- caps lock -> ctrl via GNOME xkb-options (merged with existing options) - homebrew at /home/linuxbrew/.linuxbrew (root-created prefix, user-owned clone) followed by brewsync; casks are skipped on Linux - mise install for all tools in the mise config - pi umans login: API key from 1Password (umans-api-key/password) into ~/.pi/agent/auth.json; skipped with a note when the op CLI is not set up - Dark Reader added to the Helium extension forcelist - default browser: always apply gio mime + xdg-settings, then verify and fail loudly if Helium is not the default Fixes found validating as a non-root user: - unattended-upgrades 20auto-upgrades copy now runs as root; it broke on machines where the file content differs from the package default (container tests masked this because the postinst writes identical content) - brew and mise change markers are checked on stderr; both tools print progress there, so stdout-only checks never matched