Merge pull request #11901 from omacom/fix/v4-0-4-complete-kernel-headers

Treat kernel headers as part of the 4.0.4 base system

agents/skills/install-scripts.md

@@ -13,6 +13,7 @@ commands and reusable setup leaves:
 - use `$OMARCHY_INSTALL` and `$OMARCHY_PATH` instead of hard-coded Omarchy paths.
 - keep root-scoped hardware setup under `install/hardware/` and orchestrate it through `install/hardware/all.sh`.
 - keep every per-user setup leaf under `install/user/` (including `install/user/hardware/` and `install/user/first-run/`) so it is clear what must run for each user.
+- The base install supplies matching kernel headers before hardware setup. DKMS installers should install their driver packages and assume the headers exist.
 - prefer helper commands for package and command checks where available.
 
 Raw `command -v`, `pacman`, and `pacman-key` are acceptable in package-helper

bin/omarchy-install-gaming-xbox-controllers

@@ -10,7 +10,7 @@ set -e
 echo "Installing Xbox controller Bluetooth support..."
 
 # Install xpadneo to ensure controllers work out of the box
-omarchy-pkg-add linux-headers xpadneo-dkms
+omarchy-pkg-add xpadneo-dkms
 
 # Prevent xpad/xpadneo driver conflict
 echo blacklist xpad | sudo tee /etc/modprobe.d/blacklist-xpad.conf >/dev/null

etc/limine-entry-tool.d/omarchy-defaults.conf

@@ -15,7 +15,8 @@ ENABLE_LIMINE_FALLBACK=yes
 # Find and add other bootloaders
 FIND_BOOTLOADERS=yes
 
-BOOT_ORDER="*, *fallback, Snapshots"
+# Keep T2 Macs on their specialized kernel; prefer linux-omarchy elsewhere.
+BOOT_ORDER="linux-t2, linux-omarchy, linux-omarchy-*, *, *fallback, Snapshots"
 
 # Snapper is configured with NUMBER_LIMIT="5" (see default/snapper/root), but
 # limine-snapper-sync can see the newly created sixth snapshot before cleanup

install/hardware/all.sh

@@ -14,11 +14,6 @@ run_logged "$OMARCHY_INSTALL/hardware/vulkan.sh"
 run_logged "$OMARCHY_INSTALL/hardware/intel/video-acceleration.sh"
 run_logged "$OMARCHY_INSTALL/hardware/intel/lpmd.sh"
 run_logged "$OMARCHY_INSTALL/hardware/intel/thermald.sh"
-# Swap in the Panther Lake kernel before anything pulls DKMS modules in.
-# intel-ipu7-camera drags in ipu7-drivers, vision-drivers and v4l2loopback,
-# and building all three against the stock kernel only to rebuild them against
-# linux-ptl and tear the first set down again cost ~25s of the install.
-run_logged "$OMARCHY_INSTALL/hardware/intel/ptl-kernel.sh"
 run_logged "$OMARCHY_INSTALL/hardware/intel/ipu7-camera.sh"
 run_logged "$OMARCHY_INSTALL/hardware/intel/fred.sh"
 run_logged "$OMARCHY_INSTALL/hardware/intel/fix-wifi7-eht.sh"

install/hardware/fix-bcm43xx.sh

@@ -6,5 +6,5 @@ pci_info=$(lspci -nn)
 
 if (echo "$pci_info" | grep -q "14e4:43a0" || echo "$pci_info" | grep -q "14e4:4331"); then
   echo "BCM4360 / BCM4331 detected"
-  omarchy-pkg-add broadcom-wl-dkms linux-headers
+  omarchy-pkg-add broadcom-wl-dkms
 fi

install/hardware/fix-tuxedo-backlight.sh

@@ -1,7 +1,7 @@
 # Install Tuxedo drivers for keyboard backlighting on Tuxedo laptops and
 # compatible devices like the Slimbook Executive (Clevo/Tuxedo chassis).
 if cat /sys/class/dmi/id/sys_vendor 2>/dev/null | grep -qi "TUXEDO\|Slimbook"; then
-  omarchy-pkg-add linux-headers tuxedo-drivers-nocompatcheck-dkms
+  omarchy-pkg-add tuxedo-drivers-nocompatcheck-dkms
 
   # Blacklist the legacy clevo_xsm_wmi module which conflicts with the tuxedo-drivers
   # clevo_wmi module. When clevo_xsm_wmi loads first, it grabs the Clevo WMI GUIDs,

install/hardware/fix-yt6801-ethernet-adapter.sh

@@ -1,4 +1,4 @@
 # Install drivers for Motorcomm YT6801 ethernet adapter used by the Slimbook Executive
 if lspci | grep -i "YT6801\|Motorcomm.*Ethernet"; then
-  omarchy-pkg-add linux-headers yt6801-dkms
+  omarchy-pkg-add yt6801-dkms
 fi

install/hardware/intel/ptl-kernel.sh

@@ -1,25 +0,0 @@
-# Install Panther Lake kernel for Dell XPS Panther Lake systems
-# The linux-ptl kernel includes audio driver patches not yet in mainline.
-
-if omarchy-hw-match "XPS" && omarchy-hw-intel-ptl; then
-  echo "Detected Dell XPS Panther Lake, installing PTL kernel..."
-
-  omarchy-pkg-add linux-ptl linux-ptl-headers
-  pacman -Rdd --noconfirm linux linux-headers || true
-
-  # linux-ptl doesn't provide=linux, so anything depending on linux drags the
-  # stock kernel back in and the boot menu grows a second, slower entry.
-  if pacman -Qq linux &>/dev/null; then
-    echo "WARNING: stock linux kernel still installed alongside linux-ptl:"
-    pacman -Qi linux | grep -i "required by"
-  fi
-
-  mkdir -p /etc/limine-entry-tool.d
-  # Named to sort after omarchy-defaults.conf: drop-ins are read in order and
-  # the last BOOT_ORDER wins, so an earlier-sorting name is a silent no-op.
-  rm -f /etc/limine-entry-tool.d/dell-xps-panther-lake.conf
-  cat > /etc/limine-entry-tool.d/zz-dell-xps-panther-lake.conf <<'EOF'
-# Only show Panther Lake kernel in boot menu on Dell XPS Panther Lake
-BOOT_ORDER="linux-ptl*, *fallback, Snapshots"
-EOF
-fi

install/hardware/nvidia.sh

@@ -1,8 +1,4 @@
 if lspci | grep -qi 'nvidia'; then
-  # Check which kernel is installed and set appropriate headers package
-  KERNEL_PACKAGE=$(pacman -Qqs '^linux(-zen|-lts|-hardened|-t2|-ptl)?$' | head -1 || true)
-  [[ -n $KERNEL_PACKAGE ]] && omarchy-pkg-add "$KERNEL_PACKAGE-headers"
-
   if omarchy-hw-nvidia-gsp; then
     PACKAGES=(nvidia-open-dkms nvidia-utils lib32-nvidia-utils libva-nvidia-driver)
   elif omarchy-hw-nvidia-without-gsp; then

install/omarchy-other.packages

@@ -20,11 +20,9 @@ libva-nvidia-driver
 limine
 limine-mkinitcpio-hook
 limine-snapper-sync
-linux
 linux-firmware
-linux-headers
-linux-ptl
-linux-ptl-headers
+linux-omarchy
+linux-omarchy-headers
 macbook12-spi-driver-dkms
 nvidia-580xx-dkms
 nvidia-dkms

migrations/1789325478.sh

@@ -0,0 +1,44 @@
+echo "Install the Omarchy kernel and make it the first Limine boot entry"
+
+# linux-omarchy is an x86_64 kernel. T2 Macs must keep their specialized kernel,
+# including when other kernels are installed or the running T2 package is gone.
+[[ $(uname -m) == "x86_64" ]] || exit 0
+running_kernel=$(uname -r)
+if omarchy-pkg-present linux-t2 || [[ ${running_kernel,,} == *-t2* ]]; then
+  exit 0
+fi
+
+limine_conf="${OMARCHY_KERNEL_LIMINE_CONF:-/etc/default/limine}"
+rebuild_marker="${OMARCHY_KERNEL_REBUILD_MARKER:-/var/lib/omarchy/migrations/1789325478}"
+kernel="linux-omarchy"
+
+# Completion is machine-wide even though migrations run once per user. Leave
+# the old kernel installed so it remains available if the new one cannot boot.
+# The new filename and marker also reach users who completed 1789095456.
+[[ ! -e $rebuild_marker ]] || exit 0
+omarchy-pkg-add "$kernel" "$kernel-headers"
+
+# /etc/default/limine has priority over every drop-in, including old Dell
+# settings and customized package files whose updates landed in a .pacnew.
+# Set the exact kernel first: linux-omarchy-* only matches its older variants.
+# Preserve unrelated settings, especially the root filesystem's kernel cmdline.
+sudo mkdir -p "$(dirname "$limine_conf")"
+sudo touch "$limine_conf"
+sudo sed -i -E '/^[[:space:]]*BOOT_ORDER[[:space:]]*=/d' "$limine_conf"
+printf '\n%s\n' 'BOOT_ORDER="linux-omarchy, linux-omarchy-*, *, *fallback, Snapshots"' | sudo tee -a "$limine_conf" >/dev/null
+
+# Package hooks ran before the config repair. Rebuild the new kernel's image
+# and boot entry explicitly, including on retries after a failed rebuild.
+sudo limine-mkinitcpio "$kernel"
+
+# limine-mkinitcpio can return success after skipping a failed kernel build.
+# Do not mark the migration complete unless the new kernel is in the menu.
+if ! sudo limine-entry-tool --tree | grep -E "(^|[^[:alnum:]_-])$kernel([^[:alnum:]_-]|$)" >/dev/null; then
+  echo "The Omarchy kernel has no Limine boot entry; rerun omarchy-migrate after fixing the boot image build." >&2
+  exit 1
+fi
+
+# Keeping the running kernel installed prevents the updater from detecting a
+# kernel replacement, so request the reboot explicitly.
+omarchy-state set reboot-required
+sudo install -Dm644 /dev/null "$rebuild_marker"

migrations/1789444024.sh

@@ -0,0 +1,10 @@
+echo "Install missing headers for the Omarchy or T2 kernel"
+
+# Fresh ISO installs mark earlier migrations complete, so the kernel migration
+# cannot repair headers omitted by those installers. Package installation is
+# idempotent when another user has already applied this repair.
+for kernel in linux-omarchy linux-t2; do
+  if omarchy-pkg-present "$kernel"; then
+    omarchy-pkg-add "$kernel-headers"
+  fi
+done

test/acceptance.d/system-test.sh

@@ -24,6 +24,20 @@ verify_core_packages() {
   pass "all Omarchy core packages are installed (${#missing[@]} missing)"
 }
 
+verify_kernel_headers() {
+  local kernel=linux-omarchy
+  local release
+  release=$(uname -r)
+  omarchy-pkg-present linux-t2 && kernel=linux-t2
+
+  [[ $(cat "/usr/lib/modules/$release/pkgbase") == "$kernel" ]] ||
+    fail "the installed system boots the supported kernel" "$release is not $kernel"
+  omarchy-pkg-present "$kernel-headers" || fail "kernel headers are installed" "$kernel-headers is missing"
+  [[ $(cat "/usr/lib/modules/$release/build/include/config/kernel.release") == "$release" ]] ||
+    fail "headers match the running kernel" "$release has missing or mismatched headers"
+  pass "the running $kernel kernel has matching headers ($release)"
+}
+
 verify_defaults() {
   [[ $(omarchy-default-browser) == "chromium" ]] || fail "Chromium is the default browser"
   pass "Chromium is the default browser"
@@ -112,7 +126,7 @@ verify_user_setup() {
   pass "Omarchy user state and shell configuration exist"
 }
 
-for check in verify_core_packages verify_defaults verify_services verify_runtime_tools verify_user_setup; do
+for check in verify_core_packages verify_kernel_headers verify_defaults verify_services verify_runtime_tools verify_user_setup; do
   if ! ("$check"); then
     status=1
   fi

test/shell.d/kernel-headers-migration-test.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+set -euo pipefail
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+tmp_dir=$(mktemp -d)
+trap 'rm -rf "$tmp_dir"' EXIT
+mkdir -p "$tmp_dir/bin"
+export INSTALLED_PACKAGES="$tmp_dir/installed" CALL_LOG="$tmp_dir/calls"
+export PATH="$tmp_dir/bin:$ROOT/bin:$PATH"
+
+# Keep the real package helpers, but contain every pacman transaction here.
+cat > "$tmp_dir/bin/pacman" <<'SH'
+#!/bin/bash
+case "$1" in
+  -Q) grep -Fxq -- "$2" "$INSTALLED_PACKAGES" ;;
+  -S)
+    [[ ${FAIL_INSTALL:-0} == 0 ]] || exit 1
+    shift 3 # -S --noconfirm --needed
+    printf '%s\n' "$@" >> "$INSTALLED_PACKAGES"
+    printf '%s\n' "$@" >> "$CALL_LOG"
+    ;;
+  *) exit 1 ;;
+esac
+SH
+cat > "$tmp_dir/bin/sudo" <<'SH'
+#!/bin/bash
+[[ $1 == "pacman" ]] || exit 1
+"$@"
+SH
+chmod +x "$tmp_dir/bin/"*
+
+migration="$ROOT/migrations/1789444024.sh"
+for kernels in linux-omarchy linux-t2 'linux-omarchy linux-t2'; do
+  read -ra installed <<< "$kernels"
+  printf '%s\n' linux linux-headers "${installed[@]}" > "$INSTALLED_PACKAGES"
+  : > "$CALL_LOG"
+  bash -euo pipefail "$migration" >/dev/null
+  for kernel in "${installed[@]}"; do
+    grep -Fxq "$kernel-headers" "$INSTALLED_PACKAGES" || fail "$kernel gets its headers"
+  done
+  : > "$CALL_LOG"
+  bash -euo pipefail "$migration" >/dev/null
+  [[ ! -s $CALL_LOG ]] || fail "header repair is idempotent"
+  pass "missing headers are repaired once for $kernels"
+done
+
+printf '%s\n' linux linux-aarch64 > "$INSTALLED_PACKAGES"
+: > "$CALL_LOG"
+bash -euo pipefail "$migration" >/dev/null
+[[ ! -s $CALL_LOG ]] || fail "header repair skips unrelated kernels"
+pass "header repair skips unrelated kernels"
+
+echo linux-omarchy > "$INSTALLED_PACKAGES"
+if FAIL_INSTALL=1 bash -euo pipefail "$migration" >/dev/null; then
+  fail "a failed header installation must leave the migration pending"
+fi
+pass "header installation failure is propagated"

test/shell.d/limine-defaults-test.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+packaged_defaults="$ROOT/etc/limine-entry-tool.d/omarchy-defaults.conf"
+
+grep -Fq 'KERNEL_CMDLINE[default]+=" initramfs_async=0"' "$packaged_defaults" ||
+  fail "the packaged Limine defaults still unpack the initramfs synchronously"
+pass "packaged Limine defaults keep Plymouth alive at the LUKS prompt"
+
+grep -Fxq 'BOOT_ORDER="linux-t2, linux-omarchy, linux-omarchy-*, *, *fallback, Snapshots"' "$packaged_defaults" ||
+  fail "packaged Limine defaults protect T2 Macs and prefer the exact Omarchy kernel elsewhere"
+pass "packaged Limine defaults protect T2 Macs and prefer the exact Omarchy kernel elsewhere"

test/shell.d/omarchy-kernel-migration-test.sh

@@ -0,0 +1,248 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+migration="$ROOT/migrations/1789325478.sh"
+scratch=$(mktemp -d)
+trap 'rm -rf "$scratch"' EXIT
+mkdir -p "$scratch/bin" "$scratch/drop-ins"
+
+export PATH="$scratch/bin:$ROOT/bin:$PATH"
+export CALL_LOG="$scratch/calls"
+export INSTALLED_PACKAGES="$scratch/packages"
+export OMARCHY_KERNEL_LIMINE_CONF="$scratch/limine"
+export OMARCHY_KERNEL_LIMINE_DROP_INS="$scratch/drop-ins"
+export OMARCHY_KERNEL_REBUILD_MARKER="$scratch/state/1789325478"
+kernel="linux-omarchy"
+boot_order='BOOT_ORDER="linux-omarchy, linux-omarchy-*, *, *fallback, Snapshots"'
+
+# Exercise the real package helpers, including their post-install queries.
+cat > "$scratch/bin/pacman" <<'SH'
+#!/bin/bash
+case "$1" in
+  -Q) grep -Fxq "$2" "$INSTALLED_PACKAGES" ;;
+  -S)
+    printf 'pacman %s\n' "$*" >> "$CALL_LOG"
+    [[ ${INSTALL_FAIL:-0} == "0" ]] || exit 1
+    for arg in "$@"; do
+      [[ $arg == -* ]] || printf '%s\n' "$arg" >> "$INSTALLED_PACKAGES"
+    done
+    ;;
+  *) exit 99 ;;
+esac
+SH
+
+cat > "$scratch/bin/sudo" <<'SH'
+#!/bin/bash
+printf 'sudo %s\n' "$*" >> "$CALL_LOG"
+case "$1" in
+  pacman | mkdir | touch | sed | tee | install | limine-mkinitcpio | limine-entry-tool) exec "$@" ;;
+  *) exit 99 ;;
+esac
+SH
+
+cat > "$scratch/bin/limine-mkinitcpio" <<'SH'
+#!/bin/bash
+[[ ${REBUILD_FAIL:-0} == "0" ]]
+SH
+
+cat > "$scratch/bin/limine-entry-tool" <<'SH'
+#!/bin/bash
+[[ $* == "--tree" ]] || exit 99
+printf '%s\n' 'Omarchy' '  linux-ptl' '  linux-omarchy-ptl-novrr-mm' '  linux-omarchy-bore' '  linux-omarchy-fallback' '  Snapshots'
+if [[ ${MISSING_ENTRY:-0} == "0" ]]; then
+  printf '%s\n' '  linux-omarchy'
+fi
+SH
+
+cat > "$scratch/bin/omarchy-state" <<'SH'
+#!/bin/bash
+[[ $* == "set reboot-required" ]] || exit 99
+printf 'state %s\n' "$*" >> "$CALL_LOG"
+SH
+
+cat > "$scratch/bin/uname" <<'SH'
+#!/bin/bash
+case "$1" in
+  -m) printf '%s\n' "${TEST_ARCH:-x86_64}" ;;
+  -r) printf '%s\n' "${TEST_KERNEL_RELEASE:-7.2.5-arch1-1}" ;;
+  *) exit 99 ;;
+esac
+SH
+
+cat > "$scratch/bin/omarchy-notification-dismiss" <<'SH'
+#!/bin/bash
+exit 0
+SH
+chmod +x "$scratch/bin/"*
+
+reset_fixture() {
+  : > "$CALL_LOG"
+  printf '%s\n' linux-ptl linux-ptl-headers > "$INSTALLED_PACKAGES"
+  rm -f "$OMARCHY_KERNEL_REBUILD_MARKER" "$OMARCHY_KERNEL_LIMINE_DROP_INS/"*
+  cat > "$OMARCHY_KERNEL_LIMINE_CONF" <<'CONF'
+KERNEL_CMDLINE[default]="root=UUID=keep-me rw cryptdevice=UUID=keep-me:root"
+BOOT_ORDER="*, *fallback, Snapshots"
+ENABLE_UKI=yes
+CONF
+  cp "$OMARCHY_KERNEL_LIMINE_CONF" "$scratch/original-limine"
+}
+
+run_migration() {
+  bash -euo pipefail "$migration" > "$scratch/output" 2>&1
+}
+
+assert_preferred() {
+  grep -Fxq "$boot_order" "$1" || fail "Omarchy kernels are preferred in $1"
+}
+
+assert_skipped() {
+  [[ ! -s $CALL_LOG ]] || fail "excluded systems do not change" "$(<"$CALL_LOG")"
+  cmp -s "$OMARCHY_KERNEL_LIMINE_CONF" "$scratch/original-limine" || fail "excluded systems keep their boot settings"
+  [[ ! -e $OMARCHY_KERNEL_REBUILD_MARKER ]] || fail "excluded systems do not get a completion marker"
+}
+
+for old_kernel in linux linux-lts linux-zen linux-ptl linux-omarchy-ptl-novrr-mm; do
+  reset_fixture
+  printf '%s\n' "$old_kernel" "$old_kernel-headers" > "$INSTALLED_PACKAGES"
+  run_migration
+  grep -Fxq "$kernel" "$INSTALLED_PACKAGES" || fail "the generic kernel is installed"
+  grep -Fxq "$kernel-headers" "$INSTALLED_PACKAGES" || fail "its headers are installed"
+  grep -Fxq "$old_kernel" "$INSTALLED_PACKAGES" || fail "the previous kernel remains available"
+  assert_preferred "$OMARCHY_KERNEL_LIMINE_CONF"
+  pass "$old_kernel systems receive the generic Omarchy kernel and retain their recovery kernel"
+done
+
+for installed in linux-t2 $'linux-t2\nlinux\nlinux-ptl\nlinux-omarchy'; do
+  reset_fixture
+  printf '%s\n' "$installed" > "$INSTALLED_PACKAGES"
+  run_migration
+  assert_skipped
+done
+pass "linux-t2 systems are skipped even with other kernels installed"
+
+reset_fixture
+TEST_KERNEL_RELEASE=7.2.5-arch1-T2 run_migration
+assert_skipped
+pass "a running T2 kernel is excluded even if its package is no longer installed"
+
+reset_fixture
+TEST_ARCH=aarch64 run_migration
+assert_skipped
+pass "ARM systems cannot receive an x86_64 kernel"
+
+reset_fixture
+printf '%s\n' linux-omarchy-ptl-novrr-mm > "$INSTALLED_PACKAGES"
+mkdir -p "$scratch/state" "$scratch/user-markers" "$scratch/omarchy/migrations"
+export OMARCHY_PTL_REBUILD_MARKER="$scratch/state/1789095456"
+export OMARCHY_MIGRATION_STATE="$scratch/user-markers"
+touch "$OMARCHY_PTL_REBUILD_MARKER" "$OMARCHY_MIGRATION_STATE/1789095456.sh"
+cp "$migration" "$scratch/omarchy/migrations/"
+[[ ! -e $ROOT/migrations/1789095456.sh ]] || fail "the superseded migration must not install the PTL variant first"
+pending=$(OMARCHY_PATH="$scratch/omarchy" "$ROOT/bin/omarchy-migrate" --pending)
+[[ $pending == "1789325478.sh" ]] || fail "the renamed migration is pending after completing the old migration"
+OMARCHY_PATH="$scratch/omarchy" "$ROOT/bin/omarchy-migrate" > "$scratch/output" 2>&1
+grep -Fxq "$kernel" "$INSTALLED_PACKAGES" || fail "the old completion markers cannot skip the generic kernel"
+[[ -f $OMARCHY_KERNEL_REBUILD_MARKER && -f $OMARCHY_MIGRATION_STATE/1789325478.sh ]] || fail "new machine and user completion markers are recorded"
+assert_preferred "$OMARCHY_KERNEL_LIMINE_CONF"
+pass "users who completed the PTL migration run the renamed migration with fresh completion markers"
+
+reset_fixture
+for name in dell-xps-panther-lake zz-dell-xps-panther-lake; do
+  printf '%s\n' 'BOOT_ORDER="linux-ptl*, *fallback, Snapshots"' > "$OMARCHY_KERNEL_LIMINE_DROP_INS/$name.conf"
+done
+cp "$OMARCHY_KERNEL_LIMINE_CONF" "$OMARCHY_KERNEL_LIMINE_DROP_INS/omarchy-defaults.conf"
+run_migration
+grep -Fxq "pacman -S --noconfirm --needed $kernel $kernel-headers" "$CALL_LOG" || fail "both new packages are installed"
+grep -Fxq linux-ptl "$INSTALLED_PACKAGES" || fail "the old kernel is kept for recovery"
+grep -Fxq linux-ptl-headers "$INSTALLED_PACKAGES" || fail "the old kernel headers are kept"
+assert_preferred "$OMARCHY_KERNEL_LIMINE_CONF"
+diff -u <(sed '/^BOOT_ORDER=/d; /^$/d' "$scratch/original-limine") \
+  <(sed '/^BOOT_ORDER=/d; /^$/d' "$OMARCHY_KERNEL_LIMINE_CONF") || fail "kernel command line and unrelated settings are preserved"
+grep -Fxq "sudo limine-mkinitcpio $kernel" "$CALL_LOG" || fail "the new kernel's boot image is rebuilt"
+[[ -f $OMARCHY_KERNEL_REBUILD_MARKER ]] || fail "successful completion is recorded"
+grep -Fxq 'state set reboot-required' "$CALL_LOG" || fail "the updater must offer a reboot when retaining the old kernel"
+pass "new packages install, the central boot order is set, and the old kernel remains available"
+
+: > "$CALL_LOG"
+run_migration
+[[ ! -s $CALL_LOG ]] || fail "another user's run does not repeat the machine-wide migration"
+pass "repeat runs are a no-op after successful completion"
+
+reset_fixture
+printf '%s\n' "$kernel" >> "$INSTALLED_PACKAGES"
+run_migration
+grep -Fxq "$kernel-headers" "$INSTALLED_PACKAGES" || fail "missing headers install when the kernel is already present"
+pass "a partially installed kernel gets its missing headers"
+
+reset_fixture
+printf '%s\n' "$kernel" "$kernel-headers" >> "$INSTALLED_PACKAGES"
+run_migration
+! grep -q '^pacman -S' "$CALL_LOG" || fail "already installed packages are not reinstalled"
+assert_preferred "$OMARCHY_KERNEL_LIMINE_CONF"
+pass "existing new packages still receive the config repair and boot rebuild"
+
+reset_fixture
+if INSTALL_FAIL=1 run_migration; then
+  fail "package installation failure must fail the migration"
+fi
+cmp -s "$OMARCHY_KERNEL_LIMINE_CONF" "$scratch/original-limine" || fail "install failure leaves the config untouched"
+! grep -q 'limine-mkinitcpio' "$CALL_LOG" || fail "install failure does not rebuild"
+[[ ! -e $OMARCHY_KERNEL_REBUILD_MARKER ]] || fail "install failure stays pending"
+pass "package failures leave the old boot setup intact and the migration pending"
+
+reset_fixture
+if REBUILD_FAIL=1 run_migration; then
+  fail "boot rebuild failure must fail the migration"
+fi
+[[ ! -e $OMARCHY_KERNEL_REBUILD_MARKER ]] || fail "rebuild failure stays pending"
+! grep -q '^state ' "$CALL_LOG" || fail "rebuild failure must not request a reboot"
+assert_preferred "$OMARCHY_KERNEL_LIMINE_CONF"
+: > "$CALL_LOG"
+run_migration
+grep -Fxq "sudo limine-mkinitcpio $kernel" "$CALL_LOG" || fail "retry must rebuild even after config and packages are repaired"
+[[ -f $OMARCHY_KERNEL_REBUILD_MARKER ]] || fail "retry records successful completion"
+pass "a failed rebuild is retried even after config and package changes succeeded"
+
+reset_fixture
+if MISSING_ENTRY=1 run_migration; then
+  fail "a silently skipped kernel build must fail the migration"
+fi
+[[ ! -e $OMARCHY_KERNEL_REBUILD_MARKER ]] || fail "a missing boot entry stays pending"
+! grep -q '^state ' "$CALL_LOG" || fail "a missing boot entry must not request a reboot"
+run_migration
+[[ -f $OMARCHY_KERNEL_REBUILD_MARKER ]] || fail "a missing boot entry can be repaired on retry"
+pass "older Omarchy variants and fallback entries cannot satisfy generic kernel verification"
+
+reset_fixture
+cat >> "$OMARCHY_KERNEL_LIMINE_CONF" <<'CONF'
+BOOT_ORDER="linux-omarchy-*, *, *fallback, Snapshots"
+  BOOT_ORDER = 'linux-lts, *, *fallback, Snapshots'
+CONF
+run_migration
+assert_preferred "$OMARCHY_KERNEL_LIMINE_CONF"
+[[ $(grep -c '^BOOT_ORDER=' "$OMARCHY_KERNEL_LIMINE_CONF") == "1" ]] || fail "only one boot order is written"
+! grep -Eq '^[[:space:]]+BOOT_ORDER' "$OMARCHY_KERNEL_LIMINE_CONF" || fail "a later custom assignment cannot override first position"
+pass "the exact generic kernel takes first position over previous PTL and custom orders"
+
+reset_fixture
+for name in omarchy-defaults dell-xps-panther-lake zz-dell-xps-panther-lake; do
+  printf '%s\n' 'BOOT_ORDER="linux-ptl*, *fallback, Snapshots"' > "$OMARCHY_KERNEL_LIMINE_DROP_INS/$name.conf"
+done
+printf '%s\n' 'ENABLE_SORT=yes' >> "$OMARCHY_KERNEL_LIMINE_DROP_INS/omarchy-defaults.conf"
+cp "$ROOT/etc/limine-entry-tool.d/omarchy-defaults.conf" "$OMARCHY_KERNEL_LIMINE_DROP_INS/omarchy-defaults.conf.pacnew"
+run_migration
+effective_order=$(bash -c 'declare -A KERNEL_CMDLINE; for conf in "$1/"*.conf "$2"; do source "$conf"; done; printf "%s" "$BOOT_ORDER"' -- "$OMARCHY_KERNEL_LIMINE_DROP_INS" "$OMARCHY_KERNEL_LIMINE_CONF")
+[[ $effective_order == "linux-omarchy, linux-omarchy-*, *, *fallback, Snapshots" ]] || fail "the central config wins over old and customized drop-ins"
+grep -Fxq 'ENABLE_SORT=yes' "$OMARCHY_KERNEL_LIMINE_DROP_INS/omarchy-defaults.conf" || fail "custom packaged settings survive"
+cmp -s "$ROOT/etc/limine-entry-tool.d/omarchy-defaults.conf" \
+  "$OMARCHY_KERNEL_LIMINE_DROP_INS/omarchy-defaults.conf.pacnew" || fail "the pacnew is left for the administrator to merge"
+pass "the central boot order overrides legacy drop-ins and pacnew files without rewriting them"
+
+reset_fixture
+rm "$OMARCHY_KERNEL_LIMINE_CONF"
+run_migration
+assert_preferred "$OMARCHY_KERNEL_LIMINE_CONF"
+pass "a missing central config is created with the exact kernel first"