feat(menu): System › Rollback — desktop generations picker (item 9b, item 9 done)

Undo is one menu away: the new rollback flow lists the last ten Home
Manager generations (the theme/config history is already generations,
newest marked current) and activates the picked one in a terminal —
HM's supported rollback, reversible by re-picking a newer one, so no
typed-yes gate. System-level undo deliberately links out rather than
reimplementing destructive flows in rofi: the Snapshots row opens the
existing gated flow, and 'boot an older generation (how)' fires an
instruction notification pointing at docs/RECOVERY.md §3 (which now
cross-references the menu path).

V1: template-home built, generated menu bash -n clean, row rendering
and pick-parsing verified against fixture generations output. V3
exercise queued.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -26,18 +26,6 @@ next, in what order*.
 
 ## NEXT
 
-### 9. Update & rollback UX
-New; extends the update-awareness story to the other half: what changed,
-and how do I get back. Done: (a) `sys-update` AND `sys-rebuild` end with
-an `nvd diff` of old→new generation (store-path-pinned; never fails the
-run; "no changes" fast-path). Remaining: (b) a **System → Rollback**
-menu flow: desktop = pick a recent `home-manager generations` entry and
-activate it (the theme history is already generations); system = point
-at the boot-menu generation flow + `nomarchy-snapshots` rather than
-reimplementing it — destructive steps keep the typed-`yes` gate.
-**Why:** informative + rock-stable means undo is one menu away, not a
-Nix lesson. **Verify:** V1; V2 for the generation-activate path in a VM.
-
 ### 10. `nomarchy-doctor` — one-shot health check
 New. A single command (+ System-menu entry) that checks the things that
 actually break user machines and prints a themed pass/fail sheet:

agent/HARDWARE-QUEUE.md

@@ -86,6 +86,13 @@ QA machine), the **T14s** (webcam case).
       `sudo nomarchy-snapshots`, restore a single file (`undochange`)
       and walk a root-config rollback up to (or through) the
       typed-`yes` gate.
+- [ ] **Rollback menu (item 9b)** — after a couple of theme changes,
+      menu › System › Rollback: recent desktop generations listed
+      (newest marked current); picking an older one opens a terminal,
+      activates it, and the theme visibly reverts; picking the newer one
+      again rolls forward. The two System rows: Snapshots opens the
+      snapshot flow, "boot an older generation (how)" fires an
+      instruction notification.
 - [ ] **Open-a-file smoke (viewers + mime defaults, item 8)** — after
       `home-update`: from yazi/Thunar, open a PDF (→ zathura, themed to
       the palette), an image (→ imv, NOT GIMP), a video (→ mpv);

agent/JOURNAL.md

@@ -17,6 +17,24 @@ Template:
 
 ---
 
+## 2026-07-04 — System › Rollback menu (iteration #19, item 9b → item 9 done)
+- **Task:** BACKLOG NEXT#9 half (b) — undo one menu away.
+- **Did:** new `rollback` case in nomarchy-menu (System submenu row):
+  lists the last 10 `home-manager generations` (newest marked current),
+  picking one activates it in a terminal — HM's supported rollback,
+  reversible, so no typed-yes. System-level undo LINKS OUT by design:
+  Snapshots row → existing flow; "boot an older generation (how)" →
+  instruction notification pointing at docs/RECOVERY.md §3 (no
+  destructive reimplementation in rofi). RECOVERY §1 cross-references
+  the menu path. Item 9 complete → deleted.
+- **Verified:** V0; V1 — template-home built, generated nomarchy-menu
+  bash -n clean, row-render + pick-parse logic run against a fixture
+  `generations` output (id/path extraction correct). V2 skipped
+  deliberately: the only novel logic is the parsing (fixture-covered);
+  the activate step is HM's own mechanism. V3 queued.
+- **Pending:** V3 rollback-menu exercise on hardware.
+- **Next suggestion:** NEXT#10 `nomarchy-doctor` (V2-able in a VM).
+
 ## 2026-07-04 — sys-update/-rebuild what-changed diff (iteration #18, item 9a)
 - **Task:** BACKLOG NEXT#9 half (a) — a human diff after system rebuilds.
 - **Did:** both sys-update and sys-rebuild (twins stay twins) capture