docs(agent): NEXT #45–46 for VM verification of recent V0 work

Queue headless-incomplete checks for a VM-capable agent: Boreal default
(live/HM apply, preview.png, flake check) and install contracts
(swap=0 + unattended LUKS fail-closed).

agent/BACKLOG.md

@@ -47,6 +47,34 @@ non-empty), laptop charge-threshold sysfs when a limit is set. Spec:
 docs/HARDWARE.md §10. Cost: doctor.sh sections; V1 in existing
 `checks.doctor` where fakes exist, rest V2/V3.
 
+### 45. V2/V3 verify: Boreal default theme (follow-up to #42 / `351b7ad`)
+Code for Boreal-as-default shipped at V0 only (seed JSON + eval
+fallbacks; contrast green). **Needs a VM-capable agent** (or hardware)
+to close the honesty gap. Checklist:
+1. `nix flake check --no-build` green on current `main` (ISO eval can be
+   slow — let it finish).
+2. V1 optional: build template HM or live toplevel if time allows.
+3. V2: boot live ISO (`tools/test-live-iso.sh`) or apply template HM —
+   confirm session/wallpaper/terminal read as **Boreal** (slug
+   `boreal`, violet accent, GeistMono), not Tokyo Night.
+4. Capture `themes/boreal/preview.png` for the theme picker (square
+   crop per MEMORY rofi icon note) and commit it.
+5. V3 optional: append HARDWARE-QUEUE if only a real panel/GPU shows
+   something headless can't. Delete this item when checklist is done;
+   journal the tier reached.
+
+### 46. V2 verify: install swap=0 + unattended LUKS fail-closed (`208b8d4`)
+Pure `nix-instantiate` on disko subvols passed V0; **full install path
+not exercised**. VM agent with KVM:
+1. Unattended install with `NOMARCHY_SWAP_GB=0` + LUKS passphrase —
+   assert no `/swap` (or empty policy) and no `@swap` surprise; system
+   boots.
+2. Unattended **without** passphrase and **without** `NOMARCHY_NO_LUKS=1`
+   — must **fail** before wipe (fail-closed).
+3. Optional: `NOMARCHY_NO_LUKS=1` + swap=2 still installs. Use
+   `tools/test-install.sh` variants / env flags; journal results; delete
+   item when green (or file NOW bugs on failure).
+
 ### 14. Automated lock bumps — confirm the first real run
 Slices b+c shipped 2026-07-05 (`.gitea/workflows/bump.yml`): weekly
 schedule (Mon 05:17 UTC) + `workflow_dispatch` as the security

agent/JOURNAL.md

@@ -21,8 +21,8 @@ Template:
 - **Task:** NEXT #42 — distro default theme Tokyo Night → Boreal (`VISION § B` / v1.0 bar).
 - **Did:** Seeded `theme-state.json` + `templates/downstream/theme-state.json` from `themes/boreal.json` (incl. border + settings). Eval fallbacks: `theme.nix` preset → boreal.json; plymouth + live ISO splash hex fallbacks; theme-shot / theme-sync examples; TESTING/RECOVERY wording.
 - **Verified:** V0 — state JSON matches boreal palette/fonts; `check-theme-contrast` 24×7 pass; py_compile theme-sync. Full `nix flake check --no-build` started but not waited (slow ISO eval). No V2 apply / V3 session.
-- **Pending:** `themes/boreal/preview.png` still missing (picker name-only) — left in PROPOSED theme polish; V2/V3 visual on hardware. Queue head now #43 Firmware.
-- **Next suggestion:** #43 System › Firmware or #44 doctor hardware.
+- **Pending:** Filed **NEXT #45** (V2/V3 Boreal verify + `preview.png`) and **#46** (V2 install swap=0 / LUKS fail-closed) for a VM-capable agent. Queue head remains #43 Firmware for product work.
+- **Next suggestion:** #43 Firmware, or a VM agent takes #45/#46.
 
 ## 2026-07-09 — Install contracts: swap=0 + unattended LUKS (workflow test run)
 - **Task:** VISION § v1.0 install golden path — PROPOSED install P0s (NEXT head blocked: item 14 wait-cron, 20 `[human]`, 33 V3 visual, 41 hw). Test of VISION→BACKLOG→verify→commit loop.