# Separate reboot procedure

This procedure begins only after successful package execution and review of its unique maintenance record. It never reboots automatically. Maintenance and validation records are atomic unique root-owned mode `0700` directories. They can contain sensitive operational metadata and must not be committed.

## Pre-reboot verification

Set the exact record path printed by `execute-maintenance.sh`:

```bash
record=/var/log/le-phase2a-maintenance/maintenance.YYYYMMDDTHHMMSSZ.XXXXXXXX
test -d "$record" || { printf 'STOP: invalid record path\n' >&2; return 1; }
```

Record the running kernel and review installed kernel packages:

```bash
uname -a | tee "$record/running-kernel-immediately-before-reboot.txt"
pacman -Q linux linux-headers linux-zen linux-zen-headers |
  tee "$record/installed-kernels-immediately-before-reboot.txt"
```

Verify both new module trees, kernel images, and nonempty initramfs files:

```bash
find /usr/lib/modules /boot -maxdepth 2 -type f \
  \( -name vmlinuz -o -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' -o -name pkgbase \) \
  -printf '%p size=%s mtime=%TY-%Tm-%TdT%TH:%TM:%TS\n' |
  sort | tee "$record/verified-kernel-initramfs-files.txt"

find /boot -maxdepth 1 -type f \
  \( -name 'vmlinuz-*' -o -name 'initramfs*' -o -name 'initrd*' \) -size 0 -print
```

Any zero-length artifact is a hard stop. Review DKMS and package hook output:

```bash
dkms status | tee "$record/dkms-immediately-before-reboot.txt"
systemctl --failed --no-pager | tee "$record/failed-units-immediately-before-reboot.txt"
sed -n '1,240p' "$record/hook-restart-summary.txt"
```

Confirm bootloader state without changing it:

```bash
bootctl status 2>&1 | tee "$record/bootctl-status-before-reboot.txt"
find /boot/loader/entries -maxdepth 1 -type f -print -exec sed -n '1,160p' {} \; 2>/dev/null |
  tee "$record/systemd-boot-entries-before-reboot.txt"

grub-install --version 2>&1 | tee "$record/grub-version-before-reboot.txt"
test -f /boot/grub/grub.cfg &&
  grep -E "^menuentry |^submenu |linux.*vmlinuz|initrd" /boot/grub/grub.cfg |
  tee "$record/grub-entries-before-reboot.txt"
```

The operator must identify and record both the intended new-kernel entry and a known-good previous-kernel/fallback entry. Stop if boot entries or initramfs references are missing, DKMS failed, storage is degraded, backups are unavailable, SSH is unstable, or production is unhealthy.

## Separately approved reboot command

Only after explicit approval for this exact reboot:

```bash
sudo systemctl reboot
```

Do not embed this command in the maintenance script, a timer, `at`, a shell trap, or a command chain. Keep independent console access open and proceed to `post-reboot-validate.sh` after the host returns.