- appset: goTemplate, filename-based app names, .path.path IS the directory, exclude apps/root from the glob (v3.5 git files-generator schema) - remove empty Secret stubs: with prune:true they would overwrite live secret values (openwebui, paperless, vaultwarden-admin-token, password) - secrets stay cluster-managed, not in git