docs: correct spec+plan for self-vs-inputs in imports

The fix subagent found that inputs.hermes-agent.nixosModules.default
inside `imports` causes infinite recursion in this repo's wiring
(inputs comes from _module.args, which merges after imports resolve;
self comes from specialArgs, which is available at import-time).
Tested both ways. Update docs to show self.inputs, matching commit
31e1910.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S

docs/superpowers/plans/2026-09-08-hermes-agent-mibook.md

@@ -58,7 +58,7 @@ No other files change.
 
 **Interfaces:**
 - Produces: NixOS option `my.profiles.hermes-agent.enable` (bool). When true, configures `services.hermes-agent` with `environmentFiles = [ config.sops.secrets."hermes-env".path ]` and grants `finn` the `hermes` group. Declares `sops.secrets.hermes-env` (owner/group `hermes`, path resolves to `/run/secrets/hermes-env` at runtime — but note the *service* re-copies it to `/var/lib/hermes/.hermes/.env`, per the spec's persistence note).
-- Consumes: `hermes-agent.nixosModules.default` from the new flake input, imported directly inside the profile module via the `inputs` module arg (see Step 3) — not through `machines/configuration.nix`; existing `sops.secrets.<name>` mechanism from `machines/core/sops.nix` (already applied to every machine, unaffected by this task).
+- Consumes: `hermes-agent.nixosModules.default` from the new flake input, imported directly inside the profile module via `self.inputs` (the `self` module arg, from `specialArgs` — see Step 3 and Step 5's note on why not the `inputs` module arg) — not through `machines/configuration.nix`; existing `sops.secrets.<name>` mechanism from `machines/core/sops.nix` (already applied to every machine, unaffected by this task).
 
 - [ ] **Step 1: Add the flake input**
 
@@ -109,14 +109,14 @@ Create `modules/environments/hermes-agent/default.nix`:
   config,
   lib,
   pkgs,
-  inputs,
+  self,
   ...
 }:
 let
   cfg = config.my.profiles.hermes-agent;
 in
 {
-  imports = [ inputs.hermes-agent.nixosModules.default ];
+  imports = [ self.inputs.hermes-agent.nixosModules.default ];
 
   options.my.profiles.hermes-agent.enable =
     lib.mkEnableOption "Hermes Agent (Telegram + Email gateway)";
@@ -139,9 +139,15 @@ in
 }
 ```
 
-The `inputs` argument is available automatically — every module in this
-repo gets it via `_module.args.inputs = self.inputs;` in
-`machines/configuration.nix`, no extra wiring needed.
+**Use `self`, not `inputs`, in the `imports` line.** `inputs` is supplied
+via `_module.args.inputs = self.inputs;`, set inside a config block —  but
+NixOS resolves a module's `imports` before `_module.args` assignments
+merge, so anything referenced inside `imports` must come from
+`specialArgs` (fixed up front) instead. `self` is threaded via
+`specialArgs = { inherit self; };` in `machines/configuration.nix` and is
+available at import-time; `inputs` is not. Using `inputs` here reproduces
+`infinite recursion encountered` — confirmed by testing it directly, not
+theoretical. `self.inputs.hermes-agent` is the same flake input either way.
 
 - [ ] **Step 6: Register the module in the environments import list**
 

docs/superpowers/specs/2026-09-08-hermes-agent-nixos-design.md

@@ -48,10 +48,16 @@ hermes-agent = {
 ```
 
 Import the upstream module **from inside the profile module itself**, via
-`imports = [ inputs.hermes-agent.nixosModules.default ];` — using the
-`inputs` module arg already provided repo-wide by
-`_module.args.inputs = self.inputs;` in `machines/configuration.nix`.
-**Correction (found during implementation, 2026-09-08):** this is
+`imports = [ self.inputs.hermes-agent.nixosModules.default ];` — using
+`self` (available via `specialArgs = { inherit self; };` in
+`machines/configuration.nix`), not the `inputs` module arg. **Correction
+(found during implementation, 2026-09-08):** `inputs` is supplied via
+`_module.args.inputs = self.inputs;`, set inside a config block — but
+NixOS resolves a module's `imports` list before `_module.args` assignments
+merge, so anything referenced inside `imports` must come from
+`specialArgs` (fixed up front) instead. Using `inputs` here reproduces
+`infinite recursion encountered`; `self.inputs.hermes-agent` is the same
+flake input, reached the way that actually works. Separately, this is
 deliberately *not* wired through `machines/configuration.nix`'s per-machine
 module lists. NixOS's module system errors on a definition for an
 undeclared option regardless of `lib.mkIf`'s condition — so declaring
@@ -72,14 +78,14 @@ repo's standard profile pattern:
   config,
   lib,
   pkgs,
-  inputs,
+  self,
   ...
 }:
 let
   cfg = config.my.profiles.hermes-agent;
 in
 {
-  imports = [ inputs.hermes-agent.nixosModules.default ];
+  imports = [ self.inputs.hermes-agent.nixosModules.default ];
 
   options.my.profiles.hermes-agent.enable =
     lib.mkEnableOption "Hermes Agent (Telegram + Email gateway)";