fix(installer): address issues 2-8 from sanity check

#2 — Word-boundary match for all module patterns
  Generator now pads SELECTED_APPS with spaces and uses *" id "* in
  counters, summary, and dispatch, matching the conflict fix from #1.
  plymouth-custom no longer false-triggers any plymouth check.

#3 — Guided installer now runs tui-install.sh
  archbaseos-guided-install.sh was calling simple-install.sh; both
  paths now use the full TUI (sentinel-managed, modules.conf-driven).

#4 — EFI/boot partition size unified at 10 GiB
  arch-autoinstall.sh was 15 GiB, archbaseos-guided-install.sh was
  5 GiB. Both now use 10 GiB.

#5 — Interactive retry for dotfiles clone (guided installer)
  Clone moved outside the chroot heredoc so read() reaches the terminal.
  Loops until success or the user skips; AF_MODE warns and continues.

#6 — PAM target unified on system-local-login
  archbaseos-guided-install.sh was writing to system-auth (affects
  sudo). Both installers now target system-local-login only.

#7 — Redundant second clone removed from autoinstaller
  arch-autoinstall.sh had a second git clone inside the chroot as a
  fallback that collided with the skel copy and printed a spurious
  warning. Removed; skel-only approach matches the guided installer
  (last updated). Also removed the individual .zshrc/.bashrc/.vimrc
  cp block; aligned to the guided installer's cleaner skel structure.

#8 — Docs: remove stale plymouth core-module section
  docs/md/modules.md still described plymouth under Core Modules.
  Section removed; plymouth appears in Optional Applications (system
  category) via the generated sentinel.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/md/modules.md

@@ -47,17 +47,6 @@ Also deploys `greetd-tuigreet` config from the dotfiles.
 - **Yazi** file manager
 - Deploys `.bashrc`, `.zshrc`, `starship.toml`, Micro config, Neovim config
 
-### `plymouth` — Boot Splash *(on by default)*
-
-Installs the **M-Archy Plymouth theme**: the skull logo (`resources/bg-skull.svg`) centred on a dark background with a 12-dot magenta spinner animation below it.
-
-- Converts the bundled SVG to PNG via `rsvg-convert` (Plymouth's image loader is PNG-only)
-- Injects the `plymouth` or `sd-plymouth` mkinitcpio hook automatically (detects `udev` vs `systemd` hook set)
-- Adds `quiet splash` to `GRUB_CMDLINE_LINUX_DEFAULT` and regenerates GRUB config
-- Rebuilds the initramfs so the theme is baked in
-
-To install with a **custom image** on an existing system, use `install-modules.sh` and select *Plymouth (custom)* — you will be prompted for a PNG or SVG path.
-
 ---
 
 ## Desktop Environments

setup/arch-autoinstall.sh

@@ -273,15 +273,15 @@ fi
 # Read installed RAM in GiB; used to size both the swap and to calculate remaining
 # root space.  `--giga` prints in GiB units; awk extracts the total column.
 RAM_GB=$(free --giga | awk '/^Mem:/ {print $2}')
-# 15 GiB boot partition: large enough for multiple kernels, initramfs, and UKIs.
+# 10 GiB boot partition: large enough for multiple kernels, initramfs, and UKIs.
-BOOT_SIZE=15GiB
+BOOT_SIZE=10GiB
 SWAP_SIZE="${RAM_GB}GiB"
 
 # lsblk -b reports raw bytes; divide down to GiB for integer arithmetic.
 DISK_SIZE=$(lsblk -b -dn -o SIZE "$DRIVE")
 DISK_GIB=$((DISK_SIZE / 1024 / 1024 / 1024))
-# Root gets whatever is left after reserving 15 GiB for boot and RAM_GB for swap.
+# Root gets whatever is left after reserving 10 GiB for boot and RAM_GB for swap.
-ROOT_GIB=$((DISK_GIB - RAM_GB - 15))
+ROOT_GIB=$((DISK_GIB - RAM_GB - 10))
 if (( ROOT_GIB < 8 )); then
     echo "ERROR: Not enough disk space. Root would be only ${ROOT_GIB}GiB (need ≥8GiB)."
     exit 1
@@ -296,16 +296,16 @@ echo "  Swap: ${SWAP_SIZE}"
 # PARTITION DISK
 ############################################
 # --script suppresses interactive prompts; mklabel gpt wipes any existing table.
-# Partition 1: ESP at 1MiB–15GiB, flagged boot/esp so firmware can find it.
+# Partition 1: ESP at 1MiB–10GiB, flagged boot/esp so firmware can find it.
 # Partition 2: ROOT immediately after the ESP.
 # Partition 3: SWAP fills the rest (100%).
 # Starting at 1MiB aligns the first partition to a 1 MiB boundary, which is
 # optimal for both SSD erase blocks and spinner track alignment.
 parted "$DRIVE" --script mklabel gpt \
-    mkpart ESP fat32 1MiB 15GiB \
+    mkpart ESP fat32 1MiB 10GiB \
     set 1 boot on \
-    mkpart ROOT 15GiB "$((15 + ROOT_GIB))"GiB \
+    mkpart ROOT 10GiB "$((10 + ROOT_GIB))"GiB \
-    mkpart SWAP "$((15 + ROOT_GIB))"GiB 100%
+    mkpart SWAP "$((10 + ROOT_GIB))"GiB 100%
 
 # Resolve partition device paths via the `part` helper (handles NVMe 'p' suffix).
 BOOT_PART=$(part "$DRIVE" 1)
@@ -488,16 +488,8 @@ systemctl enable NetworkManager
 # Populate /etc/skel before user creation so useradd -m copies everything
 echo "Cloning dotfiles into /etc/skel..."
 git clone https://git.abdelbaki.eu/The_miro/Dotfiles.git /etc/skel/Dotfiles \
-    || echo "Warning: dotfiles clone into skel failed — will fall back to direct clone."
+    || echo "Warning: dotfiles clone failed — clone manually after first boot."
-# Seed /etc/skel with base shell dotfiles from the repo clone
+mkdir -p /etc/skel/{Desktop,Documents,Downloads,Music,Pictures,Public,Templates,Videos}
-if [[ -d /etc/skel/Dotfiles ]]; then
-    D=/etc/skel/Dotfiles
-    # Copy individually; `2>/dev/null || true` silently skips any file that is absent
-    # in this repo revision rather than aborting the install.
-    cp "$D/.zshrc"  /etc/skel/.zshrc  2>/dev/null || true
-    cp "$D/.bashrc" /etc/skel/.bashrc 2>/dev/null || true
-    cp "$D/.vimrc"  /etc/skel/.vimrc  2>/dev/null || true
-fi
 
 # User
 # -m: create home dir; -G wheel: add to sudoers group; -s /bin/zsh: default shell.
@@ -568,16 +560,6 @@ if [[ "$FIDO_USER" == "YES" ]]; then
     echo "auth required pam_u2f.so" >> /etc/pam.d/system-local-login
 fi
 
-###################################################
-# CLONE DOTFILES
-###################################################
-# Fall back to a direct clone if /etc/skel/Dotfiles was not copied into home
-# (happens when the skel clone failed or useradd did not copy skel).
-echo "Cloning dotfiles..."
-git clone https://git.abdelbaki.eu/The_miro/Dotfiles.git "/home/$USERNAME/Dotfiles" \
-    && chown -R "$USERNAME":"$USERNAME" "/home/$USERNAME/Dotfiles" \
-    || echo "Warning: dotfiles clone failed — clone manually after first boot."
-
 CHROOT_EOF
 
 ############################################

setup/archbaseos-guided-install.sh

@@ -243,8 +243,8 @@ RAM_GB=$(free --giga | awk '/Mem/ {print $2}')
 # lsblk -b: bytes; -d: disk only (no partitions); -n: no header; -o SIZE: size column.
 DISK_GB=$(lsblk -dn -o SIZE -b "$DRIVE" | awk '{print int($1/1024/1024/1024)}')
 
-# Reserve 5 GiB for the EFI partition and 1 GiB for alignment/overhead.
+# Reserve 10 GiB for the EFI partition and 1 GiB for alignment/overhead.
-EFI_SIZE=5
+EFI_SIZE=10
 SWAP_SIZE=$RAM_GB
 ROOT_SIZE=$((DISK_GB - SWAP_SIZE - EFI_SIZE - 1))
 
@@ -389,6 +389,29 @@ if $AF_MODE; then
     install -m 644 "$ANSWERFILE" /mnt/answerfile.json
 fi
 
+############################################
+# DOTFILES CLONE TO SKEL (with retry)
+############################################
+# Clone before entering the chroot so useradd -m inside will copy Dotfiles to
+# the new user's home.  Interactive retry is available so a transient network
+# failure doesn't silently leave the system without dotfiles.
+echo "Cloning dotfiles into /mnt/etc/skel..."
+_clone_ok=false
+while ! $_clone_ok; do
+    if git clone https://git.abdelbaki.eu/The_miro/Dotfiles.git /mnt/etc/skel/Dotfiles; then
+        mkdir -p /mnt/etc/skel/{Desktop,Documents,Downloads,Music,Pictures,Public,Templates,Videos}
+        _clone_ok=true
+    else
+        if $AF_MODE; then
+            echo "Warning: dotfiles clone failed — continuing without dotfiles."
+            _clone_ok=true
+        else
+            read -rp "Clone failed — retry? [y/N]: " _retry
+            [[ "${_retry,,}" == "y" ]] || { echo "Skipping dotfiles — clone manually after first boot."; _clone_ok=true; }
+        fi
+    fi
+done
+
 ############################################
 # CHROOT Configuration
 ############################################
@@ -430,15 +453,7 @@ echo "$HOSTNAME" > /etc/hostname
 # Enable NetworkManager at boot so the installed system has networking on first login.
 systemctl enable NetworkManager
 
-# Populate /etc/skel before user creation so useradd -m copies everything
+# -m: create home from /etc/skel (dotfiles cloned before chroot); -G wheel: allow sudo; -s /bin/zsh: default shell.
-echo "Cloning dotfiles into /etc/skel..."
-git clone https://git.abdelbaki.eu/The_miro/Dotfiles.git /etc/skel/Dotfiles \
-    || echo "Warning: dotfiles clone failed — clone manually after first boot."
-
-# Create standard XDG user directories in skel so they are present in every new home.
-mkdir -p /etc/skel/{Desktop,Documents,Downloads,Music,Pictures,Public,Templates,Videos}
-
-# -m: create home from /etc/skel; -G wheel: allow sudo; -s /bin/zsh: default shell.
 useradd -m -G wheel -s /bin/zsh "$USERNAME"
 # chpasswd reads "user:pass" from stdin to set the password non-interactively.
 echo "$USERNAME:$USERPASS" | chpasswd
@@ -492,7 +507,7 @@ if [[ "$ENABLE_FIDO_USER" == "YES" ]]; then
     mkdir -p "/home/$USERNAME/.config/Yubico"
     chown "$USERNAME:$USERNAME" "/home/$USERNAME/.config/Yubico"
     # `cue` option: pam_u2f prints a prompt so the user knows to touch the key.
-    echo "auth required pam_u2f.so cue" >> /etc/pam.d/system-auth
+    echo "auth required pam_u2f.so cue" >> /etc/pam.d/system-local-login
 fi
 
 CHROOT_EOF
@@ -535,11 +550,11 @@ if [[ "${_DO_TUI^^}" == "YES" ]]; then
     echo "${USERNAME} ALL=(ALL) NOPASSWD: ALL" \
         | arch-chroot /mnt tee /etc/sudoers.d/99-setup-nopasswd > /dev/null
 
-    echo "Running simple-install.sh as ${USERNAME} inside chroot..."
+    echo "Running tui-install.sh as ${USERNAME} inside chroot..."
     # `runuser -u` switches to the unprivileged user inside the chroot so that
     # AUR helpers and dotfiles are owned/built by the correct UID.
     arch-chroot /mnt runuser -u "${USERNAME}" -- \
-        bash "/home/${USERNAME}/Dotfiles/setup/simple-install.sh" \
+        bash "/home/${USERNAME}/Dotfiles/setup/tui-install.sh" \
         || echo "Warning: tui-install exited with errors — check ~/dotfiles-install.log in the new system."
 
     # Remove the temporary no-password sudoers drop-in after setup completes.
@@ -560,7 +575,7 @@ echo "  umount -R /mnt && reboot"
 if [[ "${_DO_TUI^^}" != "YES" ]]; then
     echo
     echo "After first boot, login as ${USERNAME} and run:"
-    echo "  ~/Dotfiles/setup/simple-install.sh"
+    echo "  ~/Dotfiles/setup/tui-install.sh"
 fi
 if [[ "$ENCRYPT_DISK" == "YES" ]]; then
     echo