config(topgrade): manage topgrade.toml on both OSes; add package

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.beads/interactions.jsonl

@@ -24,3 +24,4 @@
 {"id":"int-e46b03b9","kind":"field_change","created_at":"2026-08-09T18:53:55.604366711Z","actor":"Prad Nukala","issue_id":"chezmoi-9sg","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
 {"id":"int-264d97de","kind":"field_change","created_at":"2026-08-09T18:56:09.353024643Z","actor":"Prad Nukala","issue_id":"chezmoi-9sg","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}}
 {"id":"int-d44f53f8","kind":"field_change","created_at":"2026-08-09T18:56:09.547383656Z","actor":"Prad Nukala","issue_id":"chezmoi-iu2","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Closed"}}
+{"id":"int-ad1edd15","kind":"field_change","created_at":"2026-08-09T18:57:20.971643841Z","actor":"Prad Nukala","issue_id":"chezmoi-udp","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}

.beads/issues.jsonl

@@ -5,7 +5,7 @@
 {"_type":"issue","id":"chezmoi-5by","title":"Cutover: freeze dotstate for migrated paths","description":"After both validations: remove migrated paths from .dotstate-profiles.toml, tag dotstate pre-chezmoi-freeze, stop Dolt sync for those paths. Archive, never delete.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-5by","depends_on_id":"chezmoi-42m","type":"blocks","created_at":"2026-08-09T14:42:25Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-5by","depends_on_id":"chezmoi-udp","type":"blocks","created_at":"2026-08-09T14:42:25Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"chezmoi-9sg","title":"Arch layer: niri, noctalia, fontconfig, mimeapps, systemd user units — linux-gated","description":"niri config.d split preserved with exact_ dir; noctalia; fontconfig; mimeapps.list; systemd user units; foot/alacritty if live. All gated in .chezmoiignore.tmpl for darwin. niri validate must pass.","status":"closed","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:56:09Z","started_at":"2026-08-09T18:53:56Z","closed_at":"2026-08-09T18:56:09Z","close_reason":"Closed","dependencies":[{"issue_id":"chezmoi-9sg","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-9sg","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"chezmoi-iu2","title":"packages.yaml: translate dotstate manifests + live state into declarative manifest","description":"Curate Noctalia pacman list (drop base-system noise), custom installers, cargo/go tools, shared gh_extensions; darwin brew/cask section. Install scripts run_onchange keyed on yaml hash: pacman --needed + paru | brew loop; gh extension install loop; linux systemctl --user enable; post: fc-cache, bat cache.","status":"closed","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:56:10Z","closed_at":"2026-08-09T18:56:10Z","close_reason":"Closed","dependencies":[{"issue_id":"chezmoi-iu2","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:53Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-iu2","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:53Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
-{"_type":"issue","id":"chezmoi-udp","title":"Validation: darwin simulation","description":"chezmoi execute-template with os=darwin on every .tmpl; darwin-mode dry-run apply writes zero linux-gated paths, errors on nothing. Full Mac apply deferred until hardware available.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-21v","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-4sj","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-9sg","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-a2k","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-exq","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-fde","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-hou","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-iu2","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-sd9","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-utl","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-uw2","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-x7f","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-xi5","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":13,"dependent_count":1,"comment_count":0}
+{"_type":"issue","id":"chezmoi-udp","title":"Validation: darwin simulation","description":"chezmoi execute-template with os=darwin on every .tmpl; darwin-mode dry-run apply writes zero linux-gated paths, errors on nothing. Full Mac apply deferred until hardware available.","status":"in_progress","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:57:21Z","started_at":"2026-08-09T18:57:21Z","dependencies":[{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-21v","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-4sj","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-9sg","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-a2k","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-exq","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-fde","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-hou","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-iu2","type":"blocks","created_at":"2026-08-09T14:43:01Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-sd9","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-utl","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-uw2","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-x7f","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-udp","depends_on_id":"chezmoi-xi5","type":"blocks","created_at":"2026-08-09T14:43:00Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":13,"dependent_count":1,"comment_count":0}
 {"_type":"issue","id":"chezmoi-21v","title":"gh: config file + declarative extension list","description":"~/.config/gh config.yml (hosts.yml has oauth token - exclude/encrypt). Extensions: clean-branches, commit, dash, notify into packages.yaml shared.gh_extensions.","status":"closed","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:53:15Z","closed_at":"2026-08-09T18:53:15Z","close_reason":"Closed","dependencies":[{"issue_id":"chezmoi-21v","depends_on_id":"chezmoi-1a0","type":"blocks","created_at":"2026-08-09T14:42:24Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-21v","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-21v","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":3,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"chezmoi-4sj","title":"lazydocker: static config from live","description":"~/.config/lazydocker (not in dotstate).","status":"closed","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:53:15Z","closed_at":"2026-08-09T18:53:15Z","close_reason":"Closed","dependencies":[{"issue_id":"chezmoi-4sj","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-4sj","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:51Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0}
 {"_type":"issue","id":"chezmoi-a2k","title":"claude: settings, commands, agents, hooks, skills only","description":"~/.claude: settings.json, commands/, hooks/, skills/, CLAUDE.md. Never credentials/history/projects/sessions.","status":"closed","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:06Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:53:47Z","started_at":"2026-08-09T18:53:15Z","closed_at":"2026-08-09T18:53:47Z","close_reason":"Closed","dependencies":[{"issue_id":"chezmoi-a2k","depends_on_id":"chezmoi-1a0","type":"blocks","created_at":"2026-08-09T14:42:24Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-a2k","depends_on_id":"chezmoi-byc","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-a2k","depends_on_id":"chezmoi-rnv","type":"blocks","created_at":"2026-08-09T14:42:52Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":3,"dependent_count":2,"comment_count":0}

.chezmoidata/packages.yaml

@@ -44,7 +44,8 @@ packages:
       - starship
       # fonts
       - ttf-victor-mono-nerd
-    aur: []
+    aur:
+      - topgrade
     desktop:
       # linux desktop layer (role desktop|laptop)
       pacman:
@@ -83,6 +84,7 @@ packages:
       - glow
       - atuin
       - starship
+      - topgrade
     cask:
       - kitty
       - font-victor-mono-nerd-font

MIGRATION-NOTES.md

@@ -53,6 +53,7 @@ Live `~/.config` entries were symlinks into dotstate storage; content copied wit
 | gh extensions | universal | Declarative list in `packages.yaml` (`shared.gh_extensions`): clean-branches, commit, dash, notify |
 | `.claude/` subset | universal | `settings.json`, `CLAUDE.md`, `commands/`, `hooks/`, `skills/` only. Never `.credentials.json`, `history.jsonl`, `projects/`, `sessions/`, caches |
 | `.ssh/config` | universal | `private_dot_ssh/config`, mode 0600 |
+| `.config/topgrade.toml` | universal | User request; topgrade in packages (AUR on arch — cargo-installed today, brew on mac) |
 
 ## Decisions
 

dot_config/topgrade.toml

@@ -0,0 +1,96 @@
+# ~/.config/topgrade.toml — tailored for CachyOS (Arch · shelly · fish)
+# Only the keys that matter for this box are uncommented; everything else
+# keeps topgrade's sane defaults.
+
+[misc]
+# shelly escalates privileges mid-run; cache sudo creds up front so an
+# unattended run doesn't block on a password prompt halfway through.
+pre_sudo = true
+
+# topgrade on this box is cargo-installed (~/.cargo/bin/topgrade), and the
+# [cargo] step below (cargo-update) already owns updating it. Self-update
+# stays off so two updaters don't fight over the same binary.
+no_self_update = true
+
+# Run distro cleanup after upgrading (paccache / shelly cache clean).
+# Needs `pacman-contrib` for paccache; harmlessly skipped if absent.
+cleanup = true
+
+# Surface *.pacnew / *.pacsave you need to merge — critical on a rolling
+# Arch base. (default true; pinned here as a reminder.)
+show_distribution_summary = true
+
+# Globally skipped steps:
+#   containers → topgrade pulls :latest for every local image on every run,
+#                which is noisy and can drag in breaking tags. Drop this entry
+#                if you actually want your dev images auto-refreshed.
+disable = ["containers", "config_update"]
+
+ignore_failures = ["uv", "containers"]
+
+# NOTE: the [python] pip/conda steps are off by default and left that way —
+# that's what protects your pinned torch 2.10.0+rocm7.2.4 from a blind upgrade.
+
+# Optional: update topgrade on goliath in the same pass. Requires topgrade
+# installed there + tmux locally; rides your existing SSH ControlMaster.
+# remote_topgrades = ["goliath"]
+
+
+[linux]
+# shelly is the CachyOS default package manager CLI now. Pin it so topgrade
+# never silently falls back to bare `pacman` (which would skip the AUR *and*
+# CachyOS's precompiled-AUR repo), and never picks up the still-installed
+# paru via autodetect.
+# Valid values: autodetect, aura, garuda_update, pacman, pamac, paru, pikaur,
+#               shelly, trizen, yay
+arch_package_manager = "paru"
+
+# Pull archlinux.org news before the upgrade. CachyOS tracks Arch, so
+# manual-intervention advisories (keyring, library bumps) still apply to you.
+show_arch_news = true
+
+# Extra flags for shelly, if ever needed (e.g. ignoring a pinned package):
+# shelly_arguments = "upgrade-all -n"
+
+
+[cargo]
+# Also update git-sourced installs (your smartcommit / niri-app / skillforge CLIs),
+# not just crates.io ones. This step is also what keeps topgrade itself fresh.
+git = true
+# Requires the updater binary:  shelly install cargo-update
+
+
+[firmware]
+# Check + display only — review fwupd updates before flashing the Z13 rather
+# than auto-applying firmware in an unattended run.
+upgrade = false
+
+
+[git]
+# Predefined repos still get pulled by default. Add your own globs if you want
+# dotfiles fetched in the same pass; left commented so topgrade doesn't trip
+# over a dirty working tree mid-run.
+# repos = ["~/.config/niri", "~/.config/mango", "~/dotfiles"]
+# arguments = "--rebase --autostash"
+
+
+[flatpak]
+# User-scope flatpaks update without sudo. Only set this if you keep
+# system-wide installs.
+# use_sudo = true
+
+
+[pre_commands]
+# "Emacs Snapshot" = "rm -rf ~/.emacs.d/elpa.bak && cp -rl ~/.emacs.d/elpa ~/.emacs.d/elpa.bak"
+"Dotstate Sync" = "dotstate sync"
+"GHQ Update" = "ghq list | ghq get -u -s"
+
+
+# Commands to run after anything
+[post_commands]
+# "Emacs Snapshot" = "rm -rf ~/.emacs.d/elpa.bak && cp -rl ~/.emacs.d/elpa ~/.emacs.d/elpa.bak"
+"Omp Update" = "omp update"
+"Hermes Update" = "hermes update --backup --yes"
+"Herdr Update" = "herdr update"
+"Shelly Update" = "shelly upgrade-all -n"
+"Cachy Update" = "cachy-update"