diff --git a/local/scripts/apply-patches.sh b/local/scripts/apply-patches.sh
index 0720f3a0..b3bdd37f 100755
--- a/local/scripts/apply-patches.sh
+++ b/local/scripts/apply-patches.sh
@@ -89,6 +89,35 @@ for patch_file in "$PATCHES_DIR"/build-system/[0-9]*.patch; do
             echo "  SKIP $patch_name (already applied)"
             continue
         fi
+
+        # Reverse-check failed — maybe working tree diverged but patch is
+        # effectively applied. Use signature markers for robustness.
+        already_applied=0
+        case "$patch_name" in
+            001-rebrand-and-build.patch)
+                grep -q 'Red Bear OS' Makefile 2>/dev/null && already_applied=1
+                ;;
+            002-cookbook-fixes.patch)
+                grep -q 'redbear_cookbook' Cargo.toml 2>/dev/null \
+                    && grep -q 'redbear_protected_recipe' src/cook/fetch.rs 2>/dev/null \
+                    && already_applied=1
+                ;;
+            003-config.patch)
+                grep -q 'redbear-full' config/redbear-full.toml 2>/dev/null && already_applied=1
+                ;;
+            004-docs-and-cleanup.patch)
+                grep -q 'Red Bear OS' README.md 2>/dev/null && already_applied=1
+                ;;
+            005-qtbase-toolchain-elf-header.patch)
+                # This patch touches recipes/libs/qtbase; check for our marker
+                grep -q 'REDBEAR' recipes/libs/qtbase/recipe.toml 2>/dev/null && already_applied=1
+                ;;
+        esac
+        if [ "$already_applied" -eq 1 ]; then
+            echo "  SKIP $patch_name (already applied via signature marker)"
+            continue
+        fi
+
         # Patch conflicts and is NOT already applied — this is a real problem
         echo "  FAIL $patch_name — conflicts with current tree"
         echo "       This likely means upstream has changed the target files."
diff --git a/local/scripts/test-baremetal.sh b/local/scripts/test-baremetal.sh
index 12569f04..c19168a4 100755
--- a/local/scripts/test-baremetal.sh
+++ b/local/scripts/test-baremetal.sh
@@ -8,6 +8,11 @@ REDOX_ROOT="$(dirname "$0")/../.."
 REDOX_ROOT="$(cd "$REDOX_ROOT" && pwd)"
 IMAGE_PATH="$REDOX_ROOT/build/harddrive.img"
 
+# Auto-disable TUI when stdout is not a terminal (prevents repo cook panic)
+if [ -z "${CI:-}" ] && { [ ! -t 0 ] || [ ! -t 1 ]; }; then
+    export CI=1
+fi
+
 CONFIG="my-amd-desktop"
 DEVICE=""
 DRY_RUN=0
@@ -187,7 +192,7 @@ warn_if_system_disk "$DEVICE"
 
 if [ "$SKIP_BUILD" -eq 0 ]; then
     echo "=== Building Red Bear OS image ==="
-    run_cmd make -C "$REDOX_ROOT" all CONFIG_NAME="$CONFIG"
+    run_cmd make -C "$REDOX_ROOT" all CONFIG_NAME="$CONFIG" CI=1
 else
     echo "=== Skipping build step ==="
 fi
diff --git a/local/scripts/test-live-iso-qemu.sh b/local/scripts/test-live-iso-qemu.sh
index 46386951..eb380f93 100755
--- a/local/scripts/test-live-iso-qemu.sh
+++ b/local/scripts/test-live-iso-qemu.sh
@@ -71,7 +71,7 @@ for config in "${configs[@]}"; do
     expect <<EOF
 log_user 1
 set timeout 420
-spawn make qemu CONFIG_NAME=$config live=yes serial=yes gpu=no net=no
+spawn env CI=1 make qemu CONFIG_NAME=$config live=yes serial=yes gpu=no net=no
 expect "login:"
 send "root\r"
 expect "assword:"
diff --git a/scripts/build-all-isos.sh b/scripts/build-all-isos.sh
new file mode 100755
index 00000000..5103ae64
--- /dev/null
+++ b/scripts/build-all-isos.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+ALLOW_UPSTREAM=0
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") [OPTIONS]
+
+Build ALL Red Bear OS live ISOs for real bare metal.
+
+Targets built in order:
+  1. redbear-full   — Full desktop ISO (Wayland + KDE + GPU drivers)
+  2. redbear-mini   — Text-only ISO
+  3. redbear-grub   — Text-only ISO with GRUB boot manager
+
+Options:
+  --upstream          Allow Redox/upstream recipe source refresh during build
+  -h, --help          Show this help
+
+Environment:
+  CI=1                Force non-interactive mode (no TUI)
+  MAKEFLAGS           Passed through to make
+EOF
+    exit 0
+}
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --upstream)
+            ALLOW_UPSTREAM=1
+            ;;
+        -h|--help)
+            usage
+            ;;
+        -*)
+            echo "Unknown option: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+        *)
+            echo "Unknown argument: $1" >&2
+            usage >&2
+            exit 1
+            ;;
+    esac
+    shift
+done
+
+cd "$PROJECT_ROOT"
+
+# Auto-disable TUI when stdout is not a terminal (prevents repo cook panic)
+if [ -z "${CI:-}" ] && { [ ! -t 0 ] || [ ! -t 1 ]; }; then
+    export CI=1
+fi
+
+TARGETS=("redbear-full" "redbear-mini" "redbear-grub")
+ARCH="x86_64"
+FAILED=()
+
+for CONFIG_NAME in "${TARGETS[@]}"; do
+    echo ""
+    echo "======================================================================"
+    echo "  Building ISO: $CONFIG_NAME"
+    echo "======================================================================"
+    echo ""
+
+    if [ "$ALLOW_UPSTREAM" -eq 1 ]; then
+        if ! bash "$SCRIPT_DIR/build-iso.sh" --upstream "$CONFIG_NAME" "$ARCH"; then
+            FAILED+=("$CONFIG_NAME")
+            echo ""
+            echo "WARNING: Build failed for $CONFIG_NAME — continuing with next target..."
+            echo ""
+        fi
+    else
+        if ! bash "$SCRIPT_DIR/build-iso.sh" "$CONFIG_NAME" "$ARCH"; then
+            FAILED+=("$CONFIG_NAME")
+            echo ""
+            echo "WARNING: Build failed for $CONFIG_NAME — continuing with next target..."
+            echo ""
+        fi
+    fi
+done
+
+echo ""
+echo "======================================================================"
+echo "  Build Summary"
+echo "======================================================================"
+echo ""
+
+for CONFIG_NAME in "${TARGETS[@]}"; do
+    ISO_PATH="build/$ARCH/$CONFIG_NAME.iso"
+    if [ -f "$ISO_PATH" ]; then
+        echo "  [OK]   $CONFIG_NAME  →  $ISO_PATH"
+    else
+        echo "  [MISSING] $CONFIG_NAME"
+    fi
+done
+
+if [ ${#FAILED[@]} -gt 0 ]; then
+    echo ""
+    echo "FAILED targets: ${FAILED[*]}"
+    exit 1
+fi
+
+echo ""
+echo "All ISOs built successfully."
diff --git a/scripts/run.sh b/scripts/run.sh
index a13ab139..1aed2d5e 100755
--- a/scripts/run.sh
+++ b/scripts/run.sh
@@ -52,6 +52,11 @@ done
 
 cd "$PROJECT_ROOT"
 
+# Auto-disable TUI when stdout is not a terminal (prevents repo cook panic)
+if [ -z "${CI:-}" ] && { [ ! -t 0 ] || [ ! -t 1 ]; }; then
+    export CI=1
+fi
+
 if [ "$BUILD" -eq 1 ]; then
     echo "==> Ensuring .config is set for native build..."
     if ! grep -q 'PODMAN_BUILD?=0' .config 2>/dev/null; then
@@ -91,4 +96,4 @@ fi
 echo "==> Launching Red Bear OS in QEMU ($CONFIG_NAME, $ARCH)..."
 echo ""
 
-exec make qemu "CONFIG_NAME=$CONFIG_NAME" ARCH="$ARCH" "${QEMU_EXTRA_ARGS[@]}"
+exec make qemu "CONFIG_NAME=$CONFIG_NAME" ARCH="$ARCH" CI=1 "${QEMU_EXTRA_ARGS[@]}"
diff --git a/src/bin/repo.rs b/src/bin/repo.rs
index 167ac78c..77281693 100644
--- a/src/bin/repo.rs
+++ b/src/bin/repo.rs
@@ -1032,7 +1032,11 @@ impl TuiApp {
         thread::spawn(move || {
             while let Ok(msg) = log_writer_rx.recv() {
                 match msg {
-                    LogWriterMessage::Write { _name, path, content } => {
+                    LogWriterMessage::Write {
+                        _name,
+                        path,
+                        content,
+                    } => {
                         if content.trim_end().is_empty() {
                             continue;
                         }
@@ -1157,10 +1161,8 @@ impl TuiApp {
             }
             StatusUpdate::FlushLog(name, path) => {
                 let (logs, line) = self.get_recipe_log(&name);
-                let content = strip_ansi_escapes::strip_str(join_logs(
-                    logs.unwrap_or(&Vec::new()),
-                    line,
-                ));
+                let content =
+                    strip_ansi_escapes::strip_str(join_logs(logs.unwrap_or(&Vec::new()), line));
                 let _ = self.log_writer_tx.send(LogWriterMessage::Write {
                     _name: name,
                     path,
@@ -1328,9 +1330,9 @@ fn run_tui_cook(config: CliConfig, recipes: Vec<CookRecipe>) -> Result<TuiApp, c
     let mstdin = stdin();
     let mstdout = stdout()
         .into_raw_mode()
-        .unwrap()
+        .map_err(|e| Error::from_io_error(e, "Entering raw terminal mode (try CI=1)"))?
         .into_alternate_screen()
-        .unwrap();
+        .map_err(|e| Error::from_io_error(e, "Entering alternate terminal screen"))?;
 
     // ----- Input Thread -----
     let (input_tx, input_rx) = mpsc::channel::<Event>();
diff --git a/src/config.rs b/src/config.rs
index 02347df0..1cfbeab9 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,4 +1,10 @@
-use std::{collections::HashMap, env, fs, str::FromStr, sync::OnceLock};
+use std::{
+    collections::HashMap,
+    env, fs,
+    io::{IsTerminal, stdin},
+    str::FromStr,
+    sync::OnceLock,
+};
 
 use serde::{Deserialize, Serialize};
 
@@ -86,7 +92,9 @@ pub fn init_config() {
     };
 
     if config.cook_opt.tui.is_none() {
-        config.cook_opt.tui = Some(!env::var("CI").is_ok_and(|s| !s.is_empty()));
+        let ci_set = env::var("CI").is_ok_and(|s| !s.is_empty());
+        let tty = stdin().is_terminal();
+        config.cook_opt.tui = Some(!ci_set && tty);
     }
     if config.cook_opt.jobs.is_none() {
         config.cook_opt.jobs = Some(extract_env(