System Updates & Snapshot Rollback

Linxira OS is a rolling release: security patches become available as soon as upstream publishes them, with no release cycle to wait for. The safety net is automatic too — the system quietly checks for updates every hour, a Timeshift snapshot is created before every pacman transaction, and if anything breaks, picking the snapshot entry in the GRUB menu at reboot rolls you back. This page covers everyday use of that machinery, plus the optional fully-automatic update switch EnableAutoApply.

1. Automatic Checks: On by Default, Hands-Free

No "update manager" needs installing after setup — the check mechanism ships with the linxira-update package and activates itself:

• Enabled at first login: the package ships a systemd user preset (/usr/lib/systemd/user-preset/80-linxira-update.preset), so linxira-update.timer is enabled automatically the first time you log in.
• Cadence: first check 2 minutes after boot, then hourly; Persistent=true means checks missed while powered off are caught up at next boot.
• What it does: each run executes linxira-update --check, which calls checkupdates underneath (120 s timeout, hard failures retried once). It only queries — nothing is installed.
• Result on disk: the outcome is atomically written to ~/.local/state/linxira-update/status.json.
• Three surfaces, one file: the Welcome update card, the tray icon, and desktop notifications (notify-send) all read that file — no second query is made.

To check once manually:

linxira-update --check

Fields of status.json (version 1):

2. Ways to Update

linxira-update

Scope and Boundaries

• By default all configured pacman repositories are updated: the signed [linxira] repo plus Arch core/extra — one full upgrade, no partial upgrades.
• AUR and Flatpak are left alone by default; both require explicit opt-in in the config (EnableAUR / EnableFlatpak).
• First-party linxira-* packages are never handed to AUR helpers — they come only from the signed repository.
• If a package's origin cannot be determined, the check is recorded as incomplete rather than falsely claiming "up to date".

3. Snapshots: Automatic Before Every pacman Transaction

The system ships the pacman hook /etc/pacman.d/hooks/linxira-timeshift-autosnap.hook: it fires in the PreTransaction phase, matches Upgrade/Install/Remove on target * — meaning any pacman transaction (a system upgrade, installing a component, even a hand-typed pacman -R) runs timeshift --create --tags O to record the current state before touching the system.

• Near-zero cost: btrfs snapshots are copy-on-write — initially they take almost no space, and afterwards only modified data produces deltas.
• Automatic pruning: the 20 most recent snapshots are kept; older ones are cleaned up without manual attention.
• Soft gating (intentional): if Timeshift is not configured (no /etc/timeshift/timeshift.json) the hook silently skips; a failed snapshot also does not block the transaction — a non-zero PreTransaction exit would abort the whole transaction, and making a safety net a hard dependency would turn it into a single point of failure.

Scheduled Snapshots

Beyond "before every transaction" there are periodic snapshots on a time/boot schedule. The installer enables them automatically at install time (btrfs mode, 3 daily + 3 per boot); at runtime linxira-config manages them, driving the same idempotent script used by the installer:

linxira-config timeshift status    # current configuration
linxira-config timeshift enable    # enable (idempotent)
linxira-config timeshift disable   # disable

4. When Something Breaks: Reboot and Pick a Snapshot in GRUB

Snapshots are not decorative: the grub-btrfsd service (--timeshift-auto mode) watches Timeshift snapshots and generates matching GRUB boot entries, and grub-btrfs-overlayfs is present in the mkinitcpio HOOKS so snapshot entries boot through a read-only overlay.

5. Fully-Automatic Updates: EnableAutoApply (Off by Default)

This removes even the "click to confirm" step — once updates are found, "snapshot → full upgrade" runs by itself. The switch is off by default; it suits machines on stable networks that should stay current unattended.

How to Enable

Edit ~/.config/linxira-update/linxira-update.conf and add a bare key on its own line (same style as EnableAUR):

EnableAutoApply

Remove the line to return to the default (off).

Hard Gates: All Four Must Pass Before the System Is Touched

When --check finds updates and the switch is on, gating runs first and all of the following must hold:

1. The root filesystem is btrfs;
2. /etc/timeshift/timeshift.json exists (Timeshift is configured);
3. the mkinitcpio HOOKS contain grub-btrfs-overlayfs (snapshots are bootable);
4. the grub-btrfsd unit is enabled (snapshots reach the GRUB menu).

Only then: an explicit snapshot is created and verified → a non-interactive full upgrade runs (pacman -Syu --noconfirm) → the snapshot ID is written to pre_snapshot_id in status.json.

Refusal and Fallback

If any gate fails, or the snapshot cannot be created, the automatic apply is refused for that run: behavior stays "check and notify only", and status.json records auto_apply: false with the reason. No snapshot, no system changes — a hard rule with no exception path.

• Non-btrfs is unsupported by construction: server mode, WSL, and ext4 installs are rejected by the gates and stay on manual updates.
• Automatic apply never touches AUR/Flatpak and never performs whitelisted partial upgrades — Arch discipline: upgrade everything or nothing; problems caused by partial upgrades are out of scope.

Command Cheat Sheet

Related pages: the installation guide (btrfs + Timeshift partitioning scheme), Official Apps (linxira-update and the other first-party tools), Config Hub (the timeshift subcommands), and the blog post Btrfs Snapshots & Rollback (design rationale and drill suggestions).