diff --git a/CLAUDE.md b/CLAUDE.md
index 18015fd..37d391e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -8,6 +8,13 @@
 - **No comments** unless the WHY is genuinely non-obvious.
 - The `.plg` symlinks the installed plugin location directly to this workspace — one copy, no drift.
 
+### Hard limits — do not cross these
+
+- **Never create or modify `.claude/settings.json`** in this repo. No workspace hooks, ever. The stale hook that existed here previously fired `Deployment/deploy.sh` (now deleted) on every file edit and caused unintended deploys. If you think a hook would help, ask first.
+- **Never change `HOST1_STORAGE_MODE_INTERNAL`** in `host1.conf`. Claude data belongs in `/mnt/user/appdata/claude-code/` — not inside this repo.
+- **Never run or reference anything in the stale dev folder** (`/mnt/user/Important Shit/Git/Development/Varaverk` or `/mnt/cloud-storage/...`). It does not exist for purposes of this project.
+- **Never move files between `Configurations/` and `Deployment/`** without explicit instruction. `Configurations/` = live runtime confs (gitignored). `Deployment/` = templates and setup tooling (tracked).
+
 ---
 
 ## Project: What Varaverk Is
diff --git a/Configurations/README.md b/Configurations/README.md
new file mode 100644
index 0000000..14ede63
--- /dev/null
+++ b/Configurations/README.md
@@ -0,0 +1,15 @@
+# Configurations/
+
+Runtime home for the live conf files. These are gitignored — never committed.
+
+| File | Source |
+|------|--------|
+| `master.conf` | Seeded from `Deployment/master.conf.template` on first install |
+| `host1.conf` | Seeded from `Deployment/host.conf.template` on first install |
+| `host2.conf` | Seeded from `Deployment/host.conf.template` on first install |
+
+**Templates and tooling live in `Deployment/`:**
+- `Deployment/host.conf.template` — canonical template for new host confs
+- `Deployment/master.conf.template` — canonical template for master.conf
+- `Deployment/conf_upgrade.sh` — merges schema changes into existing confs
+- `Deployment/conf_populate.sh` — auto-detects and fills arr keys on first run
diff --git a/Plugin/unraid/Tools/conf_populate.sh b/Deployment/conf_populate.sh
similarity index 100%
rename from Plugin/unraid/Tools/conf_populate.sh
rename to Deployment/conf_populate.sh
diff --git a/Deployment/conf_upgrade.sh b/Deployment/conf_upgrade.sh
index 2a5af14..9877b88 100755
--- a/Deployment/conf_upgrade.sh
+++ b/Deployment/conf_upgrade.sh
@@ -53,13 +53,13 @@
 # RUNTIME MODES
 # ==============================================================================================
 #
-# conf_upgrade.sh --template Configurations/master.conf.template --target Configurations/master.conf --dry-run
+# conf_upgrade.sh --template Deployment/master.conf.template --target Configurations/master.conf --dry-run
 #     Preview what would be added, removed, and kept — no changes written.
 #
-# conf_upgrade.sh --template Configurations/master.conf.template --target Configurations/master.conf --backup
+# conf_upgrade.sh --template Deployment/master.conf.template --target Configurations/master.conf --backup
 #     Apply the upgrade, writing a .bak first.
 #
-# conf_upgrade.sh --template Configurations/master.conf.template --target Configurations/master.conf
+# conf_upgrade.sh --template Deployment/master.conf.template --target Configurations/master.conf
 #     Apply the upgrade in-place with no backup.
 #
 # ==============================================================================================
diff --git a/Configurations/host.conf.template b/Deployment/host.conf.template
similarity index 100%
rename from Configurations/host.conf.template
rename to Deployment/host.conf.template
diff --git a/Configurations/master.conf.template b/Deployment/master.conf.template
similarity index 100%
rename from Configurations/master.conf.template
rename to Deployment/master.conf.template
diff --git a/Plugin/unraid/api/setup.php b/Plugin/unraid/api/setup.php
index ef7d62a..6a30d72 100644
--- a/Plugin/unraid/api/setup.php
+++ b/Plugin/unraid/api/setup.php
@@ -55,7 +55,7 @@ if ($action === 'ssh_generate') {
 
 // ── POST: run conf_populate.sh ─────────────────────────────────────────────────────────────────
 if ($action === 'populate') {
-    $script = SCRIPTS_DIR . '/Plugin/unraid/Tools/conf_populate.sh';
+    $script = DEPLOY_DIR . '/conf_populate.sh';
     if (!file_exists($script)) {
         echo json_encode(['ok' => false, 'error' => 'conf_populate.sh not found']);
         exit;
@@ -137,7 +137,7 @@ if ($action === 'pull') {
     // Create host conf from template if it doesn't exist
     $confFile = $hostIdLow . '.conf';
     if (!file_exists(CONF_DIR . '/' . $confFile)) {
-        $template = @file_get_contents(CONF_DIR . '/host.conf.template') ?: '';
+        $template = @file_get_contents(DEPLOY_DIR . '/host.conf.template') ?: '';
         if ($template) {
             $bootPart2  = trim(shell_exec('findmnt -n -o SOURCE /boot 2>/dev/null') ?: '');
             $bootDisk2  = $bootPart2 ? trim(shell_exec('lsblk -no pkname ' . escapeshellarg($bootPart2) . ' 2>/dev/null') ?: '') : '';
@@ -229,7 +229,7 @@ if ($smParam === 'flash') {
 }
 
 if (!file_exists(CONF_DIR . '/' . $confFile)) {
-    $template = @file_get_contents(CONF_DIR . '/host.conf.template') ?: '';
+    $template = @file_get_contents(DEPLOY_DIR . '/host.conf.template') ?: '';
     if ($template) {
         $sshOwner   = strtolower(preg_replace('/^unraid-/i', '', $myHostname));
         $sshKeyPath = '/root/.ssh/' . $sshOwner . '_rsync_automation';
diff --git a/Plugin/unraid/include/config.php b/Plugin/unraid/include/config.php
index 4eee967..493db3b 100644
--- a/Plugin/unraid/include/config.php
+++ b/Plugin/unraid/include/config.php
@@ -7,6 +7,7 @@ define('PLUGIN_CFG',  '/boot/config/plugins/varaverk/varaverk.cfg');
 $_vv_cfg = @parse_ini_file(PLUGIN_CFG) ?: [];
 define('SCRIPTS_DIR', $_vv_cfg['SCRIPTS_DIR'] ?? '/boot/config/plugins/varaverk');
 define('CONF_DIR',    SCRIPTS_DIR . '/Configurations');
+define('DEPLOY_DIR',  SCRIPTS_DIR . '/Deployment');
 define('DATA_DIR',    SCRIPTS_DIR . '/data');
 define('STATE_DIR',   SCRIPTS_DIR . '/State_Files');
 define('LOG_DIR',     '/var/log/varaverk');
diff --git a/Plugin/unraid/pages/setup.php b/Plugin/unraid/pages/setup.php
index fd691cc..8a46c75 100644
--- a/Plugin/unraid/pages/setup.php
+++ b/Plugin/unraid/pages/setup.php
@@ -275,7 +275,7 @@ function vvRunPopulate() {
         : '✓ Auto-populate ran — arr keys will fill once services are running';
       el.style.color = '#4a8';
     } else {
-      el.textContent = 'Auto-populate skipped — run Tools/conf_populate.sh once your arr containers are up';
+      el.textContent = 'Auto-populate skipped — run Deployment/conf_populate.sh once your arr containers are up';
       el.style.color = '#555';
     }
     vvLoadChecklist();
diff --git a/Plugin/varaverk.plg b/Plugin/varaverk.plg
index 0e506c3..0db8c0a 100644
--- a/Plugin/varaverk.plg
+++ b/Plugin/varaverk.plg
@@ -90,6 +90,7 @@ log() { echo "[$(date '+%H:%M:%S')] $*" | tee -a "$LOG"; }
 # Scripts live in the plugin dir on flash — no array needed.
 SCRIPTS_DIR="$CFG_DIR"
 CONF_DIR="$SCRIPTS_DIR/Configurations"
+DEPLOY_DIR="$SCRIPTS_DIR/Deployment"
 
 # ── Boot device check ─────────────────────────────────────────────────────────
 # Warn if /boot is on a USB/removable device. Varaverk is designed for internal
@@ -195,8 +196,8 @@ fi
 
 # Seed master.conf from template if absent.
 mkdir -p "$CONF_DIR"
-if [[ ! -f "$CONF_DIR/master.conf" && -f "$CONF_DIR/master.conf.template" ]]; then
-    cp "$CONF_DIR/master.conf.template" "$CONF_DIR/master.conf"
+if [[ ! -f "$CONF_DIR/master.conf" && -f "$DEPLOY_DIR/master.conf.template" ]]; then
+    cp "$DEPLOY_DIR/master.conf.template" "$CONF_DIR/master.conf"
     log "seeded master.conf from template"
 fi
 log "install step complete"
diff --git a/git_pull_execute.sh b/git_pull_execute.sh
index 8c99c3f..a03f68d 100755
--- a/git_pull_execute.sh
+++ b/git_pull_execute.sh
@@ -282,6 +282,7 @@ echo "━━━ $ICON_GEAR Conf Upgrade ━━━"
 
 UPGRADE_SCRIPT="$TARGET_DIR/Deployment/conf_upgrade.sh"
 CONF_DIR="$TARGET_DIR/Configurations"
+DEPLOY_DIR="$TARGET_DIR/Deployment"
 
 if [[ ! -f "$UPGRADE_SCRIPT" ]]; then
     log "conf_upgrade.sh not found — skipping (pre-deployment-folder repo)"
@@ -291,9 +292,9 @@ elif [[ "$SYNC_SUCCESS" == true ]]; then
     _DRY=""
 
     # master.conf
-    if [[ -f "$CONF_DIR/master.conf.template" && -f "$CONF_DIR/master.conf" ]]; then
+    if [[ -f "$DEPLOY_DIR/master.conf.template" && -f "$CONF_DIR/master.conf" ]]; then
         bash "$UPGRADE_SCRIPT" \
-            --template "$CONF_DIR/master.conf.template" \
+            --template "$DEPLOY_DIR/master.conf.template" \
             --target   "$CONF_DIR/master.conf" \
             --backup   $_DRY
     else
@@ -302,11 +303,11 @@ elif [[ "$SYNC_SUCCESS" == true ]]; then
 
     # This server's host conf only — sparse checkout ensures we have it
     HOST_CONF="$CONF_DIR/${MY_ID,,}.conf"
-    if [[ -f "$CONF_DIR/host.conf.template" && -f "$HOST_CONF" ]]; then
+    if [[ -f "$DEPLOY_DIR/host.conf.template" && -f "$HOST_CONF" ]]; then
         # Template uses HOSTN_ as generic prefix. Substitute MY_ID before merging
         # so keys match the target (HOST1_* or HOST2_*) and real values are preserved.
         TMPL_RESOLVED=$(mktemp)
-        sed "s/HOSTN_/${MY_ID}_/g; s/REMOTE_ID/${REMOTE_ID}/g" "$CONF_DIR/host.conf.template" > "$TMPL_RESOLVED"
+        sed "s/HOSTN_/${MY_ID}_/g; s/REMOTE_ID/${REMOTE_ID}/g" "$DEPLOY_DIR/host.conf.template" > "$TMPL_RESOLVED"
         bash "$UPGRADE_SCRIPT" \
             --template "$TMPL_RESOLVED" \
             --target   "$HOST_CONF" \