[nonreagent]

Resolves #28

Problem

Bringing a new Mac to the state this repo describes meant running the README's shell block by hand, in order, and knowing which lines to skip on a re-run. Several make targets failed when run twice, and two were destructive on every run after the first.

Motivation

This replaces the Mac half of #74, which bundled a Mac setup script and an exe.dev box wrapper into one PR. The goal for this half: to provision a new Mac, run curl -sS https://nonration.al/setup.sh | bash and be guided through the steps. Your end-to-end run of #74 on a fresh macOS 26 VM found four rough edges and one table row that macOS 26 refuses; this PR fixes all of them.

Proposed Solution

• setup.sh at the repo root, one file. Piped from curl it clones into ~/.dotfiles and execs the clone as a first run; from a checkout it walks the ordered steps, each a guard plus an existing make target, skipping what already holds. Three numbered checkpoints halt for a human: Command Line Tools, Full Disk Access, the reboot. Exit codes: 0 converged, 1 checkpoint, 2 a step failed (it prints failed: <name>). --dry-run ends with setup: dry run (<os>), N would run.
• The Dock reset and preference restore run only on a first run. A marker in .git/ keeps that true across a first run that failed partway, and is removed once the Dock reset succeeds.
• The make targets that failed twice now check their end state first; set-shell owns the /etc/shells and chsh logic.
• Fixes from the VM run: failed steps exit 2; the submodule guard reads git submodule status, so the stale etc/tomorrow-theme entry no longer re-runs init; a reboot that fails outside a GUI session becomes checkpoint 3; the ABShowDebugMenu row is dropped from macos-defaults.
• nonration.al becomes GitHub Pages published from this repo, replacing the old splash page. .github/workflows/pages.yml runs make site on every push to main, copying site/index.html (a plain "hi! run this" page) and the root setup.sh into the artifact, so the served script is always main's and nothing else in the repo is published. make check-site, now part of preflight, fails when the built site lacks setup.sh or the command.
• CI dry-runs the script on both OSes and runs the real Linux path twice, requiring the second run to skip deploy. The README's install section is the curl line plus the three checkpoints.

Design: docs/superpowers/specs/2026-09-25-setup-script-design.md (amended for the split). Plan: docs/superpowers/plans/2026-10-29-setup-script-split.md. The exe.dev wrapper ships separately in #98.

Feedback

• Cutover is yours, in this order. (1) Before merging, enable Pages on this repo with source "GitHub Actions" (Settings, Pages), so the first deploy on main has an environment to land in. (2) Merge this PR; the pages workflow deploys. (3) Merge Retire the nonration.al splash page; repurpose as a staging ground nonrational.github.io#23, which wipes that repo and drops its CNAME. (4) Set this repo's Pages custom domain to nonration.al. The site is down between (3) and (4), a few minutes. Then curl -s https://nonration.al/setup.sh | cmp - setup.sh should exit 0. The keybase proof in the old site's .well-known/ is retired on purpose.
• Highest risk is the error handling in step. "$run" || exit 2 suspends errexit inside the run function, so every multi-command run chains with && (apply_macos is the one that matters). Read that pair.
• Your VM run predates these fixes. A second run on a fresh VM would confirm the marker, the exit codes, and the reboot checkpoint end to end.
• link-sublime now refuses to delete a real directory and tells you to move it aside, carried over from One setup command for a Mac, and one for an exe box #74.
• The make-target commit is a verbatim cherry-pick and keeps One setup command for a Mac, and one for an exe box #74's original authorship; the rest are authored by @nonreagent.