Untrack a retired niri config that was committed as trash; correct two census rows

The repo still tracked `dotfiles/niri/.config/niri/cfg/.AGENTTRASH/display.kdl.superseded`
— a retired output config committed 2026-10-09, five days before `.gitignore` grew the
`.AGENTTRASH/` rule. Tracked-then-ignored: an ignore rule never reaches an already-tracked
path, so `git rm --cached` is the only repair. The working copy joins the rest of today's
tracked debt.

Found while answering "does this repo still track my noctalia and niri settings", which
also falsified two rows of the census committed yesterday: niri is 9 tracked files, not
12; noctalia is 3 authored files against 2672 files of app state and downloaded catalog,
not 2/0. The page's own classifier command reproduces the new numbers — it never
reproduced the old ones, which is the only reason they were wrong and not merely
different.

Two laws recorded alongside, both from the same probe: `config.kdl`'s
`include "noctalia.kdl"` is not `optional=true`, so a fresh box cannot start niri until
the theme pipeline has run once; and `cfg/display.kdl -> desk-1-home.kdl` is desk state a
fresh box does not receive — by design, but nowhere written down.

Refs #40

omp-docs/tools/dotfiles-deploy.md

@@ -32,7 +32,7 @@ instead of crash-looping.
 
 **The tracked unit is the file, not the directory.** A live directory can be a real
 directory and still be fully tracked, because every file inside it is a symlink into the
-repo (`niri` is 12 tracked / 1 box-only; `gtk-3.0` is 3/0). Any audit that classifies by
+repo (`niri` is 9 tracked / 1 box-only; `gtk-3.0` is 3/0). Any audit that classifies by
 directory mislabels the tree — classify per file with `readlink -f`. The live census and
 its classifier command are in [home-config-census](/inventory/home-config-census.md).
 
@@ -70,3 +70,23 @@ ls -l ~/.config/systemd/user/default.target.wants/
 
 Fix is to relink into the deployment checkout (`~/.omp/dotfiles/…`), `systemctl --user
 daemon-reload`, then confirm with `is-active` — `is-enabled` proves nothing.
+
+## Law: a generated file must never be a required include
+
+`~/.config/niri/config.kdl` ends with `include "noctalia.kdl"` — no `optional=true`.
+That file is noctalia's palette output (`#ff8c00`, `#f43841`, one re-stamp
+`2026-10-18 17:36:27`), so it is machine state and correctly untracked. But on a fresh
+box `deploy.sh` links `config.kdl` first, and niri then refuses to start until noctalia
+has run once and written the file — the compositor is bricked by the order of operations,
+not by a bad config. Close it at the include, which survives someone skipping the theme
+pipeline: mark generated includes `optional=true`, as the `display.kdl` and
+`switch-events.kdl` lines in the same file already are.
+
+## Desk choice is live state, never config
+
+`~/.config/niri/cfg/display.kdl` is a relative symlink to whichever profile is active
+(`desk-1-home.kdl`, `desk-2-portable.kdl`), written by `desk.sh`. Both profiles are
+tracked in `dotfiles/zz-blankpad/`; the pointer is not, because which desk the box sits on
+is not a fact about the repo. A fresh box therefore starts with no output configuration —
+`config.kdl` includes `display.kdl` with `optional=true`, so niri comes up usable but with
+default monitors until `desk.sh` is run once.