fix(global_defaults): normalize disks when install_drive is supplied externally

roles/bootstrap/vars/hardware.yml

@@ -9,7 +9,7 @@ bootstrap_hardware_packages:
       amd: [amd-ucode]
     firmware_base: []
     firmware:
-      intel: [linux-firmware-other]      # iwlwifi + i915 firmware live here
+      intel: [linux-firmware-intel]      # iwlwifi (WiFi) + i915/xe (GPU) + ibt (BT) firmware live here
       amd: [linux-firmware-amdgpu]
       nvidia: [linux-firmware-nvidia]
       atheros: [linux-firmware-atheros]

roles/configuration/tasks/bootloader.yml

@@ -18,13 +18,24 @@
       register: configuration_bootloader_result
       changed_when: configuration_bootloader_result.rc == 0
 
-    - name: Check existing EFI boot entries
+    - name: Remove stale EFI boot entries for this OS
-      ansible.builtin.command: efibootmgr
+      # UEFI NVRAM entries survive a disk wipe (they live in firmware, not on disk).
-      register: configuration_efi_entries
+      # A prior install leaves a dead entry, and a case-insensitive duplicate label
-      changed_when: false
+      # ("ArchLinux" vs "archlinux") would otherwise win the boot order - the firmware
+      # then falls through to removable media. Delete every entry carrying our label,
+      # then recreate exactly one clean entry.
+      ansible.builtin.shell:
+        cmd: >-
+          set -o pipefail;
+          efibootmgr | grep -iP '^Boot[0-9A-F]{4}\*?\s+{{ _efi_vendor }}\s*$'
+          | grep -oP '^Boot\K[0-9A-F]{4}'
+          | xargs -r -I{} efibootmgr -b {} -B
+        executable: /bin/bash
+      register: _efi_gc_result
+      changed_when: _efi_gc_result.stdout | length > 0
+      failed_when: false
 
-    - name: Ensure EFI boot entry exists
+    - name: Create EFI boot entry (efibootmgr -c prepends it to BootOrder)
-      when: ('* ' + _efi_vendor) not in configuration_efi_entries.stdout
       ansible.builtin.command: >-
         efibootmgr -c
         -L '{{ _efi_vendor }}'
@@ -34,15 +45,16 @@
       register: configuration_efi_entry_result
       changed_when: configuration_efi_entry_result.rc == 0
 
-    - name: Set installed OS as first EFI boot entry
+    - name: Install removable EFI fallback loader
-      ansible.builtin.shell:
+      # Firmware-agnostic fallback (\EFI\BOOT\BOOTX64.EFI): many consumer firmwares
-        cmd: >-
+      # ignore or reset custom NVRAM entries and boot only the removable path.
-          set -o pipefail &&
+      when: _configuration_platform.grub_install
-          efibootmgr | grep -i '{{ _efi_vendor }}' | grep -oP 'Boot\K[0-9A-F]+' | head -1
+      ansible.builtin.command: >-
-          | xargs -I{} efibootmgr -o {}
+        {{ chroot_command }} /usr/bin/install -Dm644
-        executable: /bin/bash
+        {{ partitioning_efi_mountpoint }}/EFI/{{ _efi_vendor }}/{{ _efi_loader }}
-      register: _efi_bootorder_result
+        {{ partitioning_efi_mountpoint }}/EFI/BOOT/BOOTX64.EFI
-      changed_when: _efi_bootorder_result.rc == 0
+      register: _efi_fallback_result
+      changed_when: _efi_fallback_result.rc == 0
 
     - name: Ensure lvm2 for non btrfs filesystems
       when: os == "archlinux" and system_cfg.filesystem != "btrfs"

roles/global_defaults/tasks/_normalize_disks.yml

@@ -94,6 +94,7 @@
 
     - name: Set install_drive from primary disk
       when:
+        - install_drive is not defined
         - system_disks_cfg | length > 0
         - system_disks_cfg[0].device | string | length > 0
       ansible.builtin.set_fact:

roles/global_defaults/tasks/system.yml

@@ -79,9 +79,7 @@
     os_version: "{{ system_cfg.version | default('') | string }}"
 
 - name: Normalize disk configuration (pre-computed system_cfg)
-  when:
+  when: system_cfg is defined
-    - system_cfg is defined
-    - install_drive is not defined
   ansible.builtin.include_tasks: _normalize_disks.yml
 
 # Runs on every path before validation, so an empty firewall.backend / content.source