fix(audit): close all missing-references rows in script audit

The audit's "missing references" table held 15 rows — 2 real doc bugs and 13 grep false-positives — making Pillar 3 Phase B triage noisier than it needed to be. - Wrote themes/engine/scripts/nomarchy-theme-next so SKILL.md's documented "cycle to next theme" command actually resolves. - Scrubbed three stale `nomarchy-dev-*` references from SKILL.md (skill frontmatter, body, and Out-of-Scope list) — they hallucinated a workflow that doesn't exist and broke AI-assisted use of the skill. - Added a line-context filter to both nomarchy-docs-scripts generators that drops `nomarchy-*` tokens appearing in Nix pname/derivation idents, /tmp/ and /etc/sudoers.d/ paths, nixosConfigurations.* / packages.* flake outputs, mktemp -t prefixes, systemd unit vars, ./result/bin/run- binaries, and docker container references. - Added a small token-level denylist for five residual non-script identifiers (nomarchy-plymouth, nomarchy-sddm-theme, nomarchy-live, nomarchy-rev, nomarchy-windows) that survive line filtering because they appear as bare Nix list refs, comment backticks, or compose-heredoc identifiers. Regenerated docs/SCRIPTS.md; the "Missing references" section is now empty. Logged in docs/ROADMAP.md Shipped. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-18 16:58:54 +01:00
parent c1895eefd4
commit 158ae308cc
6 changed files with 87 additions and 33 deletions
--- a/bin/utils/nomarchy-docs-scripts
+++ b/bin/utils/nomarchy-docs-scripts
@@ -81,13 +81,34 @@ ref_files_per_cmd() {
 # Final char must be alphanumeric — dropping trailing-dash matches like
 # `nomarchy-pkg-` that come from glob references (`for c in nomarchy-pkg-*`).
 # Restrict to grep_includes so binaries / tmpfiles don't pollute the set.
-# We also filter out common prefix-only tokens that are false positives from
-# wildcards/expansions.
-all_refs=$(grep -rohE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
+# The first `grep -vE` drops lines where `nomarchy-*` is a derivation /
+# tmp file / sudoers basename / systemd unit / flake output / docker
+# container identifier rather than a shell invocation.
+# The second `grep -vE` is a token-level safety net for prefix-only
+# tokens left over from wildcards/expansions (e.g. `nomarchy-pkg-*`).
+all_refs=$(grep -rhE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
            "${grep_includes[@]}" \
            "${search_dirs[@]}" 2>/dev/null \
+          | grep -vE \
+              -e '(pname|name)[[:space:]]*=[[:space:]]*"nomarchy-' \
+              -e '/tmp/nomarchy-' \
+              -e '/etc/sudoers\.d/[^"[:space:]]*nomarchy-' \
+              -e 'nixosConfigurations\.nomarchy-' \
+              -e 'packages\.[^.]+\.nomarchy-' \
+              -e '\./result/bin/run-nomarchy-' \
+              -e 'mktemp[[:space:]]+[^|]*-t[[:space:]]+nomarchy-' \
+              -e '(TIMER_NAME|NOPASSWD_FILE|UNIT_NAME)=.*nomarchy-' \
+              -e 'docker[[:space:]]+[^|]*nomarchy-' \
+          | grep -oE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
          | grep -vE '^(nomarchy-launch|nomarchy-brightness|nomarchy-cmd|nomarchy-pkg|nomarchy-restart|nomarchy-toggle|nomarchy-theme|nomarchy-webapp-handler|nomarchy-font-selector|nomarchy-theme-selector|nomarchy-wallpaper-selector|nomarchy-setup|nomarchy-refresh|nomarchy-scripts|nomarchy-system-scripts|nomarchy-theme-engine-scripts)$' \
+          | grep -vE '^(nomarchy-plymouth|nomarchy-sddm-theme|nomarchy-live|nomarchy-rev|nomarchy-windows)$' \
          | sort -u)
+# The second denylist covers identifiers whose ambiguity survives the line
+# filter: `nomarchy-plymouth` / `nomarchy-sddm-theme` are Nix derivation
+# names referenced as bare idents in `[...]` lists, `nomarchy-live` is an
+# ISO label that shows up in comments, `nomarchy-rev` is `/etc/nomarchy-rev`
+# (written by the ISO), and `nomarchy-windows` is a docker container name
+# in compose heredocs.

 # --- Render: header --------------------------------------------------------

--- a/core/home/config/nomarchy-skill/SKILL.md
+++ b/core/home/config/nomarchy-skill/SKILL.md
@@ -8,7 +8,7 @@ description: >
  monitors, gaps, borders, blur, opacity, waybar, walker, terminal config, themes,
  wallpaper, night light, idle, lock screen, screenshots, layer rules, workspace
  settings, display config, and user-facing nomarchy commands. Excludes Nomarchy
-  source development in ~/.local/share/nomarchy/ and nomarchy-dev-* workflows.
+  source development in ~/.local/share/nomarchy/ and repo-internal workflows.
 ---

 # Nomarchy Skill
@@ -34,7 +34,7 @@ It is not for contributing to Nomarchy source code.

 **If you're about to edit a config file in ~/.config/ on this system, STOP and use this skill first.**

-**Do NOT use this skill for Nomarchy development tasks** (editing files in `~/.local/share/nomarchy/`, creating migrations, or running `nomarchy-dev-*` workflows).
+**Do NOT use this skill for Nomarchy development tasks** — editing files in `~/.local/share/nomarchy/` or modifying repo internals.

 ## Critical Safety Rules

@@ -352,7 +352,7 @@ When user requests system changes:
 This skill intentionally does not cover Nomarchy source development. Do not use this skill for:
 - Editing files in `~/.local/share/nomarchy/` (`bin/`, `config/`, `default/`, `themes/`, `migrations/`, etc.)
 - Creating or editing migrations
- Running `nomarchy-dev-*` commands
+- Modifying Nomarchy's own source tree

 ## Example Requests

--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -121,6 +121,7 @@ Each PR description should reference the row(s) in `docs/SCRIPTS.md` it closes,

 (Move items here when they land — keep them brief, link the commit/PR.)

+- _2026-05-18_ — Pillar 3 Phase B: missing-references triage. (1) Wrote `themes/engine/scripts/nomarchy-theme-next` so `SKILL.md`'s documented "cycle to next theme" command resolves; (2) scrubbed three stale `nomarchy-dev-*` references from `core/home/config/nomarchy-skill/SKILL.md`; (3) added a line-context filter to both `nomarchy-docs-scripts` generators that drops `nomarchy-*` tokens appearing in Nix `pname`/derivation idents, `/tmp/` & `/etc/sudoers.d/` paths, `nixosConfigurations.*` / `packages.*` flake outputs, `mktemp -t` prefixes, systemd unit vars, `./result/bin/run-` binaries, and `docker` container references; (4) added a small token-level denylist for five residual non-script identifiers (`nomarchy-plymouth`, `nomarchy-sddm-theme`, `nomarchy-live`, `nomarchy-rev`, `nomarchy-windows`) that survive line filtering. `docs/SCRIPTS.md` "Missing references" section is now empty (was 15).
 - _2026-05-04_ — Pillar 8: Distro Branding. (1) Scrubbed remaining "Omarchy" and "Spirit of Omarchy" references from README, scripts, and welcome wizard; (2) Updated `nomarchy-welcome` banner and `nomarchy-version` codename ("Sovereign"); (3) Verified existing `core/system/branding.nix` handles OS-release and bootloader labels; (4) Confirmed SDDM and Plymouth metadata are already Nomarchy-branded.
 - _2026-05-04_ — Thorough Out-of-the-Box QA Audit. (1) Restored automatic wallpaper switching by removing image filters from deployed themes; (2) Fixed broken "Style" menu entries by creating missing `about.txt` and `screensaver.txt` branding files; (3) Cleaned up conflicting keybindings by removing deprecated `tiling.conf` and updating the doc generator; (4) Removed legacy Nord theme hack from `nomarchy-theme-set`; (5) Fixed JSON parse error in `summer-day` waybar theme.
 - _2026-05-03_ — Fixed multi-disk LUKS/BTRFS boot hang. (1) Moved temporary LUKS keyfile to `/tmp/` so Disko correctly omits it from the runtime configuration; (2) Injected `x-systemd.requires` and `x-systemd.device-timeout=0` into BTRFS mount options to ensure all LUKS drives are decrypted before mounting.
--- a/docs/SCRIPTS.md
+++ b/docs/SCRIPTS.md
@@ -24,7 +24,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 - `delete-dead` — Phase B verdict: remove and update callers.
 - `stub-with-notify` — Phase B verdict: temporary `notify-send` stub.

-## Scripts (170)
+## Scripts (171)

 | Script | Location | Callers | Status | Notes |
 | --- | --- | --- | --- | --- |
@@ -69,7 +69,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-hw-vulkan` | `core/system/scripts` | features/scripts/utils/nomarchy-voxtype-install | `kept` |  |
 | `nomarchy-hyprland-active-window-transparency-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf | `kept` |  |
 | `nomarchy-hyprland-monitor-scaling-cycle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf,features/scripts/utils/nomarchy-menu, +1 more | `kept` |  |
-| `nomarchy-hyprland-window-close-all` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling.conf,core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf, +3 more | `kept` |  |
+| `nomarchy-hyprland-window-close-all` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf,core/system/scripts/nomarchy-system-logout, +2 more | `kept` |  |
 | `nomarchy-hyprland-window-gaps-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-hyprland-window-pop` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf | `kept` |  |
 | `nomarchy-hyprland-window-single-square-aspect-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/scripts/utils/nomarchy-menu | `kept` |  |
@@ -91,7 +91,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-launch-webapp` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/plain-bindings.conf,features/desktop/hyprland/config/bindings.conf, +7 more | `kept` |  |
 | `nomarchy-launch-wifi` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy/default/mako/core.ini, +4 more | `kept` |  |
 | `nomarchy-lock-screen` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy/extensions/menu.sh, +3 more | `kept` |  |
-| `nomarchy-manual` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu,themes/engine/scripts/nomarchy-theme-install | `kept` |  |
+| `nomarchy-manual` | `features/scripts/utils` | core/branding/about.txt,features/scripts/utils/nomarchy-menu, +1 more | `kept` |  |
 | `nomarchy-menu` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/hypr/bindings/utilities.conf, +10 more | `kept` |  |
 | `nomarchy-menu-keybindings` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy/default/mako/core.ini, +2 more | `kept` |  |
 | `nomarchy-migrate-state` | `features/scripts/utils` | — | `unused?` |  |
@@ -129,7 +129,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-restart-xcompose` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-rollback` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-setup-dns` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-setup-fido2` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
+| `nomarchy-setup-fido2` | `core/system/scripts` | features/scripts/utils/nomarchy-menu,installer/install.sh | `kept` |  |
 | `nomarchy-setup-fingerprint` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-show-done` | `themes/engine/scripts` | features/scripts/utils/nomarchy-launch-floating-terminal-with-presentation | `kept` |  |
 | `nomarchy-show-logo` | `themes/engine/scripts` | features/scripts/utils/nomarchy-launch-floating-terminal-with-presentation | `kept` |  |
@@ -150,16 +150,17 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-test-installer` | `features/scripts/utils` | features/scripts/utils/nomarchy-test-vm,README.md | `kept` |  |
 | `nomarchy-test-live-iso` | `features/scripts/utils` | hosts/nomarchy-live.nix | `kept` |  |
 | `nomarchy-test-vm` | `features/scripts/utils` | features/scripts/utils/nomarchy-test-live-iso | `kept` |  |
-| `nomarchy-theme` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/elephant/nomarchy_background_selector.lua, +16 more | `kept` |  |
+| `nomarchy-theme` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/elephant/nomarchy_background_selector.lua, +17 more | `kept` |  |
 | `nomarchy-theme-bg-install` | `themes/engine/scripts` | — | `unused?` |  |
 | `nomarchy-theme-bg-next` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-wallpaper, +1 more | `kept` |  |
 | `nomarchy-theme-bg-set` | `themes/engine/scripts` | core/home/config/nomarchy/default/elephant/nomarchy_background_selector.lua,features/scripts/utils/nomarchy-wallpaper | `kept` |  |
-| `nomarchy-theme-current` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-theme-current` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,themes/engine/scripts/nomarchy-theme-next | `kept` |  |
 | `nomarchy-theme-install` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
-| `nomarchy-theme-list` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-theme, +1 more | `kept` |  |
+| `nomarchy-theme-list` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-theme, +2 more | `kept` |  |
+| `nomarchy-theme-next` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-theme-refresh` | `themes/engine/scripts` | — | `unused?` |  |
 | `nomarchy-theme-remove` | `themes/engine/scripts` | — | `unused?` |  |
-| `nomarchy-theme-set` | `themes/engine/scripts` | core/home/config/nomarchy/default/elephant/nomarchy_themes.lua,core/home/config/nomarchy-skill/SKILL.md, +8 more | `kept` |  |
+| `nomarchy-theme-set` | `themes/engine/scripts` | core/home/config/nomarchy/default/elephant/nomarchy_themes.lua,core/home/config/nomarchy-skill/SKILL.md, +9 more | `kept` |  |
 | `nomarchy-theme-set-keyboard` | `themes/engine/scripts` | features/scripts/utils/nomarchy-on-boot | `kept` |  |
 | `nomarchy-theme-set-keyboard-asus-rog` | `themes/engine/scripts` | features/scripts/utils/nomarchy-on-boot,themes/engine/scripts/nomarchy-theme-set-keyboard | `kept` |  |
 | `nomarchy-theme-set-keyboard-f16` | `themes/engine/scripts` | features/scripts/utils/nomarchy-on-boot,themes/engine/scripts/nomarchy-theme-set-keyboard | `kept` |  |
@@ -167,7 +168,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-theme-set-templates` | `themes/engine/scripts` | themes/engine/scripts/nomarchy-theme-set | `kept` |  |
 | `nomarchy-themes-prebuild` | `themes/engine/scripts` | installer/install.sh | `kept` |  |
 | `nomarchy-theme-update` | `themes/engine/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-toggle-hybrid-gpu` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
+| `nomarchy-toggle-hybrid-gpu` | `core/system/scripts` | features/scripts/utils/nomarchy-menu,features/scripts/utils/nomarchy-sys-update, +1 more | `kept` |  |
 | `nomarchy-toggle-idle` | `core/system/scripts` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/waybar/config/config.jsonc, +2 more | `kept` |  |
 | `nomarchy-toggle-nightlight` | `themes/engine/scripts` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy-skill/SKILL.md, +1 more | `kept` |  |
 | `nomarchy-toggle-notification-silencing` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/waybar/config/config.jsonc, +1 more | `kept` |  |
@@ -177,7 +178,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-tui-install` | `features/scripts/utils` | features/scripts/utils/nomarchy-tui-remove-all | `kept` |  |
 | `nomarchy-tui-remove` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-tui-remove-all` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-tz-select` | `core/system/scripts` | features/desktop/waybar/config/config.jsonc,features/scripts/utils/nomarchy-menu | `kept` |  |
+| `nomarchy-tz-select` | `core/system/scripts` | features/desktop/waybar/config/config.jsonc,features/scripts/utils/nomarchy-menu, +2 more | `kept` |  |
 | `nomarchy-update` | `core/system/scripts` | core/home/config/nomarchy/default/mako/core.ini,core/home/config/nomarchy-skill/SKILL.md, +4 more | `kept` |  |
 | `nomarchy-update-available` | `features/scripts/utils` | features/desktop/waybar/config/config.jsonc,features/desktop/waybar/themes/summer-night/config.jsonc | `kept` |  |
 | `nomarchy-update-firmware` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
@@ -196,7 +197,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-webapp-remove` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-webapp-remove-all` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-welcome` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/autostart.conf | `kept` |  |
-| `nomarchy-wifi-powersave` | `core/system/scripts` | — | `unused?` |  |
+| `nomarchy-wifi-powersave` | `core/system/scripts` | features/scripts/utils/nomarchy-sys-update,installer/install.sh | `kept` |  |
 | `nomarchy-windows-vm` | `features/scripts/utils` | — | `unused?` |  |

 ## Missing references
@@ -205,21 +206,6 @@ Tokens grepped from `core/`, `features/`, `themes/`, `installer/`, `hosts/`, `bi

 | Token | Referenced in | Status |
 | --- | --- | --- |
-| `nomarchy-dev` | core/home/config/nomarchy-skill/SKILL.md | `missing` |
-| `nomarchy-dryrun` | installer/install.sh | `missing` |
-| `nomarchy-installer` | features/scripts/utils/nomarchy-build-iso,README.md | `missing` |
-| `nomarchy-live` | features/scripts/utils/nomarchy-build-live-iso,features/scripts/utils/nomarchy-test-live-iso | `missing` |
-| `nomarchy-luks` | installer/disko-config.nix,installer/install.sh | `missing` |
-| `nomarchy-menu-rows` | bin/utils/nomarchy-docs-scripts,features/scripts/utils/nomarchy-docs-scripts | `missing` |
-| `nomarchy-nopasswd` | core/system/scripts/nomarchy-sudo-passwordless-toggle | `missing` |
-| `nomarchy-nopasswd-expire` | core/system/scripts/nomarchy-sudo-passwordless-toggle | `missing` |
-| `nomarchy-plymouth` | themes/engine/plymouth.nix | `missing` |
-| `nomarchy-screenrecord-filename` | features/scripts/utils/nomarchy-cmd-screenrecord | `missing` |
-| `nomarchy-sddm-theme` | themes/engine/sddm.nix | `missing` |
-| `nomarchy-theme-next` | core/home/config/nomarchy-skill/SKILL.md | `missing` |
-| `nomarchy-themes-no-images` | themes/engine/files.nix | `missing` |
-| `nomarchy-vm` | features/scripts/utils/nomarchy-test-vm | `missing` |
-| `nomarchy-windows` | features/scripts/utils/nomarchy-windows-vm | `missing` |

 ## Menu items

--- a/features/scripts/utils/nomarchy-docs-scripts
+++ b/features/scripts/utils/nomarchy-docs-scripts
@@ -82,10 +82,32 @@ ref_files_per_cmd() {
 # Final char must be alphanumeric — dropping trailing-dash matches like
 # `nomarchy-pkg-` that come from glob references (`for c in nomarchy-pkg-*`).
 # Restrict to grep_includes so binaries / tmpfiles don't pollute the set.
-all_refs=$(grep -rohE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
+# The middle `grep -vE` drops lines where `nomarchy-*` is a derivation /
+# tmp file / sudoers basename / systemd unit / flake output / docker
+# container identifier — not a shell invocation — so they don't show up
+# as fake "missing" references.
+all_refs=$(grep -rhE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
            "${grep_includes[@]}" \
            "${search_dirs[@]}" 2>/dev/null \
+          | grep -vE \
+              -e '(pname|name)[[:space:]]*=[[:space:]]*"nomarchy-' \
+              -e '/tmp/nomarchy-' \
+              -e '/etc/sudoers\.d/[^"[:space:]]*nomarchy-' \
+              -e 'nixosConfigurations\.nomarchy-' \
+              -e 'packages\.[^.]+\.nomarchy-' \
+              -e '\./result/bin/run-nomarchy-' \
+              -e 'mktemp[[:space:]]+[^|]*-t[[:space:]]+nomarchy-' \
+              -e '(TIMER_NAME|NOPASSWD_FILE|UNIT_NAME)=.*nomarchy-' \
+              -e 'docker[[:space:]]+[^|]*nomarchy-' \
+          | grep -oE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
+          | grep -vE '^(nomarchy-plymouth|nomarchy-sddm-theme|nomarchy-live|nomarchy-rev|nomarchy-windows)$' \
          | sort -u)
+# The token-level denylist above covers identifiers whose ambiguity survives
+# the line filter: `nomarchy-plymouth` / `nomarchy-sddm-theme` are Nix
+# derivation names referenced as bare idents in `[...]` lists,
+# `nomarchy-live` is an ISO label that shows up in comments, `nomarchy-rev`
+# is `/etc/nomarchy-rev` (a file written by the ISO), and
+# `nomarchy-windows` is a docker container name in compose heredocs.

 # --- Render: header --------------------------------------------------------

--- a/themes/engine/scripts/nomarchy-theme-next
+++ b/themes/engine/scripts/nomarchy-theme-next
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+# Cycles to the next available theme (wraps from last back to first).
+
+mapfile -t THEMES < <(nomarchy-theme-list)
+TOTAL=${#THEMES[@]}
+
+if (( TOTAL == 0 )); then
+  notify-send "No themes available"
+  exit 1
+fi
+
+CURRENT=$(nomarchy-theme-current)
+INDEX=-1
+for i in "${!THEMES[@]}"; do
+  if [[ "${THEMES[$i]}" == "$CURRENT" ]]; then
+    INDEX=$i
+    break
+  fi
+done
+
+NEXT_INDEX=$(((INDEX + 1) % TOTAL))
+nomarchy-theme-set "${THEMES[$NEXT_INDEX]}"