test(checks): pure-contract guards batch (#49)

Four new no-VM checks.* + CI py_compile expansion:
- hardware-db-modules: installer DB module names ∈ pinned
  nixos-hardware.nixosModules (a lock bump can rename a module and break
  profiled installs on just the matching DMI, invisible to any VM).
- installer-compose-lock: offline lock-composer contract on fixtures.
- installer-disko: pure Nix assert — swapSize "0"/"0G" → no @swap, "2G"
  → sized, withLuks wraps root (permanently guards the #46 install fix).
- windowrule-syntax: builds the generated hyprland.conf and fails on the
  pre-0.53 grammar / windowrulev2 keyword (guards ed7fd93).
CI py_compile now covers all tracked *.py; docs/TESTING.md §1 synced.

Implemented by a worktree agent; diff reviewed. Verified V0 (flake check)
+ V1 (each checks.x86_64-linux.* built on main, exit 0); agent's negative
tests confirm each guard fails on a regression.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -114,19 +114,6 @@ Next slice: on hardware, run `hyprctl clients` while each is open, read
 the real `class`, then append rules. Also revisit whether blueman/s-c-p
 actually float once seen (regex tolerance for the `.…-wrapped` form).
 
-### 49. Pure-contract `checks.*` batch — no VM (promoted 2026-07-09)
-Add pure runCommand checks (all V0):
-- Expand CI `py_compile` to **all** tracked `*.py` (compose-lock, tools/*,
-  tools/vm/*), not just theme-sync (`.gitea/workflows/check.yml`; sync
-  `docs/TESTING.md §1`).
-- Hardware-db module names ∈ pinned `nixos-hardware.nixosModules` (a lock bump
-  can rename modules and break profiled installs only on matching DMI).
-- Installer pure contracts: `compose-lock.py`, disko `swapSize`
-  ("0"/"0G"/"NG") + `withLuks` arg contract.
-- **windowrule dead-syntax guard:** build the generated `hyprland.conf` and
-  fail on the rule-first `windowrule = (float|center|size|tile|…) ,` pattern
-  or the `windowrulev2` keyword (would have caught `ed7fd93`).
-
 ### 50. Small code one-liners batch — V0/V1 (promoted 2026-07-09)
 - Bluetooth menu row self-gate on `command -v blueman-manager` (`rofi.nix`) —
   no-op when `nomarchy.system.bluetooth.enable = false`, like Printers.

agent/JOURNAL.md

@@ -17,6 +17,24 @@ Template:
 
 ---
 
+## 2026-07-09 — #49 pure-contract checks.* batch (delegated, worktree)
+- **Task:** NEXT #49 — add pure (no-VM) `checks.*` guards. Delegated to a
+  worktree opus agent, parallel with #46 VM + the #47/#48 agent.
+- **Did:** Four new checks wired into `flake.nix` + CI py_compile expansion:
+  `hardware-db-modules` (installer DB module names ∈ pinned
+  nixos-hardware.nixosModules), `installer-compose-lock` (offline composer
+  contract on fixtures), `installer-disko` (pure Nix assert: swapSize
+  "0"/"0G" → no @swap, "2G" → sized, withLuks wrapping — permanently guards
+  the #46 fix), `windowrule-syntax` (builds the generated hyprland.conf, fails
+  on pre-0.53 grammar / windowrulev2 — permanently guards `ed7fd93`). CI
+  py_compile now covers all tracked `*.py`; TESTING.md §1 synced.
+- **Verified:** V0 flake check green; **V1** I built each of the four
+  `checks.x86_64-linux.*` on main after cherry-pick — all exit 0. Agent's
+  negative tests confirmed each guard FAILS on a deliberate regression.
+- **Pending:** none — all pure/headless, no VM. (A KVM CI runner, item 20,
+  would later run these + the VM suite on push.)
+- **Next suggestion:** #50 one-liners (mine); then close #46 (variant A boot).
+
 ## 2026-07-09 — #47+#48 docs/string factual-drift pass (delegated, worktree)
 - **Task:** NEXT #47 (docs + string drift) + #48 (i2c option-docs). Delegated
   to a worktree sonnet agent, parallel with #46 VM + the #49 agent, no shared