What’s new

Large multi-line pastes no longer switch modes / reorder text / run vim commands. Root cause: core/10-tools.ps1 sets EditMode Vi, and PSReadLine versions before 2.2.0 have no bracketed-paste support, so a pasted block is replayed keystroke-by-keystroke and :/d/i/a/o/Esc are taken as Vi commands. Fix: bumped the PSReadLine pin in packages/modules.ps1 from 2.2.0 to 2.3.6 (the current gallery release; first paste-safe release is 2.2.0), kept Vi mode (deliberate parity with Core's zsh-vi-mode), and added a cheap (Get-Module PSReadLine).Version guard that emits a one-line Write-DotWarn with the upgrade command if a stale in-box PSReadLine (< 2.2.0) is loaded, so a stale box self-diagnoses. tests/Repo.Tests.ps1 now asserts the >= 2.2.0 floor.

install.ps1 now uses -LiteralPath for every existence/copy/move/remove in Link-Item and the seed/ppm steps. Bare Test-Path/Copy-Item/Move-Item treat [/] as wildcards, so a profile path containing brackets could read an existing real config as absent — skipping the back-up branch and clobbering it with no .bak. Brackets are now matched literally.

DOTFILES_PPM_REF is rejected when it begins with -, closing the argument-injection seam (e.g. --upload-pack=…) that bootstrap.ps1 already guards for DOTFILES_REF. The ppm git checkout also gained a -- ref/pathspec separator to match (disambiguation, not the injection guard).

Dependency probes scoped to real executables — Get-Command gum/git/scoop/winget now pass -CommandType Application, so a user-defined function/alias of the same name can no longer satisfy a presence check (the repo's profile encourages such wrappers, which previously could flip Test-DotGum true with no real gum).

nvim-sync bot (.github/workflows/nvim-sync.yml) — runs nvim-sync.ps1 weekly (and on demand) and opens a PR when Core's nvim/ tree has actually moved ahead, so the host editor config can't silently fall behind. Judges drift on the Lua tree only (ignores .core-ref's per-run timestamp). First-party (GITHUB_TOKEN + gh), no third-party action.

.core-ref records the Core release tag — nvim-sync.ps1 now stamps a tag field (git describe --tags of the vendored commit) alongside commit, so dotfiles-core's fleet-drift.sh can label the Windows row by release name (e.g. v2.0.0) like the Unix repos' core.lock core_tag, instead of a bare SHA. Best-effort and backward compatible: the line is omitted when Core carries no tag (the commit SHA stays the source of truth and the drift verdict). Read path covered by a new Get-CoreRefField test case.

package-freshness bot (.github/workflows/package-freshness.yml + packages/Check-PackageFreshness.ps1) — weekly on windows-latest, resolves the live scoop/winget version of each managed app and files a deduplicated findings issue when any is ahead of packages.lock.json. Findings only: re-pinning still runs locally via Update-PackageLock.ps1 (it needs the apps installed).

Coverage gate — Pester enforces ≥85% coverage on the pure-helper library.

uninstall.ps1 — reverse the bootstrap; removes only symlinks that point back into the repo, with -DryRun / -RestoreBackups.

Pre-commit hook — .githooks/pre-commit runs the dependency-free validator; install.ps1 wires core.hooksPath.

Fragment-load health gate — the profile records any fragment that fails to load; dotfiles-doctor reports it.

More host-layer tests — extracted pure helpers (ConvertTo-WslPath, Get-FragmentHealthResult, the uninstall link map) with behavioral tests.

Pinned module floors — packages/modules.ps1 carries -MinimumVersion floors for a reproducible baseline without freezing maintenance updates.

Dependabot for the pinned actions.

Install transcript log under %LOCALAPPDATA%\dotfiles\logs.

editorconfig enforcement (final newline / trailing whitespace / LF) in the validator and Pester suite.

Manifest provenance — winget ids must be Publisher.Package; scoop apps must name a declared bucket.

This changelog.

install.ps1 -DryRun previews every change and mutates nothing; -Help prints usage; -NonInteractive / -Yes for unattended runs.

Graceful interrupts — install.ps1 and the package installer print where they stopped (and close the log) on Ctrl-C or error.

Unified error/warning layout — Write-DotErr / Write-DotWarn used across the entry points.

NO_COLOR + DOTFILES_ASCII fallbacks across every renderer.

Install progress — per-package [n/total] with elapsed time.

Interactive overwrite — confirm before backing up a real user file; stale links are rewired silently.

Tab-completion for dothelp filters, derived from the catalog.

Zero-config onboarding — prompt for git name/email at install time.

dotfiles-doctor -Fix opt-in remediation for the common issues.

dothelp -i fuzzy command picker (fzf) that copies the pick.

serve -Local — opt-in localhost-only bind (127.0.0.1) for the quick CWD HTTP server; LAN exposure stays the default.

Retired the debian WSL-jump helper — dotfiles-Debian is no longer part of the fleet and Debian isn't a target distro, so the debian shortcut is removed from os/31-wsl-bridge.ps1 (function + provides: line), the dothelp WSL-bridge catalog (Help.Helpers.ps1), and the module header comment (Wsl.Helpers.ps1). kali and the generic cdwsl [distro] remain for jumping into any WSL distro.

md no longer shadows mkdir — the glow markdown-render alias was bound to md, clobbering PowerShell's built-in md (mkdir). It's now gmd; md is mkdir again. README, docs/TOOLS.md, and the dothelp catalog updated.

tools command implemented — the cheatsheet advertised tools ("open the host tool docs") but nothing defined it. It now renders docs/TOOLS.md (glow → bat → nvim → plain), and is listed in dothelp.

Dead-shim guards for fif / fbr — a tool that *resolves* on PATH but won't *launch* (a stale Chocolatey shim, or a scoop shim whose app was removed, shadowing the real binary) produced raw Program rg.exe failed to run / cannot find file ...fzf.exe errors. A new Test-CmdRuns helper probes executability so fif/fbr (and the same class of Ctrl+t/Ctrl+r breakage) fail with an actionable fix hint instead.

dotfiles-doctor now checks executability — a new *Core toolchain runs* probe flags tools that resolve but won't launch, which the resolve-only check could not see.

tools / gmd no longer abort when less is absent — glow (and bat) page through $PAGER, defaulting to less, which isn't on a stock Windows box, so glow --pager died with exec: "less" not found. Both now pass paging flags only when a pager actually exists and render inline otherwise. Per-finding backlog IDs and their status live in docs/ARCHITECTURE-AUDIT.md — the single ID registry, so this log stays prose with no competing B#/U# scheme.

sesh detection (HAVE_SESH) — finishing wiring Core already half-shipped. sesh (joshmedeski's smart tmux session manager) was already driven by the Ctrl-G shell widget (fzf.zsh), the prefix + f tmux popup (tmux-sesh.sh), a seeded sesh/sesh.toml.example, and listed in core-doctor's integrations — but tools.zsh never set a HAVE_SESH flag for it the way it does for the other detected tools. (Detection itself still worked — the Ctrl-G/prefix + f fallback keys off command -v sesh, and core-doctor already probes sesh the same way.) tools.zsh now sets HAVE_SESH (like HAVE_GUM, no _core_wired arm — sesh registers no persistent shell hook, so presence ≈ wired), and PORTING-MATRIX.md gains a sesh row + footnote documenting the go install github.com/joshmedeski/sesh/v2@latest build path (the v2 module path; go is already a pinned mise runtime) for the distros that don't package it. No core.manifest change — the .example is already listed.

RELEASE-RUNBOOK.md — the step-by-step, copy-paste recipe for cutting a release (Core, the OS-repo fan-out rollout, and htpx), plus a "dry-run a new cross-repo workflow before relying on it" habit and a troubleshooting table. Complements RELEASE-STRATEGY.md (the policy); cross-linked from it and CLAUDE.md.

nvim: disable <LeftDrag> and <LeftRelease> in all modes unconditionally. Previously these were suppressed only when inside a $TMUX session, in Normal and Visual modes. They are now <Nop> in Normal, Insert, and Visual modes regardless of environment, eliminating accidental mouse-drag selections during terminal use.

bootstrap-test.yml retries the per-distro prep step (up to 5x with backoff). The reusable links-only job ran the dep install once; a transient distro-mirror timeout (notably openSUSE Tumbleweed's OSS CDN) then redded the job — and every Core fan-out PR — on a network blip. The retry is fleet-wide (one place, every caller); a genuinely broken prep still fails loud after the attempts are exhausted.

jujutsu (jj) as an OPT-IN, colocated git companion. Additive — it never replaces git. New jujutsu/config.toml (symlinked to ~/.config/jj/config.toml, in core.manifest) sets a sensible colocated-friendly default (ui.default-command = "log", auto-local-bookmark; identity intentionally unset — jj does NOT inherit git's user.name/user.email, so an opt-in author sets it once with jj config set --user user.name/user.email). tools.zsh gains HAVE_JJ detection and aliases.zsh a few HAVE_JJ-guarded verbs (jjs/jjl/jjd); nothing is aliased over git. On a box without jj everything is inert. PORTING-MATRIX.md documents per-distro packaging (packaged on Arch/openSUSE/Gentoo/Fedora/Homebrew/nix; cargo install jujutsu on Alpine(musl)/Debian-Kali — same pattern as yazi/ouch).

fleet-drift.sh anchors to the latest released Core tag by default, not the working tip. Fan-out stamps each OS repo with the Core tag it carries, so the dashboard now measures against the newest vX.Y.Z (via git describe), falling back to origin/main/main/HEAD. An explicit --ref/$CORE_REF_SHA still wins. This stops the false "BEHIND by N" the report showed for every unreleased commit on main (CHANGELOG/auto-tag churn between releases); the fleet-drift.yml workflow drops its --ref HEAD accordingly.

auto-tag.sh exit-code contract hardened + tested. Added a defence-in-depth guard so _next_version fails loudly (non-zero) on a non-X.Y.Z input instead of producing a garbage component, and the call site now propagates that failure rather than tagging a bogus v. The behavioral suite (test-core.sh) now asserts the full exit-code contract hermetically (no network/gh): success → 0, no-op → 0, validation error → 2, and a real create failure (a --push onto an already-taken tag name, tripping Guard 2) → non-zero.

auto-tag.sh --release fails CI when an opted-in Release create actually fails. The gh release create error branch called fail but the script still exited 0, so a real failure (gh present, API error) went green with no Release. It now exit 1s there — the tag still stands (pushed above), but CI goes red so you create the Release manually. The two non-failure exits stay deliberate: gh absent → skip, Release already exists → no-op. Also added --release to the usage() synopsis line (it was only in the flag list) and clarified its gh/skip semantics.

tag-release.sh recipe spells out the land-then-tag order. The printed next-steps now make the sequence explicit — land the release commit via PR (a merge commit), then tag origin/main (the merged tip) so the tag sits on main's HEAD and git describe stays clean — instead of tagging the pre-merge commit and re-pointing. The two tag pushes use ;, not && (an "already exists" on the first must not skip the second — the vN move). PUSH=1 now warns that it tags the pre-merge commit and prints the re-point steps.