Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@e2e/cli/test_system_status`:
- Around line 25-27: The test's "empty section" case writes the wrong TOML
section (`[tools]`) so it doesn't validate an empty `[system.packages]` config;
update the test content that writes to "mise.toml" to emit `[system.packages]`
(and any nested/expected structure used by the validation logic) instead of
`[tools]` so the case actually targets the `system.packages` table referenced by
the validation code.

In `@src/cli/doctor/mod.rs`:
- Around line 363-365: doctor_json() is skipping system-package diagnostics
because analyze_system_packages(config).await is only invoked via
analyze_config(); update the JSON path to call the same helper so JSON output
matches text mode—either have doctor_json() call
self.analyze_system_packages(config).await (and merge its results into the JSON
payload) or refactor so doctor_json() reuses analyze_config()'s result; ensure
you reference analyze_system_packages(), analyze_config(), and doctor_json() and
propagate/serialize any errors or findings into the JSON response just like the
text path.

In `@src/system/packages/apt.rs`:
- Around line 44-47: dpkg_name currently strips architecture qualifiers (e.g.,
"gcc:arm64"), causing queries and status checks to conflate architectures;
change the logic so the architecture qualifier is preserved for queries and
matching: update or replace dpkg_name to return both base name and optional arch
(e.g., parse into (pkg, arch) or provide dpkg_arch), use the original name:arch
when constructing dpkg/apt queries, and when comparing installed package status
(the code paths that currently call dpkg_name for matching), compare both
package name and architecture (or match against a returned Package:Architecture
string) so "gcc:arm64" only matches an installed arm64 package and not amd64.
Ensure all callers that previously relied on dpkg_name are updated to use the
new parsed pair or arch-aware comparison.

In `@src/system/packages/brew/macho.rs`:
- Around line 84-89: Before calling u32_at(slice, off) in the load-command
parsing loops, validate that off + 8 is within the declared load-command table
bound so we don't read past the table and panic; specifically, in the loop that
uses HEADER_SIZE_64 and ncmds (and the second loop around the 113-116 region)
check that off + 8 <= HEADER_SIZE_64 + sizeofcmds (or equivalently ensure off +
8 <= slice.len() && off < slice.len()) before reading cmd and cmdsize, and bail!
with the existing error path if that check fails; apply the same guard to both
occurrences where u32_at(slice, off) is called.

In `@src/system/packages/brew/pour.rs`:
- Around line 28-45: installed_versions currently sorts kegs by preserved
directory mtimes (in installed_versions) which is incorrect; instead read the
active opt symlink (prefix::opt().join(name)) via std::fs::read_link to
determine the currently active keg and use that as the primary source of truth:
collect all keg directory names as you already do in installed_versions, detect
the opt symlink target basename and, if it matches one of the collected
versions, move that version to the front of the returned Vec; if the opt symlink
is missing or invalid, fall back to the existing deterministic ordering (e.g.,
name sort or the current mtime-based fallback) so behavior remains stable.
- Around line 100-105: The code moves the temp keg into place with
crate::file::rename(&tmp, &keg) before calling link_keg(name, &pkg_version,
rf.formula.keg_only), which can leave the formula half-installed if linking
fails; either preflight link conflicts before the rename (call the link
validation logic used by link_keg or a new preflight_link_check(name,
&pkg_version, rf.formula.keg_only) and abort before moving the keg) or perform
the rename and then roll back on error (if link_keg returns Err, remove the
moved keg via crate::file::remove_all(&keg)? and restore the tmp via
crate::file::rename(&backup_tmp, &keg)? or return the original tmp to its
previous name), and ensure keg_installed() only returns true after both rename
and successful linking and ledger recording complete.

In `@src/system/packages/brew/prefix.rs`:
- Around line 91-100: The code uses crate::env::var("USER") with a "root"
fallback when building chown_args (used in the needs_create || needs_chown
branch), causing incorrect ownership when USER is unset; change this to resolve
the username from the effective UID (e.g., call
libc::geteuid()/nix::unistd::getuid() and lookup the passwd entry via getpwuid
or the users crate) and use that resolved username in the
format!("{user}:admin") for chown_args; if the UID-to-username lookup fails,
return an explicit error instead of defaulting to "root" so we don't
accidentally chown to root:admin and then fail writability checks.

In `@src/system/packages/brew/resolve.rs`:
- Around line 22-45: The dependency resolver currently always uses host_tag when
calling Formula::dependencies_for, causing it to miss dependencies for the
actual bottle chosen by tag::select; update resolve_closure() to call
tag::select (or the equivalent selection routine used elsewhere) for each
formula to obtain the actual selected bottle tag/variation (e.g., bottle_tag =
tag::select(&formula.variations) or similar) and pass that bottle_tag into
formula.dependencies_for(&bottle_tag) instead of &host_tag; apply the same fix
to the other occurrence referenced in the comment (the block around the later
76-90 region) so both places compute dependencies from the selected bottle tag
rather than always from host_tag.

In `@src/system/packages/brew/state.rs`:
- Around line 29-42: load() treats parse failures as empty and save() overwrites
brew.json in-place, which can corrupt state if interrupted; change save() to
write JSON to a temporary file adjacent to ledger_path() (e.g., ledger_path() ->
tmp path like ledger_path().with_extension("tmp") or similar), fsync the temp
file, then atomically rename the temp to the final path (using rename), and
ensure parent dir exists via crate::file::create_dir_all before creating the
temp; keep serde_json::to_string_pretty(self) as the content and propagate
errors as Result, and leave load() behavior unchanged aside from reading the
final file produced by the atomic rename.

In `@src/system/packages/dnf.rs`:
- Around line 80-87: The current rpm -q error branch bails whenever stdout is
empty and stderr is non-empty, which treats all-missing queries as fatal; change
the condition in the rpm-query handling (the block that checks output.status,
output.stdout, output.stderr and calls bail!) to only bail on real errors by
inspecting output.stderr contents: if stderr contains lines other than the
expected "package X is not installed" messages (or otherwise does not match the
"is not installed" pattern), then bail with the stderr; otherwise skip bailing
and allow the existing parser to interpret missing packages as Missing. Ensure
you reference the same output.status/output.stdout/output.stderr variables and
preserve the existing bail! call for genuine errors.

In `@src/system/packages/pacman.rs`:
- Around line 96-105: The current code treats any non-success from the pacman -Q
command as "missing" by always calling parse_pacman_query(&stdout, pkgs); change
the logic to detect real command failures: if output.status is not success and
output.stdout is empty, return an Err containing the command stderr (or a
wrapped error) instead of calling parse_pacman_query; keep the existing behavior
only when stdout contains data to parse. Update the branch around the existing
debug/if block (referencing output, stdout, pkgs, and parse_pacman_query) so
real pacman/database errors surface as errors rather than being mapped to
Missing.

---

Nitpick comments:
In `@xtasks/fig/src/mise.ts`:
- Around line 3201-3203: The "manager" arg currently defined as args: { name:
"manager" } should include a fixed set of suggestions to improve completion
accuracy; update the arg definition for name "manager" (the args object for the
manager flag) to add a suggestions array or suggestion provider with the values
["apt", "dnf", "pacman", "brew"] so completions present these known package
managers instead of leaving it free-form.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/system/packages/brew/prefix.rs`:
- Around line 48-57: The bootstrap routine currently creates SUBDIRS under
prefix(), but repository() on Linux is prefix().join("Homebrew") so relocated
paths (see relocate::standard_replacements()) point inside prefix()/Homebrew
which never gets created; update bootstrap() (and any helper that builds SUBDIRS
in the 67-137 region) to create the repository tree returned by repository()
instead of prefix() on Linux — e.g., call repository() to derive the base and
ensure it creates repository()/Library and all other expected SUBDIRS so
relocated paths exist after bootstrap.

---

Outside diff comments:
In `@src/system/packages/brew/mod.rs`:
- Around line 53-61: The current filter on closure turns any pkg_version() Err
into false, silently excluding malformed formulas from to_pour; change the logic
so pkg_version() errors are not treated as "already poured" but instead cause an
early error (propagate a Result Err) or otherwise include the problematic
formula in to_pour. Concretely, update the closure used to build to_pour (the
filter around rf.formula.pkg_version() and pour::keg_installed) to match on
pkg_version() and on Err return/bubble a descriptive error (including
rf.formula.name) from the surrounding function rather than mapping to false, so
malformed versions don't silently pass as installed.

---

Duplicate comments:
In `@src/system/packages/brew/prefix.rs`:
- Around line 96-100: The code currently falls back to crate::env::var("USER")
when nix::unistd::User::from_uid(nix::unistd::geteuid()) fails; remove that
fallback and instead surface a hard failure so we don't trust a possibly stale
$USER for recursive chown. Replace the or_else(|| crate::env::var("USER").ok())
path so that when User::from_uid(geteuid()) returns None (or Err) the calling
function returns an error (or uses expect with a clear message) indicating
failure to resolve the current UID to a user; reference the User::from_uid and
nix::unistd::geteuid call sites and ensure any downstream use (the chown -R
owner resolution) only proceeds when a valid username was obtained.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/system/packages/brew/prefix.rs`:
- Around line 77-84: The brewed_glibc detection hardcodes the x86_64 loader
filename, so update the logic that builds `brewed_glibc` (the
`crate::file::ls(&cellar().join("glibc"))...filter_map` block) to look for the
dynamic loader generically rather than only "lib/ld-linux-x86_64.so.2": e.g.,
inspect files under each keg's lib directory and accept any entry whose filename
starts with "ld-linux-" and contains ".so" (or check both known names
"ld-linux-x86_64.so.2" and "ld-linux-aarch64.so.1" based on target arch), then
return the first match as `candidate`; keep using `candidate.exists()` semantics
and `next_back()` as before.

---

Outside diff comments:
In `@src/system/packages/brew/prefix.rs`:
- Around line 162-165: The sudo-elevation branch builds dirs from SUBDIRS
directly so the Linux repo tree (added by bootstrap_dirs()) is omitted; change
the code that constructs dirs for the elevated path to call or reuse
bootstrap_dirs(prefix) (the same source used by the non-elevated path) so dirs
includes the Homebrew/Library entries, then build mkdir_args and chown_args from
that expanded dirs vector (variables: dirs, SUBDIRS, bootstrap_dirs(),
mkdir_args, chown_args).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/system-packages/index.md`:
- Around line 12-16: Update the sentence in docs that reads "System packages ...
are managed by the OS package manager" (the paragraph starting with "System
packages are intentionally separate from [`[tools]`](/configuration.html):") to
clarify the exception for the brew backend: state that system packages are
generally managed by the OS package manager, but the brew backend in this PR can
bypass the Homebrew CLI and pour bottles directly, so users should not assume
the normal Homebrew CLI is required; reword the paragraph to avoid implying
every backend uses the Homebrew CLI and add a short note mentioning the brew
backend exception.
- Around line 32-35: Update the "OS-filtered" paragraph to stop claiming "brew
entries on Linux are ignored" and to accurately reflect runtime behavior: note
that package managers are filtered by OS where unsupported (but Homebrew is
supported on Linux in this PR), and clarify that unsupported managers are
skipped for operations like install/apply but are still reported by the status
and doctor commands; specifically edit the paragraph referencing "OS-filtered",
mention "brew" support on Linux, and call out "status" and "doctor" as the
commands that surface unavailable managers.

In `@src/system/packages/apt.rs`:
- Around line 69-84: parse_dpkg_query currently collapses multiple installed
rows for a bare package name into a single (status, version) in the installed
map, causing order-dependent behavior; change parse_dpkg_query so that for a
given package bare name it preserves all installed versions (e.g., store
Vec<String> of versions or at minimum keep a set of installed versions) instead
of overwriting only when existing status != "installed", and then when building
the result for each request (requests -> state) prefer an exact
requested-version match among those preserved installed versions before falling
back to a generic stored version or reporting VersionMismatch; update logic that
reads the installed map (the code that does installed.get(&req.name) and matches
Some(("installed", version))) to check for a matching version in the preserved
list and return PackageState::Installed with that version when found.
- Around line 147-154: AptManager::install currently appends PackageRequest.raw
directly to apt-get args, allowing malicious or config-like entries (e.g.
-oDebug::...) to be parsed as options; fix by inserting the end-of-options
marker "--" into the args vector before extending with any pkg.raw values in
install so all remaining entries are treated strictly as package operands. Also
update parse_dpkg_query's bare-name multiarch aggregation logic so it doesn't
keep only the first "installed" version: collect all installed versions per base
name and choose deterministically (e.g., prefer exact version-pin matches when
present, otherwise use a stable selection like highest-version-or-arch order) so
a bare-name + version pin is not order-dependent across architectures.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@e2e/cli/test_system_install_brew_linux`:
- Around line 13-29: Add an unconditional cleanup trap so /home/linuxbrew is
removed even if any assert_contains fails: after the initial guard/setup block
and before running assertions (i.e. before the first assert_contains call),
register an EXIT trap that runs the same cleanup currently done by the final rm
-rf /home/linuxbrew; this ensures the directory is removed regardless of
failures during the assert_contains checks or mise system install steps.