diff --git a/.fvmrc b/.fvmrc
index 16a96ef..d7f4b8c 100644
--- a/.fvmrc
+++ b/.fvmrc
@@ -1,3 +1,3 @@
 {
-  "flutter": "3.47.2"
+  "flutter": "3.47.3"
 }
diff --git a/.github/workflows/release-apk.yml b/.github/workflows/release-apk.yml
index b3f0586..ddcd2cb 100644
--- a/.github/workflows/release-apk.yml
+++ b/.github/workflows/release-apk.yml
@@ -50,7 +50,7 @@ jobs:
 
       - uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.47.2
+          flutter-version: 3.47.3
           channel: stable
           cache: true
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d74d3f7..602851f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -179,7 +179,7 @@ repos:
       # unrelated commit never breaks; exits 1 rather than warning. No
       # baseline and no allowlist -- those are suppressions. The exemption
       # list (generated/vendored/data files) lives with the checker in
-      # ~/utils/file_length/config.py so the gate and the survey cannot
+      # ~/src/utils/file_length/config.py so the gate and the survey cannot
       # disagree.
       #
       # Deliberately unfiltered: no types_or and no files. The cap applies to
@@ -203,7 +203,7 @@ repos:
 
       # Four markdown namespaces (README / CLAUDE* / DOCS* / TODO*), plus the
       # rule that a TODO carries "REMOVE ME AFTER FINISH" and nothing else may.
-      # Shared gate in ~/utils owns the namespaces and the exemption list, so
+      # Shared gate in ~/src/utils owns the namespaces and the exemption list, so
       # one repo's idea of a valid name cannot drift from every other repo's.
       - id: md-naming
         name: markdown naming convention
diff --git a/AGENTS.md b/AGENTS.md
index 6859660..b225106 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -120,7 +120,7 @@ non-stdlib dependency must go into system Python's user site-packages:
 Verify against `/usr/bin/python3 -c "import <dep>"`, not the dev venv.
 Installing only into `.venv` caused a 3-day production outage (2026-06-19).
 
-Run `install.sh` from a **durable** clone (`~/diet-guard`), never a scratch
+Run `install.sh` from a **durable** clone (`~/src/diet-guard`), never a scratch
 dir — it does `pip install -e`, so the clone must persist for `git pull` to
 reach the running service.
 
@@ -159,7 +159,7 @@ reach the running service.
 
 `app/` builds for **Android** and **web** only. There is no `app/linux/` —
 Flutter's GTK embedder manages ~20fps at 3840x2160 where the same Dart in
-Chrome sustains ~144fps (`~/todo/docs/DOCS-desktop-performance-findings.md`). The
+Chrome sustains ~144fps (`~/src/todo/docs/DOCS-desktop-performance-findings.md`). The
 desktop app is the web build served by `bin/diet_guard_desktop.dart` in a
 Chrome `--app` window.
 
@@ -235,7 +235,7 @@ phone show both.
   Chrome profile path.
 - Don't exceed **250 lines** in any file. Enforced by the `file-length`
   pre-commit hook and `.github/workflows/file-length.yml`; the cap and its
-  exemptions live in `~/utils/file_length/config.py`.
+  exemptions live in `~/src/utils/file_length/config.py`.
 
 ## Flutter/Dart AI rules
 
diff --git a/app/README.md b/app/README.md
index 3249e67..137e7e6 100644
--- a/app/README.md
+++ b/app/README.md
@@ -13,7 +13,7 @@ desktop, sharing one food log through GitHub-backed sync.
 There is no `linux/` directory. Flutter's GTK embedder manages ~20fps at
 3840x2160 -- measured on a stock `flutter create` counter app, so it is the
 toolkit rather than this code -- where the same Dart rendered by Chrome
-sustains ~144fps (`~/todo/docs/DOCS-desktop-performance-findings.md`). Running
+sustains ~144fps (`~/src/todo/docs/DOCS-desktop-performance-findings.md`). Running
 `flutter create --platforms linux` here would silently restore the slow path.
 
 ## Commands
diff --git a/app/desktop/install_desktop_entry.sh b/app/desktop/install_desktop_entry.sh
index dadff5a..10212f6 100755
--- a/app/desktop/install_desktop_entry.sh
+++ b/app/desktop/install_desktop_entry.sh
@@ -10,7 +10,7 @@
 #
 # Icon PNGs are pre-rendered and committed under desktop/icons/, so this script
 # needs no image tooling at run time. Regenerate them with:
-#   PYTHONPATH=~/testsAndMisc python3 -m python_pkg.app_icons \
+#   PYTHONPATH=~/src/testsAndMisc python3 -m python_pkg.app_icons \
 #       generate --app diet_guard_app --linux-out desktop/icons
 # ============================================================================
 
diff --git a/app/lib/desktop/wrapper_server.dart b/app/lib/desktop/wrapper_server.dart
index 7da245d..3fa9696 100644
--- a/app/lib/desktop/wrapper_server.dart
+++ b/app/lib/desktop/wrapper_server.dart
@@ -2,7 +2,7 @@
 ///
 /// The desktop app is a Flutter **web** build (Flutter's Linux embedder
 /// manages only ~20fps at 4K, where the same Dart code in Chrome sustains
-/// ~144fps -- see `~/todo/docs/desktop-performance-findings.md`), so it runs
+/// ~144fps -- see `~/src/todo/docs/desktop-performance-findings.md`), so it runs
 /// in a browser and cannot touch the filesystem. This process is the other
 /// half of the desktop app:
 ///
diff --git a/app/lib/services/desktop_wrapper.dart b/app/lib/services/desktop_wrapper.dart
index 7255e56..0fcfaee 100644
--- a/app/lib/services/desktop_wrapper.dart
+++ b/app/lib/services/desktop_wrapper.dart
@@ -9,7 +9,7 @@ library;
 /// packaging and `bin/diet_guard_desktop.dart` must all use this value, and
 /// the Chrome `--user-data-dir` must stay equally fixed for the same reason.
 ///
-/// 8730 is `~/todo`'s wrapper and 8731 is `~/habit_stack`'s; this is the next
+/// 8730 is `~/src/todo`'s wrapper and 8731 is `~/src/habit_stack`'s; this is the next
 /// free one so all three can run at once.
 const desktopWrapperPort = 8732;
 
diff --git a/app/lib/services/sync_settings.dart b/app/lib/services/sync_settings.dart
index a65b1d4..142bcaa 100644
--- a/app/lib/services/sync_settings.dart
+++ b/app/lib/services/sync_settings.dart
@@ -1,4 +1,4 @@
-/// Locally-stored GitHub sync configuration, ported from `~/todo`'s
+/// Locally-stored GitHub sync configuration, ported from `~/src/todo`'s
 /// `sync/sync_settings.dart`, including the OAuth device-flow fields: the
 /// "Connect GitHub" button is the primary path, with a pasted PAT kept as a
 /// manual fallback.
diff --git a/app/pubspec.lock b/app/pubspec.lock
index 60a1d97..f55c76e 100644
--- a/app/pubspec.lock
+++ b/app/pubspec.lock
@@ -203,10 +203,10 @@ packages:
     dependency: "direct main"
     description:
       name: flutter_secure_storage
-      sha256: "15e8c8fe269fdf7d469b23008ab3df521c8b826ed345820532364c31bdebace6"
+      sha256: "4540927d8b37e6cc47aaa2d17b6035a2d49049e2797cb19d2bdd299bff602c67"
       url: "https://pub.dev"
     source: hosted
-    version: "11.0.0"
+    version: "11.1.0"
   flutter_secure_storage_darwin:
     dependency: transitive
     description:
@@ -227,10 +227,10 @@ packages:
     dependency: transitive
     description:
       name: flutter_secure_storage_platform_interface
-      sha256: "8ceea1223bee3c6ac1a22dabd8feefc550e4729b3675de4b5900f55afcb435d6"
+      sha256: "4bc033841169d07f690d46d89dbc3f5305b6562820822445384c82e0866e2719"
       url: "https://pub.dev"
     source: hosted
-    version: "2.0.1"
+    version: "2.1.0"
   flutter_secure_storage_web:
     dependency: transitive
     description:
@@ -342,10 +342,10 @@ packages:
     dependency: "direct main"
     description:
       name: idb_shim
-      sha256: e36a748165663a165e1f292e9d85af6e3aa087f6e2291d16f86b2035103b2950
+      sha256: "6a478bf0928fa954512f2a1e7e56f09e2fb2e3e7d183eb051a59b5d6b39ec16f"
       url: "https://pub.dev"
     source: hosted
-    version: "2.9.8"
+    version: "2.9.9"
   image:
     dependency: transitive
     description:
diff --git a/app/pubspec.yaml b/app/pubspec.yaml
index 53f78ce..093ccad 100644
--- a/app/pubspec.yaml
+++ b/app/pubspec.yaml
@@ -2,7 +2,7 @@ name: diet_guard_app
 description: "Companion phone app for diet_guard: log meals on the go."
 publish_to: 'none'
 
-version: 1.0.79+1
+version: 1.0.80+1
 
 environment:
   sdk: ^3.12.2
@@ -17,7 +17,7 @@ dependencies:
   flutter:
     sdk: flutter
   flutter_local_notifications: 22.3.0
-  flutter_secure_storage: 11.0.0
+  flutter_secure_storage: 11.1.0
 
   # One-tap sign-in for the sync account. App-side only: crdt_sync stays pure
   # Dart so it keeps working on Linux desktop and headless.
@@ -28,7 +28,7 @@ dependencies:
       path: github_device_auth
   google_sign_in: 7.2.0
   http: 1.6.0
-  idb_shim: 2.9.8
+  idb_shim: 2.9.9
   path: 1.9.1
   path_provider: 2.1.6
   permission_handler: 13.0.2
@@ -64,7 +64,7 @@ flutter:
   uses-material-design: true
 
 # Launcher icon generation. Source art is produced by the shared generator:
-#   PYTHONPATH=~/testsAndMisc python3 -m python_pkg.app_icons generate --app <key>
+#   PYTHONPATH=~/src/testsAndMisc python3 -m python_pkg.app_icons generate --app <key>
 # then run: dart run flutter_launcher_icons
 flutter_launcher_icons:
   android: true
diff --git a/app/test/repo_invariants_test.dart b/app/test/repo_invariants_test.dart
index b025eb0..37e80f0 100644
--- a/app/test/repo_invariants_test.dart
+++ b/app/test/repo_invariants_test.dart
@@ -160,7 +160,7 @@ void main() {
         isTrue,
         reason: 'The wrapper port changed. IndexedDB is keyed by origin, so a '
             'new port looks like a different app with no history at all. '
-            '8730 is ~/todo and 8731 is ~/habit_stack; do not collide.',
+            '8730 is ~/src/todo and 8731 is ~/src/habit_stack; do not collide.',
       );
     });
 
diff --git a/diet_guard/_constants.py b/diet_guard/_constants.py
index 7ed68c7..cf02f6d 100644
--- a/diet_guard/_constants.py
+++ b/diet_guard/_constants.py
@@ -89,7 +89,7 @@ GATE_LOCK_FILE: Path = DATA_DIR / ".gate.lock"
 
 # --- Sync (cross-device log merge) ------------------------------------------
 # GitHub is used purely as dumb file storage via the REST Contents API (not a
-# git clone) -- mirrors ~/todo's sync transport. Each device pushes its own
+# git clone) -- mirrors ~/src/todo's sync transport. Each device pushes its own
 # full current log as one file under devices/<id>/food_log.json; merging
 # happens client-side (see _sync_merge.py), never via git.
 SYNC_REPO_OWNER: str = "kuhyx"
diff --git a/diet_guard/_gatelock_spacing.py b/diet_guard/_gatelock_spacing.py
index f12a426..71047bf 100644
--- a/diet_guard/_gatelock_spacing.py
+++ b/diet_guard/_gatelock_spacing.py
@@ -3,7 +3,7 @@
 Split out so :mod:`._gatelock_ui` and :mod:`._gatelock_calendar` pick
 ``pady``/``padx``/``ipady`` values from one deliberate scale instead of
 each row inventing its own gap -- see ``DESIGN_AUDIT_TODO.md``. Values are
-the px steps from ``~/utils/unified-design-system/tokens.md``'s spacing
+the px steps from ``~/src/utils/unified-design-system/tokens.md``'s spacing
 scale, used directly as Tk pixel counts.
 """
 
diff --git a/diet_guard/_gatelock_typography.py b/diet_guard/_gatelock_typography.py
index a8d286d..4fffa23 100644
--- a/diet_guard/_gatelock_typography.py
+++ b/diet_guard/_gatelock_typography.py
@@ -6,7 +6,7 @@ own value per label -- see ``DESIGN_AUDIT_TODO.md``.
 
 **These are Tk font sizes, and Tk encodes the unit in the sign: positive
 means points, negative means pixels.** The design-system scale in
-``~/utils/unified-design-system/tokens.md`` is in *pixels*, so every constant
+``~/src/utils/unified-design-system/tokens.md`` is in *pixels*, so every constant
 here is negative.
 
 This module previously carried the positive values with a comment asserting
diff --git a/diet_guard/sync_merge/__init__.py b/diet_guard/sync_merge/__init__.py
index 4ff4ba9..d6f433e 100644
--- a/diet_guard/sync_merge/__init__.py
+++ b/diet_guard/sync_merge/__init__.py
@@ -4,7 +4,7 @@ diet_guard's own on-disk ``food_log.json`` format is unchanged (a
 :class:`~diet_guard._state.DayLog`: date string -> list of entry dicts) --
 only the GitHub-synced wire format and the cross-device merge algorithm go
 through ``crdt_sync``'s ``Record``/``Log``/``Hlc`` primitives, the same ones
-every other kuhy app that syncs this way uses (see ``~/crdt-sync``).
+every other kuhy app that syncs this way uses (see ``~/src/utils/crdt-sync``).
 
 Split into three submodules for file size, along the same seams the tests
 already use:
diff --git a/packaging/aur/README.md b/packaging/aur/README.md
index 62ee88e..911011d 100644
--- a/packaging/aur/README.md
+++ b/packaging/aur/README.md
@@ -1,7 +1,7 @@
 # AUR packaging
 
 `PKGBUILD` here is the source of truth for the `diet-guard-app` AUR package.
-The AUR checkout (`~/aur/diet-guard-app`) is a copy of this file plus a
+The AUR checkout (`~/sdk/aur/diet-guard-app`) is a copy of this file plus a
 generated `.SRCINFO`.
 
 ## Why the checksum can go stale
@@ -35,8 +35,8 @@ the first packageable tag was `v1.0.1`.
 git tag v1.2.3 && git push origin v1.2.3
 
 # 3. sync + checksum + build + verify
-cp packaging/aur/PKGBUILD ~/aur/diet-guard-app/PKGBUILD
-cd ~/aur/diet-guard-app
+cp packaging/aur/PKGBUILD ~/sdk/aur/diet-guard-app/PKGBUILD
+cd ~/sdk/aur/diet-guard-app
 # bump pkgver to match the tag, then:
 updpkgsums
 makepkg -Cf
diff --git a/prompts/DOCS-crdt-sync-session-reuse.md b/prompts/DOCS-crdt-sync-session-reuse.md
index 93cef54..e651cac 100644
--- a/prompts/DOCS-crdt-sync-session-reuse.md
+++ b/prompts/DOCS-crdt-sync-session-reuse.md
@@ -1,12 +1,12 @@
 # Session prompt: connection pooling in crdt_sync
 
 Paste everything below the line into a fresh Claude Code session started in
-`~/utils` (that is where the library lives — **not** `~/diet-guard`).
+`~/src/utils` (that is where the library lives — **not** `~/src/diet-guard`).
 
 ---
 
 Add HTTP connection pooling to the shared `crdt_sync` library at
-`~/utils/crdt-sync`, then bump the tag and re-pin `~/diet-guard` to it.
+`~/src/utils/crdt-sync`, then bump the tag and re-pin `~/src/diet-guard` to it.
 
 ## Why
 
@@ -32,22 +32,22 @@ changed.
 ## Scope
 
 **In scope**
-1. Connection pooling in `~/utils/crdt-sync/crdt_sync/`, across exactly 9 call
+1. Connection pooling in `~/src/utils/crdt-sync/crdt_sync/`, across exactly 9 call
    sites in 3 files:
    - `_github.py`: lines ~73, ~84 (get), ~163 (put), ~238 (delete)
    - `_firebase.py`: ~189, ~319 (get), ~254 (put), ~300 (delete)
    - `_firebase_auth.py`: ~290 (post)
 2. A `timeout_seconds` keyword on `firebase_client_for` in `_config.py`
    (see "Second fix" below).
-3. Tag bump + re-pin `~/diet-guard/pyproject.toml` **and**
-   `~/diet-guard/requirements.txt` (both name the tag).
+3. Tag bump + re-pin `~/src/diet-guard/pyproject.toml` **and**
+   `~/src/diet-guard/requirements.txt` (both name the tag).
 
 **Out of scope — do not touch**
-- The other consumers. `~/screen-locker` is already on `crdt-sync-v0.7.0`;
-  `~/leetcode-guard`, `~/build_your_x` and `~/wake-alarm` are on
+- The other consumers. `~/src/screen-locker` is already on `crdt-sync-v0.7.0`;
+  `~/src/leetcode-guard`, `~/build_your_x` and `~/src/wake-alarm` are on
   `crdt-sync-v0.5.1`. Leave every one of those pins alone and say so in your
   final report.
-- `~/diet-guard/diet_guard/_sync*.py` logic. That work is finished and
+- `~/src/diet-guard/diet_guard/_sync*.py` logic. That work is finished and
   committed; this task only re-pins the dependency.
 
 ## The constraint that decides the design
@@ -93,7 +93,7 @@ note in your report that it can be simplified in a follow-up.
   the underlying issue instead; do not add a suppression, and do not add one to
   the ignore list without asking.
 - 250-line cap per file, enforced by a hook.
-- `~/diet-guard` has a `no local crdt_sync dependency_override` pre-commit hook
+- `~/src/diet-guard` has a `no local crdt_sync dependency_override` pre-commit hook
   that exists to stop a local path override leaking into a commit. Do not
   defeat it — re-pin to a real pushed tag.
 
@@ -102,7 +102,7 @@ note in your report that it can be simplified in a follow-up.
 `diet-guard-gate.service` runs `/usr/bin/python`, not a venv. After re-pinning:
 
 ```bash
-/usr/bin/python3 -m pip install --user --break-system-packages -e ~/diet-guard
+/usr/bin/python3 -m pip install --user --break-system-packages -e ~/src/diet-guard
 /usr/bin/python3 -c "import crdt_sync, sys; print(crdt_sync.__file__)"
 ```
 
@@ -116,7 +116,7 @@ Verify against `/usr/bin/python3`, **never** the dev venv.
   `RealUserStateWriteError` if a test tries to write there — that is a feature.
 - A sync tick **pushes to a shared remote** that the phone also reads. Timing a
   real `run_sync()` is fine (it is idempotent), but do not add throwaway writes.
-- `~/utils` is a monorepo holding several packages. Stage narrowly —
+- `~/src/utils` is a monorepo holding several packages. Stage narrowly —
   `crdt-sync/` only — and note that `crdt-sync/tool/seed_session.py` is already
   modified and `crdt-sync/firebase-debug.log` is untracked; both predate this
   task, so leave them out of your commit.
@@ -129,7 +129,7 @@ Verify against `/usr/bin/python3`, **never** the dev venv.
 
 1. `crdt_sync` at 100% branch coverage, lint clean, with a near-zero test diff.
 2. A pushed `crdt-sync-v0.8.0` tag.
-3. `~/diet-guard` re-pinned in both `pyproject.toml` and `requirements.txt`,
+3. `~/src/diet-guard` re-pinned in both `pyproject.toml` and `requirements.txt`,
    830 tests still green at 100%.
 4. Installed into `/usr/bin/python3`'s user site-packages and verified there.
 5. A re-measured full tick, reported against the 7.6s / 27-request baseline
diff --git a/prompts/TODO-dopamine-ux-diet-guard.md b/prompts/TODO-dopamine-ux-diet-guard.md
index 9ccb7df..e851389 100644
--- a/prompts/TODO-dopamine-ux-diet-guard.md
+++ b/prompts/TODO-dopamine-ux-diet-guard.md
@@ -2,8 +2,8 @@
 > "do dopamine-ux-diet-guard". It is self-contained -- it needs no context from
 > any other session.
 >
-> Canonical copy: `~/utils/dopamine-ux/03-diet-guard.md` (source of truth; this is a
-> distributed copy). Running order and cross-prompt rules: `~/utils/dopamine-ux/00-INDEX.md`.
+> Canonical copy: `~/src/utils/dopamine-ux/03-diet-guard.md` (source of truth; this is a
+> distributed copy). Running order and cross-prompt rules: `~/src/utils/dopamine-ux/00-INDEX.md`.
 > Generated 2026-08-16 from a survey of this repo -- line numbers are accurate
 > as of that date; **anchor on the symbol names, not the line numbers.**
 
@@ -19,10 +19,10 @@ Do **both**, in the same session that completes the work:
    Do not leave a finished prompt lying in the repo -- a stale prompt is
    indistinguishable from a pending one, and the next session will re-run it.
 
-2. **Log completion in the canonical index**, in `~/utils` (a *different* repo,
+2. **Log completion in the canonical index**, in `~/src/utils` (a *different* repo,
    so it needs its own commit):
    ```bash
-   cd ~/utils
+   cd ~/src/utils
    # append to the "Completion log" table in dopamine-ux/00-INDEX.md:
    #   | 03-diet-guard.md | DONE <YYYY-MM-DD> | <impl commit sha> | <one-line note> |
    git add dopamine-ux/00-INDEX.md
@@ -64,7 +64,7 @@ the streak/progress reacting visibly rather than blinking into existence.
 
 ## where
 
-Repo: `~/diet-guard`. Flutter app: `~/diet-guard/app` (package `diet_guard_app`).
+Repo: `~/src/diet-guard`. Flutter app: `~/src/diet-guard/app` (package `diet_guard_app`).
 
 Primary:
 - `app/lib/screens/log_meal_screen.dart` — `_onLogMeal()` (line 122-168 as of
@@ -136,7 +136,7 @@ Settings (for the sound opt-out in step 2):
   and salience are fair game — the numbers are not.
 - must not: add a celebratory cue to *deleting* or editing a meal. Only the
   record-creating act gets it.
-- must not: touch `~/diet-guard/diet_guard/` (the Python desktop side) — it has
+- must not: touch `~/src/diet-guard/diet_guard/` (the Python desktop side) — it has
   its own streak logic and is out of scope here.
 - optional: a progress ring instead of the plain kcal text. The article's
   near-miss point applies honestly here — a ring at 80% of budget is truthful
@@ -146,8 +146,8 @@ Settings (for the sound opt-out in step 2):
 
 1. Logging a meal on the phone produces a haptic within ~50ms of the tap, an
    explicit confirmation, and a visible (not instant) update of the streak/progress.
-2. `cd ~/diet-guard/app && flutter analyze` is clean.
-3. `cd ~/diet-guard/app && flutter test` passes.
+2. `cd ~/src/diet-guard/app && flutter analyze` is clean.
+3. `cd ~/src/diet-guard/app && flutter test` passes.
 4. With OS "remove animations" enabled, the screen still works and durations are
    zero — verified by toggling it, not by reading the code.
 5. Step 2 only: the settings toggle flips, persists across an app restart, and
@@ -159,7 +159,7 @@ Settings (for the sound opt-out in step 2):
 
 ```
 adb devices                      # confirm 23181JEGR08034 is attached
-cd ~/diet-guard/app
+cd ~/src/diet-guard/app
 flutter build apk --release
 adb install -r build/app/outputs/flutter-apk/app-release.apk
 ```
@@ -180,10 +180,10 @@ whitelist entry before it can be tested.
 - `app/lib/services/app_settings_service.dart` — the `dailyKcalGoal` field
   (~:34/:40) is the pattern to copy for a new bool. Note the `_writeToDisk`
   comment.
-- `~/diet-guard/diet_guard/_calendar_view.py` — `streaks_text()` ~:136 and
+- `~/src/diet-guard/diet_guard/_calendar_view.py` — `streaks_text()` ~:136 and
   `ytd_text()` ~:154. The Dart `streak_summary_row.dart` docstring says it mirrors
   this formatting; keep them consistent if you change wording.
-- `~/utils/unified-design-system/motion.md` — the motion/haptic vocabulary from
+- `~/src/utils/unified-design-system/motion.md` — the motion/haptic vocabulary from
   prompt 01. **Prompt 01 must have run first.**
 
 ## context you would otherwise rediscover
@@ -203,6 +203,6 @@ whitelist entry before it can be tested.
   making existing true data feel like something, not inventing a new metric.
 - diet-guard state lives under XDG (`~/.local/share/diet_guard`), unlike
   screen-locker's in-repo JSON. Tests isolate it via
-  `~/diet-guard/diet_guard/tests/conftest.py:97` `_isolate_state`.
+  `~/src/diet-guard/diet_guard/tests/conftest.py:97` `_isolate_state`.
 
 REMOVE ME AFTER FINISH
diff --git a/pyproject.toml b/pyproject.toml
index 340a62d..08517e9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -16,7 +16,7 @@ dependencies = [
 # so the systemd/CLI system-python path stays dependency-light and never has
 # to import the MCP SDK.
 [project.optional-dependencies]
-mcp = ["mcp==2.1.1"]
+mcp = ["mcp==2.2.0"]
 
 # Without this, setuptools' flat-layout auto-discovery treats the Flutter
 # app/ directory as a second top-level package and refuses to build.
diff --git a/requirements.txt b/requirements.txt
index d04d5f3..8280aec 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -6,7 +6,7 @@ coverage==7.16.0
 crdt-sync @ git+https://github.com/kuhyx/utils@crdt-sync-v0.9.1#subdirectory=crdt-sync
 freedays @ git+https://github.com/kuhyx/utils@freedays-v0.2.0#subdirectory=freedays
 gatelock @ git+https://github.com/kuhyx/utils@gatelock-v0.7.3#subdirectory=gatelock
-mcp==2.1.1
+mcp==2.2.0
 mypy==2.3.1
 pre-commit==4.6.2
 pydantic==2.13.5
@@ -17,4 +17,4 @@ pytest-randomly==5.0.0
 pytest-sugar==1.1.1
 pytest-xdist==3.8.0
 requests==2.34.2
-ruff==0.16.6
+ruff==0.16.7
diff --git a/scripts/check_dependency_freshness.sh b/scripts/check_dependency_freshness.sh
index 5cb0d78..7715d3c 100755
--- a/scripts/check_dependency_freshness.sh
+++ b/scripts/check_dependency_freshness.sh
@@ -3,7 +3,7 @@
 # ============================================================================
 # Fail if any dependency in the commit is behind its ecosystem's newest stable.
 #
-# Thin delegate to the shared gate in ~/utils, which owns the registry
+# Thin delegate to the shared gate in ~/src/utils, which owns the registry
 # adapters, the pre-release rules and the allowlist semantics. Copying that
 # logic here is what lets one repo's idea of "current" drift from every other
 # repo's -- so this script only locates the shared checker and forwards its
@@ -18,12 +18,12 @@
 
 set -euo pipefail
 
-readonly SHARED_GATE="${UTILS_ROOT:-$HOME/utils}/scripts/check_dependency_freshness.sh"
+readonly SHARED_GATE="${UTILS_ROOT:-$HOME/src/utils}/scripts/check_dependency_freshness.sh"
 
 main() {
     if [[ ! -x "$SHARED_GATE" ]]; then
         echo "Error: shared dependency-freshness gate not found at $SHARED_GATE" >&2
-        echo "       Clone github.com/kuhyx/utils to ~/utils, or set" >&2
+        echo "       Clone github.com/kuhyx/utils to ~/src/utils, or set" >&2
         echo "       UTILS_ROOT to where it lives." >&2
         exit 1
     fi
diff --git a/scripts/check_file_length.sh b/scripts/check_file_length.sh
index 45d8370..943f67a 100755
--- a/scripts/check_file_length.sh
+++ b/scripts/check_file_length.sh
@@ -3,7 +3,7 @@
 # ============================================================================
 # Fail if any file in the commit exceeds the shared 250-line cap.
 #
-# Thin delegate to the shared gate in ~/utils, which owns the cap and the
+# Thin delegate to the shared gate in ~/src/utils, which owns the cap and the
 # exemption list (generated / vendored / data files). Copying that logic here
 # is what lets one repo's idea of "too long" drift from every other repo's --
 # so this script only locates the shared checker and forwards its arguments.
@@ -15,12 +15,12 @@
 
 set -euo pipefail
 
-readonly SHARED_GATE="${UTILS_ROOT:-$HOME/utils}/scripts/check_file_length.sh"
+readonly SHARED_GATE="${UTILS_ROOT:-$HOME/src/utils}/scripts/check_file_length.sh"
 
 main() {
     if [[ ! -x "$SHARED_GATE" ]]; then
         echo "Error: shared file-length gate not found at $SHARED_GATE" >&2
-        echo "       Clone github.com/kuhyx/utils to ~/utils, or set" >&2
+        echo "       Clone github.com/kuhyx/utils to ~/src/utils, or set" >&2
         echo "       UTILS_ROOT to where it lives." >&2
         exit 1
     fi
diff --git a/scripts/check_md_naming.sh b/scripts/check_md_naming.sh
index 50deaa0..7847c56 100755
--- a/scripts/check_md_naming.sh
+++ b/scripts/check_md_naming.sh
@@ -3,7 +3,7 @@
 # ============================================================================
 # Fail if any markdown file breaks the shared naming convention.
 #
-# Thin delegate to the shared gate in ~/utils, which owns the four namespaces
+# Thin delegate to the shared gate in ~/src/utils, which owns the four namespaces
 # (README / CLAUDE* / DOCS* / TODO*), the "REMOVE ME AFTER FINISH" marker rule
 # and the exemption list. Copying that logic here is what lets one repo's idea
 # of a valid name drift from every other repo's -- so this script only locates
@@ -16,12 +16,12 @@
 
 set -euo pipefail
 
-readonly SHARED_GATE="${UTILS_ROOT:-$HOME/utils}/scripts/check_md_naming.sh"
+readonly SHARED_GATE="${UTILS_ROOT:-$HOME/src/utils}/scripts/check_md_naming.sh"
 
 main() {
     if [[ ! -x "$SHARED_GATE" ]]; then
         echo "Error: shared markdown-naming gate not found at $SHARED_GATE" >&2
-        echo "       Clone github.com/kuhyx/utils to ~/utils, or set" >&2
+        echo "       Clone github.com/kuhyx/utils to ~/src/utils, or set" >&2
         echo "       UTILS_ROOT to where it lives." >&2
         exit 1
     fi
diff --git a/scripts/check_no_crdt_sync_override.sh b/scripts/check_no_crdt_sync_override.sh
index 967e6c8..e945a0d 100755
--- a/scripts/check_no_crdt_sync_override.sh
+++ b/scripts/check_no_crdt_sync_override.sh
@@ -5,7 +5,7 @@
 #
 # The apps depend on crdt_sync as a *git dependency pinned to a tag*, so what
 # CI builds is whatever that tag points at. A `dependency_overrides:` entry
-# pointing at ~/utils/crdt_sync_dart is invaluable while developing an unreleased
+# pointing at ~/src/utils/crdt_sync_dart is invaluable while developing an unreleased
 # library change -- and catastrophic if it survives the commit: local tests go
 # green against code CI has never seen, and the failure is silent in both
 # directions.