, ",")
+        key = second > 0 ? substr(rest, 1, second - 1) : rest
+        if (key in key_name) $0 = substr($0, 1, first) key_name[key] (second > 0 ? substr(rest, second) : "")
      }

      print
@@ -81,7 +101,9 @@ build_lua_bind_cache() {
    LUA_BIND_DISPATCHER_MAP["$cache_key"]="$dispatcher"
    LUA_BIND_ARG_MAP["$cache_key"]="$arg"
  done < <(
-    lua <<'LUA'
+    # -E keeps LUA_INIT and LUA_PATH from the environment out of the scan, which
+    # loads the user's config.
+    lua -E - <<'LUA'
 local modifiers = { SHIFT = 1, CTRL = 4, CONTROL = 4, ALT = 8, SUPER = 64 }

 local function split_keys(keys)
@@ -332,7 +354,6 @@ dynamic_bindings() {
 static_bindings() {
  echo "SHIFT ALT,L,Copy URL from Web App,sendshortcut,SHIFT ALT,L,"
  echo "SHIFT ALT,D,Download Video from Web App,sendshortcut,SHIFT ALT,D,"
-  echo "CTRL SHIFT,SPACE,Switch input language,exec,fcitx5-remote -t"
 }

 # Actions Omarchy binds to a second chord meant as an alternative, named one at
@@ -536,6 +557,7 @@ keybindings_cache_key() {
  {
    printf 'v15\n'
    hyprctl devices 2>/dev/null | grep -F 'active keymap:'
+    cat "$key_names_file" 2>/dev/null
    hyprctl binds 2>/dev/null
  } | sha256sum | awk '{ print $1 }'
 }
@@ -1,9 +1,9 @@
 #!/bin/bash

-# omarchy:summary=Pick one option from a menu
+# omarchy:summary=Pick one or multiple options from a menu
 # omarchy:group=menu
 # omarchy:name=select
-# omarchy:args=prompt [option...] [-- menu args...]
+# omarchy:args=prompt [option...] [-- --multiple --selected <value> --on-change <command-json> --change-key <key> --width <pixels> --maxheight <pixels>]
 # omarchy:examples=omarchy menu select Format jpg png|omarchy-menu-select Resolution 4k 1080p 720p -- --width 400

 # An option may lead with an icon, as "<glyph><TAB><label>", and may trail a
@@ -12,6 +12,12 @@
 # alone; an option with a subtext returns "<label><TAB><subtext>", so callers
 # with same-named rows get the subtext back as the stable key.

+# With --multiple, clicking/Enter toggles rows and Apply returns a JSON array.
+# --on-change takes a JSON command array; each toggle runs it with the selection
+# JSON appended, applies immediately, and needs no Apply row. A successful
+# command may print a JSON array of actual selections to update the checkmarks.
+# --selected takes a returned value (label plus any subtext), and can be repeated.
+
 set -euo pipefail

 if (( $# < 1 )); then
@@ -25,12 +31,43 @@ shift
 options=()
 menu_width=""
 menu_maxheight=""
+multiple=0
+on_change="[]"
+change_key=""
+selected=()

 while (( $# > 0 )); do
  if [[ $1 == "--" ]]; then
    shift
    while (( $# > 0 )); do
      case "$1" in
+        --on-change)
+          shift
+          if (( $# == 0 )); then
+            echo "omarchy-menu-select: --on-change requires a JSON command array" >&2
+            exit 1
+          fi
+          on_change="$1"
+          ;;
+        --change-key)
+          shift
+          if (( $# == 0 )); then
+            echo "omarchy-menu-select: --change-key requires a value" >&2
+            exit 1
+          fi
+          change_key="$1"
+          ;;
+        --multiple)
+          multiple=1
+          ;;
+        --selected)
+          shift
+          if (( $# == 0 )); then
+            echo "omarchy-menu-select: --selected requires a value" >&2
+            exit 1
+          fi
+          selected+=("$1")
+          ;;
        --width)
          shift
          if (( $# == 0 )); then
@@ -73,20 +110,25 @@ rm -f "$done_file"
 trap 'rm -f "$selection_file" "$done_file"' EXIT

 options_json=$(perl -MEncode=decode -MJSON::PP=encode_json -e 'print encode_json([map { decode("UTF-8", $_) } @ARGV])' "${options[@]}")
+selected_json=$(perl -MEncode=decode -MJSON::PP=encode_json -e 'print encode_json([map { decode("UTF-8", $_) } @ARGV])' "${selected[@]}")
 payload=$(perl -MEncode=decode -MJSON::PP=encode_json,decode_json -e '
  my $payload = {
    mode => "select",
    prompt => decode("UTF-8", $ARGV[0]),
    options => decode_json($ARGV[1]),
+    multiple => $ARGV[6] ? JSON::PP::true : JSON::PP::false,
+    selected => decode_json($ARGV[7]),
+    onChange => decode_json($ARGV[8]),
+    changeKey => $ARGV[9],
    selectionFile => decode("UTF-8", $ARGV[2]),
    doneFile => decode("UTF-8", $ARGV[3])
  };
  $payload->{width} = int($ARGV[4]) if length($ARGV[4] // "");
  $payload->{maxHeight} = int($ARGV[5]) if length($ARGV[5] // "");
  print encode_json($payload)
-' "$prompt" "$options_json" "$selection_file" "$done_file" "$menu_width" "$menu_maxheight")
+' "$prompt" "$options_json" "$selection_file" "$done_file" "$menu_width" "$menu_maxheight" "$multiple" "$selected_json" "$on_change" "$change_key")

-omarchy-shell shell summon omarchy.menu "$payload" >/dev/null
+omarchy-shell shell summon omarchy.menu "$payload" >/dev/null || exit 2

 while [[ ! -e $done_file ]]; do
  sleep 0.05
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# omarchy:summary=Print the default package set for this computer's platform, or for the named one: the base list plus its architecture's and platform's additions.
+# omarchy:args=[x86|aarch64|aarch64-apple]
+# omarchy:hidden=true
+
+set -eo pipefail
+
+platform=${1:-}
+if [[ -z $platform ]]; then
+  platform=$(omarchy-hw-platform)
+fi
+
+# Image builders written before the platform names settled pass the old ones.
+case $platform in
+  apple-silicon) platform=aarch64-apple ;;
+  generic-aarch64) platform=aarch64 ;;
+  generic) platform=x86 ;;
+esac
+
+case $platform in
+  x86) lists=(base) ;;
+  aarch64) lists=(base aarch64) ;;
+  aarch64-apple) lists=(base aarch64 "$platform") ;;
+  *)
+    echo "Error: unknown platform '$platform'" >&2
+    exit 1
+    ;;
+esac
+
+# The base list always exists. An architecture or platform with nothing to add
+# has no list of its own.
+files=()
+for list in "${lists[@]}"; do
+  file="$OMARCHY_PATH/install/omarchy-$list.packages"
+  if [[ $list == "base" || -f $file ]]; then
+    files+=("$file")
+  fi
+done
+
+names() {
+  sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' "$@"
+}
+
+# One name per line, first occurrence kept, in list order. An aarch64 platform
+# leaves out the base packages that only x86_64 builds.
+if [[ $platform == "x86" ]]; then
+  names "${files[@]}" | awk '!seen[$0]++'
+else
+  names "${files[@]}" | awk -v skips=<(names "$OMARCHY_PATH/install/omarchy-x86_64-only.packages") '
+    BEGIN { while ((getline name < skips) > 0) skip[name] = 1 }
+    !skip[$0] && !seen[$0]++'
+fi
@@ -56,6 +56,7 @@ if [[ -z ${profile:-} ]] || ! profile_available "$profile"; then
 fi

 powerprofilesctl set "$profile" || exit
+omarchy-shell -q battery refreshPowerProfile >/dev/null 2>&1 || true

 if [[ -n $requested_profile ]]; then
  mkdir -p "$state_dir"
@@ -75,6 +75,10 @@ run_first_run_step "install agent setup post-update hook" \

 run_first_run_step "enable user systemd units" \
  bash "$OMARCHY_PATH/install/user/first-run/enable-user-units.sh"
+# Finalization ran it too, maybe without a session; the platform finishes what
+# needs one here.
+run_first_run_step "run the platform's user setup" \
+  omarchy-lifecycle-dispatch setup-user
 run_first_run_step "set GNOME theme" \
  bash "$OMARCHY_PATH/install/user/first-run/gnome-theme.sh"
 run_first_run_step "set GTK primary paste" \
@@ -0,0 +1,162 @@
+#!/bin/bash
+
+# omarchy:summary=Finish the hardware setup an image build deferred to this machine
+# omarchy:requires-sudo=true
+# omarchy:hidden=true
+
+# Started by omarchy-provision-hardware.service on every boot while an image's
+# deferred steps remain (see install/helpers/image-target.sh), and safe to call
+# from a platform's own first boot as well: runs are serialised. The first run
+# retires the image's build manifest, so from then on this machine is itself.
+# Steps run in order and each one that succeeds leaves the queue, so a failure
+# stops the run and the next run resumes at that step. Once the queue is empty
+# the initramfs is rebuilt if any step changed its configuration or asked for
+# the rebuild, and the service is disabled. With nothing deferred this does
+# nothing. A failed step, or a failure to make the pacman keyring the build
+# asked for, exits 75 (it stays queued for the next run); anything else that
+# stops the run, such as an untrusted manifest or queue, exits 1.
+
+set -euo pipefail
+
+fail() {
+  echo "Error: $*" >&2
+  exit 1
+}
+
+if (( EUID == 0 )); then
+  export OMARCHY_PATH=/usr/share/omarchy
+  export PATH=/usr/share/omarchy/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
+elif [[ -z ${OMARCHY_IMAGE_ROOT:-} || -z ${OMARCHY_PATH:-} ]]; then
+  fail "omarchy-provision-hardware must run as root"
+fi
+export OMARCHY_INSTALL=$OMARCHY_PATH/install
+export OMARCHY_INSTALL_USER=""
+
+source "$OMARCHY_INSTALL/helpers/logging.sh"
+source "$OMARCHY_INSTALL/helpers/image-target.sh"
+omarchy_image_init
+export OMARCHY_INSTALL_LOG_FILE=$omarchy_image_root/var/log/omarchy-install.log
+
+queue_present() {
+  [[ -e $omarchy_image_queue || -L $omarchy_image_queue ]]
+}
+
+# Anything left for the first boot: the manifest, a queue, or the keyring an
+# image build asked for, which is owed even when no step was queued.
+work_present() {
+  omarchy_image_manifest_present || queue_present || [[ -e $omarchy_image_keyring_request ]]
+}
+
+work_present || exit 0
+omarchy_image_lock || exit 1
+# Another run may have finished while this one waited for the lock.
+work_present || exit 0
+
+if omarchy_image_manifest_present; then
+  omarchy_image_read_manifest || exit 1
+  mv -f "$omarchy_image_manifest" "$omarchy_image_manifest.booted" || fail "could not retire $omarchy_image_manifest"
+  live_platform=$(omarchy-hw-platform) || live_platform=unknown
+  echo "First boot of an image built for $omarchy_image_platform, on $live_platform hardware"
+fi
+
+remaining=()
+if queue_present; then
+  [[ -f $omarchy_image_queue ]] && omarchy_image_trusted "$omarchy_image_queue" ||
+    fail "$omarchy_image_queue is not a root-owned regular file"
+  mapfile -t queued <"$omarchy_image_queue"
+  for step in "${queued[@]}"; do
+    [[ -z $step ]] || remaining+=("$step")
+  done
+fi
+
+# What the boot image is built from: mkinitcpio's configuration, the module
+# options its modconf hook copies in (leaves such as nvidia.sh write them), and
+# the kernel command line Limine's entry tool adds (leaves such as intel/fred.sh
+# add to it).
+initramfs_inputs() {
+  local file
+
+  for file in "$omarchy_image_root/etc/mkinitcpio.conf" "$omarchy_image_root/etc/mkinitcpio.conf.d/"* \
+    "$omarchy_image_root/etc/modprobe.d/"* "$omarchy_image_root/usr/lib/modprobe.d/"* \
+    "$omarchy_image_root/etc/default/limine" "$omarchy_image_root/etc/limine-entry-tool.d/"*; do
+    [[ -e $file ]] || continue
+    printf '%s\0' "$file"
+    cat -- "$file"
+  done | cksum
+}
+
+# Recorded before the first step and kept until a rebuild lands, so a step that
+# changed the initramfs and then failed or lost power still gets one.
+if [[ ! -f $omarchy_image_initramfs_baseline ]]; then
+  baseline=$(mktemp "$omarchy_image_dir/.initramfs-inputs.XXXXXX") &&
+    initramfs_inputs >"$baseline" && chmod 0644 "$baseline" && mv -f "$baseline" "$omarchy_image_initramfs_baseline" ||
+    fail "could not record the initramfs inputs"
+fi
+
+mkdir -p "$(dirname "$OMARCHY_INSTALL_LOG_FILE")"
+
+# A step that would build the boot image itself (a platform's boot setup) asks
+# for this run's rebuild instead, so the image is built once, after the last
+# step. The request stays on disk until that rebuild lands.
+export OMARCHY_IMAGE_BOOT_REBUILD=$omarchy_image_boot_rebuild
+# Tells a step it runs on the booted machine, after boot already brought up the
+# targets its units hang off (see install/hardware/bluetooth.sh).
+export OMARCHY_IMAGE_DEFERRED_HARDWARE=1
+
+# An image build asks for this machine's own pacman keyring (see
+# install/post-install/pacman.sh), made before any step installs a package. Any
+# keyring the build or an interrupted run left is replaced; the request stays
+# until a keyring is complete.
+if [[ -e $omarchy_image_keyring_request ]]; then
+  echo "Creating this machine's pacman keyring"
+  keyring=$omarchy_image_root/etc/pacman.d/gnupg
+  if ! { rm -rf "$keyring" && pacman-key --gpgdir "$keyring" --init &&
+    pacman-key --gpgdir "$keyring" --populate; } </dev/null >>"$OMARCHY_INSTALL_LOG_FILE" 2>&1; then
+    echo "Error: could not create the pacman keyring (see $OMARCHY_INSTALL_LOG_FILE); the next run retries it" >&2
+    exit 75
+  fi
+  rm -f "$omarchy_image_keyring_request"
+fi
+
+while (( ${#remaining[@]} )); do
+  step=${remaining[0]}
+  [[ $step == install/hardware/*.sh && $step != *..* ]] || fail "Deferred step is not a hardware setup step: $step"
+  script=$OMARCHY_PATH/$step
+
+  if [[ -L $script ]]; then
+    fail "Deferred step is a symlink: $step"
+  elif [[ ! -e $script ]]; then
+    echo "Skipping deferred hardware step $step: this Omarchy no longer ships it"
+  else
+    echo "Running deferred hardware step $step"
+    if ! run_logged "$script"; then
+      echo "Error: Deferred hardware step failed: $step (see $OMARCHY_INSTALL_LOG_FILE); the next run resumes here" >&2
+      exit 75
+    fi
+  fi
+
+  remaining=("${remaining[@]:1}")
+  omarchy_image_write_queue "${remaining[@]}" || fail "could not update $omarchy_image_queue"
+done
+
+if [[ -e $omarchy_image_boot_rebuild || $(initramfs_inputs) != "$(<"$omarchy_image_initramfs_baseline")" ]]; then
+  echo "Rebuilding the initramfs for the deferred hardware setup"
+  if omarchy-cmd-present limine-mkinitcpio; then
+    limine-mkinitcpio </dev/null >>"$OMARCHY_INSTALL_LOG_FILE" 2>&1
+  else
+    mkinitcpio -P </dev/null >>"$OMARCHY_INSTALL_LOG_FILE" 2>&1
+  fi || fail "Initramfs rebuild failed (see $OMARCHY_INSTALL_LOG_FILE); the next run retries it"
+  # The new image must be on disk before the queue that owes it is cleared.
+  sync || fail "could not flush the rebuilt initramfs to disk"
+fi
+rm -f "$omarchy_image_initramfs_baseline" "$omarchy_image_boot_rebuild"
+
+# Disabled, not deleted: a platform first boot that runs this while the
+# service's start job waits would otherwise fail that job at the next
+# daemon-reload. The emptied queue keeps the unit from running.
+rm -f "$omarchy_image_systemd_dir/multi-user.target.wants/$omarchy_image_unit"
+rm -f "$omarchy_image_queue"
+if (( EUID == 0 )); then
+  systemctl daemon-reload 2>/dev/null || true
+fi
+echo "Deferred hardware setup is complete"
@@ -9,7 +9,9 @@
 # behind. Asks for the user (the configurator's Step 2), creates it with the
 # groups system setup recorded, finalizes it offline from the stashed Node
 # tarball, re-keys LUKS from the throwaway install passphrase to the user's
-# password, and hands off to SDDM.
+# password, and hands off to SDDM. A platform whose boot package owns its boot
+# chain prepares it, drops the install key's unlock from it and records the
+# kept key slot through omarchy-lifecycle-dispatch.

 set -euo pipefail

@@ -33,6 +35,9 @@ fi

 export PATH="$OMARCHY_PATH/bin:$PATH"

+REKEY_STATE=$PROVISIONING_DIR/luks-rekey.state
+source "$OMARCHY_PATH/install/provisioning/luks-rekey.sh"
+
 # The shared setup form — the same questions, prompts, and validation the ISO
 # configurator's user step asks. The ISO vendors this very file out of the
 # runtime package it bundles, so an install and the first boot that finishes it
@@ -182,11 +187,11 @@ tips=(
  "Super + Space opens the Omarchy menu for apps, settings, and more"
  "Super + K shows all the key bindings"
  "Super is the Windows or command key on your keyboard"
-  "Use Xournal++ to sign PDFs"
+  "Sign PDFs and fill them in with Signed"
  "Share files with phones and laptops using LocalSend"
  "Turn any website into an app with Install > Web App in the menu"
  "Super + Return opens a terminal, Super + Shift + Return the browser"
-  "Edit images with Pinta, videos with Kdenlive, docs with LibreOffice"
+  "Edit images with Pinta, trim videos with Omacut, docs with LibreOffice"
  "Super + Ctrl + Print grabs text off the screen with OCR"
  "Print takes a screenshot, Alt + Print records the screen"
  "Set a reminder with Super + Ctrl + R"
@@ -579,14 +584,27 @@ greeter_screen() {
 # The keyboard step the ISO configurator runs — deferred to first boot for OEM
 # installs, so the machine's owner picks their own layout. Applied immediately
 # (live VT + persisted) so the password typed next, and the LUKS re-key below,
-# use the chosen layout.
+# use the chosen layout. A layout that did not take is asked for again: the
+# password form must never be typed in a layout the disk unlock won't use.
+# Three failures in a row mean the machine can't set a layout at all (a
+# missing or broken localectl, say), so the attempt fails and setup's own
+# retry-or-console screen takes over instead of asking forever.
 keyboard_form() {
-  local status
+  local status failures=0

  while true; do
    step "Let's setup your keyboard..."
    omarchy_prompt_keyboard && status=0 || status=$?
-    ((status == 0)) && break
+    if ((status == 0)); then
+      apply_keyboard "$keyboard" && break
+      if ((++failures >= 3)); then
+        log_step "no keyboard layout could be set after $failures attempts"
+        notice "Setup could not set a keyboard layout on this machine." 4
+        return 1
+      fi
+      notice "Could not set the ${keyboard_label:-$keyboard} keyboard layout. Choose it again." 4
+      continue
+    fi

    # Esc means "back", and nothing precedes the first screen, so re-ask.
    ((status == OMARCHY_FORM_BACK)) && continue
@@ -598,7 +616,6 @@ keyboard_form() {
    confirm_reboot && exec systemctl reboot
  done

-  apply_keyboard "$keyboard"
  omarchy_persist_input_selection
 }

@@ -610,21 +627,73 @@ confirm_reboot() {
  gum confirm --affirmative "Yes, reboot" --negative "No, keep setting up" "Reboot this machine?"
 }

-# Load the layout on the live VT and persist it for the installed system.
-# systemd-firstboot writes both the console KEYMAP and the XKB layout Hyprland
-# reads, matching what the ISO's configure_keyboard does at install time. A
-# keymap localectl doesn't know keeps the default rather than failing (defensive;
-# the picker no longer offers any such layout).
-apply_keyboard() {
-  local keymap="$1"
-  [[ $(tty 2>/dev/null) == /dev/tty* ]] && loadkeys "$keymap" 2>/dev/null || true
+# XKB settings for the form's keymaps that kbd-model-map lacks, as its rows for
+# the nearest keymap give them, so the desktop types what the console does:
+# kbd's cz is QWERTY and bg-cp1251 phonetic. Non-Latin layouts keep a US layout
+# to switch to, so the shared password stays typeable.
+keyboard_xkb_settings() {
+  local layout variant="" options=terminate:ctrl_alt_bksp
+  local switch=terminate:ctrl_alt_bksp,grp:shifts_toggle,grp_led:scroll

-  if localectl --no-pager list-keymaps 2>/dev/null | grep -qix "$keymap"; then
-    systemd-firstboot --keymap="$keymap" --force >>"$LOG_FILE" 2>&1 || \
-      localectl set-keymap "$keymap" >>"$LOG_FILE" 2>&1 || \
-      log_step "could not persist keymap $keymap"
-  else
-    log_step "keymap $keymap unknown to localectl; keeping the default"
+  case $1 in
+    colemak) layout=us variant=colemak ;;
+    bg-cp1251) layout=bg,us variant=phonetic, options=$switch ;;
+    cz) layout=cz,us variant=qwerty, options=$switch ;;
+    de_CH-latin1) layout=ch ;;
+    kyrgyz) layout=kg,us options=$switch ;;
+    no-latin1) layout=no ;;
+    pl) layout=pl ;;
+    ua) layout=ua,us options=$switch ;;
+    *) return 1 ;;
+  esac
+
+  printf 'XKBLAYOUT=%s\nXKBMODEL=pc105\n' "$layout"
+  [[ -z $variant ]] || printf 'XKBVARIANT=%s\n' "$variant"
+  printf 'XKBOPTIONS=%s\n' "$options"
+}
+
+# Load the layout on the live VT and persist it for the installed system, or
+# fail. systemd-firstboot writes both the console KEYMAP and the XKB layout
+# Hyprland reads, matching what the ISO's configure_keyboard does at install
+# time. The boot files ask for the disk password in the layout vconsole.conf
+# names, so a keymap localectl doesn't know, a failed loadkeys, or a file that
+# does not read back as the chosen keymap with an XKB layout is a failure.
+apply_keyboard() {
+  local keymap=$1 keymaps saved
+
+  if [[ $(tty 2>/dev/null) == /dev/tty* ]] && ! loadkeys "$keymap" >>"$LOG_FILE" 2>&1; then
+    log_step "loadkeys could not load keymap $keymap"
+    return 1
+  fi
+
+  if ! keymaps=$(localectl --no-pager list-keymaps 2>>"$LOG_FILE"); then
+    log_step "localectl could not list keymaps to check $keymap"
+    return 1
+  fi
+  if ! grep -qxF -- "$keymap" <<<"$keymaps"; then
+    log_step "keymap $keymap unknown to localectl"
+    return 1
+  fi
+
+  if ! systemd-firstboot --keymap="$keymap" --force >>"$LOG_FILE" 2>&1 &&
+    ! localectl set-keymap "$keymap" >>"$LOG_FILE" 2>&1; then
+    log_step "could not persist keymap $keymap"
+    return 1
+  fi
+
+  # systemd-firstboot writes an XKB layout only for keymaps in kbd-model-map,
+  # and several the form offers are not, so Hyprland would come up in US.
+  if ! grep -q '^XKBLAYOUT=.' /etc/vconsole.conf 2>/dev/null; then
+    keyboard_xkb_settings "$keymap" >>/etc/vconsole.conf 2>>"$LOG_FILE" ||
+      log_step "no XKB layout known for keymap $keymap"
+  fi
+
+  # A clean shell, so nothing this process exported stands in for the file.
+  saved=$(env -i /bin/bash --noprofile --norc -c \
+    '. /etc/vconsole.conf && [[ -n ${XKBLAYOUT:-} ]] && printf %s "${KEYMAP:-}"' 2>>"$LOG_FILE") || saved=""
+  if [[ $saved != "$keymap" ]]; then
+    log_step "/etc/vconsole.conf does not read back as keymap $keymap with an XKB layout"
+    return 1
  fi
 }

@@ -715,7 +784,7 @@ luks_device() {
  local src part
  src=$(findmnt -no SOURCE / | sed 's/\[.*//')
  [[ -n $src ]] || return 1
-  part=$(lsblk -nspo NAME,FSTYPE "$src" 2>/dev/null | awk '$2=="crypto_LUKS"{print $1; exit}')
+  part=$(lsblk -nsrpo NAME,FSTYPE "$src" 2>/dev/null | awk '$2=="crypto_LUKS"{print $1; exit}')
  [[ -n $part ]] && { echo "$part"; return 0; }
  return 1
 }
@@ -823,13 +892,24 @@ configure_hostname() {
 # step, overwriting the placeholder (UTC) the deferred install seeded.
 configure_timezone() {
  [[ -n ${timezone:-} ]] || return 0
-  if timedatectl set-timezone "$timezone" 2>&1; then
-    return 0
+  if ! timedatectl set-timezone "$timezone" 2>&1; then
+    # Fallback only if the zone file exists, so a bad zone can't point
+    # /etc/localtime at nothing and break every localtime read afterward.
+    [[ -e /usr/share/zoneinfo/$timezone ]] &&
+      ln -sf "/usr/share/zoneinfo/$timezone" /etc/localtime 2>&1 || true
+  fi
+  configure_wireless_regdom
+}
+
+# The install's hardware step found only the UTC placeholder, which names no
+# country, so the wireless regulatory domain comes from the owner's timezone
+# here. No reboot follows setup, so the radios get it now the way udev applies
+# it at every boot.
+configure_wireless_regdom() {
+  bash "$OMARCHY_PATH/install/hardware/set-wireless-regdom.sh" 2>&1 || return 0
+  if omarchy-cmd-present set-wireless-regdom; then
+    set-wireless-regdom 2>&1 || true
  fi
-  # Fallback only if the zone file exists, so a bad zone can't point
-  # /etc/localtime at nothing and break every localtime read afterward.
-  [[ -e /usr/share/zoneinfo/$timezone ]] &&
-    ln -sf "/usr/share/zoneinfo/$timezone" /etc/localtime 2>&1 || true
 }

 finalize_user() {
@@ -852,16 +932,99 @@ finalize_user() {
    "$OMARCHY_PATH/bin/omarchy-provision-user" --force --first-install
 }

+# During the provisioning window the staged key rides in the UKI's initramfs,
+# named on the kernel cmdline, so boot unlocks unattended.
+PROVISIONING_UNLOCK_FILES=(
+  /etc/omarchy/provisioning.key
+  /etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf
+  /etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf
+)
+
+limine_auto_unlock_present() {
+  local file
+  for file in "${PROVISIONING_UNLOCK_FILES[@]}"; do
+    [[ -e $file ]] && return 0
+  done
+  return 1
+}
+
+# Rebuild the UKI without the embedded keyfile. A failed rebuild restores the
+# auto-unlock, so the retry still boots unattended.
+limine_auto_unlock_drop() {
+  rm -f "${PROVISIONING_UNLOCK_FILES[@]}"
+  reset_limine_config
+  if limine-update >>"$LOG_FILE" 2>&1; then
+    return 0
+  fi
+
+  # Once the staged key is destroyed there is no auto-unlock to restore: the
+  # boot files already ask for the owner's password. The rebuild is still
+  # retried for the boot entries.
+  if [[ -f $PROVISIONING_DIR/luks-key ]]; then
+    log_step "limine-update failed during re-key; restoring auto-unlock for retry"
+    install -Dm600 "$PROVISIONING_DIR/luks-key" /etc/omarchy/provisioning.key
+    echo 'KERNEL_CMDLINE[default]+=" cryptkey=rootfs:/etc/omarchy/provisioning.key"' \
+      >/etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf
+    echo 'FILES+=(/etc/omarchy/provisioning.key)' >/etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf
+  else
+    log_step "limine-update failed during re-key; the staged key is gone, so no auto-unlock is restored"
+  fi
+  limine-update >>"$LOG_FILE" 2>&1 || true
+  return 1
+}
+
+# A platform whose boot package implements provision-commit and provision-verify
+# stages the unlock in its own boot chain and owns it; everywhere else it rides
+# in the Limine UKI above. Deciding fails closed: the unlock then counts as
+# present and cannot be dropped.
+UNLOCK_OWNER=""
+
+unlock_owner() {
+  [[ -z ${UNLOCK_OWNER:-} ]] || return 0
+
+  local commit verify
+  commit=$("$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" --resolve provision-commit) || return 1
+  verify=$("$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" --resolve provision-verify) || return 1
+  if [[ -n $commit && -n $verify ]]; then
+    UNLOCK_OWNER=platform
+  elif [[ -z $commit && -z $verify ]]; then
+    UNLOCK_OWNER=limine
+  else
+    log_step "the platform implements only one of provision-commit and provision-verify"
+    return 1
+  fi
+}
+
+luks_auto_unlock_present() {
+  unlock_owner || return 0
+  if [[ $UNLOCK_OWNER == "platform" ]]; then
+    ! "$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" provision-verify >>"$LOG_FILE" 2>&1
+  else
+    limine_auto_unlock_present
+  fi
+}
+
+luks_auto_unlock_drop() {
+  unlock_owner || return 1
+  if [[ $UNLOCK_OWNER == "platform" ]]; then
+    "$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" provision-commit >>"$LOG_FILE" 2>&1
+  else
+    limine_auto_unlock_drop
+  fi
+}
+
+# The platform records the slot the re-key keeps, and no recovery slot; a no-op
+# where nothing does.
+luks_record_slots() {
+  "$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" luks-slots "owner=$1" "recovery=" >>"$LOG_FILE" 2>&1
+}
+
 # Move the LUKS volume from the throwaway install passphrase to the user's
-# password: add the user's key, kill every other slot (throwaway + any seller
-# keys a reset left behind), then rebuild the UKI without the embedded
-# auto-unlock keyfile.
-#
-# Failing here must be LOUD (abort the attempt, offer retry): silently keeping
-# the staged auto-unlock keyfile would leave the disk effectively unencrypted
-# forever.
+# password and retire every other slot (throwaway + any seller keys a reset
+# left behind). luks_rekey journals each step, so an interrupted attempt
+# resumes where it stopped.
 rekey_luks() {
-  [[ -f $PROVISIONING_DIR/luks-key ]] || return 0
+  luks_rekey_pending || return 0

  local device
  if ! device=$(luks_device) || [[ ! -e $device ]]; then
@@ -870,61 +1033,32 @@ rekey_luks() {
    return 1
  fi

-  if ! cryptsetup open --test-passphrase --key-file "$PROVISIONING_DIR/luks-key" "$device" 2>>"$LOG_FILE"; then
-    log_step "staged LUKS key does not unlock $device"
-    say --foreground 1 "The staged LUKS key no longer unlocks $device."
-    return 1
-  fi
+  luks_rekey "$device"
+}

-  # Add the user's key (a retry with a different password just adds another
-  # slot; all but the current one are killed once the rebuild succeeds).
-  cryptsetup luksAddKey --key-file "$PROVISIONING_DIR/luks-key" "$device" <(printf '%s' "$password")
-
-  # Rebuild the no-auto-unlock UKI FIRST, keeping the throwaway key and slot as
-  # a fallback. Only once that succeeds do we kill the other slots and destroy
-  # the staged key — so a limine-update failure leaves a recoverable,
-  # still-auto-unlocking state to retry, never a disk locked to a password the
-  # user may have just changed.
-  rm -f /etc/omarchy/provisioning.key \
-    /etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf \
-    /etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf
-  reset_limine_config
-  if ! limine-update >>"$LOG_FILE" 2>&1; then
-    log_step "limine-update failed during re-key; restoring auto-unlock for retry"
-    install -Dm600 "$PROVISIONING_DIR/luks-key" /etc/omarchy/provisioning.key
-    echo 'KERNEL_CMDLINE[default]+=" cryptkey=rootfs:/etc/omarchy/provisioning.key"' \
-      >/etc/limine-entry-tool.d/99-omarchy-provisioning-unlock.conf
-    echo 'FILES+=(/etc/omarchy/provisioning.key)' >/etc/mkinitcpio.conf.d/99-omarchy-provisioning-key.conf
-    limine-update >>"$LOG_FILE" 2>&1 || true
-    return 1
+# The re-key's fingerprint of the console keyboard layout the boot files ask for
+# the disk password in: a hash of vconsole.conf's keymap and XKB settings, in
+# file order since a later duplicate wins, so the journal never names the layout.
+luks_boot_layout() {
+  if [[ ! -f /etc/vconsole.conf ]]; then
+    echo none
+    return
  fi
+  awk '/^[ \t]*(KEYMAP|KEYMAP_TOGGLE|XKB[A-Z_]*)=/ { sub(/^[ \t]+/, ""); print }' /etc/vconsole.conf |
+    sha256sum | cut -d' ' -f1
+}

-  local new_slot slot other_slots
-  new_slot=$(cryptsetup open --test-passphrase --verbose --key-file <(printf '%s' "$password") "$device" 2>&1 |
-    grep -o 'Key slot [0-9]* unlocked' | grep -o '[0-9]*' | head -1)
-  # Retiring the throwaway/seller slots must be all-or-nothing: if we can't
-  # identify the user's slot or a kill fails, keep the staged key and retry —
-  # never shred it while a slot the seller knows still unlocks the disk.
-  if [[ -z $new_slot ]]; then
-    log_step "could not identify the user's LUKS slot after re-key; keeping the staged key for retry"
-    say --foreground 1 "Could not confirm the LUKS re-key; will retry."
-    return 1
+# A re-key interrupted after the staged key was retired can only finish with
+# the password the disk already holds.
+rekey_accepts_password() {
+  local -
+  set +x
+  local device
+  [[ -f $REKEY_STATE ]] || return 0
+  if ! device=$(luks_device) || [[ ! -e $device ]]; then
+    return 0
  fi
-  if ! other_slots=$(cryptsetup luksDump "$device" | awk '/^ +[0-9]+: luks2/ { sub(":", "", $1); print $1 }'); then
-    log_step "luksDump failed while retiring slots; keeping the staged key for retry"
-    say --foreground 1 "Could not enumerate LUKS slots; will retry."
-    return 1
-  fi
-  for slot in $other_slots; do
-    [[ $slot == "$new_slot" ]] && continue
-    if ! cryptsetup luksKillSlot -q --key-file <(printf '%s' "$password") "$device" "$slot"; then
-      log_step "failed to kill LUKS slot $slot; keeping the staged key for retry"
-      say --foreground 1 "Could not remove the throwaway LUKS key; will retry."
-      return 1
-    fi
-  done
-
-  shred -u "$PROVISIONING_DIR/luks-key" 2>/dev/null || rm -f "$PROVISIONING_DIR/luks-key"
+  luks_rekey_accepts_password "$device"
 }

 # Start the ESP's limine.conf over from the shipped template and drop foreign
@@ -991,7 +1125,7 @@ reset_limine_config() {
 cleanup_oem_state() {
  # Keep groups + packages: omarchy-system-factory-reset stages the bundled Node
  # tarball from these live copies when the factory snapshot predates it.
-  rm -f "$PROVISIONING_DIR/pending" "$PROVISIONING_DIR/authorized_keys" "$PROVISIONING_DIR/setup-user"
+  rm -f "$PROVISIONING_DIR/pending" "$PROVISIONING_DIR/authorized_keys" "$PROVISIONING_DIR/setup-user" "$REKEY_STATE"

  rm -f /etc/systemd/system/multi-user.target.wants/omarchy-provision-owner.service
  systemctl daemon-reload 2>/dev/null || true
@@ -1018,7 +1152,7 @@ run_provisioning() {
    touch "$FINALIZE_WARNING_FLAG"
  fi

-  if [[ -f $PROVISIONING_DIR/luks-key ]]; then
+  if luks_rekey_pending; then
    log_step "re-keying LUKS to the user's password"
    echo rekey >"$STATE_FILE"
    rekey_luks
@@ -1035,16 +1169,42 @@ run_provisioning() {
    limine-update
  fi

+  if luks_staged_unlock_remains; then
+    log_step "refusing to finish setup while the staged LUKS key or its auto-unlock remains"
+    return 1
+  fi
+
  log_step "cleaning up provisioning state"
  cleanup_oem_state
  log_step "first-boot setup complete"
 }

+# Where the platform's boot package owns the boot chain, it must be ready to
+# finish setup, and able to record the kept key slot, before the owner is asked
+# anything.
+platform_ready() {
+  local error
+  if error=$("$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" provision-prepare 2>&1 >>"$LOG_FILE") &&
+    error=$("$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch" --resolve luks-slots 2>&1 >/dev/null); then
+    return 0
+  fi
+  error=${error:-"The boot package could not prepare this machine for setup."}
+
+  log_step "the boot package is not ready for setup: $error"
+  clear_logo
+  echo
+  say --foreground 1 "$error"
+  sleep 5
+  return 1
+}
+
 run_setup() {
  local status

+  platform_ready || return 1
+
  while true; do
-    keyboard_form
+    keyboard_form || return 1
    user_form && status=0 || status=$?
    if ((status != 0)); then
      # Esc unwinds to the keyboard step. Ctrl+C is the only other way out of a
@@ -1052,7 +1212,12 @@ run_setup() {
      ((status == OMARCHY_FORM_SIGNAL)) && confirm_reboot && exec systemctl reboot
      continue
    fi
-    confirm_form && break
+    confirm_form || continue
+    if ! rekey_accepts_password; then
+      notice "Setup already set the disk password. Enter that same password." 4
+      continue
+    fi
+    break
  done

  touch "$LOG_FILE"
@@ -24,31 +24,29 @@ omarchy_security_install_sudo_cleanup_traps
 omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo

-channel="${1:-stable}"
-if [[ $channel != "stable" && $channel != "rc" && $channel != "edge" ]]; then
+channel="${1:-}"
+if [[ -n $channel && $channel != "stable" && $channel != "rc" && $channel != "edge" ]]; then
  echo "Invalid channel: $channel" >&2
  exit 2
 fi

-# Render the channel templates plus this machine's regional additions as the
-# caller, so root only copies finished files. The scratch directory goes on
-# every exit, including a failed render, a refused sudo prompt, or a signal;
-# revoking the sudo timestamp stays the last thing the exit path does.
-rendered=$(mktemp -d)
-cleanup_refresh() {
-  local status=$?
-  rm -rf "$rendered"
-  omarchy_security_exit_with_revoked_sudo "$status"
-}
-trap cleanup_refresh EXIT
-"$OMARCHY_PATH/bin/omarchy-apply-pacman" --render "$channel" "$rendered"
+source "$OMARCHY_PATH/install/helpers/pacman.sh"
+if ! platform=$(omarchy-hw-platform); then
+  echo "Cannot tell this machine's platform. No repository configuration changed." >&2
+  exit 1
+fi
+templates=$(omarchy_pacman_templates "$platform") || exit 1
+[[ -n $channel ]] || channel=$(omarchy_pacman_default_channel "$platform") || exit 1
+if [[ ! -f $templates/pacman-$channel.conf || ! -f $templates/mirrorlist-$channel ]]; then
+  echo "Omarchy has no $channel channel for $platform. No repository configuration changed." >&2
+  exit 1
+fi

 sudo cp -f /etc/pacman.conf /etc/pacman.conf.bak
 sudo cp -f /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.bak
 echo "Setting channel to $channel"
-sudo cp -f "$rendered/pacman.conf" /etc/pacman.conf
-sudo cp -f "$rendered/mirrorlist" /etc/pacman.d/mirrorlist
-rm -rf "$rendered"
+sudo cp -f "$templates/pacman-$channel.conf" /etc/pacman.conf
+sudo cp -f "$templates/mirrorlist-$channel" /etc/pacman.d/mirrorlist

 # Allow user customization of /etc/pacman.conf before the upgrade runs, so
 # custom repositories and IgnorePkg entries shape the downgrade-capable
@@ -1,57 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Show or switch the region this machine is set up for
-# omarchy:args=[global|cn]
-# omarchy:examples=omarchy region | omarchy region cn
-# omarchy:requires-sudo=true
-
-set -euo pipefail
-
-region_file=/etc/omarchy/region
-
-if (($# == 0)); then
-  if [[ ! -e $region_file ]]; then
-    echo "Global"
-  elif [[ $(<"$region_file") == "cn" ]]; then
-    echo "China"
-  else
-    echo "Unknown region in $region_file: $(<"$region_file")" >&2
-    exit 1
-  fi
-  exit 0
-fi
-
-if [[ $1 != "global" && $1 != "cn" ]]; then
-  echo "Usage: omarchy-region [global|cn]" >&2
-  exit 1
-fi
-
-channel=$(omarchy-version-channel)
-if [[ $channel != "stable" && $channel != "rc" && $channel != "edge" ]]; then
-  echo "Cannot tell this machine's package channel ($channel); run omarchy channel set first" >&2
-  exit 1
-fi
-
-if [[ $1 == "cn" ]]; then
-  # Upgrade first: the keyring install below syncs new databases.
-  omarchy-update-pacman -Syu --noconfirm
-  sudo env OMARCHY_REGION=cn OMARCHY_PATH="$OMARCHY_PATH" bash -e "$OMARCHY_PATH/install/config/region.sh"
-  # Trust ArchLinuxCN before the refresh upgrades through it.
-  rendered=$(mktemp -d)
-  trap 'rm -rf "$rendered"' EXIT
-  omarchy-apply-pacman --render "$channel" "$rendered"
-  mapfile -t profile_packages < <(grep -Ev '^[[:space:]]*(#|$)' "$OMARCHY_PATH/default/regions/cn/packages")
-  sudo pacman --config "$rendered/pacman.conf" -Sy --noconfirm --needed "${profile_packages[@]}"
-  sudo pacman-key --populate archlinuxcn
-  omarchy-refresh-pacman "$channel"
-else
-  sudo env OMARCHY_REGION=global OMARCHY_PATH="$OMARCHY_PATH" bash -e "$OMARCHY_PATH/install/config/region.sh"
-  omarchy-refresh-pacman "$channel"
-fi
-
-# The developer mirrors reach only a new session, so offer one.
-if [[ -t 0 && -t 1 ]] && gum confirm --affirmative "$(omarchy-text "Log out now")" --negative "$(omarchy-text "Later")" "$(omarchy-text "Log out now to switch the developer mirrors?")" 2>&1; then
-  omarchy-system-logout
-else
-  omarchy-text "Log back in to switch the developer mirrors."
-fi
@@ -1,18 +1,20 @@
 #!/bin/bash

-# omarchy:summary=Reinstall all default Omarchy packages from the stable channel
+# omarchy:summary=Reinstall all default Omarchy packages from the stable channel, or on aarch64 the edge channel
 # omarchy:requires-sudo=true

 set -e

-# Reinstall all default Omarchy packages from the stable channel and downgrade any packages that are too new.
+# Reinstall all default Omarchy packages from the platform's default channel
+# (stable, or edge on aarch64) and downgrade any packages that are too new.

-# Set the package repository to the stable mirrors
+# Set the package repository to the platform's default channel
 omarchy-refresh-pacman

-# Downgrade any packages to the stable setup
+# Downgrade any packages to that channel's setup
 omarchy-update-pacman -Suu --noconfirm

-# Ensure all packages are installed
-mapfile -t packages < <(grep -v '^#' "$OMARCHY_PATH/install/omarchy-base.packages" | grep -v '^$')
+# Ensure this platform's default packages are installed
+default_packages=$(omarchy-pkg-defaults)
+mapfile -t packages <<<"$default_packages"
 omarchy-update-pacman -Syu --noconfirm --needed "${packages[@]}"
@@ -5,6 +5,7 @@

 set -e

+omarchy-lifecycle-dispatch pre-remove steam
 omarchy-pkg-drop steam

 rm -rf \
@@ -34,15 +34,13 @@ if gum confirm "Are you sure you want to remove all preinstalled web apps, TUI w
    aether \
    cliamp \
    libreoffice-fresh \
-    xournalpp \
    pinta \
    obsidian \
-    obs-studio \
-    kdenlive \
    moonlight-qt \
    omacut \
    monologue \
    omacalc \
    omawrite \
-    hype
+    hype \
+    signed
 fi
@@ -10,13 +10,18 @@ fi

 omarchy_security_require_privileged_bash_startup() {
  [[ $- == *p* ]] || return 1
+  # The caller is this check's parent, under the number this /proc gives it.
+  # arch-chroot runs the installer in a new PID namespace beneath the outer
+  # /proc, where $$ names no process, or someone else's.
  /usr/bin/env -i /usr/bin/bash -p -c '
-    mapfile -d "" -t argv <"/proc/$1/cmdline" || exit 1
-    executable=$(/usr/bin/readlink -e -- "/proc/$1/exe") || exit 1
+    stat=$(</proc/self/stat) || exit 1
+    read -r _ caller _ <<<"${stat##*) }"
+    mapfile -d "" -t argv <"/proc/$caller/cmdline" || exit 1
+    executable=$(/usr/bin/readlink -e -- "/proc/$caller/exe") || exit 1
    [[ $executable == "/usr/bin/bash" &&
      ( ${argv[0]:-} == "/bin/bash" || ${argv[0]:-} == "/usr/bin/bash" ) &&
      ${argv[1]:-} == "-p" ]]
-  ' omarchy-bash-startup "$$"
+  ' omarchy-bash-startup
 }

 omarchy_security_sanitize_bash_environment() {
@@ -3,6 +3,14 @@
 # omarchy:summary=Add or remove an EFI boot entry for the Omarchy UKI, allowing the system to boot directly
 # omarchy:requires-sudo=true

+# Apple Silicon boots m1n1, then U-Boot, which finds the bootloader on its own
+# and creates its boot entries itself, so there is no direct-boot entry to add
+# or remove.
+if omarchy-hw-aarch64-apple; then
+  echo "Error: Direct boot is not supported on Apple Silicon: U-Boot finds the bootloader itself" >&2
+  exit 1
+fi
+
 if [[ ! -d /sys/firmware/efi ]]; then
  echo "Error: System is not booted in UEFI mode" >&2
  exit 1
@@ -1,6 +1,6 @@
 #!/bin/bash

-# omarchy:summary=Set up Japanese, Korean, or Chinese typing
+# omarchy:summary=Select input methods for Japanese, Korean, or Chinese typing
 # omarchy:args=[mozc|hangul|pinyin|chewing]
 # omarchy:examples=omarchy setup input | omarchy setup input mozc
 # omarchy:requires-sudo=true
@@ -14,9 +14,8 @@ fi

 method=${1:-}
 if [[ -z $method ]]; then
-  choice=$(jq -r 'to_entries[] | select(.key != "none") | .value.label' "$OMARCHY_PATH/default/input-methods/presets.json" |
-    gum choose --header "Select input language")
-  method=$(jq -r --arg label "$choice" 'to_entries[] | select(.value.label == $label) | .key' "$OMARCHY_PATH/default/input-methods/presets.json")
+  /usr/bin/python3 "$OMARCHY_PATH/default/input-methods/typing_setup.py" input
+  exit
 fi

 case "$method" in
@@ -26,5 +25,5 @@ esac

 mapfile -t packages < <(jq -r --arg method "$method" '.[$method].packages[]' "$OMARCHY_PATH/default/input-methods/presets.json")
 omarchy-pkg-add "${packages[@]}"
-omarchy-input-method configure "$method"
-echo "Input method added. The default switch is Ctrl+Shift+Space or the Japanese/Korean input key; existing custom keys are preserved."
+/usr/bin/python3 "$OMARCHY_PATH/default/input-methods/typing_setup.py" add "$method"
+echo "Input method added. Use Super+I or the Japanese/Korean input key to switch; existing custom Fcitx keys are preserved."
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# omarchy:summary=Select the keyboard layouts available for switching
+
+set -euo pipefail
+
+/usr/bin/python3 "$OMARCHY_PATH/default/input-methods/typing_setup.py" keyboard
@@ -462,7 +462,34 @@ root_dispatch() {
  esac
 }

+# The bar indicator only probes on demand, so every grant change pushes a
+# refresh. Root's expiry timer can't reach the user's shell, so a user timer
+# refreshes once the deadline has passed. Both are best effort: a stale red
+# indicator still revokes cleanly when clicked.
+refresh_indicator() {
+  /usr/bin/omarchy-shell -q omarchy.indicators refresh >/dev/null 2>&1 || true
+}
+
+# A failed enable can still change the grant (a renewal that rolls back removes
+# the previous policy), so refresh whatever the privileged action returned.
+change_grant() {
+  local status=0
+  /usr/bin/sudo "$@" || status=$?
+  refresh_indicator
+  return "$status"
+}
+
+# A wall-clock deadline, like the sudoers rule and root's timer, so expiry
+# during suspend still refreshes on resume.
+schedule_expiry_refresh() {
+  [[ $minutes == "permanent" ]] && return 0
+  /usr/bin/systemd-run --user --quiet --collect --on-calendar="@$((EPOCHSECONDS + 10#$minutes * 60 + 2))" \
+    --timer-property=AccuracySec=1s \
+    -- /usr/bin/omarchy-shell -q omarchy.indicators refresh >/dev/null 2>&1 || true
+}
+
 show_enabled() {
+  schedule_expiry_refresh
  if [[ $minutes == "permanent" ]]; then
    echo "Passwordless sudo has been ENABLED permanently. Run this command again to disable it."
  else
@@ -542,12 +569,12 @@ else
  fi
 fi
 if (( status == 0 )) && { (($# == 0)) || [[ $minutes == "--disable" ]]; }; then
-  /usr/bin/sudo -n -N -- "$INSTALLED_SELF" __disable "$uid"
+  change_grant -n -N -- "$INSTALLED_SELF" __disable "$uid"
  echo "Passwordless sudo has been DISABLED. Sudo will require a password again."
 elif (( status == STATUS_INACTIVE )) && [[ $minutes == "--disable" ]]; then
  echo "Passwordless sudo is already DISABLED."
 elif (( status == 0 )) && [[ $minutes != "permanent" ]]; then
-  /usr/bin/sudo -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
+  change_grant -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
  show_enabled
 else
  if (( status != 0 && status != STATUS_INACTIVE )); then
@@ -587,7 +614,7 @@ else
  echo ""

  if /usr/bin/gum confirm "Enable passwordless sudo $duration? This is a significant security risk!"; then
-    /usr/bin/sudo -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
+    change_grant -N -- "$INSTALLED_SELF" __enable "$uid" "$minutes"
    echo ""
    show_enabled
  else
@@ -17,7 +17,9 @@
 # The heavy lifting happens on the next boot via omarchy-system-factory-reset-finish, staged
 # here. On encrypted installs the LUKS volume is re-keyed to a throwaway
 # passphrase with an auto-unlock keyfile for the provisioning window; first-boot setup
-# re-keys it to the new owner's password and removes the keyfile.
+# re-keys it to the new owner's password and removes the keyfile. A platform
+# whose boot chain the Limine UKI path can't drive rebuilds, verifies and
+# unlocks it through omarchy-lifecycle-dispatch.
 #
 # Honest limitations:
 #  - On unencrypted disks this is deletion, not forensic erasure. fstrim helps
@@ -29,17 +31,25 @@
 set -euo pipefail

 PROVISIONING_DIR=/var/lib/omarchy/provisioning
+PACKAGED_PATH=/usr/bin/omarchy-system-factory-reset
 OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
 TOP_MNT=/run/omarchy-system-factory-reset/top
 NEXT_NAME=@omarchy-reset-next
 LOG_FILE=/var/log/omarchy-system-factory-reset.log

+# Never replace a newer checkout reset with a different installed implementation.
+if ! /usr/bin/cmp -s -- "${BASH_SOURCE[0]}" "$PACKAGED_PATH"; then
+  echo "Factory reset differs from the installed command. Install the matching Omarchy package before resetting." >&2
+  exit 1
+fi
+
 # Self-elevate so the menu entry (and a bare shell invocation) need no sudo
 # prefix. The caller's gum theme vars are forwarded as `env` arguments rather
 # than via `sudo -E`, so styling survives even under an env_reset sudoers.
+# Always elevate the packaged copy, including when invoked from a dev checkout.
 if (( EUID != 0 )); then
  mapfile -t gum_env < <(env | grep '^GUM_' || true)
-  exec sudo env "${gum_env[@]}" "$0" "$@"
+  exec sudo env "${gum_env[@]}" "$PACKAGED_PATH" "$@"
 fi

 export PATH="$OMARCHY_PATH/bin:$PATH"
@@ -62,6 +72,51 @@ root_is_btrfs_at() {
  [[ $(findmnt -no FSTYPE /) == btrfs ]] && findmnt -no OPTIONS / | grep -q "subvol=/@\(,\|$\)"
 }

+DISPATCH="$OMARCHY_PATH/bin/omarchy-lifecycle-dispatch"
+
+# A platform whose boot package implements the reset operations rebuilds,
+# verifies and unlocks the factory root's boot chain itself; everywhere else
+# the Limine UKI path below does. Deciding fails closed.
+RESET_BOOT=""
+
+reset_boot_owner() {
+  [[ -z $RESET_BOOT ]] || return 0
+
+  local operation path found=0 missing=0
+  for operation in reset-prepare reset-verify reset-commit reset-rollback; do
+    path=$("$DISPATCH" --resolve "$operation") || return 1
+    if [[ -n $path ]]; then
+      found=$((found + 1))
+    else
+      missing=$((missing + 1))
+    fi
+  done
+  if (( missing == 0 )); then
+    RESET_BOOT=platform
+  elif (( found == 0 )); then
+    RESET_BOOT=generic
+  else
+    echo "Error: the boot package implements only some of the factory reset operations" >&2
+    return 1
+  fi
+}
+
+# Runs a reset operation with its output in the log. A failure keeps the
+# operation's last line for the error shown.
+RESET_BOOT_ERROR=""
+
+reset_boot_op() {
+  local output status=0
+  output=$("$DISPATCH" "$@" 2>&1) || status=$?
+  [[ -z $output ]] || printf '%s\n' "$output" >>"$LOG_FILE"
+  if (( status == 0 )); then
+    return 0
+  fi
+  RESET_BOOT_ERROR=$(tail -n 1 <<<"$output")
+  RESET_BOOT_ERROR=${RESET_BOOT_ERROR:-"$1 failed"}
+  return 1
+}
+
 # Resolve the crypto_LUKS partition backing the root, or return non-zero if
 # the root is not on LUKS. Prefers the cmdline cryptdevice= spec (archinstall
 # writes PARTUUID=, the pre-mounted path UUID=), and falls back to walking the
@@ -81,7 +136,7 @@ luks_device() {
  local src part
  src=$(findmnt -no SOURCE / | sed 's/\[.*//')
  [[ -n $src ]] || return 1
-  part=$(lsblk -nspo NAME,FSTYPE "$src" 2>/dev/null | awk '$2=="crypto_LUKS"{print $1; exit}')
+  part=$(lsblk -nsrpo NAME,FSTYPE "$src" 2>/dev/null | awk '$2=="crypto_LUKS"{print $1; exit}')
  [[ -n $part ]] && { echo "$part"; return 0; }
  return 1
 }
@@ -99,6 +154,11 @@ generate_passphrase() {
 }

 cleanup() {
+  # Before the switch the old root still boots: the boot package gives it back
+  # its boot state before the reset's throwaway slot is revoked.
+  if [[ ${reset_committed:-0} == 0 && ${RESET_BOOT_PREPARED:-0} == 1 ]]; then
+    reset_boot_op reset-rollback || echo "Error: $RESET_BOOT_ERROR (see $LOG_FILE)" >&2
+  fi
  if mountpoint -q "$TOP_MNT" 2>/dev/null; then
    if [[ -d $TOP_MNT/$NEXT_NAME && ${swap_done:-0} == 0 ]]; then
      btrfs subvolume delete --recursive "$TOP_MNT/$NEXT_NAME" >/dev/null 2>&1 || true
@@ -106,6 +166,9 @@ cleanup() {
    umount -R "$TOP_MNT" 2>/dev/null || true
  fi
  rmdir "$TOP_MNT" 2>/dev/null || true
+  if [[ ${reset_committed:-0} == 0 ]]; then
+    revoke_reset_luks
+  fi
 }
 trap cleanup EXIT

@@ -127,8 +190,54 @@ confirm_reset() {
  [[ $typed == "reset" ]] || fail "Reset not confirmed."
 }

+# The slot the reset's throwaway key opens, or nothing. Restricting cryptsetup
+# to a token type no token has keeps an enrolled token from answering for it.
+reset_luks_slot() {
+  local -
+  set +x
+  LC_ALL=C cryptsetup open --test-passphrase --verbose --token-type passphrase-only \
+    --key-file <(printf '%s' "$RESET_THROWAWAY") "$RESET_LUKS_DEVICE" 2>&1 |
+    grep -o 'Key slot [0-9]* unlocked' | grep -o '[0-9]*' | head -1 || true
+}
+
+# Add the throwaway slot where the platform's boot package owns the unlock.
+# Called once reset-verify passed, so a failed rebuild adds no credential.
+# reset-commit writes the boot-time key only once the factory root is active:
+# a power loss before the switch leaves the old root asking for its password,
+# never unlocked unattended.
+add_reset_luks_slot() {
+  local -
+  set +x
+  [[ -n ${RESET_LUKS_DEVICE:-} && -n ${RESET_LUKS_AUTH:-} && -n ${RESET_THROWAWAY:-} ]] || fail "the reset is missing its throwaway passphrase"
+  RESET_LUKS_ADDED=1
+  { cryptsetup luksAddKey --key-file <(printf '%s' "$RESET_LUKS_AUTH") "$RESET_LUKS_DEVICE" <(printf '%s' "$RESET_THROWAWAY") ; } 2>>"$LOG_FILE" ||
+    fail "could not add the throwaway LUKS keyslot"
+  RESET_LUKS_SLOT=$(reset_luks_slot)
+  [[ -n $RESET_LUKS_SLOT ]] || fail "could not identify the throwaway LUKS keyslot"
+}
+
+# Only the slot this attempt added goes, found by its key if the add was not
+# confirmed. The platform's boot-time key is written only after activation, so
+# a failed reset has none to revoke.
+revoke_reset_luks() {
+  local -
+  set +x
+  [[ ${RESET_LUKS_ADDED:-0} == 1 && -n ${RESET_LUKS_AUTH:-} ]] || return 0
+  [[ -n ${RESET_LUKS_SLOT:-} ]] || RESET_LUKS_SLOT=$(reset_luks_slot)
+  if [[ -n $RESET_LUKS_SLOT ]]; then
+    { cryptsetup luksKillSlot -q --key-file <(printf '%s' "$RESET_LUKS_AUTH") "$RESET_LUKS_DEVICE" "$RESET_LUKS_SLOT" ; } 2>>"$LOG_FILE" || true
+  else
+    echo "Could not find the reset's throwaway LUKS slot on $RESET_LUKS_DEVICE to revoke; check its keyslots" >>"$LOG_FILE"
+  fi
+  RESET_LUKS_ADDED=0
+  RESET_LUKS_SLOT=""
+}
+
 # Re-key to a throwaway passphrase whose keyfile auto-unlocks boot during the
-# provisioning window. $1 is the root of the staged factory system.
+# provisioning window. $1 is the root of the staged factory system. Where the
+# platform's boot package owns the unlock, only the staged key is written here:
+# reset-prepare stages the unlock with the rest of the boot files, and the
+# throwaway slot follows their verification.
 stage_luks_rekey() {
  local next="$1" device passphrase

@@ -140,19 +249,29 @@ stage_luks_rekey() {
  local current
  while true; do
    current=$(gum input --password --placeholder "Current disk encryption passphrase" --prompt "Passphrase> ") || exit 1
-    if cryptsetup open --test-passphrase --key-file <(printf '%s' "$current") "$device" 2>/dev/null; then
+    if cryptsetup open --test-passphrase --token-type passphrase-only --key-file <(printf '%s' "$current") "$device" 2>/dev/null; then
      break
    fi
    gum style --foreground 1 "That passphrase does not unlock $device. Try again."
  done

  passphrase=$(generate_passphrase)
-  cryptsetup luksAddKey --key-file <(printf '%s' "$current") "$device" <(printf '%s' "$passphrase")
+  reset_boot_owner || fail "could not tell how this machine's boot chain is reset"
+  RESET_LUKS_AUTH=$current
+  RESET_LUKS_DEVICE=$device
+  RESET_THROWAWAY=$passphrase
+  if [[ $RESET_BOOT == "generic" ]]; then
+    # Revoked like the platform's slot if the reset fails before activation.
+    RESET_LUKS_ADDED=1
+    cryptsetup luksAddKey --key-file <(printf '%s' "$current") "$device" <(printf '%s' "$passphrase")
+  fi

  install -d -m 755 "$next$PROVISIONING_DIR"
  printf '%s' "$passphrase" >"$next$PROVISIONING_DIR/luks-key"
  chmod 600 "$next$PROVISIONING_DIR/luks-key"

+  [[ $RESET_BOOT == "generic" ]] || return 0
+
  install -d -m 755 "$next/etc/omarchy"
  printf '%s' "$passphrase" >"$next/etc/omarchy/provisioning.key"
  chmod 600 "$next/etc/omarchy/provisioning.key"
@@ -235,6 +354,12 @@ verify_limine_hashes() {
 rebuild_next_boot() {
  local next="$1"

+  reset_boot_owner || fail "could not tell how this machine's boot chain is reset"
+  if [[ $RESET_BOOT == "platform" ]]; then
+    rebuild_next_boot_platform "$next"
+    return
+  fi
+
  local esp_source esp_mount
  esp_mount=$(awk '$3 == "vfat" && $2 ~ /^\/(boot|efi)/ { print $2; exit }' "$next/etc/fstab")
  esp_source=$(awk '$3 == "vfat" && $2 ~ /^\/(boot|efi)/ { print $1; exit }' "$next/etc/fstab")
@@ -297,6 +422,23 @@ rebuild_next_boot() {
  umount "$next$esp_mount"
 }

+# The boot package stages the factory root's boot files and unlock, then proves
+# they boot it; reset-rollback undoes both if the reset fails before the switch.
+# The throwaway slot is added only once they are proven.
+rebuild_next_boot_platform() {
+  local next="$1"
+  local -a luks=()
+  [[ -z ${RESET_LUKS_DEVICE:-} ]] || luks=("$RESET_LUKS_DEVICE")
+
+  RESET_BOOT_PREPARED=1
+  log "Rebuilding boot files from the factory system (this can take a minute)"
+  reset_boot_op reset-prepare "$next" "${luks[@]}" || fail "$RESET_BOOT_ERROR (see $LOG_FILE)"
+  log "Verifying that the factory system boots"
+  reset_boot_op reset-verify "$next" || fail "$RESET_BOOT_ERROR (see $LOG_FILE)"
+
+  [[ -z ${RESET_LUKS_DEVICE:-} ]] || add_reset_luks_slot
+}
+
 # Both the staged system and the retained baseline must lose the old hashes.
 scrub_factory_accounts() {
  local root="$1" user users
@@ -388,9 +530,30 @@ stage_full_reset() {
  log "Activating the factory system"
  local old="@omarchy-old-$(date +%s)"
  mv "$top/@" "$top/$old"
-  mv "$next" "$top/@"
+  # Until the factory root is at @ the reset is not committed: cleanup has the
+  # platform's boot package roll its boot state back to the old root and
+  # revokes the throwaway slot, so the old root goes back to @ first.
+  if ! mv "$next" "$top/@"; then
+    if mv "$top/$old" "$top/@"; then
+      [[ $RESET_BOOT == "platform" ]] ||
+        fail "could not activate the factory system; the current root is back at @, but its boot files were already rebuilt from the factory system: run 'sudo limine-update' before rebooting (see $LOG_FILE)"
+      fail "could not activate the factory system; the current root is back at @ (see $LOG_FILE)"
+    fi
+    # Neither root is at @. Keep the staged one as well for recovery.
+    swap_done=1
+    fail "could not activate the factory system or put the current root back; from a live USB, mount the Btrfs top level, rename $old to @, and rebuild its boot files if it does not boot"
+  fi
+  # From here the old root is gone, so the reset's unlock must survive.
+  reset_committed=1
  swap_done=1
  sync
+
+  # The boot package that prepared the reset gets the key on standard input,
+  # never in arguments. A failure costs the first boot one prompt for the
+  # current disk password.
+  if [[ ${RESET_BOOT_PREPARED:-0} == 1 ]] && ! reset_boot_op reset-commit < <(printf '%s' "${RESET_THROWAWAY:-}"); then
+    log "$RESET_BOOT_ERROR"
+  fi
 }

 # A reset is a clone of @factory, so a machine without one has nothing to
@@ -428,6 +591,10 @@ main() {

  require_factory_snapshot

+  # Decided before anything is asked: a platform whose boot package is missing
+  # stops here, with the dispatcher's error naming the package.
+  reset_boot_owner || fail "this machine's boot package cannot factory-reset it"
+
  confirm_reset

  # The running system's limine-snapper-sync must not rewrite the ESP's
@@ -11,8 +11,9 @@
 # omarchy-system-sleep-lock then usually finds the session already secure.
 #
 # A docked lid close does not suspend (HandleLidSwitchDocked defaults to
-# ignore), so it must not lock either: that is clamshell mode, still in use on
-# the external display.
+# ignore, and omarchy-system-lid-inhibit covers displays logind does not count),
+# so it must not lock either: that is clamshell mode, still in use on the
+# external display.
 if omarchy-hw-laptop-closed && ! omarchy-hw-external-monitors; then
  omarchy-system-lock >/dev/null 2>&1 || true
 fi
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+# omarchy:summary=Keep logind from suspending on lid close while a display it misses is in use
+# omarchy:group=system
+# omarchy:hidden=true
+
+# systemd-logind treats a closed lid as docked only when an external display is
+# on a connector type it lists (HDMI, DisplayPort, DVI, VGA...), and USB-C
+# displays on Apple Silicon arrive on "USB" connectors instead. Left alone,
+# logind suspends a laptop still in use on one. Holding its handle-lid-switch
+# inhibitor while such a display is in use leaves the lid to Omarchy's
+# clamshell handling, as HandleLidSwitchDocked=ignore would. Once released, a
+# lid that is still shut suspends at once: logind rechecks a closed lid after
+# every event.
+
+UNIT="omarchy-lid-inhibit.service"
+drm_path="${OMARCHY_DRM_PATH:-/sys/class/drm}"
+cgroup_path="${OMARCHY_CGROUP_PATH:-/proc/self/cgroup}"
+
+# Connected connectors of the external types logind does not count, by the name
+# Hyprland gives them (card2-USB-2 is USB-2). DVI-A and Composite are on its
+# list, but a missing comma there fuses them into one entry.
+uncounted_outputs() {
+  local status connector
+
+  for status in "$drm_path"/card*-*/status; do
+    [[ -r $status ]] || continue
+    connector=${status%/status}
+    connector=${connector##*/}
+
+    case $connector in
+      card*-USB-* | card*-DVI-A-* | card*-Composite-*) ;;
+      *) continue ;;
+    esac
+
+    [[ $(<"$status") == "connected" ]] && printf '%s\n' "${connector#card*-}"
+  done
+}
+
+held() {
+  systemctl --user is-active --quiet "$UNIT"
+}
+
+in_use=0
+outputs=$(uncounted_outputs)
+
+# In use means enabled in Hyprland: a display switched off in the monitor config
+# should not keep a closed laptop awake, while one blanked by DPMS still should,
+# and the connector's own "enabled" flag cannot tell the two apart on every
+# driver. A compositor that does not answer, as while it reconfigures outputs
+# around a lid close, changes nothing: releasing then would suspend a closed lid.
+if [[ -n $outputs ]]; then
+  monitors=$(hyprctl monitors all -j 2>/dev/null) || exit 0
+  [[ -n $monitors ]] || exit 0
+  jq -e --arg outputs "$outputs" \
+    '($outputs | split("\n")) as $names | any(.[]; .disabled == false and (.name | IN($names[])))' \
+    <<<"$monitors" >/dev/null 2>&1
+  case $? in
+    0) in_use=1 ;;
+    1) ;;
+    *) exit 0 ;;
+  esac
+fi
+
+# Only where logind would ignore a docked lid is there anything to stand in for.
+# An unanswered query changes nothing, for the same reason as above.
+wanted=0
+if (( in_use )) && omarchy-hw-laptop; then
+  docked_action=$(busctl get-property org.freedesktop.login1 /org/freedesktop/login1 \
+    org.freedesktop.login1.Manager HandleLidSwitchDocked 2>/dev/null) || exit 0
+  [[ -n $docked_action ]] || exit 0
+  [[ $docked_action == 's "ignore"' ]] && wanted=1
+fi
+
+# Bound to the user unit of the watcher that keeps it in step, so a watcher that
+# is gone cannot leave the lid inhibited until logout. systemd-run unquotes
+# property values, so the backslashes in an escaped unit name are doubled.
+watcher_binding() {
+  local cgroup="" unit
+
+  read -r cgroup 2>/dev/null <"$cgroup_path"
+  unit=${cgroup##*/}
+  if [[ $cgroup == */user@*.service/* && ( $unit == *.scope || $unit == *.service ) ]]; then
+    unit=${unit//\\/\\\\}
+    printf '%s\n' "--property=BindsTo=$unit" "--property=After=$unit"
+  fi
+}
+
+if (( wanted )); then
+  if ! held; then
+    mapfile -t bind < <(watcher_binding)
+    systemd-run --user --quiet --collect --unit="$UNIT" \
+      --description="Omarchy clamshell lid inhibitor" \
+      --property=PartOf=graphical-session.target "${bind[@]}" \
+      systemd-inhibit --no-ask-password --what=handle-lid-switch --mode=block \
+      --who=Omarchy --why="External display in use" sleep infinity
+  fi
+elif held; then
+  systemctl --user stop "$UNIT"
+fi
@@ -20,6 +20,6 @@ fi
 # Create symlink to the new background media
 ln -nsf "$BACKGROUND" "$CURRENT_BACKGROUND_LINK"

-# Update the live shell background immediately when it is running. The
-# background plugin also polls this symlink, but IPC avoids the visible delay.
+# Update the live shell background when it is running. Nothing watches the
+# symlink, so this is how the shell learns of the new background.
 omarchy-shell -q background set "$BACKGROUND"
@@ -207,11 +207,14 @@ set_theme_background() {
      shell_ipc shell applyTheme "$colors_payload" "$shell_payload" || true
    ln -nsf "$new_background" "$CURRENT_BACKGROUND_LINK"
    (
-      if ! omarchy-theme-bg-boot-intro --theme-switch "$new_background" "$theme_id" "$intro_prepared"; then
-        if [[ $(readlink -f "$CURRENT_BACKGROUND_LINK") == "$(readlink -f "$new_background")" &&
-          $(stat -Lc '%d:%i' "$CURRENT_THEME_PATH" 2>/dev/null) == "$theme_id" ]]; then
-          shell_ipc background setInstant "$new_background" || true
-        fi
+      # Played or not, the shell gets the new still: it still holds the old
+      # theme's path, which the theme swap above deleted, and loads it again
+      # when OWE hands the desktop back after the intro. While the intro plays
+      # the shell's background is suspended under it, so the swap is unseen.
+      omarchy-theme-bg-boot-intro --theme-switch "$new_background" "$theme_id" "$intro_prepared" || true
+      if [[ $(readlink -f "$CURRENT_BACKGROUND_LINK") == "$(readlink -f "$new_background")" &&
+        $(stat -Lc '%d:%i' "$CURRENT_THEME_PATH" 2>/dev/null) == "$theme_id" ]]; then
+        shell_ipc background setInstant "$new_background" || true
      fi
      shell_ipc shell finishThemeIntro "$theme_id" || true
      wait_for_theme_intro themeIntroStatus "$theme_id" "pending"
@@ -1,9 +1,10 @@
 #!/bin/bash

-# omarchy:summary=Apply current Omarchy theme colors to running Foot terminals
+# omarchy:summary=Apply current Omarchy theme colors and background alpha to running Foot terminals
 # omarchy:hidden=true

 colors_toml=$HOME/.local/state/omarchy/current/theme/colors.toml
+foot_ini=$HOME/.local/state/omarchy/current/theme/foot.ini

 if [[ ! -f $colors_toml ]] || ! pgrep -x foot >/dev/null; then
  exit 0
@@ -12,6 +13,16 @@ fi
 foot_osc=$(omarchy-theme-osc "$colors_toml")
 [[ -n $foot_osc ]] || exit 0

+# foot takes a background alpha as an urxvt-style [percent] prefix, so a theme
+# going see-through or back, as with Glassy windows, reaches running terminals.
+# The last alpha in the theme's foot.ini wins, as it does when foot reads it.
+alpha=$(sed -n 's/^[[:space:]]*alpha[[:space:]]*=[[:space:]]*\([0-9.]*\).*/\1/p' "$foot_ini" 2>/dev/null | tail -n 1)
+background=$(omarchy-theme-color --file "$colors_toml" background 2>/dev/null)
+if [[ -n $background ]]; then
+  percent=$(awk -v alpha="${alpha:-1}" 'BEGIN { printf "%d", alpha * 100 + 0.5 }')
+  foot_osc+=$(printf '\033]11;[%d]%s\007' "$percent" "$background")
+fi
+
 for foot_pid in $(pgrep -x foot); do
  for child_pid in $(pgrep -P "$foot_pid"); do
    tty=$(readlink "/proc/$child_pid/fd/1" 2>/dev/null)
@@ -0,0 +1,122 @@
+#!/bin/bash
+
+# omarchy:summary=Give terminals, btop, and GTK apps a see-through background while windows are glassy
+# omarchy:args=[theme-dir]
+# omarchy:hidden=true
+
+# A Hyprland opacity rule fades a terminal's text along with its background,
+# and foot turns compositor blur down unless its own config asks for it, so the
+# glass belongs in each terminal's theme file, as in the glassy Starship
+# (#14726). The lines sit between markers so leaving glassy takes them out
+# again, and a theme that sets its own opacity keeps it.
+
+THEME_DIR="${1:-$HOME/.local/state/omarchy/current/theme}"
+TOGGLES_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/omarchy/toggles/hypr"
+GLASSY=false
+[[ -f $TOGGLES_DIR/window-glassy.lua ]] && GLASSY=true
+status=0
+
+# A literal for a sed address, whose delimiter is /.
+regex() {
+  sed 's/[][\\.*^$/]/\\&/g' <<<"$1"
+}
+
+# A block added to a file that did not end in a newline has to supply one, so
+# its begin marker says so, and taking the block out takes that newline back.
+# Leaving glassy then gives the file back exactly as it was. Markers come as
+# an opening and a closing part, so CSS can wrap them in a comment.
+remove_block() {
+  local file="$1" open="$2" close="$3"
+  local begin end
+  begin=$(regex "$open omarchy-glass begin")
+  end=$(regex "$open omarchy-glass end$close")
+  [[ -f $file ]] && grep -qF "$open omarchy-glass begin" "$file" || return 0
+
+  local added_newline=false
+  grep -qxF "$open omarchy-glass begin after a line without a newline$close" "$file" && added_newline=true
+  sed -i "/^$begin/,/^$end\$/d" "$file" || return 1
+  if [[ $added_newline == "true" && -s $file && -z $(tail -c 1 "$file") ]]; then
+    truncate -s -1 "$file" || return 1
+  fi
+}
+
+append_block() {
+  local file="$1" open="$2" close="$3" lines="$4"
+  if [[ -s $file && -n $(tail -c 1 "$file") ]]; then
+    printf '\n%s\n%s\n%s\n' "$open omarchy-glass begin after a line without a newline$close" "$lines" "$open omarchy-glass end$close" >>"$file"
+  else
+    printf '%s\n%s\n%s\n' "$open omarchy-glass begin$close" "$lines" "$open omarchy-glass end$close" >>"$file"
+  fi
+}
+
+# Each setting comes with a pattern for the theme setting it already, which
+# keeps the theme's own; an empty pattern always adds it. Lines that belong in
+# a section go in under its header. A file that already has the section gets
+# them inside it, since TOML refuses a table declared twice; otherwise the
+# header comes along with them.
+glass() {
+  local file="$THEME_DIR/$1" section="$2"
+  shift 2
+  [[ -f $file ]] || return 0
+
+  remove_block "$file" "#" "" || return 1
+  [[ $GLASSY == "true" ]] || return 0
+
+  local lines=""
+  while (( $# >= 2 )); do
+    if [[ -z $1 ]] || ! grep -qE "$1" "$file"; then
+      lines+="${lines:+$'\n'}$2"
+    fi
+    shift 2
+  done
+  [[ -n $lines ]] || return 0
+
+  # A header may carry trailing space or a comment.
+  local header="^$(regex "$section")[[:space:]]*(#.*)?\$"
+  if [[ -n $section ]] && grep -qE "$header" "$file"; then
+    local block
+    block=$(mktemp) || return 1
+    printf '# omarchy-glass begin\n%s\n# omarchy-glass end\n' "$lines" >"$block"
+    sed -i -E "0,/$header/{/$header/r $block
+}" "$file"
+    local result=$?
+    rm -f "$block"
+    return $result
+  fi
+
+  append_block "$file" "#" "" "${section:+$section$'\n'}$lines"
+}
+
+# Alacritty's own blur works only on macOS and KDE; Hyprland blurs it anyway.
+glass alacritty.toml '[window]' \
+  '^[[:space:]]*opacity[[:space:]]*=' 'opacity = 0.65' || status=1
+glass foot.ini '[colors-dark]' \
+  '^[[:space:]]*alpha[[:space:]]*=' 'alpha=0.65' \
+  '^[[:space:]]*blur[[:space:]]*=' 'blur=yes' || status=1
+glass kitty.conf '' \
+  '^[[:space:]]*background_opacity[[:space:]]' 'background_opacity 0.65' || status=1
+# btop paints its own background over the terminal's glass. An empty main_bg
+# uses the terminal background; the last theme value wins, so removing the
+# block restores the theme's colour without changing btop's user config.
+glass btop.theme '' \
+  '^[[:space:]]*theme\[main_bg\][[:space:]]*=[[:space:]]*""' 'theme[main_bg]=""' || status=1
+# GTK only asks Hyprland for blur under a CSS backdrop-filter, which Ghostty
+# takes as custom CSS and reloads live; its background-blur speaks only KDE's
+# blur protocol.
+glass ghostty.conf '' \
+  '^[[:space:]]*background-opacity[[:space:]]*=' 'background-opacity = 0.65' \
+  '' "gtk-custom-css = $OMARCHY_PATH/default/gtk/glass.css" || status=1
+
+# Other GTK apps, such as Nautilus, read the user's gtk.css at launch, so the
+# same backdrop blur is imported there. It follows the mode alone, so a theme
+# switch, which names the theme it is rendering, leaves it be.
+if (( $# == 0 )); then
+  gtk_css="${XDG_CONFIG_HOME:-$HOME/.config}/gtk-4.0/gtk.css"
+  remove_block "$gtk_css" "/*" " */" || status=1
+  if [[ $GLASSY == "true" ]]; then
+    { mkdir -p "${gtk_css%/*}" &&
+      append_block "$gtk_css" "/*" " */" "@import url(\"file://$OMARCHY_PATH/default/gtk/glass.css\");"; } || status=1
+  fi
+fi
+
+exit $status
@@ -451,3 +451,4 @@ if [[ -f $COLORS_FILE ]]; then
 fi

 apply_shell_section_overrides
+omarchy-theme-set-glass "$NEXT_THEME_DIR"
@@ -1,6 +1,6 @@
 #!/bin/bash

-# omarchy:summary=Toggle animations, transparency and other effects that are slow without a GPU
+# omarchy:summary=Toggle animations, blur and shadows, which are slow without a GPU
 # omarchy:args=[toggle|on|off]
 # omarchy:examples=omarchy toggle animations | omarchy toggle animations off | omarchy toggle animations on

@@ -16,7 +16,7 @@ off) omarchy-hyprland-toggle no-animations on ;;
 esac

 if omarchy-hyprland-toggle-enabled no-animations; then
-  omarchy-notification-send -g 󰕟 "$(omarchy-text "Animations disabled")"
+  omarchy-notification-send -g 󰗘 "$(omarchy-text "Animations disabled")"
 else
-  omarchy-notification-send -g 󰕟 "$(omarchy-text "Animations enabled")"
+  omarchy-notification-send -g 󰗘 "$(omarchy-text "Animations enabled")"
 fi
@@ -1,6 +1,6 @@
 #!/bin/bash

-# omarchy:summary=Toggle bar visibility without killing the Omarchy shell
+# omarchy:summary=Toggle bar visibility without killing the Omarchy shell (on hides the bar, off shows it)
 # omarchy:args=[toggle|on|off]
 # omarchy:examples=omarchy toggle bar | omarchy toggle bar off | omarchy toggle bar on

@@ -148,6 +148,15 @@ if [[ ${1:-} == "-y" ]] || omarchy-update-confirm; then
  PATH="$OMARCHY_PATH/default/omarchy/sudo-no-update:$PATH" OMARCHY_SUDO_NO_UPDATE=1 omarchy-update-aur-pkgs
  omarchy_security_revoke_sudo_timestamp

+  # The last sudo-capable step: the boot files every package step left, AUR
+  # packages' initramfs rebuilds included, must be shown to boot the updated
+  # system. It follows third-party build code, so it starts cold and, like AUR,
+  # authorizes one command through the no-update wrapper without a reusable
+  # timestamp. Until it passes, the update neither finishes nor offers a reboot.
+  boot_verified=1
+  PATH="$OMARCHY_PATH/default/omarchy/sudo-no-update:$PATH" OMARCHY_SUDO_NO_UPDATE=1 omarchy-update-boot || boot_verified=0
+  omarchy_security_revoke_sudo_timestamp
+
  # The sleep inhibitor covers AUR builds, hooks and mise as well; releasing it
  # needs no privilege because the held command already dropped to this user.
  # Release it before offering a reboot: a confirmed reboot can terminate this
@@ -156,5 +165,10 @@ if [[ ${1:-} == "-y" ]] || omarchy-update-confirm; then
  omarchy-update-stay-awake stop
  update_stay_awake_stopped=1

-  "$OMARCHY_PATH/bin/omarchy-update-restart" --reboot-only
+  if (( boot_verified )); then
+    "$OMARCHY_PATH/bin/omarchy-update-restart" --reboot-only
+  else
+    echo -e "\e[31m\nThe update is not finished: its boot files did not pass verification (see above). Do not reboot until omarchy update completes.\e[0m" >&2
+    exit 1
+  fi
 fi
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+# omarchy:summary=Verify the platform's boot chain after the update's package changes
+# omarchy:hidden=true
+# omarchy:requires-sudo=true
+
+# Proves that the boot files the package steps left boot the updated system;
+# omarchy update neither finishes nor offers a reboot until this passes. It is
+# the update-verify lifecycle dispatch operation: a no-op where the platform
+# registers no boot package, x86 included, and the platform's own entrypoint
+# says what failed.
+
+set -e
+
+if (( $# )); then
+  echo "Usage: omarchy-update-boot" >&2
+  exit 2
+fi
+operation=update-verify
+
+# Resolving as the user keeps sudo, and its password prompt, out of updates
+# with nothing to run. Root resolves again from its own fixed paths before
+# anything runs.
+errors=$(mktemp)
+trap 'rm -f "$errors"' EXIT
+status=0
+resolved=$(omarchy-lifecycle-dispatch --resolve "$operation" 2>"$errors") || status=$?
+
+# 3: the platform's boot package is not installed at all. Such a machine
+# predates it and boots a chain the package does not manage, so verification
+# warns instead of failing every update until the package is installed.
+if (( status == 3 )); then
+  echo -e "\e[33m\n$(sed 's/^Error: //' "$errors")\nThe boot files were not verified. This machine predates its platform's boot package; updates verify them once it is installed.\e[0m" >&2
+elif (( status != 0 )); then
+  cat "$errors" >&2
+  exit "$status"
+elif [[ -n $resolved ]]; then
+  sudo omarchy-lifecycle-dispatch "$operation"
+fi
@@ -22,8 +22,32 @@ fi

 # Ensure we have the latest archlinux-keyring, maintainer keys might have changed
 # Always reinstall, as the keyring can be updated without a package version bump.
+# An aarch64 machine's Arch Linux ARM repositories are signed with keys of
+# their own, so its keyring is kept current the same way.
+keyrings=(archlinux-keyring)
+if omarchy-hw-aarch64 && omarchy-pkg-present archlinuxarm-keyring; then
+  keyrings+=(archlinuxarm-keyring)
+fi
+# A platform package names the signing keyrings of the repositories it adds,
+# one package per line. Only installed ones are refreshed, so this adds no
+# repository the machine didn't already trust; a refreshed keyring may carry
+# that repository's new keys. A line that isn't one keyring package name is
+# skipped with a warning, so a mistake in the list can't stop every update.
+platform_keyrings=/usr/share/omarchy-platform/keyrings
+if [[ -f $platform_keyrings ]]; then
+  while read -r keyring extra || [[ -n $keyring ]]; do
+    [[ -n $keyring && $keyring != \#* ]] || continue
+    if [[ -n $extra || ! $keyring =~ ^[a-z0-9][a-z0-9@._+-]*-keyring$ ]]; then
+      echo "Warning: skipping ${keyring}${extra:+ $extra} in $platform_keyrings: not a keyring package name" >&2
+      continue
+    fi
+    if omarchy-pkg-present "$keyring" && [[ " ${keyrings[*]} " != *" $keyring "* ]]; then
+      keyrings+=("$keyring")
+    fi
+  done <"$platform_keyrings"
+fi
 echo -e "\e[32m\nUpdate Arch signing keys\e[0m"
-sudo pacman -Sy --noconfirm archlinux-keyring >/dev/null 2> >(grep -vE '^warning: archlinux-keyring-[^ ]+ is up to date -- reinstalling$' >&2)
+sudo pacman -Sy --noconfirm "${keyrings[@]}" >/dev/null 2> >(grep -vE '^warning: [a-z0-9@._+-]+-keyring-[^ ]+ is up to date -- reinstalling$' >&2)

 # Say "correct" only once the key verifiably is: before the failure checks
 # above, a failed recv or reinstall still ended here with exit 0.
@@ -98,6 +98,17 @@ mapfile -t leftovers < <(
 # the moved files inactive for nothing.
 ((${#leftovers[@]} == $(grep -c ' exists in filesystem' "$errors"))) || exit 1

+# A platform whose boot package owns the boot chain may also have files no
+# package owns that it can't do without (written by its image or installer).
+# Its boot package vouches for the takeover or refuses it, and the files stay.
+# Where the platform registers none, nothing resolves and nothing asks for root.
+takeover=$(omarchy-lifecycle-dispatch --resolve update-takeover) || exit 1
+if [[ -n $takeover ]] && ! sudo omarchy-lifecycle-dispatch update-takeover "${leftovers[@]}"; then
+  echo -e "\e[33m\nThis platform keeps these files, so the upgrade can't take them over:\e[0m" >&2
+  printf '  %s\n' "${leftovers[@]}" >&2
+  exit 1
+fi
+
 echo -e "\e[33m\nTaking over files pacman doesn't own yet:\e[0m"
 for path in "${leftovers[@]}"; do
  sudo mkdir -p "$replaced${path%/*}"
@@ -807,6 +807,11 @@ install_omarchy_quattro_packages() {
  if [[ -f /usr/share/omarchy/install/omarchy-base.packages ]]; then
    log "Installing Omarchy quattro default package set"
    mapfile -t base_packages < <(sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' /usr/share/omarchy/install/omarchy-base.packages)
+    # Some base packages have no aarch64 build.
+    if [[ $(uname -m) != "x86_64" && -f /usr/share/omarchy/install/omarchy-x86_64-only.packages ]]; then
+      mapfile -t base_packages < <(printf '%s\n' "${base_packages[@]}" |
+        grep -vxF -f <(sed -e 's/[[:space:]]*#.*$//' -e '/^[[:space:]]*$/d' /usr/share/omarchy/install/omarchy-x86_64-only.packages))
+    fi
    if (( ${#base_packages[@]} )); then
      as_root pacman -S --needed --noconfirm --ask 4 --overwrite='*' "${base_packages[@]}"
      mark_packages_explicit "${base_packages[@]}"
@@ -234,6 +234,11 @@ if [[ -n $MIME_TYPES ]]; then
  printf 'MimeType=%s\n' "$(desktop_string_escape "$MIME_TYPES")" >>"$DESKTOP_FILE"
 fi

+# Floating titlebars name the window after this entry rather than its page title.
+if [[ -z $CUSTOM_EXEC ]]; then
+  printf 'StartupWMClass=%s\n' "$(desktop_string_escape "$(omarchy-webapp-window-class "$APP_URL")")" >>"$DESKTOP_FILE"
+fi
+
 chmod +x "$DESKTOP_FILE"

 if [[ $INTERACTIVE_MODE == "true" ]]; then
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+# omarchy:summary=Print the window class Chromium gives a web app opened at a URL
+# omarchy:args=<url>
+# omarchy:hidden=true
+
+# Chromium names an --app window after the URL's host and path, so a web app's
+# launcher can name its window in StartupWMClass, which titlebars use to show
+# the app's name rather than the page title.
+
+url=${1:-}
+if [[ -z $url ]]; then
+  echo "Usage: omarchy-webapp-window-class <url>" >&2
+  exit 1
+fi
+
+address=${url#*://}
+address=${address%%[?#]*}
+host=${address%%/*}
+path=${address:${#host}}
+host=${host##*@}
+host=${host%%:*}
+
+printf 'chrome-%s_%s-Default\n' "${host,,}" "${path:-/}" | sed 's|/|_|g'
@@ -4,6 +4,12 @@
 # omarchy:args=<install|remove|launch|stop|status> [options]
 # omarchy:requires-sudo=true

+# The VM is an x86_64 Windows guest under KVM, which only an x86_64 host runs.
+if ! omarchy-hw-x86; then
+  echo "Windows VM needs an x86_64 machine (it runs an x86_64 guest under KVM)." >&2
+  exit 1
+fi
+
 # The Windows VM runs a privileged container (KVM, /dev/net/tun, NET_ADMIN), so
 # it needs the root-owned Docker daemon. By default the user is NOT in the docker
 # group (that group is root-equivalent), so Docker access is gated behind a
@@ -1,8 +1,7 @@
-# Leave Ctrl+Space to tmux/Herdr and the Super shortcuts to the desktop.
+# Omarchy binds Super+I. Leave Ctrl+Space to tmux/Herdr and other Super keys to the desktop.
 [Hotkey/TriggerKeys]
-0=Control+Shift+space
-1=Zenkaku_Hankaku
-2=Hangul
+0=Zenkaku_Hankaku
+1=Hangul

 [Hotkey/ActivateKeys]
 0=Henkan
@@ -10,7 +9,9 @@
 [Hotkey/DeactivateKeys]
 0=Muhenkan

+# A lone Shift leaves an engine like Pinyin for Latin input and returns to it.
 [Hotkey/AltTriggerKeys]
+0=Shift_L

 [Hotkey/EnumerateGroupForwardKeys]

@@ -6,9 +6,12 @@
 name = "terminal"

 [theme.custom]
-# The active tab is drawn as panel_bg text on an accent background, so panel_bg
-# has to be dark for it to read - same colors as status-left's "#[fg=black,bg=blue]"
-panel_bg = "black"
+# The tab bar sits on the terminal's own background, like tmux's bg=default, so
+# it turns see-through with the rest of the terminal under Glassy windows. With
+# no panel_bg the active tab's text falls back to surface_dim, so that is black
+# for dark text on the accent - same colors as status-left's "#[fg=black,bg=blue]"
+panel_bg = "reset"
+surface_dim = "black"

 [terminal]
 # Matches -c "#{pane_current_path}" on every split, window, and session
@@ -7,7 +7,7 @@
 --   input = {
 --     -- Use multiple keyboard layouts and switch between them with Left Alt + Right Alt.
 --     kb_layout = "us,dk,eu",
--     kb_options = "compose:caps,shift:both_capslock_cancel,grp:alts_toggle",
+--     kb_options = "omarchy:shift_caps_compose,grp:alts_toggle",
 --
 --     -- Use a specific keyboard variant if needed (e.g. intl for international keyboards).
 --     kb_variant = "intl",
@@ -6,7 +6,7 @@
  },
  "bar": {
    "position": "top",
-    "transparent": false,
+    "background": "opaque",
    "centerAnchor": "omarchy.clock",
    "layout": {
      "left": [
@@ -21,9 +21,6 @@
        {
          "id": "omarchy.indicators"
        },
-        {
-          "id": "omarchy.elsewhen"
-        },
        {
          "id": "omarchy.clock",
          "format": "dddd HH:mm",
@@ -31,7 +28,7 @@
          "verticalFormat": "HH\n\u2014\nmm"
        },
        {
-          "id": "omarchy.keyboard-layout"
+          "id": "omarchy.elsewhen"
        },
        {
          "id": "omarchy.weather"
@@ -41,6 +38,9 @@
        }
      ],
      "right": [
+        {
+          "id": "omarchy.keyboard-layout"
+        },
        {
          "id": "omarchy.tray"
        },
@@ -1,268 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--The Xournal++ settings file. Do not edit this file! Most settings are available in the Settings dialog, the others are commented in this file, but handle with care!-->
-<settings>
-  <property name="pressureSensitivity" value="true"/>
-  <property name="minimumPressure" value="0.05"/>
-  <property name="pressureMultiplier" value="1"/>
-  <property name="zoomGesturesEnabled" value="true"/>
-  <property name="selectedToolbar" value="Portrait"/>
-  <property name="lastSavePath" value=""/>
-  <property name="lastOpenPath" value=""/>
-  <property name="lastImagePath" value=""/>
-  <property name="edgePanSpeed" value="20"/>
-  <property name="edgePanMaxMult" value="5"/>
-  <property name="zoomStep" value="10"/>
-  <property name="zoomStepScroll" value="2"/>
-  <property name="displayDpi" value="72"/>
-  <property name="mainWndWidth" value="800"/>
-  <property name="mainWndHeight" value="600"/>
-  <property name="maximized" value="true"/>
-  <property name="showToolbar" value="true"/>
-  <property name="showSidebar" value="true"/>
-  <property name="sidebarWidth" value="150"/>
-  <property name="sidebarNumberingStyle" value="1"/>
-  <property name="sidebarOnRight" value="false"/>
-  <property name="scrollbarOnLeft" value="false"/>
-  <property name="menubarVisible" value="true"/>
-  <property name="filepathShownInTitlebar" value="false"/>
-  <property name="numColumns" value="1"/>
-  <property name="numRows" value="1"/>
-  <property name="viewFixedRows" value="false"/>
-  <property name="showPairedPages" value="false"/>
-  <property name="layoutVertical" value="false"/>
-  <property name="layoutRightToLeft" value="false"/>
-  <property name="layoutBottomToTop" value="false"/>
-  <property name="numPairsOffset" value="1"/>
-  <!--The icon theme, allowed values are "disabled", "onDrawOfLastPage", and "onScrollOfLastPage"-->
-  <property name="emptyLastPageAppend" value="disabled"/>
-  <property name="presentationMode" value="false"/>
-  <!--Which GUI elements are shown in default view mode, separated by a colon (,)-->
-  <property name="defaultViewModeAttributes" value="showMenubar,showToolbar,showSidebar"/>
-  <!--Which GUI elements are shown in fullscreen view mode, separated by a colon (,)-->
-  <property name="fullscreenViewModeAttributes" value="goFullscren,showToolbar,showSidebar"/>
-  <!--Which GUI elements are shown in presentation view mode, separated by a colon (,)-->
-  <property name="presentationViewModeAttributes" value="goFullscren,showToolbar"/>
-  <!--The cursor icon used with a stylus, allowed values are "none", "dot", "big", "arrow"-->
-  <property name="stylusCursorType" value="dot"/>
-  <!--The eraser cursor visibility used with a stylus, allowed values are "never", "always", "hover", "touch"-->
-  <property name="eraserVisibility" value="always"/>
-  <!--The icon theme, allowed values are "iconsColor", "iconsLucide"-->
-  <property name="iconTheme" value="iconsColor"/>
-  <!--Dark/light mode, allowed values are "useSystem", "forceLight", "forceDark"-->
-  <property name="themeVariant" value="forceDark"/>
-  <property name="highlightPosition" value="false"/>
-  <property name="cursorHighlightColor" value="2164260608"/>
-  <property name="cursorHighlightBorderColor" value="2147483903"/>
-  <property name="cursorHighlightRadius" value="30"/>
-  <property name="cursorHighlightBorderWidth" value="0"/>
-  <property name="useStockIcons" value="false"/>
-  <property name="disableScrollbarFadeout" value="false"/>
-  <property name="disableAudio" value="false"/>
-  <!--Hides scroolbars in the main window, allowed values: "none", "horizontal", "vertical", "both"-->
-  <property name="scrollbarHideType" value="none"/>
-  <property name="autoloadMostRecent" value="false"/>
-  <property name="autoloadPdfXoj" value="true"/>
-  <property name="defaultSaveName" value="%F-Note-%H-%M"/>
-  <property name="defaultPdfExportName" value="%{name}_annotated"/>
-  <property name="autosaveEnabled" value="true"/>
-  <property name="autosaveTimeout" value="3"/>
-  <property name="addHorizontalSpace" value="false"/>
-  <property name="addHorizontalSpaceAmount" value="150"/>
-  <property name="addVerticalSpace" value="false"/>
-  <property name="addVerticalSpaceAmount" value="150"/>
-  <property name="drawDirModsEnabled" value="false"/>
-  <property name="drawDirModsRadius" value="50"/>
-  <property name="snapRotation" value="true"/>
-  <property name="snapRotationTolerance" value="0.3"/>
-  <property name="snapGrid" value="true"/>
-  <property name="snapGridTolerance" value="0.5"/>
-  <property name="snapGridSize" value="14.17"/>
-  <property name="strokeRecognizerMinSize" value="40"/>
-  <property name="touchDrawing" value="false"/>
-  <property name="gtkTouchInertialScrolling" value="true"/>
-  <property name="pressureGuessing" value="false"/>
-  <property name="selectionBorderColor" value="4294901760"/>
-  <property name="backgroundColor" value="4292664021"/>
-  <property name="selectionMarkerColor" value="4285702095"/>
-  <property name="touchZoomStartThreshold" value="0"/>
-  <property name="pageRerenderThreshold" value="5"/>
-  <!--The count of rendered PDF pages which will be cached.-->
-  <property name="pdfPageCacheSize" value="10"/>
-  <property name="preloadPagesBefore" value="3"/>
-  <property name="preloadPagesAfter" value="5"/>
-  <property name="eagerPageCleanup" value="true"/>
-  <!--Config for new pages-->
-  <property name="pageTemplate" value="xoj/template&#10;copyLastPageSettings=true&#10;size=595.275591x841.889764&#10;backgroundType=lined&#10;backgroundColor=#ffffff&#10;"/>
-  <property name="sizeUnit" value=""/>
-  <property name="audioFolder" value=""/>
-  <property name="audioInputDevice" value="-1"/>
-  <property name="audioOutputDevice" value="-1"/>
-  <property name="audioSampleRate" value="44100"/>
-  <property name="audioGain" value="1"/>
-  <property name="defaultSeekTime" value="5"/>
-  <property name="pluginEnabled" value=""/>
-  <property name="pluginDisabled" value=""/>
-  <property name="strokeFilterIgnoreTime" value="150"/>
-  <property name="strokeFilterIgnoreLength" value="1"/>
-  <property name="strokeFilterSuccessiveTime" value="500"/>
-  <property name="strokeFilterEnabled" value="false"/>
-  <property name="doActionOnStrokeFiltered" value="false"/>
-  <property name="trySelectOnStrokeFiltered" value="false"/>
-  <property name="snapRecognizedShapesEnabled" value="false"/>
-  <property name="restoreLineWidthEnabled" value="false"/>
-  <property name="numIgnoredStylusEvents" value="0"/>
-  <property name="inputSystemTPCButton" value="false"/>
-  <property name="inputSystemDrawOutsideWindow" value="true"/>
-  <property name="preferredLocale" value=""/>
-  <property name="stabilizerAveragingMethod" value="0"/>
-  <property name="stabilizerPreprocessor" value="0"/>
-  <property name="stabilizerBuffersize" value="20"/>
-  <property name="stabilizerSigma" value="0.5"/>
-  <property name="stabilizerDeadzoneRadius" value="1.3"/>
-  <property name="stabilizerDrag" value="0.4"/>
-  <property name="stabilizerMass" value="5"/>
-  <property name="stabilizerCuspDetection" value="true"/>
-  <property name="stabilizerFinalizeStroke" value="true"/>
-  <property name="latexSettings.autoCheckDependencies" value="true"/>
-  <property name="latexSettings.defaultText" value="x^2"/>
-  <property name="latexSettings.globalTemplatePath" value="/usr/share/xournalpp/resources/default_template.tex"/>
-  <property name="latexSettings.genCmd" value="pdflatex -halt-on-error -interaction=nonstopmode '{}'"/>
-  <property name="latexSettings.sourceViewThemeId" value=""/>
-  <property name="latexSettings.editorFont" value="Monospace 12"/>
-  <property name="latexSettings.useCustomEditorFont" value="false"/>
-  <property name="latexSettings.editorWordWrap" value="true"/>
-  <property name="latexSettings.sourceViewAutoIndent" value="true"/>
-  <property name="latexSettings.sourceViewSyntaxHighlight" value="true"/>
-  <property name="latexSettings.sourceViewShowLineNumbers" value="false"/>
-  <property name="font" font="Sans" size="12"/>
-  <data name="buttonConfig">
-    <data name="default">
-      <attribute name="color" type="hex" value="ff000000"/>
-      <attribute name="drawingType" type="string" value="default"/>
-      <attribute name="size" type="string" value="thin"/>
-      <attribute name="tool" type="string" value="pen"/>
-    </data>
-    <data name="eraser">
-      <attribute name="eraserMode" type="string" value="none"/>
-      <attribute name="size" type="string" value="none"/>
-      <attribute name="tool" type="string" value="eraser"/>
-    </data>
-    <data name="middle">
-      <attribute name="tool" type="string" value="hand"/>
-    </data>
-    <data name="right">
-      <attribute name="tool" type="string" value="none"/>
-    </data>
-    <data name="stylus">
-      <attribute name="tool" type="string" value="none"/>
-    </data>
-    <data name="stylus2">
-      <attribute name="tool" type="string" value="none"/>
-    </data>
-    <data name="touch">
-      <attribute name="device" type="string" value=""/>
-      <attribute name="disableDrawing" type="boolean" value="false"/>
-      <attribute name="tool" type="string" value="none"/>
-    </data>
-  </data>
-  <data name="deviceClasses">
-    <data name="Wayland Finger Scrolling">
-      <attribute name="deviceClass" type="int" value="1"/>
-      <attribute name="deviceSource" type="int" value="6"/>
-    </data>
-    <data name="Wayland Pointer">
-      <attribute name="deviceClass" type="int" value="1"/>
-      <attribute name="deviceSource" type="int" value="0"/>
-    </data>
-  </data>
-  <data name="tools">
-    <attribute name="current" type="string" value="text"/>
-    <data name="drawArrow">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="drawCoordinateSystem">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="drawDoubleArrow">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="drawEllipse">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="drawRect">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="drawSpline">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="eraser">
-      <attribute name="drawingType" type="string" value="default"/>
-      <attribute name="size" type="string" value="MEDIUM"/>
-      <attribute name="type" type="string" value="default"/>
-    </data>
-    <data name="hand">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="highlighter">
-      <attribute name="color" type="hex" value="ffffff00"/>
-      <attribute name="drawingType" type="string" value="default"/>
-      <attribute name="fill" type="int" value="0"/>
-      <attribute name="fillAlpha" type="int" value="128"/>
-      <attribute name="size" type="string" value="MEDIUM"/>
-    </data>
-    <data name="image">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="pen">
-      <attribute name="color" type="hex" value="ff3333cc"/>
-      <attribute name="drawingType" type="string" value="default"/>
-      <attribute name="fill" type="int" value="0"/>
-      <attribute name="fillAlpha" type="int" value="128"/>
-      <attribute name="size" type="string" value="MEDIUM"/>
-      <attribute name="style" type="string" value="plain"/>
-    </data>
-    <data name="playObject">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="selectMultiLayerRect">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="selectMultiLayerRegion">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="selectObject">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="selectPdfTextLinear">
-      <attribute name="color" type="hex" value="ff000000"/>
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="selectPdfTextRect">
-      <attribute name="color" type="hex" value="ff000000"/>
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="selectRect">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="selectRegion">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="showFloatingToolbox">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="text">
-      <attribute name="color" type="hex" value="ff000000"/>
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-    <data name="verticalSpace">
-      <attribute name="drawingType" type="string" value="default"/>
-    </data>
-  </data>
-  <data name="touch">
-    <attribute name="cmdDisable" type="string" value=""/>
-    <attribute name="cmdEnable" type="string" value=""/>
-    <attribute name="disableTouch" type="boolean" value="false"/>
-    <attribute name="method" type="string" value="auto"/>
-    <attribute name="timeout" type="int" value="1000"/>
-  </data>
-</settings>
@@ -2,12 +2,12 @@
 name: omarchy
 description: >
  REQUIRED for end-user customization of Linux desktop, window manager, or system config.
-  Use when editing ~/.config/hypr/, ~/.config/omarchy/,
+  Use when editing ANY file in ~/.config/, ~/.config/hypr/, ~/.config/omarchy/,
  ~/.config/alacritty/, ~/.config/foot/, ~/.config/kitty/, or ~/.config/ghostty/.
-  Triggers: Hyprland, window rules, animations, keybindings, monitors, gaps, borders,
-  blur, opacity, omarchy-shell, bar, terminal config, themes, background,
-  night light, idle, lock screen, screenshots, reminders, layer rules, workspace
-  settings, display config, and user-facing omarchy commands. Excludes Omarchy
+  Triggers: Hyprland, window rules, window behavior, animations, keybindings, monitors, gaps, borders,
+  blur, opacity, omarchy-shell, bar, widgets, terminal config, themes, fonts, background,
+  night light, idle, lock screen, screenshots, screen recording, reminders, layer rules, workspace
+  settings, display config, appearance changes, and user-facing omarchy commands. Excludes Omarchy
  source development through `omarchy dev link` workflows.
 ---

@@ -18,24 +18,6 @@ Manage [Omarchy](https://omarchy.org/) Linux systems - a beautiful, fun, agentic
 This skill is for end-user customization on installed systems.
 It is not for contributing to Omarchy source code.

-## When This Skill MUST Be Used
-
-**ALWAYS invoke this skill for end-user requests involving ANY of these:**
-
- Editing ANY file in `~/.config/hypr/` (window rules, animations, keybindings, monitors, etc.)
- Editing `~/.config/omarchy/shell.json` (status bar layout, widgets)
- Editing terminal configs (alacritty, foot, kitty, ghostty)
- Editing ANY file in `~/.config/omarchy/`
- Window behavior, animations, opacity, blur, gaps, borders
- Layer rules, workspace settings, display/monitor configuration
- Themes, backgrounds, fonts, appearance changes
- User-facing `omarchy` commands (`omarchy theme ...`, `omarchy refresh ...`, `omarchy restart ...`, etc.)
- Screenshots, screen recording, reminders, night light, idle behavior, lock screen
-
-**If you're about to edit a config file in ~/.config/ on this system, STOP and use this skill first.**
-
-**Do NOT use this skill for Omarchy development tasks** (editing the Omarchy source tree, creating migrations, or running `omarchy dev ...` workflows).
-
 ## Topic Guides

 Deeper instructions for common areas live next to this file. Read the
@@ -17,6 +17,25 @@ changes. `idle.screensaver` and `idle.lock` are seconds since user idle began.

 **Commands:** `omarchy restart shell`, `omarchy refresh shell`

+## Plugin UI Safety
+
+Plugins run inside Omarchy's long-lived, unsandboxed shell. Treat text from network responses, files, IPC, settings, environment variables, and command output as untrusted.
+
+- QML `Text` defaults to `Text.AutoText`. Do not bind untrusted data to an AutoText sink: markup-shaped input such as `<img src="https://example.invalid/tracker">` can be interpreted as rich text and load a resource.
+- For display text owned by the plugin, set `textFormat: Text.PlainText`. Prefer a local `PlainText` component when the plugin has multiple text elements.
+
+```qml
+Text {
+  textFormat: Text.PlainText
+  text: modelData.name
+}
+```
+
+- When passing dynamic text to an Omarchy-owned component whose internal `Text` format the plugin cannot set, neutralize markup in the plugin first with a helper of its own, and add a regression test; Omarchy ships no such helper. Never edit the packaged component to add a plain-text option: that belongs in a pull request to Omarchy.
+- Bound and validate downloaded data before displaying or saving it: limit response and collection sizes, string lengths, identifiers, and timestamps.
+- Keep network access explicit. Use fixed HTTPS sources, timeouts, response-size limits, and validation. For periodic background refreshes, disclose the behavior and let users enable or disable it. Never execute downloaded content or interpolate untrusted values into shell commands.
+- Add regression coverage for markup-shaped input and every shared tooltip or notification sink that receives dynamic text.
+
 ## Bar Layout

 Use the `omarchy bar` group to move and manage widgets:
@@ -1,298 +1,6 @@
 <?xml version="1.0"?>
 <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
 <fontconfig>
-  <!-- CJK: fold the language tag onto one tag per Noto CJK variant -->
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="eq">
-      <string>zh</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-cn</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="eq">
-      <string>zh-hant</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-tw</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-hant-hk</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-hk</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-hant-mo</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-hk</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-hant</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-tw</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-hans</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-cn</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-sg</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-cn</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-mo</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-hk</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="eq">
-      <string>yue</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-hk</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>yue-hans</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-cn</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>yue-cn</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-cn</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>yue</string>
-    </test>
-    <edit name="lang" mode="assign">
-      <string>zh-hk</string>
-    </edit>
-  </match>
-
-  <!-- Then append that variant after the generic family it falls back from -->
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-cn</string>
-    </test>
-    <test name="family">
-      <string>sans-serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans CJK SC</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-cn</string>
-    </test>
-    <test name="family">
-      <string>serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Serif CJK SC</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-cn</string>
-    </test>
-    <test name="family">
-      <string>monospace</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans Mono CJK SC</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-hk</string>
-    </test>
-    <test name="family">
-      <string>sans-serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans CJK HK</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-hk</string>
-    </test>
-    <test name="family">
-      <string>serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Serif CJK HK</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-hk</string>
-    </test>
-    <test name="family">
-      <string>monospace</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans Mono CJK HK</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-tw</string>
-    </test>
-    <test name="family">
-      <string>sans-serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans CJK TC</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-tw</string>
-    </test>
-    <test name="family">
-      <string>serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Serif CJK TC</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <string>zh-tw</string>
-    </test>
-    <test name="family">
-      <string>monospace</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans Mono CJK TC</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <langset><string>ja</string></langset>
-    </test>
-    <test name="family">
-      <string>sans-serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans CJK JP</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <langset><string>ja</string></langset>
-    </test>
-    <test name="family">
-      <string>serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Serif CJK JP</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <langset><string>ja</string></langset>
-    </test>
-    <test name="family">
-      <string>monospace</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans Mono CJK JP</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <langset><string>ko</string></langset>
-    </test>
-    <test name="family">
-      <string>sans-serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans CJK KR</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <langset><string>ko</string></langset>
-    </test>
-    <test name="family">
-      <string>serif</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Serif CJK KR</string>
-    </edit>
-  </match>
-
-  <match target="pattern">
-    <test name="lang" qual="first" compare="contains">
-      <langset><string>ko</string></langset>
-    </test>
-    <test name="family">
-      <string>monospace</string>
-    </test>
-    <edit name="family" mode="append" binding="strong">
-      <string>Noto Sans Mono CJK KR</string>
-    </edit>
-  </match>
-
  <match target="pattern">
    <test name="family" qual="any">
      <string>sans-serif</string>
@@ -0,0 +1,7 @@
+/* GTK asks the compositor to blur behind a see-through window only where a
+   backdrop-filter blur covers it, so Glassy windows load this into GTK apps,
+   such as Ghostty and Nautilus. The compositor's own blur settings decide
+   how it looks. */
+window {
+  backdrop-filter: blur(20px);
+}
@@ -1,9 +1,15 @@
-if o.shell_succeeds("omarchy-default-dictation") then
+-- Bound only once the chosen backend's own program is installed (Omarchy ships
+-- every adapter): an aarch64 machine has no Superwhisper build, and
+-- push-to-talk would hold Right Alt (AltGr) for nothing.
+local pipe = io.popen("omarchy-default-dictation 2>/dev/null", "r")
+local backend = pipe and pipe:read("*l")
+if pipe then
+  pipe:close()
+end
+if backend and backend:match("^[%w%-]+$") and not o.cmd_missing(backend) then
  o.bind("SUPER + CTRL + X", "Toggle dictation", "omarchy-dictation toggle")
-  o.bind("F9", "Start dictation (push-to-talk)", "omarchy-dictation start")
-  o.bind("F9", "Stop dictation (push-to-talk)", "omarchy-dictation stop", { release = true })
+  o.bind_hold("F9", "Start dictation (push-to-talk)", "omarchy-dictation start", "Stop dictation (push-to-talk)", "omarchy-dictation stop")
  -- A modifier's mask changes between its press and release. Match the keysym
  -- independently of that mask; AltGr layouts use a different keysym.
-  o.bind("ALT + Alt_R", "Start dictation (push-to-talk)", "omarchy-dictation start", { ignore_mods = true })
-  o.bind("ALT + Alt_R", "Stop dictation (push-to-talk)", "omarchy-dictation stop", { release = true, ignore_mods = true })
+  o.bind_hold("ALT + Alt_R", "Start dictation (push-to-talk)", "omarchy-dictation start", "Stop dictation (push-to-talk)", "omarchy-dictation stop", { ignore_mods = true })
 end
@@ -1,5 +1,3 @@
-local paths = require("default.hypr.paths")
-
 -- Same terminal tag test as clipboard.lua.
 local function active_window_is_terminal()
  local window = hl.get_active_window()
@@ -16,50 +14,15 @@ local function active_window_is_terminal()
  return false
 end

-- Read on demand so adding an engine in a live desktop needs no reload.
-local function has_input_method()
-  local file = io.open(paths.config_home .. "/fcitx5/profile", "r")
-  if not file then return false end
-  local in_item, found = false, false
-  for line in file:lines() do
-    if line:match("^%[") then
-      in_item = line:match("^%[Groups/%d+/Items/%d+%]$") ~= nil
-    elseif in_item then
-      local name = line:match("^Name=(.+)$")
-      if name and not name:match("^keyboard%-") then found = true end
-    end
-  end
-  file:close()
-  return found
-end
-
-- Preserve custom Ctrl + Space triggers. Without a
-- [Hotkey/TriggerKeys] list in the config, fcitx5 uses its default, which has
-- Ctrl + Space.
-local function fcitx5_toggles_on_ctrl_space()
-  local file = io.open(paths.config_home .. "/fcitx5/config", "r")
-  if not file then
-    return true
-  end
-
-  local in_triggers, has_triggers, toggles = false, false, false
-  for line in file:lines() do
-    if line:match("^%[") then
-      in_triggers = line == "[Hotkey/TriggerKeys]"
-      has_triggers = has_triggers or in_triggers
-    elseif in_triggers and line:match("^%d+=Control%+space$") then
-      toggles = true
-    end
-  end
-
-  file:close()
-  return toggles or not has_triggers
-end
+-- Keep the desktop shortcut independent of Fcitx's custom switching keys.
+-- Read the live Fcitx group so setup works without a compositor reload.
+o.bind("SUPER + I", "Switch input language", "omarchy-input-method cycle")
+o.bind("SUPER + SHIFT + I", "Switch input language back", "omarchy-input-method cycle back")

 -- Pass the tmux/Herdr prefix through and return to direct input, so the next
 -- key reaches the multiplexer instead of the engine's composition.
 o.bind("CTRL + SPACE", "Direct input for the terminal prefix", function()
-  if active_window_is_terminal() and has_input_method() and not fcitx5_toggles_on_ctrl_space() then
+  if active_window_is_terminal() then
    -- Wait for the local controller reply before dispatching the next key.
    o.shell_succeeds("timeout 0.3 fcitx5-remote --check -c")
  end
@@ -11,7 +11,8 @@ o.bind("SUPER + ALT + F", "Full width", hl.dsp.window.fullscreen({ mode = "maxim
 o.bind("SUPER + O", "Pop window out (float & pin)", "omarchy-hyprland-window-pop")
 o.bind("SUPER + ALT + Home", "Save window width", "omarchy-hyprland-window-width save")
 o.bind("SUPER + Home", "Restore window width", "omarchy-hyprland-window-width restore")
-o.bind("SUPER + L", "Toggle workspace layout", "omarchy-hyprland-workspace-layout-toggle")
+o.bind("SUPER + L", "Cycle workspace layout", "omarchy-hyprland-workspace-layout-toggle")
+o.bind("SUPER + ALT + L", "Cycle workspace layout back", "omarchy-hyprland-workspace-layout-toggle back")

 o.bind("SUPER + LEFT", "Focus on left window", hl.dsp.focus({ direction = "l" }))
 o.bind("SUPER + RIGHT", "Focus on right window", hl.dsp.focus({ direction = "r" }))
@@ -34,6 +34,9 @@ o.bind("SUPER + CTRL + Delete", "Toggle laptop display", "omarchy-hyprland-monit
 o.bind("SUPER + CTRL + ALT + Delete", "Toggle laptop display mirroring", "omarchy-hyprland-monitor-internal-mirror toggle")
 o.bind("switch:on:Lid Switch", nil, "omarchy-system-lid-close", { locked = true })
 o.bind("switch:off:Lid Switch", nil, "omarchy-hyprland-monitor-clamshell", { locked = true })
+-- Apple Silicon reports its lid through the SMC, under its own switch name.
+o.bind("switch:on:Apple SMC power/lid events", nil, "omarchy-system-lid-close", { locked = true })
+o.bind("switch:off:Apple SMC power/lid events", nil, "omarchy-hyprland-monitor-clamshell", { locked = true })

 o.bind("PRINT", "Screenshot", "omarchy-capture-screenshot")
 o.bind("ALT + PRINT", "Screenrecording", "omarchy-capture-screenrecording --stop-recording || omarchy-menu toggle trigger.capture.screenrecord")
@@ -0,0 +1,22 @@
+-- Frosted glass from the glassy Starship (#14726), shared by Glassy windows and
+-- the Glassy bar: whatever is behind a see-through surface is blurred.
+return function()
+  hl.config({
+    decoration = {
+      blur = {
+        enabled = true,
+        size = 4,
+        passes = 2,
+        new_optimizations = true,
+        xray = false,
+        contrast = 1.0,
+        brightness = 0.75,
+        noise = 0.01,
+        vibrancy = 0.35,
+        vibrancy_darkness = 0.35,
+        popups = true,
+        special = true,
+      },
+    },
+  })
+end
@@ -206,6 +206,63 @@ function o.bind_toggle(keys, description, toggle, options)
  o.bind(keys, description, "omarchy-toggle-" .. toggle, options)
 end

+-- Bind one action to a key's press and another to its release, as for
+-- push-to-talk. Hyprland skips a plain release bind once another key or mouse
+-- button is released during the hold, or once the modifiers have changed, so
+-- typing while holding the key would never run the release. The release half
+-- here is transparent and ignores modifiers, and runs only after its own press
+-- did, so letting go of the key without the rest of the chord does nothing. It
+-- is also non-consuming: a release bind that ignores modifiers would otherwise
+-- take the key from apps whenever it is pressed with other modifiers, such as
+-- Shift+F9, or without them, such as a plain x for SUPER + X.
+function o.bind_hold(keys, press_description, press, release_description, release, options)
+  local held = false
+  press, release = command_from(press, press_description), command_from(release, release_description)
+
+  local function run(dispatcher)
+    if type(dispatcher) == "string" then
+      hl.exec_cmd(dispatcher)
+    elseif type(dispatcher) == "function" then
+      dispatcher()
+    else
+      hl.dispatch(dispatcher)
+    end
+  end
+
+  local function on_press()
+    held = true
+    run(press)
+  end
+
+  local function on_release()
+    if held then
+      held = false
+      run(release)
+    end
+  end
+
+  if type(press) == "string" then
+    o.bind_commands[on_press] = press
+  end
+  if type(release) == "string" then
+    o.bind_commands[on_release] = release
+  end
+
+  local press_options, release_options = {}, {}
+  for key, value in pairs(options or {}) do
+    press_options[key], release_options[key] = value, value
+  end
+  -- Options that change when the press half fires would break the release half.
+  for _, key in ipairs({ "repeating", "long_press", "click", "drag" }) do
+    release_options[key] = nil
+  end
+  release_options.release, release_options.transparent = true, true
+  release_options.ignore_mods, release_options.non_consuming = true, true
+
+  o.bind(keys, press_description, on_press, press_options)
+  o.bind(keys, release_description, on_release, release_options)
+end
+
 function o.notify(message)
  return "omarchy-notification-send -u low " .. shell_quote(message)
 end
@@ -224,7 +281,8 @@ function o.window(match, rules)
  hl.window_rule(rules)
 end

-- Opt a window in to Omarchy's standard active/inactive transparency.
+-- Opt a window in to Omarchy's standard active/inactive transparency. The tag
+-- lets Appearance > Window Transparency turn these windows opaque or glassy.
 function o.transparent_window(match, opacity)
-  o.window(match, { opacity = opacity or "0.985 0.96" })
+  o.window(match, { opacity = opacity or "0.985 0.96", tag = "+transparent-window" })
 end