diff --git a/Makefile b/Makefile
index 79f4b88..55d0fdc 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 .PHONY: basic term utils hypr kreation buntes-monster
 
 # basic wird immer zuerst eingerichtet: es legt die Basis-Systemumgebung an
-# (multilib, yay, Display-Manager, Audio-Stack), von der alle anderen
+# (multilib, yay, Display-Manager, Audio-Stack, Docker), von der alle anderen
 # Zweige abhaengen. Die uebrigen Ziele haengen nur von basic ab und sind
 # untereinander unabhaengig.
 basic:
@@ -59,14 +59,15 @@ test-lint-docker:
 	docker run --rm dotfiles-lint
 
 # Docker smoke test: builds the Arch container and runs the dry probes.
-#   By default (REAL_SMOKE=1) it also installs the real pacman packages inside
-#   the container and verifies them, so a plain `make test` actually exercises
-#   the install path. Set REAL_SMOKE=0 (or RUN_SMOKE=0) for the fast dry-probe
-#   run. RUN_FULL=1 additionally attempts AUR/npm + hypr/kreation. SKIP_NET=1
-#   skips anything that contacts the network.
-# Example:  make test-smoke            # real term package install + verify
+#   By default (REAL_SMOKE=1) it also installs the real term pacman + npm
+#   packages inside the container (AUR stays opt-in) and verifies them, so a
+#   plain `make test` actually exercises the install path. Set REAL_SMOKE=0
+#   (or RUN_SMOKE=0) for the fast dry-probe run. RUN_FULL=1 additionally
+#   attempts AUR + hypr/kreation/buntes-monster. SKIP_NET=1 skips anything
+#   that contacts the network.
+# Example:  make test-smoke            # real term pacman+npm install + verify
 #           make test-smoke REAL_SMOKE=0   # dry probes only
-#           make test-smoke RUN_FULL=1 # full AUR/npm + hypr/kreation
+#           make test-smoke RUN_FULL=1 # full AUR + hypr/kreation
 REAL_SMOKE ?= 1
 test-smoke:
 	docker build --target test -t dotfiles-test -f test/Dockerfile .
diff --git a/README.md b/README.md
index 515478a..4672ab3 100644
--- a/README.md
+++ b/README.md
@@ -42,8 +42,8 @@ Run `make <target>` from the repository root. Each target first runs the relevan
 
 | Target | What it does |
 |--------|--------------|
-| `make term` | Runs `term/setup.sh` (installs terminal packages, sets fish as default shell, clones tmuxifier), then `stow term` |
-| `make basic` | Runs `install_basic_pcks.sh`, stows `nvim`, runs `nextcloud.sh` |
+| `make term` | Runs `term/setup.sh` (installs terminal packages, sets fish as default shell, clones tmuxifier), then `stow term`. Pulls in `basic`. |
+| `make basic` | Runs `basic/setup.sh`: enables multilib, updates the system, installs `yay` if missing, installs the `basic/packages.txt` packages, and sets up Docker (enables/starts the service, adds your user to the `docker` group, verifies the service) |
 | `make hypr`  | `make basic`, installs Hyprland packages, stows `hypr`, runs the Hyprland setup scripts (`ensure-env.sh`, `portal-host-override.sh`, `fix_dolphin_file_associations.sh`) |
 | `make kreation` | `make basic`, installs VST runtime, stows `kreation` |
 | `make buntes-monster` | Everything (`basic` + `hypr` + `kreation`), then wires up symlinks |
@@ -64,11 +64,12 @@ Add/remove packages on separate lines. Lines starting with `#` are ignored, and
 @npm      # install via npm -g
 ```
 
-The default section is `@pacman`. Any AUR dependency (`yay`) is bootstrapped automatically by `term/setup.sh`.
+The default section is `@pacman`. The AUR helper `yay` is bootstrapped automatically by `basic/setup.sh`.
 
 ## What the install scripts do
 
-- **`term/setup.sh`** – enables multilib, updates the system, installs `yay` if missing, reads `term/packages.txt` and installs all packages with `--needed` (skips already-installed ones), sets `fish` as the default shell (`chsh -s /usr/bin/fish`), clones `tmuxifier`, adds the `git` yazi plugin, and runs `sudo updatedb`. It is idempotent and safe to re-run.
+- **`basic/setup.sh`** – enables multilib, updates the system (`pacman -Syu`), ensures `yay` is installed, reads `basic/packages.txt` and installs all packages with `--needed` (skips already-installed ones), and sets up Docker (`sudo systemctl enable --now docker`, adds the current user to the `docker` group, checks the service). Idempotent and safe to re-run.
+- **`term/setup.sh`** – reads `term/packages.txt` and installs all packages (pacman/AUR via `yay --needed`, npm via `sudo npm install -g`), sets `fish` as the default shell (`chsh`), clones `tmuxifier`, adds the `git` yazi plugin (skips if already present), and runs `sudo updatedb`. Idempotent and safe to re-run.
 
 ## Stow: resolving conflicts with existing paths
 
@@ -140,15 +141,15 @@ There are **two tiers**:
 | `make test-stow` | `stow --simulate` for every stow-able package; fails if a package the Makefile stows doesn't exist (e.g. `stow nvim` — nvim lives under `term/`). | No |
 | `make test-shellcheck` | Runs shellcheck over all tracked scripts (shellcheck must be installed). | No |
 | `make test-lint-docker` | Builds the `/dev` stage (`archlinux:latest` + shellcheck) and runs `test/lint.sh` inside it. | Yes |
-| `make test-smoke` | Builds the `/test` stage, runs the container's dry probes (`make -n` over every target, `stow --simulate` over every Makefile-stowed package, `test/lint.sh`), **and by default installs the real pacman packages** (`REAL_SMOKE=1`) then verifies them. | Yes |
+| `make test-smoke` | Builds the `/test` stage, runs the container's dry probes (`make -n` over every target, `stow --simulate` over every Makefile-stowed package, `test/lint.sh`), **and by default installs the real term pacman + npm packages** (`REAL_SMOKE=1`) then verifies them. Every `@pacman` entry is also pre-resolved against the repo DB, and the install is re-run to prove idempotency. | Yes |
 | `make test` | `test-lint` + `test-smoke` (the real install runs). | Partially |
 
 ### Docker smoke details
 
 ```bash
-make test-smoke                     # real pacman install of the term packages + verify
+make test-smoke                     # real pacman + npm install of the term packages + verify
 make test-smoke REAL_SMOKE=0        # dry probes only (fast, no installs)
-make test-smoke RUN_SMOKE=1 RUN_FULL=1   # + AUR/npm + hypr/kreation/buntes-monster
+make test-smoke RUN_SMOKE=1 RUN_FULL=1   # + AUR + hypr/kreation/buntes-monster
 make test-smoke SKIP_NET=1          # skip anything that contacts the network
 ```
 
@@ -162,7 +163,7 @@ The container:
 - stubs host-dependent commands as no-ops so nothing talks to a real systemd/dbus
   inside the container (`systemctl`, `updatedb`, `kbuildsycoca6`,
   `dbus-update-activation-environment`, `chsh`), and routes `yay` through
-  `pacman` for the pacman-only smoke.
+  `pacman` for the AUR-free smoke.
 
 In the `REAL_SMOKE=1` (default) install path, the harness additionally
 **verifies the installed packages** (`test/verify_packages.sh`):
diff --git a/basic/setup.sh b/basic/setup.sh
index dcfb78c..1750d65 100644
--- a/basic/setup.sh
+++ b/basic/setup.sh
@@ -89,6 +89,37 @@ install_npm() {
     fi
 }
 
+# ---------------------------------------------------------------------------
+# Docker: Dienst aktivieren/starten, Benutzer in die docker-Gruppe aufnehmen
+# und den Dienst verifizieren. (docker selbst wird ueber basic/packages.txt
+# als Pacman-Paket installiert.)
+# ---------------------------------------------------------------------------
+setup_docker() {
+    if ! command -v docker >/dev/null 2>&1; then
+        echo "Warnung: docker nicht installiert; ueberspringe Docker-Setup."
+        return
+    fi
+
+    echo "==> Aktiviere und starte Docker-Dienst ..."
+    sudo systemctl enable --now docker
+
+    # Bei Aufruf via `sudo <script>` ist SUDO_USER der eigentliche Benutzer.
+    local target_user="${SUDO_USER:-$USER}"
+    echo "==> Stelle sicher, dass $target_user in der docker-Gruppe ist ..."
+    if [[ "$target_user" == "root" ]] || id -nG "$target_user" 2>/dev/null | grep -qw docker; then
+        echo "Benutzer $target_user ist bereits in der docker-Gruppe."
+    else
+        sudo usermod -aG docker "$target_user"
+        echo "Benutzer $target_user zur docker-Gruppe hinzugefuegt; wirksam nach dem naechsten Login."
+    fi
+
+    echo "==> Pruefe Docker-Dienst ..."
+    if systemctl is-active --quiet docker; then
+        echo "Docker-Dienst laeuft (Socket: /var/run/docker.sock)."
+    else
+        echo "Warnung: Docker-Dienst laeuft nicht; pruefe mit: systemctl status docker"
+    fi
+}
 
 # ---------------------------------------------------------------------------
 # Main
@@ -110,6 +141,9 @@ main() {
     install_aur
     install_npm
 
+    echo "==> Richte Docker ein ..."
+    setup_docker
+
     echo "Fertig. Die Basis-Systemumgebung ist eingerichtet."
 }
 
diff --git a/term/.config/fish/config.fish b/term/.config/fish/config.fish
index f9b2a09..29fb8aa 100644
--- a/term/.config/fish/config.fish
+++ b/term/.config/fish/config.fish
@@ -133,3 +133,4 @@ export ROCM_PATH=/opt/rocm
 export HSA_OVERRIDE_GFX_VERSION=11.0.0
 export HIP_VISIBLE_DEVICES=0
 
+fish_add_path -m $HOME/.local/bin
diff --git a/test/Dockerfile b/test/Dockerfile
index 6a39306..2fa7649 100644
--- a/test/Dockerfile
+++ b/test/Dockerfile
@@ -13,7 +13,7 @@
 #
 # Or simply use the Makefile targets:
 #   make test-lint-docker   # build dev stage, run shellcheck+lint
-#   make test-smoke         # dry probes; add RUN_SMOKE=1 for real installs
+#   make test-smoke         # dry probes; add RUN_SMOKE=1 for real pacman+npm installs
 #
 # See README.md ("Testing") and test/entrypoint-test.sh for details.
 
diff --git a/test/entrypoint-test.sh b/test/entrypoint-test.sh
index 2859a77..347f6c3 100755
--- a/test/entrypoint-test.sh
+++ b/test/entrypoint-test.sh
@@ -9,13 +9,15 @@
 #       - `make -n` dry-runs to catch Makefile typos / missing scripts
 #       - `stow --simulate` to prove every stow target resolves
 #   2. REAL SMOKE  (guarded by RUN_SMOKE=1)
-#       - exercises term/setup.sh package parsing and (optionally) installs
+#       - resolves every @pacman entry against the repo DB
+#       - exercises term/setup.sh (pacman + npm) and re-runs it to prove
+#         idempotency
 #       - verifies stow actually creates symlinks into $HOME
-#   Full AUR/npm + kreation/buntes-monster only run with RUN_FULL=1.
+#   AUR + kreation/buntes-monster only run with RUN_FULL=1.
 #
 # Env flags (set via `docker run -e`):
-#   RUN_SMOKE=1   run the real pacman-install smoke
-#   RUN_FULL=1    also attempt AUR/npm + hypr/kreation/buntes-monster
+#   RUN_SMOKE=1   run the real pacman+npm install smoke
+#   RUN_FULL=1    also attempt AUR + hypr/kreation/buntes-monster
 #   SKIP_NET=1    pretend no network; skip anything that needs the mirror
 
 set -uo pipefail
@@ -137,8 +139,8 @@ NOOP
 echo "[stub] chsh $*"
 exit 0
 NOOP
-    # The AUR section is stripped for the pacman-only smoke, so term/setup.sh
-    # only ever passes repo packages here; route yay through pacman directly.
+    # The AUR section is stripped for the smoke, so term/setup.sh only ever
+    # passes repo packages (+ npm) here; route yay through pacman directly.
     # --noconfirm is needed because the container isn't interactive.
     cat > "$HOME/bin/yay" <<'NOOP'
 #!/bin/bash
@@ -157,9 +159,9 @@ NOOP
             say_fail "$d/setup.sh syntax error"
         fi
         pacman_count=$(awk '
-            /^@pacman/{s="pacman"}
-            /^@aur/{s="aur"}
-            /^@npm/{s="npm"}
+            /^@pacman/{s="pacman"; next}
+            /^@aur/{s="aur"; next}
+            /^@npm/{s="npm"; next}
             /^[[:space:]]*#/{next}
             /^[[:space:]]*$/{next}
             s=="pacman"{pc++} s=="aur"{ac++} s=="npm"{nc++}
@@ -169,12 +171,46 @@ NOOP
         say_ok "$d/packages.txt -> ${PC} pacman, ${AC} aur, ${NC} npm entries"
     done
 
+    # 2c2. Every @pacman entry in every packages.txt must resolve in the
+    # repo DB, using the same resolution as the installer (`pacman -S
+    # --print-format`). Aliases/provides count as resolved (locate ->
+    # plocate, ttf-font-awesome -> woff2-font-awesome), while a typo'd or
+    # AUR-only name (e.g. `rd`) fails here before any install happens.
+    header "package resolvability (@pacman entries)"
+    resolv_fail=0
+    for d in basic term utils; do
+        while IFS= read -r pkg; do
+            [[ -z "$pkg" ]] && continue
+            if pacman -S --print-format '%n' "$pkg" >/dev/null 2>&1; then
+                say_ok "pacman resolves $pkg ($d)"
+            else
+                say_fail "pacman cannot resolve $pkg ($d) - target not found"
+                resolv_fail=1
+            fi
+        done < <(awk '
+            BEGIN{s="pacman"}
+            /^@pacman/{s="pacman"; next}
+            /^@aur/{s="skip"; next}
+            /^@npm/{s="skip"; next}
+            /^[[:space:]]*#/{next} /^[[:space:]]*$/{next}
+            s=="pacman"{ sub(/^[^\/]*\//,""); print }
+        ' "$REPO/$d/packages.txt")
+    done
+
     # 2d. If network allowed and not skipped, actually install the pacman
-    # section of term/setup.sh (mirrors `make term` without AUR/npm).
+    # and npm sections of term/setup.sh (mirrors `make term` without AUR;
+    # the @aur section stays RUN_FULL-gated since it needs yay/AUR builds).
     if [[ "${SKIP_NET:-0}" != "1" ]]; then
-        header "make term (pacman packages, AUR/npm skipped)"
-        # Patch packages.txt to drop @aur/@npm so we don't hit AUR/npm.
+        header "make term (pacman + npm packages, AUR skipped)"
+        # Patch packages.txt: keep @pacman and @npm (@npm runs via sudo npm
+        # in the container), drop @aur so we don't hit AUR builds.
         cp "$REPO/term/packages.txt" "$HOME/packages.txt.full"
+        awk '
+            /^@aur$/{s="skip"}; /^@npm$/{s="npm"}; /^@pacman$/{s="pacman"}
+            { if (s!="skip" && NF>0 && $1 !~ /^#/) print }
+        ' "$REPO/term/packages.txt" > "$HOME/packages.txt.term-smoke"
+        # pacman-only list for verify_packages.sh (npm packages are not in
+        # the pacman DB).
         awk '
             /^@aur$/{s="skip"}; /^@npm$/{s="skip"}; /^@pacman$/{s="pacman"}
             { if (s!="skip" && NF>0 && $1 !~ /^#/) print }
@@ -182,14 +218,27 @@ NOOP
         # set a scratch HOME for setup.sh so it doesn't touch the real one.
         mkdir -p "$HOME/term"
         cp "$REPO/term/setup.sh" "$HOME/term/setup.sh"
-        cp "$HOME/packages.txt.term-only" "$HOME/term/packages.txt"
+        cp "$HOME/packages.txt.term-smoke" "$HOME/term/packages.txt"
         # chsh is stubbed via $HOME/bin so even `chsh` works without a pty.
         setup_ok=0
         if ( cd "$HOME/term" && bash setup.sh ) ; then
-            say_ok "term/setup.sh (term-only) completed"
+            say_ok "term/setup.sh (pacman+npm) completed"
             setup_ok=1
         else
-            say_fail "term/setup.sh (term-only) failed (exit $?)"
+            say_fail "term/setup.sh (pacman+npm) failed (exit $?)"
+        fi
+
+        # 2d1. Idempotency probe: a second run must also succeed. Catches
+        # steps that break on re-runs over an already-populated state (e.g.
+        # `ya pkg add` failing with "already exists").
+        if [[ "$setup_ok" == "1" ]]; then
+            if ( cd "$HOME/term" && bash setup.sh ) ; then
+                say_ok "term/setup.sh re-run: idempotent"
+            else
+                say_fail "term/setup.sh re-run failed (exit $?) - not idempotent"
+            fi
+        else
+            echo "  skipping idempotency probe (first run did not complete)"
         fi
 
         # 2d2. Verify that every package is really installed and its binary