ci: install archiso via private pacman config, not /etc/pacman.conf

Writing stock core/extra over the host /etc/pacman.conf raced with the tests workflow, which appends [cachyos]/[chaotic-aur] to the same file — runs 132 and 133 ran concurrently on the runner, so either job could corrupt the other's config mid-pacman. Use 'pacman --config $(mktemp)' with stock core/extra instead: same DNS-lookup reduction (only core/extra sync, no cachyos/chaotic), zero writes to shared state. Verified on the runner: exit 0, only core/extra synced, host /etc/pacman.conf mtime unchanged.
ci: retry pacman syncs and reset host pacman.conf before build
2026-10-07 11:22:12 +11:00 · 2026-10-07 11:14:28 +11:00 · 2026-10-06 14:53:16 +11:00 · 2026-10-05 17:42:15 +11:00 · 2026-10-05 17:32:23 +11:00 · 2026-10-05 16:26:12 +11:00
19 changed files with 3021 additions and 62 deletions
@@ -22,22 +22,115 @@ jobs:
      - name: Setup local AUR repo
        run: |
          set -euo pipefail
+          shopt -s nullglob
          mkdir -p /tmp/localrepo
          cp localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files* /tmp/localrepo/
          sed -i 's|file:///home/alvin/AlvinArch/localrepo|file:///tmp/localrepo|' pacman.conf
+          # The medium needs its own copy: the ISO's /etc/pacman.conf points
+          # [local-aur] at file:///opt/localrepo, which pacstrap reads at
+          # install time to resolve packages that are not in the official repos
+          # (built during the ISO build and harvested there by
+          # airootfs/root/customize_airootfs.sh).
+          mkdir -p airootfs/opt/localrepo
+          shipped=(localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files*)
+          if (( ${#shipped[@]} > 0 )); then
+            cp -L "${shipped[@]}" airootfs/opt/localrepo/
+          fi
+          echo "airootfs/opt/localrepo: $(ls airootfs/opt/localrepo | wc -l) file(s)"

      - name: Install archiso and dependencies
        run: |
          set -euo pipefail
-          pacman -Syu --noconfirm --needed archiso jq
+          # Install with a *private* config instead of /etc/pacman.conf.
+          # The host config is shared mutable state: the tests workflow
+          # rewrites it and jobs overlap on this runner (runs 132 and 133
+          # ran concurrently), so writing it here could corrupt a concurrent
+          # tests run. It also carries [cachyos] and [chaotic-aur] leftovers
+          # from tests.yaml, and syncing those two repos means extra DNS
+          # lookups against a gateway that intermittently drops UDP/53 —
+          # that is what failed run 131 at this very step. The build only
+          # needs archiso/jq from extra; mkarchiso reads the *profile's*
+          # pacman.conf for everything that goes into the ISO.
+          BUILD_CONF=$(mktemp)
+          trap 'rm -f "$BUILD_CONF"' EXIT
+          cat > "$BUILD_CONF" << 'STOCKCONF'
+          [options]
+          DisableSandbox
+          HoldPkg     = pacman glibc
+          Architecture = auto
+          CheckSpace
+          ParallelDownloads = 5
+          SigLevel    = Required DatabaseOptional
+          LocalFileSigLevel = Optional

-      - name: Ensure /dev/stdin exists for mkinitcpio
+          [core]
+          Include = /etc/pacman.d/mirrorlist
+
+          [extra]
+          Include = /etc/pacman.d/mirrorlist
+          STOCKCONF
+          sed -i 's/^          //' "$BUILD_CONF"
+
+          # Warm the resolver cache for the mirrors we are about to query.
+          # systemd-resolved serves later lookups from cache, so a gateway
+          # UDP/53 burst cannot hit them again. Failures here are not fatal —
+          # the retry loop below is the real safety net.
+          for host in mirror.aarnet.edu.au gsl-syd.mm.fcix.net au.arch.niranjan.co; do
+            for try in 1 2 3 4 5; do
+              if getent hosts "$host" >/dev/null 2>&1; then
+                break
+              fi
+              echo "  ⏳ DNS for $host failed (try $try/5), retrying in $(( try * 3 ))s..."
+              sleep $(( try * 3 ))
+            done
+          done
+
+          # The gateway drops DNS queries in bursts; one burst must not fail
+          # the whole job, so retry with backoff before giving up.
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman --config "$BUILD_CONF" -Syu --noconfirm --needed archiso jq; then
+              synced=1
+              break
+            fi
+            echo "  ⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
+
+      - name: Ensure /dev/fd symlinks exist for mkinitcpio and procsub
        run: |
          set -euo pipefail
-          # Docker/container environments may lack /dev/stdin; mkinitcpio needs it
-          [ -e /dev/stdin ]  || ln -sf /proc/self/fd/0 /dev/stdin
-          [ -e /dev/stdout ] || ln -sf /proc/self/fd/1 /dev/stdout
-          [ -e /dev/stderr ] || ln -sf /proc/self/fd/2 /dev/stderr
+          # mkinitcpio's preset step pipes through /dev/stdin and bash process
+          # substitution (< <(...)) uses /dev/fd; both break if these symlinks
+          # are missing (they are normally created once at boot by mkinitcpio's
+          # init). Two places need them, so cover both:
+          # 1. the executor's own /dev: mkarchiso reads /dev/stdin on the host
+          #    (machine-id, version, pkglist) and the workflow's own scripts use
+          #    process substitution here. A no-op if the links already exist.
+          ln -sfn /proc/self/fd    /dev/fd
+          ln -sfn /proc/self/fd/0  /dev/stdin
+          ln -sfn /proc/self/fd/1  /dev/stdout
+          ln -sfn /proc/self/fd/2  /dev/stderr
+          # 2. the chroot's /dev: devtmpfs is single-instance, so mounting it
+          #    here yields the same tree that pacstrap/arch-chroot expose as
+          #    <chroot>/dev. When the executor's /dev is itself devtmpfs (1)
+          #    already fixed that tree; this pass is what makes it work when
+          #    the executor's /dev is a plain tmpfs or directory instead.
+          d="$(mktemp -d)"
+          trap 'umount "$d" 2>/dev/null || true; rmdir "$d" 2>/dev/null || true' EXIT
+          mount -t devtmpfs devtmpfs "$d"
+          ln -sfn /proc/self/fd    "$d/fd"
+          ln -sfn /proc/self/fd/0  "$d/stdin"
+          ln -sfn /proc/self/fd/1  "$d/stdout"
+          ln -sfn /proc/self/fd/2  "$d/stderr"
+          ls -l "$d/fd" "$d/stdin" "$d/stdout" "$d/stderr"
+          umount "$d"
+          rmdir "$d"
+          trap - EXIT

      - name: Build Arch ISO
        run: |
@@ -258,6 +351,9 @@ jobs:
            uploaded=0
            attempt=1
            while [ "$attempt" -le "$MAX_ATTEMPTS" ]; do
+              # Fresh output file each attempt: curl does not truncate -o on
+              # transport failure, so a stale body must not be misreported.
+              rm -f "$tmpdir/upload.json"
              # A previous attempt may have saved the asset but lost the
              # response; Gitea rejects duplicate names, so only after the
              # first attempt check for and remove same-name leftovers
@@ -280,19 +376,28 @@ jobs:
                fi
              fi

-              if curl -sf -X POST --max-time 600 \
+              # Capture HTTP status explicitly: `-f` would swallow the Gitea
+              # error body (e.g. attachment size-limit messages) and leave the
+              # failure reason unknown.
+              if http_code=$(curl -sS -X POST --max-time 600 \
                  -H "Authorization: token $GITEA_TOKEN" \
                  -F "attachment=@$iso" \
                  "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
-                  -o "$tmpdir/upload.json"; then
-                if download_url=$(jq -er '.browser_download_url' "$tmpdir/upload.json"); then
+                  -o "$tmpdir/upload.json" -w '%{http_code}'); then
+                if [ "${http_code:0:1}" = "2" ] \
+                    && download_url=$(jq -er '.browser_download_url' "$tmpdir/upload.json"); then
                  echo "  ✅ Uploaded $fname (attempt $attempt/$MAX_ATTEMPTS): $download_url"
                  uploaded=1
                  break
                fi
-                echo "  ⚠️ Upload of $fname returned no download URL (attempt $attempt/$MAX_ATTEMPTS)" >&2
+                echo "  ⚠️ Upload of $fname: HTTP $http_code (attempt $attempt/$MAX_ATTEMPTS)" >&2
+                echo "  Response: $(head -c 2000 "$tmpdir/upload.json" 2>/dev/null)" >&2
              else
-                echo "  ⚠️ Upload of $fname failed (attempt $attempt/$MAX_ATTEMPTS)" >&2
+                rc=$?
+                echo "  ⚠️ Upload of $fname failed (attempt $attempt/$MAX_ATTEMPTS): curl exit $rc, HTTP ${http_code:-000}" >&2
+                if [ -s "$tmpdir/upload.json" ]; then
+                  echo "  Response: $(head -c 2000 "$tmpdir/upload.json")" >&2
+                fi
              fi

              if [ "$attempt" -lt "$MAX_ATTEMPTS" ]; then
@@ -36,7 +36,23 @@ jobs:
          rm -f /var/lib/pacman/sync/cachyos* /var/lib/pacman/sync/chaotic*

      - name: Install prerequisites
-        run: pacman -Syu --noconfirm --needed shellcheck yamllint
+        run: |
+          # The gateway intermittently drops UDP/53 (it failed build run 131
+          # at the equivalent step); retry with backoff instead of dying on
+          # the first bad DNS burst.
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed shellcheck yamllint; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi

      - name: Set up CachyOS repo
        run: |
@@ -54,7 +70,20 @@ jobs:
          printf '\n[cachyos]\nInclude = /etc/pacman.d/cachyos-mirrorlist\n' \
            >> /etc/pacman.conf

-          pacman -Syu --noconfirm --needed
+          # Retry: gateway drops UDP/53 in bursts (see run 131)
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi

      - name: Set up chaotic-aur repo
        run: |
@@ -65,7 +94,20 @@ jobs:
          printf '\n[chaotic-aur]\nInclude = /etc/pacman.d/chaotic-mirrorlist\n' \
            >> /etc/pacman.conf

-          pacman -Syu --noconfirm --needed
+          # Retry: gateway drops UDP/53 in bursts (see run 131)
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi

      - name: Lint shell scripts with ShellCheck
        run: |
@@ -0,0 +1,11 @@
+# Multi-GB mkarchiso output (see AGENTS.md build command)
+work/
+out/
+
+# In-image copy of localrepo/ — populated by localrepo/update.sh and
+# .gitea/workflows/build-iso.yaml, shipped as /opt/localrepo on the ISO
+airootfs/opt/localrepo/
+
+# Build stamp staged by profiledef.sh at ISO build time (see AGENTS.md);
+# consumed by customize_airootfs.sh, never committed
+airootfs/root/.iso-build-stamp
@@ -17,6 +17,9 @@ sudo mkarchiso -v -w work -o out/ .
 ./localrepo/update.sh pkg1.pkg.tar.zst   # add files, then re-index
 ```

+`update.sh` also refreshes `airootfs/opt/localrepo/` (the copy that ships on the
+ISO), so run it after touching `localrepo/` before building.
+
 ## CI Checks (must pass before merge)

 - **ShellCheck**: all `.sh` files checked with `shellcheck -x -s bash`
@@ -32,6 +35,13 @@ sudo mkarchiso -v -w work -o out/ .
 2. **`localrepo/*.pkg.tar.zst`** — pre-built AUR packages. The `local-aur` repo is configured in `pacman.conf` and picked up by mkarchiso automatically.
 3. **`build-end4-deps.sh`** — builds end-4 AUR deps at build time.

+There is a **fourth source**: `customize_airootfs.sh` runs end-4's own
+`./setup install-deps` inside the image (as a throwaway `ii-builder` account),
+which resolves and compiles everything the dotfiles need (quickshell, MicroTeX,
+theming, fonts, ...). Those packages are installed in the live system, land in
+`pkglist.x86_64.txt`, and are harvested into `/opt/localrepo` so pacstrap can
+install them into the target without the network.
+
 **Important**: `localrepo/update.sh` auto-appends new package names to `packages.x86_64`. If you remove a package from `packages.x86_64` that exists in `localrepo/`, it will be re-added on the next `update.sh` run.

 ## Key Files
@@ -39,17 +49,27 @@ sudo mkarchiso -v -w work -o out/ .
 | File | Purpose |
 |------|---------|
 | `packages.x86_64` | Live ISO package list (~402 packages) |
-| `profiledef.sh` | ISO metadata, compression, boot modes |
+| `profiledef.sh` | ISO metadata, compression, boot modes, build-stamp staging |
 | `pacman.conf` | Repos: cachyos → core → extra → multilib → chaotic-aur → local-aur |
 | `bootstrap_packages` | Minimal build-time packages (`base`, `arch-install-scripts`) |
-| `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, oh-my-zsh, lazy.nvim, plugins |
+| `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, skel dotfiles (incl. end4-pC), qsConfig patch, end-4 `install-deps`, package harvest, uv/font pre-warm |
+| `airootfs/root/.live-pacman.conf` | `/etc/pacman.conf` of the built image (adds `[local-aur]` = `file:///opt/localrepo`) |
+| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, LUKS (systemd initramfs **or** experimental unl0kr + optional TPM2 unlock), user, git identity + GitHub SSH keys, login manager (none/greetd/sddm/gdm) + autologin, end-4 dotfiles (`--skip-alldeps`), build-stamp motd, boot |
 | `localrepo/build-end4-deps.sh` | Non-interactive AUR builds for end-4 dependencies |
-| `localrepo/update.sh` | Regenerates localrepo DB + syncs names to packages.x86_64 |
+| `localrepo/update.sh` | Regenerates localrepo DB, syncs names to packages.x86_64, syncs `airootfs/opt/localrepo/` |

 ## Gotchas

 - The profile root is the **repo root** (not a `releng/` subdirectory). The CI build-iso workflow uses `mkarchiso -v -w work -o out/ releng` but this is a naming convention — the actual profile files live at the repo root.
- `customize_airootfs.sh` clones git repos (oh-my-zsh, lazy.nvim, plugins) into `/etc/skel` during the ISO build. These require network access at build time but make the live ISO work offline.
+- `customize_airootfs.sh` clones git repos (oh-my-zsh, lazy.nvim, plugins, end-4 dots) into `/etc/skel` and `/opt` during the ISO build. These require network access at build time but make the live ISO work offline.
+- `customize_airootfs.sh` runs `./setup install-deps -f -s --skip-plasmaintg` as the throwaway user `ii-builder` (end-4's scripts refuse to run as root) and aborts the build if it fails. `--skip-plasmaintg` is deliberate: that optional Firefox widget pulls 410 packages / 526 MiB of KDE.
 - The `[local-aur]` repo path in `pacman.conf` (`file:///home/alvin/alvinarch/localrepo`) is for local builds only. The CI does not use this path.
+- The **image** ships its own `[local-aur]` at `file:///opt/localrepo` (see `.live-pacman.conf`). It holds `localrepo/` (copied by CI/`update.sh`) plus everything `install-deps` built. pacstrap runs without `-P`, so the target keeps the stock `/etc/pacman.conf`; `alvin-install` strips `[local-aur]` from it anyway as a safety net, because `/opt/localrepo` exists only on the medium.
+- `alvin-install` runs end-4 with `--skip-alldeps` — dependencies must come from the ISO. It feeds `yes i` to end-4's failure prompt: inside the installer chroot the medium's `/run` is bind-mounted in, so end-4's `systemctl --machine=…@.host --user enable … --now` lines can never work (and `--now` would start services on the live medium). `install_end4_dots` re-applies the enable-only part (bluetooth, ydotool, i2c module) outside the chroot and reports every step end-4 had to skip. If the end-4 step reports "incomplete", check that `hyprctl`/`quickshell`/the venv were resolvable (harvest) before re-running anything.
+- `/etc/skel/.cache/uv` + `/etc/skel/.local/share/uv/python` are pre-warmed by the build (~460 MB: CPython 3.12 and the pinned wheel cache) so end-4's `uv venv`/`uv pip install` at install time needs no network.
+- **end4-pC** (`pctrade/end4-pC`) is the default quickshell config: cloned into `/etc/skel/.config/quickshell/end4-pC` at build time, selected by patching `hl.env("qsConfig", "ii")` → `"end4-pC"` in the **staged** `/opt/dots-hyprland/dots/.config/hypr/hyprland/variables.lua` (there is no `hypr/hyprland/` in this repo — `./setup install` copies it to the installed system). `alvin-install` re-copies end4-pC into the user's home *after* `./setup install`, because end-4's installer `rsync --delete`s all of `~/.config/quickshell`.
+- `airootfs/etc/skel/.config/illogical-impulse/presets/` carries the user's presets (`Laptop.json`, `Personal-Performance.json`, `Personal-Performance.zip`). They embed `/home/alvin/...` paths, so wallpapers/screenshots need fixing up after install.
 - End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
 - `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.
+- `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it.
+- **Build stamp flow**: `profiledef.sh` (sourced by mkarchiso) stages the gitignored `airootfs/root/.iso-build-stamp` when a `.git` dir exists **or** `CI`/`GITEA_ACTIONS` is set — line reads `AlvinArch build <date> | commit <date> | <4-char hash>` (falls back to `commit unknown` if `git -c safe.directory` can't read the repo; without `.git`/CI no file is staged). `customize_airootfs.sh` installs it as `/etc/alvin-build-stamp` on the live medium, and `alvin-install`'s `install_motd` copies the live `/etc/motd` banner to the target and appends the stamp. If the medium has no stamp, the installed system gets no motd from us.
@@ -50,6 +50,7 @@ AlvinArch/
 ### Key Features

 - **Hyprland + end-4** — Wayland compositor with illogical-impulse dotfiles (quickshell, bibata cursors, microtex)
+- **Automated installer (`alvin-install`)** — gum TUI: LUKS with systemd initramfs or experimental touchscreen unl0kr, optional TPM2 auto-unlock, GitHub SSH key import, login manager choice (none/greetd/sddm/gdm), autologin, and a build stamp in `/etc/motd`
 - **LazyVim** — Pre-configured Neovim with lazy.nvim and curated plugins
 - **Fish + Zsh + Starship** — Dual shell setup with oh-my-zsh and a cross-shell prompt
 - **Local AUR repo** — Pre-built packages (end-4 deps, wallust, grub-customizer, etc.) that aren't in official repos
@@ -23,7 +23,7 @@ if status is-interactive
    alias celar "printf '\033[2J\033[3J\033[1;1H'"
    alias claer "printf '\033[2J\033[3J\033[1;1H'"
    alias pamcan pacman
-    alias q 'qs -c ii'
+    alias q 'qs -c end4-pC'
    if test "$TERM" != "linux"
        alias ls 'eza --icons'
    end
@@ -0,0 +1,677 @@
+{
+  "appearance": {
+    "extraBackgroundTint": true,
+    "fakeScreenRounding": 0,
+    "fonts": {
+      "expressive": "Space Grotesk",
+      "iconNerd": "JetBrains Mono NF",
+      "main": "Google Sans Flex",
+      "monospace": "JetBrains Mono NF",
+      "numbers": "Google Sans Flex",
+      "reading": "Readex Pro",
+      "title": "Google Sans Flex"
+    },
+    "palette": {
+      "accentColor": "",
+      "type": "scheme-tonal-spot"
+    },
+    "transparency": {
+      "automatic": true,
+      "backgroundTransparency": 0.11,
+      "contentTransparency": 0.57,
+      "enable": false
+    },
+    "wallpaperTheming": {
+      "enableAppsAndShell": true,
+      "enableQtApps": true,
+      "enableTerminal": true,
+      "terminalGenerationProps": {
+        "forceDarkMode": false,
+        "harmonizeThreshold": 100,
+        "harmony": 0.5,
+        "termFgBoost": 0.35
+      }
+    }
+  },
+  "apps": {
+    "bluetooth": "kcmshell6 kcm_bluetooth",
+    "changePassword": "kitty -1 --hold=yes fish -i -c 'passwd'",
+    "manageUser": "kcmshell6 kcm_users",
+    "network": "kcmshell6 kcm_networkmanagement",
+    "networkEthernet": "kcmshell6 kcm_networkmanagement",
+    "taskManager": "plasma-systemmonitor --page-name Processes",
+    "terminal": "kitty -1",
+    "update": "kitty -1 --hold=yes fish -i -c 'pkexec pacman -Syu'",
+    "volumeMixer": "~/.config/hypr/hyprland/scripts/launch_first_available.sh \"pavucontrol-qt\" \"pavucontrol\""
+  },
+  "background": {
+    "blurRadius": 32,
+    "centeredWallpaper": false,
+    "centeredWallpaperColor": "primaryContainer",
+    "centeredWallpaperOnlyWhenLocked": false,
+    "centeredWallpaperShape": "Cookie7Sided",
+    "centeredWallpaperSize": 400,
+    "enableWallpaperPreview": false,
+    "hideWhenFullscreen": true,
+    "lockWall": "",
+    "parallax": {
+      "autoVertical": false,
+      "enableSidebar": true,
+      "enableWorkspace": true,
+      "vertical": false,
+      "widgetsFactor": 1.2,
+      "workspaceZoom": 1.07
+    },
+    "screenList": [],
+    "showBlur": true,
+    "showGrid": true,
+    "showSnapLines": true,
+    "splitRatio": "25",
+    "splitSide": "right",
+    "thumbnailPath": "",
+    "wallpaperAnimation": "random",
+    "wallpaperPath": "/home/alvin/Pictures/Wallpapers/Dynamic-Wallpapers/Dark/japan-street-Dark.png",
+    "widgets": {
+      "blurRadius": 32,
+      "blurWidgets": false,
+      "calendar": {
+        "enable": true,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "x": 1596,
+        "y": 744,
+        "z": 4
+      },
+      "clock": {
+        "color": "",
+        "cookie": {
+          "aiStyling": false,
+          "constantlyRotate": false,
+          "dateInClock": true,
+          "dateStyle": "bubble",
+          "dialNumberStyle": "full",
+          "hourHandStyle": "hollow",
+          "hourMarks": false,
+          "minuteHandStyle": "medium",
+          "secondHandStyle": "line",
+          "sides": 12,
+          "timeIndicators": true,
+          "useSineCookie": false
+        },
+        "digital": {
+          "adaptiveAlignment": true,
+          "animateChange": true,
+          "font": {
+            "family": "Google Sans Flex",
+            "roundness": 1.1290989771359807,
+            "size": 129.49608904933814,
+            "weight": 595.725165314564,
+            "width": 99.44532190132371
+          },
+          "showDate": true,
+          "vertical": false
+        },
+        "enable": true,
+        "pixel": {
+          "orientation": "vertical"
+        },
+        "placementStrategy": "leastBusy",
+        "quote": {
+          "enable": true,
+          "followClock": false,
+          "text": "Kawaī neko o zenbu tabe chaimasu."
+        },
+        "showOnlyWhenLocked": false,
+        "style": "digital",
+        "styleLocked": "cookie",
+        "x": 1423,
+        "y": 383,
+        "z": 3
+      },
+      "customImage": {
+        "enable": true,
+        "path": "",
+        "placementStrategy": "free",
+        "shape": "Cookie4Sided",
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "customText": {
+        "alignment": "center",
+        "color": "",
+        "content": "Hello world",
+        "enable": true,
+        "fontFamily": "Caveat",
+        "fontSize": 72,
+        "placementStrategy": "free",
+        "shadow": true,
+        "x": 400,
+        "y": 300,
+        "z": 0
+      },
+      "images": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "media": {
+        "backgroundShape": "Cookie4Sided",
+        "enable": true,
+        "placementStrategy": "free",
+        "showControls": true,
+        "showLyrics": false,
+        "showTitles": true,
+        "sizeMode": "1x3",
+        "x": 744,
+        "y": 876,
+        "z": 1
+      },
+      "notes": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "resources": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "shadow": true,
+      "sticker": {
+        "enable": false,
+        "items": [],
+        "outlineColor": "#ffffff",
+        "outlineWidth": 8,
+        "path": "",
+        "placementStrategy": "free",
+        "rotation": 0,
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "timers": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "todo": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "userCard": {
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "1x2",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "visualizer": {
+        "colorSource": "theme",
+        "enable": true,
+        "height": 343,
+        "placementStrategy": "free",
+        "ringSize": 380,
+        "sensitivity": 1.65,
+        "style": "mirror",
+        "x": 0,
+        "y": 0,
+        "z": -1000
+      },
+      "weather": {
+        "enable": false,
+        "expanded": false,
+        "placementStrategy": "mostBusy",
+        "sizeMode": "1x3",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "worldClock": {
+        "clockCount": 4,
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "timezones": [
+          "Australia/Sydney",
+          "Asia/Tokyo",
+          "Europe/London",
+          "America/New_York"
+        ],
+        "x": 400,
+        "y": 100,
+        "z": 0
+      }
+    },
+    "widgetsLocked": false
+  },
+  "bar": {
+    "autoHide": {
+      "enable": false,
+      "hoverRegionWidth": 2,
+      "pushWindows": false,
+      "showWhenPressingSuper": {
+        "delay": 140,
+        "enable": true
+      }
+    },
+    "borderless": "transparent",
+    "bottom": false,
+    "centerOnlyReserveFrame": false,
+    "cornerStyle": 3,
+    "divider": {
+      "spacing": 20,
+      "style": "rect"
+    },
+    "dynamicIsland": {
+      "leftWidget": "clockWidget",
+      "rightWidget": "systemIcons",
+      "showMediaControls": false,
+      "visualizerStyle": "wave"
+    },
+    "floatStyleShadow": true,
+    "followFrameColor": false,
+    "frameColor": "secondaryContainer",
+    "frameThickness": 4,
+    "groupColor": "layer1",
+    "indicators": {
+      "notifications": {
+        "showUnreadCount": true
+      }
+    },
+    "layouts": {
+      "leftLayout": [
+        "leftSidebarButton",
+        "activeWindow",
+        "resources"
+      ],
+      "middleLayout": [
+        "media",
+        "clockWidget",
+        "workspaces",
+        "utilButtons",
+        "weatherBar",
+        "batteryIndicator"
+      ],
+      "rightLayout": [
+        "sysTray",
+        "updatesCount",
+        "bluetooth",
+        "systemIcons"
+      ]
+    },
+    "media": {
+      "alwaysVisible": false,
+      "maxWidth": 280,
+      "minWidth": 100,
+      "onlyTitle": false,
+      "preferredPlayer": "",
+      "showLyrics": false
+    },
+    "resources": {
+      "alwaysShowCpu": true,
+      "alwaysShowCpuTemp": true,
+      "alwaysShowDisk": false,
+      "alwaysShowRam": true,
+      "alwaysShowSwap": false,
+      "cpuWarningThreshold": 90,
+      "memoryWarningThreshold": 95,
+      "showValue": true,
+      "style": "outline",
+      "swapWarningThreshold": 85
+    },
+    "screenList": [],
+    "showBackground": true,
+    "showFrame": false,
+    "tooltips": {
+      "clickToShow": false,
+      "enable": true
+    },
+    "topLeftIcon": "spark",
+    "utilButtons": {
+      "isRecording": false,
+      "showColorPicker": false,
+      "showDarkModeToggle": false,
+      "showKeyboardToggle": true,
+      "showMicToggle": true,
+      "showPerformanceProfileToggle": true,
+      "showScreenRecord": false,
+      "showScreenSnip": false,
+      "showWallpaperToggle": false
+    },
+    "verbose": true,
+    "vertical": false,
+    "workspaces": {
+      "alwaysShowNumbers": true,
+      "indicatorStyle": "dot",
+      "monochromeIcons": true,
+      "numberMap": [],
+      "showAppIcons": true,
+      "showNumberDelay": 200,
+      "shown": 10,
+      "useNerdFont": false
+    }
+  },
+  "calendar": {
+    "locale": "en-GB"
+  },
+  "conflictKiller": {
+    "autoKillNotificationDaemons": true,
+    "autoKillTrays": true
+  },
+  "crosshair": {
+    "code": "0;P;d;1;0l;10;0o;2;1b;0"
+  },
+  "custom": {
+    "colorizeIcon": true,
+    "distroIcon": "google-gemini-symbolic"
+  },
+  "dock": {
+    "enable": true,
+    "height": 60,
+    "hoverRegionHeight": 2,
+    "hoverToReveal": true,
+    "ignoredAppRegexes": [],
+    "monochromeIcons": false,
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "zen"
+    ],
+    "pinnedOnStartup": false,
+    "showAppsButton": true,
+    "showBackground": true,
+    "showMedia": true,
+    "showPinButton": true
+  },
+  "hacks": {
+    "arbitraryRaceConditionDelay": 20
+  },
+  "hyprland": {
+    "animations": {
+      "animation": "normal",
+      "enable": true
+    },
+    "decoration": {
+      "activeOpacity": 1,
+      "blur": {
+        "enabled": false,
+        "passes": 3,
+        "size": 1
+      },
+      "inactiveOpacity": 0.95,
+      "rounding": 22,
+      "shadow": {
+        "enabled": true,
+        "range": 4
+      }
+    },
+    "general": {
+      "borderColor": {
+        "activeOpacity": 0.47,
+        "activeRole": "layer0Border",
+        "enable": false,
+        "inactiveOpacity": 0.2,
+        "inactiveRole": "layer0Border"
+      },
+      "borderSize": 1,
+      "gapsIn": 2,
+      "gapsOut": 5
+    },
+    "idle": {
+      "lock": 300,
+      "screenOff": 600,
+      "suspend": 10800
+    }
+  },
+  "interactions": {
+    "deadPixelWorkaround": {
+      "enable": false
+    },
+    "scrolling": {
+      "fasterTouchpadScroll": false,
+      "mouseScrollDeltaThreshold": 120,
+      "mouseScrollFactor": 120,
+      "touchpadScrollFactor": 450
+    }
+  },
+  "launcher": {
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "kitty",
+      "cmake-gui"
+    ]
+  },
+  "light": {
+    "antiFlashbang": {
+      "enable": false
+    },
+    "night": {
+      "automatic": false,
+      "colorTemperature": 5559,
+      "from": "19:00",
+      "to": "06:30"
+    }
+  },
+  "lock": {
+    "blur": {
+      "enable": false,
+      "extraZoom": 1.1,
+      "radius": 100,
+      "size": 20
+    },
+    "centerClock": true,
+    "launchOnStartup": false,
+    "materialShapeChars": true,
+    "security": {
+      "requirePasswordToPower": true,
+      "unlockKeyring": true
+    },
+    "showLockedText": true,
+    "showMedia": true,
+    "showToolbars": true,
+    "showWidgets": false,
+    "useHyprlock": false
+  },
+  "media": {
+    "filterDuplicatePlayers": true
+  },
+  "notifications": {
+    "position": "top_right",
+    "timeout": 7000
+  },
+  "osd": {
+    "timeout": 3000
+  },
+  "osk": {
+    "layout": "qwerty_full",
+    "pinnedOnStartup": false
+  },
+  "overlay": {
+    "clickthroughOpacity": 0.8,
+    "darkenScreen": false,
+    "floatingImage": {
+      "imageSource": "https://media.tenor.com/H5U5bJzj3oAAAAAi/kukuru.gif",
+      "scale": 0.5
+    },
+    "openingZoomAnimation": true
+  },
+  "overview": {
+    "centerIcons": true,
+    "columns": 5,
+    "enable": true,
+    "orderBottomUp": false,
+    "orderRightLeft": false,
+    "rows": 2,
+    "scale": 0.18,
+    "style": "default"
+  },
+  "panelFamily": "ii",
+  "policies": {
+    "ai": 1,
+    "weeb": 1
+  },
+  "profile": {
+    "avatarPath": "/home/alvin/Sync_Documents/",
+    "avatarPicture": "/home/alvin/Sync_Documents/Alvin logo original.png",
+    "descriptionText": "::uptime::",
+    "displayName": "",
+    "onlinePresets": true
+  },
+  "regionSelector": {
+    "annotation": {
+      "useSatty": false
+    },
+    "circle": {
+      "padding": 10,
+      "strokeWidth": 6
+    },
+    "rect": {
+      "showAimLines": true
+    },
+    "targetRegions": {
+      "content": true,
+      "contentRegionOpacity": 0.8,
+      "layers": true,
+      "opacity": 0.3,
+      "selectionPadding": 5,
+      "showLabel": false,
+      "windows": true
+    }
+  },
+  "resources": {
+    "historyLength": 60,
+    "updateInterval": 3100
+  },
+  "settings": {
+    "borderColor": "layer0Border",
+    "borderSize": 1,
+    "collapsedSections": [],
+    "style": "default"
+  },
+  "sidebar": {
+    "ai": {
+      "textFadeIn": false
+    },
+    "banner": true,
+    "bannerImage": "",
+    "booru": {
+      "allowNsfw": true,
+      "defaultProvider": "yandere",
+      "limit": 20,
+      "zerochan": {
+        "username": "theodorer61"
+      }
+    },
+    "bottomGroup": false,
+    "cornerOpen": {
+      "bottom": true,
+      "bottomLeftAction": "sidebarLeftOpen",
+      "bottomRightAction": "sidebarRightOpen",
+      "clickless": false,
+      "clicklessCornerEnd": true,
+      "clicklessCornerVerticalOffset": 1,
+      "cornerRegionHeight": 5,
+      "cornerRegionWidth": 250,
+      "enable": true,
+      "valueScroll": true,
+      "visualize": false
+    },
+    "keepRightSidebarLoaded": false,
+    "media": {
+      "artColors": false,
+      "artShape": "Oval",
+      "blurredBackground": false,
+      "enable": true,
+      "shapeArt": false,
+      "showLyrics": true
+    },
+    "mediaPlayer": false,
+    "quickSliders": {
+      "enable": true,
+      "showBrightness": true,
+      "showMic": true,
+      "showVolume": true
+    },
+    "quickToggles": {
+      "android": {
+        "columns": 6,
+        "toggles": [
+          {
+            "size": 2,
+            "type": "network"
+          },
+          {
+            "size": 2,
+            "type": "bluetooth"
+          },
+          {
+            "size": 2,
+            "type": "audio"
+          },
+          {
+            "size": 1,
+            "type": "idleInhibitor"
+          },
+          {
+            "size": 2,
+            "type": "mic"
+          },
+          {
+            "size": 1,
+            "type": "nightLight"
+          },
+          {
+            "size": 2,
+            "type": "powerProfile"
+          }
+        ]
+      },
+      "style": "android"
+    },
+    "translator": {
+      "delay": 300,
+      "enable": true
+    }
+  },
+  "tray": {
+    "filterPassive": true,
+    "invertPinnedItems": true,
+    "monochromeIcons": false,
+    "pinnedItems": [
+      "Fcitx"
+    ],
+    "showItemId": false
+  },
+  "wallpaperSelector": {
+    "changeInterval": 0,
+    "closeAfterSelection": true,
+    "columns": 4,
+    "liveWallpapersPath": "",
+    "showBlurBackground": false,
+    "showHomePath": true,
+    "showSearchbar": true,
+    "sortMode": "time",
+    "useSystemFileDialog": false,
+    "userPath": "/home/alvin/Pictures/Wallpapers/"
+  },
+  "windows": {
+    "centerTitle": true,
+    "showTitlebar": true
+  }
+}
@@ -0,0 +1,676 @@
+{
+  "appearance": {
+    "extraBackgroundTint": true,
+    "fakeScreenRounding": 0,
+    "fonts": {
+      "expressive": "Space Grotesk",
+      "iconNerd": "JetBrains Mono NF",
+      "main": "Google Sans Flex",
+      "monospace": "JetBrains Mono NF",
+      "numbers": "Google Sans Flex",
+      "reading": "Readex Pro",
+      "title": "Google Sans Flex"
+    },
+    "palette": {
+      "accentColor": "",
+      "type": "scheme-tonal-spot"
+    },
+    "transparency": {
+      "automatic": true,
+      "backgroundTransparency": 0.11,
+      "contentTransparency": 0.57,
+      "enable": false
+    },
+    "wallpaperTheming": {
+      "enableAppsAndShell": true,
+      "enableQtApps": true,
+      "enableTerminal": true,
+      "terminalGenerationProps": {
+        "forceDarkMode": false,
+        "harmonizeThreshold": 100,
+        "harmony": 0.5,
+        "termFgBoost": 0.35
+      }
+    }
+  },
+  "apps": {
+    "bluetooth": "kcmshell6 kcm_bluetooth",
+    "changePassword": "kitty -1 --hold=yes fish -i -c 'passwd'",
+    "manageUser": "kcmshell6 kcm_users",
+    "network": "kcmshell6 kcm_networkmanagement",
+    "networkEthernet": "kcmshell6 kcm_networkmanagement",
+    "taskManager": "plasma-systemmonitor --page-name Processes",
+    "terminal": "kitty -1",
+    "update": "kitty -1 --hold=yes fish -i -c 'pkexec pacman -Syu'",
+    "volumeMixer": "~/.config/hypr/hyprland/scripts/launch_first_available.sh \"pavucontrol-qt\" \"pavucontrol\""
+  },
+  "background": {
+    "blurRadius": 32,
+    "centeredWallpaper": false,
+    "centeredWallpaperColor": "primaryContainer",
+    "centeredWallpaperOnlyWhenLocked": false,
+    "centeredWallpaperShape": "Cookie7Sided",
+    "centeredWallpaperSize": 400,
+    "enableWallpaperPreview": false,
+    "hideWhenFullscreen": true,
+    "lockWall": "",
+    "parallax": {
+      "autoVertical": false,
+      "enableSidebar": true,
+      "enableWorkspace": true,
+      "vertical": false,
+      "widgetsFactor": 1.2,
+      "workspaceZoom": 1.07
+    },
+    "screenList": [],
+    "showBlur": true,
+    "showGrid": true,
+    "showSnapLines": true,
+    "splitRatio": "25",
+    "splitSide": "right",
+    "thumbnailPath": "",
+    "wallpaperAnimation": "random",
+    "wallpaperPath": "/home/alvin/Pictures/Wallpapers/Dynamic-Wallpapers/Dark/japan-street-Dark.png",
+    "widgets": {
+      "blurRadius": 32,
+      "blurWidgets": false,
+      "calendar": {
+        "enable": true,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "x": 1596,
+        "y": 744,
+        "z": 4
+      },
+      "clock": {
+        "color": "",
+        "cookie": {
+          "aiStyling": false,
+          "constantlyRotate": false,
+          "dateInClock": true,
+          "dateStyle": "bubble",
+          "dialNumberStyle": "full",
+          "hourHandStyle": "hollow",
+          "hourMarks": false,
+          "minuteHandStyle": "medium",
+          "secondHandStyle": "line",
+          "sides": 12,
+          "timeIndicators": true,
+          "useSineCookie": false
+        },
+        "digital": {
+          "adaptiveAlignment": true,
+          "animateChange": true,
+          "font": {
+            "family": "Google Sans Flex",
+            "roundness": 1.1290989771359807,
+            "size": 129.49608904933814,
+            "weight": 350,
+            "width": 99.44532190132371
+          },
+          "showDate": true,
+          "vertical": false
+        },
+        "enable": true,
+        "pixel": {
+          "orientation": "vertical"
+        },
+        "placementStrategy": "leastBusy",
+        "quote": {
+          "enable": true,
+          "followClock": false,
+          "text": "Kawaī neko o zenbu tabe chaimasu."
+        },
+        "showOnlyWhenLocked": false,
+        "style": "digital",
+        "styleLocked": "cookie",
+        "x": 1423,
+        "y": 383,
+        "z": 3
+      },
+      "customImage": {
+        "enable": true,
+        "path": "",
+        "placementStrategy": "free",
+        "shape": "Cookie4Sided",
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "customText": {
+        "alignment": "center",
+        "color": "",
+        "content": "Hello world",
+        "enable": true,
+        "fontFamily": "Caveat",
+        "fontSize": 72,
+        "placementStrategy": "free",
+        "shadow": true,
+        "x": 400,
+        "y": 300,
+        "z": 0
+      },
+      "images": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "media": {
+        "backgroundShape": "Cookie4Sided",
+        "enable": true,
+        "placementStrategy": "free",
+        "showControls": true,
+        "showLyrics": false,
+        "showTitles": true,
+        "sizeMode": "1x3",
+        "x": 744,
+        "y": 876,
+        "z": 1
+      },
+      "notes": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "resources": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "shadow": true,
+      "sticker": {
+        "enable": false,
+        "items": [],
+        "outlineColor": "#ffffff",
+        "outlineWidth": 8,
+        "path": "",
+        "placementStrategy": "free",
+        "rotation": 0,
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "timers": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "todo": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "userCard": {
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "1x2",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "visualizer": {
+        "colorSource": "theme",
+        "enable": true,
+        "height": 342,
+        "placementStrategy": "free",
+        "ringSize": 380,
+        "sensitivity": 1.65,
+        "style": "mirror",
+        "x": 0,
+        "y": 0,
+        "z": -1000
+      },
+      "weather": {
+        "enable": false,
+        "expanded": false,
+        "placementStrategy": "mostBusy",
+        "sizeMode": "1x3",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "worldClock": {
+        "clockCount": 4,
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "timezones": [
+          "Australia/Sydney",
+          "Asia/Tokyo",
+          "Europe/London",
+          "America/New_York"
+        ],
+        "x": 400,
+        "y": 100,
+        "z": 0
+      }
+    },
+    "widgetsLocked": false
+  },
+  "bar": {
+    "autoHide": {
+      "enable": false,
+      "hoverRegionWidth": 2,
+      "pushWindows": false,
+      "showWhenPressingSuper": {
+        "delay": 140,
+        "enable": true
+      }
+    },
+    "borderless": "transparent",
+    "bottom": false,
+    "centerOnlyReserveFrame": false,
+    "cornerStyle": 3,
+    "divider": {
+      "spacing": 20,
+      "style": "rect"
+    },
+    "dynamicIsland": {
+      "leftWidget": "clockWidget",
+      "rightWidget": "systemIcons",
+      "showMediaControls": false,
+      "visualizerStyle": "wave"
+    },
+    "floatStyleShadow": true,
+    "followFrameColor": false,
+    "frameColor": "secondaryContainer",
+    "frameThickness": 4,
+    "groupColor": "layer1",
+    "indicators": {
+      "notifications": {
+        "showUnreadCount": true
+      }
+    },
+    "layouts": {
+      "leftLayout": [
+        "leftSidebarButton",
+        "activeWindow",
+        "resources"
+      ],
+      "middleLayout": [
+        "media",
+        "clockWidget",
+        "workspaces",
+        "utilButtons",
+        "weatherBar"
+      ],
+      "rightLayout": [
+        "sysTray",
+        "updatesCount",
+        "bluetooth",
+        "systemIcons"
+      ]
+    },
+    "media": {
+      "alwaysVisible": false,
+      "maxWidth": 280,
+      "minWidth": 100,
+      "onlyTitle": false,
+      "preferredPlayer": "",
+      "showLyrics": false
+    },
+    "resources": {
+      "alwaysShowCpu": true,
+      "alwaysShowCpuTemp": true,
+      "alwaysShowDisk": false,
+      "alwaysShowRam": true,
+      "alwaysShowSwap": false,
+      "cpuWarningThreshold": 90,
+      "memoryWarningThreshold": 95,
+      "showValue": true,
+      "style": "outline",
+      "swapWarningThreshold": 85
+    },
+    "screenList": [],
+    "showBackground": true,
+    "showFrame": false,
+    "tooltips": {
+      "clickToShow": false,
+      "enable": true
+    },
+    "topLeftIcon": "spark",
+    "utilButtons": {
+      "isRecording": false,
+      "showColorPicker": false,
+      "showDarkModeToggle": false,
+      "showKeyboardToggle": false,
+      "showMicToggle": true,
+      "showPerformanceProfileToggle": true,
+      "showScreenRecord": false,
+      "showScreenSnip": false,
+      "showWallpaperToggle": false
+    },
+    "verbose": true,
+    "vertical": false,
+    "workspaces": {
+      "alwaysShowNumbers": true,
+      "indicatorStyle": "dot",
+      "monochromeIcons": true,
+      "numberMap": [],
+      "showAppIcons": true,
+      "showNumberDelay": 200,
+      "shown": 10,
+      "useNerdFont": false
+    }
+  },
+  "calendar": {
+    "locale": "en-GB"
+  },
+  "conflictKiller": {
+    "autoKillNotificationDaemons": true,
+    "autoKillTrays": true
+  },
+  "crosshair": {
+    "code": "0;P;d;1;0l;10;0o;2;1b;0"
+  },
+  "custom": {
+    "colorizeIcon": true,
+    "distroIcon": "google-gemini-symbolic"
+  },
+  "dock": {
+    "enable": true,
+    "height": 60,
+    "hoverRegionHeight": 2,
+    "hoverToReveal": true,
+    "ignoredAppRegexes": [],
+    "monochromeIcons": false,
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "zen"
+    ],
+    "pinnedOnStartup": false,
+    "showAppsButton": true,
+    "showBackground": true,
+    "showMedia": true,
+    "showPinButton": true
+  },
+  "hacks": {
+    "arbitraryRaceConditionDelay": 20
+  },
+  "hyprland": {
+    "animations": {
+      "animation": "normal",
+      "enable": true
+    },
+    "decoration": {
+      "activeOpacity": 1,
+      "blur": {
+        "enabled": false,
+        "passes": 3,
+        "size": 1
+      },
+      "inactiveOpacity": 0.95,
+      "rounding": 22,
+      "shadow": {
+        "enabled": true,
+        "range": 4
+      }
+    },
+    "general": {
+      "borderColor": {
+        "activeOpacity": 0.47,
+        "activeRole": "layer0Border",
+        "enable": false,
+        "inactiveOpacity": 0.2,
+        "inactiveRole": "layer0Border"
+      },
+      "borderSize": 1,
+      "gapsIn": 2,
+      "gapsOut": 5
+    },
+    "idle": {
+      "lock": 300,
+      "screenOff": 600,
+      "suspend": 10800
+    }
+  },
+  "interactions": {
+    "deadPixelWorkaround": {
+      "enable": false
+    },
+    "scrolling": {
+      "fasterTouchpadScroll": false,
+      "mouseScrollDeltaThreshold": 120,
+      "mouseScrollFactor": 120,
+      "touchpadScrollFactor": 450
+    }
+  },
+  "launcher": {
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "kitty",
+      "cmake-gui"
+    ]
+  },
+  "light": {
+    "antiFlashbang": {
+      "enable": false
+    },
+    "night": {
+      "automatic": false,
+      "colorTemperature": 5559,
+      "from": "19:00",
+      "to": "06:30"
+    }
+  },
+  "lock": {
+    "blur": {
+      "enable": false,
+      "extraZoom": 1.1,
+      "radius": 100,
+      "size": 20
+    },
+    "centerClock": true,
+    "launchOnStartup": false,
+    "materialShapeChars": true,
+    "security": {
+      "requirePasswordToPower": true,
+      "unlockKeyring": true
+    },
+    "showLockedText": true,
+    "showMedia": true,
+    "showToolbars": true,
+    "showWidgets": false,
+    "useHyprlock": false
+  },
+  "media": {
+    "filterDuplicatePlayers": true
+  },
+  "notifications": {
+    "position": "top_right",
+    "timeout": 7000
+  },
+  "osd": {
+    "timeout": 3000
+  },
+  "osk": {
+    "layout": "qwerty_full",
+    "pinnedOnStartup": false
+  },
+  "overlay": {
+    "clickthroughOpacity": 0.8,
+    "darkenScreen": false,
+    "floatingImage": {
+      "imageSource": "https://media.tenor.com/H5U5bJzj3oAAAAAi/kukuru.gif",
+      "scale": 0.5
+    },
+    "openingZoomAnimation": true
+  },
+  "overview": {
+    "centerIcons": true,
+    "columns": 5,
+    "enable": true,
+    "orderBottomUp": false,
+    "orderRightLeft": false,
+    "rows": 2,
+    "scale": 0.18,
+    "style": "default"
+  },
+  "panelFamily": "ii",
+  "policies": {
+    "ai": 1,
+    "weeb": 1
+  },
+  "profile": {
+    "avatarPath": "",
+    "avatarPicture": "",
+    "descriptionText": "::uptime::",
+    "displayName": "",
+    "onlinePresets": false
+  },
+  "regionSelector": {
+    "annotation": {
+      "useSatty": false
+    },
+    "circle": {
+      "padding": 10,
+      "strokeWidth": 6
+    },
+    "rect": {
+      "showAimLines": true
+    },
+    "targetRegions": {
+      "content": true,
+      "contentRegionOpacity": 0.8,
+      "layers": true,
+      "opacity": 0.3,
+      "selectionPadding": 5,
+      "showLabel": false,
+      "windows": true
+    }
+  },
+  "resources": {
+    "historyLength": 60,
+    "updateInterval": 3100
+  },
+  "settings": {
+    "borderColor": "layer0Border",
+    "borderSize": 1,
+    "collapsedSections": [],
+    "style": "default"
+  },
+  "sidebar": {
+    "ai": {
+      "textFadeIn": false
+    },
+    "banner": true,
+    "bannerImage": "",
+    "booru": {
+      "allowNsfw": true,
+      "defaultProvider": "yandere",
+      "limit": 20,
+      "zerochan": {
+        "username": "theodorer61"
+      }
+    },
+    "bottomGroup": false,
+    "cornerOpen": {
+      "bottom": true,
+      "bottomLeftAction": "sidebarLeftOpen",
+      "bottomRightAction": "sidebarRightOpen",
+      "clickless": false,
+      "clicklessCornerEnd": true,
+      "clicklessCornerVerticalOffset": 1,
+      "cornerRegionHeight": 5,
+      "cornerRegionWidth": 250,
+      "enable": true,
+      "valueScroll": true,
+      "visualize": false
+    },
+    "keepRightSidebarLoaded": false,
+    "media": {
+      "artColors": false,
+      "artShape": "Oval",
+      "blurredBackground": false,
+      "enable": true,
+      "shapeArt": false,
+      "showLyrics": true
+    },
+    "mediaPlayer": false,
+    "quickSliders": {
+      "enable": true,
+      "showBrightness": true,
+      "showMic": true,
+      "showVolume": true
+    },
+    "quickToggles": {
+      "android": {
+        "columns": 6,
+        "toggles": [
+          {
+            "size": 2,
+            "type": "network"
+          },
+          {
+            "size": 2,
+            "type": "bluetooth"
+          },
+          {
+            "size": 2,
+            "type": "audio"
+          },
+          {
+            "size": 1,
+            "type": "idleInhibitor"
+          },
+          {
+            "size": 2,
+            "type": "mic"
+          },
+          {
+            "size": 1,
+            "type": "nightLight"
+          },
+          {
+            "size": 2,
+            "type": "powerProfile"
+          }
+        ]
+      },
+      "style": "android"
+    },
+    "translator": {
+      "delay": 300,
+      "enable": true
+    }
+  },
+  "tray": {
+    "filterPassive": true,
+    "invertPinnedItems": true,
+    "monochromeIcons": false,
+    "pinnedItems": [
+      "Fcitx"
+    ],
+    "showItemId": false
+  },
+  "wallpaperSelector": {
+    "changeInterval": 0,
+    "closeAfterSelection": true,
+    "columns": 4,
+    "liveWallpapersPath": "",
+    "showBlurBackground": false,
+    "showHomePath": true,
+    "showSearchbar": true,
+    "sortMode": "time",
+    "useSystemFileDialog": false,
+    "userPath": "/home/alvin/Pictures/Wallpapers/"
+  },
+  "windows": {
+    "centerTitle": true,
+    "showTitlebar": true
+  }
+}
@@ -48,4 +48,13 @@ Include = /etc/pacman.d/cachyos-mirrorlist

 [chaotic-aur]
 SigLevel = Required DatabaseOptional
-Include = /etc/pacman.d/chaotic-mirrorlist
+Include = /etc/pacman.d/chaotic-mirrorlist
+
+[local-aur]
+# Ships on the medium only: packages built at ISO build time (end-4
+# dependencies, plus localrepo/). Keeps pacstrap from needing the network for
+# anything that is not in the official repos. alvin-install strips this whole
+# section from the target system's pacman.conf, because /opt/localrepo exists
+# only on the live medium.
+SigLevel = Optional TrustAll
+Server = file:///opt/localrepo
@@ -1,6 +1,19 @@
 #!/usr/bin/env bash
 set -euo pipefail

+# The chroot's /dev is the kernel's single shared devtmpfs, which only gets the
+# fd/stdin/stdout/stderr symlinks at boot (from mkinitcpio's init). If the
+# runner environment lacks them, process substitution (< <(...)) and upstream
+# tools (pacman-key) fail with "… /dev/fd/63: No such file or directory".
+# Self-heal here; the CI build-iso workflow does the same before pacstrap so
+# that mkinitcpio's hook (which pipes through /dev/stdin) works too.
+for _link in "fd:/proc/self/fd" "stdin:/proc/self/fd/0" \
+  "stdout:/proc/self/fd/1" "stderr:/proc/self/fd/2"; do
+  [[ -e "/dev/${_link%%:*}" || -L "/dev/${_link%%:*}" ]] ||
+    ln -sfn "${_link#*:}" "/dev/${_link%%:*}"
+done
+unset _link
+
 # Populate the keyring in the built root from the keyring bundles
 # (/usr/share/pacman/keyrings, incl. the copied cachyos keyring).
 # This mirrors the guide; it runs inside the image you are making.
@@ -14,6 +27,13 @@ pacman-key --populate archlinux cachyos chaotic
 install -m 0644 /root/.live-pacman.conf /etc/pacman.conf
 rm -f /root/.live-pacman.conf

+# Build stamp staged by profiledef.sh (absent for non-git, non-CI builds):
+# keep it where alvin-install looks for it, drop the staging copy.
+if [[ -f /root/.iso-build-stamp ]]; then
+  install -m 0644 /root/.iso-build-stamp /etc/alvin-build-stamp
+  rm -f /root/.iso-build-stamp
+fi
+
 # ============================================================================
 # Pre-install dotfile dependencies into /etc/skel so new users get them
 # instantly on first login (no network required).
@@ -57,6 +77,263 @@ if [[ ! -d "${NVIM_DATA}/lazy/lazy.nvim" ]]; then
    https://github.com/folke/lazy.nvim.git "${NVIM_DATA}/lazy/lazy.nvim"
 fi

+# ── end-4 dots-hyprland, staged for alvin-install (avoids a clone at install) ─
+DOTS_REPO="/opt/dots-hyprland"
+if [[ ! -d "${DOTS_REPO}/.git" ]]; then
+  echo "[customize] Cloning end-4 dots-hyprland..."
+  git clone --depth=1 https://github.com/end-4/dots-hyprland.git "${DOTS_REPO}"
+  git -C "${DOTS_REPO}" submodule update --init --depth=1
+fi
+
+# ── end4-pC: the default quickshell config, shipped in skel ──────────────────
+# pctrade/end4-pC is a fork of the ii shell config. It lives next to ii in
+# ~/.config/quickshell and does not modify it; which one runs is decided by
+# qsConfig (patched just below). The repo has no submodules.
+if [[ ! -d "${SKEL}/.config/quickshell/end4-pC" ]]; then
+  echo "[customize] Cloning end4-pC quickshell config into skel..."
+  git clone --depth=1 https://github.com/pctrade/end4-pC.git \
+    "${SKEL}/.config/quickshell/end4-pC"
+fi
+
+# ── Default quickshell config: ii -> end4-pC ─────────────────────────────────
+# alvin-install copies this staged repo onto the target and runs `./setup
+# install`, whose rsync writes hypr/hyprland/variables.lua into the user's
+# home - so patching the staged copy is what sets qsConfig on the installed
+# system. Re-running is a no-op; anything other than ii/end4-pC aborts.
+VARIABLES_LUA="${DOTS_REPO}/dots/.config/hypr/hyprland/variables.lua"
+if grep -Fq 'hl.env("qsConfig", "ii")' "${VARIABLES_LUA}"; then
+  echo "[customize] Setting qsConfig to end4-pC..."
+  sed -i 's|hl\.env("qsConfig", "ii")|hl.env("qsConfig", "end4-pC")|' "${VARIABLES_LUA}"
+fi
+if ! grep -Fq 'hl.env("qsConfig", "end4-pC")' "${VARIABLES_LUA}"; then
+  echo "[customize] qsConfig is neither ii nor end4-pC in ${VARIABLES_LUA}" >&2
+  exit 1
+fi
+
+# ============================================================================
+# Pre-install end-4 dependencies into the image (network heavy, once per ISO)
+# ============================================================================
+# ./setup install-deps resolves and *builds* every AUR/source dependency the
+# dotfiles need (quickshell, MicroTeX, theming, fonts, ...). Doing it here lets
+# alvin-install run its end-4 step with --skip-alldeps, so an install only
+# copies files - no AUR clones, no makepkg, no dependency resolution.
+#
+# The script refuses to run as root, hence the throwaway builder account.
+# ============================================================================
+BUILD_USER="ii-builder"
+
+if ! id -u "${BUILD_USER}" &>/dev/null; then
+  useradd -m -u 1500 "${BUILD_USER}"
+fi
+echo "${BUILD_USER} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/99-ii-builder
+chmod 440 /etc/sudoers.d/99-ii-builder
+
+# makepkg writes src/, pkg/ and *.pkg.tar.zst into the PKGBUILD directories,
+# so the tree must be owned by the account that runs it.
+chown -R "${BUILD_USER}:${BUILD_USER}" "${DOTS_REPO}"
+
+# -f: never prompt (ask=false); -s: skip "pacman -Syu";
+# --skip-plasmaintg: optional Firefox widget that pulls 410 pkgs / 526 MiB of
+#                    KDE packages onto a non-KDE system;
+# stdin: answer end-4's x() failure prompt with "e", so a failed command
+#        aborts the build instead of blocking forever without a TTY.
+# shellcheck disable=SC2024  # the redirect is meant for the child, not sudo
+if ! sudo -u "${BUILD_USER}" env HOME="/home/${BUILD_USER}" \
+    GIT_TERMINAL_PROMPT=0 \
+    bash -c "cd ${DOTS_REPO} && ./setup install-deps -f -s --skip-plasmaintg" \
+    < <(yes e); then
+  echo "[customize] end-4 ./setup install-deps failed" >&2
+  exit 1
+fi
+
+# ── Harvest the packages install-deps just built into the in-image local repo ─
+# The live /etc/pacman.conf points [local-aur] at /opt/localrepo; without the
+# harvested copies pacstrap cannot resolve these packages at install time and
+# would silently drop them from the target system.
+mkdir -p /opt/localrepo
+shopt -s nullglob
+
+# <name> <version> from a package's embedded .PKGINFO (update.sh does the same)
+pkg_meta() {
+  tar -xOf "$1" .PKGINFO 2>/dev/null |
+    awk -F' = ' '/^pkgname = /{n=$2} /^pkgver = /{v=$2} END{print n, v}'
+}
+
+mapfile -d '' -t built_pkgs < <(
+  find "${DOTS_REPO}" "/home/${BUILD_USER}/.cache/yay" \
+    -name '*.pkg.tar.zst' -print0 2>/dev/null
+)
+
+declare -A built_file=() built_ver=()
+for p in "${built_pkgs[@]}"; do
+  read -r n v < <(pkg_meta "$p")
+  [[ -n "${n:-}" && -n "${v:-}" ]] || continue
+  built_file["$n"]="$p"
+  built_ver["$n"]="$v"
+done
+
+# One entry per package name, and the entry must be the version the image
+# actually installed - a stale copy with the same name but another version
+# would let pacstrap install something else than what was tested.
+for existing in /opt/localrepo/*.pkg.tar.zst; do
+  [[ -e "$existing" ]] || continue
+  read -r n v < <(pkg_meta "$existing")
+  [[ -n "${n:-}" ]] || continue
+  if [[ -n "${built_ver[$n]:-}" ]]; then
+    echo "[customize] Replacing localrepo ${n} ${v} with built ${built_ver[$n]}"
+    rm -f "$existing"
+  fi
+done
+
+if ((${#built_file[@]} > 0)); then
+  echo "[customize] Harvesting ${#built_file[@]} package(s) into /opt/localrepo"
+  cp -f -- "${built_file[@]}" /opt/localrepo/
+  # makepkg -Afsi leaves its archives next to the PKGBUILD. They are already
+  # harvested (and installed in this image); keeping them in the dots tree
+  # would ship a second copy inside /opt/dots-hyprland, which alvin-install
+  # copies to ~/.dots-hyprland on every installed system.
+  find "${DOTS_REPO}" -type f -name '*.pkg.tar.zst' -delete
+fi
+
+# Rebuild the repo database (CI/update.sh ship a pre-built one alongside the
+# packages) and refresh the live system's copy of it. No network needed: the
+# remote repos were synced during pacstrap.
+local_pkgs=(/opt/localrepo/*.pkg.tar.zst)
+if ((${#local_pkgs[@]} > 0)); then
+  echo "[customize] Rebuilding local-aur db (${#local_pkgs[@]} packages)..."
+  repo-add -R /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}"
+  mkdir -p /var/lib/pacman/sync
+  cp -fL /opt/localrepo/local-aur.db /var/lib/pacman/sync/local-aur.db
+  if [[ -f /opt/localrepo/local-aur.files ]]; then
+    cp -fL /opt/localrepo/local-aur.files /var/lib/pacman/sync/local-aur.files
+  fi
+fi
+
+# ── makepkg leftovers + throwaway account do not belong in the ISO ──────────
+if [[ -d "${DOTS_REPO}/sdata/dist-arch" ]]; then
+  find "${DOTS_REPO}/sdata/dist-arch" -mindepth 2 -maxdepth 2 -type d \
+    \( -name src -o -name pkg \) -prune -exec rm -rf {} +
+fi
+rm -f /etc/sudoers.d/99-ii-builder
+
+# Processes still running as BUILD_USER make userdel exit 8 and abort the
+# build. end-4's ./setup is the usual source: sudo_init_keepalive forks
+# `(sleep 60; sudo true) &` and its EXIT trap kills only the subshell,
+# orphaning the sleep child for up to a minute. Mirrors shadow's
+# user_busy_processes(): match real/effective/saved uid AND require the
+# process to live inside this build chroot - the runner shares our PID
+# namespace, and a host process could carry the same uid.
+#
+# mkarchiso runs this script via arch-chroot, which mounts proc *before*
+# `unshare --fork --pid`: /proc entry numbers belong to the outer pid
+# namespace, while kill(2) resolves pids in our (nested) namespace. Use the
+# last NSpid field - the pid in our own namespace - for signalling; keep the
+# /proc entry number for logging, since that is what userdel reports.
+nspid_fields() {
+  awk -F'\t' '/^NSpid:/{ $1=""; sub(/^ +/, ""); print; exit }' "$1"
+}
+
+builder_procs() {
+  local uid broot st p key real eff saved kpid cmd
+  local -a nsf self_nsf=()
+  uid=$(id -u "${BUILD_USER}") || return 0
+  broot=$(stat -Lc '%d:%i' /)
+  read -r -a self_nsf < <(nspid_fields /proc/self/status)
+  for st in /proc/[0-9]*/status; do
+    [[ -r "$st" ]] || continue
+    real=""; eff=""; saved=""
+    while read -r key real eff saved _; do
+      [[ $key == "Uid:" ]] && break
+    done < "$st" || continue
+    [[ $real == "$uid" || $eff == "$uid" || $saved == "$uid" ]] || continue
+    p=${st#/proc/}; p=${p%/status}
+    # Stat of /proc/<pid>/root needs CAP_SYS_PTRACE (or same-uid): exactly
+    # what shadow's userdel uses, so a process we cannot see here is one
+    # userdel cannot flag either. Compare by device+inode; skip on failure.
+    [[ $(stat -Lc '%d:%i' "/proc/$p/root" 2>/dev/null) == "$broot" ]] || continue
+    # NSpid chain length must equal ours, i.e. the process must live in our
+    # pid namespace - only then is its last field killable from here.
+    nsf=()
+    read -r -a nsf < <(nspid_fields "/proc/$p/status") || continue
+    if ((${#nsf[@]} > 0 && ${#nsf[@]} == ${#self_nsf[@]})); then
+      kpid=${nsf[${#nsf[@]} - 1]}
+    else
+      kpid="-"
+    fi
+    cmd=$(tr '\0' ' ' < "/proc/$p/cmdline" 2>/dev/null)
+    printf '%s\t%s\t%s\n' "$p" "$kpid" "$cmd"
+  done
+  return 0
+}
+
+sweep_builder_procs() {
+  local sig=$1 p kpid cmd kerr
+  local -a pids=()
+  while IFS=$'\t' read -r p kpid cmd; do
+    [[ -n $p ]] || continue
+    if [[ -z $kpid || $kpid == "-" ]]; then
+      echo "[customize] ${BUILD_USER} process outside our pid namespace (cannot signal): pid $p: $cmd"
+      continue
+    fi
+    echo "[customize] ${BUILD_USER} process ($sig): pid $p: $cmd"
+    pids+=("$kpid")
+  done < <(builder_procs)
+  if ((${#pids[@]} > 0)); then
+    # Surface signal failures (they used to be swallowed, hiding a
+    # pid-namespace mismatch as a silent no-op sweep).
+    if ! kerr=$(kill -"$sig" "${pids[@]}" 2>&1); then
+      [[ -n $kerr ]] && printf '[customize] kill -%s: %s\n' "$sig" "$kerr"
+    fi
+  fi
+  return 0
+}
+
+sweep_builder_procs TERM
+sleep 2
+sweep_builder_procs KILL
+sleep 1
+
+if ! userdel -r "${BUILD_USER}"; then
+  rm -rf "/home/${BUILD_USER:?}"
+  if ! userdel "${BUILD_USER}"; then
+    echo "[customize] FATAL: cannot remove user ${BUILD_USER}; leftover processes:" >&2
+    builder_procs >&2 || true
+    exit 1
+  fi
+fi
+chown -R root:root "${DOTS_REPO}"
+
+# ── Google Sans Flex into skel: install_google_sans_flex() early-returns once
+#    fc-list sees the font, so the install step needs no network ──────────────
+FONT_DIR="${SKEL}/.local/share/fonts/illogical-impulse-google-sans-flex"
+if [[ ! -f "${FONT_DIR}/.git/HEAD" ]]; then
+  echo "[customize] Pre-installing Google Sans Flex into skel..."
+  rm -rf "${FONT_DIR}"
+  git clone --depth=1 --recurse-submodules --shallow-submodules \
+    https://github.com/end-4/google-sans-flex "${FONT_DIR}"
+fi
+
+# ── uv into skel: CPython 3.12 + the end-4 requirements wheel cache ──────────
+# install-python-packages() runs `uv venv -p 3.12` and `uv pip install -r ...`
+# during setup. Arch has no python312 package (uv would download one) and the
+# pinned requirements are ~250 MiB of wheels, so warm both into skel: the venv
+# is then created and filled straight from the image.
+if command -v uv &>/dev/null; then
+  echo "[customize] Pre-warming uv (CPython 3.12 + requirements cache)..."
+  warm_venv="/tmp/uv-warm-venv"
+  rm -rf "${warm_venv}"
+  UV_CACHE_DIR="${SKEL}/.cache/uv" \
+    UV_PYTHON_INSTALL_DIR="${SKEL}/.local/share/uv/python" \
+    uv venv -p 3.12 "${warm_venv}"
+  UV_CACHE_DIR="${SKEL}/.cache/uv" \
+    UV_PYTHON_INSTALL_DIR="${SKEL}/.local/share/uv/python" \
+    uv pip install --python "${warm_venv}/bin/python" \
+    -r "${DOTS_REPO}/sdata/uv/requirements.txt"
+  rm -rf "${warm_venv}"
+else
+  echo "[customize] uv not found - skipping python/wheel pre-warm."
+fi
+
 # ── Fish: ensure default shell is set for the live user ──────────────────────
 # The live user (usually 'archlinux' or 'root') gets fish as default shell
 if command -v fish &>/dev/null; then
@@ -87,34 +87,36 @@ done
 info "═══ Step 2: Building AUR dependencies ═══"

 # ── Theming & appearance ─────────────────────────────────────────────────────
+# Entries in these lists must start at column 0: CI's package check accepts
+# repo-less packages via `grep -qxF <pkg>` against this file (exact whole-line
+# match), which silently never matched while the names were indented.
 AUR_THEMING=(
-  adw-gtk-theme-git
-  darkly-bin
-  ttf-material-symbols-variable-git
-  ttf-readex-pro
-  ttf-rubik-vf
-  ttf-twemoji
-  otf-space-grotesk
-  kde-material-you-colors-git
+adw-gtk-theme-git
+darkly-bin
+ttf-material-symbols-variable-git
+ttf-readex-pro
+ttf-rubik-vf
+ttf-twemoji
+otf-space-grotesk
+kde-material-you-colors-git
 )

 # ── end-4 specific / build-from-source packages ──────────────────────────────
 # matugen — material you color generation tool
 # speech-dispatcher — may need AUR build on some setups
 AUR_TOOLS=(
-  matugen
-  python-rpypostprocess
-  tts
+matugen
+python-rpypostprocess
+tts
 )

 # ── Packages not in any standard repo ────────────────────────────────────────
 AUR_MISSING=(
-  asciinema-agg
-  davs2
-  syncthingtray-qt6
-  varia
-  woeusb-ng
-  ttf-ms-fonts
+asciinema-agg
+davs2
+varia
+woeusb-ng
+ttf-ms-fonts
 )

 # ── Large / complex builds (skipped with --quick) ────────────────────────────
@@ -22,11 +22,26 @@ mapfile -t pkgs < <(find "${repo_dir}" -maxdepth 1 -name '*.pkg.tar.zst' -print

 if [[ ${#pkgs[@]} -eq 0 ]]; then
    echo "No .pkg.tar.zst files in ${repo_dir}" >&2
+    # keep the medium's copy honest too - an emptied localrepo/ must not
+    # leave the previous packages shipping on the next build
+    rm -rf "${profile_dir}/airootfs/opt/localrepo"
    exit 0
 fi

 repo-add -R "${repo_dir}/${repo_name}.db.tar.gz" "${pkgs[@]}"

+# Sync the medium's copy: the ISO ships its own [local-aur] at
+# airootfs/opt/localrepo (pacman.conf on the live system points there, and
+# pacstrap resolves these packages from it at install time).
+img_repo="${profile_dir}/airootfs/opt/localrepo"
+mkdir -p "${img_repo}"
+rm -f "${img_repo}"/*.pkg.tar.zst "${img_repo}/${repo_name}".db \
+    "${img_repo}/${repo_name}".db.tar.gz "${img_repo}/${repo_name}".files \
+    "${img_repo}/${repo_name}".files.tar.gz
+cp -f "${pkgs[@]}" "${img_repo}/"
+cp -fL "${repo_dir}/${repo_name}".db* "${repo_dir}/${repo_name}".files* "${img_repo}/"
+echo "Medium copy ready: ${img_repo}"
+
 new_names=()
 for p in "${pkgs[@]}"; do
    name=$(tar -xOf "${p}" .PKGINFO | sed -n 's/^pkgname = //p' | head -1)
@@ -46,6 +46,7 @@ cpio
 cronie
 cryptsetup
 cups
+curl
 darkhttpd
 davs2
 dconf-editor
@@ -321,7 +322,7 @@ starship
 sudo
 swaync
 syncthing
-syncthingtray-qt6
+syncthingtray
 syntax-highlighting
 syslinux
 systemd-resolvconf
@@ -24,3 +24,32 @@ file_permissions=(
  ["/usr/local/bin/Installation_guide"]="0:0:755"
  ["/usr/local/bin/livecd-sound"]="0:0:755"
 )
+
+# ── Build stamp (staged file, never committed) ────────────────────────────────
+# airootfs/root/.iso-build-stamp lands at /root/.iso-build-stamp on the ISO;
+# customize_airootfs.sh installs it as /etc/alvin-build-stamp, and alvin-install
+# appends it to the installed system's /etc/motd. Only stamp builds from a git
+# checkout or CI — a random source-tarball build would record a bogus commit.
+# Sourced by mkarchiso under `set -eu`, hence every expansion is defaulted.
+_stamp_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_stamp_file="${_stamp_dir}/airootfs/root/.iso-build-stamp"
+rm -f "${_stamp_file}"
+if [[ -e "${_stamp_dir}/.git" || -n "${CI:-}" || -n "${GITEA_ACTIONS:-}" ]]; then
+    _stamp_build="$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)"
+    # git ≥2.46 honours -c safe.directory even when mkarchiso runs as root
+    # over a user-owned checkout; older gits ignore it (protected-config
+    # scope) and fall through to the "unknown" line below instead of failing
+    # the build (`|| true` keeps set -e happy either way).
+    _stamp_commit="$(git -C "${_stamp_dir}" -c safe.directory="${_stamp_dir}" \
+        log -1 --format='%cs|%h' 2>/dev/null || true)"
+    if [[ -n "${_stamp_commit}" && "${_stamp_commit}" == *"|"* ]]; then
+        _stamp_hash="${_stamp_commit##*|}"
+        printf 'AlvinArch build %s | commit %s | %s\n' \
+            "${_stamp_build}" "${_stamp_commit%%|*}" "${_stamp_hash:0:4}" \
+            > "${_stamp_file}"
+    else
+        printf 'AlvinArch build %s | commit unknown\n' \
+            "${_stamp_build}" > "${_stamp_file}"
+    fi
+fi
+unset _stamp_dir _stamp_file _stamp_build _stamp_commit _stamp_hash
Author	SHA1	Message	Date
alvinlollo	1bb6f8dddd	ci: install archiso via private pacman config, not /etc/pacman.conf Tests / tests (push) Successful in 4m8s Details Writing stock core/extra over the host /etc/pacman.conf raced with the tests workflow, which appends [cachyos]/[chaotic-aur] to the same file — runs 132 and 133 ran concurrently on the runner, so either job could corrupt the other's config mid-pacman. Use 'pacman --config $(mktemp)' with stock core/extra instead: same DNS-lookup reduction (only core/extra sync, no cachyos/chaotic), zero writes to shared state. Verified on the runner: exit 0, only core/extra synced, host /etc/pacman.conf mtime unchanged.	2026-10-07 11:22:12 +11:00
alvinlollo	0fbec83573	ci: retry pacman syncs and reset host pacman.conf before build Tests / tests (push) Successful in 5m7s Details Run 131 failed at 'pacman -Syu archiso jq' because the gateway (192.168.1.1) intermittently drops UDP/53: cachyos.db and chaotic-aur.db lookups hit libalpm's 10s resolve timeout while core/extra survived on resolved's cache. - build-iso: reset the host /etc/pacman.conf to stock core/extra first (tests.yaml leaves [cachyos]/[chaotic-aur] behind, and mkarchiso reads the profile's pacman.conf anyway), pre-warm mirror hostnames in the resolver cache, then retry pacman -Syu 5x with backoff. - tests: wrap all three pacman -Syu calls in the same retry loop. DNS-side redundancy was added on the runner separately (networkd drop-in adds 1.1.1.1/8.8.8.8 next to the gateway).	2026-10-07 11:14:28 +11:00
alvinlollo	a6c99b72d0	fix(ci): ensure /dev/fd symlinks exist for mkinitcpio and procsub Tests / tests (push) Successful in 2m33s Details The chroot's /dev only gains fd/stdin/stdout/stderr symlinks at boot, and container executors often lack them, which breaks mkinitcpio's preset step (pipes through /dev/stdin) and bash process substitution ("/dev/fd/63: No such file or directory"). - build-iso workflow: create the links in the executor's /dev, then mount a fresh devtmpfs and create them there too so the chroot tree is covered whether the executor's /dev is devtmpfs or a plain tmpfs - customize_airootfs.sh: self-heal the same links inside the chroot	2026-10-06 14:53:16 +11:00
alvinlollo	c64c64dc97	feat(installer): ask GitHub username first in git screen Tests / tests (push) Successful in 2m14s Details screen_git now prompts GitHub username before git name/email, and the screen description plus installation summary list SSH before git to match the new prompt order. Behavior unchanged - prompts are independent and all assignment sites are read after the screen returns.	2026-10-05 17:42:15 +11:00
alvinlollo	319333e400	fix(packages): rename syncthingtray-qt6, ship neofetch from localrepo Tests / tests (push) Successful in 2m23s Details CI package check failed on main (400/402): - syncthingtray-qt6 no longer exists in the AUR (RPC returns nothing); the qt6 build is now the official 'syncthingtray' package in extra/ cachyos - rename it in packages.x86_64 and drop the dead AUR_MISSING entry from build-end4-deps.sh - neofetch left the distro repos (only chaotic-neofetch-git remains); build the AUR package locally (7.1.0-2, PGP-verified against Dylan Araps' key) and commit it to localrepo/ with a reindexed local-aur db so both the CI check (file glob) and pacstrap ([local-aur]) work - un-indent the package lists in build-end4-deps.sh: CI accepts repo-less packages via 'grep -qxF <name>' (exact whole-line match), which could never match indented names Verified locally with an exact replica of the CI check: 402/402.	2026-10-05 17:32:23 +11:00
alvinlollo	bb6f64e977	feat(installer): build-stamp motd, LUKS mode A/B, TPM2, unl0kr, login managers Tests / tests (push) Failing after 2m33s Details - profiledef.sh stages airootfs/root/.iso-build-stamp (git/CI gated, falls back to 'commit unknown'); customize_airootfs.sh installs it as /etc/alvin-build-stamp; install_motd appends it to the target /etc/motd - alvin-install: skippable git/GitHub screens with ssh-import-id import (yay build + python-distro, curl .keys fallback), LUKS Mode A (systemd sd-encrypt + rd.luks.name) vs Mode B (unl0kr + cryptdevice), TPM2 enrollment via $PASSWORD with rd.luks.options activation, unl0kr build/verify with Mode-A fallback, login manager none/greetd/sddm/gdm (enable DM before disabling getty@tty1), autologin per DM (forced off when TPM enrolled), build-stamp motd; includes the existing GRUB_DISABLE_BOOTNEXT grub tweak - review fixes: greetd autologin TOML quoting, .ssh chowned before ssh-import-id, builtin-aware initramfs module verification across all installed kernels, curl exit-code split (fetch failure vs no keys), plain Hyprland on every login path - add curl to packages.x86_64; document stamp flow and installer in AGENTS.md/README.md	2026-10-05 16:26:12 +11:00
alvinlollo	3b3764573e	fix(installer): resolve owner in one chroot call, log ydotool link errors Tests / tests (push) Failing after 2m28s Details Two low-severity review findings on `8501a60`: - owner="$(id -u):$(id -g)" as two substitutions only propagates the last status, so a lone id -u failure would build ':1000' and abort at the chown with "invalid owner" under the wrong line. Run both ids in a single arch-chroot sh -c chained with && and join with paste -sd:; pipefail makes any failure abort at the owner= line. Verified both paths: existing user yields 1000:1000, missing user trips the ERR trap before owner is used. - the ydotool symlink mkdir/ln wrote stderr to the terminal while the failure warn pointed at $LOG, which never recorded it; redirect both into the log, matching the bluetooth block.	2026-10-02 17:18:40 +10:00
alvinlollo	8501a60165	fix(installer): chown target files by numeric id, not live-medium name The end-4 step's chowns ran on the live medium, whose /etc/passwd has no $USERNAME (the user exists only inside /mnt), so 'chown -R alvin:alvin' failed with "invalid user" and the ERR trap aborted the install at line 543. Resolve uid/gid once via arch-chroot id and chown by number; the three remaining name-based chowns (fork/fish/hypr restores) would have hit the same wall later. Replace those three mid-function chowns with one catch-all over the target home after the last root-side write: sed -i on the presets rewrites through a temp file, which leaves them root-owned with no chown after it. systemctl --user enable ydotool.service could never work inside the chroot (no /run/user/UID/bus exists before boot; it only ever warned with "Failed to connect to user scope bus", so ydotool never autostarted). Write the symlink enable would write: ~/.config/systemd/user/default.target.wants/ydotool.service -> /usr/lib/systemd/user/ydotool.service.	2026-10-02 17:05:19 +10:00
alvinlollo	7c601ca53d	ci: log HTTP status and response body on ISO upload failure Tests / tests (push) Failing after 2m30s Details `curl -f` swallowed Gitea's error response, so the 3-attempt upload failure on the 6330 MiB ISO reported nothing diagnosable. Capture the status code via -w, print up to 2 KB of the response body for both HTTP-level and transport-level failures, and clear upload.json at the start of each attempt so a stale body cannot be misreported.	2026-09-27 18:33:04 +10:00
alvinlollo	f3bd10cf0f	fix(iso): sweep ii-builder leftovers via NSpid before userdel Tests / tests (push) Successful in 2m19s Details end-4's ./setup sudo keepalive orphans a `sleep 60` child as ii-builder; userdel then exits 8 and aborts the ISO build (CI exit 8). Sweep uid-matching processes inside the build chroot before userdel, mirroring shadow's user_busy_processes() checks (real/effective/saved uid + root device/inode). Because arch-chroot mounts proc before `unshare --fork --pid`, /proc entry numbers are outer-namespace pids: signal the last NSpid field instead, require matching NSpid depth, and surface kill errors instead of swallowing them. userdel keeps its stderr and, on final failure, dumps the leftover process list before aborting.	2026-09-27 14:03:47 +10:00
alvinlollo	83ed87f6a9	feat(iso): build end-4 deps in-image, ship end4-pC as default shell Tests / tests (push) Successful in 2m35s Details - customize_airootfs.sh stages dots-hyprland at /opt, runs ./setup install-deps as a throwaway builder, harvests the built packages into /opt/localrepo so pacstrap resolves them offline - image ships its own [local-aur] (file:///opt/localrepo); CI and localrepo/update.sh keep that copy in sync; .gitignore covers work/, out/ and airootfs/opt/localrepo/ - alvin-install runs ./setup install --skip-alldeps on the target - clone pctrade/end4-pC into /etc/skel/.config/quickshell, patch qsConfig ii -> end4-pC in the staged variables.lua (guarded + idempotent), and restore the fork after setup rsync --delete's ~/.config/quickshell - ship user presets in skel, point fish `q` alias at end4-pC - AGENTS.md: document the fourth package source and new gotchas	2026-09-27 10:31:49 +10:00