diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..4712c33
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,42 @@
+# Matches what the repo already does, and what ./test.sh enforces for shell
+# (shfmt -i 4, default case indentation).
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+
+[*.{sh,bash}]
+indent_size = 4
+
+# chezmoi source names carry attribute prefixes rather than extensions, so the
+# shell scripts installed to ~/.local/bin match on the prefix instead.
+[executable_*]
+indent_size = 4
+
+[*.{ps1,psm1}]
+indent_size = 4
+
+[*.{json,jsonc,toml,yaml,yml,md}]
+indent_size = 2
+
+[*.fish]
+indent_size = 4
+
+[*.lua]
+indent_size = 2
+
+[*.qml]
+indent_size = 2
+
+# Go templates wrap whatever they render; leave their indentation alone.
+[*.tmpl]
+trim_trailing_whitespace = false
+
+# Vendored upstream, kept byte-identical for easy diffing against new releases.
+[root/private_dot_config/fish/functions/fundle.fish]
+trim_trailing_whitespace = false
+insert_final_newline = false
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
index a5713c5..7cafab0 100644
--- a/.vscode/extensions.json
+++ b/.vscode/extensions.json
@@ -4,6 +4,7 @@
     "timonwong.shellcheck",
     "foxundermoon.shell-format",
     "mads-hartmann.bash-ide-vscode",
-    "bmalehorn.vscode-fish"
+    "bmalehorn.vscode-fish",
+    "theqtcompany.qt-qml"
   ]
 }
\ No newline at end of file
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 2feb09e..a37ae47 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -23,5 +23,7 @@
     "editor.codeActionsOnSave": {
       "source.fixAll.markdownlint": "explicit"
     }
-  }
+  },
+  "qt-core.showWelcomePageOnActivation": false,
+  "qt-qml.qmlls.enabled": false
 }
diff --git a/AGENTS.md b/AGENTS.md
index eeac50b..6701f76 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -19,9 +19,11 @@ This is a personal dotfiles repository managed with [chezmoi](https://www.chezmo
 
 Shell-agnostic commands applied by chezmoi to `~/.local/bin` (source: `root/dot_local/bin/`), so one bash implementation serves fish, bash, and zsh. Not applied on Windows (ignored via `.chezmoiignore.tmpl`):
 
-- `update` - Updates everything: system packages (apt or pacman on Linux, brew on macOS), mise itself, chezmoi, then `chezmoi update` (pull latest dotfiles + apply), then `mise upgrade` for the freshly pulled tool pins. The mise step is skipped over when mise is package-managed — the system-package step above already covered it
-- `clean` - Prunes what `update` leaves behind: orphaned system packages and caches (`apt-get autoremove --purge`/`clean`, `pacman -Rns` of `-Qtdq` orphans + `-Sc`, `brew autoremove`/`cleanup --prune=all`), mise tool versions no longer referenced by any config (`mise prune`), and mise's download cache
-- `set-work-email <addr>` - Writes `~/work.email` and re-runs `chezmoi init --apply` so the work identity takes effect (Windows gets a PowerShell function equivalent in the profile)
+- `update` - Updates everything: system packages (apt or pacman on Linux, brew on macOS), mise itself, chezmoi, then `chezmoi update` (pull latest dotfiles + apply), then `mise upgrade` for the freshly pulled tool pins. On Omarchy the system-package step is `omarchy update -y` and it runs **last** instead of first: that command ends in a `gum confirm` reboot prompt which `-y` does not suppress (it exports `OMARCHY_UPDATE_UNATTENDED`, which nothing reads), so going first meant a kernel upgrade could reboot the machine before the dotfiles were ever pulled. The mise step is skipped over when mise is package-managed — the system-package step above already covered it. `chezmoi upgrade` is likewise skipped when the binary is not writable by the user, which is the real precondition for an in-place self-upgrade and covers every packager (Omarchy/Arch `extra/`, Homebrew) at once
+- `clean` - Prunes what `update` leaves behind: orphaned system packages and caches (`apt-get autoremove --purge`/`clean`, `pacman -Rns` of `-Qtdq` orphans + `-Sc`, `brew autoremove`/`cleanup --prune=all`), mise tool versions no longer referenced by any config (`mise prune`), and mise's download cache. On Omarchy both package steps differ and the difference is destructive if ignored — see the Omarchy notes below
+- `set-work-email <addr>` - Writes `~/work.email` and re-runs `chezmoi init --apply` so the work identity takes effect
+
+Windows gets all three as PowerShell functions in `pwsh/rc.d/60-commands.ps1`, because `.chezmoiignore` drops `.local/bin` there (those are bash scripts). Without them a Windows machine has no way to update itself.
 
 ## Architecture
 
@@ -42,6 +44,33 @@ The dotfiles adapt based on environment variables:
 - `DOTFILES_WORK_EMAIL` - Work email fallback when `~/work.email` is absent (the file wins; Codespaces user secrets surface as env vars)
 - `DOTFILES_WORK_EMAIL_FILE` - Relocates the work-email file from `~/work.email` (used by render.sh; unset in normal use)
 
+Two data flags are derived from the machine itself rather than from env vars:
+
+- **`isOmarchy`** - true when `/etc/os-release` has `ID=omarchy`. [Omarchy](https://omarchy.org) is an opinionated Arch/Hyprland distribution that owns a large part of `$HOME`. Because the check is on the distro ID, it is false by construction in WSL (`ID=arch`/`ubuntu`), dev containers, macOS and Windows, so no Omarchy-only file can leak onto another host. Preview an Omarchy render from anywhere with `./render.sh --data '{"isOmarchy":true}' <template>`
+- **`isThinkPad`** - true when `/sys/class/dmi/id/product_family` starts with `ThinkPad`. Gates the hardware-specific pieces (keyboard-backlight daemon, touchpad modprobe drop-in) so a future Omarchy desktop does not get a laptop keyboard-LED service
+
+### Working with Omarchy
+
+Omarchy provisions `$HOME` on first run and keeps it current through migrations, so the governing rule is: **only manage a file that differs from its `$OMARCHY_PATH/config` default.** A file that matches the default is left to Omarchy, which keeps its own tooling (`omarchy font set`, `omarchy refresh`, the theme system) working with zero drift — and, as the hypr note below explains, keeps Omarchy's migrations from fighting the next apply.
+
+Every Omarchy-only path is listed in one block in `.chezmoiignore.tmpl` so the rule stays auditable, and every Omarchy-only script in `.chezmoiscripts/` opens with `{{ if .isOmarchy -}}` so it renders empty elsewhere (the same pattern as the existing Windows guards).
+
+Things worth knowing before changing anything here:
+
+- **Only manage a hypr file that you have actually customized.** This one is not tidiness, it is how Omarchy's migrations decide what to touch: a migration that improves a user's Hyprland config hashes the file first and rewrites it *only when it still matches a known stock checksum* (see `$OMARCHY_PATH/migrations/1781485962.sh` and its `stock_input_sha` / `stock_bindings_sha` constants). So a **stock** file under chezmoi is a standing conflict — Omarchy rewrites it, the next apply reverts it, every update — while a **customized** file is skipped by the migration and chezmoi is its only writer. `~/.config/hypr` therefore holds only `input.lua`, `looknfeel.lua` and `monitors.lua`; the stock files are byte-identical to what Omarchy installs, so a rebuilt machine gets them from Omarchy anyway. The same reasoning is why `~/.config/ghostty/config` is unmanaged there.
+- **Themes: definitions sync, the selection does not.** A custom theme's files under `~/.config/omarchy/themes/<name>/` are managed, so every machine has them in the switcher. Which theme is *active* is deliberately per-device — it lives in `~/.local/state/omarchy/current/theme.name`, which nothing here manages — so two machines on the same dotfiles can look completely different and `omarchy theme set` is never overridden. `run_onchange_after_07-omarchy-theme.sh.tmpl` exists only because Omarchy compiles `colors.toml` into per-application files (ghostty.conf, claude.json, btop.theme, …) at set/refresh time rather than on demand: when chezmoi changes a managed theme's colors, that script refreshes **only if that theme is the one currently active on this machine**, and otherwise does nothing. It enumerates the managed themes from the source tree at render time, so adding a theme needs no change to it.
+
+  Two related pieces follow the live theme rather than pinning one, which is what makes per-device theming work: `theme-set.d/omazed` (points Zed at the current theme) and the `"theme": "custom:omarchy"` key in `dot_claude/settings.json.tmpl` (points Claude Code at `~/.claude/themes/omarchy.json`, which Omarchy regenerates on every theme change).
+- **Never `pacman -Syu`.** Omarchy's `00-omarchy-update-guard` libalpm hook aborts any direct system upgrade. `update` hands the whole step to `omarchy update -y` (last, see above), and `install.sh` bootstraps with `omarchy pkg add` (which installs only what is missing and needs no `-Syu`).
+- **Never `pacman -Sc` and never bulk-remove orphans.** Omarchy's package cache is its *only* offline downgrade path, so it keeps two versions per package (`omarchy-update-pkg-prune` runs `paccache -rk2`); emptying it removes the ability to roll back a bad update. Orphans are reviewed rather than assumed — `omarchy-update-orphan-pkgs` lists them and asks, defaulting to no. `clean` branches for both.
+- **`omarchy update -y` can still block and can still reboot.** `-y` sets `OMARCHY_UPDATE_UNATTENDED`, but grep `$OMARCHY_PATH` and nothing reads it; `omarchy-update-restart` calls `gum confirm` unconditionally and reboots on yes. Never put work you need to finish after it.
+- **mise wrappers.** Omarchy's first run provisions ~13 wrappers in `~/.local/bin` via `omarchy mise install`; each runs `mise use -g <tool>` on *every invocation*, rewriting `~/.config/mise/config.toml`. That file is Omarchy's — the dotfiles use `conf.d/10-dotfiles.toml` instead. `env-bootstrap` also puts the mise shim dir on PATH, so a tool declared to mise is served by its shim regardless of what sits in `~/.local/bin`.
+- **Compile before files.** `run_before_*` scripts run before chezmoi writes anything, so anything that can fail a build belongs there: a failed compile then aborts the apply with nothing half-written. `run_before` scripts cannot read `~/.local/src`, which chezmoi has not written yet — build from `{{ .chezmoi.sourceDir }}` instead.
+- **Privilege escalation** in scripts: `sudo` when there is a TTY, `pkexec` otherwise (an apply triggered from the bar widget has no terminal, and Omarchy's polkit agent puts up a dialog). Always compare before escalating so a no-op apply never prompts.
+- **`/etc`** is out of chezmoi's reach ($HOME only). Root-owned files live in `system/etc/` at the repo root and are installed by `run_onchange_after_05-omarchy-etc.sh.tmpl`.
+- **Third-party plugins and packages** are declared in `root/.chezmoidata/omarchy.toml` and installed by `run_before_00-omarchy-packages.sh.tmpl`. See the manifest's own header comment.
+- **The sync widget.** `carson.dotfiles` surfaces chezmoi drift on the bar. Its data comes from `dotfiles-status`, which is also what `dotfiles-sync` and the menu's Dotfiles submenu read, so the three cannot disagree. Hovering it lists the changed files with `+added -removed` counts (capped by the `tooltipFiles` setting), with a `!` against any file edited outside chezmoi. Those counts come from parsing one `chezmoi diff`; they are verified to match `git apply --numstat` exactly. The distinction that matters: `chezmoi status` column 2 is a pending apply, column 1 is a target edited *outside* chezmoi (an Omarchy migration, `omarchy refresh`, a hand edit) which chezmoi will not overwrite unprompted — that is the state the widget colours urgent.
+
 ### Identity System
 
 The work identity is driven by a single file, **`~/work.email`**, whose only contents are one work email address (no other text or formatting). This mirrors the per-host signing-key file pattern (`~/.ssh/git_signing.pub`). When the file is absent, the **`DOTFILES_WORK_EMAIL`** env var is consulted as a fallback (the file always wins when both exist) — this is how Codespaces get a work identity, since user secrets surface there as env vars. `.chezmoi.toml.tmpl` reads the email at render time and derives the `identity`, `isWork`, `isPersonal`, and `workEmail` data variables. The email's **domain** selects the identity:
@@ -76,17 +105,11 @@ On real hosts (WSL, VMs, bare metal), `install.sh` runs `scripts/generate-signin
 
 ### Tool Management
 
-CLI tools are managed by [mise](https://mise.jdx.dev/) via `root/private_dot_config/mise/config.toml.tmpl`. Language SDKs (go, node, bun) are conditionally included only outside dev containers (`not .isDc`). Tools are installed automatically during `chezmoi apply` via the `run_onchange_after_01-mise-install.sh.tmpl` script.
-
-### Chezmoi Automation Scripts
+CLI tools are managed by [mise](https://mise.jdx.dev/) via `root/private_dot_config/mise/conf.d/10-dotfiles.toml.tmpl`. Language SDKs (go, node, bun) are conditionally included only outside dev containers (`not .isDc`). Tools are installed automatically during `chezmoi apply` via the `run_onchange_after_01-mise-install.sh.tmpl` script.
 
-Post-install scripts in `root/.chezmoiscripts/` run automatically during `chezmoi apply`:
+**Anything mise can install, mise installs.** A tool with a mise backend does not get a bespoke curl-into-bash installer, on any platform — one declaration in the tool list replaces an install step, a version that nobody tracks, and an update path that differs per machine. Claude Code (`aqua:anthropics/claude-code`) is managed this way rather than through `claude.ai/install.sh`. The two deliberate exceptions are the bootstrappers that have to exist before the tool list can be read: **mise itself**, and **chezmoi** (installed from `pacman` on Omarchy, else the official installer — `update` refreshes it in place only when the binary is user-writable). System packages that must exist before mise runs, or that a login shell depends on (fish, neovim, git), stay with the platform package manager.
 
-- `run_onchange_after_01-mise-install.sh.tmpl` - Installs mise tools when config changes
-- `run_after_mise-update.sh.tmpl` / `.ps1.tmpl` - Runs `mise self-update`. Failure is reported and stepped over rather than aborting the apply: packagers can disable self-update so mise is updated through the package manager instead (Homebrew, Arch's `mise`, distro and scoop/winget packages), and those builds exit nonzero — as does a root-owned mise an unprivileged user can't replace. Updating mise there belongs to whatever installed it
-- `run_after_install-claude-config.sh.tmpl` - Syncs Claude Code configuration
-- `run_onchange_after_02-install-completions.sh.tmpl` - Generates fish completions for every installed tool that supports it (gh, docker, mise, rg, fd, ast-grep, zellij, herdr, starship, pnpm); re-runs when the mise config changes so completions track tool versions. worktrunk uses dynamic completions instead (`conf.d/wt.fish` sources `COMPLETE=fish wt` at shell startup)
-- `run_onchange_after_04-claude-plugins.sh.tmpl` - Installs/enables Claude Code plugins when the plugin list changes (see Claude Plugin Management)
+Before adding an installer for anything, check `mise registry <tool>`.
 
 ### Claude Plugin Management
 
@@ -113,19 +136,62 @@ on the next apply (removal is handled declaratively by settings regeneration; th
 script never force-uninstalls). The provisioner re-runs whenever the file's hash
 changes, following the same `run_onchange` pattern as the mise script.
 
-The script skips cleanly when the `claude` CLI is not yet installed (e.g. the
-first `install.sh` run, which installs Claude Code after `chezmoi apply`) and
-picks the plugins up on the next apply. Hand-authored skills under
+The script still skips cleanly when the `claude` CLI is absent, but that is now
+a fallback rather than the normal first-run path: Claude Code is a mise tool, so
+`run_onchange_after_01-mise-install.sh.tmpl` has installed it by the time this
+script runs. Hand-authored skills under
 `dot_claude/skills/` are unrelated — those are files applied directly to
 `~/.claude/skills/`.
 
+### Shell Configuration: drop-in directories
+
+Configuration is organized around **drop-in directories** wherever the tool
+supports one, so that a file another owner also writes to (a distro's rc file,
+`mise use -g`'s config) never has to be contested. The rule is uniform: one
+numbered file per concern, loaded in sorted order, from a predictable location.
+
+| Consumer | Drop-in directory | Loaded by |
+| --- | --- | --- |
+| bash, zsh | `~/.config/sh/rc.d/*.sh` | a four-line loop in `~/.bashrc` / `~/.zshrc` (partial: `.chezmoitemplates/shell-rcd`) |
+| PowerShell | `~/.config/pwsh/rc.d/*.ps1` | the same loop in `Microsoft.PowerShell_profile.ps1` (partial: `.chezmoitemplates/pwsh-rcd`) |
+| fish | `~/.config/fish/conf.d/*.fish` | fish, natively |
+| mise | `~/.config/mise/conf.d/*.toml` | mise, natively |
+| systemd (user) | `~/.config/systemd/user/` | systemd, natively |
+
+The numbering is shared across shells, and one position in it is load-bearing:
+**`25-mise` runs before every tool activation**, because starship, zoxide and
+mcfly can all be mise-managed and mise's shim directory is not on PATH until it
+runs. Probing for them first silently skips their setup on a host where mise is
+the only thing providing them.
+
+`~/.bashrc`, `~/.zshrc` and the PowerShell profile are therefore **thin loaders
+that should not need to change again**. Everything shell-agnostic lives in `root/private_dot_config/sh/rc.d/`,
+where `00-shell.sh` sets `DOTFILES_SHELL` (`bash`|`zsh`) and later files use it
+to pick the right argument for `starship init`, `mise activate` and friends. One
+drop-in per concern is what lets a single `.chezmoiignore` line disable exactly
+the pieces a given host already provides — on Omarchy, `40-starship.sh`,
+`41-mise.sh`, `42-zoxide.sh` and `70-history.sh` are ignored because Omarchy's
+own `default/bash/rc` already does all four.
+
+To add a shell setting, add a numbered file to `sh/rc.d/` (or the fish `conf.d/`
+equivalent). Only reach for `~/.bashrc` itself when the thing genuinely must run
+before the interactivity guard.
+
+**mise** uses a `conf.d` drop-in for the same reason: Omarchy's tool wrappers run
+`mise use -g` on every invocation, which rewrites `~/.config/mise/config.toml`.
+chezmoi owns `conf.d/10-dotfiles.toml` and mise structurally refuses to write
+into `conf.d`, so the two can never clobber each other. The trade-off is
+precedence — within a global config dir `config.toml` **outranks** `conf.d`, so
+the Omarchy branch of that template drops every tool Omarchy already provides
+rather than pinning a version that would be silently ignored.
+
 ### Environment Variables
 
 Simple key-value environment variables (e.g., `VISUAL`, `HOMEBREW_NO_AUTO_UPDATE`) are centralized in template partials under `root/.chezmoitemplates/`. Each partial renders the same variables in the syntax for its target shell:
 
 | Partial | Syntax | Consumed by |
 | --- | --- | --- |
-| `env-posix` | `export VAR=val` | `dot_bashrc.tmpl`, `dot_zshrc.tmpl` |
+| `env-posix` | `export VAR=val` | `private_dot_config/sh/rc.d/20-env.sh.tmpl` |
 | `env-fish` | `set -gx VAR val` | `config.fish.tmpl` |
 | `env-powershell` | `$env:VAR = "val"` | `Microsoft.PowerShell_profile.ps1.tmpl` |
 | `env-windows-persist` | `[Environment]::SetEnvironmentVariable(...)` | `run_onchange_after_03-windows-env.ps1.tmpl` |
@@ -141,15 +207,6 @@ On Windows, `run_onchange_after_03-windows-env.ps1.tmpl` persists env vars from
 - `root/.chezmoiignore.tmpl` - Controls which files chezmoi ignores per environment
 - There is no `.chezmoiexternal` file: fundle is vendored at `root/private_dot_config/fish/functions/fundle.fish` (update it by copying a newer upstream release in, preserving the MIT license header at the top of the file), and binaries like eget install through mise
 
-### Key Files
-
-- `root/.chezmoi.toml.tmpl` - Main chezmoi configuration with environment variables
-- `root/dot_gitconfig.tmpl` - Git configuration with conditional work includes
-- `root/dot_gitconfig-work.tmpl` - Work-specific git configuration
-- `root/private_dot_config/fish/config.fish.tmpl` - Fish shell configuration
-- `root/dot_bashrc.tmpl` - Bash configuration (Homebrew, starship, mise, zoxide, mcfly)
-- `root/dot_zshrc.tmpl` - Zsh configuration
-
 ## Common Commands
 
 ```bash
@@ -184,4 +241,4 @@ clean                       # Prune orphaned packages, old tool versions, caches
 
 4. **Template formatting** - Template files containing Go template strings must be formatted carefully to preserve correct whitespace and avoid trimming issues.
 
-5. **NEVER test on host machine** - Changes must never be tested on the host machine. `chezmoi apply` should be considered dangerous unless run within a Docker container.
+5. **NEVER test on host machine** - Changes must never be tested on the host machine. `chezmoi apply` should be considered dangerous unless run within a Docker container, or pointed at a throwaway `--destination` with its own `--persistent-state`.
diff --git a/README.md b/README.md
index bc4c204..e00a475 100644
--- a/README.md
+++ b/README.md
@@ -4,16 +4,24 @@ My personal dotfiles, managed with [chezmoi](https://www.chezmoi.io/).
 
 ## Install
 
-### Linux (Debian/Ubuntu/Arch) — dev containers, WSL, cloud VMs
+### Linux (Debian/Ubuntu/Arch/Omarchy) — dev containers, WSL, cloud VMs, desktops
 
-Clone and run the bootstrap script. It installs mise, chezmoi, fish, and Claude
-Code, then applies the dotfiles:
+Clone and run the bootstrap script. It installs mise, chezmoi and fish, then
+applies the dotfiles — which is what installs the CLI tools, Claude Code
+included:
 
 ```sh
 git clone https://github.com/CS-5/dotfiles.git ~/.local/share/chezmoi
 ~/.local/share/chezmoi/install.sh [--work-email <address>]
 ```
 
+On [Omarchy](https://omarchy.org) the same command also brings up the desktop:
+Hyprland config, the Omarchy shell layout, the custom theme, declared packages
+and shell plugins, and the ThinkPad keyboard-backlight daemon. It defers to
+Omarchy wherever Omarchy already owns something — packages go through `omarchy
+pkg add`, chezmoi comes from the Arch repos, and Claude Code is left to
+Omarchy's own mise wrapper. Expect one sudo prompt, then log out and back in.
+
 The work identity comes from a single file, `~/work.email`, containing just your
 work email address; its domain selects the identity (e.g. `…@kirbtech.com`). No
 file means a personal machine. `--work-email` writes that file before applying;
@@ -40,6 +48,17 @@ sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply CS-5
 iex "&{$(irm 'https://get.chezmoi.io/ps1')} init --apply CS-5"
 ```
 
+Everything the dotfiles can do for themselves happens during that apply — mise
+tools, fish plugins, completions, Claude Code and its plugins. Two things a
+bootstrap script does on Linux have no equivalent here:
+
+- **A per-host signing key.** Without one, commits sign through the SSH agent
+  using the committed public key, which works. To get a key on disk instead,
+  run `scripts/generate-signing-key.sh` **before** `chezmoi init` — the key path
+  is read when the config template renders, so generating it afterwards has no
+  effect until the next `chezmoi init`.
+- **Making fish the login shell** (`chsh -s $(which fish)` on macOS).
+
 ## Commit signing
 
 Commits are signed with an SSH key. The signing **public** key is baked into the
diff --git a/cloud-init.yaml b/cloud-init.yaml
index 8555e70..d111451 100644
--- a/cloud-init.yaml
+++ b/cloud-init.yaml
@@ -22,14 +22,13 @@ users:
 package_update: true
 package_upgrade: true
 
+# Only what cloud-init itself needs to fetch the repo. Everything else
+# (build-essential, fish, neovim, wget/unzip/gnupg, mise, chezmoi and the
+# dotfiles' own tool list) is install.sh's job.
 packages:
-  - build-essential
   - ca-certificates
   - curl
   - git
-  - wget
-  - unzip
-  - gnupg
 
 runcmd:
   - su - carson -c "git clone https://github.com/CS-5/dotfiles.git ~/.local/share/chezmoi"
diff --git a/install.sh b/install.sh
index 646ec7e..71cdf5f 100755
--- a/install.sh
+++ b/install.sh
@@ -6,13 +6,6 @@
 set -eufo pipefail
 
 # Discover dev container workspace if present (/workspaces/<repo-name> convention).
-# Uses find rather than a glob because `set -f` disables pathname expansion.
-#
-# Codespaces names the folder outright in CODESPACE_VSCODE_FOLDER, so prefer it.
-# The find fallback has to skip dotdirs and sort: Codespaces also mounts
-# /workspaces/.codespaces, and find emits filesystem order, so an unsorted
-# `head -n1` picks .codespaces over the repo — and `mise trust` then trusts a
-# directory with no config in it.
 WORKSPACE_DIR="${CODESPACE_VSCODE_FOLDER:-}"
 if [[ -n "$WORKSPACE_DIR" && ! -d "$WORKSPACE_DIR" ]]; then
     WORKSPACE_DIR=""
@@ -21,13 +14,18 @@ if [[ -z "$WORKSPACE_DIR" && -d "/workspaces" ]]; then
     WORKSPACE_DIR="$(find /workspaces -maxdepth 1 -mindepth 1 -type d ! -name '.*' 2>/dev/null | sort | head -n1)"
 fi
 
-# Dev containers sign commits via the host's forwarded SSH agent; real hosts
-# (WSL, VMs, bare metal) own a signing key on disk.
+# Is Dev Container?
 IS_DC=false
 if [[ -n "${REMOTE_CONTAINERS_IPC:-}" || "${USER:-}" == "vscode" || "${CODESPACES:-}" == "true" || -n "$WORKSPACE_DIR" ]]; then
     IS_DC=true
 fi
 
+# Is Omarchy?
+IS_OMARCHY=false
+if [[ -r /etc/os-release ]] && grep -q '^ID=omarchy$' /etc/os-release; then
+    IS_OMARCHY=true
+fi
+
 # Work identity is detected from ~/work.email at chezmoi render time. Pass
 # --work-email to write that file here (non-interactive provisioning); leave it
 # unset to keep any existing ~/work.email (no file => personal identity).
@@ -68,16 +66,17 @@ export PATH="$HOME/.local/bin:$PATH"
 
 #### Bootstrap Dependencies ####
 show_progress "Installing bootstrap dependencies"
-# Same package names in Debian/Ubuntu and Arch repos.
+
+# Same package names in Debian/Ubuntu and Arch repos
 BOOTSTRAP_PKGS=(curl git wget unzip gnupg fish neovim)
-if command -v apt-get >/dev/null 2>&1; then
+
+if [[ "$IS_OMARCHY" == "true" ]]; then
+    omarchy pkg add "${BOOTSTRAP_PKGS[@]}" base-devel
+elif command -v apt-get >/dev/null 2>&1; then
     sudo apt-get update
-    sudo apt-get install -y "${BOOTSTRAP_PKGS[@]}"
+    sudo apt-get install -y "${BOOTSTRAP_PKGS[@]}" build-essential
 elif command -v pacman >/dev/null 2>&1; then
-    # -Syu, not -Sy: Arch doesn't support partial upgrades, so installing
-    # against a synced-but-not-upgraded system can break shared libs.
-    # --needed skips packages already present.
-    sudo pacman -Syu --needed --noconfirm "${BOOTSTRAP_PKGS[@]}"
+    sudo pacman -Syu --needed --noconfirm "${BOOTSTRAP_PKGS[@]}" base-devel
 else
     log_error "No supported package manager found (apt-get or pacman)."
     log_error "Install these manually, then re-run: ${BOOTSTRAP_PKGS[*]}"
@@ -86,10 +85,8 @@ fi
 log_success "Bootstrap dependencies installed"
 
 #### Mise ####
-# Leave an existing mise alone. Dev container images commonly install a pinned
-# mise and assert the pin at build time; reinstalling from mise.run would replace
-# it with latest and silently defeat that. Same shape as the guards in
-# .chezmoiscripts/*mise*.
+
+# Leave an existing mise alone. Omarchy ships with Mise and Dev Container images may also 
 if command -v mise >/dev/null 2>&1; then
     log_info "mise $(mise --version | cut -d' ' -f1) already installed, leaving it as-is"
 else
@@ -97,11 +94,14 @@ else
     curl -fsSL https://mise.run | sh
     log_success "mise installed"
 fi
+
+# If there's a workspace dir (Dev Container)
 if [[ -n "$WORKSPACE_DIR" ]]; then
     mise trust --cd="$WORKSPACE_DIR" --quiet
 fi
 
 #### Signing Key ####
+
 # Must run before chezmoi applies so the key is detected at render time.
 if [[ "$IS_DC" != "true" ]]; then
     show_progress "Ensuring commit signing key"
@@ -109,7 +109,18 @@ if [[ "$IS_DC" != "true" ]]; then
     log_success "Signing key ready"
 fi
 
+#### Chezmoi ####
+
+# On Omarchy, take chezmoi from the repos rather than the curl installer, so it
+# is upgraded by `omarchy update` along with everything else.
+if [[ "$IS_OMARCHY" == "true" ]] && ! command -v chezmoi >/dev/null 2>&1; then
+    show_progress "Installing chezmoi from the Arch repos"
+    omarchy pkg add chezmoi
+    log_success "chezmoi installed"
+fi
+
 #### Chezmoi Setup ####
+
 show_progress "Installing chezmoi and dotfiles"
 if [[ -n "$WORK_EMAIL" ]]; then
     "$SCRIPT_DIR/install-dotfiles.sh" --work-email "$WORK_EMAIL"
@@ -119,17 +130,12 @@ fi
 log_success "Dotfiles installed and applied"
 
 #### Shell ####
+
 show_progress "Setting up shell"
-fish -c "fundle install"
 if [[ "${SHELL:-}" != *"fish"* ]]; then
     log_info "Changing default shell to fish"
     sudo chsh -s "$(which fish)" "${USER:-$(id -un)}"
 fi
 log_success "Shell setup complete"
 
-#### Claude Code ####
-show_progress "Installing Claude Code"
-curl -fsSL https://claude.ai/install.sh | bash
-log_success "Claude Code installed"
-
 log_success "Setup complete"
diff --git a/render.sh b/render.sh
index bd7a32c..84e1bc8 100755
--- a/render.sh
+++ b/render.sh
@@ -132,7 +132,7 @@ fi
 # and .chezmoidata are unavailable. Without --init both load, and the rendered
 # config's [data] is still supplied via --config.
 chezmoi execute-template --init --source="$SCRIPT_DIR/root" \
-    < "$SCRIPT_DIR/root/.chezmoi.toml.tmpl" > "$TEMP_DIR/chezmoi.toml"
+    <"$SCRIPT_DIR/root/.chezmoi.toml.tmpl" >"$TEMP_DIR/chezmoi.toml"
 
 # --override-data (chezmoi >= 2.66) applies last, on top of the rendered
 # config's [data], so --data can force values like isMac or isDc directly.
@@ -142,4 +142,4 @@ if [[ -n "$OVERRIDE_DATA" ]]; then
 fi
 
 chezmoi execute-template --config="$TEMP_DIR/chezmoi.toml" --source="$SCRIPT_DIR/root" \
-    ${OVERRIDE_ARGS[@]+"${OVERRIDE_ARGS[@]}"} < "$SCRIPT_DIR/$TEMPLATE_FILE"
+    ${OVERRIDE_ARGS[@]+"${OVERRIDE_ARGS[@]}"} <"$SCRIPT_DIR/$TEMPLATE_FILE"
diff --git a/root/.chezmoi.toml.tmpl b/root/.chezmoi.toml.tmpl
index 6559d03..582064d 100644
--- a/root/.chezmoi.toml.tmpl
+++ b/root/.chezmoi.toml.tmpl
@@ -3,21 +3,24 @@ sourceDir = {{ env "DOTFILES_SOURCE_DIR" | default "~/.local/share/chezmoi" | qu
 {{ $probablyDc := or (env "REMOTE_CONTAINERS_IPC" | not | not) (eq (env "USER") "vscode") (stat "/workspaces" | not | not) -}}
 {{ $isCodespaces := env "CODESPACES" | not | not -}}
 {{ $isDc := or $probablyDc $isCodespaces -}}
+{{ $isOmarchy := and (eq .chezmoi.os "linux") (eq (get .chezmoi.osRelease "id" | default "") "omarchy") -}}
+{{ $isThinkPad := false -}}
+
 {{ $binDir := ".local/bin" -}}
 
-{{/* Work identity is driven by ~/work.email: a file whose sole contents
-     are one work email address. When the file is absent, the
-     DOTFILES_WORK_EMAIL env var is consulted as a fallback (Codespaces
-     user secrets surface as env vars). The email's domain selects the
-     identity; no email or an unrecognized domain means personal. Mirrors
-     the per-host signing-key file below. Add new jobs to $identities. */}}
+{{ $dmiFamilyPath := "/sys/class/dmi/id/product_family" -}}
+{{ if stat $dmiFamilyPath -}}
+  {{ $isThinkPad = include $dmiFamilyPath | trim | hasPrefix "ThinkPad" -}}
+{{ end -}}
+
 {{ $identities := dict
     "kirbtech.com"    "kirbtech"
     "journalytic.com" "journalytic" -}}
 {{ $identity := "personal" -}}
+
 {{ $workEmail := "" -}}
-{{/* Defaults to ~/work.email; DOTFILES_WORK_EMAIL_FILE relocates it (render.sh). */}}
 {{ $workEmailPath := joinPath .chezmoi.homeDir "work.email" -}}
+
 {{ if env "DOTFILES_WORK_EMAIL_FILE" -}}{{ $workEmailPath = env "DOTFILES_WORK_EMAIL_FILE" -}}{{ end -}}
 {{ $email := "" -}}
 {{ if stat $workEmailPath -}}
@@ -34,24 +37,15 @@ sourceDir = {{ env "DOTFILES_SOURCE_DIR" | default "~/.local/share/chezmoi" | qu
 {{ end -}}
 {{ $isWork := ne $identity "personal" -}}
 
-{{/* Signing public key: committed canonical default, overridden by a
-     per-host file, overridden by an explicit env var. The key is public,
-     so committing it is safe; the matching private key lives in the SSH
-     agent wherever commits are made. */}}
 {{ $signingKey := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEgjvCUvsO0qdi0D+H0ksk2HbfGhlQU7fQE4F817N+G" -}}
 {{ $signingKeyPath := joinPath .chezmoi.homeDir ".ssh/git_signing.pub" -}}
 {{ if stat $signingKeyPath -}}{{ $signingKey = include $signingKeyPath | trim -}}{{ end -}}
 {{ if env "DOTFILES_SIGNING_KEY" -}}{{ $signingKey = env "DOTFILES_SIGNING_KEY" -}}{{ end -}}
 
-{{/* Private signing key on disk (hosts/VMs/WSL). When present, git signs
-     directly from the file with no agent; otherwise it falls back to the
-     canonical public key via a forwarded agent (dev containers). */}}
 {{ $signingKeyFilePath := joinPath .chezmoi.homeDir ".ssh/git_signing" -}}
 {{ $signingKeyFile := "" -}}
 {{ if stat $signingKeyFilePath -}}{{ $signingKeyFile = $signingKeyFilePath -}}{{ end -}}
 
-{{/* Sign commits everywhere except Codespaces, which signs commits with
-     GitHub's own web-flow key and cannot reach the forwarded signing key. */}}
 {{ $gitSign := and (not $isCodespaces) (ne $signingKey "") -}}
 
 [data]
@@ -64,6 +58,8 @@ sourceDir = {{ env "DOTFILES_SOURCE_DIR" | default "~/.local/share/chezmoi" | qu
     isWindows = {{ eq .chezmoi.os "windows" }}
     isWsl = {{ env "WSL_DISTRO_NAME" | not | not }}
     isDc = {{ $isDc }}
+    isOmarchy = {{ $isOmarchy }}
+    isThinkPad = {{ $isThinkPad }}
 
     # Identity
     identity = {{ $identity | quote }}
diff --git a/root/.chezmoidata/omarchy.toml b/root/.chezmoidata/omarchy.toml
new file mode 100644
index 0000000..a62811d
--- /dev/null
+++ b/root/.chezmoidata/omarchy.toml
@@ -0,0 +1,73 @@
+# Everything this machine needs that is not a file: packages, Omarchy's
+# opinionated installers, and third-party shell plugins. Source-only (it lives
+# under .chezmoidata/, so it is template data and is never applied to $HOME),
+# and consumed by .chezmoiscripts/run_before_00-omarchy-packages.sh.tmpl.
+#
+# To add something, add a line here. Removal is deliberately NOT handled: this
+# manifest says what must be present, not what must be absent, so deleting a
+# line stops the machine from installing it on a rebuild but never uninstalls
+# it from a running system.
+
+[omarchy]
+
+# Arch repo packages (including Omarchy's own mirror). `fish` is also in
+# install.sh's bootstrap list, which is what covers non-Omarchy hosts and the
+# window before chezmoi first runs.
+packages = [
+  "fish",
+  "bitwarden",
+  "efibootmgr",
+  "fprintd",
+  "fwupd",
+  "libfprint",
+  "omazed",
+  "usbutils",
+  "visual-studio-code-bin",
+]
+
+# AUR packages with no Omarchy installer of their own. google-chrome is absent
+# on purpose -- `omarchy install browser chrome` below owns it.
+aur = ["claude-desktop", "hyprmoncfg"]
+
+# Omarchy's opinionated installers do more than install a package: they set the
+# app as the Omarchy default and wire it into the theme system. `package` is the
+# sentinel checked to decide whether the installer still needs to run.
+[[omarchy.installers]]
+command = "terminal ghostty"
+package = "ghostty"
+
+[[omarchy.installers]]
+command = "editor zed"
+package = "zed"
+
+[[omarchy.installers]]
+command = "service spotify"
+package = "spotify"
+
+[[omarchy.installers]]
+command = "browser chrome"
+package = "google-chrome"
+
+# Third-party Omarchy shell plugins. shell.json (managed) is what enables and
+# places them; this only makes sure the code is on disk first, so a
+# restore-from-scratch doesn't leave the bar referencing plugins that aren't
+# there. `omarchy plugin update` keeps them current afterwards.
+[[omarchy.plugins]]
+id = "bobbynicholas.omaland"
+url = "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/bobby-nicholas/omaland.git"
+
+[[omarchy.plugins]]
+id = "crmne.hyprmoncfg"
+url = "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/crmne/omarchy-hyprmoncfg.git"
+
+[[omarchy.plugins]]
+id = "io.github.sirjul1337.lock-explorer"
+url = "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/SirJul1337/omarchy-lock-explorer.git"
+
+[[omarchy.plugins]]
+id = "jkoestinger.vpn"
+url = "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/jkoestinger/omarchy-vpn.git"
+
+[[omarchy.plugins]]
+id = "io.github.cyprusad.omakeez"
+url = "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/cyprusad/omakeez.git"
diff --git a/root/.chezmoiignore.tmpl b/root/.chezmoiignore.tmpl
index 4c01aba..fb46f86 100644
--- a/root/.chezmoiignore.tmpl
+++ b/root/.chezmoiignore.tmpl
@@ -6,6 +6,7 @@
 .bashrc
 .zshrc
 .hushlogin
+.config/sh
 .config/fish
 .config/ghostty
 .config/zellij
@@ -18,6 +19,7 @@ Library
 {{- else }}
 Documents
 AppData
+.config/pwsh
 
 {{- if .isMac }}
 .config/pnpm
@@ -25,10 +27,31 @@ AppData
 Library
 {{- end }}
 
+{{- if not .isMac }}
+.config/sh/rc.d/05-brew.sh
+{{- end }}
+
 {{- if .isDc }}
 .config/ghostty
 {{- end }}
 
+{{- if not .isOmarchy }}
+.config/hypr
+.config/omarchy
+{{- else }}
+.config/ghostty
+.config/sh/rc.d/25-mise.sh
+.config/sh/rc.d/40-starship.sh
+.config/sh/rc.d/42-zoxide.sh
+.config/sh/rc.d/70-history.sh
+.config/hypr/monitors.lua
+{{- end }}
+
+{{- if not (and .isOmarchy .isThinkPad) }}
+.config/systemd
+.local/src
+{{- end }}
+
 {{- if .isPersonal }}
 .gitconfig-work
 {{- end }}
diff --git a/root/.chezmoiremove.tmpl b/root/.chezmoiremove.tmpl
index e69de29..a822b0d 100644
--- a/root/.chezmoiremove.tmpl
+++ b/root/.chezmoiremove.tmpl
@@ -0,0 +1,8 @@
+{{- if .isOmarchy }}
+{{/* Omarchy's first-run writes ~/.config/git/config with a personal user.email
+     and init.defaultBranch=master. git reads it BEFORE ~/.gitconfig, and the
+     dotfiles only win on keys they actually set — so anything they leave unset
+     leaks through from Omarchy's copy. Omarchy writes the file only on
+     first-run (install/user/git.sh), so removing it here is permanent. */}}
+.config/git/config
+{{- end }}
diff --git a/root/.chezmoiscripts/run_before_00-omarchy-packages.sh.tmpl b/root/.chezmoiscripts/run_before_00-omarchy-packages.sh.tmpl
new file mode 100644
index 0000000..cb2935c
--- /dev/null
+++ b/root/.chezmoiscripts/run_before_00-omarchy-packages.sh.tmpl
@@ -0,0 +1,94 @@
+{{ if .isOmarchy -}}
+#!/bin/bash
+
+# Install everything in .chezmoidata/omarchy.toml that isn't already here.
+#
+# This is a plain run_ script rather than run_onchange_ on purpose. The work is
+# guarded by presence checks, so on a settled machine it is a handful of
+# `pacman -Q` calls and exits without touching anything -- while a run_onchange
+# keyed on the manifest hash would record itself as done even on a run that had
+# to skip (no terminal for the sudo prompt, AUR unreachable), and never retry.
+# Always-run plus cheap checks is both simpler and harder to leave half-applied.
+#
+# It runs before any file is written so that a fresh machine has the packages
+# its config refers to by the time the config lands.
+
+set -euo pipefail
+
+step() { printf '\033[1;34m==>\033[0m %s\n' "$1"; }
+
+repo_packages=({{ range .omarchy.packages }}{{ . | quote }} {{ end }})
+aur_packages=({{ range .omarchy.aur }}{{ . | quote }} {{ end }})
+
+missing_repo=()
+for pkg in "${repo_packages[@]}"; do
+    pacman -Q "$pkg" &>/dev/null || missing_repo+=("$pkg")
+done
+
+missing_aur=()
+for pkg in "${aur_packages[@]}"; do
+    pacman -Q "$pkg" &>/dev/null || missing_aur+=("$pkg")
+done
+
+pending_installers=()
+{{ range .omarchy.installers -}}
+omarchy pkg present {{ .package | quote }} || pending_installers+=({{ .command | quote }})
+{{ end }}
+# Plugins are just git clones into ~/.config/omarchy/plugins and need no
+# privileges, so they are handled below regardless of whether there is a
+# terminal for a password prompt.
+missing_plugins=()
+{{ range .omarchy.plugins -}}
+[[ -d "$HOME/.config/omarchy/plugins/{{ .id }}" ]] || missing_plugins+=({{ .url | quote }})
+{{ end }}
+if (( ${#missing_plugins[@]} )); then
+    step "Installing ${#missing_plugins[@]} Omarchy shell plugin(s)"
+    for url in "${missing_plugins[@]}"; do
+        # shell.json (managed by chezmoi) is what enables and places these, so
+        # --enable is deliberately not passed: it would edit shell.json and be
+        # overwritten moments later when chezmoi applies its copy.
+        omarchy plugin add "$url" --yes || echo "warning: could not add plugin $url" >&2
+    done
+fi
+
+if (( ${#missing_repo[@]} + ${#missing_aur[@]} + ${#pending_installers[@]} == 0 )); then
+    exit 0
+fi
+
+# Everything below needs root. Omarchy has no passwordless pacman rule, so
+# without a terminal there is nowhere to type the password; warn and leave it
+# for the next interactive apply (this script runs every time, so it retries).
+if [[ ! -t 0 ]]; then
+    echo "omarchy-packages: no terminal for a sudo prompt, skipping:" >&2
+    printf '  repo:      %s\n' "${missing_repo[*]:-none}" >&2
+    printf '  aur:       %s\n' "${missing_aur[*]:-none}" >&2
+    printf '  installer: %s\n' "${pending_installers[*]:-none}" >&2
+    echo "omarchy-packages: run 'chezmoi apply' from a terminal to finish" >&2
+    exit 0
+fi
+
+# One prompt for the whole run rather than one per package.
+step "Package installation needs sudo"
+sudo -v
+
+if (( ${#missing_repo[@]} )); then
+    step "Installing ${#missing_repo[@]} package(s): ${missing_repo[*]}"
+    omarchy pkg add "${missing_repo[@]}"
+fi
+
+if (( ${#missing_aur[@]} )); then
+    step "Installing ${#missing_aur[@]} AUR package(s): ${missing_aur[*]}"
+    if omarchy pkg aur accessible; then
+        omarchy pkg aur add "${missing_aur[@]}"
+    else
+        echo "warning: AUR is unreachable, skipping ${missing_aur[*]}" >&2
+    fi
+fi
+
+for installer in "${pending_installers[@]}"; do
+    step "Running: omarchy install $installer"
+    # Word-split on purpose: these are two-word routes ("terminal ghostty").
+    # shellcheck disable=SC2086
+    omarchy install $installer || echo "warning: 'omarchy install $installer' failed" >&2
+done
+{{ end -}}
diff --git a/root/.chezmoiscripts/run_once_before_00-migrate-mise-config.ps1.tmpl b/root/.chezmoiscripts/run_once_before_00-migrate-mise-config.ps1.tmpl
new file mode 100644
index 0000000..3f5a5da
--- /dev/null
+++ b/root/.chezmoiscripts/run_once_before_00-migrate-mise-config.ps1.tmpl
@@ -0,0 +1,16 @@
+{{ if eq .chezmoi.os "windows" -}}
+# See run_once_before_00-migrate-mise-config.sh.tmpl. The dotfiles' mise tool
+# config moved to a conf.d drop-in; config.toml outranks conf.d, so a leftover
+# dotfiles-owned copy would keep winning. Move it aside once.
+
+$ErrorActionPreference = 'Stop'
+
+$config = Join-Path $env:USERPROFILE '.config\mise\config.toml'
+
+if (-not (Test-Path $config)) { exit 0 }
+if (-not (Select-String -Path $config -Pattern '^minimum_release_age' -Quiet)) { exit 0 }
+
+$backup = "$config.pre-conf.d.bak"
+Write-Host "mise: moving dotfiles-owned config.toml aside to $(Split-Path $backup -Leaf)"
+Move-Item -Force -Path $config -Destination $backup
+{{ end -}}
diff --git a/root/.chezmoiscripts/run_once_before_00-migrate-mise-config.sh.tmpl b/root/.chezmoiscripts/run_once_before_00-migrate-mise-config.sh.tmpl
new file mode 100644
index 0000000..a804a6f
--- /dev/null
+++ b/root/.chezmoiscripts/run_once_before_00-migrate-mise-config.sh.tmpl
@@ -0,0 +1,24 @@
+{{ if ne .chezmoi.os "windows" -}}
+#!/bin/bash
+
+# The dotfiles' mise tool config moved from ~/.config/mise/config.toml to a
+# conf.d drop-in so that `mise use -g` (which Omarchy's tool wrappers run on
+# every invocation) keeps a file of its own to write to. Within a global config
+# dir config.toml OUTRANKS conf.d, so a leftover dotfiles-owned config.toml
+# would keep winning and silently pin the old versions forever.
+#
+# chezmoi does not delete a file it merely stopped managing, so move it aside
+# here. The minimum_release_age line identifies it as ours: a config.toml that
+# `mise use -g` wrote has no [settings] block and is left untouched.
+
+set -euo pipefail
+
+config="$HOME/.config/mise/config.toml"
+
+[[ -f $config ]] || exit 0
+grep -q '^minimum_release_age' "$config" || exit 0
+
+backup="$config.pre-conf.d.bak"
+echo "mise: moving dotfiles-owned config.toml aside to $(basename "$backup")" >&2
+mv -f "$config" "$backup"
+{{ end -}}
diff --git a/root/.chezmoiscripts/run_onchange_after_01-mise-install.ps1.tmpl b/root/.chezmoiscripts/run_onchange_after_01-mise-install.ps1.tmpl
index 9d4a2f2..c37f547 100644
--- a/root/.chezmoiscripts/run_onchange_after_01-mise-install.ps1.tmpl
+++ b/root/.chezmoiscripts/run_onchange_after_01-mise-install.ps1.tmpl
@@ -1,5 +1,5 @@
 {{ if eq .chezmoi.os "windows" -}}
-# mise config hash: {{ include "private_dot_config/mise/config.toml.tmpl" | sha256sum }}
+# mise config hash: {{ include "private_dot_config/mise/conf.d/10-dotfiles.toml.tmpl" | sha256sum }}
 
 if (Get-Command mise -ErrorAction SilentlyContinue) {
     mise install --yes --quiet
diff --git a/root/.chezmoiscripts/run_onchange_after_01-mise-install.sh.tmpl b/root/.chezmoiscripts/run_onchange_after_01-mise-install.sh.tmpl
index 3561252..60b4ecd 100644
--- a/root/.chezmoiscripts/run_onchange_after_01-mise-install.sh.tmpl
+++ b/root/.chezmoiscripts/run_onchange_after_01-mise-install.sh.tmpl
@@ -1,7 +1,7 @@
 {{ if ne .chezmoi.os "windows" -}}
 #!/bin/bash
 
-# mise config hash: {{ include "private_dot_config/mise/config.toml.tmpl" | sha256sum }}
+# mise config hash: {{ include "private_dot_config/mise/conf.d/10-dotfiles.toml.tmpl" | sha256sum }}
 
 if ! command -v mise >/dev/null 2>&1; then
     echo "mise not found, skipping tool install"
diff --git a/root/.chezmoiscripts/run_onchange_after_02-install-completions.sh.tmpl b/root/.chezmoiscripts/run_onchange_after_02-install-completions.sh.tmpl
index e463a06..7563c18 100644
--- a/root/.chezmoiscripts/run_onchange_after_02-install-completions.sh.tmpl
+++ b/root/.chezmoiscripts/run_onchange_after_02-install-completions.sh.tmpl
@@ -3,7 +3,7 @@
 
 # Regenerate whenever any pinned tool version changes, not just when this
 # script changes — otherwise completions go stale as tools upgrade.
-# mise config hash: {{ include "private_dot_config/mise/config.toml.tmpl" | sha256sum }}
+# mise config hash: {{ include "private_dot_config/mise/conf.d/10-dotfiles.toml.tmpl" | sha256sum }}
 
 # Freshly mise-installed tools aren't on this non-interactive script's PATH
 # during the first apply (01-mise-install runs just before this); the shims
diff --git a/root/.chezmoiscripts/run_onchange_after_05-omarchy-etc.sh.tmpl b/root/.chezmoiscripts/run_onchange_after_05-omarchy-etc.sh.tmpl
new file mode 100644
index 0000000..aae14d8
--- /dev/null
+++ b/root/.chezmoiscripts/run_onchange_after_05-omarchy-etc.sh.tmpl
@@ -0,0 +1,39 @@
+{{ if and .isOmarchy .isThinkPad -}}
+#!/bin/bash
+
+# Install the root-owned files under system/etc/. chezmoi only manages $HOME,
+# so these live outside root/ and are placed here instead.
+#
+# The content is embedded below rather than read from the source tree, so this
+# works the same whether or not the source directory is still around.
+#
+# etc-hash: {{ include (joinPath .chezmoi.sourceDir "../system/etc/modprobe.d/99-thinkpad-touchpad.conf") | sha256sum }}
+
+set -euo pipefail
+
+target=/etc/modprobe.d/99-thinkpad-touchpad.conf
+staged="$(mktemp)"
+trap 'rm -f "$staged"' EXIT
+
+cat >"$staged" <<'CONF'
+{{ include (joinPath .chezmoi.sourceDir "../system/etc/modprobe.d/99-thinkpad-touchpad.conf") -}}
+CONF
+
+# Only escalate when something actually differs -- an unchanged apply should
+# never put up a password prompt.
+if cmp -s "$staged" "$target" 2>/dev/null; then
+    exit 0
+fi
+
+# A visible terminal can take a password; an apply triggered from the bar
+# widget cannot, and Omarchy's polkit agent puts up a dialog for pkexec.
+if [[ -t 0 ]]; then
+    escalate=(sudo)
+else
+    escalate=(pkexec)
+fi
+
+echo "etc: installing $target"
+"${escalate[@]}" install -Dm644 "$staged" "$target"
+echo "etc: $target updated -- reboot for the touchpad to switch transport"
+{{ end -}}
diff --git a/root/.chezmoiscripts/run_onchange_after_06-systemd-user.sh.tmpl b/root/.chezmoiscripts/run_onchange_after_06-systemd-user.sh.tmpl
new file mode 100644
index 0000000..e49c48a
--- /dev/null
+++ b/root/.chezmoiscripts/run_onchange_after_06-systemd-user.sh.tmpl
@@ -0,0 +1,23 @@
+{{ if and .isOmarchy .isThinkPad -}}
+#!/bin/bash
+
+# Pick up the user unit chezmoi just wrote and make sure it is running.
+#
+# Only the unit file itself is managed. The enablement symlinks under
+# default.target.wants/ are systemd's to write, which is what `enable` below
+# does -- checking them into the repo would fight `systemctl disable`.
+#
+# unit-hash: {{ include (joinPath .chezmoi.sourceDir "private_dot_config/systemd/user/kbd-backlight-auto.service") | sha256sum }}
+
+set -euo pipefail
+
+# No user bus during a TTY bootstrap or a container apply; the unit file is on
+# disk and the next graphical login starts it.
+if ! systemctl --user show-environment >/dev/null 2>&1; then
+    echo "systemd-user: no user bus, leaving kbd-backlight-auto to start at next login"
+    exit 0
+fi
+
+systemctl --user daemon-reload
+systemctl --user enable --now kbd-backlight-auto.service
+{{ end -}}
diff --git a/root/.chezmoiscripts/run_onchange_after_07-omarchy-theme.sh.tmpl b/root/.chezmoiscripts/run_onchange_after_07-omarchy-theme.sh.tmpl
new file mode 100644
index 0000000..3d32dfc
--- /dev/null
+++ b/root/.chezmoiscripts/run_onchange_after_07-omarchy-theme.sh.tmpl
@@ -0,0 +1,62 @@
+{{ if .isOmarchy -}}
+{{- $themeRoot := joinPath .chezmoi.sourceDir "private_dot_config/omarchy/themes" -}}
+{{- $themes := list -}}
+{{- range (output "sh" "-c" (printf "ls -1 %s 2>/dev/null || true" ($themeRoot | squote)) | trim | splitList "\n") -}}
+{{-   if . }}{{ $themes = append $themes . }}{{ end -}}
+{{- end -}}
+#!/bin/bash
+
+# Regenerate a managed theme's derived files — without ever choosing the theme.
+#
+# The split is deliberate: theme *definitions* are synced, so every machine has
+# them available in the switcher, but the *active selection* is not. That is
+# what lets two machines running these same dotfiles look completely different,
+# and it means `omarchy theme set` is yours alone — nothing here will ever
+# switch a theme out from under you.
+#
+# There is still one thing to do. Omarchy compiles a theme's colors.toml into
+# per-application files (ghostty.conf, claude.json, btop.theme, …) at the moment
+# a theme is set or refreshed, not on demand. So when chezmoi changes the
+# colors.toml of the theme this particular machine happens to be using, those
+# derived files are stale until something regenerates them. Hence: refresh if
+# and only if the active theme is one we manage, and otherwise do nothing.
+#
+# Re-runs whenever any managed theme's files change:
+# themes-hash: {{ output "sh" "-c" (printf "find %s -type f -print0 2>/dev/null | sort -z | xargs -0 sha256sum 2>/dev/null | sha256sum | cut -d' ' -f1" ($themeRoot | squote)) | trim }}
+
+set -euo pipefail
+
+# Theme directories this repo ships, enumerated from the source tree at render
+# time — adding a custom theme needs no change to this script.
+managed_themes=({{ range $themes }}{{ . | quote }} {{ end }})
+((${#managed_themes[@]})) || exit 0
+
+# A TTY bootstrap or a container has no compositor to reload and no shell to
+# talk to. The theme files are on disk either way, and the next graphical
+# session compiles them when a theme is next set.
+if [[ -z ${HYPRLAND_INSTANCE_SIGNATURE:-} ]]; then
+    echo "omarchy-theme: no Hyprland session, nothing to refresh"
+    exit 0
+fi
+
+# `omarchy theme current` prints the display name ("Portland Head"), not the
+# directory slug, so compare on a normalized form.
+current="$(omarchy theme current 2>/dev/null | tr '[:upper:] ' '[:lower:]-')" || current=""
+if [[ -z $current ]]; then
+    echo "omarchy-theme: could not determine the active theme, leaving it alone"
+    exit 0
+fi
+
+for theme in "${managed_themes[@]}"; do
+    if [[ $current == "$theme" ]]; then
+        # `omarchy theme refresh` re-runs theme-set against the *currently
+        # selected* theme, which recompiles every derived file and restarts what
+        # needs restarting. It never changes which theme is selected.
+        echo "omarchy-theme: '$theme' is active and its files changed, refreshing"
+        omarchy theme refresh || true
+        exit 0
+    fi
+done
+
+echo "omarchy-theme: active theme '$current' is not managed here, leaving it alone"
+{{ end -}}
diff --git a/root/.chezmoiscripts/run_onchange_after_08-fish-plugins.sh.tmpl b/root/.chezmoiscripts/run_onchange_after_08-fish-plugins.sh.tmpl
new file mode 100644
index 0000000..71d4a47
--- /dev/null
+++ b/root/.chezmoiscripts/run_onchange_after_08-fish-plugins.sh.tmpl
@@ -0,0 +1,35 @@
+{{ if ne .chezmoi.os "windows" -}}
+#!/bin/bash
+
+# Install the fish plugins declared in config.fish (via fundle).
+#
+# This lives here rather than in install.sh so that every platform gets it.
+# install.sh is Linux-only, so on macOS -- which applies chezmoi directly --
+# `fundle install` was never run at all and the plugins listed in config.fish
+# silently never appeared.
+#
+# Re-runs whenever the plugin list changes, since that list lives in the fish
+# config itself:
+# fish config hash: {{ include "private_dot_config/fish/config.fish.tmpl" | sha256sum }}
+
+set -uo pipefail
+
+if ! command -v fish >/dev/null 2>&1; then
+    echo "fish not found, skipping plugin install"
+    exit 0
+fi
+
+# fundle is vendored to fish/functions/fundle.fish, which chezmoi has written by
+# the time an after-script runs — but not on a machine where .config/fish is
+# ignored, so check rather than assume.
+if [[ ! -f "{{ .chezmoi.homeDir }}/.config/fish/functions/fundle.fish" ]]; then
+    echo "fundle not present, skipping plugin install"
+    exit 0
+fi
+
+# Cloning plugins needs the network. A failure here should not abort an apply
+# that has otherwise succeeded; the next apply retries.
+if ! fish -c "fundle install" 2>&1; then
+    echo "[WARN] fundle install failed (offline?); plugins will retry on the next apply" >&2
+fi
+{{ end -}}
diff --git a/root/.chezmoiscripts/run_onchange_before_10-build-kbd-backlight.sh.tmpl b/root/.chezmoiscripts/run_onchange_before_10-build-kbd-backlight.sh.tmpl
new file mode 100644
index 0000000..6aa0cfe
--- /dev/null
+++ b/root/.chezmoiscripts/run_onchange_before_10-build-kbd-backlight.sh.tmpl
@@ -0,0 +1,30 @@
+{{ if and .isOmarchy .isThinkPad -}}
+#!/bin/bash
+
+# Compile the keyboard-backlight daemon before any file is applied.
+#
+# This is a run_before on purpose: if the C source stops compiling, the apply
+# aborts here with nothing half-written, rather than after the unit file has
+# already been replaced. gcc and make are present on every Omarchy install
+# (base-devel).
+#
+# The build runs out of a temporary copy of the source rather than out of
+# ~/.local/src, because run_before scripts execute before chezmoi has written
+# that directory -- on a fresh machine it does not exist yet.
+#
+# source-hash: {{ include (joinPath .chezmoi.sourceDir "dot_local/src/kbd-backlight-auto/kbd-backlight-auto.c") | sha256sum }}
+# makefile-hash: {{ include (joinPath .chezmoi.sourceDir "dot_local/src/kbd-backlight-auto/Makefile") | sha256sum }}
+
+set -euo pipefail
+
+src={{ joinPath .chezmoi.sourceDir "dot_local/src/kbd-backlight-auto" | quote }}
+build="$(mktemp -d)"
+trap 'rm -rf "$build"' EXIT
+
+cp "$src"/kbd-backlight-auto.c "$src"/Makefile "$build/"
+make -C "$build" install PREFIX="$HOME/.local"
+
+# No-op until 06-systemd-user has enabled the unit (first run); afterwards this
+# is what picks up a newly built binary.
+systemctl --user try-restart kbd-backlight-auto.service 2>/dev/null || true
+{{ end -}}
diff --git a/root/.chezmoitemplates/pwsh-rcd b/root/.chezmoitemplates/pwsh-rcd
new file mode 100644
index 0000000..72be974
--- /dev/null
+++ b/root/.chezmoitemplates/pwsh-rcd
@@ -0,0 +1,9 @@
+# Load PowerShell drop-ins. Mirrors ~/.config/sh/rc.d for bash and zsh: every
+# piece of this configuration is one numbered file, so this profile stays a
+# loader that never needs to change again.
+$rcDir = Join-Path $HOME ".config" "pwsh" "rc.d"
+if (Test-Path $rcDir) {
+    foreach ($rc in Get-ChildItem -Path $rcDir -Filter *.ps1 | Sort-Object Name) {
+        . $rc.FullName
+    }
+}
diff --git a/root/.chezmoitemplates/shell-rcd b/root/.chezmoitemplates/shell-rcd
new file mode 100644
index 0000000..bdae5d5
--- /dev/null
+++ b/root/.chezmoitemplates/shell-rcd
@@ -0,0 +1,9 @@
+# Load POSIX-shell drop-ins. Every shell-agnostic piece of this configuration
+# lives in one numbered file under ~/.config/sh/rc.d, so ~/.bashrc and ~/.zshrc
+# stay thin loaders that never need to change again — which is what lets a
+# distro that owns the rc file (Omarchy) keep its own copy above this line.
+# fish is the exception: it has a native conf.d and uses that instead.
+for _rc in "$HOME/.config/sh/rc.d"/*.sh; do
+    [ -r "$_rc" ] && . "$_rc"
+done
+unset _rc
diff --git a/root/Documents/PowerShell/Microsoft.PowerShell_profile.ps1.tmpl b/root/Documents/PowerShell/Microsoft.PowerShell_profile.ps1.tmpl
index 8db2617..c0a68d9 100644
--- a/root/Documents/PowerShell/Microsoft.PowerShell_profile.ps1.tmpl
+++ b/root/Documents/PowerShell/Microsoft.PowerShell_profile.ps1.tmpl
@@ -1,34 +1 @@
-# Add .local/bin to PATH
-$localBin = Join-Path $HOME ".local" "bin"
-if (Test-Path $localBin) {
-    $env:PATH = "$localBin;$env:PATH"
-}
-
-# Environment variables
-{{ template "env-powershell" . }}
-
-
-# Mise activation
-if (Get-Command mise -ErrorAction SilentlyContinue) {
-    (&mise activate pwsh) | Out-String | Invoke-Expression
-}
-
-# Tools must be enabled after Mise is activated, since they are managed by Mise
-
-# Starship prompt
-if (Get-Command starship -ErrorAction SilentlyContinue) {
-    Invoke-Expression (&starship init powershell)
-}
-
-# Zoxide
-if (Get-Command zoxide -ErrorAction SilentlyContinue) {
-    Invoke-Expression (& { (zoxide init powershell | Out-String) })
-}
-
-# Write ~/work.email and re-apply dotfiles so the work identity takes effect.
-# Windows counterpart of the bash script at ~/.local/bin/set-work-email.
-function set-work-email {
-    param([Parameter(Mandatory)][string]$Address)
-    Set-Content -Path (Join-Path $HOME "work.email") -Value $Address -NoNewline
-    chezmoi init --apply
-}
+{{ template "pwsh-rcd" . }}
diff --git a/root/dot_bashrc.tmpl b/root/dot_bashrc.tmpl
index e90bae4..6bbce2d 100644
--- a/root/dot_bashrc.tmpl
+++ b/root/dot_bashrc.tmpl
@@ -1,44 +1,17 @@
-{{ if .isMac -}}
-# Homebrew completion (macOS)
-if command -v brew >/dev/null 2>&1; then
-    eval "$(brew shellenv)"
-    if [[ -r "$(brew --prefix)/etc/profile.d/bash_completion.sh" ]]; then
-        source "$(brew --prefix)/etc/profile.d/bash_completion.sh"
-    fi
-fi
-{{- end }}
-
-export PATH="{{ .binDirAbs }}:$PATH"
-{{ template "env-posix" . }}
-
-# Initialize starship prompt
-if command -v starship >/dev/null 2>&1; then
-    eval "$(starship init bash)"
-fi
-
-# Initialize tools
-if command -v mise >/dev/null 2>&1; then
-    eval "$(mise activate bash --shims)"
-fi
-
-if command -v zoxide >/dev/null 2>&1; then
-    eval "$(zoxide init bash)"
-fi
-
-if command -v mcfly >/dev/null 2>&1; then
-    eval "$(mcfly init bash)"
-fi
-
-[[ "$TERM_PROGRAM" == "vscode" ]] && . "$(code --locate-shell-integration-path bash)"
-
-fzkill() {
-    ps -eo pid,args,%mem,%cpu | fzf --multi --header-lines=1 | awk '{print $1}' | xargs kill "$@"
-}
-
-# History settings
-HISTFILE=~/.bash_history
-HISTSIZE=20000
-HISTFILESIZE=20000
-HISTCONTROL=ignoreboth:erasedups
-shopt -s histappend
-shopt -s cmdhist
+{{ if .isOmarchy -}}
+# Omarchy environment (OMARCHY_PATH + PATH), needed even for non-interactive shells.
+# Kept byte-for-byte from Omarchy's /etc/skel/.bashrc: `bash -lc`, SSH commands
+# and omarchy-launch-floating-terminal (a `bash -c`) all lose OMARCHY_PATH and
+# the mise/~/.local/bin PATH entries without it, and it has to sit above the
+# interactivity guard to reach them.
+[[ -r /usr/share/omarchy/default/bash/env-bootstrap ]] && source /usr/share/omarchy/default/bash/env-bootstrap
+
+# If not running interactively, don't do anything else (leave this above the rc source)
+[[ $- != *i* ]] && return
+
+# All the default Omarchy aliases and functions
+# (don't mess with these directly, just overwrite them here!)
+source "$OMARCHY_PATH/default/bash/rc"
+
+{{ end -}}
+{{ template "shell-rcd" . }}
diff --git a/root/dot_claude/executable_statusline.sh b/root/dot_claude/executable_statusline.sh
index 1140d8c..a4b02c4 100644
--- a/root/dot_claude/executable_statusline.sh
+++ b/root/dot_claude/executable_statusline.sh
@@ -26,8 +26,8 @@ bar_width=15
 filled=$((context_percent * bar_width / 100))
 empty=$((bar_width - filled))
 bar=""
-for ((i=0; i<filled; i++)); do bar+="█"; done
-for ((i=0; i<empty; i++)); do bar+="░"; done
+for ((i = 0; i < filled; i++)); do bar+="█"; done
+for ((i = 0; i < empty; i++)); do bar+="░"; done
 
 # Extract cost information
 session_cost=$(echo "$input" | jq -r '.cost.total_cost_usd // empty')
@@ -51,24 +51,24 @@ cd "$current_dir" 2>/dev/null || cd /
 # Get git branch
 if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
     branch=$(git branch --show-current 2>/dev/null || echo "detached")
-    
+
     # Get git status with file counts
     status_output=$(git status --porcelain 2>/dev/null)
-    
+
     if [ -n "$status_output" ]; then
         # Count files and get basic line stats
         total_files=$(echo "$status_output" | wc -l | xargs)
         line_stats=$(git diff --numstat HEAD 2>/dev/null | awk '{added+=$1; removed+=$2} END {print added+0, removed+0}')
-        
+
         added=$(echo $line_stats | cut -d' ' -f1)
         removed=$(echo $line_stats | cut -d' ' -f2)
-        
+
         # Build status display
         git_info=" ${YELLOW}($branch${NC} ${YELLOW}|${NC} ${GRAY}${total_files} files${NC}"
-        
+
         [ "$added" -gt 0 ] && git_info="${git_info} ${GREEN}+${added}${NC}"
         [ "$removed" -gt 0 ] && git_info="${git_info} ${RED}-${removed}${NC}"
-        
+
         git_info="${git_info} ${YELLOW})${NC}"
     else
         git_info=" ${YELLOW}($branch)${NC}"
@@ -87,4 +87,4 @@ fi
 context_info="${GRAY}${bar}${NC} ${context_percent}%"
 
 # Output the status line
-echo -e "${BLUE}${dir_name}${NC} ${GRAY}|${NC} ${CYAN}${model_name}${NC} ${GRAY}|${NC} ${context_info}${git_info:+ ${GRAY}|${NC}}${git_info}${cost_info}"
\ No newline at end of file
+echo -e "${BLUE}${dir_name}${NC} ${GRAY}|${NC} ${CYAN}${model_name}${NC} ${GRAY}|${NC} ${context_info}${git_info:+ ${GRAY}|${NC}}${git_info}${cost_info}"
diff --git a/root/dot_claude/hooks/executable_block-dangerous-git.sh b/root/dot_claude/hooks/executable_block-dangerous-git.sh
index 7476fd1..d715642 100755
--- a/root/dot_claude/hooks/executable_block-dangerous-git.sh
+++ b/root/dot_claude/hooks/executable_block-dangerous-git.sh
@@ -7,20 +7,20 @@ INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command')
 
 DANGEROUS_PATTERNS=(
-  # Pushing (any form)
-  "git push"
-  # Destructive resets
-  "git reset --hard"
-  # Cleaning untracked files
-  "git clean -f"
-  # Force-deleting branches
-  "git branch -D"
-  # Discarding all working tree changes
-  "git checkout \."
-  "git restore \."
-  # Dropping stashes
-  "git stash drop"
-  "git stash clear"
+    # Pushing (any form)
+    "git push"
+    # Destructive resets
+    "git reset --hard"
+    # Cleaning untracked files
+    "git clean -f"
+    # Force-deleting branches
+    "git branch -D"
+    # Discarding all working tree changes
+    "git checkout \."
+    "git restore \."
+    # Dropping stashes
+    "git stash drop"
+    "git stash clear"
 )
 
 # Only match a pattern when it begins an actual command — at the start of the
@@ -30,10 +30,10 @@ DANGEROUS_PATTERNS=(
 BOUNDARY='(^|[;&|(]|&&|\|\|)[[:space:]]*'
 
 for pattern in "${DANGEROUS_PATTERNS[@]}"; do
-  if echo "$COMMAND" | grep -qE "${BOUNDARY}${pattern}"; then
-    echo "BLOCKED: '$COMMAND' matches dangerous pattern '$pattern'. The user has prevented you from doing this." >&2
-    exit 2
-  fi
+    if echo "$COMMAND" | grep -qE "${BOUNDARY}${pattern}"; then
+        echo "BLOCKED: '$COMMAND' matches dangerous pattern '$pattern'. The user has prevented you from doing this." >&2
+        exit 2
+    fi
 done
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/root/dot_claude/settings.json.tmpl b/root/dot_claude/settings.json.tmpl
index f51ef05..43491dd 100644
--- a/root/dot_claude/settings.json.tmpl
+++ b/root/dot_claude/settings.json.tmpl
@@ -1,5 +1,8 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
+{{- if .isOmarchy }}
+  "theme": "custom:omarchy",
+{{- end }}
   "alwaysThinkingEnabled": true,
   "showThinkingSummaries": true,
   "effortLevel": "high",
@@ -10,11 +13,6 @@
     "OTEL_METRICS_EXPORTER": "otlp",
     "OTEL_LOGS_EXPORTER": "otlp",
     "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
-    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
-    "OTEL_EXPORTER_OTLP_ENDPOINT": "{{ if or .isPersonal (eq .identity "journalytic") }}http://docker-infra.vm.seese.xyz:4317{{ else if eq .identity "kirbtech" }}http://localhost:4317{{ end }}",
-    "OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE": "cumulative",
-    "OTEL_METRIC_EXPORT_INTERVAL": "10000",
-    "OTEL_LOGS_EXPORT_INTERVAL": "5000"
   },
   "permissions": {
     "allow": [
diff --git a/root/dot_local/bin/executable_clean b/root/dot_local/bin/executable_clean
index 43ae7ab..a4cd556 100644
--- a/root/dot_local/bin/executable_clean
+++ b/root/dot_local/bin/executable_clean
@@ -10,6 +10,12 @@ set -eufo pipefail
 
 step() { printf '\n\033[1;34m==>\033[0m \033[1m%s\033[0m\n' "$1"; }
 
+# Omarchy prunes packages its own way, and the differences are not cosmetic --
+# see the pacman branch below. Same detection as `update`.
+is_omarchy() {
+    [[ -r /etc/os-release ]] && grep -q '^ID=omarchy$' /etc/os-release
+}
+
 case "$(uname -s)" in
 Darwin)
     step "Pruning Homebrew packages and caches"
@@ -17,7 +23,23 @@ Darwin)
     brew cleanup --prune=all
     ;;
 Linux)
-    if command -v apt-get >/dev/null 2>&1; then
+    if is_omarchy; then
+        # Omarchy differs from plain Arch on both halves of this, and getting
+        # either wrong is destructive rather than merely untidy:
+        #
+        #   - The package cache is Omarchy's ONLY offline downgrade path, so it
+        #     keeps two versions per package (omarchy-update-pkg-prune runs
+        #     `paccache -rk2`). `pacman -Sc` would empty it and take the ability
+        #     to roll back a bad update with it.
+        #   - Orphans are reviewed, not assumed: omarchy-update-orphan-pkgs
+        #     lists them and asks, defaulting to no. Removing them unattended
+        #     here would undo that deliberate choice.
+        step "Pruning the package cache (keeping 2 versions per package)"
+        sudo paccache -rk2
+
+        step "Reviewing orphaned packages"
+        omarchy-update-orphan-pkgs
+    elif command -v apt-get >/dev/null 2>&1; then
         step "Pruning apt packages and caches"
         sudo apt-get autoremove --purge -y
         sudo apt-get clean
diff --git a/root/dot_local/bin/executable_dotfiles-status b/root/dot_local/bin/executable_dotfiles-status
new file mode 100755
index 0000000..ceb08ae
--- /dev/null
+++ b/root/dot_local/bin/executable_dotfiles-status
@@ -0,0 +1,155 @@
+#!/bin/bash
+
+# One-line JSON summary of the dotfiles' state, shared by the carson.dotfiles
+# bar widget, the Omarchy menu's Dotfiles submenu, and dotfiles-sync.
+#
+#   {"applyNeeded":3,"localEdits":1,"behind":2,"ahead":0,"uncommitted":4,
+#    "ok":true,"files":[{"path":".config/hypr/input.lua","status":"MM",
+#                        "added":12,"removed":3}]}
+#
+# "files" lists what an apply would change, newest information first for the bar
+# widget's tooltip. Counts come from a single `chezmoi diff` (~60ms here, and
+# binaries are summarized rather than embedded, so it stays small).
+#
+# Three hard rules, because a bar widget polls this unattended:
+#   - never prompt (a credential prompt would hang the shell's Process forever)
+#   - never block on the network for long (hence the fetch timeout)
+#   - never exit nonzero; a failure sets "ok":false and still prints valid JSON
+#
+# Managed by chezmoi; installed to ~/.local/bin so it works from any shell.
+
+set -uo pipefail
+
+fetch=false
+case "${1:-}" in
+--fetch) fetch=true ;;
+"") ;;
+-h | --help)
+    echo "Usage: dotfiles-status [--fetch]"
+    echo "  --fetch  contact the remote to compute behind/ahead (adds latency)"
+    exit 0
+    ;;
+*)
+    echo "dotfiles-status: unknown option $1" >&2
+    exit 2
+    ;;
+esac
+
+apply_needed=0
+local_edits=0
+uncommitted=0
+behind=0
+ahead=0
+ok=true
+
+files_json="[]"
+
+emit() {
+    printf '{"applyNeeded":%d,"localEdits":%d,"behind":%d,"ahead":%d,"uncommitted":%d,"ok":%s,"files":%s}\n' \
+        "$apply_needed" "$local_edits" "$behind" "$ahead" "$uncommitted" "$ok" "$files_json"
+    exit 0
+}
+
+command -v chezmoi >/dev/null 2>&1 || {
+    ok=false
+    emit
+}
+
+# `chezmoi status` is shaped like `git status --short`: column 1 is the target
+# having changed out from under chezmoi since it last wrote it (an Omarchy
+# migration, `omarchy refresh`, a hand edit), column 2 is the source state being
+# ahead of the target (an apply would change something).
+declare -A status_code=()
+if status="$(chezmoi status 2>/dev/null)"; then
+    while IFS= read -r line; do
+        [[ -n $line ]] || continue
+        # Scripts are reported as a run ('R' in column 2) rather than a file
+        # change. They are not drift and there is nothing to show a diff for.
+        [[ ${line:3} == .chezmoiscripts/* ]] && continue
+        [[ ${line:0:1} != " " ]] && ((++local_edits))
+        [[ ${line:1:1} != " " ]] && ((++apply_needed))
+        status_code["${line:3}"]="${line:0:2}"
+    done <<<"$status"
+else
+    ok=false
+fi
+
+# Per-file added/removed line counts, from one `chezmoi diff`. Parsed here
+# rather than shelled out to git, so this works outside a work tree and cannot
+# be tripped by a patch git declines to apply.
+build_files_json() {
+    local diff_out
+    diff_out="$(chezmoi diff 2>/dev/null)" || return 1
+    [[ -n $diff_out ]] || return 0
+
+    local counts
+    # Only lines inside a hunk are counted. Matching on "^--- " instead would
+    # misread a removed Lua comment ("-- three-finger swipe") as a diff header,
+    # and the Hyprland configs are full of those.
+    counts="$(awk '
+        /^diff --git a\// {
+            path = $3; sub(/^a\//, "", path)
+            order[++n] = path
+            in_hunk = 0
+            next
+        }
+        # Binary payloads are summarized by chezmoi, not embedded, so there are
+        # no +/- lines to count for them.
+        /^Binary files / { binary[path] = 1; next }
+        # A directory is a mode 40xxx entry. Creating one is a real change, but
+        # it has no line diff and listing it only pushes real files out of the
+        # tooltip, so drop it from the list.
+        /^(new|deleted) file mode 40[0-7][0-7][0-7]$/ { isdir[path] = 1; next }
+        /^@@ / { in_hunk = 1; next }
+        !in_hunk { next }
+        /^\+/ { added[path]++ ; next }
+        /^-/  { removed[path]++ }
+        END {
+            for (i = 1; i <= n; i++) {
+                p = order[i]
+                if (seen[p]++ || isdir[p]) continue
+                printf "%s\t%d\t%d\t%d\n", p, added[p] + 0, removed[p] + 0, binary[p] + 0
+            }
+        }
+    ' <<<"$diff_out")"
+
+    local json="" path added removed binary code sep=""
+    while IFS=$'\t' read -r path added removed binary; do
+        [[ -n $path ]] || continue
+        [[ $path == .chezmoiscripts/* ]] && continue
+        code="${status_code[$path]:-  }"
+        # Escape the two characters that can appear in a path and break JSON.
+        path="${path//\\/\\\\}"
+        path="${path//\"/\\\"}"
+        json+="${sep}{\"path\":\"${path}\",\"status\":\"${code}\",\"added\":${added},\"removed\":${removed},\"binary\":$([[ $binary == 1 ]] && echo true || echo false)}"
+        sep=","
+    done <<<"$counts"
+    files_json="[${json}]"
+}
+
+build_files_json || ok=false
+
+if porcelain="$(chezmoi git -- status --porcelain 2>/dev/null)"; then
+    [[ -n $porcelain ]] && uncommitted="$(grep -c '^' <<<"$porcelain")"
+else
+    ok=false
+fi
+
+if $fetch; then
+    # GIT_TERMINAL_PROMPT=0 turns a credential prompt into an immediate failure
+    # rather than a hang; timeout covers a network that accepts but never answers.
+    GIT_TERMINAL_PROMPT=0 timeout 15 chezmoi git -- fetch --quiet >/dev/null 2>&1 || ok=false
+fi
+
+# Left side of the range is the upstream, right side is HEAD: "<behind> <ahead>".
+# Fails when there is no upstream configured, which is genuinely unknown rather
+# than zero, so it counts as not-ok.
+if counts="$(chezmoi git -- rev-list --left-right --count '@{u}...HEAD' 2>/dev/null)" &&
+    [[ $counts =~ ^([0-9]+)[[:space:]]+([0-9]+)$ ]]; then
+    behind="${BASH_REMATCH[1]}"
+    ahead="${BASH_REMATCH[2]}"
+else
+    ok=false
+fi
+
+emit
diff --git a/root/dot_local/bin/executable_dotfiles-sync b/root/dot_local/bin/executable_dotfiles-sync
new file mode 100755
index 0000000..5822377
--- /dev/null
+++ b/root/dot_local/bin/executable_dotfiles-sync
@@ -0,0 +1,167 @@
+#!/bin/bash
+
+# Interactive front-end for keeping the dotfiles and this machine in step.
+#
+# Bare, it shows a gum picker (the look Omarchy's floating terminals use) and is
+# what the carson.dotfiles bar widget opens on a left click. With a subcommand
+# it is fully non-interactive, which is what the widget's right click, the
+# Omarchy menu entries, and any script should use.
+#
+# Managed by chezmoi; installed to ~/.local/bin so it works from any shell.
+
+set -uo pipefail
+
+step() { printf '\n\033[1;34m==>\033[0m \033[1m%s\033[0m\n' "$1"; }
+die() {
+    printf '\033[0;31m%s\033[0m\n' "$1" >&2
+    exit 1
+}
+
+usage() {
+    cat <<'USAGE'
+Usage: dotfiles-sync [command]
+
+With no command, opens an interactive picker.
+
+Commands:
+  pull      Pull the latest dotfiles and apply them (chezmoi update)
+  apply     Apply the current source state without pulling
+  diff      Show what an apply would change
+  re-add    Re-add targets that were edited out of band, into the source
+  commit    Open lazygit in the dotfiles source directory
+  update    Full system update (packages, mise, chezmoi, dotfiles)
+  status    Print the JSON status summary
+USAGE
+}
+
+# Targets whose column 1 is non-empty in `chezmoi status`: the file on disk
+# changed after chezmoi last wrote it.
+drifted_targets() {
+    chezmoi status 2>/dev/null | awk 'substr($0,1,1) != " " { print substr($0,4) }'
+}
+
+do_pull() {
+    step "Pulling latest dotfiles and applying"
+    chezmoi update
+}
+
+do_apply() {
+    step "Applying the current source state"
+    chezmoi apply
+}
+
+do_diff() {
+    step "Pending changes"
+    chezmoi diff
+}
+
+do_readd() {
+    local targets=()
+    mapfile -t targets < <(drifted_targets)
+    if ((${#targets[@]} == 0)); then
+        step "Nothing has drifted; no targets to re-add"
+        return 0
+    fi
+
+    step "Re-adding ${#targets[@]} drifted target(s) into the source"
+    printf '  %s\n' "${targets[@]}"
+
+    # No arguments on purpose: bare `chezmoi re-add` re-adds exactly the
+    # modified targets, which is the same set listed above, and avoids having to
+    # rebuild absolute paths from status output.
+    chezmoi re-add
+}
+
+do_commit() {
+    local src
+    src="$(chezmoi source-path)" || die "could not locate the dotfiles source directory"
+    step "Opening lazygit in $src"
+    if command -v lazygit >/dev/null 2>&1; then
+        (cd "$src" && lazygit)
+    else
+        (cd "$src" && git status)
+        echo "lazygit is not installed; showing git status instead" >&2
+    fi
+}
+
+do_update() {
+    step "Full system update"
+    if command -v update >/dev/null 2>&1; then
+        update
+    else
+        die "the 'update' command is not installed"
+    fi
+}
+
+# --help must work on a machine that has not been provisioned yet.
+if [[ ${1:-} != "-h" && ${1:-} != "--help" ]]; then
+    command -v chezmoi >/dev/null 2>&1 || die "chezmoi is not installed"
+fi
+
+case "${1:-}" in
+pull)
+    do_pull
+    exit $?
+    ;;
+apply)
+    do_apply
+    exit $?
+    ;;
+diff)
+    do_diff
+    exit $?
+    ;;
+re-add | readd)
+    do_readd
+    exit $?
+    ;;
+commit)
+    do_commit
+    exit $?
+    ;;
+update)
+    do_update
+    exit $?
+    ;;
+status) exec dotfiles-status --fetch ;;
+-h | --help)
+    usage
+    exit 0
+    ;;
+"") ;;
+*)
+    usage >&2
+    exit 2
+    ;;
+esac
+
+# ---- interactive ----------------------------------------------------------
+
+command -v gum >/dev/null 2>&1 || die "gum is not installed (needed for the interactive menu)"
+command -v jq >/dev/null 2>&1 || die "jq is not installed (needed to read the status summary)"
+
+read -r applyNeeded localEdits behind ahead uncommitted < <(
+    dotfiles-status --fetch | jq -r '[.applyNeeded,.localEdits,.behind,.ahead,.uncommitted] | @tsv' 2>/dev/null
+) || true
+
+gum style --border rounded --padding "0 1" --margin "1 0" \
+    "Dotfiles" \
+    "apply pending: ${applyNeeded:-?}   drifted: ${localEdits:-?}" \
+    "behind: ${behind:-?}   ahead: ${ahead:-?}   uncommitted: ${uncommitted:-?}"
+
+choice="$(gum choose --header "What would you like to do?" \
+    "Pull & apply" \
+    "Show diff" \
+    "Re-add local edits" \
+    "Commit & push" \
+    "Full update" \
+    "Quit")" || exit 0
+
+case "$choice" in
+"Pull & apply") do_pull ;;
+"Show diff") do_diff ;;
+"Re-add local edits") do_readd ;;
+"Commit & push") do_commit ;;
+"Full update") do_update ;;
+*) exit 0 ;;
+esac
diff --git a/root/dot_local/bin/executable_update b/root/dot_local/bin/executable_update
index fb9eb0a..49b3d4c 100644
--- a/root/dot_local/bin/executable_update
+++ b/root/dot_local/bin/executable_update
@@ -9,23 +9,33 @@ set -eufo pipefail
 
 step() { printf '\n\033[1;34m==>\033[0m \033[1m%s\033[0m\n' "$1"; }
 
+# Omarchy routes every system update through `omarchy update`, and enforces it:
+# a libalpm hook (00-omarchy-update-guard) aborts any direct `pacman -Syu`.
+is_omarchy() {
+    [[ -r /etc/os-release ]] && grep -q '^ID=omarchy$' /etc/os-release
+}
+
 # Everything lives inside main so bash parses the whole script before any of
 # it runs: `chezmoi update` below re-applies the dotfiles, which can rewrite
 # this very file mid-execution.
 main() {
-    step "Updating system packages"
-    case "$(uname -s)" in
-    Darwin)
-        brew update && brew upgrade
-        ;;
-    Linux)
-        if command -v apt-get >/dev/null 2>&1; then
-            sudo apt-get update && sudo apt-get upgrade -y
-        elif command -v pacman >/dev/null 2>&1; then
-            sudo pacman -Syu --noconfirm
-        fi
-        ;;
-    esac
+    # Omarchy is the exception to going first: its update step runs last, at the
+    # bottom of main(). See the comment there.
+    if ! is_omarchy; then
+        step "Updating system packages"
+        case "$(uname -s)" in
+        Darwin)
+            brew update && brew upgrade
+            ;;
+        Linux)
+            if command -v apt-get >/dev/null 2>&1; then
+                sudo apt-get update && sudo apt-get upgrade -y
+            elif command -v pacman >/dev/null 2>&1; then
+                sudo pacman -Syu --noconfirm
+            fi
+            ;;
+        esac
+    fi
 
     if command -v mise >/dev/null 2>&1; then
         step "Updating mise"
@@ -37,8 +47,19 @@ main() {
 
     # Upgrade the chezmoi binary before pulling the dotfiles: newer templates
     # may require a newer chezmoi (.chezmoiversion).
+    #
+    # `chezmoi upgrade` replaces the binary in place, so it only works on a copy
+    # this user owns. A package-managed chezmoi (Omarchy and Arch install it
+    # from extra/, Homebrew from its own prefix) is root-owned and updated by
+    # the system-package step above -- same reasoning as the mise step. Testing
+    # writability rather than the distro covers every packager at once.
     step "Updating chezmoi"
-    chezmoi upgrade
+    chezmoi_bin="$(command -v chezmoi)"
+    if [[ -w $chezmoi_bin ]]; then
+        chezmoi upgrade
+    else
+        echo "chezmoi is package-managed ($chezmoi_bin), updated with system packages"
+    fi
 
     step "Pulling latest dotfiles and applying"
     chezmoi update
@@ -49,6 +70,22 @@ main() {
         mise upgrade
     fi
 
+    # Omarchy last, deliberately. `omarchy update` ends in
+    # omarchy-update-restart, which calls `gum confirm "... Reboot?"` and, on
+    # yes, reboots then and there. `-y` does not prevent that: it exports
+    # OMARCHY_UPDATE_UNATTENDED, but nothing under $OMARCHY_PATH reads that
+    # variable, so the prompt still appears. Running it first meant a kernel
+    # upgrade could take the machine down before the dotfiles were ever pulled,
+    # leaving a half-done update that looked like a finished one.
+    #
+    # Nothing above needs it to have run: chezmoi and mise are both already
+    # installed, and the package-managed guards skip their own self-updates
+    # precisely because this step is what updates them.
+    if is_omarchy; then
+        step "Updating Omarchy and system packages"
+        omarchy update -y
+    fi
+
     step "Update complete"
 }
 
diff --git a/root/dot_local/src/kbd-backlight-auto/Makefile b/root/dot_local/src/kbd-backlight-auto/Makefile
new file mode 100644
index 0000000..ef7979a
--- /dev/null
+++ b/root/dot_local/src/kbd-backlight-auto/Makefile
@@ -0,0 +1,13 @@
+CFLAGS ?= -O2 -Wall -Wextra -std=c11 -D_FORTIFY_SOURCE=2
+PREFIX ?= $(HOME)/.local
+
+kbd-backlight-auto: kbd-backlight-auto.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+install: kbd-backlight-auto
+	install -Dm755 kbd-backlight-auto $(PREFIX)/bin/kbd-backlight-auto
+
+clean:
+	rm -f kbd-backlight-auto
+
+.PHONY: install clean
diff --git a/root/dot_local/src/kbd-backlight-auto/kbd-backlight-auto.c b/root/dot_local/src/kbd-backlight-auto/kbd-backlight-auto.c
new file mode 100644
index 0000000..18522c7
--- /dev/null
+++ b/root/dot_local/src/kbd-backlight-auto/kbd-backlight-auto.c
@@ -0,0 +1,428 @@
+/*
+ * kbd-backlight-auto - macOS-style keyboard backlight for the ThinkPad T14 Gen 2i.
+ *
+ * Lights the keyboard on the first keystroke, keeps it lit while you type, and
+ * drops it after a short idle window or as soon as the lid closes.
+ *
+ * Why a daemon at all: ThinkPad Fn+Space is handled entirely in EC firmware and
+ * never reaches Hyprland, so there is no key event a keybinding could hang off.
+ * This watches the keyboard's evdev node directly instead.
+ *
+ * Fn+Space stays your brightness control. The kernel reports firmware-driven
+ * brightness changes through the LED's brightness_hw_changed attribute, so the
+ * daemon sees your Fn+Space presses as events and adopts whatever level you
+ * pick for auto-on from then on, including 0, which reads as "leave it off".
+ *
+ * Nothing here polls. The process sits in a single poll() over three
+ * descriptors (keyboard, lid, brightness_hw_changed) and wakes only on a real
+ * event, plus once to end the idle countdown. While the keyboard is dark it
+ * blocks indefinitely at zero cost.
+ *
+ * Note on brightness_hw_changed: sysfs poll() returns POLLERR|POLLPRI
+ * immediately on the first call. You have to lseek+read once to complete the
+ * handshake, after which it blocks until the next *hardware* change and stays
+ * quiet for writes we make ourselves.
+ *
+ * Usage:
+ *   kbd-backlight-auto              run the daemon (what the systemd unit does)
+ *   kbd-backlight-auto cycle        next level, wrapping off -> low -> high -> off
+ *   kbd-backlight-auto up|down      step the level
+ *   kbd-backlight-auto set <n>      set the level outright (0 disables the light)
+ *   kbd-backlight-auto get          print the stored level
+ *
+ * Environment (the systemd unit sets these):
+ *   KBD_BACKLIGHT_IDLE   seconds of no typing before the light drops (default 8)
+ *   KBD_BACKLIGHT_LEVEL  level used before one has ever been chosen  (default 1)
+ *   KBD_BACKLIGHT_DEV    override the keyboard evdev path
+ */
+
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <glob.h>
+#include <limits.h>
+#include <poll.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+#define KBD_DEV_DEFAULT "/dev/input/by-path/platform-i8042-serio-0-event-kbd"
+#define LID_DEV         "/dev/input/by-path/platform-PNP0C0D:00-event"
+#define LID_STATE       "/proc/acpi/button/lid/LID/state"
+
+static char brightness_path[PATH_MAX];
+static char hw_changed_path[PATH_MAX];
+static char state_path[PATH_MAX];
+static int  max_level = 2;
+static int  idle_secs = 8;
+static int  default_level = 1;
+
+static volatile sig_atomic_t stop_requested = 0;
+
+static void on_signal(int sig) { (void)sig; stop_requested = 1; }
+
+/* ------------------------------------------------------------- small I/O */
+
+static int read_int_file(const char *path, int *out)
+{
+	char buf[32];
+	int fd = open(path, O_RDONLY);
+	if (fd < 0)
+		return -1;
+	ssize_t n = read(fd, buf, sizeof buf - 1);
+	close(fd);
+	if (n <= 0)
+		return -1;
+	buf[n] = '\0';
+	*out = (int)strtol(buf, NULL, 10);
+	return 0;
+}
+
+static int write_int_file(const char *path, int value)
+{
+	char buf[32];
+	int fd = open(path, O_WRONLY);
+	if (fd < 0)
+		return -1;
+	int len = snprintf(buf, sizeof buf, "%d", value);
+	ssize_t n = write(fd, buf, (size_t)len);
+	close(fd);
+	return n == len ? 0 : -1;
+}
+
+/* mkdir -p for the state file's parent. */
+static void mkdir_parents(const char *path)
+{
+	char tmp[PATH_MAX + 8];
+	snprintf(tmp, sizeof tmp, "%s", path);
+	for (char *p = tmp + 1; *p; p++) {
+		if (*p != '/')
+			continue;
+		*p = '\0';
+		mkdir(tmp, 0755);
+		*p = '/';
+	}
+}
+
+/* ------------------------------------------------------------------ LED */
+
+/*
+ * Resolve the LED by pattern so this keeps working if the node is ever renamed.
+ * The udev rule in /etc/udev/rules.d/99-kbd-backlight.rules gives group 'input'
+ * write access to brightness, so no helper and no logind session are needed.
+ */
+static int find_led(void)
+{
+	glob_t g;
+	if (glob("/sys/class/leds/*kbd_backlight*", 0, NULL, &g) != 0 || g.gl_pathc == 0) {
+		globfree(&g);
+		return -1;
+	}
+	char max_path[PATH_MAX];
+	snprintf(brightness_path, sizeof brightness_path, "%s/brightness", g.gl_pathv[0]);
+	snprintf(hw_changed_path, sizeof hw_changed_path, "%s/brightness_hw_changed", g.gl_pathv[0]);
+	snprintf(max_path, sizeof max_path, "%s/max_brightness", g.gl_pathv[0]);
+	globfree(&g);
+
+	if (read_int_file(max_path, &max_level) < 0 || max_level < 1)
+		max_level = 2;
+	return 0;
+}
+
+static int led_read(void)
+{
+	int v = 0;
+	read_int_file(brightness_path, &v);
+	return v;
+}
+
+static int led_write(int value) { return write_int_file(brightness_path, value) == 0; }
+
+/* --------------------------------------------------------------- level */
+
+static int clamp_level(int level)
+{
+	if (level < 0)
+		return 0;
+	return level > max_level ? max_level : level;
+}
+
+static int level_read(void)
+{
+	int level;
+	if (read_int_file(state_path, &level) < 0)
+		level = default_level;
+	return clamp_level(level);
+}
+
+static void level_write(int level)
+{
+	char tmp[PATH_MAX + 8];
+	mkdir_parents(state_path);
+	snprintf(tmp, sizeof tmp, "%s.tmp", state_path);
+
+	int fd = open(tmp, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+	if (fd < 0)
+		return;
+	char buf[32];
+	int len = snprintf(buf, sizeof buf, "%d\n", level);
+	if (write(fd, buf, (size_t)len) != len) {
+		close(fd);
+		unlink(tmp);
+		return;
+	}
+	close(fd);
+	rename(tmp, state_path);
+}
+
+static int lid_closed(void)
+{
+	char buf[128];
+	int fd = open(LID_STATE, O_RDONLY);
+	if (fd < 0)
+		return 0;
+	ssize_t n = read(fd, buf, sizeof buf - 1);
+	close(fd);
+	if (n <= 0)
+		return 0;
+	buf[n] = '\0';
+	return strstr(buf, "closed") != NULL;
+}
+
+/* ------------------------------------------------------------- CLI half */
+
+static void osd(int level)
+{
+	char pct[16];
+	snprintf(pct, sizeof pct, "%d", level * 100 / max_level);
+
+	pid_t pid = fork();
+	if (pid == 0) {
+		execlp("omarchy-osd", "omarchy-osd", "-i", "keyboard", "-p", pct, (char *)NULL);
+		_exit(127);
+	}
+	if (pid > 0)
+		waitpid(pid, NULL, 0);
+}
+
+static void apply_level(int level)
+{
+	level = clamp_level(level);
+	level_write(level);
+	/*
+	 * Turning off applies now; turning up only applies if the keyboard is
+	 * already lit. Lighting a dark keyboard is the daemon's job, on a keystroke.
+	 */
+	if (level == 0 || led_read() > 0)
+		led_write(level);
+	osd(level);
+	printf("%d\n", level);
+}
+
+/* --------------------------------------------------------------- daemon */
+
+static int open_input(const char *path)
+{
+	return open(path, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
+}
+
+/* Consume everything queued. Returns 0 if the device went away. */
+static int drain(int fd)
+{
+	char buf[4096];
+	for (;;) {
+		ssize_t n = read(fd, buf, sizeof buf);
+		if (n > 0)
+			continue;
+		if (n == 0)
+			return 0;
+		if (errno == EAGAIN || errno == EWOULDBLOCK)
+			return 1;
+		if (errno == EINTR)
+			continue;
+		return 0;
+	}
+}
+
+static double now_monotonic(void)
+{
+	struct timespec ts;
+	clock_gettime(CLOCK_MONOTONIC, &ts);
+	return (double)ts.tv_sec + (double)ts.tv_nsec / 1e9;
+}
+
+static int daemon_loop(const char *kbd_dev)
+{
+	int kbd_fd = open_input(kbd_dev);
+	if (kbd_fd < 0) {
+		fprintf(stderr, "cannot open %s: %s (is this user in the 'input' group?)\n",
+		        kbd_dev, strerror(errno));
+		return 1;
+	}
+	int lid_fd = open_input(LID_DEV); /* optional */
+
+	/* Firmware-driven brightness changes (Fn+Space) arrive here. */
+	int hw_fd = open(hw_changed_path, O_RDONLY | O_CLOEXEC);
+	if (hw_fd >= 0) {
+		/* Complete the sysfs poll handshake so later polls block on real changes. */
+		char scratch[32];
+		lseek(hw_fd, 0, SEEK_SET);
+		/* The value at startup is not interesting; only the re-arm matters. */
+		(void)!read(hw_fd, scratch, sizeof scratch);
+	}
+
+	struct pollfd fds[3];
+	int nfds = 0;
+	int kbd_i = nfds;
+	fds[nfds].fd = kbd_fd;   fds[nfds].events = POLLIN;  nfds++;
+	int hw_i = -1;
+	if (lid_fd >= 0) { fds[nfds].fd = lid_fd; fds[nfds].events = POLLIN; nfds++; }
+	if (hw_fd  >= 0) { hw_i  = nfds; fds[nfds].fd = hw_fd;  fds[nfds].events = POLLPRI | POLLERR; nfds++; }
+
+	int lit = 0;
+	double last_activity = 0.0;
+	led_write(0);
+
+	while (!stop_requested) {
+		/* Only the idle countdown needs a timer. Dark means block indefinitely. */
+		int timeout = -1;
+		if (lit) {
+			double remaining = idle_secs - (now_monotonic() - last_activity);
+			timeout = remaining > 0 ? (int)(remaining * 1000) : 0;
+		}
+
+		int ready = poll(fds, (nfds_t)nfds, timeout);
+		if (ready < 0) {
+			if (errno == EINTR)
+				continue;
+			break;
+		}
+
+		double now = now_monotonic();
+		int typed = 0;
+		int adopted = -1;
+
+		for (int i = 0; i < nfds; i++) {
+			if (!fds[i].revents)
+				continue;
+			if (i == hw_i) {
+				/* Must re-read to re-arm the notification. */
+				char buf[32];
+				lseek(hw_fd, 0, SEEK_SET);
+				ssize_t n = read(hw_fd, buf, sizeof buf - 1);
+				if (n > 0) {
+					buf[n] = '\0';
+					adopted = (int)strtol(buf, NULL, 10);
+				}
+				continue;
+			}
+			if (!drain(fds[i].fd)) {
+				/* Device vanished (suspend, re-enumeration). Let systemd restart us. */
+				return 0;
+			}
+			if (i == kbd_i)
+				typed = 1;
+		}
+
+		/* Fn+Space told us what "on" should mean from now on. */
+		if (adopted >= 0) {
+			adopted = clamp_level(adopted);
+			level_write(adopted);
+			lit = adopted > 0;
+			if (lit)
+				last_activity = now;
+		}
+
+		if (lid_closed()) {
+			if (lit) {
+				led_write(0);
+				lit = 0;
+			}
+		} else if (typed) {
+			last_activity = now;
+			if (!lit) {
+				int level = level_read();
+				if (level > 0 && led_write(level))
+					lit = 1;
+			}
+		} else if (lit && now - last_activity >= idle_secs) {
+			led_write(0);
+			lit = 0;
+		}
+	}
+
+	/* Leave the keyboard dark on the way out rather than stranding it lit. */
+	led_write(0);
+	return 0;
+}
+
+/* ----------------------------------------------------------------- main */
+
+int main(int argc, char **argv)
+{
+	if (find_led() < 0) {
+		fprintf(stderr, "no keyboard backlight LED found\n");
+		return 1;
+	}
+
+	const char *env;
+	if ((env = getenv("KBD_BACKLIGHT_IDLE")))
+		idle_secs = atoi(env) > 0 ? atoi(env) : idle_secs;
+	if ((env = getenv("KBD_BACKLIGHT_LEVEL")))
+		default_level = atoi(env);
+
+	const char *xdg_state = getenv("XDG_STATE_HOME");
+	if (xdg_state && *xdg_state) {
+		snprintf(state_path, sizeof state_path, "%s/kbd-backlight/level", xdg_state);
+	} else {
+		const char *home = getenv("HOME");
+		snprintf(state_path, sizeof state_path, "%s/.local/state/kbd-backlight/level",
+		         home ? home : "/tmp");
+	}
+
+	const char *cmd = argc > 1 ? argv[1] : "daemon";
+
+	if (!strcmp(cmd, "get")) {
+		printf("%d\n", level_read());
+		return 0;
+	}
+	if (!strcmp(cmd, "cycle")) {
+		apply_level((level_read() + 1) % (max_level + 1));
+		return 0;
+	}
+	if (!strcmp(cmd, "up")) {
+		apply_level(level_read() + 1);
+		return 0;
+	}
+	if (!strcmp(cmd, "down")) {
+		apply_level(level_read() - 1);
+		return 0;
+	}
+	if (!strcmp(cmd, "set")) {
+		if (argc < 3) {
+			fprintf(stderr, "usage: kbd-backlight-auto set <0-%d>\n", max_level);
+			return 1;
+		}
+		apply_level(atoi(argv[2]));
+		return 0;
+	}
+	if (strcmp(cmd, "daemon")) {
+		fprintf(stderr, "usage: kbd-backlight-auto [daemon|cycle|up|down|set <0-%d>|get]\n",
+		        max_level);
+		return 1;
+	}
+
+	struct sigaction sa = { 0 };
+	sa.sa_handler = on_signal;
+	sigaction(SIGTERM, &sa, NULL);
+	sigaction(SIGINT, &sa, NULL);
+	sigaction(SIGHUP, &sa, NULL);
+
+	env = getenv("KBD_BACKLIGHT_DEV");
+	return daemon_loop(env && *env ? env : KBD_DEV_DEFAULT);
+}
diff --git a/root/dot_zshrc.tmpl b/root/dot_zshrc.tmpl
index 2bb617f..d0e51e9 100644
--- a/root/dot_zshrc.tmpl
+++ b/root/dot_zshrc.tmpl
@@ -1,50 +1,8 @@
-{{ if .isMac -}}
-# Homebrew completion (macOS)
-if command -v brew >/dev/null 2>&1; then
-    eval "$(brew shellenv)"
-    if [[ -r "$(brew --prefix)/share/zsh/site-functions" ]]; then
-        fpath=("$(brew --prefix)/share/zsh/site-functions" $fpath)
-    fi
-fi
-{{- end }}
-
-export PATH="{{ .binDirAbs }}:$PATH"
-{{ template "env-posix" . }}
-
-# Enable completions
-autoload -U compinit && compinit
-
-# Initialize starship prompt
-if command -v starship >/dev/null 2>&1; then
-    eval "$(starship init zsh)"
-fi
-
-# Initialize tools
-if command -v mise >/dev/null 2>&1; then
-    eval "$(mise activate zsh --shims)"
-fi
-
-if command -v zoxide >/dev/null 2>&1; then
-    eval "$(zoxide init zsh)"
-fi
-
-if command -v mcfly >/dev/null 2>&1; then
-    eval "$(mcfly init zsh)"
-fi
-
-[[ "$TERM_PROGRAM" == "vscode" ]] && . "$(code --locate-shell-integration-path zsh)"
-
-fzkill() {
-    ps -eo pid,args,%mem,%cpu | fzf --multi --header-lines=1 | awk '{print $1}' | xargs kill "$@"
-}
-
-# History settings
-HISTFILE=~/.zsh_history
-HISTSIZE=20000
-SAVEHIST=20000
-setopt HIST_IGNORE_DUPS
-setopt HIST_IGNORE_ALL_DUPS
-setopt HIST_IGNORE_SPACE
-setopt HIST_SAVE_NO_DUPS
-setopt APPEND_HISTORY
-setopt SHARE_HISTORY
\ No newline at end of file
+{{ if .isOmarchy -}}
+# Omarchy publishes OMARCHY_PATH and the mise/~/.local/bin PATH entries through
+# a POSIX-sh snippet; zsh is not a shell Omarchy sets up, so source it directly
+# rather than going through its bash rc chain.
+[[ -r /usr/share/omarchy/default/bash/env-bootstrap ]] && source /usr/share/omarchy/default/bash/env-bootstrap
+
+{{ end -}}
+{{ template "shell-rcd" . }}
diff --git a/root/private_dot_config/hypr/input.lua b/root/private_dot_config/hypr/input.lua
new file mode 100644
index 0000000..9a384c4
--- /dev/null
+++ b/root/private_dot_config/hypr/input.lua
@@ -0,0 +1,33 @@
+hl.config({
+  input = {
+    kb_options = "caps:escape",
+  },
+})
+
+-- macOS-style "natural" touchpad scrolling: content follows your fingers.
+hl.config({
+  input = {
+    touchpad = {
+      natural_scroll = true,
+    },
+  },
+})
+
+-- Touchpad responsiveness on the T14 Gen 2i. The big accuracy win is the
+-- RMI4/SMBus switch in /etc/modprobe.d/99-thinkpad-touchpad.conf (the PS/2
+-- fallback reports coarse coordinates); this just sharpens the pointer on top
+-- of it. `disable_while_typing` stays on deliberately, it's what keeps the
+-- cursor from jumping mid-sentence.
+hl.config({
+  input = {
+    sensitivity = 0.2,
+
+    touchpad = {
+      tap_and_drag = true,
+      drag_lock = 2,
+    },
+  },
+})
+
+-- https://wiki.hypr.land/Configuring/Advanced-and-Cool/Gestures/
+hl.gesture({ fingers = 3, direction = "horizontal", action = "workspace" })
diff --git a/root/private_dot_config/hypr/looknfeel.lua b/root/private_dot_config/hypr/looknfeel.lua
new file mode 100644
index 0000000..2797a00
--- /dev/null
+++ b/root/private_dot_config/hypr/looknfeel.lua
@@ -0,0 +1,15 @@
+-- Tighter margins around windows. Omarchy defaults are gaps_in 5 / gaps_out 10;
+-- these reclaim screen space on the T14's 14" panel without butting windows
+-- straight up against the bar.
+hl.config({
+  general = {
+    gaps_in = 2,
+    gaps_out = 4,
+  },
+
+  -- Softer corners. Rounding has to stay a little larger than border_size or
+  -- the border reads as a hard notch at the corner.
+  decoration = {
+    rounding = 8,
+  },
+})
diff --git a/root/private_dot_config/mise/config.toml.tmpl b/root/private_dot_config/mise/conf.d/10-dotfiles.toml.tmpl
similarity index 79%
rename from root/private_dot_config/mise/config.toml.tmpl
rename to root/private_dot_config/mise/conf.d/10-dotfiles.toml.tmpl
index 24f0409..9271fc7 100644
--- a/root/private_dot_config/mise/config.toml.tmpl
+++ b/root/private_dot_config/mise/conf.d/10-dotfiles.toml.tmpl
@@ -1,37 +1,47 @@
 [tools]
+
+{{ if not .isDc -}}
+go = "1.27.0"
+node = "lts"
+bun = "1.4.0"
+python = "3.14.7"
+pnpm = "11.24.0"
+{{- end }}
+
+{{ if not .isOmarchy -}}
+claude = "2.1.247"
 starship = "1.26.0"
 lazygit = "0.64.1"
-lazydocker = "0.25.2"
-ast-grep = "0.45.2"
-hyperfine = "1.20.0"
-duf = "0.9.1"
 fd = "10.4.2"
 fzf = "0.74.3"
+gum = "2.0.0"
 jq = "1.8.2"
 ripgrep = "15.2.0"
-lsd = "1.2.0"
-gh = "2.98.0"
 zoxide = "0.10.0"
+usage = "6.4.0"
+gh = "2.98.0"
+"github:modem-dev/hunk" = "0.19.0"
+{{ end -}}
+
+lazydocker = "0.25.2"
+ast-grep = "0.45.2"
+hyperfine = "1.20.0"
+duf = "0.9.1"
+lsd = "1.2.0"
 worktrunk = "0.74.0"
 cloudflared = "2026.8.2"
 aube = "2.1.0"
-usage = "6.4.0"
 
 "github:Ataraxy-Labs/sem" = "0.23.1"
 "github:backnotprop/plannotator" = "0.27.8"
-"github:modem-dev/hunk" = "0.19.0"
+
 {{ if ne .chezmoi.os "windows" -}}
+{{ if not .isOmarchy -}}
 herdr = "0.8.2"
+{{ end -}}
 zellij = "0.45.0"
 "github:zyedidia/eget" = "1.3.4"
 {{- end }}
-{{ if not .isDc -}}
-go = "1.27.0"
-node = "lts"
-bun = "1.4.0"
-python = "3.14.7"
-pnpm = "11.24.0"
-{{- end }}
 
 [settings]
 
@@ -40,8 +50,10 @@ idiomatic_version_file_enable_tools = ["node", "go", "python", "bun"]
 # Tools must be published for at least N days before they will be installed
 minimum_release_age = "7d"
 
-# Pin SHA256 + per-platform download URLs in mise.lock alongside this config.
-# Survives upstream tampering and avoids GitHub rate limits on reinstall.
+# Pin SHA256 + per-platform download URLs in a mise.lock next to each project
+# config. Survives upstream tampering and avoids GitHub rate limits on
+# reinstall. (Global configs are exempt: mise only writes a lockfile for one on
+# an explicit `mise lock --global`.)
 lockfile = true
 
 # Re-verify provenance/checksums on every install (auto-enables
diff --git a/root/private_dot_config/omarchy/extensions/omarchy-menu.jsonc b/root/private_dot_config/omarchy/extensions/omarchy-menu.jsonc
new file mode 100644
index 0000000..ca40530
--- /dev/null
+++ b/root/private_dot_config/omarchy/extensions/omarchy-menu.jsonc
@@ -0,0 +1,23 @@
+{
+  // Extend the Quickshell Omarchy menu with JSONC.
+  //
+  // IDs are object keys and the parent is inferred from the dotted id, so
+  // "dotfiles.pull" appears under "dotfiles", and "dotfiles" appears on the
+  // root menu. See $OMARCHY_PATH/default/omarchy/omarchy-menu.jsonc for the
+  // full field list.
+  //
+  // This file is managed by chezmoi (root/private_dot_config/omarchy/extensions/).
+
+  // Dotfiles — the keyboard path to the same actions the carson.dotfiles bar
+  // widget offers. Every row shells out to dotfiles-sync, so the menu, the
+  // widget and the CLI cannot drift apart.
+  "dotfiles": {"icon":"󰊢","label":"Dotfiles","aliases":["chezmoi"],"description":"chezmoi dotfiles: apply, pull, re-add, commit"},
+
+  "dotfiles.sync": {"icon":"󰓦","label":"Sync","description":"Open the interactive dotfiles menu","action":"omarchy-launch-floating-terminal-with-presentation dotfiles-sync"},
+  "dotfiles.pull": {"icon":"󰇚","label":"Pull & apply","description":"chezmoi update: pull the latest dotfiles and apply them","action":"omarchy-launch-floating-terminal-with-presentation dotfiles-sync pull"},
+  "dotfiles.diff": {"icon":"󰦓","label":"Show diff","description":"What an apply would change","action":"omarchy-launch-floating-terminal-with-presentation dotfiles-sync diff"},
+  "dotfiles.readd": {"icon":"󰑙","label":"Re-add local edits","description":"Take targets edited outside chezmoi back into the source","action":"omarchy-launch-floating-terminal-with-presentation dotfiles-sync re-add"},
+  "dotfiles.commit": {"icon":"󰊢","label":"Commit & push","description":"Open lazygit in the dotfiles source directory","action":"omarchy-launch-floating-terminal-with-presentation dotfiles-sync commit"},
+  "dotfiles.update": {"icon":"","label":"Full update","description":"System packages, mise, chezmoi, dotfiles and tools","action":"omarchy-launch-floating-terminal-with-presentation dotfiles-sync update"},
+  "dotfiles.refresh": {"icon":"","label":"Refresh indicator","description":"Re-check status and update the bar widget","action":"omarchy-shell -q carson.dotfiles refresh"},
+}
diff --git a/root/private_dot_config/omarchy/hooks/post-update.d/executable_dotfiles-refresh.hook b/root/private_dot_config/omarchy/hooks/post-update.d/executable_dotfiles-refresh.hook
new file mode 100755
index 0000000..3cb92e6
--- /dev/null
+++ b/root/private_dot_config/omarchy/hooks/post-update.d/executable_dotfiles-refresh.hook
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Poke the carson.dotfiles bar widget after an Omarchy update.
+#
+# Migrations rewrite files under ~/.config/hypr and ~/.config/omarchy that
+# chezmoi also manages, so the moment an update finishes is exactly when the
+# drift counter is most likely to have changed. Without this the badge would
+# not catch up until the widget's own half-hourly poll.
+#
+# -q makes this a no-op when the shell isn't running (a TTY update, a headless
+# session), so it can never fail the update it is hooked into.
+
+set -e
+
+omarchy-shell -q carson.dotfiles refresh
diff --git a/root/private_dot_config/omarchy/hooks/theme-set.d/executable_omazed b/root/private_dot_config/omarchy/hooks/theme-set.d/executable_omazed
new file mode 100755
index 0000000..5292d7c
--- /dev/null
+++ b/root/private_dot_config/omarchy/hooks/theme-set.d/executable_omazed
@@ -0,0 +1,2 @@
+#!/bin/bash
+omazed set "$1"
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/Agent.qml b/root/private_dot_config/omarchy/plugins/carson.agents/Agent.qml
new file mode 100644
index 0000000..c9ba4c5
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/Agent.qml
@@ -0,0 +1,34 @@
+import QtQuick
+import Quickshell.Io
+
+// One agent's usage record, read straight off the data file that
+// omarchy-agent-usage-update maintains. The panel never learns how the
+// numbers were made — a record that appears in the usage directory is an
+// agent, whoever wrote it.
+Item {
+  id: root
+  visible: false
+
+  property string agentId: ""
+  property string path: ""
+  property var record: null
+
+  FileView {
+    path: root.path
+    watchChanges: true
+    printErrors: false
+    onFileChanged: reload()
+    onLoaded: root.parse(text())
+    onLoadFailed: root.record = null
+  }
+
+  function parse(content) {
+    try {
+      var parsed = JSON.parse(String(content || ""))
+      root.record = parsed && typeof parsed === "object" ? parsed : null
+    } catch (e) {
+      console.warn("agents", "Ignoring bad usage record", root.path, e)
+      root.record = null
+    }
+  }
+}
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/Main.qml b/root/private_dot_config/omarchy/plugins/carson.agents/Main.qml
new file mode 100644
index 0000000..cb8e8c2
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/Main.qml
@@ -0,0 +1,748 @@
+import QtQuick
+import Quickshell
+import Quickshell.Io
+
+// The display side of agent usage. All extraction lives behind
+// omarchy-agent-usage-update, which writes one JSON record per agent into
+// the usage directory; this file only discovers those records, watches them
+// for changes, and optionally merges snapshots synced from other machines.
+Item {
+  id: root
+  visible: false
+
+  property var settings: ({})
+
+  readonly property string home: Quickshell.env("HOME") || ""
+  readonly property string usageDir: (Quickshell.env("XDG_STATE_HOME") || home + "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/.local/state") + "/omarchy/agents/usage"
+
+  // ------------------------------------------------------------- discovery
+
+  property var agentIds: []
+  property var agents: []
+  property int dataRevision: 0
+
+  Process {
+    id: listProcess
+    running: false
+    command: ["find", root.usageDir, "-maxdepth", "1", "-name", "*.json", "-printf", "%f\n"]
+
+    stdout: StdioCollector {
+      waitForEnd: true
+      onStreamFinished: root.applyAgentListing(text)
+    }
+  }
+
+  function rescanAgents() {
+    if (!listProcess.running) listProcess.running = true
+  }
+
+  function applyAgentListing(output) {
+    var ids = []
+    var lines = String(output || "").split("\n")
+    for (var i = 0; i < lines.length; i++) {
+      var name = lines[i].trim()
+      if (name.slice(-5) === ".json") ids.push(name.slice(0, -5))
+    }
+    ids.sort()
+    // Same list, same objects: reassigning the model would tear down every
+    // FileView just to build identical ones.
+    if (JSON.stringify(ids) !== JSON.stringify(agentIds)) agentIds = ids
+  }
+
+  Instantiator {
+    id: agentInstantiator
+    model: root.agentIds
+
+    delegate: Agent {
+      required property var modelData
+      agentId: modelData
+      path: root.usageDir + "/" + modelData + ".json"
+      onRecordChanged: root.recordsChanged()
+    }
+
+    onObjectAdded: (index, object) => root.rebuildAgents()
+    onObjectRemoved: (index, object) => root.rebuildAgents()
+  }
+
+  function rebuildAgents() {
+    var result = []
+    for (var i = 0; i < agentInstantiator.count; i++) {
+      var agent = agentInstantiator.objectAt(i)
+      if (agent) result.push(agent)
+    }
+    agents = result
+    recordsChanged()
+  }
+
+  function recordsChanged() {
+    dataRevision++
+    scheduleLimitsRetry()
+    scheduleSync()
+  }
+
+  // A collector that could not reach its limits endpoint at all — typically
+  // the seconds after login before the network is up — writes retryAdvised
+  // into its record. Honor it with one sooner try instead of waiting out the
+  // full refresh interval; a run that reaches the endpoint clears the flag.
+  // Only the advising agents rerun, so an outage at one provider does not
+  // put every other collector on a 30-second treadmill.
+  property var retryAgentIds: []
+
+  Timer {
+    id: limitsRetry
+    interval: 30000
+    repeat: false
+    onTriggered: root.runUpdate("limits", root.retryAgentIds)
+  }
+
+  function scheduleLimitsRetry() {
+    var advising = []
+    for (var i = 0; i < agents.length; i++) {
+      var record = agents[i] ? agents[i].record : null
+      if (record && record.retryAdvised === true && providerEnabled(String(record.id || "")))
+        advising.push(String(record.id))
+    }
+    retryAgentIds = advising
+    if (advising.length > 0) limitsRetry.restart()
+    else limitsRetry.stop()
+  }
+
+  Component.onCompleted: {
+    rescanAgents()
+    if (syncConfigured()) scheduleSync()
+  }
+
+  // -------------------------------------------------------------- refresh
+
+  property int refreshIntervalSec: Math.max(30, Number(setting("refreshIntervalSec", 900)))
+  property string pendingUpdateKind: ""
+
+  Timer {
+    interval: root.refreshIntervalSec * 1000
+    running: true
+    repeat: true
+    triggeredOnStart: true
+    onTriggered: root.runUpdate("normal")
+  }
+
+  Process {
+    id: updateProcess
+    running: false
+    onExited: {
+      root.rescanAgents()
+      if (root.pendingUpdateKind !== "") {
+        var kind = root.pendingUpdateKind
+        root.pendingUpdateKind = ""
+        root.runUpdate(kind)
+      }
+    }
+
+    stderr: StdioCollector {
+      waitForEnd: true
+      onStreamFinished: if (text.trim() !== "") console.warn("agents", text.trim())
+    }
+  }
+
+  function updateCommand(kind, agentIds) {
+    var command = ["omarchy-agent-usage-update"]
+    if (kind === "force") command.push("--force")
+    if (kind === "limits") command.push("--limits-only")
+    var providers = settings && settings.providers ? settings.providers : {}
+    for (var id in providers) {
+      if (providers[id] && providers[id].enabled === false) command.push("--except", id)
+    }
+    if (agentIds) {
+      for (var i = 0; i < agentIds.length; i++) command.push(agentIds[i])
+    }
+    return command
+  }
+
+  function runUpdate(kind, agentIds) {
+    if (updateProcess.running) {
+      // Collapse queued requests to one full rerun; a forced refresh outranks
+      // the cheaper kinds it might have been queued behind.
+      if (kind === "force" || root.pendingUpdateKind === "") root.pendingUpdateKind = kind
+      return
+    }
+    updateProcess.command = updateCommand(kind, agentIds)
+    updateProcess.running = true
+  }
+
+  function refresh() { refreshAll(true) }
+  function refreshAll(force) { runUpdate(force === true ? "force" : "normal") }
+
+  // Opening the panel wants the numbers that go stale on the wire, not
+  // another walk over every transcript on disk — the collectors reuse their
+  // recent scans in this mode.
+  function refreshLimits() { runUpdate("limits") }
+
+  // ------------------------------------------------------------- providers
+
+  // An agent earns a place in the bar and the panel by being switched on in
+  // settings and having actually produced numbers — locally or on a synced
+  // device. With nothing to show, the whole module collapses out of the bar
+  // rather than sitting there dimmed.
+  property var enabledProviders: {
+    var rev = dataRevision
+    var syncRev = syncRevision
+    var result = []
+    var localIds = {}
+    for (var i = 0; i < agents.length; i++) {
+      var record = agents[i] ? agents[i].record : null
+      if (!record || !record.id) continue
+      var id = String(record.id)
+      localIds[id] = true
+      if (!providerEnabled(id)) continue
+      var display = displayProvider(record)
+      if (providerHasData(display)) result.push(display)
+    }
+    // An agent that only ever ran on another machine has no local record, but
+    // its synced numbers still deserve a tab. Rate limits stay blank — they
+    // are per-account and never travel.
+    var syncedProviders = syncConfigured() && aggregateData && aggregateData.providers ? aggregateData.providers : {}
+    for (var syncedId in syncedProviders) {
+      if (localIds[syncedId] || !providerEnabled(syncedId)) continue
+      var stats = syncedProviders[syncedId] || {}
+      var syncedDisplay = displayProvider({ id: syncedId, name: stats.providerName || syncedId })
+      if (providerHasData(syncedDisplay)) result.push(syncedDisplay)
+    }
+    return result
+  }
+
+  function providerEnabled(id) {
+    if (!settings || !settings.providers || !settings.providers[id]) return true
+    return settings.providers[id].enabled !== false
+  }
+
+  // All-time keeps a quiet day from hiding an agent; today's counts admit a
+  // machine whose only source is history.jsonl, which knows nothing older.
+  function providerHasData(p) {
+    return numberValue(p.totalPrompts) > 0 || numberValue(p.totalSessions) > 0
+      || numberValue(p.activeDays) > 0 || numberValue(p.todayPrompts) > 0
+      || numberValue(p.todaySessions) > 0 || (p.limits && p.limits.length > 0)
+      || !!p.balance
+  }
+
+  // A prepaid agent's credit ledger. Like rate limits, the balance is
+  // per-account and never merged across devices.
+  function balanceValue(raw) {
+    if (!raw || typeof raw !== "object") return null
+    var remaining = Number(raw.remaining)
+    var funded = Number(raw.funded)
+    if (!isFinite(remaining) || remaining < 0) return null
+    return {
+      remaining: remaining,
+      funded: isFinite(funded) && funded > 0 ? funded : 0,
+      spent: Math.max(0, Number(raw.spent) || 0),
+      currency: String(raw.currency || "USD"),
+      estimated: raw.estimated === true
+    }
+  }
+
+  function displayProvider(record) {
+    var stats = syncedStatsFor(String(record.id))
+    var synced = !!stats
+    var deviceCount = synced ? Number(stats.deviceCount || aggregateData.deviceCount || 0) : 0
+
+    return {
+      providerId: String(record.id),
+      providerName: String(record.name || record.id),
+      ready: record.ready === true || synced,
+      usageStatusText: String(record.usageStatusText || ""),
+      authHelpText: String(record.authHelpText || ""),
+
+      // Rate limits and balances stay per-account and are never merged
+      // across devices.
+      limits: Array.isArray(record.limits) ? record.limits : [],
+      tierLabel: String(record.tierLabel || ""),
+      balance: balanceValue(record.balance),
+
+      todayPrompts: synced ? numberValue(stats.todayPrompts) : numberValue(record.todayPrompts),
+      todaySessions: synced ? numberValue(stats.todaySessions) : numberValue(record.todaySessions),
+      todayTotalTokens: synced ? numberValue(stats.todayTotalTokens) : numberValue(record.todayTotalTokens),
+      todayTokensByModel: synced ? (stats.todayTokensByModel || ({})) : (record.todayTokensByModel || ({})),
+      recentDays: synced ? (stats.recentDays || []) : (record.recentDays || []),
+      totalPrompts: synced ? numberValue(stats.totalPrompts) : numberValue(record.totalPrompts),
+      totalSessions: synced ? numberValue(stats.totalSessions) : numberValue(record.totalSessions),
+      activeDays: synced ? numberValue(stats.activeDays) : numberValue(record.activeDays),
+      modelUsage: synced ? (stats.modelUsage || ({})) : (record.modelUsage || ({})),
+      hasLocalStats: synced ? (stats.hasLocalStats !== false) : (record.hasLocalStats !== false),
+      hasPromptStats: synced ? (stats.hasPromptStats !== false) : (record.hasPromptStats !== false),
+
+      syncEnabled: synced,
+      syncDeviceCount: deviceCount,
+      syncUpdatedAt: aggregateData && aggregateData.updatedAt ? aggregateData.updatedAt : ""
+    }
+  }
+
+  function setting(name, fallback) {
+    var value = settings ? settings[name] : undefined
+    return value === undefined || value === null ? fallback : value
+  }
+
+  // ------------------------------------------------------------------ sync
+
+  property var syncModeSetting: setting("syncMode", setting("syncEnabled", false))
+  property bool syncEnabled: parseSyncEnabled(syncModeSetting)
+  property string syncDir: String(setting("syncDir", ""))
+  property string syncFileName: String(setting("syncFileName", ""))
+  property string syncDeviceId: String(setting("syncDeviceId", ""))
+  property string detectedHostname: ""
+  readonly property string syncEffectiveDir: expandPath(syncDir)
+  readonly property string syncEffectiveFileName: safeSnapshotFileName(syncFileName, syncDeviceId)
+  readonly property string syncEffectiveDeviceId: safeDeviceId(syncDeviceId || syncEffectiveFileName.replace(/\.json$/i, ""))
+  readonly property string syncSnapshotPath: syncConfigured() ? syncEffectiveDir + "/" + syncEffectiveFileName : home + "/.cache/omarchy/agents-disabled.json"
+  property var aggregateData: ({})
+  property int syncRevision: 0
+  property bool syncRunning: false
+  property bool syncRequestedWhileRunning: false
+  property string syncStatusText: ""
+  property double aggregateUpdatedAtMs: aggregateData && aggregateData.updatedAtMs ? Number(aggregateData.updatedAtMs) : 0
+
+  onSyncEnabledChanged: syncSettingsChanged()
+  onSyncDirChanged: syncSettingsChanged()
+  onSyncFileNameChanged: if (syncConfigured()) scheduleSync()
+  onSyncDeviceIdChanged: if (syncConfigured()) scheduleSync()
+
+  Timer {
+    id: syncDebounce
+    interval: 1000
+    repeat: false
+    onTriggered: root.runSync()
+  }
+
+  Process {
+    id: syncMkdirProcess
+    running: false
+    onRunningChanged: root.updateSyncRunning()
+    onExited: function(exitCode) {
+      if (exitCode !== 0) {
+        if (root.syncConfigured()) root.syncStatusText = "Usage sync mkdir failed"
+        root.finishSyncRun()
+        return
+      }
+      root.writeSyncSnapshot()
+    }
+  }
+
+  Process {
+    id: syncScanProcess
+    running: false
+    onRunningChanged: root.updateSyncRunning()
+    onExited: function(exitCode) {
+      if (exitCode !== 0 && root.syncConfigured()) root.syncStatusText = "Usage sync scan failed"
+      root.finishSyncRun()
+    }
+
+    stdout: StdioCollector {
+      waitForEnd: true
+      onStreamFinished: root.parseSyncScanOutput(text)
+    }
+
+    stderr: StdioCollector {
+      waitForEnd: true
+      onStreamFinished: if (text.trim() !== "") console.warn("agents/sync", text.trim())
+    }
+  }
+
+  FileView {
+    id: syncSnapshotFile
+    path: root.syncSnapshotPath
+    watchChanges: false
+    atomicWrites: true
+    printErrors: false
+  }
+
+  FileView {
+    id: hostnameFile
+    path: "/etc/hostname"
+    watchChanges: false
+    printErrors: false
+    onLoaded: root.detectedHostname = String(text() || "").trim()
+  }
+
+  function parseSyncEnabled(value) {
+    if (value === true) return true
+    var text = String(value || "").trim().toLowerCase()
+    return text === "on" || text === "enabled" || text === "true" || text === "yes" || text === "1"
+  }
+
+  function syncConfigured() {
+    return root.syncEnabled === true && String(root.syncDir || "").trim() !== ""
+  }
+
+  function syncSettingsChanged() {
+    if (syncConfigured()) {
+      scheduleSync()
+    } else {
+      syncDebounce.stop()
+      syncRequestedWhileRunning = false
+      aggregateData = ({})
+      syncStatusText = ""
+      syncRevision++
+    }
+  }
+
+  function updateSyncRunning() {
+    root.syncRunning = syncMkdirProcess.running || syncScanProcess.running
+  }
+
+  function scheduleSync() {
+    if (!syncConfigured()) return
+    syncDebounce.restart()
+  }
+
+  function runSync() {
+    if (!syncConfigured()) return
+    if (root.syncRunning) {
+      syncRequestedWhileRunning = true
+      return
+    }
+
+    syncRequestedWhileRunning = false
+    syncStatusText = ""
+    syncMkdirProcess.command = ["mkdir", "-p", root.syncEffectiveDir]
+    syncMkdirProcess.running = true
+  }
+
+  function writeSyncSnapshot() {
+    if (!syncConfigured()) {
+      finishSyncRun()
+      return
+    }
+    syncSnapshotFile.setText(JSON.stringify(localSnapshot(), null, 2) + "\n")
+    Qt.callLater(root.startSyncScan)
+  }
+
+  function startSyncScan() {
+    if (!syncConfigured()) {
+      finishSyncRun()
+      return
+    }
+    var script = "dir=$0; [[ -d \"$dir\" ]] || exit 0; shopt -s nullglob; for f in \"$dir\"/*.json; do [[ -f \"$f\" ]] || continue; printf '===%s===\\n' \"$f\"; cat \"$f\"; printf '\\n=== EOM ===\\n'; done"
+    syncScanProcess.command = ["bash", "-c", script, root.syncEffectiveDir]
+    syncScanProcess.running = true
+  }
+
+  function finishSyncRun() {
+    if (syncRequestedWhileRunning && syncConfigured()) {
+      syncRequestedWhileRunning = false
+      scheduleSync()
+    }
+  }
+
+  function expandPath(path) {
+    var value = String(path || "").trim()
+    if (value === "") return ""
+    if (value === "~") return home
+    if (value.indexOf("~/") === 0) return home + value.substring(1)
+    if (value.indexOf("$HOME/") === 0) return home + value.substring(5)
+    if (value.charAt(0) !== "/") return home + "/" + value
+    return value
+  }
+
+  function safeDeviceId(raw) {
+    var value = String(raw || "").trim()
+    if (value === "") value = Quickshell.env("HOSTNAME") || root.detectedHostname || Quickshell.env("HOST") || Quickshell.env("USER") || "device"
+    value = value.replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "")
+    if (value === "") value = "device"
+    return value.length > 80 ? value.substring(0, 80) : value
+  }
+
+  function safeSnapshotFileName(rawFileName, rawDeviceId) {
+    var value = String(rawFileName || "").trim()
+    if (value === "") value = safeDeviceId(rawDeviceId) + ".json"
+    value = value.split("/").pop().replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "")
+    if (value === "") value = safeDeviceId(rawDeviceId) + ".json"
+    if (!/\.json$/i.test(value)) value += ".json"
+    return value.length > 100 ? value.substring(0, 95) + ".json" : value
+  }
+
+  function parseSyncScanOutput(output) {
+    var lines = String(output || "").split("\n")
+    var snapshots = []
+    var currentPath = ""
+    var currentJson = []
+
+    function flush() {
+      if (currentPath === "") return
+      var raw = currentJson.join("\n").trim()
+      try {
+        var parsed = JSON.parse(raw)
+        if (parsed && parsed.providers) snapshots.push(parsed)
+      } catch (e) {
+        console.warn("agents/sync", "Ignoring bad snapshot", currentPath, e)
+      }
+      currentPath = ""
+      currentJson = []
+    }
+
+    for (var i = 0; i < lines.length; i++) {
+      var line = lines[i]
+      var start = line.match(/^===(.+)===$/)
+      if (start && line !== "=== EOM ===") {
+        flush()
+        currentPath = start[1]
+        currentJson = []
+        continue
+      }
+      if (line === "=== EOM ===") {
+        flush()
+        continue
+      }
+      if (currentPath !== "") currentJson.push(line)
+    }
+    flush()
+
+    aggregateData = aggregateSnapshots(snapshots)
+    syncStatusText = ""
+    syncRevision++
+  }
+
+  function cloneValue(value, fallback) {
+    if (value === undefined || value === null) return fallback
+    try {
+      return JSON.parse(JSON.stringify(value))
+    } catch (e) {
+      return fallback
+    }
+  }
+
+  function numberValue(value) {
+    var n = Number(value || 0)
+    return isFinite(n) ? Math.round(n) : 0
+  }
+
+  function dateString(date) {
+    var y = date.getFullYear()
+    var m = String(date.getMonth() + 1).padStart(2, "0")
+    var d = String(date.getDate()).padStart(2, "0")
+    return y + "-" + m + "-" + d
+  }
+
+  function recentDateStrings() {
+    var result = []
+    for (var offset = 6; offset >= 0; offset--) {
+      var date = new Date()
+      date.setDate(date.getDate() - offset)
+      result.push(dateString(date))
+    }
+    return result
+  }
+
+  function emptyTokenBucket() {
+    return { inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, cacheCreationInputTokens: 0 }
+  }
+
+  // Device-scoped stats add up across machines; account-scoped stats
+  // (Fireworks' billing API) are replicas of the same upstream truth on
+  // every synced device, so the widest value wins — summing them would
+  // double every token per machine.
+  function combineNumber(additive, current, value) {
+    return additive ? numberValue(current) + numberValue(value) : Math.max(numberValue(current), numberValue(value))
+  }
+
+  function combineObjectNumbers(additive, target, source) {
+    if (!source) return
+    for (var key in source) target[key] = combineNumber(additive, target[key], source[key])
+  }
+
+  function aggregateSnapshots(snapshots) {
+    var dates = recentDateStrings()
+    var devices = {}
+    var providers = {}
+
+    function providerAcc(id) {
+      if (providers[id]) return providers[id]
+      var recentByDay = {}
+      for (var d = 0; d < dates.length; d++) recentByDay[dates[d]] = 0
+      providers[id] = {
+        providerId: id,
+        providerName: "",
+        ready: false,
+        hasLocalStats: false,
+        hasPromptStats: false,
+        todayPrompts: 0,
+        todaySessions: 0,
+        todayTotalTokens: 0,
+        todayTokensByModel: ({}),
+        recentByDay: recentByDay,
+        totalPrompts: 0,
+        totalSessions: 0,
+        activeDays: 0,
+        activeDates: ({}),
+        modelUsage: ({}),
+        devices: ({})
+      }
+      return providers[id]
+    }
+
+    for (var i = 0; i < snapshots.length; i++) {
+      var snapshot = snapshots[i]
+      var device = safeDeviceId(snapshot.deviceId || "device")
+      devices[device] = true
+      var snapshotProviders = snapshot.providers || {}
+      for (var providerId in snapshotProviders) {
+        var stats = snapshotProviders[providerId] || {}
+        var acc = providerAcc(String(providerId))
+        acc.devices[device] = true
+        if (stats.providerName && acc.providerName === "") acc.providerName = String(stats.providerName)
+        acc.ready = acc.ready || stats.ready === true
+        acc.hasLocalStats = acc.hasLocalStats || stats.hasLocalStats !== false
+        // Snapshots from before the field existed only came from agents that
+        // count prompts, so a missing value reads as true.
+        acc.hasPromptStats = acc.hasPromptStats || stats.hasPromptStats !== false
+        var additive = String(stats.scope || "device") !== "account"
+        acc.todayPrompts = combineNumber(additive, acc.todayPrompts, stats.todayPrompts)
+        acc.todaySessions = combineNumber(additive, acc.todaySessions, stats.todaySessions)
+        acc.todayTotalTokens = combineNumber(additive, acc.todayTotalTokens, stats.todayTotalTokens)
+        acc.totalPrompts = combineNumber(additive, acc.totalPrompts, stats.totalPrompts)
+        acc.totalSessions = combineNumber(additive, acc.totalSessions, stats.totalSessions)
+        // Active days overlap between machines, so union the dates rather than
+        // summing counts. Snapshots written before activeDates existed only
+        // carry a count; the widest one stands in for them.
+        var activeDates = Array.isArray(stats.activeDates) ? stats.activeDates : []
+        for (var ad = 0; ad < activeDates.length; ad++) acc.activeDates[String(activeDates[ad])] = true
+        acc.activeDays = Math.max(acc.activeDays, numberValue(stats.activeDays))
+        combineObjectNumbers(additive, acc.todayTokensByModel, stats.todayTokensByModel || {})
+
+        var recent = Array.isArray(stats.recentDays) ? stats.recentDays : []
+        for (var r = 0; r < recent.length; r++) {
+          var day = recent[r] || {}
+          var date = String(day.date || "")
+          if (acc.recentByDay[date] !== undefined)
+            acc.recentByDay[date] = combineNumber(additive, acc.recentByDay[date], day.messageCount)
+        }
+
+        var usage = stats.modelUsage || {}
+        for (var modelId in usage) {
+          var bucket = acc.modelUsage[modelId]
+          if (!bucket) bucket = acc.modelUsage[modelId] = emptyTokenBucket()
+          combineObjectNumbers(additive, bucket, usage[modelId] || {})
+        }
+      }
+    }
+
+    var outProviders = {}
+    for (var id in providers) {
+      var acc = providers[id]
+      var recentDays = []
+      for (var di = 0; di < dates.length; di++) recentDays.push({ date: dates[di], messageCount: acc.recentByDay[dates[di]] || 0 })
+      var providerDevices = Object.keys(acc.devices).sort()
+      outProviders[id] = {
+        providerId: acc.providerId,
+        providerName: acc.providerName,
+        ready: acc.ready || providerDevices.length > 0,
+        hasLocalStats: acc.hasLocalStats,
+        hasPromptStats: acc.hasPromptStats,
+        todayPrompts: acc.todayPrompts,
+        todaySessions: acc.todaySessions,
+        todayTotalTokens: acc.todayTotalTokens,
+        todayTokensByModel: acc.todayTokensByModel,
+        recentDays: recentDays,
+        totalPrompts: acc.totalPrompts,
+        totalSessions: acc.totalSessions,
+        activeDays: Math.max(acc.activeDays, Object.keys(acc.activeDates).length),
+        modelUsage: acc.modelUsage,
+        deviceCount: providerDevices.length,
+        devices: providerDevices
+      }
+    }
+
+    return {
+      schemaVersion: 1,
+      updatedAt: new Date().toISOString(),
+      updatedAtMs: Date.now(),
+      deviceCount: Object.keys(devices).length,
+      devices: Object.keys(devices).sort(),
+      providers: outProviders
+    }
+  }
+
+  // Snapshots keep the field names older Omarchy versions wrote, so a fleet
+  // of machines on mixed versions still merges cleanly in both directions.
+  function providerSnapshot(record) {
+    return {
+      providerId: String(record.id),
+      providerName: String(record.name || record.id),
+      ready: record.ready === true,
+      hasLocalStats: record.hasLocalStats !== false,
+      hasPromptStats: record.hasPromptStats !== false,
+      scope: String(record.scope || "device"),
+      todayPrompts: numberValue(record.todayPrompts),
+      todaySessions: numberValue(record.todaySessions),
+      todayTotalTokens: numberValue(record.todayTotalTokens),
+      todayTokensByModel: cloneValue(record.todayTokensByModel, ({})),
+      recentDays: cloneValue(record.recentDays, []),
+      totalPrompts: numberValue(record.totalPrompts),
+      totalSessions: numberValue(record.totalSessions),
+      activeDays: numberValue(record.activeDays),
+      activeDates: cloneValue(record.activeDates, []),
+      modelUsage: cloneValue(record.modelUsage, ({}))
+    }
+  }
+
+  function localSnapshot() {
+    var providerMap = {}
+    for (var i = 0; i < agents.length; i++) {
+      var record = agents[i] ? agents[i].record : null
+      if (!record || !record.id) continue
+      if (!providerEnabled(String(record.id))) continue
+      providerMap[String(record.id)] = providerSnapshot(record)
+    }
+    return {
+      schemaVersion: 1,
+      deviceId: syncEffectiveDeviceId,
+      updatedAt: new Date().toISOString(),
+      providers: providerMap
+    }
+  }
+
+  function syncedStatsFor(providerId) {
+    var rev = syncRevision
+    if (!syncConfigured() || !aggregateData || !aggregateData.providers) return null
+    return aggregateData.providers[providerId] || null
+  }
+
+  // ---------------------------------------------------------------- format
+
+  function formatTokenCount(n) {
+    if (n === undefined || n === null) return "0"
+    if (n >= 1e9) return (n / 1e9).toFixed(1) + "B"
+    if (n >= 1e6) return (n / 1e6).toFixed(1) + "M"
+    if (n >= 1e3) return (n / 1e3).toFixed(1) + "K"
+    return String(n)
+  }
+
+  function modelWordCase(word) {
+    if (word === "gpt") return "GPT"
+    if (word === "deepseek") return "DeepSeek"
+    return word.charAt(0).toUpperCase() + word.slice(1)
+  }
+
+  // Model ids arrive hyphenated with the version split across segments
+  // (`claude-opus-4-8`, `gpt-5.6-sol`). Rejoin the numeric run into one
+  // version and title-case the words around it.
+  function friendlyModelName(id) {
+    if (!id) return "Unknown"
+    var name = String(id).replace(/^claude-/, "").replace(/-\d{8}$/, "")
+    var parts = name.split("-")
+    var words = []
+    var version = []
+    for (var i = 0; i < parts.length; i++) {
+      var part = parts[i]
+      if (part === "") continue
+      if (/^\d/.test(part)) {
+        version.push(part)
+        continue
+      }
+      if (version.length > 0) {
+        words.push(version.join("."))
+        version = []
+      }
+      words.push(modelWordCase(part))
+    }
+    if (version.length > 0) words.push(version.join("."))
+    return words.length > 0 ? words.join(" ") : "Unknown"
+  }
+}
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/Panel.qml b/root/private_dot_config/omarchy/plugins/carson.agents/Panel.qml
new file mode 100644
index 0000000..33de50c
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/Panel.qml
@@ -0,0 +1,977 @@
+import QtQuick
+import QtQuick.Controls
+import Quickshell
+import Quickshell.Io
+import qs.Commons
+import qs.Ui
+
+Panel {
+  id: root
+  moduleName: "omarchy.agents"
+  ipcTarget: "omarchy.agents"
+  manageIpc: false
+
+  readonly property color foreground: bar ? bar.foreground : Color.foreground
+  readonly property color urgent: bar ? bar.urgent : Color.urgent
+  readonly property color dim: Qt.darker(foreground, 1.55)
+  readonly property color surface: Color.popups.background
+  readonly property color track: Style.selectedFillFor(foreground, Color.accent)
+  readonly property string fontFamily: bar ? bar.fontFamily : Style.font.family
+
+  readonly property var providers: usage.enabledProviders
+  // The selection follows the provider, not the slot it happens to sit in: a
+  // provider whose first scan lands while the panel is open would otherwise
+  // shift the list underneath you and swap out what you were reading.
+  property string selectedProviderId: ""
+  readonly property int providerIndex: {
+    for (var i = 0; i < providers.length; i++)
+      if (providers[i].providerId === selectedProviderId) return i
+    return 0
+  }
+  readonly property var provider: providers.length > 0 ? providers[providerIndex] : null
+
+  property bool cursorActive: false
+
+  // Countdowns and "updated" read this instead of Date.now() so the
+  // panel keeps telling the truth while it sits open.
+  property double nowMs: Date.now()
+
+  readonly property var limits: limitWindows(provider)
+  readonly property var models: modelRows(provider)
+  readonly property var headline: bindingWindow(provider)
+  readonly property var balance: provider ? (provider.balance || null) : null
+  // A prepaid account runs low the way a subscription window fills up: the
+  // last 10% of the funded credits lights the same alarm.
+  readonly property bool balanceAlarming: !!balance && balance.funded > 0
+    && balance.remaining / balance.funded <= 0.1
+  readonly property bool alarming: (!!headline && headline.percent >= 0.9) || balanceAlarming
+
+  // ---- Bar label -------------------------------------------------------
+  //
+  // The bar shows Claude Code's current 5-hour session window as a percentage
+  // next to the glyph. It is pinned to Claude on purpose: the panel's selected
+  // provider moves with h/l and middle-click, and a bar number whose meaning
+  // silently changes under you is worse than no number.
+  readonly property bool vertical: root.bar ? root.bar.vertical : false
+  readonly property string glyph: "󱚣"
+
+  readonly property var claudeProvider: {
+    var list = root.providers
+    for (var i = 0; i < list.length; i++)
+      if (list[i].providerId === "claude") return list[i]
+    return null
+  }
+
+  // limitWindows() normalizes both collectors onto the titles "Session" and
+  // "Weekly", so this picks the rolling window rather than the 7-day one.
+  readonly property var claudeSession: {
+    var windows = root.limitWindows(root.claudeProvider)
+    for (var i = 0; i < windows.length; i++)
+      if (windows[i].title === "Session") return windows[i]
+    return null
+  }
+
+  // percent arrives as 0..1 from the collector.
+  readonly property int claudeSessionPercent: root.claudeSession
+    ? Math.round(root.claudeSession.percent * 100) : -1
+
+  readonly property string barLabel: {
+    if (root.claudeSessionPercent < 0) return root.glyph
+    var pct = root.claudeSessionPercent + "%"
+    // A vertical bar has no room for the glyph and the number side by side.
+    return root.vertical ? pct : root.glyph + "  " + pct
+  }
+
+  // Hovering the bar wants the numbers the label had no room for.
+  readonly property string barTooltip: {
+    var windows = root.limitWindows(root.claudeProvider)
+    if (windows.length === 0) return "Claude Code"
+    var parts = []
+    for (var i = 0; i < windows.length; i++)
+      parts.push(windows[i].title + " " + Math.round(windows[i].percent * 100) + "%")
+    return "Claude Code — " + parts.join(" · ")
+  }
+
+  function clamp(v, lo, hi) { return Math.max(lo, Math.min(hi, v)) }
+  function alpha(c, a) { return Qt.rgba(c.r, c.g, c.b, a) }
+
+  function selectProvider(index) {
+    if (providers.length === 0) return
+    var wrapped = ((index % providers.length) + providers.length) % providers.length
+    selectedProviderId = providers[wrapped].providerId
+  }
+
+  function refreshNow() {
+    usage.refreshAll(true)
+  }
+
+  function launchAgent() {
+    if (root.bar) root.bar.run("omarchy-agent --pick")
+    root.close()
+  }
+
+  // ---------------------------------------------------------------- limits
+  //
+  // Both providers report the same two shapes: a short rolling session window
+  // and a long weekly one. Everything below normalizes them into one record so
+  // the meters and the hero speak a single language.
+
+  // Claude spells its windows out ("Session (5-hour)"), Codex abbreviates
+  // them ("5h window", "30m window"). Both have to land on the same record.
+  function windowIsLong(text) {
+    return text.indexOf("week") >= 0 || text.indexOf("7-day") >= 0 || text.indexOf("seven") >= 0
+      || text.indexOf("month") >= 0 || text.indexOf("30-day") >= 0
+  }
+
+  function windowSpanMs(label) {
+    var text = String(label || "").toLowerCase()
+    if (text.indexOf("month") >= 0 || text.indexOf("30-day") >= 0) return 30 * 24 * 3600 * 1000
+    if (windowIsLong(text)) return 7 * 24 * 3600 * 1000
+    var hours = text.match(/(\d+)\s*-?\s*h(?:our)?\b/)
+    if (hours) return Number(hours[1]) * 3600 * 1000
+    var minutes = text.match(/(\d+)\s*-?\s*m(?:in(?:ute)?s?)?\b/)
+    if (minutes) return Number(minutes[1]) * 60 * 1000
+    return 0
+  }
+
+  function windowTitle(label) {
+    var text = String(label || "").toLowerCase()
+    if (text.indexOf("month") >= 0) return "Monthly"
+    if (windowIsLong(text)) return "Weekly"
+    if (text.indexOf("session") >= 0 || windowSpanMs(label) > 0) return "Session"
+    var plain = String(label || "").replace(/\s*\(.*\)\s*/, "").trim()
+    return plain === "" ? "Limit" : plain
+  }
+
+  // A collector that already knows which window a limit belongs to says so,
+  // and that beats reading it back out of the label: a model-scoped limit is
+  // titled after its model, and a name like "Opus 5 (1M context)" would parse
+  // as a one-minute window.
+  function limitWindow(label, percent, resetAt, title) {
+    return {
+      title: String(title || "") !== "" ? String(title) : windowTitle(label),
+      percent: Number(percent),
+      resetAt: String(resetAt || "")
+    }
+  }
+
+  function limitWindows(p) {
+    if (!p) return []
+    var out = []
+    var list = p.limits || []
+    for (var i = 0; i < list.length; i++) {
+      var entry = list[i] || {}
+      var percent = Number(entry.percent)
+      if (percent >= 0) out.push(limitWindow(entry.label, percent, entry.resetsAt, entry.title))
+    }
+    return out
+  }
+
+  // The window that decides how much room is left — the fullest one, since
+  // that is what stops the next prompt.
+  function bindingWindow(p) {
+    var windows = limitWindows(p)
+    var best = null
+    for (var i = 0; i < windows.length; i++) {
+      if (!best || windows[i].percent > best.percent) best = windows[i]
+    }
+    return best
+  }
+
+  function resetMsFor(w) {
+    if (!w || w.resetAt === "") return -1
+    var ms = new Date(w.resetAt).getTime()
+    return isFinite(ms) ? ms - root.nowMs : -1
+  }
+
+  function formatDuration(ms) {
+    if (!(ms > 0)) return "now"
+    var minutes = Math.floor(ms / 60000)
+    var hours = Math.floor(minutes / 60)
+    var days = Math.floor(hours / 24)
+    if (days > 0) return days + "d " + (hours % 24) + "h"
+    if (hours > 0) return hours + "h " + (minutes % 60) + "m"
+    return Math.max(1, minutes) + "m"
+  }
+
+  // ---------------------------------------------------------------- balance
+  //
+  // Prepaid agents report a credit ledger instead of rate-limit windows: the
+  // record's balance object carries remaining, funded, and spent amounts.
+
+  function currencyPrefix(currency) {
+    var code = String(currency || "USD").toUpperCase()
+    if (code === "USD") return "$"
+    if (code === "EUR") return "€"
+    if (code === "GBP") return "£"
+    return code + " "
+  }
+
+  function formatMoney(value, currency) {
+    var amount = Number(value)
+    if (!isFinite(amount)) amount = 0
+    return currencyPrefix(currency) + amount.toFixed(2)
+  }
+
+  function balanceDetailText(b) {
+    if (!b || !(b.funded > 0)) return ""
+    var text = formatMoney(b.spent, b.currency) + " spent of " + formatMoney(b.funded, b.currency) + " funded"
+    if (b.estimated) text += " · estimated"
+    return text
+  }
+
+  // ---------------------------------------------------------------- content
+
+  // The plan you pay for, under the name of the tool it pays for. Limits live
+  // in their own section; the hero just says what this is.
+  function heroMeta(p) {
+    if (!p) return ""
+    if (String(p.usageStatusText || "") !== "") return p.usageStatusText
+    var tier = String(p.tierLabel || "")
+    if (tier === "") return "Subscription"
+    return tier.charAt(0).toUpperCase() + tier.slice(1)
+  }
+
+  // Local calendar date, recomputed from nowMs so a panel left open across
+  // midnight moves the "Today" row with the clock.
+  function todayDate() {
+    var now = new Date(root.nowMs)
+    return now.getFullYear()
+      + "-" + String(now.getMonth() + 1).padStart(2, "0")
+      + "-" + String(now.getDate()).padStart(2, "0")
+  }
+
+  function dayName(date) {
+    var parsed = new Date(String(date || "") + "T00:00:00")
+    if (isNaN(parsed.getTime())) return String(date || "")
+    return ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"][parsed.getDay()]
+  }
+
+  function dayLabel(date, today) {
+    if (today) return "Today"
+    return dayName(date)
+  }
+
+  function dayTooltip(day, today) {
+    if (!day) return ""
+    var parsed = new Date(String(day.date) + "T00:00:00")
+    var label = isNaN(parsed.getTime())
+      ? String(day.date)
+      : dayName(day.date) + " " + (parsed.getMonth() + 1) + "/" + parsed.getDate()
+    var text = label + " · " + usage.formatTokenCount(Number(day.messageCount || 0)) + " tokens"
+    // Prompt and session counts only exist for today, so they ride along here
+    // instead of taking a section of their own. Billing-API agents never
+    // count prompts, and "0 prompts" would read as a quiet day, not a gap.
+    if (today && provider && provider.hasPromptStats !== false)
+      text += " · " + Number(provider.todayPrompts || 0) + " prompts · "
+        + Number(provider.todaySessions || 0) + " sessions"
+    return text
+  }
+
+  function weekPeak(p) {
+    var days = p ? (p.recentDays || []) : []
+    var peak = 0
+    for (var i = 0; i < days.length; i++) peak = Math.max(peak, Number(days[i].messageCount || 0))
+    return peak
+  }
+
+  function modelRows(p) {
+    var usageByModel = p ? (p.modelUsage || {}) : {}
+    var rows = []
+    for (var id in usageByModel) {
+      var bucket = usageByModel[id] || {}
+      var input = Number(bucket.inputTokens || 0)
+      var output = Number(bucket.outputTokens || 0)
+      var cacheRead = Number(bucket.cacheReadInputTokens || 0)
+      var cacheWrite = Number(bucket.cacheCreationInputTokens || 0)
+      rows.push({
+        name: usage.friendlyModelName(id),
+        total: input + output + cacheRead + cacheWrite,
+        input: input,
+        output: output,
+        cacheRead: cacheRead,
+        cacheWrite: cacheWrite
+      })
+    }
+    rows.sort(function(a, b) { return b.total - a.total })
+    return rows.slice(0, 4)
+  }
+
+  function modelTooltip(row) {
+    if (!row) return ""
+    return "In " + usage.formatTokenCount(row.input)
+      + " · out " + usage.formatTokenCount(row.output)
+      + " · cache read " + usage.formatTokenCount(row.cacheRead)
+      + " · cache write " + usage.formatTokenCount(row.cacheWrite)
+  }
+
+  // Only speaks up when the numbers cover more than this machine.
+  function footerText() {
+    if (usage.syncStatusText !== "") return usage.syncStatusText
+    if (provider && provider.syncEnabled && provider.syncDeviceCount > 0)
+      return "Merged from " + provider.syncDeviceCount + " device" + (provider.syncDeviceCount === 1 ? "" : "s")
+    return ""
+  }
+
+  // Agents that ship a white mark carry an `assets/<id>-light.svg` twin for
+  // light surfaces; marks that work on both (Claude's brand-orange) ship one
+  // file. The luminance check decides which candidate to try first.
+  function colorChannelLuminance(value) {
+    var channel = Number(value)
+    if (!isFinite(channel)) return 0
+    return channel <= 0.03928 ? channel / 12.92 : Math.pow((channel + 0.055) / 1.055, 2.4)
+  }
+
+  function colorLuminance(color) {
+    return 0.2126 * colorChannelLuminance(color.r)
+      + 0.7152 * colorChannelLuminance(color.g)
+      + 0.0722 * colorChannelLuminance(color.b)
+  }
+
+  // Marks resolve by convention, so a new agent's data file needs nothing
+  // from this panel: assets/<id>.svg if it ships one, the module's bar glyph
+  // if it doesn't.
+  function iconCandidatesForProvider(p, surfaceColor) {
+    if (!p) return []
+    var candidates = []
+    if (colorLuminance(surfaceColor || Color.background) >= 0.5)
+      candidates.push(Qt.resolvedUrl("assets/" + p.providerId + "-light.svg"))
+    candidates.push(Qt.resolvedUrl("assets/" + p.providerId + ".svg"))
+    return candidates
+  }
+
+  // Nothing to report, nothing in the bar: Bar.qml collapses a slot whose item
+  // is invisible, so the icon appears the moment the first scan finds usage and
+  // stays away entirely on a machine that has never run either CLI.
+  visible: providers.length > 0
+  implicitWidth: button.implicitWidth
+  implicitHeight: button.implicitHeight
+
+  onProviderIndexChanged: if (panelFlick) panelFlick.contentY = 0
+  onOpenedChanged: if (opened) {
+    cursorActive = false
+    nowMs = Date.now()
+    if (panelFlick) panelFlick.contentY = 0
+    usage.refreshLimits()
+    Qt.callLater(function() { keyCatcher.forceActiveFocus() })
+  }
+
+  Main {
+    id: usage
+    settings: root.settings
+  }
+
+  // Cheap enough to keep running: it only re-evaluates text bindings, and a
+  // stale "resets in 2h" on a panel that is open is worse than a timer.
+  Timer {
+    interval: 30000
+    running: root.opened
+    repeat: true
+    onTriggered: root.nowMs = Date.now()
+  }
+
+  IpcHandler {
+    target: root.ipcTarget
+    function open(): void { root.open() }
+    function close(): void { root.close() }
+    function show(): void { root.open() }
+    function hide(): void { root.close() }
+    function toggle(): void { root.toggle() }
+    function refresh(): string { root.refreshNow(); return "ok" }
+    function next(): string { root.selectProvider(root.providerIndex + 1); return "ok" }
+  }
+
+  WidgetButton {
+    id: button
+    anchors.fill: parent
+    bar: root.bar
+    text: root.barLabel
+    active: root.alarming
+    tooltipText: root.barTooltip
+    onPressed: function(buttonCode) {
+      if (buttonCode === Qt.RightButton) root.launchAgent()
+      else if (buttonCode === Qt.MiddleButton) root.selectProvider(root.providerIndex + 1)
+      else root.toggle()
+    }
+  }
+
+  KeyboardPanel {
+    id: panel
+    anchorItem: button
+    owner: root
+    bar: root.bar
+    open: root.opened
+    focusTarget: keyCatcher
+    contentWidth: panel.fittedContentWidth(Style.space(380))
+    // Taller than the control panels on purpose: this one is a dashboard, and
+    // the whole point is reading limits and history without scrolling.
+    contentHeight: panel.fittedContentHeight(column.implicitHeight, Style.space(640))
+
+    PanelKeyCatcher {
+      id: keyCatcher
+      anchors.fill: parent
+
+      onMoveRequested: function(dx, dy) {
+        if (dx !== 0) {
+          root.cursorActive = true
+          root.selectProvider(root.providerIndex + dx)
+        }
+        if (dy !== 0)
+          panelFlick.contentY = root.clamp(panelFlick.contentY + dy * Style.space(56), 0,
+                                           Math.max(0, panelFlick.contentHeight - panelFlick.height))
+      }
+      onActivateRequested: root.refreshNow()
+      onCloseRequested: root.close()
+      onTabRequested: function(direction) { root.switchPanel(direction) }
+      onTextKey: function(t) { if (t === "r" || t === "R") root.refreshNow() }
+
+      Flickable {
+        id: panelFlick
+        anchors.fill: parent
+        contentWidth: width
+        contentHeight: column.implicitHeight
+        clip: true
+        boundsBehavior: Flickable.StopAtBounds
+        flickableDirection: Flickable.VerticalFlick
+        interactive: contentHeight > height
+        ScrollBar.vertical: ScrollBar { policy: ScrollBar.AsNeeded }
+
+        Column {
+          id: column
+          width: panelFlick.width
+          spacing: Style.space(12)
+
+          // ---------- Hero: provider mark · name · plan ----------
+          PanelHero {
+            id: hero
+            visible: !!root.provider
+            width: parent.width
+            title: root.provider ? root.provider.providerName : ""
+            meta: root.heroMeta(root.provider)
+            foreground: root.foreground
+            fontFamily: root.fontFamily
+
+            iconComponent: Component {
+              Item {
+                id: heroMark
+                property var candidates: root.iconCandidatesForProvider(root.provider, root.surface)
+                // Provider objects are rebuilt on every refresh, which churns the
+                // array's identity without changing its content. Restart the fallback
+                // walk only when the URLs change: re-pointing source at a URL whose
+                // load already failed emits no statusChanged, so an identity-only
+                // reset would strand the walker on a missing -light twin.
+                property string candidatesKey: candidates.join("\n")
+                property int candidateIndex: 0
+                onCandidatesKeyChanged: candidateIndex = 0
+
+                width: Style.font.display
+                height: Style.font.display
+
+                Image {
+                  id: heroMarkImage
+                  anchors.fill: parent
+                  source: heroMark.candidateIndex < heroMark.candidates.length ? heroMark.candidates[heroMark.candidateIndex] : ""
+                  sourceSize.width: Style.font.display * 2
+                  sourceSize.height: Style.font.display * 2
+                  fillMode: Image.PreserveAspectFit
+                  // Advancing source from inside its own status change trips the
+                  // binding-loop detector; defer the step one tick.
+                  onStatusChanged: if (status === Image.Error && heroMark.candidateIndex < heroMark.candidates.length)
+                    Qt.callLater(function() { heroMark.candidateIndex++ })
+                }
+
+                Text {
+                  anchors.centerIn: parent
+                  visible: heroMarkImage.status !== Image.Ready
+                  text: root.glyph
+                  color: root.foreground
+                  font.family: root.fontFamily
+                  font.pixelSize: Style.font.display
+                }
+              }
+            }
+          }
+
+          Text {
+            visible: root.providers.length === 0
+            width: parent.width
+            topPadding: Style.space(24)
+            text: "No AI coding subscriptions found.\nAgents show up here once you've used them."
+            color: root.dim
+            font.family: root.fontFamily
+            font.pixelSize: Style.font.body
+            horizontalAlignment: Text.AlignHCenter
+            wrapMode: Text.WordWrap
+          }
+
+          // ---------- Provider switch ----------
+          Row {
+            id: providerSwitch
+            visible: root.providers.length > 1
+            width: parent.width
+            spacing: Style.spacing.md
+
+            readonly property real cellWidth: root.providers.length > 0
+              ? (width - spacing * (root.providers.length - 1)) / root.providers.length
+              : 0
+
+            Repeater {
+              model: root.providers
+
+              Button {
+                required property var modelData
+                required property int index
+
+                width: providerSwitch.cellWidth
+                text: modelData.providerName
+                selected: index === root.providerIndex
+                hasCursor: root.cursorActive && index === root.providerIndex
+                bordered: true
+                foreground: root.foreground
+                fontFamily: root.fontFamily
+                fontSize: Style.font.bodySmall
+                verticalPadding: Style.spacing.controlPaddingY
+                onClicked: {
+                  root.cursorActive = true
+                  root.selectProvider(index)
+                }
+                onHovered: function(isHovered) { if (isHovered) root.cursorActive = true }
+              }
+            }
+          }
+
+          // ---------- Status ----------
+          BorderSurface {
+            visible: !!root.provider && String(root.provider.usageStatusText || "") !== ""
+            width: parent.width
+            implicitHeight: statusText.implicitHeight + Style.spacing.xl * 2
+            color: root.alpha(root.urgent, 0.10)
+            borderSpec: Border.flat(root.alpha(root.urgent, 0.35), 1)
+            radius: Style.cornerRadius
+
+            Text {
+              id: statusText
+              anchors.left: parent.left
+              anchors.right: parent.right
+              anchors.verticalCenter: parent.verticalCenter
+              anchors.leftMargin: Style.space(12)
+              anchors.rightMargin: Style.space(12)
+              text: root.provider ? String(root.provider.authHelpText || "") : ""
+              color: root.dim
+              font.family: root.fontFamily
+              font.pixelSize: Style.font.caption
+              wrapMode: Text.WordWrap
+            }
+          }
+
+          // ---------- Balance / limits ----------
+          PanelSeparator {
+            visible: balanceSection.visible || limitsSection.visible
+            foreground: root.foreground
+          }
+
+          Column {
+            id: balanceSection
+            visible: !!root.balance
+            width: parent.width
+            spacing: Style.space(10)
+
+            // The meter shows what is left, not what is used: a prepaid
+            // account drains toward empty rather than filling toward a cap.
+            readonly property real ratio: root.balance && root.balance.funded > 0
+              ? root.clamp(root.balance.remaining / root.balance.funded, 0, 1)
+              : -1
+
+            PanelSectionHeader {
+              width: parent.width
+              text: "BALANCE"
+              foreground: root.foreground
+              fontFamily: root.fontFamily
+            }
+
+            Item {
+              width: parent.width
+              implicitHeight: Math.max(balanceLabel.implicitHeight, balanceValue.implicitHeight)
+
+              Text {
+                id: balanceLabel
+                text: "Prepaid credits"
+                color: root.foreground
+                font.family: root.fontFamily
+                font.pixelSize: Style.font.body
+                anchors.left: parent.left
+                anchors.verticalCenter: parent.verticalCenter
+              }
+
+              Text {
+                id: balanceValue
+                text: root.balance ? root.formatMoney(root.balance.remaining, root.balance.currency) : ""
+                color: root.balanceAlarming ? root.urgent : root.foreground
+                font.family: root.fontFamily
+                font.pixelSize: Style.font.caption
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+              }
+            }
+
+            Meter {
+              visible: balanceSection.ratio >= 0
+              width: parent.width
+              value: balanceSection.ratio
+              alarming: root.balanceAlarming
+            }
+
+            Text {
+              visible: text !== ""
+              width: parent.width
+              text: root.balanceDetailText(root.balance)
+              color: root.dim
+              font.family: root.fontFamily
+              font.pixelSize: Style.font.caption
+            }
+          }
+
+          Column {
+            id: limitsSection
+            visible: root.limits.length > 0
+            width: parent.width
+            spacing: Style.space(10)
+
+            PanelSectionHeader {
+              text: "LIMITS"
+              foreground: root.foreground
+              fontFamily: root.fontFamily
+            }
+
+            Repeater {
+              model: root.limits
+
+              LimitRow {
+                required property var modelData
+                width: limitsSection.width
+                window: modelData
+              }
+            }
+          }
+
+          // ---------- Usage ----------
+          PanelSeparator {
+            visible: usageSection.visible
+            foreground: root.foreground
+          }
+
+          Column {
+            id: usageSection
+            visible: !!root.provider && root.provider.recentDays && root.provider.recentDays.length > 0
+            width: parent.width
+            spacing: Style.spacing.md
+
+            readonly property var days: root.provider ? (root.provider.recentDays || []) : []
+            readonly property real peak: Math.max(1, root.weekPeak(root.provider))
+
+            PanelSectionHeader {
+              width: parent.width
+              text: "TOKENS BY DAY"
+              foreground: root.foreground
+              fontFamily: root.fontFamily
+            }
+
+            Repeater {
+              model: usageSection.days
+
+              DayRow {
+                required property var modelData
+                required property int index
+
+                width: usageSection.width
+                day: modelData
+                ratio: Number(modelData.messageCount || 0) / usageSection.peak
+                // By date, not by position: the Claude stats-cache fallback can
+                // hand us a window that stops short of today.
+                today: String(modelData.date || "") === root.todayDate()
+              }
+            }
+          }
+
+          // ---------- Models ----------
+          PanelSeparator {
+            visible: modelSection.visible
+            foreground: root.foreground
+          }
+
+          Column {
+            id: modelSection
+            visible: root.models.length > 0
+            width: parent.width
+            spacing: Style.spacing.md
+
+            PanelSectionHeader {
+              width: parent.width
+              text: "TOKENS BY MODEL"
+              foreground: root.foreground
+              fontFamily: root.fontFamily
+            }
+
+            Repeater {
+              model: root.models
+
+              ModelRow {
+                required property var modelData
+                width: modelSection.width
+                row: modelData
+                // Scaled to the heaviest model, so the top row is always full —
+                // the same scale-to-peak the weekly chart uses for its busiest day.
+                share: modelData.total / Math.max(1, root.models[0].total)
+              }
+            }
+          }
+
+          Text {
+            visible: text !== ""
+            width: parent.width
+            topPadding: Style.space(2)
+            text: root.footerText()
+            color: root.dim
+            font.family: root.fontFamily
+            font.pixelSize: Style.font.caption
+            horizontalAlignment: Text.AlignHCenter
+            elide: Text.ElideRight
+          }
+        }
+      }
+    }
+  }
+
+  // A limit window: label and percentage, meter, and reset countdown.
+  component LimitRow: Column {
+    id: limitRow
+    property var window: null
+
+    readonly property bool alarming: window && window.percent >= 0.9
+
+    spacing: Style.space(6)
+
+    Item {
+      width: parent.width
+      implicitHeight: Math.max(limitLabel.implicitHeight, limitValue.implicitHeight)
+
+      Text {
+        id: limitLabel
+        // A model-scoped window is titled after its model, and those names run
+        // long enough to reach the percentage, so the title gives way first.
+        text: limitRow.window ? limitRow.window.title : ""
+        color: root.foreground
+        font.family: root.fontFamily
+        font.pixelSize: Style.font.body
+        elide: Text.ElideRight
+        anchors.left: parent.left
+        anchors.right: limitValue.left
+        anchors.rightMargin: Style.spacing.sm
+        anchors.verticalCenter: parent.verticalCenter
+      }
+
+      Text {
+        id: limitValue
+        text: limitRow.window && limitRow.window.percent >= 0
+          ? Math.round(limitRow.window.percent * 100) + "%"
+          : "—"
+        color: limitRow.alarming ? root.urgent : root.foreground
+        font.family: root.fontFamily
+        font.pixelSize: Style.font.caption
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+      }
+    }
+
+    Meter {
+      width: parent.width
+      value: limitRow.window ? limitRow.window.percent : -1
+      alarming: limitRow.alarming
+    }
+
+    Text {
+      id: resetText
+      width: parent.width
+      text: {
+        var remainingMs = root.resetMsFor(limitRow.window)
+        return remainingMs > 0 ? "Resets in " + root.formatDuration(remainingMs) : ""
+      }
+      color: root.dim
+      font.family: root.fontFamily
+      font.pixelSize: Style.font.caption
+    }
+  }
+
+  // Rounded track showing the percentage of the allowance used.
+  component Meter: Item {
+    id: meter
+    property real value: -1
+    property bool alarming: false
+    property real thickness: Math.max(Style.space(4), Math.round(Style.spacing.controlHeight * 0.14))
+
+    implicitHeight: thickness
+
+    Rectangle {
+      id: meterTrack
+      anchors.fill: parent
+      radius: height / 2
+      color: root.track
+    }
+
+    Rectangle {
+      anchors.left: meterTrack.left
+      anchors.verticalCenter: meterTrack.verticalCenter
+      height: meterTrack.height
+      radius: meterTrack.radius
+      width: meterTrack.width * root.clamp(meter.value, 0, 1)
+      color: meter.alarming ? root.urgent : root.foreground
+
+      Behavior on width {
+        NumberAnimation { duration: 160; easing.type: Easing.OutCubic }
+      }
+    }
+
+  }
+
+  // One row per day: label, bar, tokens. Today is picked out in full
+  // foreground so the week reads as a run-up to right now.
+  component DayRow: Item {
+    id: dayRow
+    property var day: null
+    property real ratio: 0
+    property bool today: false
+
+    implicitHeight: Math.max(dayLabel.implicitHeight, dayValue.implicitHeight) + Style.spacing.sm
+
+    Text {
+      id: dayLabel
+      text: root.dayLabel(dayRow.day ? dayRow.day.date : "", dayRow.today)
+      color: dayRow.today ? root.foreground : root.dim
+      font.family: root.fontFamily
+      font.pixelSize: Style.font.caption
+      font.bold: dayRow.today
+      anchors.left: parent.left
+      anchors.verticalCenter: parent.verticalCenter
+      width: Style.space(52)
+    }
+
+    Rectangle {
+      id: dayTrack
+      anchors.left: dayLabel.right
+      anchors.right: dayValue.left
+      anchors.leftMargin: Style.space(8)
+      anchors.rightMargin: Style.space(10)
+      anchors.verticalCenter: parent.verticalCenter
+      height: Math.max(Style.space(4), Math.round(Style.spacing.controlHeight * 0.14))
+      radius: height / 2
+      color: root.track
+
+      Rectangle {
+        anchors.left: parent.left
+        anchors.verticalCenter: parent.verticalCenter
+        height: parent.height
+        radius: parent.radius
+        width: parent.width * root.clamp(dayRow.ratio, 0, 1)
+        color: dayRow.today ? root.foreground : root.alpha(root.foreground, 0.55)
+
+        Behavior on width {
+          NumberAnimation { duration: 160; easing.type: Easing.OutCubic }
+        }
+      }
+    }
+
+    Text {
+      id: dayValue
+      text: usage.formatTokenCount(dayRow.day ? Number(dayRow.day.messageCount || 0) : 0)
+      color: dayRow.today ? root.foreground : root.dim
+      font.family: root.fontFamily
+      font.pixelSize: Style.font.caption
+      font.bold: true
+      horizontalAlignment: Text.AlignRight
+      anchors.right: parent.right
+      anchors.verticalCenter: parent.verticalCenter
+      width: Style.space(52)
+    }
+
+    MouseArea {
+      id: dayHover
+      anchors.fill: parent
+      hoverEnabled: true
+      acceptedButtons: Qt.NoButton
+    }
+
+    PanelToolTip {
+      visible: dayHover.containsMouse
+      text: root.dayTooltip(dayRow.day, dayRow.today)
+      fontFamily: root.fontFamily
+    }
+  }
+
+  // Model rows read as a table: the share bar fills the row behind the label
+  // instead of stacking under it, which keeps the whole dashboard on one screen.
+  component ModelRow: Item {
+    id: modelRow
+    property var row: null
+    property real share: 0
+
+    implicitHeight: modelName.implicitHeight + Style.spacing.lg
+
+    Rectangle {
+      anchors.fill: parent
+      radius: Style.cornerRadius
+      color: root.alpha(root.foreground, 0.05)
+    }
+
+    Rectangle {
+      anchors.left: parent.left
+      anchors.top: parent.top
+      anchors.bottom: parent.bottom
+      width: parent.width * root.clamp(modelRow.share, 0, 1)
+      radius: Style.cornerRadius
+      color: root.alpha(root.foreground, 0.14)
+
+      Behavior on width {
+        NumberAnimation { duration: 160; easing.type: Easing.OutCubic }
+      }
+    }
+
+    Text {
+      id: modelName
+      text: modelRow.row ? modelRow.row.name : ""
+      color: root.foreground
+      font.family: root.fontFamily
+      font.pixelSize: Style.font.bodySmall
+      elide: Text.ElideRight
+      anchors.left: parent.left
+      anchors.leftMargin: Style.space(8)
+      anchors.right: modelTokens.left
+      anchors.rightMargin: Style.space(8)
+      anchors.verticalCenter: parent.verticalCenter
+    }
+
+    Text {
+      id: modelTokens
+      text: modelRow.row ? usage.formatTokenCount(modelRow.row.total) : ""
+      color: root.dim
+      font.family: root.fontFamily
+      font.pixelSize: Style.font.bodySmall
+      font.bold: true
+      anchors.right: parent.right
+      anchors.rightMargin: Style.space(8)
+      anchors.verticalCenter: parent.verticalCenter
+    }
+
+    MouseArea {
+      id: modelHover
+      anchors.fill: parent
+      hoverEnabled: true
+      acceptedButtons: Qt.NoButton
+    }
+
+    PanelToolTip {
+      visible: modelHover.containsMouse
+      text: root.modelTooltip(modelRow.row)
+      fontFamily: root.fontFamily
+    }
+  }
+}
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/README.md b/root/private_dot_config/omarchy/plugins/carson.agents/README.md
new file mode 100644
index 0000000..51ad4e4
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/README.md
@@ -0,0 +1,150 @@
+# Agents
+
+One bar icon and one panel for every AI coding subscription on the machine.
+The panel is strictly a display: it watches the usage records that
+`omarchy-agent-usage-update` writes to `~/.local/state/omarchy/agents/usage/`
+and draws whatever appears there. `Panel.qml` owns the bar button and the
+popup; `Main.qml` discovers and watches the records (and handles the optional
+cross-device aggregation); `Agent.qml` is the per-record file watcher.
+
+## Panel
+
+- **Hero** — the mark, the tool, and the plan it runs on ("Max 20x", "Pro").
+  Auth and endpoint problems replace the plan line and repeat in a card.
+- **Subscription switch** — one chip per enabled agent (`h`/`l` or click).
+  It appears only when more than one agent is enabled.
+- **Limits** — the percentage of each allowance used, a matching meter, and
+  the time until the session or weekly window resets.
+- **Balance** — prepaid agents report a credit ledger instead of limits:
+  remaining credit, a fuel-gauge meter that drains toward empty, and
+  funded-versus-spent detail.
+- **Tokens by day** — one row per day for the last week: day, bar, tokens, with today
+  bolded at the bottom. Hover today for its prompt and session count.
+- **Tokens by model** — tokens per model with the bar behind each row scaled
+  to the heaviest model,
+  the same way the weekly chart scales to its busiest day. Hover for the
+  input / output / cache split.
+
+A subscription appears only when it is enabled in settings and has actually
+recorded usage — on this machine or on a synced one. With one such agent
+there is no switch row at all; with none, the module leaves the bar entirely
+rather than sitting there with nothing to say. A CLI installed mid-session
+shows up at the next refresh, so nothing polls the disk waiting for it.
+
+That self-hiding is why the widget ships in the default bar layout: a machine
+that has never run an AI coding agent draws nothing, and the icon arrives on
+its own the first time a scan finds usage. Drop it with
+`omarchy plugin disable omarchy.agents`.
+
+## Data
+
+Each agent is one JSON record in `~/.local/state/omarchy/agents/usage/`,
+written by `omarchy-agent-usage-update`. That command runs one
+`omarchy-agent-usage-<agent>` collector per agent; the widget invokes it
+on its refresh timer and whenever you ask for a refresh, and picks up any
+record that lands in the directory regardless of who wrote it.
+
+Adding an agent therefore never touches this plugin: ship a collector that
+prints the record contract (see the `claude` and `codex` collectors in
+`bin/`), and the panel gains a tab. An `assets/<id>.svg` mark is optional —
+with an `assets/<id>-light.svg` twin if the mark needs a dark variant for
+light surfaces — and the bar glyph stands in when there is none.
+
+| Collector | Limits | Local stats |
+|---|---|---|
+| `claude` | Anthropic's OAuth usage endpoint (5-hour session + 7-day weekly) | `~/.claude/projects` transcripts, opencode sessions on an Anthropic provider, plus `stats-cache.json` and `history.jsonl` as fallback |
+| `codex` | The Codex app-server RPC | native Codex CLI session files (plus pi and opencode sessions) |
+| `fireworks` | Estimated prepaid balance: configured funding minus rated account costs | Fireworks billing API, grouped by day and model for the last 30 days |
+
+Claude limits need a signed-in CLI; without credentials the panel says so and
+falls back to local stats only. A non-default Claude directory is honored via
+`CLAUDE_CONFIG_DIR`, Codex via `CODEX_HOME`. Fireworks reads
+`FIREWORKS_API_KEY` and `FIREWORKS_ACCOUNT_ID` first, then
+`~/.fireworks/auth.ini` (which `firectl set-api-key` creates), then the key
+opencode stores in `~/.local/share/opencode/auth.json` when Fireworks is
+signed in there.
+
+### Fireworks balance
+
+The collector first asks the account's `:getBalance` endpoint for the real
+prepaid ledger. That endpoint exists but is permission-gated, and as of
+August 2026 no console-issued API key passes it — Fireworks appears to
+reserve it for the dashboard session. The probe stays because it is cheap
+and the live figure lights up automatically if Fireworks ever opens it to
+keys. Until then the collector falls back to estimating the balance from
+configuration in `~/.config/omarchy/agents/fireworks.json`:
+
+```json
+{
+  "accountId": "",
+  "fundedAmount": 20,
+  "fundedAt": "2026-07-01"
+}
+```
+
+Set `fundedAmount` to the credits purchased and optionally `fundedAt` to the
+purchase date; with no date, the collector uses the account creation time. It
+subtracts rated account costs and the panel labels the result as estimated.
+For a later top-up, increase `fundedAmount` by the new credit while keeping
+the original `fundedAt`, so both the funding and spend still cover the same
+period. `accountId` only matters when one API key can access several
+accounts. Without a configured `fundedAmount` the tab still shows token
+usage, just no balance. With a live ledger, `fundedAmount` is optional and
+only adds the meter and the spent-of-funded line under the real figure.
+
+## Interactions
+
+- Bar icon: left = panel, right = launch agent, middle = next subscription.
+- Panel: `h`/`l` switch subscription, `j`/`k` scroll, `r` or Enter refresh,
+  Tab moves to the neighboring bar panel, Esc closes.
+- IPC: `omarchy-shell omarchy.agents <open|close|toggle|refresh|next>`.
+
+## Settings
+
+Settings live in the widget's entry in `~/.config/omarchy/shell.json`. The
+top-level keys can be set with
+`omarchy bar set omarchy.agents <key> <value>`:
+
+| Key | Default | What it does |
+|---|---|---|
+| `refreshIntervalSec` | `900` | How often the usage records regenerate |
+| `syncMode` | `"Off"` | `"On"` writes this machine's snapshot and merges the others |
+| `syncDir` | `""` | A folder synced by Syncthing, Dropbox, rsync, … |
+| `syncFileName` | `<hostname>.json` | This machine's snapshot file |
+| `syncDeviceId` | hostname | Stable device name inside the snapshot |
+
+Numbers need `--json`, or they land in `shell.json` as strings:
+
+```bash
+omarchy bar set omarchy.agents refreshIntervalSec 300 --json
+omarchy bar set omarchy.agents syncDir '~/Sync/agent-usage'
+```
+
+Per-agent enablement is nested, and `set` writes its key literally rather
+than walking a dotted path — so pass the whole `providers` object as JSON (or
+edit `shell.json` directly):
+
+```bash
+omarchy bar set omarchy.agents providers '{
+  "claude": { "enabled": true },
+  "codex": { "enabled": false },
+  "fireworks": { "enabled": true }
+}' --json
+```
+
+`enabled` defaults to `true` for every discovered agent; set it to `false` to
+hide a subscription that is installed. Disabled agents are also skipped when
+the records regenerate.
+
+With `syncMode` on, every `*.json` snapshot in `syncDir` is merged, so today,
+the last 7 days, and the all-time totals cover every machine you code on —
+active days are unioned by date rather than summed. Rate limits stay
+per-account and are never merged. A record may declare `"scope": "account"`
+when its stats are account-global rather than machine-local (Fireworks'
+billing API); those merge by taking the widest value instead of summing, so
+the same account synced from two machines is not counted twice.
+
+One caveat on "all-time": the Codex collector only reads native session files
+touched in the last 30 days, and Fireworks requests the last 30 days from its
+billing API, so their totals and day counts cover that window. Claude's cover
+every transcript still on disk.
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/assets/claude.svg b/root/private_dot_config/omarchy/plugins/carson.agents/assets/claude.svg
new file mode 100644
index 0000000..d300701
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/assets/claude.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="257" preserveAspectRatio="xMidYMid" viewBox="0 0 256 257"><path fill="#D97757" d="m50.228 170.321 50.357-28.257.843-2.463-.843-1.361h-2.462l-8.426-.518-28.775-.778-24.952-1.037-24.175-1.296-6.092-1.297L0 125.796l.583-3.759 5.12-3.434 7.324.648 16.202 1.101 24.304 1.685 17.629 1.037 26.118 2.722h4.148l.583-1.685-1.426-1.037-1.101-1.037-25.147-17.045-27.22-18.017-14.258-10.37-7.713-5.25-3.888-4.925-1.685-10.758 7-7.713 9.397.649 2.398.648 9.527 7.323 20.35 15.75L94.817 91.9l3.889 3.24 1.555-1.102.195-.777-1.75-2.917-14.453-26.118-15.425-26.572-6.87-11.018-1.814-6.61c-.648-2.723-1.102-4.991-1.102-7.778l7.972-10.823L71.42 0 82.05 1.426l4.472 3.888 6.61 15.101 10.694 23.786 16.591 32.34 4.861 9.592 2.592 8.879.973 2.722h1.685v-1.556l1.36-18.211 2.528-22.36 2.463-28.776.843-8.1 4.018-9.722 7.971-5.25 6.222 2.981 5.12 7.324-.713 4.73-3.046 19.768-5.962 30.98-3.889 20.739h2.268l2.593-2.593 10.499-13.934 17.628-22.036 7.778-8.749 9.073-9.657 5.833-4.601h11.018l8.1 12.055-3.628 12.443-11.342 14.388-9.398 12.184-13.48 18.147-8.426 14.518.778 1.166 2.01-.194 30.46-6.481 16.462-2.982 19.637-3.37 8.88 4.148.971 4.213-3.5 8.62-20.998 5.184-24.628 4.926-36.682 8.685-.454.324.519.648 16.526 1.555 7.065.389h17.304l32.21 2.398 8.426 5.574 5.055 6.805-.843 5.184-12.962 6.611-17.498-4.148-40.83-9.721-14-3.5h-1.944v1.167l11.666 11.406 21.387 19.314 26.767 24.887 1.36 6.157-3.434 4.86-3.63-.518-23.526-17.693-9.073-7.972-20.545-17.304h-1.36v1.814l4.73 6.935 25.017 37.59 1.296 11.536-1.814 3.76-6.481 2.268-7.13-1.297-14.647-20.544-15.1-23.138-12.185-20.739-1.49.843-7.194 77.448-3.37 3.953-7.778 2.981-6.48-4.925-3.436-7.972 3.435-15.749 4.148-20.544 3.37-16.333 3.046-20.285 1.815-6.74-.13-.454-1.49.194-15.295 20.999-23.267 31.433-18.406 19.702-4.407 1.75-7.648-3.954.713-7.064 4.277-6.286 25.47-32.405 15.36-20.092 9.917-11.6-.065-1.686h-.583L44.07 198.125l-12.055 1.555-5.185-4.86.648-7.972 2.463-2.593 20.35-13.999-.064.065Z"/></svg>
\ No newline at end of file
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/assets/codex-light.svg b/root/private_dot_config/omarchy/plugins/carson.agents/assets/codex-light.svg
new file mode 100644
index 0000000..62b6686
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/assets/codex-light.svg
@@ -0,0 +1 @@
+<svg fill="#111" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Codex</title><path clip-rule="evenodd" d="M8.086.457a6.105 6.105 0 013.046-.415c1.333.153 2.521.72 3.564 1.7a.117.117 0 00.107.029c1.408-.346 2.762-.224 4.061.366l.063.03.154.076c1.357.703 2.33 1.77 2.918 3.198.278.679.418 1.388.421 2.126a5.655 5.655 0 01-.18 1.631.167.167 0 00.04.155 5.982 5.982 0 011.578 2.891c.385 1.901-.01 3.615-1.183 5.14l-.182.22a6.063 6.063 0 01-2.934 1.851.162.162 0 00-.108.102c-.255.736-.511 1.364-.987 1.992-1.199 1.582-2.962 2.462-4.948 2.451-1.583-.008-2.986-.587-4.21-1.736a.145.145 0 00-.14-.032c-.518.167-1.04.191-1.604.185a5.924 5.924 0 01-2.595-.622 6.058 6.058 0 01-2.146-1.781c-.203-.269-.404-.522-.551-.821a7.74 7.74 0 01-.495-1.283 6.11 6.11 0 01-.017-3.064.166.166 0 00.008-.074.115.115 0 00-.037-.064 5.958 5.958 0 01-1.38-2.202 5.196 5.196 0 01-.333-1.589 6.915 6.915 0 01.188-2.132c.45-1.484 1.309-2.648 2.577-3.493.282-.188.55-.334.802-.438.286-.12.573-.22.861-.304a.129.129 0 00.087-.087A6.016 6.016 0 015.635 2.31C6.315 1.464 7.132.846 8.086.457zm-.804 7.85a.848.848 0 00-1.473.842l1.694 2.965-1.688 2.848a.849.849 0 001.46.864l1.94-3.272a.849.849 0 00.007-.854l-1.94-3.393zm5.446 6.24a.849.849 0 000 1.695h4.848a.849.849 0 000-1.696h-4.848z"/></svg>
\ No newline at end of file
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/assets/codex.svg b/root/private_dot_config/omarchy/plugins/carson.agents/assets/codex.svg
new file mode 100644
index 0000000..1716a13
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/assets/codex.svg
@@ -0,0 +1 @@
+<svg fill="#fff" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Codex</title><path clip-rule="evenodd" d="M8.086.457a6.105 6.105 0 013.046-.415c1.333.153 2.521.72 3.564 1.7a.117.117 0 00.107.029c1.408-.346 2.762-.224 4.061.366l.063.03.154.076c1.357.703 2.33 1.77 2.918 3.198.278.679.418 1.388.421 2.126a5.655 5.655 0 01-.18 1.631.167.167 0 00.04.155 5.982 5.982 0 011.578 2.891c.385 1.901-.01 3.615-1.183 5.14l-.182.22a6.063 6.063 0 01-2.934 1.851.162.162 0 00-.108.102c-.255.736-.511 1.364-.987 1.992-1.199 1.582-2.962 2.462-4.948 2.451-1.583-.008-2.986-.587-4.21-1.736a.145.145 0 00-.14-.032c-.518.167-1.04.191-1.604.185a5.924 5.924 0 01-2.595-.622 6.058 6.058 0 01-2.146-1.781c-.203-.269-.404-.522-.551-.821a7.74 7.74 0 01-.495-1.283 6.11 6.11 0 01-.017-3.064.166.166 0 00.008-.074.115.115 0 00-.037-.064 5.958 5.958 0 01-1.38-2.202 5.196 5.196 0 01-.333-1.589 6.915 6.915 0 01.188-2.132c.45-1.484 1.309-2.648 2.577-3.493.282-.188.55-.334.802-.438.286-.12.573-.22.861-.304a.129.129 0 00.087-.087A6.016 6.016 0 015.635 2.31C6.315 1.464 7.132.846 8.086.457zm-.804 7.85a.848.848 0 00-1.473.842l1.694 2.965-1.688 2.848a.849.849 0 001.46.864l1.94-3.272a.849.849 0 00.007-.854l-1.94-3.393zm5.446 6.24a.849.849 0 000 1.695h4.848a.849.849 0 000-1.696h-4.848z"/></svg>
\ No newline at end of file
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/assets/fireworks.svg b/root/private_dot_config/omarchy/plugins/carson.agents/assets/fireworks.svg
new file mode 100644
index 0000000..a659bed
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/assets/fireworks.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <g fill="none" stroke="#ff6b22" stroke-linecap="round" stroke-width="5">
+    <path d="M32 5v12M32 47v12M5 32h12M47 32h12"/>
+    <path d="m13 13 8.5 8.5M42.5 42.5 51 51M51 13l-8.5 8.5M21.5 42.5 13 51"/>
+  </g>
+  <circle cx="32" cy="32" r="4" fill="#ff6b22"/>
+</svg>
diff --git a/root/private_dot_config/omarchy/plugins/carson.agents/manifest.json b/root/private_dot_config/omarchy/plugins/carson.agents/manifest.json
new file mode 100644
index 0000000..2c4b6d0
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.agents/manifest.json
@@ -0,0 +1,90 @@
+{
+  "schemaVersion": 1,
+  "id": "carson.agents",
+  "name": "My Agents",
+  "version": "1.0.0",
+  "author": "Omarchy",
+  "license": "MIT",
+  "description": "Claude Code, Codex, and Fireworks usage, limits, and pace in a native Omarchy bar panel.",
+  "kinds": [
+    "bar-widget"
+  ],
+  "activation": "on-demand",
+  "entryPoints": {
+    "barWidget": "Panel.qml"
+  },
+  "barWidget": {
+    "displayName": "My Agents",
+    "description": "One bar icon and one panel: rate-limit meters with pace, today, the last week, and the all-time model breakdown for every subscription.",
+    "category": "AI",
+    "aliases": [
+      "agents",
+      "model-usage"
+    ],
+    "allowMultiple": false,
+    "defaults": {
+      "providers": {
+        "claude": {
+          "enabled": true
+        },
+        "codex": {
+          "enabled": true
+        },
+        "fireworks": {
+          "enabled": true
+        }
+      },
+      "refreshIntervalSec": 900,
+      "syncMode": "Off",
+      "syncDir": "",
+      "syncFileName": "",
+      "syncDeviceId": ""
+    },
+    "schema": [
+      {
+        "key": "refreshIntervalSec",
+        "type": "integer",
+        "label": "Refresh interval (seconds)",
+        "min": 30,
+        "max": 3600,
+        "step": 30,
+        "defaultValue": 900
+      },
+      {
+        "key": "syncMode",
+        "type": "enum",
+        "label": "Synced aggregation",
+        "options": [
+          "Off",
+          "On"
+        ],
+        "defaultValue": "Off",
+        "description": "When On, write this machine's local usage snapshot and merge snapshots from other machines."
+      },
+      {
+        "key": "syncDir",
+        "type": "path",
+        "label": "Sync folder",
+        "defaultValue": "",
+        "description": "A folder synced by Syncthing, Dropbox, rsync, etc."
+      },
+      {
+        "key": "syncFileName",
+        "type": "string",
+        "label": "Snapshot file name",
+        "defaultValue": "",
+        "description": "Optional. Defaults to <hostname>.json. Use a different file name on each machine, such as laptop.json or desktop.json."
+      },
+      {
+        "key": "syncDeviceId",
+        "type": "string",
+        "label": "Device id",
+        "defaultValue": "",
+        "description": "Optional stable device name used inside synced aggregate snapshots."
+      }
+    ]
+  },
+  "omarchy": {
+    "clonedFrom": "omarchy.agents"
+  }
+}
diff --git a/root/private_dot_config/omarchy/plugins/carson.dotfiles/Widget.qml b/root/private_dot_config/omarchy/plugins/carson.dotfiles/Widget.qml
new file mode 100644
index 0000000..c4489ae
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.dotfiles/Widget.qml
@@ -0,0 +1,180 @@
+import QtQuick
+import Quickshell
+import Quickshell.Io
+import qs.Commons
+import qs.Ui
+
+// Bar widget for the state of the chezmoi dotfiles.
+//
+// Modelled on the first-party omarchy.system-update widget: invisible while
+// there is nothing to do, so it costs no bar space on a machine that is in
+// step. The counts come from `dotfiles-status`, which is also what the Omarchy
+// menu's Dotfiles submenu and dotfiles-sync read, so all three always agree.
+BarWidget {
+  id: root
+  moduleName: "carson.dotfiles"
+
+  // Straight from dotfiles-status; `loaded` distinguishes "all zero" from
+  // "not asked yet", which is what keeps the widget hidden on first paint.
+  property int applyNeeded: 0
+  property int localEdits: 0
+  property int behind: 0
+  property int ahead: 0
+  property int uncommitted: 0
+  property bool ok: true
+  property bool loaded: false
+  // [{path, status, added, removed, binary}] -- what an apply would change.
+  property var files: []
+
+  readonly property string glyph: "󰊢"
+
+  // localEdits means a target changed after chezmoi last wrote it -- an Omarchy
+  // migration, `omarchy refresh`, or a hand edit. chezmoi will not overwrite
+  // such a file without being told to, so this is the one state that needs a
+  // decision rather than just a command, and the only one that goes urgent.
+  readonly property bool needsDecision: localEdits > 0
+  readonly property bool hasWork: applyNeeded > 0 || localEdits > 0 || behind > 0
+                                  || ahead > 0 || uncommitted > 0
+
+  readonly property string badge: {
+    if (localEdits > 0) return "!" + localEdits
+    if (behind > 0) return "↓" + behind
+    if (ahead > 0) return "↑" + ahead
+    if (uncommitted > 0) return "↑" + uncommitted
+    if (applyNeeded > 0) return "•" + applyNeeded
+    return ""
+  }
+
+  // A vertical bar has no room for the glyph and the badge side by side.
+  readonly property string label: {
+    if (badge === "") return glyph
+    return root.vertical ? badge : glyph + "  " + badge
+  }
+
+  // How many files to name before collapsing the rest into a count.
+  readonly property int fileLimit: Math.max(0, root.setting("tooltipFiles", 8))
+
+  function describeFile(f) {
+    var change = f.binary ? "(binary)"
+      : "+" + (f.added || 0) + " -" + (f.removed || 0)
+    // Column 1 of `chezmoi status`: the target changed after chezmoi last
+    // wrote it. Worth calling out inline, since those are the ones an apply
+    // will refuse to overwrite.
+    var mark = (f.status && f.status.charAt(0) !== " ") ? "! " : "  "
+    return mark + f.path + "   " + change
+  }
+
+  readonly property string tooltip: {
+    var lines = []
+    if (localEdits > 0) lines.push(localEdits + " changed outside chezmoi — needs a decision")
+    if (applyNeeded > 0) lines.push(applyNeeded + " pending apply")
+    if (behind > 0) lines.push(behind + " commit(s) behind")
+    if (ahead > 0) lines.push(ahead + " commit(s) ahead")
+    if (uncommitted > 0) lines.push(uncommitted + " uncommitted change(s)")
+    if (!ok) lines.push("(status may be stale — could not reach the remote)")
+    if (lines.length === 0) lines.push("Dotfiles are in step")
+
+    var list = root.files || []
+    if (list.length > 0 && root.fileLimit > 0) {
+      lines.push("")
+      for (var i = 0; i < list.length && i < root.fileLimit; i++)
+        lines.push(root.describeFile(list[i]))
+      if (list.length > root.fileLimit)
+        lines.push("  … and " + (list.length - root.fileLimit) + " more")
+    }
+
+    lines.push("")
+    lines.push("Left: open sync menu · Right: pull & apply · Middle: refresh")
+    return lines.join("\n")
+  }
+
+  function refresh() {
+    if (!statusProc.running) statusProc.running = true
+  }
+
+  function apply(output) {
+    try {
+      var d = JSON.parse(String(output || "").trim())
+      root.applyNeeded = d.applyNeeded || 0
+      root.localEdits = d.localEdits || 0
+      root.behind = d.behind || 0
+      root.ahead = d.ahead || 0
+      root.uncommitted = d.uncommitted || 0
+      root.ok = d.ok === true
+      root.files = Array.isArray(d.files) ? d.files : []
+      root.loaded = true
+    } catch (e) {
+      console.warn("carson.dotfiles: could not parse dotfiles-status output:", e)
+      root.ok = false
+    }
+  }
+
+  function openSync() {
+    if (root.bar) root.bar.run("omarchy-launch-floating-terminal-with-presentation dotfiles-sync")
+  }
+
+  // Deliberately in a floating terminal rather than a silent Process: a pull can
+  // stop on a merge conflict or an out-of-band edit, and swallowing that would
+  // leave the bar quietly wrong.
+  function pullAndApply() {
+    if (root.bar) root.bar.run("omarchy-launch-floating-terminal-with-presentation dotfiles-sync pull")
+    settleTimer.restart()
+  }
+
+  visible: loaded && hasWork
+  implicitWidth: button.implicitWidth
+  implicitHeight: button.implicitHeight
+
+  IpcHandler {
+    target: "carson.dotfiles"
+
+    function refresh(): string {
+      root.broadcast("refresh")
+      return "ok"
+    }
+  }
+
+  Process {
+    id: statusProc
+    command: ["dotfiles-status", "--fetch"]
+    stdout: StdioCollector {
+      waitForEnd: true
+      onStreamFinished: root.apply(text)
+    }
+    stderr: StdioCollector {
+      waitForEnd: true
+      onStreamFinished: if (text.trim() !== "") console.warn("carson.dotfiles:", text.trim())
+    }
+  }
+
+  Timer {
+    id: pollTimer
+    interval: Math.max(60, root.setting("refreshIntervalSec", 1800)) * 1000
+    running: true
+    repeat: true
+    triggeredOnStart: true
+    onTriggered: root.refresh()
+  }
+
+  // Give a pull started above time to finish before re-reading the counts.
+  Timer {
+    id: settleTimer
+    interval: 20000
+    repeat: false
+    onTriggered: root.refresh()
+  }
+
+  WidgetButton {
+    id: button
+    anchors.fill: parent
+    bar: root.bar
+    text: root.label
+    active: root.needsDecision
+    tooltipText: root.tooltip
+    onPressed: function (buttonCode) {
+      if (buttonCode === Qt.RightButton) root.pullAndApply()
+      else if (buttonCode === Qt.MiddleButton) root.refresh()
+      else root.openSync()
+    }
+  }
+}
diff --git a/root/private_dot_config/omarchy/plugins/carson.dotfiles/manifest.json b/root/private_dot_config/omarchy/plugins/carson.dotfiles/manifest.json
new file mode 100644
index 0000000..0a83657
--- /dev/null
+++ b/root/private_dot_config/omarchy/plugins/carson.dotfiles/manifest.json
@@ -0,0 +1,47 @@
+{
+  "schemaVersion": 1,
+  "id": "carson.dotfiles",
+  "name": "Dotfiles",
+  "version": "1.0.0",
+  "author": "Carson Seese",
+  "description": "Shows when the chezmoi dotfiles and this machine have drifted apart, and offers the commands to put them back in step.",
+  "kinds": [
+    "bar-widget"
+  ],
+  "entryPoints": {
+    "barWidget": "Widget.qml"
+  },
+  "barWidget": {
+    "displayName": "Dotfiles",
+    "description": "Pending applies, out-of-band edits, and unpushed or unpulled commits in the dotfiles repo. Hidden while everything is in step.",
+    "category": "System",
+    "allowMultiple": false,
+    "defaultSection": "center",
+    "defaults": {
+      "refreshIntervalSec": 1800,
+      "tooltipFiles": 8
+    },
+    "schema": [
+      {
+        "key": "refreshIntervalSec",
+        "type": "integer",
+        "label": "Refresh interval (seconds)",
+        "min": 60,
+        "max": 21600,
+        "step": 60,
+        "defaultValue": 1800,
+        "description": "How often to re-check status. Each check contacts the git remote."
+      },
+      {
+        "key": "tooltipFiles",
+        "type": "integer",
+        "label": "Files listed in the tooltip",
+        "min": 0,
+        "max": 50,
+        "step": 1,
+        "defaultValue": 8,
+        "description": "How many changed files to name before collapsing the rest into a count. 0 hides the list."
+      }
+    ]
+  }
+}
diff --git a/root/private_dot_config/omarchy/shell.json b/root/private_dot_config/omarchy/shell.json
new file mode 100644
index 0000000..2dbbbf2
--- /dev/null
+++ b/root/private_dot_config/omarchy/shell.json
@@ -0,0 +1,93 @@
+{
+  "version": 1,
+  "idle": {
+    "screensaver": 150,
+    "lock": 300
+  },
+  "bar": {
+    "position": "top",
+    "transparent": false,
+    "centerAnchor": "omarchy.clock",
+    "layout": {
+      "left": [
+        {
+          "id": "omarchy.menu"
+        },
+        {
+          "id": "omarchy.workspaces"
+        }
+      ],
+      "center": [
+        {
+          "id": "omarchy.indicators"
+        },
+        {
+          "id": "omarchy.clock",
+          "format": "dddd HH:mm",
+          "formatAlt": "d MMMM 'W'ww yyyy",
+          "verticalFormat": "HH\n—\nmm"
+        },
+        {
+          "id": "omarchy.keyboard-layout"
+        },
+        {
+          "id": "omarchy.weather"
+        },
+        {
+          "id": "omarchy.system-update"
+        },
+        {
+          "id": "carson.dotfiles"
+        }
+      ],
+      "right": [
+        {
+          "id": "omarchy.tray",
+          "pinned": [],
+          "hidden": [
+            "Claude_status_icon_1"
+          ]
+        },
+        {
+          "id": "jkoestinger.vpn"
+        },
+        {
+          "id": "crmne.hyprmoncfg"
+        },
+        {
+          "id": "carson.agents"
+        },
+        {
+          "id": "omarchy.bluetooth"
+        },
+        {
+          "id": "omarchy.network"
+        },
+        {
+          "id": "omarchy.audio"
+        },
+        {
+          "id": "omarchy.monitor"
+        },
+        {
+          "id": "omarchy.power"
+        }
+      ]
+    }
+  },
+  "plugins": [
+    {
+      "id": "bobbynicholas.omaland"
+    },
+    {
+      "id": "io.github.sirjul1337.lock-explorer",
+      "design": "terminal"
+    }
+  ],
+  "disabledPlugins": [
+    "omarchy.lock"
+  ],
+  "cloneSourceRestores": [
+    "io.github.sirjul1337.lock-explorer"
+  ]
+}
diff --git a/root/private_dot_config/omarchy/themes/portland-head/backgrounds/0-portland-head.jpg b/root/private_dot_config/omarchy/themes/portland-head/backgrounds/0-portland-head.jpg
new file mode 100644
index 0000000..04519ab
Binary files /dev/null and b/root/private_dot_config/omarchy/themes/portland-head/backgrounds/0-portland-head.jpg differ
diff --git a/root/private_dot_config/omarchy/themes/portland-head/colors.toml b/root/private_dot_config/omarchy/themes/portland-head/colors.toml
new file mode 100644
index 0000000..90dbacc
--- /dev/null
+++ b/root/private_dot_config/omarchy/themes/portland-head/colors.toml
@@ -0,0 +1,36 @@
+# Portland Head
+# Every hue below is sampled from the image in backgrounds/ and then lifted for
+# contrast: the sky over the headland is the accent, the harbor water in shadow
+# is the background, and the whitewashed tower is the brightest foreground.
+
+mode = "dark"
+
+accent = "#6595cd"
+selection = "#1b3b52"
+muted = "#3f5f75"
+
+background = "#0c1a24"
+dark_background = "#091420"
+darker_background = "#060e17"
+lighter_background = "#132836"
+
+foreground = "#aec0cf"
+dark_foreground = "#5a7285"
+light_foreground = "#bfcedb"
+bright_foreground = "#dce6ee"
+
+red = "#b3766a"
+yellow = "#c2a468"
+orange = "#b57a55"
+green = "#7a8a52"
+cyan = "#4d8ba3"
+blue = "#6595cd"
+magenta = "#9080b0"
+brown = "#7a6a5c"
+
+bright_red = "#c4826f"
+bright_yellow = "#dcc084"
+bright_green = "#9aab6c"
+bright_cyan = "#6fb0c7"
+bright_blue = "#82afdb"
+bright_magenta = "#ab9bc9"
diff --git a/root/private_dot_config/pwsh/rc.d/10-path.ps1.tmpl b/root/private_dot_config/pwsh/rc.d/10-path.ps1.tmpl
new file mode 100644
index 0000000..133f424
--- /dev/null
+++ b/root/private_dot_config/pwsh/rc.d/10-path.ps1.tmpl
@@ -0,0 +1,4 @@
+$localBin = Join-Path $HOME ".local" "bin"
+if (Test-Path $localBin) {
+    $env:PATH = "$localBin;$env:PATH"
+}
diff --git a/root/private_dot_config/pwsh/rc.d/20-env.ps1.tmpl b/root/private_dot_config/pwsh/rc.d/20-env.ps1.tmpl
new file mode 100644
index 0000000..11d32e2
--- /dev/null
+++ b/root/private_dot_config/pwsh/rc.d/20-env.ps1.tmpl
@@ -0,0 +1 @@
+{{ template "env-powershell" . }}
diff --git a/root/private_dot_config/pwsh/rc.d/25-mise.ps1 b/root/private_dot_config/pwsh/rc.d/25-mise.ps1
new file mode 100644
index 0000000..16954b6
--- /dev/null
+++ b/root/private_dot_config/pwsh/rc.d/25-mise.ps1
@@ -0,0 +1,5 @@
+# Before every tool below: they can be mise-managed, and mise's shims are not
+# on PATH until this runs. Matches sh/rc.d/25-mise.sh.
+if (Get-Command mise -ErrorAction SilentlyContinue) {
+    (&mise activate pwsh) | Out-String | Invoke-Expression
+}
diff --git a/root/private_dot_config/pwsh/rc.d/40-starship.ps1 b/root/private_dot_config/pwsh/rc.d/40-starship.ps1
new file mode 100644
index 0000000..07de0f9
--- /dev/null
+++ b/root/private_dot_config/pwsh/rc.d/40-starship.ps1
@@ -0,0 +1,3 @@
+if (Get-Command starship -ErrorAction SilentlyContinue) {
+    Invoke-Expression (&starship init powershell)
+}
diff --git a/root/private_dot_config/pwsh/rc.d/42-zoxide.ps1 b/root/private_dot_config/pwsh/rc.d/42-zoxide.ps1
new file mode 100644
index 0000000..ed9d0de
--- /dev/null
+++ b/root/private_dot_config/pwsh/rc.d/42-zoxide.ps1
@@ -0,0 +1,3 @@
+if (Get-Command zoxide -ErrorAction SilentlyContinue) {
+    Invoke-Expression (& { (zoxide init powershell | Out-String) })
+}
diff --git a/root/private_dot_config/pwsh/rc.d/60-commands.ps1 b/root/private_dot_config/pwsh/rc.d/60-commands.ps1
new file mode 100644
index 0000000..72ea6f5
--- /dev/null
+++ b/root/private_dot_config/pwsh/rc.d/60-commands.ps1
@@ -0,0 +1,58 @@
+# Windows counterparts of the commands chezmoi installs to ~/.local/bin on
+# every other platform. .chezmoiignore drops .local/bin on Windows (those are
+# bash), so without these a Windows machine has no way to update itself.
+
+# Update everything: winget packages, mise, chezmoi, the dotfiles, then the
+# freshly pulled tool pins. Mirrors ~/.local/bin/update.
+function update {
+    function Step($m) { Write-Host "`n==> $m" -ForegroundColor Blue }
+
+    if (Get-Command winget -ErrorAction SilentlyContinue) {
+        Step "Updating system packages"
+        winget upgrade --all --silent --accept-source-agreements --accept-package-agreements
+    }
+
+    if (Get-Command mise -ErrorAction SilentlyContinue) {
+        Step "Updating mise"
+        # A package-managed mise (scoop, winget) has self-update disabled and
+        # exits nonzero; the step above is what updates those.
+        mise self-update --yes
+        if ($LASTEXITCODE -ne 0) { Write-Host "mise self-update skipped" }
+    }
+
+    Step "Updating chezmoi"
+    chezmoi upgrade
+
+    Step "Pulling latest dotfiles and applying"
+    chezmoi update
+
+    if (Get-Command mise -ErrorAction SilentlyContinue) {
+        Step "Upgrading mise tools"
+        mise upgrade
+    }
+
+    Step "Update complete"
+}
+
+# Prune what update leaves behind. Mirrors ~/.local/bin/clean.
+function clean {
+    function Step($m) { Write-Host "`n==> $m" -ForegroundColor Blue }
+
+    if (Get-Command mise -ErrorAction SilentlyContinue) {
+        Step "Pruning unused mise tool versions"
+        mise prune --yes
+
+        Step "Clearing mise download cache"
+        mise cache clear
+    }
+
+    Step "Clean complete"
+}
+
+# Write ~/work.email and re-apply so the work identity takes effect.
+# Mirrors ~/.local/bin/set-work-email.
+function set-work-email {
+    param([Parameter(Mandatory)][string]$Address)
+    Set-Content -Path (Join-Path $HOME "work.email") -Value $Address -NoNewline
+    chezmoi init --apply
+}
diff --git a/root/private_dot_config/sh/rc.d/00-shell.sh b/root/private_dot_config/sh/rc.d/00-shell.sh
new file mode 100644
index 0000000..fab07c5
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/00-shell.sh
@@ -0,0 +1,10 @@
+# Which shell is sourcing these drop-ins. Set once here so the later files can
+# hand the right name to `starship init`, `mise activate` and friends instead of
+# each re-deriving it.
+if [ -n "${ZSH_VERSION:-}" ]; then
+    DOTFILES_SHELL=zsh
+elif [ -n "${BASH_VERSION:-}" ]; then
+    DOTFILES_SHELL=bash
+else
+    DOTFILES_SHELL=sh
+fi
diff --git a/root/private_dot_config/sh/rc.d/05-brew.sh.tmpl b/root/private_dot_config/sh/rc.d/05-brew.sh.tmpl
new file mode 100644
index 0000000..7923b93
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/05-brew.sh.tmpl
@@ -0,0 +1,10 @@
+# Homebrew (macOS). Runs before 10-path.sh so our own bin dir still wins.
+if command -v brew >/dev/null 2>&1; then
+    eval "$(brew shellenv)"
+    if [ "$DOTFILES_SHELL" = bash ] && [ -r "$(brew --prefix)/etc/profile.d/bash_completion.sh" ]; then
+        . "$(brew --prefix)/etc/profile.d/bash_completion.sh"
+    fi
+    if [ "$DOTFILES_SHELL" = zsh ] && [ -r "$(brew --prefix)/share/zsh/site-functions" ]; then
+        fpath=("$(brew --prefix)/share/zsh/site-functions" $fpath)
+    fi
+fi
diff --git a/root/private_dot_config/sh/rc.d/10-path.sh.tmpl b/root/private_dot_config/sh/rc.d/10-path.sh.tmpl
new file mode 100644
index 0000000..6882d82
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/10-path.sh.tmpl
@@ -0,0 +1 @@
+export PATH="{{ .binDirAbs }}:$PATH"
diff --git a/root/private_dot_config/sh/rc.d/20-env.sh.tmpl b/root/private_dot_config/sh/rc.d/20-env.sh.tmpl
new file mode 100644
index 0000000..368564d
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/20-env.sh.tmpl
@@ -0,0 +1 @@
+{{ template "env-posix" . }}
diff --git a/root/private_dot_config/sh/rc.d/25-mise.sh b/root/private_dot_config/sh/rc.d/25-mise.sh
new file mode 100644
index 0000000..b41056d
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/25-mise.sh
@@ -0,0 +1,7 @@
+# Before every tool below: starship, zoxide and mcfly can all be mise-managed,
+# and mise's shim directory is not on PATH until this runs. Probing for them
+# first would silently skip their setup on a host where mise is the only thing
+# that provides them.
+if command -v mise >/dev/null 2>&1; then
+    eval "$(mise activate "$DOTFILES_SHELL" --shims)"
+fi
diff --git a/root/private_dot_config/sh/rc.d/30-completions.sh b/root/private_dot_config/sh/rc.d/30-completions.sh
new file mode 100644
index 0000000..65a1085
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/30-completions.sh
@@ -0,0 +1,4 @@
+# zsh needs compinit before anything that registers completions.
+if [ "$DOTFILES_SHELL" = zsh ]; then
+    autoload -U compinit && compinit
+fi
diff --git a/root/private_dot_config/sh/rc.d/40-starship.sh b/root/private_dot_config/sh/rc.d/40-starship.sh
new file mode 100644
index 0000000..23e33bb
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/40-starship.sh
@@ -0,0 +1,3 @@
+if command -v starship >/dev/null 2>&1; then
+    eval "$(starship init "$DOTFILES_SHELL")"
+fi
diff --git a/root/private_dot_config/sh/rc.d/42-zoxide.sh b/root/private_dot_config/sh/rc.d/42-zoxide.sh
new file mode 100644
index 0000000..0bcf83c
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/42-zoxide.sh
@@ -0,0 +1,3 @@
+if command -v zoxide >/dev/null 2>&1; then
+    eval "$(zoxide init "$DOTFILES_SHELL")"
+fi
diff --git a/root/private_dot_config/sh/rc.d/43-mcfly.sh b/root/private_dot_config/sh/rc.d/43-mcfly.sh
new file mode 100644
index 0000000..502ad5b
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/43-mcfly.sh
@@ -0,0 +1,3 @@
+if command -v mcfly >/dev/null 2>&1; then
+    eval "$(mcfly init "$DOTFILES_SHELL")"
+fi
diff --git a/root/private_dot_config/sh/rc.d/50-vscode.sh b/root/private_dot_config/sh/rc.d/50-vscode.sh
new file mode 100644
index 0000000..9c2f624
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/50-vscode.sh
@@ -0,0 +1,3 @@
+if [ "$TERM_PROGRAM" = "vscode" ] && command -v code >/dev/null 2>&1; then
+    . "$(code --locate-shell-integration-path "$DOTFILES_SHELL")"
+fi
diff --git a/root/private_dot_config/sh/rc.d/60-fzkill.sh b/root/private_dot_config/sh/rc.d/60-fzkill.sh
new file mode 100644
index 0000000..09968fb
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/60-fzkill.sh
@@ -0,0 +1,3 @@
+fzkill() {
+    ps -eo pid,args,%mem,%cpu | fzf --multi --header-lines=1 | awk '{print $1}' | xargs kill "$@"
+}
diff --git a/root/private_dot_config/sh/rc.d/70-history.sh b/root/private_dot_config/sh/rc.d/70-history.sh
new file mode 100644
index 0000000..e9032d7
--- /dev/null
+++ b/root/private_dot_config/sh/rc.d/70-history.sh
@@ -0,0 +1,18 @@
+if [ "$DOTFILES_SHELL" = zsh ]; then
+    HISTFILE=~/.zsh_history
+    HISTSIZE=20000
+    SAVEHIST=20000
+    setopt HIST_IGNORE_DUPS
+    setopt HIST_IGNORE_ALL_DUPS
+    setopt HIST_IGNORE_SPACE
+    setopt HIST_SAVE_NO_DUPS
+    setopt APPEND_HISTORY
+    setopt SHARE_HISTORY
+elif [ "$DOTFILES_SHELL" = bash ]; then
+    HISTFILE=~/.bash_history
+    HISTSIZE=20000
+    HISTFILESIZE=20000
+    HISTCONTROL=ignoreboth:erasedups
+    shopt -s histappend
+    shopt -s cmdhist
+fi
diff --git a/root/private_dot_config/systemd/user/kbd-backlight-auto.service b/root/private_dot_config/systemd/user/kbd-backlight-auto.service
new file mode 100644
index 0000000..6a75f9a
--- /dev/null
+++ b/root/private_dot_config/systemd/user/kbd-backlight-auto.service
@@ -0,0 +1,23 @@
+[Unit]
+Description=macOS-style keyboard backlight (on while typing, off when idle or lid closed)
+Documentation=file:%h/.local/src/kbd-backlight-auto/kbd-backlight-auto.c
+
+[Service]
+Type=simple
+ExecStart=%h/.local/bin/kbd-backlight-auto
+Restart=always
+RestartSec=2
+
+# Seconds of no typing before the light drops, and the level used before one has
+# ever been chosen (0-2 on this panel). After that, Fn+Space owns the level and
+# the daemon persists whatever you pick to ~/.local/state/kbd-backlight/level.
+Environment=KBD_BACKLIGHT_IDLE=8
+Environment=KBD_BACKLIGHT_LEVEL=1
+
+# It reads two evdev nodes and writes one sysfs attribute. ProtectHome is off
+# deliberately: the daemon persists the chosen level under ~/.local/state.
+NoNewPrivileges=yes
+PrivateTmp=yes
+
+[Install]
+WantedBy=default.target
diff --git a/scripts/generate-signing-key.sh b/scripts/generate-signing-key.sh
index 78abaad..2edd508 100755
--- a/scripts/generate-signing-key.sh
+++ b/scripts/generate-signing-key.sh
@@ -3,7 +3,7 @@
 # Ensure an SSH commit-signing key exists at ~/.ssh/git_signing.
 #
 # For real hosts (WSL, VMs, bare-metal Linux) that own their signing key on
-# disk. Dev containers don't need this — they sign via the host's forwarded
+# disk. Dev containers don't need this, they sign via the host's forwarded
 # SSH agent. Idempotent: a no-op if the key already exists.
 #
 # chezmoi reads the public key into `gitSigningPubKey` and the private key
@@ -31,15 +31,6 @@ chmod 600 "$KEY_PATH"
 chmod 644 "${KEY_PATH}.pub"
 log_success "Signing key generated"
 
-# Upload to GitHub automatically when gh is installed and authenticated.
-if command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1; then
-    if gh ssh-key add "${KEY_PATH}.pub" --type signing --title "git signing ($(hostname))"; then
-        log_success "Uploaded signing key to GitHub"
-        exit 0
-    fi
-    log_warn "Automatic upload failed — add the key manually:"
-fi
-
 echo
 log_warn "Add this PUBLIC key to GitHub as a Signing Key:"
 log_warn "  https://github.com/settings/ssh/new  (Key type: Signing Key)"
diff --git a/scripts/install-dotfiles.sh b/scripts/install-dotfiles.sh
index f9a3423..58a07eb 100755
--- a/scripts/install-dotfiles.sh
+++ b/scripts/install-dotfiles.sh
@@ -26,25 +26,25 @@ if [[ -n "$WORK_EMAIL" ]]; then
 fi
 
 if ! chezmoi="$(command -v chezmoi)"; then
-  chezmoi="${DOTFILES_BIN_DIR}/chezmoi"
-  echo "Installing chezmoi to '${chezmoi}'" >&2
-
-  if command -v curl >/dev/null; then
-    chezmoi_install_script="$(curl -fsSL https://chezmoi.io/get)"
-  elif command -v wget >/dev/null; then
-    chezmoi_install_script="$(wget -qO- https://chezmoi.io/get)"
-  else
-    echo "To install chezmoi, you must have curl or wget installed." >&2
-    exit 1
-  fi
-
-  sh -c "${chezmoi_install_script}" -- -b "${DOTFILES_BIN_DIR}"
-  unset chezmoi_install_script
+    chezmoi="${DOTFILES_BIN_DIR}/chezmoi"
+    echo "Installing chezmoi to '${chezmoi}'" >&2
+
+    if command -v curl >/dev/null; then
+        chezmoi_install_script="$(curl -fsSL https://chezmoi.io/get)"
+    elif command -v wget >/dev/null; then
+        chezmoi_install_script="$(wget -qO- https://chezmoi.io/get)"
+    else
+        echo "To install chezmoi, you must have curl or wget installed." >&2
+        exit 1
+    fi
+
+    sh -c "${chezmoi_install_script}" -- -b "${DOTFILES_BIN_DIR}"
+    unset chezmoi_install_script
 fi
 
 if [ -z "${DOTFILES_SOURCE_DIR:-}" ]; then
-  DOTFILES_SOURCE_DIR="$(cd -P -- "$(dirname -- "$(dirname -- "$(command -v -- "$0")")")" && pwd -P)"
-  export DOTFILES_SOURCE_DIR
+    DOTFILES_SOURCE_DIR="$(cd -P -- "$(dirname -- "$(dirname -- "$(command -v -- "$0")")")" && pwd -P)"
+    export DOTFILES_SOURCE_DIR
 fi
 
 echo "Running 'chezmoi init --apply --source=${DOTFILES_SOURCE_DIR}'" >&2
diff --git a/system/etc/modprobe.d/99-thinkpad-touchpad.conf b/system/etc/modprobe.d/99-thinkpad-touchpad.conf
new file mode 100644
index 0000000..4724586
--- /dev/null
+++ b/system/etc/modprobe.d/99-thinkpad-touchpad.conf
@@ -0,0 +1,11 @@
+# ThinkPad T14 Gen 2i (Synaptics LEN2072) — use the RMI4/SMBus transport
+# instead of the legacy PS/2 fallback. The kernel asks for this itself:
+#
+#   psmouse serio1: synaptics: Your touchpad (PNP: LEN2072 PNP0f13) says it
+#   can support a different bus. If i2c-hid and hid-rmi are not used, you
+#   might want to try setting psmouse.synaptics_intertouch to 1
+#
+# PS/2 mode reports coarse coordinates and limited multitouch; RMI4 gives the
+# touchpad's native resolution, real multi-finger data, and libinput's proper
+# palm rejection. Delete this file and reboot to revert.
+options psmouse synaptics_intertouch=1