This is the install log I actually follow, trimmed of everything that turned out to be optional. Full disk encryption, BTRFS subvolumes for snapshots, and Secure Boot with my own keys.
1. Partition and encrypt
One EFI system partition, one LUKS2 container, nothing else. Swap lives in a file inside BTRFS so resizing never means repartitioning.
cryptsetup luksFormat --type luks2 /dev/nvme0n1p2
cryptsetup open /dev/nvme0n1p2 cryptroot
mkfs.btrfs /dev/mapper/cryptroot2. Subvolume layout
Snapshots are only useful if the layout excludes the directories you never want rolled back.
@mounted at/@homemounted at/home@logmounted at/var/log@pkgmounted at/var/cache/pacman/pkg
3. Unified kernel image
A unified kernel image bundles the kernel, initramfs and command line into one signed EFI binary. That is the piece that makes Secure Boot practical rather than theatrical.
mkinitcpio -P
sbctl sign -s /efi/EFI/Linux/arch-linux.efi4. Verify before rebooting
Check that the signature enrolled, that the fstab UUIDs match the mapper device, and that a fallback entry exists. Then reboot once and never think about it again.