Check dev update support before changing the system

bin/omarchy-channel-set

@@ -46,9 +46,18 @@ validate_dev_checkout() {
 }
 
 link_dev_checkout() {
-  local checkout="$1"
+  local checkout="$1" required
   [[ -d $checkout/.git ]] || git clone https://github.com/basecamp/omarchy.git "$checkout"
 
+  # Check the destination before changing /etc/omarchy.conf or sudo's path.
+  # An existing checkout is not pulled automatically and may predate this policy.
+  for required in bin/omarchy-security-functions bin/omarchy-update bin/omarchy-refresh-pacman default/omarchy/sudo-no-update/sudo; do
+    if [[ ! -f $checkout/$required || ! -r $checkout/$required ||
+      ( $required != "bin/omarchy-security-functions" && ! -x $checkout/$required ) ]]; then
+      fail "Update the checkout before switching to dev; missing required update support in $required."
+    fi
+  done
+
   omarchy-dev-link "$checkout" --no-reboot
 }
 

test/shell.d/channel-sudo-boundary-test.sh

@@ -62,6 +62,18 @@ for channel in stable rc edge dev; do
   pass "$channel starts cold, authorizes only individual commands, defers hooks and exits cold"
 done
 
+reset_boundary
+wrapper="$SUDO_TEST_HOME/omarchy/default/omarchy/sudo-no-update/sudo"
+mv "$wrapper" "$boundary_tmp/saved-wrapper"
+if run_channel dev; then fail "an old checkout without the wrapper was accepted"; fi
+if grep -Eq '^step:omarchy-(dev-link|state)|^sudo -N ' "$SUDO_TEST_LOG"; then
+  fail "an incompatible dev checkout changed the system before rejection"
+fi
+grep -q 'Update the checkout before switching to dev' "$boundary_tmp/output" || fail "stale checkout rejection lacks recovery guidance"
+assert_boundary_cold "stale checkout"
+mv "$boundary_tmp/saved-wrapper" "$wrapper"
+pass "a stale dev checkout is rejected before linking or privileged work"
+
 reset_boundary
 OMARCHY_PATH="$SUDO_TEST_HOME/omarchy" run_channel stable || fail "leaving dev failed" "$(<"$boundary_tmp/output")"
 assert_scoped_channel "dev to stable"