docs(agent): NEXT #45–46 for VM verification of recent V0 work

Queue headless-incomplete checks for a VM-capable agent: Boreal default
(live/HM apply, preview.png, flake check) and install contracts
(swap=0 + unattended LUKS fail-closed).

agent/BACKLOG.md

@@ -47,6 +47,34 @@ non-empty), laptop charge-threshold sysfs when a limit is set. Spec:
 docs/HARDWARE.md §10. Cost: doctor.sh sections; V1 in existing
 `checks.doctor` where fakes exist, rest V2/V3.
 
+### 45. V2/V3 verify: Boreal default theme (follow-up to #42 / `351b7ad`)
+Code for Boreal-as-default shipped at V0 only (seed JSON + eval
+fallbacks; contrast green). **Needs a VM-capable agent** (or hardware)
+to close the honesty gap. Checklist:
+1. `nix flake check --no-build` green on current `main` (ISO eval can be
+   slow — let it finish).
+2. V1 optional: build template HM or live toplevel if time allows.
+3. V2: boot live ISO (`tools/test-live-iso.sh`) or apply template HM —
+   confirm session/wallpaper/terminal read as **Boreal** (slug
+   `boreal`, violet accent, GeistMono), not Tokyo Night.
+4. Capture `themes/boreal/preview.png` for the theme picker (square
+   crop per MEMORY rofi icon note) and commit it.
+5. V3 optional: append HARDWARE-QUEUE if only a real panel/GPU shows
+   something headless can't. Delete this item when checklist is done;
+   journal the tier reached.
+
+### 46. V2 verify: install swap=0 + unattended LUKS fail-closed (`208b8d4`)
+Pure `nix-instantiate` on disko subvols passed V0; **full install path
+not exercised**. VM agent with KVM:
+1. Unattended install with `NOMARCHY_SWAP_GB=0` + LUKS passphrase —
+   assert no `/swap` (or empty policy) and no `@swap` surprise; system
+   boots.
+2. Unattended **without** passphrase and **without** `NOMARCHY_NO_LUKS=1`
+   — must **fail** before wipe (fail-closed).
+3. Optional: `NOMARCHY_NO_LUKS=1` + swap=2 still installs. Use
+   `tools/test-install.sh` variants / env flags; journal results; delete
+   item when green (or file NOW bugs on failure).
+
 ### 14. Automated lock bumps — confirm the first real run
 Slices b+c shipped 2026-07-05 (`.gitea/workflows/bump.yml`): weekly
 schedule (Mon 05:17 UTC) + `workflow_dispatch` as the security