feat(menu): System › Rollback — desktop generations picker (item 9b, item 9 done)

Undo is one menu away: the new rollback flow lists the last ten Home
Manager generations (the theme/config history is already generations,
newest marked current) and activates the picked one in a terminal —
HM's supported rollback, reversible by re-picking a newer one, so no
typed-yes gate. System-level undo deliberately links out rather than
reimplementing destructive flows in rofi: the Snapshots row opens the
existing gated flow, and 'boot an older generation (how)' fires an
instruction notification pointing at docs/RECOVERY.md §3 (which now
cross-references the menu path).

V1: template-home built, generated menu bash -n clean, row rendering
and pick-parsing verified against fixture generations output. V3
exercise queued.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -26,18 +26,6 @@ next, in what order*.
 
 ## NEXT
 
-### 9. Update & rollback UX
-New; extends the update-awareness story to the other half: what changed,
-and how do I get back. Done: (a) `sys-update` AND `sys-rebuild` end with
-an `nvd diff` of old→new generation (store-path-pinned; never fails the
-run; "no changes" fast-path). Remaining: (b) a **System → Rollback**
-menu flow: desktop = pick a recent `home-manager generations` entry and
-activate it (the theme history is already generations); system = point
-at the boot-menu generation flow + `nomarchy-snapshots` rather than
-reimplementing it — destructive steps keep the typed-`yes` gate.
-**Why:** informative + rock-stable means undo is one menu away, not a
-Nix lesson. **Verify:** V1; V2 for the generation-activate path in a VM.
-
 ### 10. `nomarchy-doctor` — one-shot health check
 New. A single command (+ System-menu entry) that checks the things that
 actually break user machines and prints a themed pass/fail sheet:

agent/HARDWARE-QUEUE.md

@@ -86,6 +86,13 @@ QA machine), the **T14s** (webcam case).
       `sudo nomarchy-snapshots`, restore a single file (`undochange`)
       and walk a root-config rollback up to (or through) the
       typed-`yes` gate.
+- [ ] **Rollback menu (item 9b)** — after a couple of theme changes,
+      menu › System › Rollback: recent desktop generations listed
+      (newest marked current); picking an older one opens a terminal,
+      activates it, and the theme visibly reverts; picking the newer one
+      again rolls forward. The two System rows: Snapshots opens the
+      snapshot flow, "boot an older generation (how)" fires an
+      instruction notification.
 - [ ] **Open-a-file smoke (viewers + mime defaults, item 8)** — after
       `home-update`: from yazi/Thunar, open a PDF (→ zathura, themed to
       the palette), an image (→ imv, NOT GIMP), a video (→ mpv);

agent/JOURNAL.md

@@ -17,6 +17,24 @@ Template:
 
 ---
 
+## 2026-07-04 — System › Rollback menu (iteration #19, item 9b → item 9 done)
+- **Task:** BACKLOG NEXT#9 half (b) — undo one menu away.
+- **Did:** new `rollback` case in nomarchy-menu (System submenu row):
+  lists the last 10 `home-manager generations` (newest marked current),
+  picking one activates it in a terminal — HM's supported rollback,
+  reversible, so no typed-yes. System-level undo LINKS OUT by design:
+  Snapshots row → existing flow; "boot an older generation (how)" →
+  instruction notification pointing at docs/RECOVERY.md §3 (no
+  destructive reimplementation in rofi). RECOVERY §1 cross-references
+  the menu path. Item 9 complete → deleted.
+- **Verified:** V0; V1 — template-home built, generated nomarchy-menu
+  bash -n clean, row-render + pick-parse logic run against a fixture
+  `generations` output (id/path extraction correct). V2 skipped
+  deliberately: the only novel logic is the parsing (fixture-covered);
+  the activate step is HM's own mechanism. V3 queued.
+- **Pending:** V3 rollback-menu exercise on hardware.
+- **Next suggestion:** NEXT#10 `nomarchy-doctor` (V2-able in a VM).
+
 ## 2026-07-04 — sys-update/-rebuild what-changed diff (iteration #18, item 9a)
 - **Task:** BACKLOG NEXT#9 half (a) — a human diff after system rebuilds.
 - **Did:** both sys-update and sys-rebuild (twins stay twins) capture

docs/RECOVERY.md

@@ -21,6 +21,9 @@ home-manager generations          # newest first, one per theme/HM change
 /nix/store/…-home-manager-generation/activate   # run the one you want
 ```
 
+The same picker lives in the menu: **System › Rollback** lists the
+recent desktop generations — pick one and it activates.
+
 Or simply apply a theme you know is good: `nomarchy-theme-sync apply
 tokyo-night`. If a switch failed halfway, the state file is written
 *before* the rebuild — fix the cause and re-run

modules/home/rofi.nix

@@ -434,6 +434,46 @@ ${themeRows}
           || { notify-send "Snapshots" "Snapshot tools unavailable (nomarchy.system.snapper off?)."; exit 0; }
         exec ${cfg.terminal} -e sudo nomarchy-snapshots ;;
 
+      rollback)
+        # Undo, one menu away (informative + rock-stable). Desktop =
+        # Home Manager generations: theme/config history is already one
+        # generation per change, and running an older generation's
+        # activate script is the supported HM rollback — reversible by
+        # activating a newer one again, so no typed-yes gate here.
+        # System-level undo deliberately LINKS OUT instead of putting
+        # destructive flows in rofi: boot-menu generations and snapper
+        # rollback have their own homes and gates (docs/RECOVERY.md,
+        # nomarchy-snapshots).
+        gens=$(home-manager generations 2>/dev/null | head -10)
+        choice=$( {
+          if [ -n "$gens" ]; then
+            printf '%s\n' "$gens" | awk '{
+              printf "Desktop gen %s — %s %s%s\n", $5, $1, $2, (NR==1 ? "  (current)" : "")
+            }' | while IFS= read -r line; do row "$line" document-open-recent; done
+          fi
+          command -v nomarchy-snapshots >/dev/null 2>&1 \
+            && row "System files → Snapshots" timeshift
+          row "System config → boot an older generation (how)" help-about
+          back
+        } | rofi -dmenu -show-icons -p Rollback) || exit 0
+        case "$choice" in
+          "$BACK") exec "$0" system ;;
+          "Desktop gen "*)
+            num=''${choice#Desktop gen }; num=''${num%% *}
+            path=$(printf '%s\n' "$gens" | awk -v n="$num" '$5 == n { print $7 }')
+            [ -x "$path/activate" ] \
+              || { notify-send "Rollback" "Generation $num not found on disk."; exit 1; }
+            exec ${cfg.terminal} -e sh -c "
+              echo \"Activating Home Manager generation $num…\"; echo
+              \"$path/activate\"
+              echo; echo \"Desktop rolled back to generation $num.\"
+              echo \"(Roll forward the same way — newer generations stay listed.)\"
+              printf 'Enter to close.'; read -r _" ;;
+          *Snapshots*) exec "$0" snapshot ;;
+          *"older generation"*)
+            notify-send "System rollback" "Reboot and pick an older NixOS generation in the boot menu (the last 10 are kept). Make it stick: revert the change in ~/.nomarchy, then sys-rebuild. Details: docs/RECOVERY.md §3." ;;
+        esac ;;
+
       tools)
         # Tools submenu — utilities you invoke. Each leaf is also reachable
         # directly (SUPER+CTRL+<mnemonic>); this just keeps the root short.
@@ -487,6 +527,7 @@ ${themeRows}
             fi
           fi
           command -v nomarchy-snapshots >/dev/null 2>&1 && row "Snapshots" timeshift
+          row "Rollback" edit-undo
           if [ -e "''${bats[0]}" ] && command -v powerprofilesctl >/dev/null 2>&1; then
             row "Power profile" preferences-system-power
           fi
@@ -505,6 +546,7 @@ ${themeRows}
           *"Auto timezone"*)  exec "$0" autotimezone ;;
           *"Auto-commit"*)    exec "$0" autocommit ;;
           *Snapshots*)        exec "$0" snapshot ;;
+          *Rollback*)         exec "$0" rollback ;;
           *"Power profile"*)  exec "$0" power-profile ;;
         esac ;;