The DC-005 src/ refactor left depth-2 route files (routes/auth/*, routes/recipes/*, routes/apps/*, routes/arr/*, routes/config/*) with broken require() paths. A filesystem-resolving scanner found 67 broken requires across 21 files — three distinct bug classes: A) '../../../src/...' (3 levels up, above package root) — Bug 7, ~49 occurrences B) '../src/utils/...' (1 level up, resolves to nonexistent routes/src/) — ~15 occurrences C) routes/apps/restore.js:5 used utilities/responses (wrong dir) — should be utils/responses All fixed to '../../src/...' (or '../../src/utils/responses' for class C). routes/auth/totp.js was already fixed in the DC-006 commit. Post-fix: 922/922 tests pass, zero new ESLint warnings. No logic changes — purely mechanical require() path corrections.