docs(agent): clean stale PROPOSED backlog residue

Drop shipped #52 high-ROI theme bullets, neon-glass quarantine, empty
installer audit sections, resolved template seed drift, and #50 soft
gaps. PROPOSED is open work only (day-2, installer follow-ups, theme
polish residuals, tooling).

agent/BACKLOG.md

@@ -69,425 +69,99 @@ polkit/pinentry/blueman actually float.
 *Agents: append here with a one-paragraph pitch (what/why/cost). Do not
 implement. Bernardo moves accepted items into a tier.*
 
-### v1.0 track — see `docs/VISION.md`
+*Open work only. Shipped exam/A–C items (#47–#63, #14, #52 theme
+high-ROI, etc.) live in the journal + ROADMAP — not here.*
 
-Product themes and the release bar live in **VISION**. Shipped 2026-07-09:
-#42 boreal default · #43 Firmware menu · #44 doctor hardware · neon-glass
-quarantine (#53). **A/B/C batch shipped 2026-07-10:** #55 fingerprint ·
-#56 human rebuild errors · #57 live Install · #58 detect-hw · #59 NVIDIA
-comments · #60 BAT*-agnostic · #61 review Source · #62 wholeswap CI ·
-#63 generated bar logo/powermenu. Still PROPOSED: first-boot tips residual
-(partial via #43 MOTD), charge-limit instant apply, theme taste polish.
-
-### Pre-existing
+### Product / day-2
 
 - **Battery charge-limit — make the toggle instant** `[blocked:hw]`
-  (follow-up to the preset toggle shipped 2026-07-07, iteration #55).
-  The control-center now has a proper toggle (Off / 80% / 90% / 60% /
-  Custom…) writing `settings.power.batteryChargeLimit` — but that's a
-  baked NixOS option, so it only lands on the next `sys-rebuild`. To make
-  it instant (no rebuild): add a udev rule making
-  system-battery `charge_control_end_threshold` nodes
-  group-writable (`MODE`/`GROUP`) so the menu can `echo N >` it live
-  alongside persisting state (the sysfs oneshot in power.nix still owns
-  boot + AC-replug re-apply), and/or surface a rofi-menu quick row or a
-  Waybar action. `[blocked:hw]`: the sysfs write + no-rebuild effect can
-  only be confirmed on a laptop exposing the threshold. Decide first
-  whether the small privilege grant (a local user can set the charge cap)
-  is acceptable.
+  Menu/CC write `settings.power.batteryChargeLimit` but need a rebuild.
+  Instant path: udev group-writable `charge_control_end_threshold` on
+  system batteries + live `echo` alongside state persist. Decide first
+  whether a local user may set the charge cap. Cost: medium; hw confirm.
 
-- **Portal/Flatpak camera picker still lists the internal IR sensor**
-  (ROADMAP § Webcam follow-up). The shipped IR-hide is a *WirePlumber
-  v4l2* rule, but Flatpak/portal apps consume cameras via the
-  **libcamera** path, where both sensors remain visible — a Flatpak
-  Zoom user can still pick the black IR "camera". Options, roughly
-  ascending cost: (a) do nothing — document it (portal camera support
-  is still rare in practice); (b) a WirePlumber *libcamera* monitor
-  rule disabling GREY-only nodes — needs verifying that libcamera
-  monitor rules can match early enough (the v4l2 investigation found
-  only `device.api` binds pre-rule, which is why surgical scoping
-  failed before — same wall likely applies); (c) a libcamera
-  configuration/udev quirk hiding the IR sensor at the libcamera layer
-  itself. Cost: (b)/(c) need a T14s-style RGB+IR machine to verify →
-  pairs with a hardware-queue session. Recommend (a) now, (b)
-  investigated when the T14s is next available.
+- **Portal/Flatpak IR camera still listed** (libcamera path). WirePlumber
+  v4l2 hide is shipped; Flatpak Zoom can still pick the IR node.
+  Options: (a) document; (b) libcamera monitor rule; (c) udev/libcamera
+  quirk. Rec: (a) until T14s session. Cost: (b)/(c) `[blocked:hw]`.
 
-### Bugs / broken behavior (codebase exam 2026-07-09)
+- **Post-install hardware hints residual** — #43 shipped Firmware MOTD;
+  still open: fingerprint + doctor one-liners (once/dismissible). Cost:
+  small; V2/V3.
 
-_(Waybar doctor indicator, Control Center appearance no-ops, summer-day
-scroll → #51; neon-glass broken waybar → **fixed** 2026-07-09 by quarantine
-(removed `waybar.css` → generated bar; render-confirmed).)_
-_(Battery charge-limit / powerprofile BAT*-only → **#60** ✓ 2026-07-10;
-  V3 pending on non-BAT* hardware.)_
+- **Look & Feel submenu** (ROADMAP optional) — night-light, wallpaper
+  cycle, blur/gaps with Theme; root stays six entries. Product call.
 
-### Docs / option-surface drift (codebase exam 2026-07-09)
+- **NVIDIA first-class options** `[big]` `[blocked:hw]` — thin
+  `nomarchy.hardware.nvidia.*` only with hybrid maintainer + queue.
+  Prefer shipped #59 commented guidance until then.
 
-_(i2c option-docs → #48; README/docs drift pack, keybind nmtui label,
-nomarchy-menu usage string, secondary docs, always-on pieces → #47.)_
+### Installer / template
 
-- **Template / seed state drift (residual after SoT work)**
-  (1) `templates/downstream/theme-state.json` lacks `border` and
-  `settings` keys present in repo root state (eval merges defaults);
-  (2) no commented `nomarchy.system.snapper.enable` or
-  `hardware.i2c.*` in template `system.nix` despite opt-in convention.
-  Main home/system sync is **Installer consumes template as SoT**
-  below — do that first, then close these residual gaps on the
-  template itself. Cost: small template polish.
+- **Installer ↔ template SoT follow-ups** — core copy+patch shipped.
+  Remaining: (1) optional CI that install share matches template;
+  (2) V2 `test-install.sh` after ISO rebuild (larger HM pre-activate
+  closure). Cost: CI + KVM time.
 
-- **Installer ↔ template SoT — follow-ups** (shipped 2026-07-09: copy +
-  `patch-template.py`). Remaining: (1) optional CI that the install
-  share ships the same template files; (2) V2 `test-install.sh` after
-  ISO rebuild (HM pre-activate now pulls starter packages — larger
-  closure); (3) residual theme-state / i2c comment polish on template
-  (see residual seed drift item).
+- **Installer soft gap: chown flake dir** — `chown -R 1000:100` assumes
+  first-user UID/GID. Cost: small. _(usbutils PATH + flake package
+  exports → #50 ✓.)_
 
-### Theme polish / completeness (codebase exam 2026-07-09)
+- **MIGRATION.md snapshot layout** — still says top-level
+  `@home-snapshots`; installer uses `@snapshots` + nested
+  `/home/.snapshots`. One clarifying paragraph. Cost: docs only.
 
-- **theme preview recapture nicety** (all 24 themes now have `preview.png`
-  as of 2026-07-09 — executive-slate + neon-glass captured via theme-shot).
-  These headless captures are a clean bare desktop+bar, not the
-  theme-shot capture — a clean bare desktop+bar, not the floating-terminal
-  (fastfetch+btop) composition the other 21 use; a real-hardware recapture to
-  match the grid would be nicer (VM is the documented fallback). Optional hand
-  `btop.theme` for the three identity themes still open. Cost: asset capture;
-  V3 visual.
+- **Unattended-install test matrix** — document/script no-swap and
+  no-LUKS paths in `test-install.sh` (env flags only). Cost: script +
+  KVM. Do not grow the interactive installer.
 
-_(Generated Waybar missing identity-bar affordances → **#63** ✓ 2026-07-10.)_
+- **Fail-closed / friendlier theme-state errors in `mkFlake`** — missing
+  or invalid `theme-state.json` should point at schema/docs early.
+  Related: `settings.displayProfile*` defaults, unknown border role.
+  Cost: medium lib UX.
 
-- **summer-* CSS under-styles status module states**
-  summer-day/night include modules in selectors but largely lack
-  `.on` / `.available` / `.recording` polish that boreal,
-  executive-slate, and the generated style have. Functional OK;
-  visual hierarchy weak. Cost: CSS pass; V3.
+### Theme polish
 
-_(Optional CI: whole-swap CSS self-containment → **#62** ✓ 2026-07-10.)_
+- **#52 residual ANSI** — after high-ROI fixes: **vantablack** `ansi[8]`
+  still `#fdfdfd` (diverges from `muted #666666`); **osaka-jade**
+  `ansi[3]` still warn-green `#459451` while `warn` is `#E5C736`.
+  Decide identity vs bug per theme. Cost: tiny JSON; V0 contrast.
 
-### Per-theme design audit (2026-07-09)
+- **summer-day / summer-night pair polish** — waybar CSS vs JSON dual
+  SoT; night `subtext`=`muted`=`overlay`; day/night font + battery
+  threshold + VPN pill drift. Pick JSON as SoT (or document EF split).
+  Cost: CSS/JSON; V3.
 
-*Method: `checks.theme-contrast` (all 24×7 pairings pass) +
-`tools/audit-theme-design.py` + per-theme agent review of JSON roles,
-ANSI, assets, whole-swaps, and fidelity to canonical sources. Gated
-WCAG floors are green; items below are fidelity, hierarchy, btop
-drift, identity semantics, and polish. Identity themes (white,
-vantablack, lumon, hackerman, matte-black, miasma, neon-glass) are
-flagged separately from fidelity bugs.*
+- **summer-\* CSS status module states** — missing `.on` / `.available`
+  / `.recording` polish vs boreal/generated. Cost: CSS; V3.
 
-#### Broken / high-ROI fixes
+- **theme preview recapture nicety** — executive-slate + neon-glass
+  previews are bare desktop+bar, not the floating-terminal composition
+  of the other 21; optional identity `btop.theme`s. Cost: asset/V3.
 
-_→ promoted as NEXT **#52** (2026-07-09); the six bullets below are its
-spec (exact hexes). The rest of the per-theme audit stays PROPOSED._
+- **Fidelity / hierarchy nits (popular ports)** — gruvbox Material vs
+  classic name+btop split; nord inverted subtext/text; tokyo-night btop
+  warm fg; ethereal surface=base; retro-82 surface darker than base;
+  ristretto subtext=text + btop bg drift; flexoki-light bright-black.
+  Cost: small JSON/btop each; V0–V1.
 
-_Residual ANSI drift exposed by the #52 fixes (not yet touched — small
-follow-up): **vantablack** `ansi[8]` (bright-black) still `#fdfdfd`, now
-diverging from the new `muted #666666`; **osaka-jade** `ansi[3]`
-(normal-yellow) still the old warn-green `#459451` while `warn`/`ansi[11]`
-are now `#E5C736`. Decide per theme whether these are identity or bugs._
+- **Identity optional taste retunes** — white / lumon / hackerman /
+  matte-black / miasma hierarchy or status L-steps only (no traffic-light
+  forced on identity themes). Product call per theme.
 
-- **rose-pine btop is Main-on-Dawn (near-invisible hi_fg)**
-  JSON is **Rosé Pine Dawn** (`mode: light`, base `#faf4ed`, text
-  `#575279`) but `themes/rose-pine/btop.theme` mixes Dawn
-  `main_bg`/`main_fg` with **Main** accents: `hi_fg=#e0def4` on
-  `#faf4ed` ≈ invisible, `selected_bg=#524f67`, love `#eb6f92`,
-  foam/iris Main hexes. **Fix:** rewrite btop entirely to Dawn roles
-  (foam `#56949f`, iris `#907aa9`, love `#b4637a`, gold
-  `#ea9d34`/`#d68a16`, pine `#286983`). Also rename display name to
-  "Rosé Pine Dawn" (or ship a dark Main preset as a separate slug).
-  Cost: one btop rewrite + optional rename; V1 + visual V2.
+- **Import pipeline hierarchy when ANSI 0==8** — `import-palettes.py`
+  collapses surface/overlay; light themes get sludge mantle. Allow role
+  overrides independent of ANSI. Cost: tool + convention.
 
-- **everforest + summer-night btop: inactive_fg == main_bg**
-  `themes/everforest/btop.theme` and `themes/summer-night/btop.theme`
-  set `inactive_fg` to `#2d353b` (= `main_bg`) → inactive/disabled
-  labels invisible. **Fix:** `inactive_fg` → grey1/muted range
-  (`#859289` / `#7a8478` / JSON muted). Cost: two lines; V1.
+- **audit-theme-design identity exemptions** — document expected CVD/
+  hue noise for white/vantablack/lumon/hackerman/matte-black/miasma.
+  Cost: docs or small script.
 
-- **vantablack role inversion breaks selection / muted**
-  `overlay` and `muted` are near-white `#fdfdfd` while base is
-  `#0d0d0d`. Generated consumers use `overlay` as selected_bg;
-  hand btop has `selected_bg=#fdfdfd` + `selected_fg=#ffffff`
-  (white-on-white) and `inactive_fg=#fdfdfd` (inactive rows scream).
-  Status greys are intentional monochrome identity. **Fix (keep void
-  identity):** `surface #1a1a1a`, `overlay #2a2a2a`, `muted #666666`;
-  btop `selected_bg #333` / `selected_fg #fff` / `inactive_fg` ≈
-  muted. Cost: JSON + btop; re-run contrast; V1–V2.
+### v1.0 pointer
 
-- **osaka-jade: warn≈good and text/subtext inverted**
-  `warn #459451` is green (same family as `good #549e6a`) → battery
-  warning reads as "ok". `subtext #F6F5DD` is brighter than `text
-  #C1C497` (secondary louder than primary). **Fix:** swap text↔subtext;
-  set `warn #E5C736` (from bright yellow ANSI, already in palette).
-  Keep jade accent + blossom accentAlt. Cost: small JSON retune;
-  contrast re-check; V1.
-
-- **catppuccin-latte: ANSI black/white axis inverted + mantle sludge**
-  Latte UI roles mostly match (base/text/accent/good/bad exact), but
-  `ansi[0]=#bcc0cc` (light) and `ansi[7]/[15]` are darkish → terminal
-  "black"/"white" slots misbehave; design-audit flags inverted slots.
-  `mantle #cbcdd0` is import-darken of light base (should be Latte
-  mantle `#e6e9ef`); `accentAlt #d260b5` is not Latte pink/mauve.
-  **Fix:**
-  ```
-  mantle #e6e9ef; accentAlt #ea76cb (pink);
-  ansi[0] #5c5f77; ansi[7] #acb0be; ansi[8] #6c6f85; ansi[15] #bcc0cc
-  ```
-  warn keep `#d6860a` if contrast requires, else `#df8e1d`. Cost:
-  JSON only; btop already Latte-correct. V0 contrast + V1.
-
-- **catppuccin (Mocha) btop is Frappé-on-Mocha**
-  JSON is exact Mocha; `btop.theme` uses Mocha `main_bg` but Frappé
-  fgs/boxes (`main_fg #c6d0f5`, `hi_fg #8caaee`, mauve/green/maroon
-  Frappé hexes). **Fix:** replace with official Mocha btop hexes
-  (`#cdd6f4`, `#89b4fa`, …). Optional: rename to "Catppuccin Mocha".
-  Cost: btop rewrite; V1.
-
-#### Whole-swap / identity themes
-
-- **neon-glass** — already queued above (broken waybar.css). JSON
-  palette itself is fine (high-chroma cyber). Finish or quarantine.
-
-- **summer-day / summer-night pair polish**
-  Structurally paired (inverted Everforest bar language) but:
-  (1) waybar CSS hexes drift from JSON (day warn/accentAlt; night
-  red/blue/yellow/purple vs JSON); bar follows legacy EF source,
-  Stylix/swaync follow JSON — dual sources of truth;
-  (2) night JSON collapses `subtext`=`muted`=`overlay` `#868d80`
-  (no secondary ladder for generated surfaces);
-  (3) day font 16px vs night 13px; day battery thresholds 30/15 vs
-  night 25/10; day missing `#custom-vpn` in pill selectors;
-  (4) day scroll `e±1` already queued. **Fix:** pick JSON as source
-  of truth and map waybar tokens to it (or document intentional EF
-  split); split night muted darker / subtext lighter; align font +
-  battery thresholds + VPN pill. Cost: CSS/JSON polish pass; V3.
-
-- **boreal / executive-slate** — whole-swaps self-define colors and
-  match JSON; best-in-class. Only gaps: `preview.png` + optional
-  `btop.theme` (already queued).
-
-- **white (monochrome light)** — identity-ok. Status good/warn/bad
-  are greys by design (audit hue/CVD noise expected). Optional:
-  widen L steps (`good #555`, `warn #777`, `bad #222`), raise
-  `surface #f0f0f0`, split `subtext #404040` while staying hueless.
-  Do not inject traffic-light hues. Cost: optional taste retune.
-
-- **lumon (Severance blue mono-status)** — identity-ok. good/warn/bad
-  all blue family by design; CVD collapse expected — rely on
-  glyph/shape (item 28). Optional: dim `subtext` one step
-  (`#9bb0c0`); increase L separation only among blues. Cost:
-  optional; document as identity exemption in audit tooling.
-
-- **hackerman** — matrix identity: warn cyan, bad green, ANSI reds
-  are greens. CVD collapse expected. **Keep identity** or optional
-  cyber-semantic UI only: `warn #e8d44f`, `bad #ff5a7a` while leaving
-  ANSI matrix. Raise `surface #1a1c2e` (flat base=surface). Cost:
-  product call + small JSON.
-
-- **matte-black** — identity: `good=#FFC107` amber, `warn=#b91c1c`
-  red (inverted traffic-light). Matches Omarchy matte-black. Minimal
-  fix: `subtext #9a9a9d` (text==subtext today). Full semantic remap
-  only if product wants conventional battery colors on this theme.
-  Cost: one-line hierarchy or deliberate status retune.
-
-- **miasma** — earthy `bad #685742` (brown, contrast ~2.3 audit-only)
-  is JOURNAL-exempt identity. Optional more readable brown-red
-  `#8b5a4a` / `#a65d4e` without leaving the forest. Cost: optional.
-
-#### Fidelity / hierarchy polish (popular ports)
-
-- **gruvbox is Material medium, not classic — name + btop split**
-  JSON hexes are Gruvbox **Material** (`text #d4be98`, material
-  green/yellow/red) while name says "Gruvbox" and `btop.theme` is
-  **classic** (`#ebdbb2`, `#d79921`, …). `surface`=`overlay`,
-  `text`=`subtext`. **Fix:** rename to "Gruvbox Material" **or**
-  retune JSON to classic; sync btop to the chosen lineage;
-  `overlay #504945`, `subtext #a89984`. Cost: naming + assets.
-
-- **nord** — clean Polar Night. Only nit: `subtext #e5e9f0` is
-  **brighter** than `text #d8dee9` (hierarchy inverted). **Fix:**
-  subtext → nord4-dim or bump text to nord6 `#eceff4`. Cost: one hex.
-
-- **tokyo-night** — Night (not Storm), JSON solid. btop
-  `main_fg`/`title` use warm `#cfc9c2` instead of Night
-  `#c0caf5`/`#a9b1d6`. Optional: `text #c0caf5`, `accentAlt
-  #bb9af7` (modern purple). Cost: btop + optional JSON.
-
-- **kanagawa** — Wave, clean. No action required; optional rename
-  "Kanagawa Wave"; optional brighter good `springGreen #98bb6c`.
-
-- **ethereal** — vibe solid; `surface`=`base`, `muted`=`overlay`.
-  **Fix:** `surface #1a2340` (or Omarchy color0 `#3C486D`); split
-  muted darker than overlay; optional richer good. Cost: small JSON.
-
-- **retro-82** — strong synthwave + excellent rofi whole-swap.
-  `surface #00172e` darker than `base #05182e` (inverted raise);
-  `good #028391` teal (reads info not ok). **Fix:** `surface
-  #0a2844`; optional `good #3f8f8a` or phosphor green. Cost: small
-  JSON; keep rofi.
-
-- **ristretto** — Monokai Pro Ristretto, ship-quality. Only
-  `subtext`=`text`; btop `main_bg` 1-step drift (`#2c2421` vs
-  `#2c2525`). **Fix:** `subtext #b5a9aa`; align btop bg. Cost: tiny.
-
-- **flexoki-light** — best of the Flexoki/import set post item-28.
-  Optional: distinct ANSI bright-black `#575653`; recapture preview
-  if terminal chrome still looks dark-on-paper. Cost: polish only.
-
-#### Systemic theme tooling
-
-- **Import pipeline collapses hierarchy when ANSI 0==8**
-  `tools/import-palettes.py` maps `surface←color0`, `overlay←color8`,
-  `good/warn/bad←color2/3/1`, `mantle←darken(base)`. When color0==8
-  (gruvbox, everforest) surface=overlay; light themes get sludge
-  mantle. Long-term: allow explicit role overrides independent of
-  ANSI for identity themes; don't re-import without a hierarchy pass.
-  Cost: tool + convention doc.
-
-- **audit-theme-design identity exemptions**
-  Document expected noise for white/vantablack/lumon/hackerman/
-  matte-black/miasma (hue-family + CVD) so future audits don't
-  "fix" identity into traffic lights. Optional: special-case in
-  the report script. Cost: docs or small script tweak.
-
-### Tooling / CI / installer hardening (codebase exam 2026-07-09)
-
-_(py_compile expand, installer pure contracts, hardware-db ∈ nixos-hardware,
-windowrule dead-syntax guard → #49.)_
-
-- **Installer soft gaps**
-  (1) fingerprint path prefers `lsusb` but package PATH has
-  `pciutils` not `usbutils` (sysfs fallback usually OK); (2)
-  `chown -R 1000:100` on the flake dir assumes first-user UID/GID;
-  (3) flake `packages` exports only theme-sync + install, not
-  doctor / control-center / battery-notify (runtime via overlay is
-  fine — discoverability only). Cost: small each.
-
-_(Control Center `/tmp/nomarchy-gens` → mktemp → #50.)_
-
-### Distro improvement ideas (codebase exam 2026-07-09)
-
-- **Fail-closed / friendlier theme-state errors in `mkFlake`**
-  Missing `theme-state.json` fails later at `readFile`; invalid JSON
-  fails at `fromJSON` before theme.nix's field-level validator. A
-  friendly "add theme-state.json" / schema pointer would help
-  downstream authors. Related: `settings.displayProfile*` not in
-  defaults block (consumers use `or`); unknown border role falls
-  through to raw string. Cost: medium lib/theme.nix UX.
-
-- **Look & Feel submenu (ROADMAP optional)**
-  Night-light, wallpaper cycle, blur/gaps (once CC appearance is
-  fixed) grouped with Theme once the root stays six entries. Cost:
-  menu structure only; product call.
-
-_(Export overlay tools as flake packages → #50.)_
-
-- **Unattended-install test matrix**
-  `test-install.sh` always LUKS+swap; add (or document) no-swap and
-  no-LUKS paths once those contracts are fixed, so swap/LUKS-class
-  bugs cannot recur. Cost: script flags + time on KVM host.
-
-_(Document always-on home pieces (easyeffects/udiskie/cliphist) → #47.)_
-
-### Hardware product (investigation 2026-07-09)
-
-*Full write-up: [`docs/HARDWARE.md`](../docs/HARDWARE.md). Install-time
-autodetect is strong; day-2 lifecycle (firmware, biometrics, re-detect,
-NVIDIA depth) is still mostly CLI. Items below are product work on top
-of that doc — design notes live there (§4–§10).*
-
-_(`nomarchy-detect-hw` CLI → **#58** ✓ 2026-07-10; Fingerprint menu → **#55** ✓
-2026-07-10 (V3 enroll on reader); Installer NVIDIA commented guidance →
-**#59** ✓ 2026-07-10.)_
-
-_(hardware-db ∈ nixos-hardware → #49; usbutils on install PATH → #50;
-i2c README table → #48.)_
-
-- **Post-install hardware hints (MOTD / first session)**
-  When relevant services exist, surface one line each: firmware
-  (`fwupdmgr get-updates`), fingerprint (`fprintd-enroll`), optional
-  “run nomarchy-doctor”. Avoid nagging — once or until dismissed.
-  Spec: HARDWARE.md §4/§5. Cost: small greeter/MOTD or notify; V2/V3.
-  _(Partial: #43 shipped Firmware MOTD/tip 2026-07-09; fingerprint +
-  doctor lines still open.)_
-
-- **NVIDIA first-class options (larger, optional)**
-  Only if a maintainer commits to hybrid testing: thin
-  `nomarchy.hardware.nvidia.*` wrapping common PRIME/power patterns.
-  Prefer NEXT **#59** (commented guidance) first; promote only with
-  hardware-queue coverage. Cost: high; `[big]` + `[blocked:hw]`.
-
-### Installer process (audit 2026-07-09)
-
-*Full-path review of live ISO → `nomarchy-install` → disko → config
-generation → offline/online `nixos-install` → HM pre-activate → first
-boot. Philosophy applied: **opinionated, stability-first** — prefer safer
-defaults and fewer install questions over option sprawl. Day-2 firmware /
-fingerprint / re-detect stay in Hardware product above, not in the
-installer questionnaire.*
-
-#### Already strong (do not “fix” with more choices)
-
-- Single whole-disk GPT, UEFI + systemd-boot only; multi-disk RAID /
-  dual-boot / BIOS deferred (ROADMAP LATER).
-- LUKS2 **default** + greeter auto-login (one gate); type-to-confirm wipe;
-  live medium excluded from disk list; careful pre-wipe.
-- BTRFS subvols + snapper on by default; hibernation swap default = RAM;
-  hardware autodetection with **safe defaults on, heavy bits commented**.
-- Offline-capable install (compose-lock, ISO store pin, daemon
-  substituter); HM pre-activate so first boot is themed.
-- No Secure Boot theater; no install-time app-suite *wizard* / custom
-  partitioner / pbkdf knobs. (Starter apps come from the **template**
-  `home.packages` once the installer consumes the template as SoT —
-  see above; not a separate install questionnaire.)
-- Live: no idle suspend (avoids mid-install sleep); WiFi via normal
-  desktop NM path.
-
-#### Bugs (stability contracts — fix, don’t optionalize)
-
-- **Installer swap=0 + unattended LUKS fail-closed** — ✓ shipped
-  (workflow test run 2026-07-09): pass bare `"0"`; disko accepts
-  `"0"`/`"0G"`; unattended needs passphrase or `NOMARCHY_NO_LUKS=1`.
-
-_(Offline fail-closed → #54.)_
-
-#### Safety / clarity (one line each — no new install menus)
-
-_(Review-panel destructive-data warning → #54.)_
-
-_(Review panel: offline vs online source line → **#61** ✓ 2026-07-10.)_
-
-_(User password minimum length = 8 → #54.)_
-
-#### Live ISO discoverability (one durable cue)
-
-_(Live: one always-visible “Install Nomarchy” action → **#57** ✓ 2026-07-10;
-  V2: `checks.live-install-entry` on live HM gen.)_
-
-#### Generated config / post-install polish
-
-_(HM pre-activate failure → durable recovery hint → #54.)_
-
-- **MIGRATION.md: installer snapshot layout vs `@home-snapshots`**
-  Installer creates disko `@snapshots` → `/.snapshots` and a first-boot
-  oneshot for nested `/home/.snapshots`. MIGRATION still speaks of
-  top-level `@home-snapshots` (TuringMachine vocabulary). One paragraph
-  clarifying installer layout vs migration machines prevents wrong
-  expectations. Cost: docs only.
-
-#### Test / pure contracts (after P0 bugs)
-
-- **Installer pure checks + expanded unattended matrix** — overlaps
-  existing *Tooling* items (disko `swapSize` contract, compose-lock
-  py_compile, hardware-db ∈ nixos-hardware). After swap/LUKS fixes:
-  document or script unattended no-swap and explicit no-LUKS paths in
-  `test-install.sh` (env flags only — no interactive options). Do **not**
-  grow the interactive installer questionnaire.
-
-#### Explicit non-goals for the installer (defer)
-
-Do **not** add install-time: dual-boot / preserve partitions, multi-disk
-RAID, Secure Boot/lanzaboote, recovery-key *wizard* (optional silent
-recovery print is the only recovery-key idea worth considering later),
-custom partitioner, online/offline user toggle, app suite selection,
-pbkdf/TRIM knobs, or a second installer frontend. Stability and the
-single golden path win.
+See **VISION** for release bar. Day-2 surfaces largely shipped (#43–#45,
+#55–#58). Remaining product-ish PROPOSED: charge-limit instant, IR
+portal doc, first-boot hint residual, theme polish above.
 
 
 ## Decisions `[human]`