Overlay: manifest-as-intent before copy, two-pass validated uninstall

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKxGW1raAWaqeU8WdHsMsp

bin/omarchy-cn-install-overlay

@@ -37,12 +37,17 @@ uninstall() {
     exit 1
   fi
 
+  # Validate every entry before deleting anything
   while IFS= read -r rel; do
     [[ $rel == source=* || $rel == dest=* ]] && continue
     if ! valid_entry "$rel"; then
-      echo "Refusing suspicious manifest entry: $rel" >&2
+      echo "Refusing suspicious manifest entry: $rel (nothing deleted)" >&2
       exit 1
     fi
+  done < "$MANIFEST"
+
+  while IFS= read -r rel; do
+    [[ $rel == source=* || $rel == dest=* ]] && continue
     if [[ $rel == "cn" ]]; then
       run_in "$dest" rm -rf "$dest/cn"
     else
@@ -84,20 +89,21 @@ install() {
     entries+=("$rel")
   done
 
+  # Manifest is the intent record, published BEFORE copying: if a copy fails
+  # midway, a rerun sees the manifest, uninstalls the partial state, retries.
   mkdir -p "${MANIFEST%/*}"
   {
     echo "source=$SRC"
     echo "dest=$DEST"
     echo "cn"
     printf '%s\n' "${entries[@]}"
-  } > "$MANIFEST.tmp"
+  } > "$MANIFEST"
 
   run_in "$DEST" cp -r "$SRC/cn" "$DEST/cn"
   for rel in "${entries[@]}"; do
     run_in "$DEST" cp "$SRC/$rel" "$DEST/$rel"
   done
 
-  mv "$MANIFEST.tmp" "$MANIFEST"
   echo "OmarchyCN overlay installed into $DEST (${#entries[@]} commands)"
   echo "Verify: omarchy cn version"
 }