no caching in test containers

test/Dockerfile

@@ -32,7 +32,11 @@ RUN pacman -Syu --noconfirm \
         sudo \
     && pacman -Scc --noconfirm
 
-RUN useradd -m -u "$UID_ARG" -s /bin/bash -G wheel "$USERNAME"
+# Remove the /etc/skel profile files so `useradd -m` starts the test user with
+# a truly empty HOME: the term package owns .bashrc/.bash_profile, and stow
+# must be able to take ownership of them without conflicting with copied files.
+RUN rm -f /etc/skel/.bashrc /etc/skel/.bash_profile /etc/skel/.bash_logout \
+    && useradd -m -u "$UID_ARG" -s /bin/bash -G wheel "$USERNAME"
 
 # Passwordless sudo so scripts that call `sudo pacman`, `sudo systemctl`, etc.
 # do not hang on a password prompt inside the container.

test/entrypoint-test.sh

@@ -42,6 +42,12 @@ say_ok()  { printf '  ok:   %s\n' "$*"; PASS=$((PASS+1)); }
 say_fail(){ printf '  FAIL: %s\n' "$*"; FAIL=$((FAIL+1)); }
 header()  { printf '\n==== %s ====\n' "$*"; }
 
+# Scratch file for captured stderr; kept OUTSIDE the repo mount so it never
+# leaks into the host workspace (the mount is /dotfiles).
+ERR_LOG="$(mktemp -t entrypoint.XXXXXX)"
+cleanup() { rm -f "$ERR_LOG"; }
+trap cleanup EXIT
+
 if command -v git >/dev/null 2>&1 && [[ ! -d .git ]]; then
     # when mounted from a worktree, .git may be a file; fine.
     :
@@ -59,25 +65,23 @@ header "Dry probes"
 targets=$(grep -oE '^[A-Za-z0-9_-]+:' Makefile | tr -d ':' | grep -v '^test' | sort -u)
 for target in $targets; do
     # `make -n` must not error out from missing scripts / dirs.
-    if ( cd "$REPO" && make -n "$target" >/dev/null 2>err.txt ); then
+    if ( cd "$REPO" && make -n "$target" >/dev/null 2>"$ERR_LOG" ); then
         say_ok "make -n $target parses"
     else
         say_fail "make -n $target (typo? missing script?)"
-        sed 's/^/      /' err.txt 2>/dev/null
+        sed 's/^/      /' "$ERR_LOG" 2>/dev/null
     fi
-    rm -f err.txt
 done
 
 # 1b. stow --simulate for every package the Makefile stows.
 while IFS= read -r pkg; do
     [[ -z "$pkg" ]] && continue
-    if stow --simulate --dir="$REPO" --target="$REPO" "$pkg" 2>err.txt; then
+    if stow --simulate --dir="$REPO" --target="$REPO" "$pkg" 2>"$ERR_LOG"; then
         say_ok "stow --simulate $pkg resolves"
     else
         say_fail "stow --simulate $pkg (non-existent package or conflict)"
-        sed 's/^/      /' err.txt 2>/dev/null
+        sed 's/^/      /' "$ERR_LOG" 2>/dev/null
     fi
-    rm -f err.txt
 done < <(grep -P '^\t' Makefile | grep -oE 'stow [A-Za-z0-9_-]+' | awk '{print $2}' | sort -u)
 
 # 1c. run the repo's own lint + probe scripts (they're mounted here).
@@ -125,6 +129,21 @@ NOOP
 #!/bin/bash
 echo "[stub] updatedb $*"
 exit 0
+NOOP
+    # chsh has no functional /etc/passwd in the container; make it a no-op so
+    # set_fish_default_shell doesn't fail (documented in the header comment).
+    cat > "$HOME/bin/chsh" <<'NOOP'
+#!/bin/bash
+echo "[stub] chsh $*"
+exit 0
+NOOP
+    # The AUR section is stripped for the pacman-only smoke, so term/setup.sh
+    # only ever passes repo packages here; route yay through pacman directly.
+    # --noconfirm is needed because the container isn't interactive.
+    cat > "$HOME/bin/yay" <<'NOOP'
+#!/bin/bash
+echo "[stub] yay $* (routed through pacman)"
+exec sudo pacman --noconfirm "$@"
 NOOP
     chmod +x "$HOME/bin/"*
     export PATH="$HOME/bin:$PATH"
@@ -195,15 +214,18 @@ NOOP
 
     # 2e. stow --actual into $HOME to prove real symlinks are created.
     header "stow real symlinks into \$HOME"
+    # term/setup.sh may have just re-created the yazi plugin (`ya pkg add`)
+    # as real files. The repo vendors the same plugin under term/.config/yazi,
+    # so drop the duplicate first, letting stow take ownership of that config.
+    rm -rf "$HOME/.config/yazi"
     for pkg in term hypr kreation local_ai; do
         if [[ -d "$REPO/$pkg" ]]; then
-            if stow --dir="$REPO" --target="$HOME" "$pkg" 2>err.txt; then
+            if stow --dir="$REPO" --target="$HOME" "$pkg" 2>"$ERR_LOG"; then
                 say_ok "stow $pkg into \$HOME"
             else
                 say_fail "stow $pkg into \$HOME"
-                sed 's/^/      /' err.txt 2>/dev/null
+                sed 's/^/      /' "$ERR_LOG" 2>/dev/null
             fi
-            rm -f err.txt
         else
             say_fail "package dir missing: $pkg"
         fi

test/probe_stow.sh

@@ -48,16 +48,20 @@ fi
 echo "== Probing stow packages: ${PACKAGES[*]} =="
 
 FAIL=0
+ERR_LOG="$(mktemp -t probe_stow.XXXXXX)"
+
+cleanup() { rm -f "$ERR_LOG"; }
+trap cleanup EXIT
+
 for pkg in "${PACKAGES[@]}"; do
     echo "--- stow --simulate: $pkg ---"
-    if stow --simulate --verbose=1 --dir="$REPO_ROOT" --target="$REPO_ROOT" "$pkg" >/dev/null 2>probe_err.txt; then
+    if stow --simulate --verbose=1 --dir="$REPO_ROOT" --target="$REPO_ROOT" "$pkg" >/dev/null 2>"$ERR_LOG"; then
         echo "ok: stow --simulate '$pkg' resolved without conflicts"
     else
         echo "FAIL: stow --simulate '$pkg'"
-        sed 's/^/    /' probe_err.txt
+        sed 's/^/    /' "$ERR_LOG"
         FAIL=$((FAIL+1))
     fi
-    rm -f probe_err.txt
 done
 
 # Cross-check: does the Makefile stow anything that is NOT in our package set?

test/verify_packages.sh

@@ -46,7 +46,7 @@ declare -A BINS=(
     [tree-sitter-cli]="tree-sitter --version"
     [python]="python --version"
     [python-pip]="pip3 --version"
-    [unzip]="unzip --version"
+    [unzip]="unzip -v"
     [selene]="selene --version"
     [tmux]="tmux -V"
     [yazi]="yazi --version"