ci: install archiso via private pacman config, not /etc/pacman.conf

Writing stock core/extra over the host /etc/pacman.conf raced with the
tests workflow, which appends [cachyos]/[chaotic-aur] to the same file —
runs 132 and 133 ran concurrently on the runner, so either job could
corrupt the other's config mid-pacman.

Use 'pacman --config $(mktemp)' with stock core/extra instead: same
DNS-lookup reduction (only core/extra sync, no cachyos/chaotic), zero
writes to shared state. Verified on the runner: exit 0, only core/extra
synced, host /etc/pacman.conf mtime unchanged.

.gitea/workflows/build-iso.yaml

@@ -22,18 +22,127 @@ jobs:
       - name: Setup local AUR repo
         run: |
           set -euo pipefail
+          shopt -s nullglob
           mkdir -p /tmp/localrepo
           cp localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files* /tmp/localrepo/
-          sed -i 's|file:///home/alvin/alvinarch/localrepo|file:///tmp/localrepo|' pacman.conf
+          sed -i 's|file:///home/alvin/AlvinArch/localrepo|file:///tmp/localrepo|' pacman.conf
+          # The medium needs its own copy: the ISO's /etc/pacman.conf points
+          # [local-aur] at file:///opt/localrepo, which pacstrap reads at
+          # install time to resolve packages that are not in the official repos
+          # (built during the ISO build and harvested there by
+          # airootfs/root/customize_airootfs.sh).
+          mkdir -p airootfs/opt/localrepo
+          shipped=(localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files*)
+          if (( ${#shipped[@]} > 0 )); then
+            cp -L "${shipped[@]}" airootfs/opt/localrepo/
+          fi
+          echo "airootfs/opt/localrepo: $(ls airootfs/opt/localrepo | wc -l) file(s)"
 
       - name: Install archiso and dependencies
         run: |
           set -euo pipefail
-          pacman -Syu --noconfirm --needed archiso jq git-lfs zstd
+          # Install with a *private* config instead of /etc/pacman.conf.
+          # The host config is shared mutable state: the tests workflow
+          # rewrites it and jobs overlap on this runner (runs 132 and 133
+          # ran concurrently), so writing it here could corrupt a concurrent
+          # tests run. It also carries [cachyos] and [chaotic-aur] leftovers
+          # from tests.yaml, and syncing those two repos means extra DNS
+          # lookups against a gateway that intermittently drops UDP/53 —
+          # that is what failed run 131 at this very step. The build only
+          # needs archiso/jq from extra; mkarchiso reads the *profile's*
+          # pacman.conf for everything that goes into the ISO.
+          BUILD_CONF=$(mktemp)
+          trap 'rm -f "$BUILD_CONF"' EXIT
+          cat > "$BUILD_CONF" << 'STOCKCONF'
+          [options]
+          DisableSandbox
+          HoldPkg     = pacman glibc
+          Architecture = auto
+          CheckSpace
+          ParallelDownloads = 5
+          SigLevel    = Required DatabaseOptional
+          LocalFileSigLevel = Optional
+
+          [core]
+          Include = /etc/pacman.d/mirrorlist
+
+          [extra]
+          Include = /etc/pacman.d/mirrorlist
+          STOCKCONF
+          sed -i 's/^          //' "$BUILD_CONF"
+
+          # Warm the resolver cache for the mirrors we are about to query.
+          # systemd-resolved serves later lookups from cache, so a gateway
+          # UDP/53 burst cannot hit them again. Failures here are not fatal —
+          # the retry loop below is the real safety net.
+          for host in mirror.aarnet.edu.au gsl-syd.mm.fcix.net au.arch.niranjan.co; do
+            for try in 1 2 3 4 5; do
+              if getent hosts "$host" >/dev/null 2>&1; then
+                break
+              fi
+              echo "  ⏳ DNS for $host failed (try $try/5), retrying in $(( try * 3 ))s..."
+              sleep $(( try * 3 ))
+            done
+          done
+
+          # The gateway drops DNS queries in bursts; one burst must not fail
+          # the whole job, so retry with backoff before giving up.
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman --config "$BUILD_CONF" -Syu --noconfirm --needed archiso jq; then
+              synced=1
+              break
+            fi
+            echo "  ⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
+
+      - name: Ensure /dev/fd symlinks exist for mkinitcpio and procsub
+        run: |
+          set -euo pipefail
+          # mkinitcpio's preset step pipes through /dev/stdin and bash process
+          # substitution (< <(...)) uses /dev/fd; both break if these symlinks
+          # are missing (they are normally created once at boot by mkinitcpio's
+          # init). Two places need them, so cover both:
+          # 1. the executor's own /dev: mkarchiso reads /dev/stdin on the host
+          #    (machine-id, version, pkglist) and the workflow's own scripts use
+          #    process substitution here. A no-op if the links already exist.
+          ln -sfn /proc/self/fd    /dev/fd
+          ln -sfn /proc/self/fd/0  /dev/stdin
+          ln -sfn /proc/self/fd/1  /dev/stdout
+          ln -sfn /proc/self/fd/2  /dev/stderr
+          # 2. the chroot's /dev: devtmpfs is single-instance, so mounting it
+          #    here yields the same tree that pacstrap/arch-chroot expose as
+          #    <chroot>/dev. When the executor's /dev is itself devtmpfs (1)
+          #    already fixed that tree; this pass is what makes it work when
+          #    the executor's /dev is a plain tmpfs or directory instead.
+          d="$(mktemp -d)"
+          trap 'umount "$d" 2>/dev/null || true; rmdir "$d" 2>/dev/null || true' EXIT
+          mount -t devtmpfs devtmpfs "$d"
+          ln -sfn /proc/self/fd    "$d/fd"
+          ln -sfn /proc/self/fd/0  "$d/stdin"
+          ln -sfn /proc/self/fd/1  "$d/stdout"
+          ln -sfn /proc/self/fd/2  "$d/stderr"
+          ls -l "$d/fd" "$d/stdin" "$d/stdout" "$d/stderr"
+          umount "$d"
+          rmdir "$d"
+          trap - EXIT
 
       - name: Build Arch ISO
         run: |
           set -euo pipefail
+          # Pin one timestamp for the whole job: mkarchiso derives the ISO label,
+          # volume UUID, file mtimes, and ext4 hash seed from SOURCE_DATE_EPOCH.
+          # Exporting it explicitly makes every timestamp-derived value traceable
+          # (and lets later steps log the same value via $GITHUB_ENV).
+          SOURCE_DATE_EPOCH="$(date -u +%s)"
+          export SOURCE_DATE_EPOCH
+          echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> "$GITHUB_ENV"
+          echo "Building with SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
           # Clean up immediately even if this step is interrupted (cancel/exit):
           # unmount leftovers first, then remove the multi-GB work dir.
           trap 'umount -R "$PWD/work" 2>/dev/null || true; rm -rf "$PWD/work"' EXIT HUP INT TERM
@@ -43,6 +152,80 @@ jobs:
           mkdir -p "$PWD/out"
           mkarchiso -v -w "$PWD/work" -o "$PWD/out" -- "$PWD"
 
+      - name: Verify ISO search metadata
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          isos=(out/*.iso)
+          if (( ${#isos[@]} != 1 )); then
+            echo "❌ Expected exactly 1 ISO in out/, found ${#isos[@]}" >&2
+            exit 1
+          fi
+          iso=${isos[0]}
+
+          # blkid exits non-zero when a field is missing; keep going so the
+          # explicit guard below can report a useful error.
+          vol_uuid=$(blkid -o value -s UUID "$iso" || true)
+          vol_label=$(blkid -o value -s LABEL "$iso" || true)
+          if [ -z "$vol_uuid" ]; then
+            echo "❌ blkid found no UUID for $iso — volume date chain broken?" >&2
+            exit 1
+          fi
+          echo "Volume UUID:  $vol_uuid"
+          echo "Volume label: ${vol_label:-<none>}"
+          echo "SOURCE_DATE_EPOCH: ${SOURCE_DATE_EPOCH:-<unset>}"
+
+          fail() {
+            echo "❌ $1" >&2
+            echo "   If you changed boot configs (efiboot/, syslinux/, grub/) on purpose," >&2
+            echo "   update this 'Verify ISO search metadata' step to match." >&2
+            exit 1
+          }
+
+          # 1) /boot/<uuid>.uuid (the archisosearchfilename fallback key) must
+          #    exist inside the ISO and its stem must equal the volume UUID.
+          uuid_refs=0
+          while IFS= read -r member; do
+            [ -z "$member" ] && continue
+            member=${member#/}
+            stem=$(basename "$member" .uuid)
+            if [ "$stem" != "$vol_uuid" ]; then
+              fail "$member: stem '$stem' != volume UUID '$vol_uuid'"
+            fi
+            echo "  ✅ $member matches volume UUID"
+            uuid_refs=$((uuid_refs + 1))
+          done < <(bsdtar -tf "$iso" | grep -E '(^|/)boot/[0-9A-Za-z-]+\.uuid$' || true)
+          if (( uuid_refs == 0 )); then
+            fail "no /boot/<uuid>.uuid file found inside the ISO"
+          fi
+
+          # 2) Every archisosearchuuid= in shipped boot configs must equal the
+          #    volume UUID; every %ARCHISO% placeholder must have been substituted.
+          search_refs=0
+          while IFS= read -r member; do
+            [ -z "$member" ] && continue
+            member=${member#/}
+            if ! content=$(bsdtar -xOf "$iso" "$member" 2>/dev/null); then
+              fail "could not extract $member from the ISO"
+            fi
+            if printf '%s\n' "$content" | grep -q '%ARCHISO'; then
+              fail "$member contains an unsubstituted %ARCHISO% placeholder"
+            fi
+            while IFS= read -r val; do
+              [ -z "$val" ] && continue
+              search_refs=$((search_refs + 1))
+              if [ "$val" != "$vol_uuid" ]; then
+                fail "$member: archisosearchuuid=$val != volume UUID '$vol_uuid'"
+              fi
+              echo "  ✅ $member: archisosearchuuid=$val matches volume UUID"
+            done < <(printf '%s\n' "$content" | grep -o 'archisosearchuuid=[^[:space:]]*' | cut -d= -f2- || true)
+          done < <(bsdtar -tf "$iso" | grep -E '(^|/)(loader/entries/.*\.conf|boot/.*\.(cfg|conf))$' || true)
+          if (( search_refs == 0 )); then
+            fail "no archisosearchuuid= references found in shipped boot configs (params removed without updating this check?)"
+          fi
+
+          echo "✅ ISO search metadata consistent: $uuid_refs uuid file(s), $search_refs search reference(s)"
+
       - name: Generate Unique Dynamic Tag
         id: tag
         env:
@@ -73,22 +256,32 @@ jobs:
           echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
           echo "release_name=Arch Linux ISO (${BASE_DATE} Rev ${REVISION})" >> "$GITHUB_OUTPUT"
 
-      - name: Create Release and Upload ISO via Git LFS
+      - name: Create Release and Upload ISO
+        id: release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           # Use internal Gitea URL to bypass traefik proxy timeout on large uploads
           GITEA_API: http://192.168.1.168:3000/api/v1
-          GITEA_PUBLIC_URL: https://git.vilaythong.us
           REPOSITORY: ${{ github.repository }}
-          RELEASES_REPO: alvinlollo/AlvinArch-releases
           TAG_NAME: ${{ steps.tag.outputs.tag_name }}
           RELEASE_NAME: ${{ steps.tag.outputs.release_name }}
         run: |
-          set -euo pipefail
+          set -eu
           shopt -s nullglob
-          test -n "$GITEA_TOKEN"
-          test -n "$TAG_NAME"
-          test -n "$RELEASE_NAME"
+          tmpdir=$(mktemp -d)
+          trap 'rm -rf "$tmpdir"' EXIT
+          if [ -z "$GITEA_TOKEN" ]; then
+            echo "❌ GITEA_TOKEN is empty" >&2
+            exit 1
+          fi
+          if [ -z "$TAG_NAME" ]; then
+            echo "❌ TAG_NAME is empty" >&2
+            exit 1
+          fi
+          if [ -z "$RELEASE_NAME" ]; then
+            echo "❌ RELEASE_NAME is empty" >&2
+            exit 1
+          fi
 
           # Pre-flight: confirm the internal Gitea API is reachable so failures are clear
           if ! curl -sfS -o /dev/null "$GITEA_API/version"; then
@@ -96,24 +289,13 @@ jobs:
             exit 1
           fi
 
-          RELEASES_OWNER="${RELEASES_REPO%%/*}"
-          RELEASES_NAME="${RELEASES_REPO#*/}"
-          GITEA_BASE="${GITEA_API%/api/v1}"
-          GITEA_SCHEME="${GITEA_BASE%%://*}"
-          GITEA_HOST="${GITEA_BASE#*://}"
-          CLONE_URL="${GITEA_SCHEME}://${RELEASES_OWNER}:${GITEA_TOKEN}@${GITEA_HOST}/${RELEASES_REPO}.git"
-          REPO_DIR=/tmp/alvinarch-releases
-          trap 'rm -rf "$REPO_DIR"' EXIT
-
-          # Collect the ISOs produced by the build
+          # Collect the ISOs produced by the build and record SHA-256
           isos=(out/*.iso)
           if (( ${#isos[@]} == 0 )); then
             echo "❌ No ISO found in out/ — nothing to upload, aborting." >&2
             exit 1
           fi
 
-          # Compress each ISO with zstd and record its SHA-256
-          zst_files=()
           sha256sums=()
           for iso in "${isos[@]}"; do
             fname=$(basename "$iso")
@@ -123,155 +305,258 @@ jobs:
               echo "❌ '$iso' is only $size bytes — refusing to upload (not an ISO)." >&2
               exit 1
             fi
-
-            echo "Compressing $fname ($(( size / 1024 / 1024 )) MiB) with zstd..."
-            zstd -T0 -19 -f "$iso" -o "$iso.zst"
-            sha=$(sha256sum "$iso.zst" | awk '{print $1}')
-            echo "  ✅ ${fname}.zst: $(( $(stat -c %s "$iso.zst") / 1024 / 1024 )) MiB, sha256=$sha"
-            zst_files+=("$iso.zst")
+            sha=$(sha256sum "$iso" | awk '{print $1}')
+            if [ -z "$sha" ]; then
+              echo "❌ Failed to compute SHA-256 for '$iso'" >&2
+              exit 1
+            fi
+            echo "  ✅ $fname: $(( size / 1024 / 1024 )) MiB, sha256=$sha"
             sha256sums+=("$sha")
           done
 
-          # Make sure the releases repo exists (create it via API if missing)
-          if ! curl -sf -o /dev/null -H "Authorization: token $GITEA_TOKEN" \
-              "$GITEA_API/repos/$RELEASES_REPO"; then
-            echo "Creating releases repo '$RELEASES_REPO'..."
-            curl -sf -X POST \
-              -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              "$GITEA_API/user/repos" \
-              -d "{\"name\": \"$RELEASES_NAME\", \"description\": \"Compressed Arch Linux live ISOs (Git LFS)\", \"auto_init\": true}" > /dev/null
-          fi
-
-          # Push the compressed ISOs to the releases repo via Git LFS
-          if ! git clone --quiet "$CLONE_URL" "$REPO_DIR" 2>/dev/null; then
-            echo "❌ Failed to clone $RELEASES_REPO (check token access)." >&2
-            exit 1
-          fi
-
-          # Work on the 'main' branch (create it if the remote default differs)
-          if git -C "$REPO_DIR" rev-parse --verify -q origin/main >/dev/null 2>&1; then
-            git -C "$REPO_DIR" checkout -q -B main origin/main
-          else
-            git -C "$REPO_DIR" checkout -q -B main
-          fi
-
-          git -C "$REPO_DIR" lfs install --local
-          git -C "$REPO_DIR" lfs track "*.iso.zst"
-          mkdir -p "$REPO_DIR/releases/$TAG_NAME"
-          for zst in "${zst_files[@]}"; do
-            cp "$zst" "$REPO_DIR/releases/$TAG_NAME/"
-          done
-
-          # Seed a short README redirecting to the main repo (status badges on top)
-          cat > "$REPO_DIR/README.md" <<'MDEOF'
-          [![Scheduled ArchISO Build](https://git.vilaythong.us/alvinlollo/AlvinArch/actions/workflows/build-iso.yaml/badge.svg?branch=main)](https://git.vilaythong.us/alvinlollo/AlvinArch/actions?workflow=build-iso.yaml)
-          [![Tests](https://git.vilaythong.us/alvinlollo/AlvinArch/actions/workflows/tests.yaml/badge.svg?branch=main)](https://git.vilaythong.us/alvinlollo/AlvinArch/actions?workflow=tests.yaml)
-
-          # AlvinArch Releases
-
-          Compressed (zstd) Arch Linux live ISOs built automatically by
-          [alvinlollo/AlvinArch](https://git.vilaythong.us/alvinlollo/AlvinArch).
-
-          **Main repository:** [alvinlollo/AlvinArch](https://git.vilaythong.us/alvinlollo/AlvinArch)
-          MDEOF
-
-          git -C "$REPO_DIR" config user.name "Gitea Actions"
-          git -C "$REPO_DIR" config user.email "actions@gitea.local"
-          git -C "$REPO_DIR" add .gitattributes README.md "releases/$TAG_NAME"
-          if git -C "$REPO_DIR" diff --cached --quiet; then
-            echo "⚠️  No changes to commit for $TAG_NAME — releasing as-is." >&2
-          else
-            git -C "$REPO_DIR" commit --quiet -m "Add $TAG_NAME"
-          fi
-          if ! git -C "$REPO_DIR" push --quiet origin main 2>/dev/null; then
-            echo "❌ Failed to push $TAG_NAME to $RELEASES_REPO." >&2
-            exit 1
-          fi
-
-          # Verify each LFS object exists server-side (oid == the sha256 we recorded)
-          for i in "${!zst_files[@]}"; do
-            fname=$(basename "${zst_files[$i]}")
-            size=$(stat -c %s "${zst_files[$i]}")
-            oid=${sha256sums[$i]}
-            lfs_payload=$(jq -nc --arg oid "$oid" --argjson sz "$size" \
-              '{operation:"download",transfers:["basic"],objects:[{oid:$oid,size:$sz}]}')
-            obj=$(curl -sf -u "$RELEASES_OWNER:$GITEA_TOKEN" \
-              -H "Content-Type: application/vnd.git-lfs+json" \
-              -d "$lfs_payload" \
-              "$GITEA_BASE/$RELEASES_REPO.git/info/lfs/objects/batch")
-            if [[ "$(jq -r '.objects[0] | has("actions")' <<< "$obj")" != "true" ]]; then
-              echo "❌ Verification failed: LFS object for '$fname' ($size bytes) missing on server." >&2
-              exit 1
-            fi
-            echo "  ✅ Verified '$fname' ($size bytes) on $RELEASES_REPO"
-          done
-
-          # Create the release with a link to the file directory + SHA-256 checksums
-          DOWNLOAD_URL="$GITEA_PUBLIC_URL/$RELEASES_REPO/src/branch/main/releases/$TAG_NAME"
-          printf -v body 'Arch Linux live ISO %s\n\nDownload: %s\n\nChecksums (SHA-256):\n' \
-            "$RELEASE_NAME" "$DOWNLOAD_URL"
-          for i in "${!zst_files[@]}"; do
-            printf -v line -- '- `%s`: sha256 `%s`\n' "$(basename "${zst_files[$i]}")" "${sha256sums[$i]}"
+          # Build the release body with SHA-256 checksums
+          printf -v body 'Arch Linux live ISO %s\n\nChecksums (SHA-256):\n' "$RELEASE_NAME"
+          for i in "${!isos[@]}"; do
+            # Release body: markdown backticks are literal (printf format below)
+            # shellcheck disable=SC2016
+            printf -v line -- '- `%s`: sha256 `%s`\n' "$(basename "${isos[$i]}")" "${sha256sums[$i]}"
             body+="$line"
           done
 
+          # Create the release (curl result written to a file, checked with if)
           payload=$(jq -nc --arg tag "$TAG_NAME" --arg name "$RELEASE_NAME" --arg body "$body" \
             '{tag_name:$tag,name:$name,body:$body}')
-          RELEASE_ID=$(curl -sf -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "$GITEA_API/repos/$REPOSITORY/releases" \
-            -d "$payload" | jq -er '.id')
-
-          echo "  ✅ Released $TAG_NAME (ID: $RELEASE_ID) with download link + SHA-256 checksums"
-
-          # Mirror the release tag on the releases repo for redundancy/discovery
-          if ! git -C "$REPO_DIR" ls-remote --exit-code origin \
-              refs/tags/"$TAG_NAME" >/dev/null 2>&1; then
-            git -C "$REPO_DIR" tag "$TAG_NAME"
-            if ! git -C "$REPO_DIR" push --quiet origin "$TAG_NAME" 2>/dev/null; then
-              echo "❌ Failed to push tag $TAG_NAME to $RELEASES_REPO." >&2
-              exit 1
-            fi
-          fi
-          if ! curl -sf -o /dev/null -H "Authorization: token $GITEA_TOKEN" \
-              "$GITEA_API/repos/$RELEASES_REPO/releases/tags/$TAG_NAME"; then
-            curl -sf -X POST \
+          if ! curl -sf -X POST \
               -H "Authorization: token $GITEA_TOKEN" \
               -H "Content-Type: application/json" \
-              "$GITEA_API/repos/$RELEASES_REPO/releases" \
-              -d "$payload" > /dev/null
-            echo "  ✅ Mirrored $TAG_NAME release on $RELEASES_REPO"
+              "$GITEA_API/repos/$REPOSITORY/releases" \
+              -d "$payload" -o "$tmpdir/release.json"; then
+            echo "❌ Failed to create release $TAG_NAME" >&2
+            exit 1
+          fi
+          if ! RELEASE_ID=$(jq -er '.id' "$tmpdir/release.json"); then
+            echo "❌ Release response contained no id" >&2
+            exit 1
+          fi
+          echo "release_id=${RELEASE_ID}" >> "$GITHUB_OUTPUT"
+          echo "  ✅ Created release $TAG_NAME (ID: $RELEASE_ID)"
+
+          # Upload each ISO as a release asset, up to 3 attempts per file
+          MAX_ATTEMPTS=3
+          for i in "${!isos[@]}"; do
+            iso=${isos[$i]}
+            fname=$(basename "$iso")
+            size=$(stat -c %s "$iso")
+            echo "Uploading $fname ($(( size / 1024 / 1024 )) MiB) to release $TAG_NAME..."
+            uploaded=0
+            attempt=1
+            while [ "$attempt" -le "$MAX_ATTEMPTS" ]; do
+              # Fresh output file each attempt: curl does not truncate -o on
+              # transport failure, so a stale body must not be misreported.
+              rm -f "$tmpdir/upload.json"
+              # A previous attempt may have saved the asset but lost the
+              # response; Gitea rejects duplicate names, so only after the
+              # first attempt check for and remove same-name leftovers
+              if [ "$attempt" -gt 1 ]; then
+                if curl -sf -H "Authorization: token $GITEA_TOKEN" \
+                    "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
+                    -o "$tmpdir/assets.json"; then
+                  asset_ids=$(jq -r --arg name "$fname" \
+                    '.[] | select(.name == $name) | .id' "$tmpdir/assets.json")
+                  while read -r asset_id; do
+                    if [ -n "$asset_id" ]; then
+                      echo "  ↻ Removing leftover asset id=$asset_id from a previous attempt"
+                      if ! curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+                          "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets/$asset_id" \
+                          -o /dev/null; then
+                        echo "  ⚠️ Could not remove leftover asset id=$asset_id (continuing)" >&2
+                      fi
+                    fi
+                  done <<< "$asset_ids"
+                fi
+              fi
+
+              # Capture HTTP status explicitly: `-f` would swallow the Gitea
+              # error body (e.g. attachment size-limit messages) and leave the
+              # failure reason unknown.
+              if http_code=$(curl -sS -X POST --max-time 600 \
+                  -H "Authorization: token $GITEA_TOKEN" \
+                  -F "attachment=@$iso" \
+                  "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
+                  -o "$tmpdir/upload.json" -w '%{http_code}'); then
+                if [ "${http_code:0:1}" = "2" ] \
+                    && download_url=$(jq -er '.browser_download_url' "$tmpdir/upload.json"); then
+                  echo "  ✅ Uploaded $fname (attempt $attempt/$MAX_ATTEMPTS): $download_url"
+                  uploaded=1
+                  break
+                fi
+                echo "  ⚠️ Upload of $fname: HTTP $http_code (attempt $attempt/$MAX_ATTEMPTS)" >&2
+                echo "  Response: $(head -c 2000 "$tmpdir/upload.json" 2>/dev/null)" >&2
+              else
+                rc=$?
+                echo "  ⚠️ Upload of $fname failed (attempt $attempt/$MAX_ATTEMPTS): curl exit $rc, HTTP ${http_code:-000}" >&2
+                if [ -s "$tmpdir/upload.json" ]; then
+                  echo "  Response: $(head -c 2000 "$tmpdir/upload.json")" >&2
+                fi
+              fi
+
+              if [ "$attempt" -lt "$MAX_ATTEMPTS" ]; then
+                sleep $(( attempt * 10 ))
+              fi
+              attempt=$(( attempt + 1 ))
+            done
+
+            if [ "$uploaded" -ne 1 ]; then
+              echo "❌ Failed to upload $fname after $MAX_ATTEMPTS attempts — aborting." >&2
+              exit 1
+            fi
+          done
+
+          echo "✅ All ISOs uploaded to release $TAG_NAME"
+          exit 0
+
+      - name: Verify uploaded ISO checksums
+        if: success()
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          # Internal origin bypasses traefik (and its Anubis bot wall) — the
+          # same host the upload step already uses.
+          GITEA_API: http://192.168.1.168:3000/api/v1
+          GITEA_ORIGIN: http://192.168.1.168:3000
+          REPOSITORY: ${{ github.repository }}
+          TAG_NAME: ${{ steps.tag.outputs.tag_name }}
+          RELEASE_ID: ${{ steps.release.outputs.release_id }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          tmpdir=$(mktemp -d)
+          trap 'rm -rf "$tmpdir"' EXIT
+
+          for var in GITEA_TOKEN TAG_NAME RELEASE_ID; do
+            if [ -z "${!var:-}" ]; then
+              echo "❌ $var is empty" >&2
+              exit 1
+            fi
+          done
+          case "$RELEASE_ID" in
+            ''|*[!0-9]*) echo "❌ RELEASE_ID is not numeric: $RELEASE_ID" >&2; exit 1 ;;
+          esac
+
+          # fail_verify <reason...>: job fails but the release is kept — used
+          # for transport/API errors where the upload itself may be fine.
+          fail_verify() {
+            echo "❌ $1" >&2
+            echo "   Release $TAG_NAME (ID $RELEASE_ID) left in place (not proven corrupt)." >&2
+            exit 1
+          }
+
+          # abort_release <reason...>: the asset is provably wrong — delete the
+          # release so a corrupt asset can never be published, then fail.
+          abort_release() {
+            echo "❌ $1" >&2
+            echo "Deleting release $TAG_NAME (ID $RELEASE_ID) so the bad upload cannot be used..." >&2
+            if ! curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+                "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID" -o /dev/null; then
+              echo "⚠️ Could not delete release $RELEASE_ID — delete it manually!" >&2
+            fi
+            exit 1
+          }
+
+          isos=(out/*.iso)
+          if (( ${#isos[@]} == 0 )); then
+            echo "❌ No ISO in out/ to verify" >&2
+            exit 1
           fi
 
-      - name: Keep only latest 3 releases
+          # Recompute local checksums
+          declare -A local_sha local_size
+          for iso in "${isos[@]}"; do
+            fname=$(basename "$iso")
+            local_sha["$fname"]=$(sha256sum "$iso" | awk '{print $1}')
+            local_size["$fname"]=$(stat -c %s "$iso")
+            if [ -z "${local_sha[$fname]}" ]; then
+              echo "❌ Failed to compute SHA-256 for '$iso'" >&2
+              exit 1
+            fi
+          done
+
+          # List the release's assets as uploaded (API error = transient, no delete)
+          if ! curl -sf -H "Authorization: token $GITEA_TOKEN" \
+              "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
+              -o "$tmpdir/assets.json"; then
+            fail_verify "Failed to list assets of release $RELEASE_ID (API/transport error)"
+          fi
+
+          for iso in "${isos[@]}"; do
+            fname=$(basename "$iso")
+            api_size=$(jq -er --arg name "$fname" \
+              '.[] | select(.name == $name) | .size' "$tmpdir/assets.json" 2>/dev/null) \
+              || abort_release "Asset '$fname' missing from release $RELEASE_ID"
+            if [ "$api_size" != "${local_size[$fname]}" ]; then
+              abort_release "Asset '$fname' size mismatch: server=$api_size local=${local_size[$fname]}"
+            fi
+
+            # Download from the internal origin (traefik/Anubis bypassed).
+            # iso_name contains a space ("Alvin archlinux"), so the filename
+            # must be percent-encoded or curl rejects the URL outright.
+            enc_fname=$(jq -rn --arg v "$fname" '$v|@uri')
+            url="$GITEA_ORIGIN/$REPOSITORY/releases/download/$TAG_NAME/$enc_fname"
+            downloaded=0
+            for attempt in 1 2 3; do
+              # Try header auth, then ?token=, then anonymous (public repo).
+              if curl -sfL --max-time 600 -H "Authorization: token $GITEA_TOKEN" \
+                  "$url" -o "$tmpdir/$fname"; then
+                downloaded=1
+              elif curl -sfL --max-time 600 "$url?token=$GITEA_TOKEN" \
+                  -o "$tmpdir/$fname"; then
+                downloaded=1
+              elif curl -sfL --max-time 600 "$url" -o "$tmpdir/$fname"; then
+                downloaded=1
+              fi
+              [ "$downloaded" -eq 1 ] && break
+              echo "  ⚠️ Download of $fname failed (attempt $attempt/3)" >&2
+              [ "$attempt" -lt 3 ] && sleep $(( attempt * 10 ))
+            done
+            if [ "$downloaded" -ne 1 ]; then
+              fail_verify "Could not download asset '$fname' back from release $RELEASE_ID (auth/transport error, not proven corrupt)"
+            fi
+
+            actual=$(sha256sum "$tmpdir/$fname" | awk '{print $1}')
+            expected=${local_sha[$fname]}
+            if [ "$actual" != "$expected" ]; then
+              abort_release "SHA-256 mismatch for '$fname': server=$actual local=$expected"
+            fi
+            echo "  ✅ $fname: size and SHA-256 match"
+            rm -f "$tmpdir/$fname"
+          done
+
+          echo "✅ All uploaded assets verified against local ISO checksums"
+          exit 0
+
+      - name: Keep only latest 2 releases
         if: success()
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_API: http://192.168.1.168:3000/api/v1
           REPOSITORY: ${{ github.repository }}
-          RELEASES_REPO: alvinlollo/AlvinArch-releases
         run: |
           set -euo pipefail
           test -n "$GITEA_TOKEN"
 
-          for repo in "$REPOSITORY" "$RELEASES_REPO"; do
-            echo "Pruning old releases in $repo..."
-            readarray -t ids < <(curl -sf -H "Authorization: token $GITEA_TOKEN" \
-              "$GITEA_API/repos/$repo/releases" \
-              | jq -er 'sort_by(.created_at) | .[].id')
+          echo "Pruning old releases in $REPOSITORY..."
+          readarray -t ids < <(curl -sf -H "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API/repos/$REPOSITORY/releases" \
+            | jq -er 'sort_by(.created_at) | .[].id')
 
-            to_delete=$(( ${#ids[@]} - 3 ))
-            if (( to_delete > 0 )); then
-              for ((i = 0; i < to_delete; i++)); do
-                id=${ids[$i]}
-                echo "Deleting old release ID: $id (in $repo)"
-                curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
-                  "$GITEA_API/repos/$repo/releases/$id"
-              done
-            fi
-          done
+          to_delete=$(( ${#ids[@]} - 2 ))
+          if (( to_delete > 0 )); then
+            for ((i = 0; i < to_delete; i++)); do
+              id=${ids[$i]}
+              echo "Deleting old release ID: $id"
+              curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+                "$GITEA_API/repos/$REPOSITORY/releases/$id"
+            done
+          fi
 
       - name: Cleanup mkarchiso mounts and workdirs
         if: always() # Runs on success, failure, or cancellation
@@ -293,9 +578,8 @@ jobs:
           # Remove working directories with proper permissions
           $PRIV rm -rf "$PWD/work"
 
-      - name: Remove built ISO (success or cancellation)
-        if: success() || cancelled()
+      - name: Remove built ISO
+        if: always()
         run: |
           set -eu
-          # On failure the ISO is kept in out/ for manual upload
           rm -rf "$PWD/out"

.gitea/workflows/tests.yaml

@@ -36,7 +36,23 @@ jobs:
           rm -f /var/lib/pacman/sync/cachyos* /var/lib/pacman/sync/chaotic*
 
       - name: Install prerequisites
-        run: pacman -Syu --noconfirm --needed shellcheck yamllint
+        run: |
+          # The gateway intermittently drops UDP/53 (it failed build run 131
+          # at the equivalent step); retry with backoff instead of dying on
+          # the first bad DNS burst.
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed shellcheck yamllint; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
 
       - name: Set up CachyOS repo
         run: |
@@ -54,7 +70,20 @@ jobs:
           printf '\n[cachyos]\nInclude = /etc/pacman.d/cachyos-mirrorlist\n' \
             >> /etc/pacman.conf
 
-          pacman -Syu --noconfirm --needed
+          # Retry: gateway drops UDP/53 in bursts (see run 131)
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
 
       - name: Set up chaotic-aur repo
         run: |
@@ -65,7 +94,20 @@ jobs:
           printf '\n[chaotic-aur]\nInclude = /etc/pacman.d/chaotic-mirrorlist\n' \
             >> /etc/pacman.conf
 
-          pacman -Syu --noconfirm --needed
+          # Retry: gateway drops UDP/53 in bursts (see run 131)
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
 
       - name: Lint shell scripts with ShellCheck
         run: |

.gitignore

@@ -0,0 +1,11 @@
+# Multi-GB mkarchiso output (see AGENTS.md build command)
+work/
+out/
+
+# In-image copy of localrepo/ — populated by localrepo/update.sh and
+# .gitea/workflows/build-iso.yaml, shipped as /opt/localrepo on the ISO
+airootfs/opt/localrepo/
+
+# Build stamp staged by profiledef.sh at ISO build time (see AGENTS.md);
+# consumed by customize_airootfs.sh, never committed
+airootfs/root/.iso-build-stamp

AGENTS.md

@@ -17,6 +17,9 @@ sudo mkarchiso -v -w work -o out/ .
 ./localrepo/update.sh pkg1.pkg.tar.zst   # add files, then re-index
 ```
 
+`update.sh` also refreshes `airootfs/opt/localrepo/` (the copy that ships on the
+ISO), so run it after touching `localrepo/` before building.
+
 ## CI Checks (must pass before merge)
 
 - **ShellCheck**: all `.sh` files checked with `shellcheck -x -s bash`
@@ -32,6 +35,13 @@ sudo mkarchiso -v -w work -o out/ .
 2. **`localrepo/*.pkg.tar.zst`** — pre-built AUR packages. The `local-aur` repo is configured in `pacman.conf` and picked up by mkarchiso automatically.
 3. **`build-end4-deps.sh`** — builds end-4 AUR deps at build time.
 
+There is a **fourth source**: `customize_airootfs.sh` runs end-4's own
+`./setup install-deps` inside the image (as a throwaway `ii-builder` account),
+which resolves and compiles everything the dotfiles need (quickshell, MicroTeX,
+theming, fonts, ...). Those packages are installed in the live system, land in
+`pkglist.x86_64.txt`, and are harvested into `/opt/localrepo` so pacstrap can
+install them into the target without the network.
+
 **Important**: `localrepo/update.sh` auto-appends new package names to `packages.x86_64`. If you remove a package from `packages.x86_64` that exists in `localrepo/`, it will be re-added on the next `update.sh` run.
 
 ## Key Files
@@ -39,17 +49,27 @@ sudo mkarchiso -v -w work -o out/ .
 | File | Purpose |
 |------|---------|
 | `packages.x86_64` | Live ISO package list (~402 packages) |
-| `profiledef.sh` | ISO metadata, compression, boot modes |
+| `profiledef.sh` | ISO metadata, compression, boot modes, build-stamp staging |
 | `pacman.conf` | Repos: cachyos → core → extra → multilib → chaotic-aur → local-aur |
 | `bootstrap_packages` | Minimal build-time packages (`base`, `arch-install-scripts`) |
-| `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, oh-my-zsh, lazy.nvim, plugins |
+| `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, skel dotfiles (incl. end4-pC), qsConfig patch, end-4 `install-deps`, package harvest, uv/font pre-warm |
+| `airootfs/root/.live-pacman.conf` | `/etc/pacman.conf` of the built image (adds `[local-aur]` = `file:///opt/localrepo`) |
+| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, LUKS (systemd initramfs **or** experimental unl0kr + optional TPM2 unlock), user, git identity + GitHub SSH keys, login manager (none/greetd/sddm/gdm) + autologin, end-4 dotfiles (`--skip-alldeps`), build-stamp motd, boot |
 | `localrepo/build-end4-deps.sh` | Non-interactive AUR builds for end-4 dependencies |
-| `localrepo/update.sh` | Regenerates localrepo DB + syncs names to packages.x86_64 |
+| `localrepo/update.sh` | Regenerates localrepo DB, syncs names to packages.x86_64, syncs `airootfs/opt/localrepo/` |
 
 ## Gotchas
 
 - The profile root is the **repo root** (not a `releng/` subdirectory). The CI build-iso workflow uses `mkarchiso -v -w work -o out/ releng` but this is a naming convention — the actual profile files live at the repo root.
-- `customize_airootfs.sh` clones git repos (oh-my-zsh, lazy.nvim, plugins) into `/etc/skel` during the ISO build. These require network access at build time but make the live ISO work offline.
+- `customize_airootfs.sh` clones git repos (oh-my-zsh, lazy.nvim, plugins, end-4 dots) into `/etc/skel` and `/opt` during the ISO build. These require network access at build time but make the live ISO work offline.
+- `customize_airootfs.sh` runs `./setup install-deps -f -s --skip-plasmaintg` as the throwaway user `ii-builder` (end-4's scripts refuse to run as root) and aborts the build if it fails. `--skip-plasmaintg` is deliberate: that optional Firefox widget pulls 410 packages / 526 MiB of KDE.
 - The `[local-aur]` repo path in `pacman.conf` (`file:///home/alvin/alvinarch/localrepo`) is for local builds only. The CI does not use this path.
+- The **image** ships its own `[local-aur]` at `file:///opt/localrepo` (see `.live-pacman.conf`). It holds `localrepo/` (copied by CI/`update.sh`) plus everything `install-deps` built. pacstrap runs without `-P`, so the target keeps the stock `/etc/pacman.conf`; `alvin-install` strips `[local-aur]` from it anyway as a safety net, because `/opt/localrepo` exists only on the medium.
+- `alvin-install` runs end-4 with `--skip-alldeps` — dependencies must come from the ISO. It feeds `yes i` to end-4's failure prompt: inside the installer chroot the medium's `/run` is bind-mounted in, so end-4's `systemctl --machine=…@.host --user enable … --now` lines can never work (and `--now` would start services on the live medium). `install_end4_dots` re-applies the enable-only part (bluetooth, ydotool, i2c module) outside the chroot and reports every step end-4 had to skip. If the end-4 step reports "incomplete", check that `hyprctl`/`quickshell`/the venv were resolvable (harvest) before re-running anything.
+- `/etc/skel/.cache/uv` + `/etc/skel/.local/share/uv/python` are pre-warmed by the build (~460 MB: CPython 3.12 and the pinned wheel cache) so end-4's `uv venv`/`uv pip install` at install time needs no network.
+- **end4-pC** (`pctrade/end4-pC`) is the default quickshell config: cloned into `/etc/skel/.config/quickshell/end4-pC` at build time, selected by patching `hl.env("qsConfig", "ii")` → `"end4-pC"` in the **staged** `/opt/dots-hyprland/dots/.config/hypr/hyprland/variables.lua` (there is no `hypr/hyprland/` in this repo — `./setup install` copies it to the installed system). `alvin-install` re-copies end4-pC into the user's home *after* `./setup install`, because end-4's installer `rsync --delete`s all of `~/.config/quickshell`.
+- `airootfs/etc/skel/.config/illogical-impulse/presets/` carries the user's presets (`Laptop.json`, `Personal-Performance.json`, `Personal-Performance.zip`). They embed `/home/alvin/...` paths, so wallpapers/screenshots need fixing up after install.
 - End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
 - `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.
+- `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it.
+- **Build stamp flow**: `profiledef.sh` (sourced by mkarchiso) stages the gitignored `airootfs/root/.iso-build-stamp` when a `.git` dir exists **or** `CI`/`GITEA_ACTIONS` is set — line reads `AlvinArch build <date> | commit <date> | <4-char hash>` (falls back to `commit unknown` if `git -c safe.directory` can't read the repo; without `.git`/CI no file is staged). `customize_airootfs.sh` installs it as `/etc/alvin-build-stamp` on the live medium, and `alvin-install`'s `install_motd` copies the live `/etc/motd` banner to the target and appends the stamp. If the medium has no stamp, the installed system gets no motd from us.

README.md

@@ -50,6 +50,7 @@ AlvinArch/
 ### Key Features
 
 - **Hyprland + end-4** — Wayland compositor with illogical-impulse dotfiles (quickshell, bibata cursors, microtex)
+- **Automated installer (`alvin-install`)** — gum TUI: LUKS with systemd initramfs or experimental touchscreen unl0kr, optional TPM2 auto-unlock, GitHub SSH key import, login manager choice (none/greetd/sddm/gdm), autologin, and a build stamp in `/etc/motd`
 - **LazyVim** — Pre-configured Neovim with lazy.nvim and curated plugins
 - **Fish + Zsh + Starship** — Dual shell setup with oh-my-zsh and a cross-shell prompt
 - **Local AUR repo** — Pre-built packages (end-4 deps, wallust, grub-customizer, etc.) that aren't in official repos

airootfs/etc/motd

@@ -1,4 +1,5 @@
-To install Arch Linux follow the installation guide:
+To install Arch Linux, follow the installation guide,
+or run alvin-install for an automated setup.
 https://wiki.archlinux.org/title/Installation_guide
 
 For Wi-Fi, run nmtui to configure a wireless network.

airootfs/etc/pacman.d/hooks/00-ensure-dev-stdin.hook

@@ -0,0 +1,10 @@
+[Trigger]
+Type = Package
+Operation = Install
+Operation = Upgrade
+Target = *
+
+[Action]
+Description = Ensuring /dev/stdin exists...
+When = PreTransaction
+Exec = /usr/bin/sh -c "[ -e /dev/stdin ]  || ln -sf /proc/self/fd/0 /dev/stdin; [ -e /dev/stdout ] || ln -sf /proc/self/fd/1 /dev/stdout; [ -e /dev/stderr ] || ln -sf /proc/self/fd/2 /dev/stderr"

airootfs/etc/skel/.config/fish/config.fish

@@ -23,7 +23,7 @@ if status is-interactive
     alias celar "printf '\033[2J\033[3J\033[1;1H'"
     alias claer "printf '\033[2J\033[3J\033[1;1H'"
     alias pamcan pacman
-    alias q 'qs -c ii'
+    alias q 'qs -c end4-pC'
     if test "$TERM" != "linux"
         alias ls 'eza --icons'
     end

airootfs/etc/skel/.config/illogical-impulse/presets/Laptop.json

@@ -0,0 +1,677 @@
+{
+  "appearance": {
+    "extraBackgroundTint": true,
+    "fakeScreenRounding": 0,
+    "fonts": {
+      "expressive": "Space Grotesk",
+      "iconNerd": "JetBrains Mono NF",
+      "main": "Google Sans Flex",
+      "monospace": "JetBrains Mono NF",
+      "numbers": "Google Sans Flex",
+      "reading": "Readex Pro",
+      "title": "Google Sans Flex"
+    },
+    "palette": {
+      "accentColor": "",
+      "type": "scheme-tonal-spot"
+    },
+    "transparency": {
+      "automatic": true,
+      "backgroundTransparency": 0.11,
+      "contentTransparency": 0.57,
+      "enable": false
+    },
+    "wallpaperTheming": {
+      "enableAppsAndShell": true,
+      "enableQtApps": true,
+      "enableTerminal": true,
+      "terminalGenerationProps": {
+        "forceDarkMode": false,
+        "harmonizeThreshold": 100,
+        "harmony": 0.5,
+        "termFgBoost": 0.35
+      }
+    }
+  },
+  "apps": {
+    "bluetooth": "kcmshell6 kcm_bluetooth",
+    "changePassword": "kitty -1 --hold=yes fish -i -c 'passwd'",
+    "manageUser": "kcmshell6 kcm_users",
+    "network": "kcmshell6 kcm_networkmanagement",
+    "networkEthernet": "kcmshell6 kcm_networkmanagement",
+    "taskManager": "plasma-systemmonitor --page-name Processes",
+    "terminal": "kitty -1",
+    "update": "kitty -1 --hold=yes fish -i -c 'pkexec pacman -Syu'",
+    "volumeMixer": "~/.config/hypr/hyprland/scripts/launch_first_available.sh \"pavucontrol-qt\" \"pavucontrol\""
+  },
+  "background": {
+    "blurRadius": 32,
+    "centeredWallpaper": false,
+    "centeredWallpaperColor": "primaryContainer",
+    "centeredWallpaperOnlyWhenLocked": false,
+    "centeredWallpaperShape": "Cookie7Sided",
+    "centeredWallpaperSize": 400,
+    "enableWallpaperPreview": false,
+    "hideWhenFullscreen": true,
+    "lockWall": "",
+    "parallax": {
+      "autoVertical": false,
+      "enableSidebar": true,
+      "enableWorkspace": true,
+      "vertical": false,
+      "widgetsFactor": 1.2,
+      "workspaceZoom": 1.07
+    },
+    "screenList": [],
+    "showBlur": true,
+    "showGrid": true,
+    "showSnapLines": true,
+    "splitRatio": "25",
+    "splitSide": "right",
+    "thumbnailPath": "",
+    "wallpaperAnimation": "random",
+    "wallpaperPath": "/home/alvin/Pictures/Wallpapers/Dynamic-Wallpapers/Dark/japan-street-Dark.png",
+    "widgets": {
+      "blurRadius": 32,
+      "blurWidgets": false,
+      "calendar": {
+        "enable": true,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "x": 1596,
+        "y": 744,
+        "z": 4
+      },
+      "clock": {
+        "color": "",
+        "cookie": {
+          "aiStyling": false,
+          "constantlyRotate": false,
+          "dateInClock": true,
+          "dateStyle": "bubble",
+          "dialNumberStyle": "full",
+          "hourHandStyle": "hollow",
+          "hourMarks": false,
+          "minuteHandStyle": "medium",
+          "secondHandStyle": "line",
+          "sides": 12,
+          "timeIndicators": true,
+          "useSineCookie": false
+        },
+        "digital": {
+          "adaptiveAlignment": true,
+          "animateChange": true,
+          "font": {
+            "family": "Google Sans Flex",
+            "roundness": 1.1290989771359807,
+            "size": 129.49608904933814,
+            "weight": 595.725165314564,
+            "width": 99.44532190132371
+          },
+          "showDate": true,
+          "vertical": false
+        },
+        "enable": true,
+        "pixel": {
+          "orientation": "vertical"
+        },
+        "placementStrategy": "leastBusy",
+        "quote": {
+          "enable": true,
+          "followClock": false,
+          "text": "Kawaī neko o zenbu tabe chaimasu."
+        },
+        "showOnlyWhenLocked": false,
+        "style": "digital",
+        "styleLocked": "cookie",
+        "x": 1423,
+        "y": 383,
+        "z": 3
+      },
+      "customImage": {
+        "enable": true,
+        "path": "",
+        "placementStrategy": "free",
+        "shape": "Cookie4Sided",
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "customText": {
+        "alignment": "center",
+        "color": "",
+        "content": "Hello world",
+        "enable": true,
+        "fontFamily": "Caveat",
+        "fontSize": 72,
+        "placementStrategy": "free",
+        "shadow": true,
+        "x": 400,
+        "y": 300,
+        "z": 0
+      },
+      "images": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "media": {
+        "backgroundShape": "Cookie4Sided",
+        "enable": true,
+        "placementStrategy": "free",
+        "showControls": true,
+        "showLyrics": false,
+        "showTitles": true,
+        "sizeMode": "1x3",
+        "x": 744,
+        "y": 876,
+        "z": 1
+      },
+      "notes": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "resources": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "shadow": true,
+      "sticker": {
+        "enable": false,
+        "items": [],
+        "outlineColor": "#ffffff",
+        "outlineWidth": 8,
+        "path": "",
+        "placementStrategy": "free",
+        "rotation": 0,
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "timers": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "todo": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "userCard": {
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "1x2",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "visualizer": {
+        "colorSource": "theme",
+        "enable": true,
+        "height": 343,
+        "placementStrategy": "free",
+        "ringSize": 380,
+        "sensitivity": 1.65,
+        "style": "mirror",
+        "x": 0,
+        "y": 0,
+        "z": -1000
+      },
+      "weather": {
+        "enable": false,
+        "expanded": false,
+        "placementStrategy": "mostBusy",
+        "sizeMode": "1x3",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "worldClock": {
+        "clockCount": 4,
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "timezones": [
+          "Australia/Sydney",
+          "Asia/Tokyo",
+          "Europe/London",
+          "America/New_York"
+        ],
+        "x": 400,
+        "y": 100,
+        "z": 0
+      }
+    },
+    "widgetsLocked": false
+  },
+  "bar": {
+    "autoHide": {
+      "enable": false,
+      "hoverRegionWidth": 2,
+      "pushWindows": false,
+      "showWhenPressingSuper": {
+        "delay": 140,
+        "enable": true
+      }
+    },
+    "borderless": "transparent",
+    "bottom": false,
+    "centerOnlyReserveFrame": false,
+    "cornerStyle": 3,
+    "divider": {
+      "spacing": 20,
+      "style": "rect"
+    },
+    "dynamicIsland": {
+      "leftWidget": "clockWidget",
+      "rightWidget": "systemIcons",
+      "showMediaControls": false,
+      "visualizerStyle": "wave"
+    },
+    "floatStyleShadow": true,
+    "followFrameColor": false,
+    "frameColor": "secondaryContainer",
+    "frameThickness": 4,
+    "groupColor": "layer1",
+    "indicators": {
+      "notifications": {
+        "showUnreadCount": true
+      }
+    },
+    "layouts": {
+      "leftLayout": [
+        "leftSidebarButton",
+        "activeWindow",
+        "resources"
+      ],
+      "middleLayout": [
+        "media",
+        "clockWidget",
+        "workspaces",
+        "utilButtons",
+        "weatherBar",
+        "batteryIndicator"
+      ],
+      "rightLayout": [
+        "sysTray",
+        "updatesCount",
+        "bluetooth",
+        "systemIcons"
+      ]
+    },
+    "media": {
+      "alwaysVisible": false,
+      "maxWidth": 280,
+      "minWidth": 100,
+      "onlyTitle": false,
+      "preferredPlayer": "",
+      "showLyrics": false
+    },
+    "resources": {
+      "alwaysShowCpu": true,
+      "alwaysShowCpuTemp": true,
+      "alwaysShowDisk": false,
+      "alwaysShowRam": true,
+      "alwaysShowSwap": false,
+      "cpuWarningThreshold": 90,
+      "memoryWarningThreshold": 95,
+      "showValue": true,
+      "style": "outline",
+      "swapWarningThreshold": 85
+    },
+    "screenList": [],
+    "showBackground": true,
+    "showFrame": false,
+    "tooltips": {
+      "clickToShow": false,
+      "enable": true
+    },
+    "topLeftIcon": "spark",
+    "utilButtons": {
+      "isRecording": false,
+      "showColorPicker": false,
+      "showDarkModeToggle": false,
+      "showKeyboardToggle": true,
+      "showMicToggle": true,
+      "showPerformanceProfileToggle": true,
+      "showScreenRecord": false,
+      "showScreenSnip": false,
+      "showWallpaperToggle": false
+    },
+    "verbose": true,
+    "vertical": false,
+    "workspaces": {
+      "alwaysShowNumbers": true,
+      "indicatorStyle": "dot",
+      "monochromeIcons": true,
+      "numberMap": [],
+      "showAppIcons": true,
+      "showNumberDelay": 200,
+      "shown": 10,
+      "useNerdFont": false
+    }
+  },
+  "calendar": {
+    "locale": "en-GB"
+  },
+  "conflictKiller": {
+    "autoKillNotificationDaemons": true,
+    "autoKillTrays": true
+  },
+  "crosshair": {
+    "code": "0;P;d;1;0l;10;0o;2;1b;0"
+  },
+  "custom": {
+    "colorizeIcon": true,
+    "distroIcon": "google-gemini-symbolic"
+  },
+  "dock": {
+    "enable": true,
+    "height": 60,
+    "hoverRegionHeight": 2,
+    "hoverToReveal": true,
+    "ignoredAppRegexes": [],
+    "monochromeIcons": false,
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "zen"
+    ],
+    "pinnedOnStartup": false,
+    "showAppsButton": true,
+    "showBackground": true,
+    "showMedia": true,
+    "showPinButton": true
+  },
+  "hacks": {
+    "arbitraryRaceConditionDelay": 20
+  },
+  "hyprland": {
+    "animations": {
+      "animation": "normal",
+      "enable": true
+    },
+    "decoration": {
+      "activeOpacity": 1,
+      "blur": {
+        "enabled": false,
+        "passes": 3,
+        "size": 1
+      },
+      "inactiveOpacity": 0.95,
+      "rounding": 22,
+      "shadow": {
+        "enabled": true,
+        "range": 4
+      }
+    },
+    "general": {
+      "borderColor": {
+        "activeOpacity": 0.47,
+        "activeRole": "layer0Border",
+        "enable": false,
+        "inactiveOpacity": 0.2,
+        "inactiveRole": "layer0Border"
+      },
+      "borderSize": 1,
+      "gapsIn": 2,
+      "gapsOut": 5
+    },
+    "idle": {
+      "lock": 300,
+      "screenOff": 600,
+      "suspend": 10800
+    }
+  },
+  "interactions": {
+    "deadPixelWorkaround": {
+      "enable": false
+    },
+    "scrolling": {
+      "fasterTouchpadScroll": false,
+      "mouseScrollDeltaThreshold": 120,
+      "mouseScrollFactor": 120,
+      "touchpadScrollFactor": 450
+    }
+  },
+  "launcher": {
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "kitty",
+      "cmake-gui"
+    ]
+  },
+  "light": {
+    "antiFlashbang": {
+      "enable": false
+    },
+    "night": {
+      "automatic": false,
+      "colorTemperature": 5559,
+      "from": "19:00",
+      "to": "06:30"
+    }
+  },
+  "lock": {
+    "blur": {
+      "enable": false,
+      "extraZoom": 1.1,
+      "radius": 100,
+      "size": 20
+    },
+    "centerClock": true,
+    "launchOnStartup": false,
+    "materialShapeChars": true,
+    "security": {
+      "requirePasswordToPower": true,
+      "unlockKeyring": true
+    },
+    "showLockedText": true,
+    "showMedia": true,
+    "showToolbars": true,
+    "showWidgets": false,
+    "useHyprlock": false
+  },
+  "media": {
+    "filterDuplicatePlayers": true
+  },
+  "notifications": {
+    "position": "top_right",
+    "timeout": 7000
+  },
+  "osd": {
+    "timeout": 3000
+  },
+  "osk": {
+    "layout": "qwerty_full",
+    "pinnedOnStartup": false
+  },
+  "overlay": {
+    "clickthroughOpacity": 0.8,
+    "darkenScreen": false,
+    "floatingImage": {
+      "imageSource": "https://media.tenor.com/H5U5bJzj3oAAAAAi/kukuru.gif",
+      "scale": 0.5
+    },
+    "openingZoomAnimation": true
+  },
+  "overview": {
+    "centerIcons": true,
+    "columns": 5,
+    "enable": true,
+    "orderBottomUp": false,
+    "orderRightLeft": false,
+    "rows": 2,
+    "scale": 0.18,
+    "style": "default"
+  },
+  "panelFamily": "ii",
+  "policies": {
+    "ai": 1,
+    "weeb": 1
+  },
+  "profile": {
+    "avatarPath": "/home/alvin/Sync_Documents/",
+    "avatarPicture": "/home/alvin/Sync_Documents/Alvin logo original.png",
+    "descriptionText": "::uptime::",
+    "displayName": "",
+    "onlinePresets": true
+  },
+  "regionSelector": {
+    "annotation": {
+      "useSatty": false
+    },
+    "circle": {
+      "padding": 10,
+      "strokeWidth": 6
+    },
+    "rect": {
+      "showAimLines": true
+    },
+    "targetRegions": {
+      "content": true,
+      "contentRegionOpacity": 0.8,
+      "layers": true,
+      "opacity": 0.3,
+      "selectionPadding": 5,
+      "showLabel": false,
+      "windows": true
+    }
+  },
+  "resources": {
+    "historyLength": 60,
+    "updateInterval": 3100
+  },
+  "settings": {
+    "borderColor": "layer0Border",
+    "borderSize": 1,
+    "collapsedSections": [],
+    "style": "default"
+  },
+  "sidebar": {
+    "ai": {
+      "textFadeIn": false
+    },
+    "banner": true,
+    "bannerImage": "",
+    "booru": {
+      "allowNsfw": true,
+      "defaultProvider": "yandere",
+      "limit": 20,
+      "zerochan": {
+        "username": "theodorer61"
+      }
+    },
+    "bottomGroup": false,
+    "cornerOpen": {
+      "bottom": true,
+      "bottomLeftAction": "sidebarLeftOpen",
+      "bottomRightAction": "sidebarRightOpen",
+      "clickless": false,
+      "clicklessCornerEnd": true,
+      "clicklessCornerVerticalOffset": 1,
+      "cornerRegionHeight": 5,
+      "cornerRegionWidth": 250,
+      "enable": true,
+      "valueScroll": true,
+      "visualize": false
+    },
+    "keepRightSidebarLoaded": false,
+    "media": {
+      "artColors": false,
+      "artShape": "Oval",
+      "blurredBackground": false,
+      "enable": true,
+      "shapeArt": false,
+      "showLyrics": true
+    },
+    "mediaPlayer": false,
+    "quickSliders": {
+      "enable": true,
+      "showBrightness": true,
+      "showMic": true,
+      "showVolume": true
+    },
+    "quickToggles": {
+      "android": {
+        "columns": 6,
+        "toggles": [
+          {
+            "size": 2,
+            "type": "network"
+          },
+          {
+            "size": 2,
+            "type": "bluetooth"
+          },
+          {
+            "size": 2,
+            "type": "audio"
+          },
+          {
+            "size": 1,
+            "type": "idleInhibitor"
+          },
+          {
+            "size": 2,
+            "type": "mic"
+          },
+          {
+            "size": 1,
+            "type": "nightLight"
+          },
+          {
+            "size": 2,
+            "type": "powerProfile"
+          }
+        ]
+      },
+      "style": "android"
+    },
+    "translator": {
+      "delay": 300,
+      "enable": true
+    }
+  },
+  "tray": {
+    "filterPassive": true,
+    "invertPinnedItems": true,
+    "monochromeIcons": false,
+    "pinnedItems": [
+      "Fcitx"
+    ],
+    "showItemId": false
+  },
+  "wallpaperSelector": {
+    "changeInterval": 0,
+    "closeAfterSelection": true,
+    "columns": 4,
+    "liveWallpapersPath": "",
+    "showBlurBackground": false,
+    "showHomePath": true,
+    "showSearchbar": true,
+    "sortMode": "time",
+    "useSystemFileDialog": false,
+    "userPath": "/home/alvin/Pictures/Wallpapers/"
+  },
+  "windows": {
+    "centerTitle": true,
+    "showTitlebar": true
+  }
+}

airootfs/etc/skel/.config/illogical-impulse/presets/Personal-Performance.json

@@ -0,0 +1,676 @@
+{
+  "appearance": {
+    "extraBackgroundTint": true,
+    "fakeScreenRounding": 0,
+    "fonts": {
+      "expressive": "Space Grotesk",
+      "iconNerd": "JetBrains Mono NF",
+      "main": "Google Sans Flex",
+      "monospace": "JetBrains Mono NF",
+      "numbers": "Google Sans Flex",
+      "reading": "Readex Pro",
+      "title": "Google Sans Flex"
+    },
+    "palette": {
+      "accentColor": "",
+      "type": "scheme-tonal-spot"
+    },
+    "transparency": {
+      "automatic": true,
+      "backgroundTransparency": 0.11,
+      "contentTransparency": 0.57,
+      "enable": false
+    },
+    "wallpaperTheming": {
+      "enableAppsAndShell": true,
+      "enableQtApps": true,
+      "enableTerminal": true,
+      "terminalGenerationProps": {
+        "forceDarkMode": false,
+        "harmonizeThreshold": 100,
+        "harmony": 0.5,
+        "termFgBoost": 0.35
+      }
+    }
+  },
+  "apps": {
+    "bluetooth": "kcmshell6 kcm_bluetooth",
+    "changePassword": "kitty -1 --hold=yes fish -i -c 'passwd'",
+    "manageUser": "kcmshell6 kcm_users",
+    "network": "kcmshell6 kcm_networkmanagement",
+    "networkEthernet": "kcmshell6 kcm_networkmanagement",
+    "taskManager": "plasma-systemmonitor --page-name Processes",
+    "terminal": "kitty -1",
+    "update": "kitty -1 --hold=yes fish -i -c 'pkexec pacman -Syu'",
+    "volumeMixer": "~/.config/hypr/hyprland/scripts/launch_first_available.sh \"pavucontrol-qt\" \"pavucontrol\""
+  },
+  "background": {
+    "blurRadius": 32,
+    "centeredWallpaper": false,
+    "centeredWallpaperColor": "primaryContainer",
+    "centeredWallpaperOnlyWhenLocked": false,
+    "centeredWallpaperShape": "Cookie7Sided",
+    "centeredWallpaperSize": 400,
+    "enableWallpaperPreview": false,
+    "hideWhenFullscreen": true,
+    "lockWall": "",
+    "parallax": {
+      "autoVertical": false,
+      "enableSidebar": true,
+      "enableWorkspace": true,
+      "vertical": false,
+      "widgetsFactor": 1.2,
+      "workspaceZoom": 1.07
+    },
+    "screenList": [],
+    "showBlur": true,
+    "showGrid": true,
+    "showSnapLines": true,
+    "splitRatio": "25",
+    "splitSide": "right",
+    "thumbnailPath": "",
+    "wallpaperAnimation": "random",
+    "wallpaperPath": "/home/alvin/Pictures/Wallpapers/Dynamic-Wallpapers/Dark/japan-street-Dark.png",
+    "widgets": {
+      "blurRadius": 32,
+      "blurWidgets": false,
+      "calendar": {
+        "enable": true,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "x": 1596,
+        "y": 744,
+        "z": 4
+      },
+      "clock": {
+        "color": "",
+        "cookie": {
+          "aiStyling": false,
+          "constantlyRotate": false,
+          "dateInClock": true,
+          "dateStyle": "bubble",
+          "dialNumberStyle": "full",
+          "hourHandStyle": "hollow",
+          "hourMarks": false,
+          "minuteHandStyle": "medium",
+          "secondHandStyle": "line",
+          "sides": 12,
+          "timeIndicators": true,
+          "useSineCookie": false
+        },
+        "digital": {
+          "adaptiveAlignment": true,
+          "animateChange": true,
+          "font": {
+            "family": "Google Sans Flex",
+            "roundness": 1.1290989771359807,
+            "size": 129.49608904933814,
+            "weight": 350,
+            "width": 99.44532190132371
+          },
+          "showDate": true,
+          "vertical": false
+        },
+        "enable": true,
+        "pixel": {
+          "orientation": "vertical"
+        },
+        "placementStrategy": "leastBusy",
+        "quote": {
+          "enable": true,
+          "followClock": false,
+          "text": "Kawaī neko o zenbu tabe chaimasu."
+        },
+        "showOnlyWhenLocked": false,
+        "style": "digital",
+        "styleLocked": "cookie",
+        "x": 1423,
+        "y": 383,
+        "z": 3
+      },
+      "customImage": {
+        "enable": true,
+        "path": "",
+        "placementStrategy": "free",
+        "shape": "Cookie4Sided",
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "customText": {
+        "alignment": "center",
+        "color": "",
+        "content": "Hello world",
+        "enable": true,
+        "fontFamily": "Caveat",
+        "fontSize": 72,
+        "placementStrategy": "free",
+        "shadow": true,
+        "x": 400,
+        "y": 300,
+        "z": 0
+      },
+      "images": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "media": {
+        "backgroundShape": "Cookie4Sided",
+        "enable": true,
+        "placementStrategy": "free",
+        "showControls": true,
+        "showLyrics": false,
+        "showTitles": true,
+        "sizeMode": "1x3",
+        "x": 744,
+        "y": 876,
+        "z": 1
+      },
+      "notes": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "resources": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "shadow": true,
+      "sticker": {
+        "enable": false,
+        "items": [],
+        "outlineColor": "#ffffff",
+        "outlineWidth": 8,
+        "path": "",
+        "placementStrategy": "free",
+        "rotation": 0,
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "timers": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "todo": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "userCard": {
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "1x2",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "visualizer": {
+        "colorSource": "theme",
+        "enable": true,
+        "height": 342,
+        "placementStrategy": "free",
+        "ringSize": 380,
+        "sensitivity": 1.65,
+        "style": "mirror",
+        "x": 0,
+        "y": 0,
+        "z": -1000
+      },
+      "weather": {
+        "enable": false,
+        "expanded": false,
+        "placementStrategy": "mostBusy",
+        "sizeMode": "1x3",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "worldClock": {
+        "clockCount": 4,
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "timezones": [
+          "Australia/Sydney",
+          "Asia/Tokyo",
+          "Europe/London",
+          "America/New_York"
+        ],
+        "x": 400,
+        "y": 100,
+        "z": 0
+      }
+    },
+    "widgetsLocked": false
+  },
+  "bar": {
+    "autoHide": {
+      "enable": false,
+      "hoverRegionWidth": 2,
+      "pushWindows": false,
+      "showWhenPressingSuper": {
+        "delay": 140,
+        "enable": true
+      }
+    },
+    "borderless": "transparent",
+    "bottom": false,
+    "centerOnlyReserveFrame": false,
+    "cornerStyle": 3,
+    "divider": {
+      "spacing": 20,
+      "style": "rect"
+    },
+    "dynamicIsland": {
+      "leftWidget": "clockWidget",
+      "rightWidget": "systemIcons",
+      "showMediaControls": false,
+      "visualizerStyle": "wave"
+    },
+    "floatStyleShadow": true,
+    "followFrameColor": false,
+    "frameColor": "secondaryContainer",
+    "frameThickness": 4,
+    "groupColor": "layer1",
+    "indicators": {
+      "notifications": {
+        "showUnreadCount": true
+      }
+    },
+    "layouts": {
+      "leftLayout": [
+        "leftSidebarButton",
+        "activeWindow",
+        "resources"
+      ],
+      "middleLayout": [
+        "media",
+        "clockWidget",
+        "workspaces",
+        "utilButtons",
+        "weatherBar"
+      ],
+      "rightLayout": [
+        "sysTray",
+        "updatesCount",
+        "bluetooth",
+        "systemIcons"
+      ]
+    },
+    "media": {
+      "alwaysVisible": false,
+      "maxWidth": 280,
+      "minWidth": 100,
+      "onlyTitle": false,
+      "preferredPlayer": "",
+      "showLyrics": false
+    },
+    "resources": {
+      "alwaysShowCpu": true,
+      "alwaysShowCpuTemp": true,
+      "alwaysShowDisk": false,
+      "alwaysShowRam": true,
+      "alwaysShowSwap": false,
+      "cpuWarningThreshold": 90,
+      "memoryWarningThreshold": 95,
+      "showValue": true,
+      "style": "outline",
+      "swapWarningThreshold": 85
+    },
+    "screenList": [],
+    "showBackground": true,
+    "showFrame": false,
+    "tooltips": {
+      "clickToShow": false,
+      "enable": true
+    },
+    "topLeftIcon": "spark",
+    "utilButtons": {
+      "isRecording": false,
+      "showColorPicker": false,
+      "showDarkModeToggle": false,
+      "showKeyboardToggle": false,
+      "showMicToggle": true,
+      "showPerformanceProfileToggle": true,
+      "showScreenRecord": false,
+      "showScreenSnip": false,
+      "showWallpaperToggle": false
+    },
+    "verbose": true,
+    "vertical": false,
+    "workspaces": {
+      "alwaysShowNumbers": true,
+      "indicatorStyle": "dot",
+      "monochromeIcons": true,
+      "numberMap": [],
+      "showAppIcons": true,
+      "showNumberDelay": 200,
+      "shown": 10,
+      "useNerdFont": false
+    }
+  },
+  "calendar": {
+    "locale": "en-GB"
+  },
+  "conflictKiller": {
+    "autoKillNotificationDaemons": true,
+    "autoKillTrays": true
+  },
+  "crosshair": {
+    "code": "0;P;d;1;0l;10;0o;2;1b;0"
+  },
+  "custom": {
+    "colorizeIcon": true,
+    "distroIcon": "google-gemini-symbolic"
+  },
+  "dock": {
+    "enable": true,
+    "height": 60,
+    "hoverRegionHeight": 2,
+    "hoverToReveal": true,
+    "ignoredAppRegexes": [],
+    "monochromeIcons": false,
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "zen"
+    ],
+    "pinnedOnStartup": false,
+    "showAppsButton": true,
+    "showBackground": true,
+    "showMedia": true,
+    "showPinButton": true
+  },
+  "hacks": {
+    "arbitraryRaceConditionDelay": 20
+  },
+  "hyprland": {
+    "animations": {
+      "animation": "normal",
+      "enable": true
+    },
+    "decoration": {
+      "activeOpacity": 1,
+      "blur": {
+        "enabled": false,
+        "passes": 3,
+        "size": 1
+      },
+      "inactiveOpacity": 0.95,
+      "rounding": 22,
+      "shadow": {
+        "enabled": true,
+        "range": 4
+      }
+    },
+    "general": {
+      "borderColor": {
+        "activeOpacity": 0.47,
+        "activeRole": "layer0Border",
+        "enable": false,
+        "inactiveOpacity": 0.2,
+        "inactiveRole": "layer0Border"
+      },
+      "borderSize": 1,
+      "gapsIn": 2,
+      "gapsOut": 5
+    },
+    "idle": {
+      "lock": 300,
+      "screenOff": 600,
+      "suspend": 10800
+    }
+  },
+  "interactions": {
+    "deadPixelWorkaround": {
+      "enable": false
+    },
+    "scrolling": {
+      "fasterTouchpadScroll": false,
+      "mouseScrollDeltaThreshold": 120,
+      "mouseScrollFactor": 120,
+      "touchpadScrollFactor": 450
+    }
+  },
+  "launcher": {
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "kitty",
+      "cmake-gui"
+    ]
+  },
+  "light": {
+    "antiFlashbang": {
+      "enable": false
+    },
+    "night": {
+      "automatic": false,
+      "colorTemperature": 5559,
+      "from": "19:00",
+      "to": "06:30"
+    }
+  },
+  "lock": {
+    "blur": {
+      "enable": false,
+      "extraZoom": 1.1,
+      "radius": 100,
+      "size": 20
+    },
+    "centerClock": true,
+    "launchOnStartup": false,
+    "materialShapeChars": true,
+    "security": {
+      "requirePasswordToPower": true,
+      "unlockKeyring": true
+    },
+    "showLockedText": true,
+    "showMedia": true,
+    "showToolbars": true,
+    "showWidgets": false,
+    "useHyprlock": false
+  },
+  "media": {
+    "filterDuplicatePlayers": true
+  },
+  "notifications": {
+    "position": "top_right",
+    "timeout": 7000
+  },
+  "osd": {
+    "timeout": 3000
+  },
+  "osk": {
+    "layout": "qwerty_full",
+    "pinnedOnStartup": false
+  },
+  "overlay": {
+    "clickthroughOpacity": 0.8,
+    "darkenScreen": false,
+    "floatingImage": {
+      "imageSource": "https://media.tenor.com/H5U5bJzj3oAAAAAi/kukuru.gif",
+      "scale": 0.5
+    },
+    "openingZoomAnimation": true
+  },
+  "overview": {
+    "centerIcons": true,
+    "columns": 5,
+    "enable": true,
+    "orderBottomUp": false,
+    "orderRightLeft": false,
+    "rows": 2,
+    "scale": 0.18,
+    "style": "default"
+  },
+  "panelFamily": "ii",
+  "policies": {
+    "ai": 1,
+    "weeb": 1
+  },
+  "profile": {
+    "avatarPath": "",
+    "avatarPicture": "",
+    "descriptionText": "::uptime::",
+    "displayName": "",
+    "onlinePresets": false
+  },
+  "regionSelector": {
+    "annotation": {
+      "useSatty": false
+    },
+    "circle": {
+      "padding": 10,
+      "strokeWidth": 6
+    },
+    "rect": {
+      "showAimLines": true
+    },
+    "targetRegions": {
+      "content": true,
+      "contentRegionOpacity": 0.8,
+      "layers": true,
+      "opacity": 0.3,
+      "selectionPadding": 5,
+      "showLabel": false,
+      "windows": true
+    }
+  },
+  "resources": {
+    "historyLength": 60,
+    "updateInterval": 3100
+  },
+  "settings": {
+    "borderColor": "layer0Border",
+    "borderSize": 1,
+    "collapsedSections": [],
+    "style": "default"
+  },
+  "sidebar": {
+    "ai": {
+      "textFadeIn": false
+    },
+    "banner": true,
+    "bannerImage": "",
+    "booru": {
+      "allowNsfw": true,
+      "defaultProvider": "yandere",
+      "limit": 20,
+      "zerochan": {
+        "username": "theodorer61"
+      }
+    },
+    "bottomGroup": false,
+    "cornerOpen": {
+      "bottom": true,
+      "bottomLeftAction": "sidebarLeftOpen",
+      "bottomRightAction": "sidebarRightOpen",
+      "clickless": false,
+      "clicklessCornerEnd": true,
+      "clicklessCornerVerticalOffset": 1,
+      "cornerRegionHeight": 5,
+      "cornerRegionWidth": 250,
+      "enable": true,
+      "valueScroll": true,
+      "visualize": false
+    },
+    "keepRightSidebarLoaded": false,
+    "media": {
+      "artColors": false,
+      "artShape": "Oval",
+      "blurredBackground": false,
+      "enable": true,
+      "shapeArt": false,
+      "showLyrics": true
+    },
+    "mediaPlayer": false,
+    "quickSliders": {
+      "enable": true,
+      "showBrightness": true,
+      "showMic": true,
+      "showVolume": true
+    },
+    "quickToggles": {
+      "android": {
+        "columns": 6,
+        "toggles": [
+          {
+            "size": 2,
+            "type": "network"
+          },
+          {
+            "size": 2,
+            "type": "bluetooth"
+          },
+          {
+            "size": 2,
+            "type": "audio"
+          },
+          {
+            "size": 1,
+            "type": "idleInhibitor"
+          },
+          {
+            "size": 2,
+            "type": "mic"
+          },
+          {
+            "size": 1,
+            "type": "nightLight"
+          },
+          {
+            "size": 2,
+            "type": "powerProfile"
+          }
+        ]
+      },
+      "style": "android"
+    },
+    "translator": {
+      "delay": 300,
+      "enable": true
+    }
+  },
+  "tray": {
+    "filterPassive": true,
+    "invertPinnedItems": true,
+    "monochromeIcons": false,
+    "pinnedItems": [
+      "Fcitx"
+    ],
+    "showItemId": false
+  },
+  "wallpaperSelector": {
+    "changeInterval": 0,
+    "closeAfterSelection": true,
+    "columns": 4,
+    "liveWallpapersPath": "",
+    "showBlurBackground": false,
+    "showHomePath": true,
+    "showSearchbar": true,
+    "sortMode": "time",
+    "useSystemFileDialog": false,
+    "userPath": "/home/alvin/Pictures/Wallpapers/"
+  },
+  "windows": {
+    "centerTitle": true,
+    "showTitlebar": true
+  }
+}

airootfs/etc/systemd/system/multi-user.target.wants/NetworkManager.service

@@ -1,30 +0,0 @@
-[Unit]
-Description=Network Manager
-Documentation=man:NetworkManager.conf(5)
-Wants=NetworkManager-wait-online.service
-After=sysinit.target network-pre.target
-Wants=network-pre.target
-Before=network-online.target remote-fs.target
-After=network-pre.target
-BindsTo=sys-subsystem-net-devices.target
-After=sys-subsystem-net-devices.target
-
-[Service]
-Type=dbus
-BusName=org.freedesktop.NetworkManager
-ExecCondition=/usr/bin/test -x /usr/bin/NetworkManager
-ExecReload=/usr/bin/kill -HUP $MAINPID
-ExecStart=/usr/bin/NetworkManager --no-daemon
-Restart=on-failure
-KillMode=process
-CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE
-LockPersonality=yes
-MemoryDenyWriteExecute=yes
-ProtectHome=yes
-ProtectSystem=yes
-RestrictNamespaces=yes
-RestrictRealtime=yes
-SystemCallFilter=@system-service
-
-[Install]
-WantedBy=multi-user.target

airootfs/etc/systemd/system/multi-user.target.wants/NetworkManager.service

@@ -0,0 +1 @@
+/usr/lib/systemd/system/NetworkManager.service

airootfs/root/.live-pacman.conf

@@ -49,3 +49,12 @@ Include = /etc/pacman.d/cachyos-mirrorlist
 [chaotic-aur]
 SigLevel = Required DatabaseOptional
 Include = /etc/pacman.d/chaotic-mirrorlist
+
+[local-aur]
+# Ships on the medium only: packages built at ISO build time (end-4
+# dependencies, plus localrepo/). Keeps pacstrap from needing the network for
+# anything that is not in the official repos. alvin-install strips this whole
+# section from the target system's pacman.conf, because /opt/localrepo exists
+# only on the live medium.
+SigLevel = Optional TrustAll
+Server = file:///opt/localrepo

airootfs/root/customize_airootfs.sh

@@ -1,6 +1,19 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# The chroot's /dev is the kernel's single shared devtmpfs, which only gets the
+# fd/stdin/stdout/stderr symlinks at boot (from mkinitcpio's init). If the
+# runner environment lacks them, process substitution (< <(...)) and upstream
+# tools (pacman-key) fail with "… /dev/fd/63: No such file or directory".
+# Self-heal here; the CI build-iso workflow does the same before pacstrap so
+# that mkinitcpio's hook (which pipes through /dev/stdin) works too.
+for _link in "fd:/proc/self/fd" "stdin:/proc/self/fd/0" \
+  "stdout:/proc/self/fd/1" "stderr:/proc/self/fd/2"; do
+  [[ -e "/dev/${_link%%:*}" || -L "/dev/${_link%%:*}" ]] ||
+    ln -sfn "${_link#*:}" "/dev/${_link%%:*}"
+done
+unset _link
+
 # Populate the keyring in the built root from the keyring bundles
 # (/usr/share/pacman/keyrings, incl. the copied cachyos keyring).
 # This mirrors the guide; it runs inside the image you are making.
@@ -14,6 +27,13 @@ pacman-key --populate archlinux cachyos chaotic
 install -m 0644 /root/.live-pacman.conf /etc/pacman.conf
 rm -f /root/.live-pacman.conf
 
+# Build stamp staged by profiledef.sh (absent for non-git, non-CI builds):
+# keep it where alvin-install looks for it, drop the staging copy.
+if [[ -f /root/.iso-build-stamp ]]; then
+  install -m 0644 /root/.iso-build-stamp /etc/alvin-build-stamp
+  rm -f /root/.iso-build-stamp
+fi
+
 # ============================================================================
 # Pre-install dotfile dependencies into /etc/skel so new users get them
 # instantly on first login (no network required).
@@ -57,6 +77,263 @@ if [[ ! -d "${NVIM_DATA}/lazy/lazy.nvim" ]]; then
     https://github.com/folke/lazy.nvim.git "${NVIM_DATA}/lazy/lazy.nvim"
 fi
 
+# ── end-4 dots-hyprland, staged for alvin-install (avoids a clone at install) ─
+DOTS_REPO="/opt/dots-hyprland"
+if [[ ! -d "${DOTS_REPO}/.git" ]]; then
+  echo "[customize] Cloning end-4 dots-hyprland..."
+  git clone --depth=1 https://github.com/end-4/dots-hyprland.git "${DOTS_REPO}"
+  git -C "${DOTS_REPO}" submodule update --init --depth=1
+fi
+
+# ── end4-pC: the default quickshell config, shipped in skel ──────────────────
+# pctrade/end4-pC is a fork of the ii shell config. It lives next to ii in
+# ~/.config/quickshell and does not modify it; which one runs is decided by
+# qsConfig (patched just below). The repo has no submodules.
+if [[ ! -d "${SKEL}/.config/quickshell/end4-pC" ]]; then
+  echo "[customize] Cloning end4-pC quickshell config into skel..."
+  git clone --depth=1 https://github.com/pctrade/end4-pC.git \
+    "${SKEL}/.config/quickshell/end4-pC"
+fi
+
+# ── Default quickshell config: ii -> end4-pC ─────────────────────────────────
+# alvin-install copies this staged repo onto the target and runs `./setup
+# install`, whose rsync writes hypr/hyprland/variables.lua into the user's
+# home - so patching the staged copy is what sets qsConfig on the installed
+# system. Re-running is a no-op; anything other than ii/end4-pC aborts.
+VARIABLES_LUA="${DOTS_REPO}/dots/.config/hypr/hyprland/variables.lua"
+if grep -Fq 'hl.env("qsConfig", "ii")' "${VARIABLES_LUA}"; then
+  echo "[customize] Setting qsConfig to end4-pC..."
+  sed -i 's|hl\.env("qsConfig", "ii")|hl.env("qsConfig", "end4-pC")|' "${VARIABLES_LUA}"
+fi
+if ! grep -Fq 'hl.env("qsConfig", "end4-pC")' "${VARIABLES_LUA}"; then
+  echo "[customize] qsConfig is neither ii nor end4-pC in ${VARIABLES_LUA}" >&2
+  exit 1
+fi
+
+# ============================================================================
+# Pre-install end-4 dependencies into the image (network heavy, once per ISO)
+# ============================================================================
+# ./setup install-deps resolves and *builds* every AUR/source dependency the
+# dotfiles need (quickshell, MicroTeX, theming, fonts, ...). Doing it here lets
+# alvin-install run its end-4 step with --skip-alldeps, so an install only
+# copies files - no AUR clones, no makepkg, no dependency resolution.
+#
+# The script refuses to run as root, hence the throwaway builder account.
+# ============================================================================
+BUILD_USER="ii-builder"
+
+if ! id -u "${BUILD_USER}" &>/dev/null; then
+  useradd -m -u 1500 "${BUILD_USER}"
+fi
+echo "${BUILD_USER} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/99-ii-builder
+chmod 440 /etc/sudoers.d/99-ii-builder
+
+# makepkg writes src/, pkg/ and *.pkg.tar.zst into the PKGBUILD directories,
+# so the tree must be owned by the account that runs it.
+chown -R "${BUILD_USER}:${BUILD_USER}" "${DOTS_REPO}"
+
+# -f: never prompt (ask=false); -s: skip "pacman -Syu";
+# --skip-plasmaintg: optional Firefox widget that pulls 410 pkgs / 526 MiB of
+#                    KDE packages onto a non-KDE system;
+# stdin: answer end-4's x() failure prompt with "e", so a failed command
+#        aborts the build instead of blocking forever without a TTY.
+# shellcheck disable=SC2024  # the redirect is meant for the child, not sudo
+if ! sudo -u "${BUILD_USER}" env HOME="/home/${BUILD_USER}" \
+    GIT_TERMINAL_PROMPT=0 \
+    bash -c "cd ${DOTS_REPO} && ./setup install-deps -f -s --skip-plasmaintg" \
+    < <(yes e); then
+  echo "[customize] end-4 ./setup install-deps failed" >&2
+  exit 1
+fi
+
+# ── Harvest the packages install-deps just built into the in-image local repo ─
+# The live /etc/pacman.conf points [local-aur] at /opt/localrepo; without the
+# harvested copies pacstrap cannot resolve these packages at install time and
+# would silently drop them from the target system.
+mkdir -p /opt/localrepo
+shopt -s nullglob
+
+# <name> <version> from a package's embedded .PKGINFO (update.sh does the same)
+pkg_meta() {
+  tar -xOf "$1" .PKGINFO 2>/dev/null |
+    awk -F' = ' '/^pkgname = /{n=$2} /^pkgver = /{v=$2} END{print n, v}'
+}
+
+mapfile -d '' -t built_pkgs < <(
+  find "${DOTS_REPO}" "/home/${BUILD_USER}/.cache/yay" \
+    -name '*.pkg.tar.zst' -print0 2>/dev/null
+)
+
+declare -A built_file=() built_ver=()
+for p in "${built_pkgs[@]}"; do
+  read -r n v < <(pkg_meta "$p")
+  [[ -n "${n:-}" && -n "${v:-}" ]] || continue
+  built_file["$n"]="$p"
+  built_ver["$n"]="$v"
+done
+
+# One entry per package name, and the entry must be the version the image
+# actually installed - a stale copy with the same name but another version
+# would let pacstrap install something else than what was tested.
+for existing in /opt/localrepo/*.pkg.tar.zst; do
+  [[ -e "$existing" ]] || continue
+  read -r n v < <(pkg_meta "$existing")
+  [[ -n "${n:-}" ]] || continue
+  if [[ -n "${built_ver[$n]:-}" ]]; then
+    echo "[customize] Replacing localrepo ${n} ${v} with built ${built_ver[$n]}"
+    rm -f "$existing"
+  fi
+done
+
+if ((${#built_file[@]} > 0)); then
+  echo "[customize] Harvesting ${#built_file[@]} package(s) into /opt/localrepo"
+  cp -f -- "${built_file[@]}" /opt/localrepo/
+  # makepkg -Afsi leaves its archives next to the PKGBUILD. They are already
+  # harvested (and installed in this image); keeping them in the dots tree
+  # would ship a second copy inside /opt/dots-hyprland, which alvin-install
+  # copies to ~/.dots-hyprland on every installed system.
+  find "${DOTS_REPO}" -type f -name '*.pkg.tar.zst' -delete
+fi
+
+# Rebuild the repo database (CI/update.sh ship a pre-built one alongside the
+# packages) and refresh the live system's copy of it. No network needed: the
+# remote repos were synced during pacstrap.
+local_pkgs=(/opt/localrepo/*.pkg.tar.zst)
+if ((${#local_pkgs[@]} > 0)); then
+  echo "[customize] Rebuilding local-aur db (${#local_pkgs[@]} packages)..."
+  repo-add -R /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}"
+  mkdir -p /var/lib/pacman/sync
+  cp -fL /opt/localrepo/local-aur.db /var/lib/pacman/sync/local-aur.db
+  if [[ -f /opt/localrepo/local-aur.files ]]; then
+    cp -fL /opt/localrepo/local-aur.files /var/lib/pacman/sync/local-aur.files
+  fi
+fi
+
+# ── makepkg leftovers + throwaway account do not belong in the ISO ──────────
+if [[ -d "${DOTS_REPO}/sdata/dist-arch" ]]; then
+  find "${DOTS_REPO}/sdata/dist-arch" -mindepth 2 -maxdepth 2 -type d \
+    \( -name src -o -name pkg \) -prune -exec rm -rf {} +
+fi
+rm -f /etc/sudoers.d/99-ii-builder
+
+# Processes still running as BUILD_USER make userdel exit 8 and abort the
+# build. end-4's ./setup is the usual source: sudo_init_keepalive forks
+# `(sleep 60; sudo true) &` and its EXIT trap kills only the subshell,
+# orphaning the sleep child for up to a minute. Mirrors shadow's
+# user_busy_processes(): match real/effective/saved uid AND require the
+# process to live inside this build chroot - the runner shares our PID
+# namespace, and a host process could carry the same uid.
+#
+# mkarchiso runs this script via arch-chroot, which mounts proc *before*
+# `unshare --fork --pid`: /proc entry numbers belong to the outer pid
+# namespace, while kill(2) resolves pids in our (nested) namespace. Use the
+# last NSpid field - the pid in our own namespace - for signalling; keep the
+# /proc entry number for logging, since that is what userdel reports.
+nspid_fields() {
+  awk -F'\t' '/^NSpid:/{ $1=""; sub(/^ +/, ""); print; exit }' "$1"
+}
+
+builder_procs() {
+  local uid broot st p key real eff saved kpid cmd
+  local -a nsf self_nsf=()
+  uid=$(id -u "${BUILD_USER}") || return 0
+  broot=$(stat -Lc '%d:%i' /)
+  read -r -a self_nsf < <(nspid_fields /proc/self/status)
+  for st in /proc/[0-9]*/status; do
+    [[ -r "$st" ]] || continue
+    real=""; eff=""; saved=""
+    while read -r key real eff saved _; do
+      [[ $key == "Uid:" ]] && break
+    done < "$st" || continue
+    [[ $real == "$uid" || $eff == "$uid" || $saved == "$uid" ]] || continue
+    p=${st#/proc/}; p=${p%/status}
+    # Stat of /proc/<pid>/root needs CAP_SYS_PTRACE (or same-uid): exactly
+    # what shadow's userdel uses, so a process we cannot see here is one
+    # userdel cannot flag either. Compare by device+inode; skip on failure.
+    [[ $(stat -Lc '%d:%i' "/proc/$p/root" 2>/dev/null) == "$broot" ]] || continue
+    # NSpid chain length must equal ours, i.e. the process must live in our
+    # pid namespace - only then is its last field killable from here.
+    nsf=()
+    read -r -a nsf < <(nspid_fields "/proc/$p/status") || continue
+    if ((${#nsf[@]} > 0 && ${#nsf[@]} == ${#self_nsf[@]})); then
+      kpid=${nsf[${#nsf[@]} - 1]}
+    else
+      kpid="-"
+    fi
+    cmd=$(tr '\0' ' ' < "/proc/$p/cmdline" 2>/dev/null)
+    printf '%s\t%s\t%s\n' "$p" "$kpid" "$cmd"
+  done
+  return 0
+}
+
+sweep_builder_procs() {
+  local sig=$1 p kpid cmd kerr
+  local -a pids=()
+  while IFS=$'\t' read -r p kpid cmd; do
+    [[ -n $p ]] || continue
+    if [[ -z $kpid || $kpid == "-" ]]; then
+      echo "[customize] ${BUILD_USER} process outside our pid namespace (cannot signal): pid $p: $cmd"
+      continue
+    fi
+    echo "[customize] ${BUILD_USER} process ($sig): pid $p: $cmd"
+    pids+=("$kpid")
+  done < <(builder_procs)
+  if ((${#pids[@]} > 0)); then
+    # Surface signal failures (they used to be swallowed, hiding a
+    # pid-namespace mismatch as a silent no-op sweep).
+    if ! kerr=$(kill -"$sig" "${pids[@]}" 2>&1); then
+      [[ -n $kerr ]] && printf '[customize] kill -%s: %s\n' "$sig" "$kerr"
+    fi
+  fi
+  return 0
+}
+
+sweep_builder_procs TERM
+sleep 2
+sweep_builder_procs KILL
+sleep 1
+
+if ! userdel -r "${BUILD_USER}"; then
+  rm -rf "/home/${BUILD_USER:?}"
+  if ! userdel "${BUILD_USER}"; then
+    echo "[customize] FATAL: cannot remove user ${BUILD_USER}; leftover processes:" >&2
+    builder_procs >&2 || true
+    exit 1
+  fi
+fi
+chown -R root:root "${DOTS_REPO}"
+
+# ── Google Sans Flex into skel: install_google_sans_flex() early-returns once
+#    fc-list sees the font, so the install step needs no network ──────────────
+FONT_DIR="${SKEL}/.local/share/fonts/illogical-impulse-google-sans-flex"
+if [[ ! -f "${FONT_DIR}/.git/HEAD" ]]; then
+  echo "[customize] Pre-installing Google Sans Flex into skel..."
+  rm -rf "${FONT_DIR}"
+  git clone --depth=1 --recurse-submodules --shallow-submodules \
+    https://github.com/end-4/google-sans-flex "${FONT_DIR}"
+fi
+
+# ── uv into skel: CPython 3.12 + the end-4 requirements wheel cache ──────────
+# install-python-packages() runs `uv venv -p 3.12` and `uv pip install -r ...`
+# during setup. Arch has no python312 package (uv would download one) and the
+# pinned requirements are ~250 MiB of wheels, so warm both into skel: the venv
+# is then created and filled straight from the image.
+if command -v uv &>/dev/null; then
+  echo "[customize] Pre-warming uv (CPython 3.12 + requirements cache)..."
+  warm_venv="/tmp/uv-warm-venv"
+  rm -rf "${warm_venv}"
+  UV_CACHE_DIR="${SKEL}/.cache/uv" \
+    UV_PYTHON_INSTALL_DIR="${SKEL}/.local/share/uv/python" \
+    uv venv -p 3.12 "${warm_venv}"
+  UV_CACHE_DIR="${SKEL}/.cache/uv" \
+    UV_PYTHON_INSTALL_DIR="${SKEL}/.local/share/uv/python" \
+    uv pip install --python "${warm_venv}/bin/python" \
+    -r "${DOTS_REPO}/sdata/uv/requirements.txt"
+  rm -rf "${warm_venv}"
+else
+  echo "[customize] uv not found - skipping python/wheel pre-warm."
+fi
+
 # ── Fish: ensure default shell is set for the live user ──────────────────────
 # The live user (usually 'archlinux' or 'root') gets fish as default shell
 if command -v fish &>/dev/null; then

efiboot/loader/entries/01-archiso-linux.conf

@@ -1,5 +1,5 @@
 title    Arch Linux install medium (%ARCH%, UEFI)
 sort-key 01
-linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%

efiboot/loader/entries/02-archiso-speech-linux.conf

@@ -1,5 +1,5 @@
 title    Arch Linux install medium (%ARCH%, UEFI) with speech
 sort-key 02
-linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on

grub/grub.cfg

@@ -46,14 +46,14 @@ timeout_style=menu
 
 menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }
 
 menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }
 
 

grub/loopback.cfg

@@ -23,14 +23,14 @@ timeout_style=menu
 
 menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}"
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}"
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }
 
 menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
     set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }
 
 

localrepo/build-end4-deps.sh

@@ -87,34 +87,36 @@ done
 info "═══ Step 2: Building AUR dependencies ═══"
 
 # ── Theming & appearance ─────────────────────────────────────────────────────
+# Entries in these lists must start at column 0: CI's package check accepts
+# repo-less packages via `grep -qxF <pkg>` against this file (exact whole-line
+# match), which silently never matched while the names were indented.
 AUR_THEMING=(
-  adw-gtk-theme-git
-  darkly-bin
-  ttf-material-symbols-variable-git
-  ttf-readex-pro
-  ttf-rubik-vf
-  ttf-twemoji
-  otf-space-grotesk
-  kde-material-you-colors-git
+adw-gtk-theme-git
+darkly-bin
+ttf-material-symbols-variable-git
+ttf-readex-pro
+ttf-rubik-vf
+ttf-twemoji
+otf-space-grotesk
+kde-material-you-colors-git
 )
 
 # ── end-4 specific / build-from-source packages ──────────────────────────────
 # matugen — material you color generation tool
 # speech-dispatcher — may need AUR build on some setups
 AUR_TOOLS=(
-  matugen
-  python-rpypostprocess
-  tts
+matugen
+python-rpypostprocess
+tts
 )
 
 # ── Packages not in any standard repo ────────────────────────────────────────
 AUR_MISSING=(
-  asciinema-agg
-  davs2
-  syncthingtray-qt6
-  varia
-  woeusb-ng
-  ttf-ms-fonts
+asciinema-agg
+davs2
+varia
+woeusb-ng
+ttf-ms-fonts
 )
 
 # ── Large / complex builds (skipped with --quick) ────────────────────────────

localrepo/update.sh

@@ -22,11 +22,26 @@ mapfile -t pkgs < <(find "${repo_dir}" -maxdepth 1 -name '*.pkg.tar.zst' -print
 
 if [[ ${#pkgs[@]} -eq 0 ]]; then
     echo "No .pkg.tar.zst files in ${repo_dir}" >&2
+    # keep the medium's copy honest too - an emptied localrepo/ must not
+    # leave the previous packages shipping on the next build
+    rm -rf "${profile_dir}/airootfs/opt/localrepo"
     exit 0
 fi
 
 repo-add -R "${repo_dir}/${repo_name}.db.tar.gz" "${pkgs[@]}"
 
+# Sync the medium's copy: the ISO ships its own [local-aur] at
+# airootfs/opt/localrepo (pacman.conf on the live system points there, and
+# pacstrap resolves these packages from it at install time).
+img_repo="${profile_dir}/airootfs/opt/localrepo"
+mkdir -p "${img_repo}"
+rm -f "${img_repo}"/*.pkg.tar.zst "${img_repo}/${repo_name}".db \
+    "${img_repo}/${repo_name}".db.tar.gz "${img_repo}/${repo_name}".files \
+    "${img_repo}/${repo_name}".files.tar.gz
+cp -f "${pkgs[@]}" "${img_repo}/"
+cp -fL "${repo_dir}/${repo_name}".db* "${repo_dir}/${repo_name}".files* "${img_repo}/"
+echo "Medium copy ready: ${img_repo}"
+
 new_names=()
 for p in "${pkgs[@]}"; do
     name=$(tar -xOf "${p}" .PKGINFO | sed -n 's/^pkgname = //p' | head -1)

packages.x86_64

@@ -46,6 +46,7 @@ cpio
 cronie
 cryptsetup
 cups
+curl
 darkhttpd
 davs2
 dconf-editor
@@ -176,7 +177,6 @@ libfprint
 libisoburn
 libtorrent
 libusb-compat
-linux
 linux-atm
 linux-cachyos
 linux-cachyos-headers
@@ -322,7 +322,7 @@ starship
 sudo
 swaync
 syncthing
-syncthingtray-qt6
+syncthingtray
 syntax-highlighting
 syslinux
 systemd-resolvconf

pacman.conf

@@ -103,7 +103,7 @@ Include = /etc/pacman.d/chaotic-mirrorlist
 
 [local-aur]
 SigLevel = Optional TrustAll
-Server = file:///home/alvin/alvinarch/localrepo
+Server = file:///home/alvin/AlvinArch/localrepo
 
 # An example of a custom package repository.  See the pacman manpage for
 # tips on creating your own repositories.

profiledef.sh

@@ -20,6 +20,36 @@ file_permissions=(
   ["/root/.automated_script.sh"]="0:0:755"
   ["/root/.gnupg"]="0:0:700"
   ["/usr/local/bin/choose-mirror"]="0:0:755"
+  ["/usr/local/bin/alvin-install"]="0:0:755"
   ["/usr/local/bin/Installation_guide"]="0:0:755"
   ["/usr/local/bin/livecd-sound"]="0:0:755"
 )
+
+# ── Build stamp (staged file, never committed) ────────────────────────────────
+# airootfs/root/.iso-build-stamp lands at /root/.iso-build-stamp on the ISO;
+# customize_airootfs.sh installs it as /etc/alvin-build-stamp, and alvin-install
+# appends it to the installed system's /etc/motd. Only stamp builds from a git
+# checkout or CI — a random source-tarball build would record a bogus commit.
+# Sourced by mkarchiso under `set -eu`, hence every expansion is defaulted.
+_stamp_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_stamp_file="${_stamp_dir}/airootfs/root/.iso-build-stamp"
+rm -f "${_stamp_file}"
+if [[ -e "${_stamp_dir}/.git" || -n "${CI:-}" || -n "${GITEA_ACTIONS:-}" ]]; then
+    _stamp_build="$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)"
+    # git ≥2.46 honours -c safe.directory even when mkarchiso runs as root
+    # over a user-owned checkout; older gits ignore it (protected-config
+    # scope) and fall through to the "unknown" line below instead of failing
+    # the build (`|| true` keeps set -e happy either way).
+    _stamp_commit="$(git -C "${_stamp_dir}" -c safe.directory="${_stamp_dir}" \
+        log -1 --format='%cs|%h' 2>/dev/null || true)"
+    if [[ -n "${_stamp_commit}" && "${_stamp_commit}" == *"|"* ]]; then
+        _stamp_hash="${_stamp_commit##*|}"
+        printf 'AlvinArch build %s | commit %s | %s\n' \
+            "${_stamp_build}" "${_stamp_commit%%|*}" "${_stamp_hash:0:4}" \
+            > "${_stamp_file}"
+    else
+        printf 'AlvinArch build %s | commit unknown\n' \
+            "${_stamp_build}" > "${_stamp_file}"
+    fi
+fi
+unset _stamp_dir _stamp_file _stamp_build _stamp_commit _stamp_hash

syslinux/archiso_pxe-linux.cfg

@@ -4,8 +4,8 @@ Boot the Arch Linux install medium using NBD.
 It allows you to install Arch Linux or perform system maintenance.
 ENDTEXT
 MENU LABEL Arch Linux install medium (%ARCH%, NBD)
-LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% archiso_nbd_srv=${pxeserver} cms_verify=y
 SYSAPPEND 3
 
@@ -15,8 +15,8 @@ Boot the Arch Linux live medium using NFS.
 It allows you to install Arch Linux or perform system maintenance.
 ENDTEXT
 MENU LABEL Arch Linux install medium (%ARCH%, NFS)
-LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 APPEND archisobasedir=%INSTALL_DIR% archiso_nfs_srv=${pxeserver}:/run/archiso/bootmnt cms_verify=y
 SYSAPPEND 3
 
@@ -26,7 +26,7 @@ Boot the Arch Linux live medium using HTTP.
 It allows you to install Arch Linux or perform system maintenance.
 ENDTEXT
 MENU LABEL Arch Linux install medium (%ARCH%, HTTP)
-LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+LINUX ::/%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+INITRD ::/%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 APPEND archisobasedir=%INSTALL_DIR% archiso_http_srv=http://${pxeserver}/ cms_verify=y
 SYSAPPEND 3

syslinux/archiso_sys-linux.cfg

@@ -4,8 +4,8 @@ Boot the Arch Linux install medium on BIOS.
 It allows you to install Arch Linux or perform system maintenance.
 ENDTEXT
 MENU LABEL Arch Linux install medium (%ARCH%, BIOS)
-LINUX /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-INITRD /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+LINUX /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+INITRD /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
 
 # Accessibility boot option
@@ -15,6 +15,6 @@ Boot the Arch Linux install medium on BIOS with speakup screen reader.
 It allows you to install Arch Linux or perform system maintenance with speech feedback.
 ENDTEXT
 MENU LABEL Arch Linux install medium (%ARCH%, BIOS) with ^speech
-LINUX /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-INITRD /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+LINUX /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+INITRD /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 APPEND archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on