chore(audit): final Phase B batch — close out unused? cluster

Pillar 3 Phase B, batch 4 (final). Triages the last 13 `unused?` rows: five deletes and eight SKILL.md surfacings. Deleted (no callers anywhere, work duplicated inline or marginal value): - `nomarchy-restart-hyprctl` and `nomarchy-restart-mako`: stale comments claimed "used by theme switching" but no Nomarchy script calls them. Theme-set and refresh paths call `hyprctl reload` / `makoctl reload` directly (see nomarchy-refresh-hyprland). - `nomarchy-restart-tmux`: 3-line pgrep+source-file wrapper. Users can `tmux source-file ~/.config/tmux/tmux.conf` themselves. - `nomarchy-battery-present`: the battery monitor reads `/sys/class/power_supply/BAT*` inline; the helper never got wired in. - `nomarchy-sudo-keepalive`: intended to be `source`d from longer-running scripts (nomarchy-update, etc.) but nothing sources it. Resurrect from git history if a future caller actually needs it. Surfaced in SKILL.md (now tagged `kept` by the audit): - Themes: `nomarchy-theme-{remove,refresh,bg-install}` - System: `nomarchy-sudo-{passwordless-toggle,reset}`, `nomarchy-restart-trackpad` (intel_quicki2c THC reload — a real laptop bug fix worth documenting) - New Virtualization section: `nomarchy-windows-vm {install,launch,stop,status}` - Enriched Troubleshooting's generic `nomarchy-refresh-<app>` example with literal `nomarchy-refresh-fastfetch` so the audit catches it. Verified `nix flake check --no-build` still passes and zero callers reference the deleted scripts. **Phase B is now complete.** Final audit state: 164 → 159 scripts, all tagged `kept`, `unused?` = 0, missing references = 0. The audit table is now a clean reference of what Nomarchy ships, not a triage backlog. Logged in `docs/ROADMAP.md` Shipped. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
chore(audit): triage webapp/tui/voxtype install-remove pairs
2026-05-18 17:19:57 +01:00 · 2026-05-18 17:13:39 +01:00 · 2026-05-18 17:08:09 +01:00 · 2026-05-18 17:01:29 +01:00 · 2026-05-18 17:01:22 +01:00 · 2026-05-18 17:01:15 +01:00
27 changed files with 299 additions and 409 deletions
--- a/README.md
+++ b/README.md
@@ -40,7 +40,8 @@ This builds a full graphical VM of the installer environment. Once inside, click
 ### 2. Build the Installer ISO
 To install on physical hardware, generate your own bootable image:
 ```bash
-nix build .#nixosConfigurations.nomarchy-installer.config.system.build.isoImage
+./features/scripts/utils/nomarchy-build-iso       # Minimal TTY installer
+./features/scripts/utils/nomarchy-build-live-iso  # Graphical try-before-install
 ```
 The ISO will be located at `./result/iso/nixos-*.iso`. Flash it to a USB drive and boot.

--- a/bin/utils/nomarchy-docs-scripts
+++ b/bin/utils/nomarchy-docs-scripts
@@ -81,13 +81,34 @@ ref_files_per_cmd() {
 # Final char must be alphanumeric — dropping trailing-dash matches like
 # `nomarchy-pkg-` that come from glob references (`for c in nomarchy-pkg-*`).
 # Restrict to grep_includes so binaries / tmpfiles don't pollute the set.
-# We also filter out common prefix-only tokens that are false positives from
-# wildcards/expansions.
-all_refs=$(grep -rohE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
+# The first `grep -vE` drops lines where `nomarchy-*` is a derivation /
+# tmp file / sudoers basename / systemd unit / flake output / docker
+# container identifier rather than a shell invocation.
+# The second `grep -vE` is a token-level safety net for prefix-only
+# tokens left over from wildcards/expansions (e.g. `nomarchy-pkg-*`).
+all_refs=$(grep -rhE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
            "${grep_includes[@]}" \
            "${search_dirs[@]}" 2>/dev/null \
+          | grep -vE \
+              -e '(pname|name)[[:space:]]*=[[:space:]]*"nomarchy-' \
+              -e '/tmp/nomarchy-' \
+              -e '/etc/sudoers\.d/[^"[:space:]]*nomarchy-' \
+              -e 'nixosConfigurations\.nomarchy-' \
+              -e 'packages\.[^.]+\.nomarchy-' \
+              -e '\./result/bin/run-nomarchy-' \
+              -e 'mktemp[[:space:]]+[^|]*-t[[:space:]]+nomarchy-' \
+              -e '(TIMER_NAME|NOPASSWD_FILE|UNIT_NAME)=.*nomarchy-' \
+              -e 'docker[[:space:]]+[^|]*nomarchy-' \
+          | grep -oE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
          | grep -vE '^(nomarchy-launch|nomarchy-brightness|nomarchy-cmd|nomarchy-pkg|nomarchy-restart|nomarchy-toggle|nomarchy-theme|nomarchy-webapp-handler|nomarchy-font-selector|nomarchy-theme-selector|nomarchy-wallpaper-selector|nomarchy-setup|nomarchy-refresh|nomarchy-scripts|nomarchy-system-scripts|nomarchy-theme-engine-scripts)$' \
+          | grep -vE '^(nomarchy-plymouth|nomarchy-sddm-theme|nomarchy-live|nomarchy-rev|nomarchy-windows)$' \
          | sort -u)
+# The second denylist covers identifiers whose ambiguity survives the line
+# filter: `nomarchy-plymouth` / `nomarchy-sddm-theme` are Nix derivation
+# names referenced as bare idents in `[...]` lists, `nomarchy-live` is an
+# ISO label that shows up in comments, `nomarchy-rev` is `/etc/nomarchy-rev`
+# (written by the ISO), and `nomarchy-windows` is a docker container name
+# in compose heredocs.

 # --- Render: header --------------------------------------------------------

--- a/core/home/config/nomarchy-skill/SKILL.md
+++ b/core/home/config/nomarchy-skill/SKILL.md
@@ -8,7 +8,7 @@ description: >
  monitors, gaps, borders, blur, opacity, waybar, walker, terminal config, themes,
  wallpaper, night light, idle, lock screen, screenshots, layer rules, workspace
  settings, display config, and user-facing nomarchy commands. Excludes Nomarchy
-  source development in ~/.local/share/nomarchy/ and nomarchy-dev-* workflows.
+  source development in ~/.local/share/nomarchy/ and repo-internal workflows.
 ---

 # Nomarchy Skill
@@ -34,7 +34,7 @@ It is not for contributing to Nomarchy source code.

 **If you're about to edit a config file in ~/.config/ on this system, STOP and use this skill first.**

-**Do NOT use this skill for Nomarchy development tasks** (editing files in `~/.local/share/nomarchy/`, creating migrations, or running `nomarchy-dev-*` workflows).
+**Do NOT use this skill for Nomarchy development tasks** — editing files in `~/.local/share/nomarchy/` or modifying repo internals.

 ## Critical Safety Rules

@@ -244,6 +244,9 @@ nomarchy-theme-set <name>        # Apply theme (use "Tokyo Night" not "tokyo-nig
 nomarchy-theme-next              # Cycle to next theme
 nomarchy-theme-bg-next           # Cycle wallpaper
 nomarchy-theme-install <url>     # Install from git repo
+nomarchy-theme-remove <name>     # Remove an installed extra theme
+nomarchy-theme-refresh           # Re-apply current theme from templates
+nomarchy-theme-bg-install        # Open backgrounds dir to drop in custom images
 ```

 ### Keybindings
@@ -311,10 +314,48 @@ nomarchy-debug --no-sudo --print # Debug info (ALWAYS use these flags)
 nomarchy-lock-screen             # Lock screen
 nomarchy-system-shutdown         # Shutdown
 nomarchy-system-reboot           # Reboot
+nomarchy-sudo-passwordless-toggle # Toggle 15-min passwordless sudo
+nomarchy-sudo-reset              # Clear sudo lockout / faillock
+nomarchy-restart-trackpad        # Reload intel_quicki2c (fixes dead THC trackpad)
 ```

 **IMPORTANT:** Always run `nomarchy-debug` with `--no-sudo --print` flags to avoid interactive sudo prompts that will hang the terminal.

+### Custom App Launchers
+
+```bash
+nomarchy-webapp-install                  # Add a web app launcher (interactive)
+nomarchy-webapp-remove [name...]         # Remove web apps (interactive if no name)
+nomarchy-webapp-remove-all               # Bulk-remove every web app
+nomarchy-tui-install                     # Add a TUI launcher for a terminal program
+nomarchy-tui-remove [name...]            # Remove TUI launchers
+nomarchy-tui-remove-all                  # Bulk-remove every TUI launcher
+```
+
+Both families write `.desktop` files into `~/.local/share/applications/` so they appear in the app launcher (walker / rofi).
+
+### Voice dictation (Voxtype)
+
+```bash
+nomarchy-voxtype-install                 # Install Voxtype + AI model (~150MB)
+nomarchy-voxtype-remove                  # Uninstall Voxtype
+nomarchy-voxtype-status                  # Running state (also shown in waybar)
+```
+
+Toggle dictation with `SUPER+CTRL+X` after install.
+
+### Virtualization
+
+```bash
+nomarchy-windows-vm install              # Provision a Windows VM via docker-compose
+nomarchy-windows-vm launch               # Connect to the VM (auto-stop on disconnect)
+nomarchy-windows-vm launch -k            # Connect, keep VM running after disconnect
+nomarchy-windows-vm stop                 # Shut the VM down
+nomarchy-windows-vm status               # Show current state
+```
+
+Requires KVM (`/dev/kvm`) and Docker (enable via `nomarchy.system.virtualization.docker`).
+
 ## Troubleshooting

 ```bash
@@ -325,6 +366,7 @@ nomarchy-debug --no-sudo --print
 nomarchy-upload-log

 # Reset specific config to defaults
+# Examples: nomarchy-refresh-fastfetch, nomarchy-refresh-hyprland, nomarchy-refresh-waybar
 nomarchy-refresh-<app>

 # Refresh specific config file
@@ -352,7 +394,7 @@ When user requests system changes:
 This skill intentionally does not cover Nomarchy source development. Do not use this skill for:
 - Editing files in `~/.local/share/nomarchy/` (`bin/`, `config/`, `default/`, `themes/`, `migrations/`, etc.)
 - Creating or editing migrations
- Running `nomarchy-dev-*` commands
+- Modifying Nomarchy's own source tree

 ## Example Requests

--- a/core/home/state.nix
+++ b/core/home/state.nix
@@ -19,7 +19,7 @@ in
        skipVsCodeTheme = togglesState.skipVsCodeTheme or false;
      };
      nightlightTemperature = togglesState.nightlightTemperature or 4000;
-      theme = togglesState.theme or "summer-night";
+      theme = togglesState.theme or "nord";
      wallpaper = togglesState.wallpaper or "";
      panelPosition = togglesState.panelPosition or "top";
      hyprland = {
@@ -31,11 +31,11 @@ in

      # Derived properties from the theme directory
      isLightMode = nomarchyLib.isThemeLightMode {
-        themeName = togglesState.theme or "summer-night";
+        themeName = togglesState.theme or "nord";
        inherit assetsPath;
      };
      iconsTheme = nomarchyLib.getIconsTheme {
-        themeName = togglesState.theme or "summer-night";
+        themeName = togglesState.theme or "nord";
        inherit assetsPath;
      };
    };
--- a/core/system/impermanence.nix
+++ b/core/system/impermanence.nix
@@ -10,13 +10,27 @@ in

  options.nomarchy.system.impermanence = {
    enable = lib.mkEnableOption "Erase Your Darlings (Impermanence) root wipe on boot";
+
+    # The disko layout names the main LUKS mapping `crypted` on single-disk
+    # installs and `crypted_main` on multi-disk installs (see
+    # installer/disko-config.nix: `mainLuksName`). The rollback hook must
+    # mount the right device, otherwise initrd fails on every boot and the
+    # @ → root-blank snapshot is never restored.
+    mainLuksName = lib.mkOption {
+      type = lib.types.str;
+      default = "crypted";
+      description = ''
+        Name of the /dev/mapper entry holding the BTRFS root. Set to
+        "crypted_main" on multi-disk installs to match the disko layout.
+      '';
+    };
  };

  config = lib.mkIf cfg.enable {
    # 1. The Rollback Script: Runs in initrd before filesystems are mounted
    boot.initrd.postDeviceCommands = lib.mkAfter ''
      mkdir -p /btrfs_tmp
-      mount -o subvol=/ /dev/mapper/crypted /btrfs_tmp
+      mount -o subvol=/ /dev/mapper/${cfg.mainLuksName} /btrfs_tmp
      
      if [[ -e /btrfs_tmp/@ ]]; then
          mkdir -p /btrfs_tmp/old_roots
--- a/core/system/options.nix
+++ b/core/system/options.nix
@@ -55,8 +55,8 @@
    };
    theme = lib.mkOption {
      type = lib.types.str;
-      default = "summer-night";
-      description = "Selected system theme.";
+      default = "nord";
+      description = "Selected system theme. Matches lib/state-schema.nix and the installer-written state.json so a missing/blank state file lands on the same theme everywhere.";
    };

    # ----- Tier 1 system features (all opt-in, no behavioural change off) ---
--- a/core/system/scripts/nomarchy-battery-present
+++ b/core/system/scripts/nomarchy-battery-present
@@ -1,14 +0,0 @@
-#!/bin/bash
-set -e
-
-# Returns true if a battery is present on the system.
-# Used by the battery monitor and other battery-related checks.
-
-for bat in /sys/class/power_supply/BAT*; do
-  [[ -r $bat/present ]] &&
-  [[ $(cat $bat/present) == "1" ]] &&
-  [[ $(cat $bat/type) == "Battery" ]] &&
-  exit 0
-done
-
-exit 1
--- a/core/system/scripts/nomarchy-sudo-keepalive
+++ b/core/system/scripts/nomarchy-sudo-keepalive
@@ -1,11 +0,0 @@
-#!/bin/bash
-set -e
-
-# Prompt for sudo once and keep the credential alive in the background.
-# Source this script so the trap applies to the calling shell:
-#   source nomarchy-sudo-keepalive
-
-sudo -v
-while true; do sudo -n true; sleep 60; done 2>/dev/null &
-SUDO_KEEPALIVE_PID=$!
-trap "kill $SUDO_KEEPALIVE_PID 2>/dev/null" EXIT
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -121,6 +121,10 @@ Each PR description should reference the row(s) in `docs/SCRIPTS.md` it closes,

 (Move items here when they land — keep them brief, link the commit/PR.)

+- _2026-05-18_ — **Pillar 3 Phase B: complete.** Final batch (restart/sudo/theme/misc clusters) cleared the last 13 `unused?` rows. Deleted five truly dead scripts: `nomarchy-restart-{hyprctl,mako}` (theme switching calls `hyprctl reload`/`makoctl reload` directly now), `nomarchy-restart-tmux` (one-liner of marginal value), `nomarchy-battery-present` (battery monitor checks `/sys/class/power_supply/BAT*` inline), `nomarchy-sudo-keepalive` (intended-to-be-sourced building block with no users). Surfaced eight useful tools in `SKILL.md` so the audit catches them as `kept` and AI assistants can discover them: `nomarchy-restart-trackpad` (intel_quicki2c reload), `nomarchy-sudo-{passwordless-toggle,reset}`, `nomarchy-theme-{bg-install,refresh,remove}`, `nomarchy-refresh-fastfetch`, `nomarchy-windows-vm` (new Virtualization section). Final state: 159 scripts, all `kept`, `unused?` = 0, missing references = 0.
+- _2026-05-18_ — Pillar 3 Phase B: webapp/tui/voxtype install-remove pair triage. Deleted two dead webapp URI handlers (`nomarchy-webapp-handler-hey`, `nomarchy-webapp-handler-zoom`) — no `.desktop` MimeType registration anywhere routed `mailto:`/`zoom:` URIs to them, so the handlers could never fire. Surfaced six useful CLI tools in `SKILL.md` "Common Tasks" so they're discoverable by AI assistants and tagged `kept` by the audit: `nomarchy-webapp-{remove,remove-all}`, `nomarchy-tui-{remove,remove-all}`, `nomarchy-voxtype-{install,remove}`. Script count 166 → 164; `unused?` 21 → 13.
+- _2026-05-18_ — Pillar 3 Phase B: dead-code sweep (NixOS-irrelevant Omarchy ports). Deleted five scripts that duplicated NixOS-native facilities or referenced infrastructure Nomarchy doesn't ship: `nomarchy-rollback` (boot-menu generations + `nixos-rebuild rollback` already cover this), `nomarchy-snapshot` (used `snapper`; impermanence and BTRFS subvolumes are the Nomarchy answer), `nomarchy-migrate-state` (one-shot pre-unification migration, no current callers), `nomarchy-config-direct-boot` (added an EFI entry for a UKI we never build), and `nomarchy-npx-install` (Arch idiom — `nix-shell -p nodejs` is the NixOS path). Kept `nomarchy-build-iso` and `nomarchy-build-live-iso` and surfaced them in README §2 so the audit tags them `kept`. Script count 171 → 166.
+- _2026-05-18_ — Pillar 3 Phase B: missing-references triage. (1) Wrote `themes/engine/scripts/nomarchy-theme-next` so `SKILL.md`'s documented "cycle to next theme" command resolves; (2) scrubbed three stale `nomarchy-dev-*` references from `core/home/config/nomarchy-skill/SKILL.md`; (3) added a line-context filter to both `nomarchy-docs-scripts` generators that drops `nomarchy-*` tokens appearing in Nix `pname`/derivation idents, `/tmp/` & `/etc/sudoers.d/` paths, `nixosConfigurations.*` / `packages.*` flake outputs, `mktemp -t` prefixes, systemd unit vars, `./result/bin/run-` binaries, and `docker` container references; (4) added a small token-level denylist for five residual non-script identifiers (`nomarchy-plymouth`, `nomarchy-sddm-theme`, `nomarchy-live`, `nomarchy-rev`, `nomarchy-windows`) that survive line filtering. `docs/SCRIPTS.md` "Missing references" section is now empty (was 15).
 - _2026-05-04_ — Pillar 8: Distro Branding. (1) Scrubbed remaining "Omarchy" and "Spirit of Omarchy" references from README, scripts, and welcome wizard; (2) Updated `nomarchy-welcome` banner and `nomarchy-version` codename ("Sovereign"); (3) Verified existing `core/system/branding.nix` handles OS-release and bootloader labels; (4) Confirmed SDDM and Plymouth metadata are already Nomarchy-branded.
 - _2026-05-04_ — Thorough Out-of-the-Box QA Audit. (1) Restored automatic wallpaper switching by removing image filters from deployed themes; (2) Fixed broken "Style" menu entries by creating missing `about.txt` and `screensaver.txt` branding files; (3) Cleaned up conflicting keybindings by removing deprecated `tiling.conf` and updating the doc generator; (4) Removed legacy Nord theme hack from `nomarchy-theme-set`; (5) Fixed JSON parse error in `summer-day` waybar theme.
 - _2026-05-03_ — Fixed multi-disk LUKS/BTRFS boot hang. (1) Moved temporary LUKS keyfile to `/tmp/` so Disko correctly omits it from the runtime configuration; (2) Injected `x-systemd.requires` and `x-systemd.device-timeout=0` into BTRFS mount options to ensure all LUKS drives are decrypted before mounting.
--- a/docs/SCRIPTS.md
+++ b/docs/SCRIPTS.md
@@ -24,22 +24,21 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 - `delete-dead` — Phase B verdict: remove and update callers.
 - `stub-with-notify` — Phase B verdict: temporary `notify-send` stub.

-## Scripts (170)
+## Scripts (159)

 | Script | Location | Callers | Status | Notes |
 | --- | --- | --- | --- | --- |
 | `nomarchy-backup` | `features/scripts/utils` | features/scripts/utils/nomarchy-sync | `kept` |  |
 | `nomarchy-battery-capacity` | `core/system/scripts` | core/system/scripts/nomarchy-battery-status | `kept` |  |
 | `nomarchy-battery-monitor` | `core/system/scripts` | features/scripts/battery-monitor.nix | `kept` |  |
-| `nomarchy-battery-present` | `core/system/scripts` | — | `unused?` |  |
 | `nomarchy-battery-remaining` | `core/system/scripts` | core/system/scripts/nomarchy-battery-monitor,core/system/scripts/nomarchy-battery-status | `kept` |  |
 | `nomarchy-battery-remaining-time` | `core/system/scripts` | core/system/scripts/nomarchy-battery-status | `kept` |  |
 | `nomarchy-battery-status` | `core/system/scripts` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/system/scripts/nomarchy-battery-capacity, +1 more | `kept` |  |
 | `nomarchy-brightness-display` | `core/system/scripts` | core/home/config/nomarchy/default/hypr/bindings/media.conf,core/home/config/nomarchy/default/hypr/bindings/utilities.conf | `kept` |  |
 | `nomarchy-brightness-display-apple` | `core/system/scripts` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf | `kept` |  |
 | `nomarchy-brightness-keyboard` | `core/system/scripts` | core/home/config/nomarchy/default/hypr/bindings/media.conf | `kept` |  |
-| `nomarchy-build-iso` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-build-live-iso` | `features/scripts/utils` | — | `unused?` |  |
+| `nomarchy-build-iso` | `features/scripts/utils` | README.md | `kept` |  |
+| `nomarchy-build-live-iso` | `features/scripts/utils` | README.md | `kept` |  |
 | `nomarchy-cmd-audio-switch` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/media.conf | `kept` |  |
 | `nomarchy-cmd-present` | `features/scripts/utils` | core/home/config/nomarchy/hooks/battery-low.sample,features/scripts/utils/nomarchy-launch-editor, +4 more | `kept` |  |
 | `nomarchy-cmd-screenrecord` | `features/scripts/utils` | features/desktop/waybar/config/config.jsonc,features/desktop/waybar/themes/summer-night/config.jsonc, +1 more | `kept` |  |
@@ -47,7 +46,6 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-cmd-screenshot` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy-skill/SKILL.md, +1 more | `kept` |  |
 | `nomarchy-cmd-share` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-cmd-terminal-cwd` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/plain-bindings.conf,features/desktop/hyprland/config/bindings.conf | `kept` |  |
-| `nomarchy-config-direct-boot` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-debug` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-docs-keybindings` | `features/scripts/utils` | bin/utils/nomarchy-docs-keybindings | `kept` |  |
 | `nomarchy-docs-scripts` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts | `kept` |  |
@@ -69,7 +67,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-hw-vulkan` | `core/system/scripts` | features/scripts/utils/nomarchy-voxtype-install | `kept` |  |
 | `nomarchy-hyprland-active-window-transparency-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf | `kept` |  |
 | `nomarchy-hyprland-monitor-scaling-cycle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf,features/scripts/utils/nomarchy-menu, +1 more | `kept` |  |
-| `nomarchy-hyprland-window-close-all` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling.conf,core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf, +3 more | `kept` |  |
+| `nomarchy-hyprland-window-close-all` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf,core/system/scripts/nomarchy-system-logout, +2 more | `kept` |  |
 | `nomarchy-hyprland-window-gaps-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-hyprland-window-pop` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf | `kept` |  |
 | `nomarchy-hyprland-window-single-square-aspect-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/scripts/utils/nomarchy-menu | `kept` |  |
@@ -88,15 +86,13 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-launch-screensaver` | `features/scripts/utils` | features/desktop/idle.nix,features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-launch-tui` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/hyprland/config/bindings.conf, +2 more | `kept` |  |
 | `nomarchy-launch-walker` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/clipboard.conf,core/home/config/nomarchy/default/hypr/bindings/utilities.conf, +4 more | `kept` |  |
-| `nomarchy-launch-webapp` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/plain-bindings.conf,features/desktop/hyprland/config/bindings.conf, +7 more | `kept` |  |
+| `nomarchy-launch-webapp` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/plain-bindings.conf,features/desktop/hyprland/config/bindings.conf, +5 more | `kept` |  |
 | `nomarchy-launch-wifi` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy/default/mako/core.ini, +4 more | `kept` |  |
 | `nomarchy-lock-screen` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy/extensions/menu.sh, +3 more | `kept` |  |
-| `nomarchy-manual` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu,themes/engine/scripts/nomarchy-theme-install | `kept` |  |
+| `nomarchy-manual` | `features/scripts/utils` | core/branding/about.txt,features/scripts/utils/nomarchy-menu, +1 more | `kept` |  |
 | `nomarchy-menu` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/hypr/bindings/utilities.conf, +10 more | `kept` |  |
 | `nomarchy-menu-keybindings` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy/default/mako/core.ini, +2 more | `kept` |  |
-| `nomarchy-migrate-state` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-notification-dismiss` | `features/scripts/utils` | core/home/config/nomarchy/default/mako/core.ini | `kept` |  |
-| `nomarchy-npx-install` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-on-boot` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/autostart.conf | `kept` |  |
 | `nomarchy-pkg-add` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-pkg-install, +2 more | `kept` |  |
 | `nomarchy-pkg-aur-add` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
@@ -104,42 +100,36 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-pkg-install` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-pkg-remove` | `core/system/scripts` | features/scripts/utils/nomarchy-pkg-drop | `kept` |  |
 | `nomarchy-powerprofiles-list` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-preflight-migration` | `core/system/scripts` | core/system/scripts/nomarchy-env-update,features/scripts/utils/nomarchy-migrate-state | `kept` |  |
+| `nomarchy-preflight-migration` | `core/system/scripts` | core/system/scripts/nomarchy-env-update | `kept` |  |
 | `nomarchy-refresh-config` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-refresh-fastfetch | `kept` |  |
-| `nomarchy-refresh-fastfetch` | `features/scripts/utils` | — | `unused?` |  |
+| `nomarchy-refresh-fastfetch` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-refresh-hyprland` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-refresh-waybar` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-reinstall` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-restart-app` | `features/scripts/utils` | core/system/scripts/nomarchy-restart-xcompose,features/scripts/utils/nomarchy-restart-hypridle, +3 more | `kept` |  |
 | `nomarchy-restart-bluetooth` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-restart-btop` | `features/scripts/utils` | themes/engine/scripts/nomarchy-theme-set | `kept` |  |
-| `nomarchy-restart-hyprctl` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-restart-hypridle` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-restart-hyprsunset` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-restart-mako` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-restart-opencode` | `features/scripts/utils` | themes/engine/scripts/nomarchy-theme-set | `kept` |  |
 | `nomarchy-restart-pipewire` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-restart-swayosd` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-restart-terminal` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
-| `nomarchy-restart-tmux` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-restart-trackpad` | `core/system/scripts` | — | `unused?` |  |
+| `nomarchy-restart-trackpad` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-restart-walker` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-menu, +1 more | `kept` |  |
 | `nomarchy-restart-waybar` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-menu, +4 more | `kept` |  |
 | `nomarchy-restart-wifi` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-restart-xcompose` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-rollback` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-setup-dns` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-setup-fido2` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
+| `nomarchy-setup-fido2` | `core/system/scripts` | features/scripts/utils/nomarchy-menu,installer/install.sh | `kept` |  |
 | `nomarchy-setup-fingerprint` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-show-done` | `themes/engine/scripts` | features/scripts/utils/nomarchy-launch-floating-terminal-with-presentation | `kept` |  |
 | `nomarchy-show-logo` | `themes/engine/scripts` | features/scripts/utils/nomarchy-launch-floating-terminal-with-presentation | `kept` |  |
 | `nomarchy-skill` | `features/scripts/utils` | core/home/configs.nix | `kept` |  |
-| `nomarchy-snapshot` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-state` | `features/scripts/utils` | core/system/scripts/nomarchy-system-reboot,core/system/scripts/nomarchy-system-shutdown, +2 more | `kept` |  |
 | `nomarchy-state-write` | `features/scripts/utils` | features/scripts/utils/nomarchy-welcome | `kept` |  |
-| `nomarchy-sudo-keepalive` | `core/system/scripts` | — | `unused?` |  |
-| `nomarchy-sudo-passwordless-toggle` | `core/system/scripts` | — | `unused?` |  |
-| `nomarchy-sudo-reset` | `core/system/scripts` | — | `unused?` |  |
+| `nomarchy-sudo-passwordless-toggle` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-sudo-reset` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-swayosd-brightness` | `core/system/scripts` | core/system/scripts/nomarchy-brightness-display,core/system/scripts/nomarchy-brightness-display-apple | `kept` |  |
 | `nomarchy-swayosd-kbd-brightness` | `core/system/scripts` | core/system/scripts/nomarchy-brightness-keyboard | `kept` |  |
 | `nomarchy-sync` | `features/scripts/utils` | features/scripts/utils/nomarchy-backup,README.md | `kept` |  |
@@ -150,16 +140,17 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-test-installer` | `features/scripts/utils` | features/scripts/utils/nomarchy-test-vm,README.md | `kept` |  |
 | `nomarchy-test-live-iso` | `features/scripts/utils` | hosts/nomarchy-live.nix | `kept` |  |
 | `nomarchy-test-vm` | `features/scripts/utils` | features/scripts/utils/nomarchy-test-live-iso | `kept` |  |
-| `nomarchy-theme` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/elephant/nomarchy_background_selector.lua, +16 more | `kept` |  |
-| `nomarchy-theme-bg-install` | `themes/engine/scripts` | — | `unused?` |  |
+| `nomarchy-theme` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/elephant/nomarchy_background_selector.lua, +17 more | `kept` |  |
+| `nomarchy-theme-bg-install` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-theme-bg-next` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-wallpaper, +1 more | `kept` |  |
 | `nomarchy-theme-bg-set` | `themes/engine/scripts` | core/home/config/nomarchy/default/elephant/nomarchy_background_selector.lua,features/scripts/utils/nomarchy-wallpaper | `kept` |  |
-| `nomarchy-theme-current` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-theme-current` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,themes/engine/scripts/nomarchy-theme-next | `kept` |  |
 | `nomarchy-theme-install` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
-| `nomarchy-theme-list` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-theme, +1 more | `kept` |  |
-| `nomarchy-theme-refresh` | `themes/engine/scripts` | — | `unused?` |  |
-| `nomarchy-theme-remove` | `themes/engine/scripts` | — | `unused?` |  |
-| `nomarchy-theme-set` | `themes/engine/scripts` | core/home/config/nomarchy/default/elephant/nomarchy_themes.lua,core/home/config/nomarchy-skill/SKILL.md, +8 more | `kept` |  |
+| `nomarchy-theme-list` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-theme, +2 more | `kept` |  |
+| `nomarchy-theme-next` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-theme-refresh` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-theme-remove` | `themes/engine/scripts` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-theme-set` | `themes/engine/scripts` | core/home/config/nomarchy/default/elephant/nomarchy_themes.lua,core/home/config/nomarchy-skill/SKILL.md, +9 more | `kept` |  |
 | `nomarchy-theme-set-keyboard` | `themes/engine/scripts` | features/scripts/utils/nomarchy-on-boot | `kept` |  |
 | `nomarchy-theme-set-keyboard-asus-rog` | `themes/engine/scripts` | features/scripts/utils/nomarchy-on-boot,themes/engine/scripts/nomarchy-theme-set-keyboard | `kept` |  |
 | `nomarchy-theme-set-keyboard-f16` | `themes/engine/scripts` | features/scripts/utils/nomarchy-on-boot,themes/engine/scripts/nomarchy-theme-set-keyboard | `kept` |  |
@@ -167,37 +158,35 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-theme-set-templates` | `themes/engine/scripts` | themes/engine/scripts/nomarchy-theme-set | `kept` |  |
 | `nomarchy-themes-prebuild` | `themes/engine/scripts` | installer/install.sh | `kept` |  |
 | `nomarchy-theme-update` | `themes/engine/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-toggle-hybrid-gpu` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
+| `nomarchy-toggle-hybrid-gpu` | `core/system/scripts` | features/scripts/utils/nomarchy-menu,features/scripts/utils/nomarchy-sys-update, +1 more | `kept` |  |
 | `nomarchy-toggle-idle` | `core/system/scripts` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/waybar/config/config.jsonc, +2 more | `kept` |  |
 | `nomarchy-toggle-nightlight` | `themes/engine/scripts` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy-skill/SKILL.md, +1 more | `kept` |  |
 | `nomarchy-toggle-notification-silencing` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/waybar/config/config.jsonc, +1 more | `kept` |  |
 | `nomarchy-toggle-screensaver` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-toggle-suspend` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-toggle-waybar` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy-skill/SKILL.md, +1 more | `kept` |  |
-| `nomarchy-tui-install` | `features/scripts/utils` | features/scripts/utils/nomarchy-tui-remove-all | `kept` |  |
-| `nomarchy-tui-remove` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-tui-remove-all` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-tz-select` | `core/system/scripts` | features/desktop/waybar/config/config.jsonc,features/scripts/utils/nomarchy-menu | `kept` |  |
-| `nomarchy-update` | `core/system/scripts` | core/home/config/nomarchy/default/mako/core.ini,core/home/config/nomarchy-skill/SKILL.md, +4 more | `kept` |  |
+| `nomarchy-tui-install` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-tui-remove-all | `kept` |  |
+| `nomarchy-tui-remove` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-tui-remove-all` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-tz-select` | `core/system/scripts` | features/desktop/waybar/config/config.jsonc,features/scripts/utils/nomarchy-menu, +2 more | `kept` |  |
+| `nomarchy-update` | `core/system/scripts` | core/home/config/nomarchy/default/mako/core.ini,core/home/config/nomarchy-skill/SKILL.md, +3 more | `kept` |  |
 | `nomarchy-update-available` | `features/scripts/utils` | features/desktop/waybar/config/config.jsonc,features/desktop/waybar/themes/summer-night/config.jsonc | `kept` |  |
 | `nomarchy-update-firmware` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-update-time` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-upload-log` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-debug | `kept` |  |
-| `nomarchy-version` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-debug, +1 more | `kept` |  |
+| `nomarchy-version` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-debug | `kept` |  |
 | `nomarchy-voxtype-config` | `features/scripts/utils` | features/desktop/waybar/config/config.jsonc,features/desktop/waybar/themes/summer-night/config.jsonc | `kept` |  |
-| `nomarchy-voxtype-install` | `features/scripts/utils` | — | `unused?` |  |
+| `nomarchy-voxtype-install` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-voxtype-model` | `features/scripts/utils` | features/desktop/waybar/config/config.jsonc,features/desktop/waybar/themes/summer-night/config.jsonc | `kept` |  |
-| `nomarchy-voxtype-remove` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-voxtype-status` | `features/scripts/utils` | features/desktop/waybar/config/config.jsonc,features/desktop/waybar/themes/summer-night/config.jsonc | `kept` |  |
+| `nomarchy-voxtype-remove` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-voxtype-status` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/desktop/waybar/config/config.jsonc, +1 more | `kept` |  |
 | `nomarchy-wallpaper` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/hypr/autostart.conf, +2 more | `kept` |  |
-| `nomarchy-webapp-handler-hey` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-webapp-handler-zoom` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-webapp-install` | `features/scripts/utils` | features/scripts/utils/nomarchy-webapp-remove-all | `kept` |  |
-| `nomarchy-webapp-remove` | `features/scripts/utils` | — | `unused?` |  |
-| `nomarchy-webapp-remove-all` | `features/scripts/utils` | — | `unused?` |  |
+| `nomarchy-webapp-install` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-webapp-remove-all | `kept` |  |
+| `nomarchy-webapp-remove` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-webapp-remove-all` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-welcome` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/autostart.conf | `kept` |  |
-| `nomarchy-wifi-powersave` | `core/system/scripts` | — | `unused?` |  |
-| `nomarchy-windows-vm` | `features/scripts/utils` | — | `unused?` |  |
+| `nomarchy-wifi-powersave` | `core/system/scripts` | features/scripts/utils/nomarchy-sys-update,installer/install.sh | `kept` |  |
+| `nomarchy-windows-vm` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |

 ## Missing references

@@ -205,21 +194,6 @@ Tokens grepped from `core/`, `features/`, `themes/`, `installer/`, `hosts/`, `bi

 | Token | Referenced in | Status |
 | --- | --- | --- |
-| `nomarchy-dev` | core/home/config/nomarchy-skill/SKILL.md | `missing` |
-| `nomarchy-dryrun` | installer/install.sh | `missing` |
-| `nomarchy-installer` | features/scripts/utils/nomarchy-build-iso,README.md | `missing` |
-| `nomarchy-live` | features/scripts/utils/nomarchy-build-live-iso,features/scripts/utils/nomarchy-test-live-iso | `missing` |
-| `nomarchy-luks` | installer/disko-config.nix,installer/install.sh | `missing` |
-| `nomarchy-menu-rows` | bin/utils/nomarchy-docs-scripts,features/scripts/utils/nomarchy-docs-scripts | `missing` |
-| `nomarchy-nopasswd` | core/system/scripts/nomarchy-sudo-passwordless-toggle | `missing` |
-| `nomarchy-nopasswd-expire` | core/system/scripts/nomarchy-sudo-passwordless-toggle | `missing` |
-| `nomarchy-plymouth` | themes/engine/plymouth.nix | `missing` |
-| `nomarchy-screenrecord-filename` | features/scripts/utils/nomarchy-cmd-screenrecord | `missing` |
-| `nomarchy-sddm-theme` | themes/engine/sddm.nix | `missing` |
-| `nomarchy-theme-next` | core/home/config/nomarchy-skill/SKILL.md | `missing` |
-| `nomarchy-themes-no-images` | themes/engine/files.nix | `missing` |
-| `nomarchy-vm` | features/scripts/utils/nomarchy-test-vm | `missing` |
-| `nomarchy-windows` | features/scripts/utils/nomarchy-windows-vm | `missing` |

 ## Menu items

--- a/docs/STRUCTURE.md
+++ b/docs/STRUCTURE.md
@@ -125,7 +125,6 @@ The `lib/` directory provides centralized logic and data structures to maintain
 ### `installer/` (Bootstrap)
 - **`install.sh`**: The interactive TTY-based installer. It handles disk partitioning, NixOS installation, and generating a clean "Downstream" flake for the user.
 - **`disko-config.nix`**: The disko partition layout (BTRFS on top of LUKS2). A Nix function of `{ mainDrive, extraDrives ? [] }` — single-disk path is `extraDrives = []`; multi-disk adds BTRFS `-d single -m raid1` across the extras. Invoked by `install.sh` via `disko --argstr mainDrive … --arg extraDrives '[…]'`.
- **`disko-btrfs-luks.nix`**: A simpler reference layout for disk management (not used by the installer).

 ### `hosts/` (Targets)
 - **`nomarchy-installer.nix`**: Configuration for the minimal, TTY-based installation ISO.
--- a/features/scripts/utils/nomarchy-config-direct-boot
+++ b/features/scripts/utils/nomarchy-config-direct-boot
@@ -1,46 +0,0 @@
-#!/bin/bash
-set -e
-
-# Add an EFI boot entry for the Nomarchy UKI, allowing the system to boot directly
-# without a bootloader like Limine. Requires UEFI firmware and a built UKI.
-
-if [[ ! -d /sys/firmware/efi ]]; then
-  echo "Error: System is not booted in UEFI mode" >&2
-  exit 1
-fi
-
-if ! efibootmgr &>/dev/null; then
-  echo "Error: efibootmgr is not available or not functional" >&2
-  exit 1
-fi
-
-if cat /sys/class/dmi/id/bios_vendor 2>/dev/null | grep -qi "American Megatrends"; then
-  echo "Error: American Megatrends firmware may not safely support custom EFI entries" >&2
-  exit 1
-fi
-
-if cat /sys/class/dmi/id/bios_vendor 2>/dev/null | grep -qi "Apple"; then
-  echo "Error: Apple firmware uses its own boot manager" >&2
-  exit 1
-fi
-
-uki_file=$(find /boot/EFI/Linux/ -name "nomarchy*.efi" -printf "%f\n" 2>/dev/null | head -1)
-
-if [[ -z $uki_file ]]; then
-  echo "Error: No Nomarchy UKI found in /boot/EFI/Linux/" >&2
-  exit 1
-fi
-
-boot_source=$(findmnt -n -o SOURCE /boot)
-disk=$(echo "$boot_source" | sed 's/p\?[0-9]*$//')
-part=$(echo "$boot_source" | grep -o 'p\?[0-9]*$' | sed 's/^p//')
-
-if gum confirm "Setup direct boot (so snapshot booting must be done via bios)?"; then
-  echo "Creating EFI boot entry for $uki_file"
-
-  sudo efibootmgr --create \
-    --disk "$disk" \
-    --part "$part" \
-    --label "Nomarchy" \
-    --loader "\\EFI\\Linux\\$uki_file"
-fi
--- a/features/scripts/utils/nomarchy-docs-scripts
+++ b/features/scripts/utils/nomarchy-docs-scripts
@@ -82,10 +82,32 @@ ref_files_per_cmd() {
 # Final char must be alphanumeric — dropping trailing-dash matches like
 # `nomarchy-pkg-` that come from glob references (`for c in nomarchy-pkg-*`).
 # Restrict to grep_includes so binaries / tmpfiles don't pollute the set.
-all_refs=$(grep -rohE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
+# The middle `grep -vE` drops lines where `nomarchy-*` is a derivation /
+# tmp file / sudoers basename / systemd unit / flake output / docker
+# container identifier — not a shell invocation — so they don't show up
+# as fake "missing" references.
+all_refs=$(grep -rhE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
            "${grep_includes[@]}" \
            "${search_dirs[@]}" 2>/dev/null \
+          | grep -vE \
+              -e '(pname|name)[[:space:]]*=[[:space:]]*"nomarchy-' \
+              -e '/tmp/nomarchy-' \
+              -e '/etc/sudoers\.d/[^"[:space:]]*nomarchy-' \
+              -e 'nixosConfigurations\.nomarchy-' \
+              -e 'packages\.[^.]+\.nomarchy-' \
+              -e '\./result/bin/run-nomarchy-' \
+              -e 'mktemp[[:space:]]+[^|]*-t[[:space:]]+nomarchy-' \
+              -e '(TIMER_NAME|NOPASSWD_FILE|UNIT_NAME)=.*nomarchy-' \
+              -e 'docker[[:space:]]+[^|]*nomarchy-' \
+          | grep -oE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
+          | grep -vE '^(nomarchy-plymouth|nomarchy-sddm-theme|nomarchy-live|nomarchy-rev|nomarchy-windows)$' \
          | sort -u)
+# The token-level denylist above covers identifiers whose ambiguity survives
+# the line filter: `nomarchy-plymouth` / `nomarchy-sddm-theme` are Nix
+# derivation names referenced as bare idents in `[...]` lists,
+# `nomarchy-live` is an ISO label that shows up in comments, `nomarchy-rev`
+# is `/etc/nomarchy-rev` (a file written by the ISO), and
+# `nomarchy-windows` is a docker container name in compose heredocs.

 # --- Render: header --------------------------------------------------------

--- a/features/scripts/utils/nomarchy-migrate-state
+++ b/features/scripts/utils/nomarchy-migrate-state
@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-# Nomarchy State Migration Script
-# Migrates state from old locations to unified ~/.config/nomarchy/state.json
-
-set -e
-
-NEW_STATE_DIR="$HOME/.config/nomarchy"
-NEW_STATE_FILE="$NEW_STATE_DIR/state.json"
-OLD_HOME_STATE="$HOME/.config/home-manager/state.json"
-OLD_SYSTEM_STATE="/etc/nixos/state.json"
-
-mkdir -p "$NEW_STATE_DIR"
-
-# Initialize new state file if it doesn't exist
-if [[ ! -f "$NEW_STATE_FILE" ]]; then
-    echo "{}" > "$NEW_STATE_FILE"
-fi
-
-# Function to safely merge JSON
-merge_json() {
-    local source="$1"
-    if [[ -f "$source" ]]; then
-        echo "Migrating from $source..."
-        TMP_FILE=$(mktemp)
-        # Merge source into new state (new state values take precedence if conflict)
-        jq -s '.[0] * .[1]' "$source" "$NEW_STATE_FILE" > "$TMP_FILE" && mv "$TMP_FILE" "$NEW_STATE_FILE"
-    fi
-}
-
-# Migrate old home-manager state
-if [[ -f "$OLD_HOME_STATE" ]] && [[ "$OLD_HOME_STATE" != "$NEW_STATE_FILE" ]]; then
-    merge_json "$OLD_HOME_STATE"
-    echo "Old home state migrated. You can remove: $OLD_HOME_STATE"
-fi
-
-# Check if system state exists and user wants to sync it
-if [[ -f "$OLD_SYSTEM_STATE" ]]; then
-    echo ""
-    echo "System state found at $OLD_SYSTEM_STATE"
-    echo "Note: System state will continue to be read from /etc/nixos/state.json"
-    echo "      for system-level NixOS configuration."
-fi
-
-# Run the preflight migration for any legacy formats
-if command -v nomarchy-preflight-migration &> /dev/null; then
-    nomarchy-preflight-migration
-fi
-
-echo ""
-echo "Migration complete!"
-echo "New state location: $NEW_STATE_FILE"
-echo ""
-echo "Current state:"
-jq '.' "$NEW_STATE_FILE"
--- a/features/scripts/utils/nomarchy-npx-install
+++ b/features/scripts/utils/nomarchy-npx-install
@@ -1,25 +0,0 @@
-#!/bin/bash
-set -e
-
-# Install an npx wrapper for a given npm package.
-# Usage: nomarchy-npx-install <package> [command-name]
-#
-# If command-name is omitted, it defaults to the package name.
-# Example: nomarchy-npx-install opencode-ai opencode
-
-if [[ -z $1 ]]; then
-  echo "Usage: nomarchy-npx-install <package> [command-name]"
-  exit 1
-fi
-
-package=$1
-command=${2:-$1}
-
-mkdir -p "$HOME/.local/bin"
-
-cat > "$HOME/.local/bin/$command" <<EOF
-#!/bin/bash
-exec npx --yes $package "\$@"
-EOF
-
-chmod +x "$HOME/.local/bin/$command"
--- a/features/scripts/utils/nomarchy-restart-hyprctl
+++ b/features/scripts/utils/nomarchy-restart-hyprctl
@@ -1,6 +0,0 @@
-#!/bin/bash
-set -e
-
-# Reload hyprland configuration (used by the Nomarchy theme switching).
-
-hyprctl reload >/dev/null
--- a/features/scripts/utils/nomarchy-restart-mako
+++ b/features/scripts/utils/nomarchy-restart-mako
@@ -1,6 +0,0 @@
-#!/bin/bash
-set -e
-
-# Reload mako configuration (used by the Nomarchy theme switching).
-
-makoctl reload
--- a/features/scripts/utils/nomarchy-restart-tmux
+++ b/features/scripts/utils/nomarchy-restart-tmux
@@ -1,8 +0,0 @@
-#!/bin/bash
-set -e
-
-# Restart tmux if running with the latest configuration
-
-if pgrep -x tmux; then
-  tmux source-file ~/.config/tmux/tmux.conf
-fi
--- a/features/scripts/utils/nomarchy-rollback
+++ b/features/scripts/utils/nomarchy-rollback
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-# Nomarchy Rollback Script
-# Reverts the system to a previous working generation.
-
-set -e
-
-if command -v snapper &>/dev/null; then
-    echo "BTRFS Snapper detected. Listing snapshots..."
-    sudo snapper list
-    echo ""
-    echo "To rollback to a specific snapshot, run: sudo snapper rollback <number>"
-    echo "Or to rollback the current NixOS generation only:"
-fi
-
-echo "Rolling back NixOS generation..."
-sudo nixos-rebuild rollback
-
-echo "Rollback complete. Please reboot if you performed a BTRFS rollback."
--- a/features/scripts/utils/nomarchy-snapshot
+++ b/features/scripts/utils/nomarchy-snapshot
@@ -1,33 +0,0 @@
-#!/bin/bash
-
-set -e
-
-COMMAND="$1"
-
-if [[ -z $COMMAND ]]; then
-  echo "Usage: nomarchy-snapshot <create|restore>" >&2
-  exit 1
-fi
-
-if ! command -v snapper &>/dev/null; then
-  exit 127 # nomarchy-update can use this to just ignore if snapper is not available
-fi
-
-case "$COMMAND" in
-create)
-  DESC="$(nomarchy-version)"
-
-  echo -e "\e[32mCreate system snapshot\e[0m"
-
-  # Get existing snapper config names from CSV output
-  mapfile -t CONFIGS < <(sudo snapper --csvout list-configs | awk -F, 'NR>1 {print $1}')
-
-  for config in "${CONFIGS[@]}"; do
-    sudo snapper -c "$config" create -c number -d "$DESC"
-  done
-  echo
-  ;;
-restore)
-  sudo limine-snapper-restore
-  ;;
-esac
--- a/features/scripts/utils/nomarchy-sys-update
+++ b/features/scripts/utils/nomarchy-sys-update
@@ -15,8 +15,20 @@ else
    exit 1
 fi

-# Apply NixOS changes from the local flake
-echo "Applying system-level changes from $REPO_DIR..."
-sudo nixos-rebuild switch --flake "$REPO_DIR#default" --impure
+# The installer generates `nixosConfigurations.<hostname>` (see
+# installer/install.sh: `nixosConfigurations.$HOSTNAME`), so the flake target
+# must match the current host. The previous `#default` literal worked only
+# for a development host that happened to be named "default" and silently
+# broke every toggle script (nomarchy-tz-select, nomarchy-wifi-powersave,
+# nomarchy-setup-{dns,fido2,fingerprint}, nomarchy-toggle-hybrid-gpu) on a
+# real install.
+HOSTNAME_ATTR=$(hostname)
+if [ -z "$HOSTNAME_ATTR" ]; then
+    echo "Error: could not determine hostname for flake attribute." >&2
+    exit 1
+fi
+
+echo "Applying system-level changes from $REPO_DIR#$HOSTNAME_ATTR..."
+sudo nixos-rebuild switch --flake "$REPO_DIR#$HOSTNAME_ATTR"

 echo "System update complete."
--- a/features/scripts/utils/nomarchy-webapp-handler-hey
+++ b/features/scripts/utils/nomarchy-webapp-handler-hey
@@ -1,12 +0,0 @@
-#!/bin/bash
-set -e
-url="$1"
-web_url="https://app.hey.com"
-
-# Handle mailto: URLs
-if [[ $url =~ ^mailto: ]]; then
-  email=$(echo "$url" | sed 's/mailto://')
-  web_url="https://app.hey.com/messages/new?to=$email"
-fi
-
-exec nomarchy-launch-webapp "$web_url"
--- a/features/scripts/utils/nomarchy-webapp-handler-zoom
+++ b/features/scripts/utils/nomarchy-webapp-handler-zoom
@@ -1,21 +0,0 @@
-#!/bin/bash
-set -e
-
-url="$1"
-web_url="https://app.zoom.us/wc/home"
-
-if [[ $url =~ ^zoom(mtg|us):// ]]; then
-  confno=$(echo "$url" | sed -n 's/.*[?&]confno=\([^&]*\).*/\1/p')
-
-  if [[ -n $confno ]]; then
-    pwd=$(echo "$url" | sed -n 's/.*[?&]pwd=\([^&]*\).*/\1/p')
-
-    if [[ -n $pwd ]]; then
-      web_url="https://app.zoom.us/wc/join/$confno?pwd=$pwd"
-    else
-      web_url="https://app.zoom.us/wc/join/$confno"
-    fi
-  fi
-fi
-
-exec nomarchy-launch-webapp "$web_url"
--- a/hosts/nomarchy-live.nix
+++ b/hosts/nomarchy-live.nix
@@ -22,6 +22,7 @@
    parted
    btrfs-progs
    cryptsetup
+    mkpasswd
    inputs.disko.packages.${pkgs.stdenv.hostPlatform.system}.disko
    (pkgs.makeDesktopItem {
      name = "install-nomarchy";
@@ -64,6 +65,15 @@

  environment.etc."nomarchy".source = inputs.self;

+  # Embed the git revision the ISO was built from so install.sh can pin the
+  # generated flake to the exact same commit. `inputs.self.rev` exists only
+  # when the flake is built from a clean git tree; from a dirty worktree we
+  # fall back to dirtyRev (which won't be resolvable by `git+https`, so the
+  # installer treats it as "unpinned"). Empty file = unpinned.
+  environment.etc."nomarchy-rev".text =
+    if inputs.self ? rev then inputs.self.rev
+    else "";
+
  # Auto-login to the graphical session
  services.displayManager.autoLogin.enable = true;
  services.displayManager.autoLogin.user = "nixos";
--- a/installer/disko-btrfs-luks.nix
+++ b/installer/disko-btrfs-luks.nix
@@ -1,68 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        device = "@TARGET_DRIVE@";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              priority = 1;
-              name = "ESP";
-              start = "1M";
-              end = "512M";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "crypted";
-                settings.allowDiscards = true;
-                content = {
-                  type = "btrfs";
-                  extraArgs = [ "-f" ];
-                  subvolumes = {
-                    "@" = {
-                      mountpoint = "/";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "@persist" = {
-                      mountpoint = "/persist";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "@home" = {
-                      mountpoint = "/home";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "@nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                    "@log" = {
-                      mountpoint = "/var/log";
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                    };
-                  };
-                  postCreateHook = ''
-                    MNTPOINT=$(mktemp -d)
-                    mount -t btrfs /dev/mapper/crypted $MNTPOINT
-                    btrfs subvolume snapshot -r $MNTPOINT/@ $MNTPOINT/root-blank
-                    umount $MNTPOINT
-                  '';
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}
--- a/installer/install.sh
+++ b/installer/install.sh
@@ -32,6 +32,7 @@ TARGET_DRIVE=""
 USERNAME=""
 LUKS_PASSWORD=""
 USER_PASSWORD=""
+USER_PASSWORD_HASH=""
 TIMEZONE="UTC"
 KEYMAP_LAYOUT=""
 KEYMAP_VARIANT=""
@@ -92,6 +93,14 @@ parse_args() {
 # Persist non-secret answers so an interrupted install can pick up where it
 # left off. Uses `declare -p` so each line is a self-contained `declare --`
 # statement that `source` re-establishes verbatim.
+#
+# USER_PASSWORD_HASH is intentionally NOT persisted, even though a SHA-512
+# crypt hash isn't reversible. The contract is: after --resume, the password
+# prompt re-runs. configure_user's early-return guard at the top of the
+# function checks `[[ -n "$USER_PASSWORD_HASH" ]]` for exactly this reason —
+# if you ever change that guard to skip on USERNAME+HOSTNAME alone, --resume
+# will silently install a system with an empty password hash and lock the
+# user out. Keep the guard checking the hash.
 save_state() {
    declare -p \
        TARGET_DRIVE USERNAME HOSTNAME TIMEZONE \
@@ -128,7 +137,7 @@ clear_step_state() {
    case "$1" in
        select_disk) TARGET_DRIVE="" ;;
        get_luks_passphrase) LUKS_PASSWORD="" ;;
-        configure_user) USERNAME=""; HOSTNAME=""; USER_PASSWORD="" ;;
+        configure_user) USERNAME=""; HOSTNAME=""; USER_PASSWORD=""; USER_PASSWORD_HASH="" ;;
        select_keymap_locale) KEYMAP_LAYOUT=""; KEYMAP_VARIANT=""; LOCALE="" ;;
        select_timezone) TIMEZONE="" ;;
        select_hardware) HARDWARE_MODULES=""; NOMARCHY_HW_OPTS="" ;;
@@ -206,13 +215,32 @@ check_environment() {
    # Capture the exact commit we're installing from. The generated flake
    # pins `nomarchy.url` to this revision so the installed system can't
    # silently drift onto a newer (possibly breaking) main.
-    if command -v git >/dev/null 2>&1 && [[ -d "$NOMARCHY_REPO/.git" ]]; then
+    #
+    # Three sources, in priority order:
+    #   1. /etc/nomarchy-rev — written at ISO build time from `inputs.self.rev`
+    #      (the only source that works on a normal live-ISO install, because
+    #      `inputs.self` strips .git from the Nix store copy at /etc/nomarchy).
+    #   2. `git rev-parse HEAD` in the repo — works when running the installer
+    #      from a dev checkout instead of the live ISO.
+    #   3. Empty → unpinned, user gets a loud confirmation prompt below.
+    if [[ -z "$NOMARCHY_REV" ]] && [[ -f /etc/nomarchy-rev ]]; then
+        NOMARCHY_REV=$(tr -d '[:space:]' < /etc/nomarchy-rev)
+    fi
+    if [[ -z "$NOMARCHY_REV" ]] && command -v git >/dev/null 2>&1 && [[ -d "$NOMARCHY_REPO/.git" ]]; then
        NOMARCHY_REV=$(git -C "$NOMARCHY_REPO" rev-parse HEAD 2>/dev/null || echo "")
    fi
    if [[ -n "$NOMARCHY_REV" ]]; then
        success "Pinning Nomarchy to $NOMARCHY_REV"
    else
-        info "Could not determine Nomarchy revision; downstream flake will track main."
+        error "Could not determine Nomarchy revision."
+        info  "The installed system would silently track upstream main, which"
+        info  "defeats the point of locking inputs at install time."
+        if [[ "$DRY_RUN" != "true" ]]; then
+            if ! nrun gum confirm --default=false \
+                "Continue anyway with an unpinned (tracking main) configuration?"; then
+                exit 1
+            fi
+        fi
    fi

    # Check internet
@@ -452,8 +480,8 @@ configure_user() {
    section "User Configuration"

    if [[ -n "$USERNAME" && -n "$HOSTNAME" ]]; then
-        # Password check skipped in dry run or if already set
-        if [[ "$DRY_RUN" == "true" ]] || [[ -n "$USER_PASSWORD" ]]; then
+        # Password check skipped in dry run or if already hashed in this session.
+        if [[ "$DRY_RUN" == "true" ]] || [[ -n "$USER_PASSWORD_HASH" ]]; then
            success "User $USERNAME @ $HOSTNAME configured"
            return 0
        fi
@@ -493,6 +521,9 @@ configure_user() {
    if [[ "$DRY_RUN" == "true" ]]; then
        info "Dry run: skipping user password prompt."
        USER_PASSWORD="dryrun-not-used"
+        # Stable placeholder hash so generated system.nix still parses as Nix.
+        # Never lands on a real install — dry-run skips nixos-install.
+        USER_PASSWORD_HASH='$6$dryrun$3xxK3aQ.0bGcv0fM2RhV4Q9oN3p1mYxz5kSjQ.bC8tZpZ7QnFv2cN0Yhd5lDqJ8X9mP2K1L0vR6BqWqzNk7Yo/'
        save_state
        return
    fi
@@ -521,6 +552,20 @@ configure_user() {
        fi
    done

+    # Hash now so we never have to embed the cleartext in /etc/nixos/system.nix
+    # (where it would be world-readable and break Nix parsing on quotes/backslash).
+    # mkpasswd is added to the live ISO via hosts/nomarchy-live.nix.
+    if ! command -v mkpasswd >/dev/null 2>&1; then
+        error "mkpasswd not found on the live ISO — cannot hash the user password."
+        exit 1
+    fi
+    USER_PASSWORD_HASH=$(printf '%s' "$USER_PASSWORD" | mkpasswd -m sha-512 -s)
+    if [[ -z "$USER_PASSWORD_HASH" ]]; then
+        error "mkpasswd produced an empty hash."
+        exit 1
+    fi
+    unset pass1 pass2 USER_PASSWORD
+
    success "User password set"
    save_state
 }
@@ -1346,9 +1391,17 @@ EOF
 # ============================================================================

 generate_flake_config() {
+    # Impermanence must mount the same /dev/mapper name that disko created.
+    # disko-config.nix uses "crypted" for single-disk and "crypted_main" once
+    # extraDrives is non-empty — keep these in sync.
    local impermanence_opt=""
    if [[ "$ENABLE_IMPERMANENCE" == "true" ]]; then
-        impermanence_opt="nomarchy.system.impermanence.enable = true;"
+        local _main_luks_name="crypted"
+        local _drives=($TARGET_DRIVE)
+        if (( ${#_drives[@]} > 1 )); then
+            _main_luks_name="crypted_main"
+        fi
+        impermanence_opt=$'nomarchy.system.impermanence.enable = true;\n  nomarchy.system.impermanence.mainLuksName = "'"$_main_luks_name"$'";'
    fi

    local PROFILE_SYSTEM_OPTS=""
@@ -1534,7 +1587,9 @@ $xkb_variant_line

  users.users."$USERNAME" = {
    isNormalUser = true;
-    initialPassword = "$USER_PASSWORD";
+    # SHA-512 crypt hash generated by mkpasswd during install. Cleartext
+    # never touches /etc/nixos. Change later with \`passwd\`.
+    initialHashedPassword = "$USER_PASSWORD_HASH";
    extraGroups = [ "networkmanager" "wheel" "video" "audio" "render" ];
  };

@@ -1685,6 +1740,31 @@ EOF
  # Extra Home Manager modules go here (program configs, services, etc.).
 }
 EOF
+
+    # state.json — consumed by core/system/state.nix at every nixos-rebuild and
+    # mutated by toggle scripts (nomarchy-tz-select, nomarchy-setup-fido2,
+    # nomarchy-toggle-hybrid-gpu, nomarchy-wifi-powersave, ...). Those scripts
+    # `jq` the file in place and fail hard if it doesn't exist or isn't valid
+    # JSON, so a fresh install MUST ship one. Shape must match lib/state-schema.nix.
+    # Quoted heredoc — no shell expansion except the explicit $TIMEZONE below.
+    local _state_tz="${TIMEZONE:-UTC}"
+    cat > /mnt/etc/nixos/state.json <<JSON_EOF
+{
+  "theme": "nord",
+  "timezone": "${_state_tz}",
+  "dns": "DHCP",
+  "customDns": [],
+  "wifi": {
+    "powersave": true
+  },
+  "features": {
+    "fingerprint": false,
+    "fido2": false,
+    "hybridGPU": false,
+    "makima": false
+  }
+}
+JSON_EOF
 }

 # ============================================================================
@@ -1712,8 +1792,18 @@ finish() {
    echo "     variant. Theme switches after that are instant (no rebuild)."
    echo ""

+    # Unmount /mnt before either reboot or returning to the live shell:
+    #   - Reboot: clean unmount avoids dirty BTRFS, which would otherwise
+    #     force a longer first-boot fsck/replay.
+    #   - Decline: leaving /mnt mounted blocks a second `install.sh` run on
+    #     the same live ISO (disko refuses to wipe a busy device).
+    # `-R` recursively unmounts /mnt/boot, /mnt/home, /mnt/nix, etc.; the
+    # `|| true` absorbs the case where /mnt was already torn down.
    if nrun gum confirm "Reboot now?"; then
+        umount -R /mnt 2>/dev/null || true
        reboot
+    else
+        umount -R /mnt 2>/dev/null || true
    fi
 }

--- a/themes/engine/scripts/nomarchy-theme-next
+++ b/themes/engine/scripts/nomarchy-theme-next
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+# Cycles to the next available theme (wraps from last back to first).
+
+mapfile -t THEMES < <(nomarchy-theme-list)
+TOTAL=${#THEMES[@]}
+
+if (( TOTAL == 0 )); then
+  notify-send "No themes available"
+  exit 1
+fi
+
+CURRENT=$(nomarchy-theme-current)
+INDEX=-1
+for i in "${!THEMES[@]}"; do
+  if [[ "${THEMES[$i]}" == "$CURRENT" ]]; then
+    INDEX=$i
+    break
+  fi
+done
+
+NEXT_INDEX=$(((INDEX + 1) % TOTAL))
+nomarchy-theme-set "${THEMES[$NEXT_INDEX]}"
Author	SHA1	Message	Date
Bernardo Magri	46738c3663	chore(audit): final Phase B batch — close out unused? cluster Pillar 3 Phase B, batch 4 (final). Triages the last 13 `unused?` rows: five deletes and eight SKILL.md surfacings. Deleted (no callers anywhere, work duplicated inline or marginal value): - `nomarchy-restart-hyprctl` and `nomarchy-restart-mako`: stale comments claimed "used by theme switching" but no Nomarchy script calls them. Theme-set and refresh paths call `hyprctl reload` / `makoctl reload` directly (see nomarchy-refresh-hyprland). - `nomarchy-restart-tmux`: 3-line pgrep+source-file wrapper. Users can `tmux source-file ~/.config/tmux/tmux.conf` themselves. - `nomarchy-battery-present`: the battery monitor reads `/sys/class/power_supply/BAT` inline; the helper never got wired in. - `nomarchy-sudo-keepalive`: intended to be `source`d from longer-running scripts (nomarchy-update, etc.) but nothing sources it. Resurrect from git history if a future caller actually needs it. Surfaced in SKILL.md (now tagged `kept` by the audit): - Themes: `nomarchy-theme-{remove,refresh,bg-install}` - System: `nomarchy-sudo-{passwordless-toggle,reset}`, `nomarchy-restart-trackpad` (intel_quicki2c THC reload — a real laptop bug fix worth documenting) - New Virtualization section: `nomarchy-windows-vm {install,launch,stop,status}` - Enriched Troubleshooting's generic `nomarchy-refresh-<app>` example with literal `nomarchy-refresh-fastfetch` so the audit catches it. Verified `nix flake check --no-build` still passes and zero callers reference the deleted scripts. Phase B is now complete.* Final audit state: 164 → 159 scripts, all tagged `kept`, `unused?` = 0, missing references = 0. The audit table is now a clean reference of what Nomarchy ships, not a triage backlog. Logged in `docs/ROADMAP.md` Shipped. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 17:19:57 +01:00
Bernardo Magri	9be4363f4b	chore(audit): triage webapp/tui/voxtype install-remove pairs Pillar 3 Phase B, batch 3 — Batch A of the unused? clusters. Deleted two dead webapp URI handlers: - `nomarchy-webapp-handler-hey` - `nomarchy-webapp-handler-zoom` Neither was registered as a MimeType handler anywhere — a grep across `*.desktop` files in `core/`, `features/`, `themes/`, `installer/`, and `hosts/` returned zero matches. Without a `.desktop` registration the system never routes `mailto:`/`zoom:`/`zoomus:` URIs to them, so the handlers were unreachable code. Kept the six remaining install/remove pairs (they're real CLI tools, just unwired into any menu) and surfaced them in `SKILL.md` "Common Tasks" so AI assistants can discover them on user request and the audit tags them `kept`: - Custom App Launchers: webapp-{install,remove,remove-all}, tui-{install,remove,remove-all} - Voice dictation: voxtype-{install,remove,status} Menu-wiring these (e.g. a "Setup → Apps" submenu in nomarchy-menu) is a separate Pillar 6 onboarding job, not scoped here. Regenerated `docs/SCRIPTS.md` — script count 166 → 164, `unused?` 21 → 13. Logged in `docs/ROADMAP.md` Shipped. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 17:13:39 +01:00
Bernardo Magri	f93eb7435f	chore(audit): delete NixOS-irrelevant Omarchy port scripts Pillar 3 Phase B, batch 2. Five `unused?` scripts that either duplicate NixOS-native facilities or reference infrastructure Nomarchy doesn't ship. All five had no callers anywhere in the tree. - `nomarchy-rollback`: ran `nixos-rebuild rollback` after listing `snapper` snapshots. NixOS already exposes the previous generation in the boot menu and `nixos-rebuild --rollback`; Nomarchy uses impermanence, not snapper. - `nomarchy-snapshot`: wrapped `snapper create/restore`. Same reason — snapper isn't part of Nomarchy. The script's "nomarchy-update can use this" comment never came true; nomarchy-update has no reference to it. - `nomarchy-migrate-state`: one-time migration from old `~/.config/home-manager/state.json` and `/etc/nixos/state.json` to the unified `~/.config/nomarchy/state.json`. The installer now seeds the unified file directly; no current install needs the migration. - `nomarchy-config-direct-boot`: added an EFI boot entry for a Nomarchy UKI. We don't build a UKI (no references anywhere in `core/` or `hosts/`), so the script targeted nonexistent infrastructure. - `nomarchy-npx-install`: generated npx wrappers in `~/.local/bin/`. An Arch idiom — on NixOS the path is `nix-shell -p nodejs` or a declarative `home.packages` entry. Kept `nomarchy-build-iso` and `nomarchy-build-live-iso` (the user-flagged useful build wrappers) and surfaced them in README §2 in place of the raw `nix build` command, which both removes the audit's `unused?` flag on them and shortens the docs. Regenerated docs/SCRIPTS.md (171 → 166 scripts; 28 `unused?` → 21). Logged in docs/ROADMAP.md Shipped. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 17:08:09 +01:00
Bernardo Magri	6b2c678669	chore: switch default theme from summer-night to nord Both the system option (`core/system/options.nix:theme`) and the home-side state evaluator (`core/home/state.nix`) defaulted to "summer-night". The installer-written state.json now seeds "nord" (see preceding installer commit), and `lib/state-schema.nix` already defaults to "nord". Align the hardcoded fallbacks here so a missing or blank state file lands on the same theme everywhere instead of a now-inconsistent split. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 17:01:29 +01:00
Bernardo Magri	ac4d66e54d	fix: nomarchy-sys-update targets actual hostname, not '#default' The installer generates `nixosConfigurations.<hostname>` (see installer/install.sh: `nixosConfigurations.$HOSTNAME`), but the system update script was rebuilding `.#default` and using `--impure`. The `#default` literal worked only on dev hosts that happened to be named "default" and silently broke every toggle script on real installs. Now resolves `$(hostname)` at runtime and aborts with a clear error if empty. Dropped `--impure` — the flake doesn't need it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 17:01:22 +01:00
Bernardo Magri	098cd42ac8	fix(installer): harden multi-disk LUKS, password handling, revision pinning Several installer reliability fixes that were left uncommitted: - Impermanence + multi-disk LUKS: disko-config.nix names the main LUKS mapping `crypted` for single-disk and `crypted_main` once extraDrives is non-empty. The impermanence rollback hook used to hardcode `crypted`, which made every multi-disk install fail to mount root in initrd. Added a `nomarchy.system.impermanence.mainLuksName` option and wired the installer to write the correct value into the generated system.nix based on the drive count. - Password no longer cleartext in /etc/nixos: installer now hashes the user password with `mkpasswd -m sha-512` and emits `initialHashedPassword` instead of `initialPassword`. Added mkpasswd to the live ISO. Cleartext is unset immediately after hashing. USER_PASSWORD_HASH is deliberately not persisted in --resume state — configure_user re-prompts on resume. - Revision pinning that actually works on the live ISO: `inputs.self` strips .git in the Nix store copy, so `git rev-parse HEAD` would silently return empty on a real install and the generated flake would track main. Live ISO now writes `/etc/nomarchy-rev` from `inputs.self.rev` at build time; install.sh reads it first, falls back to git, and aborts with a loud confirmation prompt if both are empty (instead of silently installing an unpinned system). - Generated `/mnt/etc/nixos/state.json`: toggle scripts (nomarchy-tz-select, nomarchy-setup-{fido2,fingerprint}, nomarchy-toggle-hybrid-gpu, nomarchy-wifi-powersave) `jq` this file in place and fail hard if it doesn't exist. Fresh installs now ship a schema-conformant file matching lib/state-schema.nix. - Unmount /mnt before exiting `finish()` regardless of reboot choice. Clean unmount avoids dirty BTRFS on reboot; on "no", leaving /mnt mounted blocked a second installer run on the same live ISO. - Removed obsolete `installer/disko-btrfs-luks.nix` (superseded by `disko-config.nix` per commit `3aadc36`) and dropped its dangling `docs/STRUCTURE.md` reference. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 17:01:15 +01:00
Bernardo Magri	158ae308cc	fix(audit): close all missing-references rows in script audit The audit's "missing references" table held 15 rows — 2 real doc bugs and 13 grep false-positives — making Pillar 3 Phase B triage noisier than it needed to be. - Wrote themes/engine/scripts/nomarchy-theme-next so SKILL.md's documented "cycle to next theme" command actually resolves. - Scrubbed three stale `nomarchy-dev-` references from SKILL.md (skill frontmatter, body, and Out-of-Scope list) — they hallucinated a workflow that doesn't exist and broke AI-assisted use of the skill. - Added a line-context filter to both nomarchy-docs-scripts generators that drops `nomarchy-` tokens appearing in Nix pname/derivation idents, /tmp/ and /etc/sudoers.d/ paths, nixosConfigurations.* / packages.* flake outputs, mktemp -t prefixes, systemd unit vars, ./result/bin/run- binaries, and docker container references. - Added a small token-level denylist for five residual non-script identifiers (nomarchy-plymouth, nomarchy-sddm-theme, nomarchy-live, nomarchy-rev, nomarchy-windows) that survive line filtering because they appear as bare Nix list refs, comment backticks, or compose-heredoc identifiers. Regenerated docs/SCRIPTS.md; the "Missing references" section is now empty. Logged in docs/ROADMAP.md Shipped. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-18 16:58:54 +01:00