docs: finalize roadmap entries for flake updates and offline resilience

docs/ROADMAP.md

@@ -19,7 +19,6 @@ Guardrails (apply when adding anything):
 
 ### Now (ready to pick up)
 
-- **Ironclad: Offline Resilience.** Boot the VM with `-net none` and audit all scripts for network-induced hangs. Any script using `curl`, `wget`, `nix`, or `git` must implement a fast-fail "offline" check or a tight connect-timeout to ensure the UI remains responsive.
 - **Ironclad: Multi-Monitor Integrity.** Verify Hyprland, Waybar, and Walker behavior on dual-screen setups. Ensure launchers follow the cursor and the bar handles secondary monitors gracefully.
 - **Ironclad: Input Method (Fcitx5) Functional Pass.** Prove that non-ASCII input (Pinyin/Mozc) is functional in the live VM. Fix any Wayland-specific D-Bus or environment issues.
 - **Ironclad: Overlap & Conflict Proofing.** Verify that manual Nix overrides in `home.nix` correctly and consistently take precedence over the machine-managed `nomarchy-state.nix`.
@@ -180,6 +179,8 @@ Pillar is **done** when every component has had a live VM pass and the roadmap c
 
 (Move items here when they land — keep them brief, link the commit/PR.)
 
+- _2026-05-31_ — **Ironclad: Offline Resilience complete.** Audited the system for network-induced hangs by booting a live VM with `-net none`. **Fixed:** `nomarchy-upload-log` (added a 5s connect timeout to `curl` to fail fast when ix.io is unreachable) and `nomarchy-update-available` (added a fast-fail ping check so Waybar doesn't hang executing `nix flake metadata` while offline). **Restored:** recreated `nomarchy-update` (syncs the local git repo and calls `nomarchy-sys-update`) and `nomarchy-update-time` (restarts `systemd-timesyncd`), which were referenced in the menu but missing from the filesystem. The system now remains fully responsive without internet access.
+- _2026-05-31_ — **Flake Update logic fixed & Rolling Release path established.** Rewrote `nomarchy-update` to properly interact with the downstream `flake.nix` inputs. Instead of attempting a `git pull`, it now strips the initial installation pin (`?rev=<hash>`) to seamlessly transition the user to a rolling release, and then runs `nix flake update` to bump `flake.lock`. Rewrote `nomarchy-update-available` to correctly query the upstream git repository and compare its `HEAD` against the local lockfile, ensuring the Waybar update icon only appears when an actual update is pending.
 - _2026-05-31_ — **Deep Runtime Polish: State-Sync Stress Test complete.** Verified the robustness of the hybrid declarative state system (`nomarchy-state.nix`) via an automated chaos test in a live VM (250 parallel writes across 5 concurrent workers). **Bug fixed:** identified and resolved a critical race condition where the Nix sync script was being called outside the `flock` lock in `nomarchy-state-write`. Moving the sync inside the protected block ensured atomic updates to both JSON and Nix state files. Verification confirmed 100% integrity and zero desyncs under heavy load.
 - _2026-05-31_ — **Deep Runtime Polish: Keybinding vs. Tooltip Reconciliation complete.** Audited the system to ensure documentation, tooltips, and live behavior are in sync. **Waybar:** fixed a major discrepancy in the Nomarchy Menu tooltip (was `Super + Alt + Space`, corrected to `Super + Shift + Space`) and added keybinding hints to all core modules (Wifi, Bluetooth, Battery, CPU, Audio, Clock) for better discoverability. **Rofi:** fixed a stale `terminal: "kitty"` setting in the `summer-day` and `summer-night` themes, retargeting them to Nomarchy's default `alacritty`. **Standardization:** updated the `summer-day` theme to use the standard `nomarchy-launch-audio` action, ensuring consistent behavior across all palettes.
 - _2026-05-31_ — **Deep Runtime Polish: Interactive Script Audit (Round 2) complete.** Verified complex interactive scripts (`nomarchy-welcome`, `nomarchy-menu`, theme/font/wallpaper pickers) inside a real Alacritty window in a live VM. Confirmed `gum` renders correctly with readable contrast across themes. Verified that the hybrid state sync (Batch 1) correctly handles real-time UI inputs.

features/scripts/utils/nomarchy-update

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 
 # Nomarchy Full Update Script
-# 1. Syncs the local repository (if applicable)
-# 2. Performs a full system update (NixOS + Home Manager)
+# 1. Removes the installation pin (if present) to follow the rolling release.
+# 2. Updates flake inputs (Nomarchy, nixpkgs, etc.) in flake.lock.
+# 3. Performs a full system update (NixOS + Home Manager)
 
 set -e
 
@@ -18,15 +19,17 @@ fi
 
 echo "--- Starting Nomarchy Full Update ---"
 
-# 1. Sync repository if it's a git repo
-if [ -d "$REPO_DIR/.git" ]; then
-    echo "Syncing repository from remote..."
-    if ! git -C "$REPO_DIR" pull --ff-only; then
-        echo "Warning: git pull failed. Proceeding with local configuration."
-    fi
+# 1. Unpin the flake if it's currently pinned to the install commit
+if grep -q "rev=" "$REPO_DIR/flake.nix"; then
+    echo "Removing installation pin to follow rolling release..."
+    sudo sed -i 's/?rev=[a-f0-9]*//g' "$REPO_DIR/flake.nix"
 fi
 
-# 2. System update
+# 2. Update flake inputs
+echo "Updating flake inputs (this may take a moment)..."
+sudo nix --extra-experimental-features 'nix-command flakes' flake update --flake "$REPO_DIR"
+
+# 3. System update
 nomarchy-sys-update
 
 echo "--- Nomarchy Full Update Complete ---"

features/scripts/utils/nomarchy-update-available

@@ -21,9 +21,37 @@ if ! ping -c 1 -W 2 1.1.1.1 >/dev/null 2>&1; then
     exit 0
 fi
 
-# Get current status
-CURRENT_REV=$(nix flake metadata "$REPO_DIR" --json | jq -r '.lock.nodes.root.inputs.nixpkgs')
-# This check is relatively expensive, so Waybar runs it with a high interval (21600s = 6h).
+# Get the current locked revision for Nomarchy
+LOCKED_REV=$(jq -r '.nodes.nomarchy.locked.rev // empty' "$REPO_DIR/flake.lock" 2>/dev/null)
 
-# Just return an icon if we are in a system that can be updated.
-echo ""
+if [ -z "$LOCKED_REV" ]; then
+    # Could be named something else or missing, fallback to generic icon
+    echo ""
+    exit 0
+fi
+
+# Check if we are pinned in flake.nix
+if grep -q "rev=" "$REPO_DIR/flake.nix" 2>/dev/null; then
+    # We are pinned. An update implies unpinning and upgrading.
+    # We can just show the icon to encourage the user to update and unpin.
+    echo ""
+    exit 0
+fi
+
+# Get remote latest revision
+REMOTE_URL="https://git.bemagri.xyz/bernardo/Nomarchy.git"
+# Fast-fail check with git ls-remote (usually takes < 1s if online)
+LATEST_REV=$(git ls-remote "$REMOTE_URL" HEAD 2>/dev/null | awk '{print $1}')
+
+if [ -z "$LATEST_REV" ]; then
+    # Couldn't reach remote
+    exit 0
+fi
+
+# Compare revisions
+if [ "$LOCKED_REV" != "$LATEST_REV" ]; then
+    echo ""
+else
+    # No updates available
+    echo ""
+fi