Keep an administrator's migration target as it is in the Mac bootstrap

bin/omarchy-mac-migrate-bootstrap

@@ -16,9 +16,12 @@
 # through their conflict, so nothing is overwritten.
 #
 # The package's own migration target is the switch that activates this: until
-# the published omarchy-mac-boot ships one, nothing runs. The Mac moves to the
-# channel that target names, or to --channel's, which
-# /etc/omarchy-mac/migration-target then keeps for later runs.
+# the published omarchy-mac-boot ships one, nothing runs. An administrator's
+# /etc/omarchy-mac/migration-target always wins and reaches the engine as it
+# is, server= and all; a --channel that disagrees with it is ignored with a
+# warning. Without one the Mac moves to --channel's channel, which that file
+# then keeps for later runs, or else to the channel the package's target names.
+# The package itself always comes from pkgs.omarchy.org's channel of that name.
 #
 # --prime fetches, checks and unpacks the package, and stops there.
 #
@@ -212,36 +215,45 @@ if migration_in_progress; then
   exit 0
 fi
 
-# An administrator's target names the channel this Mac keeps.
+# The package's target must activate the migration and the engine must run
+# from a download. Sets packaged and packaged_channel.
+check_payload() {
+  packaged=$payload/usr/lib/omarchy-mac/boot/migration-target
+  [[ -f $packaged ]] || defer "omarchy-mac-boot $version does not activate the migration yet"
+  grep -q -- '--payload' "$payload/usr/bin/omarchy-mac-migrate" || defer "omarchy-mac-boot $version cannot run from a download"
+  packaged_channel=$(target_value "$packaged" channel)
+  [[ $(target_value "$packaged" type) == "repository" && $packaged_channel =~ ^(stable|rc|edge)$ ]] ||
+    defer "omarchy-mac-boot $version ships a target that is not a repository channel"
+}
+
 if [[ -f $admin_target ]]; then
   [[ $(target_value "$admin_target" type) == "repository" ]] ||
     defer "$admin_target is not a repository target; run omarchy-mac-migrate with it yourself"
-  channel=$(target_value "$admin_target" channel)
-fi
-
-version=$(fetch_payload "${channel:-stable}")
-packaged=$payload/usr/lib/omarchy-mac/boot/migration-target
-[[ -f $packaged ]] || defer "omarchy-mac-boot $version does not activate the migration yet"
-grep -q -- '--payload' "$payload/usr/bin/omarchy-mac-migrate" || defer "omarchy-mac-boot $version cannot run from a download"
-packaged_channel=$(target_value "$packaged" channel)
-[[ $(target_value "$packaged" type) == "repository" && $packaged_channel =~ ^(stable|rc|edge)$ ]] ||
-  defer "omarchy-mac-boot $version ships a target that is not a repository channel"
-if [[ -z $channel && $packaged_channel != "stable" ]]; then
-  channel=$packaged_channel
-  version=$(fetch_payload "$channel")
-fi
-
-target=$packaged
-if [[ -n $channel && $channel != "$packaged_channel" ]]; then
-  install -d -m 755 "$(dirname "$admin_target")"
-  sed -e '/^server=/d' -e "s/^channel=.*/channel=$channel/" "$packaged" >"$admin_target.new"
-  chmod 644 "$admin_target.new"
-  if cmp -s "$admin_target.new" "$admin_target"; then
-    rm -f "$admin_target.new"
-  else
-    mv -f "$admin_target.new" "$admin_target"
+  admin_channel=$(target_value "$admin_target" channel)
+  [[ $admin_channel =~ ^(stable|rc|edge)$ ]] || defer "$admin_target names no channel (stable, rc or edge)"
+  if [[ -n $channel && $channel != "$admin_channel" ]]; then
+    echo "omarchy-mac-migrate-bootstrap: keeping the $admin_channel channel from $admin_target; --channel $channel is ignored: edit or remove that file to change it" >&2
   fi
+  version=$(fetch_payload "$admin_channel")
+  check_payload
   target=$admin_target
+else
+  explicit=$channel
+  version=$(fetch_payload "${channel:-stable}")
+  check_payload
+  if [[ -z $channel && $packaged_channel != "stable" ]]; then
+    channel=$packaged_channel
+    version=$(fetch_payload "$channel")
+    check_payload
+  fi
+  target=$packaged
+  if [[ -n $explicit || ( -n $channel && $channel != "$packaged_channel" ) ]]; then
+    install -d -m 755 "$(dirname "$admin_target")"
+    sed -e '/^server=/d' -e "s/^channel=.*/channel=$channel/" "$packaged" >"$admin_target.new"
+    chmod 644 "$admin_target.new"
+    mv -f "$admin_target.new" "$admin_target"
+    target=$admin_target
+  fi
 fi
 
 if (( prime )); then

test/shell.d/mac-migrate-bootstrap-test.sh

@@ -205,3 +205,65 @@ mkdir -p "$R/etc/omarchy-mac"
 printf 'format=1\ntype=candidate-set\nchannel=edge\nset=/x\nfingerprint=%s\n' "$signer" >"$R/etc/omarchy-mac/migration-target"
 expect_deferred "an administrator's candidate-set target" "is not a repository target"
 pass "an administrator's own candidate-set target is left to them"
+
+# An administrator's repository target reaches the engine as it is, whichever
+# channel the package's own target names.
+for packaged in stable rc; do
+  new_root
+  publish rc 20260926-2 "$(package 20260926-2 "$packaged")"
+  mkdir -p "$R/etc/omarchy-mac"
+  printf 'format=1\ntype=repository\nchannel=rc\nserver=https://mirror.example/rc/$arch\npackages=omarchy omarchy-mac-boot\n' >"$R/etc/omarchy-mac/migration-target"
+  cp "$R/etc/omarchy-mac/migration-target" "$tmp/admin-target"
+  output=$(run_bootstrap 2>&1) || fail "an administrator's rc target migrates (packaged $packaged)" "$output"
+  cmp -s "$tmp/admin-target" "$R/etc/omarchy-mac/migration-target" ||
+    fail "the administrator's target is left as it is (packaged $packaged)" "$(cat "$R/etc/omarchy-mac/migration-target")"
+  [[ $(cat "$tmp/engine.log") == "--payload $R$payload run --target $R/etc/omarchy-mac/migration-target" ]] ||
+    fail "the engine runs with the administrator's target (packaged $packaged)" "$(cat "$tmp/engine.log")"
+  [[ $(sed -n 's/^pkgver = //p' "$R$payload/.PKGINFO") == "20260926-2" ]] || fail "the package comes from the administrator's channel"
+done
+pass "an administrator's target keeps its channel, server and packages, and the engine gets it unchanged"
+
+new_root
+publish rc 20260926-2 "$(package 20260926-2 stable)"
+mkdir -p "$R/etc/omarchy-mac"
+printf 'format=1\ntype=repository\nchannel=rc\nserver=https://mirror.example/rc/$arch\n' >"$R/etc/omarchy-mac/migration-target"
+cp "$R/etc/omarchy-mac/migration-target" "$tmp/admin-target"
+output=$(run_bootstrap --channel edge 2>&1) || fail "a --channel that disagrees with the administrator's target still migrates" "$output"
+grep -q "keeping the rc channel from $R/etc/omarchy-mac/migration-target; --channel edge is ignored" <<<"$output" ||
+  fail "a --channel that disagrees with the administrator's target is reported" "$output"
+cmp -s "$tmp/admin-target" "$R/etc/omarchy-mac/migration-target" && grep -q -- "--target $R/etc/omarchy-mac/migration-target" "$tmp/engine.log" ||
+  fail "the administrator's target wins over --channel" "$(cat "$tmp/engine.log")"
+: >"$tmp/engine.log"
+output=$(run_bootstrap --prime --channel edge 2>&1) || fail "priming with a disagreeing --channel succeeds" "$output"
+grep -q "ready to move this Mac onto the rc channel" <<<"$output" && [[ ! -s $tmp/engine.log ]] ||
+  fail "priming with a disagreeing --channel primes the administrator's channel" "$output"
+pass "a --channel that disagrees with the administrator's target is ignored with a warning, never applied"
+
+new_root
+publish stable 20260926-1 "$(package 20260926-1 stable)"
+mkdir -p "$R/etc/omarchy-mac"
+printf 'format=1\ntype=repository\nchannel=beta\n' >"$R/etc/omarchy-mac/migration-target"
+expect_deferred "an administrator's target without a known channel" "names no channel"
+pass "an administrator's target without a known channel defers, running nothing"
+
+new_root
+publish stable 20260926-1 "$(package 20260926-1 stable)"
+run_bootstrap --prime --channel stable >/dev/null 2>&1 || fail "priming for stable succeeds"
+[[ $(cat "$R/etc/omarchy-mac/migration-target") == $'format=1\ntype=repository\nchannel=stable' ]] ||
+  fail "a chosen channel is kept even when the package names it too" "$(cat "$R/etc/omarchy-mac/migration-target" 2>/dev/null)"
+pass "a channel given with --channel is kept for later runs even when it is the package's own"
+
+# When stable's package names another channel, that channel's package is
+# checked again and its target decides whether the Mac needs one of its own.
+new_root
+publish stable 20260926-1 "$(package 20260926-1 rc)"
+publish rc 20260926-2 "$(package 20260926-2 stable)"
+output=$(run_bootstrap 2>&1) || fail "a package naming another channel migrates on it" "$output"
+[[ $(sed -n 's/^pkgver = //p' "$R$payload/.PKGINFO") == "20260926-2" &&
+  $(cat "$R/etc/omarchy-mac/migration-target") == $'format=1\ntype=repository\nchannel=rc' ]] ||
+  fail "the channel the package names is kept when its own package names another" "$(cat "$R/etc/omarchy-mac/migration-target" 2>/dev/null)"
+publish rc 20260926-2 "$(package 20260926-2 none)"
+rm -rf "$R/etc" "$R/var/lib/omarchy-mac/bootstrap"
+: >"$tmp/engine.log"
+expect_deferred "a channel whose package does not activate the migration" "does not activate the migration yet"
+pass "the package from the channel the stable target names is checked and decides the Mac's own target"