discovering the disks instead of naming them

Installation scripts are written on one machine and run on another, and the difference is rarely written down. On this hardware two identical disks present themselves in an order that differs between installations, so a script that names a disk has already made a bet about which disk it is talking to. When the mapping shifts, that bet is lost, and losing it at partition time is not a recoverable class of mistake.

The mismatch has no elegant fix, because device naming is a fact about the particular boot, not about the machine. The decision was to make the pipeline ask instead of assume: identify what is attached at run time, derive the layout from what is actually present, and refuse to continue when the shape is not the shape it expects. That last clause is the interesting one. A discovery step that guesses produces a machine that boots; a discovery step that stops produces an error and a machine that is still yours.

The cost is that the pipeline can no longer be read as a fixed sequence of named steps. It asks first, so it cannot be replayed without inspecting the answers, and the answers vary enough that no single run is a template for the next.

What it proves is that the difference between a provisioning system and a foot-gun is a refusal to proceed.