feat(update): sys-update/sys-rebuild end with an nvd what-changed diff (item 9a)

The informative half of 'informative + rock-stable': both rebuild
wrappers capture /run/current-system before the switch and print a
package-level nvd diff after it — store-path-pinned so no PATH
dependence, || true so an ornamental diff can never fail a succeeded
rebuild, and an identical-path fast-path says 'no changes'. README §3
notes it. V1: template-system toplevel rebuilt, generated scripts
bash -n clean, nvd smoke-run against the real closure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -28,15 +28,15 @@ next, in what order*.
 
 ### 9. Update & rollback UX
 New; extends the update-awareness story to the other half: what changed,
-and how do I get back. (a) `sys-update` prints a human diff of what the
-update changed (`nvd diff` between system generations, or `nix store
-diff-closures`); (b) a **System → Rollback** menu flow: desktop = pick a
-recent `home-manager generations` entry and activate it (the theme
-history is already generations); system = point at the boot-menu
-generation flow + `nomarchy-snapshots` rather than reimplementing it —
-destructive steps keep the typed-`yes` gate. **Why:** informative +
-rock-stable means undo is one menu away, not a Nix lesson. **Verify:**
-V1; V2 for the generation-activate path in a VM.
+and how do I get back. Done: (a) `sys-update` AND `sys-rebuild` end with
+an `nvd diff` of old→new generation (store-path-pinned; never fails the
+run; "no changes" fast-path). Remaining: (b) a **System → Rollback**
+menu flow: desktop = pick a recent `home-manager generations` entry and
+activate it (the theme history is already generations); system = point
+at the boot-menu generation flow + `nomarchy-snapshots` rather than
+reimplementing it — destructive steps keep the typed-`yes` gate.
+**Why:** informative + rock-stable means undo is one menu away, not a
+Nix lesson. **Verify:** V1; V2 for the generation-activate path in a VM.
 
 ### 10. `nomarchy-doctor` — one-shot health check
 New. A single command (+ System-menu entry) that checks the things that

agent/JOURNAL.md

@@ -17,6 +17,22 @@ Template:
 
 ---
 
+## 2026-07-04 — sys-update/-rebuild what-changed diff (iteration #18, item 9a)
+- **Task:** BACKLOG NEXT#9 half (a) — a human diff after system rebuilds.
+- **Did:** both sys-update and sys-rebuild (twins stay twins) capture
+  /run/current-system before, and after the switch print
+  `nvd diff before after` (store-path-pinned ${"$"}{pkgs.nvd}, `|| true`
+  so it can't fail a succeeded rebuild; identical-path fast-path says
+  "no changes"). README §3 shortcut block notes it.
+- **Verified:** V0; V1 — template-system toplevel rebuilt, generated
+  scripts extracted + bash -n, nvd smoke-run against the real closure
+  (correct output format). Runtime behaviour is a trivial shell path —
+  no VM needed.
+- **Pending:** half (b) — the System → Rollback menu flow (desktop
+  generations picker; system → boot menu + snapshots pointer).
+- **Next suggestion:** item 9b — it completes the item; V2 the
+  generation-activate path.
+
 ## 2026-07-04 — viewers + mime defaults (iteration #17, item 8)
 - **Task:** BACKLOG NEXT#8 — PDF/image viewers + xdg-mime defaults.
 - **Did:** modules/home/viewers.nix (`nomarchy.viewers.enable`, default