From 612f947e1d664cdf52dc0f3d00c1187cf0af2179 Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Thu, 21 May 2026 01:42:40 -0400
Subject: [PATCH] limine-snapper.sh: move validation after snapper + hook
 re-enable

Per apollo audit: the /boot/limine.conf assertion grep was firing
BEFORE snapper config setup, btrfs quota disable, service enable, and
the mkinitcpio pacman hook re-enable. A validation failure (the failure
path the validation exists for) would leave the system half-configured.

Move the validation block to after 'mkinitcpio hooks re-enabled' so all
the post-config steps run first. Guard it with LIMINE_CONFIGURED=true so
non-limine setups still pass straight through to efibootmgr cleanup.
---
 install/login/limine-snapper.sh | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/install/login/limine-snapper.sh b/install/login/limine-snapper.sh
index bc436a12..100a2eef 100644
--- a/install/login/limine-snapper.sh
+++ b/install/login/limine-snapper.sh
@@ -80,17 +80,6 @@ EOF
   # limine's UKI pipeline — only this command does.
   sudo limine-update
 
-  # Sanity-check the final state. If any of these fail, the system will not
-  # boot, so it's better to halt the installer here than to ship a broken UKI.
-  if ! grep -q "^/+Omarchy" /boot/limine.conf; then
-    echo "Error: /boot/limine.conf does not contain an Omarchy entry" >&2
-    exit 1
-  fi
-  if [[ $CMDLINE == *cryptdevice=* ]] && ! grep -q "cryptdevice=" /boot/limine.conf; then
-    echo "Error: encrypted install but /boot/limine.conf has no cryptdevice=" >&2
-    exit 1
-  fi
-
   # Only snapshot root — /home is user data; rolling it back loses user work
   if ! sudo snapper list-configs 2>/dev/null | grep -q "root"; then
     sudo snapper -c root create-config /
@@ -101,6 +90,7 @@ EOF
   sudo btrfs quota disable / 2>/dev/null || true
 
   chrootable_systemctl_enable limine-snapper-sync.service
+  LIMINE_CONFIGURED=true
 fi
 
 echo "Re-enabling mkinitcpio hooks..."
@@ -116,6 +106,20 @@ fi
 
 echo "mkinitcpio hooks re-enabled"
 
+# Final sanity check: assert the Limine config and UKI actually contain what
+# they need to boot. Run AFTER snapper setup and hook re-enable so a
+# validation failure doesn't leave the system half-configured.
+if [[ ${LIMINE_CONFIGURED:-} == true ]]; then
+  if ! grep -q "^/+Omarchy" /boot/limine.conf; then
+    echo "Error: /boot/limine.conf does not contain an Omarchy entry" >&2
+    exit 1
+  fi
+  if [[ ${CMDLINE:-} == *cryptdevice=* ]] && ! grep -q "cryptdevice=" /boot/limine.conf; then
+    echo "Error: encrypted install but /boot/limine.conf has no cryptdevice=" >&2
+    exit 1
+  fi
+fi
+
 if [[ -n $EFI ]] && efibootmgr &>/dev/null; then
   # Remove the archinstall-created Limine entry
   while IFS= read -r bootnum; do