diff --git a/docs/fish-config.1 b/docs/fish-config.1
index e18c152..af962c6 100644
--- a/docs/fish-config.1
+++ b/docs/fish-config.1
@@ -354,7 +354,7 @@ Ctrl+Enter Smart execute: runs commands instantly without
at the cursor position.
\f[R]
.fi
-.SS FZF Bindings (from PatrickF1/fzf.fish)
+.SS FZF Bindings (bundled from PatrickF1/fzf.fish)
.IP
.nf
\f[C]
@@ -1795,10 +1795,10 @@ Highlights: #F38BA8 (red) #CBA6F7 (mauve) #B4BEFE (lavender)
To customize, override FZF_DEFAULT_OPTS in local.fish.
.SS Catppuccin Mocha Syntax Highlighting
.PP
-The catppuccin/fish plugin applies syntax highlight colors on first run.
+The Catppuccin Mocha theme ships with this config in themes/ and is
+applied on first run via \f[V]conf.d/first_run.fish\f[R].
Colors are stored in fish_variables (universal).
-To switch variants, install a different theme from the themes/
-directory:
+To switch variants, install a different theme from themes/:
.IP
.nf
\f[C]
@@ -1825,23 +1825,96 @@ set -Ue __fish_config_first_run_complete
.fi
.PP
Then open a new shell.
+.SS Fisher-Managed Plugins
.PP
-The plugin list is maintained in fish_plugins at the config root.
+The following plugins are fully managed by Fisher.
+Their files are installed into the repo directory by Fisher and are
+listed in \f[V].gitignore\f[R] \[em] do not commit them.
+Fisher installs and updates them automatically.
.IP
.nf
\f[C]
jorgebucaran/fisher Plugin manager itself
-catppuccin/fish Catppuccin Mocha color theme
-PatrickF1/fzf.fish fzf integration for Fish
-franciscolourenco/done Desktop notification when long commands finish
-jorgebucaran/autopair.fish Auto-pair brackets and quotes
meaningful-ooo/sponge Remove failed commands from history
-nickeb96/puffer-fish !! / !$ / ./ expansion
+\f[R]
+.fi
+.SS Sponge History Filtering
+.PP
+Sponge removes failed commands from history and, via
+conf.d/sponge_privacy.fish, also filters privacy-sensitive commands
+through three layers:
+.PP
+Layer 1 \[em] Static patterns (universal, persistent across sessions):
+Commands matching any of these structural signatures are never recorded:
+.IP
+.nf
+\f[C]
+--password / --token / --passphrase / --api-key flags with values
+Inline env assignments: GITHUB_TOKEN=xxx, MY_API_KEY=abc
+Fish set with sensitive names: set -gx GITHUB_TOKEN xxx
+URLs with embedded credentials: https://user:pass\[at]host
+HTTP Authorization headers: curl -H \[dq]Authorization: ...\[dq]
+Basic auth flags: curl -u user:pass
+sshpass, docker login -p, openssl -passin/-passout
\f[R]
.fi
.PP
-Run \f[V]fisher update\f[R] to update all plugins, or
-\f[V]fish-deps update\f[R] which calls fisher update as its first step.
+Layer 2 \[em] Dynamic secret values (session globals, refreshed each
+login): On the first prompt, after secrets.fish has loaded, the literal
+values of all exported variables whose names suggest credentials (TOKEN,
+PASSWORD, SECRET, API_KEY, etc.)
+are collected, regex-escaped, and added as a session-scoped overlay.
+Because globals shadow universals in Fish, the combined list is what
+sponge sees.
+Rotating a token takes effect on the next login automatically.
+.PP
+Layer 3 \[em] Per-command filter (sponge_filter_secrets): Catches
+credentials in variables exported after login, such as tokens sourced
+from a project .env file mid-session.
+.PP
+To add your own persistent patterns:
+.IP
+.nf
+\f[C]
+set -U -a sponge_regex_patterns \[aq]your-regex-here\[aq]
+\f[R]
+.fi
+.SS Bundled Plugin Functionality
+.PP
+The remaining plugin functionality is bundled directly with this config
+rather than managed through Fisher.
+The bundled versions include customizations for Fish 4.x compatibility
+and improved behavior that differ from their upstream releases.
+Installing them through Fisher would overwrite these customizations.
+.PP
+Bundled components and their upstream origins:
+.IP
+.nf
+\f[C]
+catppuccin/fish → themes/ + conf.d/theme.fish
+PatrickF1/fzf.fish → functions/_fzf_*.fish + conf.d/fzf.fish
+franciscolourenco/done → conf.d/done.fish
+jorgebucaran/autopair.fish → functions/_autopair_*.fish + conf.d/autopair.fish
+nickeb96/puffer-fish → functions/_puffer_fish_*.fish + conf.d/puffer.fish
+\f[R]
+.fi
+.PP
+Do not run \f[V]fisher install\f[R] for these \[em] it will overwrite
+the customized versions.
+To update their behavior, edit the relevant bundled files directly.
+.SS fish_plugins Manifest
+.PP
+The \f[V]fish_plugins\f[R] file at the config root:
+.IP
+.nf
+\f[C]
+jorgebucaran/fisher Plugin manager itself
+meaningful-ooo/sponge Remove failed commands from history
+\f[R]
+.fi
+.PP
+To update all Fisher-managed plugins, run \f[V]fisher update\f[R] or
+\f[V]fish-deps update\f[R] which calls it as its first step.
.PP
* * * * *
.SH 9. INSTALLATION
@@ -1857,8 +1930,10 @@ git clone https://git.rootiest.dev/rootiest/fish-config.git \[ti]/.config/fish
.fi
.PP
Then open a new Fish shell.
-Fisher and all plugins install automatically on first launch and the
-Catppuccin Mocha theme is applied.
+Fisher installs automatically on first launch and the Catppuccin Mocha
+theme is applied.
+All other plugin functionality is bundled directly with this config and
+requires no additional installation.
.SS Return Sentinel
.PP
config.fish ends with a return sentinel guard.
diff --git a/docs/html/11-7-customization.html b/docs/html/11-7-customization.html
index 96cbdc9..698b5ad 100644
--- a/docs/html/11-7-customization.html
+++ b/docs/html/11-7-customization.html
@@ -536,9 +536,10 @@ Highlights: #F38BA8 (red) #CBA6F7 (mauve) #B4BEFE (lavender)Catppuccin Mocha Syntax
Highlighting
-The catppuccin/fish plugin applies syntax highlight colors on first
-run. Colors are stored in fish_variables (universal). To switch
-variants, install a different theme from the themes/ directory:
+The Catppuccin Mocha theme ships with this config in themes/ and is
+applied on first run via conf.d/first_run.fish. Colors are
+stored in fish_variables (universal). To switch variants, install a
+different theme from themes/:
fish_config theme save "Catppuccin Latte"
diff --git a/docs/html/12-8-fisher-plugins.html b/docs/html/12-8-fisher-plugins.html
index 2322d7f..155b540 100644
--- a/docs/html/12-8-fisher-plugins.html
+++ b/docs/html/12-8-fisher-plugins.html
@@ -498,17 +498,64 @@ overhead.
or for testing), run: