Dissolve linux_configuration/scripts/ and single_use/

Two levels of pure taxonomy carrying no information, and a 2-directory
cap leaves no room for them. Categories now sit directly under
linux_configuration/: features, fixes, utils, misc, fresh-install,
installers, diagnostics, gaming, boot_recovery, periodic_background, lib,
meta, tests. A script's own lib/ and tests/ are exempt from the cap, so
those stay put.

Depth violations 248 -> 139; roughly 40 of the remainder are inside
digital_wellbeing and hosts, deferred until the guard-lib repoint.

The moves are the easy half. What breaks is every path that counted
levels, and three classes of it had to be found by resolving paths rather
than reading diffs:

  - 52 relative `source` lines for lib/common.sh and lib/android.sh. The
    correct prefix differs per file: 40 were ../../ and 12 were ../../../,
    so a blanket replace would have fixed one set and broken the other.
  - REPO_ROOT in 7 fixes/lib/tests harnesses and setup_syncyomi_guard.sh,
    each walking up four levels from a directory now two levels shallower.
    This caused a real regression -- the fixes suite went red with
    "log_warn: command not found" -- caught by running it and comparing
    against the pre-move baseline worktree.
  - conftest.py's sys.path entries, which took the pytest gate down with
    14 collection errors, and the `# shellcheck source=` directives, which
    took shellcheck down with SC1091.

16 symlinks in $HOME broke, including the entire i3blocks bar. All
repointed, and cpu_monitor/memory/disk/time/volume were run to confirm
they emit real output rather than merely resolving.

Verified: 1798 tests pass at 100% coverage, 8 of 9 lib/tests suites pass
(the ninth needs the coverage jail, identically at baseline), pre-commit
is clean, and the two untracked secret configs are still ignored after
their gitignore paths changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp

.copilotignore

@@ -104,7 +104,7 @@ __pycache__/
 python_pkg/cinema_planner/pasted_content.txt
 
 # Large data files (exceed indexing limits)
-linux_configuration/scripts/digital_wellbeing/pacman/words.txt
+linux_configuration/digital_wellbeing/pacman/words.txt
 
 # C build artifacts
 **/*.out

.github/skills/efficient-polling-scripts/SKILL.md

@@ -211,6 +211,6 @@ cached snapshot tools, some builds don't refresh them between calls.
 - `linux_configuration/i3-configuration/i3blocks/battery_status.sh` — zero-fork via `/sys/class/power_supply`.
 - `linux_configuration/i3-configuration/i3blocks/cpu_monitor.sh` — zero-fork via `/proc/loadavg` + `/sys/class/hwmon`.
 - `linux_configuration/i3-configuration/i3blocks/motherboard_temp.sh` — zero-fork via `/sys/class/hwmon`.
-- `linux_configuration/scripts/system-maintenance/systemd/monitors.slice` — resource-cap slice.
+- `linux_configuration/system-maintenance/systemd/monitors.slice` — resource-cap slice.
 - `phone_focus_mode/dns_enforcer.sh::chain_intact()`/`expected_rule_count()` — R9's hash/count-gate pattern, fixed 2026-07-03 after it was found pegging Android's `netd` at ~50% CPU.
 - `phone_focus_mode/hosts_enforcer.sh::sync_magisk_module` — the original hash-before-write pattern R9 mirrors.

.github/skills/self-hosted-service-exposure/SKILL.md

@@ -13,7 +13,7 @@ description: Use BEFORE deploying any Docker-based self-hosted service on this m
   `setup_wireguard_ssh.sh`'s own `setup_duckdns()` also has a
   `duckdns_already_updated()` guard for this reason. **Do not add a second one.**
 - **The firewall is owned entirely by**
-  `linux_configuration/scripts/single_use/features/setup_wireguard_ssh.sh`. It
+  `linux_configuration/features/setup_wireguard_ssh.sh`. It
   regenerates `/etc/nftables.conf` from scratch on every `setup` run (`flush
 ruleset` + fixed heredoc). **Never hand-edit `/etc/nftables.conf` directly or
   from a second script** — the next `setup` re-run (e.g. adding a WireGuard peer)
@@ -139,7 +139,7 @@ own startup, independent of `docker compose` ever being re-invoked.
 
 ## Reference implementation
 
-`linux_configuration/scripts/single_use/features/setup_gitea.sh` and
+`linux_configuration/features/setup_gitea.sh` and
 `migrate_github_to_gitea.sh` are working, idempotent examples of this whole
 pattern end to end (firewall, Caddy, headless bootstrap, host networking
 workaround, least-privilege external credential). Copy the shape, not

.gitignore

@@ -373,15 +373,15 @@ out.txt
 # Locally built Arch packages. The PKGBUILD and installer script are the source
 # and stay tracked; the built artifact is a ~600 MB binary that must never be
 # committed (see memories/binary-files.md).
-linux_configuration/scripts/single_use/*/*.pkg.tar.zst
-linux_configuration/scripts/single_use/*/*.pkg.tar.xz
+linux_configuration/*/*.pkg.tar.zst
+linux_configuration/*/*.pkg.tar.xz
 
 # Wine/Bottles prefixes — local runtime state, not source.
 bottles/
 
 # archwiki_rag local vector index: regenerated by `reindex`, machine-specific,
 # and full of binary sqlite/parquet blobs.
-linux_configuration/scripts/periodic_background/digital_wellbeing/data/
+linux_configuration/periodic_background/digital_wellbeing/data/
 
 # ===========================================================================
 # billsplit (Flutter) — launcher icons & platform assets MUST live in-repo

.pre-commit-config.yaml

@@ -37,9 +37,9 @@ repos:
         # chattr +i (self-commitment lock on the shutdown-enforcement
         # script) makes this file unwritable on purpose; the fixer hooks
         # can't open it for writing even as the owning user.
-        exclude: ^linux_configuration/scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown\.sh$
+        exclude: ^linux_configuration/periodic_background/digital_wellbeing/setup_midnight_shutdown\.sh$
       - id: end-of-file-fixer
-        exclude: ^linux_configuration/scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown\.sh$
+        exclude: ^linux_configuration/periodic_background/digital_wellbeing/setup_midnight_shutdown\.sh$
       - id: check-yaml
         args: [--unsafe]
       - id: check-json
@@ -218,7 +218,7 @@ repos:
           (?x)^(
             Bash/.*|
             \.venv/.*|
-            linux_configuration/scripts/single_use/misc/testsAndMisc-bash/tools/.*
+            linux_configuration/misc/testsAndMisc-bash/tools/.*
           )$
         additional_dependencies:
           - types-requests

AGENTS.md

@@ -9,7 +9,6 @@ Mixed-language monorepo: Python packages, Bash automation, and several apps.
 | `python_pkg/`          | Python packages — every `.py` in the repo belongs here or in an allowlisted dir                           |
 | `meta/`                | Repo-wide tooling: `pyproject.toml`, `requirements.txt`, `run.sh`, `lint_python.sh`, `.fvmrc`, `scripts/` |
 | `linux_configuration/` | Arch setup, i3 config, system maintenance, and the tracked git hooks                                      |
-| `billsplit/`           | Receipt bill-splitting Flutter app (Dart)                                                                 |
 | `bottles/`             | Small standalone project                                                                                  |
 | `docs/`                | Reference docs; `docs/superpowers/` holds AI workflow artifacts                                           |
 | `third_party/`         | Vendored upstream skills/agents                                                                           |
@@ -18,6 +17,14 @@ Root `pyproject.toml`, `requirements.txt`, `run.sh`, `lint_python.sh` and
 `.fvmrc` are **symlinks into `meta/`** — edit the files in `meta/`, not the
 symlinks.
 
+`linux_configuration/` has no `scripts/` or `single_use/` level: those two were
+pure taxonomy carrying no information, and the directory-depth cap does not
+leave room for them. Categories sit directly under it — `features/`, `fixes/`,
+`utils/`, `misc/`, `fresh-install/`, `installers/`, `diagnostics/`, `gaming/`,
+`boot_recovery/`, `periodic_background/`, `lib/`, `meta/`, `tests/`. A script's
+own `lib/` and `tests/` subdirectories are exempt from the cap, so those stay
+where they are.
+
 Extracted to their own repos: [`steam-backlog-enforcer`](https://github.com/kuhyx/steam-backlog-enforcer),
 [`screen-locker`](https://github.com/kuhyx/screen-locker),
 [`diet-guard`](https://github.com/kuhyx/diet-guard),
@@ -38,18 +45,19 @@ Archived work: [`testsAndMisc-archive`](https://github.com/kuhyx/testsAndMisc-ar
 
 ## Adding a Flutter app
 
-`billsplit/` is currently the only one, and the only place binaries are
-committed. To add another, repeat **both** halves or the icons fail silently:
+There is currently no Flutter app here — `billsplit/` was archived, and with it
+the only committed binaries. Adding one means repeating **both** halves or the
+icons fail silently:
 
 1. Add the icon globs to `.binary-allowlist`.
 2. Add matching `!` overrides at the end of `.gitignore` — an ignored file
    fails silently on `git add` rather than erroring.
 
-Icons come from the shared generator in `python_pkg/app_icons/`. Dart style is
-gated by CI only (`.github/workflows/billsplit-ci.yml`), not by a local hook.
-Keep app dirs free of Python: the `check-python-location` hook requires every
-`.py` to sit under `python_pkg/` (or `linux_configuration/`, `meta/scripts/`). `billsplit/`'s coverage gate therefore lives at
-`python_pkg/billsplit_coverage/`.
+Icons come from the shared generator in `python_pkg/app_icons/`. Dart style
+needs its own CI workflow; there is no local hook for it. Keep app dirs free of
+Python: the `check-python-location` hook requires every `.py` to sit under
+`python_pkg/` (or `linux_configuration/`, `meta/scripts/`), so an app's coverage
+gate lives in `python_pkg/`.
 
 ## Git Workflow
 

NEXT_SESSION_PROMPT.md

@@ -32,7 +32,7 @@ branches, measured in a clean worktree. **File-length cap needs nothing:** 0
 violations, hook-enforced.
 
 **What is left, if anyone wants it:** 8 directories still have no suite at all
-(`.githooks/lib`, `scripts/meta/lib`, `mtk_root/lib`, `digital_wellbeing/{pacman,
+(`.githooks/lib`, `meta/lib`, `mtk_root/lib`, `digital_wellbeing/{pacman,
 virtualbox}/lib`, `system-maintenance/bin/lib`, `single_use/{fresh-install,}/lib`)
 — 20 libs, ~1,980 lines. All are allowlisted, so nothing is blocked. This is
 optional work now, not a campaign.
@@ -100,7 +100,7 @@ SP=$(mktemp -d); git worktree add --detach --quiet "$SP/co" HEAD
 
 time (cd "$SP/co" && SKIP=pytest-coverage pre-commit run --all-files)
 time (cd "$SP/co" && python meta/scripts/pytest_changed_packages.py)
-time bash linux_configuration/scripts/single_use/fixes/lib/tests/run_all.sh
+time bash linux_configuration/fixes/lib/tests/run_all.sh
 
 git worktree remove --force "$SP/co"
 ```
@@ -242,7 +242,7 @@ the shape before you spend it.
 
 ## The suite and its harnesses
 
-`linux_configuration/scripts/single_use/fixes/lib/tests/` is the reference
+`linux_configuration/fixes/lib/tests/` is the reference
 suite: **30 test files, 645 assertions, all green, zero suppressions, 37s.**
 Copy its shape. Layers:
 

NEXT_SESSION_RESTRUCTURE.md

@@ -15,7 +15,7 @@ patterns at all).
 **Extracted** to public repos, full history, each with CI it did not have here:
 `reverse-survivors`, `kcd2-dice-solver` (cloned to `~/kcd2-dice-solver`),
 `focus-owner`, `mtk-root` (took the four `mtk_*` libs and three suites that
-lived in `scripts/lib/`).
+lived in `lib/`).
 
 **Gates written, deliberately NOT wired**: `meta/scripts/check_directory_depth.sh`
 (cap 2; exempts `third_party/`, `docs/superpowers/`, `.github/skills/` by prefix
@@ -29,7 +29,7 @@ Depth, tests and pre-commit verified green at every commit; nothing used
 - **Depth cap is 2**, with `lib/` and `tests/` exempt — so the ~118 single_use
   lib files stay put and step D only flattens entry scripts.
 - **`meta/` is in scope** for the cap.
-- **`scripts/lib/common.sh` STAYS.** Measured: 55 consumers, 51 of which remain
+- **`lib/common.sh` STAYS.** Measured: 55 consumers, 51 of which remain
   here. The `.githooks` use a _separate_ `common.sh`, so the ">2 units" rule
   selects nothing worth moving. Deviation from the original instruction,
   agreed after measurement.

docs/explanations/2026-07-13-explanation-setup-syncyomi.html

@@ -263,7 +263,7 @@ docker exec "${CADDY_CONTAINER}" caddy reload --config "${CADDYFILE_IN_CONTAINER
 
   <div class="foot">
     Generated by <code>/explain-diff</code> for commit <code>59430f9</code> ·
-    <code>linux_configuration/scripts/single_use/features/setup_syncyomi.sh</code>
+    <code>linux_configuration/features/setup_syncyomi.sh</code>
   </div>
 </div>
 

docs/explanations/2026-07-17-explanation-night-lockdown.html

@@ -116,7 +116,7 @@
 <main>
 
 <h1>Night lockdown: keeping the servers up through the curfew</h1>
-<p class="sub">How a self-discipline shutdown stopped killing seven services every night — and the four bugs that surfaced on the way there. <br><code>3ebb56c</code> · 2026-07-17 · <code>linux_configuration/scripts/periodic_background/digital_wellbeing/</code></p>
+<p class="sub">How a self-discipline shutdown stopped killing seven services every night — and the four bugs that surfaced on the way there. <br><code>3ebb56c</code> · 2026-07-17 · <code>linux_configuration/periodic_background/digital_wellbeing/</code></p>
 
 <nav class="toc">
   <strong>Contents</strong>

docs/explanations/2026-07-19-explanation-network-diagnostics-and-stale-tests.html

@@ -318,7 +318,7 @@ elif [[ -f "/usr/local/lib/common.sh" ]]; then   # ← the trap
 <h3>a. Making bash unit-testable</h3>
 
 <p>
-  The two new diagnostics live in <code>linux_configuration/scripts/diagnostics/</code>. Their
+  The two new diagnostics live in <code>linux_configuration/diagnostics/</code>. Their
   arithmetic — rate conversion, duty percentage, the mean of a sample window — is pulled out into
   pure functions, with the measurement loop kept separate:
 </p>

docs/restructure-live-state.md

@@ -17,9 +17,9 @@ its timer next fires.
 ```
 ## systemd units
   /etc/systemd/system/dns-blocklist-refresh.service
-      7:ExecStart=/home/kuhy/testsAndMisc/linux_configuration/scripts/single_use/features/setup_dns_blocker.sh refresh
+      7:ExecStart=/home/kuhy/testsAndMisc/linux_configuration/features/setup_dns_blocker.sh refresh
   /etc/systemd/system/media-organizer.service
-      10:ExecStart=/home/kuhy/testsAndMisc/linux_configuration/scripts/single_use/utils/organize_downloads.sh
+      10:ExecStart=/home/kuhy/testsAndMisc/linux_configuration/utils/organize_downloads.sh
   /home/kuhy/.config/systemd/user/endurain-import.service
       3:Documentation=file:///home/kuhy/testsAndMisc/endurain/README.md
       11:WorkingDirectory=/home/kuhy/testsAndMisc
@@ -33,37 +33,37 @@ its timer next fires.
 
 ## /etc references
   /etc/guard-lib/targets/nsswitch.conf
-      4:PLUGIN="/home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/hosts/guard/plugins/nsswitch-plugin.sh"
+      4:PLUGIN="/home/kuhy/testsAndMisc/linux_configuration/periodic_background/hosts/guard/plugins/nsswitch-plugin.sh"
   /etc/guard-lib/targets/resolved.conf
-      4:PLUGIN="/home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/hosts/guard/plugins/resolved-plugin.sh"
+      4:PLUGIN="/home/kuhy/testsAndMisc/linux_configuration/periodic_background/hosts/guard/plugins/resolved-plugin.sh"
 
 ## installed scripts referencing the repo
   /usr/local/bin/hosts-file-monitor.sh
-      10:HOSTS_INSTALL_SCRIPT="/home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/hosts/install.sh"
+      10:HOSTS_INSTALL_SCRIPT="/home/kuhy/testsAndMisc/linux_configuration/periodic_background/hosts/install.sh"
   /usr/local/bin/periodic-system-maintenance.sh
-      26:PACMAN_WRAPPER_INSTALL="/home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh"
-      27:MAKEPKG_WRAPPER_INSTALL="/home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/install_makepkg_wrapper.sh"
-      28:HOSTS_INSTALL_SCRIPT="/home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/hosts/install.sh"
+      26:PACMAN_WRAPPER_INSTALL="/home/kuhy/testsAndMisc/linux_configuration/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh"
+      27:MAKEPKG_WRAPPER_INSTALL="/home/kuhy/testsAndMisc/linux_configuration/periodic_background/digital_wellbeing/pacman/install_makepkg_wrapper.sh"
+      28:HOSTS_INSTALL_SCRIPT="/home/kuhy/testsAndMisc/linux_configuration/periodic_background/hosts/install.sh"
   /usr/local/bin/wsg-grabber
       4:export PYTHONPATH="/home/kuhy/testsAndMisc${PYTHONPATH:+:$PYTHONPATH}"
 
 ## symlinks into the repo
-  /home/kuhy/.config/i3blocks/claude_usage.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/claude_usage.sh
-  /home/kuhy/.config/i3blocks/config -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/config
-  /home/kuhy/.config/i3blocks/cpu_monitor.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/cpu_monitor.sh
-  /home/kuhy/.config/i3blocks/disk.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/disk.sh
-  /home/kuhy/.config/i3blocks/ethernet.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/ethernet.sh
-  /home/kuhy/.config/i3blocks/gpu_monitor.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/gpu_monitor.sh
-  /home/kuhy/.config/i3blocks/memory.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/memory.sh
-  /home/kuhy/.config/i3blocks/motherboard_temp.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/motherboard_temp.sh
-  /home/kuhy/.config/i3blocks/pc_startup_status.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/pc_startup_status.sh
-  /home/kuhy/.config/i3blocks/persist_common.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/persist_common.sh
-  /home/kuhy/.config/i3blocks/shutdown_countdown.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/shutdown_countdown.sh
-  /home/kuhy/.config/i3blocks/time.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/time.sh
-  /home/kuhy/.config/i3blocks/volume.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/periodic_background/i3-configuration/i3blocks/volume.sh
-  /home/kuhy/.local/bin/keepass-open -> /home/kuhy/testsAndMisc/linux_configuration/scripts/single_use/features/keepass-open.sh
-  /home/kuhy/.local/bin/line-speed-probe.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/diagnostics/line-speed-probe.sh
-  /home/kuhy/.local/bin/steam-download-duty.sh -> /home/kuhy/testsAndMisc/linux_configuration/scripts/diagnostics/steam-download-duty.sh
+  /home/kuhy/.config/i3blocks/claude_usage.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/claude_usage.sh
+  /home/kuhy/.config/i3blocks/config -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/config
+  /home/kuhy/.config/i3blocks/cpu_monitor.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/cpu_monitor.sh
+  /home/kuhy/.config/i3blocks/disk.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/disk.sh
+  /home/kuhy/.config/i3blocks/ethernet.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/ethernet.sh
+  /home/kuhy/.config/i3blocks/gpu_monitor.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/gpu_monitor.sh
+  /home/kuhy/.config/i3blocks/memory.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/memory.sh
+  /home/kuhy/.config/i3blocks/motherboard_temp.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/motherboard_temp.sh
+  /home/kuhy/.config/i3blocks/pc_startup_status.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/pc_startup_status.sh
+  /home/kuhy/.config/i3blocks/persist_common.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/persist_common.sh
+  /home/kuhy/.config/i3blocks/shutdown_countdown.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/shutdown_countdown.sh
+  /home/kuhy/.config/i3blocks/time.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/time.sh
+  /home/kuhy/.config/i3blocks/volume.sh -> /home/kuhy/testsAndMisc/linux_configuration/periodic_background/i3-configuration/i3blocks/volume.sh
+  /home/kuhy/.local/bin/keepass-open -> /home/kuhy/testsAndMisc/linux_configuration/features/keepass-open.sh
+  /home/kuhy/.local/bin/line-speed-probe.sh -> /home/kuhy/testsAndMisc/linux_configuration/diagnostics/line-speed-probe.sh
+  /home/kuhy/.local/bin/steam-download-duty.sh -> /home/kuhy/testsAndMisc/linux_configuration/diagnostics/steam-download-duty.sh
   /home/kuhy/.oh-my-zsh/custom/calc-live.zsh -> /home/kuhy/testsAndMisc/linux_configuration/zsh/calc-live.zsh
   /home/kuhy/.oh-my-zsh/custom/claude-tty-fix.zsh -> /home/kuhy/testsAndMisc/linux_configuration/zsh/claude-tty-fix.zsh
   /home/kuhy/.oh-my-zsh/custom/token-savers.zsh -> /home/kuhy/testsAndMisc/linux_configuration/zsh/token-savers.zsh

docs/shell-split-recipes.md

@@ -43,7 +43,7 @@ SCRIPT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
 
 ### Shape of a new lib (two hooks disagree unless you get this right)
 
-Follow `scripts/lib/common.sh`: **shebang present, file executable.** The two
+Follow `lib/common.sh`: **shebang present, file executable.** The two
 obvious-looking alternatives each fail a hook:
 
 - No shebang → `shellcheck` SC2148 ("target shell unknown").
@@ -56,9 +56,9 @@ boilerplate that feeds jscpd. Say so in the lib's header comment.
 - **Two live units point at repo paths** and break if a file moves or is
   renamed. `systemctl cat` them after touching either:
   - `/etc/systemd/system/dns-blocklist-refresh.service` →
-    `scripts/single_use/features/setup_dns_blocker.sh refresh`
+    `./features/setup_dns_blocker.sh refresh`
   - `/etc/systemd/system/media-organizer.service` →
-    `scripts/single_use/utils/organize_downloads.sh`
+    `./utils/organize_downloads.sh`
 
   Every other in-repo unit references an installed copy under `/usr/local/`,
   so those are only at risk if the _installer_ is what you split.
@@ -69,12 +69,12 @@ A split is only safe if the file still resolves its libs from wherever it
 actually runs. Two ways a script leaves the repo, both silent when broken:
 
 - **Copied out** — only three, all under
-  `scripts/periodic_background/hosts/guard/pacman-hooks/`, installed to
+  `periodic_background/hosts/guard/pacman-hooks/`, installed to
   `/usr/local/share/hosts-guard/` by `hosts/guard/install_pacman_hooks.sh`.
   Splitting any of those three means the installer must copy the new libs too,
   **in the same commit** — the same trap as `phone_focus_mode/deploy.sh`.
 - **Symlinked in** — exactly one: `/usr/local/bin/start-player2` →
-  `scripts/gaming/start-player2.sh`. `${BASH_SOURCE[0]%/*}` resolves to
+  `gaming/start-player2.sh`. `${BASH_SOURCE[0]%/*}` resolves to
   `/usr/local/bin` there, so a lib path must go through
   `readlink -f "${BASH_SOURCE[0]}"` first.
 

docs/superpowers/contracts/flatten-linux-configuration-2026-08-23.json

@@ -0,0 +1,21 @@
+{
+  "title": "Dissolve linux_configuration/scripts/ and single_use/ to satisfy the depth-2 cap",
+  "objective": "Flatten the largest source of directory-depth violations. scripts/ and single_use/ were three levels of pure taxonomy carrying no information, and a 2-directory cap leaves no room for them. Categories move up to sit directly under linux_configuration/, which is what makes the cap satisfiable at all.",
+  "acceptance_criteria": [
+    "linux_configuration/scripts/ no longer exists; its children sit one level under linux_configuration/.",
+    "Every relative `source` of a shared library resolves from its file's NEW location, checked by resolving each path on disk rather than by reading the diff.",
+    "Every REPO_ROOT derivation that walks up a fixed number of levels is recomputed for the new depth.",
+    "All lib/tests suites that passed before still pass, and any that fail are proven to fail identically in the pre-move baseline worktree.",
+    "The repo-wide pytest gate still reports 100% coverage.",
+    "Every symlink in $HOME pointing into the moved tree is repointed, and the i3blocks scripts are RUN to prove the status bar still works.",
+    "No config, workflow, allowlist or ignore rule names a path that no longer exists.",
+    "The .gitignore rules protecting untracked secrets still match after their paths change.",
+    "pre-commit passes without --no-verify."
+  ],
+  "out_of_scope": [
+    "periodic_background/digital_wellbeing and hosts, deferred while the guard-lib repoint is pending; they keep their depth violations for now.",
+    "Deduplicating the two Nextcloud implementations, which is a separate change.",
+    "Wiring the depth gate, which lands only once the tree conforms."
+  ],
+  "verifier": "check_directory_depth.sh --all falls 248 -> 139; every '$SCRIPT_DIR/../lib/...' source resolves on disk; 8 of 9 lib/tests run_all.sh pass with the ninth proven to need the jail at baseline too; pytest_changed_packages.py reports 1798 passed at 100%; find ~ -xtype l finds no broken link; the i3blocks scripts emit real output."
+}

docs/superpowers/evidence/flatten-linux-configuration-2026-08-23.json

@@ -0,0 +1,61 @@
+{
+  "intent": "Flatten linux_configuration by dissolving the scripts/ and single_use/ levels, cutting directory-depth violations nearly in half and making the depth-2 cap reachable.",
+  "scope": [
+    "linux_configuration/scripts/{features,fixes,utils,misc,fresh-install,feedback-appimage,lib,boot_recovery,diagnostics,gaming,meta,periodic_background} -> linux_configuration/<same>",
+    "single_use's loose installer scripts -> linux_configuration/installers/",
+    "single_use/lib/joplin_server.sh -> installers/, freeing lib/ for the shared library",
+    "~90 files rewritten for the new paths; 16 $HOME symlinks repointed",
+    "Non-goal: periodic_background/digital_wellbeing and hosts, deferred pending the guard-lib repoint"
+  ],
+  "changes": [
+    "git mv'd every category out of scripts/single_use/ and scripts/ up to linux_configuration/, then removed the two empty parents. scripts/tests/ held only an untracked __pycache__ and was deleted.",
+    "Rewrote absolute references (linux_configuration/scripts/... -> linux_configuration/...) across 38 files, and relative ../scripts/X forms across the docs and harnesses that used them.",
+    "Recomputed every relative `source` of lib/common.sh and lib/android.sh per file depth: 40 files were ../../ and 12 were ../../../, and the correct prefix differs by where the file now sits.",
+    "Fixed REPO_ROOT in 7 fixes/lib/tests harnesses plus setup_syncyomi_guard.sh, which walked up four levels from a directory that is now two levels shallower.",
+    "Repointed 16 symlinks in $HOME: the whole i3blocks bar, keepass-open, and two diagnostics tools.",
+    "Fixed linux_configuration/.gitignore's two secret paths and meta/shell-coverage-allowlist.txt's joplin_server entry.",
+    "Fixed linux_configuration/tests/conftest.py, whose sys.path entries for fast_count and the transcribe tools still named the old tree.",
+    "Documented the new layout in AGENTS.md and removed the last stale billsplit references."
+  ],
+  "verification": [
+    {
+      "command": "check_directory_depth.sh --all",
+      "result": "pass (improvement)",
+      "evidence": "248 -> 139 violations. Roughly 40 of the remainder are inside digital_wellbeing and hosts, which are deliberately deferred."
+    },
+    {
+      "command": "resolve every '$SCRIPT_DIR/../lib/...' source against the filesystem",
+      "result": "fail then pass",
+      "evidence": "First sweep left 5 files in misc/testsAndMisc-bash pointing at ../../../lib/common.sh (they had a different prefix than the 40 already fixed). After the second pass every source resolves. Checked by testing the path on disk, not by reading the diff."
+    },
+    {
+      "command": "run every lib/tests/run_all.sh",
+      "result": "pass",
+      "evidence": "8 of 9 pass. features/lib/tests fails 'REFUSING: must run under shell_coverage_jail.sh' -- confirmed identical in the pre-move baseline worktree, so it is the suite's jail requirement, not a regression. fixes/lib/tests DID regress (log_warn: command not found) and was fixed by correcting REPO_ROOT; it passes again."
+    },
+    {
+      "command": "pytest_changed_packages.py",
+      "result": "fail then pass",
+      "evidence": "First run: 14 collection errors from conftest.py's stale sys.path. After the fix: 1798 passed, TOTAL coverage 100.00%."
+    },
+    {
+      "command": "find ~ -maxdepth 4 -xtype l -lname '*testsAndMisc*'; then run the i3blocks scripts",
+      "result": "fail then pass",
+      "evidence": "16 broken symlinks immediately after the move, including the entire i3blocks bar. After repointing, zero broken, and cpu_monitor/memory/disk/time/volume all emit real output (e.g. '54°C, 1.18', '17.9GiB/30.4GiB')."
+    },
+    {
+      "command": "git check-ignore on the two secret configs; check_shell_coverage.sh --all",
+      "result": "pass",
+      "evidence": "features/.wireguard_ssh.conf and .dufs_cloud.conf are still ignored after their gitignore paths changed. Coverage gate exits 0 and every allowlist entry names a file that exists."
+    }
+  ],
+  "risks": [
+    "This renames ~400 tracked files. Anything outside this repo and outside $HOME that hardcodes linux_configuration/scripts/... would break; report_live_state.sh covers systemd, /etc, /usr/local and $HOME symlinks, and all of those were checked.",
+    "docs/superpowers/ artifacts still quote old paths. They are dated records of past work and were deliberately not rewritten.",
+    "features/lib/tests remains jail-only. That predates this change but means one suite is not exercised by a bare run."
+  ],
+  "rollback": [
+    "git revert restores the tree; the symlinks then need repointing back, which the same one-liner does with the substitution reversed.",
+    "Re-run pytest_changed_packages.py and the lib/tests suites to confirm the restored state."
+  ]
+}

docs/syncyomi-restore-runbook.md

@@ -88,8 +88,8 @@ loudly on a collapse, and keeps 14 restorable `.tachibk` snapshots.
 python3 -m python_pkg.syncyomi_guard          # exit 0 healthy, 1 collapsed
 
 # install / remove the timer
-./linux_configuration/scripts/single_use/features/setup_syncyomi_guard.sh
-./linux_configuration/scripts/single_use/features/setup_syncyomi_guard.sh --uninstall
+./linux_configuration/features/setup_syncyomi_guard.sh
+./linux_configuration/features/setup_syncyomi_guard.sh --uninstall
 
 systemctl --user list-timers syncyomi-guard.timer
 journalctl --user -u syncyomi-guard.service -n 20

linux_configuration/.github/BRANCH_PROTECTION.md

@@ -36,7 +36,7 @@ To make the shell linting check **required** before merging PRs, follow these st
 Before pushing changes, run the linting script locally to catch issues early:
 
 ```bash
-bash scripts/meta/shell_check.sh
+bash meta/shell_check.sh
 ```
 
 This will:
@@ -68,7 +68,7 @@ The workflow validates shell scripts with these extensions or shebangs:
 If the check fails on your PR:
 
 1. Review the workflow logs to see which files failed
-2. Run `bash scripts/meta/shell_check.sh` locally to reproduce
+2. Run `bash meta/shell_check.sh` locally to reproduce
 3. Fix the issues (usually formatting with `shfmt -w -i 2 -ci -sr -s`)
 4. Commit and push the fixes
 

linux_configuration/.github/copilot-instructions.md

@@ -7,29 +7,29 @@ This repo automates Linux desktop bootstrap, hardening, and i3 setup. It’s pri
 - fresh-install/: end-to-end bootstrap for Arch/Ubuntu workstations. Reads package lists, configures pacman/makepkg, sets up GPU drivers, i3, hosts guard, pacman wrapper, and useful services. Example: `fresh-install/main.sh` orchestrates most steps and sources `detect_gpu*.sh`.
 - hosts/: manages a highly-opinionated `/etc/hosts` via StevenBlack upstream with custom edits, plus “guard” friction:
   - `hosts/install.sh` builds and locks `/etc/hosts` (immutable/append-only; selective unblocks; custom blocks).
-  - `hosts/guard/` enforcement is provided by guard-lib (`guardctl`, installed outside this repo): a `file-guard` instance per target (`hosts`, `nsswitch`, `resolved`) with a path-watcher, optional RO bind mount, generic pacman hooks, and per-target plugins under `hosts/guard/plugins/`. The pre-guard-lib scripts (`setup_hosts_guard.sh`, `enforce-*.sh`, per-target systemd units, `psychological/unlock-hosts.sh`) are archived at github.com/kuhyx/testsAndMisc-archive — see `scripts/single_use/fixes/migrate_hosts_guard_to_guard_lib.sh` for how the migration works.
-- scripts/periodic_background/digital_wellbeing/pacman/: a policy-aware pacman wrapper with friction mechanics.
+  - `hosts/guard/` enforcement is provided by guard-lib (`guardctl`, installed outside this repo): a `file-guard` instance per target (`hosts`, `nsswitch`, `resolved`) with a path-watcher, optional RO bind mount, generic pacman hooks, and per-target plugins under `hosts/guard/plugins/`. The pre-guard-lib scripts (`setup_hosts_guard.sh`, `enforce-*.sh`, per-target systemd units, `psychological/unlock-hosts.sh`) are archived at github.com/kuhyx/testsAndMisc-archive — see `./fixes/migrate_hosts_guard_to_guard_lib.sh` for how the migration works.
+- periodic_background/digital_wellbeing/pacman/: a policy-aware pacman wrapper with friction mechanics.
   - `pacman_wrapper.sh` intercepts transactions, runs hosts-guard pre/post hooks, handles stale db lock, auto-wires maintenance services, and enforces package policy (blocked/whitelisted lists); adds weekend-only “Steam” challenge and a VirtualBox challenge powered by `words.txt`.
   - `install_pacman_wrapper.sh` backs up `/usr/bin/pacman` to `pacman.orig` and symlinks to the wrapper.
-- scripts/periodic_background/system-maintenance/: templates and installer for periodic jobs and monitoring.
+- periodic_background/system-maintenance/: templates and installer for periodic jobs and monitoring.
   - `setup_periodic_system.sh` installs: `/usr/local/bin/periodic-system-maintenance.sh`, a timer (`periodic-system-maintenance.timer`), a startup oneshot, and `hosts-file-monitor.service` that restores `/etc/hosts` if tampered. Also installs a browser pre-exec wrapper that re-runs the hosts installer before launching common browsers.
 - i3-configuration/: installs i3 and i3blocks configs with small font sizing logic (`i3-configuration/install.sh`).
 
 ## Conventions you should follow
 
-- Bash style: use `set -e` or `set -euo pipefail`, re-exec with sudo if not root, be idempotent, and log to `/var/log/*` with timestamps. Examples: `setup_periodic_system.sh`, `scripts/single_use/fixes/migrate_hosts_guard_to_guard_lib.sh`.
-- Install via templates: scripts under `scripts/periodic_background/system-maintenance/bin` and `.../systemd` are templates. The setup script substitutes placeholders like `__HOSTS_INSTALL_SCRIPT__` and `__PACMAN_WRAPPER_INSTALL__` before installing to `/usr/local/bin` and `/etc/systemd/system`. Don’t edit installed copies directly; modify templates and the setup script.
+- Bash style: use `set -e` or `set -euo pipefail`, re-exec with sudo if not root, be idempotent, and log to `/var/log/*` with timestamps. Examples: `setup_periodic_system.sh`, `./fixes/migrate_hosts_guard_to_guard_lib.sh`.
+- Install via templates: scripts under `periodic_background/system-maintenance/bin` and `.../systemd` are templates. The setup script substitutes placeholders like `__HOSTS_INSTALL_SCRIPT__` and `__PACMAN_WRAPPER_INSTALL__` before installing to `/usr/local/bin` and `/etc/systemd/system`. Don’t edit installed copies directly; modify templates and the setup script.
 - Package lists: `fresh-install/pacman_packages.txt` and `aur_packages.txt` treat any line not starting with lowercase alnum as a comment.
 
 ## Core workflows (what to run)
 
 - Fresh machine: run from repo root
   - `fresh-install/main.sh` (bootstraps configs, GPU, hosts, i3, pacman wrapper, services). It assumes the repo is at `~/linux-configuration` in some steps.
-- Periodic services: `sudo scripts/periodic_background/setup_periodic_system.sh` (installs timer, startup service, hosts monitor, and browser pre-exec wrapper; then performs an initial run).
-- Pacman wrapper only: `sudo scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh` (backs up pacman and wires the wrapper). The wrapper auto-runs hosts-guard pre/post hooks and can self-setup periodic services when missing.
+- Periodic services: `sudo periodic_background/setup_periodic_system.sh` (installs timer, startup service, hosts monitor, and browser pre-exec wrapper; then performs an initial run).
+- Pacman wrapper only: `sudo periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh` (backs up pacman and wires the wrapper). The wrapper auto-runs hosts-guard pre/post hooks and can self-setup periodic services when missing.
 - Hosts guard:
   - `sudo hosts/install.sh` to (re)build `/etc/hosts` from cache/upstream then lock it.
-  - Guard layers (hosts/nsswitch/resolved) are managed by `guardctl file-guard <install|status|unlock|uninstall> <name>`; see `scripts/single_use/fixes/migrate_hosts_guard_to_guard_lib.sh` to (re)install them.
+  - Guard layers (hosts/nsswitch/resolved) are managed by `guardctl file-guard <install|status|unlock|uninstall> <name>`; see `./fixes/migrate_hosts_guard_to_guard_lib.sh` to (re)install them.
   - To edit a guarded file: `sudo guardctl file-guard unlock <name>`, edit, then let the path-watcher re-lock it (or `guardctl file-guard enforce <name>`).
 - i3 config: `i3-configuration/install.sh` (copies `i3` and `i3blocks`, adjusts font size; installs required tools conditionally for Arch/Ubuntu).
 
@@ -37,24 +37,24 @@ This repo automates Linux desktop bootstrap, hardening, and i3 setup. It’s pri
 
 - Pacman interception: `pacman_wrapper.sh` sets `PACMAN_BIN=/usr/bin/pacman.orig` and symlinks `/usr/bin/pacman` -> wrapper. Keep this invariant when changing the wrapper.
 - Hosts hooks: pacman transactions are unlocked/relocked by guard-lib's generic hooks (`/etc/pacman.d/hooks/10-guard-lib-unlock-all.hook`, `90-guard-lib-relock-all.hook`), which iterate every registered `file-guard` instance rather than being hosts-specific.
-- Logs: check `/var/log/periodic-system-maintenance.log` and `/var/log/hosts-file-monitor.log` for service behavior; timer and services live under `scripts/periodic_background/system-maintenance/systemd/` (templates).
+- Logs: check `/var/log/periodic-system-maintenance.log` and `/var/log/hosts-file-monitor.log` for service behavior; timer and services live under `periodic_background/system-maintenance/systemd/` (templates).
 - Browser pre-exec: setup creates `/usr/local/bin/browser-preexec-wrapper` and symlinks common browser names to it; it silently re-runs the hosts installer before launching the real binary in `/usr/bin`.
 
 ## Patterns to reuse when adding features
 
-- Follow the sudo re-exec + idempotent install pattern from `setup_periodic_system.sh` and `scripts/single_use/fixes/migrate_hosts_guard_to_guard_lib.sh`.
-- Add new periodic behaviors as templates under `scripts/periodic_background/system-maintenance/bin` and `.../systemd`, then extend `setup_periodic_system.sh` to install/enable them.
-- Extend package policy by updating `scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt` or by adding `check_for_<pkg>` + `prompt_for_<pkg>_challenge` blocks in the wrapper.
-- Run `scripts/meta/shell_check.sh` to detect things to fix before committing.
+- Follow the sudo re-exec + idempotent install pattern from `setup_periodic_system.sh` and `./fixes/migrate_hosts_guard_to_guard_lib.sh`.
+- Add new periodic behaviors as templates under `periodic_background/system-maintenance/bin` and `.../systemd`, then extend `setup_periodic_system.sh` to install/enable them.
+- Extend package policy by updating `periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt` or by adding `check_for_<pkg>` + `prompt_for_<pkg>_challenge` blocks in the wrapper.
+- Run `meta/shell_check.sh` to detect things to fix before committing.
 
 ## Detailed LLM Documentation
 
 For in-depth understanding of specific components, see these dedicated guides:
 
-- **Hosts Guard**: [scripts/single_use/fixes/migrate_hosts_guard_to_guard_lib.sh](../scripts/single_use/fixes/migrate_hosts_guard_to_guard_lib.sh) header comment - guard-lib migration, protection layers, canonical copies, path watchers. The pre-guard-lib README is archived at github.com/kuhyx/testsAndMisc-archive.
-- **Pacman Wrapper**: [scripts/periodic_background/digital_wellbeing/pacman/README_FOR_LLM.md](../scripts/periodic_background/digital_wellbeing/pacman/README_FOR_LLM.md) - Policy files, integrity checks, challenges
-- **Midnight Shutdown**: [scripts/periodic_background/digital_wellbeing/README_MIDNIGHT_SHUTDOWN_LLM.md](../scripts/periodic_background/digital_wellbeing/README_MIDNIGHT_SHUTDOWN_LLM.md) - Schedule protection, timer system
-- **Compulsive Block**: [scripts/periodic_background/digital_wellbeing/README_COMPULSIVE_BLOCK_LLM.md](../scripts/periodic_background/digital_wellbeing/README_COMPULSIVE_BLOCK_LLM.md) - App launch limiting
+- **Hosts Guard**: [./fixes/migrate_hosts_guard_to_guard_lib.sh](../fixes/migrate_hosts_guard_to_guard_lib.sh) header comment - guard-lib migration, protection layers, canonical copies, path watchers. The pre-guard-lib README is archived at github.com/kuhyx/testsAndMisc-archive.
+- **Pacman Wrapper**: [periodic_background/digital_wellbeing/pacman/README_FOR_LLM.md](../periodic_background/digital_wellbeing/pacman/README_FOR_LLM.md) - Policy files, integrity checks, challenges
+- **Midnight Shutdown**: [periodic_background/digital_wellbeing/README_MIDNIGHT_SHUTDOWN_LLM.md](../periodic_background/digital_wellbeing/README_MIDNIGHT_SHUTDOWN_LLM.md) - Schedule protection, timer system
+- **Compulsive Block**: [periodic_background/digital_wellbeing/README_COMPULSIVE_BLOCK_LLM.md](../periodic_background/digital_wellbeing/README_COMPULSIVE_BLOCK_LLM.md) - App launch limiting
 - **Security Analysis**: [docs/SECURITY_HARDENING_ANALYSIS.md](../docs/SECURITY_HARDENING_ANALYSIS.md) - Vulnerabilities and implementation roadmap
 
 ## Digital Wellbeing Components Summary
@@ -62,8 +62,8 @@ For in-depth understanding of specific components, see these dedicated guides:
 | Component         | Purpose                       | Key Files                                                                   |
 | ----------------- | ----------------------------- | --------------------------------------------------------------------------- |
 | Hosts Guard       | Block websites via /etc/hosts | `hosts/install.sh`, `guardctl` (guard-lib), `hosts/guard/plugins/*`         |
-| Pacman Wrapper    | Block package installation    | `scripts/periodic_background/digital_wellbeing/pacman/*`                    |
-| Midnight Shutdown | Auto-shutdown at night        | `scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown.sh`  |
-| Compulsive Block  | Limit app launches            | `scripts/periodic_background/digital_wellbeing/block_compulsive_opening.sh` |
-| Music Wrapper     | Block music during focus      | `scripts/periodic_background/digital_wellbeing/youtube-music-wrapper.sh`    |
+| Pacman Wrapper    | Block package installation    | `periodic_background/digital_wellbeing/pacman/*`                    |
+| Midnight Shutdown | Auto-shutdown at night        | `periodic_background/digital_wellbeing/setup_midnight_shutdown.sh`  |
+| Compulsive Block  | Limit app launches            | `periodic_background/digital_wellbeing/block_compulsive_opening.sh` |
+| Music Wrapper     | Block music during focus      | `periodic_background/digital_wellbeing/youtube-music-wrapper.sh`    |
 | Screen Locker     | Require workout to unlock     | External: `~/testsAndMisc/python_pkg/screen_locker/`                        |

linux_configuration/.github/workflows/shell-check.yml

@@ -8,7 +8,7 @@ on:
       - "**.bash"
       - "**.zsh"
       - ".github/workflows/shell-check.yml"
-      - "scripts/meta/shell_check.sh"
+      - "meta/shell_check.sh"
   pull_request:
     branches: [main, master]
     paths:
@@ -16,7 +16,7 @@ on:
       - "**.bash"
       - "**.zsh"
       - ".github/workflows/shell-check.yml"
-      - "scripts/meta/shell_check.sh"
+      - "meta/shell_check.sh"
 
 jobs:
   shellcheck:
@@ -43,7 +43,7 @@ jobs:
 
       - name: Run shell_check.sh
         run: |
-          bash scripts/meta/shell_check.sh --skip-install
+          bash meta/shell_check.sh --skip-install
 
       - name: Report status
         if: success()
@@ -54,4 +54,4 @@ jobs:
         run: |
           echo "❌ Shell script linting failed!"
           echo "This check is required to merge PRs into main/master."
-          echo "Please run 'bash scripts/meta/shell_check.sh' locally and fix any issues."
+          echo "Please run 'bash meta/shell_check.sh' locally and fix any issues."

linux_configuration/.gitignore

@@ -5,11 +5,11 @@ scripts/features/.raspberry_pi.conf
 .raspberry_pi.conf
 
 # WireGuard/SSH remote-access setup config (contains the DuckDNS token)
-scripts/single_use/features/.wireguard_ssh.conf
+features/.wireguard_ssh.conf
 .wireguard_ssh.conf
 
 # dufs cloud setup config (contains the plaintext web password) — never commit.
-scripts/single_use/features/.dufs_cloud.conf
+features/.dufs_cloud.conf
 .dufs_cloud.conf
 **/.dufs_cloud.conf
 

linux_configuration/docs/PACMAN_WRAPPER_SECURITY.md

@@ -16,7 +16,7 @@ The original pacman wrapper had the following vulnerabilities:
 
 ### 1. Policy File Integrity Checks
 
-**File**: `scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh`
+**File**: `periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh`
 
 The installer now:
 
@@ -25,7 +25,7 @@ The installer now:
 - Makes the integrity file immutable using `chattr +i`
 - Makes policy files (`pacman_blocked_keywords.txt`, `pacman_greylist.txt`) immutable
 
-**File**: `scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh`
+**File**: `periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh`
 
 The wrapper now:
 
@@ -42,7 +42,7 @@ The wrapper now:
 
 ### 2. Hardcoded VirtualBox Restrictions
 
-**File**: `scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh`
+**File**: `periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh`
 
 Added hardcoded VirtualBox detection that **cannot be bypassed** by editing policy files:
 
@@ -75,7 +75,7 @@ This function:
 
 ### 3. VirtualBox Hosts Enforcement
 
-**File**: `scripts/periodic_background/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh`
+**File**: `periodic_background/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh`
 
 A new enforcement script that:
 
@@ -116,7 +116,7 @@ The pacman wrapper automatically:
 
 ### 4. Installation Integration
 
-**File**: `scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh`
+**File**: `periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh`
 
 The installer now:
 

linux_configuration/docs/SUMMARY.md

@@ -37,7 +37,7 @@ Implemented a **defense-in-depth** security architecture with multiple layers:
 
 ### Layer 4: VirtualBox Enforcement
 
-- New script: `scripts/periodic_background/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh`
+- New script: `periodic_background/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh`
 - Automatically configures all VMs to:
   - Use host's DNS resolution (`--natdnshostresolver1 on`)
   - Enable NAT DNS proxy (`--natdnsproxy1 on`)
@@ -55,15 +55,15 @@ Implemented a **defense-in-depth** security architecture with multiple layers:
 
 ### New Files (4)
 
-1. `scripts/periodic_background/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh` - VirtualBox enforcement script
+1. `periodic_background/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh` - VirtualBox enforcement script
 2. `tests/test_pacman_wrapper_security.sh` - Comprehensive test suite (12 tests)
 3. `docs/PACMAN_WRAPPER_SECURITY.md` - Detailed security documentation
 4. `docs/SUMMARY.md` - This summary
 
 ### Modified Files (2)
 
-1. `scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh` - Added integrity checks and immutable attributes
-2. `scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh` - Added integrity verification and VirtualBox enforcement
+1. `periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh` - Added integrity checks and immutable attributes
+2. `periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh` - Added integrity verification and VirtualBox enforcement
 
 ## Security Guarantees
 
@@ -103,7 +103,7 @@ Tests verify:
 ## Installation
 
 ```bash
-cd scripts/periodic_background/digital_wellbeing/pacman
+cd periodic_background/digital_wellbeing/pacman
 sudo ./install_pacman_wrapper.sh
 ```
 
@@ -137,7 +137,7 @@ If legitimate policy updates are needed:
 ```bash
 sudo chattr -i /usr/local/bin/pacman_greylist.txt
 sudo nano /usr/local/bin/pacman_greylist.txt
-cd scripts/periodic_background/digital_wellbeing/pacman
+cd periodic_background/digital_wellbeing/pacman
 sudo ./install_pacman_wrapper.sh  # Regenerates checksums
 ```
 

linux_configuration/docs/pacman-wrapper/testing-and-usage.md

@@ -22,7 +22,7 @@ Tests verify:
 ### Installation
 
 ```bash
-cd scripts/periodic_background/digital_wellbeing/pacman
+cd periodic_background/digital_wellbeing/pacman
 sudo ./install_pacman_wrapper.sh
 ```
 
@@ -46,7 +46,7 @@ sudo chattr -i /usr/local/bin/pacman_greylist.txt
 sudo nano /usr/local/bin/pacman_greylist.txt
 
 # Reinstall wrapper to update checksums
-cd scripts/periodic_background/digital_wellbeing/pacman
+cd periodic_background/digital_wellbeing/pacman
 sudo ./install_pacman_wrapper.sh
 
 # This will regenerate checksums and reapply immutable attributes

linux_configuration/docs/security-hardening/01-current-state.md

@@ -36,7 +36,7 @@
 
 **Files involved:**
 
-- [scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown.sh](../scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown.sh) (1359 lines)
+- [periodic_background/digital_wellbeing/setup_midnight_shutdown.sh](../periodic_background/digital_wellbeing/setup_midnight_shutdown.sh) (1359 lines)
 
 **Current Protection Layers:**
 
@@ -79,9 +79,9 @@
 
 **Files involved:**
 
-- [scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh](../scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh) (823 lines)
-- [scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt](../scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt)
-- [scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh](../scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh)
+- [periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh](../periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh) (823 lines)
+- [periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt](../periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt)
+- [periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh](../periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh)
 
 **Current Protection:**
 
@@ -101,7 +101,7 @@
 
 ### 5. Block Compulsive Opening
 
-**File:** [scripts/periodic_background/digital_wellbeing/block_compulsive_opening.sh](../scripts/periodic_background/digital_wellbeing/block_compulsive_opening.sh) (507 lines)
+**File:** [periodic_background/digital_wellbeing/block_compulsive_opening.sh](../periodic_background/digital_wellbeing/block_compulsive_opening.sh) (507 lines)
 
 **Current Behavior:**
 
@@ -121,7 +121,7 @@
 
 ### 6. YouTube Music Wrapper
 
-**File:** [scripts/periodic_background/digital_wellbeing/youtube-music-wrapper.sh](../scripts/periodic_background/digital_wellbeing/youtube-music-wrapper.sh)
+**File:** [periodic_background/digital_wellbeing/youtube-music-wrapper.sh](../periodic_background/digital_wellbeing/youtube-music-wrapper.sh)
 
 **Current Behavior:**
 

linux_configuration/docs/security-hardening/03-implementation.md

@@ -27,7 +27,7 @@ hosts line completely bypasses /etc/hosts without touching it.
 
 ## 2. MIDNIGHT SHUTDOWN - Silent Denial
 
-Location: scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown.sh
+Location: periodic_background/digital_wellbeing/setup_midnight_shutdown.sh
 
 Changes needed:
 - Remove ALL helpful messages about how to bypass (unlock-shutdown-schedule path)
@@ -59,7 +59,7 @@ Changes needed:
 
 ## 4. PACMAN WRAPPER - Chrome Block + LeechBlock Auto-Install
 
-Location: scripts/periodic_background/digital_wellbeing/pacman/
+Location: periodic_background/digital_wellbeing/pacman/
 
 Changes needed to pacman_blocked_keywords.txt:
 - Add: google-chrome
@@ -78,7 +78,7 @@ New behavior in pacman_wrapper.sh:
 
 ## 5. BLOCK COMPULSIVE OPENING - Auto-Close Timer
 
-Location: scripts/periodic_background/digital_wellbeing/block_compulsive_opening.sh
+Location: periodic_background/digital_wellbeing/block_compulsive_opening.sh
 
 New behavior:
 - After app is allowed to open, start a background timer
@@ -126,7 +126,7 @@ launch_with_timer() {
 
 This requires a more sophisticated approach. Create a new Python daemon.
 
-Location: scripts/periodic_background/digital_wellbeing/focus_mode_daemon.py (new file)
+Location: periodic_background/digital_wellbeing/focus_mode_daemon.py (new file)
 
 Behavior:
 
@@ -158,18 +158,18 @@ New files:
 - hosts/guard/nsswitch-guard.path
 - hosts/guard/nsswitch-guard.service
 - hosts/guard/enforce-nsswitch.sh
-- scripts/periodic_background/digital_wellbeing/focus_mode_daemon.py
-- scripts/periodic_background/digital_wellbeing/install_focus_mode_daemon.sh
+- periodic_background/digital_wellbeing/focus_mode_daemon.py
+- periodic_background/digital_wellbeing/install_focus_mode_daemon.sh
 - tests/test_security_hardening.sh
 
 Modified files:
 
 - hosts/guard/setup_hosts_guard.sh (add nsswitch protection)
-- scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown.sh (remove helpful messages)
-- scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt (add chrome)
-- scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh (leechblock auto-install)
-- scripts/periodic_background/digital_wellbeing/block_compulsive_opening.sh (auto-close timer)
-- scripts/periodic_background/digital_wellbeing/youtube-music-wrapper.sh (daemon integration)
+- periodic_background/digital_wellbeing/setup_midnight_shutdown.sh (remove helpful messages)
+- periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt (add chrome)
+- periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh (leechblock auto-install)
+- periodic_background/digital_wellbeing/block_compulsive_opening.sh (auto-close timer)
+- periodic_background/digital_wellbeing/youtube-music-wrapper.sh (daemon integration)
 
 External repo (separate changes):
 

linux_configuration/docs/security-hardening/04-agent-personas.md

@@ -45,7 +45,7 @@ You are an expert on the midnight shutdown system. You understand:
 
 FILES YOU KNOW:
 
-- scripts/periodic_background/digital_wellbeing/setup_midnight_shutdown.sh - Main installer (1300+ lines)
+- periodic_background/digital_wellbeing/setup_midnight_shutdown.sh - Main installer (1300+ lines)
 - /etc/shutdown-schedule.conf - Runtime config (MON_WED_HOUR, THU_SUN_HOUR, MORNING_END_HOUR)
 - /usr/local/share/locked-shutdown-schedule.conf - Canonical protected copy
 - /usr/local/bin/day-specific-shutdown-check.sh - Checks if in shutdown window
@@ -83,12 +83,12 @@ You are an expert on the pacman wrapper security system. You understand:
 
 FILES YOU KNOW:
 
-- scripts/periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh - Main wrapper (823 lines)
-- scripts/periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh - Backs up real pacman
-- scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt - Always blocked
-- scripts/periodic_background/digital_wellbeing/pacman/pacman_whitelist.txt - Exceptions to keywords
-- scripts/periodic_background/digital_wellbeing/pacman/pacman_greylist.txt - Challenge required
-- scripts/periodic_background/digital_wellbeing/pacman/words.txt - Word scramble challenge words
+- periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh - Main wrapper (823 lines)
+- periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh - Backs up real pacman
+- periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt - Always blocked
+- periodic_background/digital_wellbeing/pacman/pacman_whitelist.txt - Exceptions to keywords
+- periodic_background/digital_wellbeing/pacman/pacman_greylist.txt - Challenge required
+- periodic_background/digital_wellbeing/pacman/words.txt - Word scramble challenge words
 - /var/lib/pacman-wrapper/policy.sha256 - Integrity checksums
 
 KEY CONCEPTS:
@@ -127,7 +127,7 @@ You are an expert on the block_compulsive_opening.sh script. You understand:
 
 FILES YOU KNOW:
 
-- scripts/periodic_background/digital_wellbeing/block_compulsive_opening.sh - Main script (507 lines)
+- periodic_background/digital_wellbeing/block_compulsive_opening.sh - Main script (507 lines)
 - /usr/local/bin/block-compulsive-opening.sh - Installed location
 - ~/.local/state/compulsive-block/\*.lastopen - Per-app state files
 - ~/.local/state/compulsive-block/compulsive-block.log - Activity log

linux_configuration/docs/security-hardening/05-llm-readmes.md

@@ -51,7 +51,7 @@ sudo ~/linux-configuration/hosts/guard/setup_hosts_guard.sh
 
 ````
 
-### [scripts/periodic_background/digital_wellbeing/pacman/README_FOR_LLM.md](to be created)
+### [periodic_background/digital_wellbeing/pacman/README_FOR_LLM.md](to be created)
 
 ```markdown
 # Pacman Wrapper - LLM Reference

linux_configuration/dwm/README.md

@@ -2,7 +2,7 @@
 
 Versioned customisation for [suckless dwm](https://dwm.suckless.org/). This
 directory is the **source of truth**; the installer
-[`../scripts/single_use/features/setup_dwm.sh`](../scripts/single_use/features/setup_dwm.sh)
+[`../features/setup_dwm.sh`](../features/setup_dwm.sh)
 clones upstream `dwm` master, copies these files on top, applies the two
 `dwm.c` patches, and builds. Nothing here is a full fork of dwm — only the
 files we actually change live in the repo, so upstream stays bleeding-edge.

linux_configuration/dwm/bin/dwm-session

@@ -20,7 +20,7 @@ command -v simplenote >/dev/null 2>&1 && simplenote &
 [ -x "$HOME/.fehbg" ] && "$HOME/.fehbg" &
 
 # repo helpers (real current paths under single_use/utils); guarded in case moved
-idle="$HOME/testsAndMisc/linux_configuration/scripts/single_use/utils/turn_off_auto_idle_screen_shutdown.sh"
+idle="$HOME/testsAndMisc/linux_configuration/utils/turn_off_auto_idle_screen_shutdown.sh"
 [ -x "$idle" ] && bash "$idle" --watch-controller &
 
 # lightweight status bar (root window name)

linux_configuration/dwm/config.h

@@ -201,13 +201,13 @@ static const Key keys[] = {
 	 * backend as the media keys, with a notification and NO pacman side-effects.
 	 * (toggle_mic.sh is deliberately avoided here: it runs `sudo pacman -S dunst`
 	 * if dunst is missing, which deadlocks pacman when spawned without a tty.) */
-	{ MODKEY,                       XK_m,          spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/scripts/single_use/utils/volume_control.sh micmute") },
+	{ MODKEY,                       XK_m,          spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/utils/volume_control.sh micmute") },
 
 	/* media keys — routed through volume_control.sh, same as the (now-fixed) i3 config */
-	{ 0, XF86XK_AudioRaiseVolume,                  spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/scripts/single_use/utils/volume_control.sh up") },
-	{ 0, XF86XK_AudioLowerVolume,                  spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/scripts/single_use/utils/volume_control.sh down") },
-	{ 0, XF86XK_AudioMute,                         spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/scripts/single_use/utils/volume_control.sh mute") },
-	{ 0, XF86XK_AudioMicMute,                      spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/scripts/single_use/utils/volume_control.sh micmute") },
+	{ 0, XF86XK_AudioRaiseVolume,                  spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/utils/volume_control.sh up") },
+	{ 0, XF86XK_AudioLowerVolume,                  spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/utils/volume_control.sh down") },
+	{ 0, XF86XK_AudioMute,                         spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/utils/volume_control.sh mute") },
+	{ 0, XF86XK_AudioMicMute,                      spawn,          SHCMD("$HOME/testsAndMisc/linux_configuration/utils/volume_control.sh micmute") },
 
 	/* tags 1-10 (i3 workspaces 1-10) */
 	TAGKEYS(                        XK_1,                          0)

linux_configuration/features/install_unreal_mcp.sh

@@ -12,8 +12,8 @@ SCRIPT_NAME="$(basename "$0")"
 
 # Source common library for shared functions
 SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
-# shellcheck source=../../lib/common.sh
-source "$SCRIPT_DIR/../../lib/common.sh"
+# shellcheck source=../lib/common.sh
+source "$SCRIPT_DIR/../lib/common.sh"
 
 # ---------- User/paths ----------
 set_actual_user_vars

linux_configuration/features/lib/tests/run_all.sh

@@ -12,7 +12,7 @@
 # need on an Arch host:
 #
 #   meta/scripts/shell_coverage_jail.sh \
-#       --subject linux_configuration/scripts/single_use/features/lib/tests/run_all.sh \
+#       --subject linux_configuration/features/lib/tests/run_all.sh \
 #       --bind /etc --bind /usr/local/bin --bind /var/lib \
 #       --seed-dir /etc/php/8.2/apache2 \
 #       --seed-dir /etc/php/8.2/mods-available \