Merge remote-tracking branch 'origin/main' into refactor/shared-color-palette

# Conflicts:
#	tests/functional.fish

completions/tailscale.fish

@@ -228,16 +228,15 @@ function __tailscale_prepare_completions
     return 0
 end
 
-# Since Fish completions are only loaded once the user triggers them, we trigger them ourselves
+# REMOVED (2026-09-07): Cobra's self-priming block —
-# so we can properly delete any completions provided by another script.
+#   if type -q "tailscale"; complete --do-complete "tailscale " >/dev/null 2>&1; end
-# Only do this if the program can be found, or else fish may print some errors; besides,
+# It existed to force any pre-existing tailscale completions to load so the
-# the existing completions will only be loaded if the program can be found.
+# `complete -c tailscale -e` below could erase them. From completions/ it has
-if type -q "tailscale"
+# no job: fish autoloads only the FIRST match on $fish_complete_path, and
-    # The space after the program name is essential to trigger completion for the program
+# $__fish_config_dir/completions precedes /usr/share/fish/vendor_completions.d,
-    # and not completion of the program name itself.
+# so the vendor file is never sourced and there is nothing to erase. It also
-    # Also, we use '> /dev/null 2>&1' since '&>' is not supported in older versions of fish.
+# executed the tailscale binary at startup. Verified: completion output is
-    complete --do-complete "tailscale " > /dev/null 2>&1
+# byte-identical with and without it. See AGENTS/specs/2026-09-07-startup-latency-design.md D2.
-end
 
 # Remove any pre-existing completions for the program since we will be handling all of them.
 complete -c tailscale -e

conf.d/abbr.fish

@@ -12,6 +12,9 @@
 #   site abbr-integrations: integrations/terminal-abbrs
 #   site abbr-overrides: overrides/key-bindings
 
+# Abbreviations only expand in the line editor; a script can never use one.
+status is-interactive; or return
+
 # Neovim
 # @category Editors
 # @desc nvim

conf.d/auto-pull.fish

@@ -13,6 +13,11 @@
 #
 # Manage the registry with: auto-pull add / remove / list / status
 
+# Registers an --on-variable PWD handler that backgrounds a git fetch. In a
+# script that cd's, that is both wasted work and AGENTS.md Task #4's
+# credential-prompt hazard fired from a background job.
+status is-interactive; or return
+
 # C2 guard: when auto-execution is disabled, do not register the handler.
 __fish_config_op_enabled (status basename); or exit
 

conf.d/bash_expands.fish

@@ -7,6 +7,10 @@
 # Provides bash-style history expansion functions for abbreviations.
 # These functions are gated by the C3 overrides switch.
 
+# The six expand_* functions are reachable only through abbr --function
+# (conf.d/abbr.fish:677-697), i.e. only during interactive expansion.
+status is-interactive; or return
+
 # Execute expand_bang_all
 function expand_bang_all --description 'Execute expand_bang_all'
     # Opinionated guard (C3): no expansion when overrides are disabled.

conf.d/key_bindings.fish

@@ -47,6 +47,10 @@
 # This allows for rapid-fire math without leaving the current shell.
 # ──────────────────────────────────────────────────────────────────────
 
+# Defines only fish_user_key_bindings, which fish calls from the interactive
+# reader and nowhere else.
+status is-interactive; or return
+
 function fish_user_key_bindings
 
     # Custom key chords are opinionated (C3 overrides); skip them entirely

conf.d/logging-events.fish

@@ -13,6 +13,12 @@
 # solely in functions/ are never registered and their --on-variable triggers
 # never fire.
 
+# Calls __fish_config_sync_logging at every shell start, which mkdir+touches
+# the C5 sentinel on disk. Its only consumers — the Kitty watcher and the
+# paru/yay wrappers — are interactive-context; every interactive shell still
+# refreshes it.
+status is-interactive; or return
+
 function __fish_config_logging_changed --on-variable __fish_config_op_logging \
     --description 'C5 event handler: sync logging state when __fish_config_op_logging changes'
     __fish_config_sync_logging

conf.d/paru-wrapper.fish

@@ -10,6 +10,10 @@
 #   site paru-autoexec: autoexec/pkg-wrappers
 #   site paru-logging: logging/pkg-logs
 
+# Defines nothing; its only effect is generating ~/.local/bin/paru, an
+# idempotent write every interactive session already performs.
+status is-interactive; or return
+
 # Auto-generating a wrapper in ~/.local/bin is opinionated (C2 auto-exec).
 # Wrapper generation is also gated by C5 (Logging & Capture).
 __fish_config_op_enabled (status basename) paru-autoexec; or return

conf.d/starship.fish

@@ -9,6 +9,10 @@
 # Without starship, fish's built-in prompt already emits OSC 133;A
 # on the prompt line itself, so no wrapper is needed.
 
+# Defines fish_prompt; no script renders a prompt. Checked before the
+# op-guard so the builtin short-circuits ahead of three function autoloads.
+status is-interactive; or return
+
 # Replacing the prompt is opinionated (C3 overrides)
 __fish_config_op_enabled (status basename); or return
 

conf.d/theme.fish

@@ -20,6 +20,11 @@ if not __fish_config_op_enabled (status basename)
     return
 end
 
+# Below the cleanup block on purpose: that branch erases a stale universal
+# FZF_DEFAULT_OPTS and must keep running wherever it runs today. Everything
+# past here is fish_color_* for the syntax highlighter, interactive-only.
+status is-interactive; or return
+
 #   ────────────────────── Syntax highlighting colors ──────────────────────
 set --global fish_color_autosuggestion 6c7086
 set --global fish_color_cancel f38ba8

conf.d/tricks.fish

@@ -18,20 +18,32 @@ if test -f ~/.fish_profile
     source ~/.fish_profile
 end
 
-# Append unique directories to $PATH (fish_add_path handles duplicates automatically)
+# This file is sourced twice per shell on CachyOS (once by the conf.d
-fish_add_path ~/.local/bin
+# autoload, once forced by config.fish to re-win over the distro's own
-fish_add_path ~/Applications/depot_tools
+# tricks.fish). The PATH/MANPAGER setup below doesn't need to repeat on
+# the second pass -- only the functions/aliases further down do, since
+# those are what re-assert over the distro config. Gate the expensive
+# calls (fish_add_path, type -q bat) behind a once-per-session guard.
+# ponytail: per-session guard, not per-value; if this file grows more
+# expensive one-time setup, extend the same guard rather than adding more.
+if not set -q __fish_config_tricks_env_applied
+    set -g __fish_config_tricks_env_applied 1
 
-# Expose user-local man pages
+    # Append unique directories to $PATH (fish_add_path handles duplicates automatically)
-if not contains ~/.local/share/man $MANPATH
+    fish_add_path ~/.local/bin
+    fish_add_path ~/Applications/depot_tools
+
+    # Expose user-local man pages
+    if not contains ~/.local/share/man $MANPATH
         set -gx MANPATH ~/.local/share/man $MANPATH
-end
+    end
 
-# Format man pages using bat (only if bat is installed)
+    # Format man pages using bat (only if bat is installed)
-# Overriding $MANPAGER is opinionated (C3 overrides)
+    # Overriding $MANPAGER is opinionated (C3 overrides)
-if type -q bat; and __fish_config_op_enabled (status basename) tricks-manpager
+    if type -q bat; and __fish_config_op_enabled (status basename) tricks-manpager
         set -gx MANROFFOPT -c
         set -gx MANPAGER "sh -c 'col -bx | bat -l man -p'"
+    end
 end
 
 # Set settings for https://github.com/franciscolourenco/done

conf.d/wakatime.fish

@@ -9,6 +9,10 @@
 #   site wakatime-autoexec: autoexec/telemetry
 #   site wakatime-hook: integrations/notifications
 
+# Registers a fish_postexec handler; that event is emitted only by the
+# interactive reader, so the handler is dead weight in a script.
+status is-interactive; or return
+
 # Local modification: opinionated guard (AGENTS.md Task #3). WakaTime
 # reporting is classified under both C2 auto-execution and C4 integrations;
 # disabling either category skips registering the hook.

conf.d/yay-wrapper.fish

@@ -10,6 +10,10 @@
 #   site yay-autoexec: autoexec/pkg-wrappers
 #   site yay-logging: logging/pkg-logs
 
+# Defines nothing; its only effect is generating ~/.local/bin/yay, an
+# idempotent write every interactive session already performs.
+status is-interactive; or return
+
 # Auto-generating a wrapper in ~/.local/bin is opinionated (C2 auto-exec).
 # Wrapper generation is also gated by C5 (Logging & Capture).
 __fish_config_op_enabled (status basename) yay-autoexec; or return

docs/fish-config.md

@@ -46,7 +46,6 @@ The configuration uses a structured file tree:
     ├── conf.d/
     │   ├── abbr.fish               All abbreviations
     │   ├── autopair.fish           Auto-pair brackets and quotes
-    │   ├── cheat.fish              cheat.sh tab completions
     │   ├── done.fish               Desktop notifications for long commands
     │   ├── first_run.fish          One-time init: Fisher bootstrap, theme
     │   ├── key_bindings.fish       Custom key bindings and Vi mode
@@ -58,14 +57,13 @@ The configuration uses a structured file tree:
     │   ├── zellij-logging.fish     C5 fish_exit handler for zellij
     │   ├── sponge_privacy.fish     Sponge privacy patterns
     │   ├── starship.fish           fish_prompt shell-integration markers
-    │   ├── tailscale.fish          Tailscale CLI tab completions
     │   ├── theme.fish              Catppuccin syntax highlight colors
     │   ├── tricks.fish             PATH, bang-bang helpers, bat man pages
     │   ├── wakatime.fish           WakaTime shell hook
     │   ├── yay-wrapper.fish        Auto-generates yay logging wrapper
     │   └── zoxide.fish             Zoxide z/zi integration; overrides cd
     ├── functions/                  Custom functions, one per file
-    ├── completions/                Tab completion scripts
+    ├── completions/                Tab completion scripts, autoloaded on demand
     ├── integrations/
     │   └── fzf.fish                FZF Catppuccin theme and key bindings
     ├── scripts/
@@ -245,7 +243,8 @@ Every shell command is reported to WakaTime for time-tracking. Set
 
 ### Tailscale
 
-Full tab completion for the `tailscale` CLI is provided via `conf.d/tailscale.fish`.
+Full tab completion for the `tailscale` CLI is provided via
+`completions/tailscale.fish`, autoloaded on the first `tailscale<TAB>`.
 
 ### Done Notifications
 

docs/manual/01-configuration-variables.md

@@ -118,7 +118,8 @@ Every shell command is reported to WakaTime for time-tracking. Set
 
 ### Tailscale
 
-Full tab completion for the `tailscale` CLI is provided via `conf.d/tailscale.fish`.
+Full tab completion for the `tailscale` CLI is provided via
+`completions/tailscale.fish`, autoloaded on the first `tailscale<TAB>`.
 
 ### Done Notifications
 

docs/manual/index.md

@@ -35,7 +35,6 @@ The configuration uses a structured file tree:
     ├── conf.d/
     │   ├── abbr.fish               All abbreviations
     │   ├── autopair.fish           Auto-pair brackets and quotes
-    │   ├── cheat.fish              cheat.sh tab completions
     │   ├── done.fish               Desktop notifications for long commands
     │   ├── first_run.fish          One-time init: Fisher bootstrap, theme
     │   ├── key_bindings.fish       Custom key bindings and Vi mode
@@ -47,14 +46,13 @@ The configuration uses a structured file tree:
     │   ├── zellij-logging.fish     C5 fish_exit handler for zellij
     │   ├── sponge_privacy.fish     Sponge privacy patterns
     │   ├── starship.fish           fish_prompt shell-integration markers
-    │   ├── tailscale.fish          Tailscale CLI tab completions
     │   ├── theme.fish              Catppuccin syntax highlight colors
     │   ├── tricks.fish             PATH, bang-bang helpers, bat man pages
     │   ├── wakatime.fish           WakaTime shell hook
     │   ├── yay-wrapper.fish        Auto-generates yay logging wrapper
     │   └── zoxide.fish             Zoxide z/zi integration; overrides cd
     ├── functions/                  Custom functions, one per file
-    ├── completions/                Tab completion scripts
+    ├── completions/                Tab completion scripts, autoloaded on demand
     ├── integrations/
     │   └── fzf.fish                FZF Catppuccin theme and key bindings
     ├── scripts/

functions/__fish_config_sync_logging.fish

@@ -28,84 +28,38 @@ function __fish_config_sync_logging --description 'Sync C5 logging state: sentin
         set config_home "$HOME/.config"
     end
     set -l sentinel "$config_home/fish/.logging_disabled"
-    set -l paru_wrapper "$HOME/.local/bin/paru"
-    set -l yay_wrapper "$HOME/.local/bin/yay"
-    set -l wrapper_version 1
 
     if __fish_config_op_enabled (status current-function)
-        # Logging enabled: remove sentinel and regenerate wrappers if binaries exist
+        # Logging enabled: remove sentinel
         rm -f $sentinel
 
         # Restart tmux pipe-pane for the current pane if inside tmux
         _tmux_pipe_log
-
-        if test -x /usr/bin/paru
-            mkdir -p (dirname $paru_wrapper)
-            printf '%s\n' \
-                '#!/usr/bin/env bash' \
-                "# paru-wrapper-version: $wrapper_version" \
-                '# Auto-generated by conf.d/paru-wrapper.fish — do not edit by hand.' \
-                '# Tees paru output to a timestamped log file and prunes old ones.' \
-                'set -o pipefail' \
-                '' \
-                'log_dir="${SCROLLBACK_HISTORY_DIR:-$HOME/.terminal_history}"' \
-                'mkdir -p "$log_dir"' \
-                'log_file="$log_dir/paru_$(date +%Y-%m-%d_%H-%M-%S).log"' \
-                '' \
-                '/usr/bin/paru "$@" 2>&1 | tee "$log_file"' \
-                '' \
-                'max_files="${SCROLLBACK_HISTORY_MAX_FILES:-100}"' \
-                'mapfile -t logs < <(ls -1t "$log_dir"/paru_*.log 2>/dev/null)' \
-                'excess=$(( ${#logs[@]} - max_files ))' \
-                'for (( i = ${#logs[@]} - 1; i >= ${#logs[@]} - excess && i >= 0; i-- )); do' \
-                '    rm -f "${logs[$i]}"' \
-                'done' \
-                >$paru_wrapper
-            chmod +x $paru_wrapper
-        end
-
-        if test -x /usr/bin/yay
-            mkdir -p (dirname $yay_wrapper)
-            printf '%s\n' \
-                '#!/usr/bin/env bash' \
-                "# yay-wrapper-version: $wrapper_version" \
-                '# Auto-generated by conf.d/yay-wrapper.fish — do not edit by hand.' \
-                '# Tees yay output to a timestamped log file and prunes old ones.' \
-                'set -o pipefail' \
-                '' \
-                'log_dir="${SCROLLBACK_HISTORY_DIR:-$HOME/.terminal_history}"' \
-                'mkdir -p "$log_dir"' \
-                'log_file="$log_dir/yay_$(date +%Y-%m-%d_%H-%M-%S).log"' \
-                '' \
-                '/usr/bin/yay "$@" 2>&1 | tee "$log_file"' \
-                '' \
-                'max_files="${SCROLLBACK_HISTORY_MAX_FILES:-100}"' \
-                'mapfile -t logs < <(ls -1t "$log_dir"/yay_*.log 2>/dev/null)' \
-                'excess=$(( ${#logs[@]} - max_files ))' \
-                'for (( i = ${#logs[@]} - 1; i >= ${#logs[@]} - excess && i >= 0; i-- )); do' \
-                '    rm -f "${logs[$i]}"' \
-                'done' \
-                >$yay_wrapper
-            chmod +x $yay_wrapper
-        end
     else
-        # Logging disabled: create sentinel and remove any generated wrappers
+        # Logging disabled: create sentinel
         mkdir -p (dirname $sentinel)
         touch $sentinel
 
-        if test -f $paru_wrapper
-            and grep -q "# paru-wrapper-version:" $paru_wrapper 2>/dev/null
-            rm -f $paru_wrapper
-        end
-
-        if test -f $yay_wrapper
-            and grep -q "# yay-wrapper-version:" $yay_wrapper 2>/dev/null
-            rm -f $yay_wrapper
-        end
-
         # Stop tmux pipe-pane for the current pane if inside tmux
         if set -q TMUX
             tmux pipe-pane 2>/dev/null
         end
     end
+
+    # Delegate paru/yay wrapper (re)generation and removal to the canonical
+    # generators. They resolve the real binary via __fish_real_command
+    # (never /usr/bin-assumed) and independently gate on their own C2/C5
+    # keys, so sourcing them here covers both the enabled-regenerate and
+    # disabled-remove cases without duplicating that logic. Previously this
+    # function carried its own inferior copy (tee instead of a PTY, no
+    # progress-bar rendering, hard-coded /usr/bin/paru|yay), which fought
+    # the canonical generator for the wrapper file on every version-marker
+    # mismatch. See startup-latency-JOB-BRIEF-FINDINGS.md §2.
+    #
+    # Routed through _fish_source_scoped: both files `return` early on
+    # several guard checks, and a sourced `return` exits the *calling*
+    # function, which would otherwise abort this function and skip
+    # whichever of paru/yay hadn't run yet.
+    _fish_source_scoped "$__fish_config_dir/conf.d/paru-wrapper.fish"
+    _fish_source_scoped "$__fish_config_dir/conf.d/yay-wrapper.fish"
 end

functions/__fish_help_header.fish

@@ -0,0 +1,141 @@
+# Copyright (C) 2026 Rootiest
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# SYNOPSIS
+#    __fish_help_header <name> [args...]
+#
+# DESCRIPTION
+#    Prints <name>'s man-page comment header as a help menu on stdout.
+#    Intended as the first statement of a user-facing function's body:
+#
+#        __fish_help_header (status current-function) $argv; and return 0
+#
+#    Returns 1 -- printing nothing -- ONLY when args[1] is not a help flag.
+#    Every other outcome, including an unreadable or headerless source
+#    file, prints something and returns 0. That asymmetry is load-bearing:
+#    a return of 1 means "run the real body", and the real body of upgrade
+#    is `paru -Syu --noconfirm`. A parse failure must never return 1.
+#
+#    Only args[1] is inspected, never the whole list. wake-lock, bkg,
+#    split and spwin take a command to run as their arguments, so
+#    scanning all of $argv would make `wake-lock rsync --help` print
+#    wake-lock's own help instead of running rsync.
+#
+#    The header is read from the caller's source at call time rather than
+#    from the generated manual, so it cannot go stale between a header
+#    edit and a docs rebuild.
+#
+# ARGUMENTS
+#    name      The calling function's name, from (status current-function)
+#    args...   The caller's $argv, forwarded verbatim
+#
+# EXIT STATUS
+#    0  Help was printed, including the degraded fallback
+#    1  args[1] is not -h/--help; the caller should carry on
+#
+# EXAMPLE
+#    __fish_help_header (status current-function) $argv; and return 0
+#
+# NOTES
+#    Section labels are those of the manual SSOT parser in
+#    docs/manualtools.py. CATEGORY, COMPONENT and DEPENDENCIES are build
+#    metadata and are suppressed; SYNOPSIS renders as USAGE and EXAMPLE as
+#    EXAMPLES.
+function __fish_help_header --argument-names name
+    # First argument only -- see DESCRIPTION.
+    contains -- "$argv[2]" -h --help; or return 1
+
+    set -l c_ttl (set_color --bold)
+    set -l c_sec (set_color --bold brblue)
+    set -l c_rst (set_color normal)
+    set -l miss "  No documentation header found. Try: help config $name"
+
+    set -l file (functions -D -- $name 2>/dev/null)
+    if not test -f "$file"
+        # Quoted: set_color yields an EMPTY LIST under TERM=dumb, and an
+        # unquoted empty list in a concatenation annihilates the whole
+        # word -- the title line would silently vanish wherever colour is
+        # off, which is exactly where a test would be reading it.
+        echo "$c_ttl$name$c_rst"
+        echo $miss
+        return 0
+    end
+
+    # Collect the contiguous comment run directly above `function <name>`,
+    # walking backwards. This resolves multi-header files (fish-deps, gi,
+    # y) without reimplementing manualtools._block_identity, and is more
+    # accurate at runtime: in dops.fish it finds the header above
+    # `function docker` rather than attributing it to the file stem.
+    # One blank separator line is tolerated -- sponge_filter_secrets.fish
+    # is the only file that has one, and JOB-BRIEF-FINDINGS.md records it
+    # so this skip is not mistaken for dead code.
+    set -l lines (string split \n -- (command cat $file))
+    set -l pat '^\s*function\s+'(string escape --style=regex -- $name)'(\s|$)'
+    set -l start 0
+    for i in (seq (count $lines))
+        if string match -qr -- $pat $lines[$i]
+            set start $i
+            break
+        end
+    end
+
+    set -l header
+    if test $start -gt 1
+        set -l j (math $start - 1)
+        if test -z (string trim -- "$lines[$j]")
+            set j (math $j - 1)
+        end
+        while test $j -ge 1; and string match -q '#*' -- $lines[$j]
+            set -p header $lines[$j]
+            set j (math $j - 1)
+        end
+    end
+
+    # Render. Comment lines before the first `# LABEL` -- the copyright
+    # preamble -- carry no label and are dropped, matching
+    # manualtools._header_blocks.
+    set -l skip CATEGORY COMPONENT DEPENDENCIES
+    set -l label ""
+    set -l out
+    for line in $header
+        set -l m (string match -r -- '^#\s+([A-Z][A-Z ]*[A-Z])\s*$' $line)
+        if set -q m[2]
+            set label $m[2]
+            contains -- $label $skip; and continue
+            set -l shown (string replace SYNOPSIS USAGE -- $label)
+            set shown (string replace EXAMPLE EXAMPLES -- $shown)
+            # One blank line before a heading, never two: the header's own
+            # `#` separator has usually already emitted one.
+            if set -q out[1]; and test -n (string trim -- "$out[-1]")
+                set -a out ""
+            end
+            set -a out "$c_sec$shown$c_rst"
+            continue
+        end
+        test -n "$label"; or continue
+        contains -- $label $skip; and continue
+        set -l body (string sub -s 2 -- $line)
+        if string match -q '   *' -- $body
+            set -a out "  "(string sub -s 4 -- $body)
+        else
+            set -a out (string trim -- $body)
+        end
+    end
+
+    # Trim the trailing blank separator, mirroring
+    # manualtools._trailing_blanks.
+    while set -q out[-1]; and test -z (string trim -- "$out[-1]")
+        set -e out[-1]
+    end
+
+    echo "$c_ttl$name$c_rst"
+    if test (count $out) -eq 0
+        echo $miss
+    else
+        # out[1] is always a heading -- a body line cannot precede the
+        # first label -- so this blank is never doubled.
+        echo ""
+        printf '%s\n' $out
+    end
+    return 0
+end

functions/_fish_source_scoped.fish

@@ -0,0 +1,26 @@
+# Copyright (C) 2026 Rootiest
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# SYNOPSIS
+#   _fish_source_scoped <file>
+#
+# DESCRIPTION
+#   Sources <file> inside its own function-call boundary. `source` runs
+#   in the caller's own scope, so a bare `return` in a sourced file --
+#   used by several conf.d guards as an early exit -- would otherwise
+#   unwind whatever function called `source` directly, not just the
+#   sourced file. Calling through this helper contains it to here.
+#
+# ARGUMENTS
+#   file  Path to the fish script to source
+#
+# EXIT STATUS
+#   0  File does not exist (nothing to do)
+#   Exit status of the sourced file otherwise
+#
+# EXAMPLE
+#   _fish_source_scoped $__fish_config_dir/conf.d/paru-wrapper.fish
+function _fish_source_scoped --argument-names file
+    test -f $file; or return 0
+    source $file
+end

functions/bd-pull.fish

@@ -23,6 +23,8 @@
 #   bd-pull myuser/myproject
 #   bd-pull rootiest/fish-config
 function bd-pull --description 'Pull new Gitea issues into local Beads and link them'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if not set -q argv[1]; echo "Need repo owner/name"; return 1; end
     if not set -q GITEA_TOKEN; echo "\$GITEA_TOKEN not set"; return 1; end
 

functions/bkg.fish

@@ -23,6 +23,8 @@
 # EXAMPLE
 #   bkg firefox
 function bkg --description 'Execute bkg'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Check if a command was provided as an argument.
     if test -z "$argv[1]"
         __fish_palette

functions/branch.fish

@@ -21,6 +21,8 @@
 # EXAMPLE
 #   branch feature/new-ui
 function branch --description 'Switch to or create a git branch'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if not git rev-parse --is-inside-work-tree >/dev/null 2>&1
         echo "Not a git repo."
         return 1

functions/check_fish_deps.fish

@@ -11,8 +11,13 @@
 #   Backwards-compatibility wrapper that delegates to fish-deps status to
 #   report which fish shell dependencies are installed or missing.
 #
+# EXIT STATUS
+#   Exit status of `fish-deps status`
+#
 # EXAMPLE
 #   check_fish_deps
 function check_fish_deps --description 'Check all fish-related dependencies'
+    __fish_help_header (status current-function) $argv; and return 0
+
     fish-deps status
 end

functions/claude-docs.fish

@@ -12,8 +12,13 @@
 #   README.md, ensuring all features and examples are accurate and pruning
 #   obsolete content.
 #
+# EXIT STATUS
+#   Exit status of the `claude` invocation
+#
 # EXAMPLE
 #   claude-docs
 function claude-docs --description 'Claude-code: Sync README with recent changes'
+    __fish_help_header (status current-function) $argv; and return 0
+
     claude "Analyze the recent changes and update the README.md to ensure all features, setup instructions, and examples are 100% accurate. Prune any obsolete information."
 end

functions/claude-pr.fish

@@ -12,8 +12,13 @@
 #   branch, write a Conventional Commit, run verification, push, and open a
 #   pull request with a manual verification checklist.
 #
+# EXIT STATUS
+#   Exit status of the `claude` invocation
+#
 # EXAMPLE
 #   claude-pr
 function claude-pr --description 'Claude-code: New branch, commit, push, and PR'
+    __fish_help_header (status current-function) $argv; and return 0
+
     claude "Act as a senior engineer. Execute this sequence: 1. Create a new git branch (kebab-case). 2. Stage changes and write a Conventional Commit message. 3. Self-verify the changes by running relevant build/test commands or linting. 4. Push to remote. 5. Create a PR to 'main' including a summary of changes and a 'Manual Verification' section containing a Markdown checklist (- [ ]) of specific, bite-sized steps required to manually verify the functionality."
 end

functions/cleanup.fish

@@ -11,9 +11,15 @@
 #   Identifies and removes Arch Linux orphan packages using pacman. Logs
 #   package names and versions to ~/.removed_orphans before removal.
 #
+# EXIT STATUS
+#   0        No orphans found, or orphans removed successfully
+#   Nonzero  `sudo pacman -Rns` failed
+#
 # EXAMPLE
 #   cleanup
 function cleanup --description 'Log orphans to ~/.removed_orphans and remove them'
+    __fish_help_header (status current-function) $argv; and return 0
+
     set -l orphans (pacman -Qtdq)
     if test -n "$orphans"
         echo "📝 Logging orphans to ~/.removed_orphans..."

functions/docker.fish

@@ -0,0 +1,41 @@
+# Copyright (C) 2026 Rootiest
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# CATEGORY
+#   12-ai-and-developer-tools
+#
+# DEPENDENCIES
+#   dops
+#
+# SYNOPSIS
+#   docker [subcommand] [args...]
+#
+# DESCRIPTION
+#   Wrapper for docker that intercepts the ps subcommand and redirects it to
+#   the dops function for enhanced container listing. All other subcommands,
+#   and a bare invocation with no subcommand, are passed through to the real
+#   docker binary.
+#
+# ARGUMENTS
+#   subcommand  Docker subcommand (ps is redirected to dops)
+#   args...     Arguments forwarded to docker or dops
+#
+# EXIT STATUS
+#   Exit status of dops (for ps), or of the real docker binary otherwise
+#
+# EXAMPLE
+#   docker ps
+#   docker
+function docker --description 'Execute docker, redirecting ps to the enhanced dops listing'
+    if test -z "$argv[1]"
+        command docker
+        return
+    end
+
+    switch $argv[1]
+        case ps
+            dops $argv[2..-1]
+        case '*'
+            command docker $argv[1..-1]
+    end
+end

functions/dops.fish

@@ -4,27 +4,28 @@
 # CATEGORY
 #   12-ai-and-developer-tools
 #
+# DEPENDENCIES
+#   docker
+#
 # SYNOPSIS
-#   docker [subcommand] [args...]
+#   dops [args...]
 #
 # DESCRIPTION
-#   Wrapper for docker that intercepts the ps subcommand and redirects it to
+#   Enhanced container listing: runs docker ps with a clean custom table
-#   the dops function for enhanced container listing. All other subcommands are
+#   (Names, Image, Status, Ports) instead of docker's noisier default
-#   passed through to the real docker binary.
+#   columns. Extra arguments (e.g. -a) are forwarded to docker ps.
 #
 # ARGUMENTS
-#   subcommand  Docker subcommand (ps is redirected to dops)
+#   args...  Arguments forwarded to `docker ps`
-#   args...     Arguments forwarded to docker or dops
+#
+# EXIT STATUS
+#   Exit status of `docker ps`
 #
 # EXAMPLE
-#   docker ps
+#   dops
-function docker --description 'Execute docker'
+#   dops -a
-    if test -n "$argv[1]"
+function dops --description 'Enhanced, formatted docker ps listing'
-        switch $argv[1]
+    __fish_help_header (status current-function) $argv; and return 0
-            case ps
+
-                dops $argv[2..-1]
+    command docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}' $argv
-            case '*'
-                command docker $argv[1..-1]
-        end
-    end
 end

functions/fast.fish

@@ -33,9 +33,14 @@
 #   Displays a styled message indicating that the fast command is unavailable
 #   and suggests using fast-cli instead.
 #
+# EXIT STATUS
+#   0  Always
+#
 # EXAMPLE
 #   fast
 function fast --description 'Placeholder for future fast utility'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # ANSI Escape Codes (Standard 16-color palette)
     set -l bold "\e[1m"
     set -l italic "\e[3m"

functions/fc.fish

@@ -24,6 +24,8 @@
 #   fc
 #   fc git
 function fc --description 'Edit and execute the last command (Bash-style fc)'
+    __fish_help_header (status current-function) $argv; and return 0
+
     set -l tmpfile (mktemp /tmp/fish_fc.XXXXXX).fish
 
     if count $argv >/dev/null

functions/fish-deps.fish

@@ -66,6 +66,13 @@ function fish-deps --description 'Manage fish shell dependencies'
             _fish_deps_status
         case install
             _fish_deps_install $flags
+        case -h --help
+            # Reuse the existing menu rather than the header renderer: it
+            # is richer, and it is already the text the unknown-subcommand
+            # path prints. Previously --help fell into `case '*'` and
+            # exited 1 with "Unknown subcommand: --help".
+            __fish_deps_help
+            return 0
         case update
             _fish_deps_update
         case sync

functions/fzf-update.fish

@@ -11,9 +11,15 @@
 #   Installs or upgrades fzf from git HEAD into ~/.fzf. Pulls the latest
 #   changes if ~/.fzf already exists, or clones the repository if not.
 #
+# EXIT STATUS
+#   0        fzf installed or updated successfully
+#   Nonzero  git or the fzf install script failed
+#
 # EXAMPLE
 #   fzf-update
 function fzf-update --description 'Install or upgrade fzf from git HEAD'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if test -d ~/.fzf
         echo "Updating fzf..."
         git -C ~/.fzf pull --ff-only

functions/gip.fish

@@ -11,9 +11,14 @@
 #   Fetches and prints both the public IPv4 and IPv6 addresses using
 #   icanhazip.com. Shows "Not detected" for any address that times out.
 #
+# EXIT STATUS
+#   0  Always (network failures print "Not detected" instead of failing)
+#
 # EXAMPLE
 #   gip
 function gip --description 'Show all public IP addresses'
+    __fish_help_header (status current-function) $argv; and return 0
+
     echo -n "IPv4: "
     curl -4 -s --max-time 2 https://icanhazip.com || echo "Not detected"
     echo -n "IPv6: "

functions/gip4.fish

@@ -10,8 +10,13 @@
 # DESCRIPTION
 #   Fetches and prints the machine's public IPv4 address using icanhazip.com.
 #
+# EXIT STATUS
+#   Exit status of curl
+#
 # EXAMPLE
 #   gip4
 function gip4 --wraps='curl' --description 'Get public IPv4 address'
+    __fish_help_header (status current-function) $argv; and return 0
+
     curl -4 -s https://icanhazip.com
 end

functions/gip6.fish

@@ -21,6 +21,8 @@
 # EXAMPLE
 #   gip6
 function gip6 --description 'Get public IPv6 address'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Use -6 to force IPv6 and --fail to catch network errors
     set -l ip (curl -6 -s --fail https://icanhazip.com 2>/dev/null)
     

functions/hist.fish

@@ -14,9 +14,15 @@
 #   Searches fish history interactively using fzf, inserts the selected command
 #   into the command line, and copies it to the clipboard via wl-copy.
 #
+# EXIT STATUS
+#   0  Command selected and inserted, or fzf was cancelled
+#   1  Disabled by __fish_config_op_integrations
+#
 # EXAMPLE
 #   hist
 function hist --description 'Search fish history and put it in the prompt'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Opinionated guard (C4): integrations disabled
     if not __fish_config_op_enabled (status current-function)
         __fish_palette

functions/lD.fish

@@ -14,9 +14,14 @@
 # ARGUMENTS
 #   args...  Arguments forwarded to the listing command
 #
+# EXIT STATUS
+#   Exit status of eza, lsd, or ls, whichever ran
+#
 # EXAMPLE
 #   lD ~/projects
 function lD --description 'List directories only'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if which eza >/dev/null 2>&1
         eza --only-dirs --long --icons --color=auto --hyperlink $argv
     else if which lsd >/dev/null 2>&1

functions/ld.fish

@@ -17,6 +17,8 @@
 # EXAMPLE
 #   ld
 function ld --description 'Run lazydocker on the current Docker context'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if not type -q docker
         echo "ld: docker is not installed" >&2
         return 1

functions/limine-edit.fish

@@ -13,9 +13,14 @@
 #   files tracked by sbctl. Combines the edit and sign steps into a single
 #   command.
 #
+# EXIT STATUS
+#   0  Always (individual step failures are not propagated)
+#
 # EXAMPLE
 #   limine-edit
 function limine-edit --description 'Safely edit and re-verify Limine configuration'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # 1. Open the config with sudoedit
     sudoedit /boot/limine.conf
 

functions/lock.fish

@@ -10,8 +10,13 @@
 # DESCRIPTION
 #   Locks the current desktop session using loginctl lock-session.
 #
+# EXIT STATUS
+#   Exit status of `loginctl lock-session`
+#
 # EXAMPLE
 #   lock
 function lock --wraps='loginctl' --description 'alias lock=loginctl'
+    __fish_help_header (status current-function) $argv; and return 0
+
     loginctl lock-session
 end

functions/lsr.fish

@@ -14,9 +14,14 @@
 # ARGUMENTS
 #   args...  Arguments forwarded to the listing command
 #
+# EXIT STATUS
+#   Exit status of eza, lsd, or ls, whichever ran
+#
 # EXAMPLE
 #   lsr ~/projects
 function lsr --description 'Reversed time-sorted listing'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if which eza >/dev/null 2>&1
         eza --oneline --sort=modified --reverse --icons --color=auto --hyperlink $argv
     else if which lsd >/dev/null 2>&1

functions/lss.fish

@@ -14,9 +14,14 @@
 # ARGUMENTS
 #   args...  Arguments forwarded to the listing command
 #
+# EXIT STATUS
+#   Exit status of eza, lsd, or ls, whichever ran
+#
 # EXAMPLE
 #   lss ~/downloads
 function lss --description 'Size-sorted listing'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if which eza >/dev/null 2>&1
         eza --oneline --long --all --sort=size --icons --color=auto --hyperlink --color-scale=size --color-scale-mode=gradient $argv
     else if which lsd >/dev/null 2>&1

functions/lstree.fish

@@ -14,9 +14,14 @@
 # ARGUMENTS
 #   args...  Arguments forwarded to the listing command
 #
+# EXIT STATUS
+#   Exit status of eza, lsd, or ls, whichever ran
+#
 # EXAMPLE
 #   lstree ~/projects/myapp
 function lstree --description 'Full recursive tree listing'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if which eza >/dev/null 2>&1
         eza --tree --icons --color=auto --hyperlink=auto $argv
     else if which lsd >/dev/null 2>&1

functions/lt.fish

@@ -14,9 +14,14 @@
 # ARGUMENTS
 #   args...  Arguments forwarded to the listing command
 #
+# EXIT STATUS
+#   Exit status of eza, lsd, or ls, whichever ran
+#
 # EXAMPLE
 #   lt ~/projects
 function lt --description 'Tree listing, depth 2'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if which eza >/dev/null 2>&1
         eza --tree --level=2 --icons --color=auto --hyperlink $argv
     else if which lsd >/dev/null 2>&1

functions/ltr.fish

@@ -15,9 +15,14 @@
 # ARGUMENTS
 #   args...  Arguments forwarded to the listing command
 #
+# EXIT STATUS
+#   Exit status of eza, lsd, or ls, whichever ran
+#
 # EXAMPLE
 #   ltr ~/projects
 function ltr --description 'Reversed time-sorted listing'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if which eza >/dev/null 2>&1
         eza --long --all --sort=modified --icons --hyperlink --color=auto --color-scale=age --color-scale-mode=gradient $argv
     else if which lsd >/dev/null 2>&1

functions/lx.fish

@@ -14,9 +14,14 @@
 # ARGUMENTS
 #   args...  Arguments forwarded to the listing command
 #
+# EXIT STATUS
+#   Exit status of eza, lsd, or ls, whichever ran
+#
 # EXAMPLE
 #   lx ~/projects
 function lx --description 'Extension-sorted listing'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if which eza >/dev/null 2>&1
         eza --long --all --sort=extension --icons --color=auto --hyperlink $argv
     else if which lsd >/dev/null 2>&1

functions/parur.fish

@@ -19,6 +19,8 @@
 # EXAMPLE
 #   parur
 function parur --description 'Interactively search and remove an installed package using fzf'
+    __fish_help_header (status current-function) $argv; and return 0
+
     set -l aur ""
     if type -q paru
         set aur paru

functions/poke.fish

@@ -21,6 +21,8 @@
 # EXAMPLE
 #   poke ~/projects/new/src/main.fish
 function poke --description 'touch with automatic parent directory creation'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if test (count $argv) -eq 0
         echo (set_color red)"poke: no file specified"(set_color normal) >&2
         return 1

functions/ports.fish

@@ -11,8 +11,13 @@
 #   Lists all active TCP listeners on the system using lsof, showing
 #   port numbers and addresses without hostname resolution.
 #
+# EXIT STATUS
+#   Exit status of `lsof`
+#
 # EXAMPLE
 #   ports
 function ports --wraps='sudo' --description 'Show active network listeners'
+    __fish_help_header (status current-function) $argv; and return 0
+
     sudo lsof -iTCP -sTCP:LISTEN -P -n
 end

functions/qr.fish

@@ -15,10 +15,15 @@
 # ARGUMENTS
 #   text...  Text to encode; reads from stdin if omitted
 #
+# EXIT STATUS
+#   Exit status of qrencode, or curl if qrencode is unavailable
+#
 # EXAMPLE
 #   qr "https://example.com"
 #   echo "hello" | qr
 function qr --description 'Generate a QR code from text or pipe'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if type -q qrencode
         if set -q argv[1]
             echo $argv | qrencode -t utf8

functions/sbver.fish

@@ -24,6 +24,8 @@
 #   sbver
 #   sbver --brief
 function sbver --description 'Verifies Secure Boot status of EFI binaries using sbctl'
+  __fish_help_header (status current-function) $argv; and return 0
+
   if not type -q sbctl
     echo "Error: 'sbctl' is not installed."
     return 1

functions/screensleep.fish

@@ -11,9 +11,14 @@
 #   Turns off the display after a 1-second delay by invoking the KDE
 #   PowerDevil "Turn Off Screen" global shortcut via busctl.
 #
+# EXIT STATUS
+#   Exit status of `busctl`
+#
 # EXAMPLE
 #   screensleep
 function screensleep --description 'Turn off the display using KDE PowerDevil'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Optional: 1-second delay to ensure no keystrokes wake it immediately
     sleep 1
     busctl --user call \

functions/split.fish

@@ -29,6 +29,10 @@
 #   split
 #   split -v nvim README.md
 function split --description 'Run a command in a new terminal split'
+    # -h is --horizontal here (see this function's own ARGUMENTS),
+    # so only the long form may reach the renderer.
+    test "$argv[1]" = --help; and __fish_help_header (status current-function) --help; and return 0
+
     # Opinionated guard (C4): integrations disabled
     if not __fish_config_op_enabled (status current-function)
         __fish_palette

functions/sponge_filter_secrets.fish

@@ -31,7 +31,6 @@
 # EXAMPLE
 #   # Register with sponge (done automatically by conf.d/sponge_privacy.fish):
 #   set -U -a sponge_filters sponge_filter_secrets
-
 function sponge_filter_secrets --argument-names command
     # Find all exported variables with security-sensitive names
     set -l sensitive_vars (set --names --export | string match --regex -- \

functions/spwin.fish

@@ -24,6 +24,8 @@
 # EXAMPLE
 #   spwin
 function spwin --wraps='~/.config/kitty/spawn-window.sh' --description 'spawn window in kitty or wezterm'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Opinionated guard (C4): integrations disabled
     if not __fish_config_op_enabled (status current-function)
         __fish_palette

functions/steam-dl.fish

@@ -11,9 +11,14 @@
 #   Launches Steam with systemd-inhibit to prevent the system from idling
 #   or sleeping during active downloads.
 #
+# EXIT STATUS
+#   Exit status of `steam` (via systemd-inhibit)
+#
 # EXAMPLE
 #   steam-dl
 function steam-dl --description 'Run Steam while inhibiting system sleep'
+    __fish_help_header (status current-function) $argv; and return 0
+
     echo "Inhibiting sleep while Steam downloads..."
     systemd-inhibit --why="Active Download" --who="User" --what=idle:sleep steam
 end

functions/sudo-toggle.fish

@@ -19,6 +19,8 @@
 # EXAMPLE
 #   sudo-toggle
 function sudo-toggle --description 'Toggle sudo password requirement on/off'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Check the file size using sudo stat to see if our bypass rule is active
     set -l file_size (sudo stat -c %s /etc/sudoers.d/nofail-toggle 2>/dev/null)
     

functions/swapstat.fish

@@ -12,9 +12,14 @@
 #   zRAM compression ratio, zRAM device details (via zramctl), and
 #   active swap priority (via swapon).
 #
+# EXIT STATUS
+#   0  Always
+#
 # EXAMPLE
 #   swapstat
 function swapstat --description 'View colorized zRAM and swappiness status'
+    __fish_help_header (status current-function) $argv; and return 0
+
     set -l swappiness (sysctl -n vm.swappiness)
     set -l zdata (zramctl --bytes --noheadings --output DATA,TOTAL /dev/zram0 2>/dev/null)
     

functions/tab.fish

@@ -25,6 +25,8 @@
 # EXAMPLE
 #   tab
 function tab --description 'Spawn a new tab in the current terminal'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Opinionated guard (C4): integrations disabled
     if not __fish_config_op_enabled (status current-function)
         __fish_palette

functions/tmux-clean.fish

@@ -11,9 +11,14 @@
 #   Kills all detached (unattached) tmux sessions, leaving any currently
 #   attached sessions running.
 #
+# EXIT STATUS
+#   0  Always
+#
 # EXAMPLE
 #   tmux-clean
 function tmux-clean --description 'Kill all tmux sessions except the current one'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Get a list of all session names that are NOT currently attached
     set sessions (tmux list-sessions -F '#{session_name} #{session_attached}' | string match -rv ' 1$' | string split -f1 ' ')
 

functions/upgrade.fish

@@ -21,6 +21,8 @@
 # EXAMPLE
 #   upgrade
 function upgrade --description 'Full system upgrade via paru or yay'
+    __fish_help_header (status current-function) $argv; and return 0
+
     # Opinionated guard (C4): integrations disabled
     if not __fish_config_op_enabled (status current-function)
         __fish_palette

functions/wake-lock.fish

@@ -22,6 +22,8 @@
 # EXAMPLE
 #   wake-lock rsync -avz src/ dest/
 function wake-lock --description 'Run a command while inhibiting system sleep'
+    __fish_help_header (status current-function) $argv; and return 0
+
     if test (count $argv) -eq 0
         __fish_palette
         echo "$c_head""Usage:$c_reset $c_cmd""wake-lock$c_reset $c_arg""[command] [args...]$c_reset"

tests/functional.fish

@@ -1,188 +0,0 @@
-# Copyright (C) 2026 Rootiest
-# SPDX-License-Identifier: AGPL-3.0-or-later
-#
-# Functional checks for foundational config behavior. Sourced inside a
-# fully-loaded, sandboxed interactive fish session by tests/run-tests.fish
-# -- see that file for the sandbox setup. Each test_* function returns 0
-# on pass, non-zero on fail; functional_test_main collects and runs them.
-
-function test_xdg_defaults
-    test -n "$XDG_CONFIG_HOME" -a -n "$XDG_CACHE_HOME" \
-        -a -n "$XDG_DATA_HOME" -a -n "$XDG_STATE_HOME"
-end
-
-function test_path_additions
-    contains -- "$HOME/.local/bin" $PATH
-end
-
-function test_cdpath
-    contains -- "$HOME/projects" $CDPATH
-end
-
-function test_vi_key_bindings
-    test "$fish_key_bindings" = fish_vi_key_bindings
-end
-
-function test_abbreviations_loaded
-    abbr -q n
-end
-
-function test_core_functions_defined
-    for f in cat logs config-help fish-deps check_fish_deps config-settings
-        if not functions -q $f
-            echo "    missing function: $f"
-            return 1
-        end
-    end
-end
-
-function test_exit_rewired
-    functions -q exit
-    and functions exit | string match -q '*smart_exit*'
-end
-
-function test_op_registry_lookup
-    functions -q __fish_config_op_registry_lookup
-    or return 1
-    set -l tags (__fish_config_op_registry_lookup config cdpath)
-    test $status -eq 0 -a (count $tags) -gt 0
-end
-
-function test_privacy_variables
-    test "$DO_NOT_TRACK" = "1" -a "$DISABLE_TELEMETRY" = "1"
-end
-
-function test_privacy_op_registry_lookup
-    functions -q __fish_config_op_registry_lookup
-    or return 1
-    set -l tags (__fish_config_op_registry_lookup config privacy)
-    test $status -eq 0 -a "$tags" = "overrides/privacy"
-end
-
-function test_op_enabled_fail_open
-    # An identity/site pair with no registry entry must resolve to
-    # enabled -- the documented fail-open default.
-    __fish_config_op_enabled __fish_config_test_never_registered somesite
-end
-
-function test_greeting_function_defined
-    functions -q fish_greeting
-end
-
-function test_agents_vault_defined
-    for f in agents-vault _agents_vault_dir _agents_repo_slug \
-        _agents_repo_ensure_symlink _agents_repo_sync \
-        _agents_repo_install_tools
-        if not functions -q $f
-            echo "    missing function: $f"
-            return 1
-        end
-    end
-end
-
-function test_wrappers_call_agents_vault
-    functions -q claude; or return 1
-    functions claude | string match -q '*agents-vault*'; or return 1
-    functions -q agy; or return 1
-    functions agy | string match -q '*agents-vault*'
-end
-
-function test_vault_dir_honors_override
-    set -l saved
-    set -q __fish_agent_vault_dir; and set saved $__fish_agent_vault_dir
-    set -g __fish_agent_vault_dir /tmp/vault-override-check
-    set -l got (_agents_vault_dir)
-    set -e __fish_agent_vault_dir
-    test (count $saved) -gt 0; and set -g __fish_agent_vault_dir $saved
-    test "$got" = /tmp/vault-override-check
-end
-
-function test_palette_roles_defined
-    functions -q __fish_palette
-    or begin
-        echo "    __fish_palette is not defined"
-        return 1
-    end
-    # Called from inside a function, the palette must land in THIS scope.
-    __fish_palette
-    set -l missing
-    for role in c_reset c_head c_cmd c_arg c_flag c_warn c_err c_ok \
-        c_accent c_dim c_sel c_hi
-        if not set -q $role; or test -z "$$role"
-            set -a missing $role
-        end
-    end
-    if test (count $missing) -gt 0
-        echo "    palette roles empty or unset: $missing"
-        return 1
-    end
-    # Nothing may leak to global scope.
-    if set -q -g c_reset
-        echo "    __fish_palette leaked c_reset into global scope"
-        return 1
-    end
-    return 0
-end
-
-# Every user-facing function that renders a coloured --help must still emit
-# escape sequences.
-#
-# This is deliberately a RUNTIME check, never a static grep for
-# __fish_palette. Measured on a deliberately broken functions/logs.fish --
-# the palette call de-duplicated per indentation depth instead of per
-# contiguous run, so the --help block lost its declarations without gaining
-# a call:
-#
-#     fish tests/palette-bytes.fish
-#       FAIL  logs --help    stdout=DIFF stderr=ok
-#       baseline 431 B -> broken 150 B (every escape stripped)
-#
-#     fish -n functions/logs.fish        -> exit 0   (lint PASSES)
-#     grep -c '__fish_palette' logs.fish -> 1        (grep PASSES)
-#
-# Both cheap checks are green on a file whose help output has lost all of
-# its colour. Only running the function and looking for an \e byte catches
-# it. The full test suite was also green throughout.
-#
-# functions/fish_prompt.fish is excluded BY NAME. It interpolates $c_dim
-# from its own Catppuccin hex palette -- those are colour arguments passed
-# to set_color, not captured escapes -- so it legitimately never calls
-# __fish_palette and would otherwise look unconverted forever.
-#
-# qc is absent from the list on purpose: its --help shells out to aichat,
-# which is not installed in CI, so its colour path is unreachable here.
-# tests/palette-bytes.fish stubs aichat and does cover it.
-function test_functions_keep_their_palette
-    set -l colored agents-init agents-vault auto-pull config-settings \
-        config-update detach dng2avif dockup edit jobrunner kitty-logging \
-        logs mkcd open-url p pkg play-media rand_string replay repo-open \
-        scrub smart_exit spark y
-    set -l uncolored
-    for fn in $colored
-        functions -q $fn; or continue
-        if not $fn --help 2>&1 | string match -qr \e
-            set -a uncolored $fn
-        end
-    end
-    if test (count $uncolored) -gt 0
-        echo "    --help lost its colour: $uncolored"
-        return 1
-    end
-    return 0
-end
-
-function functional_test_main
-    set -l names (functions -a | string match 'test_*' | sort)
-    set -l failed 0
-    for name in $names
-        if $name
-            echo "  PASS  $name"
-        else
-            echo "  FAIL  $name"
-            set failed (math $failed + 1)
-        end
-    end
-    echo ""
-    echo (math (count $names) - $failed)"/"(count $names)" passed"
-    return $failed
-end

tests/lib.fish

@@ -0,0 +1,62 @@
+#!/usr/bin/env fish
+# Copyright (C) 2026 Rootiest
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Shared assertion and reporting core for tests/test-*.fish.
+#
+# One assertion: `check <label> <want> <got>`, string equality. Status
+# assertions use the two-line form, which is the point -- it can say "I
+# expected exactly 1", where a pass/fail predicate can only say "non-zero":
+#
+#     __fish_config_op_cascade __probe_cat
+#     check "all unset -> enabled" 0 $status
+#
+# That distinction matters here: __fish_variable_check returns four distinct
+# codes (0 truthy, 1 falsy, 2 unset/empty, 3 unrecognized) and the cascade's
+# behavior depends on telling 2 and 3 apart from 1.
+#
+# Boolean assertions use the idiom the vault suite already uses throughout:
+#
+#     check "label" true (some-test; and echo true; or echo false)
+
+set -g TESTS_RUN 0
+set -g TESTS_FAILED 0
+
+# The driver always sets this; the fallback is for running a suite by hand.
+if set -q FISH_CONFIG_TEST_ROOT
+    set -g repo_root $FISH_CONFIG_TEST_ROOT
+else
+    set -g repo_root (realpath (dirname (status filename))/..)
+end
+
+function section
+    echo ""
+    echo "== $argv[1] =="
+end
+
+function check --argument-names label want got
+    set -g TESTS_RUN (math $TESTS_RUN + 1)
+    if test "$want" = "$got"
+        echo "  PASS  $label"
+    else
+        echo "  FAIL  $label"
+        echo "        want: $want"
+        echo "        got:  $got"
+        set -g TESTS_FAILED (math $TESTS_FAILED + 1)
+    end
+end
+
+function report
+    echo ""
+    echo (math $TESTS_RUN - $TESTS_FAILED)"/$TESTS_RUN passed"
+    if set -q FISH_CONFIG_TEST_COUNTS
+        echo "$TESTS_RUN $TESTS_FAILED" >>$FISH_CONFIG_TEST_COUNTS
+    end
+    # Explicit terminal status, never a trailing `if` (AGENTS.md item 5).
+    # This is form, not a bug fix: fish clamps `exit`/`return` to 255 rather
+    # than wrapping mod 256, so `exit $TESTS_FAILED` could not have produced
+    # a false green. Verified: `fish -c 'exit 256'` -> 255, while
+    # `sh -c 'exit 256'` -> 0. A boolean is still the right shape -- it
+    # composes with `and`/`or`, which a raw count does not.
+    test $TESTS_FAILED -eq 0
+end

tests/run-tests.fish

@@ -4,15 +4,19 @@
 #
 # CI test runner for this fish configuration.
 #   1. Syntax-lints every tracked .fish file (fish -n).
-#   2. Copies the config-relevant files into a throwaway sandbox (never
+#   2. Discovers tests/test-*.fish and reads the mode each suite declares
-#      the live checkout -- this repo doubles as a real ~/.config/fish,
+#      in its own header (`# MODE: isolated` or `# MODE: in-session`).
-#      so a symlinked sandbox would let universal-variable writes like
+#   3. Runs each isolated suite as its own --no-config fish process with
-#      first-run's escape into the real, gitignored fish_variables file)
+#      throwaway XDG dirs.
-#      and loads it as an isolated interactive session.
+#   4. Sources every in-session suite into ONE sandboxed interactive fish
-#   3. Runs the functional checks in tests/functional.fish inside that
+#      session built from a copy of this config (never the live checkout
-#      loaded session.
+#      -- this repo doubles as a real ~/.config/fish, so a symlinked
-#   4. Runs tests/test-agents-vault.fish as its own process; that suite
+#      sandbox would let universal-variable writes like first-run's escape
-#      builds its own throwaway repos and needs no loaded config.
+#      into the real, gitignored fish_variables file).
+#   5. Sums the per-suite assertion counts and reports a total.
+#
+# Assertions come from tests/lib.fish (section/check/report); suites are
+# never special-cased here by name.
 #
 # Usage: fish tests/run-tests.fish
 
@@ -42,61 +46,154 @@ if test $lint_failed -ne 0
     set overall_failed 1
 end
 
-# ---- Phase 2: isolated load + functional checks --------------------------
+# ---- Phase 2: discover suites --------------------------------------------
-echo ""
+# Mode is declared by the suite, not by this driver. Detection is
-echo "== Sandboxed load + functional checks =="
+# case-insensitive so a near-miss like "# Mode: in-session" is caught rather
-
+# than silently read as "no marker"; the comparison is exact so only the two
-set -l sandbox (mktemp -d)
+# real spellings are accepted. Absence means isolated, the safe default -- a
-set -l sandbox_cfg $sandbox/xdgcfg/fish
+# suite that forgets the marker gets its own clean process instead of being
-mkdir -p $sandbox_cfg
+# injected into a loaded session, and no typo can ever promote a suite into
-# path-setup only adds directories that already exist (fish_add_path is a
+# in-session. Duplicate markers resolve first-match-wins.
-# no-op on missing paths), so give it $HOME/.local/bin to find.
+set -l isolated_suites
-mkdir -p $sandbox/home/.local/bin
+set -l session_suites
-
+for f in (find $script_dir -name 'test-*.fish' | sort)
-cp $repo_root/config.fish $sandbox_cfg/
+    set -l decl (grep -im1 '^# *mode:' $f)
-test -f $repo_root/fish_plugins
+    if test -z "$decl"
-and cp $repo_root/fish_plugins $sandbox_cfg/
+        set -a isolated_suites $f
-for d in functions conf.d completions integrations themes data
+    else if test "$decl" = "# MODE: in-session"
-    test -d $repo_root/$d
+        set -a session_suites $f
-    and cp -r $repo_root/$d $sandbox_cfg/
+    else if test "$decl" = "# MODE: isolated"
+        set -a isolated_suites $f
+    else
+        echo "  FAIL  "(basename $f)": unrecognized mode declaration: $decl" >&2
+        set overall_failed 1
+    end
 end
 
-set -l err_file (mktemp)
+set -l counts (mktemp)
-env -i \
+
+# ---- Phase 3: isolated suites --------------------------------------------
+# HOME is deliberately NOT overridden here. Read this before "improving" it.
+#
+# Overriding XDG_CONFIG_HOME/XDG_DATA_HOME plus --no-config is what makes these
+# runs isolated: the universal-variable file fish can reach is a fresh empty
+# one, and no config.fish/conf.d is loaded. Without that, an "isolated" suite
+# runs against the user's LIVE config and real universal variables -- this repo
+# doubles as a real ~/.config/fish -- so a guard test doing
+# `set -e __fish_config_op_logging` would erase a real universal variable out of
+# the running shell. Measured: $__fish_config_op_registry_keys has 65 entries
+# under a plain `fish`, 0 under `fish --no-config`.
+#
+# `env -i HOME=$sandbox` was tried and REJECTED. It looks strictly more
+# hermetic, but test-agents-vault.fish's hermeticity floor snapshots the real
+# $HOME/.claude/memory and $HOME/.gemini/antigravity-cli and asserts them
+# unchanged at the end. Point HOME at a sandbox and both snapshots read "absent"
+# before and after: the assertions still pass while asserting nothing. A change
+# that turns a real assertion into a tautology without turning anything red is
+# the worst failure mode a test harness has. Keeping HOME real is what keeps
+# those two assertions biting.
+#
+# Overriding XDG_DATA_HOME is a hermeticity gain on top of the isolation:
+# _agents_vault_dir falls back to
+# ${XDG_DATA_HOME:-$HOME/.local/share}/agent-vault, so a vault path that no test
+# overrode lands in a temp dir instead of the user's real ~/.local/share.
+for suite in $isolated_suites
+    echo ""
+    echo "== "(string replace $repo_root/ '' $suite)" =="
+    set -l xdg (mktemp -d)
+    env XDG_CONFIG_HOME=$xdg/cfg XDG_DATA_HOME=$xdg/data \
+        FISH_CONFIG_TEST_ROOT=$repo_root FISH_CONFIG_TEST_COUNTS=$counts \
+        fish --no-config $suite
+    if test $status -ne 0
+        set overall_failed 1
+    end
+    command rm -rf $xdg
+end
+
+# ---- Phase 4: in-session suites ------------------------------------------
+# All in-session suites share ONE sandboxed interactive session: building it
+# (copying the config, starting fish -i) is the expensive part.
+#
+# The config is COPIED, never symlinked. This repo doubles as a real
+# ~/.config/fish, so a symlinked sandbox would let universal-variable writes
+# like first-run's escape into the real, gitignored fish_variables file.
+if test (count $session_suites) -gt 0
+    echo ""
+    echo "== Sandboxed load + session checks =="
+
+    set -l sandbox (mktemp -d)
+    set -l sandbox_cfg $sandbox/xdgcfg/fish
+    mkdir -p $sandbox_cfg
+    # path-setup only adds directories that already exist (fish_add_path is a
+    # no-op on missing paths), so give it $HOME/.local/bin to find.
+    mkdir -p $sandbox/home/.local/bin
+
+    # Every utility below goes through `command`. This driver runs under the
+    # very config it tests, which shadows these: `cp` is an alias for `cp -i`,
+    # `rm` is a trash wrapper, `cat` resolves to bat. Only `cp` is an actual
+    # hazard today -- `-i` on a non-empty destination reads EOF in a
+    # non-interactive runner and SILENTLY SKIPS the copy while exiting 0,
+    # which would leave the sandbox missing config files and report success.
+    # `rm -rf` and `cat` were measured and behave correctly as-is (the rm
+    # wrapper bails to `command rm` on any non-recursive flag, so -rf really
+    # deletes and does not trash). Prefixed anyway: a test runner must not
+    # depend on the configuration under test.
+    command cp $repo_root/config.fish $sandbox_cfg/
+    test -f $repo_root/fish_plugins
+    and command cp $repo_root/fish_plugins $sandbox_cfg/
+    for d in functions conf.d completions integrations themes data
+        test -d $repo_root/$d
+        and command cp -r $repo_root/$d $sandbox_cfg/
+    end
+
+    set -l srcs
+    for s in $session_suites
+        set -a srcs "source $s;"
+    end
+
+    set -l err_file (mktemp)
+    env -i \
         HOME=$sandbox/home \
         XDG_CONFIG_HOME=$sandbox/xdgcfg \
         PATH="$PATH" \
         TERM=xterm \
         __fish_config_op_autoexec=off \
-    fish -i -c "source $repo_root/tests/functional.fish; functional_test_main" \
+        FISH_CONFIG_TEST_ROOT=$repo_root \
+        FISH_CONFIG_TEST_COUNTS=$counts \
+        fish -i -c "source $repo_root/tests/lib.fish; $srcs report" \
         2>$err_file
-set -l functional_status $status
+    set -l session_status $status
 
-set -l stderr_out (cat $err_file)
+    set -l stderr_out (command cat $err_file)
-rm -rf $sandbox $err_file
+    command rm -rf $sandbox $err_file
 
-if test -n "$stderr_out"
+    if test -n "$stderr_out"
         # Diagnostic only, not a gate: on machines with vendor fish configs
         # (e.g. CachyOS's cachyos-fish-config, which this repo's config.fish
         # sources when present) unrelated vendor warnings can land here. Real
-    # breakage in this repo's own code is caught by the assertions below.
+        # breakage in this repo's own code is caught by the assertions.
         echo "  Session stderr output (informational):"
         printf '%s\n' $stderr_out
-end
+    end
 
-if test $functional_status -ne 0
+    if test $session_status -ne 0
         set overall_failed 1
+    end
 end
 
-# ---- Phase 3: hermetic vault helper tests --------------------------------
+# ---- Phase 5: totals -----------------------------------------------------
-# Run as its own fish process rather than inside the sandboxed session:
+set -l total_run 0
-# the suite builds its own throwaway git repos and binds the vault, claude
+set -l total_failed 0
-# and agy roots to them, so it needs no loaded config and must never see
+for line in (command cat $counts)
-# the real ~/.claude.
+    set -l parts (string split ' ' -- $line)
+    set total_run (math $total_run + $parts[1])
+    set total_failed (math $total_failed + $parts[2])
+end
+command rm -f $counts
+
 echo ""
-echo "== Vault helper tests =="
+echo "TOTAL: "(math $total_run - $total_failed)"/$total_run assertions passed"
-fish $repo_root/tests/test-agents-vault.fish
+if test $total_failed -ne 0
-if test $status -ne 0
     set overall_failed 1
 end
 

tests/test-agents-vault.fish

@@ -8,12 +8,9 @@
 #
 # Usage: fish tests/test-agents-vault.fish
 
-set -l here (realpath (dirname (status filename)))
+source (realpath (dirname (status filename)))/lib.fish
-set -g repo_root (realpath $here/..)
 set -p fish_function_path $repo_root/functions
 
-set -g TESTS_RUN 0
-set -g TESTS_FAILED 0
 set -g TMPDIRS
 
 # The suite is hermetic against $HOME and ~/.claude, but it was not
@@ -50,18 +47,6 @@ set -gx GIT_CONFIG_VALUE_0 false
 set -gx GIT_CONFIG_KEY_1 init.defaultBranch
 set -gx GIT_CONFIG_VALUE_1 main
 
-function check --argument-names label want got
-    set -g TESTS_RUN (math $TESTS_RUN + 1)
-    if test "$want" = "$got"
-        echo "  PASS  $label"
-    else
-        echo "  FAIL  $label"
-        echo "        want: $want"
-        echo "        got:  $got"
-        set -g TESTS_FAILED (math $TESTS_FAILED + 1)
-    end
-end
-
 # Failure injection that survives uid 0.
 #
 # These fixtures used to force a failure with `chmod 500` on a parent
@@ -1995,6 +1980,4 @@ set -e __fish_agent_vault_claude_home
 set -e __fish_agent_vault_agy_root
 
 cleanup
-echo ""
+report
-echo (math $TESTS_RUN - $TESTS_FAILED)"/$TESTS_RUN passed"
-exit $TESTS_FAILED

tests/test-guards.fish

@@ -0,0 +1,331 @@
+#!/usr/bin/env fish
+# Copyright (C) 2026 Rootiest
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Table-driven coverage of the opinionated-component guard system:
+# __fish_variable_check, __fish_config_op_cascade,
+# __fish_config_op_registry_lookup and __fish_config_op_enabled.
+#
+# Runs isolated (no `# MODE:` marker, which means isolated): the driver gives
+# this process temp XDG dirs and --no-config, so there is no loaded config and
+# no universal variables. That is load-bearing in both directions --
+#
+#   * these cases `set -e` real guard variable names, including
+#     __fish_config_op_logging and __fish_config_opinionated. Under a plain
+#     `fish` those erase from the innermost scope holding the variable, which
+#     for a user with the variable set universally means destroying a real
+#     universal variable. The temp XDG_CONFIG_HOME is what makes that
+#     impossible.
+#   * the two `set -p` / `source` lines below are what make the FORK's code the
+#     code under test. Their failure modes differ and the difference matters:
+#     forgetting the fish_function_path prepend fails LOUDLY (the guard
+#     functions are unresolvable under --no-config and a call exits 127, which
+#     can never equal an expected 0/1/2/3, so every case turns red), while
+#     forgetting the registry source fails SILENTLY (__fish_config_op_enabled
+#     fail-opens on a missing entry, so a third of the table would pass for
+#     entirely the wrong reason). Hence the explicit precondition below.
+
+source (realpath (dirname (status filename)))/lib.fish
+set -p fish_function_path $repo_root/functions
+source $repo_root/conf.d/__fish_config_op_registry.fish
+
+section "guards: preconditions"
+
+check "the fork's registry is loaded" 65 (count $__fish_config_op_registry_keys)
+
+section "__fish_variable_check: truthy"
+
+for v in 1 true yes on y Y TRUE ON
+    set -g __probe_v $v
+    __fish_variable_check __probe_v
+    check "truthy '$v' -> 0" 0 $status
+end
+
+section "__fish_variable_check: falsy"
+
+for v in 0 false no off n OFF FALSE
+    set -g __probe_v $v
+    __fish_variable_check __probe_v
+    check "falsy '$v' -> 1" 1 $status
+end
+
+section "__fish_variable_check: neither"
+
+set -e __probe_v
+__fish_variable_check __probe_v
+check "unset -> 2" 2 $status
+
+set -g __probe_v ""
+__fish_variable_check __probe_v
+check "empty string -> 2" 2 $status
+
+set -g __probe_v banana
+__fish_variable_check __probe_v
+check "unrecognized -> 3" 3 $status
+
+__fish_variable_check
+check "no argument -> 2" 2 $status
+
+set -g __probe_v a b
+__fish_variable_check __probe_v
+check "multi-element list -> 3" 3 $status
+set -e __probe_v
+
+section "cascade: category only"
+
+# Invented variable names the real config can never set, so nothing ambient can
+# perturb these -- only the C5 and master cases below need real names.
+set -e __fish_config_opinionated __probe_cat __probe_cat_sub
+
+__fish_config_op_cascade __probe_cat
+check "all unset -> enabled" 0 $status
+
+set -g __probe_cat 0
+__fish_config_op_cascade __probe_cat
+check "category falsy -> disabled" 1 $status
+
+set -g __probe_cat 1
+__fish_config_op_cascade __probe_cat
+check "category truthy -> enabled" 0 $status
+
+set -g __probe_cat garbage
+__fish_config_op_cascade __probe_cat
+check "category unrecognized defers to master -> enabled" 0 $status
+set -e __probe_cat
+
+section "cascade: subcategory beats category"
+
+set -g __probe_cat 0
+set -g __probe_cat_sub 1
+__fish_config_op_cascade __probe_cat __probe_cat_sub
+check "sub on, category off -> enabled" 0 $status
+
+set -g __probe_cat 1
+set -g __probe_cat_sub 0
+__fish_config_op_cascade __probe_cat __probe_cat_sub
+check "sub off, category on -> disabled" 1 $status
+
+set -e __probe_cat_sub
+set -g __probe_cat 0
+__fish_config_op_cascade __probe_cat __probe_cat_sub
+check "sub unset, category off -> disabled" 1 $status
+
+set -g __probe_cat_sub garbage
+__fish_config_op_cascade __probe_cat __probe_cat_sub
+check "sub unrecognized defers, category off -> disabled" 1 $status
+set -e __probe_cat __probe_cat_sub
+
+__fish_config_op_cascade __probe_cat ""
+check "empty subcategory argument -> category-only chain" 0 $status
+
+section "cascade: the master is an off switch only"
+
+set -g __fish_config_opinionated 0
+__fish_config_op_cascade __probe_cat
+check "master off, category unset -> disabled" 1 $status
+
+set -g __probe_cat 1
+__fish_config_op_cascade __probe_cat
+check "master off, category on -> enabled" 0 $status
+set -e __probe_cat
+
+set -g __fish_config_opinionated 1
+__fish_config_op_cascade __probe_cat
+check "master on, category unset -> enabled" 0 $status
+
+set -g __fish_config_opinionated garbage
+__fish_config_op_cascade __probe_cat
+check "master unrecognized, category unset -> enabled" 0 $status
+set -e __fish_config_opinionated
+
+section "cascade: C5 logging is opt-in"
+
+# Uses the REAL __fish_config_op_logging name because the opt-in list lives
+# inside the cascade keyed on it. AGENTS.md: "C5 is opt-in (do not 'fix' this)"
+# -- unset or unrecognized means off, and the master switch cannot enable it.
+# If any of these three fail, that is a real defect: record it in
+# JOB-BRIEF-FINDINGS.md, do not repair the guard.
+set -e __fish_config_op_logging __fish_config_opinionated
+
+__fish_config_op_cascade __fish_config_op_logging
+check "C5 unset -> disabled" 1 $status
+
+set -g __fish_config_opinionated 1
+__fish_config_op_cascade __fish_config_op_logging
+check "C5 unset + master truthy -> still disabled" 1 $status
+set -e __fish_config_opinionated
+
+set -g __fish_config_op_logging garbage
+__fish_config_op_cascade __fish_config_op_logging
+check "C5 unrecognized is not consent -> disabled" 1 $status
+
+set -g __fish_config_op_logging on
+__fish_config_op_cascade __fish_config_op_logging
+check "C5 explicit truthy -> enabled" 0 $status
+
+set -g __fish_config_op_logging off
+__fish_config_op_cascade __fish_config_op_logging
+check "C5 explicit falsy -> disabled" 1 $status
+set -e __fish_config_op_logging
+
+section "cascade: C5 subcategories inherit opt-in"
+
+# The opt-in check reads chain[-1], which is always the CATEGORY variable, so
+# nesting inherits "off unless explicit" with no per-subcategory special case.
+set -e __fish_config_op_logging_terminal_capture
+
+__fish_config_op_cascade __fish_config_op_logging __fish_config_op_logging_terminal_capture
+check "C5 sub unset, C5 unset -> disabled" 1 $status
+
+set -g __fish_config_op_logging_terminal_capture 1
+__fish_config_op_cascade __fish_config_op_logging __fish_config_op_logging_terminal_capture
+check "C5 sub explicit truthy -> enabled" 0 $status
+
+set -g __fish_config_op_logging_terminal_capture 0
+set -g __fish_config_op_logging on
+__fish_config_op_cascade __fish_config_op_logging __fish_config_op_logging_terminal_capture
+check "C5 sub falsy, C5 truthy -> disabled" 1 $status
+set -e __fish_config_op_logging_terminal_capture __fish_config_op_logging
+
+section "registry lookup"
+
+__fish_config_op_registry_lookup cat "" >/dev/null
+check "known unsited key found" 0 $status
+
+set -l t (__fish_config_op_registry_lookup cat "")
+check "cat's tags" aliases/filesystem "$t"
+
+__fish_config_op_registry_lookup nosuchthing "" >/dev/null
+check "unknown identity -> not found" 1 $status
+
+set -l t2 (__fish_config_op_registry_lookup config cdpath)
+check "sited key config:cdpath" overrides/environment "$t2"
+
+# The key is the identity:site PAIR, not the identity alone.
+__fish_config_op_registry_lookup cat wrongsite >/dev/null
+check "known identity, wrong site -> not found" 1 $status
+
+section "op_enabled: against the real registry"
+
+set -e __fish_config_op_aliases __fish_config_op_aliases_filesystem
+set -e __fish_config_opinionated
+
+__fish_config_op_enabled cat
+check "cat, nothing set -> enabled" 0 $status
+
+__fish_config_op_enabled cat.fish
+check "a .fish suffix is stripped" 0 $status
+
+set -g __fish_config_op_aliases 0
+__fish_config_op_enabled cat
+check "cat, aliases off -> disabled" 1 $status
+
+set -g __fish_config_op_aliases_filesystem 1
+__fish_config_op_enabled cat
+check "cat, aliases off but its subcategory on -> enabled" 0 $status
+set -e __fish_config_op_aliases __fish_config_op_aliases_filesystem
+
+# Fail-open: an unclassified identity, or one whose doc header has no
+# # COMPONENT section, resolves to enabled. This is what keeps user-authored
+# and third-party functions unaffected.
+__fish_config_op_enabled __totally_unregistered somesite
+check "no registry entry -> fail open" 0 $status
+
+section "op_enabled: always/* and AND, via a synthetic registry"
+
+# Why this fixture exists, so nobody deletes it as redundant:
+#
+# The generated registry has 65 entries, EVERY ONE carrying exactly one tag,
+# and contains no always/on or always/off anywhere (measured 2026-09-07
+# against conf.d/__fish_config_op_registry.fish). So three documented
+# semantics -- always/off, always/on, and AND-across-tags -- have no reachable
+# case in production data and would otherwise go completely untested.
+#
+# The registry is just two global lists, and in isolated mode nothing else in
+# this process reads them, so overriding them is free.
+set -g __fish_config_op_registry_keys "syn_on:" "syn_off:" "syn_and:" "syn_bare:" "syn_multi:"
+set -g __fish_config_op_registry_values \
+    "always/on" \
+    "always/off" \
+    "aliases/filesystem integrations/notifications" \
+    "aliases" \
+    "always/off always/on"
+
+set -e __fish_config_op_aliases __fish_config_op_integrations __fish_config_opinionated
+
+__fish_config_op_enabled syn_off
+check "always/off -> disabled" 1 $status
+
+set -g __fish_config_op_aliases 1
+__fish_config_op_enabled syn_off
+check "always/off ignores an enabled category" 1 $status
+set -e __fish_config_op_aliases
+
+__fish_config_op_enabled syn_on
+check "always/on -> enabled" 0 $status
+
+set -g __fish_config_op_aliases 0
+__fish_config_op_enabled syn_on
+check "always/on short-circuits a disabled category" 0 $status
+set -e __fish_config_op_aliases
+
+__fish_config_op_enabled syn_multi
+check "always/off beats always/on" 1 $status
+
+section "op_enabled: AND across tagged sub-categories"
+
+__fish_config_op_enabled syn_and
+check "both categories default -> enabled" 0 $status
+
+set -g __fish_config_op_aliases 0
+__fish_config_op_enabled syn_and
+check "first tag's category off -> disabled" 1 $status
+set -e __fish_config_op_aliases
+
+set -g __fish_config_op_integrations 0
+__fish_config_op_enabled syn_and
+check "second tag's category off -> disabled" 1 $status
+set -e __fish_config_op_integrations
+
+set -g __fish_config_op_aliases 1
+set -g __fish_config_op_integrations 1
+__fish_config_op_enabled syn_and
+check "both explicitly on -> enabled" 0 $status
+set -e __fish_config_op_aliases __fish_config_op_integrations
+
+section "op_enabled: a tag with no slash"
+
+# Degenerate but harmless: with no '/', $parts[2] is empty and the derived
+# subcategory name gets a trailing underscore. That name is simply always
+# unset, so the chain falls through to the category. Pinned so a future reader
+# does not mistake it for a bug.
+__fish_config_op_enabled syn_bare
+check "bare tag 'aliases' -> enabled by default" 0 $status
+
+set -g __fish_config_op_aliases 0
+__fish_config_op_enabled syn_bare
+check "bare tag honors its category" 1 $status
+set -e __fish_config_op_aliases
+
+section "op_enabled: C5 through the guard"
+
+# The path production code actually takes, as opposed to calling the cascade
+# directly. Same rule: unset means off and the master cannot enable it.
+set -g __fish_config_op_registry_keys "syn_log:"
+set -g __fish_config_op_registry_values "logging/terminal-capture"
+set -e __fish_config_op_logging __fish_config_op_logging_terminal_capture
+
+__fish_config_op_enabled syn_log
+check "C5-tagged component, nothing set -> disabled" 1 $status
+
+set -g __fish_config_opinionated 1
+__fish_config_op_enabled syn_log
+check "C5-tagged component + master truthy -> still disabled" 1 $status
+set -e __fish_config_opinionated
+
+set -g __fish_config_op_logging 1
+__fish_config_op_enabled syn_log
+check "C5-tagged component + explicit C5 on -> enabled" 0 $status
+set -e __fish_config_op_logging
+
+report

tests/test-help.fish

@@ -0,0 +1,282 @@
+#!/usr/bin/env fish
+# Copyright (C) 2026 Rootiest
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Coverage for the header-driven --help renderer (__fish_help_header) and
+# the repo-wide rule that every user-facing function handles -h/--help.
+#
+# Runs isolated (no `# MODE:` marker): every case spawns its own --no-config
+# fish with an explicit fish_function_path, so none of it needs a loaded
+# session -- only $repo_root/functions (or a throwaway fixture dir) on the
+# child's function path.
+
+source (realpath (dirname (status filename)))/lib.fish
+
+# Helper: run `<fn> $argv` in a throwaway fish that can see both $dir and
+# this repo's real functions/, so a fixture function can call the real
+# __fish_help_header. $dir is always mktemp -d output, never spaced.
+function _help_probe --argument-names dir
+    env TERM=dumb fish --no-config -c \
+        "set -g fish_function_path $dir $repo_root/functions; $argv[2..]"
+end
+
+function test_help_renderer
+    set -l tmp (mktemp -d)
+    printf '%s\n' \
+        '# Copyright (C) 2026 Rootiest' \
+        '' \
+        '# CATEGORY' \
+        '#   99-fixture' \
+        '#' \
+        '# SYNOPSIS' \
+        '#   fixturefn [options]' \
+        '#' \
+        '# DESCRIPTION' \
+        '#   First paragraph.' \
+        '#' \
+        '#   Second paragraph.' \
+        '#' \
+        '# ARGUMENTS' \
+        '#   -x        Do the thing' \
+        '#       more  Indented continuation' \
+        '#' \
+        '# EXAMPLE' \
+        '#   fixturefn -x' \
+        'function fixturefn' \
+        '    __fish_help_header (status current-function) $argv; and return 0' \
+        '    echo RAN-BODY' \
+        'end' >$tmp/fixturefn.fish
+
+    set -l out (_help_probe $tmp 'fixturefn --help')
+    set -l code $status
+    set -l text (string join \n $out)
+    rm -rf $tmp
+
+    set -l failed 0
+    if test $code -ne 0
+        echo "    renderer exited $code, expected 0"
+        set failed 1
+    end
+    if contains -- RAN-BODY $out
+        echo "    body executed despite --help"
+        set failed 1
+    end
+    if not contains -- USAGE $out
+        echo "    missing USAGE heading (SYNOPSIS should render as USAGE)"
+        set failed 1
+    end
+    if contains -- CATEGORY $out
+        echo "    CATEGORY leaked into the menu"
+        set failed 1
+    end
+    if not string match -q '*      more  Indented continuation*' -- $text
+        echo "    nested ARGUMENTS indentation lost"
+        set failed 1
+    end
+    # Index-based, not a glob: fish's `string match` glob `*` does not
+    # span newlines, so a pattern straddling two lines silently never
+    # matches and the assertion would pass for the wrong reason.
+    set -l i (contains -i -- "  First paragraph." $out)
+    if test -z "$i"
+        echo "    DESCRIPTION body missing entirely"
+        set failed 1
+    else
+        # Indices hoisted: a command substitution inside a quoted index
+        # ("$out[(math ...)]") is a fish parse error, not an expansion.
+        set -l gap (math $i + 1)
+        set -l nxt (math $i + 2)
+        if test -n "$out[$gap]"
+            echo "    multi-paragraph DESCRIPTION lost its blank line"
+            set failed 1
+        else if test "$out[$nxt]" != "  Second paragraph."
+            echo "    second paragraph missing after the blank"
+            set failed 1
+        end
+    end
+    test $failed -eq 0
+end
+
+function test_help_renderer_degrades_safely
+    # The renderer must return 1 ONLY when argv[1] is not a help flag.
+    # A missing or label-less header must still print and exit 0, because
+    # returning 1 hands control back to the caller's body -- and the body
+    # of upgrade(1) is `paru -Syu --noconfirm`.
+    set -l tmp (mktemp -d)
+    printf '%s\n' \
+        'function headerless' \
+        '    __fish_help_header (status current-function) $argv; and return 0' \
+        "    touch $tmp/BODY-RAN" \
+        'end' >$tmp/headerless.fish
+    # A comment run carrying no `# LABEL` line at all.
+    printf '%s\n' \
+        '# just an ordinary comment, no labels here' \
+        'function malformed' \
+        '    __fish_help_header (status current-function) $argv; and return 0' \
+        "    touch $tmp/BODY-RAN" \
+        'end' >$tmp/malformed.fish
+
+    set -l failed 0
+    for fn in headerless malformed
+        set -l out (_help_probe $tmp "$fn --help")
+        set -l code $status
+        if test $code -ne 0
+            echo "    $fn --help exited $code, expected 0"
+            set failed 1
+        end
+        if test (count $out) -eq 0
+            echo "    $fn --help printed nothing"
+            set failed 1
+        end
+        if not contains -- $fn $out
+            echo "    $fn --help did not name the function"
+            set failed 1
+        end
+        if test -e $tmp/BODY-RAN
+            echo "    $fn executed its body despite --help"
+            set failed 1
+            rm -f $tmp/BODY-RAN
+        end
+    end
+
+    # The inverse: no help flag must return 1 and let the body run.
+    _help_probe $tmp headerless >/dev/null 2>&1
+    if not test -e $tmp/BODY-RAN
+        echo "    body did NOT run when no help flag was passed"
+        set failed 1
+    end
+
+    rm -rf $tmp
+    # Explicit, never a trailing `if`: standing gotcha #5 -- an if with no
+    # branch taken resolves $status to 0 and the test would pass silently.
+    test $failed -eq 0
+end
+
+function test_help_never_executes_destructive_path
+    # These eight ignore $argv entirely, so before the header-driven help
+    # landed, `upgrade --help` ran `paru -Syu --noconfirm`. The check has
+    # to prove --help does NOT reach the destructive path *without* ever
+    # running it: every external binary the eight can reach is shadowed by
+    # a recording stub on PATH, and the recorder must stay empty.
+    #
+    # WARNING: a silent pass here means a MISSING STUB, not success. If a
+    # function shows neither an EXECUTED line nor its own help, its
+    # command is absent from the stub list below -- add it. A test that
+    # cannot fail proves nothing about a body that runs sudo pacman -Rns.
+    set -l tmp (mktemp -d)
+    mkdir -p $tmp/bin
+    set -l log $tmp/invoked.log
+    touch $log
+
+    for b in sudo pacman paru yay loginctl busctl tmux systemd-inhibit \
+        sudoedit limine-enroll-config limine-mkinitcpio sbctl git fzf steam
+        printf '#!/bin/sh\necho "$(basename "$0") $*" >> %s\n' $log >$tmp/bin/$b
+        chmod +x $tmp/bin/$b
+    end
+
+    set -l failed 0
+    for fn in cleanup fzf-update limine-edit lock screensleep sudo-toggle \
+        tmux-clean upgrade
+        set -l out (env TERM=dumb PATH="$tmp/bin:$PATH" HOME=$tmp \
+            fish --no-config -c \
+            "set -g fish_function_path $repo_root/functions; $fn --help" 2>/dev/null)
+        set -l code $status
+
+        if test $code -ne 0
+            echo "    $fn --help exited $code, expected 0"
+            set failed 1
+        end
+        if not contains -- $fn $out
+            echo "    $fn --help did not print its own help"
+            set failed 1
+        end
+        set -l ran (string trim -- (command cat $log))
+        if test -n "$ran"
+            echo "    $fn --help EXECUTED: $ran"
+            set failed 1
+        end
+        echo -n "" >$log
+    end
+
+    rm -rf $tmp
+    test $failed -eq 0
+end
+
+# Functions published in the manual that are exempt from the -h/--help
+# rule. Rationale per entry: AGENTS/specs/2026-09-07-header-driven-help-design.md
+# §4. This array is the ONLY machine-readable copy of the exempt set.
+#
+# EXEMPT-A -- shadows a same-named binary, or forwards $argv to one named
+# tool that owns its own --help. Intercepting would hide that tool's help,
+# and for the C1-guarded shadows it also breaks the disabled-fallback
+# contract, where the bare tool is supposed to answer.
+set -g __help_exempt \
+    agy antigravity-ide bash cat cdi cffetch cheat claude clone clonet \
+    config-toggle copy docker du dusize fast-cli ffetch gitui gitup jr \
+    joplin less ls mkdir mv paste ping rawfish rg rm search ssh top \
+    view yt-dlp
+# EXEMPT-B -- invoked by fish, never typed by a user.
+set -a __help_exempt fish_prompt fish_right_prompt fish_mode_prompt \
+    sponge_filter_secrets
+
+function test_every_user_facing_function_has_help
+    set -l failed 0
+    set -l published
+
+    for f in $repo_root/functions/*.fish
+        set -l lines (string split \n -- (command cat $f))
+        # Published == carries a `# CATEGORY` block, matching
+        # manualtools.parse_functions.
+        contains -- "# CATEGORY" (string trim -- $lines); or continue
+        # Resolve the real defined name; the file stem can disagree with it
+        # (formerly dops.fish defined `docker` -- see JOB-BRIEF-FINDINGS.md
+        # §1, fixed by splitting it into dops.fish and docker.fish).
+        set -l name (string match -rg '^\s*function\s+(\S+)' -- $lines)[1]
+        test -n "$name"; or continue
+        set name (string trim -c "'\"" -- $name)
+        string match -q '_*' -- $name; and continue
+        set -a published $name
+
+        contains -- $name $__help_exempt; and continue
+
+        # Body == everything from the `function` line down, comment lines
+        # dropped, so a header that merely mentions --help cannot pass.
+        set -l body
+        set -l in_body 0
+        for l in $lines
+            test $in_body -eq 1; or string match -qr '^\s*function\s' -- $l; and set in_body 1
+            test $in_body -eq 1; or continue
+            string match -qr '^\s*#' -- $l; and continue
+            set -a body $l
+        end
+        if not string match -qr -- '__fish_help_header|_flag_help|h/help|--help' \
+                (string join \n -- $body)
+            echo "    $name: no -h/--help handling and not in \$__help_exempt"
+            set failed 1
+        end
+    end
+
+    # Guard against a stale exempt list: every exempt name must still be a
+    # published function. Catches renames and deletions.
+    for e in $__help_exempt
+        if not contains -- $e $published
+            echo "    \$__help_exempt lists '$e', which is no longer published"
+            set failed 1
+        end
+    end
+
+    test $failed -eq 0
+end
+
+section "help: renderer"
+check "full render: headings, indentation, multi-paragraph description" true (test_help_renderer; and echo true; or echo false)
+
+section "help: renderer degrades safely"
+check "headerless/malformed functions still print and exit 0" true (test_help_renderer_degrades_safely; and echo true; or echo false)
+
+section "help: destructive paths"
+check "eight functions never execute their destructive path on --help" true (test_help_never_executes_destructive_path; and echo true; or echo false)
+
+section "help: coverage"
+check "every user-facing function has --help or is exempt" true (test_every_user_facing_function_has_help; and echo true; or echo false)
+
+report

tests/test-session.fish

@@ -0,0 +1,165 @@
+# Copyright (C) 2026 Rootiest
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# MODE: in-session
+#
+# Functional checks for foundational config behavior. Sourced by
+# tests/run-tests.fish into a fully-loaded, sandboxed interactive fish
+# session -- see that file for the sandbox setup. Assertions here are the
+# ones that genuinely need a loaded config; anything testable against a
+# single function belongs in an isolated suite instead.
+
+section "session: environment"
+
+check "XDG vars are all set" true (test -n "$XDG_CONFIG_HOME" -a -n "$XDG_CACHE_HOME" -a -n "$XDG_DATA_HOME" -a -n "$XDG_STATE_HOME"; and echo true; or echo false)
+check "PATH includes ~/.local/bin" true (contains -- "$HOME/.local/bin" $PATH; and echo true; or echo false)
+check "CDPATH includes ~/projects" true (contains -- "$HOME/projects" $CDPATH; and echo true; or echo false)
+check "vi key bindings active" fish_vi_key_bindings "$fish_key_bindings"
+check "abbreviations loaded" true (abbr -q n; and echo true; or echo false)
+check "privacy variables set" true (test "$DO_NOT_TRACK" = 1 -a "$DISABLE_TELEMETRY" = 1; and echo true; or echo false)
+
+section "session: functions"
+
+set -l missing
+for f in cat logs config-help fish-deps check_fish_deps config-settings
+    functions -q $f; or set -a missing $f
+end
+check "core functions defined" "" "$missing"
+
+check "exit is rewired to smart_exit" true (functions -q exit; and functions exit | string match -q '*smart_exit*'; and echo true; or echo false)
+check "fish_greeting defined" true (functions -q fish_greeting; and echo true; or echo false)
+
+set -l missing_vault
+for f in agents-vault _agents_vault_dir _agents_repo_slug \
+    _agents_repo_ensure_symlink _agents_repo_sync _agents_repo_install_tools
+    functions -q $f; or set -a missing_vault $f
+end
+check "agents-vault functions defined" "" "$missing_vault"
+
+# One assertion, not two, so this file maps 1:1 onto the fifteen test_*
+# predicates it replaces and the suite's 15/15 baseline is preserved.
+check "claude and agy wrappers call agents-vault" true (functions -q claude; and functions claude | string match -q '*agents-vault*'; and functions -q agy; and functions agy | string match -q '*agents-vault*'; and echo true; or echo false)
+
+section "session: guards in a loaded session"
+
+set -l tags (__fish_config_op_registry_lookup config cdpath)
+check "registry lookup finds config:cdpath" overrides/environment "$tags"
+
+set -l ptags (__fish_config_op_registry_lookup config privacy)
+check "registry lookup finds config:privacy" overrides/privacy "$ptags"
+
+__fish_config_op_enabled __fish_config_test_never_registered somesite
+check "unregistered component fails open" 0 $status
+
+section "session: vault dir override"
+
+set -l saved
+set -q __fish_agent_vault_dir; and set saved $__fish_agent_vault_dir
+set -g __fish_agent_vault_dir /tmp/vault-override-check
+set -l got (_agents_vault_dir)
+set -e __fish_agent_vault_dir
+test (count $saved) -gt 0; and set -g __fish_agent_vault_dir $saved
+check "vault dir honors the override" /tmp/vault-override-check "$got"
+
+section "session: conf.d guards are lazy in non-interactive scripts"
+
+# A non-interactive shell must not load interactive-only conf.d work. The
+# child inherits XDG_CONFIG_HOME from this sandboxed session, so it loads
+# the same config under test. Each exit code names one regression.
+#
+# Assertion 5 (tailscale) is vacuously true where tailscale is not
+# installed: conf.d/tailscale.fish returned early on `type -q tailscale`
+# before this change, and completions/tailscale.fish does the same, so the
+# function is absent either way. The test still cannot fail wrongly there
+# -- it just stops proving anything about that one file. A positive
+# "completions still work" check would need the binary present and would
+# make the suite machine-dependent, so it stays out.
+fish -c '
+    abbr -q n; and exit 1
+    functions -q fish_user_key_bindings; and exit 2
+    functions -q expand_bang_all; and exit 3
+    functions -q __fish_config_logging_changed; and exit 4
+    functions -q __tailscale_perform_completion; and exit 5
+    exit 0'
+check "conf.d guards stay out of non-interactive scripts" 0 $status
+
+# Positive counterpart to the assertion above: the guard must not over-fire.
+check "fish_user_key_bindings still defined in-session" true (functions -q fish_user_key_bindings; and echo true; or echo false)
+
+section "session: shared output palette"
+
+function test_palette_roles_defined
+    functions -q __fish_palette
+    or begin
+        echo "    __fish_palette is not defined"
+        return 1
+    end
+    # Called from inside a function, the palette must land in THIS scope.
+    __fish_palette
+    set -l missing
+    for role in c_reset c_head c_cmd c_arg c_flag c_warn c_err c_ok \
+        c_accent c_dim c_sel c_hi
+        if not set -q $role; or test -z "$$role"
+            set -a missing $role
+        end
+    end
+    if test (count $missing) -gt 0
+        echo "    palette roles empty or unset: $missing"
+        return 1
+    end
+    # Nothing may leak to global scope.
+    if set -q -g c_reset
+        echo "    __fish_palette leaked c_reset into global scope"
+        return 1
+    end
+    return 0
+end
+check "palette roles all defined, non-empty, and scoped to the caller" true (test_palette_roles_defined; and echo true; or echo false)
+
+# Every user-facing function that renders a coloured --help must still emit
+# escape sequences.
+#
+# This is deliberately a RUNTIME check, never a static grep for
+# __fish_palette. Measured on a deliberately broken functions/logs.fish --
+# the palette call de-duplicated per indentation depth instead of per
+# contiguous run, so the --help block lost its declarations without gaining
+# a call:
+#
+#     fish tests/palette-bytes.fish
+#       FAIL  logs --help    stdout=DIFF stderr=ok
+#       baseline 431 B -> broken 150 B (every escape stripped)
+#
+#     fish -n functions/logs.fish        -> exit 0   (lint PASSES)
+#     grep -c '__fish_palette' logs.fish -> 1        (grep PASSES)
+#
+# Both cheap checks are green on a file whose help output has lost all of
+# its colour. Only running the function and looking for an \e byte catches
+# it.
+#
+# functions/fish_prompt.fish is excluded BY NAME. It interpolates $c_dim
+# from its own Catppuccin hex palette -- those are colour arguments passed
+# to set_color, not captured escapes -- so it legitimately never calls
+# __fish_palette and would otherwise look unconverted forever.
+#
+# qc is absent from the list on purpose: its --help shells out to aichat,
+# which is not installed in CI, so its colour path is unreachable here.
+# tests/palette-bytes.fish stubs aichat and does cover it.
+function test_functions_keep_their_palette
+    set -l colored agents-init agents-vault auto-pull config-settings \
+        config-update detach dng2avif dockup edit jobrunner kitty-logging \
+        logs mkcd open-url p pkg play-media rand_string replay repo-open \
+        scrub smart_exit spark y
+    set -l uncolored
+    for fn in $colored
+        functions -q $fn; or continue
+        if not $fn --help 2>&1 | string match -qr \e
+            set -a uncolored $fn
+        end
+    end
+    if test (count $uncolored) -gt 0
+        echo "    --help lost its colour: $uncolored"
+        return 1
+    end
+    return 0
+end
+check "colored --help output keeps its escape sequences" true (test_functions_keep_their_palette; and echo true; or echo false)