Never leave updatedb.conf with two definitions of the same setting

updatedb refuses to run at all on a config that defines a variable twice
("variable `PRUNEPATHS' was already defined"), so any rewrite that misses
an existing line and appends a second one takes the locate index down
rather than fixing it. Two shapes updatedb accepts got missed: a trailing
comment after the value, and a setting indented by whitespace.

Read the existing paths out of the quoted value and write the whole
setting back canonically instead of splicing into a line of unknown
shape. Quotes are not optional to updatedb ("value in quotes expected
after `='"), so a bare value is already a broken config: rewriting it
quoted repairs the file as a side effect.

The tests now hand every rewritten file to the real parser through
`updatedb --config-file`, which is what caught this.

Read the Snapper config as root when the running user cannot read it.
snapper create-config leaves the config root-only, and a config the user
cannot read was passing for one that wants its timeline snapshots kept.

Report the snapshots the drain could not delete. omarchy-migrate writes
the completion marker whether or not the batches succeeded, so there is
no later run to pick up the remainder, whatever the comment claimed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

migrations/1784809452.sh

@@ -14,8 +14,14 @@ command -v snapper >/dev/null || exit 0
 [[ -f $SNAPPER_CONFIG_PATH ]] || exit 0
 
 # Only clean up when timeline snapshotting is off, as Omarchy configures it.
-# Anyone who deliberately turned it back on keeps their snapshots.
-grep -qFx 'TIMELINE_CREATE="no"' "$SNAPPER_CONFIG_PATH" || exit 0
+# Anyone who deliberately turned it back on keeps their snapshots. Snapper's
+# own create-config leaves the file readable by root alone, and a config this
+# user cannot read must not pass for one that wants its snapshots kept.
+if [[ -r $SNAPPER_CONFIG_PATH ]]; then
+  grep -qFx 'TIMELINE_CREATE="no"' "$SNAPPER_CONFIG_PATH" || exit 0
+else
+  as_root grep -qFx 'TIMELINE_CREATE="no"' "$SNAPPER_CONFIG_PATH" || exit 0
+fi
 
 # Earlier installs ran hourly timeline snapshots. Later configs stopped
 # creating them but never deleted the existing ones, and number cleanup
@@ -28,16 +34,23 @@ echo "Deleting $(wc -w <<<"$leaked") leaked timeline snapshots (disk space is re
 
 # Delete in small batches; one big delete can die on a DBus timeout partway.
 # A failed batch must not take the rest of the migration run down with it, so
-# the drain is best effort: whatever survives is picked up by the next run.
+# the drain is best effort. omarchy-migrate records the migration either way,
+# so say what is left rather than counting on a rerun that will not come.
+failed=0
 batch=()
+
 for number in $leaked; do
   batch+=("$number")
   if (( ${#batch[@]} == 20 )); then
-    as_root snapper -c root delete "${batch[@]}" || true
+    as_root snapper -c root delete "${batch[@]}" || failed=$((failed + ${#batch[@]}))
     batch=()
   fi
 done
 
 if (( ${#batch[@]} > 0 )); then
-  as_root snapper -c root delete "${batch[@]}" || true
+  as_root snapper -c root delete "${batch[@]}" || failed=$((failed + ${#batch[@]}))
+fi
+
+if (( failed > 0 )); then
+  echo "$failed snapshots could not be deleted. Finish with: sudo snapper -c root delete <number>"
 fi