improve version and mirror updating

README.md

@@ -170,13 +170,14 @@ The installer adds the Vulkan driver for Intel and AMD GPUs, and Intel's video d
 Besides installing software, CoreDesktop changes these settings. They're listed so you know what you're running, and so you can undo them (see "Uninstalling").
 
 - **/etc/pacman.conf**: adds the `[federated]` repository and trusts its signing key (see Pacman above).
+- **Mirrors**: reflector rewrites /etc/pacman.d/mirrorlist once a week with fast HTTPS mirrors that synced with Arch in the last 12 hours, using /etc/xdg/reflector/reflector.conf. To choose your own mirrors, delete that file's first (CoreDesktop) line and edit the rest; to stop CoreDesktop changing your mirrors at all, add `reflector` to ~/.config/coredesktop/skip-packages.
 - **SSH**: sshd is on, with key login only (/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf). The SSH client keepalives are in /etc/ssh/ssh_config.d/20-coredesktop-keepalive.conf.
 - **Firewall**: ufw is on, with the rules under Firewall above, and ufw-docker's rules in /etc/ufw/after.rules.
 - **Login lockout**: deny and unlock_time in /etc/security/faillock.conf.
 - **systemd**: a 10-second stop timeout (/etc/systemd/system.conf.d/ and /etc/systemd/user.conf.d/10-coredesktop-timeout.conf), systemd-oomd for apps (/etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf), and NetworkManager-wait-online is masked.
 - **/etc/security/pam_env.conf**: a PATH line, so SSH commands find ~/.local/bin and mise.
 - **mDNS**: Avahi is on, nss-mdns is added to /etc/nsswitch.conf, and SSH is advertised in /etc/avahi/services/ssh.service.
-- **Services turned on**: Avahi, Bluetooth, CUPS (printing), fwupd, GDM, NetworkManager, sshd, Docker, Tailscale, ufw and systemd-oomd. Your user is added to the docker group.
+- **Services turned on**: Avahi, Bluetooth, CUPS (printing), fwupd, GDM, NetworkManager, reflector (weekly), sshd, Docker, Tailscale, ufw and systemd-oomd. Your user is added to the docker group.
 - **Snapper** (btrfs only): a config for / in /etc/snapper/configs/root.
 - **NVIDIA** (only if it installs the driver): /etc/mkinitcpio.conf.d/nvidia.conf and NVIDIA's suspend services.
 - **Your home folder**: lines in ~/.bashrc (CoreDesktop's shell setup, ~/.local/bin on PATH, the Bitwarden SSH agent), the commands in ~/.local/bin (update, refresh, sibling, version, configure, audit), GNOME extensions and their settings, Claude Code's ~/.claude/settings.json if you had none, a user timer that checks for updates, and a user service that pauses your Core's email if its password stops working (see Configure).
@@ -196,6 +197,7 @@ The script pulls the latest CoreDesktop, then runs each step in ~/.local/share/c
 
 - stops if there's less than 10 GiB free on / (run `UPDATE_FORCE=1 update` to skip the check)
 - snapshots / first, if Snapper is set up (see Snapshots above)
+- switches to up-to-date mirrors first if yours is more than a day behind Arch, as it would otherwise miss new packages without saying so
 - updates the Arch keyring, then Arch and GNOME, then AUR packages, Flatpaks, the languages you installed with mise, the pipx apps CoreDesktop installs, GNOME extensions and firmware
 - warns you not to reboot if the initramfs failed to rebuild
 - runs any one-time migrations, the way existing machines pick up new CoreDesktop setup
@@ -232,7 +234,7 @@ Video driver Mesa 26.2.6
 Last update  2026-10-22 13:43
 ```
 
-The kernel and video driver (NVIDIA's if it's installed, otherwise Mesa, which drives Intel and AMD graphics) come from Arch, so they're shown separately. "version" tells you if Arch has a newer kernel or video driver, or if a newer version of CoreDesktop is available; "update" installs them. If a newer kernel is waiting for a reboot, it says that too.
+The kernel and video driver (NVIDIA's if it's installed, otherwise Mesa, which drives Intel and AMD graphics) come from Arch, so they're shown separately. "version" tells you if Arch has a newer kernel or video driver, or if a newer version of CoreDesktop is available; "update" installs them. If a newer kernel is waiting for a reboot, it says that too. It can only see what your package mirror has, so if the mirror is more than a day behind Arch it warns you; "update" then switches to up-to-date mirrors.
 
 You don't have to check by hand: a few minutes after you log in, and every few hours after that, CoreDesktop checks for a new version and shows a notification if there is one. Click it to run "update" in a terminal, or dismiss it. Once dismissed, you won't be notified again until there's an even newer version.