fix: ground + fix three Pillar-9 candidate bugs from the script sweep

All three confirmed real on inspection.

1. nomarchy-refresh-config was dead on every system: it read
   /etc/nixos/nomarchy/{core/home/config,features} (the source tree never
   lands there — only /etc/nomarchy on VM-guest/live ISO) and fell back to
   ~/.local/share/nomarchy/config, which nothing deployed despite SKILL.md
   documenting it. Deploy the pristine core/home/config tree to
   ~/.local/share/nomarchy/config via xdg.dataFile and read from there, so it
   works without a source checkout; its live caller nomarchy-refresh-fastfetch
   now succeeds. Fix two stale SKILL.md examples (waybar/, hypr/) that pointed
   at non-existent stock paths.

2. nomarchy-docs-scripts shipped a stale divergent copy in
   features/scripts/utils/ (in the user nomarchy-system-scripts package)
   beside the canonical bin/utils dev tool — it errored outside the repo.
   Grounding it surfaced the identical bug in nomarchy-docs-keybindings.
   Delete both duplicates, add them to the generator's self-reference
   denylist so they don't show as false `missing`, regenerate docs/SCRIPTS.md.

3. Home ~/.config/nomarchy/state.json was never seeded on non-installer
   systems, so nomarchy-installed-summary rendered "—" for theme/font/panel.
   Add an idempotent home-manager activation seed in core/home/state.nix that
   backfills the resolved values (defaults * existing — user choices and
   runtime-only keys like welcome_done always win).

Verified: flake check + full eval matrix clean; refresh-config happy/error
paths and the seed deep-merge proven by hand.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -178,13 +178,14 @@ Pillar is **done** when every component has had a live VM pass and the roadmap c
 
 (Move items here when they land — keep them brief, link the commit/PR.)
 
+- _2026-05-31_ — **Pillar 9 / Component 2 follow-up: grounded + fixed the three candidate bugs from the script sweep.** All three confirmed real. **(1)** `nomarchy-refresh-config` was dead on every system — it read `/etc/nixos/nomarchy/{core/home/config,features}` (the source tree never lands there; it's only at `/etc/nomarchy`, and only on VM-guest/live ISO) and fell back to `~/.local/share/nomarchy/config`, which nothing deployed even though `SKILL.md` documents it as the stock-config path. Deployed the pristine `core/home/config` tree to `~/.local/share/nomarchy/config` via `xdg.dataFile` and rewrote the script to read from there, so it works on any system without a source checkout (its only live caller, `nomarchy-refresh-fastfetch` → `fastfetch/config.jsonc`, now succeeds); fixed two stale `SKILL.md` examples that pointed at non-existent stock paths (`waybar/`, `hypr/`). Restoring arbitrary `features/`-owned configs (waybar, the full hypr tree) has no single stock mirror — deferred as a possible future feature, not grafted on. **(2)** `nomarchy-docs-scripts` shipped a stale, divergent copy in `features/scripts/utils/` (in the user `nomarchy-system-scripts` package) alongside the canonical `bin/utils/` dev tool — outside the repo it errored (`set -u` + `repo_root=…/../..`). Deleted the duplicate; grounding it surfaced **the identical bug** in `nomarchy-docs-keybindings` (a stale `features/` copy still referencing `tiling.conf` vs the canonical `tiling-v2.conf`), deleted too. Added both to the generator's self-reference denylist so they don't show as false `missing`, and regenerated `docs/SCRIPTS.md`. **(3)** Home `~/.config/nomarchy/state.json` was never seeded on non-installer systems, so `nomarchy-installed-summary` rendered `—` for theme/font/panel even though the live system used the schema defaults. Added an idempotent home-manager activation seed in `core/home/state.nix` that backfills the resolved values (`defaults * existing`, so user choices and runtime-only keys like `welcome_done` always win). Verified: `flake check` + full eval matrix clean, `refresh-config` happy/error paths and the seed deep-merge proven by hand. Activation file-write on a real boot is the one piece left for a live VM pass.
 - _2026-05-31_ — **Pillar 9: chasing a D-Bus error uncovered the whole app list being dropped.** A `DBus.Error … name is not activatable` seen during the menu run traced back to `notify-send` failing because mako wasn't running. Reproduced exactly via `uwsm-app -- mako` → "Command not found: mako". Root cause was far bigger than the notification daemon: `home.packages` in `features/default.nix` was wrapped in `lib.mkDefault`. `home.packages` is a list, and `filterOverrides` keeps only the highest-priority definitions — so the moment any other module set `home.packages` at normal priority (`features/scripts/default.nix`'s `[ nomarchy-scripts ]`, the installer's profile packages), the **entire curated mkDefault list was silently discarded**. Every install was missing firefox, thunar, imv, mpv, swww, **mako** (→ broken notifications), **hyprlock** (→ broken lock screen, the "hyprlock not found" flagged in the earlier script sweep), and rofi — and the drop also hid a stale `rofi-wayland` reference (merged into `rofi` upstream) that only errored once the list went live. Removed the `mkDefault` so the list merges (`home.packages` 31 → 52 pkgs) and fixed `rofi-wayland` → `rofi` (`1117dcf`). Verified on a rebuilt VM: mako installs + runs + owns `org.freedesktop.Notifications`, hyprlock/firefox present, and `nomarchy-toggle-waybar` (the command that errored) runs clean with no D-Bus error. Lesson for `docs/AGENT.md`-style guardrails: never wrap a *list/attrset* option in `lib.mkDefault` expecting downstream override — it makes the whole definition vanish when anything else contributes; `mkDefault` only makes sense on scalar leaves.
 
 - _2026-05-31_ — **Pillar 9 / Component 5: walker menus verified, two real bugs fixed.** Drove every walker menu in a VM (theme picker, background selector, app launcher). Found two bugs, both invisible to eval/CI: **(1)** the elephant lua menu providers (`nomarchy_themes.lua` → `menus:nomarchythemes`, `nomarchy_background_selector.lua` → `menus:nomarchyBackgroundSelector`) were deployed via the bulk nomarchy config to `~/.config/nomarchy/default/elephant/` — outside elephant's provider search path — so elephant never registered them and the theme picker / background selector returned "No Results" (used by `nomarchy-theme`, `nomarchy-wallpaper`, and the `nomarchy-menu` Style submenu). Moved them into `features/apps/elephant/config/menus/` → `~/.config/elephant/menus/` (`c831b01`); verified on a fresh boot via `elephant listproviders` and the rendered theme picker showing all 21 palettes **with per-theme preview images**. **(2)** Even once registered, the background selector still returned "No Results" because its `GetEntries` ran `find <dir> -type f`, but home-manager deploys the per-theme backgrounds as nix-store symlinks and `-type f` doesn't follow symlinks — added `-L` to match `nomarchy_themes.lua` (`c5fe0e0`); proven in the VM (`find -type f` → 0, `find -L` → the backgrounds). App launcher (desktopapplications provider) confirmed working — lists apps with icons. Note on method: walker renders reliably when launched from a terminal in-session; the `sendkey` keybinding/`esc` path is flaky headless.
 
 - _2026-05-31_ — **Pillar 9 / Component 8 + 1: full installer end-to-end on a real VM install.** Built the installer ISO, booted it in a UEFI QEMU VM with a blank 30 GB target disk, and drove `install.sh` to a complete install — then rebooted from the installed disk and verified the running system. Method: a hand-crafted `--resume` state file (env-preseed doesn't stick because `install.sh` re-inits its vars, but `load_state` sources whatever the state file contains, including the `USER_PASSWORD_HASH`/`LUKS_PASSWORD` that `save_state` omits), reducing 34 `gum` prompts to a single `expect`-driven review confirmation (a test ISO variant added SSH + `expect`; `TERM` must be overridden off `xterm-kitty`). The installer ran clean: env checks, disko (LUKS2 + BTRFS), `nixos-install` of the full desktop (~16 min, pinned to the install commit so it built this session's fixes), and its own preflight `nixos-rebuild dry-build` passed ("Configuration evaluates cleanly"). The installed system then **booted end-to-end**: UEFI → systemd-boot → themed Plymouth LUKS passphrase prompt (per-palette splash, confirming the Plymouth templating shipped earlier) → autologin → Hyprland desktop with the correct identity (`test@nomarchy-test`), form factor (desktop), timezone (UTC), CLI-Utils profile, and `FDE (LUKS): Yes`. Interactivity verified via `sendkey`: SUPER+Return opened a themed terminal, and the welcome wizard advanced into the walker theme picker (all 21 palettes listed). **No Hyprland config-error overlay** — the geforce/pip/idleinhibit + compgen fixes from this session are confirmed correct on a real install. Validates the installer, generated config, FDE boot, Plymouth theming, desktop, walker, keybindings, and first-boot UX in one pass.
 
-- _2026-05-31_ — **Pillar 9 / Component 2 + 4: VM script sweep + theme visual pass (partial).** Built an SSH-into-VM harness (key auth + `QEMU_NET_OPTS` port-forward) and ran a 107-command sweep of the ~160 `nomarchy-*` commands. Most apparent failures were harness artifacts (non-login PATH, no `HYPRLAND_INSTANCE_SIGNATURE`, no session bus, no TTY for `gum`) — the `jq … column 28` family is just `hyprctl -j | jq` with no reachable instance over SSH. One confirmed real bug fixed: `nomarchy-haptic-touchpad` (python3 script wired as the XPS `systemd.services.nomarchy-haptic-touchpad`) died with `env: python3: not found` because `python3` wasn't in `systemScriptDeps` (`23d432f`). Theme pass (Component 4): the live `nomarchy-theme-set` rebuild path can't run in a throwaway VM (read-only store flake + Nix git-ownership check — a VM artifact), so verified rendering by booting the VM with each palette baked in as the default (`extendModules` + Stylix). Confirmed correct rendering — themed waybar, readable contrast, correct accents, no broken colours — across the **entire light-mode risk class** (catppuccin-latte, flexoki-light, rose-pine, summer-day, white) plus extremes (vantablack pure-black, summer-night default). **Still to do:** re-run the graphical scripts with the session env imported; the 14 remaining dark palettes (lower contrast risk); and the candidate bugs logged below. Candidate bugs to ground next: `nomarchy-refresh-config` reads `/etc/nixos/nomarchy/features` (doesn't exist — flake is at `/etc/nomarchy`); a repo dev-tool (`nomarchy-docs-scripts`) appears to ship in the user scripts package and hits `script_loc: unbound` outside the repo; home `~/.config/nomarchy/state.json` isn't seeded in a non-installer system so the installed-summary shows `—`.
+- _2026-05-31_ — **Pillar 9 / Component 2 + 4: VM script sweep + theme visual pass (partial).** Built an SSH-into-VM harness (key auth + `QEMU_NET_OPTS` port-forward) and ran a 107-command sweep of the ~160 `nomarchy-*` commands. Most apparent failures were harness artifacts (non-login PATH, no `HYPRLAND_INSTANCE_SIGNATURE`, no session bus, no TTY for `gum`) — the `jq … column 28` family is just `hyprctl -j | jq` with no reachable instance over SSH. One confirmed real bug fixed: `nomarchy-haptic-touchpad` (python3 script wired as the XPS `systemd.services.nomarchy-haptic-touchpad`) died with `env: python3: not found` because `python3` wasn't in `systemScriptDeps` (`23d432f`). Theme pass (Component 4): the live `nomarchy-theme-set` rebuild path can't run in a throwaway VM (read-only store flake + Nix git-ownership check — a VM artifact), so verified rendering by booting the VM with each palette baked in as the default (`extendModules` + Stylix). Confirmed correct rendering — themed waybar, readable contrast, correct accents, no broken colours — across the **entire light-mode risk class** (catppuccin-latte, flexoki-light, rose-pine, summer-day, white) plus extremes (vantablack pure-black, summer-night default). **Still to do:** re-run the graphical scripts with the session env imported; the 14 remaining dark palettes (lower contrast risk); and the candidate bugs logged below. Candidate bugs to ground next: `nomarchy-refresh-config` reads `/etc/nixos/nomarchy/features` (doesn't exist — flake is at `/etc/nomarchy`); a repo dev-tool (`nomarchy-docs-scripts`) appears to ship in the user scripts package and hits `script_loc: unbound` outside the repo; home `~/.config/nomarchy/state.json` isn't seeded in a non-installer system so the installed-summary shows `—`. _(All three grounded + fixed 2026-05-31 — see the Component 2 follow-up entry above.)_
 
 - _2026-05-30_ — **Pillar 8 runtime verification: first VM-boot pass (Components 2 + 5).** Built `nixosConfigurations.default.config.system.build.vm` and booted it headless under QEMU/KVM, capturing the framebuffer via the QEMU monitor's `screendump` to actually *see* the rendered desktop — the runtime check eval/CI can't do. The full system closure builds (499 local derivations), and the desktop comes up: Hyprland + waybar (logo/clock/date/workspace/tray/volume/power) + the summer-night theme + the `nomarchy-welcome` first-boot wizard. Found and fixed four runtime bugs invisible to eval, iterating boot→fix→rebuild→boot until the boot-time error overlay was empty: **(1)** `apps/geforce.conf` + `apps/moonlight.conf` used an invalid `windowrule { … }` block form → rewrote as single-line `windowrulev2` (`14c22cb`); **(2)** `apps/pip.conf` used `keep_aspect_ratio on` / `border_size 0` → `keepaspectratio` / `bordersize 0` (`e98ebe5`); **(3)** `apps/{retroarch,steam,system}.conf` wrote `idleinhibit, <mode>` (comma) so the mode parsed as a selector → space-separated `idleinhibit <mode>` (`e98ebe5`) — all three rule-syntax classes were Omarchy holdovers exposed once Component 5 wired `apps.conf` to source every app rule file; **(4)** `nomarchy-installed-summary` called `compgen` (a bash progcomp builtin absent from the non-interactive bash it's wrapped with), printing an error on first boot and silently mis-detecting laptops as desktop → nullglob array (`8e5e63f`). The summary's `—` values for theme/font/etc. in a non-installer `default` VM are expected (no populated `state.json`; `jq_or_empty` degrades gracefully). Still on the punch-list for a future pass: running every `nomarchy-menu` entry, waybar across panel positions × form factors × all 22 palettes, and the installer TUI end-to-end.