Explain USB availability in older recovery snapshots

bin/omarchy-setup-security-usb-authorization

@@ -22,6 +22,9 @@ while (( $# > 0 )); do
     echo "--boot also blocks USB devices from the start of kernel boot. Connected"
     echo "devices are added to USBGuard's policy, but remain unavailable before"
     echo "USBGuard starts, including at an encrypted-disk password prompt."
+    echo "Older snapshots without USBGuard keep all USB disabled after startup,"
+    echo "including keyboards, network adapters, and storage. Use --boot only if"
+    echo "disk unlock and recovery work without any USB devices."
     exit 0
     ;;
   *)
@@ -53,8 +56,11 @@ if (( ! assume_yes )); then
     echo
     echo "Boot-time protection blocks all USB devices until USBGuard starts."
     echo "A USB keyboard will not work at an encrypted-disk password prompt, even"
-    echo "when it is connected now. Continue only if unlock and recovery do not"
-    echo "depend on USB input."
+    echo "when it is connected now."
+    echo
+    echo "Older snapshots without USBGuard keep ALL USB disabled after startup,"
+    echo "including keyboards, network adapters, and storage."
+    echo "Continue only if disk unlock and recovery work without any USB devices."
   fi
   echo
   if (( from_boot )); then

manual/48-security.md

@@ -19,7 +19,9 @@ Only approve hardware you recognize. A malicious USB device can forge the manufa
 
 The policy protects devices connected after USBGuard starts during boot. It does not replace operating-system and driver security updates, and USB devices needed before the service starts, such as a keyboard used to unlock an encrypted disk, remain governed by the kernel's boot-time policy.
 
-For machines whose disk unlock and recovery never depend on USB input, _Setup > Security > USB at Boot_ can extend the block to the beginning of kernel boot. Omarchy adds every currently connected device to USBGuard's trusted policy, sets `usbcore.authorized_default=0`, and updates current and Limine snapshot boot entries. The trusted policy applies only once USBGuard starts: even a trusted USB keyboard remains unavailable at an earlier encrypted-disk password prompt. _Remove > Security > USB at Boot_ restores the normal early-boot behavior while keeping USBGuard active after startup.
+For machines whose disk unlock and recovery never depend on any USB devices, _Setup > Security > USB at Boot_ can extend the block to the beginning of kernel boot. Omarchy adds every currently connected device to USBGuard's trusted policy, sets `usbcore.authorized_default=0`, and updates current and Limine snapshot boot entries. The trusted policy applies only once USBGuard starts: even a trusted USB keyboard remains unavailable at an earlier encrypted-disk password prompt.
+
+Older snapshots created before USBGuard was installed and enabled keep all USB disabled even after startup, including keyboards, network adapters, and storage. Trusting the devices connected now does not make them available in those snapshots. Enable boot-time protection only if you can unlock and recover the machine without any USB devices. _Remove > Security > USB at Boot_ restores the normal early-boot behavior while keeping USBGuard active after startup.
 
 ## Changing your passwords