Fully revert USB and Thunderbolt device approval (#15091)

* Revert "Merge pull request #11874 from acrogenesis/feature/usb-device-authorization" This reverts commit 5cb31317b4, reversing changes made to 9d48fc402e. * Undo USB and Thunderbolt device approval on machines that ran it * Verify boot rebuilds, recover Thunderbolt journals and prove USBGuard ownership in the removal migration * Read the boot partition from ESP_PATH and stop on failed Bolt reads in the removal migration * Recover Bolt's original mode from the setup journal in the removal migration
2026-10-12 01:20:01 -04:00
1 parent 9480d1b6a9
commit defbf90e89
@@ -0,0 +1,341 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(dirname "$0")/base-test.sh"
+
+shipped_migration="$ROOT/migrations/1791769486.sh"
+[[ -f $shipped_migration ]] || fail "the device authorization removal migration exists"
+
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+
+root="$test_dir/root"
+home="$test_dir/home"
+migration="$test_dir/migration.sh"
+export CALLS="$test_dir/calls" FAKE_ROOT="$root"
+
+# Run a scratch copy whose machine paths all live under the fake root.
+sed -e "s#/etc/#$root/etc/#g" -e "s#/var/#$root/var/#g" -e "s#/run/#$root/run/#g" \
+  -e "s#/sys/#$root/sys/#g" -e "s#:-/boot}#:-$root/boot}#" -e "s#/usr/share/polkit-1/#$root/usr/share/polkit-1/#g" \
+  "$shipped_migration" >"$migration"
+
+mkdir -p "$test_dir/bin"
+
+cat >"$test_dir/bin/sudo" <<'STUB'
+#!/bin/bash
+printf 'sudo %s\n' "$*" >>"$CALLS"
+exec "$@"
+STUB
+
+cat >"$test_dir/bin/systemctl" <<'STUB'
+#!/bin/bash
+printf 'systemctl %s\n' "$*" >>"$CALLS"
+STUB
+
+# Bolt: devices/<uid>/<Property> and domains/<uid>/BootACL hold JSON values.
+cat >"$test_dir/bin/busctl" <<'STUB'
+#!/bin/bash
+args=()
+for arg in "$@"; do [[ $arg == --* ]] || args+=("$arg"); done
+object=${args[2]#/org/freedesktop/bolt/}
+uid=${object#*/}
+file="$FAKE_ROOT/bolt/${object%%/*}/${uid//_/-}/${args[4]}"
+case ${args[0]} in
+  call)
+    kind=devices
+    [[ ${args[4]} == "ListDevices" ]] || kind=domains
+    for dir in "$FAKE_ROOT/bolt/$kind"/*/; do
+      dir=${dir%/}
+      uid=${dir##*/}
+      printf '/org/freedesktop/bolt/%s/%s\n' "$kind" "${uid//-/_}"
+    done | jq -Rnc '{type:"ao",data:[[inputs]]}'
+    ;;
+  get-property)
+    [[ -f $file && -z ${BOLT_READ_FAILS:-} ]] || exit 1
+    printf '{"type":"x","data":%s}\n' "$(<"$file")"
+    ;;
+  set-property)
+    [[ -f $file ]] || exit 1
+    value=$(printf '%s\n' "${args[@]:7}" | jq -Rnc '[inputs]')
+    (( args[6] > 0 )) || value='[]'
+    # Like Bolt, refuse a BootACL write that changes nothing.
+    [[ $value != "$(jq -c . "$file")" ]] || exit 1
+    printf '%s\n' "$value" >"$file"
+    ;;
+esac
+STUB
+
+cat >"$test_dir/bin/boltctl" <<'STUB'
+#!/bin/bash
+printf 'boltctl %s\n' "$*" >>"$CALLS"
+case $2 in
+  device.policy) printf '"%s"\n' "$4" >"$FAKE_ROOT/bolt/devices/$3/Policy" ;;
+  global.auth-mode) printf '%s\n' "$3" >"$FAKE_ROOT/bolt/authmode" ;;
+esac
+STUB
+
+# Rebuilds the current entries from the drop-in. Old snapshot entries keep the
+# parameter. MKINITCPIO=fail fails; MKINITCPIO=stale "succeeds" without
+# rebuilding, like a kernel image that failed inside the Limine hook.
+cat >"$test_dir/bin/limine-mkinitcpio" <<'STUB'
+#!/bin/bash
+printf 'limine-mkinitcpio\n' >>"$CALLS"
+[[ ${MKINITCPIO:-} != "fail" ]] || exit 1
+[[ ${MKINITCPIO:-} != "stale" ]] || exit 0
+parameter=""
+[[ ! -e $FAKE_ROOT/etc/limine-entry-tool.d/usb-authorization.conf ]] || parameter=" usbcore.authorized_default=0"
+esp=$(sed -n 's/^ESP_PATH="\(.*\)"$/\1/p' "$FAKE_ROOT/etc/default/limine")
+esp=${esp:-$FAKE_ROOT/boot}
+mkdir -p "$esp/EFI/Linux"
+printf 'MZ...cmdline root=x%s...initrd' "$parameter" >"$esp/EFI/Linux/omarchy_linux.efi"
+cat >"$esp/limine.conf" <<EOF
+/+Omarchy
+  comment: machine-id=abc
+  //linux
+  comment: kernel-id=linux
+  path: boot():/EFI/Linux/omarchy_linux.efi#0123
+  cmdline: root=x quiet$parameter
+     //Snapshots
+     ///1
+     ////linux
+     path: boot():/abc/limine_history/omarchy_linux.efi#4567
+     cmdline: root=x usbcore.authorized_default=0
+EOF
+STUB
+
+cat >"$test_dir/bin/omarchy-pkg-present" <<'STUB'
+#!/bin/bash
+[[ -e $FAKE_ROOT/packages/$1 ]]
+STUB
+
+cat >"$test_dir/bin/omarchy-pkg-drop" <<'STUB'
+#!/bin/bash
+printf 'omarchy-pkg-drop %s\n' "$*" >>"$CALLS"
+rm -f "$FAKE_ROOT/packages/$1" "$FAKE_ROOT/etc/usbguard/rules.conf"
+STUB
+
+cat >"$test_dir/bin/pacman" <<'STUB'
+#!/bin/bash
+exit 1
+STUB
+
+chmod +x "$test_dir/bin/"*
+
+grant=$'Devices=list,modify,listen\nPolicy=list\nExceptions=listen'
+dock=b8f58780-002a-50c4-ffff-ffffffffffff
+other=aaaaaaaa-0000-0000-0000-000000000001
+domain=895a5509-000a-3075-ffff-ffffffffffff
+gone_domain=895a5509-010a-3075-ffff-ffffffffffff
+
+# A machine that never had the feature, with Bolt in its default mode.
+reset_machine() {
+  rm -rf "$root" "$home"
+  mkdir -p "$root"/{etc/default,var/log,var/lib/omarchy,run,packages,usr/share/polkit-1/actions} \
+    "$root/sys/bus/usb/devices"/{usb1,usb2,1-1} "$root/bolt/devices"/{$dock,$other} "$root/bolt/domains/$domain" \
+    "$home/.config/systemd/user/graphical-session.target.wants" "$home/.local/state/omarchy"
+  echo 'KERNEL_CMDLINE[default]+="quiet"' >"$root/etc/default/limine"
+  echo enabled >"$root/bolt/authmode"
+  echo '"auto"' >"$root/bolt/devices/$dock/Policy"
+  echo 1791668776 >"$root/bolt/devices/$dock/StoreTime"
+  echo '"manual"' >"$root/bolt/devices/$other/Policy"
+  echo 1700000000 >"$root/bolt/devices/$other/StoreTime"
+  echo '["",""]' >"$root/bolt/domains/$domain/BootACL"
+  echo 1 | tee "$root"/sys/bus/usb/devices/{usb1,usb2}/authorized_default "$root"/sys/bus/usb/devices/{usb1,usb2,1-1}/authorized >/dev/null
+  echo '[2026-01-02T03:04:05-0500] [ALPM] installed jq (1.8)' >"$root/var/log/pacman.log"
+  MKINITCPIO=ok "$test_dir/bin/limine-mkinitcpio"
+}
+
+# What #11874's default setup left behind on the author's machine.
+enable_feature() {
+  touch "$root/packages/usbguard"
+  echo '[2026-10-10T17:44:55-0400] [ALPM] installed usbguard (1.1.4-11)' >>"$root/var/log/pacman.log"
+  mkdir -p "$root/etc/usbguard/IPCAccessControl.d" "$root/etc/omarchy" "$root/var/lib/omarchy/thunderbolt-authorization" \
+    "$root/etc/systemd/system/multi-user.target.wants" "$home/.local/state/omarchy/usb-authorization/requests"
+  echo 'allow id 1d6b:0002' >"$root/etc/usbguard/rules.conf"
+  printf '%s\n' "$grant" >"$root/etc/usbguard/IPCAccessControl.d/tester"
+  echo 0 | tee "$root"/sys/bus/usb/devices/{usb1,usb2}/authorized_default >/dev/null
+  echo 0 >"$root/sys/bus/usb/devices/1-1/authorized"
+  touch "$home/.local/state/omarchy/usb-authorization/policy-generated-by-omarchy"
+  touch "$root/usr/share/polkit-1/actions"/org.omarchy.{usb,thunderbolt}.policy
+  touch "$home/.config/systemd/user/omarchy-usb-authorization.service"
+  ln -s ../omarchy-usb-authorization.service "$home/.config/systemd/user/graphical-session.target.wants/omarchy-usb-authorization.service"
+  ln -s /usr/lib/systemd/user/omarchy-thunderbolt-authorization.service "$home/.config/systemd/user/graphical-session.target.wants/omarchy-thunderbolt-authorization.service"
+  ln -s /etc/systemd/system/omarchy-thunderbolt-authorization.service "$root/etc/systemd/system/multi-user.target.wants/omarchy-thunderbolt-authorization.service"
+  touch "$root/etc/omarchy/thunderbolt-authorization.enabled"
+  echo disabled >"$root/bolt/authmode"
+  echo '"manual"' >"$root/bolt/devices/$dock/Policy"
+  cat >"$root/var/lib/omarchy/thunderbolt-authorization/policy.json" <<EOF
+{"enabled":true,"original_authmode":"enabled","version":1,
+ "enrolled":{"$dock":{"Name":"TS4","StoreTime":1791668776,"Uid":"$dock","Vendor":"CalDigit, Inc."}},
+ "trusted":{"$dock":{"Name":"TS4","Uid":"$dock","Vendor":"CalDigit, Inc."}}}
+EOF
+}
+
+enable_usb_at_boot() {
+  mkdir -p "$root/etc/limine-entry-tool.d"
+  echo 'KERNEL_CMDLINE[default]+=" usbcore.authorized_default=0"' >"$root/etc/limine-entry-tool.d/usb-authorization.conf"
+  printf '%s\n' '# Omarchy USB authorization begin' 'SNAPSHOT_KERNEL_PARAMETERS+=usbcore.authorized_default=0' \
+    '# Omarchy USB authorization end' >>"$root/etc/default/limine"
+  MKINITCPIO=ok "$test_dir/bin/limine-mkinitcpio"
+}
+
+run_migration() {
+  : >"$CALLS"
+  HOME="$home" USER=tester PATH="$test_dir/bin:$PATH" bash -euo pipefail "$migration" >"$test_dir/output" 2>&1
+}
+
+value() { tr -d '\n' <"$root/bolt/$1"; }
+
+reset_machine
+run_migration || fail "migration fails on a machine that never had the feature" "$(cat "$test_dir/output")"
+! grep -q '^sudo' "$CALLS" || fail "migration asks for sudo on a machine that never had the feature" "$(cat "$CALLS")"
+pass "a machine that never had the feature is left alone without sudo"
+
+reset_machine
+touch "$root/packages/usbguard"
+printf '%s\n' '[2025-03-01T10:00:00-0500] [ALPM] installed usbguard (1.1.3-1)' \
+  '[2026-10-10T17:44:55-0400] [ALPM] upgraded usbguard (1.1.3-1 -> 1.1.4-11)' >>"$root/var/log/pacman.log"
+run_migration || fail "migration fails beside the user's own USBGuard" "$(cat "$test_dir/output")"
+[[ -e $root/packages/usbguard ]] || fail "migration removes a USBGuard installed before Omarchy shipped it"
+! grep -q '^sudo' "$CALLS" || fail "migration asks for sudo for a USBGuard it does not own" "$(cat "$CALLS")"
+pass "a USBGuard installed before Omarchy shipped it is kept, even after an upgrade"
+
+reset_machine
+touch "$root/packages/usbguard"
+echo '[2026-10-10T09:00:00-0400] [ALPM] installed usbguard (1.1.4-11)' >>"$root/var/log/pacman.log"
+run_migration || fail "migration fails beside a USBGuard without Omarchy's grant" "$(cat "$test_dir/output")"
+[[ -e $root/packages/usbguard ]] || fail "migration removes a USBGuard without Omarchy's ownership evidence"
+pass "a USBGuard without Omarchy's marker or grant is kept"
+
+reset_machine
+enable_feature
+run_migration || fail "migration fails on a machine with the feature" "$(cat "$test_dir/output")"
+[[ ! -e $root/packages/usbguard ]] || fail "migration keeps the USBGuard Omarchy installed"
+[[ $(cat "$root"/sys/bus/usb/devices/*/authorized_default "$root"/sys/bus/usb/devices/*/authorized | sort -u) == "1" ]] ||
+  fail "migration leaves USB devices denied after USBGuard exits"
+[[ ! -e $root/etc/usbguard ]] || fail "migration leaves Omarchy's USBGuard grants behind" "$(find "$root/etc/usbguard")"
+[[ $(value authmode) == "enabled" && $(value devices/$dock/Policy) == '"auto"' ]] ||
+  fail "migration does not hand Thunderbolt back to Bolt" "$(value authmode) $(value devices/$dock/Policy)"
+[[ $(value devices/$other/Policy) == '"manual"' ]] || fail "migration changes a manual policy Omarchy did not set"
+for path in "$root/var/lib/omarchy/thunderbolt-authorization" "$root/etc/omarchy/thunderbolt-authorization.enabled" \
+  "$root/etc/systemd/system/multi-user.target.wants/omarchy-thunderbolt-authorization.service" \
+  "$root/usr/share/polkit-1/actions/org.omarchy.usb.policy" "$root/usr/share/polkit-1/actions/org.omarchy.thunderbolt.policy" \
+  "$home/.local/state/omarchy/usb-authorization" "$home/.config/systemd/user/omarchy-usb-authorization.service" \
+  "$home/.config/systemd/user/graphical-session.target.wants/omarchy-usb-authorization.service" \
+  "$home/.config/systemd/user/graphical-session.target.wants/omarchy-thunderbolt-authorization.service"; do
+  [[ ! -e $path && ! -L $path ]] || fail "migration leaves $path behind"
+done
+pass "the default feature is removed and devices connect as before"
+
+run_migration || fail "a second run fails" "$(cat "$test_dir/output")"
+! grep -q '^sudo' "$CALLS" || fail "a second run asks for sudo" "$(cat "$CALLS")"
+pass "a second run is a no-op"
+
+# A deferred install that never finished setup left only the pending marker,
+# without changing Bolt's mode; an administrator's own setting stays.
+reset_machine
+mkdir -p "$root/etc/omarchy"
+touch "$root/etc/omarchy/thunderbolt-authorization.pending"
+echo disabled >"$root/bolt/authmode"
+run_migration || fail "migration fails with only the pending marker" "$(cat "$test_dir/output")"
+[[ $(value authmode) == "disabled" ]] || fail "migration enables Bolt authorization it never changed"
+[[ ! -e $root/etc/omarchy/thunderbolt-authorization.pending ]] || fail "migration leaves the pending marker"
+pass "Bolt's mode is untouched when Omarchy never saved one"
+
+# A first setup failed and its undo deleted policy.json before restoring
+# boltd.conf: Bolt's original config survives only in the setup journal.
+for original in "$(printf '[config]\nAuthMode = enabled\n' | base64 -w0)" ""; do
+  reset_machine
+  mkdir -p "$root/etc/omarchy" "$root/var/lib/omarchy/thunderbolt-authorization"
+  touch "$root/etc/omarchy/thunderbolt-authorization.enabled"
+  echo disabled >"$root/bolt/authmode"
+  if [[ -n $original ]]; then
+    saved="{\"data\":\"$original\",\"mode\":\"600\"}"
+  else
+    saved=null
+  fi
+  echo "{\"files\":{\"/var/lib/boltd/boltd.conf\":$saved},\"units\":{}}" \
+    >"$root/var/lib/omarchy/thunderbolt-authorization/setup-recovery.json"
+  run_migration || fail "migration fails with only the setup journal" "$(cat "$test_dir/output")"
+  [[ $(value authmode) == "enabled" ]] || fail "migration leaves Bolt off when its original config is only in the setup journal"
+done
+pass "Bolt's original mode is recovered from the setup journal"
+
+# Turning on Thunderbolt Boot was interrupted: the originals are only in the
+# recovery journal. One controller's list already matches; another is gone.
+reset_machine
+enable_feature
+echo '"manual"' >"$root/bolt/devices/$other/Policy"
+echo '["",""]' >"$root/bolt/domains/$domain/BootACL"
+cat >"$root/var/lib/omarchy/thunderbolt-authorization/boot-recovery.json" <<EOF
+{"policies":{"$other":"iommu","$dock":"manual"},"acls":{"$domain":["$dock",""]},"state":{}}
+EOF
+run_migration || fail "migration fails while recovering Thunderbolt Boot" "$(cat "$test_dir/output")"
+[[ $(value devices/$other/Policy) == '"iommu"' ]] || fail "migration ignores the Thunderbolt Boot recovery journal"
+[[ $(value domains/$domain/BootACL) == "[\"$dock\",\"\"]" ]] || fail "migration does not restore the firmware boot allowlist"
+[[ $(value devices/$dock/Policy) == '"auto"' ]] || fail "migration does not hand the enrolled dock back after recovery"
+[[ ! -e $root/var/lib/omarchy/thunderbolt-authorization ]] || fail "migration keeps fully restored Thunderbolt state"
+pass "an interrupted Thunderbolt Boot is recovered from its journal"
+
+reset_machine
+enable_feature
+jq --arg d "$domain" --arg g "$gone_domain" --arg dock "$dock" \
+  '.boot_protection=true | .boot_original={policies:{($dock):"manual"},acls:{($d):["",""],($g):[""]}}' \
+  "$root/var/lib/omarchy/thunderbolt-authorization/policy.json" >"$test_dir/policy.json"
+mv "$test_dir/policy.json" "$root/var/lib/omarchy/thunderbolt-authorization/policy.json"
+run_migration || fail "migration fails when a list already matches or a controller is gone" "$(cat "$test_dir/output")"
+[[ -f $root/var/lib/omarchy/thunderbolt-authorization.unrestored/policy.json ]] ||
+  fail "migration discards settings it could not restore"
+grep -q "$gone_domain is not present" "$test_dir/output" || fail "migration does not say which controller was skipped"
+[[ $(value devices/$dock/Policy) == '"auto"' ]] || fail "migration stops before handing back the dock"
+pass "unrestorable firmware settings are kept aside, and matching lists are not rewritten"
+
+# A Bolt read that fails, unlike a record Bolt no longer has, must leave the
+# saved settings in place and the migration pending.
+reset_machine
+enable_feature
+BOLT_READ_FAILS=1 run_migration && fail "migration succeeds although Bolt could not be read"
+[[ -f $root/var/lib/omarchy/thunderbolt-authorization/policy.json ]] || fail "a failed Bolt read discards the saved settings"
+run_migration || fail "migration does not finish once Bolt can be read" "$(cat "$test_dir/output")"
+[[ $(value devices/$dock/Policy) == '"auto"' ]] || fail "the retry does not hand back the dock"
+pass "a failed Bolt read keeps the saved settings and retries"
+
+# USB at Boot: a failed rebuild, then one that silently leaves the parameter,
+# must both keep USBGuard and retry, even though the settings are already gone.
+reset_machine
+enable_feature
+enable_usb_at_boot
+MKINITCPIO=fail run_migration && fail "migration succeeds although the boot rebuild failed"
+[[ -e $root/packages/usbguard && -e $root/var/lib/omarchy/usb-authorization-boot.removing ]] ||
+  fail "a failed rebuild removes USBGuard or forgets to retry"
+MKINITCPIO=stale run_migration && fail "migration trusts a rebuild that left the parameter" "$(cat "$test_dir/output")"
+[[ -e $root/packages/usbguard ]] || fail "migration removes USBGuard while a boot entry still denies USB"
+grep -q 'limine-mkinitcpio' "$CALLS" || fail "a retry skips the rebuild once the settings are gone"
+MKINITCPIO=ok run_migration || fail "migration fails once the rebuild succeeds" "$(cat "$test_dir/output")"
+[[ ! -e $root/packages/usbguard && ! -e $root/var/lib/omarchy/usb-authorization-boot.removing ]] ||
+  fail "migration does not finish after a successful rebuild"
+grep -q 'usbcore' "$root/etc/default/limine" && fail "migration leaves the snapshot parameter in /etc/default/limine"
+pass "USB at Boot is removed only once the rebuilt entries are verified"
+
+# A boot partition mounted somewhere other than /boot, named by ESP_PATH.
+reset_machine
+rm -rf "$root/boot"
+echo "ESP_PATH=\"$root/efi\"" >>"$root/etc/default/limine"
+enable_feature
+enable_usb_at_boot
+MKINITCPIO=stale run_migration && fail "migration trusts a stale rebuild on a boot partition outside /boot"
+MKINITCPIO=ok run_migration || fail "migration does not check the boot partition named by ESP_PATH" "$(cat "$test_dir/output")"
+[[ ! -e $root/packages/usbguard ]] || fail "migration keeps USBGuard after a verified rebuild outside /boot"
+pass "boot entries are verified on the boot partition named by ESP_PATH"
+
+# Under Secure Boot the signed image's own command line is what boots.
+reset_machine
+enable_feature
+enable_usb_at_boot
+mkdir -p "$root/sys/firmware/efi/efivars"
+printf '\x06\x00\x00\x00\x01' >"$root/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c"
+sed -i 's/ usbcore.authorized_default=0$//' "$root/boot/limine.conf"
+MKINITCPIO=stale run_migration && fail "migration trusts Limine's command line over the signed image's"
+MKINITCPIO=ok run_migration || fail "migration fails under Secure Boot after a clean rebuild" "$(cat "$test_dir/output")"
+pass "Secure Boot images are checked for the parameter too"
@@ -1,87 +0,0 @@
-#!/bin/bash
-
-# Runs against the private real boltd created by bolt-integration.py. No policy,
-# busctl, firmware reads, or writes are mocked here.
-set -euo pipefail
-source "$ROOT/install/helpers/thunderbolt-policy.sh"
-source "$ROOT/install/helpers/thunderbolt-setup.sh"
-TB_STATE="$TB_TEST_DIR/policy.json"
-TB_RUNTIME="$TB_TEST_DIR/runtime"
-mkdir -p "$TB_RUNTIME"
-check() { jq -e "$1" "$2" >/dev/null; }
-reject() { if "$@"; then echo 'Unexpected approval success' >&2; exit 1; fi; }
-case "$1" in
-  approve)
-    echo '{"version":1,"enabled":true,"trusted":{}}' | tb_json_write "$TB_STATE"
-    cat /proc/sys/kernel/random/uuid > "$TB_RUNTIME/generation"
-    tb_snapshot > "$TB_TEST_DIR/before.json"
-    capture=$(tb_capture)
-    tb_inventory | jq -e --arg uid "$TB_TEST_UID" --argjson capture "$capture" \
-      '.devices[] | select(.Uid==$uid) | $capture[$uid]=={Uid,Name,Vendor}' >/dev/null
-    check 'all(.devices[]; .status=="connected" and (.stored|not))' "$TB_TEST_DIR/before.json"
-    id=$(jq -c --arg uid "$TB_TEST_UID" '.devices[] | select(.identity.Uid==$uid) | .identity' "$TB_TEST_DIR/before.json")
-    printf '%s\n' "$id" > "$TB_TEST_DIR/identity.json"
-    tb_approve "$id" true true > "$TB_TEST_DIR/after.json"
-    jq -e --arg uid "$TB_TEST_UID" '.devices[] | select(.identity.Uid==$uid) | .trusted and .status=="authorized" and .policy=="manual"' "$TB_TEST_DIR/after.json" >/dev/null
-    jq -e --arg uid "$TB_TEST_OTHER" '.devices[] | select(.identity.Uid==$uid) | .status=="connected"' "$TB_TEST_DIR/after.json" >/dev/null
-    check 'all(.domains[0].BootACL[]; .=="")' "$TB_TEST_DIR/after.json"
-    inventory=$(tb_inventory)
-    if [[ $TB_TEST_SECURITY == "secure" ]]; then
-      jq -e --arg uid "$TB_TEST_UID" '.devices[] | select(.Uid==$uid) | .Stored and .Key=="have"' <<< "$inventory" >/dev/null
-      [[ -s $TB_TEST_KEYS/$TB_TEST_UID ]]
-      sha256sum "$TB_TEST_KEYS/$TB_TEST_UID" > "$TB_TEST_DIR/key-checksum"
-    fi
-    owner=$(jq -r .owner <<< "$inventory")
-    device=$(jq -c --arg uid "$TB_TEST_UID" '.stored[] | select(.Uid==$uid)' <<< "$inventory")
-    domain=$(jq -c '.domains[0]' <<< "$inventory")
-    device_path=$(jq -r .path <<< "$device"); domain_path=$(jq -r .path <<< "$domain")
-    tb_set "$owner" "$device_path" "$TB_DEVICE" Policy '"auto"'
-    acl=$(jq -c --arg uid "$TB_TEST_UID" '.BootACL | map("") | .[0]=$uid' <<< "$domain")
-    tb_set "$owner" "$domain_path" "$TB_DOMAIN" BootACL "$acl" as
-    tb_boot_change true
-    check .boot_protection "$TB_STATE"
-    tb_inventory > "$TB_TEST_DIR/inventory.json"
-    check 'all(.domains[0].BootACL[]; .=="") and .stored[0].Policy=="manual"' "$TB_TEST_DIR/inventory.json"
-    tb_boot_change false
-    check '.boot_protection==false' "$TB_STATE"
-    tb_inventory > "$TB_TEST_DIR/inventory.json"
-    jq -e --argjson acl "$acl" '.domains[0].BootACL==$acl and .stored[0].Policy=="auto"' "$TB_TEST_DIR/inventory.json" >/dev/null
-    jq --arg other "$TB_TEST_OTHER" 'del(.trusted[$other])' "$TB_STATE" | tb_json_write "$TB_STATE"
-    tb_set "$owner" "$device_path" "$TB_DEVICE" Policy '"manual"'
-    tb_set "$owner" "$domain_path" "$TB_DOMAIN" BootACL "$(jq -c 'map("")' <<< "$acl")" as
-    ;;
-  restart)
-    cat /proc/sys/kernel/random/uuid > "$TB_RUNTIME/generation"
-    reject tb_approve "$(cat "$TB_TEST_DIR/identity.json")" true
-    tb_reconcile > "$TB_TEST_DIR/after.json"
-    jq -e --arg uid "$TB_TEST_UID" '.devices[] | select(.identity.Uid==$uid) | .trusted and .status=="authorized"' "$TB_TEST_DIR/after.json" >/dev/null
-    jq -e --arg uid "$TB_TEST_OTHER" '.devices[] | select(.identity.Uid==$uid) | .status=="connected"' "$TB_TEST_DIR/after.json" >/dev/null
-    tb_inventory | jq -e '.manager.AuthMode=="disabled"' >/dev/null
-    if [[ $TB_TEST_SECURITY == "secure" ]]; then
-      # Bolt must challenge with the originally saved key, not provision a new
-      # key merely because a reconnecting device advertises the same identity.
-      tb_inventory | jq -e --arg uid "$TB_TEST_UID" \
-        '.devices[] | select(.Uid==$uid) | .Key=="have" and (.AuthFlags | contains("secure"))' >/dev/null
-      sha256sum --status -c "$TB_TEST_DIR/key-checksum"
-    fi
-    ;;
-  daemon)
-    TB_MARKER="$TB_TEST_DIR/enabled" TB_LOCK="$TB_TEST_DIR/root.lock"
-    touch "$TB_MARKER"
-    tb_daemon
-    ;;
-  status)
-    snapshot=$(tb_public_snapshot)
-    jq -e --arg owner "$(tb_owner)" '.owner==$owner' <<< "$snapshot" >/dev/null
-    printf '%s\n' "$snapshot"
-    ;;
-  once)
-    snapshot=$(tb_public_snapshot)
-    id=$(jq -c --arg uid "$TB_TEST_OTHER" '.devices[] | select(.identity.Uid==$uid) | .identity' <<< "$snapshot")
-    exec 9> "$TB_TEST_DIR/root.lock"
-    flock -x 9
-    tb_approve "$id" false > "$TB_TEST_DIR/once.json"
-    jq -e --arg uid "$TB_TEST_OTHER" '.devices[] | select(.identity.Uid==$uid) | .status=="authorized" and (.trusted|not)' "$TB_TEST_DIR/once.json" >/dev/null
-    ;;
-  *) exit 64 ;;
-esac
@@ -1,185 +0,0 @@
-"""Only the hardware fixture is Python: upstream Bolt uses UMockdev/GObject.
-
-All Omarchy behavior and assertions run in bolt-exercise.sh against real boltd,
-real busctl, a private system bus, and disposable sysfs/firmware/store state.
-"""
-import importlib.machinery
-import importlib.util
-import os
-from pathlib import Path
-import subprocess
-import sys
-import time
-import unittest
-
-root = Path(sys.argv.pop(1))
-loader = importlib.machinery.SourceFileLoader('bolt_upstream', str(Path(os.environ['BOLT_TEST_SOURCE']) / 'tests/test-integration'))
-spec = importlib.util.spec_from_loader(loader.name, loader)
-u = importlib.util.module_from_spec(spec)
-loader.exec_module(u)
-
-
-class ApprovalIntegration(u.BoltTest):
-  def exercise(self, security, numeric=False):
-    self.user_config(AuthMode='disabled', DefaultPolicy='manual')
-    _, host = self.add_domain_host(security=security, iommu='1')
-    path, uid = self.add_device(host, 1, 'Dock', 'Example', authorized=0, key='' if security == 'secure' else None, boot='0')
-    _, other = self.add_device(host, 2, 'Unknown', 'Example', authorized=0, key=None, boot='0')
-    if numeric:
-      # Linux omits these files when the peripheral has no descriptive names.
-      for attribute in ('device_name', 'vendor_name'):
-        Path(self.testbed.get_root_dir(), path.lstrip('/'), attribute).unlink()
-    self.daemon_start()
-    self.polkitd_start()
-    self.polkitd.SetAllowed(['org.freedesktop.bolt.authorize', 'org.freedesktop.bolt.enroll', 'org.freedesktop.bolt.manage'])
-    env = os.environ | {'ROOT': str(root), 'UMOCKDEV_DIR': self.testbed.get_root_dir(),
-                        'TB_TEST_DIR': self.rundir, 'TB_TEST_UID': uid, 'TB_TEST_OTHER': other,
-                        'TB_TEST_KEYS': str(Path(self.dbpath, 'keys')), 'TB_TEST_SECURITY': security}
-    command = ['bash', str(root / 'test/shell.d/fixtures/thunderbolt/bolt-exercise.sh')]
-    subprocess.run(command + ['approve'], env=env, check=True)
-    self.daemon_stop()
-    self.testbed.set_attribute(path, 'authorized', '0')
-    if security == 'secure':
-      self.testbed.set_attribute(path, 'key', '\n')
-    self.daemon_start()
-    subprocess.run(command + ['restart'], env=env, check=True)
-    # The real Bash daemon publishes a fresh readable snapshot and reconnects
-    # to Bolt after a restart. No custom Omarchy D-Bus server is involved.
-    child = subprocess.Popen(command + ['daemon'], env=env)
-    try:
-      for _ in range(100):
-        result = subprocess.run(command + ['status'], env=env, capture_output=True)
-        if result.returncode == 0:
-          break
-        time.sleep(0.1)
-      else:
-        raise RuntimeError('Bash daemon did not publish a valid snapshot')
-      subprocess.run(command + ['once'], env=env, check=True)
-      self.daemon_stop()
-      self.daemon_start()
-      for _ in range(100):
-        if subprocess.run(command + ['status'], env=env, capture_output=True).returncode == 0:
-          break
-        time.sleep(0.1)
-      else:
-        raise RuntimeError('Bash daemon did not publish the new Bolt generation')
-    finally:
-      child.terminate()
-      child.wait(timeout=15)
-    self.daemon_stop()
-
-  def test_user_approval(self):
-    self.exercise('user')
-
-  def test_secure_approval(self):
-    self.exercise('secure')
-
-  def test_numeric_identity(self):
-    self.exercise('user', numeric=True)
-
-  def removal(self, security, boot=False, disconnected=False):
-    self.user_config(AuthMode='disabled')
-    _, host = self.add_domain_host(security=security, iommu='1')
-    path, uid = self.add_device(host, 1, 'Dock', 'Example', authorized=0, key='' if security == 'secure' else None, boot='0')
-    other_path, other = self.add_device(host, 2, 'Existing', 'Example', authorized=0, key=None, boot='0')
-    self.daemon_start()
-    self.polkitd_start()
-    self.polkitd.SetAllowed(['org.freedesktop.bolt.authorize', 'org.freedesktop.bolt.enroll', 'org.freedesktop.bolt.manage'])
-    env = os.environ | {'ROOT': str(root), 'UMOCKDEV_DIR': self.testbed.get_root_dir(),
-                        'TB_TEST_DIR': self.rundir, 'TB_TEST_UID': uid, 'TB_TEST_OTHER': other,
-                        'TB_TEST_STORE': self.dbpath, 'TB_TEST_SECURITY': security}
-    command = ['bash', str(root / 'test/shell.d/fixtures/thunderbolt/bolt-removal.sh')]
-    service = 'omarchy-thunderbolt-authorization.service'
-    child = None
-
-    def operation(action, unit):
-      nonlocal child
-      if unit == 'bolt.service':
-        if action == 'stop':
-          self.daemon_stop()
-        elif self.daemon is None:
-          self.daemon_start()
-      elif unit == service:
-        if action == 'stop' and child is not None:
-          child.terminate()
-          child.wait(timeout=15)
-          child = None
-        elif action == 'start' and child is None:
-          child = subprocess.Popen(['bash', str(root / 'test/shell.d/fixtures/thunderbolt/bolt-exercise.sh'), 'daemon'], env=env)
-      else:
-        raise RuntimeError('Unexpected private service: ' + unit)
-      marker = Path(self.rundir, unit + '.active')
-      if action == 'start':
-        marker.touch()
-      else:
-        marker.unlink(missing_ok=True)
-
-    def run(action):
-      process = subprocess.Popen(command + [action], env=env)
-      control = Path(self.rundir, 'control')
-      deadline = time.monotonic() + 90
-      try:
-        while process.poll() is None:
-          if time.monotonic() > deadline:
-            raise RuntimeError('Private setup timed out: ' + action)
-          if control.exists():
-            operation(*control.read_text().strip().split())
-            control.unlink()
-          time.sleep(0.05)
-        if process.returncode:
-          raise subprocess.CalledProcessError(process.returncode, command + [action])
-      finally:
-        if process.poll() is None:
-          process.terminate()
-          process.wait(timeout=15)
-
-    def wait_for(action):
-      for _ in range(50):
-        result = subprocess.run(command + [action], env=env, capture_output=True, text=True)
-        if result.returncode == 0:
-          print(result.stdout, end='', flush=True)
-          return
-        time.sleep(0.1)
-      raise RuntimeError(action + ': ' + result.stdout + result.stderr)
-
-    def unplug():
-      for device_path in (path, other_path):
-        self.testbed.uevent(device_path, 'remove')
-        self.testbed.remove_device(device_path)
-      wait_for('disconnected')
-
-    try:
-      Path(self.rundir, 'bolt.service.active').touch()
-      run('approve')
-      operation('start', service)
-      Path(self.rundir, service + '.enabled').touch()
-      if boot:
-        run('boot-enable')
-      run('rollback')
-      if disconnected:
-        unplug()
-      run('disable')
-      if not disconnected:
-        unplug()
-      for number, device_uid, name in ((1, uid, 'Dock'), (2, other, 'Existing')):
-        attributes = ['device_name', name, 'device', '0x23', 'vendor_name', 'Example',
-                      'vendor', '0x23', 'authorized', '0', 'unique_id', device_uid, 'boot', '0']
-        if number == 1 and security == 'secure':
-          attributes += ['key', '\n']
-        self.testbed.add_device('thunderbolt', '0-' + str(number), host, attributes, ['DEVTYPE', 'thunderbolt_device'])
-      wait_for('reconnected')
-    finally:
-      operation('stop', service)
-      self.daemon_stop()
-
-  def test_user_removal(self):
-    self.removal('user')
-
-  def test_secure_removal(self):
-    self.removal('secure', boot=True, disconnected=True)
-
-
-names = sys.argv[1:] or ('test_user_approval', 'test_secure_approval', 'test_numeric_identity', 'test_user_removal', 'test_secure_removal')
-suite = unittest.TestSuite(ApprovalIntegration(name) for name in names)
-result = unittest.TextTestRunner(verbosity=2).run(suite)
-sys.exit(not result.wasSuccessful())
@@ -1,95 +0,0 @@
-#!/bin/bash
-
-# Real Bolt policy/approval/setup calls. Only systemd is bridged to the private
-# daemon processes owned by bolt-integration.py; never contact host systemd.
-set -euo pipefail
-source "$ROOT/install/helpers/thunderbolt-policy.sh"
-source "$ROOT/install/helpers/thunderbolt-setup.sh"
-TB_STATE="$TB_TEST_DIR/policy.json" TB_CONFIG="$TB_TEST_STORE/boltd.conf"
-TB_MARKER="$TB_TEST_DIR/enabled" TB_PENDING="$TB_TEST_DIR/pending"
-TB_RUNTIME="$TB_TEST_DIR/runtime" TB_LOCK="$TB_TEST_DIR/root.lock"
-mkdir -p "$TB_RUNTIME"
-
-service_request() {
-  printf '%s\n' "$*" > "$TB_TEST_DIR/control.tmp"
-  mv "$TB_TEST_DIR/control.tmp" "$TB_TEST_DIR/control"
-  for (( attempt=0; attempt<300; attempt++ )); do
-    [[ -f $TB_TEST_DIR/control ]] || return 0
-    sleep 0.05
-  done
-  echo "Private service operation timed out: $*" >&2
-  return 1
-}
-systemctl() {
-  local action=$1 unit
-  shift
-  printf '%s\n' "$action $*" >> "$TB_TEST_DIR/services.log"
-  case "$action" in
-    show)
-      unit=${!#}
-      if [[ -f $TB_TEST_DIR/$unit.active ]]; then echo ActiveState=active; else echo ActiveState=inactive; fi
-      if [[ -f $TB_TEST_DIR/$unit.enabled ]]; then echo UnitFileState=enabled; else echo UnitFileState=disabled; fi ;;
-    start|stop)
-      for unit in "$@"; do service_request "$action" "$unit" || return 1; done ;;
-    enable)
-      unit=${!#}
-      touch "$TB_TEST_DIR/$unit.enabled"
-      if [[ $1 == "--now" ]]; then service_request start "$unit"; fi ;;
-    disable)
-      if [[ -f $TB_TEST_DIR/fail-disable ]]; then rm "$TB_TEST_DIR/fail-disable"; return 1; fi
-      rm -f -- "$TB_TEST_DIR/$1.enabled" ;;
-    daemon-reload) ;;
-    *) echo "Unexpected systemctl action: $action $*" >&2; return 1 ;;
-  esac
-}
-check_inventory() { tb_inventory | jq -e --arg uid "$TB_TEST_UID" --arg other "$TB_TEST_OTHER" "$1" >/dev/null; }
-case "$1" in
-  approve)
-    jq -cn '{version:1,enabled:true,trusted:{},original_authmode:"enabled"}' > "$TB_STATE"
-    echo removal-test > "$TB_RUNTIME/generation"
-    touch "$TB_MARKER"
-    identity=$(tb_snapshot | jq -c --arg uid "$TB_TEST_UID" '.devices[]|select(.identity.Uid==$uid)|.identity')
-    tb_approve "$identity" true true >/dev/null
-    # An existing manual record, even explicitly trusted through Omarchy,
-    # must keep the policy its administrator chose before enrollment.
-    inventory=$(tb_inventory)
-    owner=$(jq -r .owner <<< "$inventory")
-    path=$(jq -r --arg uid "$TB_TEST_OTHER" '.devices[]|select(.Uid==$uid)|.path' <<< "$inventory")
-    tb_bus call "$owner" "$path" "$TB_DEVICE" Authorize s '' >/dev/null
-    tb_bus call "$owner" "$TB_PATH" "$TB_MANAGER" EnrollDevice sss "$TB_TEST_OTHER" manual '' >/dev/null
-    identity=$(tb_snapshot | jq -c --arg uid "$TB_TEST_OTHER" '.devices[]|select(.identity.Uid==$uid)|.identity')
-    tb_approve "$identity" true true >/dev/null
-    jq -e --arg uid "$TB_TEST_UID" --arg other "$TB_TEST_OTHER" \
-      '.enrolled[$uid].StoreTime>0 and .enrolled[$other]==null and .trusted[$other]!=null' "$TB_STATE" >/dev/null
-    if [[ $TB_TEST_SECURITY == "secure" ]]; then
-      sha256sum "$TB_TEST_STORE/keys/$TB_TEST_UID" > "$TB_TEST_DIR/key-checksum"
-    fi ;;
-  boot-enable) tb_admin boot-enable ;;
-  rollback)
-    cp "$TB_STATE" "$TB_TEST_DIR/old-policy.json"
-    tb_inventory | tb_boot_saved > "$TB_TEST_DIR/old-firmware.json"
-    touch "$TB_TEST_DIR/fail-disable"
-    if tb_admin disable; then echo 'Failed removal unexpectedly succeeded' >&2; exit 1; fi
-    cmp "$TB_STATE" "$TB_TEST_DIR/old-policy.json"
-    cmp <(tb_inventory | tb_boot_saved | jq -cS .) <(jq -cS . "$TB_TEST_DIR/old-firmware.json")
-    [[ -f $TB_MARKER && -f $TB_TEST_DIR/$TB_SERVICE.active && -f $TB_TEST_DIR/$TB_SERVICE.enabled && ! -f $TB_TEST_DIR/setup-recovery.json ]]
-    check_inventory '.manager.AuthMode=="disabled"'
-    echo 'Removal failure restored policy, firmware ACLs and approval service' ;;
-  disable)
-    tb_admin disable
-    [[ ! -f $TB_MARKER && ! -f $TB_TEST_DIR/$TB_SERVICE.active && ! -f $TB_TEST_DIR/$TB_SERVICE.enabled ]]
-    jq -e '.enabled==false and .enrolled==null' "$TB_STATE" >/dev/null
-    check_inventory '.manager.AuthMode=="enabled" and any(.stored[]; .Uid==$uid and .Policy=="auto") and any(.stored[]; .Uid==$other and .Policy=="manual")'
-    if [[ $TB_TEST_SECURITY == "secure" ]]; then sha256sum --status -c "$TB_TEST_DIR/key-checksum"; fi
-    echo 'Removal handed our record back to Bolt and preserved existing manual policy' ;;
-  disconnected)
-    check_inventory 'any(.stored[]; .Uid==$uid and .Status=="disconnected") and any(.stored[]; .Uid==$other and .Status=="disconnected")' ;;
-  reconnected)
-    check_inventory 'any(.devices[]; .Uid==$uid and .Policy=="auto" and (.Status|startswith("authorized"))) and any(.devices[]; .Uid==$other and .Policy=="manual" and .Status=="connected")'
-    if [[ $TB_TEST_SECURITY == "secure" ]]; then
-      check_inventory 'any(.devices[]; .Uid==$uid and .Key=="have" and (.AuthFlags|contains("secure")))'
-      sha256sum --status -c "$TB_TEST_DIR/key-checksum"
-    fi
-    echo "Automatic reconnect succeeded in $TB_TEST_SECURITY mode; pre-existing manual device stayed blocked" ;;
-  *) exit 64 ;;
-esac
@@ -1,728 +0,0 @@
-#!/bin/bash
-
-# These behavior cases were first run as the existing Python assertions against
-# the Bash implementation. Fixtures replace only Bolt, systemd and desktop I/O.
-set -euo pipefail
-source "$ROOT/test/shell.d/base-test.sh"
-source "$ROOT/install/helpers/thunderbolt-policy.sh"
-source "$ROOT/install/helpers/thunderbolt-setup.sh"
-source "$ROOT/install/helpers/thunderbolt-review.sh"
-
-fixture() {
-  T=$(mktemp -d)
-  trap 'rm -rf -- "$T"' EXIT
-  export HOME="$T/home"
-  TB_STATE="$T/policy.json" TB_CONFIG="$T/boltd.conf" TB_MARKER="$T/enabled"
-  TB_PENDING="$T/pending" TB_SYSFS="$T/sysfs" TB_KEYS="$T/keys"
-  TB_RUNTIME="$T/runtime" TB_LOCK="$T/root.lock"
-  mkdir -p "$TB_RUNTIME" "$HOME" "$TB_SYSFS" "$TB_KEYS"
-  echo generation-a > "$TB_RUNTIME/generation"
-  echo '{"version":1,"enabled":true,"trusted":{},"original_authmode":"enabled"}' > "$TB_STATE"
-  cat > "$T/inventory" <<'JSON'
-{"owner":":1.5","manager":{"AuthMode":"disabled"},"domains":[{"Uid":"host","SecurityLevel":"user","IOMMU":true,"SysfsPath":"/sys/domain","path":"/domain","BootACL":["device-1",""]}],"devices":[{"Uid":"device-1","Name":"Dock","Vendor":"Vendor","Parent":"host","SysfsPath":"/sys/devices/test/0-1","ConnectTime":1,"Status":"connected","Stored":false,"Policy":"default","AuthFlags":"","path":"/devices/1","inode":"1"}]}
-JSON
-  : > "$T/operations"; : > "$T/units"; : > "$T/notifications"
-  echo '{}' > "$T/capture"
-  tb_requests
-}
-
-edit_inventory() { jq "$@" "$T/inventory" > "$T/next"; mv "$T/next" "$T/inventory"; }
-edit_state() { jq "$@" "$TB_STATE" | tb_json_write "$TB_STATE"; }
-check() { jq -e "$1" "$2" >/dev/null || fail "$1" "$(cat "$2")"; }
-reject() { if ("$@") > "$T/output" 2> "$T/error"; then fail "unexpected success: $*"; fi; }
-identity() { tb_snapshot | jq -c '.devices[0].identity'; }
-
-tb_inventory() {
-  [[ ! -f $T/inventory-failure ]] || { tb_fail 'inventory unavailable'; return 1; }
-  jq '. + {stored:[.devices[] | select(.Stored)]}' "$T/inventory"
-}
-tb_properties() { jq -c --arg path "$2" '(.devices + .domains)[] | select(.path==$path)' "$T/inventory"; }
-tb_bus() {
-  local command=$1 path=$3 member=$5 value
-  printf '%s\n' "$member" >> "$T/operations"
-  case "$member" in
-    Authorize)
-      [[ ! -f $T/authorize-failure ]] || return 1
-      if [[ ! -f $T/authorize-noop ]]; then edit_inventory --arg path "$path" '(.devices[] | select(.path==$path)).Status="authorized"'; fi ;;
-    EnrollDevice)
-      if [[ ! -f $T/enroll-noop ]]; then
-        edit_inventory '(.devices[0] | .Stored=true | .Policy="manual" | .StoreTime=100) as $d | .devices[0]=$d'
-        if [[ -f $TB_SYSFS/0-1/key && $(cat "$TB_SYSFS/0-1/key") =~ ^[0-9a-f]{64}$ && ! -f $T/key-store-failure ]]; then
-          edit_inventory '.devices[0].Key="have"'
-        fi
-      fi
-      if [[ -f $T/enroll-lost-reply ]]; then rm "$T/enroll-lost-reply"; return 1; fi ;;
-    Policy|BootACL)
-      if [[ $member == "BootACL" && -f $T/boot-failure ]] || [[ $member == "Policy" && ${7:-} == "auto" && -f $T/restore-failure ]]; then
-        tb_fail 'firmware rejected write'; return 1
-      fi
-      [[ $member != "Policy" || ! -f $T/policy-noop ]] || return 0
-      if [[ $member == "BootACL" ]]; then
-        shift 7
-        value=$(jq -cn '$ARGS.positional' --args "$@")
-      else
-        value=$(jq -cn --arg value "$7" '$value')
-      fi
-      edit_inventory --arg path "$path" --arg key "$member" --argjson value "$value" \
-        '((.devices[],.domains[]) | select(.path==$path))[$key]=$value'
-      if [[ $member == "Policy" ]]; then
-        # Real Bolt changes firmware ACLs when a stored policy changes.
-        edit_inventory --arg path "$path" --arg value "$7" '
-          (.devices[] | select(.path==$path) | .Uid) as $uid |
-          .domains[].BootACL |= (if $value=="auto" and (index($uid)==null) then
-            (index("") // 0) as $slot | .[$slot]=$uid
-          elif $value!="auto" then map(if .==$uid then "" else . end) else . end)'
-      fi ;;
-    *) tb_fail "Unexpected Bolt call: $*"; return 1 ;;
-  esac
-}
-tb_capture() { [[ ! -f $T/capture-failure ]] && cat "$T/capture"; }
-tb_unit_state() { jq -cn --arg unit "$1" '{active:($unit=="bolt.service"),enabled:false}'; }
-systemctl() {
-  if [[ $1 == --root=* ]]; then command systemctl "$@"; return; fi
-  printf '%s\n' "$*" >> "$T/units"
-  if [[ -f $T/unit-failure && $* == "$(cat "$T/unit-failure")" ]]; then
-    [[ -f $T/repeat-failure ]] || rm "$T/unit-failure"
-    tb_fail 'systemd failed'; return 1
-  fi
-  if [[ $* == "start bolt.service" && -f $TB_CONFIG ]]; then
-    edit_inventory --arg mode "$(tb_config_authmode "$TB_CONFIG")" '.manager.AuthMode=$mode'
-    if [[ ! -f $TB_MARKER && -f $T/restart-policy-failure ]]; then
-      rm "$T/restart-policy-failure"
-      edit_inventory '.devices[0].Policy="manual"'
-    fi
-  fi
-}
-tb_public_snapshot() { cat "$T/public"; }
-tb_notify() {
-  echo "$1" >> "$T/notifications"
-  if [[ -f $T/notify-failure ]]; then rm "$T/notify-failure"; return 1; fi
-}
-tb_attention() { echo attention >> "$T/notifications"; }
-gum() { if [[ $1 == "choose" ]]; then cat "$T/choice"; fi; }
-tb_request_apply() {
-  jq --argjson identity "$2" --argjson permanent "$1" \
-    '(.devices[] | select(.identity==$identity)) |= (.status="authorized" | .trusted=$permanent | .stored=$permanent)' "$T/public" > "$T/next"
-  mv "$T/next" "$T/public"
-  [[ ! -f $T/lost-reply ]] || { tb_fail 'reply lost'; return 1; }
-  cat "$T/public"
-}
-request() { local paths=("$TB_REQUESTS"/request-*.json); printf '%s\n' "${paths[0]}"; }
-request_count() { local paths; shopt -s nullglob; paths=("$TB_REQUESTS"/request-*.json); echo "${#paths[@]}"; }
-public_fixture() { tb_snapshot > "$T/public"; }
-boot_fixture() { edit_inventory '.devices[0] |= (.Stored=true | .Policy="auto")'; }
-review_tick() {
-  local path watch
-  path=$(request); watch=$(jq -r .watch "$path")
-  tb_scan "$watch" >/dev/null
-}
-
-test_iommu_is_not_consent() {
-  edit_inventory '.devices[0] |= (.Stored=true | .Policy="iommu")'
-  tb_reconcile > "$T/result"
-  [[ ! -s $T/operations ]]; check '.devices[0].trusted==false' "$T/result"
-}
-test_once_is_not_saved() {
-  tb_approve "$(identity)" false > "$T/result"
-  check '.warnings==[]' "$T/result"; check '.trusted=={}' "$TB_STATE"
-  edit_inventory '.devices[0].Status="connected"'
-  tb_reconcile >/dev/null
-  [[ $(cat "$T/operations") == "Authorize" ]]
-}
-test_always_survives_restart() {
-  tb_approve "$(identity)" true >/dev/null
-  edit_inventory '.owner=":1.9" | .devices[0] |= (.Status="connected" | .inode="2")'
-  echo generation-b > "$TB_RUNTIME/generation"
-  tb_reconcile > "$T/result"
-  check '.devices[0].status=="authorized" and .devices[0].trusted' "$T/result"
-  check '.manager.AuthMode=="disabled"' "$T/inventory"
-}
-test_enrollment_lost_reply_retains_ownership() {
-  touch "$T/enroll-lost-reply"
-  reject tb_approve "$(identity)" true
-  check '.trusted=={} and .enrolled["device-1"].StoreTime==null' "$TB_STATE"
-  tb_approve "$(identity)" true >/dev/null
-  check '.enrolled["device-1"].StoreTime==100 and .trusted["device-1"]!=null' "$TB_STATE"
-}
-secure_fixture() {
-  mkdir -p "$TB_SYSFS/0-1"
-  echo 11111111-2222-3333-4444-555555555555 > "$TB_SYSFS/0-1/unique_id"
-  echo 0 > "$TB_SYSFS/0-1/authorized"
-  : > "$TB_SYSFS/0-1/key"
-  edit_inventory --arg path "$TB_SYSFS/0-1" --arg inode "$(stat -Lc %i "$TB_SYSFS/0-1")" \
-    '.domains[0].SecurityLevel="secure" | .devices[0] |= (.Secure=true | .Key="missing" |
-      .Uid="11111111-2222-3333-4444-555555555555" | .SysfsPath=$path | .inode=$inode)'
-}
-test_secure_approval_initializes_before_trust() {
-  secure_fixture
-  tb_approve "$(identity)" true true > "$T/result"
-  [[ $(cat "$TB_SYSFS/0-1/key") =~ ^[0-9a-f]{64}$ ]]
-  check '.devices[0].trusted and .devices[0].stored' "$T/result"
-  cp "$TB_SYSFS/0-1/key" "$T/original-key"
-  tb_approve "$(identity)" true true >/dev/null
-  cmp "$TB_SYSFS/0-1/key" "$T/original-key"
-}
-test_secure_automatic_restore_cannot_initialize_keys() {
-  secure_fixture
-  jq '.devices[0] | {(.Uid):{Uid,Name,Vendor}}' "$T/inventory" > "$T/trusted"
-  edit_state --slurpfile trusted "$T/trusted" '.trusted=$trusted[0]'
-  tb_reconcile > "$T/result"
-  check '.devices[0].trusted==false' "$T/result"
-  [[ ! -s $T/operations && ! -s $TB_SYSFS/0-1/key ]]
-  reject tb_approve "$(identity)" true
-  [[ ! -s $T/operations ]]
-}
-test_secure_missing_saved_key_cannot_claim_success() {
-  secure_fixture
-  touch "$T/key-store-failure"
-  reject tb_approve "$(identity)" true true
-  check '.trusted=={}' "$TB_STATE"
-  tb_snapshot > "$T/result"; check '.devices[0].trusted==false' "$T/result"
-}
-test_secure_key_failure_does_not_authorize() {
-  secure_fixture
-  openssl() { return 1; }
-  reject tb_approve "$(identity)" true true
-  [[ ! -s $T/operations && ! -s $TB_SYSFS/0-1/key ]]
-  unset -f openssl
-  echo invalid > "$TB_SYSFS/0-1/key"
-  reject tb_approve "$(identity)" true true
-  [[ ! -s $T/operations ]]
-}
-test_authorized_keyless_device_requires_explicit_reconnect() {
-  secure_fixture
-  edit_inventory '.devices[0].Status="authorized"'
-  echo 1 > "$TB_SYSFS/0-1/authorized"
-  reject tb_approve "$(identity)" true true
-  rg -q 'disconnect, reconnect' "$T/error"
-  [[ ! -s $TB_SYSFS/0-1/key ]]; check '.trusted=={}' "$TB_STATE"
-  edit_inventory '.devices[0].Status="connected"'
-  tb_reconcile >/dev/null
-  [[ $(cat "$T/operations") == "EnrollDevice" ]]
-}
-test_stale_identity_rejected() {
-  local id field
-  id=$(identity)
-  for field in inode Name ConnectTime; do
-    cp "$T/inventory" "$T/original"
-    edit_inventory --arg field "$field" '.devices[0][$field]="replacement"'
-    reject tb_approve "$id" true
-    mv "$T/original" "$T/inventory"
-  done
-  edit_inventory '.owner=":1.9"'; reject tb_approve "$id" true
-  [[ ! -s $T/operations ]]
-}
-test_false_success_rejected() {
-  local id; id=$(identity)
-  touch "$T/authorize-noop"; reject tb_approve "$id" true; check '.trusted=={}' "$TB_STATE"
-  rm "$T/authorize-noop"; touch "$T/enroll-noop"
-  reject tb_approve "$id" true; check '.trusted=={}' "$TB_STATE"
-  rm "$T/enroll-noop"; tb_approve "$id" true > "$T/result"
-  check '.devices[0].trusted' "$T/result"
-  [[ $(rg -c '^Authorize$' "$T/operations") == 2 ]]
-}
-test_write_failure_retains_retry() {
-  local id; id=$(identity)
-  eval "$(declare -f tb_json_write | sed '1s/tb_json_write/disk_write/')"
-  tb_json_write() { [[ ! -f $T/disk-full ]] && disk_write "$@"; }
-  touch "$T/disk-full"; reject tb_approve "$id" true; check '.trusted=={}' "$TB_STATE"
-  rm "$T/disk-full"; tb_approve "$id" true > "$T/result"
-  check '.devices[0].trusted' "$T/result"
-  [[ $(rg -c '^Authorize$' "$T/operations") == 1 ]]
-}
-test_firmware_bypass_warns() {
-  edit_inventory '.domains[0].SecurityLevel="none" | .devices[0] |= (.Status="authorized" | .AuthFlags="boot")'
-  tb_snapshot > "$T/result"; check '.warnings|length==2' "$T/result"; [[ ! -s $T/operations ]]
-}
-test_global_enable_not_protected() {
-  edit_inventory '.manager.AuthMode="enabled"'
-  reject tb_snapshot; rg -q 'not active' "$T/error"
-  reject tb_reconcile
-}
-test_display_only_needs_no_approval() {
-  edit_state '.trusted["device-1"]={Uid:"device-1",Name:"Dock",Vendor:"Vendor"}'
-  edit_inventory '.devices[0].AuthFlags="nopcie"'
-  tb_reconcile > "$T/result"; check '.error==""' "$T/result"; [[ ! -s $T/operations ]]
-}
-test_empty_capture_preserved() {
-  rm "$TB_STATE"; tb_prepare
-  touch "$T/capture-failure"; tb_prepare
-  check '.trusted=={}' "$TB_STATE"; [[ $(tb_config_authmode "$TB_CONFIG") == "disabled" ]]
-}
-test_capture_failure_does_not_publish() {
-  rm "$TB_STATE"; touch "$T/capture-failure"; reject tb_prepare
-  [[ ! -e $TB_STATE && ! -e $TB_MARKER ]]
-}
-test_capture_optional_names_match_numeric_identity() {
-  source "$ROOT/install/helpers/thunderbolt-setup.sh"
-  mkdir -p "$TB_SYSFS/0-1"
-  echo device-1 > "$TB_SYSFS/0-1/unique_id"
-  echo 0x1234 > "$TB_SYSFS/0-1/device"
-  echo 0xab > "$TB_SYSFS/0-1/vendor"
-  tb_capture > "$T/result"
-  check '.["device-1"]=={Uid:"device-1",Name:"0x1234",Vendor:"0xab"}' "$T/result"
-  echo Dock > "$TB_SYSFS/0-1/device_name"
-  tb_capture > "$T/result"; check '.["device-1"].Name=="Dock" and .["device-1"].Vendor=="0xab"' "$T/result"
-  rm "$TB_SYSFS/0-1/device_name"; echo Vendor > "$TB_SYSFS/0-1/vendor_name"
-  tb_capture > "$T/result"; check '.["device-1"].Name=="0x1234" and .["device-1"].Vendor=="Vendor"' "$T/result"
-  mkdir "$TB_SYSFS/0-1/device_name"
-  reject tb_capture
-}
-test_first_activation_defers_without_touching_bolt() {
-  secure_fixture; rm "$TB_STATE"
-  printf '[config]\nAuthMode=enabled\n' > "$TB_CONFIG"; cp "$TB_CONFIG" "$T/original"
-  tb_admin owner
-  [[ -f $TB_PENDING && ! -f $TB_STATE && ! -f $TB_MARKER && ! -s $T/units ]]
-  cmp "$TB_CONFIG" "$T/original"
-  rm -rf "$TB_SYSFS/0-1"
-  tb_admin migrate
-  [[ -f $TB_PENDING && ! -f $TB_MARKER && ! -s $T/units ]]
-  tb_admin enable
-  [[ ! -f $TB_PENDING && -f $TB_MARKER ]]
-}
-test_saved_secure_binding_allows_initial_capture() {
-  secure_fixture; rm "$TB_STATE"
-  edit_inventory '.devices[0] |= (.Stored=true | .Key="have")'
-  tb_admin owner
-  [[ ! -f $TB_PENDING && -f $TB_MARKER ]]
-}
-test_key_without_record_defers_initial_capture() {
-  secure_fixture; rm "$TB_STATE"
-  edit_inventory '.devices[0].Key="have"'
-  tb_admin owner
-  [[ -f $TB_PENDING && ! -f $TB_MARKER && ! -s $T/units ]]
-}
-test_offline_prepare_cannot_trust_installers_bolt() {
-  secure_fixture; rm "$TB_STATE"
-  edit_inventory '.devices[0] |= (.Stored=true | .Key="have")'
-  tb_admin prepare
-  [[ -f $TB_PENDING && ! -f $TB_MARKER && ! -s $T/units ]]
-}
-test_deferred_opt_out_retains_initial_enrollment() {
-  secure_fixture; rm "$TB_STATE"
-  tb_admin owner
-  tb_admin disable
-  [[ ! -f $TB_PENDING && ! -f $TB_MARKER && ! -s $T/units ]]
-  check '.enabled==false and .enrollment_pending==true' "$TB_STATE"
-  tb_admin migrate
-  [[ ! -f $TB_PENDING && ! -s $T/units ]]
-  tb_admin enable
-  [[ -f $TB_PENDING && ! -f $TB_MARKER && ! -s $T/units ]]
-  rm -rf "$TB_SYSFS/0-1"
-  echo '{"new-device":{}}' > "$T/capture"
-  tb_admin enable
-  check '.enabled and .enrollment_pending==null and .trusted=={"new-device":{}}' "$TB_STATE"
-  [[ ! -f $TB_PENDING && -f $TB_MARKER ]]
-}
-test_pending_notice_retries_without_claiming_protection() {
-  touch "$TB_PENDING"
-  local count=0 notices=0
-  tb_wait() { count=$((count + 1)); (( count < 3 )) || exit 99; }
-  tb_setup_notice() { notices=$((notices + 1)); (( notices > 1 )) && echo pending >> "$T/notifications"; }
-  reject tb_watch
-  [[ $(cat "$T/notifications") == "pending" ]]
-  tb_status > "$T/result"; rg -q 'protection is deferred' "$T/result"
-}
-test_active_policy_is_not_deferred() {
-  secure_fixture; touch "$TB_MARKER"
-  tb_admin owner
-  [[ ! -f $TB_PENDING && -f $TB_MARKER ]]
-}
-test_pending_only_factory_reset_reaches_both_roots() {
-  local function_name root="$T/top/@factory"
-  local TOP_MNT="$T/top" NEXT_NAME=@next PROVISIONING_DIR=/var/lib/omarchy/provisioning LOG_FILE="$T/reset.log" swap_done=0
-  mkdir -p "$root/etc/omarchy" "$root/etc/systemd/system" "$root/usr/bin" \
-    "$root/usr/share/omarchy/install/provisioning" "$T/top/@"
-  touch "$root/etc/omarchy/thunderbolt-authorization.pending" "$root/usr/bin/omarchy-provision-owner"
-  chmod +x "$root/usr/bin/omarchy-provision-owner"
-  echo 'root:x:0:0:root:/root:/bin/bash' > "$root/etc/passwd"
-  cp "$ROOT/install/provisioning/omarchy-provision-owner.service" \
-    "$ROOT/install/provisioning/omarchy-system-factory-reset-finish.service" "$root/usr/share/omarchy/install/provisioning/"
-  cp "$ROOT/etc/systemd/system/omarchy-thunderbolt-authorization.service" "$root/etc/systemd/system/"
-  for function_name in install_provisioning_units scrub_factory_accounts sanitize_factory_baseline stage_full_reset; do
-    eval "$(sed -n "/^$function_name() {$/,/^}/p" "$ROOT/bin/omarchy-system-factory-reset")"
-  done
-  log() { :; }
-  btrfs() {
-    if [[ $1 == "subvolume" && $2 == "snapshot" ]]; then cp -a "$3" "$4"
-    elif [[ $1 == "property" ]]; then :
-    else return 1; fi
-  }
-  usermod() { [[ $1 == "--root" && $2 == "$TOP_MNT/"* && $3 == "--password" && $4 == "!" && $5 == "root" ]]; }
-  systemd-id128() { echo new-machine-id; }
-  encrypted_install() { return 1; }
-  rebuild_next_boot() { :; }
-  sync() { :; }
-  systemctl() {
-    [[ ( $1 == "--root=$TOP_MNT/@next" || $1 == "--root=$TOP_MNT/@factory" ) && $2 == "disable" && $3 == "$TB_SERVICE" ]] || return 1
-    command systemctl "$@"
-  }
-  function /usr/bin/omarchy-thunderbolt-authorization-admin() {
-    [[ $1 == "reset-root" ]] || return 1
-    printf '%s\n' "$2" >> "$T/reset-roots"
-    (
-      source "$ROOT/install/helpers/thunderbolt-policy.sh"
-      source "$ROOT/install/helpers/thunderbolt-setup.sh"
-      tb_reset_root "$2"
-    )
-  }
-  stage_full_reset
-  [[ $(wc -l < "$T/reset-roots") == 2 && $swap_done == 1 ]]
-  [[ ! -f $TOP_MNT/@/etc/omarchy/thunderbolt-authorization.pending &&
-    ! -f $TOP_MNT/@factory/etc/omarchy/thunderbolt-authorization.pending ]]
-  [[ -f $TOP_MNT/@/var/lib/omarchy/provisioning/pending ]]
-}
-test_config_preserves_settings() {
-  rm "$TB_STATE"; printf '[config]\nAuthMode=enabled\nDefaultPolicy=manual\n' > "$TB_CONFIG"
-  tb_prepare; rg -q '^DefaultPolicy=manual$' "$TB_CONFIG"
-  check '.original_authmode=="enabled"' "$TB_STATE"
-}
-test_fresh_owner_replaces_trust() {
-  rm "$TB_STATE"; echo '{"old":{}}' > "$T/capture"; tb_prepare
-  echo '{"new":{}}' > "$T/capture"; tb_prepare true
-  check '.trusted=={"new":{}} and .original_authmode=="enabled"' "$TB_STATE"
-}
-test_enable_rollback() {
-  rm "$TB_STATE"; printf '[config]\nAuthMode=enabled\nDefaultPolicy=manual\n' > "$TB_CONFIG"
-  cp "$TB_CONFIG" "$T/original"; echo 'start bolt.service' > "$T/unit-failure"
-  reject tb_transaction tb_enable
-  cmp "$TB_CONFIG" "$T/original"; [[ ! -e $TB_STATE && ! -e $TB_MARKER && ! -e $T/setup-recovery.json ]]
-  [[ $(tail -2 "$T/units") == $'start bolt.service\nstop omarchy-thunderbolt-authorization.service' ]]
-}
-test_failed_restore_keeps_checkpoint() {
-  rm "$TB_STATE"; echo '[config]' > "$TB_CONFIG"; cp "$TB_CONFIG" "$T/original"
-  echo 'stop omarchy-thunderbolt-authorization.service bolt.service' > "$T/unit-failure"; touch "$T/repeat-failure"
-  reject tb_transaction tb_enable; rg -q 'restoration is incomplete' "$T/error"
-  [[ -f $T/setup-recovery.json ]]; reject tb_transaction tb_enable; rg -q 'needs recovery' "$T/error"
-  echo partial > "$TB_CONFIG"; rm "$T/unit-failure"
-  tb_config_restore; cmp "$TB_CONFIG" "$T/original"
-}
-test_disable_restores_matching_boot_state() {
-  boot_fixture; tb_prepare; tb_boot_change true; cp "$TB_STATE" "$T/original"
-  echo 'disable omarchy-thunderbolt-authorization.service' > "$T/unit-failure"
-  reject tb_transaction tb_disable
-  cmp "$TB_STATE" "$T/original"; [[ -f $TB_MARKER && ! -f $T/setup-recovery.json ]]
-  check '.devices[0].Policy=="manual" and .domains[0].BootACL==["",""]' "$T/inventory"
-}
-test_disable_hands_off_only_our_records() {
-  tb_prepare
-  tb_approve "$(identity)" true >/dev/null
-  edit_inventory '.devices += [(.devices[0] | .Uid="existing" | .path="/devices/2" | .Policy="manual")]'
-  tb_approve "$(tb_snapshot | jq -c '.devices[1].identity')" true >/dev/null
-  tb_admin disable
-  check '.enabled==false and .enrolled==null and (.trusted|length)==2' "$TB_STATE"
-  check '.manager.AuthMode=="enabled" and .devices[0].Policy=="auto" and .devices[1].Policy=="manual"' "$T/inventory"
-  [[ ! -f $TB_MARKER && ! -f $T/setup-recovery.json ]]
-  # After a completed handoff, an administrator may choose manual themselves.
-  edit_inventory '.devices[0].Policy="manual"'
-  tb_admin enable
-  tb_admin disable
-  check 'all(.devices[]; .Policy=="manual")' "$T/inventory"
-}
-test_disable_hands_off_disconnected_device() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  edit_inventory '.devices[0].Status="disconnected"'
-  tb_admin disable
-  check '.devices[0].Policy=="auto"' "$T/inventory"
-}
-test_disable_preserves_recreated_manual_record() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  edit_inventory '.devices[0].StoreTime=200'
-  tb_admin disable
-  check '.devices[0].Policy=="manual"' "$T/inventory"
-}
-test_disable_preserves_original_disabled_mode() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  edit_state '.original_authmode="disabled"'
-  tb_admin disable
-  check '.manager.AuthMode=="disabled" and .devices[0].Policy=="auto"' "$T/inventory"
-}
-test_disable_handoff_after_boot_protection() {
-  tb_prepare; tb_boot_change true
-  tb_approve "$(identity)" true >/dev/null
-  tb_admin disable
-  check '.enabled==false and .boot_protection==false' "$TB_STATE"
-  check '.devices[0].Policy=="auto" and (.domains[0].BootACL|index("device-1"))!=null' "$T/inventory"
-}
-test_disable_handoff_rolls_back_policies_and_acl() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  edit_inventory '.domains[0].BootACL=["unrelated",""]'
-  cp "$TB_STATE" "$T/original"
-  echo 'disable omarchy-thunderbolt-authorization.service' > "$T/unit-failure"
-  reject tb_admin disable
-  cmp "$TB_STATE" "$T/original"
-  check '.manager.AuthMode=="disabled" and .devices[0].Policy=="manual" and .domains[0].BootACL==["unrelated",""]' "$T/inventory"
-  [[ -f $TB_MARKER && ! -f $T/setup-recovery.json ]]
-}
-test_disable_handoff_failure_keeps_protection() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  tb_unit_state() { echo '{"active":true,"enabled":true}'; }
-  touch "$T/restore-failure"
-  reject tb_admin disable
-  check '.enabled and .enrolled["device-1"]!=null' "$TB_STATE"
-  check '.manager.AuthMode=="disabled" and .devices[0].Policy=="manual"' "$T/inventory"
-  [[ -f $TB_MARKER && ! -f $T/setup-recovery.json ]]
-  ! rg -q '^disable ' "$T/units"
-  [[ $(tail -1 "$T/units") == "start omarchy-thunderbolt-authorization.service" ]]
-}
-test_disable_handoff_verifies_policy_writes() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  touch "$T/policy-noop"
-  reject tb_admin disable
-  rg -q 'did not retain the requested Policy' "$T/error"
-  check '.enabled and .enrolled["device-1"]!=null' "$TB_STATE"
-  check '.manager.AuthMode=="disabled" and .devices[0].Policy=="manual"' "$T/inventory"
-  [[ -f $TB_MARKER && ! -f $T/setup-recovery.json ]]
-}
-test_disable_handoff_verifies_policy_after_restart() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  touch "$T/restart-policy-failure"
-  reject tb_admin disable
-  check '.enabled and .enrolled["device-1"]!=null' "$TB_STATE"
-  check '.manager.AuthMode=="disabled" and .devices[0].Policy=="manual"' "$T/inventory"
-  [[ -f $TB_MARKER && ! -f $T/setup-recovery.json ]]
-}
-test_disable_handoff_incomplete_rollback_is_recoverable() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  echo 'disable omarchy-thunderbolt-authorization.service' > "$T/unit-failure"
-  touch "$T/boot-failure"
-  reject tb_admin disable
-  rg -q 'restoration is incomplete' "$T/error"
-  [[ -f $T/setup-recovery.json ]]
-  rm "$T/boot-failure"
-  tb_admin recover
-  check '.enabled and .enrolled["device-1"]!=null' "$TB_STATE"
-  check '.manager.AuthMode=="disabled" and .devices[0].Policy=="manual" and .domains[0].BootACL==["device-1",""]' "$T/inventory"
-  [[ -f $TB_MARKER && ! -f $T/setup-recovery.json ]]
-}
-test_disable_offline_controller_is_unchanged() {
-  tb_prepare; tb_approve "$(identity)" true >/dev/null
-  edit_inventory '.domains[0].SysfsPath=""'
-  reject tb_admin disable
-  rg -q 'Reconnect every Thunderbolt controller' "$T/error"
-  check '.enabled' "$TB_STATE"
-  [[ ! -s $T/units && ! -f $T/setup-recovery.json ]]
-}
-test_boot_policy_reconnection_and_restore() {
-  boot_fixture; tb_boot_change true
-  check '.devices[0].Policy=="manual" and .domains[0].BootACL==["",""]' "$T/inventory"
-  check '.boot_protection and .trusted["device-1"]!=null' "$TB_STATE"
-  edit_inventory '.devices[0].Policy="auto" | .domains[0].BootACL=["device-1",""]'
-  tb_snapshot > "$T/result"; check '.warnings|length>0' "$T/result"
-  tb_reconcile > "$T/result"; check '.error==""' "$T/result"
-  check '.domains[0].BootACL==["",""]' "$T/inventory"
-  tb_boot_change false
-  check '.devices[0].Policy=="auto" and .domains[0].BootACL==["device-1",""]' "$T/inventory"
-}
-test_boot_change_rollback() {
-  boot_fixture; edit_inventory '.domains[0].BootACL=["device-1","other"]'
-  cp "$TB_STATE" "$T/original"; touch "$T/boot-failure"
-  reject tb_boot_change true
-  check '.devices[0].Policy=="auto" and .domains[0].BootACL==["device-1","other"]' "$T/inventory"
-  cmp <(jq -cS . "$TB_STATE") <(jq -cS . "$T/original"); [[ ! -e $T/boot-recovery.json ]]
-}
-test_boot_recovery_retained() {
-  boot_fixture; edit_inventory '.domains[0].BootACL=["device-1","other"]'
-  cp "$TB_STATE" "$T/original"; touch "$T/boot-failure" "$T/restore-failure"
-  reject tb_boot_change true; rg -q 'recovery is incomplete' "$T/error"; [[ -f $T/boot-recovery.json ]]
-  rm "$T/boot-failure" "$T/restore-failure"; tb_boot_recover
-  cmp <(jq -cS . "$TB_STATE") <(jq -cS . "$T/original"); [[ ! -e $T/boot-recovery.json ]]
-}
-test_unsupported_boot_cannot_succeed() {
-  boot_fixture; cp "$T/inventory" "$T/original"
-  local expression
-  for expression in '.SysfsPath=""' '.SecurityLevel="none"' '.BootACL=[]'; do
-    cp "$T/original" "$T/inventory"; edit_inventory ".domains[0] |= ($expression)"
-    reject tb_boot_change true
-  done
-  [[ ! -s $T/operations ]]
-}
-test_install_defers_owner() {
-  install() { :; }
-  function /usr/bin/omarchy-thunderbolt-authorization-admin() { echo "helper $*"; }
-  export OMARCHY_PATH=$ROOT OMARCHY_INSTALL_USER=''
-  source "$ROOT/install/config/thunderbolt-authorization.sh" > "$T/output"
-  ! rg -q helper "$T/output"; [[ ! -s $T/units ]]
-  OMARCHY_INSTALL_USER=lab
-  source "$ROOT/install/config/thunderbolt-authorization.sh" > "$T/output"
-  rg -q 'helper prepare' "$T/output"; rg -q '^enable omarchy-thunderbolt-authorization.service$' "$T/units"
-}
-test_offline_reset_scrubs_private_state() {
-  source "$ROOT/install/helpers/thunderbolt-policy.sh"
-  local root="$T/clone" unit="$TB_SERVICE"
-  mkdir -p "$root/etc/systemd/system" "$root${TB_STATE%/*}" "$root${TB_MARKER%/*}"
-  cp "$ROOT/etc/systemd/system/$unit" "$root/etc/systemd/system/"
-  command systemctl --root="$root" enable "$unit" >/dev/null 2>&1
-  touch "$root$TB_MARKER" "$root$TB_STATE" "$root${TB_STATE%/*}/setup-recovery.json"
-  local kind
-  for kind in devices keys domains; do mkdir -p "$root/var/lib/boltd/$kind"; touch "$root/var/lib/boltd/$kind/old"; done
-  tb_reset_root "$root"
-  [[ ! -e $root$TB_MARKER && ! -e $root${TB_STATE%/*} && ! -e $root/etc/systemd/system/multi-user.target.wants/$unit ]]
-  [[ $(ls "$root/var/lib/boltd") == "boltd.conf" && $(tb_config_authmode "$root/var/lib/boltd/boltd.conf") == "enabled" ]]
-}
-test_live_reset_refused() { reject tb_reset_root /; }
-test_trusted_reconnect_no_alert() {
-  edit_state '.trusted["device-1"]={Uid:"device-1",Name:"Dock",Vendor:"Vendor"}'
-  public_fixture; tb_scan watch1 >/dev/null; [[ ! -s $T/notifications ]]
-}
-test_unavailable_warns_once() {
-  tb_scan() { return 1; }
-  tb_wait() { count=$((count+1)); ((count<4)) || exit 99; }
-  local count=0
-  reject tb_watch
-  [[ $(cat "$T/notifications") == "attention" ]]
-}
-test_failed_delivery_retries_other_devices() {
-  edit_inventory '.devices += [(.devices[0] | .Uid="device-2")]'; public_fixture; touch "$T/notify-failure"
-  tb_scan watch1 >/dev/null; [[ $(request_count) == 1 ]]
-  tb_scan watch1 >/dev/null; [[ $(request_count) == 2 && $(wc -l < "$T/notifications") == 3 ]]
-}
-test_restarts_restore_requests() {
-  public_fixture; tb_scan watch1 >/dev/null; local old; old=$(request)
-  tb_scan watch1 >/dev/null; [[ $(wc -l < "$T/notifications") == 1 ]]
-  edit_inventory '.owner=":1.9"'; public_fixture
-  tb_scan watch1 >/dev/null; [[ $(request) != "$old" ]]
-  tb_scan watch2 >/dev/null; [[ $(request_count) == 1 && $(wc -l < "$T/notifications") == 3 ]]
-}
-test_inventory_failure_preserves_request() {
-  public_fixture; tb_scan watch1 >/dev/null; local path; path=$(request)
-  rm "$T/public"; reject tb_scan watch1; [[ -f $path ]]
-}
-test_replacement_during_dialog_rejected() {
-  public_fixture; tb_scan watch1 >/dev/null; local path; path=$(request)
-  gum() {
-    if [[ $1 == "choose" ]]; then
-      jq '.devices[0].identity.Uid="replacement"' "$T/public" > "$T/next"; mv "$T/next" "$T/public"
-      echo 'Always allow this device'
-    fi
-  }
-  reject tb_review "${path##*/}" # A filename is not a valid token.
-  reject tb_review "$(basename "$path" .json)"
-  check '.devices[0].status=="connected"' "$T/public"
-}
-test_lost_reply_keeps_approval_intent() {
-  public_fixture; tb_scan watch1 >/dev/null; local path; path=$(request)
-  echo 'Always allow this device' > "$T/choice"; touch "$T/lost-reply"
-  sleep() { review_tick; }
-  reject tb_review "$(basename "$path" .json)"
-  check '.approval=="Always allow this device"' "$path"
-  tb_scan watch1 >/dev/null; [[ -f $path && $(wc -l < "$T/notifications") == 2 ]]
-  tb_scan watch2 >/dev/null; [[ ! -f $path && $(wc -l < "$T/notifications") == 3 ]]; path=$(request)
-  rm "$T/lost-reply"; gum() { fail 'Saved approval must not ask again'; }
-  tb_review "$(basename "$path" .json)" >/dev/null
-  [[ ! -f $path ]]
-}
-test_disconnect_and_untrusted_text() {
-  edit_inventory '.devices[0].Name="$(touch /tmp/untrusted)\u001b[2J"'
-  public_fixture; tb_scan watch1 >/dev/null
-  [[ $(basename "$(request)") =~ ^request-[0-9a-f]{64}.json$ ]]
-  [[ $(jq '.devices[0].Name' "$T/inventory" | tb_safe_text) != *$'\e'* ]]
-  edit_inventory '.devices=[]'; public_fixture; tb_scan watch1 >/dev/null; [[ $(request_count) == 0 ]]
-}
-test_snapshot_freshness_and_disabled_state() {
-  # Exercise the real public reader, including freshness after daemon failure.
-  source "$ROOT/install/helpers/thunderbolt-policy.sh"
-  TB_RUNTIME="$T/runtime"
-  jq -cn --argjson now "$(date +%s)" '{available:true,time:$now,generation:"generation-a"}' > "$TB_RUNTIME/snapshot.json"
-  tb_public_snapshot >/dev/null
-  jq '.time-=30' "$TB_RUNTIME/snapshot.json" > "$T/next"; mv "$T/next" "$TB_RUNTIME/snapshot.json"
-  reject tb_public_snapshot
-  echo generation-b > "$TB_RUNTIME/generation"; reject tb_public_snapshot
-}
-test_wait_times_out_without_input() {
-  local start=$EPOCHSECONDS
-  TB_TICK='' tb_wait 1
-  (( EPOCHSECONDS - start >= 1 && EPOCHSECONDS - start < 10 ))
-}
-test_daemon_rechecks_controller_free_bolt_less_often() {
-  touch "$TB_MARKER"; TB_IDLE_RECHECK=600
-  local tick=0 extra='{}'
-  expect() { [[ $(wc -l < "$T/reconciles") == "$1" ]] || fail "tick $tick: expected $1 reconciles" "$(wc -l < "$T/reconciles")"; }
-  tb_reconcile() {
-    echo >> "$T/reconciles"
-    jq -cn --argjson time "$EPOCHSECONDS" --argjson extra "$extra" \
-      '{available:true,time:$time,generation:"g",domains:[],devices:[],warnings:[],error:"",boot_protection:false} + $extra'
-  }
-  tb_wait() {
-    tick=$((tick + 1))
-    case $tick in
-      1) expect 1 ;;
-      2) expect 1; mkdir "$TB_SYSFS/domain0" ;;                      # idle: no reconcile
-      3) expect 2; rmdir "$TB_SYSFS/domain0" ;;                      # a controller appeared
-      4) expect 2; edit_state '.trusted.x={}' ;;
-      5) expect 3; touch "${TB_STATE%/*}/boot-recovery.json" ;;      # the policy changed
-      6) expect 4; rm "${TB_STATE%/*}/boot-recovery.json"            # a recovery checkpoint
-         extra='{"devices":[{"Uid":"device-1"}]}'; edit_state '.trusted.y={}' ;;
-      7) expect 5 ;;                                                 # devices from here on
-      8) expect 6; rm "$TB_MARKER" ;;                                # so every tick reconciles
-    esac
-  }
-  tb_daemon
-  [[ $tick == 8 ]]
-}
-test_daemon_rechecks_after_the_idle_interval() {
-  touch "$TB_MARKER"; TB_IDLE_RECHECK=2
-  local tick=0
-  tb_reconcile() {
-    echo >> "$T/reconciles"
-    jq -cn --argjson time "$EPOCHSECONDS" '{available:true,time:$time,generation:"g",domains:[],devices:[],warnings:[],error:"",boot_protection:false}'
-  }
-  tb_wait() {
-    tick=$((tick + 1))
-    case $tick in
-      1) sleep 2.1 ;;
-      2) [[ $(wc -l < "$T/reconciles") == 2 ]] || fail "the idle check did not expire"; rm "$TB_MARKER" ;;
-    esac
-  }
-  tb_daemon
-}
-test_daemon_failed_reconcile_keeps_every_tick() {
-  touch "$TB_MARKER"; TB_IDLE_RECHECK=600
-  local tick=0
-  tb_reconcile() { echo >> "$T/reconciles"; tb_fail 'Bolt unavailable'; }
-  tb_wait() { tick=$((tick + 1)); (( tick < 3 )) || rm "$TB_MARKER"; }
-  tb_daemon 2>/dev/null
-  [[ $(wc -l < "$T/reconciles") == 3 ]]
-  check '.available==false' "$TB_RUNTIME/snapshot.json"
-}
-test_watch_skips_only_unchanged_clean_snapshots() {
-  local tick=0 start=$EPOCHSECONDS
-  publish() { jq -cnS --argjson time "$1" --arg generation generation-a --argjson devices "${2:-[]}" \
-    '{available:true,time:$time,generation:$generation,devices:$devices,warnings:[],error:""}' > "$TB_RUNTIME/snapshot.json"; }
-  expect() { [[ $(wc -l < "$T/scans") == "$1" ]] || fail "tick $tick: expected $1 scans" "$(wc -l < "$T/scans")"; }
-  tb_scan() { echo >> "$T/scans"; cat "$TB_RUNTIME/snapshot.json"; }
-  publish "$start"
-  tb_wait() {
-    tick=$((tick + 1))
-    case $tick in
-      1) expect 1 ;;
-      2) expect 1; touch "$TB_REQUESTS/request-x.json" ;;            # unchanged: skipped
-      3) expect 2; rm "$TB_REQUESTS/request-x.json" ;;               # a request in flight
-      4) expect 2; publish "$((start - 5))" ;;
-      5) expect 3; echo generation-b > "$TB_RUNTIME/generation" ;;   # a new snapshot
-      6) expect 4; echo generation-a > "$TB_RUNTIME/generation"      # another daemon
-         publish "$start" '[{"identity":{}}]' ;;
-      7) expect 5 ;;                                                 # devices from here on
-      8) expect 6; exit 0 ;;                                         # so every tick scans
-    esac
-  }
-  (tb_watch)
-}
-test_watch_rescans_a_stale_snapshot() {
-  local tick=0
-  jq -cnS --argjson time "$((EPOCHSECONDS - 30))" \
-    '{available:true,time:$time,generation:"generation-a",devices:[],warnings:[],error:""}' > "$TB_RUNTIME/snapshot.json"
-  tb_scan() { echo >> "$T/scans"; cat "$TB_RUNTIME/snapshot.json"; }
-  tb_wait() { tick=$((tick + 1)); (( tick < 3 )) || exit 0; }
-  (tb_watch)
-  [[ $(wc -l < "$T/scans") == 3 ]]
-}
-test_invalid_state_not_skipped_by_migration() {
-  echo '{"enabled":false}' > "$TB_STATE"; reject tb_admin migrate
-  [[ ! -s $T/units ]]
-}
-
-for case in $(declare -F | awk '$3 ~ /^test_/ {print $3}'); do
-  (fixture; "$case")
-  pass "Thunderbolt ${case#test_}"
-done
@@ -1,31 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-source "$ROOT/test/shell.d/base-test.sh"
-fixture=$(mktemp -d)
-trap 'rm -rf -- "$fixture"' EXIT
-for name in admin approve daemon; do
-  # Map the security library and stop before service work, including when the
-  # suite itself runs as root. Startup checks remain the production code.
-  sed -e "s|source /usr/bin/omarchy-security-functions|source $ROOT/bin/omarchy-security-functions|" \
-    -e 's|source /usr/share/omarchy/install/helpers/thunderbolt-policy.sh|exit 126|' \
-    "$ROOT/bin/omarchy-thunderbolt-authorization-$name" > "$fixture/entry"
-  chmod 755 "$fixture/entry"
-  printf 'set -p\n' > "$fixture/decoy"
-  if BASH_ENV="$fixture/decoy" /usr/bin/bash "$fixture/entry" -p; then
-    fail "$name accepts ordinary Bash with a decoy -p"
-  fi
-  printf 'touch "%s"\n' "$fixture/injected" > "$fixture/startup"
-  # The entrypoint must suppress startup files and exported functions before
-  # checking EUID or reaching the fixture's service-work boundary.
-  if BASH_ENV="$fixture/startup" "$fixture/entry" >/dev/null 2>&1; then
-    fail "$name passed the fixture service-work boundary"
-  fi
-  [[ ! -e $fixture/injected ]] || fail "$name executed BASH_ENV"
-  if /usr/bin/env 'BASH_FUNC_source%%=() { echo injected > "$TB_TEST_INJECTED"; }' \
-    TB_TEST_INJECTED="$fixture/injected" "$fixture/entry" >/dev/null 2>&1; then
-    fail "$name passed the fixture boundary with an exported function"
-  fi
-  [[ ! -e $fixture/injected ]] || fail "$name imported an exported function"
-  pass "Thunderbolt $name rejects unsafe Bash startup"
-done
@@ -1,57 +0,0 @@
-#include <usbguard/Rule.hpp>
-#include <fstream>
-#include <iostream>
-#include <stdexcept>
-#include <string>
-
-static std::string read(const char* path) {
-  std::ifstream file(path);
-  std::string text;
-  std::getline(file, text);
-  if (text.empty()) throw std::runtime_error("empty rule");
-  return text;
-}
-
-static std::string replace(std::string text, const std::string& from, const std::string& to) {
-  const auto index = text.find(from);
-  if (index == std::string::npos) throw std::runtime_error("missing attribute");
-  text.replace(index, from.size(), to);
-  return text;
-}
-
-static void check(const char* name, const usbguard::Rule& policy, const usbguard::Rule& device, bool expected) {
-  if (policy.appliesTo(device) != expected) throw std::runtime_error(name);
-  std::cout << "ok - native USBGuard: " << name << '\n';
-}
-
-int main(int argc, char** argv) {
-  if (argc != 3) return 2;
-  // Test the policy produced by the real Bash implementation, not a C++ copy.
-  const auto policy = usbguard::Rule::fromString(read(argv[1]));
-  const auto text = read(argv[2]);
-  const auto device = usbguard::Rule::fromString(text);
-  check("original connection", policy, device, true);
-  auto moved = device;
-  moved.setViaPort("9-9.9");
-  check("another port", policy, moved, true);
-  moved.setParentHash("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=");
-  check("another hub", policy, moved, true);
-  auto reloaded = usbguard::Rule::fromString(policy.toString());
-  check("serialized policy reload on new hub", reloaded, moved, true);
-  check("reconnect on original port", reloaded, device, true);
-  auto different = moved;
-  different.setHash("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=");
-  check("different hash denied", policy, different, false);
-  different = moved;
-  different.setSerial("different");
-  check("different serial denied", policy, different, false);
-  different = moved;
-  different.setName("different");
-  check("different name denied", policy, different, false);
-  check("different product denied", policy, usbguard::Rule::fromString(replace(text, "046d:c53a", "046d:c53b")), false);
-  check("different vendor denied", policy, usbguard::Rule::fromString(replace(text, "046d:c53a", "046e:c53a")), false);
-  check("different interface denied", policy, usbguard::Rule::fromString(replace(text, "03:00:00", "08:06:50")), false);
-  check("different connection type denied", policy, usbguard::Rule::fromString(replace(text, "with-connect-type \"unknown\"", "with-connect-type \"hotplug\"")), false);
-  // Existing unmarked/manual rules remain location-bound.
-  check("legacy rule still restricts ports and hubs", device, moved, false);
-}
@@ -93,7 +93,7 @@ sed -n '/^rekey_luks() {/,/^}/p; /^run_provisioning() {/,/^}/p; /^cleanup_oem_st
  /^platform_ready() {/,/^}/p; /^run_setup() {/,/^}/p
  /^rekey_accepts_password() {/,/^}/p' \
  "$ROOT/bin/omarchy-provision-owner" |
-  sed -e "s|/etc/|$tmp/etc/|g" -e "s|/usr/bin/omarchy-thunderbolt-authorization-admin|omarchy-thunderbolt-authorization-admin|" >"$tmp/provision.sh"
+  sed "s|/etc/|$tmp/etc/|g" >"$tmp/provision.sh"
 grep -q '^run_provisioning() {' "$tmp/provision.sh" && grep -q '^run_setup() {' "$tmp/provision.sh" ||
  fail "omarchy-provision-owner defines its setup and provisioning worker"

@@ -241,11 +241,6 @@ setup_functions() {
  configure_hostname() { :; }
  configure_timezone() { :; }
  finalize_user() { :; }
-  # Accessory enrollment, recorded with whether the staged unlock was gone.
-  omarchy-pkg-present() { return 1; }
-  omarchy-thunderbolt-authorization-admin() {
-    if luks_staged_unlock_remains; then echo "$* early" >>"$TMP/accessories"; else echo "$*" >>"$TMP/accessories"; fi
-  }
  limine_entries_stale() {
    crash_point "re-key returned"
    [[ -e $TMP/stale ]]
@@ -335,7 +330,7 @@ slot_count() {
 fixture() {
  local format=${1:-luks2}
  rm -rf "$tmp/provisioning" "$tmp/etc" "$tmp/boot" "$tmp/log" "$tmp/output" "$tmp/trace" "$tmp/rebuilds" "$tmp/adds" "$tmp/rebuild-fail" "$tmp/kill-noop" \
-    "$tmp/prepare-fail" "$tmp/screen" "$tmp/stale" "$tmp/token-slot" "$tmp/slot-record" "$tmp/record-fail" "$tmp/accessories"
+    "$tmp/prepare-fail" "$tmp/screen" "$tmp/stale" "$tmp/token-slot" "$tmp/slot-record" "$tmp/record-fail"
  mkdir -p "$tmp/provisioning"
  chmod 755 "$tmp/provisioning"
  touch "$tmp/provisioning/pending"
@@ -474,8 +469,6 @@ for run_spec in "${matrix[@]}"; do
  fixture "$format"
  run attempt "$owner_password" || fail "$backend: uninterrupted setup completes" "$(cat "$tmp/log" "$tmp/output")"
  assert_provisioned "uninterrupted" "$owner_password"
-  [[ $(cat "$tmp/accessories" 2>/dev/null) == "owner" ]] ||
-    fail "$backend: accessories are enrolled once, after the staged unlock is gone" "$(cat "$tmp/accessories" 2>/dev/null)"
  total_steps=$(cat "$tmp/steps")
  (( total_steps >= 11 )) || fail "$backend: every durable step is a crash point" "$(cat "$tmp/trace")"
  if [[ $platform == "apple" ]]; then
@@ -352,13 +352,6 @@ assert(
  defaultById['setup.security.passwordless-sudo'].action.includes('omarchy-sudo-passwordless'),
  'menu places Passwordless Sudo under Setup > Security'
 )
-assert(
-  defaultById['setup.security.usb-authorization'].action.includes('omarchy-setup-security-usb-authorization')
-    && defaultById['remove.security.usb-authorization'].action.includes('omarchy-remove-security-usb-authorization')
-    && defaultById['setup.security.usb-authorization-boot'].action.includes('omarchy-setup-security-usb-authorization --boot')
-    && defaultById['remove.security.usb-authorization-boot'].action.includes('omarchy-remove-security-usb-authorization --boot-only'),
-  'menu can enable and remove USB device authorization under Security'
-)
 assert(
  !defaultById['trigger.toggle.direct-boot'] && !defaultById['trigger.toggle.passwordless-sudo'],
  'menu removes the relocated toggles from Trigger > Toggle'
@@ -1,13 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
-
-bash "$ROOT/test/shell.d/fixtures/thunderbolt/policy-test.sh"
-bash "$ROOT/test/shell.d/fixtures/thunderbolt/startup-test.sh"
-
-if [[ -n ${BOLT_TEST_SOURCE:-} ]]; then
-  /usr/bin/python3 "$ROOT/test/shell.d/fixtures/thunderbolt/bolt-integration.py" "$ROOT"
-else
-  skip "real boltd integration needs BOLT_TEST_SOURCE and an UMockdev environment"
-fi
@@ -1,47 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
-source "$ROOT/install/helpers/usb-authorization-policy.sh"
-scratch=$(mktemp -d)
-trap 'rm -rf "$scratch"' EXIT
-
-identity='id 046d:c53a serial "" name "USB Receiver" hash "KCUFt1MumW4Pfs/8YXWzGQB6Hsnm8qkDqFVjfY0NIBY="'
-interfaces='with-interface { 03:01:01 03:01:02 03:00:00 } with-connect-type "unknown"'
-location='parent-hash "m7yTNWlczwBbYn+uRP6TRsY5AceKmAZ0Et6mgy58+/o=" via-port "3-1.1.2.1"'
-device="allow $identity $location $interfaces"
-portable=$(usb_authorization_portable_rule "$device")
-[[ $portable == "allow $identity $interfaces"' label "omarchy-usb-authorization-v1"' ]] || fail "only device location is removed"
-[[ $(usb_authorization_portable_rule "${device/#allow/block}") == "$portable" ]] || fail "blocked approvals use the same portable identity"
-pass "portable USB rules retain every device identity attribute"
-
-# A canonical escaped name cannot cause its contents to become attributes.
-name='name "Receiver \" via-port \"fake\" parent-hash \"fake\" $(touch /tmp/usb-injection)"'
-hostile="allow id 046d:c53a serial \"\\\\\" $name hash \"hash\" $location $interfaces"
-expected="allow id 046d:c53a serial \"\\\\\" $name hash \"hash\" $interfaces"' label "omarchy-usb-authorization-v1"'
-[[ $(usb_authorization_portable_rule "$hostile") == "$expected" ]] || fail "quoted attribute text must remain data"
-if usb_authorization_portable_rule 'allow id 046d:c53a name "unterminated' >/dev/null; then fail "reject unmatched quote"; fi
-if usb_authorization_portable_rule 'allow id 046d:c53a via-port' >/dev/null; then fail "reject missing location value"; fi
-pass "USB portable parsing preserves escaped and hostile descriptor text"
-
-# Exercise the actual root entrypoint startup boundary without root work.
-sed -e "s|source /usr/bin/omarchy-security-functions|source $ROOT/bin/omarchy-security-functions|" \
-  -e 's|source /usr/share/omarchy/install/helpers/usb-authorization-policy.sh|exit 126|' \
-  "$ROOT/bin/omarchy-usb-authorization-approve" >"$scratch/entry"
-chmod 755 "$scratch/entry"
-printf 'set -p\n' >"$scratch/decoy"
-if BASH_ENV="$scratch/decoy" /usr/bin/bash "$scratch/entry" -p; then fail "ordinary Bash with decoy -p is rejected"; fi
-printf 'touch "%s"\n' "$scratch/injected" >"$scratch/startup"
-if BASH_ENV="$scratch/startup" "$scratch/entry" >/dev/null 2>&1; then fail "startup fixture boundary"; fi
-if /usr/bin/env 'BASH_FUNC_source%%=() { touch "$USB_TEST_INJECTED"; }' USB_TEST_INJECTED="$scratch/injected" "$scratch/entry" >/dev/null 2>&1; then fail "exported function fixture boundary"; fi
-[[ ! -e $scratch/injected ]] || fail "privileged entrypoint executes caller startup code"
-pass "USB privileged approval rejects unsafe Bash startup"
-
-if ! command -v g++ >/dev/null || [[ ! -f /usr/include/usbguard/Rule.hpp ]]; then
-  skip "native USBGuard matcher requires g++ and USBGuard development headers"
-  exit 0
-fi
-printf '%s\n' "$device" >"$scratch/device"
-printf '%s\n' "$portable" >"$scratch/policy"
-g++ -std=c++17 "$ROOT/test/shell.d/fixtures/usb-authorization/match.cpp" -lusbguard -o "$scratch/match"
-"$scratch/match" "$scratch/policy" "$scratch/device"
@@ -1,257 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
-source "$ROOT/bin/omarchy-usb-authorization-boot"
-
-scratch=$(mktemp -d)
-trap 'rm -rf "$scratch"' EXIT
-machine=12345678901234567890123456789012
-export calls="$scratch/calls"
-: >"$calls"
-
-# Optional integration run uses real sbctl keys and sbattach in isolated paths.
-sbctl() {
-  printf '%s\n' "$1" >>"$calls"
-  [[ ${SIGN_FAIL:-0} != 1 || $1 != sign ]] || return 1
-  [[ ${VERIFY_FAIL:-0} != 1 || $1 != verify ]] || return 1
-  if [[ -n ${USB_TEST_SBCTL_CONFIG:-} ]]; then
-    /usr/bin/sbctl --config "$USB_TEST_SBCTL_CONFIG" "$@"
-  elif [[ $1 == verify ]]; then
-    jq -n --arg file "${!#}" --argjson signed "${TEST_SIGNED:-1}" '[{file_name: $file, is_signed: $signed}]'
-  fi
-}
-sbattach() {
-  if [[ -n ${USB_TEST_SBATTACH:-} ]]; then
-    "$USB_TEST_SBATTACH" "$@"
-  fi
-}
-omarchy-cmd-missing() { return 1; }
-limine-enroll-config() { [[ ${ENROLL_FAIL:-0} != 1 ]]; }
-usb_authorization_secure_boot_enabled() { [[ ${SECURE_BOOT:-1} == 1 ]]; }
-# Bootloader enrollment/rollback is exercised with real EFI binaries in its own suite.
-usb_authorization_verify_bootloader() { return 0; }
-
-fixture() {
-  local embedded="$1" hash digest image_base
-  esp="$scratch/case-$RANDOM"
-  history="$esp/$machine/limine_history"
-  manifest="$history/snapshots.json"
-  cache="$esp/cache.json"
-  config="$esp/limine.conf"
-  mkdir -p "$history"
-  printf '%s\0' "$embedded" >"$esp/cmdline"
-  cp /usr/lib/systemd/boot/efi/linuxx64.efi.stub "$esp/image.efi"
-  image_base=$(objdump -p "$esp/image.efi" | awk '$1 == "ImageBase" {print "0x" $2}')
-  objcopy --add-section .cmdline="$esp/cmdline" --change-section-vma .cmdline="$((image_base + 0x100000))" "$esp/image.efi"
-  if [[ -n ${USB_TEST_SBCTL_CONFIG:-} ]]; then
-    sbctl sign "$esp/image.efi" >/dev/null
-  fi
-  digest=$(sha256sum "$esp/image.efi"); digest=${digest%% *}
-  old_name="test.efi_sha256_$digest"
-  cp "$esp/image.efi" "$history/$old_name"
-  hash=$(b2sum "$esp/image.efi"); hash=${hash%% *}
-  printf '/Omarchy\ncomment: machine-id=%s\n  //snapshot\n  comment: kernel-id=linux\n  path: boot():/%s/limine_history/%s#%s\n  cmdline: %s rootflags=subvol=/snapshot\n' \
-    "$machine" "$machine" "$old_name" "$hash" "$embedded" >"$config"
-  jq -n --arg name "$old_name" --arg hash "$hash" --arg machine "$machine" --arg cmdline "$embedded" '
-    def kernel:
-      {imageDetails: [{fileHashName: $name, fileName: "test.efi",
-        snapshotFilePathLine: "/" + $machine + "/limine_history/" + $name + "#" + $hash,
-        filePathLine: "/EFI/Linux/test.efi#" + $hash, properties: {HASH: "#" + $hash}}],
-       cmdlineDetails: [{cmdline: $cmdline, snapshotCmdline: $cmdline + " rootflags=subvol=/snapshot"}],
-       allInConfig: ["path: boot():/EFI/Linux/test.efi#" + $hash, "cmdline: " + $cmdline],
-       allInSnapshotConfig: ["comment: kernel-id=linux", "path: boot():/" + $machine + "/limine_history/" + $name + "#" + $hash, "cmdline: " + $cmdline + " rootflags=subvol=/snapshot"], subKernels: []};
-    {jsonFormatVersion: "1.3.0", snapshotEntries: [{kernelEntries: [kernel | .subKernels = [kernel]]}]}
-  ' >"$manifest"
-  cp "$manifest" "$manifest.old"
-  cp "$manifest" "$cache"
-  cp "$manifest" "$esp/before.json"
-  cp "$config" "$esp/before.conf"
-  : >"$calls"
-}
-
-for expected in enabled disabled; do
-  old='quiet'
-  [[ $expected != disabled ]] || old+=' usbcore.authorized_default=0'
-  fixture "$old"
-  usb_authorization_reconcile_archived_images "$expected" "$config" "$esp" "$machine" "$cache"
-  new_name=$(jq -r '.snapshotEntries[0].kernelEntries[0].imageDetails[0].fileHashName' "$manifest")
-  [[ $new_name != "$old_name" && -f $history/$new_name ]] || fail "conflicting archives get new content-addressed copies"
-  cmp "$history/$old_name" "$esp/image.efi" || fail "original archived image remains unchanged"
-  digest=$(sha256sum "$history/$new_name")
-  [[ $new_name == *"${digest%% *}" ]] || fail "replacement name matches its content hash"
-  objcopy -O binary --only-section=.cmdline "$history/$new_name" "$esp/section"
-  embedded=$(tr '\0' '\n' <"$esp/section")
-  wanted=quiet
-  [[ $expected != enabled ]] || wanted+=' usbcore.authorized_default=0'
-  [[ $embedded == "$wanted" ]] || fail "replacement must preserve embedded boot arguments and change only USB policy"
-  objcopy -O binary --only-section=.text "$history/$old_name" "$esp/text.before"
-  objcopy -O binary --only-section=.text "$history/$new_name" "$esp/text.after"
-  cmp "$esp/text.before" "$esp/text.after" || fail "archive conversion must not alter executable code"
-  [[ $(grep -c '^sign$' "$calls") == 1 && $(grep -c '^verify$' "$calls") == 2 ]] || fail "deduplicated image must be verified before and after signing"
-  for file in "$manifest" "$manifest.old" "$cache"; do
-    ! grep -Fq "$old_name" "$file" || fail "no old image references may survive in manifests"
-    usb_authorization_rewrite_snapshot_manifest "$expected" "$file"
-    # Both cached and structured restore representations must regenerate valid entries.
-    for format in cached structured; do
-      {
-        printf '/Omarchy\ncomment: machine-id=%s\n  //snapshot\n' "$machine"
-        if [[ $format == cached ]]; then
-          jq -r '.snapshotEntries[0].kernelEntries[0].allInSnapshotConfig[]' "$file"
-        else
-          printf 'comment: kernel-id=linux\n'
-          jq -r '.snapshotEntries[0].kernelEntries[0].subKernels[0] | "path: boot():" + .imageDetails[0].snapshotFilePathLine, "cmdline: " + .cmdlineDetails[0].snapshotCmdline' "$file"
-        fi
-      } >"$esp/regenerated.conf"
-      usb_authorization_verify_boot_entries "$expected" "$esp/regenerated.conf" "$esp" "$machine" enabled || fail "regenerated $format $expected snapshot must verify"
-    done
-  done
-  usb_authorization_rewrite_boot_cmdlines "$expected" "$config" "$machine"
-  usb_authorization_verify_boot_entries "$expected" "$config" "$esp" "$machine" enabled || fail "$expected archive transition must verify under Secure Boot"
-  usb_authorization_reconcile_archived_images "$expected" "$config" "$esp" "$machine" "$cache"
-  [[ $(grep -c '^sign$' "$calls") == 1 ]] || fail "retry must not resign an already-compatible archive"
-  if [[ -n ${USB_TEST_SBCTL_CONFIG:-} ]]; then
-    usb_authorization_verify_signature "$history/$new_name"
-  fi
-  pass "USB $expected transition updates signed history and all cached/structured references"
-done
-
-fixture quiet
-old_hash=$(b2sum "$esp/image.efi"); old_hash=${old_hash%% *}
-printf '  //current\n  comment: kernel-id=current\n  path: boot():/image.efi#%s\n  cmdline: quiet\n' "$old_hash" >>"$config"
-usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache"
-grep -Fq "path: boot():/image.efi#$old_hash" "$config" || fail "preflight must not rewrite hashes of unchanged current images sharing archive content"
-pass "USB archive preflight preserves unchanged current-image hashes"
-
-fixture 'quiet rd.test="two  spaces"'
-usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache"
-new_name=$(jq -r '.snapshotEntries[0].kernelEntries[0].imageDetails[0].fileHashName' "$manifest")
-objcopy -O binary --only-section=.cmdline "$history/$new_name" "$esp/section"
-[[ $(tr '\0' '\n' <"$esp/section") == 'quiet rd.test="two  spaces" usbcore.authorized_default=0' ]] || fail "unrelated quoted arguments must retain their whitespace"
-pass "USB archive policy changes preserve unrelated embedded arguments and executable code"
-
-for failure in SIGN_FAIL VERIFY_FAIL ENROLL_FAIL; do
-  fixture quiet
-  if (export "$failure=1"; usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache") >"$esp/failure.log" 2>&1; then
-    fail "$failure must prevent publication"
-  fi
-  cmp "$config" "$esp/before.conf" || fail "$failure must preserve the original boot menu"
-  for file in "$manifest" "$manifest.old" "$cache"; do
-    cmp "$file" "$esp/before.json" || fail "$failure must preserve every manifest"
-  done
-  cmp "$history/$old_name" "$esp/image.efi" || fail "$failure must preserve the archived image"
-done
-pass "USB archive signing, verification and enrollment failures preserve original references"
-
-fixture quiet
-printf corrupt >>"$history/$old_name"
-if usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache" >"$esp/hash-failure" 2>&1; then
-  fail "corrupt original archive must never be signed"
-fi
-[[ ! -s $calls ]] || fail "hash failure must occur before signing"
-cmp "$config" "$esp/before.conf"
-SECURE_BOOT=0 usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache"
-[[ ! -s $calls ]] || fail "non-Secure-Boot transitions must not rewrite archive images"
-pass "USB archive conversion rejects corruption and skips non-Secure-Boot systems"
-
-if [[ -z ${USB_TEST_SBCTL_CONFIG:-} ]]; then
-  fixture quiet
-  if TEST_SIGNED=0 usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache" >"$esp/unsigned" 2>&1; then
-    fail "a false-success sbctl result cannot authorize signing"
-  fi
-  ! grep -qx sign "$calls" || fail "an unsigned original must not be resigned"
-fi
-for missing in menu manifest; do
-  fixture quiet
-  if [[ $missing == menu ]]; then
-    sed -i '/cmdline:/d' "$config"
-  else
-    jq '.snapshotEntries[0].kernelEntries[0].cmdlineDetails = []' "$manifest" >"$esp/modified"
-    mv "$esp/modified" "$manifest"
-  fi
-  usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache" || fail "embedded-only $missing must support policy changes"
-  usb_authorization_rewrite_boot_cmdlines enabled "$config" "$machine"
-  usb_authorization_verify_boot_entries enabled "$config" "$esp" "$machine" enabled || fail "embedded-only $missing must retain a valid command line"
-done
-for section in .profile .pcrsig; do
-  fixture quiet
-  printf protected >"$esp/protected"
-  objcopy --add-section "$section=$esp/protected" "$history/$old_name" 2>/dev/null
-  if usb_authorization_reconcile_archived_images enabled "$config" "$esp" "$machine" "$cache" >"$esp/protected-failure" 2>&1; then
-    fail "a $section image must require its original builder"
-  fi
-  grep -Fq "($section)" "$esp/protected-failure" || fail "unsupported signing policies need an actionable error"
-  [[ ! -s $calls ]] || fail "unsupported signing policies must not be resigned"
-done
-pass "USB archive conversion requires authentic signatures and preserves boot/unlock requirements"
-
-# Package hooks use this same lock. Installing the optional signature tool
-# must finish before preparation takes the lock, while sync must run under it.
-fixture quiet
-prepare=$(declare -f usb_authorization_prepare_archived_images)
-prepare=${prepare//\/run\/lock\/boot-partition.lock/$scratch\/preflight.lock}
-eval "$prepare"
-omarchy-cmd-missing() { return 0; }
-omarchy-pkg-add() {
-  flock --nonblock "$scratch/preflight.lock" true || fail "package installation must precede the boot lock"
-  printf 'package\n' >>"$calls"
-}
-limine-snapper-sync() {
-  [[ $* == '--no-mutex --no-hooks' ]] || fail "preparation must use the already-held lock"
-  if flock --nonblock "$scratch/preflight.lock" true; then
-    fail "snapshot synchronization must hold the boot lock"
-  fi
-}
-usb_authorization_prepare_archived_images enabled "$config" "$esp" "$machine"
-grep -qx package "$calls" || fail "missing signature tooling must be installed before preparing archives"
-pass "USB archive preparation installs optional tools before taking Limine's lock"
-
-# The disposable Lab runs the actual root-only main function with only boot paths
-# and external build/sync commands redirected into this fixture.
-if [[ ${USB_TEST_MAIN:-0} == 1 ]]; then
-  (( EUID == 0 )) || fail "main-path fixtures require the disposable guest's root"
-  usb_authorization_prepare_archived_images() {
-    usb_authorization_reconcile_archived_images "$1" "$2" "$3" "$machine" "$cache"
-  }
-  limine-mkinitcpio() { return 0; }
-  usb_authorization_sync_and_verify() {
-    local file
-    for file in "$manifest" "$manifest.old" "$cache"; do
-      usb_authorization_rewrite_snapshot_manifest "$1" "$file" || return 1
-    done
-    usb_authorization_rewrite_boot_cmdlines "$1" "$2" "$machine" || return 1
-    usb_authorization_verify_boot_entries "$1" "$2" "$3" "$machine" enabled
-  }
-  for action in enable disable; do
-    old=quiet
-    [[ $action != disable ]] || old+=' usbcore.authorized_default=0'
-    fixture "$old"
-    drop_in="$esp/entry-tool/usb-authorization.conf"
-    limine_defaults="$esp/defaults"
-    limine_conf="$config"
-    boot_path="$esp"
-    printf '# fixture defaults\n' >"$limine_defaults"
-    if [[ $action == disable ]]; then
-      mkdir -p "${drop_in%/*}"
-      printf '%s\n' "$setting" >"$drop_in"
-      usb_authorization_enable_snapshot_setting "$limine_defaults"
-    fi
-    cp "$limine_defaults" "$esp/defaults.before"
-    if (export SIGN_FAIL=1; usb_authorization_main "$action") >"$esp/main-failed" 2>&1; then
-      fail "$action must stop if archive preparation fails"
-    fi
-    cmp "$limine_defaults" "$esp/defaults.before" || fail "$action failure must precede snapshot-setting changes"
-    if [[ $action == enable ]]; then
-      [[ ! -e $drop_in ]] || fail "enable preflight failure must not create the boot setting"
-    else
-      [[ $(<"$drop_in") == "$setting" ]] || fail "disable preflight failure must preserve the boot setting"
-    fi
-    (usb_authorization_main "$action")
-    if [[ $action == enable ]]; then
-      [[ $(<"$drop_in") == "$setting" ]] || fail "successful enable sets the boot policy"
-    else
-      [[ ! -e $drop_in ]] || fail "successful disable clears the boot policy"
-    fi
-    pass "USB $action main path prepares archives before changing boot policy"
-  done
-fi
@@ -1,183 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
-source "$ROOT/bin/omarchy-usb-authorization-boot"
-
-scratch=$(mktemp -d)
-trap 'rm -rf "$scratch"' EXIT
-usb_authorization_secure_boot_enabled() { return 0; }
-usb_authorization_limine_settings() { printf 'x64 %s\n' "${ENROLLMENT:-yes}"; }
-
-# Real PE enrollment always runs. An optional isolated sbctl configuration also
-# exercises real signatures; default runs track signed content without host keys.
-sbctl() {
-  if [[ $1 == sign && ${SIGN_FAIL:-0} == 1 ]]; then
-    return 1
-  fi
-  if [[ -n ${USB_TEST_SBCTL_CONFIG:-} ]]; then
-    /usr/bin/sbctl --config "$USB_TEST_SBCTL_CONFIG" "$@"
-  elif [[ $1 == sign ]]; then
-    sha256sum "${!#}" | cut -d ' ' -f1 >>"$scratch/signed"
-  elif [[ $1 == verify ]]; then
-    local digest signed=0
-    digest=$(sha256sum "${!#}")
-    if grep -qx "${digest%% *}" "$scratch/signed"; then signed=1; fi
-    jq -n --arg file "${!#}" --argjson signed "$signed" '[{file_name: $file, is_signed: $signed}]'
-  fi
-}
-
-fixture() {
-  case_dir=$(mktemp -d "$scratch/case.XXXXXXXX")
-  boot_path="$case_dir/boot"
-  cache="$case_dir/cache"
-  limine_conf="$boot_path/limine.conf"
-  limine_defaults="$case_dir/defaults"
-  drop_in="$case_dir/dropins/usb-authorization.conf"
-  image="$boot_path/EFI/limine/limine_x64.efi"
-  mkdir -p "${image%/*}" "$cache/lss" "${drop_in%/*}"
-  printf 'initial menu\n' >"$limine_conf"
-  printf 'initial kernel\n' >"$boot_path/kernel.efi"
-  printf 'initial snapshot\n' >"$cache/lss/snapshots.json"
-  printf 'initial defaults\n' >"$limine_defaults"
-  : >"$scratch/signed"
-  cp /usr/share/limine/BOOTX64.EFI "$image"
-  if [[ ${ENROLLMENT:-yes} == yes ]]; then
-    digest=$(b2sum "$limine_conf")
-    limine enroll-config "$image" "${digest%% *}" --quiet
-  fi
-  sbctl sign "$image" >/dev/null
-  cp "$image" "$case_dir/original.efi"
-  usb_authorization_verify_bootloader "$limine_conf" "$boot_path"
-}
-
-# Matches the installed wrapper: restore unsigned binary, enroll, attempt sign,
-# then mask failure with a successful final sync. No real ESP is ever touched.
-limine-enroll-config() {
-  cp /usr/share/limine/BOOTX64.EFI "$image"
-  if [[ ${ENROLLMENT:-yes} == yes && ${SKIP_ENROLLMENT:-0} != 1 ]]; then
-    local digest
-    digest=$(b2sum "$limine_conf")
-    limine enroll-config "$image" "${digest%% *}" --quiet || return 1
-  fi
-  sbctl sign "$image" || true
-  sync -f "$image"
-}
-
-# Relocate the outer real flock into scratch. The runner stands in for the
-# namespace child and deliberately mutates the same files as rebuild hooks.
-transaction=$(declare -f usb_authorization_boot_transaction)
-transaction=${transaction//\/run\/lock\/boot-partition.lock/$scratch\/boot.lock}
-eval "$transaction"
-usb_authorization_run_transaction() {
-  if flock --nonblock "$scratch/boot.lock" true; then
-    fail "the real boot lock must cover the entire transaction"
-  fi
-  printf 'changed menu\n' >"$limine_conf"
-  printf 'changed kernel\n' >"$boot_path/kernel.efi"
-  printf 'changed metadata\n' >"$cache/lss/snapshots.json"
-  printf 'new cached backup\n' >"$cache/lss/snapshots.json.old"
-  mkdir -p "$boot_path/$(</etc/machine-id)/limine_history"
-  printf 'new archived backup\n' >"$boot_path/$(</etc/machine-id)/limine_history/snapshots.json.old"
-  printf 'changed defaults\n' >"$limine_defaults"
-  printf '%s\n' "$setting" >"$drop_in"
-  if [[ ${EARLY_FAILURE:-0} == 1 ]]; then
-    cp /usr/share/limine/BOOTX64.EFI "$image"
-    return 1
-  fi
-  if [[ ${UNCHECKED_HOOK:-0} == 1 ]]; then
-    limine-enroll-config
-  else
-    usb_authorization_enroll_config "$limine_conf" "$boot_path"
-  fi
-}
-
-for failure in SIGN_FAIL SKIP_ENROLLMENT EARLY_FAILURE; do
-  fixture
-  if (export "$failure=1"; usb_authorization_boot_transaction enable "$cache") >"$case_dir/failure.log" 2>&1; then
-    fail "$failure must reject the boot transition"
-  fi
-  cmp "$image" "$case_dir/original.efi" || fail "$failure must restore the signed bootloader byte-for-byte without signing"
-  [[ $(<"$limine_conf") == 'initial menu' ]] || fail "$failure must restore matching menu"
-  [[ $(<"$boot_path/kernel.efi") == 'initial kernel' ]] || fail "$failure must restore images referenced by that menu"
-  [[ $(<"$cache/lss/snapshots.json") == 'initial snapshot' ]] || fail "$failure must restore cached snapshot metadata"
-  [[ ! -e $cache/lss/snapshots.json.old && ! -e $boot_path/$(</etc/machine-id)/limine_history/snapshots.json.old ]] || fail "$failure must remove newly created recovery metadata"
-  [[ $(<"$limine_defaults") == 'initial defaults' && ! -e $drop_in ]] || fail "$failure must restore settings including an absent drop-in"
-  usb_authorization_verify_bootloader "$limine_conf" "$boot_path"
-done
-pass "USB boot transitions restore signed Limine, matching menu, images, metadata and settings on failure"
-
-fixture
-printf 'original opt-in\n' >"$drop_in"
-if (SIGN_FAIL=1 UNCHECKED_HOOK=1 usb_authorization_boot_transaction disable "$cache") >"$case_dir/failure.log" 2>&1; then
-  fail "final verification must reject false-success rebuild hooks"
-fi
-cmp "$image" "$case_dir/original.efi" || fail "false-success hooks must restore original signed Limine"
-[[ $(<"$drop_in") == 'original opt-in' ]] || fail "failed disable must preserve an existing drop-in"
-pass "USB boot transitions independently verify enrollment after external hooks"
-
-for enrollment in yes no; do
-  export ENROLLMENT="$enrollment"
-  fixture
-  usb_authorization_boot_transaction enable "$cache"
-  [[ $(<"$limine_conf") == 'changed menu' && -e $drop_in ]] || fail "successful transition must commit"
-  usb_authorization_verify_bootloader "$limine_conf" "$boot_path"
-done
-pass "USB boot transitions commit verified signing with enrollment enabled or disabled"
-
-# Disposable Lab only: exercise the actual namespace runner and both lock
-# inodes, with the installed enrollment/restore functions and real signatures.
-if [[ ${USB_TEST_NAMESPACE:-0} == 1 ]]; then
-  (( EUID == 0 )) || fail "namespace tests require root in the disposable guest"
-  [[ -n ${USB_TEST_SBCTL_CONFIG:-} ]] || fail "namespace tests require isolated signing keys"
-  export ENROLLMENT=yes
-  for outcome in failure success; do
-    fixture
-    cp /usr/share/limine/BOOTX64.EFI "$case_dir/limine_x64.efi"
-    tar -cf "$case_dir/limine.bak" -C "$case_dir" limine_x64.efi
-    lock_inode=$(stat -Lc '%d:%i' /run/lock/boot-partition.lock)
-    # Source the shipped functions in both the parent and namespace child.
-    sed '/^if \[\[ ${BASH_SOURCE\[0\]} == "\$0" \]\]; then/,$d' "$ROOT/bin/omarchy-usb-authorization-boot" >"$case_dir/helper"
-    for variable in scratch case_dir boot_path cache limine_conf limine_defaults drop_in image lock_inode; do
-      printf '%s=%q\n' "$variable" "${!variable}" >>"$case_dir/helper"
-    done
-    declare -f sbctl usb_authorization_limine_settings usb_authorization_secure_boot_enabled >>"$case_dir/helper"
-    cat >>"$case_dir/helper" <<'SCRIPT'
-usb_authorization_main() {
-  [[ $(stat -Lc '%d:%i' /run/lock/boot-partition.lock) != "$lock_inode" ]] || return 1
-  exec 9>/run/lock/boot-partition.lock
-  flock --nonblock 9 || return 1
-  printf 'changed menu\n' >"$limine_conf"
-  printf 'changed kernel\n' >"$boot_path/kernel.efi"
-  source /usr/lib/limine/limine-common-functions
-  LIMINE_DIR_PATH="${image%/*}"
-  LIMINE_EFI_FILE=limine_x64.efi
-  BINARY_TARGET_PATH="$image"
-  BINARY_BACKUP_PATH="$case_dir/limine.bak"
-  LIMINE_CONFIG_PATH="$limine_conf"
-  ENABLE_ENROLL_LIMINE_CONFIG=yes
-  is_sb_installed() { return 0; }
-  is_uefi() { return 0; }
-  limine-enroll-config() { enroll_config; }
-  usb_authorization_enroll_config "$limine_conf" "$boot_path"
-}
-if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
-  usb_authorization_boot_transaction "$1" "$cache"
-fi
-SCRIPT
-    if [[ $outcome == failure ]]; then
-      if SIGN_FAIL=1 bash "$case_dir/helper" enable >"$case_dir/namespace.log" 2>&1; then
-        fail "actual namespace must reject installed wrapper's false success"
-      fi
-      grep -Fq 'Failed to sign' "$case_dir/namespace.log" || fail "failure must reach the installed enrollment function"
-      cmp "$image" "$case_dir/original.efi" || fail "namespace rollback restores original signed bootloader"
-      [[ $(<"$limine_conf") == 'initial menu' && $(<"$boot_path/kernel.efi") == 'initial kernel' ]] || fail "namespace rollback restores matching boot files"
-    else
-      bash "$case_dir/helper" disable >"$case_dir/namespace.log" 2>&1
-      [[ $(<"$limine_conf") == 'changed menu' ]] || fail "namespace success commits"
-    fi
-    usb_authorization_verify_bootloader "$limine_conf" "$boot_path"
-    flock --nonblock /run/lock/boot-partition.lock true || fail "outer lock must be released"
-  done
-  pass "USB real namespace isolates nested locks and recovers installed Limine signing failure"
-fi
@@ -1,108 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-source "$(dirname "$0")/base-test.sh"
-
-# Exercise reset staging in a temporary root with the real offline systemctl.
-# Never invoke the reset command's main function or any actual disk operations.
-python - "$ROOT" <<'PY'
-from pathlib import Path
-import os
-import re
-import shutil
-import subprocess
-import sys
-import tempfile
-
-repo = Path(sys.argv[1])
-source = (repo / 'bin/omarchy-system-factory-reset').read_text()
-functions = []
-for name in ['install_provisioning_units', 'scrub_factory_accounts', 'sanitize_factory_baseline', 'stage_full_reset']:
-  match = re.search(r'^' + name + r'\(\) \{\n.*?^\}', source, re.M | re.S)
-  assert match, name
-  functions.append(match.group())
-
-with tempfile.TemporaryDirectory(prefix='omarchy-usb-reset-') as tmp:
-  scratch = Path(tmp)
-  for scenario in ['enabled', 'disabled', 'absent', 'disable-failure']:
-    root = scratch / scenario
-    top = root / 'top'
-    factory = top / '@factory'
-    for rel in ['etc/systemd/system/basic.target.wants', 'usr/lib/systemd/system',
-          'etc/usbguard', 'usr/bin', 'usr/share/omarchy/install/provisioning']:
-      (factory / rel).mkdir(parents=True, exist_ok=True)
-    (top / '@').mkdir()
-    (top / '@' / 'original-root').touch()
-    (factory / 'etc/passwd').write_text('root:x:0:0:root:/root:/bin/bash\n')
-    (factory / 'etc/machine-id').write_text('old-machine-id\n')
-    policy = 'allow id 1234:0001 name "Original owner keyboard" hash "old-owner"\n'
-    (factory / 'etc/usbguard/rules.conf').write_text(policy)
-    unit = factory / 'usr/lib/systemd/system/usbguard.service'
-    enabled_path = Path('etc/systemd/system/basic.target.wants/usbguard.service')
-    if scenario != 'absent':
-      unit.write_text('[Unit]\nDescription=Fixture USBGuard\n[Service]\nExecStart=/bin/true\n[Install]\nWantedBy=basic.target\n')
-    if scenario in ['enabled', 'disable-failure']:
-      (factory / enabled_path).symlink_to('/usr/lib/systemd/system/usbguard.service')
-    owner = factory / 'usr/bin/omarchy-provision-owner'
-    owner.touch()
-    owner.chmod(0o755)
-    for name in ['omarchy-provision-owner.service', 'omarchy-system-factory-reset-finish.service']:
-      shutil.copyfile(repo / 'install/provisioning' / name,
-              factory / 'usr/share/omarchy/install/provisioning' / name)
-    harness = '''#!/bin/bash
-set -euo pipefail
-TOP_MNT="$1/top"
-NEXT_NAME=@next
-PROVISIONING_DIR=/var/lib/omarchy/provisioning
-LOG_FILE="$1/log"
-log() { :; }
-fail() { echo "$*" >&2; exit 1; }
-btrfs() {
-  if [[ $1 == subvolume && $2 == snapshot ]]; then
-    cp -a "$3" "$4"
-  elif [[ $1 == property ]]; then
-    :
-  else
-    return 90
-  fi
-}
-# Account cleanup has its own real-tool suite; keep this fixture focused on USB.
-usermod() {
-  [[ $1 == --root && ( $2 == "$TOP_MNT/$NEXT_NAME" || $2 == "$TOP_MNT/@factory" ) &&
-    $3 == --password && $4 == '!' && $5 == root ]]
-}
-systemd-id128() { echo new-machine-id; }
-encrypted_install() { return 1; }
-rebuild_next_boot() { :; }
-sync() { :; }
-systemctl() {
-  # All service changes must address the staged root, never the live machine.
-  [[ $1 == "--root=$TOP_MNT/$NEXT_NAME" && $2 == disable && $3 == usbguard.service ]] || return 91
-  [[ $2 != "${FAIL_OPERATION:-}" ]] || return 92
-  command systemctl "$@"
-}
-''' + '\n\n'.join(functions) + '\nstage_full_reset\n'
-    runner = root / 'run'
-    runner.write_text(harness)
-    env = os.environ.copy()
-    env['FAIL_OPERATION'] = 'disable' if scenario == 'disable-failure' else ''
-    result = subprocess.run(['bash', str(runner), str(root)], env=env, capture_output=True, text=True)
-    if scenario == 'disable-failure':
-      assert result.returncode != 0, 'failed disable must abort reset staging'
-      assert (top / '@' / 'original-root').exists(), 'failure must not activate the reset root'
-      assert 'could not disable USBGuard' in result.stderr
-    else:
-      assert result.returncode == 0, result.stderr
-      staged = top / '@'
-      assert not (staged / enabled_path).is_symlink(), 'reset must not start USBGuard before enrollment'
-      assert (staged / 'var/lib/omarchy/provisioning/pending').exists()
-      assert (staged / 'etc/usbguard/rules.conf').read_text() == policy
-      if scenario == 'enabled':
-        assert (factory / enabled_path).is_symlink(), 'only the staged clone is disabled'
-        # The owner-enrollment helper enables the daemon after policy and
-        # ACL setup. Confirm an ordinary enable can reverse this disable.
-        subprocess.run(['systemctl', '--root=' + str(staged), 'enable', 'usbguard.service'],
-               check=True, capture_output=True, text=True)
-        assert (staged / enabled_path).is_symlink()
-    print('ok - factory USB enrollment staging: ' + scenario)
-PY