deploy: post-merge host rollout for da rename + act (ASAHI and NIXPC)

[cernoh]

The merge train landing 78c39b8..5633a91 changed live-machine identity and services. Config-side verification is done; both machines still need an on-device switch + smoke test. Nothing here can be exercised from CI.

ASAHI (user is now da, was implicitly davr)

• sudo nixos-rebuild switch --impure --flake ~/.config/dendritic#ASAHI
• Confirm no second account gets created (ls /home shows only da; getent passwd davr empty)
• Existing da login keeps its real password — the declarative initialPassword = "changeme" only applies to freshly created accounts, but verify before logging out
• greetd/Noctalia greeter autologin user flips to da (was hardcoded davr)
• HM activation on existing dotfiles may trigger backupFileExtension moves: watch for *.hm-backup files under /home/da and reconcile
• Wallpaper directory now resolves to /home/da/Pictures/Wallpapers — confirm Noctalia picks it up

NIXPC

• sudo nixos-rebuild switch --impure --flake ~/.config/dendritic#NIXPC
• Docker daemon still active after losing its direct preset import (now provided via attrs/desktop → act → docker): systemctl status docker, docker info
• MCP containers healthy: systemctl status hindsight-api agentwebsearch-mcp scrapling-mcp (they only need the daemon)
• .actrc lands in ~/.davr/.actrc with the catthehacker runner default
• davr group set is exactly wheel/networkmanager/audio/video/input/docker (duplicate docker entry fixed)

Both

• Neovim: open a .nix file, save — formatting must run via bundled nixfmt (no longer alejandra); confirm no 'nixfmt not found' style errors now that it left home.packages
• Ad-hoc shells that relied on global bun/nodejs/python3/jdk will no longer find them outside direnv projects — expected per chore: clean up programming #54, flag any genuine stragglers here

[cernoh]

ASAHI-specific remediation is now split into dedicated issues for tractability:

• asahi(blocker): pre-switch gate before first nixos-rebuild on the Mac #63 — blocker: pre-switch gate (full config replacement, hardware-configuration presence/placeholder-root trap, id da, stateVersion, canTouchEfiVariables layering)
• asahi: HM takeover of existing /home/da — backups, stale hm-v3 state, substituter shadowing #64 — HM takeover of existing /home/da (*.hm-backup sweep, stale hm-v3 generations, user-level nix.conf substituter shadowing)
• asahi: docker + act stack is now enabled on the Mac — confirm that's wanted #65 — docker + act newly enabled on the Mac: keep-or-opt-out decision
• asahi: Noctalia wallpaper dir /home/da/Pictures/Wallpapers will be empty post-migration #66 — Noctalia wallpaper dir empty post-migration

The NIXPC items below stay authoritative here.

[cernoh]

ASAHI-side rollout prep is done config-side (see #63 status comment; PRs #67/#68/#69). Remaining on-device steps after the stack merges — unchanged from the checklist, plus notes:

• sudo nixos-rebuild switch --impure --flake ~/.config/dendritic#ASAHI (deliberately not run by automation)
• ls /home shows only da; getent passwd davr empty
• verify da password survives before logging out
• greetd user flips to da automatically: evals to services.greetd.settings.default_session.user = "da" already
• watch for *.hm-backup files under /home/da and reconcile (asahi: HM takeover of existing /home/da — backups, stale hm-v3 state, substituter shadowing #64)
• wallpaper dir prepared in advance: /home/da/Pictures/Wallpapers/gluee-wallpaper.png staged (asahi: Noctalia wallpaper dir /home/da/Pictures/Wallpapers will be empty post-migration #66); Noctalia should index it on first session

NIXPC items remain authoritative here; eval-verified from the Mac today:

• docker still enabled via attrs/desktop→act→docker (virtualisation.docker.enable = true)
• davr groups exactly wheel/networkmanager/audio/video/input/docker
• .actrc content correct for davr
• mcp container units all present (scrapling-mcp, agentwebsearch-mcp, hindsight-api, hindsight-control-plane); hindsight env path now derives from dendritic.userName (chore(mcp-containers): hindsight env path hardcodes /home/davr — parameterize via primary user #61/fix(mcp-containers): derive hindsight env path from dendritic.userName #67) with identical NIXPC resolution

[cernoh]

Status from NIXPC (2026-08-28, during issue-completion pass).

NIXPC — most items verified, two stragglers need a root invocation from you:

• Switch: NIXPC has been switched through the merge train (profile at gen 15, 26.11.20260826.9fbb54b). Running system is gen 13 → one reboot pending to load gen 15.
• docker daemon: active (29.7.2), docker info clean.
• MCP containers: NOT healthy —
  • docker-hindsight-api failed (start-limit): hindsight-env-check hard-fails because /home/davr/.config/hindsight/.env does not exist (by-design precheck, issue feat: declarative MCP container provisioning on NIXPC #34). Create the file with your LLM key, then sudo systemctl start docker-hindsight-api.
  • docker-scrapling-mcp failed (exit 125, no image present at 18:28); docker-agentwebsearch-mcp inactive. After the env file exists: sudo systemctl restart docker-scrapling-mcp docker-agentwebsearch-mcp.
• .actrc: correct (-P ubuntu-latest=catthehacker/ubuntu:act-latest).
• davr groups: users wheel audio video networkmanager docker input — primary users + expected extras, single docker entry.
• Neovim 0.12.5 via HM profile, nixfmt on PATH — no "nixfmt not found" path.
• Global bun/node/python3/jdk: absent, as designed (direnv-scoped, chore: clean up programming #54).

Blocker found & fixed: the #85 ghostty change broke ASAHI toplevel eval on main (mkIf false def of the undeclared wayland.windowManager.mango option → nixpkgs module-system error; CI red on main). The ASAHI rollouts checklist would have failed on the very first switch. Fixed in PR #87 (issue #86).

ASAHI side remains on-device: the switch (step 1) and all post-switch items are Mac-only; from NIXPC there is no ssh/tailscale path (tailscaled not running). Once the stack (PRs #87–#90) merges, run the checklist on the Mac — the runbook (#71), reboot signal (#72) and cache reality (#73) are now documented config.

[cernoh]

ASAHI items consolidated into #92 (agent-executable rollout checklist) — point any on-Mac agent at that issue.

[cernoh]

Agent pass (2026-08-28, from ASAHI — NIXPC items not verifiable here, it is not on the tailnet):

Verified (ASAHI side):

• /home shows only da; no davr account (getent passwd davr empty).
• greetd default_session.user = da (was hardcoded davr; now driven by dendritic.userName).
• Wallpaper dir resolves and gluee-wallpaper.png is present.
• ~/.actrc exists with the -P ubuntu-latest=catthehacker/ubuntu:act-latest override; act --version = 0.2.89.
• davr group-set / NIXPC docker-daemon items: need a session on NIXPC (offline from here).

Blocked on sudo: the ASAHI switch itself (nixos-rebuild switch --impure --flake ~/.config/dendritic#ASAHI) — current gen 58 is one switch behind the flake lock; HM activation on existing dotfiles (backupFileExtension) is what produces the *.hm-backup churn to reconcile. Config-side work for the train is in PRs #102–#106.