identity that outlives the enumeration

Two identical disks, one operating system, and a naming scheme assigned by the order in which the hardware answers at boot. This is the ordinary condition of a machine, and it means every script that names a disk is guessing. The guesses are not always right, and being wrong about which disk you are holding during installation is not a class of mistake you get to retry.

Three changes came out of that observation, and they are one idea applied three times. Identify a disk by the identifier burnt into the hardware rather than the name the system handed it, so the mapping survives a reboot. Write the boot-time mount references in terms of an identifier stored inside the filesystem rather than a device name, so swapped names cannot mount the wrong thing. And clear the array metadata on both members before installing, because a surviving member of a previous array will reassemble over the new partition table and present the installer with the world it was meant to replace.

Each of those removes a piece of information the pipeline used to carry: which disk is which, by name. What replaces it is a lookup, so the pipeline passes a mapping between steps instead of assuming every step agrees.

The cost is that a mistake in the lookup is now a silent wrong answer rather than an obvious wrong disk.

What it proves is that a machine's identity has to be designed to outlive the way that machine happens to enumerate itself.