Check dev update support before changing the system

test/shell.d/channel-sudo-boundary-test.sh

@@ -62,6 +62,18 @@ for channel in stable rc edge dev; do
   pass "$channel starts cold, authorizes only individual commands, defers hooks and exits cold"
 done
 
+reset_boundary
+wrapper="$SUDO_TEST_HOME/omarchy/default/omarchy/sudo-no-update/sudo"
+mv "$wrapper" "$boundary_tmp/saved-wrapper"
+if run_channel dev; then fail "an old checkout without the wrapper was accepted"; fi
+if grep -Eq '^step:omarchy-(dev-link|state)|^sudo -N ' "$SUDO_TEST_LOG"; then
+  fail "an incompatible dev checkout changed the system before rejection"
+fi
+grep -q 'Update the checkout before switching to dev' "$boundary_tmp/output" || fail "stale checkout rejection lacks recovery guidance"
+assert_boundary_cold "stale checkout"
+mv "$boundary_tmp/saved-wrapper" "$wrapper"
+pass "a stale dev checkout is rejected before linking or privileged work"
+
 reset_boundary
 OMARCHY_PATH="$SUDO_TEST_HOME/omarchy" run_channel stable || fail "leaving dev failed" "$(<"$boundary_tmp/output")"
 assert_scoped_channel "dev to stable"