feat(doctor): #147 — flag machine state the flake never set; linger is the worked example

/var/lib survives a migration untouched, and a stray pre-Nomarchy
Linger=yes marker shaped the QA box's session behavior for six months
with nothing in the flake to show for it. Ship the class as guards:

- nomarchy-doctor: new machine-state-drift check after the flake-checkout
  check — loginctl show-user -p Linger; "yes" warns (nothing is broken —
  it is drift) and prints the disable-linger fix; unknown-to-logind skips.
- docs/MIGRATION.md § Post-migration cleanup: "/var/lib machine state
  survives migration" — the worked example and the general suspicion rule.
- checks.doctor: linger sub-case — warn fires under enable-linger, exit
  stays 0, warning clears after disable-linger.

Deliberately NOT hardening the session wiring against the portal-gtk
restart race linger enabled: a clean install cannot reach that state.
The Waybar exec-once loose thread survives as BACKLOG #149.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.doctor green (both branches exercised).
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/MIGRATION.md

@@ -384,6 +384,26 @@ lock).
   prototype).
 - Prune old generations: `sudo nix-collect-garbage -d`.
 
+### `/var/lib` machine state survives migration
+
+A migration reconciles the **flake** — packages, services, dotfiles — and
+nothing else. Everything under `/var/lib` is left exactly as the previous
+OS wrote it, including settings the flake can neither see nor express. That
+state doesn't show up in `git diff`, doesn't get touched by `sys-rebuild`,
+and can sit there for months quietly shaping how the machine behaves.
+
+Worked example: user lingering. Run `loginctl show-user $USER -p Linger` —
+on a Nomarchy machine the answer should be `no`, because the flake never
+sets it. On our own QA box a leftover `Linger=yes` from a pre‑Nomarchy setup
+kept the user's systemd instance alive across logouts, and it took six
+months to trace a string of subtle session bugs back to that one marker.
+Fix: `sudo loginctl disable-linger <user>`.
+
+`nomarchy-doctor` now flags this specific case as a warning. More broadly:
+after migrating, if the machine ever behaves in a way the flake can't
+explain, suspect inherited state under `/var/lib` before you suspect the
+flake.
+
 ---
 
 ## Enabling hibernation on an existing machine (no reinstall)

docs/ROADMAP.md

@@ -493,6 +493,17 @@ Design/decision records and a running log of shipped work (items marked
   V2 by render, both heads + the password dialog, via the new
   `tools/plymouth-preview.sh`. V3 (a real docked boot/shutdown) is queued: the
   fake heads exist from the start, so the rig cannot resize a canvas.
+- ✓ **Machine state the flake can't see (#147, 2026-07-17):** the QA box ran
+  six months with `Linger=yes` from a pre-migration marker in
+  `/var/lib/systemd/linger` — set by nothing in the repo, visible to no flake
+  audit. The class ships as guards, not session hardening: `nomarchy-doctor`
+  now warns on linger drift (`loginctl show-user -p Linger` vs. the flake's
+  implicit "no", fix command printed), and MIGRATION.md § Post-migration
+  cleanup states plainly that `/var/lib` survives a migration and what to
+  sweep. The portal-gtk restart race that linger enabled was deliberately NOT
+  hardened against — a clean install cannot reach that state. V2:
+  `checks.doctor` grew a linger sub-case (warn fires, exit stays 0, clears
+  after `disable-linger`). The Waybar exec-once loose thread became #149.
 - ✓ **Dock mode survives a rebuild (#142, 2026-07-16):** Bernardo: every rebuild
   while docked re-lit the laptop panel and threw a workspace onto it, and he
   re-picked Dock mode by hand. It was not forgetfulness — **a rebuild performed