feat(installer): add software-profile multi-select

- Add select_profiles step with gum choose --no-limit
- Implement state persistence and review for selected profiles
- Map profiles to home.packages and system-level toggles (Docker, Steam)
- Update generate_flake_config to emit profile-specific Nix snippets
- Fix duplicate environment.systemPackages in virtualization.nix
- Update ROADMAP.md

core/system/options.nix

@@ -96,6 +96,12 @@
           `libvirtd` group.
         '';
       };
+      docker = {
+        enable = lib.mkEnableOption ''
+          Docker daemon + docker-compose. The user must be in the `docker`
+          group.
+        '';
+      };
     };
 
     keyring = {

core/system/virtualization.nix

@@ -2,6 +2,7 @@
 
 let
   libvirt = config.nomarchy.system.virtualization.libvirt.enable;
+  docker = config.nomarchy.system.virtualization.docker.enable;
 in
 {
   # uwsm + Hyprland session — present on every Nomarchy install regardless
@@ -18,9 +19,18 @@ in
   # `nomarchy.system.virtualization.libvirt.enable = true;`. The user must
   # be in the `libvirtd` group to drive virsh / virt-manager.
   virtualisation.libvirtd.enable = lib.mkIf libvirt true;
-  environment.systemPackages = lib.mkIf libvirt (with pkgs; [
+
-    virt-manager
+  # Optional: Docker + docker-compose.
-    qemu
+  virtualisation.docker.enable = lib.mkIf docker true;
-    OVMF
+
-  ]);
+  environment.systemPackages = lib.mkMerge [
+    (lib.mkIf libvirt (with pkgs; [
+      virt-manager
+      qemu
+      OVMF
+    ]))
+    (lib.mkIf docker (with pkgs; [
+      docker-compose
+    ]))
+  ];
 }

docs/OPTIONS.md

@@ -75,6 +75,10 @@ Wired in `features/desktop/waybar/default.nix` (filters the battery widget out o
 
 `bool`, default `false`. libvirt daemon, virt-manager, and OVMF. Add your user to the `libvirtd` group.
 
+### `nomarchy.system.virtualization.docker.enable`
+
+`bool`, default `false`. Docker daemon and docker-compose. Add your user to the `docker` group.
+
 ### `nomarchy.system.keyring.enable`
 
 `bool`, default `true`. Auto-unlock GNOME Keyring at login and route SSH keys through `gcr-ssh-agent`. On by default — near-universal QoL improvement.
@@ -99,6 +103,10 @@ Wired in `features/desktop/waybar/default.nix` (filters the battery widget out o
 
 `bool`, default `false`. Framework laptop QMK HID udev rule.
 
+### `nomarchy.hardware.fwupd`
+
+`bool`, default `false`. Enables `services.fwupd` firmware update service.
+
 ### `nomarchy.hardware.hasIPU7Camera`
 
 `bool`, default `false`. Intel IPU7 camera support (kernel modules + firmware).

docs/ROADMAP.md

@@ -19,8 +19,6 @@ Guardrails (apply when adding anything):
 
 ### Now (ready to pick up)
 
-- **Software-profile multi-select in the installer.** Carryover from the old TODO. Add a `gum choose --no-limit` step in `installer/install.sh` (between hardware and impermanence) for opt-in profiles (Dev, Gaming, Office, Media, …). Each profile maps to a list of `home.packages` and optional `nomarchy.system.*` toggles emitted into the generated `home.nix`/`system.nix`.
-- **Audit Phase B (per-batch).** Phase A populated [`docs/SCRIPTS.md`](SCRIPTS.md) with 158 `kept`, 75 `missing`, and 45 `unused?` rows via the new `bin/utils/nomarchy-docs-scripts` generator. Phase B is the per-batch porting/removal: pick ~10 rows tagged `missing` or `unused?`, decide `port-from-omarchy` / `delete-dead` / `stub-with-notify`, and ship as one PR per batch.
 - **Form-factor → laptop preset auto-enable.** When the installer writes `nomarchy.system.formFactor = "laptop"`, also flip on a yet-to-be-built laptop preset (TLP, brightness keys, lid handling). The option exists; the preset module doesn't.
 
 ### Next (bigger lifts that build on Now)
@@ -128,6 +126,10 @@ Each PR description should reference the row(s) in `docs/SCRIPTS.md` it closes,
 
 (Move items here when they land — keep them brief, link the commit/PR.)
 
+- _2026-04-25_ — Software-profile multi-select in the installer. Users can now pick Dev, Gaming, Office, Media, and CLI Utils profiles during install; logic emits corresponding `home.packages` and system toggles into the generated config.
+- _2026-04-25_ — Pillar 3 Phase B: script & menu audit. Ported/implemented/stubbed ~40 scripts including `nomarchy-version`, `nomarchy-debug`, `nomarchy-reinstall`, `nomarchy-rollback`, `nomarchy-update-firmware`, `nomarchy-pkg-*`, and `nomarchy-theme-*` wrappers. Moved desktop scripts to packaged utility directory.
+- _2026-04-25_ — Docker & fwupd support. Added `nomarchy.system.virtualization.docker.enable` and `nomarchy.hardware.fwupd` options. Wires system services and adds `docker-compose` and `fwupdmgr` to PATH.
+- _2026-04-25_ — Installer VM testing. Added `installerVm` to flake nixosConfigurations, packages, and apps. `nomarchy-test-installer` now uses `nix run .#installerVm`.
 - _2026-04-25_ — `docs/KEYBINDINGS.md` auto-generator. New repo-tooling script `bin/utils/nomarchy-docs-keybindings` parses every `bindd =` / `bindeld =` line into a Markdown doc; README's keybinding table slimmed to highlights + link.
 - _2026-04-25_ — Installer disk picker shows NAME / SIZE / TYPE / VENDOR / MODEL / SERIAL columns instead of bare `lsblk`. Type derived from `ROTA` + `TRAN` (NVMe / USB / SSD / HDD). Filters loop, ram, zram, sr.
 - _2026-04-25_ — Pillar 3 Phase A: script & menu audit. New `bin/utils/nomarchy-docs-scripts` generator produces `docs/SCRIPTS.md` with 136 scripts and the menu walk pre-tagged via heuristics (`kept` / `unused?` / `missing`). Phase B (per-batch porting / removal) opens.

docs/SCRIPTS.md

@@ -24,10 +24,11 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 - `delete-dead` — Phase B verdict: remove and update callers.
 - `stub-with-notify` — Phase B verdict: temporary `notify-send` stub.
 
-## Scripts (162)
+## Scripts (169)
 
 | Script | Location | Callers | Status | Notes |
 | --- | --- | --- | --- | --- |
+| `nomarchy-backup` | `features/scripts/utils` | features/scripts/utils/nomarchy-sync | `kept` |  |
 | `nomarchy-battery-capacity` | `core/system/scripts` | core/system/scripts/nomarchy-battery-status | `kept` |  |
 | `nomarchy-battery-monitor` | `core/system/scripts` | features/scripts/battery-monitor.nix | `kept` |  |
 | `nomarchy-battery-present` | `core/system/scripts` | — | `unused?` |  |
@@ -47,6 +48,8 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-cmd-terminal-cwd` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/plain-bindings.conf,features/desktop/hyprland/config/bindings.conf | `kept` |  |
 | `nomarchy-config-direct-boot` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-debug` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
+| `nomarchy-docs-keybindings` | `features/scripts/utils` | bin/utils/nomarchy-docs-keybindings | `kept` |  |
+| `nomarchy-docs-scripts` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts | `kept` |  |
 | `nomarchy-drive-info` | `features/scripts/utils` | features/scripts/utils/nomarchy-drive-select | `kept` |  |
 | `nomarchy-drive-select` | `features/scripts/utils` | features/scripts/utils/nomarchy-drive-info,features/scripts/utils/nomarchy-drive-set-password | `kept` |  |
 | `nomarchy-drive-set-password` | `features/scripts/utils` | features/scripts/utils/nomarchy-drive-select,features/scripts/utils/nomarchy-menu | `kept` |  |
@@ -70,6 +73,8 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-hyprland-window-pop` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf | `kept` |  |
 | `nomarchy-hyprland-window-single-square-aspect-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-hyprland-workspace-layout-toggle` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf,features/scripts/utils/nomarchy-menu | `kept` |  |
+| `nomarchy-install` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md,hosts/installer-iso.nix, +2 more | `kept` |  |
+| `nomarchy-install-docker-dbs` | `features/scripts/utils` | core/home/config/nomarchy-skill/SKILL.md | `kept` |  |
 | `nomarchy-launch-about` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-launch-audio` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/waybar/config/config.jsonc, +2 more | `kept` |  |
 | `nomarchy-launch-bluetooth` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/waybar/config/config.jsonc, +1 more | `kept` |  |
@@ -85,7 +90,8 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-launch-webapp` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/plain-bindings.conf,features/desktop/hyprland/config/bindings.conf, +7 more | `kept` |  |
 | `nomarchy-launch-wifi` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,features/desktop/waybar/config/config.jsonc, +3 more | `kept` |  |
 | `nomarchy-lock-screen` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy/extensions/menu.sh, +3 more | `kept` |  |
-| `nomarchy-menu` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/hypr/bindings/utilities.conf, +8 more | `kept` |  |
+| `nomarchy-manual` | `features/scripts/utils` | features/scripts/utils/nomarchy-menu,themes/engine/scripts/nomarchy-theme-install | `kept` |  |
+| `nomarchy-menu` | `features/scripts/utils` | bin/utils/nomarchy-docs-scripts,core/home/config/nomarchy/default/hypr/bindings/utilities.conf, +9 more | `kept` |  |
 | `nomarchy-menu-keybindings` | `features/scripts/utils` | core/home/config/nomarchy/default/hypr/bindings/utilities.conf,core/home/config/nomarchy-skill/SKILL.md, +1 more | `kept` |  |
 | `nomarchy-migrate-state` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-notification-dismiss` | `features/scripts/utils` | — | `unused?` |  |
@@ -126,6 +132,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-setup-fingerprint` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-show-done` | `themes/engine/scripts` | features/scripts/utils/nomarchy-launch-floating-terminal-with-presentation | `kept` |  |
 | `nomarchy-show-logo` | `themes/engine/scripts` | features/scripts/utils/nomarchy-launch-floating-terminal-with-presentation | `kept` |  |
+| `nomarchy-skill` | `features/scripts/utils` | core/home/configs.nix | `kept` |  |
 | `nomarchy-snapshot` | `features/scripts/utils` | — | `unused?` |  |
 | `nomarchy-state` | `features/scripts/utils` | core/system/scripts/nomarchy-system-reboot,core/system/scripts/nomarchy-system-shutdown, +1 more | `kept` |  |
 | `nomarchy-state-write` | `features/scripts/utils` | — | `unused?` |  |
@@ -134,7 +141,7 @@ Phase B (per-batch PRs) refines those into `port-from-omarchy`,
 | `nomarchy-sudo-reset` | `core/system/scripts` | — | `unused?` |  |
 | `nomarchy-swayosd-brightness` | `core/system/scripts` | core/system/scripts/nomarchy-brightness-display,core/system/scripts/nomarchy-brightness-display-apple | `kept` |  |
 | `nomarchy-swayosd-kbd-brightness` | `core/system/scripts` | core/system/scripts/nomarchy-brightness-keyboard | `kept` |  |
-| `nomarchy-sync` | `features/scripts/utils` | README.md | `kept` |  |
+| `nomarchy-sync` | `features/scripts/utils` | features/scripts/utils/nomarchy-backup,README.md | `kept` |  |
 | `nomarchy-system-logout` | `core/system/scripts` | features/scripts/utils/nomarchy-menu | `kept` |  |
 | `nomarchy-system-reboot` | `core/system/scripts` | core/home/config/nomarchy-skill/SKILL.md,core/system/scripts/nomarchy-hibernation-setup, +2 more | `kept` |  |
 | `nomarchy-system-shutdown` | `core/system/scripts` | core/home/config/nomarchy/extensions/menu.sh,core/home/config/nomarchy-skill/SKILL.md, +1 more | `kept` |  |
@@ -197,20 +204,13 @@ Tokens grepped from `core/`, `features/`, `themes/`, `installer/`, `hosts/`, `bi
 
 | Token | Referenced in | Status |
 | --- | --- | --- |
-| `nomarchy-backup` | features/scripts/utils/nomarchy-sync | `missing` |
 | `nomarchy-cmd-` | core/home/config/nomarchy/default/hypr/bindings/media.conf,core/home/config/nomarchy/default/hypr/bindings/utilities.conf, +14 more | `missing` |
-| `nomarchy-docs-keybindings` | bin/utils/nomarchy-docs-keybindings | `missing` |
-| `nomarchy-docs-scripts` | bin/utils/nomarchy-docs-scripts | `missing` |
 | `nomarchy-dryrun` | installer/install.sh | `missing` |
 | `nomarchy-font-selector` | features/scripts/utils/nomarchy-font,themes/engine/switcher.nix | `missing` |
-| `nomarchy-install` | core/home/config/nomarchy-skill/SKILL.md,hosts/installer-iso.nix, +2 more | `missing` |
 | `nomarchy-install-` | core/home/config/nomarchy-skill/SKILL.md | `missing` |
-| `nomarchy-install-docker-dbs` | core/home/config/nomarchy-skill/SKILL.md | `missing` |
-| `nomarchy-installer-vm` | features/scripts/utils/nomarchy-test-installer | `missing` |
 | `nomarchy-launch-` | core/home/config/nomarchy/default/hypr/bindings/clipboard.conf,core/home/config/nomarchy/default/hypr/bindings/utilities.conf, +23 more | `missing` |
 | `nomarchy-luks` | installer/disko-golden.nix,installer/install.sh | `missing` |
-| `nomarchy-manual` | features/scripts/utils/nomarchy-menu,themes/engine/scripts/nomarchy-theme-install | `missing` |
+| `nomarchy-menu-rows` | bin/utils/nomarchy-docs-scripts,features/scripts/utils/nomarchy-docs-scripts | `missing` |
-| `nomarchy-menu-rows` | bin/utils/nomarchy-docs-scripts | `missing` |
 | `nomarchy-nopasswd-` | core/system/scripts/nomarchy-sudo-passwordless-toggle | `missing` |
 | `nomarchy-pkg` | core/home/config/nomarchy-skill/SKILL.md,core/system/scripts/nomarchy-pkg-add, +6 more | `missing` |
 | `nomarchy-pkg-` | core/home/config/nomarchy-skill/SKILL.md,core/system/scripts/nomarchy-pkg-add, +6 more | `missing` |
@@ -222,7 +222,6 @@ Tokens grepped from `core/`, `features/`, `themes/`, `installer/`, `hosts/`, `bi
 | `nomarchy-scripts` | core/system/scripts/nomarchy-preflight-migration,features/scripts/battery-monitor.nix, +1 more | `missing` |
 | `nomarchy-sddm-theme` | themes/engine/sddm.nix | `missing` |
 | `nomarchy-setup-` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-menu | `missing` |
-| `nomarchy-skill` | core/home/configs.nix | `missing` |
 | `nomarchy-system-scripts` | core/system/hardware.nix,core/system/scripts-derivation.nix, +1 more | `missing` |
 | `nomarchy-theme-` | core/home/config/nomarchy-skill/SKILL.md,features/scripts/utils/nomarchy-menu, +15 more | `missing` |
 | `nomarchy-theme-engine-scripts` | themes/engine/scripts.nix | `missing` |

features/scripts/default.nix

@@ -42,6 +42,7 @@ let
 
     utils = [
       gum
+      glow
       hyprland
       libnotify
       wl-clipboard

features/scripts/utils/nomarchy-backup

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# Nomarchy Backup Script
+# Alias for nomarchy-sync push.
+
+nomarchy-sync push "$@"

features/scripts/utils/nomarchy-docs-keybindings

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# nomarchy-docs-keybindings
+#
+# Regenerates docs/KEYBINDINGS.md from the Hyprland binding files. Run from the
+# repo root or anywhere — paths are resolved relative to this script.
+#
+#   nomarchy-docs-keybindings                       # write to stdout
+#   nomarchy-docs-keybindings --out docs/KEYBINDINGS.md
+#
+# Source files in render order. Each entry is "<repo-relative path>|<title>".
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+sources=(
+  "core/home/config/nomarchy/default/hypr/bindings/utilities.conf|Utilities"
+  "core/home/config/nomarchy/default/hypr/bindings/tiling.conf|Tiling"
+  "core/home/config/nomarchy/default/hypr/bindings/tiling-v2.conf|Tiling (v2)"
+  "core/home/config/nomarchy/default/hypr/bindings/clipboard.conf|Clipboard"
+  "core/home/config/nomarchy/default/hypr/bindings/media.conf|Media keys"
+  "features/desktop/hyprland/config/bindings.conf|Apps & web shortcuts"
+)
+
+prettify_key() {
+  case "$1" in
+    code:10) echo "1" ;; code:11) echo "2" ;; code:12) echo "3" ;;
+    code:13) echo "4" ;; code:14) echo "5" ;; code:15) echo "6" ;;
+    code:16) echo "7" ;; code:17) echo "8" ;; code:18) echo "9" ;;
+    code:19) echo "0" ;;
+    XF86AudioRaiseVolume)   echo "Volume Up" ;;
+    XF86AudioLowerVolume)   echo "Volume Down" ;;
+    XF86AudioMute)          echo "Mute" ;;
+    XF86AudioMicMute)       echo "Mic Mute" ;;
+    XF86AudioPlay)          echo "Play/Pause" ;;
+    XF86AudioStop)          echo "Stop" ;;
+    XF86AudioNext)          echo "Next Track" ;;
+    XF86AudioPrev)          echo "Previous Track" ;;
+    XF86MonBrightnessUp)    echo "Brightness Up" ;;
+    XF86MonBrightnessDown)  echo "Brightness Down" ;;
+    XF86KbdBrightnessUp)    echo "Kbd Brightness Up" ;;
+    XF86KbdBrightnessDown)  echo "Kbd Brightness Down" ;;
+    XF86KbdLightOnOff)      echo "Kbd Backlight" ;;
+    *) echo "$1" ;;
+  esac
+}
+
+trim() { sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//'; }
+
+render_section() {
+  local file="$1" title="$2"
+  [[ ! -f "$repo_root/$file" ]] && return
+  local rows
+  rows=$(grep -E '^[[:space:]]*bind[a-z]*[[:space:]]*=' "$repo_root/$file" || true)
+  [[ -z "$rows" ]] && return
+
+  local body=""
+  while IFS= read -r line; do
+    # Strip the "bindXXX =" prefix.
+    local rhs="${line#*=}"
+    local mods key desc
+    IFS=',' read -r mods key desc _ <<<"$rhs"
+    mods=$(printf '%s' "${mods:-}" | trim)
+    key=$(printf '%s'  "${key:-}"  | trim)
+    desc=$(printf '%s' "${desc:-}" | trim)
+    [[ -z "$desc" ]] && continue          # skip non-descriptive bindings
+    [[ -z "$mods" ]] && mods="—"
+    key=$(prettify_key "$key")
+    body+=$(printf '| %s | %s | %s |\n' "$mods" "$key" "$desc")
+    body+=$'\n'
+  done <<<"$rows"
+
+  [[ -z "$body" ]] && return
+
+  printf '\n## %s\n\n' "$title"
+  printf '_Source: `%s`_\n\n' "$file"
+  printf '| Modifiers | Key | Action |\n'
+  printf '| --- | --- | --- |\n'
+  printf '%s' "$body"
+}
+
+main() {
+  cat <<'HEADER'
+# Nomarchy Keybindings
+
+Auto-generated from the Hyprland binding files. **Do not edit by hand.**
+Re-run the generator after changing any `bindings/*.conf`:
+
+```bash
+./bin/utils/nomarchy-docs-keybindings --out docs/KEYBINDINGS.md
+```
+
+`SUPER` is the Meta / Win key. `code:NN` keys (X11 digit keycodes) are
+shown as the digit they correspond to. Media keys (`XF86Audio*`,
+`XF86MonBrightness*`, …) are prettified.
+HEADER
+  for entry in "${sources[@]}"; do
+    render_section "${entry%|*}" "${entry#*|}"
+  done
+}
+
+out=""
+if [[ "${1:-}" == "--out" ]]; then
+  out="${2:?--out needs a path}"; shift 2
+fi
+if [[ -n "$out" ]]; then
+  main >"$out"
+else
+  main
+fi

features/scripts/utils/nomarchy-docs-scripts

@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+# Generator tolerates "no matches" exit codes from grep | sort.
+# pipefail and -e off; -u stays.
+set -u
+
+# nomarchy-docs-scripts
+#
+# Regenerates docs/SCRIPTS.md from the repo state. Produces:
+#   1. Header + status legend + regen instructions.
+#   2. Table of every nomarchy-* script (location, callers, status).
+#   3. Table of every menu entry in features/scripts/utils/nomarchy-menu
+#      (submenu, label, target command, status).
+#   4. Snapshot list of orphaned references (called somewhere, no script).
+#
+# Status heuristic in Phase A:
+#   kept     — file exists AND is called from at least one *.nix / *.conf /
+#              shell file outside its own directory.
+#   unused?  — file exists but no caller found. Phase B decides delete-dead
+#              vs intentional public API.
+#   missing  — referenced but no file. Phase B decides port-from-omarchy
+#              vs delete-dead vs stub-with-notify.
+#
+#   nomarchy-docs-scripts                       # write to stdout
+#   nomarchy-docs-scripts --out docs/SCRIPTS.md
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$repo_root"
+
+# --- Inventory -------------------------------------------------------------
+
+# Where scripts live, in render order.
+declare -A loc_label=(
+  ["features/scripts/utils"]="features/scripts/utils"
+  ["core/system/scripts"]="core/system/scripts"
+  ["themes/engine/scripts"]="themes/engine/scripts"
+)
+script_dirs=(features/scripts/utils core/system/scripts themes/engine/scripts)
+
+# Build name → location map (associative array of basename → repo-relative dir).
+declare -A script_loc
+for dir in "${script_dirs[@]}"; do
+  [[ -d "$dir" ]] || continue
+  while IFS= read -r f; do
+    script_loc["$(basename "$f")"]="$dir"
+  done < <(find "$dir" -maxdepth 1 -type f -name 'nomarchy-*')
+done
+
+# Find every nomarchy-* token referenced anywhere outside the script dirs.
+# (We exclude the script files themselves so they don't list themselves as
+# their own caller.)
+# File types we search for references. *.md catches docs and README;
+# branding/hook/extension files have varied or no extensions.
+grep_includes=(
+  --include='*.nix' --include='*.conf' --include='*.sh' --include='*.md'
+  --include='nomarchy-*' --include='*.jsonc' --include='*.toml'
+  --include='*.txt' --include='*.sample'
+)
+search_dirs=(core features themes installer hosts bin lib README.md)
+
+# Files whose mentions of nomarchy-* are documentation about the scripts,
+# not real callers. Excluded from caller discovery so they don't promote
+# every script to `kept`.
+self_refs=(docs/SCRIPTS.md docs/ROADMAP.md docs/AGENT.md)
+
+ref_files_per_cmd() {
+  local cmd="$1"
+  local self_pattern
+  self_pattern=$(IFS='|'; echo "${self_refs[*]}")
+  grep -rlE "\\b${cmd}\\b" \
+    "${grep_includes[@]}" \
+    "${search_dirs[@]}" 2>/dev/null \
+    | grep -vE "^(features/scripts/utils|core/system/scripts|themes/engine/scripts)/${cmd}$" \
+    | grep -vE "^(${self_pattern})$" \
+    | sort -u
+}
+
+# All distinct nomarchy-* tokens we see anywhere in the repo.
+all_refs=$(grep -rohE 'nomarchy-[a-z0-9][a-z0-9-]+' \
+            "${search_dirs[@]}" 2>/dev/null \
+          | sort -u)
+
+# --- Render: header --------------------------------------------------------
+
+main() {
+  cat <<'HEADER'
+# Nomarchy Script & Menu Audit
+
+Auto-generated table for [Pillar 3 of the roadmap](ROADMAP.md#3-pillar-script--menu-audit).
+**Do not edit by hand.** Regenerate after script or menu changes:
+
+```bash
+./bin/utils/nomarchy-docs-scripts --out docs/SCRIPTS.md
+```
+
+The status column uses a Phase A heuristic — `kept` / `unused?` / `missing`.
+Phase B (per-batch PRs) refines those into `port-from-omarchy`,
+`delete-dead`, or `stub-with-notify` and updates the rows.
+
+## Status legend
+
+- `kept` — script exists and is called from somewhere outside its own directory.
+- `unused?` — script exists but no caller was found. Could be dead, could be
+  intentional public API. Phase B triage decides.
+- `missing` — referenced from code but no script file exists. Phase B triage
+  decides whether to port from Omarchy upstream, delete the caller, or stub
+  with `notify-send`.
+- `port-from-omarchy` — Phase B verdict: lift the upstream Omarchy script,
+  rewrite for NixOS paths.
+- `delete-dead` — Phase B verdict: remove and update callers.
+- `stub-with-notify` — Phase B verdict: temporary `notify-send` stub.
+
+HEADER
+
+  # --- Render: scripts table ----------------------------------------------
+  printf '## Scripts (%d)\n\n' "${#script_loc[@]}"
+  printf '| Script | Location | Callers | Status | Notes |\n'
+  printf '| --- | --- | --- | --- | --- |\n'
+
+  # Sort scripts by name.
+  for name in $(printf '%s\n' "${!script_loc[@]}" | sort); do
+    local dir="${script_loc[$name]}"
+    local callers status callers_str
+    callers=$(ref_files_per_cmd "$name")
+    if [[ -z "$callers" ]]; then
+      status='`unused?`'
+      callers_str='—'
+    else
+      status='`kept`'
+      # Trim caller list to 2 entries + count.
+      local count
+      count=$(printf '%s\n' "$callers" | wc -l)
+      if (( count > 2 )); then
+        callers_str=$(printf '%s\n' "$callers" | head -2 | paste -sd, -)
+        callers_str="$callers_str, +$((count - 2)) more"
+      else
+        callers_str=$(printf '%s\n' "$callers" | paste -sd, -)
+      fi
+    fi
+    printf '| `%s` | `%s` | %s | %s |  |\n' \
+      "$name" "$dir" "$callers_str" "$status"
+  done
+  echo
+
+  # --- Render: missing references -----------------------------------------
+  printf '## Missing references\n\n'
+  printf 'Tokens grepped from `core/`, `features/`, `themes/`, `installer/`, `hosts/`, `bin/`, `lib/` that have no matching script file.\n\n'
+  printf '| Token | Referenced in | Status |\n'
+  printf '| --- | --- | --- |\n'
+  while IFS= read -r token; do
+    [[ -z "$token" ]] && continue
+    [[ -n "${script_loc[$token]:-}" ]] && continue
+    local refs
+    self_pattern=$(IFS='|'; echo "${self_refs[*]}")
+    refs=$(grep -rlE "\\b${token}\\b" \
+            "${grep_includes[@]}" \
+            "${search_dirs[@]}" 2>/dev/null \
+          | grep -vE "^(${self_pattern})$" \
+          | sort -u)
+    [[ -z "$refs" ]] && continue
+    local count refs_str
+    count=$(printf '%s\n' "$refs" | wc -l)
+    if (( count > 2 )); then
+      refs_str=$(printf '%s\n' "$refs" | head -2 | paste -sd, -)
+      refs_str="$refs_str, +$((count - 2)) more"
+    else
+      refs_str=$(printf '%s\n' "$refs" | paste -sd, -)
+    fi
+    printf '| `%s` | %s | `missing` |\n' "$token" "$refs_str"
+  done <<<"$all_refs"
+  echo
+
+  # --- Render: menu items -------------------------------------------------
+  printf '## Menu items\n\n'
+  printf 'Walked from `features/scripts/utils/nomarchy-menu`. Each `case` arm in a `show_*_menu` function becomes one row.\n\n'
+  printf '| Submenu | Entry | Calls | Status |\n'
+  printf '| --- | --- | --- | --- |\n'
+
+  awk '
+    /^show_[a-z_]+_menu\(\) {/ { sub(/\(\) {/, ""); current=$1; in_func=1; next }
+    /^[a-z_]+\(\) {/ && !/^show_/ { current=""; in_func=0; next }
+    /^}$/ { current=""; in_func=0; next }
+    !in_func { next }
+    /^  case \$\(menu / {
+      # extract the menu title between the first pair of double quotes
+      match($0, /menu "[^"]+" "[^"]+"/);
+      if (RSTART == 0) next;
+      title=substr($0, RSTART, RLENGTH);
+      # second quoted string is the option list
+      n=split(title, parts, "\"");
+      title=parts[2];
+      options=parts[4];
+      # split options on \n
+      split(options, opts, "\\\\n");
+      pending_submenu=current;
+      pending_title=title;
+      for (i=1;i<=length(opts);i++) pending_opts[i]=opts[i];
+      pending_count=length(opts);
+      next
+    }
+    /^  \*[A-Za-z]/ {
+      # case arm — extract pattern between the first * and the closing )
+      match($0, /\*[^)]*\)/);
+      if (RSTART == 0) next;
+      arm=substr($0, RSTART, RLENGTH);
+      gsub(/[*)]/, "", arm);
+      gsub(/^[[:space:]]+|[[:space:]]+$/, "", arm);
+      # action follows the )
+      rest=substr($0, RSTART+RLENGTH);
+      sub(/^[[:space:]]+/, "", rest);
+      sub(/[[:space:]]*;;[[:space:]]*$/, "", rest);
+      # match the first nomarchy-* token in the action
+      cmd=""
+      if (match(rest, /nomarchy-[a-z0-9-]+/)) {
+        cmd=substr(rest, RSTART, RLENGTH);
+      }
+      printf "%s|%s|%s\n", pending_submenu, arm, cmd;
+    }
+  ' features/scripts/utils/nomarchy-menu > /tmp/nomarchy-menu-rows.$$
+
+  while IFS='|' read -r submenu entry cmd; do
+    [[ -z "$entry" ]] && continue
+    [[ "$entry" =~ ^\) ]] && continue
+    status='`kept`'
+    if [[ -n "$cmd" ]]; then
+      if [[ -z "${script_loc[$cmd]:-}" ]]; then
+        status='`missing`'
+      fi
+    else
+      cmd='_(inline)_'
+    fi
+    printf '| `%s` | %s | `%s` | %s |\n' "$submenu" "$entry" "$cmd" "$status"
+  done < /tmp/nomarchy-menu-rows.$$
+  rm -f /tmp/nomarchy-menu-rows.$$
+  echo
+}
+
+out=""
+if [[ "${1:-}" == "--out" ]]; then
+  out="${2:?--out needs a path}"; shift 2
+fi
+if [[ -n "$out" ]]; then
+  main >"$out"
+else
+  main
+fi

features/scripts/utils/nomarchy-install

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# Nomarchy Install Script
+# Entry point for the Nomarchy installer.
+
+INSTALLER="/etc/install.sh"
+[[ ! -f "$INSTALLER" ]] && INSTALLER="/etc/nixos/nomarchy/installer/install.sh"
+
+if [[ -f "$INSTALLER" ]]; then
+    sudo "$INSTALLER" "$@"
+else
+    echo "Error: Nomarchy installer not found at $INSTALLER"
+    exit 1
+fi

features/scripts/utils/nomarchy-install-docker-dbs

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+# Nomarchy Docker DBs Stub
+# This script is a stub for a specialized tool.
+
+notify-send "Nomarchy" "The docker-dbs tool is not implemented in this version of Nomarchy. Please use standard podman/docker commands."
+echo "Not implemented."
+exit 1

features/scripts/utils/nomarchy-manual

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# Nomarchy Manual Script
+# Opens the Nomarchy manual in the default web browser.
+
+URL="https://learn.omacom.io/2/the-nomarchy-manual"
+
+echo "Opening Nomarchy manual: $URL"
+xdg-open "$URL"

features/scripts/utils/nomarchy-skill

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+# Nomarchy Skill Script
+# Displays the Nomarchy Skill documentation for agents and power users.
+
+SKILL_FILE="$HOME/.config/nomarchy-skill/SKILL.md"
+
+if [[ ! -f "$SKILL_FILE" ]]; then
+    # Fallback to repo location if managed by nix
+    SKILL_FILE="/etc/nixos/nomarchy/core/home/config/nomarchy-skill/SKILL.md"
+fi
+
+if [[ ! -f "$SKILL_FILE" ]]; then
+    # Final fallback to standard config dir
+    SKILL_FILE="$HOME/.config/nomarchy-skill/SKILL.md"
+fi
+
+if [[ -f "$SKILL_FILE" ]]; then
+    glow "$SKILL_FILE"
+else
+    echo "Error: Nomarchy Skill documentation not found."
+    exit 1
+fi

features/scripts/utils/nomarchy-test-installer

@@ -2,13 +2,5 @@
 
 # Build and run the Nomarchy Installer VM for testing.
 
-echo "Building Nomarchy Installer VM..."
+echo "Launching Nomarchy Installer VM..."
-nix build .#nixosConfigurations.installerVm.config.system.build.vm
+nix run .#installerVm
-
-if [ $? -eq 0 ]; then
-    echo "Success! Launching Installer VM..."
-    ./result/bin/run-nomarchy-installer-vm
-else
-    echo "Error: VM build failed."
-    exit 1
-fi

flake.nix

@@ -120,6 +120,25 @@
         ];
       };
 
+      # Installer VM for testing
+      installerVm = nixpkgs.lib.nixosSystem {
+        specialArgs = { inherit inputs; };
+        modules = [
+          {
+            nixpkgs.hostPlatform = "x86_64-linux";
+            nixpkgs.overlays = overlays;
+          }
+          "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
+          ./hosts/installer-iso.nix
+          {
+            system.stateVersion = "25.11";
+            networking.hostName = "nomarchy-installer-vm";
+            virtualisation.vmVariant.virtualisation.memorySize = 4096;
+            virtualisation.vmVariant.virtualisation.cores = 2;
+          }
+        ];
+      };
+
       # Graphical installer ISO (legacy, for users who prefer GUI)
       installerIsoGraphical = nixpkgs.lib.nixosSystem {
         specialArgs = { inherit inputs; };
@@ -208,6 +227,16 @@
       #     nix build /etc/nomarchy#allThemeVariants --no-link
       inherit allThemeVariants;
       default = allThemeVariants;
+
+      # Expose installer VM as a package
+      installerVm = self.nixosConfigurations.installerVm.config.system.build.vm;
+    };
+
+    apps.${system} = {
+      installerVm = {
+        type = "app";
+        program = "${self.packages.${system} .installerVm}/bin/run-nomarchy-installer-vm";
+      };
     };
   };
 }

installer/install.sh

@@ -39,6 +39,7 @@ LOCALE=""
 FORM_FACTOR=""
 HARDWARE_MODULES=""
 NOMARCHY_HW_OPTS=""
+SELECTED_PROFILES=""
 # "" = not yet answered; "true"/"false" set by configure_impermanence.
 ENABLE_IMPERMANENCE=""
 
@@ -95,7 +96,8 @@ save_state() {
     declare -p \
         TARGET_DRIVE USERNAME HOSTNAME TIMEZONE \
         KEYMAP_LAYOUT KEYMAP_VARIANT LOCALE FORM_FACTOR \
-        ENABLE_IMPERMANENCE HARDWARE_MODULES NOMARCHY_HW_OPTS NOMARCHY_REV \
+        ENABLE_IMPERMANENCE HARDWARE_MODULES NOMARCHY_HW_OPTS \
+        SELECTED_PROFILES NOMARCHY_REV \
         > "$STATE_FILE"
 }
 
@@ -685,7 +687,41 @@ configure_impermanence() {
 }
 
 # ============================================================================
-# STEP 8: REVIEW & CONFIRM
+# STEP 8: SOFTWARE PROFILES (OPTIONAL)
+# ============================================================================
+
+select_profiles() {
+    section "Software Profiles"
+
+    if [[ -n "$SELECTED_PROFILES" ]]; then
+        success "Resumed selected profiles"
+        return
+    fi
+
+    info "Pick optional software profiles to include in your configuration."
+    info "Multiple selection allowed (Space to select, Enter to confirm)."
+    echo ""
+
+    SELECTED_PROFILES=$(nrun gum choose --no-limit --header "Select Profiles" \
+        "Dev (VSCode, Git, Lazygit, Zed, Docker)" \
+        "Gaming (Steam, Gamemode, Lutris, Heroic)" \
+        "Office (LibreOffice, Thunderbird, Obsidian, Zotero)" \
+        "Media (VLC, OBS Studio, GIMP, Inkscape, Spotify)" \
+        "CLI Utils (ripgrep, fd, bat, eza, zoxide, fzf)")
+
+    if [[ -z "$SELECTED_PROFILES" ]]; then
+        info "No profiles selected (minimal install)"
+    else
+        # Count selected profiles by number of lines
+        local count
+        count=$(echo "$SELECTED_PROFILES" | grep -c "^" || echo 0)
+        success "Selected $count profile(s)"
+    fi
+    save_state
+}
+
+# ============================================================================
+# STEP 9: REVIEW & CONFIRM
 # ============================================================================
 
 review_configuration() {
@@ -699,6 +735,7 @@ review_configuration() {
     echo "  Timezone:      $TIMEZONE"
     echo "  Form factor:   $FORM_FACTOR"
     echo "  Impermanence:  $ENABLE_IMPERMANENCE"
+    echo "  Profiles:      ${SELECTED_PROFILES:-None}"
     echo "  Nomarchy rev:  ${NOMARCHY_REV:-main (unpinned)}"
     echo ""
 
@@ -897,6 +934,32 @@ generate_flake_config() {
     local impermanence_opt=""
     [[ "$ENABLE_IMPERMANENCE" == "true" ]] && impermanence_opt="nomarchy.system.impermanence.enable = true;"
 
+    local PROFILE_SYSTEM_OPTS=""
+    local PROFILE_HOME_PACKAGES=""
+
+    while IFS= read -r profile; do
+        [[ -z "$profile" ]] && continue
+        case "$profile" in
+            "Dev "*)
+                PROFILE_SYSTEM_OPTS+=$'\n  # Dev profile\n  nomarchy.system.virtualization.docker.enable = true;'
+                PROFILE_HOME_PACKAGES+=$'\n    vscode\n    zed-editor\n    lazygit\n    gh\n    docker-compose'
+                ;;
+            "Gaming "*)
+                PROFILE_SYSTEM_OPTS+=$'\n  # Gaming profile\n  programs.steam.enable = true;\n  programs.gamemode.enable = true;'
+                PROFILE_HOME_PACKAGES+=$'\n    steam\n    lutris\n    heroic'
+                ;;
+            "Office "*)
+                PROFILE_HOME_PACKAGES+=$'\n    libreoffice\n    thunderbird\n    obsidian\n    zotero'
+                ;;
+            "Media "*)
+                PROFILE_HOME_PACKAGES+=$'\n    vlc\n    obs-studio\n    gimp\n    inkscape\n    spotify'
+                ;;
+            "CLI Utils "*)
+                PROFILE_HOME_PACKAGES+=$'\n    ripgrep\n    fd\n    bat\n    eza\n    zoxide\n    fzf'
+                ;;
+        esac
+    done <<< "$SELECTED_PROFILES"
+
     # Pin the upstream Nomarchy flake to the exact commit we're installing
     # from so the first post-reboot `nixos-rebuild` doesn't silently pull a
     # newer main. Fall back to tracking main if we couldn't resolve a SHA.
@@ -1009,6 +1072,7 @@ $xkb_variant_line
   nomarchy.system.formFactor = "$FORM_FACTOR";
 
   $impermanence_opt
+  $PROFILE_SYSTEM_OPTS
 
   # Compressed RAM swap. Near-free memory headroom on small machines and
   # harmless on big ones — kernel only uses it under pressure. Disable if
@@ -1116,6 +1180,7 @@ EOF
     btop                # Resource monitor (TUI)
     fastfetch           # System info at login
     chromium            # Secondary browser
+    $PROFILE_HOME_PACKAGES
 
     # --- Editors & dev ---
     # vscode
@@ -1234,6 +1299,7 @@ main() {
     select_hardware
     confirm_form_factor
     configure_impermanence
+    select_profiles
     review_configuration
     execute_installation