diff --git a/fedora/bootmenu/dracut/90ryoku-snapshot/module-setup.sh b/fedora/bootmenu/dracut/90ryoku-snapshot/module-setup.sh
new file mode 100644
index 0000000000..0191a0e2c3
--- /dev/null
+++ b/fedora/bootmenu/dracut/90ryoku-snapshot/module-setup.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/bash
+#
+# dracut module: boots a snapper snapshot from the "Ryoku snapshots" GRUB
+# menu, read-only or restored. It runs after dracut has unlocked LUKS, so an
+# encrypted disk restores the same way as a plain one. Only the images
+# `ryoku boot-menu sync` builds for the snapshot entries carry it (dracut
+# --add ryoku-snapshot); Fedora's own initramfs images stay as they are.
+
+check() {
+  return 255
+}
+
+depends() {
+  echo btrfs
+}
+
+installkernel() {
+  hostonly='' instmods overlay
+}
+
+# shellcheck disable=SC2154 # dracut sets moddir
+install() {
+  inst_multiple mkdir mount umount mv date ln
+  inst_hook pre-mount 90 "$moddir/ryoku-snapshot-restore.sh"
+  inst_hook pre-pivot 10 "$moddir/ryoku-snapshot-preview.sh"
+}
diff --git a/fedora/bootmenu/dracut/90ryoku-snapshot/ryoku-snapshot-preview.sh b/fedora/bootmenu/dracut/90ryoku-snapshot/ryoku-snapshot-preview.sh
new file mode 100644
index 0000000000..0a9d0b10ab
--- /dev/null
+++ b/fedora/bootmenu/dracut/90ryoku-snapshot/ryoku-snapshot-preview.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/bash
+#
+# pre-pivot hook. rd.ryoku.preview=<top-level path of a snapshot> boots that
+# read-only snapshot for a look: the snapshot is the lower layer of an overlay
+# whose writes go to RAM, so the system runs normally and nothing on disk
+# changes. sysroot.mount has already mounted the snapshot read-only (the
+# entry's rootflags name it); the overlay is stacked on top of /sysroot, and
+# its lower layer is a second mount under /run, which switch-root carries
+# into the booted system. fstab's options for / name a btrfs subvolume, which
+# the overlay refuses on remount, so systemd-remount-fs is masked for this
+# boot only (/run).
+#
+# dracut sources hooks, so this returns and never exits.
+
+# shellcheck source=/dev/null
+type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
+
+ryoku_snapshot_preview() {
+  local snap dev run="${RYOKU_RUN:-/run}" newroot="${NEWROOT:-/sysroot}"
+  local base="$run/ryoku/preview"
+  snap=$(getarg rd.ryoku.preview=) || return 0
+  case "$snap" in
+    "" | /* | *..* | *[!A-Za-z0-9._/-]*) warn "ryoku: refusing snapshot path '$snap'"; return 0 ;;
+  esac
+  dev=$(label_uuid_to_dev "$(getarg root=)")
+  mkdir -p "$base/lower" "$base/rw"
+  if ! mount -t btrfs -o "ro,subvol=$snap" "$dev" "$base/lower"; then
+    warn "ryoku: cannot mount $snap; booting it read-only as it is"
+    return 0
+  fi
+  mount -t tmpfs -o mode=0755 ryoku-preview "$base/rw"
+  mkdir -p "$base/rw/upper" "$base/rw/work"
+  if ! mount -t overlay ryoku-preview \
+    -o "lowerdir=$base/lower,upperdir=$base/rw/upper,workdir=$base/rw/work" "$newroot"; then
+    warn "ryoku: overlay failed; booting $snap read-only as it is"
+    umount "$base/rw" "$base/lower"
+    return 0
+  fi
+  mkdir -p "$run/systemd/system"
+  ln -sf /dev/null "$run/systemd/system/systemd-remount-fs.service"
+  info "ryoku: previewing $snap; changes stay in RAM"
+}
+
+ryoku_snapshot_preview
diff --git a/fedora/bootmenu/dracut/90ryoku-snapshot/ryoku-snapshot-restore.sh b/fedora/bootmenu/dracut/90ryoku-snapshot/ryoku-snapshot-restore.sh
new file mode 100644
index 0000000000..202fe2bcc6
--- /dev/null
+++ b/fedora/bootmenu/dracut/90ryoku-snapshot/ryoku-snapshot-restore.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/bash
+#
+# pre-mount hook. rd.ryoku.restore=<top-level path of a snapshot> makes that
+# snapshot the root subvolume again before it is mounted: the current root is
+# renamed to <root>.broken-<time> (kept, so a mistaken restore is itself
+# reversible) and a writable snapshot of the chosen one takes its name. The
+# root subvolume is the one rootflags=subvol= names. Anything unexpected
+# leaves the disk untouched and boots the current root.
+#
+# dracut sources hooks, so this returns and never exits.
+
+# shellcheck source=/dev/null
+type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
+
+ryoku_snapshot_restore() {
+  local snap rootsub dev top stamp run="${RYOKU_RUN:-/run}"
+  snap=$(getarg rd.ryoku.restore=) || return 0
+  case "$snap" in
+    "" | /* | *..* | *[!A-Za-z0-9._/-]*) warn "ryoku: refusing snapshot path '$snap'"; return 0 ;;
+    */snapshot) ;;
+    *) warn "ryoku: '$snap' is not a snapper snapshot"; return 0 ;;
+  esac
+  rootsub=$(getarg rootflags=)
+  case "$rootsub" in *subvol=*) ;; *) rootsub="" ;; esac
+  rootsub=${rootsub#*subvol=}
+  rootsub=${rootsub%%,*}
+  rootsub=${rootsub#/}
+  case "$rootsub" in
+    "" | *..* | */*) warn "ryoku: no root subvolume in rootflags; not restoring"; return 0 ;;
+  esac
+  dev=$(label_uuid_to_dev "$(getarg root=)")
+  [ -e "$dev" ] || { warn "ryoku: root device '$dev' not found; not restoring"; return 0; }
+
+  top="$run/ryoku/restore-top"
+  mkdir -p "$top"
+  mount -t btrfs -o subvolid=5 "$dev" "$top" || { warn "ryoku: cannot mount the btrfs top level"; return 0; }
+  if [ ! -d "$top/$snap" ] || [ ! -d "$top/$rootsub" ]; then
+    warn "ryoku: $snap or $rootsub is missing; not restoring"
+    umount "$top"
+    return 0
+  fi
+  stamp=$(date -u +%Y%m%d-%H%M%S)
+  if ! mv "$top/$rootsub" "$top/$rootsub.broken-$stamp"; then
+    warn "ryoku: could not set the current root aside; not restoring"
+    umount "$top"
+    return 0
+  fi
+  if ! btrfs subvolume snapshot "$top/$snap" "$top/$rootsub" >/dev/null; then
+    warn "ryoku: snapshotting $snap failed; putting the current root back"
+    mv "$top/$rootsub.broken-$stamp" "$top/$rootsub"
+    umount "$top"
+    return 0
+  fi
+  umount "$top"
+  info "ryoku: restored $snap; the previous root is $rootsub.broken-$stamp"
+  mkdir -p "$run/ryoku"
+  echo "$snap $rootsub.broken-$stamp" >"$run/ryoku/restored"
+}
+
+ryoku_snapshot_restore
diff --git a/fedora/bootmenu/grub/42_ryoku_snapshots b/fedora/bootmenu/grub/42_ryoku_snapshots
new file mode 100755
index 0000000000..f7d0e575bf
--- /dev/null
+++ b/fedora/bootmenu/grub/42_ryoku_snapshots
@@ -0,0 +1,13 @@
+#!/usr/bin/sh
+#
+# grub2-mkconfig snippet (/etc/grub.d/42_ryoku_snapshots). It only sources
+# ryoku-snapshots.cfg next to grub.cfg, the "Ryoku snapshots" submenu that
+# `ryoku boot-menu sync` rewrites after every snapshot, so a new snapshot never
+# needs a grub2-mkconfig run and nothing touches Fedora's BLS entries.
+set -e
+
+cat <<'EOF'
+if [ -f "${config_directory}/ryoku-snapshots.cfg" ]; then
+  source "${config_directory}/ryoku-snapshots.cfg"
+fi
+EOF
diff --git a/fedora/bootmenu/grub/ryoku-grub-menu b/fedora/bootmenu/grub/ryoku-grub-menu
new file mode 100755
index 0000000000..98b055e21b
--- /dev/null
+++ b/fedora/bootmenu/grub/ryoku-grub-menu
@@ -0,0 +1,96 @@
+#!/usr/bin/bash
+#
+# Puts Ryoku into Fedora's GRUB menu, keeping shim, GRUB and the kernels
+# exactly as Fedora signs them (issue #48).
+#
+#   install   copy the theme onto /boot, point /etc/default/grub at it, and
+#             rebuild grub.cfg when either changed or grub.cfg does not
+#             source the snapshot submenu yet (ryoku-desktop %posttrans)
+#   purge     undo all of it and drop the snapshot menu and its kernels
+#             (ryoku-desktop %preun on removal; %postun rebuilds grub.cfg)
+#
+# The theme's font is a copy of GRUB's Unifont on /boot: left to itself,
+# grub2-mkconfig picks one from /usr/share/grub, which sits on the root
+# filesystem GRUB cannot read on an encrypted install.
+set -euo pipefail
+
+grub_dir="${RYOKU_GRUB_DIR:-/boot/grub2}"
+defaults="${RYOKU_GRUB_DEFAULTS:-/etc/default/grub}"
+shipped="${RYOKU_GRUB_THEME_SRC:-/usr/share/ryoku/grub/theme}"
+unifont="${RYOKU_GRUB_FONT_SRC:-/usr/share/grub/unicode.pf2}"
+theme_dir="$grub_dir/themes/ryoku"
+mkconfig="${RYOKU_GRUB_MKCONFIG:-grub2-mkconfig}"
+
+# set_key <KEY> <value>: set KEY="value" in /etc/default/grub; returns 0 when
+# the file changed.
+set_key() {
+  local line="$1=\"$2\""
+  grep -qxF -- "$line" "$defaults" && return 1
+  if grep -q "^$1=" "$defaults"; then
+    sed -i "s|^$1=.*|$line|" "$defaults"
+  else
+    printf '%s\n' "$line" >>"$defaults"
+  fi
+}
+
+# terminal_output: the current GRUB_TERMINAL_OUTPUT value, unquoted.
+terminal_output() {
+  sed -n 's/^GRUB_TERMINAL_OUTPUT="\{0,1\}\([^"]*\)"\{0,1\}$/\1/p' "$defaults"
+}
+
+drop_key() {
+  grep -q "^$1=" "$defaults" || return 1
+  sed -i "/^$1=/d" "$defaults"
+}
+
+# copy_new <src> <dest>: copy when the content differs; returns 0 when it did.
+copy_new() {
+  cmp -s "$1" "$2" && return 1
+  cp -f "$1" "$2"
+}
+
+rebuild() {
+  "$mkconfig" -o "$grub_dir/grub.cfg" >/dev/null
+}
+
+install_menu() {
+  [ -d "$grub_dir" ] && [ -f "$defaults" ] || return 0
+  mkdir -p "$theme_dir"
+  # grub2-mkconfig loads the image modules the theme directory needs, so a
+  # changed theme rebuilds grub.cfg too.
+  local changed=1 file
+  for file in "$shipped"/*; do
+    copy_new "$file" "$theme_dir/${file##*/}" && changed=0
+  done
+  [ -f "$unifont" ] && cp -f "$unifont" "$theme_dir/unicode.pf2"
+
+  # only Fedora's plain console becomes graphical; a serial or other chosen
+  # terminal is kept, and the theme simply does not show there.
+  case "$(terminal_output)" in
+    "" | console) set_key GRUB_TERMINAL_OUTPUT gfxterm && changed=0 ;;
+  esac
+  set_key GRUB_FONT "$theme_dir/unicode.pf2" && changed=0
+  set_key GRUB_THEME "$theme_dir/theme.txt" && changed=0
+  if [ "$changed" = 0 ] || ! grep -qs "ryoku-snapshots.cfg" "$grub_dir/grub.cfg"; then
+    rebuild
+  fi
+}
+
+purge_menu() {
+  [ -f "$defaults" ] || return 0
+  if grep -qxF "GRUB_THEME=\"$theme_dir/theme.txt\"" "$defaults"; then
+    drop_key GRUB_THEME || :
+    drop_key GRUB_FONT || :
+    [ "$(terminal_output)" = gfxterm ] && set_key GRUB_TERMINAL_OUTPUT console || :
+  fi
+  rm -rf "$theme_dir" "$grub_dir/ryoku-snapshots.cfg" "$(dirname "$grub_dir")/ryoku"
+}
+
+case "${1:-}" in
+  install) install_menu ;;
+  purge) purge_menu ;;
+  *)
+    echo "usage: ryoku-grub-menu install|purge" >&2
+    exit 2
+    ;;
+esac
diff --git a/fedora/bootmenu/grub/theme/background.png b/fedora/bootmenu/grub/theme/background.png
new file mode 100644
index 0000000000..04206c63f0
Binary files /dev/null and b/fedora/bootmenu/grub/theme/background.png differ
diff --git a/fedora/bootmenu/grub/theme/theme.txt b/fedora/bootmenu/grub/theme/theme.txt
new file mode 100644
index 0000000000..84052b4526
--- /dev/null
+++ b/fedora/bootmenu/grub/theme/theme.txt
@@ -0,0 +1,50 @@
+# Ryoku GRUB theme: the desktop's default palette (paper #000000, ink
+# #cdc4ba, sun #e2342a) on the Unifont GRUB ships. Installed to
+# /boot/grub2/themes/ryoku by ryoku-grub-menu. The background is a black
+# image as well as a colour because GRUB, left with only a colour, fails to
+# scale a missing bitmap whenever an entry boots from a submenu.
+
+title-text: "Ryoku"
+title-font: "Unifont Regular 16"
+title-color: "#e2342a"
+desktop-color: "#000000"
+desktop-image: "background.png"
+message-font: "Unifont Regular 16"
+message-color: "#b0a9a0"
+terminal-font: "Unifont Regular 16"
+
++ boot_menu {
+  left = 15%
+  top = 20%
+  width = 70%
+  height = 60%
+  item_font = "Unifont Regular 16"
+  item_color = "#cdc4ba"
+  selected_item_font = "Unifont Regular 16"
+  selected_item_color = "#e2342a"
+  item_height = 24
+  item_padding = 4
+  item_spacing = 4
+  scrollbar = false
+}
+
++ label {
+  id = "__timeout__"
+  left = 15%
+  top = 85%
+  width = 70%
+  align = "center"
+  font = "Unifont Regular 16"
+  color = "#b0a9a0"
+  text = "Booting in %d s"
+}
+
++ label {
+  left = 15%
+  top = 90%
+  width = 70%
+  align = "center"
+  font = "Unifont Regular 16"
+  color = "#b0a9a0"
+  text = "Enter boots   e edits   c opens a console"
+}
diff --git a/fedora/bootmenu/ryoku-snapshot-menu.path b/fedora/bootmenu/ryoku-snapshot-menu.path
new file mode 100644
index 0000000000..1ff0c64fc3
--- /dev/null
+++ b/fedora/bootmenu/ryoku-snapshot-menu.path
@@ -0,0 +1,12 @@
+[Unit]
+# Snapper changes /.snapshots while it takes a snapshot, and its Ryoku plugin
+# touches it once the snapshot is complete.
+Description=Ryoku snapshot boot menu trigger
+RequiresMountsFor=/.snapshots
+
+[Path]
+PathChanged=/.snapshots
+Unit=ryoku-snapshot-menu.service
+
+[Install]
+WantedBy=paths.target
diff --git a/fedora/bootmenu/ryoku-snapshot-menu.service b/fedora/bootmenu/ryoku-snapshot-menu.service
new file mode 100644
index 0000000000..96edc62264
--- /dev/null
+++ b/fedora/bootmenu/ryoku-snapshot-menu.service
@@ -0,0 +1,17 @@
+[Unit]
+# Started by ryoku-snapshot-menu.path after a snapshot is created or deleted,
+# and by ryoku-desktop's %posttrans. Rewrites the "Ryoku snapshots" GRUB submenu and
+# keeps one kernel and initramfs copy per kernel version the snapshots need.
+Description=Ryoku snapshot boot menu
+# A dnf transaction or a snapper cleanup changes /.snapshots many times within
+# a second. Each run is an idempotent resync, so the default start limit would
+# only fail the unit and take the path trigger down with it.
+StartLimitIntervalSec=0
+ConditionPathExists=/etc/snapper/configs/root
+RequiresMountsFor=/boot /.snapshots
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/ryoku boot-menu sync
+Nice=10
+IOSchedulingClass=idle
diff --git a/fedora/bootmenu/ryoku-snapshot-restored.service b/fedora/bootmenu/ryoku-snapshot-restored.service
new file mode 100644
index 0000000000..4f854cb93b
--- /dev/null
+++ b/fedora/bootmenu/ryoku-snapshot-restored.service
@@ -0,0 +1,16 @@
+[Unit]
+# Runs on the first boot after the initramfs restored a snapshot (the dracut
+# module leaves /run/ryoku/restored). /boot is not part of the snapshot, so it
+# still lists kernels the restored root has no modules for: those entries are
+# dropped, the restored root's own kernels get entries, and the kernel this
+# boot runs becomes the default.
+Description=Ryoku boot entries after a snapshot restore
+ConditionPathExists=/run/ryoku/restored
+RequiresMountsFor=/boot
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/ryoku boot-menu restored
+
+[Install]
+WantedBy=multi-user.target
diff --git a/fedora/bootmenu/snapper/50-ryoku-boot-menu b/fedora/bootmenu/snapper/50-ryoku-boot-menu
new file mode 100755
index 0000000000..f720224aee
--- /dev/null
+++ b/fedora/bootmenu/snapper/50-ryoku-boot-menu
@@ -0,0 +1,17 @@
+#!/usr/bin/sh
+#
+# snapper plugin (/usr/libexec/snapper/plugins/). snapperd runs it around
+# every snapshot and config change with the event as its first argument. After
+# a snapshot is created or deleted it touches /.snapshots, and
+# ryoku-snapshot-menu.path resyncs the boot menu in the background, so building
+# a kernel image for a new kernel never holds up the snapshot (or the
+# `ryoku update` that took it). SELinux lets snapperd neither start units nor
+# write a file systemd may watch, but systemd may watch /.snapshots itself.
+
+snapshots="${RYOKU_SNAPSHOTS_DIR:-/.snapshots}"
+case "${1:-}" in
+  create-snapshot-post | delete-snapshot-post)
+    touch "$snapshots" 2>/dev/null || :
+    ;;
+esac
+exit 0
diff --git a/fedora/install.sh b/fedora/install.sh
new file mode 100755
index 0000000000..aa6f3572ac
--- /dev/null
+++ b/fedora/install.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+die() { printf 'fedora-install: %s\n' "$*" >&2; exit 1; }
+usage() {
+  cat <<'USAGE'
+Usage: fedora/install.sh --base-url HTTPS_URL --gpg-key-url HTTPS_URL \
+  --gpg-fingerprint FINGERPRINT --provider hyprland|niri
+
+Environment equivalents:
+  RYOKU_RPM_BASE_URL
+  RYOKU_RPM_GPG_KEY_URL
+  RYOKU_RPM_GPG_FINGERPRINT
+  RYOKU_FEDORA_PROVIDER
+
+The repository must publish signed Fedora RPM metadata and packages under the
+Ryoku DNF repository layout. The signing key fingerprint is verified before import.
+USAGE
+}
+
+base_url=${RYOKU_RPM_BASE_URL:-}
+gpg_key_url=${RYOKU_RPM_GPG_KEY_URL:-}
+gpg_fingerprint=${RYOKU_RPM_GPG_FINGERPRINT:-}
+provider=${RYOKU_FEDORA_PROVIDER:-}
+while (($#)); do
+  case "$1" in
+    --base-url) (($# >= 2)) || die '--base-url requires a URL'; base_url=$2; shift 2 ;;
+    --gpg-key-url) (($# >= 2)) || die '--gpg-key-url requires a URL'; gpg_key_url=$2; shift 2 ;;
+    --gpg-fingerprint) (($# >= 2)) || die '--gpg-fingerprint requires a value'; gpg_fingerprint=$2; shift 2 ;;
+    --provider) (($# >= 2)) || die '--provider requires a value'; provider=$2; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) die "unknown option: $1" ;;
+  esac
+done
+
+[[ -n $base_url && -n $gpg_key_url && -n $gpg_fingerprint ]] || { usage >&2; die 'set the repository URL, key URL, and full key fingerprint'; }
+[[ $base_url =~ ^https://[^[:space:]]+$ && $gpg_key_url =~ ^https://[^[:space:]]+$ ]] || die 'repository and key URLs must be whitespace-free HTTPS URLs'
+[[ $gpg_fingerprint =~ ^([[:xdigit:]]{40}|[[:xdigit:]]{64})$ ]] || die 'provide the full 40- or 64-digit OpenPGP fingerprint'
+[[ $provider == hyprland || $provider == niri ]] || die 'provider must be hyprland or niri'
+base_url=${base_url%/}
+
+[[ $(id -u) -ne 0 ]] || die 'run as a normal user; sudo is used for system changes'
+[[ -r /etc/os-release ]] || die 'cannot identify this operating system'
+# shellcheck source=/dev/null
+. /etc/os-release
+[[ ${ID:-} == fedora || " ${ID_LIKE:-} " == *' fedora '* ]] || die 'this installer supports Fedora and Fedora derivatives only'
+[[ $(uname -m) == x86_64 ]] || die 'Ryoku RPMs currently target x86_64'
+[[ -d /run/systemd/system ]] || die 'this installer requires a mutable systemd installation'
+[[ ! -e /run/ostree-booted ]] || die 'rpm-ostree systems are not supported'
+command -v sudo >/dev/null 2>&1 || die 'sudo is required'
+command -v curl >/dev/null 2>&1 || die 'curl is required'
+command -v gpg >/dev/null 2>&1 || die 'gpg is required to verify the repository signing key; install gnupg2 first'
+dnf_cmd=dnf
+if command -v dnf5 >/dev/null 2>&1; then dnf_cmd=dnf5; fi
+sudo -v
+
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+curl -fL --retry 3 --output "$work/RPM-GPG-KEY-ryoku" "$gpg_key_url"
+[[ -s "$work/RPM-GPG-KEY-ryoku" ]] || die 'the signing key download was empty'
+actual_fingerprint=$(gpg --batch --with-colons --show-keys "$work/RPM-GPG-KEY-ryoku" | awk -F: '$1 == "fpr" { print $10; exit }')
+[[ ${actual_fingerprint^^} == ${gpg_fingerprint^^} ]] || die 'the downloaded signing key does not match the supplied fingerprint'
+cat > "$work/ryoku.repo" <<REPO
+[ryoku]
+name=Ryoku
+baseurl=$base_url
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ryoku
+skip_if_unavailable=0
+REPO
+
+sudo install -D -m 0644 "$work/RPM-GPG-KEY-ryoku" /etc/pki/rpm-gpg/RPM-GPG-KEY-ryoku
+sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-ryoku
+sudo install -D -m 0644 "$work/ryoku.repo" /etc/yum.repos.d/ryoku.repo
+sudo "$dnf_cmd" makecache --refresh --repo=ryoku
+sudo "$dnf_cmd" install -y --repo=ryoku ryoku ryoku-desktop "ryoku-desktop-$provider"
diff --git a/fedora/packages/rpm/README.md b/fedora/packages/rpm/README.md
new file mode 100644
index 0000000000..60e15a4ae8
--- /dev/null
+++ b/fedora/packages/rpm/README.md
@@ -0,0 +1,72 @@
+# Fedora integration
+
+This directory contains Fedora RPM packaging, DNF host support, and the shell
+installer. The installer targets mutable Fedora x86_64 systems using systemd.
+Fedora images and ISO build files are intentionally not part of this integration.
+
+## Install from a signed RPM repository
+
+The repository and signing key must be supplied by the repository operator.
+This checkout does not configure a public Fedora repository or signing key.
+
+```sh
+fedora/install.sh \
+  --base-url https://packages.example.org/stable/fedora/\$releasever/\$basearch \
+  --gpg-key-url https://packages.example.org/RPM-GPG-KEY-ryoku \
+  --gpg-fingerprint 0123456789ABCDEF0123456789ABCDEF01234567 \
+  --provider hyprland
+```
+
+The installer downloads the signing key, checks its full fingerprint against
+the value supplied by the repository operator, imports the verified key, then
+creates the DNF repository with package and metadata signature checks enabled.
+It refreshes metadata and installs `ryoku`, `ryoku-desktop`, and the selected
+compositor package. The desktop specs depend on several packages hosted in COPR.
+Review `fedora/packages/rpm/dependency-coprs` and, if you accept those sources,
+enable them before installation:
+
+```sh
+sudo fedora/packages/rpm/enable-dependencies.sh
+```
+
+The installer leaves third-party repository setup as an explicit step.
+
+`ryoku track stable`, `ryoku track testing`, and release tags use the same
+repository ID, `ryoku`. RPM packages include a Fedora package mapping table at
+`/usr/share/ryoku/packages/fedora.tsv`.
+
+## Build RPMs
+
+On Fedora, install the RPM and build tools, Go, and the development libraries
+listed as BuildRequires in the specs. Then prepare self-contained source RPMs:
+
+```sh
+RYOKU_SRPM_OUT=/tmp/ryoku-srpms fedora/packages/rpm/prepare-srpms.sh
+```
+
+For local edits in an uncommitted worktree, set `RYOKU_RPM_LOCAL=1`. Rebuild
+the SRPMs in clean Mock roots with:
+
+```sh
+fedora/packages/rpm/rebuild-srpms.sh /tmp/ryoku-srpms /tmp/ryoku-rebuilt
+```
+
+Build a local repository with `fedora/packages/rpm/build-rpm-repo.sh`. Set
+`RYOKU_RPM_UNSIGNED=1` only for local tests; unsigned output is not accepted by
+the shell installer. Signed builds require an RPM signing key and sign both
+packages and repository metadata. See the script usage and RPM spec files for
+the exact build inputs.
+
+The DNF host implementation is kept in
+`fedora/packages/rpm/patches/0001-host-dnf-support.patch` and applied while staging
+the RPM source tree. This keeps Fedora-specific build changes under this
+directory and leaves shared upstream files untouched in this checkout.
+
+## Scope and validation
+
+The Fedora host supports DNF4 and DNF5 on mutable x86_64 installs. The package
+mapping is maintained in `fedora/packages/rpm/payload/fedora.tsv`. Snapshot rollback
+and AUR operations are not provided by this Fedora package layer.
+
+Run the host tests from `ryoku/cli` with `go test ./internal/host`. The
+extra-package helper has tests in `fedora/tests/fedora-extras.py`.
diff --git a/fedora/packages/rpm/build-rpm-repo.sh b/fedora/packages/rpm/build-rpm-repo.sh
new file mode 100755
index 0000000000..12c43cdd0e
--- /dev/null
+++ b/fedora/packages/rpm/build-rpm-repo.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root=$(cd "$(dirname "$0")/../../.." && pwd)
+git config --global --add safe.directory "$root" 2>/dev/null || true
+git config --global --add safe.directory '*' 2>/dev/null || true
+out=${RYOKU_RPM_OUT:-$root/fedora/packages/rpm/out}
+die() { echo "build-rpm-repo: $*" >&2; exit 1; }
+for tool in rpmbuild createrepo_c python3 tar gzip; do command -v "$tool" >/dev/null || die "missing $tool"; done
+if [[ ${RYOKU_RPM_UNSIGNED:-0} != 1 ]]; then
+  : "${RYOKU_RPM_SIGNING_KEY:?set the signing key fingerprint or RYOKU_RPM_UNSIGNED=1 for local tests}"
+  [[ -z $(git -C "$root" status --porcelain) ]] || die 'signed releases require a clean checkout'
+fi
+[[ ! -e $out ]] || die "output already exists; use a new RYOKU_RPM_OUT to retain rollback packages"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+mkdir -p "$out"
+RYOKU_SRPM_OUT="$out/SRPMS" RYOKU_RPM_LOCAL="${RYOKU_RPM_UNSIGNED:-0}" "$root/fedora/packages/rpm/prepare-srpms.sh"
+for srpm in "$out"/SRPMS/*.src.rpm; do
+  rpmbuild --define "_buildhost ryoku-builder" --define "use_source_date_epoch_as_buildtime 1" --define "clamp_mtime_to_source_date_epoch 1" --define "_topdir $work" --define "_rpmdir $out" --rebuild "$srpm"
+done
+cp "$out/SRPMS/release.json" "$out/release.json"
+mapfile -d '' rpms < <(find "$out" -name '*.rpm' ! -path '*/SRPMS/*' -print0)
+((${#rpms[@]})) || die 'no RPMs built'
+if [[ ${RYOKU_RPM_UNSIGNED:-0} != 1 ]]; then
+  gpg --armor --export "$RYOKU_RPM_SIGNING_KEY" > "$work/key.asc"
+  rpm --dbpath "$work/keydb" --import "$work/key.asc"
+  for rpmfile in "${rpms[@]}"; do
+    rpmsign --define "_gpg_name $RYOKU_RPM_SIGNING_KEY" --addsign "$rpmfile"
+    rpmkeys --dbpath "$work/keydb" --checksig "$rpmfile" | grep -q 'signatures OK' || die "signature verification failed: $rpmfile"
+  done
+fi
+createrepo_c --excludes 'SRPMS/*' "$out"
+if [[ ${RYOKU_RPM_UNSIGNED:-0} != 1 ]]; then
+  gpg --batch --yes --local-user "$RYOKU_RPM_SIGNING_KEY" --armor --detach-sign "$out/repodata/repomd.xml"
+  gpg --verify "$out/repodata/repomd.xml.asc" "$out/repodata/repomd.xml"
+fi
+printf 'Built repository at %s\n' "$out"
diff --git a/fedora/packages/rpm/dependency-coprs b/fedora/packages/rpm/dependency-coprs
new file mode 100644
index 0000000000..2dbce8207e
--- /dev/null
+++ b/fedora/packages/rpm/dependency-coprs
@@ -0,0 +1,6 @@
+sdegler/hyprland
+errornointernet/quickshell
+atim/starship
+atim/lazygit
+lihaohong/yazi
+itskontra/ryotunes
diff --git a/fedora/packages/rpm/enable-dependencies.sh b/fedora/packages/rpm/enable-dependencies.sh
new file mode 100755
index 0000000000..9dbd067fdb
--- /dev/null
+++ b/fedora/packages/rpm/enable-dependencies.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+manager=${RYOKU_TEST_DNF:-dnf}
+here=$(cd "$(dirname "$0")" && pwd)
+plugin=dnf-plugins-core
+if [[ $(basename "$(readlink -f "$(command -v "$manager")")") == dnf5 ]]; then
+  plugin=dnf5-plugins
+fi
+"$manager" -y install "$plugin"
+while IFS= read -r repo; do
+  [[ -n $repo && $repo != \#* ]] || continue
+  "$manager" -y copr enable "$repo" || { echo "cannot enable required COPR $repo" >&2; exit 1; }
+done < "$here/dependency-coprs"
diff --git a/fedora/packages/rpm/patches/0001-host-dnf-support.patch b/fedora/packages/rpm/patches/0001-host-dnf-support.patch
new file mode 100644
index 0000000000..6225298cfa
--- /dev/null
+++ b/fedora/packages/rpm/patches/0001-host-dnf-support.patch
@@ -0,0 +1,657 @@
+diff --git a/ryoku/cli/internal/host/advice.go b/ryoku/cli/internal/host/advice.go
+index ee562408d69aafc0a98faaa7e0fafe92f3639721..7d308f137f8bdda5c4c3e20d3f0bf2cc101701e6 100644
+--- a/ryoku/cli/internal/host/advice.go
++++ b/ryoku/cli/internal/host/advice.go
+@@ -18,6 +18,9 @@ func (a *App) InstallAdvice(names ...string) string {
+ 	if manager == Pacman {
+ 		return "sudo pacman -S " + strings.Join(names, " ")
+ 	}
++	if manager == DNF {
++		return "sudo dnf install " + strings.Join(names, " ")
++	}
+ 	table, err := a.xbpsTable()
+ 	if err != nil {
+ 		parts := make([]string, 0, len(names))
+diff --git a/ryoku/cli/internal/host/capabilities.go b/ryoku/cli/internal/host/capabilities.go
+index 2038efc67b68b2bae8c5790bb7269af5d0dbedb1..b66d6ffb89c266ebedfe6436479bf4eb3c95c52a 100644
+--- a/ryoku/cli/internal/host/capabilities.go
++++ b/ryoku/cli/internal/host/capabilities.go
+@@ -27,7 +27,11 @@ func (a *App) Capabilities() int {
+ 	aur := manager == Pacman
+ 	aurReason := ""
+ 	if !aur {
+-		aurReason = "The AUR is an Arch Linux service; Void installs come from XBPS."
++		if manager == XBPS {
++			aurReason = "The AUR is an Arch Linux service; Void installs come from XBPS."
++		} else {
++			aurReason = "The AUR is an Arch Linux service; Fedora installs come from DNF."
++		}
+ 	}
+ 	value := hostCapabilities{
+ 		PackageManager: manager,
+diff --git a/ryoku/cli/internal/host/detect.go b/ryoku/cli/internal/host/detect.go
+index cb75c93415072a27cfaa2066918e9d89c807ddbe..59d76e0e4b67ea31245eea70cab396be8d53812b 100644
+--- a/ryoku/cli/internal/host/detect.go
++++ b/ryoku/cli/internal/host/detect.go
+@@ -17,6 +17,7 @@ type PackageManager string
+ const (
+ 	Pacman PackageManager = "pacman"
+ 	XBPS   PackageManager = "xbps"
++	DNF    PackageManager = "dnf"
+ )
+ 
+ func (a *App) Init() (InitSystem, error) {
+@@ -38,7 +39,7 @@ func (a *App) Init() (InitSystem, error) {
+ func (a *App) PackageManager() (PackageManager, error) {
+ 	if override := a.getenv("RYOKU_HOST_PKGMGR"); override != "" {
+ 		switch PackageManager(override) {
+-		case Pacman, XBPS:
++		case Pacman, XBPS, DNF:
+ 			return PackageManager(override), nil
+ 		default:
+ 			return "", fmt.Errorf("invalid RYOKU_HOST_PKGMGR %q", override)
+@@ -50,5 +51,8 @@ func (a *App) PackageManager() (PackageManager, error) {
+ 	if a.cfg.Runner.LookPath("xbps-install") {
+ 		return XBPS, nil
+ 	}
++	if a.cfg.Runner.LookPath("dnf5") || a.cfg.Runner.LookPath("dnf") {
++		return DNF, nil
++	}
+ 	return "", fmt.Errorf("no supported package manager found")
+ }
+diff --git a/ryoku/cli/internal/host/dnf.go b/ryoku/cli/internal/host/dnf.go
+new file mode 100644
+index 0000000000000000000000000000000000000000..fd0e13914529ed7d8bd5f23ede0728ca9dad365f
+--- /dev/null
++++ b/ryoku/cli/internal/host/dnf.go
+@@ -0,0 +1,178 @@
++package host
++
++import (
++	"fmt"
++	"strings"
++)
++
++func (a *App) dnfCommand() string {
++	if a.cfg.Runner.LookPath("dnf5") {
++		return "dnf5"
++	}
++	return "dnf"
++}
++
++func (a *App) fedoraTable() (packageTable, error) {
++	path := a.getenv("RYOKU_HOST_FEDORA_TABLE")
++	if path == "" {
++		path = "/usr/share/ryoku/packages/fedora.tsv"
++	}
++	table, err := readPackageTable(path)
++	if err != nil {
++		return nil, err
++	}
++	return table, nil
++}
++
++func dnfPackages(table packageTable, names []string) ([]string, []string) {
++	return translatePackages(table, names)
++}
++
++func (a *App) dnf(args []string) int {
++	if len(args) == 0 {
++		return ExitUsage
++	}
++	verb, rest := args[0], args[1:]
++	table, err := a.fedoraTable()
++	if err != nil {
++		return a.failf("read Fedora package table: %v", err)
++	}
++	if verb == "count" {
++		if len(rest) > 1 || len(rest) == 1 && rest[0] != "--foreign" {
++			return ExitUsage
++		}
++		cmd, args := "rpm", []string{"-qa", "--qf", "%{NAME}\n"}
++		if len(rest) == 1 {
++			cmd, args = a.dnfCommand(), []string{"repoquery", "--extras", "--installed", "--qf", "%{name}"}
++		}
++		result := a.query(cmd, args...)
++		if result.Code != 0 {
++			return ExitFailure
++		}
++		fmt.Fprintln(a.cfg.Stdout, countLines(result.Output))
++		return ExitOK
++	}
++	if verb == "why" {
++		if len(rest) != 1 {
++			return ExitUsage
++		}
++		return ExitFalse
++	}
++	if verb == "local" {
++		if len(rest) == 0 {
++			return ExitUsage
++		}
++		for _, name := range rest {
++			mapping := translatePackage(table, name)
++			if mapping.Special != "" {
++				fmt.Fprintln(a.cfg.Stdout)
++			} else {
++				fmt.Fprintln(a.cfg.Stdout, strings.Join(mapping.Names, " "))
++			}
++		}
++		return ExitOK
++	}
++	upgrade := false
++	if verb == "install" {
++		for len(rest) > 0 && strings.HasPrefix(rest[0], "--") {
++			switch rest[0] {
++			case "--upgrade":
++				upgrade = true
++				rest = rest[1:]
++			case "--aur":
++				return ExitNotProvided
++			case "--overwrite":
++				if len(rest) < 2 {
++					return ExitUsage
++				}
++				rest = rest[2:]
++			default:
++				return ExitUsage
++			}
++		}
++	}
++	if len(rest) == 0 {
++		return ExitUsage
++	}
++	if verb == "version" || verb == "owner" {
++		if len(rest) != 1 {
++			return ExitUsage
++		}
++		switch verb {
++		case "version":
++			result := a.query("rpm", "-q", "--qf", "%{VERSION}-%{RELEASE}\n", rest[0])
++			if result.Code != 0 {
++				return ExitFalse
++			}
++			fmt.Fprint(a.cfg.Stdout, strings.TrimSpace(result.Output))
++			return ExitOK
++		case "owner":
++			result := a.query("rpm", "-qf", "--qf", "%{NAME}\n", rest[0])
++			if result.Code != 0 {
++				return ExitFalse
++			}
++			fmt.Fprint(a.cfg.Stdout, strings.TrimSpace(result.Output))
++			return ExitOK
++		}
++	}
++	if verb == "install-file" {
++		cmd := append([]string{"install", "-y"}, rest...)
++		return commandExit(a.run(a.dnfCommand(), cmd...))
++	}
++	if verb != "installed" && verb != "available" && verb != "install" && verb != "remove" && verb != "explicit" {
++		return ExitUsage
++	}
++	names, unavailable := dnfPackages(table, rest)
++	if len(unavailable) > 0 {
++		if verb == "installed" || verb == "available" {
++			return ExitFalse
++		}
++		fmt.Fprintf(a.cfg.Stderr, "ryoku-host: packages unavailable on Fedora: %s\n", strings.Join(unavailable, " "))
++		return ExitNotProvided
++	}
++	switch verb {
++	case "installed":
++		for _, name := range names {
++			if a.probe("rpm", "-q", "--quiet", name).Code != 0 {
++				return ExitFalse
++			}
++		}
++		return ExitOK
++	case "available":
++		for _, name := range names {
++			if a.probe(a.dnfCommand(), "repoquery", "--available", "--quiet", "--qf", "%{name}", name).Code != 0 {
++				return ExitFalse
++			}
++		}
++		return ExitOK
++	case "install":
++		args := []string{"install", "-y", "--setopt=install_weak_deps=False"}
++		if upgrade {
++			args = append([]string{"upgrade", "-y", "--setopt=install_weak_deps=False"}, names...)
++		} else {
++			args = append(args, names...)
++		}
++		return commandExit(a.run(a.dnfCommand(), args...))
++	case "remove":
++		return commandExit(a.run(a.dnfCommand(), append([]string{"remove", "-y"}, names...)...))
++	case "explicit":
++		cmd := a.dnfCommand()
++		if cmd == "dnf5" {
++			return commandExit(a.run(cmd, append([]string{"mark", "user"}, names...)...))
++		}
++		return commandExit(a.run(cmd, append([]string{"mark", "install"}, names...)...))
++	}
++	return ExitUsage
++}
++
++func (a *App) dnfOrphans() ([]string, error) {
++	result := a.query(a.dnfCommand(), "repoquery", "--unneeded", "--installed", "--qf", "%{name}")
++	if result.Code != 0 {
++		return nil, fmt.Errorf("dnf repoquery --unneeded: exit %d: %s", result.Code, strings.TrimSpace(result.Output))
++	}
++	output := strings.TrimSpace(result.Output)
++	if output == "" {
++		return nil, nil
++	}
++	return strings.Split(output, "\n"), nil
++}
+diff --git a/ryoku/cli/internal/host/dnf_test.go b/ryoku/cli/internal/host/dnf_test.go
+new file mode 100644
+index 0000000000000000000000000000000000000000..f481cadf6ecba1bf58ceed0f5b759bb7bf5a6b94
+--- /dev/null
++++ b/ryoku/cli/internal/host/dnf_test.go
+@@ -0,0 +1,99 @@
++package host
++
++import (
++	"os"
++	"path/filepath"
++	"reflect"
++	"runtime"
++	"testing"
++)
++
++func fedoraPackageFixture(t *testing.T) string {
++	t.Helper()
++	path := filepath.Join(t.TempDir(), "fedora.tsv")
++	body := "arch\tfedora\tlanes\tnotes\nfd\tfd-find\tdesktop\t\ngithub-cli\tgh\tdesktop\t\nmissing\t-\tdesktop\tnot packaged\n"
++	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
++		t.Fatal(err)
++	}
++	return path
++}
++
++func TestDNFPackageTranslationAndCommands(t *testing.T) {
++	table := fedoraPackageFixture(t)
++	runner := &fakeRunner{
++		paths: map[string]bool{"dnf5": true},
++		answer: func(command Command) Result {
++			if argv(command) == "rpm -q --quiet fd-find" || argv(command) == "rpm -q --quiet gh" {
++				return Result{}
++			}
++			if command.Name == "rpm" {
++				return Result{Code: 1}
++			}
++			return Result{}
++		},
++	}
++	app, stdout, stderr := testApp(runner, map[string]string{
++		"RYOKU_HOST_PKGMGR":       "dnf",
++		"RYOKU_HOST_FEDORA_TABLE": table,
++	})
++	if code := app.Package([]string{"installed", "fd", "github-cli"}); code != ExitOK {
++		t.Fatalf("installed exit = %d", code)
++	}
++	runner.commands = nil
++	if code := app.Package([]string{"install", "fd", "github-cli"}); code != ExitOK {
++		t.Fatalf("install exit = %d, stderr=%q", code, stderr.String())
++	}
++	if got := argv(runner.commands[len(runner.commands)-1]); got != "dnf5 install -y --setopt=install_weak_deps=False fd-find gh" {
++		t.Fatalf("install argv = %q", got)
++	}
++	runner.commands = nil
++	if code := app.Package([]string{"available", "fd"}); code != ExitOK {
++		t.Fatalf("available exit = %d", code)
++	}
++	if got := argv(runner.commands[0]); got != "dnf5 repoquery --available --quiet --qf %{name} fd-find" {
++		t.Fatalf("available argv = %q", got)
++	}
++	runner.commands = nil
++	if code := app.Package([]string{"install", "missing"}); code != ExitNotProvided {
++		t.Fatalf("unmapped install exit = %d", code)
++	}
++	if len(runner.commands) != 0 {
++		t.Fatalf("unmapped install ran commands: %v", runner.commands)
++	}
++	if stdout.Len() != 0 {
++		t.Fatalf("unexpected stdout: %q", stdout.String())
++	}
++}
++
++func TestDNFDetectionAndCapabilities(t *testing.T) {
++	runner := &fakeRunner{paths: map[string]bool{"dnf5": true}}
++	app, stdout, _ := testApp(runner, map[string]string{"RYOKU_HOST_INIT": "systemd"})
++	manager, err := app.PackageManager()
++	if err != nil || manager != DNF {
++		t.Fatalf("PackageManager = %q, %v", manager, err)
++	}
++	if code := app.Capabilities(); code != ExitOK {
++		t.Fatalf("Capabilities exit = %d", code)
++	}
++	want := "{\"packageManager\":\"dnf\",\"init\":\"systemd\",\"snapshots\":{\"supported\":false,\"reason\":\"Snapshot rollback is not enabled by the Fedora package layer.\"},\"aur\":{\"supported\":false,\"reason\":\"The AUR is an Arch Linux service; Fedora installs come from DNF.\"}}\n"
++	if got := stdout.String(); got != want {
++		t.Fatalf("capabilities = %q, want %q", got, want)
++	}
++}
++
++func TestFedoraPackageTable(t *testing.T) {
++	_, source, _, ok := runtime.Caller(0)
++	if !ok {
++		t.Fatal("could not locate host test source")
++	}
++	path := filepath.Join(filepath.Dir(source), "../../../../fedora/packages/rpm/payload/fedora.tsv")
++	table, err := readPackageTable(path)
++	if err != nil {
++		t.Fatal(err)
++	}
++	got, unavailable := dnfPackages(table, []string{"fd", "github-cli", "adw-gtk-theme", "ttf-jetbrains-mono-nerd"})
++	want := []string{"fd-find", "gh", "adw-gtk3-theme"}
++	if !reflect.DeepEqual(got, want) || !reflect.DeepEqual(unavailable, []string{"ttf-jetbrains-mono-nerd"}) {
++		t.Fatalf("translation = %v, unavailable = %v", got, unavailable)
++	}
++}
+diff --git a/ryoku/cli/internal/host/package.go b/ryoku/cli/internal/host/package.go
+index 5e4945b5ddc06d7562d8856f68523c3b825c179d..aecdd6af7213dfb59fdf7dc5ed86115369c5a854 100644
+--- a/ryoku/cli/internal/host/package.go
++++ b/ryoku/cli/internal/host/package.go
+@@ -33,6 +33,9 @@ func (a *App) Package(args []string) int {
+ 	if manager == Pacman {
+ 		return a.pacman(args)
+ 	}
++	if manager == DNF {
++		return a.dnf(args)
++	}
+ 	return a.xbps(args)
+ }
+ 
+@@ -60,6 +63,9 @@ func (a *App) Orphans() ([]string, error) {
+ 	if err != nil {
+ 		return nil, err
+ 	}
++	if manager == DNF {
++		return a.dnfOrphans()
++	}
+ 	name, args := "pacman", []string{"-Qdtq"}
+ 	if manager == XBPS {
+ 		name, args = "xbps-query", []string{"-O"}
+@@ -89,6 +95,13 @@ func (a *App) PackageOwner(path string) (string, error) {
+ 	if err != nil {
+ 		return "", err
+ 	}
++	if manager == DNF {
++		result := a.query("rpm", "-qf", "--qf", "%{NAME}\n", path)
++		if result.Code != 0 {
++			return "", fmt.Errorf("rpm -qf: exit %d", result.Code)
++		}
++		return strings.TrimSpace(result.Output), nil
++	}
+ 	name, args := "pacman", []string{"-Qoq", path}
+ 	if manager == XBPS {
+ 		name, args = "xbps-query", []string{"-o", path}
+diff --git a/ryoku/cli/internal/host/repo.go b/ryoku/cli/internal/host/repo.go
+index 25bf7cbad45c812e145fe07f9f8d3d3c335aa401..3069ecdbc4bf0ce82cbfb68d57b1d31a1cb622db 100644
+--- a/ryoku/cli/internal/host/repo.go
++++ b/ryoku/cli/internal/host/repo.go
+@@ -15,8 +15,10 @@ import (
+ const (
+ 	PacmanRepoBase = "https://repo.ryoku.dev/stable"
+ 	XBPSRepoBase   = "https://repo.ryoku.dev/stable/void"
++	DNFRepoBase    = "https://repo.ryoku.dev/stable/fedora"
+ 	ryokuRepoName  = "ryoku"
+ 	xbpsRepoConfig = "20-ryoku.conf"
++	dnfRepoConfig  = "/etc/yum.repos.d/ryoku.repo"
+ )
+ 
+ var ErrRepoAbsent = errors.New("no Ryoku package repository is configured")
+@@ -31,6 +33,9 @@ func repoBaseFor(manager PackageManager) string {
+ 	if manager == XBPS {
+ 		return XBPSRepoBase
+ 	}
++	if manager == DNF {
++		return DNFRepoBase
++	}
+ 	return PacmanRepoBase
+ }
+ 
+@@ -44,6 +49,8 @@ func RepoURLFor(manager PackageManager, channel string) string {
+ 	base, arch := repoBaseFor(manager), "$arch"
+ 	if manager == XBPS {
+ 		arch = "x86_64"
++	} else if manager == DNF {
++		arch = "$releasever/$basearch"
+ 	}
+ 	switch {
+ 	case channel == "stable":
+@@ -107,8 +114,14 @@ func RepoChannelOf(manager PackageManager, raw string) string {
+ 	base := repoBaseFor(manager)
+ 	value := strings.TrimSpace(raw)
+ 	value = strings.TrimSuffix(value, "/")
+-	value = strings.TrimSuffix(value, "$arch")
+-	value = strings.TrimSuffix(value, "x86_64")
++
++	if manager == DNF {
++		value = strings.TrimSuffix(value, "$releasever/$basearch")
++	} else {
++		value = strings.TrimSuffix(value, "$arch")
++		value = strings.TrimSuffix(value, "x86_64")
++	}
++
+ 	value = strings.TrimSuffix(value, "/")
+ 	if !strings.HasPrefix(value, base) {
+ 		return ""
+@@ -142,11 +155,28 @@ func (a *App) xbpsShippedConfig() string {
+ 	return a.cfg.XBPSShippedConfig
+ }
+ 
++func (a *App) dnfRepoPath() string {
++	if path := a.getenv("RYOKU_DNF_REPO_CONFIG"); path != "" {
++		return path
++	}
++	return dnfRepoConfig
++}
++
+ func (a *App) RepoURL() (string, error) {
+ 	manager, err := a.PackageManager()
+ 	if err != nil {
+ 		return "", err
+ 	}
++	if manager == DNF {
++		body, err := os.ReadFile(a.dnfRepoPath())
++		if err != nil {
++			return "", ErrRepoAbsent
++		}
++		if value := dnfRepoURL(string(body)); value != "" {
++			return value, nil
++		}
++		return "", ErrRepoAbsent
++	}
+ 	if manager == Pacman {
+ 		path := a.cfg.PacmanConf
+ 		if override := a.getenv("RYOKU_PACMAN_CONF"); override != "" {
+@@ -193,6 +223,24 @@ func pacmanRepoURL(body string) string {
+ 	return ""
+ }
+ 
++func dnfRepoURL(body string) string {
++	inRepo := false
++	scanner := bufio.NewScanner(strings.NewReader(body))
++	for scanner.Scan() {
++		line := strings.TrimSpace(scanner.Text())
++		if strings.HasPrefix(line, "[") {
++			inRepo = line == "[ryoku]"
++			continue
++		}
++		if inRepo && strings.HasPrefix(strings.ToLower(line), "baseurl") {
++			if _, value, ok := strings.Cut(line, "="); ok {
++				return strings.TrimSpace(value)
++			}
++		}
++	}
++	return ""
++}
++
+ func xbpsRepoURL(body string) string {
+ 	scanner := bufio.NewScanner(strings.NewReader(body))
+ 	for scanner.Scan() {
+@@ -253,6 +301,10 @@ func (a *App) RepoSetURL(url string) error {
+ 	if err != nil {
+ 		return err
+ 	}
++	if manager == DNF {
++		body := "[ryoku]\nname=Ryoku\nbaseurl=" + strings.TrimSpace(url) + "\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ryoku\n"
++		return replaceFile(a.dnfRepoPath(), body, 0o644)
++	}
+ 	if manager == XBPS {
+ 		path := filepath.Join(a.xbpsConfigDir(), xbpsRepoConfig)
+ 		return replaceFile(path, "repository="+strings.TrimSpace(url)+"\n", 0o644)
+@@ -324,6 +376,11 @@ func (a *App) RepoSync(force bool) error {
+ 	name, args := "pacman", []string{"-Sy", "--noconfirm"}
+ 	if manager == XBPS {
+ 		name, args = "xbps-install", []string{"-S"}
++	} else if manager == DNF {
++		name, args = a.dnfCommand(), []string{"makecache"}
++		if force {
++			args = append(args, "--refresh")
++		}
+ 	} else if force {
+ 		args[0] = "-Syy"
+ 	}
+@@ -339,6 +396,24 @@ func (a *App) RepoPackages() ([]RepoPackage, error) {
+ 	if err != nil {
+ 		return nil, err
+ 	}
++	if manager == DNF {
++		result := a.query(a.dnfCommand(), "repoquery", "--available", "--repo="+ryokuRepoName, "--qf", "%{name}\t%{version}-%{release}")
++		if result.Code != 0 {
++			return nil, commandError(a.dnfCommand(), []string{"repoquery", "--available", "--repo=" + ryokuRepoName}, result)
++		}
++		var packages []RepoPackage
++		for _, line := range strings.Split(result.Output, "\n") {
++			fields := strings.SplitN(strings.TrimSpace(line), "\t", 2)
++			if len(fields) == 2 && fields[0] != "" {
++				packages = append(packages, RepoPackage{Name: fields[0], Version: fields[1], Repository: ryokuRepoName})
++			}
++		}
++		if len(packages) == 0 {
++			return nil, fmt.Errorf("the Ryoku DNF repository package list is empty")
++		}
++		sort.Slice(packages, func(i, j int) bool { return packages[i].Name < packages[j].Name })
++		return packages, nil
++	}
+ 	if manager == Pacman {
+ 		result := a.query("pacman", "-Sl", ryokuRepoName)
+ 		if result.Code != 0 {
+@@ -408,6 +483,20 @@ func (a *App) RepoInstalledSet(allowDowngrade bool, excluded map[string]bool) ([
+ 	if err != nil {
+ 		return nil, 0, err
+ 	}
++	if manager == DNF {
++		result := a.query(a.dnfCommand(), "repoquery", "--upgrades", "--installed", "--repo="+ryokuRepoName, "--qf", "%{name}")
++		if result.Code != 0 {
++			return nil, 0, commandError(a.dnfCommand(), []string{"repoquery", "--upgrades", "--installed", "--repo=" + ryokuRepoName}, result)
++		}
++		var targets []string
++		for _, line := range strings.Split(result.Output, "\n") {
++			if name := strings.TrimSpace(line); name != "" && !excluded[name] {
++				targets = append(targets, name)
++			}
++		}
++		sort.Strings(targets)
++		return targets, 0, nil
++	}
+ 	packages, err := a.RepoPackages()
+ 	if err != nil {
+ 		return nil, 0, err
+@@ -452,6 +541,8 @@ func (a *App) installedVersion(manager PackageManager, name string) (string, boo
+ 	command, args := "pacman", []string{"-Q", name}
+ 	if manager == XBPS {
+ 		command, args = "xbps-query", []string{"-p", "pkgver", name}
++	} else if manager == DNF {
++		command, args = "rpm", []string{"-q", "--qf", "%{VERSION}-%{RELEASE}\n", name}
+ 	}
+ 	result := a.query(command, args...)
+ 	if result.Code != 0 {
+@@ -460,7 +551,7 @@ func (a *App) installedVersion(manager PackageManager, name string) (string, boo
+ 	value := strings.TrimSpace(result.Output)
+ 	if manager == Pacman {
+ 		value = strings.TrimSpace(strings.TrimPrefix(value, name+" "))
+-	} else {
++	} else if manager == XBPS {
+ 		value = strings.TrimSpace(strings.TrimPrefix(value, name+"-"))
+ 	}
+ 	return value, value != ""
+diff --git a/ryoku/cli/internal/host/repo_test.go b/ryoku/cli/internal/host/repo_test.go
+index 0a8bfa79dd021372cef0b78ab4f7e3d6034e6b67..d52d2eb7f01a48b886829326d92e0c5c9b8fe8ca 100644
+--- a/ryoku/cli/internal/host/repo_test.go
++++ b/ryoku/cli/internal/host/repo_test.go
+@@ -228,3 +228,46 @@ func TestParseXBPSRepoPackagesAndInstalledSet(t *testing.T) {
+ 		t.Fatalf("set = %v, held = %d", set, held)
+ 	}
+ }
++
++func TestDNFRepoURLAndChannel(t *testing.T) {
++	channels := map[string]string{
++		"stable":  "$releasever/$basearch",
++		"testing": "channels/testing/$releasever/$basearch",
++		"v1.2.3":  "releases/v1.2.3/$releasever/$basearch",
++	}
++	for want, suffix := range channels {
++		url := RepoURLFor(DNF, want)
++		if got := RepoChannelOf(DNF, url); got != want {
++			t.Errorf("RepoChannelOf(%q) = %q", url, got)
++		}
++		if !strings.HasSuffix(url, suffix) {
++			t.Errorf("RepoURLFor(%q) = %q", want, url)
++		}
++	}
++	if got := RepoChannelOf(DNF, "https://example.invalid/other"); got != "" {
++		t.Fatalf("unknown DNF repo channel = %q", got)
++	}
++}
++
++func TestDNFRepoConfigReadAndWrite(t *testing.T) {
++	path := filepath.Join(t.TempDir(), "ryoku.repo")
++	app, _, _ := testApp(&fakeRunner{}, map[string]string{
++		"RYOKU_HOST_PKGMGR":     "dnf",
++		"RYOKU_DNF_REPO_CONFIG": path,
++	})
++	url := RepoURLFor(DNF, "testing")
++	if err := app.RepoSetURL(url); err != nil {
++		t.Fatal(err)
++	}
++	got, err := app.RepoURL()
++	if err != nil || got != url {
++		t.Fatalf("RepoURL() = %q, %v", got, err)
++	}
++	body, err := os.ReadFile(path)
++	if err != nil {
++		t.Fatal(err)
++	}
++	if !strings.Contains(string(body), "[ryoku]\n") || !strings.Contains(string(body), "baseurl="+url+"\n") || !strings.Contains(string(body), "repo_gpgcheck=1\n") {
++		t.Fatalf("repo config = %q", body)
++	}
++}
+diff --git a/ryoku/cli/internal/host/snapshots.go b/ryoku/cli/internal/host/snapshots.go
+index a6bb1d0a2637bf0dd8989b75df2dd034bc5fbe31..7419f7d4af07507f059a70e5af86a9084535e15b 100644
+--- a/ryoku/cli/internal/host/snapshots.go
++++ b/ryoku/cli/internal/host/snapshots.go
+@@ -8,5 +8,8 @@ func (a *App) Snapshots() (supported bool, reason string) {
+ 	if err == nil && (manager == Pacman || manager == XBPS) {
+ 		return true, ""
+ 	}
++	if err == nil && manager == DNF {
++		return false, "Snapshot rollback is not enabled by the Fedora package layer."
++	}
+ 	return false, snapshotsUnavailableReason
+ }
+diff --git a/ryoku/cli/internal/host/table.go b/ryoku/cli/internal/host/table.go
+index e538e3d0ddc5bfde9812391c49bfd26f689050cc..994edaec0793cb67e0cb2aa7826033c6d77f66ba 100644
+--- a/ryoku/cli/internal/host/table.go
++++ b/ryoku/cli/internal/host/table.go
+@@ -34,7 +34,7 @@ func readPackageTable(path string) (packageTable, error) {
+ 		fields := strings.Split(line, "\t")
+ 		if !header {
+ 			header = true
+-			if len(fields) != 4 || fields[0] != "arch" || fields[1] != "void" || fields[2] != "lanes" || fields[3] != "notes" {
++			if len(fields) != 4 || fields[0] != "arch" || (fields[1] != "void" && fields[1] != "fedora") || fields[2] != "lanes" || fields[3] != "notes" {
+ 				return nil, fmt.Errorf("%s:%d: invalid header", path, lineNo)
+ 			}
+ 			continue
diff --git a/fedora/packages/rpm/payload/fedora.tsv b/fedora/packages/rpm/payload/fedora.tsv
new file mode 100644
index 0000000000..1ffffbac01
--- /dev/null
+++ b/fedora/packages/rpm/payload/fedora.tsv
@@ -0,0 +1,7 @@
+arch	fedora	lanes	notes
+fd	fd-find	desktop	Fedora packages the fd utility as fd-find.
+github-cli	gh	desktop	Fedora uses gh as the executable package name.
+adw-gtk-theme	adw-gtk3-theme	desktop	Fedora ships the compatible GTK theme as adw-gtk3-theme.
+noto-fonts	google-noto-sans-fonts google-noto-serif-fonts google-noto-sans-mono-fonts	desktop	Fedora splits Noto families into separate packages.
+noto-fonts-emoji	google-noto-emoji-fonts	desktop	Fedora uses the google-noto-emoji-fonts package.
+ttf-jetbrains-mono-nerd	-	desktop	Fedora does not ship the Nerd Font patched glyph set.
diff --git a/fedora/packages/rpm/payload/ryogami.sh b/fedora/packages/rpm/payload/ryogami.sh
new file mode 100644
index 0000000000..ef352f141d
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryogami.sh
@@ -0,0 +1,61 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# Ryogami: the Ryoku wallpaper daemon (Go). One process owns the wallpaper
+# catalog (thumbnails, colours, favourites), applies through the in-shell
+# surface topic, the matugen palette, and the depth surface, behind ryoku's
+# line pub/sub on $XDG_RUNTIME_DIR/ryogami.sock. The vendored skwd-wall picker
+# (wall-ui) is its front end.
+#
+# built from the in-repo Go module at ryoku/shell/ryogami/daemon, no tarball
+# fetched. publish CI runs makepkg inside this dir against a full checkout, so
+# the repo root is three levels up; go builds into $srcdir so the source tree
+# stays untouched.
+pkgname=ryogami
+pkgver=${RYOKU_PKGVER:-0.2.0}
+pkgrel=1
+pkgdesc="Ryogami: the Ryoku wallpaper daemon (catalog, thumbnails, applies, depth)"
+arch=('x86_64')
+url="https://ryoku.dev"
+license=('MIT')
+# Runtime tools for the daemon and picker: ImageMagick and ffmpeg for image/video
+# processing, quickshell for the Qt Quick picker, curl for remote wallpaper
+# sources, and inotify-tools for live wallpaper directory updates.
+depends=('imagemagick' 'ffmpeg' 'quickshell' 'curl' 'inotify-tools')
+makedepends=('go' 'cmake' 'ninja' 'qt6-base' 'qt6-declarative' 'qt6-shadertools' 'qt6-multimedia' 'wayland' 'wayland-protocols')
+source=()
+
+_repo="$startdir/../../../.."
+
+build() {
+  cd "$_repo/ryoku/shell/ryogami/daemon"
+  # -mod=vendor keeps the build off proxy.golang.org so it is reproducible and
+  # works in the offline publish container (the module is stdlib-only, so there
+  # is no vendor/ tree to carry). Matches every other [ryoku] Go package.
+  CGO_ENABLED=0 go build -trimpath -mod=vendor -o "$srcdir/ryogami" .
+  "$_repo/ryoku/shell/livewall/build.sh" "$srcdir/ryogami-live"
+  RYOGAMI_PICKER_BUILD="$srcdir/picker-build" \
+    "$_repo/ryoku/shell/ryogami/picker/build.sh" "$srcdir/qml"
+}
+
+package() {
+  install -Dm755 "$srcdir/ryogami" "$pkgdir/usr/bin/ryogami"
+  install -Dm755 "$srcdir/ryogami-live" "$pkgdir/usr/bin/ryogami-live"
+  # user unit: systemd finds it under /usr/lib/systemd/user without materialize,
+  # exactly where ExecStart already points (/usr/bin/ryogami).
+  install -Dm644 "$_repo/ryoku/shell/systemd/user/ryogami.service" \
+    "$pkgdir/usr/lib/systemd/user/ryogami.service"
+  # Install the compiled Qt Quick picker module and its shell entry point.
+  install -d "$pkgdir/usr/lib/qt6/qml/Ryoku/Ryogami"
+  cp -a "$srcdir/qml/Ryoku/Ryogami/." "$pkgdir/usr/lib/qt6/qml/Ryoku/Ryogami/"
+  chmod -R u=rwX,go=rX "$pkgdir/usr/lib/qt6"
+  install -Dm644 "$_repo/ryoku/shell/ryogami/picker/shell.qml" \
+    "$pkgdir/usr/share/ryogami/shell.qml"
+  install -Dm644 "$_repo/ryoku/shell/ryogami/picker/data/ryogami.desktop" \
+    "$pkgdir/usr/share/applications/ryogami.desktop"
+  install -Dm644 "$_repo/ryoku/shell/ryogami/picker/LICENSE" \
+    "$pkgdir/usr/share/licenses/ryogami/LICENSE"
+  install -Dm644 "$_repo/ryoku/shell/ryogami/picker/NOTICE" \
+    "$pkgdir/usr/share/licenses/ryogami/NOTICE"
+  install -Dm644 -t "$pkgdir/usr/share/licenses/ryogami/" \
+    "$_repo"/ryoku/shell/ryogami/picker/qml/theme/fonts/*.txt
+}
diff --git a/fedora/packages/rpm/payload/ryoku-blobs.sh b/fedora/packages/rpm/payload/ryoku-blobs.sh
new file mode 100644
index 0000000000..6727cedd1c
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-blobs.sh
@@ -0,0 +1,38 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# Ryoku.Blobs = the SDF metaball QML plugin behind the screen frame
+# (docs/frame.md). a standard Qt6 QML module loaded by Quickshell from the
+# QML import path.
+#
+# built in-repo from ryoku/shell/plugin via its build.sh (CMake/Ninja, bakes the
+# metaball shaders). self-contained: the plugin .so carries an $ORIGIN rpath to
+# its backing library, so the whole Ryoku/Blobs dir is relocatable onto any QML
+# import path. no tarball fetch.
+pkgname=ryoku-blobs
+pkgver=${RYOKU_PKGVER:-0.1.0}
+pkgrel=1
+pkgdesc="Ryoku.Blobs: SDF metaball QML plugin for the screen frame"
+arch=('x86_64')
+url="https://ryoku.dev"
+license=('GPL-3.0-or-later')
+# qt6-multimedia backs the CameraFeed item (webcam self-view overlay): it links
+# libQt6Multimedia at runtime and needs the CMake config + headers to build.
+depends=('qt6-base' 'qt6-declarative' 'qt6-multimedia')
+makedepends=('cmake' 'ninja' 'qt6-shadertools' 'qt6-declarative' 'qt6-multimedia')
+source=()
+
+_repo="$startdir/../../../.."
+
+build() {
+  # CMake tree under $srcdir keeps the source checkout clean.
+  RYOKU_BLOBS_BUILD="$srcdir/build" \
+    "$_repo/ryoku/shell/plugin/build.sh" "$srcdir/qml"
+}
+
+package() {
+  install -dm755 "$pkgdir/usr/lib/qt6/qml/Ryoku/Blobs"
+  cp -a "$srcdir/qml/Ryoku/Blobs/." "$pkgdir/usr/lib/qt6/qml/Ryoku/Blobs/"
+  # cp -a kept build-tree mode bits; normalize for packaging: plugin .so stays
+  # executable, qmldir/.qsb data world-readable.
+  chmod -R u=rwX,go=rX "$pkgdir/usr/lib/qt6"
+}
diff --git a/fedora/packages/rpm/payload/ryoku-desktop-hyprland.sh b/fedora/packages/rpm/payload/ryoku-desktop-hyprland.sh
new file mode 100644
index 0000000000..50fc7e7c36
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-desktop-hyprland.sh
@@ -0,0 +1,56 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# ryoku-desktop-hyprland: the Hyprland compositor variant of the Ryoku desktop.
+# Carries Hyprland, its plugins, its portal and satellites, the Hyprland config
+# tree, and the ryoku-wm-hyprland provider binary (ryoku/wm/hyprland). It provides
+# the ryoku-desktop-compositor virtual, so an installed ryoku-desktop pulls it on
+# the next -Syu with no user action and `ryoku rollback` stays pure metadata.
+# Its sibling may be installed beside it: keeping both makes a switch back
+# instant, and `ryoku wm use --remove-previous` is the only thing that frees disk.
+#
+# RPM metadata and dependencies live in the sibling .spec file. This sourced
+# recipe only stages the payload assembled by stage-package.sh.
+startdir=${startdir:?stage-package.sh must set startdir}
+pkgdir=${pkgdir:?stage-package.sh must set pkgdir}
+_repo="$startdir/../../../.."
+
+package() {
+  local cfg="$pkgdir/usr/share/ryoku/config"
+
+  # Hyprland config tree: includes scripts/ (shell calls ~/.config/hypr/scripts/*
+  # by absolute path) and the hardware-managed gpu/keyboard/monitors drop-ins.
+  install -d "$cfg/hypr"
+  cp -a "$_repo/ryoku/hyprland/." "$cfg/hypr/"
+
+  # Fedora's XDPH package ships its supported picker at this name. The custom
+  # preview picker is Arch-only and must not leave the RPM transaction with an
+  # unavailable dependency or the installed portal pointing at a missing tool.
+  sed -i 's/custom_picker_binary = hyprland-preview-share-picker/custom_picker_binary = hyprland-share-picker/' \
+    "$cfg/hypr/xdph.conf"
+
+  # xdg-desktop-portal: route ScreenCast/Screenshot to Hyprland for screen sharing.
+  install -Dm644 "$_repo/ryoku/hyprland/hyprland-portals.conf" \
+    "$cfg/xdg-desktop-portal/hyprland-portals.conf"
+
+  # cp -a kept source modes; keep hypr/scripts executable, the rest world-readable.
+  chmod -R u=rwX,go=rX "$pkgdir/usr/share/ryoku"
+
+  # the Hyprland leaf scripts the keybinds, autostart and the shell call by bare
+  # name. Same ryoku-* glob the dev deploy uses, so a new script lands in both.
+  local s
+  for s in "$_repo"/ryoku/hyprland/scripts/ryoku-*; do
+    [[ -f $s ]] || continue
+    install -Dm755 "$s" "$pkgdir/usr/bin/${s##*/}"
+  done
+
+  # ryoku-wm-hyprland: the Hyprland half of the window-manager seam. Built from the
+  # ryoku/wm module (its root is one dir up from the hyprland package).
+  ( cd "$_repo/ryoku/wm/hyprland" && go build -o ryoku-wm-hyprland . )
+  install -Dm755 "$_repo/ryoku/wm/hyprland/ryoku-wm-hyprland" \
+    "$pkgdir/usr/bin/ryoku-wm-hyprland"
+
+  # Ryoku.Wm.Hyprland: the provider's QML bridges (global shortcuts, focus grab)
+  # the shell imports instead of Quickshell.Hyprland. Pure QML, like Ryoku.Ui.
+  install -d "$pkgdir/usr/lib/qt6/qml/Ryoku/Wm/Hyprland"
+  cp -a "$_repo/ryoku/wm/hyprland/qml/." "$pkgdir/usr/lib/qt6/qml/Ryoku/Wm/Hyprland/"
+}
diff --git a/fedora/packages/rpm/payload/ryoku-desktop-niri.sh b/fedora/packages/rpm/payload/ryoku-desktop-niri.sh
new file mode 100644
index 0000000000..3a032202fe
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-desktop-niri.sh
@@ -0,0 +1,57 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# ryoku-desktop-niri: the niri compositor variant of the Ryoku desktop.
+# Carries niri, the xwayland-satellite X11 bridge, the GNOME portal backend niri's
+# caps report, the niri config tree, and the ryoku-wm-niri provider binary
+# (ryoku/wm/niri). It provides the ryoku-desktop-compositor virtual, so an
+# installed ryoku-desktop is satisfied by it, and may be installed beside
+# ryoku-desktop-hyprland: a switch is then a config change, not a package swap.
+#
+# There is no plugin subsystem here: niri has no plugins, and its caps say so.
+#
+# RPM metadata and dependencies live in ryoku-desktop-niri.spec. This sourced
+# recipe only stages the payload assembled by stage-package.sh.
+#
+# niri has no built-in Xwayland; Fedora 44's xwayland-satellite 0.8.2 regresses
+# override-redirect popups (upstream #468, fixed in add2795, no release yet).
+# The distro package is the display bridge; the popup fix is not delivered and
+# must not be claimed as ported. Screen sharing rides xdg-desktop-portal-gnome.
+# Night light rides gammastep. Both variants may be installed, so a switch is a
+# config change, not a package swap.
+startdir=${startdir:?stage-package.sh must set startdir}
+pkgdir=${pkgdir:?stage-package.sh must set pkgdir}
+_repo="$startdir/../../../.."
+
+package() {
+  local cfg="$pkgdir/usr/share/ryoku/config"
+
+  # niri config tree: config.kdl plus every static file it includes (session
+  # startup, lid events, machine seeds, and the user override). A missing include
+  # is a hard niri config error, so the whole tree ships as one unit. The
+  # generated settings.kdl/rebinds.kdl are written by `ryoku-wm-niri apply`, not
+  # packaged (see caps.GeneratedFiles). No scripts/ or share picker: niri's leaf
+  # keybinds are compositor actions or `spawn ryoku-shell`, and the share picker
+  # is a hyprland-only portal helper.
+  install -d "$cfg/niri"
+  cp -a "$_repo/ryoku/niri/." "$cfg/niri/"
+
+  # xdg-desktop-portal: niri has no backend of its own, so screen sharing rides
+  # the GNOME backend (caps.PortalBackend) but the GNOME FileChooser hangs off a
+  # GNOME session. This routing pins FileChooser to gtk so file pickers open;
+  # doctor's portal reconciler reads it by the running desktop's name.
+  install -Dm644 "$_repo/ryoku/niri/niri-portals.conf" \
+    "$cfg/xdg-desktop-portal/niri-portals.conf"
+
+  # cp -a kept source modes; the tree is all data, so world-readable is right.
+  chmod -R u=rwX,go=rX "$pkgdir/usr/share/ryoku"
+
+  # ryoku-wm-niri: the niri half of the window-manager seam. Built from the
+  # ryoku/wm module (its root is one dir up from the niri package).
+  ( cd "$_repo/ryoku/wm/niri" && go build -o ryoku-wm-niri . )
+  install -Dm755 "$_repo/ryoku/wm/niri/ryoku-wm-niri" \
+    "$pkgdir/usr/bin/ryoku-wm-niri"
+  # order the config bootstrap ahead of niri.service, so the session's first login
+  # reads a laid-down ~/.config/niri instead of the compositor's own defaults.
+  install -Dm644 "$_repo/ryoku/shell/systemd/user/niri.service.d/ryoku-bootstrap.conf" \
+    "$pkgdir/usr/lib/systemd/user/niri.service.d/ryoku-bootstrap.conf"
+}
diff --git a/fedora/packages/rpm/payload/ryoku-desktop.sh b/fedora/packages/rpm/payload/ryoku-desktop.sh
new file mode 100644
index 0000000000..2108698a87
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-desktop.sh
@@ -0,0 +1,516 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# Ryoku desktop base: the compositor-neutral components + user-facing runtime.
+# The compositor and its config ship from a sibling ryoku-desktop-<wm> variant
+# this base pulls via the ryoku-desktop-compositor virtual. Lays the base config
+# under /usr/share/ryoku/config, the helper scripts, and the GPU udev rule.
+#
+# RPM metadata and dependencies live in fedora/packages/rpm/ryoku-desktop.spec. This
+# sourced recipe only stages the payload assembled by stage-package.sh.
+pkgver=${RYOKU_PKGVER:?stage-package.sh must set RYOKU_PKGVER}
+startdir=${startdir:?stage-package.sh must set startdir}
+pkgdir=${pkgdir:?stage-package.sh must set pkgdir}
+_repo="$startdir/../../../.."
+
+package() {
+  local cfg="$pkgdir/usr/share/ryoku/config"
+
+  # /etc/ryoku-release: the named state this build is. build-repo.sh exports
+  # RYOKU_RELEASE (a release tag on stable, the dev version on testing, a
+  # local-* marker for a hand build) and RYOKU_CHANNEL; `ryoku version`,
+  # `ryoku status`, the update island and the doctor read this file, and it is
+  # pacman-owned so it always names the release actually installed.
+  install -Dm644 /dev/stdin "$pkgdir/etc/ryoku-release" <<EOF
+RELEASE=${RYOKU_RELEASE:-local-$pkgver}
+NAME=$(tr -d '[:space:]' < "$_repo/CODENAME")
+CHANNEL=${RYOKU_CHANNEL:-local}
+VERSION=$pkgver
+COMMIT=$(git -C "$_repo" rev-parse HEAD 2>/dev/null || echo unknown)
+DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+EOF
+
+  # --- base configs under /usr/share/ryoku/config, mirroring ~/.config -------
+  # `ryoku materialize` copies this tree verbatim into the user's ~/.config.
+
+  # Quickshell desktop components, Hub's config nested under hub/.
+  install -d "$cfg/quickshell"
+  cp -a "$_repo/ryoku/shell/quickshell/." "$cfg/quickshell/"
+  install -d "$cfg/quickshell/hub"
+  cp -a "$_repo/ryoku/hub/quickshell/." "$cfg/quickshell/hub/"
+
+  # First-party GUI apps: a Quickshell app (ryovm, ryostore) ships its
+  # quickshell/ tree as qs -c <name>; a compiled app has a CMakeLists.txt and
+  # builds to a /usr/bin/<name> binary (supported, none ship today). Either way
+  # its bin/ helpers, .desktop and icon are installed. Dropping in an app dir
+  # ships it; see ryoku/apps/README.md for the contract a new one has to meet.
+  local appdir appname icon gomod helperdir helper b d has_qs has_cmake
+  for appdir in "$_repo"/ryoku/apps/*/; do
+    has_qs=0; [ -d "${appdir}quickshell" ] && has_qs=1
+    has_cmake=0; [ -f "${appdir}CMakeLists.txt" ] && has_cmake=1
+    [ "$has_qs" = 1 ] || [ "$has_cmake" = 1 ] || continue
+    appname="$(basename "$appdir")"
+    if [ "$has_qs" = 1 ]; then
+      install -d "$cfg/quickshell/$appname"
+      cp -a "${appdir}quickshell/." "$cfg/quickshell/$appname/"
+    fi
+    if [ "$has_cmake" = 1 ]; then
+      # compiled Qt app: build to a binary named for the app dir.
+      cmake -S "$appdir" -B "${appdir}build" -G Ninja -DCMAKE_BUILD_TYPE=Release
+      cmake --build "${appdir}build"
+      install -Dm755 "${appdir}build/$appname" "$pkgdir/usr/bin/$appname"
+    fi
+    if [ -d "${appdir}bin" ]; then
+      for b in "${appdir}bin/"*; do
+        [ -f "$b" ] && install -Dm755 "$b" "$pkgdir/usr/bin/$(basename "$b")"
+      done
+    fi
+    # Go helper(s): a subdir with go.mod builds to a bin named for the module.
+    for gomod in "${appdir}"*/go.mod; do
+      [ -f "$gomod" ] || continue
+      helperdir="$(dirname "$gomod")"
+      helper="$(sed -n -E 's/^module[[:space:]]+//p' "$gomod" | head -1)"
+      [ -n "$helper" ] || continue
+      ( cd "$helperdir" && go build -o "$helper" . )
+      install -Dm755 "$helperdir/$helper" "$pkgdir/usr/bin/$helper"
+    done
+    for d in "${appdir}"*.desktop; do
+      [ -f "$d" ] && install -Dm644 "$d" "$pkgdir/usr/share/applications/$(basename "$d")"
+    done
+    icon="${appdir}quickshell/logo.svg"
+    [ -f "$icon" ] || icon="${appdir}logo.svg"
+    [ -f "$icon" ] || icon="$_repo/ryoku/assets/brand/logo-mark.svg"
+    install -Dm644 "$icon" "$pkgdir/usr/share/icons/hicolor/scalable/apps/$appname.svg"
+  done
+
+  # Ryoku.PluginKit: the signature QML kit a shell plugin imports for its
+  # content. pure QML, lives on the system import path next to Ryoku.Blobs so
+  # plugins (loaded from outside the shell tree) can import it.
+  install -d "$pkgdir/usr/lib/qt6/qml/Ryoku/PluginKit"
+  cp -a "$_repo/ryoku/shell/quickshell/plugins/kit/." "$pkgdir/usr/lib/qt6/qml/Ryoku/PluginKit/"
+  rm -f "$pkgdir/usr/lib/qt6/qml/Ryoku/PluginKit/install.sh"
+
+  # Ryoku.Ui: the design system the shell, the Hub and the apps all import.
+  # In /usr/lib/qt6/qml so Qt resolves it without an import path, whichever
+  # way a surface was launched.
+  install -d "$pkgdir/usr/lib/qt6/qml/Ryoku/Ui"
+  cp -a "$_repo/ryoku/ui/." "$pkgdir/usr/lib/qt6/qml/Ryoku/Ui/"
+  # install.sh is an authoring-time helper, not runtime QML, so it stays off
+  # the Qt import path. The catalog it used to carry now lives once at
+  # /usr/share/ryoku/i18n, which every runtime reads.
+  rm -f "$pkgdir/usr/lib/qt6/qml/Ryoku/Ui/install.sh"
+  rm -rf "$pkgdir/usr/lib/qt6/qml/Ryoku/Ui/__pycache__"
+  chmod -R u=rwX,go=rX "$pkgdir/usr/lib/qt6/qml/Ryoku/PluginKit"
+
+  # Ryoku.FrameBars: the shared frame-bar schema + menu/bar catalogs every
+  # config root imports (shell/services/Config.qml, the launcher, widgets, and
+  # plugin surfaces via PluginKit). Quickshell sandboxes a relative import to the
+  # running config root, so this has to be an installed module, not a copy inside
+  # one root. Omitting it loads no shell at all: qs fails the import and paints a
+  # bare Hyprland desktop. Pure QML + JS like Ryoku.Ui/PluginKit; strip the
+  # authoring-time install.sh and the JS unit test.
+  install -d "$pkgdir/usr/lib/qt6/qml/Ryoku/FrameBars"
+  cp -a "$_repo/ryoku/shell/framebars/." "$pkgdir/usr/lib/qt6/qml/Ryoku/FrameBars/"
+  rm -f "$pkgdir/usr/lib/qt6/qml/Ryoku/FrameBars/install.sh" "$pkgdir"/usr/lib/qt6/qml/Ryoku/FrameBars/*.test.mjs
+
+  # matugen templates (colors.json + kitty + Hyprland from a palette).
+  install -d "$cfg/matugen"
+  cp -a "$_repo/ryoku/shell/matugen/." "$cfg/matugen/"
+
+  # browser extension (Ryoku Theme): source plus two assembled unpacked dirs the
+  # browser loads from. Native-messaging host is `ryoku-shell browser-host`; the
+  # per-user host manifests are laid by `ryoku doctor` (reconcileBrowserTheme).
+  install -d "$pkgdir/usr/share/ryoku/browser"
+  cp -a "$_repo/ryoku/browser/." "$pkgdir/usr/share/ryoku/browser/"
+  rm -rf "$pkgdir/usr/share/ryoku/browser/dist"
+  for eng in chromium firefox; do
+    install -d "$pkgdir/usr/share/ryoku/browser/dist/$eng/src"
+    cp "$_repo"/ryoku/browser/src/* "$pkgdir/usr/share/ryoku/browser/dist/$eng/src/"
+    install -Dm644 "$_repo/ryoku/browser/manifest.$eng.json" \
+      "$pkgdir/usr/share/ryoku/browser/dist/$eng/manifest.json"
+  done
+
+  # per-app configs
+  install -Dm644 "$_repo/ryoku/apps/fish/config.fish"       "$cfg/fish/config.fish"
+  install -Dm644 "$_repo/ryoku/apps/fish/conf.d/rashin.fish" "$cfg/fish/conf.d/rashin.fish"
+  install -Dm644 "$_repo/ryoku/shell/qt6ct/qt6ct.conf"     "$cfg/qt6ct/qt6ct.conf"
+  install -Dm644 "$_repo/ryoku/apps/terminal-shell/env.sh"  "$cfg/ryoku-terminal/env.sh"
+  install -Dm644 "$_repo/ryoku/apps/bash/ryoku.bash"        "$cfg/bash/ryoku.bash"
+  install -Dm644 "$_repo/ryoku/apps/bash/rashin.bash"       "$cfg/bash/rashin.bash"
+  install -Dm644 "$_repo/ryoku/apps/zsh/ryoku.zsh"          "$cfg/zsh/ryoku.zsh"
+  install -Dm644 "$_repo/ryoku/apps/zsh/rashin.zsh"         "$cfg/zsh/rashin.zsh"
+  # GTK toolkit baseline for the xsettings-less Wayland session (see the header
+  # of each file); materialized and pruned by `ryoku materialize` like qt6ct.conf.
+  install -Dm644 "$_repo/ryoku/shell/gtk-3.0/settings.ini" "$cfg/gtk-3.0/settings.ini"
+  install -Dm644 "$_repo/ryoku/shell/gtk-4.0/settings.ini" "$cfg/gtk-4.0/settings.ini"
+  install -Dm644 "$_repo/ryoku/apps/btop/btop.conf"       "$cfg/btop/btop.conf"
+  install -Dm644 "$_repo/ryoku/apps/starship/starship.toml" "$cfg/starship.toml"
+  # session environment: Hyprland sets its own from env.lua, which never reaches
+  # niri; the user manager reads this at login, so both compositors get it.
+  install -Dm644 "$_repo/ryoku/shell/environment.d/ryoku-session.conf" \
+    "$cfg/environment.d/ryoku-session.conf"
+  install -Dm644 "$_repo/ryoku/apps/fastfetch/config.jsonc" "$cfg/fastfetch/config.jsonc"
+  # the fastfetch logo the config above draws. ships beside config.jsonc so
+  # `ryoku materialize` lays both together on every update; seeding it only as a
+  # brand asset (installer-time) left updated machines pointing at a file they
+  # never received, and fastfetch silently fell back to the Arch logo.
+  install -Dm644 "$_repo/ryoku/assets/brand/fastfetch-emblem.png" \
+    "$cfg/fastfetch/fastfetch-emblem.png"
+  # wireplumber: Bluetooth codec and profile policy, materialized like every
+  # other per-user app config so package installs and dev deploys converge.
+  install -d "$cfg/wireplumber"
+  cp -a "$_repo/ryoku/apps/wireplumber/." "$cfg/wireplumber/"
+  install -Dm644 "$_repo/ryoku/apps/yazi/yazi.toml"         "$cfg/yazi/yazi.toml"
+  install -d "$cfg/kitty"
+  cp -a "$_repo/ryoku/apps/kitty/." "$cfg/kitty/"
+  # ghostty: config is the user's (materialize seeds it once, never clobbers);
+  # matugen owns ryoku-colors, which the config includes for the palette.
+  install -d "$cfg/ghostty"
+  cp -a "$_repo/ryoku/apps/ghostty/." "$cfg/ghostty/"
+
+  # neovim (LazyVim seed): the config only, not the repo docs.
+  install -Dm644 "$_repo/ryoku/apps/nvim/init.lua"       "$cfg/nvim/init.lua"
+  install -Dm644 "$_repo/ryoku/apps/nvim/.ryoku-lazyvim" "$cfg/nvim/.ryoku-lazyvim"
+  cp -a "$_repo/ryoku/apps/nvim/lua" "$cfg/nvim/"
+
+  # pip: PEP 668 --user installs (materialized to ~/.config/pip/pip.conf).
+  install -Dm644 "$_repo/ryoku/apps/pip/pip.conf" "$cfg/pip/pip.conf"
+  # npm: default config seeded for package managers
+  install -Dm644 "$_repo/ryoku/apps/npm/npmrc" "$cfg/npm/npmrc"
+  # neovim as the default text/code editor: the handler ships system-wide and
+  # the mimeapps map is materialized, so the mapping reaches installs on update.
+  install -Dm644 "$_repo/ryoku/apps/nvim/ryoku-nvim.desktop" \
+    "$pkgdir/usr/share/applications/ryoku-nvim.desktop"
+  # Compress video / Install app: launcher-searchable tools that open a
+  # multi-file picker and run the stash compress/install helpers on the pick.
+  install -Dm644 "$_repo/ryoku/apps/tools/compress-video.desktop" \
+    "$pkgdir/usr/share/applications/compress-video.desktop"
+  install -Dm644 "$_repo/ryoku/apps/tools/install-app.desktop" \
+    "$pkgdir/usr/share/applications/install-app.desktop"
+  # Ryoku Hub: a launcher-searchable entry for the settings surface, so it shows
+  # in the app launcher alongside its Super+comma keybind.
+  install -Dm644 "$_repo/ryoku/hub/ryoku-hub.desktop" \
+    "$pkgdir/usr/share/applications/ryoku-hub.desktop"
+  install -Dm644 "$_repo/ryoku/assets/brand/logo.svg" \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/ryoku-hub.svg"
+  # Default apps: the vendor layer, NOT ~/.config/mimeapps.list. That file is
+  # where "Set as default" (GNOME, Firefox, xdg-mime) writes, and materializing
+  # over it threw a user's choices away on every update. /usr/share/applications
+  # is the lowest layer of the XDG mimeapps chain, so these defaults apply until
+  # the user picks something else, and then their pick wins for good.
+  install -Dm644 "$_repo/ryoku/apps/mimeapps.list" \
+    "$pkgdir/usr/share/applications/mimeapps.list"
+  # chromium reads ~/.config/chromium-flags.conf and Google Chrome reads
+  # ~/.config/chrome-flags.conf; lay the one source to both so each pins the GNOME
+  # keyring password store and native Wayland (screen share works, and Chrome does
+  # not sit on Xwayland where it renders pages blank on NVIDIA).
+  install -Dm644 "$_repo/ryoku/apps/chromium-flags.conf" "$cfg/chromium-flags.conf"
+  install -Dm644 "$_repo/ryoku/apps/chromium-flags.conf" "$cfg/chrome-flags.conf"
+
+  # the qylock lockscreen bundle + its installer, so doctor can install or
+  # repair the in-session lock when the existing system was not prepared
+  # before the first packaged boot.
+  mkdir -p "$pkgdir/usr/share/ryoku/lockscreen"
+  cp -a "$_repo/ryoku/lockscreen/qylock" "$pkgdir/usr/share/ryoku/lockscreen/qylock"
+  install -Dm755 "$_repo/ryoku/lockscreen/install-qylock" \
+    "$pkgdir/usr/share/ryoku/lockscreen/install-qylock"
+  install -Dm755 "$_repo/ryoku/lockscreen/ryoku-qylock-activate" \
+    "$pkgdir/usr/bin/ryoku-qylock-activate"
+  install -Dm755 "$_repo/ryoku/lockscreen/ryoku-qylock-lock" \
+    "$pkgdir/usr/bin/ryoku-qylock-lock"
+  install -Dm755 \
+    "$_repo/ryoku/lockscreen/qylock/quickshell-lockscreen/ryoku-qylock-unlock-prepare" \
+    "$pkgdir/usr/bin/ryoku-qylock-unlock-prepare"
+  # the Wayland greeter compositor wrapper: weston --shell=kiosk at each
+  # output's top mode, so the login screen matches a high-refresh session.
+  install -Dm755 "$_repo/ryoku/lockscreen/sddm/ryoku-greeter" \
+    "$pkgdir/usr/share/ryoku/lockscreen/ryoku-greeter"
+  # the Wayland session wrapper: waits for the greeter (weston) to release the
+  # GPU before the compositor probes KMS, so a hybrid-GPU laptop does not miss
+  # its iGPU and fall back to a black headless dGPU (issue #174). Wired as SDDM's
+  # [Wayland] SessionCommand by sddm/setup and doctor.
+  install -Dm755 "$_repo/ryoku/lockscreen/sddm/ryoku-wayland-session" \
+    "$pkgdir/usr/share/ryoku/lockscreen/ryoku-wayland-session"
+
+  # boot menu (fedora/bootmenu): the Ryoku GRUB theme and bootable snapshots.
+  # The snapper plugin and ryoku-snapshot-menu.path resync the "Ryoku
+  # snapshots" submenu after every snapshot; %posttrans themes GRUB and
+  # renders the snippet into grub.cfg.
+  local bm="$_repo/fedora/bootmenu"
+  install -Dm755 "$bm/grub/ryoku-grub-menu" "$pkgdir/usr/bin/ryoku-grub-menu"
+  install -Dm755 "$bm/grub/42_ryoku_snapshots" "$pkgdir/etc/grub.d/42_ryoku_snapshots"
+  install -Dm644 "$bm/grub/theme/theme.txt" "$pkgdir/usr/share/ryoku/grub/theme/theme.txt"
+  install -Dm644 "$bm/grub/theme/background.png" "$pkgdir/usr/share/ryoku/grub/theme/background.png"
+  install -Dm755 "$bm/snapper/50-ryoku-boot-menu" \
+    "$pkgdir/usr/libexec/snapper/plugins/50-ryoku-boot-menu"
+  install -Dm644 "$bm/ryoku-snapshot-menu.service" \
+    "$pkgdir/usr/lib/systemd/system/ryoku-snapshot-menu.service"
+  install -Dm644 "$bm/ryoku-snapshot-menu.path" \
+    "$pkgdir/usr/lib/systemd/system/ryoku-snapshot-menu.path"
+  install -Dm644 "$bm/ryoku-snapshot-restored.service" \
+    "$pkgdir/usr/lib/systemd/system/ryoku-snapshot-restored.service"
+  local mod
+  for mod in module-setup.sh ryoku-snapshot-restore.sh ryoku-snapshot-preview.sh; do
+    install -Dm755 "$bm/dracut/90ryoku-snapshot/$mod" \
+      "$pkgdir/usr/lib/dracut/modules.d/90ryoku-snapshot/$mod"
+  done
+
+  # user session units: the target, and the shell daemon service the autostart
+  # now starts (systemctl --user start ryoku-shell). Ship the whole dir so a
+  # unit added to the tree cannot be forgotten here again; ExecStart already
+  # points at /usr/bin, the packaged path.
+  install -dm755 "$cfg/systemd/user"
+  cp -a "$_repo/ryoku/shell/systemd/user/." "$cfg/systemd/user/"
+
+  # AI-usage collectors + their timer: refresh the ~/.cache/{claude,codex,
+  # opencode}-usage.json caches the qsbar AI pill reads. The collectors are
+  # python3 stdlib-only (python is already a hard depend, for wavecap/pactl) and
+  # each no-ops when its tool/creds/db are absent. Units live in the system user
+  # generator dir so `systemctl --global enable` (the .install) can find them;
+  # the ExecStart lines already point at /usr/bin, the packaged collector path.
+  install -Dm755 "$_repo/ryoku/shell/bin/claude-usage"   "$pkgdir/usr/bin/claude-usage"
+  install -Dm755 "$_repo/ryoku/shell/bin/codex-usage"    "$pkgdir/usr/bin/codex-usage"
+  install -Dm755 "$_repo/ryoku/shell/bin/opencode-usage" "$pkgdir/usr/bin/opencode-usage"
+  install -Dm644 "$_repo/ryoku/shell/systemd/user/ryoku-ai-usage.service" \
+    "$pkgdir/usr/lib/systemd/user/ryoku-ai-usage.service"
+  install -Dm644 "$_repo/ryoku/shell/systemd/user/ryoku-ai-usage.timer" \
+    "$pkgdir/usr/lib/systemd/user/ryoku-ai-usage.timer"
+  # the config bootstrap: a package install lays nothing into ~/.config, so the
+  # first login after it boots a bare compositor unless this runs first.
+  install -Dm644 "$_repo/ryoku/shell/systemd/user/ryoku-bootstrap.service" \
+    "$pkgdir/usr/lib/systemd/user/ryoku-bootstrap.service"
+
+  # the same file for every user, so a session that never materialized still has it
+  install -Dm644 "$_repo/ryoku/shell/environment.d/ryoku-session.conf" \
+    "$pkgdir/usr/lib/environment.d/99-ryoku-session.conf"
+  # XDG user dirs are not in the login environment. This generator resolves them
+  # through xdg-user-dir so a localized Pictures or Downloads is the one the
+  # shell uses. It has to live in the generator directory; materialize cannot
+  # deliver it.
+  install -Dm755 "$_repo/ryoku/shell/systemd/user-environment-generators/60-ryoku-xdg-dirs" \
+    "$pkgdir/usr/lib/systemd/user-environment-generators/60-ryoku-xdg-dirs"
+
+  # the decor art the Decor/Placard components render. shipped here so `ryoku
+  # doctor` can seed it into ~/Pictures/ryodecors on a user box (beside
+  # Wallpapers and livewalls) where a user can see and swap it; the installer
+  # seeds a fresh install straight from the repo. the chmod below covers it.
+  install -d "$pkgdir/usr/share/ryoku/ryodecors"
+  cp -a "$_repo/ryoku/assets/ryodecors/." "$pkgdir/usr/share/ryoku/ryodecors/"
+
+  # Wallpapers and brand assets, shipped so the offline provisioner can seed
+  # them into the user's home without needing the git checkout or network.
+  install -d "$pkgdir/usr/share/ryoku/wallpapers"
+  cp -a "$_repo/ryoku/assets/wallpapers/." "$pkgdir/usr/share/ryoku/wallpapers/"
+  install -d "$pkgdir/usr/share/ryoku/brand"
+  cp -a "$_repo/ryoku/assets/brand/." "$pkgdir/usr/share/ryoku/brand/"
+
+  # cp -a kept source mode bits; normalize so hypr/scripts stays executable
+  # and the rest is world-readable data.
+  chmod -R u=rwX,go=rX "$pkgdir/usr/share/ryoku"
+
+  # --- helper scripts on PATH (/usr/bin) ------------------------------------
+  # the hardware + container helpers the shell and autostart call by bare name.
+  local s
+  for s in "$_repo"/system/hardware/*/ryoku-*; do
+    [[ -f $s && -x $s ]] || continue
+    install -Dm755 "$s" "$pkgdir/usr/bin/${s##*/}"
+  done
+  for s in "$_repo"/system/extras/ryoku-*; do
+    install -Dm755 "$s" "$pkgdir/usr/bin/${s##*/}"
+  done
+  # container runtime helper (ryoku-docker): the privileged door the stash
+  # Cobalt setup wizard drives. Its own directory because it is not hardware.
+  for s in "$_repo"/system/containers/ryoku-*; do
+    install -Dm755 "$s" "$pkgdir/usr/bin/${s##*/}"
+  done
+  # the extras actuator (renamed from ryoku-extras-install); the ryoku-* glob
+  # above no longer matches it, so install it by name.
+  install -Dm755 "$_repo/system/extras/ryostore-install" "$pkgdir/usr/bin/ryostore-install"
+  install -Dm755 "$_repo/ryoku/apps/fastfetch/ryoku-fastfetch" \
+    "$pkgdir/usr/bin/ryoku-fastfetch"
+
+  # plugin placement helper: desktop drag + Ryoku Settings call it to persist
+  # a plugin's host/position into ~/.config/ryoku/plugins.json.
+  install -Dm755 "$_repo/ryoku/shell/quickshell/plugins/ryoku-plugins-place" \
+    "$pkgdir/usr/bin/ryoku-plugins-place"
+
+  # The translation catalog, at the one path every runtime reads: the QML
+  # singleton (ryoku/ui/Singletons/I18n.qml) and the Go runtime linked by the
+  # CLI and standalone installer (ryoku/i18n/i18n.go). langs.json rides along because it is
+  # the list the Hub's language picker draws from.
+  install -d "$pkgdir/usr/share/ryoku/i18n"
+  install -m0644 "$_repo"/ryoku/i18n/catalog/*.json "$pkgdir/usr/share/ryoku/i18n/"
+  install -m0644 "$_repo/ryoku/i18n/langs.json" "$pkgdir/usr/share/ryoku/i18n/langs.json"
+
+  # AI UI translation (Ryoku Settings > Global > Language > Generate with AI):
+  # the Hub button runs `ryoku-i18n llm <lang>` and Hyprland autostart runs
+  # `ryoku-i18n ensure`, which seeds ~/.config/ryoku/i18n-llm.json for the
+  # user's API key and machine-translates the UI to their language.
+  install -Dm755 "$_repo/ryoku/i18n/tools/sync.py" "$pkgdir/usr/bin/ryoku-i18n"
+
+  # Nautilus stash actions: a nautilus-python extension that adds the deck's
+  # install/compress/LocalSend actions to the file-manager right-click menu.
+  # Loaded for every user from the system extensions dir, so it needs no
+  # per-user materialize.
+  install -Dm644 "$_repo/ryoku/apps/nautilus/ryoku-stash-menu.py" \
+    "$pkgdir/usr/share/nautilus-python/extensions/ryoku-stash-menu.py"
+
+  # GPU primary-renderer udev rule: boot-stable /dev/dri/ryoku-gpu-* symlinks
+  # that ryoku-gpu pins via AQ_DRM_DEVICES. vendor location = active on boot,
+  # so `ryoku-gpu install-udev` is never needed on an installed system.
+  install -Dm644 "$_repo/system/hardware/gpu/90-ryoku-gpu.rules" \
+    "$pkgdir/usr/lib/udev/rules.d/90-ryoku-gpu.rules"
+
+  # Panel backlight writable by the video group without logind: ASUS AMD+NVIDIA
+  # panels expose a root:root sysfs backlight with no seat ACL, so this rule
+  # chgrp/chmods it for the video group ryoku-cmd-brightness runs as. The
+  # ryoku-hw-backlight + ryoku-hw-backlight-fix helpers ride the hardware glob.
+  install -Dm644 "$_repo/system/hardware/display/90-ryoku-backlight.rules" \
+    "$pkgdir/usr/lib/udev/rules.d/90-ryoku-backlight.rules"
+
+  # external-monitor brightness over DDC/CI (pill DISPLAY faders + the
+  # XF86MonBrightness keys via ryoku-cmd-brightness): load i2c-dev so ddcutil
+  # can open /dev/i2c-*, and grant the active-session user access (uaccess).
+  install -Dm644 "$_repo/system/hardware/ddc/ryoku-i2c.conf" \
+    "$pkgdir/etc/modules-load.d/ryoku-i2c.conf"
+  install -Dm644 "$_repo/system/hardware/ddc/60-ryoku-i2c.rules" \
+    "$pkgdir/usr/lib/udev/rules.d/60-ryoku-i2c.rules"
+
+  # Maono USB mics: their control features sit on a vendor HID page the kernel
+  # leaves root-only, so uaccess is what lets a control app reach them at all.
+  install -Dm644 "$_repo/system/hardware/audio/70-ryoku-maono.rules" \
+    "$pkgdir/usr/lib/udev/rules.d/70-ryoku-maono.rules"
+
+  # HDA codec power management off: the kernel default (power_save=10) cycles the
+  # codec + headphone amp with playback, and on many codecs the amp's noise floor
+  # is a faint whine audible only while it is powered -- the "mosquito"/tinnitus
+  # hiss on headphones. Keeping it powered removes the whine (see the conf header).
+  install -Dm644 "$_repo/system/hardware/audio/99-ryoku-audio-powersave.conf" \
+    "$pkgdir/usr/lib/modprobe.d/99-ryoku-audio-powersave.conf"
+
+  # Keyboard keycast: the shell's keypress overlay (shown while recording) reads
+  # keyboard evdev via the daemon. Grant the active-seat user a uaccess ACL on
+  # keyboards so it works without the broad input group (see the rule header).
+  install -Dm644 "$_repo/system/hardware/input/72-ryoku-keyboard-uaccess.rules" \
+    "$pkgdir/usr/lib/udev/rules.d/72-ryoku-keyboard-uaccess.rules"
+  # QMK/VIA keyboard lighting: grant the seat user a uaccess ACL on a VIA board's
+  # raw HID node so qmk_hid drives its RGB matrix without root (see rule header).
+  install -Dm644 "$_repo/system/hardware/input/62-ryoku-qmk-hid.rules" \
+    "$pkgdir/usr/lib/udev/rules.d/62-ryoku-qmk-hid.rules"
+
+  # Bluetooth tuning: bluez owns /etc/bluetooth/main.conf and BlueZ has no
+  # drop-in dir, so Ryoku cannot ship a copy here (pacman file conflict). The
+  # ryoku-bluetooth-tune helper (installed by the hardware glob above) sets the
+  # keys in place; the .install runs it on install + upgrade.
+
+  # Game controllers: load uinput at boot so Steam Input and the userspace pad
+  # drivers (xpadneo-dkms, game-devices-udev) can create their virtual gamepads.
+  # The user must also be in the `input` group (installer).
+  install -Dm644 "$_repo/system/hardware/input/99-ryoku-uinput.conf" \
+    "$pkgdir/etc/modules-load.d/99-ryoku-uinput.conf"
+
+  # Xbox pads pair over Bluetooth instead of refusing to: their L2CAP handshake
+  # does not survive the kernel's Enhanced Retransmission Mode, which reads to a
+  # user as a dead controller. modprobe.d rather than a kernel cmdline entry, so
+  # it applies on first module load and survives a kernel change.
+  install -Dm644 "$_repo/system/hardware/input/99-ryoku-controller.conf" \
+    "$pkgdir/usr/lib/modprobe.d/99-ryoku-controller.conf"
+
+  # Bluetooth audio drops seconds after connecting when btusb autosuspends the
+  # controller in an audio stream's idle gaps. Disable it in modprobe.d so it
+  # applies on first btusb load; separate module from the ERTM drop-in above.
+  install -Dm644 "$_repo/system/hardware/bluetooth/99-ryoku-bt-autosuspend.conf" \
+    "$pkgdir/usr/lib/modprobe.d/99-ryoku-bt-autosuspend.conf"
+
+  # A2DP-drop workaround (bluez#1545): a user-session unit restarts bluetooth
+  # once WirePlumber is up, clearing the BlueZ 5.83+ regression where a device
+  # disconnects ~1s after connecting; a scoped polkit rule lets it do so without
+  # a prompt. Enabled per-user by the .install (systemctl --global enable).
+  install -Dm644 "$_repo/system/hardware/bluetooth/ryoku-bluetooth-reset.service" \
+    "$pkgdir/usr/lib/systemd/user/ryoku-bluetooth-reset.service"
+  install -Dm644 "$_repo/system/hardware/bluetooth/54-ryoku-bluetooth-a2dp.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/54-ryoku-bluetooth-a2dp.rules"
+
+  # Wi-Fi regulatory domain: the same one-click grant for ryoku-wifi-regdom
+  # (installed by the hardware glob above), so the country can be pinned without a
+  # password prompt; world domain 00 disables most 5 GHz channels.
+  install -Dm644 "$_repo/system/hardware/network/48-ryoku-wifi-regdom.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/48-ryoku-wifi-regdom.rules"
+  install -Dm644 "$_repo/fedora/system/hardware/network/ryoku-wifi-regdom.service" \
+    "$pkgdir/usr/lib/systemd/system/ryoku-wifi-regdom.service"
+
+  # Game Mode wifi power-save: a polkit rule authorizes the privileged helper
+  # (ryoku-wifi-powersave, installed to /usr/bin by the hardware glob above)
+  # without a password, so the deck toggle stays one click.
+  install -Dm644 "$_repo/system/hardware/network/49-ryoku-wifi-powersave.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/49-ryoku-wifi-powersave.rules"
+
+  # Full network isolation: package the exact polkit grant plus boot units. The
+  # helper itself rides the hardware glob above; the guard restores its drop
+  # table before NetworkManager starts when the user left the switch armed.
+  install -Dm644 "$_repo/system/hardware/network/55-ryoku-network-kill.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/55-ryoku-network-kill.rules"
+  install -Dm644 "$_repo/system/hardware/network/ryoku-network-kill-guard.service" \
+    "$pkgdir/usr/lib/systemd/system/ryoku-network-kill-guard.service"
+  install -Dm644 "$_repo/system/hardware/network/ryoku-network-kill-disconnect.service" \
+    "$pkgdir/usr/lib/systemd/system/ryoku-network-kill-disconnect.service"
+
+  # DNS provider switch: the same one-click grant for ryoku-dns (installed above),
+  # so the network panel's DNS buttons apply without a password prompt.
+  install -Dm644 "$_repo/system/hardware/network/50-ryoku-dns.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/50-ryoku-dns.rules"
+
+  # Wi-Fi backend switch: the same one-click grant for ryoku-wifi-backend
+  # (installed by the hardware glob above), so Settings -> Connections can flip
+  # iwd <-> wpa_supplicant for WPA3 / Android-hotspot networks without a prompt.
+  install -Dm644 "$_repo/system/hardware/network/51-ryoku-wifi-backend.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/51-ryoku-wifi-backend.rules"
+
+  # Time zone: a polkit rule so the world-map picker in Settings > Global can
+  # apply org.freedesktop.timedate1.set-timezone for the active user without a
+  # password prompt (same one-click grant pattern as the network rules above).
+  install -Dm644 "$_repo/system/policy/52-ryoku-timedate.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/52-ryoku-timedate.rules"
+
+  # Container runtime: the same one-click grant for ryoku-docker (installed to
+  # /usr/bin by the containers glob above), so the stash Cobalt setup wizard can
+  # start docker.service and the cobalt container without a password prompt per
+  # step. The helper exposes no docker passthrough, so the grant cannot be turned
+  # into arbitrary root; see the rule's own comment.
+  install -Dm644 "$_repo/system/containers/46-ryoku-docker.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/46-ryoku-docker.rules"
+
+  # Laptop clamshell: logind provides the sessionless fallback, while
+  # ryoku-clamshell (installed to /usr/bin by the hardware glob above) holds
+  # the active session's lid inhibitor. It keeps AC-plus-external closes awake
+  # and sends every other close through the shell's secure suspend transaction.
+  # The spec's %pre/%posttrans scriptlets hold a durable sleep block while
+  # ryoku-power-cutover reloads logind and adopts every live Hyprland/niri
+  # user; the block remains if adoption fails.
+  install -Dm644 "$_repo/system/hardware/power/logind-ryoku-lid.conf" \
+    "$pkgdir/etc/systemd/logind.conf.d/10-ryoku-lid.conf"
+
+  # Battery/ASPM power knobs: a polkit rule authorizes ryoku-power (installed to
+  # /usr/bin by the hardware glob above) for the active wheel user without a
+  # password, so the charge ceiling that login autostart re-applies via `apply`
+  # never throws a prompt; its argument is a range-checked value, so the grant
+  # stays safe.
+  install -Dm644 "$_repo/system/hardware/power/47-ryoku-power.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/47-ryoku-power.rules"
+
+  # Hardware GPU MUX: the same one-click grant for ryoku-gpu-mux (installed by
+  # the hardware glob above), so the Machine page can flip the display-routing
+  # knob without a terminal. The helper accepts only hybrid|discrete and writes
+  # a constant derived from that pair, so the grant stays safe; the change only
+  # takes effect after a reboot the user performs.
+  install -Dm644 "$_repo/system/hardware/gpu/45-ryoku-gpu-mux.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/45-ryoku-gpu-mux.rules"
+
+  # Game Mode's system tuning: the same one-click grant for ryoku-game-tune
+  # (installed by the hardware glob above), so the panel toggle applies the deep
+  # idle, watchdog, lock-mitigation and VM knobs without a prompt. Its argument
+  # set is three fixed verbs and every value written is a constant in the helper,
+  # so the grant stays safe.
+  install -Dm644 "$_repo/system/hardware/power/53-ryoku-game-tune.rules" \
+    "$pkgdir/usr/share/polkit-1/rules.d/53-ryoku-game-tune.rules"
+
+}
diff --git a/fedora/packages/rpm/payload/ryoku-hub.sh b/fedora/packages/rpm/payload/ryoku-hub.sh
new file mode 100644
index 0000000000..90b73c4025
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-hub.sh
@@ -0,0 +1,30 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# Ryoku Hub backend (Go). A standalone helper the Hub's Quickshell config shells
+# out to for the keybind legend and the Hub's TOML config. It parses config
+# files and prints results, so it has no runtime dependencies of its own.
+#
+# Built from the in-repo source at ryoku/hub/backend; no tarball is fetched.
+# go build reads the committed vendor/ tree (-mod=vendor), so the signed-repo CI
+# builds with no network regardless of whatever GOFLAGS makepkg picked up.
+pkgname=ryoku-hub
+pkgver=${RYOKU_PKGVER:-0.1.0}
+pkgrel=1
+pkgdesc="Ryoku Hub backend: keybind legend and config service"
+arch=('x86_64')
+url="https://ryoku.dev"
+license=('GPL-3.0-or-later')
+depends=()
+makedepends=('go')
+source=()
+
+_repo="$startdir/../../../.."
+
+build() {
+  cd "$_repo/ryoku/hub/backend"
+  CGO_ENABLED=0 go build -trimpath -mod=vendor -o "$srcdir/ryoku-hub" .
+}
+
+package() {
+  install -Dm755 "$srcdir/ryoku-hub" "$pkgdir/usr/bin/ryoku-hub"
+}
diff --git a/fedora/packages/rpm/payload/ryoku-palette-bridge.sh b/fedora/packages/rpm/payload/ryoku-palette-bridge.sh
new file mode 100644
index 0000000000..c8631dbb4b
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-palette-bridge.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+startdir=${startdir:?stage-package.sh must set startdir}
+srcdir=${srcdir:?stage-package.sh must set srcdir}
+pkgdir=${pkgdir:?stage-package.sh must set pkgdir}
+_repo="$startdir/../../../.."
+
+build() {
+  ( cd "$_repo/ryoku/palette-bridge" && go build -o "$srcdir/ryoku-palette-bridge" . )
+}
+
+package() {
+  install -Dm755 "$srcdir/ryoku-palette-bridge" "$pkgdir/usr/bin/ryoku-palette-bridge"
+  install -Dm755 "$_repo/ryoku/palette-bridge/doctor.sh" \
+    "$pkgdir/usr/bin/ryoku-palette-bridge-doctor"
+  install -Dm755 "$_repo/ryoku/palette-bridge/remove-integrations.sh" \
+    "$pkgdir/usr/bin/ryoku-palette-bridge-remove-integrations"
+  install -Dm644 "$_repo/ryoku/palette-bridge/packaging/systemd/ryoku-palette-bridge.service" \
+    "$pkgdir/usr/lib/systemd/user/ryoku-palette-bridge.service"
+  install -d "$pkgdir/usr/share/ryoku/palette-bridge"
+  cp -a "$_repo/ryoku/palette-bridge/." "$pkgdir/usr/share/ryoku/palette-bridge/"
+}
diff --git a/fedora/packages/rpm/payload/ryoku-rashin.sh b/fedora/packages/rpm/payload/ryoku-rashin.sh
new file mode 100644
index 0000000000..c7408e603d
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-rashin.sh
@@ -0,0 +1,44 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# Ryoku Rashin backend (Go). The optional local agent OS daemon: it maintains a
+# markdown knowledge vault, serves the embedded web dashboard on 127.0.0.1, and
+# bridges the Hermes agent over ACP. Ships with the desktop but stays inert until
+# the user enables it (optional means not running, not absent).
+#
+# Built from the in-repo source at ryoku/rashin/backend. go build reads the
+# committed vendor/ tree (-mod=vendor), so the signed-repo CI builds offline.
+# RPM metadata lives in ryoku-rashin.spec. Hermes itself is per-user opt-in;
+# its prerequisites (uv, gcc, nodejs) and prowl-agent are Requires there so a
+# setup never bootstraps a toolchain over the network.
+startdir=${startdir:?stage-package.sh must set startdir}
+srcdir=${srcdir:?stage-package.sh must set srcdir}
+pkgdir=${pkgdir:?stage-package.sh must set pkgdir}
+_repo="$startdir/../../../.."
+
+build() {
+  cd "$_repo/ryoku/rashin/backend" || exit
+  CGO_ENABLED=0 go build -trimpath -mod=vendor -o "$srcdir/ryoku-rashin" .
+  # Pre-index the monorepo: the installed target has no checkout, so the
+  # vault's ryoku-repo.md ships as a snapshot generated from this exact tree.
+  "$srcdir/ryoku-rashin" repo-index "$_repo" "$srcdir/ryoku-repo.md"
+}
+
+package() {
+  install -Dm755 "$srcdir/ryoku-rashin" "$pkgdir/usr/bin/ryoku-rashin"
+  # `rashin` is the terminal-lane command: the same binary under a second
+  # name (busybox pattern); argv0 routes a bare argument to the terminal ask.
+  ln -s ryoku-rashin "$pkgdir/usr/bin/rashin"
+  install -Dm644 "$srcdir/ryoku-repo.md" "$pkgdir/usr/share/ryoku/rashin/ryoku-repo.md"
+  # The `ryoku` agent skill: the source map, safety rules, the GUI map, and the
+  # bar and plugin guides. `ryoku-rashin wire` symlinks this dir into every
+  # agent's skills directory; the doctor's rashin reconciler re-wires it on update.
+  for f in SKILL.md gui.md bar.md plugins.md; do
+    install -Dm644 "$_repo/ryoku/rashin/skills/ryoku/$f" \
+      "$pkgdir/usr/share/ryoku/skills/ryoku/$f"
+  done
+  # Systemd user unit: `ryoku-rashin enable` runs `systemctl --user enable
+  # --now` on it; the daemon then starts at every login (or at boot with
+  # lingering) instead of riding the Hyprland session.
+  install -Dm644 "$_repo/ryoku/rashin/systemd/ryoku-rashin.service" \
+    "$pkgdir/usr/lib/systemd/user/ryoku-rashin.service"
+}
diff --git a/fedora/packages/rpm/payload/ryoku-shell.sh b/fedora/packages/rpm/payload/ryoku-shell.sh
new file mode 100644
index 0000000000..afe5cecb2f
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku-shell.sh
@@ -0,0 +1,56 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# Ryoku shell IPC daemon (Go). supervises the Quickshell desktop components,
+# drives wallpaper + palette, serves the ryoku-shell control socket.
+#
+# Built from the in-repo source at ryoku/shell/ipc. stage-package.sh sets the
+# directories below and the binary lands in $srcdir, so the source tree stays
+# untouched. uv is a runtime dependency: it provisions the ryostage engine's
+# Python 3.13 venv, because the system python rolls ahead of onnxruntime's wheels.
+# RPM metadata lives in ryoku-shell.spec.
+startdir=${startdir:?stage-package.sh must set startdir}
+srcdir=${srcdir:?stage-package.sh must set srcdir}
+pkgdir=${pkgdir:?stage-package.sh must set pkgdir}
+_repo="$startdir/../../../.."
+
+build() {
+  cd "$_repo/ryoku/shell/ipc" || exit
+  # -mod=vendor keeps the build hermetic. godbus is vendored, so the signed-repo
+  # CI builds offline regardless of whatever GOFLAGS makepkg picked up.
+  CGO_ENABLED=0 go build -trimpath -mod=vendor -o "$srcdir/ryoku-shell" .
+  # ryoku-livewall: the C video-wallpaper daemon the shell drives. It software-
+  # decodes a downscaled clip into wl_shm on a wlr background surface (no GL, so
+  # ~40 MB RSS on any GPU vs mpv/mpvpaper's 300-700 MB). build.sh generates the
+  # wayland protocol glue and compiles it.
+  "$_repo/ryoku/shell/livewall/build.sh" "$srcdir/ryoku-livewall"
+}
+
+package() {
+  install -Dm755 "$_repo/fedora/system/extras/ryoku-install-extra" "$pkgdir/usr/bin/ryoku-install-extra"
+  install -Dm755 "$srcdir/ryoku-shell" "$pkgdir/usr/bin/ryoku-shell"
+  install -Dm755 "$srcdir/ryoku-livewall" "$pkgdir/usr/bin/ryoku-livewall"
+  # Every shell leaf script the bar, launcher, Hub, keybinds, recorder and the
+  # daemon call by bare name (ryoku-app, ryoku-cmd-*, ryoku-sysinfo, the recorder
+  # helpers, ...). They resolve on PATH with no compositor config tree, so a niri
+  # box that ships no compositor scripts still gets every one of them. A single
+  # glob, so a new script lands here with no packaging edit.
+  local s
+  for s in "$_repo"/ryoku/shell/scripts/ryoku-*; do
+    [[ -f $s ]] || continue
+    install -Dm755 "$s" "$pkgdir/usr/bin/${s##*/}"
+  done
+  # ryostage: the wallpaper engine's launcher. Not a ryoku-* name, so it installs
+  # beside the glob.
+  install -Dm755 "$_repo/ryoku/shell/scripts/ryostage" \
+    "$pkgdir/usr/bin/ryostage"
+  # The .sh helpers the shell drives by bare name: the Stash sidebar's cobalt
+  # queue and its compress/install/download backends, the LocalSend LAN transfer,
+  # the clipboard-thumbnail generator. Shell scripts, not compositor config, so
+  # they ride the shell to PATH and resolve with no compositor config tree.
+  for s in "$_repo"/ryoku/shell/scripts/*.sh; do
+    [[ -f $s ]] || continue
+    install -Dm755 "$s" "$pkgdir/usr/bin/${s##*/}"
+  done
+  install -d "$pkgdir/usr/share/ryoku/reload-cover"
+  cp -a "$_repo/ryoku/shell/quickshell/reload-cover/." "$pkgdir/usr/share/ryoku/reload-cover/"
+}
diff --git a/fedora/packages/rpm/payload/ryoku.sh b/fedora/packages/rpm/payload/ryoku.sh
new file mode 100644
index 0000000000..43763e3adc
--- /dev/null
+++ b/fedora/packages/rpm/payload/ryoku.sh
@@ -0,0 +1,31 @@
+# Maintainer: Ryoku <releases@ryoku.dev>
+#
+# Ryoku control CLI (Go): the single front door to update, rollback, snapshot,
+# and the config materialize step.
+#
+# RPM metadata and dependencies live in fedora/packages/rpm/ryoku.spec. This sourced
+# recipe only builds from ryoku/cli and stages the payload for stage-package.sh.
+# The keyring subcommand's godbus is vendored, so the signed-repo CI builds
+# offline.
+startdir=${startdir:?stage-package.sh must set startdir}
+srcdir=${srcdir:?stage-package.sh must set srcdir}
+pkgdir=${pkgdir:?stage-package.sh must set pkgdir}
+_repo="$startdir/../../../.."
+
+build() {
+  cd "$_repo/ryoku/cli" || return
+  CGO_ENABLED=0 go build -trimpath -mod=vendor -o "$srcdir/ryoku" .
+}
+
+package() {
+  install -Dm755 "$srcdir/ryoku" "$pkgdir/usr/bin/ryoku"
+  # the boot guard: a system unit `ryoku boot-guard` runs from early in every
+  # boot (enabled by the doctor on every update, so existing boxes get it),
+  # and the tmpfiles entries for its marker and the sessions' boot-ok files.
+  install -Dm644 "$_repo/ryoku/cli/systemd/ryoku-boot-guard.service" \
+    "$pkgdir/usr/lib/systemd/system/ryoku-boot-guard.service"
+  install -Dm644 "$_repo/ryoku/cli/systemd/ryoku.tmpfiles.conf" \
+    "$pkgdir/usr/lib/tmpfiles.d/ryoku.conf"
+  install -Dm644 "$_repo/fedora/packages/rpm/payload/fedora.tsv" \
+    "$pkgdir/usr/share/ryoku/packages/fedora.tsv"
+}
diff --git a/fedora/packages/rpm/prepare-srpms.sh b/fedora/packages/rpm/prepare-srpms.sh
new file mode 100755
index 0000000000..4fb8eff95b
--- /dev/null
+++ b/fedora/packages/rpm/prepare-srpms.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root=$(cd "$(dirname "$0")/../../.." && pwd)
+out=$(realpath -m "${RYOKU_SRPM_OUT:-$root/fedora/packages/rpm/srpms}")
+channel=${RYOKU_CHANNEL:-testing}
+die() { echo "prepare-srpms: $*" >&2; exit 1; }
+for tool in rpmbuild python3 tar gzip go git patch; do command -v "$tool" >/dev/null || die "missing $tool"; done
+git config --global --add safe.directory "$root" 2>/dev/null || true
+git config --global --add safe.directory '*' 2>/dev/null || true
+[[ ${RYOKU_RPM_REVISION:-1} =~ ^[1-9][0-9]*$ ]] || die 'RPM revision must be a positive integer'
+if [[ ${RYOKU_RPM_LOCAL:-0} != 1 ]]; then
+  [[ -z $(git -C "$root" status --porcelain) ]] || die 'release sources require a clean checkout; use RYOKU_RPM_LOCAL=1 for local tests'
+fi
+[[ $(git -C "$root" rev-parse --is-shallow-repository) == false ]] || die 'fetch full history for monotonic versions'
+version="0.$(git -C "$root" rev-list --count HEAD)"
+commit=$(git -C "$root" rev-parse HEAD)
+SOURCE_DATE_EPOCH=$(git -C "$root" show -s --format=%ct HEAD)
+export SOURCE_DATE_EPOCH
+[[ ! -e $out ]] || die "output already exists: $out"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+mkdir -p "$work/SOURCES" "$work/SPECS" "$work/tree/ryoku-$version" "$out"
+# Include current edits for local builds, while excluding ignored build products.
+python3 - "$root" "$work/tree/ryoku-$version" <<'PY'
+import os, pathlib, shutil, subprocess, sys
+root, dest = map(pathlib.Path, sys.argv[1:])
+paths = subprocess.check_output(['git', '-C', str(root), 'ls-files', '-z', '--cached', '--others', '--exclude-standard']).split(b'\0')
+for raw in set(paths):
+    if not raw: continue
+    rel = pathlib.Path(os.fsdecode(raw))
+    src, dst = root / rel, dest / rel
+    if not src.exists() and not src.is_symlink(): continue
+    dst.parent.mkdir(parents=True, exist_ok=True)
+    if src.is_symlink(): dst.symlink_to(os.readlink(src))
+    elif src.is_file(): shutil.copy2(src, dst)
+PY
+# Apply Fedora's host package-manager port only inside the RPM source tree.
+patch --directory="$work/tree/ryoku-$version" --strip=1 --input="$root/fedora/packages/rpm/patches/0001-host-dnf-support.patch"
+# Resolve pinned Go dependencies into the source payload. RPM builds then run
+# offline, including modules whose development checkout has no vendor tree.
+while IFS= read -r -d '' gomod; do
+  (cd "${gomod%/go.mod}" && GOTOOLCHAIN=local go mod vendor)
+done < <(find "$work/tree/ryoku-$version/ryoku" -name vendor -prune -o -name go.mod -print0)
+python3 - "$work/tree/ryoku-$version" <<'PYEXTRAS'
+import importlib.machinery, pathlib, sys
+root = pathlib.Path(sys.argv[1])
+extra = importlib.machinery.SourceFileLoader('extra', str(root / 'fedora/system/extras/ryoku-install-extra')).load_module()
+cache = root / '.rpm-extras'
+cache.mkdir()
+for version, url, digest, relative in extra.RELEASES.values():
+    (cache / digest).write_bytes(extra.download(url, digest))
+PYEXTRAS
+release=${RYOKU_RELEASE:-$(git -C "$root" describe --tags --match 'v[0-9]*' HEAD 2>/dev/null || echo "local-$version")}
+cat > "$work/tree/ryoku-$version/.rpm-release" <<META
+RELEASE=$release
+NAME=$(cat "$root/CODENAME")
+CHANNEL=$channel
+VERSION=$version
+COMMIT=$commit
+DATE=$(date -u -d "@$SOURCE_DATE_EPOCH" +%Y-%m-%dT%H:%M:%SZ)
+META
+packages=()
+for spec in "$root"/fedora/packages/rpm/*.spec; do packages+=("$(basename "$spec" .spec)"); done
+while read -r path owners; do
+  [[ -z $path || $path == \#* ]] && continue
+  for owner in $owners; do
+    [[ $owner == - || " ${packages[*]} " == *" $owner "* ]] || die "source-owners names no spec: $owner"
+  done
+done < "$root/fedora/packages/rpm/source-owners"
+# Each SRPM carries the tree without the heavy paths only other packages stage,
+# so the build artifacts do not move the wallpapers twelve times.
+source_tarball() {
+  local package=$1 path owners excludes=()
+  while read -r path owners; do
+    [[ -z $path || $path == \#* ]] && continue
+    [[ " $owners " == *" $package "* ]] || excludes+=("--exclude=ryoku-$version/$path")
+  done < "$root/fedora/packages/rpm/source-owners"
+  mkdir -p "$work/SOURCES/$package"
+  tar --anchored "${excludes[@]}" --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --numeric-owner \
+    -C "$work/tree" -cf - "ryoku-$version" | gzip -n > "$work/SOURCES/$package/ryoku-$version.tar.gz"
+}
+for package in "${packages[@]}"; do
+  source_tarball "$package"
+  target="$work/SPECS/$package.spec"
+  sed -e "s/^Version:.*/Version:        $version/" -e "s/^Release:.*/Release:        ${RYOKU_RPM_REVISION:-1}%{?dist}/" \
+    "$root/fedora/packages/rpm/$package.spec" > "$target"
+  rpmbuild --define "_topdir $work" --define "_sourcedir $work/SOURCES/$package" --define "_srcrpmdir $out" -bs "$target"
+done
+python3 - "$out" "$release" "$channel" "$version" "$commit" "$SOURCE_DATE_EPOCH" "$(cat "$root/CODENAME")" <<'PYMETA'
+import datetime, hashlib, json, os, pathlib, sys
+out = pathlib.Path(sys.argv[1])
+data = dict(zip(('release', 'channel', 'version', 'commit'), sys.argv[2:6]))
+data['date'] = datetime.datetime.fromtimestamp(int(sys.argv[6]), datetime.timezone.utc).isoformat()
+data['name'] = sys.argv[7]
+data['sequence'] = int(os.environ.get('GITHUB_RUN_NUMBER', '0'))
+data['sources'] = {p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in sorted(out.glob('*.src.rpm'))}
+(out / 'release.json').write_text(json.dumps(data, indent=2) + '\n')
+PYMETA
diff --git a/fedora/packages/rpm/rebuild-srpms.sh b/fedora/packages/rpm/rebuild-srpms.sh
new file mode 100755
index 0000000000..0bb1a65436
--- /dev/null
+++ b/fedora/packages/rpm/rebuild-srpms.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+sources=${1:?SRPM directory}
+out=${2:?new output directory}
+chroot=${RYOKU_FEDORA_MOCK_ROOT:-fedora-44-x86_64}
+[[ ! -e $out ]] || { echo "output already exists: $out" >&2; exit 1; }
+mkdir -p "$out/RPMS" "$out/logs"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+shopt -s nullglob
+sources=("$sources"/*.src.rpm)
+((${#sources[@]})) || { echo 'no SRPMs to rebuild' >&2; exit 1; }
+for srpm in "${sources[@]}"; do
+  name=$(basename "$srpm" .src.rpm)
+  result="$work/$name"
+  status=0
+  mock --root "$chroot" --isolation=simple --resultdir "$result" --rebuild "$srpm" || status=$?
+  mkdir -p "$out/logs/$name"
+  for logfile in "$result"/*.log; do cp "$logfile" "$out/logs/$name/"; done
+  ((status == 0)) || exit "$status"
+  for rpmfile in "$result"/*.rpm; do
+    [[ $rpmfile != *.src.rpm ]] || continue
+    cp "$rpmfile" "$out/RPMS/"
+  done
+  rm -rf "$result"
+done
diff --git a/fedora/packages/rpm/ryogami.spec b/fedora/packages/rpm/ryogami.spec
new file mode 100644
index 0000000000..bf7976d343
--- /dev/null
+++ b/fedora/packages/rpm/ryogami.spec
@@ -0,0 +1,45 @@
+Name:           ryogami
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryogami desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  cmake
+BuildRequires:  ninja-build
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+BuildRequires:  gcc
+BuildRequires:  pkgconf-pkg-config
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qtbase-private-devel
+BuildRequires:  qt6-qtdeclarative-devel
+BuildRequires:  qt6-qtshadertools-devel
+BuildRequires:  qt6-qtmultimedia-devel
+BuildRequires:  wayland-devel
+BuildRequires:  wayland-protocols-devel
+BuildRequires:  ffmpeg-free-devel
+Requires:       quickshell
+Requires:       ffmpeg-free
+Requires:       ImageMagick
+Requires:       curl
+Requires:       inotify-tools
+
+%description
+ryogami, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku-blobs.spec b/fedora/packages/rpm/ryoku-blobs.spec
new file mode 100644
index 0000000000..ed7e15bf04
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-blobs.spec
@@ -0,0 +1,37 @@
+Name:           ryoku-blobs
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku-blobs desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  cmake
+BuildRequires:  ninja-build
+BuildRequires:  gcc-c++
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qtdeclarative-devel
+BuildRequires:  qt6-qtmultimedia-devel
+BuildRequires:  qt6-qtshadertools-devel
+Requires:       qt6-qtbase
+Requires:       qt6-qtdeclarative
+Requires:       qt6-qtmultimedia
+
+%description
+ryoku-blobs, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku-desktop-hyprland.spec b/fedora/packages/rpm/ryoku-desktop-hyprland.spec
new file mode 100644
index 0000000000..6537be517f
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-desktop-hyprland.spec
@@ -0,0 +1,34 @@
+Name:           ryoku-desktop-hyprland
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku-desktop-hyprland desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+Requires:       ryoku-desktop = %{version}-%{release}
+Requires:       hyprland
+Requires:       hyprpolkitagent
+Requires:       xdg-desktop-portal-hyprland
+Requires:       hyprpicker
+Provides:       ryoku-desktop-compositor
+
+%description
+ryoku-desktop-hyprland, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku-desktop-niri.spec b/fedora/packages/rpm/ryoku-desktop-niri.spec
new file mode 100644
index 0000000000..0f9e93e375
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-desktop-niri.spec
@@ -0,0 +1,34 @@
+Name:           ryoku-desktop-niri
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku-desktop-niri desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+Requires:       ryoku-desktop = %{version}-%{release}
+Requires:       niri
+Requires:       xwayland-satellite
+Requires:       xdg-desktop-portal-gnome
+Requires:       gammastep
+Provides:       ryoku-desktop-compositor
+
+%description
+ryoku-desktop-niri, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku-desktop.spec b/fedora/packages/rpm/ryoku-desktop.spec
new file mode 100644
index 0000000000..f5b6336329
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-desktop.spec
@@ -0,0 +1,205 @@
+Name:           ryoku-desktop
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku-desktop desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  gtk3-devel
+BuildRequires:  webkit2gtk4.1-devel
+BuildRequires:  golang >= 1.26.4
+BuildRequires:  cmake
+BuildRequires:  ninja-build
+BuildRequires:  gcc-c++
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qtdeclarative-devel
+Requires:       ryoku = %{version}-%{release}
+Requires:       ryoku-shell = %{version}-%{release}
+Requires:       ryogami = %{version}-%{release}
+Requires:       ryoku-hub = %{version}-%{release}
+Requires:       ryoku-rashin = %{version}-%{release}
+Requires:       ryoku-blobs = %{version}-%{release}
+Requires:       ryoku-palette-bridge = %{version}-%{release}
+Requires:       ryoku-extras = %{version}-%{release}
+Requires:       sddm-theme-ryoku = %{version}-%{release}
+Requires:       ryoku-desktop-compositor
+Requires:       quickshell
+Requires:       sddm
+Requires:       weston
+Requires:       kitty
+Requires:       fish
+Requires:       starship
+Requires:       fastfetch
+Requires:       adw-gtk3-theme
+Requires:       papirus-icon-theme
+Requires:       gnome-keyring
+Requires:       gnome-keyring-pam
+Requires:       libsecret
+Requires:       polkit
+Requires:       xdg-desktop-portal
+Requires:       xdg-desktop-portal-gtk
+Requires:       xdg-user-dirs
+Requires:       qt6-qtwayland
+Requires:       qt5-qtwayland
+Requires:       qt6-qt5compat
+Requires:       qt6-qtsvg
+Requires:       qt6-qtimageformats
+Requires:       qt6-qtmultimedia
+Requires:       kf6-syntax-highlighting
+Requires:       pipewire
+Requires:       pipewire-pulseaudio
+Requires:       NetworkManager
+Requires:       NetworkManager-wifi
+Requires:       pciutils
+Requires:       usbutils
+Requires:       kmod
+Requires:       dracut
+Requires:       grubby
+Requires:       grub2-tools
+Requires:       btrfs-progs
+Requires:       snapper
+Requires:       wireless-regdb
+Requires:       wireplumber
+Requires:       brightnessctl
+Requires:       playerctl
+Requires:       wl-clipboard
+Requires:       cliphist
+Requires:       grim
+Requires:       slurp
+Requires:       cava
+Requires:       jq
+Requires:       hypridle
+Requires:       dbus-tools
+Requires:       dnf
+Requires:       rpm
+Requires:       sudo
+Requires:       ImageMagick
+Requires:       curl
+Requires:       python3
+Requires:       rsms-inter-fonts
+Requires:       google-noto-sans-fonts
+Requires:       google-noto-sans-cjk-fonts
+Requires:       google-noto-emoji-fonts
+Requires:       jetbrains-mono-fonts
+Provides:       ryostore
+Provides:       ryovm
+Provides:       ryoku-ui = %{version}-%{release}
+Obsoletes:      ryostore < 0.2
+Obsoletes:      ryovm < 0.2
+Obsoletes:      ryoku-ui < 0.2
+
+Requires:       qt6ct
+Requires:       zsh
+Requires:       zsh-autosuggestions
+Requires:       zsh-syntax-highlighting
+Requires:       mpv
+Requires:       mpv-mpris
+Requires:       yt-dlp
+Requires:       pulseaudio-utils
+Requires:       pamixer
+Requires:       zenity
+Requires:       iw
+Requires:       nftables
+Requires:       bluez
+Requires:       pam-u2f
+Requires:       rtkit
+Requires:       tesseract
+Requires:       tesseract-langpack-eng
+Requires:       zbar
+Requires:       wf-recorder
+Requires:       hyprsunset
+Requires:       wtype
+Requires:       libqalculate
+Requires:       upower
+Requires:       power-profiles-daemon
+Requires:       ddcutil
+Requires:       uv
+Recommends:     quickemu
+Recommends:     spice-gtk-tools
+
+%description
+ryoku-desktop, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} \( -type f -o -type l \) -print0 | python3 -c 'import os,sys; root=os.fsencode(sys.argv[1]); [print("\"" + os.fsdecode(p[len(root):]).replace("\\", "\\\\").replace("\"", "\\\"") + "\"") for p in sys.stdin.buffer.read().split(bytes([0])) if p]' %{buildroot} > rpm-files
+
+%pre
+# Block sleep before the old lid, idle and shell owners are replaced. An
+# upgrade runs the installed helper, which also records the live sessions; the
+# first release that ships it holds the same durable guard directly.
+[ -d "${RYOKU_SYSTEMD_RUNTIME_DIR:-/run/systemd/system}" ] || exit 0
+systemd-detect-virt --quiet --chroot && exit 0
+helper="${RYOKU_POWER_CUTOVER_HELPER:-/usr/bin/ryoku-power-cutover}"
+[ -x "$helper" ] && exec "$helper" prepare-package
+systemctl is-active --quiet ryoku-power-cutover-guard.service && exit 0
+systemctl reset-failed ryoku-power-cutover-guard.service >/dev/null 2>&1 || :
+systemd-run --quiet --collect --unit=ryoku-power-cutover-guard.service \
+  --property=Type=exec --property=TimeoutStopSec=5s \
+  /usr/bin/systemd-inhibit --what=sleep --mode=block \
+  --who=ryoku-package-cutover \
+  --why="keep sessions awake while packaged suspend owners are replaced" \
+  /usr/bin/sleep infinity
+
+%post
+systemctl --global enable ryoku-bootstrap.service ryoku-bluetooth-reset.service >/dev/null 2>&1 || :
+systemctl daemon-reload >/dev/null 2>&1 || :
+systemctl enable ryoku-wifi-regdom.service >/dev/null 2>&1 || :
+/usr/bin/ryoku-bluetooth-tune >/dev/null 2>&1 || :
+# boot_success is set by the shell once the desktop proves itself, so a boot
+# that never gets there shows the GRUB menu; Fedora's timer would set it for
+# any login.
+systemctl --global disable grub-boot-success.timer >/dev/null 2>&1 || :
+systemctl enable ryoku-snapshot-restored.service ryoku-snapshot-menu.path >/dev/null 2>&1 || :
+
+%posttrans
+# Theme GRUB and render the snapshot submenu's snippet into grub.cfg (the
+# installer does this itself, after Anaconda writes the bootloader config).
+# On a running system, list the snapshots already on disk in the background,
+# since a kernel image is built per kernel version they need.
+/usr/bin/ryoku-grub-menu install >/dev/null 2>&1 || :
+# Adopt the new sleep and lid policy in every live Hyprland or niri session,
+# then release the guard %pre took. A failure keeps sleep blocked until
+# `ryoku update` retries or the box reboots.
+[ -d /run/systemd/system ] || exit 0
+systemd-detect-virt --quiet --chroot && exit 0
+systemctl start --no-block ryoku-snapshot-menu.path ryoku-snapshot-menu.service >/dev/null 2>&1 || :
+[ -x /usr/bin/ryoku-power-cutover ] || exit 0
+/usr/bin/ryoku-power-cutover package
+
+%preun
+# Removal: hand the boot flag back to Fedora's timer, drop the console
+# entries while their plugin is still on disk and the GRUB theme and snapshot
+# menu while their helper is, then keep a copy of the
+# executor in /run so %postun can still hand the live sessions back to
+# logind's default policy.
+[ "$1" -eq 0 ] || exit 0
+systemctl --global enable grub-boot-success.timer >/dev/null 2>&1 || :
+/usr/lib/kernel/install.d/95-ryoku-console.install purge >/dev/null 2>&1 || :
+systemctl disable ryoku-snapshot-restored.service ryoku-snapshot-menu.path >/dev/null 2>&1 || :
+/usr/bin/ryoku-grub-menu purge >/dev/null 2>&1 || :
+[ -d /run/systemd/system ] || exit 0
+systemd-detect-virt --quiet --chroot && exit 0
+systemctl stop ryoku-snapshot-menu.path >/dev/null 2>&1 || :
+[ -x /usr/bin/ryoku-power-cutover ] || exit 0
+/usr/bin/ryoku-power-cutover prepare-package
+
+%postun
+[ "$1" -eq 0 ] || exit 0
+# the theme and the snapshot snippet are gone; drop them from grub.cfg too.
+grub2-mkconfig -o /boot/grub2/grub.cfg >/dev/null 2>&1 || :
+[ -x /run/ryoku-power-cutover ] || exit 0
+/run/ryoku-power-cutover package
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku-extras.spec b/fedora/packages/rpm/ryoku-extras.spec
new file mode 100644
index 0000000000..d99eb82c1f
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-extras.spec
@@ -0,0 +1,42 @@
+Name:           ryoku-extras
+Version:        0.1
+Release:        1%{?dist}
+Summary:        Verified desktop tools, fonts and cursor assets
+License:        GPL-3.0-or-later AND OFL-1.1 AND BSD-3-Clause
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+BuildRequires:  python3
+%global debug_package %{nil}
+
+%description
+Pinned and checksum-verified desktop extras, included in the source payload.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_EXTRA_CACHE="$PWD/.rpm-extras"
+python3 - <<'PY'
+import importlib.machinery
+from pathlib import Path
+extra = importlib.machinery.SourceFileLoader('extra', 'fedora/system/extras/ryoku-install-extra').load_module()
+# The buildroot has no font cache consumers; RPM's font trigger updates it.
+extra.shutil.which = lambda name: None
+for name in extra.RELEASES:
+    extra.install(name, Path('stage/usr'))
+PY
+mkdir -p stage/usr/share/ryoku
+mv stage/usr/state/ryoku/extras stage/usr/share/ryoku/extras
+rm -r stage/usr/state
+
+%install
+cp -a stage/. %{buildroot}/
+
+%files
+%{_bindir}/prowl-agent
+%{_bindir}/matugen
+%{_bindir}/qmk_hid
+%{_datadir}/fonts/*
+%{_datadir}/icons/Bibata-*
+%{_datadir}/ryoku/extras
+%license %{_datadir}/licenses/Bibata/LICENSE
diff --git a/fedora/packages/rpm/ryoku-hub.spec b/fedora/packages/rpm/ryoku-hub.spec
new file mode 100644
index 0000000000..bcadf5d1af
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-hub.spec
@@ -0,0 +1,29 @@
+Name:           ryoku-hub
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku-hub desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+Requires:       quickshell
+
+%description
+ryoku-hub, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku-palette-bridge.spec b/fedora/packages/rpm/ryoku-palette-bridge.spec
new file mode 100644
index 0000000000..1df891407b
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-palette-bridge.spec
@@ -0,0 +1,32 @@
+Name:           ryoku-palette-bridge
+Version:        0.1
+Release:        1%{?dist}
+Summary:        Ryoku wallpaper palette event bridge
+License:        MIT
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+Requires:       curl
+Requires:       jq
+Requires:       systemd
+
+%description
+ryoku-palette-bridge, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
+%license %{_datadir}/ryoku/palette-bridge/LICENSE
diff --git a/fedora/packages/rpm/ryoku-rashin.spec b/fedora/packages/rpm/ryoku-rashin.spec
new file mode 100644
index 0000000000..8e52eab151
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-rashin.spec
@@ -0,0 +1,32 @@
+Name:           ryoku-rashin
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku-rashin desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+Requires:       uv
+Requires:       python3
+Requires:       nodejs
+Requires:       gcc
+
+%description
+ryoku-rashin, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku-shell.spec b/fedora/packages/rpm/ryoku-shell.spec
new file mode 100644
index 0000000000..b6a40053f5
--- /dev/null
+++ b/fedora/packages/rpm/ryoku-shell.spec
@@ -0,0 +1,38 @@
+Name:           ryoku-shell
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku-shell desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+BuildRequires:  gcc
+BuildRequires:  pkgconf-pkg-config
+BuildRequires:  wayland-devel
+BuildRequires:  wayland-protocols-devel
+BuildRequires:  ffmpeg-free-devel
+Requires:       quickshell
+Requires:       ffmpeg-free
+Requires:       jq
+Requires:       uv
+Requires:       python3
+
+%description
+ryoku-shell, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/ryoku.spec b/fedora/packages/rpm/ryoku.spec
new file mode 100644
index 0000000000..4ee86827e1
--- /dev/null
+++ b/fedora/packages/rpm/ryoku.spec
@@ -0,0 +1,30 @@
+Name:           ryoku
+Version:        0.1
+Release:        1%{?dist}
+Summary:        ryoku desktop component
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+%global debug_package %{nil}
+BuildRequires:  bash
+BuildRequires:  coreutils
+BuildRequires:  findutils
+BuildRequires:  golang >= 1.26.4
+Requires:       dnf
+Requires:       snapper
+
+%description
+ryoku, built from the shared Ryoku source and package payload recipe.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%build
+export RYOKU_PKGVER=%{version}
+bash fedora/packages/rpm/stage-package.sh %{name} "$PWD/stage" %{_libdir}
+
+%install
+cp -a stage/. %{buildroot}/
+find %{buildroot} -type f -o -type l | sed 's|^%{buildroot}||' > rpm-files
+
+%files -f rpm-files
diff --git a/fedora/packages/rpm/sddm-theme-ryoku.spec b/fedora/packages/rpm/sddm-theme-ryoku.spec
new file mode 100644
index 0000000000..989372ac32
--- /dev/null
+++ b/fedora/packages/rpm/sddm-theme-ryoku.spec
@@ -0,0 +1,27 @@
+Name:           sddm-theme-ryoku
+Version:        0.1
+Release:        1%{?dist}
+Summary:        Ryoku orbital greeter theme for SDDM
+License:        GPL-3.0-or-later
+URL:            https://ryoku.dev
+Source0:        ryoku-%{version}.tar.gz
+BuildArch:      noarch
+
+Requires:       sddm
+Requires:       qt6-qtdeclarative
+Requires:       qt6-qt5compat
+Requires:       qt6-qtsvg
+Requires:       qt6-qtmultimedia
+
+%description
+Ryoku clockwork orbital login screen theme for SDDM.
+
+%prep
+%setup -q -n ryoku-%{version}
+
+%install
+install -d %{buildroot}%{_datadir}/sddm/themes/ryoku
+cp -a ryoku/lockscreen/qylock/themes/clockwork/orbital/. %{buildroot}%{_datadir}/sddm/themes/ryoku/
+
+%files
+%{_datadir}/sddm/themes/ryoku
diff --git a/fedora/packages/rpm/source-owners b/fedora/packages/rpm/source-owners
new file mode 100644
index 0000000000..04ce806945
--- /dev/null
+++ b/fedora/packages/rpm/source-owners
@@ -0,0 +1,6 @@
+# Heavy source paths and the only packages whose SRPM carries them. Every other
+# path reaches every SRPM; "-" keeps a path out of all of them.
+ryoku/assets/wallpapers ryoku-desktop
+ryoku/i18n/catalog ryoku-desktop
+.rpm-extras ryoku-extras
+ryoku-shell-installer/ryoku-shell-install -
diff --git a/fedora/packages/rpm/stage-package.sh b/fedora/packages/rpm/stage-package.sh
new file mode 100755
index 0000000000..538d8d5671
--- /dev/null
+++ b/fedora/packages/rpm/stage-package.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+name=${1:?package name}
+stage=$(realpath -m "${2:?staging directory}")
+libdir=${3:-/usr/lib64}
+root=$(cd "$(dirname "$0")/../../.." && pwd)
+export GOFLAGS="-mod=vendor -trimpath" CGO_ENABLED=0 GOTOOLCHAIN=local
+export RYOKU_PKGVER=${RYOKU_PKGVER:?version required}
+startdir="$root/fedora/packages/rpm/payload"
+srcdir="$root/.rpm-build/$name"
+pkgdir="$stage"
+mkdir -p "$srcdir" "$pkgdir"
+# The payload recipe is Fedora release input. It stages files only: no host
+# installation hooks run while building an RPM.
+recipe="$startdir/$name.sh"
+[[ -f $recipe ]] || { echo "unknown RPM payload: $name" >&2; exit 2; }
+# shellcheck source=/dev/null
+source "$recipe"
+if declare -F build >/dev/null; then build; fi
+package
+if [[ -d $stage/usr/lib/qt6 ]]; then
+  mkdir -p "$stage$libdir"
+  mv "$stage/usr/lib/qt6" "$stage$libdir/qt6"
+fi
+if [[ $name == ryoku-desktop ]]; then
+  cp "$root/.rpm-release" "$stage/etc/ryoku-release"
+  rm -f "$stage/usr/share/applications/mimeapps.list"
+fi
+if [[ $name == ryoku-desktop-* ]]; then
+  provider=${name#ryoku-desktop-}
+  install -Dm644 "$root/ryoku/apps/mimeapps.list" "$stage/usr/share/applications/$provider-mimeapps.list"
+fi
+
+while IFS= read -r -d '' link; do
+  target=$(readlink "$link")
+  if [[ $target == /usr/lib/qt6/* ]]; then
+    ln -sfn "$libdir/qt6/${target#/usr/lib/qt6/}" "$link"
+  fi
+done < <(find "$stage" -type l -print0)
diff --git a/fedora/system/extras/ryoku-install-extra b/fedora/system/extras/ryoku-install-extra
new file mode 100755
index 0000000000..3b9d8ec84f
--- /dev/null
+++ b/fedora/system/extras/ryoku-install-extra
@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Install pinned desktop extras; failed downloads never replace a working file."""
+import hashlib
+import io
+import json
+import os
+import posixpath
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tarfile
+import tempfile
+import urllib.request
+import zipfile
+
+RELEASES = {
+    "prowl-agent": ("0.15.6", "https://github.com/neur0map/prowl-agent/releases/download/v0.15.6/prowl-agent-linux-amd64", "3ce3b9183112411e3283ae5857eac281ef428fbfa8656caf7cec13c402998d53", "bin/prowl-agent"),
+    "qmk-hid": ("0.1.11", "https://github.com/FrameworkComputer/qmk_hid/releases/download/v0.1.11/qmk_hid_linux_v0.1.11.zip", "57460728df3777d0abd2f2b464dea898c1fdc1cc6524ede1c2854fa9c8f027dc", "bin/qmk_hid"),
+    "matugen": ("4.2.0", "https://github.com/InioX/matugen/releases/download/v4.2.0/matugen-4.2.0-x86_64.tar.gz", "a2e3b50e49ed6439999ba3c252ed04fabd98ee4e9d12e5e5dff2e66370569751", "bin/matugen"),
+    "bibata": ("2.0.7", "https://github.com/ful1e5/Bibata_Cursor/releases/download/v2.0.7/Bibata.tar.xz", "172e33c4ae415278384dcecc7d1a9b7a024266bc944bc751fd86532be1cc6251", "share/icons"),
+    "space-grotesk": ("2.0.0", "https://github.com/floriankarsten/space-grotesk/releases/download/2.0.0/SpaceGrotesk-2.0.0.zip", "53b415577d4139248555300710bea0d268c7a5be67b93de53b716a9736cabffd", "share/fonts/SpaceGrotesk"),
+    "material-symbols": ("27e9ef1d", "https://raw.githubusercontent.com/google/material-design-icons/27e9ef1dbeedc13d682fece4a58e1eda4cb0961a/variablefont/MaterialSymbolsRounded%5BFILL%2CGRAD%2Copsz%2Cwght%5D.ttf", "7f3a16d9aa1b6f367eadc1614ad27308ae2c0e91e617e2069f122afd9f0c3c58", "share/fonts/MaterialSymbolsRounded.ttf"),
+    "jetbrains-mono-nerd-fonts": ("3.3.0", "https://github.com/ryanoasis/nerd-fonts/releases/download/v3.3.0/JetBrainsMono.tar.xz", "7d171ea3884be22fc08bf1a1aee640a3dc93f031989c27f6f9ceb30a6a668de1", "share/fonts/JetBrainsMonoNerdFont"),
+    "space-mono-nerd-fonts": ("3.3.0", "https://github.com/ryanoasis/nerd-fonts/releases/download/v3.3.0/SpaceMono.tar.xz", "a2058cfc43eee5a170208c6e90fa77d8f0aa755e0d213e795f70781f7d807942", "share/fonts/SpaceMonoNerdFont"),
+}
+FONTS = ("space-grotesk", "material-symbols", "jetbrains-mono-nerd-fonts", "space-mono-nerd-fonts")
+
+
+def download(url, digest):
+    cache = os.environ.get("RYOKU_EXTRA_CACHE")
+    if cache:
+        data = (Path(cache) / digest).read_bytes()
+    else:
+        with urllib.request.urlopen(url, timeout=60) as response:
+            data = response.read(128 * 1024 * 1024 + 1)
+    if hashlib.sha256(data).hexdigest() != digest:
+        raise ValueError("download checksum mismatch: " + url)
+    return data
+
+
+def atomic_write(path, data, mode=0o644):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, name = tempfile.mkstemp(prefix=".ryoku-download-", dir=path.parent)
+    try:
+        with os.fdopen(fd, "wb") as stream:
+            stream.write(data)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.chmod(name, mode)
+        os.replace(name, path)
+    finally:
+        if os.path.exists(name):
+            os.unlink(name)
+
+
+def install(name, root=None):
+    version, url, digest, relative = RELEASES[name]
+    root = root or Path.home() / ".local"
+    receipt = root / "state/ryoku/extras" / (name + ".json")
+    if receipt.exists():
+        saved = json.loads(receipt.read_text())
+        if saved.get("version") == version and saved.get("files") and all(
+            (root / p).is_file() and hashlib.sha256((root / p).read_bytes()).hexdigest() == h
+            for p, h in saved["files"].items()
+        ):
+            return
+    data = download(url, digest)
+    files = {}
+    install_links = {}
+    if name == "matugen":
+        with tarfile.open(fileobj=io.BytesIO(data)) as archive:
+            member = next(m for m in archive.getmembers() if Path(m.name).name == "matugen" and m.isfile())
+            files[relative] = archive.extractfile(member).read()
+    elif name == "qmk-hid":
+        with zipfile.ZipFile(io.BytesIO(data)) as archive:
+            files[relative] = archive.read("qmk_hid")
+    elif name == "bibata":
+        with tarfile.open(fileobj=io.BytesIO(data)) as archive:
+            members = archive.getmembers()
+            content = {}
+            links = {}
+            for member in members:
+                path = Path(member.name)
+                if path.is_absolute() or ".." in path.parts:
+                    raise ValueError("unsafe archive path")
+                key = str(path)
+                if member.isfile():
+                    content[key] = archive.extractfile(member).read()
+                elif member.issym() or member.islnk():
+                    target = posixpath.normpath(posixpath.join(str(path.parent), member.linkname) if member.issym() else member.linkname)
+                    if target.startswith(("/", "../")):
+                        raise ValueError("unsafe archive link")
+                    links[key] = target
+            # Resolve aliases in memory; seeking backwards through xz for each
+            # cursor alias would repeatedly decompress the entire archive.
+            def resolve(key, seen):
+                if key in content:
+                    return content[key]
+                if key in seen or key not in links:
+                    raise ValueError("broken archive link")
+                return resolve(links[key], seen | {key})
+            for key in links:
+                content[key] = resolve(key, set())
+            for key, value in content.items():
+                destination = "share/licenses/Bibata/LICENSE" if key == "LICENSE" else str(Path(relative) / key)
+                files[destination] = value
+                if key in links:
+                    install_links[destination] = posixpath.relpath(str(Path(relative) / links[key]), str(Path(destination).parent))
+    elif name == "space-grotesk":
+        with zipfile.ZipFile(io.BytesIO(data)) as archive:
+            for member in archive.namelist():
+                if member.endswith(".otf"):
+                    files[str(Path(relative) / Path(member).name)] = archive.read(member)
+    elif name in ("jetbrains-mono-nerd-fonts", "space-mono-nerd-fonts"):
+        with tarfile.open(fileobj=io.BytesIO(data)) as archive:
+            for member in archive.getmembers():
+                path = Path(member.name)
+                if path.is_absolute() or ".." in path.parts:
+                    raise ValueError("unsafe archive path")
+                if member.isfile() and member.name.endswith(".ttf"):
+                    files[str(Path(relative) / path.name)] = archive.extractfile(member).read()
+    else:
+        files[relative] = data
+    if not files:
+        raise ValueError("archive has no installable content")
+    for path, content in files.items():
+        if path.startswith("bin/") and not content.startswith(b"\x7fELF"):
+            raise ValueError("not an ELF executable")
+        if path.endswith((".ttf", ".otf")) and content[:4] not in (b"\x00\x01\x00\x00", b"OTTO", b"ttcf"):
+            raise ValueError("not an OpenType font")
+    for path, content in files.items():
+        if path not in install_links:
+            atomic_write(root / path, content, 0o755 if path.startswith("bin/") else 0o644)
+    for path, target in install_links.items():
+        destination = root / path
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        with tempfile.TemporaryDirectory(prefix=".ryoku-link-", dir=destination.parent) as staging:
+            link = Path(staging) / "link"
+            link.symlink_to(target)
+            os.replace(link, destination)
+    atomic_write(receipt, json.dumps({"version": version, "sha256": digest, "files": {
+        p: hashlib.sha256(b).hexdigest() for p, b in files.items()
+    }}, sort_keys=True).encode())
+    if name in FONTS and shutil.which("fc-cache"):
+        subprocess.run(["fc-cache", "-f", str(root / "share/fonts")], check=True)
+
+
+if __name__ == "__main__":
+    try:
+        if len(sys.argv) != 2:
+            raise ValueError("usage: ryoku-install-extra " + "|".join(RELEASES))
+        target = sys.argv[1]
+        if target == "jetbrains-mono-nerd":
+            target = "jetbrains-mono-nerd-fonts"
+        if target not in RELEASES:
+            raise ValueError("usage: ryoku-install-extra " + "|".join(RELEASES))
+        install(target)
+    except Exception as error:
+        sys.exit("ryoku-install-extra: " + str(error))
diff --git a/fedora/system/hardware/drivers/common.sh b/fedora/system/hardware/drivers/common.sh
new file mode 100644
index 0000000000..37d25cdbe4
--- /dev/null
+++ b/fedora/system/hardware/drivers/common.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Shared by the Fedora driver installers; sourced before hardware detection.
+set -euo pipefail
+
+RYOKU_DRYRUN=${RYOKU_DRYRUN:-0}
+PRIV=()
+(( EUID == 0 )) || PRIV=(sudo -n)
+
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run) RYOKU_DRYRUN=1 ;;
+    -h | --help) echo "Usage: ${0##*/} [--dry-run]"; exit 0 ;;
+    *) echo "${0##*/}: unknown argument: $arg" >&2; exit 2 ;;
+  esac
+done
+
+run() {
+  if [[ $RYOKU_DRYRUN == 1 ]]; then
+    printf 'DRYRUN: %s\n' "$*"
+    return 0
+  fi
+  "$@"
+}
+
+install_pkgs() {
+  command -v dnf >/dev/null 2>&1 || {
+    echo "${0##*/}: Fedora DNF is required" >&2
+    return 1
+  }
+  run "${PRIV[@]}" dnf -y --exclude='*.i686' install -- "$@"
+}
+
+has_gpu_vendor() {
+  local dev vendor class
+  for dev in /sys/bus/pci/devices/*; do
+    [[ -r $dev/vendor && -r $dev/class ]] || continue
+    read -r vendor <"$dev/vendor"
+    read -r class <"$dev/class"
+    [[ $vendor == "$1" && $class == 0x03* ]] && return 0
+  done
+  return 1
+}
diff --git a/fedora/system/hardware/network/ryoku-wifi-regdom.service b/fedora/system/hardware/network/ryoku-wifi-regdom.service
new file mode 100644
index 0000000000..9c062b3f5d
--- /dev/null
+++ b/fedora/system/hardware/network/ryoku-wifi-regdom.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Apply the configured Ryoku Wi-Fi regulatory domain
+After=systemd-udev-trigger.service
+Before=NetworkManager.service
+ConditionPathExists=/etc/modprobe.d/ryoku-wireless-regdom.conf
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/ryoku-wifi-regdom apply
+
+[Install]
+WantedBy=multi-user.target
diff --git a/fedora/system/hardware/power/ryoku-inhibitors b/fedora/system/hardware/power/ryoku-inhibitors
new file mode 100755
index 0000000000..511447b6c1
--- /dev/null
+++ b/fedora/system/hardware/power/ryoku-inhibitors
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Print logind's inhibitor locks as a JSON array of
+# {what, who, why, mode, uid, pid}, the shape the power and lock helpers match
+# with jq. systemd-inhibit has no --json on Fedora 44 (systemd 259), so ask
+# login1 over D-Bus, which answers the same list on every systemd.
+set -euo pipefail
+
+busctl --json=short call org.freedesktop.login1 /org/freedesktop/login1 \
+  org.freedesktop.login1.Manager ListInhibitors |
+  jq -c '.data[0] | map({what: .[0], who: .[1], why: .[2], mode: .[3], uid: .[4], pid: .[5]})'
diff --git a/fedora/tests/fedora-extras.py b/fedora/tests/fedora-extras.py
new file mode 100644
index 0000000000..e4f04aacb1
--- /dev/null
+++ b/fedora/tests/fedora-extras.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+import hashlib
+import importlib.machinery
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+helper = Path(__file__).resolve().parents[2] / 'fedora/system/extras/ryoku-install-extra'
+extra = importlib.machinery.SourceFileLoader('extra', str(helper)).load_module()
+
+
+class Extras(unittest.TestCase):
+    def test_failed_update_preserves_binary_and_retry_works(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            target = root / 'bin/prowl-agent'
+            target.parent.mkdir()
+            target.write_bytes(b'old working executable')
+            with patch.object(extra, 'download', side_effect=ValueError('truncated')):
+                with self.assertRaises(ValueError):
+                    extra.install('prowl-agent', root)
+            self.assertEqual(target.read_bytes(), b'old working executable')
+            self.assertFalse((root / 'state/ryoku/extras/prowl-agent.json').exists())
+            with patch.object(extra, 'download', return_value=b'\x7fELFnew executable'):
+                extra.install('prowl-agent', root)
+            self.assertEqual(target.read_bytes(), b'\x7fELFnew executable')
+            with patch.object(extra, 'download', side_effect=AssertionError('should use receipt')):
+                extra.install('prowl-agent', root)
+
+    def test_bad_content_does_not_become_skip_marker(self):
+        with tempfile.TemporaryDirectory() as directory:
+            with patch.object(extra, 'download', return_value=b'<html>failure</html>'):
+                with self.assertRaises(ValueError):
+                    extra.install('material-symbols', Path(directory))
+            self.assertFalse((Path(directory) / 'share/fonts/MaterialSymbolsRounded.ttf').exists())
+
+    def test_cursor_aliases_remain_links(self):
+        import io
+        import tarfile
+        blob = io.BytesIO()
+        with tarfile.open(fileobj=blob, mode='w:xz') as archive:
+            regular = tarfile.TarInfo('Bibata-Modern-Ice/cursors/left_ptr')
+            regular.size = 6
+            archive.addfile(regular, io.BytesIO(b'cursor'))
+            alias = tarfile.TarInfo('Bibata-Modern-Ice/cursors/arrow')
+            alias.type = tarfile.SYMTYPE
+            alias.linkname = 'left_ptr'
+            archive.addfile(alias)
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with patch.object(extra, 'download', return_value=blob.getvalue()):
+                extra.install('bibata', root)
+            alias_path = root / 'share/icons/Bibata-Modern-Ice/cursors/arrow'
+            self.assertTrue(alias_path.is_symlink())
+            self.assertEqual(alias_path.read_bytes(), b'cursor')
+
+    def test_exact_font_url(self):
+        url = extra.RELEASES['material-symbols'][1]
+        self.assertIn('Rounded%5BFILL%2CGRAD%2Copsz%2Cwght%5D.ttf', url)
+        self.assertNotIn('%%', url)
+
+    def test_jetbrains_mono_nerd_fonts_release(self):
+        self.assertIn('jetbrains-mono-nerd-fonts', extra.RELEASES)
+        version, url, digest, relative = extra.RELEASES['jetbrains-mono-nerd-fonts']
+        self.assertEqual(version, '3.3.0')
+        self.assertTrue(url.endswith('.tar.xz'))
+        self.assertTrue(relative.startswith('share/fonts/'))
+
+    def test_jetbrains_mono_nerd_fonts_extraction(self):
+        import io, tarfile
+        blob = io.BytesIO()
+        with tarfile.open(fileobj=blob, mode='w:xz') as archive:
+            font_data = b'\x00\x01\x00\x00mock font data'
+            info = tarfile.TarInfo('JetBrainsMonoNerdFont-Regular.ttf')
+            info.size = len(font_data)
+            archive.addfile(info, io.BytesIO(font_data))
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with patch.object(extra, 'download', return_value=blob.getvalue()):
+                extra.install('jetbrains-mono-nerd-fonts', root)
+            target = root / 'share/fonts/JetBrainsMonoNerdFont/JetBrainsMonoNerdFont-Regular.ttf'
+            self.assertTrue(target.is_file())
+            self.assertEqual(target.read_bytes(), font_data)
+
+    def test_space_mono_nerd_fonts_extraction(self):
+        import io, tarfile
+        blob = io.BytesIO()
+        with tarfile.open(fileobj=blob, mode='w:xz') as archive:
+            font_data = b'\x00\x01\x00\x00mock font data'
+            info = tarfile.TarInfo('SpaceMonoNerdFont-Regular.ttf')
+            info.size = len(font_data)
+            archive.addfile(info, io.BytesIO(font_data))
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with patch.object(extra, 'download', return_value=blob.getvalue()):
+                extra.install('space-mono-nerd-fonts', root)
+            target = root / 'share/fonts/SpaceMonoNerdFont/SpaceMonoNerdFont-Regular.ttf'
+            self.assertEqual(target.read_bytes(), font_data)
+
+    def test_truncated_download_fails_checksum(self):
+        import io
+        with patch.object(extra.urllib.request, 'urlopen', return_value=io.BytesIO(b'partial')):
+            with self.assertRaises(ValueError):
+                extra.download('https://example.invalid', hashlib.sha256(b'complete').hexdigest())
+
+
+if __name__ == '__main__':
+    unittest.main()