Lower the battery threshold to 30% and default the cachy-update prompt to yes

The prompt offering to silence cachy-update's own update notification now defaults to yes: once updates install themselves that notification is nothing but noise, so the common answer should be the one you get by pressing Enter. It also accepts "j" now. The prompt is translated, so a German user reads "[J/n]" and types the German letter - which the old check for "y" alone silently read as a refusal.
Make the settings screen redraw 50x faster
2026-08-08 16:30:20 +02:00 · 2026-08-08 16:25:09 +02:00 · 2026-08-08 16:18:59 +02:00 · 2026-08-08 15:48:55 +02:00 · 2026-08-08 15:40:07 +02:00 · 2026-08-08 15:33:03 +02:00
15 changed files with 1031 additions and 81 deletions
@@ -8,7 +8,7 @@
 # Overridable so a packager can pass the version it is actually building
 # (`make VERSION=$pkgver`). The literal below is the fallback for builds
 # straight from a checkout, and is what a release tag has to carry.
-VERSION      ?= 1.0.2
+VERSION      ?= 1.1.2

 PREFIX       ?= /usr
 DESTDIR      ?=
@@ -30,9 +30,14 @@ That opens a menu with the two switches there are:
  [3] Update now
  [4] Show log
  [5] Show current conditions
+  [6] Settings
  [q] Quit
 ```

+Everything is configurable from **[6] Settings** — a cursor list covering all
+eighteen options, so nothing needs a text editor. Arrow keys select, Space or
+Right changes a value, `q` goes back; changes are written immediately.
+
 The interface is fully translated; on a German system everything above appears
 in German.

@@ -55,14 +60,21 @@ business rebuilding somebody's system before being asked.
 | Flatpak | system and per-user installations |
 | AppImages | via [Gear Lever](https://github.com/mijorus/gearlever), if installed |

-`-git`/`-devel` AUR packages, cache trimming and orphan removal exist as
-options but are off by default.
+It also trims the pacman package cache after each run (`paccache`, keeping the
+3 most recent versions), because otherwise `/var/cache/pacman/pkg` grows
+forever — tens of gigabytes on a machine with a few large packages. Set
+`KeepOldPackages=1` if disk space matters more than the ability to downgrade.
+
+`-git`/`-devel` AUR packages and orphan removal exist as options but are off by
+default. Orphan removal deletes installed software, and "orphaned" only means
+nothing else depends on it — which is also true of something installed
+deliberately.

 ## When it holds back

 A run is postponed — and retried an hour later — when:

- the battery is below 40 % (ignored on mains power; desktops without a battery
+- the battery is below 30 % (ignored on mains power; desktops without a battery
  are never affected),
 - a game is running: GameMode, a known game process, or anything holding a
  blocking idle inhibitor,
@@ -116,6 +128,48 @@ A leftover `db.lck` from a crashed transaction is never deleted automatically
 guessing wrong there corrupts a live transaction. After it has been seen
 unheld on several consecutive runs, you get a notification instead.

+## What if the machine is switched off mid-update
+
+Three layers, in order of how much they can actually promise:
+
+**A notification goes out before the transaction starts** — "Installing
+updates, please leave the computer switched on until this is done" — and is
+replaced in place by the result when the run finishes, so it costs one bubble
+rather than two. This exists because of what the next paragraph does *not* do.
+
+**Suspend and a normal shutdown are blocked.** The run holds a
+`systemd-inhibit --what=sleep:shutdown --mode=block` lock, so closing the lid or
+picking "Shut down" cannot interrupt a transaction. Be aware of what that looks
+like, though: logind refuses the request and requires the polkit action
+`org.freedesktop.login1.power-off-ignore-inhibit`, which is `auth_admin_keep`.
+The desktop therefore answers a shutdown attempt with an **administrator
+password prompt** reading *"Power off the system while an application is
+inhibiting this"* — a string systemd ships untranslated, and one that never
+mentions updates. No KDE dialog explains the situation. Only `systemctl
+poweroff` in a terminal names the reason. That prompt is exactly why the
+notification above is on by default.
+
+**A hard power-off cannot be prevented by anything.** Holding the power button
+or pulling the plug cuts power in firmware. What limits the damage is that
+pacman's commit phase is short (about a minute even for a 200-package upgrade)
+and that most of a run is downloading, where an interruption costs nothing but
+a partial file.
+
+**The next run repairs it.** A `db.lck` left behind is detected and removed —
+but only when it is *provably* dead, meaning it is older than the current boot,
+so no process that could hold it still exists. The interrupted upgrade is then
+simply run again; pacman reinstalls anything that was caught half-written. A
+lock that is merely unheld within the same boot is never removed, only
+reported, because there the guess could be wrong.
+
+This last part matters more than it sounds: without it, a single power cut
+during an update would leave a lock file that makes every future run defer,
+and the machine would stop updating silently and permanently.
+
+On a Btrfs system with `snapper` and `snap-pac` — the CachyOS default — every
+pacman transaction is bracketed by a pre and post snapshot, so a genuinely
+broken upgrade can still be rolled back with `snapper rollback`.
+
 ## Configuration

 `/etc/cachy-auto-update/cachy-auto-update.conf`, one `Key=Value` per line, every
@@ -16,7 +16,10 @@ updated in the background, with no password prompt and no terminal.

 Run without a command it opens a small interactive menu with the two switches
 that matter - automatic updates on/off and notifications on/off - plus the
-current status.
+current status, and a settings screen covering every remaining option so the
+configuration file never has to be edited by hand. In the settings screen the
+arrow keys select, Space or Right changes a value, and _q_ goes back; every
+change is written out immediately.

 The actual work is done by a systemd system service. The timer ticks hourly;
 whether a tick does anything is decided by _UpdateInterval_ (daily by default).
@@ -100,6 +103,39 @@ running are skipped.
 The machine is never restarted automatically. When a kernel update makes a
 restart necessary, a notification says so.

+# INTERRUPTED UPDATES
+
+Before a transaction starts, a notification says an update is running and asks
+for the machine to be left on. It is replaced in place by the result once the
+run finishes.
+
+While a transaction is running, *cachy-auto-update* holds a
+*systemd-inhibit*(1) lock on _sleep_ and _shutdown_ in blocking mode, so a
+suspend, a lid close or a normal shutdown request cannot cut it short.
+
+What a user sees when they try anyway is worth knowing: logind refuses the
+request and falls back to the polkit action
+_org.freedesktop.login1.power-off-ignore-inhibit_, which is _auth_admin_keep_,
+so the desktop presents an administrator password prompt reading "Power off the
+system while an application is inhibiting this". That string is shipped
+untranslated by systemd and does not mention updates, and no KDE dialog
+explains the situation either - only *systemctl*(1) names the inhibitor and its
+reason. Hence the notification.
+
+A hard power-off - holding the power button, or losing mains power - is not
+preventable. On the next run a leftover _/var/lib/pacman/db.lck_ is removed if
+it is older than the current boot, since no process able to hold it can still
+exist; the upgrade is then repeated and pacman reinstalls whatever was caught
+half-written. A lock file that is unheld but was created during the current
+boot is reported rather than removed, because there is no way to prove it is
+abandoned.
+
+Without that recovery a single power cut would leave a lock that makes every
+subsequent run defer, silently stopping updates for good.
+
+On Btrfs with *snapper*(8) and *snap-pac*, each pacman transaction is bracketed
+by a pre and post snapshot, so a broken upgrade remains rollbackable.
+
 # FILES

 _/etc/cachy-auto-update/cachy-auto-update.conf_
@@ -134,7 +134,7 @@ msgstr ""
 msgid "Quit"
 msgstr ""

-msgid "Press Enter to continue..."
+msgid "Press any key to continue..."
 msgstr ""

 #. Commands
@@ -168,7 +168,7 @@ msgstr ""
 msgid "base-devel is missing - AUR packages cannot be built without it."
 msgstr ""

-msgid "cachy-update also notifies about available updates. Turn its notifications off? [y/N]"
+msgid "cachy-update also notifies about available updates. Turn its notifications off? [Y/n]"
 msgstr ""

 msgid "cachy-update's update check has been disabled."
@@ -243,3 +243,95 @@ msgstr ""

 msgid "pacman's lock file looks left over from an interrupted update. Updates are paused until it is cleared."
 msgstr ""
+
+msgid "Some packages were held back"
+msgstr ""
+
+#, c-format
+msgid "%s could not be updated and was skipped. Everything else is up to date."
+msgstr ""
+
+#, c-format
+msgid "Held back: %s"
+msgstr ""
+
+msgid "The last run was stopped before it finished."
+msgstr ""
+
+msgid "Finishing an interrupted update"
+msgstr ""
+
+msgid "The last update was cut short, most likely because the machine was switched off. It is being finished now."
+msgstr ""
+
+msgid "Installing updates"
+msgstr ""
+
+msgid "%d packages are being updated. Please leave the computer switched on until this is done."
+msgstr ""
+
+msgid "Settings"
+msgstr ""
+
+msgid "(none)"
+msgstr ""
+
+msgid "Up/Down select - Space or Right changes - q goes back"
+msgstr ""
+
+msgid "Package names separated by spaces, empty to clear:"
+msgstr ""
+
+msgid "Notify when an update starts"
+msgstr ""
+
+msgid "Notify after a successful update"
+msgstr ""
+
+msgid "Notify when something goes wrong"
+msgstr ""
+
+msgid "Notify when a restart is needed"
+msgstr ""
+
+msgid "Time between update runs"
+msgstr ""
+
+msgid "Postpone while a game is running"
+msgstr ""
+
+msgid "Only update on mains power"
+msgstr ""
+
+msgid "Minimum battery level (%)"
+msgstr ""
+
+msgid "Update AUR packages"
+msgstr ""
+
+msgid "Update Flatpaks"
+msgstr ""
+
+msgid "Update AppImages"
+msgstr ""
+
+msgid "Also rebuild -git packages"
+msgstr ""
+
+msgid "AUR helper"
+msgstr ""
+
+msgid "Resolve package conflicts automatically"
+msgstr ""
+
+msgid "Trim the package cache"
+msgstr ""
+
+msgid "Cached versions to keep"
+msgstr ""
+
+msgid "Remove packages nothing needs any more"
+msgstr ""
+
+msgid "Never update these packages"
+msgstr ""
@@ -135,8 +135,8 @@ msgstr "Aktuelle Bedingungen anzeigen"
 msgid "Quit"
 msgstr "Beenden"

-msgid "Press Enter to continue..."
-msgstr "Zum Fortfahren Enter drücken …"
+msgid "Press any key to continue..."
+msgstr "Zum Fortfahren eine Taste drücken …"

 #. Commands
 msgid "Automatic updates are on."
@@ -169,8 +169,8 @@ msgstr "Kein AUR-Helper gefunden – für AUR-Updates paru oder yay installieren
 msgid "base-devel is missing - AUR packages cannot be built without it."
 msgstr "base-devel fehlt – ohne das lassen sich AUR-Pakete nicht bauen."

-msgid "cachy-update also notifies about available updates. Turn its notifications off? [y/N]"
-msgstr "cachy-update benachrichtigt ebenfalls über verfügbare Updates. Dessen Benachrichtigungen abschalten? [j/N]"
+msgid "cachy-update also notifies about available updates. Turn its notifications off? [Y/n]"
+msgstr "cachy-update benachrichtigt ebenfalls über verfügbare Updates. Dessen Benachrichtigungen abschalten? [J/n]"

 msgid "cachy-update's update check has been disabled."
 msgstr "Die Update-Prüfung von cachy-update wurde abgeschaltet."
@@ -244,3 +244,96 @@ msgstr "Paketdatenbank gesperrt"

 msgid "pacman's lock file looks left over from an interrupted update. Updates are paused until it is cleared."
 msgstr "Die Sperrdatei von pacman scheint von einem abgebrochenen Update übrig zu sein. Bis sie entfernt ist, pausieren die Updates."
+
+msgid "Some packages were held back"
+msgstr "Einige Pakete wurden zurückgehalten"
+
+#, c-format
+msgid "%s could not be updated and was skipped. Everything else is up to date."
+msgstr "%s konnte nicht aktualisiert werden und wurde übersprungen. Alles andere ist aktuell."
+
+#, c-format
+msgid "Held back: %s"
+msgstr "Zurückgehalten: %s"
+
+msgid "The last run was stopped before it finished."
+msgstr "Der letzte Lauf wurde abgebrochen, bevor er fertig war."
+
+msgid "Finishing an interrupted update"
+msgstr "Abgebrochenes Update wird beendet"
+
+msgid "The last update was cut short, most likely because the machine was switched off. It is being finished now."
+msgstr "Das letzte Update wurde unterbrochen, vermutlich weil der Rechner ausgeschaltet wurde. Es wird jetzt zu Ende geführt."
+
+msgid "Installing updates"
+msgstr "Updates werden installiert"
+
+#, c-format
+msgid "%d packages are being updated. Please leave the computer switched on until this is done."
+msgstr "%d Pakete werden gerade aktualisiert. Bitte den Rechner so lange eingeschaltet lassen."
+
+msgid "Settings"
+msgstr "Einstellungen"
+
+msgid "(none)"
+msgstr "(keine)"
+
+msgid "Up/Down select - Space or Right changes - q goes back"
+msgstr "Hoch/Runter wählen – Leertaste oder Rechts ändert – q zurück"
+
+msgid "Package names separated by spaces, empty to clear:"
+msgstr "Paketnamen mit Leerzeichen getrennt, leer zum Löschen:"
+
+msgid "Notify when an update starts"
+msgstr "Melden, wenn ein Update beginnt"
+
+msgid "Notify after a successful update"
+msgstr "Melden nach erfolgreichem Update"
+
+msgid "Notify when something goes wrong"
+msgstr "Melden, wenn etwas schiefgeht"
+
+msgid "Notify when a restart is needed"
+msgstr "Melden, wenn ein Neustart nötig ist"
+
+msgid "Time between update runs"
+msgstr "Abstand zwischen Update-Läufen"
+
+msgid "Postpone while a game is running"
+msgstr "Verschieben, solange ein Spiel läuft"
+
+msgid "Only update on mains power"
+msgstr "Nur am Stromnetz aktualisieren"
+
+msgid "Minimum battery level (%)"
+msgstr "Mindest-Akkustand (%)"
+
+msgid "Update AUR packages"
+msgstr "AUR-Pakete aktualisieren"
+
+msgid "Update Flatpaks"
+msgstr "Flatpaks aktualisieren"
+
+msgid "Update AppImages"
+msgstr "AppImages aktualisieren"
+
+msgid "Also rebuild -git packages"
+msgstr "Auch -git-Pakete neu bauen"
+
+msgid "AUR helper"
+msgstr "AUR-Helfer"
+
+msgid "Resolve package conflicts automatically"
+msgstr "Paketkonflikte automatisch auflösen"
+
+msgid "Trim the package cache"
+msgstr "Paket-Cache beschneiden"
+
+msgid "Cached versions to keep"
+msgstr "Behaltene Versionen im Cache"
+
+msgid "Remove packages nothing needs any more"
+msgstr "Nicht mehr benötigte Pakete entfernen"
+
+msgid "Never update these packages"
+msgstr "Diese Pakete nie aktualisieren"
@@ -31,7 +31,7 @@ UpdateInterval=1d

 # Never update while the battery is below this percentage. Ignored on mains
 # power and on machines without a battery.
-MinBatteryPercent=40
+MinBatteryPercent=30

 # Update only while plugged in. Stricter than MinBatteryPercent.
 RequireAC=no
@@ -66,22 +66,41 @@ AutoResolveConflicts=yes
 IgnorePkg=

 # ---------------------------------------------------------------------------
-# Housekeeping - all off by default
+# Housekeeping
 # ---------------------------------------------------------------------------

-# Trim the pacman package cache after an update.
-CleanCache=no
+# Trim the pacman package cache after an update: drop the older versions of
+# installed packages, and every cached version of packages that are no longer
+# installed. Nothing that is currently installed is ever touched, so this only
+# costs the ability to downgrade further back than KeepOldPackages.
+# Without it /var/cache/pacman/pkg grows forever - tens of gigabytes on a
+# machine with a few large packages.
+CleanCache=yes

-# How many old versions per package to keep when CleanCache is on.
+# How many old versions per package to keep when CleanCache is on. 3 is the
+# Arch default and leaves room to downgrade. Set it to 1 if disk space matters
+# more than that; on a machine with a handful of multi-gigabyte packages the
+# difference is easily ten gigabytes.
 KeepOldPackages=3

-# Remove packages that were installed as dependencies and are no longer needed.
+# Remove packages nothing depends on any more: pacman packages that were pulled
+# in as dependencies and are now unreferenced, plus Flatpak runtimes no
+# installed application uses.
+# Off by default, and unlike CleanCache this one deletes installed software:
+# "orphaned" only means no other package requires it, which is also true of
+# something installed deliberately as a dependency of nothing.
 RemoveOrphans=no

 # ---------------------------------------------------------------------------
 # Notification detail
 # ---------------------------------------------------------------------------

+# Say that an update has started. Worth keeping on: while one runs, a shutdown
+# request is refused and the desktop answers with an untranslated polkit
+# password prompt that never mentions updates. This message is replaced by the
+# result when the run finishes, so it costs one bubble, not two.
+NotifyOnStart=yes
+
 # Say something after a successful update. Nothing is ever shown when there
 # was nothing to do.
 NotifyOnSuccess=yes
@@ -117,9 +117,17 @@ cau_offer_disable_cachy_update() {
 	(( found )) || return 0

 	printf '\n  %s\n  ' \
-		"$(cau_msg "cachy-update also notifies about available updates. Turn its notifications off? [y/N]")"
+		"$(cau_msg "cachy-update also notifies about available updates. Turn its notifications off? [Y/n]")"
 	read -r answer || return 0
-	[[ ${answer,,} == y ]] || return 0
+
+	# Defaults to yes: once updates install themselves, cachy-update's "N
+	# updates available" is purely noise. "j" is accepted too - the prompt is
+	# translated, so a German user types the German letter and used to have
+	# that silently read as "no".
+	case "${answer,,}" in
+		''|y|yes|j|ja) ;;
+		*) return 0 ;;
+	esac

 	while read -r user uid; do
 		[[ -n $user ]] || continue
@@ -63,6 +63,21 @@ fi
 cau_config_load
 cau_log_open

+# Record an interruption rather than leaving the previous run's verdict behind.
+# Without this, killing an interactive run leaves last_result at whatever it was
+# before - so the menu can keep reporting a problem from hours ago while the
+# machine is in fact fully up to date, which is worse than saying nothing.
+# pacman makes the commit phase itself uninterruptible, so the packages either
+# all landed or none did; only our own bookkeeping is at risk here.
+_cau_interrupted() {
+	cau_error "Update run interrupted ($1)"
+	cau_state_write last_result interrupted
+	exit 130
+}
+trap '_cau_interrupted SIGINT'  INT
+trap '_cau_interrupted SIGTERM' TERM
+trap '_cau_interrupted SIGHUP'  HUP
+
 # ---------------------------------------------------------------------------
 # Should this run happen at all?
 # ---------------------------------------------------------------------------
@@ -102,6 +117,15 @@ if (( ! FORCE )); then
 	fi
 fi

+# A lock left behind by a power cut during a previous update. It is cleared
+# before the busy check, because otherwise every future run would defer on it
+# forever and the machine would quietly stop updating.
+if cau_recover_stale_lock; then
+	cau_notify normal \
+		"Finishing an interrupted update" \
+		"The last update was cut short, most likely because the machine was switched off. It is being finished now."
+fi
+
 # This one is checked even with --force: proceeding anyway would just hand the
 # user a lock error instead of doing anything useful.
 CAU_SKIP_REASON=''
@@ -189,7 +213,7 @@ cau_state_write last_counts \
 if (( failed )); then
 	cau_state_write last_result failed
 	cau_error "Update run finished with errors"
-	[[ $CFG_NOTIFY_ERROR == yes ]] && cau_notify critical \
+	[[ $CFG_NOTIFY_ERROR == yes ]] && cau_notify_tagged run yes critical \
 		"Update failed" \
 		"Something went wrong while updating. Run 'cachy-auto-update log' for details."
 else
@@ -198,10 +222,26 @@ else
 	cau_info "Update run finished successfully ($total item(s) updated)"

 	if (( total > 0 )) && [[ $CFG_NOTIFY_SUCCESS == yes ]]; then
-		cau_notify low "System updated" "%d updates were installed." "$total"
+		cau_notify_tagged run yes low "System updated" "%d updates were installed." "$total"
 	fi
 fi

+# Packages skipped so the rest of the upgrade could proceed. The notification
+# only fires when the set changes: a blocker waiting on an upstream fix would
+# otherwise produce the same message every single day.
+prev_held="$(cau_state_read held_back '')"
+if [[ -n $CAU_PACMAN_HELD ]]; then
+	cau_state_write held_back "$CAU_PACMAN_HELD"
+	cau_warn "Held back: $CAU_PACMAN_HELD"
+	if [[ $CAU_PACMAN_HELD != "$prev_held" && $CFG_NOTIFY_ERROR == yes ]]; then
+		cau_notify normal "Some packages were held back" \
+			"%s could not be updated and was skipped. Everything else is up to date." \
+			"$CAU_PACMAN_HELD"
+	fi
+else
+	cau_state_clear held_back
+fi
+
 if cau_pacman_reboot_needed; then
 	cau_state_write reboot_needed 1
 	cau_info "A kernel update needs a restart"
@@ -75,13 +75,55 @@ cau_msg() {
 	cau_msg_in "$(cau_ui_locale)" "$@"
 }

+# cau_msg_into <locale> <msgid>
+# Plain lookup with the result in CAU_MSG_RESULT and no printf formatting.
+# For callers that redraw many labels per keypress, where wrapping cau_msg in a
+# command substitution would cost a fork per label.
+CAU_MSG_RESULT=''
+
+cau_msg_into() {
+	local locale="$1" msgid="$2" cachekey
+	cachekey="${locale}"$'\x1f'"${msgid}"
+
+	if [[ -n ${CAU_MSG_CACHE[$cachekey]+set} ]]; then
+		CAU_MSG_RESULT="${CAU_MSG_CACHE[$cachekey]}"
+		return 0
+	fi
+
+	CAU_MSG_RESULT="$(LC_ALL="$locale" LANGUAGE="${locale%%.*}" gettext -- "$msgid" 2>/dev/null)"
+	[[ -n $CAU_MSG_RESULT ]] || CAU_MSG_RESULT="$msgid"
+	CAU_MSG_CACHE[$cachekey]="$CAU_MSG_RESULT"
+	return 0
+}
+
+# Translations are memoized. Every gettext lookup is a fork, and the settings
+# screen redraws forty-odd labels per keypress; without this the redraw takes
+# long enough that a keystroke arriving during it is lost when the terminal
+# switches back to single-character mode.
+declare -A CAU_MSG_CACHE=()
+
 # cau_msg_in <locale> <msgid> [printf args...]
 cau_msg_in() {
-	local locale="$1" msgid="$2" translated
+	local locale="$1" msgid="$2" translated cachekey
 	shift 2

+	cachekey="${locale}"$'\x1f'"${msgid}"
+	if [[ -n ${CAU_MSG_CACHE[$cachekey]+set} ]]; then
+		translated="${CAU_MSG_CACHE[$cachekey]}"
+	else
 		translated="$(LC_ALL="$locale" LANGUAGE="${locale%%.*}" gettext -- "$msgid" 2>/dev/null)"
 		[[ -n $translated ]] || translated="$msgid"
+		CAU_MSG_CACHE[$cachekey]="$translated"
+	fi
+
+	# With no arguments the message is plain text, not a format string. Feeding
+	# it to printf anyway turns any literal percent sign in it - "Battery (%)",
+	# "100 % done" - into an invalid conversion, and that is a trap every
+	# translator would eventually walk into.
+	if (( $# == 0 )); then
+		printf '%s' "$translated"
+		return
+	fi

 	# shellcheck disable=SC2059  # the format string is the translated message
 	printf -- "$translated" "$@"
@@ -91,7 +133,14 @@ cau_msg_in() {
 # Output and logging
 # ---------------------------------------------------------------------------

-if [[ -t 1 && -z ${NO_COLOR:-} ]]; then
+# Is a person watching? Decided once, here, while stdout is still whatever the
+# process was started with. Testing `-t 1` at the point of use is unreliable:
+# any function called through $(...) or <(...) sees a pipe on stdout and would
+# conclude nobody is there.
+CAU_INTERACTIVE=''
+[[ -t 1 ]] && CAU_INTERACTIVE=1
+
+if [[ -n $CAU_INTERACTIVE && -z ${NO_COLOR:-} ]]; then
 	CAU_C_RESET=$'\033[0m'
 	CAU_C_BOLD=$'\033[1m'
 	CAU_C_DIM=$'\033[2m'
@@ -132,10 +181,19 @@ cau_log_open() {
 	CAU_LOG_OPEN=1
 }

-# Runs a command, streaming its combined output into the run log. Returns the
+# Runs a command, capturing its combined output in the run log. Returns the
 # command's exit status.
+#
+# When a person is watching - `cachy-auto-update run` from a terminal - the
+# output is shown as well. Building an AUR package or pulling a few hundred
+# megabytes of Flatpak can take minutes, and silence for that long is
+# indistinguishable from a hang.
 cau_run_logged() {
 	if [[ -n ${CAU_LOG_OPEN:-} ]]; then
+		if [[ -n $CAU_INTERACTIVE ]]; then
+			"$@" 2>&1 | tee -a "$CAU_RUNLOG"
+			return "${PIPESTATUS[0]}"
+		fi
 		"$@" >> "$CAU_RUNLOG" 2>&1
 	else
 		"$@" >&2
@@ -146,11 +204,18 @@ cau_run_logged() {
 # Terminal helpers for the CLI
 # ---------------------------------------------------------------------------

+# Set by cau_bad and cau_note. The menu redraws immediately after an action,
+# which would wipe the screen; this marks that something was printed that the
+# user still has to read, so only those cases wait for a keypress. A plain
+# success needs no acknowledgement - the status block at the top of the menu
+# already shows the new state.
+CAU_UI_NEEDS_ACK=''
+
 cau_say()  { printf '%s\n' "$*"; }
 cau_head() { printf '\n%s%s%s\n\n' "$CAU_C_BOLD$CAU_C_BLUE" "$*" "$CAU_C_RESET"; }
 cau_ok()   { printf '%s✔%s %s\n' "$CAU_C_GREEN" "$CAU_C_RESET" "$*"; }
-cau_bad()  { printf '%s✘%s %s\n' "$CAU_C_RED" "$CAU_C_RESET" "$*" >&2; }
-cau_note() { printf '%s•%s %s\n' "$CAU_C_DIM" "$CAU_C_RESET" "$*"; }
+cau_bad()  { CAU_UI_NEEDS_ACK=1; printf '%s✘%s %s\n' "$CAU_C_RED" "$CAU_C_RESET" "$*" >&2; }
+cau_note() { CAU_UI_NEEDS_ACK=1; printf '%s•%s %s\n' "$CAU_C_DIM" "$CAU_C_RESET" "$*"; }

 # ---------------------------------------------------------------------------
 # State files
@@ -6,14 +6,39 @@
 # root-run daemon, and sourcing it would turn a stray line into arbitrary code
 # execution. The format is one "Key=Value" per line, '#' starts a comment.

-# cau_config_get <Key> [default]
-cau_config_get() {
-	local key="$1" default="${2:-}" val
+# The file is cached and parsed in-process rather than shelled out to sed on
+# every lookup. The settings screen reads every key on every redraw, and a fork
+# per key made the redraw slow enough to swallow keystrokes.
+CAU_CONFIG_CACHE=''
+CAU_CONFIG_CACHED=0

-	[[ -r $CAU_CONFIG ]] || { printf '%s\n' "$default"; return; }
+_cau_config_slurp() {
+	(( CAU_CONFIG_CACHED )) && return 0
+	CAU_CONFIG_CACHE=''
+	[[ -r $CAU_CONFIG ]] && CAU_CONFIG_CACHE="$(< "$CAU_CONFIG")"
+	CAU_CONFIG_CACHED=1
+	return 0
+}

-	val="$(sed -nE "s/^[[:space:]]*${key}[[:space:]]*=[[:space:]]*(.*)$/\\1/p" \
-		"$CAU_CONFIG" 2>/dev/null | tail -n1)"
+# _cau_config_lookup <Key> [default]
+# Result in CAU_CONFIG_VALUE. Assigning rather than printing matters on the
+# settings screen, which reads every key on every frame: a command substitution
+# there is a fork, and forks were the entire cost of a redraw.
+CAU_CONFIG_VALUE=''
+
+_cau_config_lookup() {
+	local key="$1" default="${2:-}" val='' line
+
+	CAU_CONFIG_VALUE="$default"
+	[[ -r $CAU_CONFIG ]] || return 0
+	_cau_config_slurp
+
+	# last assignment wins, matching the previous sed|tail behaviour
+	while IFS= read -r line; do
+		[[ $line == *"$key"* ]] || continue
+		[[ $line =~ ^[[:space:]]*"$key"[[:space:]]*=(.*)$ ]] || continue
+		val="${BASH_REMATCH[1]}"
+	done <<< "$CAU_CONFIG_CACHE"

 	# strip a trailing comment and surrounding whitespace/quotes
 	val="${val%%#*}"
@@ -22,11 +47,14 @@ cau_config_get() {
 	val="${val%\"}"
 	val="${val#\"}"

-	if [[ -n $val ]]; then
-		printf '%s\n' "$val"
-	else
-		printf '%s\n' "$default"
-	fi
+	[[ -n $val ]] && CAU_CONFIG_VALUE="$val"
+	return 0
+}
+
+# cau_config_get <Key> [default]
+cau_config_get() {
+	_cau_config_lookup "$@"
+	printf '%s\n' "$CAU_CONFIG_VALUE"
 }

 # cau_config_bool <Key> <default: yes|no>
@@ -78,6 +106,7 @@ cau_config_set() {
 	fi

 	mv -f "$tmp" "$CAU_CONFIG"
+	CAU_CONFIG_CACHED=0
 }

 # ---------------------------------------------------------------------------
@@ -96,15 +125,16 @@ cau_config_load() {
 	CFG_APPIMAGE=no;              cau_config_bool UpdateAppImages      yes && CFG_APPIMAGE=yes
 	CFG_DEVEL=no;                 cau_config_bool UpdateDevel          no  && CFG_DEVEL=yes
 	CFG_RESOLVE_CONFLICTS=no;     cau_config_bool AutoResolveConflicts yes && CFG_RESOLVE_CONFLICTS=yes
-	CFG_CLEAN_CACHE=no;           cau_config_bool CleanCache           no  && CFG_CLEAN_CACHE=yes
+	CFG_CLEAN_CACHE=no;           cau_config_bool CleanCache           yes && CFG_CLEAN_CACHE=yes
 	CFG_REMOVE_ORPHANS=no;        cau_config_bool RemoveOrphans        no  && CFG_REMOVE_ORPHANS=yes
+	CFG_NOTIFY_START=no;          cau_config_bool NotifyOnStart        yes && CFG_NOTIFY_START=yes
 	CFG_NOTIFY_SUCCESS=no;        cau_config_bool NotifyOnSuccess      yes && CFG_NOTIFY_SUCCESS=yes
 	CFG_NOTIFY_ERROR=no;          cau_config_bool NotifyOnError        yes && CFG_NOTIFY_ERROR=yes
 	CFG_NOTIFY_REBOOT=no;         cau_config_bool NotifyReboot         yes && CFG_NOTIFY_REBOOT=yes

 	CFG_INTERVAL="$(cau_config_get UpdateInterval 1d)"
 	CFG_INTERVAL_SECONDS="$(cau_duration_to_seconds "$CFG_INTERVAL" 86400)"
-	CFG_MIN_BATTERY="$(cau_config_int MinBatteryPercent 40)"
+	CFG_MIN_BATTERY="$(cau_config_int MinBatteryPercent 30)"
 	CFG_KEEP_OLD="$(cau_config_int KeepOldPackages 3)"
 	CFG_AUR_HELPER="$(cau_config_get AURHelper auto)"
 	CFG_IGNORE_PKG="$(cau_config_get IgnorePkg '')"
@@ -60,11 +60,55 @@ cau_package_manager_busy() {
 	return 1
 }

+# cau_pacman_lock_is_stale
+# True only when the lock provably cannot belong to anything alive.
+#
+# The rigorous test is the boot time: no process that existed before the
+# current boot can still be running, so a db.lck older than boot is abandoned
+# by definition - which is exactly what a power cut during an update leaves
+# behind. A lock that is merely unheld *within* this boot is not provable in
+# the same way, so it is only reported (see cau_track_stale_lock) and never
+# removed; guessing wrong there would corrupt a live transaction.
+#
+# The fuser check is kept as a second condition purely to survive a backwards
+# clock jump making a live lock look pre-boot.
+cau_pacman_lock_is_stale() {
+	local boot lock
+
+	[[ -e $CAU_PACMAN_LOCK ]] || return 1
+
+	boot="$(awk '/^btime /{print $2}' /proc/stat 2>/dev/null)"
+	[[ $boot =~ ^[0-9]+$ ]] || return 1
+
+	lock="$(stat -c %Y "$CAU_PACMAN_LOCK" 2>/dev/null)" || return 1
+	[[ $lock =~ ^[0-9]+$ ]] || return 1
+
+	(( lock < boot )) || return 1
+	[[ -z "$(cau_pacman_lock_holder)" ]]
+}
+
+# cau_recover_stale_lock
+# Clears a provably abandoned lock so an interrupted update can be finished on
+# the next run. Without this, one power cut during an update stops every future
+# update permanently and silently - the worst possible outcome for a machine
+# nobody is watching.
+cau_recover_stale_lock() {
+	cau_pacman_lock_is_stale || return 1
+
+	cau_warn "Found a pacman lock older than this boot - an update was cut short"
+	rm -f "$CAU_PACMAN_LOCK" 2>/dev/null || {
+		cau_error "Could not remove the stale pacman lock"
+		return 1
+	}
+	cau_state_clear stale_lock_count
+	cau_info "Stale lock removed; the interrupted update will be finished now"
+	return 0
+}
+
 # cau_track_stale_lock
-# A db.lck with no process behind it is left over from a crashed transaction.
-# Removing it automatically would be reckless - if the guess is wrong it
-# corrupts a live transaction - so instead it is counted, and after enough
-# consecutive sightings the user is told to clean it up.
+# A db.lck with no process behind it but created during this boot: a crashed
+# pacman rather than a power cut. Not provable, so it is counted, and after
+# enough consecutive sightings the user is told to clean it up.
 CAU_STALE_LOCK_RUNS=3

 cau_track_stale_lock() {
@@ -7,6 +7,317 @@

 CAU_UNIT="cachy-auto-update.timer"

+# Terminal mode.
+#
+# bash flips the terminal into non-canonical mode for each `read -sn1` and back
+# out again in between. That gap matters: in canonical mode DEL is the ERASE
+# character, so the line discipline eats it instead of delivering it, and a
+# backspace typed while the interface was between reads simply vanished.
+# Holding non-canonical mode for the whole interface removes the gap.
+CAU_TERM_SAVED=''
+
+cau_ui_term_raw() {
+	cau_have stty || return 0
+	[[ -t 0 ]] || return 0
+	[[ -n $CAU_TERM_SAVED ]] && return 0
+
+	CAU_TERM_SAVED="$(stty -g 2>/dev/null)" || { CAU_TERM_SAVED=''; return 0; }
+	stty -icanon -echo min 1 time 0 2>/dev/null || true
+}
+
+cau_ui_term_restore() {
+	[[ -n $CAU_TERM_SAVED ]] || return 0
+	stty "$CAU_TERM_SAVED" 2>/dev/null || true
+	CAU_TERM_SAVED=''
+}
+
+# Runs an action with the terminal handed back to normal line mode, so anything
+# it prints - or prompts for - behaves the way a program expects.
+cau_ui_cooked() {
+	cau_ui_term_restore
+	"$@"
+	local rc=$?
+	cau_ui_term_raw
+	return $rc
+}
+
+# cau_read_key
+# One keypress, resolved to a symbolic name: a literal character, or one of
+# up/down/left/right/enter/space/escape. Arrow keys arrive as ESC [ A, so the
+# tail of the sequence is consumed here rather than being mistaken for three
+# separate presses.
+cau_read_key() {
+	local k rest
+
+	IFS= read -rsn1 k || return 1
+
+	case "$k" in
+		$'\e')
+			if IFS= read -rsn2 -t 0.05 rest; then
+				case "$rest" in
+					'[A') printf 'up\n' ;;
+					'[B') printf 'down\n' ;;
+					'[C') printf 'right\n' ;;
+					'[D') printf 'left\n' ;;
+					*)    printf 'escape\n' ;;
+				esac
+			else
+				printf 'escape\n'
+			fi
+			;;
+		# Enter is an empty read in cooked mode and a carriage return in raw
+		# mode, depending on whether the terminal is translating it.
+		''|$'\r')      printf 'enter\n' ;;
+		$'\x7f'|$'\b') printf 'backspace\n' ;;
+		' ')           printf 'space\n' ;;
+		*)             printf '%s\n' "$k" ;;
+	esac
+}
+
+# cau_ui_read_line <initial>
+# A minimal line editor built on cau_read_key, with the result in
+# CAU_LINE_RESULT.
+#
+# This exists instead of bash's own `read -r` because mixing line mode into a
+# single-key interface breaks it: after one cooked-mode read the following
+# `read -sn1` stops receiving keystrokes entirely, reproducibly, on a real pty.
+# Never leaving single-character mode side-steps that completely.
+CAU_LINE_RESULT=''
+
+cau_ui_read_line() {
+	local buf="${1:-}" key
+
+	CAU_LINE_RESULT=''
+	printf '%s' "$buf"
+
+	while true; do
+		key="$(cau_read_key)" || { printf '\n'; return 1; }
+
+		case "$key" in
+			enter)
+				printf '\n'
+				CAU_LINE_RESULT="$buf"
+				return 0
+				;;
+			escape)
+				printf '\n'
+				return 1
+				;;
+			backspace)
+				if [[ -n $buf ]]; then
+					buf="${buf%?}"
+					printf '\b \b'
+				fi
+				;;
+			space)
+				buf+=' '
+				printf ' '
+				;;
+			up|down|left|right) ;;   # no cursor movement in this editor
+			*)
+				# a single printable character; control keys arrive as names
+				[[ ${#key} -eq 1 ]] || continue
+				buf+="$key"
+				printf '%s' "$key"
+				;;
+		esac
+	done
+}
+
+# Everything that can be changed without opening a text editor.
+# Format: Key|type|default|label-msgid
+# type is bool, choice:<space separated values>, or text.
+CAU_SETTINGS=(
+	"NotifyOnStart|bool|yes|Notify when an update starts"
+	"NotifyOnSuccess|bool|yes|Notify after a successful update"
+	"NotifyOnError|bool|yes|Notify when something goes wrong"
+	"NotifyReboot|bool|yes|Notify when a restart is needed"
+	"UpdateInterval|choice:6h 12h 1d 2d 1w|1d|Time between update runs"
+	"SkipWhenGaming|bool|yes|Postpone while a game is running"
+	"RequireAC|bool|no|Only update on mains power"
+	"MinBatteryPercent|choice:0 20 30 40 50 60 70 80|30|Minimum battery level (%)"
+	"UpdateAUR|bool|yes|Update AUR packages"
+	"UpdateFlatpak|bool|yes|Update Flatpaks"
+	"UpdateAppImages|bool|yes|Update AppImages"
+	"UpdateDevel|bool|no|Also rebuild -git packages"
+	"AURHelper|choice:auto paru yay pikaur|auto|AUR helper"
+	"AutoResolveConflicts|bool|yes|Resolve package conflicts automatically"
+	"CleanCache|bool|yes|Trim the package cache"
+	"KeepOldPackages|choice:0 1 2 3 5|3|Cached versions to keep"
+	"RemoveOrphans|bool|no|Remove packages nothing needs any more"
+	"IgnorePkg|text||Never update these packages"
+)
+
+_cau_is_true() {
+	case "${1,,}" in
+		yes|y|true|1|on|enabled) return 0 ;;
+		*) return 1 ;;
+	esac
+}
+
+# _cau_setting_display <type> <value>
+# Result in CAU_SETTING_SHOWN. The three constant strings are resolved once by
+# the caller into CAU_LBL_*; looking them up here would put a translation call
+# on the per-line path.
+CAU_SETTING_SHOWN=''
+CAU_LBL_ON=''
+CAU_LBL_OFF=''
+CAU_LBL_NONE=''
+
+_cau_setting_display() {
+	local type="$1" value="$2"
+
+	case "$type" in
+		bool)
+			if _cau_is_true "$value"; then
+				CAU_SETTING_SHOWN="${CAU_C_GREEN}${CAU_LBL_ON}${CAU_C_RESET}"
+			else
+				CAU_SETTING_SHOWN="${CAU_C_DIM}${CAU_LBL_OFF}${CAU_C_RESET}"
+			fi
+			;;
+		text)
+			if [[ -n $value ]]; then
+				CAU_SETTING_SHOWN="$value"
+			else
+				CAU_SETTING_SHOWN="${CAU_C_DIM}${CAU_LBL_NONE}${CAU_C_RESET}"
+			fi
+			;;
+		*) CAU_SETTING_SHOWN="$value" ;;
+	esac
+}
+
+# _cau_setting_cycle <type> <value> <direction: 1|-1>
+# The next value for this setting. Choices wrap around, so one key is enough to
+# reach everything without needing a second one for the other direction.
+_cau_setting_cycle() {
+	local type="$1" value="$2" dir="$3"
+
+	if [[ $type == bool ]]; then
+		_cau_is_true "$value" && printf 'no\n' || printf 'yes\n'
+		return
+	fi
+
+	local -a choices
+	read -r -a choices <<< "${type#choice:}"
+	(( ${#choices[@]} )) || { printf '%s\n' "$value"; return; }
+
+	local i idx=0
+	for i in "${!choices[@]}"; do
+		[[ ${choices[i]} == "$value" ]] && { idx=$i; break; }
+	done
+
+	idx=$(( (idx + dir + ${#choices[@]}) % ${#choices[@]} ))
+	printf '%s\n' "${choices[idx]}"
+}
+
+# cau_ui_settings
+# A cursor list rather than a numbered menu: there are eighteen settings, and
+# numbering them would run out of digits and force paging.
+#
+# The frame is assembled in memory and written once. Everything constant - the
+# specs, the translated labels, the clear sequence - is resolved before the
+# loop, and the values are re-read only after something actually changes.
+# Drawing the naive way cost a command substitution per label per frame, which
+# measured 435 ms per keypress: arrow keys felt like the console was reloading,
+# because in effect it was.
+cau_ui_settings() {
+	local count=${#CAU_SETTINGS[@]}
+	local -a names=() types=() defaults=() labels=()
+	local -a values=()
+	local spec name type default label locale i key frame row pad dirty=1 cursor=0
+
+	locale="$(cau_ui_locale)"
+	cau_msg_into "$locale" "ON";     CAU_LBL_ON="$CAU_MSG_RESULT"
+	cau_msg_into "$locale" "OFF";    CAU_LBL_OFF="$CAU_MSG_RESULT"
+	cau_msg_into "$locale" "(none)"; CAU_LBL_NONE="$CAU_MSG_RESULT"
+
+	for spec in "${CAU_SETTINGS[@]}"; do
+		IFS='|' read -r name type default label <<< "$spec"
+		names+=("$name"); types+=("$type"); defaults+=("$default")
+		cau_msg_into "$locale" "$label"
+		labels+=("$CAU_MSG_RESULT")
+	done
+
+	local title hint
+	cau_msg_into "$locale" "Settings"; title="$CAU_MSG_RESULT"
+	cau_msg_into "$locale" "Up/Down select - Space or Right changes - q goes back"
+	hint="$CAU_MSG_RESULT"
+
+	# the terminfo clear string, fetched once instead of forking per frame
+	local clearseq
+	clearseq="$(clear 2>/dev/null)" || clearseq=$'\033[H\033[2J'
+
+	while true; do
+		if (( dirty )); then
+			for i in "${!names[@]}"; do
+				_cau_config_lookup "${names[i]}" "${defaults[i]}"
+				values[i]="$CAU_CONFIG_VALUE"
+			done
+			dirty=0
+		fi
+
+		frame="$clearseq"$'\n'"${CAU_C_BOLD}${CAU_C_BLUE}  ${title}${CAU_C_RESET}"$'\n\n'
+
+		local marker selected="${CAU_C_BLUE}▸${CAU_C_RESET} "
+		for i in "${!names[@]}"; do
+			_cau_setting_display "${types[i]}" "${values[i]}"
+			pad=$(( 42 - ${#labels[i]} ))
+			(( pad < 0 )) && pad=0
+			if (( i == cursor )); then marker="$selected"; else marker='  '; fi
+			printf -v row '  %s%s%*s %s' \
+				"$marker" "${labels[i]}" "$pad" '' "$CAU_SETTING_SHOWN"
+			frame+="$row"$'\n'
+		done
+
+		frame+=$'\n'"  ${CAU_C_DIM}${hint}${CAU_C_RESET}"$'\n'
+		printf '%s' "$frame"
+
+		key="$(cau_read_key)" || return 0
+
+		type="${types[cursor]}"
+		name="${names[cursor]}"
+
+		case "$key" in
+			up|k)    cursor=$(( (cursor - 1 + count) % count )) ;;
+			down|j)  cursor=$(( (cursor + 1) % count )) ;;
+			space|enter|right|l)
+				if [[ $type == text ]]; then
+					cau_ui_edit_text "$name" "${values[cursor]}"
+				else
+					cau_config_set "$name" "$(_cau_setting_cycle "$type" "${values[cursor]}" 1)" \
+						|| { cau_bad "$(cau_msg "Could not write the configuration file.")"; cau_pause; }
+				fi
+				dirty=1
+				;;
+			left|h)
+				if [[ $type != text ]]; then
+					cau_config_set "$name" "$(_cau_setting_cycle "$type" "${values[cursor]}" -1)" \
+						|| { cau_bad "$(cau_msg "Could not write the configuration file.")"; cau_pause; }
+					dirty=1
+				fi
+				;;
+			q|Q|escape) return 0 ;;
+			*) ;;
+		esac
+	done
+}
+
+# cau_ui_edit_text <key> <current>
+# The one setting that is a free-text list rather than a choice.
+cau_ui_edit_text() {
+	local name="$1" current="$2"
+
+	printf '\n  %s\n' "$(cau_msg "Package names separated by spaces, empty to clear:")"
+	printf '  > '
+
+	# pre-filled with the current value so it can be corrected rather than
+	# retyped; Escape leaves it unchanged
+	if cau_ui_read_line "$current"; then
+		cau_config_set "$name" "$CAU_LINE_RESULT" \
+			|| { cau_bad "$(cau_msg "Could not write the configuration file.")"; cau_pause; }
+	fi
+}
+
 # _cau_row <label> <value>
 # printf's %-28s pads by bytes, so a label containing "ü" comes out one column
 # short. ${#s} counts characters in a UTF-8 locale, so the padding is computed
@@ -81,12 +392,23 @@ cau_ui_status() {
 		printf '\n  %s%s%s\n' "$CAU_C_YELLOW" \
 			"$(cau_msg "The last run reported a problem - see 'cachy-auto-update log'.")" \
 			"$CAU_C_RESET"
+	elif [[ $result == interrupted ]]; then
+		printf '\n  %s%s%s\n' "$CAU_C_YELLOW" \
+			"$(cau_msg "The last run was stopped before it finished.")" \
+			"$CAU_C_RESET"
 	fi
 	if [[ $reboot == 1 ]]; then
 		printf '\n  %s%s%s\n' "$CAU_C_YELLOW" \
 			"$(cau_msg "A restart is recommended to finish a kernel update.")" \
 			"$CAU_C_RESET"
 	fi
+
+	local held
+	held="$(cau_state_read held_back '')"
+	if [[ -n $held ]]; then
+		printf '\n  %s%s%s\n' "$CAU_C_YELLOW" \
+			"$(cau_msg "Held back: %s" "$held")" "$CAU_C_RESET"
+	fi
 }

 # cau_ui_status_conditions
@@ -130,6 +452,10 @@ cau_ui_status_conditions() {
 cau_ui_menu() {
 	local choice

+	cau_ui_term_raw
+	# restore the terminal even if this exits through Ctrl-C or an error
+	trap 'cau_ui_term_restore' EXIT INT TERM
+
 	while true; do
 		cau_config_load

@@ -142,34 +468,59 @@ cau_ui_menu() {
 		printf '  [3] %s\n' "$(cau_msg "Update now")"
 		printf '  [4] %s\n' "$(cau_msg "Show log")"
 		printf '  [5] %s\n' "$(cau_msg "Show current conditions")"
+		printf '  [6] %s\n' "$(cau_msg "Settings")"
 		printf '  [q] %s\n' "$(cau_msg "Quit")"
 		printf '\n  > '

-		read -r choice || { printf '\n'; return 0; }
-
+		# One keypress, no Enter. A failing read means EOF (Ctrl-D, or a
+		# script piping input), which quits.
+		choice="$(cau_read_key)" || {
+			printf '\n'; cau_ui_term_restore; trap - EXIT INT TERM; return 0
+		}
 		case "$choice" in
+			enter|space|up|down|left|right|escape) choice='' ;;
+		esac
+		printf '%s\n' "$choice"
+
+		# Actions run in normal line mode: they print program output and some
+		# of them prompt, neither of which behaves in raw mode.
+		case "$choice" in
+			# The two switches flip and return straight to the menu, where the
+			# status block shows the result. Only a warning or an error holds
+			# the screen (see CAU_UI_NEEDS_ACK).
 			1)
-				if [[ $CFG_ENABLED == yes ]]; then cau_do_disable; else cau_do_enable; fi
-				cau_pause
+				CAU_UI_NEEDS_ACK=''
+				if [[ $CFG_ENABLED == yes ]]; then
+					cau_ui_cooked cau_do_disable
+				else
+					cau_ui_cooked cau_do_enable
+				fi
+				if [[ -n $CAU_UI_NEEDS_ACK ]]; then cau_pause; fi
 				;;
 			2)
+				CAU_UI_NEEDS_ACK=''
 				if [[ $CFG_NOTIFICATIONS == yes ]]; then
-					cau_do_notifications off
+					cau_ui_cooked cau_do_notifications off
 				else
-					cau_do_notifications on
+					cau_ui_cooked cau_do_notifications on
 				fi
-				cau_pause
+				if [[ -n $CAU_UI_NEEDS_ACK ]]; then cau_pause; fi
 				;;
-			3) cau_do_run --force; cau_pause ;;
-			4) cau_do_log; cau_pause ;;
+			3) cau_ui_cooked cau_do_run --force; cau_pause ;;
+			4) cau_ui_cooked cau_do_log; cau_pause ;;
 			5) cau_ui_status_conditions; cau_pause ;;
-			q|Q|'') return 0 ;;
+			6) cau_ui_settings ;;
+			q|Q) cau_ui_term_restore; trap - EXIT INT TERM; return 0 ;;
+			# Anything else - Enter, arrow keys, stray characters - just
+			# redraws. Escape is deliberately not a quit key, so a mistyped
+			# arrow key cannot close the menu.
 			*) ;;
 		esac
 	done
 }

 cau_pause() {
-	printf '\n  %s' "$(cau_msg "Press Enter to continue...")"
-	read -r _ || true
+	printf '\n  %s' "$(cau_msg "Press any key to continue...")"
+	read -rsn1 _ || true
+	printf '\n'
 }
@@ -19,10 +19,23 @@ CAU_NOTIFY_QUEUE_MAX=20
 # Never fails: a machine without libnotify, or with nobody logged in, is a
 # normal state, not an error.
 cau_notify() {
-	local urgency="$1" title="$2" body="$3"
-	shift 3
+	cau_notify_tagged '' yes "$@"
+}
+
+# cau_notify_tagged <tag> <queue: yes|no> <urgency> <title> <body> [args...]
+#
+# A tag makes this notification replace the previous one carrying the same tag
+# rather than stacking a second bubble beside it - that is what turns
+# "installing updates" into "system updated" in place instead of leaving two
+# messages that contradict each other.
+#
+# queue=no is for messages that only mean anything while somebody is looking.
+# Telling a user at next login that an update started an hour ago is noise.
+cau_notify_tagged() {
+	local tag="$1" queue="$2" urgency="$3" title="$4" body="$5"
+	shift 5
 	local -a args=("$@")
-	local delivered=0 user uid locale t b
+	local delivered=0 user uid locale t b prev newid

 	[[ $CFG_NOTIFICATIONS == yes ]] || return 0

@@ -34,17 +47,28 @@ cau_notify() {
 		t="$(cau_msg_in "$locale" "$title")"
 		b="$(cau_msg_in "$locale" "$body" "${args[@]}")"

-		if cau_as_user "$user" "$uid" notify-send \
+		prev=0
+		if [[ -n $tag ]]; then
+			prev="$(cau_state_read "notify_id_${tag}_${user}" 0)"
+			[[ $prev =~ ^[0-9]+$ ]] || prev=0
+		fi
+
+		if newid="$(cau_as_user "$user" "$uid" notify-send \
 			--app-name="$CAU_PRETTY" \
 			--icon="$CAU_NOTIFY_ICON" \
 			--urgency="$urgency" \
-			-- "$t" "$b" 2>/dev/null
+			--print-id --replace-id="$prev" \
+			-- "$t" "$b" 2>/dev/null)"
 		then
 			delivered=1
+			if [[ -n $tag && $newid =~ ^[0-9]+$ ]]; then
+				cau_state_write "notify_id_${tag}_${user}" "$newid"
+			fi
 		fi
 	done < <(cau_active_session_users)

 	(( delivered )) && return 0
+	[[ $queue == yes ]] || return 0

 	cau_notify_enqueue "$urgency" "$title" "$body" "${args[@]}"
 }
@@ -63,7 +63,10 @@ cau_flatpak_update() {
 		fi
 	done < <(cau_human_users)

-	if [[ $CFG_CLEAN_CACHE == yes ]]; then
+	# Unused runtimes are the Flatpak equivalent of orphaned packages - this is
+	# removal of installed software, not cache trimming, so it belongs behind
+	# RemoveOrphans rather than CleanCache.
+	if [[ $CFG_REMOVE_ORPHANS == yes ]]; then
 		cau_run_logged flatpak uninstall --system --unused --noninteractive --assumeyes || true
 	fi

@@ -10,15 +10,40 @@
 CAU_PACMAN_COUNT=0
 CAU_PACMAN_PENDING=''

+# Packages that had to be skipped so the rest of the upgrade could go through.
+CAU_PACMAN_HELD=''
+
 # Base flags for every unattended pacman invocation.
 cau_pacman_flags() {
-	printf '%s\n' --noconfirm --color never --noprogressbar --disable-download-timeout
+	printf '%s\n' --noconfirm --color never --disable-download-timeout
+
+	# A progress bar is worth having when somebody is watching a `run` from a
+	# terminal; in the timer's log it is only carriage-return noise.
+	[[ -n $CAU_INTERACTIVE ]] || printf '%s\n' --noprogressbar
+
 	local pkg
 	for pkg in $CFG_IGNORE_PKG; do
 		printf '%s\n' --ignore "$pkg"
 	done
 }

+# _cau_pacman_exec <logfile> <pacman args...>
+# Captures pacman's output for classification, and streams it as well when a
+# person is watching. Upgrading a few hundred packages takes minutes; without
+# this an interactive run shows one line and then nothing at all, which is
+# indistinguishable from a hang and invites someone to kill it mid-transaction.
+_cau_pacman_exec() {
+	local log="$1"
+	shift
+
+	if [[ -n $CAU_INTERACTIVE ]]; then
+		pacman "$@" 2>&1 | tee "$log"
+		return "${PIPESTATUS[0]}"
+	fi
+
+	pacman "$@" > "$log" 2>&1
+}
+
 # cau_pacman_pending
 # Fills CAU_PACMAN_PENDING and returns 1 when there is nothing to do.
 cau_pacman_pending() {
@@ -55,6 +80,8 @@ _cau_pacman_classify() {

 	if grep -qiE 'are in conflict|unresolvable package conflicts' "$log"; then
 		printf 'conflict\n'
+	elif grep -qiE 'could not satisfy dependencies|breaks dependency|unable to satisfy dependency' "$log"; then
+		printf 'dependency\n'
 	elif grep -qiE 'signature from .* is (unknown trust|marginal trust|invalid)|invalid or corrupted package \(PGP signature\)|key ".*" is unknown|keyring is not writable' "$log"; then
 		printf 'keyring\n'
 	elif grep -qiE 'exists in filesystem' "$log"; then
@@ -64,6 +91,25 @@ _cau_pacman_classify() {
 	fi
 }

+# _cau_pacman_blockers <logfile>
+# The packages standing in the way of an otherwise fine upgrade. pacman names
+# them in its dependency errors:
+#
+#   :: removing libperconaserverclient breaks dependency 'libperconaserverclient'
+#      required by heidisql-qt6-bin
+#   :: unable to satisfy dependency 'foo' required by bar
+#
+# In the first form the package being removed is the one to keep; in the second
+# it is the package that cannot be installed.
+_cau_pacman_blockers() {
+	local log="$1"
+
+	{
+		sed -nE "s/.*removing ([^ ]+) breaks dependency.*/\\1/p" "$log"
+		sed -nE "s/.*unable to satisfy dependency '[^']*' required by ([^ ]+).*/\\1/p" "$log"
+	} | grep -E '^[A-Za-z0-9@._+-]+$' | sort -u
+}
+
 # cau_pacman_update
 # Returns 0 on success (including "nothing to do"), 1 on a failure the user
 # needs to hear about. CAU_PACMAN_COUNT holds how many packages moved.
@@ -87,11 +133,34 @@ cau_pacman_update() {
 		cau_info "Running a full system upgrade (pending list unavailable)"
 	fi

+	# Say so before the transaction starts, not after it finishes.
+	#
+	# While an upgrade runs, a shutdown request is refused by logind and the
+	# desktop answers with a polkit password prompt reading "Power off the
+	# system while an application is inhibiting this" - which never mentions
+	# updates and, on a German system, is not even translated. Somebody who was
+	# simply told beforehand does not end up staring at that.
+	if [[ $CFG_NOTIFY_START == yes ]]; then
+		cau_notify_tagged run no normal \
+			"Installing updates" \
+			"%d packages are being updated. Please leave the computer switched on until this is done." \
+			"${CAU_PACMAN_COUNT:-0}"
+	fi
+
 	mapfile -t flags < <(cau_pacman_flags)
 	log="$(mktemp)" || return 1

-	if pacman -Syu "${flags[@]}" > "$log" 2>&1; then
+	# Recovery loop rather than a single retry: fixing one problem regularly
+	# uncovers the next (a conflict resolved into a dependency error, say).
+	# Each remedy is applied at most once, so this always terminates.
+	local -a extra=() blockers=() tried=()
+	local attempt=0 b
+
+	while true; do
+		if _cau_pacman_exec "$log" -Syu "${flags[@]}" "${extra[@]}"; then
 			cat "$log" >> "$CAU_RUNLOG" 2>/dev/null
+			grep -E '^(removing|replacing) ' "$log" 2>/dev/null \
+				| while read -r line; do cau_info "  $line"; done
 			rm -f "$log"
 			return 0
 		fi
@@ -100,6 +169,11 @@ cau_pacman_update() {
 		kind="$(_cau_pacman_classify "$log")"
 		cau_warn "pacman -Syu failed ($kind)"

+		if (( ++attempt > 3 )) || [[ " ${tried[*]} " == *" $kind "* ]]; then
+			break
+		fi
+		tried+=("$kind")
+
 		case "$kind" in
 			keyring)
 				# A stale keyring is the one failure that is always safe to fix
@@ -111,12 +185,6 @@ cau_pacman_update() {
 				if (( ${#keyrings[@]} )); then
 					cau_run_logged pacman -Sy --noconfirm --color never "${keyrings[@]}" || true
 				fi
-			if pacman -Syu "${flags[@]}" > "$log" 2>&1; then
-				cat "$log" >> "$CAU_RUNLOG" 2>/dev/null
-				rm -f "$log"
-				return 0
-			fi
-			cat "$log" >> "$CAU_RUNLOG" 2>/dev/null
 				;;

 			conflict)
@@ -126,18 +194,29 @@ cau_pacman_update() {
 				# question bitmask: 4 = CONFLICT_PKG, 16 = REMOVE_PKGS.
 				if [[ $CFG_RESOLVE_CONFLICTS != yes ]]; then
 					cau_error "Package conflict requires a decision (AutoResolveConflicts is off)"
-				rm -f "$log"
-				return 1
+					break
 				fi
 				cau_info "Resolving package conflicts automatically and retrying"
-			if pacman -Syu "${flags[@]}" --ask=20 > "$log" 2>&1; then
-				cat "$log" >> "$CAU_RUNLOG" 2>/dev/null
-				grep -E '^(removing|replacing) ' "$log" 2>/dev/null \
-					| while read -r line; do cau_info "  $line"; done
-				rm -f "$log"
-				return 0
+				extra+=(--ask=20)
+				;;
+
+			dependency)
+				# Something installed still depends on a package the repos want
+				# to drop or replace - almost always an AUR package that has not
+				# caught up yet. Nothing here can fix that, and it is not worth
+				# failing over: letting one stuck package block every other
+				# update indefinitely is far worse on an unattended machine.
+				# Hold the blockers back and upgrade everything else.
+				mapfile -t blockers < <(_cau_pacman_blockers "$log")
+				if (( ${#blockers[@]} == 0 )); then
+					cau_error "Dependency problem with no package to hold back"
+					break
 				fi
-			cat "$log" >> "$CAU_RUNLOG" 2>/dev/null
+				for b in "${blockers[@]}"; do
+					extra+=(--ignore "$b")
+				done
+				CAU_PACMAN_HELD="${blockers[*]}"
+				cau_warn "Holding back ${blockers[*]} and retrying without them"
 				;;

 			filesystem)
@@ -145,13 +224,18 @@ cau_pacman_update() {
 				# silently clobber something the user put there deliberately, so
 				# this one stays a human decision.
 				cau_error "Files on disk conflict with the update; manual review needed"
-			rm -f "$log"
-			return 1
+				break
+				;;
+
+			*)
+				break
 				;;
 		esac
+	done

 	rm -f "$log"
 	CAU_PACMAN_COUNT=0
+	CAU_PACMAN_HELD=''
 	return 1
 }

@@ -184,7 +268,14 @@ cau_pacman_cleanup() {
 	fi

 	if [[ $CFG_CLEAN_CACHE == yes ]] && cau_have paccache; then
-		cau_info "Trimming the package cache"
+		# paccache's dry run reports what a real run would reclaim; logging it
+		# first is the only way to tell afterwards whether trimming is doing
+		# anything, since the real run says little.
+		local reclaim
+		reclaim="$( { paccache -d --nocolor -k"$CFG_KEEP_OLD"; paccache -du --nocolor -k0; } 2>&1 \
+			| grep -oE 'disk space saved: [^)]*' | paste -sd', ' -)"
+
+		cau_info "Trimming the package cache (keeping $CFG_KEEP_OLD old version(s))${reclaim:+ - $reclaim}"
 		cau_run_logged paccache -r --nocolor -k"$CFG_KEEP_OLD"  || cau_warn "paccache -r failed"
 		cau_run_logged paccache -ru --nocolor -k0               || cau_warn "paccache -ru failed"
 	fi
Author	SHA1	Message	Date
Felitendo	a17aed4b3d	Lower the battery threshold to 30% and default the cachy-update prompt to yes The prompt offering to silence cachy-update's own update notification now defaults to yes: once updates install themselves that notification is nothing but noise, so the common answer should be the one you get by pressing Enter. It also accepts "j" now. The prompt is translated, so a German user reads "[J/n]" and types the German letter - which the old check for "y" alone silently read as a refusal.	2026-08-08 16:30:20 +02:00
Felitendo	2fa830284e	Make the settings screen redraw 50x faster Arrow-key navigation took 435 ms per keypress, which reads as the whole console reloading on every press - because it effectively was. The cost was forks: each frame ran a command substitution per label for the value, the translation and the rendered state, 54 subshells for eighteen rows. The frame is now assembled in memory and written once. Translations, the split specs and the terminfo clear string are resolved before the loop; values are re-read only after something actually changes, not on cursor movement. Helpers on that path assign to a variable instead of printing, since printing is what forced the substitution. Measured on the same machine: 435 ms -> 7.5 ms per keypress.	2026-08-08 16:25:09 +02:00
Felitendo	c308b7e286	Add a settings screen so nothing needs a text editor All eighteen options are now reachable from the menu as a cursor list: arrows select, Space or Right cycles a value, q goes back, changes are written immediately. A numbered menu would have run out of digits. Three real bugs surfaced while building it, each found by testing against an actual pty rather than a pipe: - Labels went through printf as format strings, so the percent sign in "Minimum battery level (%)" was an invalid conversion. cau_msg_in now only treats a message as a format string when arguments were actually passed - otherwise any literal % a translator writes is a trap. - Mixing bash's line-mode read into a single-key interface left the following read -sn1 receiving nothing at all, reproducibly, so the screen froze after editing the package list. Replaced with a small line editor built on the same single-character reader. - Backspace was being swallowed: in canonical mode DEL is the ERASE character and the line discipline consumes it, and bash returns to canonical mode between each read -sn1. The interface now holds non-canonical mode for its whole lifetime and hands the terminal back only around actions that print or prompt, with a trap restoring it on Ctrl-C. Translations and config reads are memoized; the screen redraws every label on every keypress and a fork per lookup was the reason the redraw was slow enough to matter.	2026-08-08 16:18:59 +02:00
Felitendo	2eff62f9fd	Say an update is running before it starts, not only after Asked what happens if someone shuts the laptop down mid-update, the honest answer turned out to be poor. The inhibitor does stop them - logind refuses and falls back to org.freedesktop.login1.power-off-ignore-inhibit, which is auth_admin_keep - so the desktop answers with an administrator password prompt reading "Power off the system while an application is inhibiting this". systemd ships that string untranslated, it never mentions updates, and no KDE catalog contains any shutdown-blocked text at all. Only systemctl names the reason. So a notification now goes out before the transaction, asking for the machine to be left on. Notifications gained a tag: the result replaces the start message in place rather than stacking a second, contradictory bubble beside it. Tagged notifications also carry a queue flag. "An update is starting" is only meaningful while somebody is looking, so unlike the result it is not spooled for delivery at next login.	2026-08-08 15:48:55 +02:00
Felitendo	0f91a79ba6	Recover from a pacman lock left behind by a power cut A machine switched off mid-update leaves /var/lib/pacman/db.lck behind. Nothing removed it, so every subsequent run deferred on it - one power cut would have stopped updates permanently and silently, which on an unattended machine is the worst outcome there is. A lock older than the current boot is provably abandoned: no process that could hold it still exists. Those are now removed and the interrupted upgrade is repeated, with pacman reinstalling anything caught half-written. A lock that is merely unheld within the same boot stays untouched and is only reported, since removing it could corrupt a live transaction; the boot-time test is what makes the difference between a proof and a guess. A fuser check is kept alongside it so a backwards clock jump cannot make a live lock look abandoned. Documented what each layer can actually promise: suspend and normal shutdown are blocked by the existing inhibitor, a hard power-off cannot be prevented by anything, and snap-pac's pre/post snapshots remain the backstop.	2026-08-08 15:40:07 +02:00
Felitendo	6514c4d859	Trim the package cache by default, and split it from orphan removal CleanCache was off, so nothing ever pruned /var/cache/pacman/pkg - 23 GB on the machine this was found on, with three 3.2 GB copies of one package. Trimming only drops older versions of installed packages and cached versions of uninstalled ones, so the cost is downgrade depth, not working software. flatpak uninstall --unused moves from CleanCache to RemoveOrphans, where it belongs: unused runtimes are the Flatpak equivalent of orphaned packages, and removing installed software should not hide behind a flag named for cache trimming. RemoveOrphans stays off - 'orphaned' only means nothing depends on it, which is also true of something installed deliberately. The log now reports what a trim reclaimed, since a real paccache run says almost nothing and there was otherwise no way to tell it was working.	2026-08-08 15:33:03 +02:00
Felitendo	243115ea19	Show what a run is doing, and record when one is cut short A run that held back a blocker then upgraded 214 packages printed one line and then nothing for nearly five minutes while pacman downloaded and installed. It looked hung, so it got killed - during pacman's uninterruptible commit phase, which meant the packages landed but our bookkeeping never did. The menu then kept showing a failure from a previous run on a fully up-to-date machine. pacman, the AUR helper and flatpak now stream their output when a person is watching, and the progress bar is left enabled for that case. Timer runs are unchanged: quiet, --noprogressbar, everything captured in the log. Interactivity is decided once at startup rather than tested at the point of use. cau_pacman_flags runs inside a process substitution, so its stdout is always a pipe and a -t 1 check there would have silently always been false. INT/TERM/HUP now record last_result=interrupted, so a run that is stopped says so instead of leaving the previous verdict standing.	2026-08-08 15:24:42 +02:00
Felitendo	9fd2458d20	Hold back blocking packages instead of failing the whole upgrade A repo package that replaces something an installed AUR package still depends on aborted the entire transaction, and would have done so on every subsequent run - one stale AUR package was enough to cut a machine off from all updates indefinitely. Observed in the wild: percona-server-clients replaces libperconaserverclient without providing it, while heidisql-qt6-bin hard-depends on it, blocking 213 unrelated package updates. pacman names the offending package in its dependency errors, so it is now extracted and passed to --ignore for one retry: the other 213 packages go through and the blocker is reported. The hold is per-run, never written to IgnorePkg, so it disappears by itself once upstream catches up. The single retry is also now a bounded recovery loop, because fixing one problem regularly uncovers the next - a conflict resolved with --ask=20 can surface a dependency error behind it. Each remedy is applied at most once. The held-back set is shown in the menu and notified only when it changes, so a blocker waiting on an upstream fix does not produce the same message daily.	2026-08-08 15:12:43 +02:00
Felitendo	f593cc1933	Menu: flip the switches without asking for a keypress Toggling automatic updates or notifications returned to a 'press any key' prompt for no reason - the status block at the top of the menu already shows the new state. cau_bad and cau_note now flag that they printed something, so the acknowledgement only appears when there is genuinely something to read (a failed sudoers check, a missing AUR helper) instead of after every toggle.	2026-08-08 15:05:38 +02:00
Felitendo	20fbadbc95	Menu: act on a single keypress instead of waiting for Enter Also stops Enter from quitting the menu (it used to share the quit branch with q) and swallows the tail of an escape sequence, so one arrow key redraws once rather than three times and never closes the menu.	2026-08-08 14:58:28 +02:00