@sebastienrousseau/dotfiles 0.2.503 → 0.2.504

package/CHANGELOG.md

@@ -2,7 +2,33 @@
 
 This file documents all notable changes to this project.
 
-## v0.2.503 (unreleased)
+## v0.2.504 — 2026-06-03
+
+First-class **stock-macOS** support: the installer and the entire `dot` CLI
+now run correctly under the system `/bin/bash` 3.2, and the mise↔chezmoi
+ownership conflict is resolved structurally. Found by performing a clean
+end-to-end install and exercising every command. Full suite: 4821/4821.
+
+### Fixed
+
+- **macOS bash 3.2 compatibility** across the CLI, which had assumed bash 4+:
+  - iTerm2 profile `run_onchange` used `declare -A` and aborted `chezmoi apply`; rewritten with indexed arrays.
+  - `dot ai` used `local -n` namerefs + `declare -A`; now passes arrays by value and reads probe results from the cached TSV via `awk`.
+  - `dot security-score` and the `matrix` effect dropped `declare -A` (parallel arrays / `case`).
+  - `dot fleet apply` replaced the bash-4.3 `wait -n` throttle with a portable PID-FIFO; `dot theme rebuild` now requires bash 4 and re-execs under a newer bash when available.
+  - `dot perf` / `dot bundle` / `dot benchmark` / `dot doctor` / `dot sync` and the pre-commit hook: empty-array `"${arr[@]}"` under `set -u` aborted on bash 3.2; cleanup traps now use the `set +u` idiom.
+  - `.bashrc` guards bash-4-only `shopt` options (`globstar`, `dirspell`, `autocd`).
+- **Installer:** backup loop no longer recurses into live `~/.ssh/agent` sockets; seeds git identity from `git config --global` and prints a hint when none is set. The v0.2.503 migration no longer exits non-zero under `set -e`.
+- **mise:** the chezmoi-managed base config moved to `conf.d/00-dotfiles.toml`; `~/.config/mise/config.toml` is now mise's `.chezmoiignore`'d writable global, so `mise use -g` no longer drifts the source. An absent `gh` token no longer breaks the whole config, and the x86_64-only hyperfine aqua package (unrunnable on Apple Silicon) is no longer managed by mise. `version-sync.sh` no longer hangs on a non-TTY stdin (rg now searches the tree, not stdin) and respects `EXCLUDE_FILES`.
+- **`Brewfile.cli`:** add `zellij` and `sops` (checked by `dot doctor`, previously absent).
+- **`dot version-locks`** is `.chezmoiroot`-aware again (had reported "config not found" since the v0.2.503 reorg).
+- **Tests:** robust large-HEIC wallpaper dimension probe (`-ping`); `test_perf_percentiles` trusts mise in its isolated environment.
+
+### Changed
+
+- Homebrew/Scoop release installers now actually install (sha256 substitution, Scoop `extract_dir` + Windows entrypoint).
+
+## v0.2.503 — 2026-05-30
 
 Polish + cross-platform + Scorecard release **plus** the
 incremental repo reorganisation per

package/README.md

@@ -10,7 +10,7 @@
 
 <p align="center">
   <a href="https://github.com/sebastienrousseau/dotfiles/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=github" alt="Build" /></a>
-  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.503-blue?style=for-the-badge" alt="Version" /></a>
+  <a href="https://github.com/sebastienrousseau/dotfiles/releases/latest"><img src="https://img.shields.io/badge/Version-v0.2.504-blue?style=for-the-badge" alt="Version" /></a>
   <a href="https://github.com/sebastienrousseau/dotfiles/releases"><img src="https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge" alt="Downloads" /></a>
   <a href="https://codespaces.new/sebastienrousseau/dotfiles"><img src="https://img.shields.io/badge/Open%20in-Codespaces-blue?style=for-the-badge&logo=github" alt="Open in GitHub Codespaces" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles"><img src="https://img.shields.io/ossf-scorecard/github.com/sebastienrousseau/dotfiles?style=for-the-badge&label=OpenSSF%20Scorecard" alt="OpenSSF Scorecard" /></a>
@@ -52,8 +52,8 @@
 
 ```bash
 curl -fsSL -o /tmp/dotfiles-install.sh \
-  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.503/install.sh
-echo "4c0303a2d88d5aed98428ab0da37618c9795af4dae0e6549646c2fce5235c280  /tmp/dotfiles-install.sh" \
+  https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.504/install.sh
+echo "d5a04c5e2813a93a63c8ecce9655cf3d107f6068862c6eba84a92cf22f801c7e  /tmp/dotfiles-install.sh" \
   | shasum -a 256 -c
 bash /tmp/dotfiles-install.sh
 ```

package/docs/COPYRIGHT

@@ -1,5 +1,5 @@
 /*
-* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.503) - <https://github.com/sebastienrousseau/dotfiles>
+* 🅳🅾🆃🅵🅸🅻🅴🆂 (v0.2.504) - <https://github.com/sebastienrousseau/dotfiles>
 * Made With ❤️ in London, United Kingdom
 * Designed by
 * Copyright (c) 2015-2026. All rights reserved.

package/docs/OPENCODE.md

@@ -117,7 +117,7 @@ install.sh                  # Bootstrap installer
 ### Key Data Files
 
 - `.chezmoidata.toml` — All configuration: profiles, feature flags, tool settings
-- `dot_config/mise/config.toml` — mise tool versions (node, python, go, rust, etc.)
+- `dot_config/mise/conf.d/00-dotfiles.toml` — mise tool versions (node, python, go, rust, etc.); the writable `~/.config/mise/config.toml` is mise-owned and not chezmoi-managed
 - `dot_config/starship.toml.tmpl` — Prompt configuration
 
 ### Testing

package/docs/index.md

@@ -7,7 +7,7 @@ render_with_liquid: false
 Cross-platform, signed, local-first dotfiles for macOS, Linux, and WSL.
 
 [![Build](https://img.shields.io/github/actions/workflow/status/sebastienrousseau/dotfiles/ci.yml?style=for-the-badge&logo=github)](https://github.com/sebastienrousseau/dotfiles/actions)
-[![Version](https://img.shields.io/badge/Version-v0.2.503-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.503)
+[![Version](https://img.shields.io/badge/Version-v0.2.504-blue?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.504)
 [![Downloads](https://img.shields.io/github/downloads/sebastienrousseau/dotfiles/total?style=for-the-badge)](https://github.com/sebastienrousseau/dotfiles/releases)
 
 This site is published from the `docs/` directory on `master` and tracks the current workstation baseline, operational guidance, and security material for the repository.
@@ -38,6 +38,6 @@ This site is published from the `docs/` directory on `master` and tracks the cur
 
 ## Current Release
 
-- Current tagged release: [`v0.2.503`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.503)
+- Current tagged release: [`v0.2.504`](https://github.com/sebastienrousseau/dotfiles/releases/tag/v0.2.504)
 - Latest release feed: [GitHub releases](https://github.com/sebastienrousseau/dotfiles/releases/latest)
 - Source repository: [sebastienrousseau/dotfiles](https://github.com/sebastienrousseau/dotfiles)

package/docs/manual/00-introduction.md

@@ -4,7 +4,7 @@ render_with_liquid: false
 
 # Introduction
 
-This manual describes `.dotfiles` v0.2.503 — a trusted agent workstation baseline for macOS, Linux, and WSL.
+This manual describes `.dotfiles` v0.2.504 — a trusted agent workstation baseline for macOS, Linux, and WSL.
 
 The repository is more than a personal dotfiles collection. It ships as workstation infrastructure: signed, attested, multi-platform, AI-aware, and self-healing. Chezmoi handles templating and platform differences. The `dot` CLI sits on top and coordinates lifecycle operations.
 

package/install.sh

@@ -59,21 +59,26 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.503)
+  version       The version (tag or branch) to install (default: v0.2.504)
 
 Options:
   --help        Show this help message
   --force       Non-interactive mode (sets DOTFILES_NONINTERACTIVE=1)
   --silent      Quiet mode (sets DOTFILES_SILENT=1)
   --minimal     Minimal profile (disable nvim, tmux, zellij)
+  --provision   After applying configs, install the toolchain (packages,
+                fonts, language tools) via the install/provision scripts.
+                Also enabled by DOTFILES_PROVISION=1. Opt-in because it
+                installs packages and may change OS defaults.
 
 EOF
 }
 
 main() {
-  local version="v0.2.503"
+  local version="v0.2.504"
   local version_set=0
   local minimal=0
+  local provision="${DOTFILES_PROVISION:-0}"
   local _cleanup_files=()
   trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
@@ -86,6 +91,7 @@ main() {
       --silent) export DOTFILES_SILENT=1 ;;
       --force) export DOTFILES_NONINTERACTIVE=1 ;;
       --minimal) minimal=1 ;;
+      --provision) provision=1 ;;
       -*)
         # Catch single-dash and double-dash unknowns the same way.
         error "Unknown option: $arg"
@@ -99,7 +105,7 @@ main() {
         # like `foobar` doesn't trigger a 30s+ network download attempt.
         # Caught by the install.sh fuzz harness (#881).
         if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
-          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.503)."
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.504)."
         fi
         version="$arg"
         version_set=1
@@ -257,6 +263,35 @@ main() {
     sed_in_place 's/^zellij = true/zellij = false/' "$data_file"
   }
 
+  # Carry the user's existing global git identity into chezmoi's data.
+  #
+  # This installer sets up chezmoi via sourceDir rather than `chezmoi init`,
+  # so the config template's prompts for git_name / git_email never run. The
+  # gitconfig template coalesces git_name->name->"" (likewise email,
+  # signingkey) and only emits a [user] block when non-empty — so without
+  # this, a fresh install produces a ~/.gitconfig with no identity at all,
+  # and commits fail with "Author identity unknown". Seed name/email/
+  # signingkey from `git config --global` when present. Idempotent: skips if
+  # the config already carries a [data] block.
+  toml_escape() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g'; }
+  seed_git_identity() {
+    local cfg="$CHEZMOI_CONFIG_FILE"
+    [[ -f "$cfg" ]] || return 0
+    grep -q '^\[data\]' "$cfg" 2>/dev/null && return 0
+    local gname gemail gkey
+    gname="$(git config --global user.name 2>/dev/null || true)"
+    gemail="$(git config --global user.email 2>/dev/null || true)"
+    gkey="$(git config --global user.signingkey 2>/dev/null || true)"
+    [[ -z "$gname" && -z "$gemail" ]] && return 0
+    {
+      printf '\n[data]\n'
+      [[ -n "$gname" ]] && printf 'name = "%s"\n' "$(toml_escape "$gname")"
+      [[ -n "$gemail" ]] && printf 'email = "%s"\n' "$(toml_escape "$gemail")"
+      [[ -n "$gkey" ]] && printf 'signingkey = "%s"\n' "$(toml_escape "$gkey")"
+    } >>"$cfg"
+    echo "   Seeded git identity ($gname <$gemail>) into chezmoi data."
+  }
+
   # 5. Backup existing dotfiles that chezmoi will overwrite
   step "Backing up existing dotfiles..."
   BACKUP_DIR="$HOME/.dotfiles.bak.$(date +"%Y%m%d_%H%M%S")"
@@ -273,6 +308,17 @@ main() {
   if command -v chezmoi >/dev/null && [[ -f "$CHEZMOI_CONFIG_FILE" ]]; then
     while IFS= read -r file; do
       [[ -z "$file" ]] && continue
+      # Skip managed *directories*: chezmoi apply never clobbers a
+      # directory's existing contents, so they don't need backing up, and
+      # `cp -a` on one recurses into things it can't copy — e.g. the live
+      # ssh-agent sockets under ~/.ssh/agent, which spew
+      # "is a socket (not copied)" warnings. The managed files chezmoi
+      # would actually overwrite are listed (and backed up) individually.
+      # `-d` without `-L` excludes only real dirs; symlinks are copied as
+      # links by `cp -a`, so they never recurse.
+      if [[ -d "$file" && ! -L "$file" ]]; then
+        continue
+      fi
       if [[ -e "$file" ]]; then
         rel="${file#"$HOME"/}"
         mkdir -p "$BACKUP_DIR/$(dirname "$rel")"
@@ -304,7 +350,7 @@ main() {
   # 6. Initialize & Apply
   step "Applying Configuration..."
 
-  # ── Auto-migration for v0.2.503 reorg ─────────────────────────────────
+  # ── Auto-migration for v0.2.504 reorg ─────────────────────────────────
   # If the user is upgrading from a pre-0.2.503 install, run the
   # migration script BEFORE `chezmoi apply` so the reorg's source-
   # path moves don't cause chezmoi to delete deployed files.
@@ -313,7 +359,7 @@ main() {
   for migrate_src in "$SOURCE_DIR" "$LEGACY_SOURCE_DIR"; do
     migrate_script="$migrate_src/install/migrate/migrate-v0_2-to-v0_2_503.sh"
     if [[ -x "$migrate_script" ]]; then
-      echo "   Running v0.2.503 migration (idempotent; safe on fresh installs)..."
+      echo "   Running v0.2.504 migration (idempotent; safe on fresh installs)..."
       "$migrate_script" || echo "   migration exited non-zero — continuing apply"
       break
     fi
@@ -323,6 +369,7 @@ main() {
   if [[ -d "$SOURCE_DIR/.git" ]]; then
     echo "   Applying from local source: $SOURCE_DIR"
     ensure_chezmoi_source "$SOURCE_DIR"
+    seed_git_identity
     APPLY_FLAGS=()
     if [[ "${DOTFILES_NONINTERACTIVE:-0}" = "1" ]]; then
       APPLY_FLAGS=(--force --no-tty)
@@ -332,6 +379,7 @@ main() {
     echo "   Migrating from legacy source: $LEGACY_SOURCE_DIR"
     mv "$LEGACY_SOURCE_DIR" "$SOURCE_DIR"
     ensure_chezmoi_source "$SOURCE_DIR"
+    seed_git_identity
     APPLY_FLAGS=()
     if [[ "${DOTFILES_NONINTERACTIVE:-0}" = "1" ]]; then
       APPLY_FLAGS=(--force --no-tty)
@@ -362,6 +410,7 @@ main() {
     fi
 
     ensure_chezmoi_source "$SOURCE_DIR"
+    seed_git_identity
     APPLY_FLAGS=()
     if [[ "${DOTFILES_NONINTERACTIVE:-0}" = "1" ]]; then
       APPLY_FLAGS=(--force --no-tty)
@@ -369,7 +418,49 @@ main() {
     chezmoi apply "${APPLY_FLAGS[@]}"
   fi
 
+  # Toolchain provisioning (opt-in). The install/provision/ scripts (package
+  # managers, fonts, language + AI tools) are chezmoi run_ scripts, but they
+  # live OUTSIDE the .chezmoiroot source dir (defaults/), so `chezmoi apply`
+  # never runs them — a fresh install otherwise ships configs but zero tools.
+  # Run them here only when explicitly requested: they install packages and
+  # can change OS defaults, so we never do it implicitly (CI / Docker /
+  # unattended automation must opt in via --provision or DOTFILES_PROVISION=1).
+  if [[ "$provision" = "1" && $minimal -eq 0 ]]; then
+    step "Provisioning toolchain (packages, fonts, tools)..."
+    local prov_dir="$SOURCE_DIR/install/provision"
+    if [[ -d "$prov_dir" ]]; then
+      local script
+      # run_once_install_* (shells) first, then numbered run_onchange_* in order.
+      while IFS= read -r script; do
+        [[ -f "$script" ]] || continue
+        echo "   → $(basename "$script")"
+        if [[ "$script" == *.tmpl ]]; then
+          chezmoi execute-template <"$script" | bash ||
+            echo "     (step exited non-zero — continuing)"
+        else
+          bash "$script" || echo "     (step exited non-zero — continuing)"
+        fi
+      done < <(ls "$prov_dir"/run_once_install_* "$prov_dir"/run_onchange_* 2>/dev/null | sort)
+    fi
+  elif [[ $minimal -eq 0 ]]; then
+    step "Configs deployed. To also install the toolchain (packages, fonts, tools):"
+    echo "   bash \"$SOURCE_DIR/install.sh\" --provision    # or DOTFILES_PROVISION=1"
+    echo "   (or: brew bundle --file ~/.config/shell/Brewfile.cli)"
+  fi
+
   success "Configuration loaded. Please restart your shell."
+
+  # If no git identity ended up configured, commits will fail with
+  # "Author identity unknown". Point the user at the one-line fix rather
+  # than letting them discover it on their first commit.
+  if [[ -z "$(git config --global user.email 2>/dev/null || true)" ]] &&
+    ! grep -q '^email' "$CHEZMOI_CONFIG_FILE" 2>/dev/null; then
+    step "No git identity detected. Set yours so commits are attributed:"
+    echo "   git config --global user.name  \"Your Name\""
+    echo "   git config --global user.email \"you@example.com\""
+    echo "   then re-run: chezmoi apply"
+  fi
+
   step "Run 'dot learn' for an interactive tour of your new dotfiles."
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.503",
+  "version": "0.2.504",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/README.md

@@ -7,7 +7,7 @@ workflows, by `chezmoi apply` hooks, or by hand.
 
 ## Subtree map
 
-Per the v0.2.503 reorg (RFC `docs/operations/RFC_v0_2_503_reorganization.md`),
+Per the repository reorg (RFC `docs/operations/RFC_v0_2_503_reorganization.md`),
 **repo-only ops** (CI, release, maintenance, docs-generation) have
 moved to the top-level `tools/` tree. `scripts/` retains the
 **runtime-invoked** scripts that the `dot` CLI dispatches to plus a
@@ -17,7 +17,7 @@ few specialised subtrees.
 
 | Path | Purpose | Touched by |
 |---|---|---|
-| `scripts/dot/commands/` | Per-subcommand handlers for the `dot` CLI. Sources `lib/dot/*.sh` (moved out of this tree in v0.2.503 Phase 1). | Dispatched by `bin/dot` |
+| `scripts/dot/commands/` | Per-subcommand handlers for the `dot` CLI. Sources `lib/dot/*.sh` (moved out of this tree in the Phase 1 reorg). | Dispatched by `bin/dot` |
 | `scripts/dot/powershell/` | Native PowerShell module (`Dot.psm1`) exporting `Get-DotVersion` / `Invoke-DotHelp` / `Test-DotAgentsSync`. | `bin/dot.ps1` |
 | `scripts/dot/data/` | Per-command static data (registry seeds, palette tables). | `scripts/dot/commands/*` |
 | `scripts/lib/` | Cross-cutting library helpers reused across multiple scripts. Example: `secrets_provider.sh` (keychain / pass / age dispatch). | `scripts/dot/commands/*`, ops scripts |
@@ -49,7 +49,7 @@ few specialised subtrees.
 The `dot` CLI is implemented as `bin/dot`
 (dispatcher) + `scripts/dot/commands/<cmd>.sh` (per-command
 handlers) + `lib/dot/*.sh` (shared helpers — moved out of
-`scripts/dot/lib/` in v0.2.503 Phase 1 per the
+`scripts/dot/lib/` in the Phase 1 reorg per the
 [reorganisation RFC](../docs/operations/RFC_v0_2_503_reorganization.md)).
 
 | Path | Purpose |

package/scripts/ci/check-copyright-headers.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail

package/scripts/ci/check-shell-preamble.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail

package/scripts/ci/guard-gitleaks-checkout.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
-# Compat shim: the canonical script moved to tools/ci/ in v0.2.503.
+# Compat shim: the canonical script moved to tools/ci/ during the repo reorg.
 # Pinned reusable workflows on master still reference the old path;
 # this delegates so they keep working until the next pin bump.
 set -euo pipefail

package/scripts/diagnostics/benchmark.sh

@@ -41,7 +41,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../../lib/dot/ui.sh

package/scripts/diagnostics/doctor-unified.sh

@@ -4,7 +4,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

package/scripts/diagnostics/perf.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../../lib/dot/ui.sh

package/scripts/diagnostics/security-score.sh

@@ -64,7 +64,25 @@ YELLOW="${YELLOW:-}"
 # Scoring
 TOTAL_POINTS=0
 MAX_POINTS=0
-declare -A CATEGORY_SCORES
+# Parallel indexed arrays instead of `declare -A` (bash 4+; macOS ships
+# bash 3.2). CAT_NAMES[i] holds a category name, CAT_SCORES[i] its running
+# total. Category names can contain spaces, so an emulation via dynamic
+# variable names wouldn't work — a linear scan over the handful of
+# categories is fine.
+CAT_NAMES=()
+CAT_SCORES=()
+
+_cat_add() {
+  local name="$1" pts="$2" i
+  for ((i = 0; i < ${#CAT_NAMES[@]}; i++)); do
+    if [[ "${CAT_NAMES[$i]}" == "$name" ]]; then
+      CAT_SCORES[i]=$((CAT_SCORES[i] + pts))
+      return 0
+    fi
+  done
+  CAT_NAMES+=("$name")
+  CAT_SCORES+=("$pts")
+}
 
 add_points() {
   local category="$1"
@@ -74,7 +92,7 @@ add_points() {
 
   TOTAL_POINTS=$((TOTAL_POINTS + points))
   MAX_POINTS=$((MAX_POINTS + max))
-  CATEGORY_SCORES["$category"]=$((${CATEGORY_SCORES[$category]:-0} + points))
+  _cat_add "$category" "$points"
 
   if ! $JSON_OUTPUT && $VERBOSE; then
     local icon
@@ -339,10 +357,11 @@ print_summary() {
     echo "  \"grade\": \"$(get_grade $score)\","
     echo "  \"categories\": {"
     local first=true
-    for cat in "${!CATEGORY_SCORES[@]}"; do
+    local _ci
+    for ((_ci = 0; _ci < ${#CAT_NAMES[@]}; _ci++)); do
       $first || echo ","
       first=false
-      printf "    \"%s\": %d" "$cat" "${CATEGORY_SCORES[$cat]}"
+      printf "    \"%s\": %d" "${CAT_NAMES[$_ci]}" "${CAT_SCORES[$_ci]}"
     done
     echo ""
     echo "  }"

package/scripts/diagnostics/version-locks.sh

@@ -30,10 +30,20 @@ resolve_source_dir() {
 
 src_dir=$(resolve_source_dir)
 
+# resolve_source_dir returns the repo root, but since the defaults/ reorg the
+# deployable tree lives under the .chezmoiroot subdir (defaults/). Descend
+# into it so paths like dot_config/... resolve. (Without this the mise lookup
+# below silently reported "config not found" on every run.)
+cm_src="$src_dir"
+if [[ -f "$src_dir/.chezmoiroot" ]]; then
+  _cm_root="$(tr -d '[:space:]' <"$src_dir/.chezmoiroot")"
+  [[ -n "$_cm_root" && -d "$src_dir/$_cm_root" ]] && cm_src="$src_dir/$_cm_root"
+fi
+
 ui_header "Version Locks"
 
 ui_section "mise toolchain"
-mise_config="$src_dir/dot_config/mise/config.toml"
+mise_config="$cm_src/dot_config/mise/conf.d/00-dotfiles.toml"
 if [[ -f "$mise_config" ]]; then
   awk -F= '
     /^\[tools\]/ {in_tools=1; next}

package/scripts/dot/commands/ai.sh

@@ -53,7 +53,8 @@ _ai_extract_version() {
 }
 
 _ai_refresh_status_cache() {
-  local -n ai_entries=$1
+  # Entries passed by value (not a `local -n` nameref — bash 4.3+; macOS bash is 3.2).
+  local ai_entries=("$@")
   local tmp_file
   tmp_file="$(mktemp)"
   mkdir -p "$AI_CACHE_DIR"
@@ -134,6 +135,12 @@ _ai_get_cached_status() {
   cat "$AI_STATUS_CACHE_FILE"
 }
 
+# Look up field $2 (2=present 0/1, 3=version) for binary $1 from the
+# cached TSV. Replaces a bash-4 associative array for macOS bash 3.2.
+_ai_status_field() {
+  awk -F'\t' -v b="$1" -v f="$2" '$1==b{print $f;exit}' "$AI_STATUS_CACHE_FILE" 2>/dev/null
+}
+
 # binary -> mise package mapping
 _ai_mise_pkg() {
   case "$1" in
@@ -177,17 +184,9 @@ cmd_ai_status() {
   )
 
   if ! _ai_cache_fresh "$AI_STATUS_CACHE_FILE"; then
-    _ai_refresh_status_cache ai_clis
+    _ai_refresh_status_cache "${ai_clis[@]}"
   fi
 
-  declare -A ai_present=()
-  declare -A ai_version=()
-  local cached_bin cached_present cached_version
-  while IFS=$'\t' read -r cached_bin cached_present cached_version; do
-    ai_present["$cached_bin"]="$cached_present"
-    ai_version["$cached_bin"]="$cached_version"
-  done < <(_ai_get_cached_status)
-
   local -a installed=()
   local -a missing=()
   local current_category=""
@@ -199,8 +198,9 @@ cmd_ai_status() {
       ui_section "$category"
       current_category="$category"
     fi
-    if [[ "${ai_present[$bin]:-0}" == "1" ]]; then
-      ver="${ai_version[$bin]:-installed}"
+    if [[ "$(_ai_status_field "$bin" 2)" == "1" ]]; then
+      ver="$(_ai_status_field "$bin" 3)"
+      [[ -z "$ver" ]] && ver="installed"
       [[ "$bin" == "claude" ]] && ver="${ver%% *}"
       ui_ok "$name" "$ver — $desc"
       installed+=("$name|$bin|$role")

package/scripts/dot/commands/fleet.sh

@@ -583,16 +583,21 @@ EOF
     fi
   }
 
-  local running=0
+  # Throttle to `jobs` concurrent workers. `wait -n` (wait for the next
+  # job to finish) is bash 4.3+, but macOS ships bash 3.2 — there it
+  # silently fails and the throttle collapses to unbounded parallelism.
+  # Track PIDs and block on the oldest when at capacity instead; works on
+  # bash 3.2 and 4+ alike.
+  local _pids=()
   while IFS=$'\t' read -r name ssh profile; do
     [[ -n "$name" && -n "$ssh" ]] || continue
     total=$((total + 1))
-    while ((running >= jobs)); do
-      wait -n 2>/dev/null || break
-      running=$((running - 1))
+    while ((${#_pids[@]} >= jobs)); do
+      wait "${_pids[0]}" 2>/dev/null || true
+      _pids=("${_pids[@]:1}")
     done
     _fleet_apply_one "$name" "$ssh" "$effective_cmd" "$tmpdir" &
-    running=$((running + 1))
+    _pids+=("$!")
   done <<<"$entries"
   wait
 

package/scripts/git-hooks/pre-commit-audit.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 # ANSI Colors
 RED='\033[0;31m'
@@ -140,6 +140,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.503 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.504 standards maintained."
   exit 0
 fi

package/scripts/ops/bundle.sh

@@ -5,7 +5,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # shellcheck disable=SC1091

package/scripts/ops/chezmoi-apply.sh

@@ -11,9 +11,15 @@ source "$SCRIPT_DIR/../../lib/dot/ui.sh"
 source "$SCRIPT_DIR/../../lib/dot/log.sh"
 export DOT_COMMAND="apply"
 
-# Temp file cleanup
+# Temp file cleanup. `set +u` guards the array expansion: on bash 3.2
+# (macOS) expanding an empty array under `set -u` is an "unbound
+# variable" error, which would fire on every clean `dot sync`.
 _TMPFILES=()
-cleanup() { rm -f "${_TMPFILES[@]}"; }
+cleanup() {
+  set +u
+  rm -f "${_TMPFILES[@]}" 2>/dev/null
+  set -u
+}
 trap cleanup EXIT
 
 # Help flag

package/scripts/theme/rebuild-themes.sh

@@ -12,11 +12,33 @@
 #   bash rebuild-themes.sh --list       # List discovered wallpapers without rebuilding
 set -euo pipefail
 
+# This script relies on associative arrays (`declare -A`) and `wait -n`,
+# both of which need bash >= 4. macOS ships /bin/bash 3.2, where it would
+# otherwise fail with cryptic "invalid option" / "bad array subscript"
+# errors mid-run. Re-exec under a newer bash when one is available
+# (Homebrew, MacPorts, mise), and fail with a clear, actionable message
+# otherwise rather than corrupting a half-built themes.toml.
+if ((BASH_VERSINFO[0] < 4)); then
+  for _newer_bash in \
+    /opt/homebrew/bin/bash \
+    /usr/local/bin/bash \
+    "${HOMEBREW_PREFIX:-}/bin/bash" \
+    "$(command -v bash 2>/dev/null || true)"; do
+    if [[ -n "$_newer_bash" && -x "$_newer_bash" ]] &&
+      "$_newer_bash" -c '((BASH_VERSINFO[0] >= 4))' 2>/dev/null; then
+      exec "$_newer_bash" "$0" "$@"
+    fi
+  done
+  echo "Error: 'dot theme rebuild' needs bash >= 4 (macOS ships bash 3.2)." >&2
+  echo "       Install a newer bash and retry:  brew install bash" >&2
+  exit 1
+fi
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EXTRACT_SCRIPT="$SCRIPT_DIR/extract-theme.py"
 DOTFILES_DIR="${HOME}/.dotfiles"
 
-# Descend into the chezmoi source subdir when .chezmoiroot is present (v0.2.503+)
+# Descend into the chezmoi source subdir when .chezmoiroot is present (post-reorg, chezmoi files under defaults/)
 CHEZMOI_SRC="$DOTFILES_DIR"
 if [[ -f "$DOTFILES_DIR/.chezmoiroot" ]]; then
   _sub="$(head -1 "$DOTFILES_DIR/.chezmoiroot" | tr -d '[:space:]')"
@@ -266,7 +288,7 @@ if [[ $TOTAL_WORK -gt 0 ]]; then
       fi
     ) &
 
-    # Limit parallel jobs
+    # Limit parallel jobs (bash >= 4 guaranteed by the guard at the top).
     while [[ $(jobs -r | wc -l) -ge $JOBS ]]; do
       wait -n 2>/dev/null || true
     done

package/scripts/theme/switch.sh

@@ -58,7 +58,7 @@ if [ -z "$SRC_DIR" ]; then
   exit 1
 fi
 
-# Descend into the chezmoi source subdir when .chezmoiroot is present (v0.2.503+)
+# Descend into the chezmoi source subdir when .chezmoiroot is present (post-reorg, chezmoi files under defaults/)
 CHEZMOI_SRC="$SRC_DIR"
 if [[ -f "$SRC_DIR/.chezmoiroot" ]]; then
   _sub="$(head -1 "$SRC_DIR/.chezmoiroot" | tr -d '[:space:]')"

package/scripts/theme/wallpaper-sync.sh

@@ -14,7 +14,7 @@ WALLPAPER_DIR="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
 CHEZMOI_CFG="${XDG_CONFIG_HOME:-$HOME/.config}/chezmoi/chezmoi.toml"
 
 # Resolve dotfiles repo root, then descend into chezmoi source subdir if
-# .chezmoiroot is present (v0.2.503+, where chezmoi files live in defaults/)
+# .chezmoiroot is present (where chezmoi files live in defaults/)
 _DOTFILES_ROOT="${HOME}/.dotfiles"
 [[ ! -d "$_DOTFILES_ROOT" && -d "${HOME}/.local/share/chezmoi" ]] && _DOTFILES_ROOT="${HOME}/.local/share/chezmoi"
 _CHEZMOI_SRC="$_DOTFILES_ROOT"

package/scripts/version-sync.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 _cleanup_files=()
-trap 'rm -f "${_cleanup_files[@]}"' EXIT
+trap 'set +u; rm -f "${_cleanup_files[@]}" 2>/dev/null; set -u' EXIT
 
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -63,6 +63,17 @@ EXCLUDE_FILES=(
   "docs/manual/05-appendices/D-bibliography.md"
   "docs/operations/MAINTENANCE.md"
 
+  # Release-process / structural docs that reference *historical* dotfiles
+  # versions (the repo reorg, past release tags, migration scenarios).
+  # Bumping these each release would corrupt accurate history.
+  "docs/operations/RELEASE_PIPELINE.md"
+  "docs/operations/TESTING.md"
+  "docs/STRUCTURE.md"
+  "install/migrate/README.md"
+  "install/README.md"
+  "tools/README.md"
+  "defaults/README.md"
+
   # CI_COMPOSITES.md cites third-party action versions (e.g. v5.0.5),
   # not dotfiles_version. False-positive pattern match.
   "docs/operations/CI_COMPOSITES.md"
@@ -154,9 +165,14 @@ find_version_files() {
 
   log_info "Scanning for markdown files with version references..."
 
-  # Find all markdown files with version patterns
+  # Find all markdown files with version patterns.
+  # The "." path is required: with no path and a non-TTY stdin (CI, pipes,
+  # background jobs) rg reads from stdin instead of searching the tree, so
+  # the whole script hangs forever. The `sed` strips rg's leading "./" so
+  # the paths match the EXCLUDE_FILES entries (which have no "./"),
+  # otherwise excluded historical docs get rewritten.
   cd "$PROJECT_ROOT"
-  rg -l "v?$VERSION_PATTERN" --type md >"$temp_file" 2>/dev/null || true
+  rg -l "v?$VERSION_PATTERN" --type md . 2>/dev/null | sed 's|^\./||' >"$temp_file" || true
 
   # Add known files that should be checked even if they don't have versions yet
   echo "README.md" >>"$temp_file"