diff --git a/public/archsetup.sh b/public/archsetup.sh
new file mode 100755
index 0000000..769bf4a
--- /dev/null
+++ b/public/archsetup.sh
@@ -0,0 +1,703 @@
+#!/usr/bin/env bash
+# Interactive, single-file Arch Linux installer for the official live ISO.
+
+set -Eeuo pipefail
+
+readonly LOG_FILE=/tmp/arch-installer.log
+readonly MNT=/mnt
+exec 4>>"$LOG_FILE"
+
+BOOT_MODE=""
+CPU_VENDOR=""
+TARGET_DISK=""
+TARGET_DISK_LABEL="Not configured"
+PARTITION_MODE=""
+FILESYSTEM="ext4"
+KERNEL="linux"
+HOSTNAME="archlinux"
+TIMEZONE="America/Chicago"
+LOCALE="en_US.UTF-8"
+KEYMAP="us"
+NETWORK="NetworkManager"
+BOOTLOADER="GRUB"
+ENABLE_TESTING_REPOS=0
+INSTALL_YAY=0
+ROOT_PASSWORD=""
+ROOT_PASSWORD_SET=0
+INSTALL_STARTED=0
+CURRENT_STAGE="Starting"
+
+declare -a DISKS=() DISK_MENU=() EXTRA_PACKAGES=() USERS=()
+declare -A USER_PASSWORDS=() USER_ADMINS=()
+declare -a MAN_PARTS=() MAN_ROLES=() MAN_MOUNTS=() MAN_FS=() MAN_FORMAT=()
+
+cleanup_secrets() {
+  ROOT_PASSWORD=""
+  local user
+  for user in "${USERS[@]}"; do USER_PASSWORDS["$user"]=""; done
+}
+
+on_error() {
+  local rc=$? line=${BASH_LINENO[0]:-unknown}
+  cleanup_secrets
+  printf 'ERROR rc=%s stage=%s line=%s\n' "$rc" "$CURRENT_STAGE" "$line" >&4
+  if command -v dialog >/dev/null 2>&1 && [[ -r /dev/tty ]]; then
+    dialog --title "Installation failed" --msgbox \
+      "A critical error occurred during:\n\n$CURRENT_STAGE\n\nSee $LOG_FILE for details.\nThe installer will not continue." 12 68 \
+      </dev/tty >/dev/tty 2>/dev/tty || true
+  else
+    printf 'Installation failed during %s. See %s\n' "$CURRENT_STAGE" "$LOG_FILE" >/dev/tty 2>/dev/null || true
+  fi
+  exit "$rc"
+}
+trap on_error ERR
+trap cleanup_secrets EXIT
+
+log() { printf '[%(%F %T)T] %s\n' -1 "$*" >&4; }
+
+# dialog writes answers to stderr. This ordering captures stderr while keeping
+# its screen output and keyboard input attached to the terminal, never stdin.
+dlg() { dialog "$@" </dev/tty 2>&1 >/dev/tty; }
+msg() { dialog --title "Arch Linux Installer" --msgbox "$1" "${2:-12}" "${3:-70}" </dev/tty >/dev/tty 2>/dev/tty; }
+yesno() { dialog --title "Arch Linux Installer" --yesno "$1" "${2:-12}" "${3:-70}" </dev/tty >/dev/tty 2>/dev/tty; }
+
+run_logged() {
+  log "+ $*"
+  "$@" >>"$LOG_FILE" 2>&1
+}
+
+stage() {
+  CURRENT_STAGE=$1
+  log "STAGE: $CURRENT_STAGE"
+  dialog --title "Installing Arch Linux" --infobox \
+    "$CURRENT_STAGE\n\nPlease wait. Detailed output: $LOG_FILE" 8 68 \
+    </dev/tty >/dev/tty 2>/dev/tty
+}
+
+die() { msg "$1" 12 72; log "FATAL: $1"; exit 1; }
+
+require_live_environment() {
+  [[ $EUID -eq 0 ]] || { printf 'This installer must run as root.\n' >&2; exit 1; }
+  [[ -r /etc/arch-release ]] || { printf 'This installer requires the Arch Linux live environment.\n' >&2; exit 1; }
+  [[ -d /run/archiso ]] || { printf 'This installer must be run from the official Arch Linux ISO.\n' >&2; exit 1; }
+  [[ -r /dev/tty && -w /dev/tty ]] || { printf 'An interactive /dev/tty is required.\n' >&2; exit 1; }
+}
+
+install_dialog() {
+  if ! command -v dialog >/dev/null 2>&1; then
+    printf 'Installing dialog in the live environment...\n' >/dev/tty
+    pacman -Sy --noconfirm dialog >>"$LOG_FILE" 2>&1 || { printf 'Could not install dialog. See %s\n' "$LOG_FILE" >/dev/tty; exit 1; }
+  fi
+}
+
+check_internet() {
+  if ! curl -fsS --connect-timeout 8 https://archlinux.org/ >/dev/null; then
+    die "Internet connectivity check failed. Connect to the internet and try again."
+  fi
+}
+
+sync_clock() {
+  run_logged timedatectl set-ntp true
+  local i
+  for i in {1..15}; do
+    [[ $(timedatectl show -p NTPSynchronized --value 2>/dev/null || true) == yes ]] && return 0
+    sleep 1
+  done
+  log "Warning: NTP did not report synchronized within 15 seconds"
+}
+
+check_commands() {
+  local -a required=(arch-chroot awk blkid cfdisk curl findmnt genfstab grep lsblk mkfs.ext4 mkfs.fat mkswap mount pacstrap partprobe sed sfdisk swapoff swapon udevadm wipefs)
+  local -a missing=()
+  local cmd
+  for cmd in "${required[@]}"; do command -v "$cmd" >/dev/null 2>&1 || missing+=("$cmd"); done
+  ((${#missing[@]} == 0)) || die "Required live-environment commands are missing:\n\n${missing[*]}"
+}
+
+detect_platform() {
+  [[ -d /sys/firmware/efi ]] && BOOT_MODE=UEFI || BOOT_MODE=BIOS
+  case $(awk -F: '/vendor_id/{gsub(/[[:space:]]/,"",$2); print $2; exit}' /proc/cpuinfo) in
+    GenuineIntel) CPU_VENDOR=Intel ;;
+    AuthenticAMD) CPU_VENDOR=AMD ;;
+    *) CPU_VENDOR=Other ;;
+  esac
+}
+
+scan_disks() {
+  DISKS=(); DISK_MENU=()
+  local path type model size ro rm
+  while IFS=$'\t' read -r path type model size ro rm; do
+    [[ $type == disk && $ro == 0 ]] || continue
+    [[ $path != /dev/loop* && $path != /dev/zram* && $path != /dev/sr* && $path != /dev/fd* ]] || continue
+    [[ -b $path ]] || continue
+    lsblk -nrpo MOUNTPOINT "$path" | grep -Eq '^/run/archiso(/|$)' && continue
+    DISKS+=("$path")
+    model=${model:-Unknown model}
+    DISK_MENU+=("$path" "$size  $model")
+  done < <(lsblk -dnP -o PATH,TYPE,MODEL,SIZE,RO,RM | awk '
+    { p=t=m=s=ro=rm=""; while (match($0,/([A-Z]+)="([^"]*)"/,a)) { if(a[1]=="PATH")p=a[2]; if(a[1]=="TYPE")t=a[2]; if(a[1]=="MODEL")m=a[2]; if(a[1]=="SIZE")s=a[2]; if(a[1]=="RO")ro=a[2]; if(a[1]=="RM")rm=a[2]; $0=substr($0,RSTART+RLENGTH) } print p"\t"t"\t"m"\t"s"\t"ro"\t"rm }')
+  ((${#DISKS[@]} > 0)) || die "No suitable installation disks were detected."
+}
+
+preflight() {
+  require_live_environment
+  install_dialog
+  CURRENT_STAGE="Preflight checks"
+  check_internet
+  sync_clock
+  check_commands
+  detect_platform
+  scan_disks
+  command -v mkfs.btrfs >/dev/null 2>&1 || run_logged pacman -Sy --noconfirm btrfs-progs
+}
+
+select_disk() {
+  local choice
+  choice=$(dlg --title "Select Target Disk" --menu \
+    "Choose carefully. No disk is selected automatically." 18 76 10 "${DISK_MENU[@]}") || return 0
+  TARGET_DISK=$choice
+  TARGET_DISK_LABEL="$choice ($(lsblk -dn -o SIZE,MODEL "$choice" | sed 's/^[[:space:]]*//'))"
+}
+
+configure_disk() {
+  local mode
+  mode=$(dlg --title "Disk Configuration" --menu "Choose a partitioning method. Disk changes occur only after final confirmation." 14 72 4 \
+    automatic "Automatic Partitioning" manual "Manual Partitioning with cfdisk") || return 0
+  select_disk
+  [[ -n $TARGET_DISK ]] || return 0
+  PARTITION_MODE=$mode
+  if [[ $BOOT_MODE == BIOS && $mode == automatic ]]; then FILESYSTEM=ext4; fi
+}
+
+choose_filesystem() {
+  if [[ $BOOT_MODE == BIOS && $PARTITION_MODE == automatic ]]; then
+    msg "Automatic BIOS installations require ext4."
+    FILESYSTEM=ext4
+    return
+  fi
+  local choice
+  choice=$(dlg --title "Filesystem" --menu "Select the root filesystem." 12 54 2 ext4 "Ext4" btrfs "Btrfs") || return 0
+  FILESYSTEM=$choice
+}
+
+choose_kernel() {
+  local choice
+  choice=$(dlg --title "Kernel" --menu "Select a kernel." 13 55 3 linux "Standard" linux-lts "Long-term support" linux-zen "Desktop-tuned") || return 0
+  KERNEL=$choice
+}
+
+input_value() {
+  local variable=$1 title=$2 prompt=$3 current value
+  current=${!variable}
+  value=$(dlg --title "$title" --inputbox "$prompt" 10 68 "$current") || return 0
+  [[ -n $value ]] || { msg "$title cannot be empty."; return; }
+  printf -v "$variable" '%s' "$value"
+}
+
+set_root_password() {
+  local p1 p2
+  p1=$(dlg --title "Root Password" --insecure --passwordbox "Enter the root password. Leave empty to keep the root account locked." 10 68) || return 0
+  if [[ -z $p1 ]]; then ROOT_PASSWORD=""; ROOT_PASSWORD_SET=0; return; fi
+  p2=$(dlg --title "Root Password" --insecure --passwordbox "Confirm the root password." 10 68) || { p1=""; return 0; }
+  if [[ $p1 != "$p2" ]]; then p1=""; p2=""; msg "Passwords did not match."; return; fi
+  ROOT_PASSWORD=$p1; p1=""; p2=""; ROOT_PASSWORD_SET=1
+}
+
+valid_username() { [[ $1 =~ ^[a-z_][a-z0-9_-]*$ && ${#1} -le 32 ]]; }
+
+manage_users() {
+  local action user p1 p2 admin summary
+  while true; do
+    summary=${USERS[*]:-None}
+    action=$(dlg --title "Users" --menu "Configured: $summary" 15 65 5 add "Add a user" remove "Remove a user" done "Return to main menu") || return 0
+    case $action in
+      add)
+        user=$(dlg --title "Add User" --inputbox "Username:" 9 55) || continue
+        valid_username "$user" || { msg "Invalid username."; continue; }
+        [[ $user != root && $user != _yaybuilder && -z ${USER_PASSWORDS[$user]+x} ]] || { msg "That user already exists or is reserved."; continue; }
+        p1=$(dlg --title "User Password" --insecure --passwordbox "Password for $user:" 10 60) || continue
+        [[ -n $p1 ]] || { msg "User passwords may not be empty."; continue; }
+        p2=$(dlg --title "User Password" --insecure --passwordbox "Confirm password for $user:" 10 60) || { p1=""; continue; }
+        [[ $p1 == "$p2" ]] || { p1=""; p2=""; msg "Passwords did not match."; continue; }
+        admin=0; yesno "Grant $user administrator (sudo) privileges?" 10 60 && admin=1
+        USERS+=("$user"); USER_PASSWORDS["$user"]=$p1; USER_ADMINS["$user"]=$admin
+        p1=""; p2=""
+        ;;
+      remove)
+        ((${#USERS[@]})) || { msg "No users are configured."; continue; }
+        local -a items=(); local u
+        for u in "${USERS[@]}"; do items+=("$u" "Remove this user"); done
+        user=$(dlg --title "Remove User" --menu "Select a user." 15 55 7 "${items[@]}") || continue
+        local -a kept=()
+        for u in "${USERS[@]}"; do [[ $u == "$user" ]] || kept+=("$u"); done
+        USER_PASSWORDS["$user"]=""; unset 'USER_PASSWORDS[$user]' 'USER_ADMINS[$user]'; USERS=("${kept[@]}")
+        ;;
+      done) return ;;
+    esac
+  done
+}
+
+set_extra_packages() {
+  local input
+  input=$(dlg --title "Additional Packages" --inputbox "Enter official repository package names separated by spaces:" 10 74 "${EXTRA_PACKAGES[*]:-}") || return 0
+  read -r -a EXTRA_PACKAGES <<<"$input"
+}
+
+toggle_testing_repos() {
+  if ((ENABLE_TESTING_REPOS)); then
+    ENABLE_TESTING_REPOS=0
+    return
+  fi
+  yesno "Enable Arch's core-testing and extra-testing repositories?\n\nTesting packages may be unstable and can require manual intervention. The repositories will be enabled in both the live environment and installed system." 14 72 && ENABLE_TESTING_REPOS=1
+}
+
+toggle_yay() {
+  if ((INSTALL_YAY)); then INSTALL_YAY=0; else INSTALL_YAY=1; fi
+}
+
+main_menu() {
+  local choice root_status users_status extras_status partition_status testing_status yay_status
+  while true; do
+    root_status="Not set"; ((ROOT_PASSWORD_SET)) && root_status="Set"
+    users_status=${USERS[*]:-None}; extras_status=${EXTRA_PACKAGES[*]:-None}
+    partition_status="Not configured"
+    [[ -n $PARTITION_MODE ]] && partition_status="${PARTITION_MODE^}: $TARGET_DISK"
+    testing_status=Disabled; ((ENABLE_TESTING_REPOS)) && testing_status=Enabled
+    yay_status="Do not install"; ((INSTALL_YAY)) && yay_status="Install yay"
+    choice=$(dlg --title "Arch Linux Installer" --menu "Boot mode: $BOOT_MODE    CPU: $CPU_VENDOR" 23 78 14 \
+      disk "Disk Configuration      $partition_status" \
+      fs "Filesystem             $FILESYSTEM" \
+      kernel "Kernel                 $KERNEL" \
+      host "Hostname               $HOSTNAME" \
+      tz "Timezone               $TIMEZONE" \
+      locale "Locale                 $LOCALE" \
+      keymap "Keymap                 $KEYMAP" \
+      network "Network                $NETWORK" \
+      rootpw "Root Password           $root_status" \
+      users "Users                   $users_status" \
+      packages "Additional Packages     $extras_status" \
+      testing "Testing Repositories    $testing_status" \
+      yay "Yay AUR Helper          $yay_status" \
+      boot "Bootloader              $BOOTLOADER" \
+      install "Install" exit "Exit") || choice=exit
+    case $choice in
+      disk) configure_disk ;; fs) choose_filesystem ;; kernel) choose_kernel ;;
+      host) input_value HOSTNAME Hostname "Enter the system hostname:" ;;
+      tz) input_value TIMEZONE Timezone "Enter an IANA timezone (for example America/Chicago):" ;;
+      locale) input_value LOCALE Locale "Enter a UTF-8 locale (for example en_US.UTF-8):" ;;
+      keymap) input_value KEYMAP Keymap "Enter a console keymap (for example us):" ;;
+      network) msg "NetworkManager is the supported network service." ;;
+      rootpw) set_root_password ;; users) manage_users ;; packages) set_extra_packages ;;
+      testing) toggle_testing_repos ;; yay) toggle_yay ;;
+      boot) msg "GRUB is the supported bootloader." ;;
+      install) confirm_install && return 0 ;;
+      exit) yesno "Exit the installer? No disk changes have been made." 10 60 && exit 0 ;;
+    esac
+  done
+}
+
+validate_config() {
+  [[ -n $TARGET_DISK && -b $TARGET_DISK ]] || { msg "Select a valid target disk."; return 1; }
+  [[ $PARTITION_MODE == automatic || $PARTITION_MODE == manual ]] || { msg "Configure partitioning first."; return 1; }
+  [[ $FILESYSTEM == ext4 || $FILESYSTEM == btrfs ]] || { msg "Invalid filesystem."; return 1; }
+  [[ $HOSTNAME =~ ^[A-Za-z0-9][A-Za-z0-9.-]{0,62}$ ]] || { msg "The hostname is invalid."; return 1; }
+  [[ $TIMEZONE =~ ^[A-Za-z0-9_+-]+(/[A-Za-z0-9_+-]+)+$ && $TIMEZONE != *..* ]] || { msg "The timezone name is invalid."; return 1; }
+  [[ -e /usr/share/zoneinfo/$TIMEZONE ]] || { msg "Timezone '$TIMEZONE' does not exist."; return 1; }
+  [[ $LOCALE =~ ^[A-Za-z_]+\.[A-Za-z0-9@_-]+$ ]] || { msg "The locale name is invalid."; return 1; }
+  [[ $KEYMAP =~ ^[A-Za-z0-9_-]+$ ]] || { msg "The keymap name is invalid."; return 1; }
+  local locale_re=${LOCALE//./\\.}
+  grep -Eq "^[#[:space:]]*${locale_re}[[:space:]]" /etc/locale.gen || { msg "Locale '$LOCALE' is not available in /etc/locale.gen."; return 1; }
+  local user
+  if ((ROOT_PASSWORD_SET == 0 && ${#USERS[@]} == 0)); then msg "Set a root password or create at least one normal user."; return 1; fi
+  for user in "${USERS[@]}"; do [[ -n ${USER_PASSWORDS[$user]:-} ]] || { msg "Missing password for $user."; return 1; }; done
+  local package
+  for package in "${EXTRA_PACKAGES[@]}"; do
+    [[ $package =~ ^[A-Za-z0-9@._+:-]+$ && $package != -* ]] || { msg "Invalid package name: $package"; return 1; }
+  done
+  return 0
+}
+
+confirm_install() {
+  validate_config || return 1
+  local warning partition_label
+  partition_label=${PARTITION_MODE^}
+  if [[ $PARTITION_MODE == automatic ]]; then
+    warning="ALL DATA ON $TARGET_DISK WILL BE DESTROYED."
+  else
+    warning="cfdisk will edit $TARGET_DISK. Only partitions you explicitly mark for formatting will be formatted."
+  fi
+  local testing_summary=Disabled yay_summary="Do not install"
+  ((ENABLE_TESTING_REPOS)) && testing_summary=Enabled
+  ((INSTALL_YAY)) && yay_summary="Install yay"
+  yesno "Installation Summary\n\nBoot Mode:        $BOOT_MODE\nTarget Disk:      $TARGET_DISK_LABEL\nPartitioning:     $partition_label\nFilesystem:       $FILESYSTEM\nKernel:           $KERNEL\nHostname:         $HOSTNAME\nTimezone:         $TIMEZONE\nLocale:           $LOCALE\nKeymap:           $KEYMAP\nNetwork:          $NETWORK\nUsers:            ${USERS[*]:-None}\nExtra Packages:   ${EXTRA_PACKAGES[*]:-None}\nTesting Repos:    $testing_summary\nYay AUR Helper:   $yay_summary\nBootloader:       $BOOTLOADER\n\n$warning\n\nProceed?" 0 78 || return 1
+  if [[ $PARTITION_MODE == automatic ]]; then
+    local typed
+    typed=$(dlg --title "Final Destructive Confirmation" --inputbox "Type the exact disk path to authorize erasing it:\n\n$TARGET_DISK" 12 68) || return 1
+    [[ $typed == "$TARGET_DISK" ]] || { msg "Disk path did not match. Installation cancelled."; return 1; }
+  fi
+  INSTALL_STARTED=1
+  return 0
+}
+
+assert_target_disk() {
+  [[ $INSTALL_STARTED == 1 && -n $TARGET_DISK && -b $TARGET_DISK ]] || die "Unsafe or missing target disk."
+  local d
+  for d in "${DISKS[@]}"; do [[ $d == "$TARGET_DISK" ]] && return 0; done
+  die "The selected target is no longer in the validated disk list."
+}
+
+partition_path() {
+  local disk=$1 number=$2
+  [[ $disk =~ [0-9]$ ]] && printf '%sp%s' "$disk" "$number" || printf '%s%s' "$disk" "$number"
+}
+
+unmount_target() {
+  if findmnt -rn -M "$MNT" >/dev/null 2>&1; then
+    local source
+    source=$(findmnt -rn -o SOURCE -M "$MNT")
+    [[ $source == "$TARGET_DISK"* ]] || die "$MNT is mounted from $source, not the selected disk. Unmount it manually before continuing."
+    run_logged umount -R "$MNT"
+  fi
+}
+
+automatic_partition() {
+  assert_target_disk
+  unmount_target
+  if lsblk -nrpo MOUNTPOINT "$TARGET_DISK" | grep -q '/'; then
+    die "A partition on $TARGET_DISK is mounted outside $MNT. Unmount it before installing."
+  fi
+  local child
+  while read -r child; do
+    [[ -n $child ]] && run_logged swapoff "$child"
+  done < <(lsblk -rpn -o PATH,TYPE "$TARGET_DISK" | awk '$2=="part"{print $1}' | while read -r child; do swapon --noheadings --raw --output NAME | grep -Fx "$child" || true; done)
+  run_logged wipefs --all --force "$TARGET_DISK"
+  if [[ $BOOT_MODE == BIOS ]]; then
+    printf 'label: dos\nunit: sectors\n\n,,83,*\n' | sfdisk "$TARGET_DISK" >>"$LOG_FILE" 2>&1
+  else
+    printf 'label: gpt\nunit: sectors\n\n,1GiB,U\n,,L\n' | sfdisk "$TARGET_DISK" >>"$LOG_FILE" 2>&1
+  fi
+  run_logged partprobe "$TARGET_DISK"
+  run_logged udevadm settle
+}
+
+manual_partition_editor() {
+  assert_target_disk
+  CURRENT_STAGE="Manual partitioning with cfdisk"
+  log "+ cfdisk $TARGET_DISK"
+  cfdisk "$TARGET_DISK" </dev/tty >/dev/tty 2>/dev/tty || die "cfdisk failed or was cancelled."
+  run_logged partprobe "$TARGET_DISK"
+  run_logged udevadm settle
+  assign_manual_partitions
+}
+
+partitions_for_target() {
+  lsblk -rpn -o PATH,TYPE "$TARGET_DISK" | awk '$2=="part"{print $1}'
+}
+
+partition_description() {
+  lsblk -dn -o SIZE,FSTYPE,LABEL "$1" | sed 's/^[[:space:]]*//'
+}
+
+manual_add_role() {
+  local part=$1 role=$2 mountpoint=$3 fs=$4 format=$5
+  MAN_PARTS+=("$part"); MAN_ROLES+=("$role"); MAN_MOUNTS+=("$mountpoint"); MAN_FS+=("$fs"); MAN_FORMAT+=("$format")
+}
+
+choose_manual_format() {
+  local part=$1 role=$2 choice
+  case $role in
+    boot)
+      choice=$(dlg --title "EFI Partition" --menu "$part: choose an action." 13 66 3 vfat "FORMAT as FAT32" preserve "Preserve existing FAT filesystem") || return 1
+      ;;
+    swap)
+      choice=$(dlg --title "Swap Partition" --menu "$part: choose an action." 13 66 3 swap "FORMAT as swap" preserve "Preserve existing swap signature") || return 1
+      ;;
+    *)
+      choice=$(dlg --title "Filesystem Action" --menu "$part: choose an action." 14 70 4 ext4 "FORMAT as ext4" btrfs "FORMAT as Btrfs" preserve "Preserve existing filesystem") || return 1
+      ;;
+  esac
+  printf '%s' "$choice"
+}
+
+assign_manual_partitions() {
+  MAN_PARTS=(); MAN_ROLES=(); MAN_MOUNTS=(); MAN_FS=(); MAN_FORMAT=()
+  local -a parts=() menu=() available=()
+  mapfile -t parts < <(partitions_for_target)
+  ((${#parts[@]})) || die "No partitions were found on $TARGET_DISK after cfdisk."
+  local p role mountpoint action existing fs i root_count=0 boot_count=0
+  available=("${parts[@]}")
+  while ((${#available[@]})); do
+    menu=()
+    for p in "${available[@]}"; do menu+=("$p" "$(partition_description "$p")"); done
+    menu+=(done "Finish assigning partitions")
+    p=$(dlg --title "Assign Partitions" --menu "Select a partition to assign. A root partition is required." 20 78 11 "${menu[@]}") || die "Manual partition assignment cancelled."
+    [[ $p == done ]] && break
+    role=$(dlg --title "Partition Role" --menu "Assign $p:" 17 66 7 root "/" boot "/boot (UEFI ESP)" home "/home" swap "swap" custom "Custom mount point" unused "Do not use") || continue
+    if [[ $role == unused ]]; then
+      local -a next=(); for existing in "${available[@]}"; do [[ $existing == "$p" ]] || next+=("$existing"); done; available=("${next[@]}"); continue
+    fi
+    mountpoint=""
+    case $role in
+      root) ((root_count == 0)) || { msg "Only one root partition is allowed."; continue; }; mountpoint=/ ;;
+      boot) [[ $BOOT_MODE == UEFI ]] || { msg "A separate /boot partition is not used for BIOS installations."; continue; }; ((boot_count == 0)) || { msg "Only one EFI /boot partition is allowed."; continue; }; mountpoint=/boot ;;
+      home) mountpoint=/home ;;
+      custom)
+        mountpoint=$(dlg --title "Custom Mount Point" --inputbox "Enter an absolute mount point (for example /srv):" 10 68) || continue
+        [[ $mountpoint == /* && $mountpoint != / && $mountpoint != /boot && $mountpoint != /home && $mountpoint != *..* ]] || { msg "Invalid or reserved mount point."; continue; }
+        ;;
+    esac
+    if [[ -n $mountpoint ]]; then
+      for i in "${!MAN_MOUNTS[@]}"; do
+        [[ ${MAN_MOUNTS[$i]} != "$mountpoint" ]] || { msg "$mountpoint is already assigned."; mountpoint=""; break; }
+      done
+      [[ -n $mountpoint ]] || continue
+    fi
+    action=$(choose_manual_format "$p" "$role") || continue
+    if [[ $action == preserve ]]; then
+      existing=$(blkid -s TYPE -o value "$p" 2>/dev/null || true)
+      case $role in
+        boot) [[ $existing == vfat ]] || { msg "$p is not currently FAT32/vfat."; continue; }; fs=vfat ;;
+        swap) [[ $existing == swap ]] || { msg "$p is not currently swap."; continue; }; fs=swap ;;
+        *) [[ $existing == ext4 || $existing == btrfs ]] || { msg "$p must contain ext4 or Btrfs to preserve it."; continue; }; fs=$existing ;;
+      esac
+    else
+      fs=$action
+      yesno "Explicit format confirmation:\n\nFORMAT $p as $fs?\n\nAll data on this partition will be destroyed." 13 70 || continue
+    fi
+    manual_add_role "$p" "$role" "$mountpoint" "$fs" "$([[ $action == preserve ]] && echo 0 || echo 1)"
+    [[ $role == root ]] && ((root_count+=1)); [[ $role == boot ]] && ((boot_count+=1))
+    local -a next=(); for existing in "${available[@]}"; do [[ $existing == "$p" ]] || next+=("$existing"); done; available=("${next[@]}")
+  done
+  ((root_count == 1)) || die "Manual partitioning requires exactly one root partition."
+  [[ $BOOT_MODE == BIOS || $boot_count == 1 ]] || die "UEFI installation requires one FAT32 partition assigned to /boot."
+}
+
+format_automatic() {
+  local p1 p2
+  p1=$(partition_path "$TARGET_DISK" 1)
+  [[ -b $p1 ]] || die "Expected partition $p1 was not created."
+  if [[ $BOOT_MODE == BIOS ]]; then
+    run_logged mkfs.ext4 -F "$p1"
+  else
+    p2=$(partition_path "$TARGET_DISK" 2); [[ -b $p2 ]] || die "Expected partition $p2 was not created."
+    run_logged mkfs.fat -F 32 "$p1"
+    if [[ $FILESYSTEM == ext4 ]]; then run_logged mkfs.ext4 -F "$p2"; else run_logged mkfs.btrfs -f "$p2"; fi
+  fi
+}
+
+format_manual() {
+  local i p fs
+  for i in "${!MAN_PARTS[@]}"; do
+    [[ ${MAN_FORMAT[$i]} == 1 ]] || continue
+    p=${MAN_PARTS[$i]}; fs=${MAN_FS[$i]}
+    [[ -b $p ]] || die "Unsafe manual partition target: $p"
+    partitions_for_target | grep -Fxq "$p" || die "$p is not a partition of $TARGET_DISK."
+    case $fs in
+      ext4) run_logged mkfs.ext4 -F "$p" ;; btrfs) run_logged mkfs.btrfs -f "$p" ;;
+      vfat) run_logged mkfs.fat -F 32 "$p" ;; swap) run_logged mkswap -f "$p" ;;
+      *) die "Unsupported format requested: $fs" ;;
+    esac
+    [[ $(blkid -s TYPE -o value "$p" 2>/dev/null || true) == "$fs" ]] || die "Formatting validation failed for $p."
+  done
+}
+
+mount_automatic() {
+  local p1 p2
+  p1=$(partition_path "$TARGET_DISK" 1)
+  run_logged mkdir -p "$MNT"
+  if [[ $BOOT_MODE == BIOS ]]; then
+    run_logged mount "$p1" "$MNT"
+  else
+    p2=$(partition_path "$TARGET_DISK" 2)
+    if [[ $FILESYSTEM == ext4 ]]; then
+      run_logged mount "$p2" "$MNT"
+    else
+      run_logged mount "$p2" "$MNT"
+      run_logged btrfs subvolume create "$MNT/@"
+      run_logged btrfs subvolume create "$MNT/@home"
+      run_logged umount "$MNT"
+      run_logged mount -o subvol=@,compress=zstd,noatime "$p2" "$MNT"
+      run_logged mkdir -p "$MNT/home"
+      run_logged mount -o subvol=@home,compress=zstd,noatime "$p2" "$MNT/home"
+    fi
+    run_logged mkdir -p "$MNT/boot"
+    run_logged mount "$p1" "$MNT/boot"
+  fi
+}
+
+mount_manual() {
+  local root_i=-1 i p mp fs
+  for i in "${!MAN_ROLES[@]}"; do [[ ${MAN_ROLES[$i]} == root ]] && root_i=$i; done
+  ((root_i >= 0)) || die "No root partition assigned."
+  run_logged mkdir -p "$MNT"
+  run_logged mount "${MAN_PARTS[$root_i]}" "$MNT"
+  for i in "${!MAN_PARTS[@]}"; do
+    [[ ${MAN_ROLES[$i]} == swap ]] && run_logged swapon "${MAN_PARTS[$i]}"
+  done
+  local ordered
+  while IFS= read -r ordered; do
+    i=${ordered#* }
+    p=${MAN_PARTS[$i]}; mp=${MAN_MOUNTS[$i]}; fs=${MAN_FS[$i]}
+    run_logged mkdir -p "$MNT$mp"
+    if [[ $fs == btrfs ]]; then run_logged mount -o compress=zstd,noatime "$p" "$MNT$mp"; else run_logged mount "$p" "$MNT$mp"; fi
+  done < <(for i in "${!MAN_PARTS[@]}"; do
+    [[ $i -eq $root_i || ${MAN_ROLES[$i]} == swap ]] && continue
+    printf '%08d %s\n' "${#MAN_MOUNTS[$i]}" "$i"
+  done | sort -n)
+}
+
+validate_mounts() {
+  findmnt -rn -M "$MNT" >/dev/null || die "Root filesystem is not mounted at $MNT."
+  if [[ $BOOT_MODE == UEFI ]]; then
+    findmnt -rn -M "$MNT/boot" >/dev/null || die "EFI system partition is not mounted at $MNT/boot."
+    [[ $(findmnt -rn -o FSTYPE -M "$MNT/boot") == vfat ]] || die "The EFI system partition is not FAT32/vfat."
+  fi
+}
+
+build_packages() {
+  PACKAGES=(base "$KERNEL" linux-firmware sudo networkmanager grub)
+  [[ $BOOT_MODE == UEFI ]] && PACKAGES+=(efibootmgr)
+  [[ $CPU_VENDOR == Intel ]] && PACKAGES+=(intel-ucode)
+  [[ $CPU_VENDOR == AMD ]] && PACKAGES+=(amd-ucode)
+  if [[ $FILESYSTEM == btrfs ]] || printf '%s\n' "${MAN_FS[@]:-}" | grep -qx btrfs; then PACKAGES+=(btrfs-progs); fi
+  ((INSTALL_YAY)) && PACKAGES+=(base-devel git go)
+  PACKAGES+=("${EXTRA_PACKAGES[@]}")
+}
+declare -a PACKAGES=()
+
+enable_testing_repositories() {
+  local config=$1
+  [[ -f $config ]] || die "Pacman configuration not found: $config"
+  sed -i -E \
+    -e '/^#\[core-testing\]$/,/^#?Include[[:space:]]*=/ s/^#//' \
+    -e '/^#\[extra-testing\]$/,/^#?Include[[:space:]]*=/ s/^#//' \
+    "$config"
+  grep -qx '\[core-testing\]' "$config" || die "Could not enable core-testing in $config."
+  grep -qx '\[extra-testing\]' "$config" || die "Could not enable extra-testing in $config."
+}
+
+install_yay_helper() {
+  stage "Build and install yay AUR helper"
+  local builder=_yaybuilder artifact relative_artifact
+  run_logged arch-chroot "$MNT" useradd -m -s /bin/bash "$builder"
+  run_logged arch-chroot "$MNT" runuser -u "$builder" -- git clone --depth 1 https://aur.archlinux.org/yay.git /tmp/yay
+  run_logged arch-chroot "$MNT" runuser -u "$builder" -- bash -c 'cd /tmp/yay && makepkg --noconfirm --clean'
+  artifact=$(find "$MNT/tmp/yay" -maxdepth 1 -type f -name 'yay-*.pkg.tar.*' ! -name '*-debug-*' -print -quit)
+  [[ -n $artifact && -f $artifact ]] || die "The yay package was not produced."
+  relative_artifact=${artifact#"$MNT"}
+  run_logged arch-chroot "$MNT" pacman -U --noconfirm "$relative_artifact"
+  run_logged arch-chroot "$MNT" userdel -r "$builder"
+  run_logged rm -rf -- "$MNT/tmp/yay"
+  arch-chroot "$MNT" pacman -Q yay >>"$LOG_FILE" 2>&1 || die "yay installation validation failed."
+}
+
+configure_system() {
+  stage "Generate fstab"
+  genfstab -U "$MNT" >"$MNT/etc/fstab"
+  [[ -s $MNT/etc/fstab ]] || die "Generated fstab is empty."
+
+  stage "Configure timezone and hardware clock"
+  run_logged arch-chroot "$MNT" ln -sf "/usr/share/zoneinfo/$TIMEZONE" /etc/localtime
+  run_logged arch-chroot "$MNT" hwclock --systohc
+
+  stage "Configure locale and console keymap"
+  sed -i -E "s|^#[[:space:]]*(${LOCALE//./\\.}[[:space:]].*)$|\\1|" "$MNT/etc/locale.gen"
+  run_logged arch-chroot "$MNT" locale-gen
+  printf 'LANG=%s\n' "$LOCALE" >"$MNT/etc/locale.conf"
+  printf 'KEYMAP=%s\n' "$KEYMAP" >"$MNT/etc/vconsole.conf"
+
+  stage "Configure hostname"
+  printf '%s\n' "$HOSTNAME" >"$MNT/etc/hostname"
+  printf '127.0.0.1\tlocalhost\n::1\t\tlocalhost\n127.0.1.1\t%s.localdomain %s\n' "$HOSTNAME" "$HOSTNAME" >"$MNT/etc/hosts"
+
+  stage "Configure users and sudo"
+  local user
+  if ((ROOT_PASSWORD_SET)); then printf 'root:%s\n' "$ROOT_PASSWORD" | arch-chroot "$MNT" chpasswd >>"$LOG_FILE" 2>&1; fi
+  for user in "${USERS[@]}"; do
+    if [[ ${USER_ADMINS[$user]} == 1 ]]; then run_logged arch-chroot "$MNT" useradd -m -G wheel -s /bin/bash "$user"; else run_logged arch-chroot "$MNT" useradd -m -s /bin/bash "$user"; fi
+    printf '%s:%s\n' "$user" "${USER_PASSWORDS[$user]}" | arch-chroot "$MNT" chpasswd >>"$LOG_FILE" 2>&1
+  done
+  if printf '%s\n' "${USER_ADMINS[@]:-}" | grep -qx 1; then
+    printf '%%wheel ALL=(ALL:ALL) ALL\n' >"$MNT/etc/sudoers.d/10-wheel"
+    chmod 0440 "$MNT/etc/sudoers.d/10-wheel"
+    run_logged arch-chroot "$MNT" visudo -cf /etc/sudoers.d/10-wheel
+  fi
+  cleanup_secrets
+
+  stage "Configure networking and enable services"
+  run_logged arch-chroot "$MNT" systemctl enable NetworkManager
+
+  ((INSTALL_YAY)) && install_yay_helper
+
+  stage "Generate initramfs"
+  run_logged arch-chroot "$MNT" mkinitcpio -P
+
+  stage "Install GRUB"
+  assert_target_disk
+  if [[ $BOOT_MODE == UEFI ]]; then
+    run_logged arch-chroot "$MNT" grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB --recheck
+  else
+    run_logged arch-chroot "$MNT" grub-install --target=i386-pc --recheck "$TARGET_DISK"
+  fi
+  stage "Generate GRUB configuration"
+  run_logged arch-chroot "$MNT" grub-mkconfig -o /boot/grub/grub.cfg
+  [[ -s $MNT/boot/grub/grub.cfg ]] || die "GRUB configuration was not created."
+}
+
+validate_installation() {
+  stage "Validate installation"
+  [[ -x $MNT/usr/bin/bash && -s $MNT/etc/fstab && -s $MNT/etc/hostname ]] || die "Installed system validation failed."
+  arch-chroot "$MNT" pacman -Q "$KERNEL" grub networkmanager >>"$LOG_FILE" 2>&1 || die "Required installed packages could not be validated."
+  if [[ $BOOT_MODE == UEFI ]]; then [[ -d $MNT/boot/EFI/GRUB ]] || die "GRUB EFI files were not found."; fi
+}
+
+install_system() {
+  stage "Validate configuration"
+  validate_config || die "Configuration became invalid."
+  assert_target_disk
+
+  stage "Partition disk"
+  if [[ $PARTITION_MODE == automatic ]]; then automatic_partition; else manual_partition_editor; fi
+
+  stage "Format filesystems"
+  if [[ $PARTITION_MODE == automatic ]]; then format_automatic; else format_manual; fi
+
+  stage "Mount filesystems"
+  if [[ $PARTITION_MODE == automatic ]]; then mount_automatic; else mount_manual; fi
+  validate_mounts
+
+  stage "Pacstrap base system"
+  build_packages
+  if ((ENABLE_TESTING_REPOS)); then
+    stage "Enable testing repositories in live environment"
+    enable_testing_repositories /etc/pacman.conf
+    run_logged pacman -Syy --noconfirm
+    stage "Pacstrap base system"
+  fi
+  run_logged pacstrap -K "$MNT" "${PACKAGES[@]}"
+  [[ -x $MNT/usr/bin/bash ]] || die "pacstrap did not create a usable base system."
+
+  if ((ENABLE_TESTING_REPOS)); then
+    stage "Enable testing repositories in installed system"
+    enable_testing_repositories "$MNT/etc/pacman.conf"
+    run_logged arch-chroot "$MNT" pacman -Syy --noconfirm
+  fi
+
+  configure_system
+  validate_installation
+  stage "Finish"
+  sync
+  dialog --title "Installation Complete" --msgbox \
+    "Arch Linux was installed successfully.\n\nThe new system remains mounted at $MNT.\nYou may exit, run 'umount -R $MNT', and reboot when ready.\n\nLog: $LOG_FILE" 14 72 \
+    </dev/tty >/dev/tty 2>/dev/tty
+}
+
+main() {
+  : >"$LOG_FILE"
+  log "Arch installer started"
+  preflight
+  main_menu
+  install_system
+}
+
+main "$@"