feat(menu,install): #50 one-liners + record #46 V2 install pass

#50: Bluetooth menu row + handler self-gate on `command -v
blueman-manager` (no-op when bluetooth is off, like Printers); Control
Center rollback list /tmp/nomarchy-gens → mktemp; usbutils on the
nomarchy-install PATH (fingerprint lsusb probe); export
nomarchy-doctor/control-center/battery-notify as flake packages.
Verified V0 (flake check) + V1 (packages, installer, HM generation build).

Also records #46: the swap=0 + unattended-LUKS fail-closed contracts
(208b8d4) V2-verified via a headless two-variant install — fail-closed
exits before wipe with the disk blank; swap=0 installs with no @swap
subvol and boots to a themed desktop. Both items removed from NEXT.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -52,18 +52,6 @@ bash -n + shellcheck) + a real-hardware read-only smoke on the dev box.
 cover the new rows headlessly; pin the fwupd `get-updates` exit-code
 semantics (0 = updates) in that fake. Spec: docs/HARDWARE.md §10.
 
-### 46. V2 verify: install swap=0 + unattended LUKS fail-closed (`208b8d4`)
-Pure `nix-instantiate` on disko subvols passed V0; **full install path
-not exercised**. VM agent with KVM:
-1. Unattended install with `NOMARCHY_SWAP_GB=0` + LUKS passphrase —
-   assert no `/swap` (or empty policy) and no `@swap` surprise; system
-   boots.
-2. Unattended **without** passphrase and **without** `NOMARCHY_NO_LUKS=1`
-   — must **fail** before wipe (fail-closed).
-3. Optional: `NOMARCHY_NO_LUKS=1` + swap=2 still installs. Use
-   `tools/test-install.sh` variants / env flags; journal results; delete
-   item when green (or file NOW bugs on failure).
-
 ### 14. Automated lock bumps — confirm the first real run
 Slices b+c shipped 2026-07-05 (`.gitea/workflows/bump.yml`): weekly
 schedule (Mon 05:17 UTC) + `workflow_dispatch` as the security
@@ -114,16 +102,6 @@ Next slice: on hardware, run `hyprctl clients` while each is open, read
 the real `class`, then append rules. Also revisit whether blueman/s-c-p
 actually float once seen (regex tolerance for the `.…-wrapped` form).
 
-### 50. Small code one-liners batch — V0/V1 (promoted 2026-07-09)
-- Bluetooth menu row self-gate on `command -v blueman-manager` (`rofi.nix`) —
-  no-op when `nomarchy.system.bluetooth.enable = false`, like Printers.
-- Control Center rollback list `/tmp/nomarchy-gens` → `mktemp` (predictable
-  world-writable path → multi-user race).
-- `usbutils` on `nomarchy-install` PATH so the fingerprint `lsusb` probe works
-  (sysfs is the current fallback).
-- Export overlay tools (doctor/control-center/battery-notify) as flake
-  `packages` (`nix build .#nomarchy-doctor`) — three lines in flake.nix.
-
 ## LATER
 
 - **Wallpapers artifact split** (ROADMAP § Faster switches — decided,

agent/JOURNAL.md

@@ -17,6 +17,40 @@ Template:
 
 ---
 
+## 2026-07-09 — #46 V2 verify: install swap=0 + LUKS fail-closed (208b8d4)
+- **Task:** NEXT #46 — exercise the full install path for the swap=0 + LUKS
+  fail-closed contracts (previously only pure `nix-instantiate`). Headless
+  KVM via a two-variant driver adapted from `tools/test-install.sh`.
+- **Did:** Built the live ISO, ran two offline unattended installs:
+  **(B fail-closed)** no passphrase + no `NOMARCHY_NO_LUKS` → installer exits
+  RC=1 at the encryption stage with the fail message; `/dev/vda` stays BLANK
+  and disko `destroy` never runs. **(A swap=0)** `SWAP_GB=0` + passphrase →
+  install RC=0, subvol dump on `/mnt` shows `@,@home,@log,@nix,@snapshots`
+  and **no `@swap`**; installed disk boots (after LUKS unlock) to a fully
+  themed Boreal desktop, no error/autoconfig banner.
+- **Verified:** **V2** — screenshots viewed: `b-failclosed.png`,
+  `a-progress-480.png` (DONE_SWAP0 + subvol dump), `a-first-boot.png` (themed
+  boot). Both contracts hold. #49's new `installer-disko` check now guards the
+  swap contract at eval time too.
+- **Pending:** none for #46. Incidental: HM pre-activate warned in the offline
+  chroot (`xrdb: no display`) yet first boot came up themed anyway — the
+  "pre-activate failure → durable recovery hint" PROPOSED item still stands.
+- **Next suggestion:** promote V2-capable PROPOSED items now the VM is free.
+
+## 2026-07-09 — #50 small code one-liners batch (V0/V1)
+- **Task:** NEXT #50 — four small fixes. Kept in-house (shares rofi.nix /
+  flake.nix with the #47/#49 agents; done after they landed).
+- **Did:** Bluetooth menu row + handler self-gate on `command -v
+  blueman-manager` (`rofi.nix`, like Printers); Control Center rollback list
+  `/tmp/nomarchy-gens` → `mktemp` + cleanup; `usbutils` added to the
+  `nomarchy-install` PATH (fingerprint `lsusb` probe); exported
+  nomarchy-doctor/control-center/battery-notify as flake `packages`.
+- **Verified:** V0 flake check green; V1 — built the four flake packages
+  (incl. the new exports), `nomarchy-install` (usbutils), and the HM
+  generation (rofi + control-center bash -n via writeShell*). All exit 0.
+- **Pending:** none.
+- **Next suggestion:** V2-capable promotions.
+
 ## 2026-07-09 — #49 pure-contract checks.* batch (delegated, worktree)
 - **Task:** NEXT #49 — add pure (no-VM) `checks.*` guards. Delegated to a
   worktree opus agent, parallel with #46 VM + the #47/#48 agent.

flake.nix

@@ -115,6 +115,11 @@
       packages.${system} = {
         nomarchy-theme-sync = pkgs.nomarchy-theme-sync;
         nomarchy-install = nomarchyInstall;
+        # Overlay tools exported for `nix build .#nomarchy-doctor` etc.
+        # (maintainer/CI convenience — modules install them via the overlay).
+        nomarchy-doctor = pkgs.nomarchy-doctor;
+        nomarchy-control-center = pkgs.nomarchy-control-center;
+        nomarchy-battery-notify = pkgs.nomarchy-battery-notify;
         default = pkgs.nomarchy-theme-sync;
       };
 

modules/home/rofi.nix

@@ -367,6 +367,10 @@ ${themeRows}
 
       bluetooth)
         # blueman-manager GUI (services.blueman.enable, system-side).
+        # Self-gated in the System menu on the CLI; guard here too in case
+        # it's invoked directly with nomarchy.system.bluetooth.enable=false.
+        command -v blueman-manager >/dev/null 2>&1 \
+          || { notify-send "Bluetooth" "Not available (nomarchy.system.bluetooth off?)."; exit 0; }
         exec blueman-manager ;;
 
       printers)
@@ -755,7 +759,8 @@ ${themeRows}
         choice=$( {
           row "Network${menuHint "network"}"        network-wireless
           row "VPN"            network-vpn
-          row "Bluetooth${menuHint "bluetooth"}"      bluetooth
+          command -v blueman-manager >/dev/null 2>&1 \
+            && row "Bluetooth${menuHint "bluetooth"}"      bluetooth
           [ -e "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/pulse/native" ] \
             && row "Audio" audio-volume-high
           row "Display" video-display

pkgs/nomarchy-control-center/nomarchy-control-center.sh

@@ -66,8 +66,10 @@ function main_menu() {
                 if [ -z "$gens" ]; then
                     echo "No Home Manager generations found."
                 else
-                    printf "%s\n" "$gens" | awk '{ printf "Desktop gen %s — %s %s%s\n", $5, $1, $2, (NR==1 ? " (current)" : "") }' > /tmp/nomarchy-gens
-                    sel=$(gum choose < /tmp/nomarchy-gens || true)
+                    tmp=$(mktemp)
+                    printf "%s\n" "$gens" | awk '{ printf "Desktop gen %s — %s %s%s\n", $5, $1, $2, (NR==1 ? " (current)" : "") }' > "$tmp"
+                    sel=$(gum choose < "$tmp" || true)
+                    rm -f "$tmp"
                     if [ -n "$sel" ]; then
                         num=${sel#Desktop gen }
                         num=${num%% *}

pkgs/nomarchy-install/default.nix

@@ -13,6 +13,7 @@
 , cryptsetup
 , lvm2             # dmsetup
 , pciutils         # lspci
+, usbutils         # lsusb (fingerprint-reader VID probe; sysfs is the fallback)
 , btrfs-progs      # inspect-internal map-swapfile (hibernation offset)
   # Baked metadata — what this installer installs and where it came from.
 , templateDir              # templates/downstream (home.nix, theme-state.json)
@@ -61,7 +62,7 @@ stdenvNoCC.mkDerivation {
     wrapProgram $out/bin/nomarchy-install \
       --prefix PATH : ${lib.makeBinPath [
         bash gum disko whois git python3
-        util-linux gptfdisk parted cryptsetup lvm2 pciutils btrfs-progs
+        util-linux gptfdisk parted cryptsetup lvm2 pciutils usbutils btrfs-progs
       ]} \
       --set NOMARCHY_INSTALL_SHARE "$share" \
       --set NOMARCHY_NIXPKGS ${nixpkgsPath} \