fix(just): remove rebase-helper and ublue-rollback-helper

.github/workflows/unit-tests.yml

@@ -42,8 +42,7 @@ jobs:
           shellcheck \
             system_files/shared/usr/bin/ublue-system-setup \
             system_files/shared/usr/bin/ublue-user-setup \
-            system_files/shared/usr/lib/ublue/setup-services/libsetup.sh \
-            system_files/bluefin/usr/bin/ublue-rollback-helper
+            system_files/shared/usr/lib/ublue/setup-services/libsetup.sh
 
       - name: Run pytest (hooks.py)
         run: python3 -m pytest tests/test_hooks.py -v

.github/workflows/validate.yml

@@ -58,14 +58,6 @@ jobs:
         shell: bash
         run: just check
 
-      - name: Install shellcheck
-        shell: bash
-        run: sudo apt-get update -y && sudo apt-get install -y shellcheck
-
-      - name: Shellcheck helper scripts
-        shell: bash
-        run: shellcheck -e SC2207 system_files/bluefin/usr/bin/ublue-rollback-helper
-
       - name: Guard against ublue-os→projectbluefin image ref regressions
         shell: bash
         run: |
@@ -95,7 +87,6 @@ jobs:
               if path.name != "validate.yml"
           ]
           candidates += list(Path(".github/workflows").rglob("*.yaml"))
-          candidates.append(Path("system_files/bluefin/usr/bin/ublue-rollback-helper"))
 
           violations = []
           for path in candidates:

docs/SKILL.md

@@ -27,7 +27,6 @@ Agent entry point for `projectbluefin/common`. Load only the skill(s) that match
 | Change a GNOME setting or dconf key | `docs/skills/dconf-consistency.md` |
 | Understand what files are editable here vs submodule | `docs/skills/submodule-boundary.md` |
 | Touch any image reference or registry path | `docs/skills/image-registry.md` |
-| Work on `ublue-rollback-helper` | `docs/skills/rollback-helper.md` |
 | Modify the Containerfile or add a new binary | `docs/skills/containerfile.md` |
 | **Build, CI, and release (this repo)** | |
 | Change `.github/workflows/` | `docs/skills/ci-tooling.md` + `docs/skills/workflow-map.md` |

docs/skills/INDEX.md

@@ -43,7 +43,6 @@ Agent-specific instruction files (`.github/copilot-instructions.md`, `AGENTS.md`
 | [submodule-boundary.md](submodule-boundary.md) | What is/isn't editable in this repo — `system_files/shared/` is directly tracked here (edit freely), `system_files/bluefin/` is Bluefin-specific |
 | [dconf-consistency.md](dconf-consistency.md) | GSettings override ↔ dconf lock file parity rules — must edit both files together for locked settings |
 | [image-registry.md](image-registry.md) | projectbluefin OCI image registry — all production images at `ghcr.io/projectbluefin/` |
-| [rollback-helper.md](rollback-helper.md) | `ublue-rollback-helper` TUI state machine — three-way coordinated arrays, LTS/non-LTS branches, registry path derivation, testing guidance |
 | [devmode.md](devmode.md) | `ujust devmode` setup wizard — what it installs, UX flow, tap strategy, group logic, legacy -dx advisory, known caveats |
 | [containerfile.md](containerfile.md) | Containerfile build structure — multi-stage build, wallpaper source caveat, ujust completion generation, SHA verification pattern, `just overlay` local testing |
 | [skill-drift.md](skill-drift.md) | How the skill-drift CI check works — path mapping, what counts as a satisfying update, waiver process |

docs/skills/acmm-audit-level2.md

@@ -98,7 +98,7 @@ Production images: `ghcr.io/projectbluefin/bluefin*` (NOT `projectbluefin`)
 CI/testing images: `ghcr.io/projectbluefin/bluefin:testing`
 
 All image refs are now `ghcr.io/projectbluefin/` — the org migration is complete.
-This breaks e2e workflows, rollback-helper, and production paths.
+This breaks e2e workflows and production paths.
 
 **Constraint:** Load `image-registry.md` before touching ANY image reference.
 

docs/skills/ci-tooling.md

@@ -149,3 +149,28 @@ If you add new OCI image pins to `Containerfile`, also update `.github/renovate.
 | `bonedigger` | `projectbluefin/bonedigger` GitHub releases | `BONEDIGGER_VERSION` in `system_files/bluefin/usr/share/ublue-os/just/60-bonedigger.just` |
 
 When adding a new binary pinned to a specific version in a script or just file, add a corresponding regex manager entry in `renovate.json5` so the version stays current automatically.
+
+---
+
+## Removing a shell script from common — 4 mandatory touch-points
+
+When deleting `system_files/bluefin/usr/bin/<script>`, check all four:
+
+| File | What to remove |
+|---|---|
+| `.github/workflows/unit-tests.yml` | The script path from the shellcheck `run:` block |
+| `.github/workflows/validate.yml` | The `shellcheck` step that invokes it (if script-specific) **and** any `candidates.append(Path("..."))` entry in the Python OCI-ref guard |
+| `system_files/bluefin/usr/share/ublue-os/just/system.just` | The `just` target and all aliases |
+| `docs/skills/` | The script's skill file (if it has one) + its `INDEX.md` row + `SKILL.md` routing row + all cross-references |
+
+### Dead apt step hazard
+
+If the `validate.yml` shellcheck step was the **only** consumer of `Install shellcheck` in that job, delete the apt install step too — it becomes a silent no-op that wastes ~20 seconds per CI run and confuses future readers.
+
+### Cross-reference sweep
+
+After deleting the script and its skill file, run:
+```bash
+grep -rn "<script-name>" docs/ specs/ --include="*.md" --include="*.json"
+```
+Common survivors: `devmode.md` advisories, `image-registry.md` section headers, `acmm-audit-level2.md` risk statements, `specs/` JSON chunks.

docs/skills/devmode.md

@@ -85,7 +85,7 @@ Groups are added via `pkexec` at the end, conditional on what was selected:
 ## Legacy -dx image users
 
 If `IMAGE_NAME` ends in `dx`, the wizard shows an advisory:
-> "Legacy -dx image detected. After setup, run 'ujust rebase-helper' to switch to the standard image."
+> "Legacy -dx image detected. After setup, run 'bootc switch ghcr.io/projectbluefin/bluefin:stable' to switch to the standard image."
 
 The wizard still runs normally — it does NOT rebase automatically.
 

docs/skills/hive-review.md

@@ -231,3 +231,44 @@ Read [skill-drift documentation](./SKILL_DRIFT_CI.md) for how to handle CI failu
 - [label-workflow](./label-workflow.md) — Lifecycle state machine and slash commands
 - [queue-dashboard](./queue-dashboard.md) — Repository-wide queue view
 - [REGRESSION_CONTRACT](../qa/REGRESSION_CONTRACT.md) — Feature parity across streams
+
+---
+
+## Executing hive advisory batches (2026-06-10 session learnings)
+
+When executing a large hive advisory fleet (many repos, many PRs), these patterns prevent wasted retries:
+
+### GitHub API parallel commit conflicts
+
+Committing multiple files to the same branch in parallel calls causes HTTP 409 — the first commit advances the branch HEAD and the second call has a stale SHA.
+
+**Pattern:** Commit serially. Re-fetch SHA before each update:
+```bash
+SHA=$(gh api "repos/OWNER/REPO/contents/PATH?ref=BRANCH" --jq '.sha')
+# ... make changes ...
+gh api "repos/OWNER/REPO/contents/PATH" -X PUT -f sha="$SHA" ...
+# Then re-fetch SHA for the next file
+SHA2=$(gh api "repos/OWNER/REPO/contents/OTHER?ref=BRANCH" --jq '.sha')
+```
+
+### Pass file content via temp file, not heredoc env vars
+
+Python `os.environ['VAR']` inside a bash heredoc with `VAR=$(...)` fails — the var isn't exported. Write content to `/tmp/file.txt` and read with `open('/tmp/file.txt').read()`.
+
+### Repo-specific branch targets
+
+| Repo | PR target | Notes |
+|---|---|---|
+| `projectbluefin/bluefin` | `testing` | Never `main` |
+| `projectbluefin/bluefin-lts` | `main` | actions AGENTS.md previously said `testing` — now fixed |
+| `projectbluefin/bootc-installer` | `dev` | Default branch is `dev`, not `main` |
+| `projectbluefin/testsuite` | `main` | Merge queue enforced — doc changes still need CI green |
+| All others | `main` | Standard |
+
+### push_files vs create_or_update_file
+
+`push_files` batches multiple files in one commit but can fail with cryptic "Required url" errors for certain input shapes. Use `create_or_update_file` for single files as the reliable fallback.
+
+### Advisory digest is truncated
+
+The hive advisory comment in `common#557` is truncated at 65KB. The full digest is ~315KB. When analyzing: there is a second half with more quality-agent findings that the CI-maintainer section doesn't repeat. Always request the full comment body via `gh issue view --comments` and check for the truncation warning at the bottom.

docs/skills/image-registry.md

@@ -39,7 +39,7 @@ Bluefin publishes two flavors, built from the same Containerfile with different
 
 > Historical note: the image was erroneously named `bluefin-nvidia-open` prior to 2026-06-07. The rename was applied in bluefin PR #434.
 
-## How rollback-helper derives the registry path
+## How runtime tools derive the registry path
 
 ```bash
 IMAGE_VENDOR="$(jq -r '."image-vendor"' < /usr/share/ublue-os/image-info.json)"

specs/00-bluespeed-specification.md

@@ -838,7 +838,7 @@ Semantic search across the full knowledge base. Use for conceptual, explanatory,
 {
   "results": [
     {
-      "chunk_text": "## Switching Streams\n\nUse `ujust rebase-helper` for interactive stream selection, or employ manual commands:\n\n```\nsudo bootc switch ghcr.io/ublue-os/bluefin:stable --enforce-container-sigpolicy\n```",
+      "chunk_text": "## Switching Streams\n\nUse `bootc switch` to change streams:\n\n```\nsudo bootc switch ghcr.io/ublue-os/bluefin:stable --enforce-container-sigpolicy\n```",
       "source_name": "bluefin-docs",
       "source_url": "https://docs.projectbluefin.io/administration#switching-streams",
       "section": "Update Streams — Switching Streams",

system_files/bluefin/usr/share/ublue-os/just/system.just

@@ -155,15 +155,6 @@ bluefin-apps:
     echo "Installing default system flatpaks..."
     @ujust install-system-flatpaks
 
-alias switch-stream := rebase-helper
-alias switch-streams := rebase-helper
-alias rollback-helper := rebase-helper
-
-# Rebase assistant
-[group('System')]
-rebase-helper:
-    @/usr/bin/ublue-rollback-helper
-
 # Check Secure Boot status and key enrollment
 [group('System')]
 check-sb-key: