DevSecNinja · DevSecNinja · Aug 13, 2026
diff --git a/config/build.config.psd1 b/config/build.config.psd1
@@ -46,9 +46,7 @@
         LocalAccountName = 'Admin'        # local account username (no password stored in the file)
         Locale           = 'en-US'        # UI / system language (kept English (United States))
         UserLocale       = 'nl-NL'         # region format for dates/times/numbers = Dutch (Netherlands)
-        # KeyboardLayout: input locale. Left unset so the profile-driven default applies:
-        #   most profiles => '0409:00000409' (US); the 'opinionated' profile => '0409:00020409'
-        #   (United States-International, so English (US) types on US-International). Uncomment to pin.
+        # KeyboardLayout: input locale. Left unset to use '0409:00000409' (US). Uncomment to pin.
         # KeyboardLayout   = '0409:00000409'
         TimeZone         = 'W. Europe Standard Time' # Amsterdam (UTC+01:00, DST-aware)
         DiskId           = 0              # target disk for the default single-partition layout

diff --git a/config/catalog.registry.psd1 b/config/catalog.registry.psd1
diff --git a/docs/autounattend.md b/docs/autounattend.md
@@ -34,7 +34,7 @@ Autounattend = @{
     LocalAccountName   = 'Admin'        # username (NO password is stored in the file)
     Locale             = 'en-US'        # UI / system language
     UserLocale         = 'en-US'        # region format (dates/times/numbers); defaults to Locale
-    KeyboardLayout     = '0409:00000409'  # input locale; 'opinionated' profile defaults to '0409:00020409' (US-International)
+    KeyboardLayout     = '0409:00000409'  # input locale; set explicitly to choose another layout
     TimeZone           = 'UTC'          # e.g. 'W. Europe Standard Time'
     ProductKey         = ''             # edition selector (see below)
     DiskId             = 0
@@ -165,11 +165,9 @@ the consumer ISO, or a business edition (Pro, Education, ...) off a business/vol
 `-Profile`, and `-Hypervisor` (`HyperV` | `VMware`) overrides, so you can test the hands-off path with
 `-Edition Home -UseGenericProductKey` and do a keyed build with `-ProductKey '<your-key>'`. Use
 `-Hypervisor VMware` to run the quick boot test under VMware Workstation (NAT-connected, real DNS).
-`-Profile` accepts one or more profiles (e.g.
-`-Profile gaming,opinionated`);
-because a quick boot test reuses the already-serviced `media\` folder it does **not** re-run debloat,
-but it re-derives the answer file, so profile-driven `Autounattend` settings (such as the opinionated
-United States-International keyboard) are reflected in the boot test.
+`-Profile` accepts one or more profiles (e.g. `-Profile gaming,opinionated`). Because a quick boot
+test reuses the already-serviced `media\` folder it does **not** re-run debloat; it only re-derives
+the answer file from the resolved configuration.
 
 To boot-test several editions at once, pass `-Isolated` to each parallel window. Isolated runs get a
 uniquely-named `Autounattend-<tag>.xml` and ISO, and ISO authoring is serialized with a named mutex

diff --git a/docs/change-rationale.md b/docs/change-rationale.md
@@ -29,7 +29,7 @@ explains the model and highlights the notable defaults.
     Reversal       = 'How to undo it.'
     DefaultEnabled = $true                         # grade-3 entries must be $false
     Profiles       = @('opinionated')              # optional: profile-membership tags (gaming | opinionated)
-    RunAfter       = @('reg-region-format-nl')     # optional: ids this entry must be applied after
+    RunAfter       = @('catalog-prerequisite')     # optional: ids this entry must be applied after
     Condition      = @{ Script='...'; Description='...' }  # optional: hardware/machine applicability guard
     Arch           = @('amd64','arm64')
 }
@@ -161,7 +161,7 @@ Most changes are independent, so the catalog is applied in authoring order. Wher
 to sit in the file:
 
 ```powershell
-RunAfter = @('reg-region-format-nl')
+RunAfter = @('catalog-prerequisite')
 ```
 
 [`Import-ChangeCatalog`](../src/WindowsIsoMaker/Private/Import-ChangeCatalog.ps1) validates every
@@ -188,15 +188,6 @@ cross-hive constraint.
 
 Self-references and dependency cycles are rejected at load time.
 
-The motivating case is **first-logon `RunOnce` commands**. `reg-region-format-nl` runs
-`Set-Culture`, which rewrites the whole `HKCU\Control Panel\International` key from the locale
-defaults, so `reg-number-format-us-first-logon` has to restore the US number separators (which keep
-Excel on a comma CSV delimiter) *after* it. Windows does not contractually document the order in
-which `RunOnce` values execute, so that entry is ordered belt-and-braces: `RunAfter` guarantees its
-value is **written** last (which wins if execution follows enumeration/write order), and its value
-name `!WimZzNumberFormatUS` sorts after `!WimRegionFormatNL` (which wins if execution follows
-lexical order). Prefer that pattern for any new ordering-sensitive `RunOnce` pair.
-
 ### `Condition` — hardware-specific entries
 
 Some changes only make sense on particular hardware. Rather than growing a per-feature switch
@@ -249,10 +240,10 @@ from three inputs, in order of increasing precedence:
 1. `Profile` — the baseline set (`minimal` / `default` / `aggressive` / `gaming` / `opinionated`,
    where `gaming` is `default` minus the entries tagged `Profiles = @('gaming')` so Xbox / Game Bar
    are preserved, and `opinionated` is `aggressive` plus the entries tagged
-   `Profiles = @('opinionated')` personal-taste extras — reversed mouse scroll (via a helper task,
-   so mice paired later are covered too), Start web-search off, lock-screen Spotlight off, a
-   Surface-Laptop-only power button that does nothing instead of sleeping, WSL, and the United
-   States-International keyboard layout for English (US)).
+   `Profiles = @('opinionated')` machine-wide/admin extras — reversed mouse scroll (via a SYSTEM
+   helper task, so mice paired later are covered too), Start web-search and clipboard policies,
+   Recall removal, WSL/Virtual Machine Platform, services/time/hibernation settings, and Surface
+   power policies).
    `Profile` also accepts a list to combine baselines (e.g. `gaming,opinionated`):
    the selected profiles are UNIONed, and when `gaming` is one of them the `Profiles = @('gaming')`
    entries stay preserved — so `gaming,opinionated` gives aggressive debloat + opinionated tweaks
@@ -262,6 +253,11 @@ from three inputs, in order of increasing precedence:
 
 Entries not applicable to the target `Architecture` are skipped automatically.
 
+Current-user, non-admin Windows personalization is intentionally outside this catalog. It moved to
+the [DevSecNinja/dotfiles](https://github.com/DevSecNinja/dotfiles) chezmoi configuration in
+[dotfiles PR #711](https://github.com/DevSecNinja/dotfiles/pull/711); windows-iso-maker retains
+machine-wide, offline-servicing, policy, elevation-requiring, and SYSTEM-task changes.
+
 ## Notable defaults
 
 **Enabled by default (spec-mandated, grade 1, reversible):**

diff --git a/docs/usage.md b/docs/usage.md
@@ -23,7 +23,7 @@ parameters and `WIM_*` environment variables exist only as optional last-mile ov
 | Field | Meaning |
 |-------|---------|
 | `Edition` / `Language` / `Release` / `Architecture` | Base image selection. `Architecture` is `amd64` or `arm64`. **Only the Home SKUs** (Home, Home N, Home Single Language) come from the Fido consumer ISO — cached once per architecture/release. **Every other edition** (Pro, Education, Enterprise, LTSC, IoT, ...) only installs and activates from the **business/volume ISO** (retail generic keys and volume/GVLK keys are not interchangeable), which Fido can't download; supply `IsoPath` with the matching business-editions ISO (e.g. from a Visual Studio / volume-licensing subscription). |
-| `Profile` | Baseline change set: `minimal` (fewest changes), `default` (balanced), `aggressive` (most debloat), `gaming` (keeps Xbox/Game Bar), or `opinionated` (aggressive + personal-taste extras: reversed scroll, Start web-search off, Spotlight off, WSL, and the United States-International keyboard layout for English (US)). Accepts a list to combine profiles, e.g. `@('gaming','opinionated')` — the baselines are UNIONed and `gaming` keeps the gaming stack. |
+| `Profile` | Baseline change set: `minimal` (fewest changes), `default` (balanced), `aggressive` (most debloat), `gaming` (keeps Xbox/Game Bar), or `opinionated` (aggressive + machine-wide/admin extras: reversed scroll, Start web-search and clipboard policies, Recall removal, WSL, services/time/hibernation settings, and Surface power policies). Accepts a list to combine profiles, e.g. `@('gaming','opinionated')` — the baselines are UNIONed and `gaming` keeps the gaming stack. |
 | `Toggles` | Per-id override map, e.g. `@{ 'appx-todos' = $false; 'feature-wsl' = $true }`. |
 | `EnableCatalogId` / `DisableCatalogId` | Force-enable / force-disable specific entries by `Id` (explicit ids win). |
 | `Autounattend` | Install/OOBE-time options (see [autounattend.md](autounattend.md)). |
@@ -98,8 +98,8 @@ $env:WIM_CONFIG_PATH = 'config/build.arm64.psd1'; ./build.ps1
 # Gaming profile: full debloat but preserve Xbox Game Bar and the Xbox provisioned apps
 ./build.ps1 -Profile gaming
 
-# Game PC: aggressive debloat + opinionated tweaks (reversed scroll, US-International keyboard,
-# WSL, ...) while keeping the whole Xbox / Game Bar gaming stack
+# Game PC: aggressive debloat + machine-wide opinionated settings (reversed scroll, WSL, ...)
+# while keeping the whole Xbox / Game Bar gaming stack
 ./build.ps1 -Profile gaming,opinionated
 
 # Opt in to Edge + OneDrive removal and enable WSL

diff --git a/scripts/Invoke-QuickBootTest.ps1 b/scripts/Invoke-QuickBootTest.ps1
@@ -80,9 +80,8 @@
 .PARAMETER Profile
     Debloat/customization profile(s) to apply for this run, overriding the config's Profile. Accepts
     a list to combine baselines (e.g. -Profile gaming,opinionated). Because a quick boot test reuses
-    the already-serviced media\ folder, this does NOT re-run debloat; it re-derives the answer file,
-    so profile-driven Autounattend settings (e.g. the opinionated United States-International
-    keyboard) are reflected in the boot test.
+    the already-serviced media\ folder, this does NOT re-run debloat; it only re-derives the answer
+    file from the resolved configuration.
 
 .EXAMPLE
     ./scripts/Invoke-QuickBootTest.ps1