@@ -11,7 +11,7 @@ Run through this before creating or editing any file under `test/`:
 
 1. **Helpers first:** Check `test/db_test_helpers.py` for existing factories (`make_db`, `make_device_dict`, `insert_device_from_dict`, `DummyDB`). Use them. If what you need doesn't exist, add it there — never define it locally in the test file.
 2. **MAC literals must be lowercase:** Every MAC string in fixtures, parametrize, assertions, docstrings, and comments must be lowercase hex (e.g. `aa:bb:cc:dd:ee:01`). No exceptions.
-3. **Test file location:** Place tests under a subdirectory of `test/` that mirrors the source path (e.g. `test/scan/` for `server/scan/`). Never put test files directly in `test/`.
+3. **Test file location:** Place *new* tests under a subdirectory of `test/` that mirrors the source path (e.g. `test/scan/` for `server/scan/`). Don't add new files directly in `test/` root - a handful of existing ones there (e.g. `test_plugin_helper.py`, `test_wol_validation.py`) predate this convention; that's not license to add more, but don't migrate them unprompted either.
 4. **No inline imports:** All imports at the top of the file.
 
 ## Before Acting on Any PR Comment
 
@@ -11,7 +11,7 @@ Run through this before creating or editing any file under `test/`:
 
 1. **Helpers first:** Check `test/db_test_helpers.py` for existing factories (`make_db`, `make_device_dict`, `insert_device_from_dict`, `DummyDB`). Use them. If what you need doesn't exist, add it there — never define it locally in the test file.
 2. **MAC literals must be lowercase:** Every MAC string in fixtures, parametrize, assertions, docstrings, and comments must be lowercase hex (e.g. `aa:bb:cc:dd:ee:01`). No exceptions.
-3. **Test file location:** Place tests under a subdirectory of `test/` that mirrors the source path (e.g. `test/scan/` for `server/scan/`). Never put test files directly in `test/`.
+3. **Test file location:** Place *new* tests under a subdirectory of `test/` that mirrors the source path (e.g. `test/scan/` for `server/scan/`). Don't add new files directly in `test/` root - a handful of existing ones there (e.g. `test_plugin_helper.py`, `test_wol_validation.py`) predate this convention; that's not license to add more, but don't migrate them unprompted either.
 4. **No inline imports:** All imports at the top of the file.
 
 ## Before Acting on Any PR Comment
 
@@ -5,7 +5,7 @@ description: Reprovision and reset the devcontainer environment. Use this when a
 
 # Devcontainer Setup
 
-The setup script forcefully resets all runtime state. It is idempotent—every run wipes and recreates all relevant folders, symlinks, and files.
+The setup script forcefully resets all *runtime* state (services, tmpfs ramdisks, symlinks, log files) unconditionally on every run. Persistent DB/config content under `/data` is the one exception - it's preserved by default; see step 7 below.
 
 ## Command
 
@@ -29,8 +29,8 @@ The setup script forcefully resets all runtime state. It is idempotent—every r
 - After modifying setup scripts
 - After container rebuild
 - When environment is in broken state
-- After database reset
+- To pick up a database/config reset done another way (setup.sh itself won't reset them - see step 7)
 
 ## Philosophy
 
-No conditional logic. Everything is recreated unconditionally. If something doesn't work, run setup again.
+Runtime state (services, tmpfs, symlinks, logs) has no conditional logic - everything is recreated unconditionally, every run. DB/config are the one deliberate exception, gated behind `ALWAYS_FRESH_INSTALL`. If something in runtime state doesn't work, run setup again.
@@ -11,7 +11,7 @@ Run through this before creating or editing any file under `test/`:
 
 1. **Helpers first:** Check `test/db_test_helpers.py` for existing factories (`make_db`, `make_device_dict`, `insert_device_from_dict`, `DummyDB`). Use them. If what you need doesn't exist, add it there — never define it locally in the test file.
 2. **MAC literals must be lowercase:** Every MAC string in fixtures, `parametrize`, assertions, docstrings, and comments must be lowercase hex (e.g. `aa:bb:cc:dd:ee:01`). No exceptions.
-3. **Test file location:** Place tests under a subdirectory of `test/` that mirrors the source path (e.g. `test/scan/` for `server/scan/`). Never put test files directly in `test/`.
+3. **Test file location:** Place *new* tests under a subdirectory of `test/` that mirrors the source path (e.g. `test/scan/` for `server/scan/`). Don't add new files directly in `test/` root - a handful of existing ones there (e.g. `test_plugin_helper.py`, `test_wol_validation.py`) predate this convention; that's not license to add more, but don't migrate them unprompted either.
 4. **No inline imports:** All imports at the top of the file.
 
 ## Before Acting on Any PR Comment
 
@@ -57,7 +57,7 @@ Three distinct roots, each with a different persistence contract — get this wr
 - `configPath` (`/data/config`) — durable, user-facing. `app.conf` lives here; config-like plugin artifacts (exports, backups) belong here too.
 - `logPath` (`/tmp/log`, plus `/tmp/api`, `/tmp/db_is_locked`, nginx state) — **ephemeral tmpfs**, wiped on every container restart. Never put anything here you need to survive a restart. (`server/plugins/adguard_export`, `unifi_import` were both fixed this way after shipping with state files rooted in `logPath` — check any plugin that opens a file outside its `RESULT_FILE` against this before assuming it's fine.)
 
-All three are exported from `server/const.py` (`dbFolderPath`, `configPath`, `dataPath`, `logPath`) and importable by any plugin.
+All three, plus `dataPath` (`/data`, the bare parent of `dbFolderPath`/`configPath` - avoid writing loose files directly under it; pick one of the two subpaths above instead), are exported from `server/const.py` and importable by any plugin.
 
 ### Plugin system (`server/plugins/*/`)