feat(menu): System ▸ Firmware — fwupd/LVFS update surface (#43)

Add a self-gated Firmware row to the System submenu (present whenever
fwupdmgr is on PATH, i.e. services.fwupd.enable — default-on), its
dispatch, and a `firmware` handler that opens a terminal and runs
fwupdmgr refresh → get-updates → y/N confirm → fwupdmgr update. Never
auto-flashes: fwupdmgr update confirms each device and prompts for the
reboot a capsule needs (pillar 1 — no silent BIOS writes). HARDWARE.md
§4 updated to "shipped".

Verified V0 (nix flake check --no-build) + V1 (HM generation builds;
generated nomarchy-menu passes bash -n; firmware handler emitted
correctly). V2 (menu render in a session) queued in #43 and V3 (real
LVFS flash) in HARDWARE-QUEUE — the VM was held by the #46 install test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -28,15 +28,20 @@ in [`docs/ROADMAP.md`](../docs/ROADMAP.md); map in
 
 ## NEXT
 
-### 43. System › Firmware — fwupd product surface (`VISION § A`)
-`services.fwupd.enable` is already default-on and never auto-flashes,
-but users only learn about `fwupdmgr` from a README sentence. Add a
-self-gated menu entry (System submenu) and/or Control Center row that:
-refreshes metadata, lists updatable devices, confirms, runs
-`fwupdmgr update`, then prints a reboot note when needed. Never
-silent-flash (pillar 1). Optional: first-boot / MOTD one-liner when
-the daemon is active. Spec: docs/HARDWARE.md §4. Cost: menu script +
-optional MOTD; V2 menu, V3 on real LVFS hardware.
+### 43. System › Firmware — fwupd menu (V2 render + optional extensions)
+Core shipped 2026-07-09: self-gated **System ▸ Firmware** rofi row
+(`nomarchy-menu firmware`) — refresh → get-updates → y/N confirm →
+`fwupdmgr update` in a terminal; never silent-flash. Verified V0+V1
+(flake check, HM build, generated `bash -n`). **Remaining:**
+1. **V2** — render the System submenu in a session (VM/live ISO) and
+   confirm the Firmware row shows when fwupd is present and the flow
+   launches. Was blocked on VM contention (a parallel install test held
+   KVM); do it on the next VM pass.
+2. **V3** — real LVFS flash + reboot note on hardware → HARDWARE-QUEUE
+   (entry added).
+3. Optional (own slices): first-boot/MOTD one-liner when fwupd is active;
+   Waybar/updates-panel integration. (The doctor "updates available"
+   check is item #44.) Spec: docs/HARDWARE.md §4.
 
 ### 44. Doctor hardware section — read-only (`VISION § A`)
 Extend `nomarchy-doctor` with the same pass/fail + one-fix-command

agent/HARDWARE-QUEUE.md

@@ -324,6 +324,14 @@ QA machine), the **T14s** (webcam case).
       active and PPD switching governors; opt-ins: ROCm (`rocminfo`, a GPU
       PyTorch/Ollama smoke) and the XDNA NPU driver loading.
 - [ ] **Fingerprint** — `fprintd-enroll` + (opt-in PAM) login/sudo.
+- [ ] **System ▸ Firmware menu on real LVFS hardware** (item #43,
+      `nomarchy-menu firmware`) — on a machine whose firmware/SSD/dock is
+      on LVFS: open Menu ▸ System ▸ **Firmware**; confirm the terminal runs
+      `fwupdmgr refresh` → lists real `get-updates` → the y/N confirm gates
+      correctly → `fwupdmgr update` applies and prints the reboot note when a
+      capsule needs one. Verify **no** flash happens on "N"/cancel. (VM only
+      proves the menu row + flow renders; a real capsule write is
+      hardware-only.)
 
 ## Latitude 5410 only
 - [x] **Waybar theme-switch resilience** (finding #1 re-test, needs main ≥

agent/JOURNAL.md

@@ -17,6 +17,24 @@ Template:
 
 ---
 
+## 2026-07-09 — #43 System ▸ Firmware fwupd menu (core shipped, V2 pending)
+- **Task:** NEXT #43 — surface fwupd/LVFS updates in the menu (VISION § A).
+  Done while the VM was busy with #46, so V0/V1 only by design.
+- **Did:** Added a self-gated **Firmware** row to the System submenu
+  (`command -v fwupdmgr`, like Printers) + dispatch + a `firmware)` handler
+  that opens a terminal and runs `fwupdmgr refresh` → `get-updates` → y/N
+  confirm → `fwupdmgr update` (never silent-flash; fwupd confirms each
+  device + prompts reboot). Updated docs/HARDWARE.md §4 to "shipped".
+- **Verified:** V0 `nix flake check --no-build` green; V1 HM generation
+  builds; extracted the generated `nomarchy-menu` and confirmed `bash -n`
+  clean + the firmware handler emitted correctly (`exec ghostty -e sh -c`,
+  quoting intact).
+- **Pending:** V2 render (System submenu shows the row + flow launches) —
+  queued in slimmed #43, do on next VM pass (KVM was held by #46). V3 real
+  LVFS flash → HARDWARE-QUEUE. Optional MOTD/Waybar extensions noted.
+- **Next suggestion:** land the #44 doctor-hw agent branch; V2-verify #43+#46
+  together once KVM frees.
+
 ## 2026-07-09 — #45 V2 verify Boreal default + capture preview.png (theme-shot)
 - **Task:** NEXT #45 — close the honesty gap on Boreal-as-default (shipped V0
   only at #42) and capture the picker preview. VM-capable environment (KVM).