diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77e6838..7163bb0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,7 +48,16 @@ jobs:
       - name: Install fish
         run: |
           sudo apt-get -o Acquire::Retries=3 update -qq
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common
+          # apt-utils, so debconf has a target for the "delaying package
+          # configuration" notice's OWN follow-up run (irrelevant to
+          # anything else in this job). That notice still fires exactly
+          # once here regardless -- verified live against two orderings
+          # (bundled with another package, and installed fully alone,
+          # first) -- because it fires *during* apt-utils' own first
+          # install, before debconf considers it "installed". Nothing
+          # this workflow controls can pre-seed that; accepted as
+          # unavoidable, same as the runs-on/checkout hint noise below.
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
           sudo add-apt-repository -y ppa:fish-shell/release-4
           sudo apt-get -o Acquire::Retries=3 update -qq
           sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y fish
@@ -65,6 +74,11 @@ jobs:
         ((github.event_name != 'workflow_dispatch' || github.event.inputs.job == 'all') &&
           needs.test.result == 'success'))
     runs-on: racknerd-mini
+    env:
+      # Silences Node's internal "punycode module is deprecated" notice
+      # (astro's toolchain still requires it transitively) on every node
+      # invocation in this job, setup-node's own included.
+      NODE_OPTIONS: --no-deprecation
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -74,7 +88,10 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get -o Acquire::Retries=3 update -qq
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common
+          # apt-utils: see the "Install fish" step's identical comment in
+          # the test job for why its own debconf notice is accepted, not
+          # chased further.
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common
           sudo add-apt-repository -y ppa:fish-shell/release-4
           sudo apt-get -o Acquire::Retries=3 update -qq
           sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y pandoc python3-yaml fish
@@ -112,7 +129,7 @@ jobs:
       - name: Build project wiki
         working-directory: docs/site
         run: |
-          npm ci
+          npm ci --no-fund
           npx astro build
 
       - name: Deploy to Cloudflare Pages
@@ -146,7 +163,7 @@ jobs:
           echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
           echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
           command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg
-          echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --import
+          echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --quiet --import
           git config user.name  "Gitea Actions Bot"
           git config user.email "fishconfig-bot@git.rootiest.dev"
           git config user.signingkey CAA082C2F3467E1F7217AD492075C120312D23F4
diff --git a/functions/agents-init.fish b/functions/agents-init.fish
index 6cd030c..95da318 100644
--- a/functions/agents-init.fish
+++ b/functions/agents-init.fish
@@ -482,7 +482,11 @@ function agents-init --description 'scaffold AGENTS/ sub-repo with agent spec fi
     # a hook-rejected commit fell straight through to a reported success.
     set -l msg "chore: sync AGENTS repository"
     test $did_init -eq 1; and set msg "chore: initialize AGENTS repository"
-    set -l sync_out (_agents_repo_sync "$agents_dir" "$msg")
+    # 2>/dev/null: a command substitution's stderr does not inherit a
+    # caller-scoped redirect on this call (fish quirk), so _agents_repo_sync's
+    # own error message leaks past --silent regardless; it is redundant with
+    # the $sync_rc-driven echoes just below anyway.
+    set -l sync_out (_agents_repo_sync "$agents_dir" "$msg" 2>/dev/null)
     set -l sync_rc $status
     set -l failed 0
     if test $sync_rc -eq 2
diff --git a/functions/agents-vault.fish b/functions/agents-vault.fish
index 1a7ba79..125d9f9 100644
--- a/functions/agents-vault.fish
+++ b/functions/agents-vault.fish
@@ -769,7 +769,11 @@ function agents-vault --description 'track curated agent memory in a host-scoped
         if not mkdir -p "$gvault"
             echo "$c_warn""agents-vault: could not create $gvault; skipping global memory$c_reset" >&2
         else
-            set -l gmsg (_agents_repo_ensure_symlink "$glive" "$gvault")
+            # 2>/dev/null: see the same call's comment further down this
+            # function -- a command substitution's stderr bypasses this
+            # call's own caller-scoped redirect, and the raw message is
+            # always redundant with the $grc-driven echo just below.
+            set -l gmsg (_agents_repo_ensure_symlink "$glive" "$gvault" 2>/dev/null)
             set -l grc $status
             if test $grc -ne 0
                 echo "$c_warn""agents-vault: could not link $glive; global memory not backed up$c_reset" >&2
@@ -939,7 +943,14 @@ function agents-vault --description 'track curated agent memory in a host-scoped
         # idempotent and makes its own parent directories, so there is
         # nothing this guard would protect that the helper does not already
         # handle on its own.
-        set -l link_msg (_agents_repo_ensure_symlink "$live" "$vmem")
+        #
+        # 2>/dev/null: a command substitution's stderr does not inherit a
+        # caller-scoped redirect on this call (fish quirk -- proven with a
+        # two-line repro: `outer 2>/dev/null` where outer does `set -l x
+        # (inner)` still leaks inner's stderr to the real terminal). The
+        # raw message below is always redundant: failure is re-announced on
+        # $link_rc below in this function's own voice.
+        set -l link_msg (_agents_repo_ensure_symlink "$live" "$vmem" 2>/dev/null)
         set -l link_rc $status
         if test $link_rc -ne 0
             echo "$c_err""agents-vault: could not link $live$c_reset" >&2
@@ -973,7 +984,11 @@ function agents-vault --description 'track curated agent memory in a host-scoped
     if not set -q _flag_link
         set -l msg "chore: sync agent memory vault"
         test $did_init -eq 1; and set msg "chore: initialize agent memory vault"
-        set -l sync_out (_agents_repo_sync "$vault" "$msg")
+        # 2>/dev/null: command-substitution stderr bypasses this call's
+        # caller-scoped redirect (see the _agents_repo_ensure_symlink calls
+        # above for the proof); the raw message is redundant with the
+        # $sync_rc-driven echoes just below.
+        set -l sync_out (_agents_repo_sync "$vault" "$msg" 2>/dev/null)
         set -l sync_rc $status
         if test $sync_rc -eq 2
             echo "$c_err""agents-vault: unresolved rebase in the vault; nothing committed$c_reset" >&2