docs: reconcile CLAUDE.md/DECISIONS with what shipped (sudo approach, rrsync, set -e lessons)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -21,16 +21,19 @@ laptop" shape).
 
 ## Current State
 
-- **Phase:** ideation -> design approved-ish; spec at `docs/plans/2026-09-15-mac-setup-design.md`
+- **Phase:** shipping — `scripts/run.sh` applied & verified 2026-09-15. Manual checklist (`docs/manual-checklist.md`) pending Seth; Ableton not yet installed.
 - **Repo:** `git.sethpc.xyz/Seth/mac`
 - **Deploy target:** the MacBook, `ssh mac` (192.168.0.94, user seth, en0 Wi-Fi)
 - **Hardware:** MacBookPro18,1 (16" 2021), M1 Pro, 32 GB, 512 GB. **macOS 26.2 Tahoe.**
 - Remote Login enabled + claude key installed 2026-09-15. `ssh mac` works from steel141.
 - **FileVault is on** — no SSH after a reboot until the password is typed at the lid.
-- Stock state is already clean: no Homebrew/CLT, only Safari in /Applications,
-  Siri off, Apple Intelligence opted out. Full snapshot:
-  `docs/reference/inventory-2026-09-15.md` — read when checking "was X stock?".
-- No changes made yet.
+- Applied: Homebrew + Brewfile (GNU userland, kitty, rectangle, tailscale-app),
+  bash5 login shell, hostname `mac`, Linux-feel + debloat `defaults`, Dock=2 apps,
+  DAW power profile (AC sleep 0 / powernap 0), nightly rsync backup agent.
+  Pre-change inventory: `docs/reference/inventory-2026-09-15.md`.
+- Backup: `~/Music/Ableton` + `~/Documents` -> `pve173:/tank/backups/mac` nightly
+  03:30 via launchd; key is rrsync-jailed; sanoid keeps history (tank_media template).
+- SparkFun PPP service left in place (macOS won't remove the sole service on a port; harmless).
 
 ## Conventions
 
@@ -40,5 +43,5 @@ laptop" shape).
 - Before any `launchctl disable`/`bootout`: record current `launchctl print` state to `.backup/`
 - Homebrew `Brewfile` at repo root is the package manifest — `brew bundle` is the install
 - macOS gotchas go in this file's Conventions; per-decision reasoning goes in `DECISIONS.md`
-- **Apply everything:** `scripts/run.sh` from steel141 (sudo primed from `$HOMELAB_PASSWORD` over `ssh -tt`). Second run must be all `[skip]`.
+- **Apply everything:** `scripts/run.sh` from steel141. It installs a TEMPORARY `/etc/sudoers.d/mac-setup` (NOPASSWD) via `_install_sudoers.sh` for the run and removes it on every exit path (+40-min on-Mac self-destruct backstop). Needs `$HOMELAB_PASSWORD`. Second run is all `[skip]`.
 - GUI-only steps live in `docs/manual-checklist.md` — read when something "didn't apply" (it's probably on that list).