Restore strict migration ordering

migrations/1787946619.sh

@@ -10,14 +10,6 @@ as_root() {
   fi
 }
 
-defer_privileged_repair() {
-  echo "Cannot remove the legacy privileged udev rule; omarchy-migrate will retry it later." >&2
-  if [[ -n ${OMARCHY_MIGRATION_DEFER_FILE:-} && -n ${OMARCHY_MIGRATION_DEFER_TOKEN:-} ]]; then
-    printf '%s\n' "$OMARCHY_MIGRATION_DEFER_TOKEN" >"$OMARCHY_MIGRATION_DEFER_FILE"
-  fi
-  exit 75
-}
-
 # Omarchy 3 generated these two rules with an unquoted heredoc, so the installing
 # user's $HOME was expanded and the file on disk names that absolute home path.
 # udev runs RUN+= as root, and
@@ -86,23 +78,19 @@ rule_runs_from_home() {
   return 1
 }
 
-removed=0
-
 for legacy_rule in "99-power-profile.rules:omarchy-powerprofiles-set" "99-wifi-powersave.rules:omarchy-wifi-powersave"; do
   rule_file="$rules_dir/${legacy_rule%%:*}"
 
   if [[ -f $rule_file ]] && rule_runs_from_home "$rule_file" "${legacy_rule##*:}"; then
     if ! as_root rm -f "$rule_file"; then
-      defer_privileged_repair
+      echo "Administrator privileges are required to remove the vulnerable legacy udev rule. Ask an administrator to run omarchy-migrate." >&2
+      exit 1
     fi
-    removed=1
+
+    # Reload after each removal, not after the whole loop. If removing a later
+    # rule fails, udevd must not keep running one this migration already deleted.
+    # Best effort the way install/post-install/udev.sh is: a machine with no
+    # udevd to talk to has had the file removed, and the next boot reads fresh.
+    as_root udevadm control --reload 2>/dev/null || true
   fi
 done
-
-if (( removed )); then
-  # Drop the rule from the running udevd too; until it reloads, the rule that was
-  # just deleted still fires on the next power_supply event. Best effort the way
-  # install/post-install/udev.sh is: a machine with no udevd to talk to has
-  # already had the file removed, and the next boot reads the directory fresh.
-  as_root udevadm control --reload 2>/dev/null || true
-fi

migrations/1788025225.sh

@@ -253,21 +253,18 @@ plymouth_unit_runs_from_home() {
 first_run_sudoers="$sudoers_dir/first-run"
 tsui_sudoers="$sudoers_dir/tsui"
 
-defer_privileged_repair() {
-  echo "Cannot complete the privileged installer-artifact repair; omarchy-migrate will retry it later." >&2
-  if [[ -n ${OMARCHY_MIGRATION_DEFER_FILE:-} && -n ${OMARCHY_MIGRATION_DEFER_TOKEN:-} ]]; then
-    printf '%s\n' "$OMARCHY_MIGRATION_DEFER_TOKEN" >"$OMARCHY_MIGRATION_DEFER_FILE"
-  fi
-  exit 75
+fail_privileged_repair() {
+  echo "Cannot complete the privileged installer-artifact repair. An administrator must run omarchy-migrate to repair this machine." >&2
+  exit 1
 }
 
 # This is a machine-wide repair with per-user migration markers. A root-owned,
 # readable marker lets later non-sudo users finish their own migration run after
 # one privileged account has inspected and repaired the machine. Until then,
-# exit 75 asks omarchy-migrate to leave this migration pending while continuing
-# with every later migration instead of wedging the whole queue.
+# the migration fails loudly and remains pending. After an administrator repairs
+# the machine, this marker lets every other account complete without using sudo.
 if ! as_root true 2>/dev/null; then
-  defer_privileged_repair
+  fail_privileged_repair
 fi
 
 # Removing a unit and reloading systemd are one repair. Persist the second half
@@ -275,10 +272,10 @@ fi
 # retry that now sees no unit on disk.
 if [[ -e $reload_needed_marker ]]; then
   if ! as_root systemctl daemon-reload >/dev/null 2>&1; then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
   if ! as_root rm -f "$reload_needed_marker"; then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
 fi
 
@@ -289,17 +286,17 @@ inspect_sudoers_file() {
   # an if-condition makes "file missing" indistinguishable from "sudo failed",
   # which could mark a live grant repaired without ever reading it.
   if ! kind=$(as_root bash -c 'if [[ -f $1 ]]; then printf file; elif [[ -e $1 ]]; then printf other; else printf missing; fi' bash "$file"); then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
 
   [[ $kind == "file" ]] || return 0
   if ! content=$(as_root cat "$file"); then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
 
   if "$predicate" <<<"$content"; then
     if ! as_root rm -f "$file"; then
-      defer_privileged_repair
+      fail_privileged_repair
     fi
   fi
 }
@@ -314,24 +311,24 @@ if [[ -f $plymouth_unit ]] && plymouth_unit_runs_from_home <"$plymouth_unit"; th
   # ExecStop is the path this migration exists to keep root away from; disabling
   # only drops the multi-user.target symlink.
   if ! as_root install -Dm644 /dev/null "$reload_needed_marker"; then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
   if ! as_root systemctl disable omarchy-plymouth-shutdown.service >/dev/null 2>&1; then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
   if ! as_root rm -f "$plymouth_unit"; then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
   # systemd keeps serving the copy it already loaded until it rereads the
   # directory, so without this the unit is still there to run at shutdown.
   if ! as_root systemctl daemon-reload >/dev/null 2>&1; then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
   if ! as_root rm -f "$reload_needed_marker"; then
-    defer_privileged_repair
+    fail_privileged_repair
   fi
 fi
 
 if ! as_root install -Dm644 /dev/null "$machine_marker"; then
-  defer_privileged_repair
+  fail_privileged_repair
 fi