12. Where things live

E:\Nimby\                            workspace root (Configuration → Workspace root)
  Community\                         one subfolder per repository
    @cba_ws\                         installed mod: junction, hardlinks or real files
    @ace\
    .nimby\_cba_ws.json              provenance: repository, checksum, mode, per-file origin
    .nimby\tracking.json             per-file index: origin, location, size + mtime, checksum
  shared\                            optional shared store, one folder per mod
    @cba_ws\
      addons\…

C:\Games\Nimby\                      extracted zip
  Nimby.exe                          GUI
  bin\nimby.exe                      CLI used by the GUI
  data\config.json                   portable configuration
  data\hashcache.json                hash cache (portable install)

%APPDATA%\Nimby\config.json          configuration when the app folder is read-only
%APPDATA%\Nimby\hashcache.json       hash cache in that case
%APPDATA%\Nimby\images\              cached repo.png / icon.png per repository
%TEMP%\nimby\                        scratch folder (default)

.nimby is created per repository folder. Lock files are named after the mod with everything outside letters, digits, _, . and - replaced by _, so @cba_ws becomes _cba_ws.json. The lock stores the full manifest, which is why verify and repair work for linked mods too.