fix: unblock new-machine installs (mise floor, startup budget, AeroSpace)

[natevick]

A fresh Mac failed chezmoi apply outright. Root cause, fix, and the work it unblocked.

The bug

install-tools.sh died with a TOML parse error, aborting the whole apply before any CLI tool installed:

unknown field `compile`, expected one of `apply_patches`, `default_packages_file`, ...
mise WARN unknown field: settings.idiomatic_version_file_enable_tools

The machine had a stale brew install mise — 2024.12.10, ~20 months old. The bootstrap only checked presence:

if ! command -v mise >/dev/null 2>&1 && [ ! -x "$HOME/.local/bin/mise" ]; then

so mise.run never ran, and a config written for current mise hit a 2024 parser.

Fix: gate on a version floor and upgrade in place. brew-managed installs take brew upgrade — self-update refuses to touch them, and dropping a second mise in ~/.local/bin would only shadow the old one inside scripts that reorder PATH. Version compare is field-wise numeric: sort -V is spotty under busybox, and string compare ranks 2026.8.10 below 2026.8.2. Both upgrade branches tested with stubs against the real 2024.12.10 string.

Startup budget

The 80ms pre-commit gate was already failing at 83ms, blocking the fix. _mise_hook was 52% of startup, but the real finding was that docs/shell-performance.md rule 1 says only mise and starship earn a sync slot — while five _eval_cached calls ran sync.

fzf keybindings, zoxide's z, and op's completion are unreachable until a prompt exists, so they now load from _deferred_tool_inits via an existing turbo plugin's atload (no null carrier clone). openclaw's 4418-line completion script is dropped entirely.

83ms → 71ms (min 66, max 80).

mise stays sync deliberately: mise --version alone is 11ms so no fork is cheap, and shims-only trades 22ms once for ~21ms per command (37ms vs 16ms for node) — bad with ls aliased to eza. A shims+turbo hybrid would just move the cost into the first prompt render: better benchmark, worse experience.

Verified under zsh/zpty that z, fzf-history-widget, _op and autosuggestions all still load. zsh -i -c exit never fires turbo, so -c cannot see this and is not a valid check.

AeroSpace

Captures ~/.aerospace.toml + installs on non-headless Macs. Swaps the cursor window rule for cmux (com.cmuxterm.app, verified from the bundle Info.plist).

⚠️ This is the repo's first tap and first cask. Everything else brew installs (tmux, vim, mise) is homebrew-core. AeroSpace isn't in homebrew-cask, so it comes from nikitabobko/tap — the upstream author's own tap, the same trust boundary as the app itself rather than a third party repackaging it. Installed fully qualified rather than via a bare brew tap, so provenance is explicit and no extra tap is left configured for unrelated formulae to resolve against.

Verification

• Budget check passes at 71ms; all four commits cleared pre-commit (the gate is not bypassed anywhere)
• aerospace reload-config accepted the config
• chezmoi diff clean after apply
• Config scanned before landing in a public repo: no secrets, hosts, or work-specific tooling

Not done

The new Mac itself is still unverified — the fix is tested here and by stub, but hasn't been run there. Merge, then chezmoi apply on that machine to confirm.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H2p4TH5SX7B3J8oAQaidc8