diff --git a/package.json b/package.json
index 829662e4..26607350 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "format": "{ git diff --name-only HEAD -- 'src/**/*.ts' 'src/**/*.tsx'; git ls-files --others --exclude-standard -- 'src/**/*.ts' 'src/**/*.tsx'; } | xargs -r prettier --write",
     "format:all": "prettier --write \"src/**/*.{ts,tsx}\"",
     "format:check": "prettier --check \"src/**/*.{ts,tsx}\"",
-    "setup": "bash scripts/setup/setup.sh"
+    "setup": "bash scripts/setup/officer-setup.sh"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.41",
diff --git a/scripts/setup/officer-set-display.sh b/scripts/setup-old/officer-set-display.sh
similarity index 100%
rename from scripts/setup/officer-set-display.sh
rename to scripts/setup-old/officer-set-display.sh
diff --git a/scripts/setup/setup-desktop.sh b/scripts/setup-old/setup-desktop.sh
similarity index 100%
rename from scripts/setup/setup-desktop.sh
rename to scripts/setup-old/setup-desktop.sh
diff --git a/scripts/setup/setup-dockers.sh b/scripts/setup-old/setup-dockers.sh
similarity index 100%
rename from scripts/setup/setup-dockers.sh
rename to scripts/setup-old/setup-dockers.sh
diff --git a/scripts/setup/setup-sidecars.sh b/scripts/setup-old/setup-sidecars.sh
similarity index 100%
rename from scripts/setup/setup-sidecars.sh
rename to scripts/setup-old/setup-sidecars.sh
diff --git a/scripts/setup/setup.sh b/scripts/setup-old/setup.sh
similarity index 100%
rename from scripts/setup/setup.sh
rename to scripts/setup-old/setup.sh
diff --git a/scripts/setup/setup_mac_light.sh b/scripts/setup-old/setup_mac_light.sh
similarity index 100%
rename from scripts/setup/setup_mac_light.sh
rename to scripts/setup-old/setup_mac_light.sh
diff --git a/scripts/setup/machine-setup/.tmux.conf b/scripts/setup/machine-setup/.tmux.conf
new file mode 100644
index 00000000..ccf66cbe
--- /dev/null
+++ b/scripts/setup/machine-setup/.tmux.conf
@@ -0,0 +1,100 @@
+########## TPM AUTO-INSTALL + SESSION PERSISTENCE ##########
+
+# Auto-install TPM if missing
+if-shell '[ ! -d ~/.tmux/plugins/tpm ]' \
+  'run-shell "git clone https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm"'
+
+# Plugin list
+set -g @plugin 'tmux-plugins/tpm'
+
+# remap prefix from 'C-b' to 'C-a'
+unbind C-b
+set-option -g prefix C-a
+bind-key C-a send-prefix
+
+set -g base-index 1
+
+# split panes using | and -
+unbind '"'
+unbind %
+bind | split-window -h
+bind - split-window -v
+
+# reload config file (change file location to your the tmux.conf you want to use)
+unbind r
+bind r source-file ~/.tmux.conf \; display-message "Config reloaded!" \; refresh-client -S
+
+# switch panes using Alt-arrow without prefix
+bind -n M-Left select-pane -L
+bind -n M-Right select-pane -R
+bind -n M-Up select-pane -U
+bind -n M-Down select-pane -D
+# switch panes using Alt-HJKL without prefix
+bind -n M-h select-pane -L
+bind -n M-l select-pane -R
+bind -n M-k select-pane -U
+bind -n M-j select-pane -D
+
+# Enable mouse control (clickable windows, panes, resizable panes)
+
+# don't rename windows automatically
+set-option -g allow-rename off
+
+######################
+### DESIGN CHANGES ###
+######################
+
+# loud or quiet?
+set -g visual-activity off
+set -g visual-bell off
+set -g visual-silence off
+setw -g monitor-activity off
+set -g bell-action none
+
+#  modes
+setw -g clock-mode-colour colour12
+setw -g mode-style 'fg=colour1 bg=colour18 bold'
+
+# panes
+set -g pane-border-style 'fg=colour19 bg=colour0'
+set -g pane-active-border-style 'bg=colour0 fg=colour9'
+
+# statusbar
+set -g status-position bottom
+set -g status-justify left
+set -g status-style 'bg=colour2 fg=colour23'
+# set -g status-left '#[fg=white,bg=black,bold] pastilhas #[default]'
+set -g status-left '#[fg=#ffffff,bg=#000000,bold] #{USER}@#H     #[default]'
+# set -g status-left-length 20
+set -g status-right '#[fg=#ffffff,bg=colour1] %d/%m #[fg=#ffffff,bg=colour8] %H:%M:%S '
+set -g status-right-length 50
+set -g status-left-length 20
+
+setw -g window-status-current-style 'fg=colour1 bg=colour19 bold'
+setw -g window-status-current-format ' #I#[fg=colour249]:#[fg=colour255]#W#[fg=colour249]#F '
+
+setw -g window-status-style 'fg=colour9 bg=colour18'
+setw -g window-status-format ' #I#[fg=colour237]:#[fg=colour250]#W#[fg=colour244]#F '
+
+setw -g window-status-bell-style 'fg=colour255 bg=colour1 bold'
+# ...existing code...
+# messages
+set -g message-style 'fg=#ffffff bg=red bold'
+# Change the font color for the exit pane confirmation message
+set -g message-command-style 'fg=#ffffff bg=red bold'
+
+# ...existing code...
+
+# messages
+# set -g message-style 'fg=colour232 bg=colour16 bold'
+
+##########################
+### END DESIGN CHANGES ###
+##########################
+
+##########################
+### EASY MOUSE SCROLL  ###
+##########################
+
+set -g mouse on
+set -ga terminal-overrides ',*256color*:smcup@:rmcup@'
diff --git a/scripts/setup/machine-setup/ufw-docker-rules.conf b/scripts/setup/machine-setup/ufw-docker-rules.conf
new file mode 100644
index 00000000..a82ab97f
--- /dev/null
+++ b/scripts/setup/machine-setup/ufw-docker-rules.conf
@@ -0,0 +1,33 @@
+# UFW Docker compatibility rules
+# Append these to /etc/ufw/after.rules (after the existing COMMIT)
+# Blocks all external access to Docker-published ports except:
+#   - Trusted IPs (add your own)
+#   - Explicitly allowed public ports (80, 443)
+#   - Docker internal and loopback traffic
+
+*filter
+:DOCKER-USER - [0:0]
+
+# Allow established/related
+-A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+
+# Allow loopback
+-A DOCKER-USER -i lo -j RETURN
+
+# Allow Docker internal networks
+-A DOCKER-USER -s 172.16.0.0/12 -j RETURN
+
+# Allow trusted external sources (add more lines as needed)
+# -A DOCKER-USER -s <TRUSTED_IP> -j RETURN
+
+# Allow public ports
+-A DOCKER-USER -i eth0 -p tcp --dport 80 -j RETURN
+-A DOCKER-USER -i eth0 -p tcp --dport 443 -j RETURN
+
+# Drop everything else from external
+-A DOCKER-USER -i eth0 -j DROP
+
+# Return for non-external traffic
+-A DOCKER-USER -j RETURN
+
+COMMIT
diff --git a/scripts/setup/officer-setup.sh b/scripts/setup/officer-setup.sh
new file mode 100755
index 00000000..ecfe0ab1
--- /dev/null
+++ b/scripts/setup/officer-setup.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+set -e
+
+# =============================================================================
+# officer-setup — the platform, on a machine that is already provisioned
+#
+# The second half of the install. machine-setup/ brings a blank box up to a
+# usable machine; this puts Officer on top of it: dependencies, .env, the
+# database schema, and the pm2 process list.
+#
+# Run:  bash scripts/setup/officer-setup.sh
+# =============================================================================
+#
+# NOT WRITTEN YET. It is being rebuilt from scripts/setup-old/setup.sh, which
+# still works and is still the one to run.
+#
+# This file exists ahead of its contents so that `bun setup` points at where the
+# installer is going rather than at a path that is about to move again. It fails
+# loudly rather than sitting empty, because an empty script exits 0 and would
+# make `bun setup` report success while doing nothing at all.
+
+echo ""
+echo "  officer-setup.sh is not written yet."
+echo ""
+echo "  It is being rebuilt from scripts/setup-old/setup.sh, which still works:"
+echo ""
+echo "      bash scripts/setup-old/setup.sh                       # full install"
+echo "      OFFICER_PROFILE=light bash scripts/setup-old/setup.sh # light install"
+echo ""
+exit 1