Speed up installs and add reproducible native benchmarks

[ryankirkman]

Repeated package database queries and per-step logging processes add avoidable installer overhead. The default changes batch package presence and successful-install verification into one read-only pacman query, and use Bash's built-in timestamp formatter. Package selection, failure handling, log format and child-shell isolation are preserved. Component results and regression checks are documented in docs/install-speed.md; they are not full-install speedup claims.

The larger installation experiments are opt-in benchmark overlays. They build on the prebuilt Btrfs image installer from upstream PR #145 and PR #113, whose authors deserve credit for that design. This branch adds reproducible same-package image preparation, preserves image files and metadata when creating child subvolumes, disables redundant package prefetch, tests guarded reboot and earlier verification, and optionally uses direct target writes. Full image verification and final sync/release checks remain required.

The latest complete trial, run 34005907730, completed three fresh alternating pairs with all six installations and media-free reboots validated. Observed control readiness was 155.341–166.325 seconds and candidate readiness was 74.847–75.465 seconds. Median observed speedup was 2.077305×; the conservative lower bound was 1.999569537×, including measured SSH polling uncertainty. The strict 2× threshold remains unmet. All 180 original sample seal hashes were independently rechecked; all 270 original artifact files and the original false verdict are retained. Complete evidence.

That measured candidate moves the unchanged locate-index command into the existing joined user-finalization branch and runs the complete foreground logo animation while installation finishes. Indexing and both finalization branches must complete before validation and the factory snapshot; the completion screen and media-removal prompt still wait for installer success and target release. Moving the ordinary filesystem scan later can change the newly created paths it observes.

Earlier results remain separately preserved: run 33996768275 produced one valid 2.19046× conservative pair before a later candidate readiness failure, and the complete direct-write trial 34001279394 reached 1.898330853× conservatively across three valid pairs. The first overlap attempt stopped at a host contract portability check before paired samples. Its isolated test fix preceded the fresh complete trial above; no samples were reused. The earlier intermittent readiness failure remains unexplained.

The fresh firewall/logging trial 34009848220 stopped at its early firewall host contract before ISO download, calibration, image construction or paired installations. Its failure evidence is retained and the test portability issue is under review; it produced no candidate installation or speed result. It moves the unchanged firewall leaf to the start of the joined user branch and exposes the built-in-clock logger through one temporary private read-only mount only during serial system setup. Firewall completion must still precede user/SSH/Tailscale/indexing work; those three shorter setup invocations keep their original logger. Package-owned helper bytes and metadata remain intact. The manifest and preflight require serial-system-finalizer-only scope. This candidate has no native performance result yet.

The earlier all-call logging design was rejected after its full four-call TCG component median increased from 14.641953 to 15.879115 seconds. The narrower design then passed fresh root/user/failure, read-only mount, concurrent parent isolation and cleanup checks, and improved every fresh component pair: median 15.316387 to 12.076732 seconds (1.268256×). These are bounded component results, not full-install claims. The component stopwatch excludes the controller's one-time module import; the native clock includes it. Both failed fixture attempts, the all-call regression, exact sources and fresh system-only evidence are preserved. The disposable guest's diagnostic Plymouth setting is excluded from the native fixtures. A separate source-only Limine hash-launch audit also makes no runtime or speedup claim.

To reproduce the latest completed candidate with the workflow's Linux/KVM prerequisites and 50 GiB free, use fresh output directories:

python3 test/benchmarks/install-speed/native-ci/run-native-experiment.py \
  --repo "$PWD" --work /tmp/omarchy-speed-work --evidence /tmp/omarchy-speed-evidence \
  --boot-method firmware --source-cache cold \
  --install-timeout 600 --standalone-reboot-timeout 180 \
  --variants image-no-package-prefetch-fast-reboot-early-verify-direct-restore-overlap

To reproduce the current unmeasured candidate instead, select --variants image-no-package-prefetch-fast-reboot-early-verify-direct-restore-overlap-firewall-logging with the same fresh-pair protocol.

Acceptance requires matching all 941 package versions and explicit/dependency reasons, successful pacman -Qk with complete file counts, fresh machine/SSH/pacman/Btrfs identities, and a second ordinary boot after removing installation media. Trials alternate three fresh pairs on matched hardware; failures remain excluded and retained. Timing covers VM start through installed-root SSH. Image manufacture is excluded; per-install verification is included. Results apply to this unencrypted Omarchy 4.0.2 KVM fixture, not physical USB installations or a production ISO release.