Take Hyprtoolkit from the mirror so fresh guest builds work again

THIRD_PARTY_NOTICES.md

@@ -20,11 +20,6 @@ code.
   PKGBUILD and `hyprwm/aquamarine` v0.14.0 tarball (pinned in `guest/spec.json`)
   for factory builds. The finished guest holds aquamarine and Hyprtoolkit on
   `IgnorePkg` with Hyprland so updates cannot mix incompatible ABIs.
-- **Hyprtoolkit** — BSD-3-Clause; the factory rebuilds the reviewed
-  `hyprwm/hyprtoolkit` v0.5.4 source using the Arch 0.5.4-6 recipe adapted for
-  aarch64 and package release 6.1, linked against aquamarine 0.14. Source,
-  recipe, packaging commit, and library hashes are pinned in `guest/spec.json`;
-  the package retains its upstream license.
 - **Glaze** — MIT; the pinned v7.2.0 headers are used by the Hyprland build, and
   their verified upstream license is retained in the rebuilt guest package.
 - **ANGLE, VirGLRenderer, libepoxy, SDL, libslirp, GLib, Pixman, and other QEMU

docs/architecture.md

@@ -203,11 +203,12 @@ creates the account on first boot.
   guarded rounded-border coverage patch for the VM graphics path, then held in
   the guest's immutable local repository. The factory rebuilds
   `aquamarine 0.15.1-1` from a reviewed Arch-derived PKGBUILD and upstream
-  tarball, then rebuilds Hyprtoolkit against its `libaquamarine.so=14` ABI,
-  matching Hyprland 0.56.2. Both packages are provided by the disposable
-  builder repository and held alongside Hyprland on guest `IgnorePkg`.
-  `hyprland-guiutils` is held with them so a rolling update cannot introduce
-  a dependency on a newer `libhyprtoolkit.so` ABI.
+  tarball, matching Hyprland 0.56.2's `libaquamarine.so=14` ABI. The
+  disposable builder repository provides it, and the guest holds it alongside
+  Hyprland on `IgnorePkg`. Hyprtoolkit 0.6.0 and `hyprland-guiutils` 0.2.2-4
+  come from the locked mirror transaction, already built against that ABI,
+  and are held with them so a rolling update cannot introduce a dependency on
+  a newer `libhyprtoolkit.so` or `libaquamarine.so` ABI.
   Source and library hashes are verified, and build paths are remapped for
   repeatable output. The factory uses an official HTTPS ARM mirror and checks
   the complete transaction against its reviewed package lock before installing.

guest/packages.lock.json

@@ -7,11 +7,11 @@
     "adwaita-fonts": "51.0-2",
     "adwaita-icon-theme": "50.0-1",
     "adwaita-icon-theme-legacy": "46.2-3",
-    "alsa-card-profiles": "1:1.6.8-1",
+    "alsa-card-profiles": "1:1.6.9-1",
     "alsa-lib": "1.2.16.1-1",
     "alsa-topology-conf": "1.2.5.1-4",
     "alsa-ucm-conf": "1.2.16.1-1",
-    "aom": "3.15.0-1",
+    "aom": "3.15.1-1",
     "appstream": "1.2.0-1",
     "aquamarine": "0.15.1-1",
     "archlinux-keyring": "20260909-1",
@@ -29,15 +29,15 @@
     "bluez-libs": "5.87-2",
     "brotli": "1.2.0-1",
     "btop": "1.4.7-1",
-    "bubblewrap": "0.12.0-1",
+    "bubblewrap": "0.13.0-1",
     "bzip2": "1.0.8-6",
     "ca-certificates": "20240618-1",
-    "ca-certificates-mozilla": "3.129-1",
+    "ca-certificates-mozilla": "3.130-1",
     "ca-certificates-utils": "20240618-1",
-    "cairo": "1.18.4-1",
+    "cairo": "1.18.6-1",
     "cfitsio": "1:4.7.0-1",
     "chromium": "153.0.8010.36-1",
-    "coreutils": "9.11-2",
+    "coreutils": "9.12-2",
     "cpptrace": "1.0.4-2",
     "cryptsetup": "2.8.8-1",
     "curl": "8.22.0-1",
@@ -61,17 +61,17 @@
     "enchant": "2.8.21-1",
     "exempi": "2.6.6-3",
     "exiv2": "0.28.9-1",
-    "expat": "2.8.4-1",
+    "expat": "2.8.5-1",
     "eza": "0.23.5-2",
     "fakeroot": "1:1.37.2-3",
-    "fastfetch": "2.68.1-1",
+    "fastfetch": "2.69.0-1",
     "fcft": "3.3.3-1",
-    "fcitx5": "5.1.22-1",
+    "fcitx5": "5.1.23-1",
     "fcitx5-chewing": "5.1.13-1",
     "fcitx5-gtk": "5.1.7-1",
-    "fcitx5-qt": "5.1.15-1",
+    "fcitx5-qt": "5.1.16-1",
     "fd": "10.5.0-3",
-    "ffmpeg": "2:9.0.1-4",
+    "ffmpeg": "2:9.0.2-1",
     "fftw": "3.3.11-1",
     "file": "5.48-1",
     "filesystem": "2025.10.12-1",
@@ -81,7 +81,7 @@
     "foot": "1.28.0-2",
     "freeglut": "3.8.0-1",
     "freetype2": "2.14.3-1",
-    "fribidi": "1.0.16-2",
+    "fribidi": "1.0.17-1",
     "fuse-common": "3.18.3-1",
     "fuse3": "3.18.3-1",
     "fzf": "0.74.4-1",
@@ -127,20 +127,20 @@
     "gsettings-system-schemas": "50.1-1",
     "gsm": "1.0.24-1",
     "gssdp": "1.6.6-1",
-    "gst-plugins-bad-libs": "1.28.7-1",
-    "gst-plugins-base-libs": "1.28.7-1",
-    "gstreamer": "1.28.7-1",
+    "gst-plugins-bad-libs": "1.28.7-2",
+    "gst-plugins-base-libs": "1.28.7-2",
+    "gstreamer": "1.28.7-2",
     "gtest": "1.18.0-1",
     "gtk-update-icon-cache": "1:4.22.5-1",
     "gtk3": "1:3.24.52-1",
     "gtk4": "1:4.22.5-1",
     "guile": "3.0.11-1",
-    "gum": "2.0.1-1",
+    "gum": "2.0.2-1",
     "gupnp": "1:1.6.10-1",
     "gupnp-dlna": "0.12.0-5",
     "gupnp-igd": "1.6.0-2",
     "gvfs": "1.60.3-3",
-    "gzip": "1.14-2",
+    "gzip": "1.15-1",
     "harfbuzz": "14.5.0-1",
     "hdf5": "2.2.0-1",
     "hicolor-icon-theme": "0.18-1",
@@ -151,21 +151,21 @@
     "hyprcursor": "0.1.13-7",
     "hyprgraphics": "0.5.1-4",
     "hyprland": "0.56.2-3",
-    "hyprland-guiutils": "0.2.2-3",
+    "hyprland-guiutils": "0.2.2-4",
     "hyprlang": "0.6.8-5",
     "hyprpicker": "0.4.7-4",
     "hyprsunset": "0.4.0-3",
-    "hyprtoolkit": "0.5.4-6.2",
+    "hyprtoolkit": "0.6.0-1",
     "hyprutils": "0.14.2-1",
     "hyprwayland-scanner": "0.4.6-1",
     "hyprwire": "0.3.1-3",
     "iana-etc": "20260617-1",
     "icu": "78.3-1",
-    "imagemagick": "7.1.2.31-1",
+    "imagemagick": "7.1.2.32-1",
     "imath": "3.2.3-1",
     "imv": "5.0.1-2",
     "iniparser": "4.3.0-1",
-    "inotify-tools": "4.25.9.0-1",
+    "inotify-tools": "4.26.262-1",
     "iproute2": "7.2.0-1",
     "iptables": "1:1.8.13-1",
     "iputils": "20250605-1",
@@ -233,7 +233,7 @@
     "libdrm": "2.4.134-1",
     "libdvdnav": "7.0.0-1",
     "libdvdread": "7.1.1-1",
-    "libdwarf": "1:2.3.2-1",
+    "libdwarf": "1:2.3.3-1",
     "libebur128": "1.2.6-2",
     "libedit": "20260512_3.1-1",
     "libei": "1.6.0-1",
@@ -258,7 +258,7 @@
     "libgsf": "1.14.58-1",
     "libgudev": "238-3",
     "libgxps": "0.3.2-5",
-    "libheif": "1.23.4-1",
+    "libheif": "1.23.5-1",
     "libice": "1.1.2-1",
     "libidn2": "2.3.8-1",
     "libiec61883": "1.2.0-9",
@@ -313,7 +313,7 @@
     "libpciaccess": "0.19-1",
     "libpgm": "5.3.128-4",
     "libpipeline": "1.5.8-1",
-    "libpipewire": "1:1.6.8-1",
+    "libpipewire": "1:1.6.9-1",
     "libplacebo": "7.360.1-6",
     "libplist": "2.7.0-3",
     "libpng": "1.6.58-2",
@@ -364,13 +364,13 @@
     "libva": "2.24.1-1",
     "libvdpau": "1.5-4",
     "libverto": "0.3.2-6",
-    "libvips": "8.18.6-1",
+    "libvips": "8.18.7-1",
     "libvorbis": "1.3.7-4",
     "libvpx": "1.17.0-1",
     "libvterm": "0.3.3-2",
     "libwacom": "2.20.0-1",
     "libwebp": "1.6.0-2",
-    "libwireplumber": "0.5.17-1",
+    "libwireplumber": "0.5.17-2",
     "libx11": "1.8.13-1",
     "libxau": "1.0.12-1",
     "libxcb": "1.17.0-1",
@@ -406,8 +406,8 @@
     "libzip": "1.11.4-1",
     "licenses": "20240728-1",
     "lilv": "0.28.0-1",
-    "linux-aarch64": "7.2.6-1",
-    "linux-aarch64-headers": "7.2.6-1",
+    "linux-aarch64": "7.2.8-1",
+    "linux-aarch64-headers": "7.2.8-1",
     "linux-api-headers": "7.2-1",
     "llhttp": "9.3.1-1",
     "llvm-libs": "22.1.8-2",
@@ -427,7 +427,7 @@
     "mdadm": "4.6-2",
     "mesa": "1:26.2.3-1",
     "minizip": "1:1.3.2-3",
-    "mkinitcpio": "42-1",
+    "mkinitcpio": "42.1-1",
     "mkinitcpio-busybox": "1.36.1-1",
     "mobile-broadband-provider-info": "20251101-1",
     "mpdecimal": "4.0.1-3",
@@ -450,18 +450,18 @@
     "noto-fonts-emoji": "1:2.051-1",
     "npth": "1.8-1",
     "nspr": "4.40-1",
-    "nss": "3.129-1",
+    "nss": "3.130-1",
     "numactl": "2.0.19-1",
     "ocl-icd": "2.3.5-1",
     "omarchy-keyring": "20251027-1",
     "onetbb": "2023.1.0-1",
     "oniguruma": "6.9.10-1",
     "openal": "1.25.2-2",
     "opencore-amr": "0.1.6-2",
-    "openexr": "3.4.15-1",
+    "openexr": "3.5.1-1",
     "openh264": "2.6.0-2",
     "openjpeg2": "2.5.4-1",
-    "openjph": "0.31.0-1",
+    "openjph": "0.32.0-1",
     "openssh": "10.5p1-1",
     "openssl": "3.6.4-1",
     "opus": "1.6.1-1",
@@ -474,21 +474,21 @@
     "pam": "1.7.2-2",
     "pambase": "20260616-1",
     "pango": "1:1.58.2-1",
-    "parted": "3.7-1",
+    "parted": "3.8-1",
     "patch": "2.8-1",
     "pciutils": "3.15.0-1",
     "pcre": "8.45-5",
     "pcre2": "10.48-1",
-    "pcsclite": "2.5.1-1",
+    "pcsclite": "2.5.2-1",
     "perl": "5.42.2-2",
     "perl-error": "0.17030-3",
     "perl-mailtools": "2.22-3",
     "perl-timedate": "2.35-1",
     "pinentry": "1.3.3-1",
-    "pipewire": "1:1.6.8-1",
-    "pipewire-alsa": "1:1.6.8-1",
-    "pipewire-audio": "1:1.6.8-1",
-    "pipewire-pulse": "1:1.6.8-1",
+    "pipewire": "1:1.6.9-1",
+    "pipewire-alsa": "1:1.6.9-1",
+    "pipewire-audio": "1:1.6.9-1",
+    "pipewire-pulse": "1:1.6.9-1",
     "pixman": "0.46.4-1.1",
     "polkit": "127-3",
     "poppler": "26.08.0-1",
@@ -499,7 +499,7 @@
     "psmisc": "23.7-2",
     "pugixml": "1.16-1",
     "python": "3.14.7-1",
-    "python-dbus": "1.4.0-2",
+    "python-dbus": "1.5.0-1",
     "python-docopt": "0.6.2-15",
     "python-gobject": "3.56.3-1",
     "python-pyxdg": "0.28-7",
@@ -544,10 +544,10 @@
     "srt": "1.5.7-1",
     "starship": "1.26.0-1",
     "sudo": "1.9.17.p2-6",
-    "systemd": "261.3-1",
-    "systemd-libs": "261.3-1",
-    "systemd-resolvconf": "261.3-1",
-    "systemd-sysvcompat": "261.3-1",
+    "systemd": "262-1",
+    "systemd-libs": "262-1",
+    "systemd-resolvconf": "262-1",
+    "systemd-sysvcompat": "262-1",
     "tar": "1.35-5",
     "tinysparql": "3.11.1-1",
     "tmux": "3.7_c-1",
@@ -571,8 +571,8 @@
     "unibilium": "2.1.4-1",
     "unzip": "6.0-23",
     "upower": "1.91.4-1",
-    "util-linux": "2.42.3-1",
-    "util-linux-libs": "2.42.3-1",
+    "util-linux": "2.42.4-1",
+    "util-linux-libs": "2.42.4-1",
     "uwsm": "0.27.0-1",
     "v4l-utils": "1.32.0-2",
     "v4l2loopback-dkms": "0.15.4-2",
@@ -586,7 +586,7 @@
     "wayland": "1.26.0-1",
     "wayland-protocols": "1.49-1",
     "webrtc-audio-processing-1": "1.3-5",
-    "wireplumber": "0.5.17-1",
+    "wireplumber": "0.5.17-2",
     "wl-clipboard": "1:2.3.0-1",
     "woff2-font-awesome": "7.3.1-1",
     "wpa_supplicant": "2:2.12-1",

guest/pinned-packages/README.md

@@ -17,14 +17,15 @@ The rounded-border backport still applies unchanged to the newer Hyprland.
 
 - `aquamarine/PKGBUILD` adapts the reviewed Arch `0.14.0-2` recipe for
   aquamarine `0.15.1-1` on aarch64, with the new upstream archive checksum.
-- `hyprtoolkit/PKGBUILD` adapts Arch `0.5.4-6` packaging for aarch64 and uses
-  package release `6.2` to distinguish the local rebuild.
-
-Packaging commits, recipe digests, upstream tarball digests, and reproduced
-library digests are pinned in `guest/spec.json`. The factory builds aquamarine
-first, installs that verified result in the disposable builder, then builds
-Hyprtoolkit against `libaquamarine.so=14`. Random build paths are remapped out
-of compiler output. Both package metadata and library digests are checked
+
+Hyprtoolkit 0.6.0 and `hyprland-guiutils` 0.2.2-4 come from the locked mirror
+transaction: Arch Linux ARM builds them against `libaquamarine.so=14`, so they
+no longer need a local rebuild. (The earlier Hyprtoolkit 0.5.4 rebuild stopped
+resolving once the mirror dropped the matching `hyprland-guiutils` 0.2.2-3.)
+
+The packaging commit, recipe digest, upstream tarball digest, and reproduced
+library digest are pinned in `guest/spec.json`. Random build paths are remapped
+out of compiler output. Package metadata and the library digest are checked
 before publishing the temporary `[try-omarchy-abi-pins]` repository.
 
 The finished guest never receives that builder repository. It holds aquamarine