Development record

A tool never creates directories in user-owned project space; the store's location binds now and its verbs bind when the store ships

adrsupersededadr-2609091248200336

Context

adr-2609091014087993 settled the trust rule this record carries: a tool never creates a directory in space the user did not hand it, and agent and session scratch is machine-scoped. Its occasion was twenty-one spent worktrees (1.4 GB) cleared by hand from the maintainer's project directory on 2026-09-01 (iss-2609020721142452) and twenty-two more created there by a single session on 2026-09-06, beside four projects that have nothing to do with abcd, with git worktree list naming twenty-seven; the maintainer's objection, verbatim, was "I don't want a user to be surprised that a folder is all of a sudden full of stuff". The record already had a home for machine-scoped state, ~/.abcd/, and a key for it, the repository's root-commit SHA, for the reason internal/core/history/location.go gives: a checkout moves, is renamed and is cloned twice on one machine, while its root commit does none of that. The read side of the rule was already in force — the loader refuses a configuration root the caller does not own, and only ~/.abcd/trusted-roots re-admits it — and the write side, stated once, was what the record lacked. None of that is reopened here, and the neighbouring principle durable-state-lives-where-the-platform-says-it-survives still answers a different question: where state survives, not whose space it is.

What forces a new record is that the original says two things about AGENTS.md that cannot both be read at face value (iss-2609091129426411). Among its normative clauses, in the present indicative: "AGENTS.md's concurrent-sessions convention names the store as the place a session's worktree goes, and names no sibling-directory form." Among its Consequences: "That edit lands with the intent, because a convention naming a verb that does not exist is a phantom gate." The first states as fact what the second schedules, and when the record was accepted neither was true of the file: § Concurrent sessions named no store, gave a parallel session no location at all, and treated a worktree inside the checkout as ordinary — the shape the same record rejects as its alternative 2.

The contradiction was closed from the other end on 2026-09-09 (805bb023). § Concurrent sessions names ~/.abcd/worktrees/<root-sha>/<name>/ as where a session's worktree goes, gives the original record and the principle as its grounds, refuses the sibling and in-checkout forms, and says in as many words that the store has no verbs: a plain git worktree add aimed at the path, with nothing to enumerate the lane or prune a spent worktree until itd-2609091014076309 ships. That made the normative clause true. What it left is a Consequence bullet that reads as though the whole edit is still ahead, when its location half is behind and only its verb half remains, and nothing in the record says the edit lands in two steps. An ADR is never amended, always superseded, so the split is stated here.

A second, smaller correction rides with it, because two records superseding one original would leave its superseded_by naming one of them and the other orphaned. The original commits the worktree store to creating itself "through one seam, one level at a time, never through a symlink, exactly as the transcript store does". On 2026-09-09 (24c2f2e3) the three copies of that sequence in the tree — internal/core/history's, internal/core/intent's and internal/core/lifeboat's — were consolidated into internal/fsutil.EnsureRealDir and EnsureRealDirAll, because one-canonical-primitive forbids a third copy and the branch that added the third had made three before consolidating (iss-2609091155525689). The original's sentence is now satisfied by calling that primitive, but it describes a mechanism where it could name the implementation, and that reading is exactly what would produce a fourth copy.

Decision

A tool never creates a directory in user-owned project space. The parent of a checkout, the directory the user keeps their projects in, and any directory the user did not hand over are theirs. The checkout itself is handed over only on the record's terms: .abcd/.work.local/ is scratch by declaration, .abcd/work/ and .abcd/development/ hold what the tiers say, and the repository root holds nothing a tool put there on a guess (a stray root file is already a stray_root_docs finding). Beside the checkout there is no declared tier at all, so nothing goes there.

Agent and session scratch is machine-scoped. A worktree for a parallel session, a verifier's scratch copy, an export nobody has asked for a home for: each lives under the caller's own ~/.abcd/, keyed on the repository's root-commit SHA where it belongs to a repository, on the shape the history, transcript and voyage stores already take. The store creates itself through one seam, because it needs no authority the caller does not hold, and the create-then-prove step at every level is fsutil.EnsureRealDir (internal/fsutil/fsutil.go) — a single non-following os.Mkdir at the store's own mode, then the proof that the result is a real directory rather than a symlink or a file — or EnsureRealDirAll where a chain is walked, which proves each level as it creates it. That is how the transcript store creates itself (adr-2609091248201071), and the worktree store calls the same primitive rather than carrying the sequence: the store owns its layout and its mode, and nothing else about directory creation.

What a tool puts in its own space, it can list and reclaim. Machine scope is invisible to ls where the user works, which is the point, and the price of that invisibility is a verb that lists what the store holds and a verb that reclaims what is spent, with a line on the status board so the user learns the count without asking. A store nobody can list is the same pile somewhere less visible. itd-2609091014076309 carries the worktree store, its list verb, its prune verb and the board line; until it ships, the rule is followed by hand and says so in the principle.

A directory the user made is theirs even inside the tool's own store. The list verb reports it; nothing moves or removes it. The store deletes only what it can prove it created, on the ground embark's destination gate already stands on (adr-35).

The rule binds an agent's conventions as much as the binary, and it binds them in two halves. The directories in the maintainer's project folder were created by agents following AGENTS.md, not by abcd, and the rule would be hollow if it bound only the Go. The location half binds now: AGENTS.md's concurrent-sessions convention names ~/.abcd/worktrees/<root-sha>/<name>/ as the place a session's worktree goes, names no sibling-directory form, and refuses the in-checkout form. The verb half binds when the store ships: the convention names abcd worktree add as the way a session gets its own checkout only once that verb exists, which is itd-2609091014076309's acceptance criterion and not this record's.

The split honours the original's reason rather than evading it. Its deferral rested on one sentence — a convention naming a verb that does not exist is a phantom gate — and that sentence is about a verb. A location is not a gate: a plain git worktree add reaches ~/.abcd/worktrees/<root-sha>/<name>/ today, so a convention naming it asserts nothing the reader cannot do. The principle the-users-directory-is-theirs had already taken the same split — "until it ships the rule is applied by hand" — so the convention is now consistent with the principle rather than silent beside it. What would be a phantom gate is the verb, and the verb stays owed.

Alternatives Considered

The original's four alternatives on location are carried as decided, because nothing here reopens them:

Git's default: a sibling directory, wherever the checkout is. The status quo, and the shape every agent reaches for unprompted. Rejected: it is the thing the maintainer objected to, and it gives nothing a stable place to look.
Inside the checkout, under .abcd/.work.local/worktrees/. Gitignored, per-worktree, with its owner. Rejected: a worktree inside the main working tree is walked by every tree scan — the payload gate, the name guard, docs-lint — which already flakes during worktree creation (iss-2608261331317889) and would slow every gate by a full tree per lane.
A configured location, chosen per user in config.json. Rejected: the default would still have to be something, and a default in the user's project space reintroduces the surprise for everyone who never sets it.
Chosen: a machine-scoped store under ~/.abcd/, keyed on the root commit, with list and reclaim.

On the contradiction, the three options iss-2609091129426411 put to the maintainer:

Accept the Consequence bullet as a prediction fulfilled in two steps, and record that reading in DECISIONS.md. Cheapest. Rejected: it leaves the record saying one thing and meaning another, and a reader of the ADR alone still looks for an unmade change. A reading that lives only in the log is not in the record.
Revert the AGENTS.md edit and hold both halves for the intent. Rejected: it restores the contradiction the record carried when it was accepted, and it is defensible only if naming a location without a verb is a phantom gate, which it is not — the location is reachable by hand and the principle already said so.
Chosen: supersede with a record that states the split.

On the helper clause:

Leave the sentence as a description of a mechanism and let the code comment name the primitive. Rejected: the record is what a builder reads first, and a mechanism with no named home is the reading under which three copies accumulated. The principle's point is that the canonical home is discoverable at the moment of temptation.
Chosen: name the primitive, and draw the boundary — the store owns layout and mode, internal/fsutil owns create-then-prove.

On the number of records:

Two successors for one original, one per issue. Rejected: an original's superseded_by names one record, so the second would be unlinked from the record it corrects. One successor per original is the shape the store's typed links can carry, and it is what the maintainer's ruling — a separate record for each original — asks for.

Consequences

adr-2609091014087993 is superseded and retained. AGENTS.md, the principle, the brief and two intents cite it, so it stays with both halves of the supersession in its frontmatter and its decision text as written. Every clause it decided is carried here; the two sentences that could not be read together are replaced by the split.
The worktree store is still an intent, not a fait accompli. The rule is accepted; its enforcement on the write side is itd-2609091014076309 in drafts, and the principle that carries the stance says the enforcement does not yet exist rather than implying it does.
AGENTS.md changed in 805bb023, and one criterion is still owed. The concurrent-sessions convention names the store, refuses the sibling and in-checkout forms, and says the store has no verbs. What remains is itd-2609091014076309's last acceptance criterion — that the convention "names the verb as the way a session gets its own checkout" — which lands with the intent and closes the verb half.
A store that wants this creation discipline calls internal/fsutil. A private ensureRealDir is refused by TestNoNonCanonicalAtomicWritePrimitives, whose detector names that spelling since 24c2f2e3; the worktree store, when built, calls EnsureRealDirAll from the caller's home and carries nothing of its own.
The twenty-seven sibling worktrees on the maintainer's machine are a hand cleanup, not a migration. The store never moves what it did not create, so nothing abcd ships will relocate them.
The rule reaches beyond worktrees. A verifier's scratch copy and any export whose home is unclear are covered by the same sentence; today's guidance routes them to .abcd/.work.local/scratch/, which remains right for what fits in a checkout and is joined by the machine scope for what does not.
The read side and the write side are one stance. trusted-roots refuses a root the caller does not own on the way in; this record refuses writing into space the caller was not handed on the way out. Neither cites the other yet; the principle names both.
What the harness itself creates is outside abcd's reach. A harness's own checkout-isolation feature puts its worktree wherever the harness decides; the convention can only say which route a session should take, and the intent's open questions carry whether the plugin surface should offer add as a host-run step for that reason.
No detector exists for the class of defect that occasioned this record. A normative clause asserting what a named file says can be checked only by reading the file, and no record-lint rule cross-checks a claim against the convention it names. The principle enforcement-claims-are-facts names that promotion; until it exists, the check is a reviewer's.

Status note

Accepted by the maintainer's ruling of 2026-09-09 on iss-2609091129426411 (supersede with a record that states the split) and iss-2609091155525689 (a separate record for each original), recorded in dcn-2609090000000003 and dcn-2609090000000004. It is a new record rather than an edit to adr-2609091014087993 by the standing instruction that an ADR is never amended and always superseded, so the original's decision text stands as written and this record carries both corrections.

Frontmatter

id	adr-2609091248200336
type	adr
status	superseded
date	2026-09-09

.abcd/development/decisions/adrs/2609091248200336-a-tool-never-creates-directories-in-user.md
open on GitHub ↗ · commit history ↗

References6

adr-35The lifeboat is a coverage experiment — read-only, out-of-tree, and proven before it is packed (supersedes adr-4)related
adr-2609090717039680The transcript corpus is a sibling store that creates itself, and the per-repo location is an opt-in pullrelated
adr-2609091014087993A tool never creates directories in user-owned project space; agent and session scratch is machine-scopedrelated
adr-2609091014087993A tool never creates directories in user-owned project space; agent and session scratch is machine-scopedsupersedes
itd-118Merged work leaves no residue: abcd-managed repos delete a PR branch on merge, and abcd tidies the stale local branch, tracking ref, and worktreerelated
itd-2609091014076309Session and agent worktrees live in a machine-scoped store that abcd lists and reclaims, never beside the user's own projectsrelated

Referenced by11

adr-2609091248201071The transcript corpus is a sibling store that creates itself through the canonical directory primitiverelated
adr-2610030720195401abcd keeps its own folders out of desktop indexing only by changing those folders, never the computer's search settingsrelated
adr-2610030814023326AGENTS.md is the one conventions file abcd writes; it never writes a host-specific copyrelated
adr-2610031352212697Claims are branches on the shared remote; nothing kept on one computer is the register; claim text is datarelated
adr-2610031751065746The worktree store lives under the renamed home, `~/.abcd.noindex/worktrees/<root-sha>/<name>/`, and the rest of its rule is unchangedrelated
adr-2610031751065746The worktree store lives under the renamed home, `~/.abcd.noindex/worktrees/<root-sha>/<name>/`, and the rest of its rule is unchangedsuperseded by
adr-2610032150581128abcd is reachable on a network only through the dashboard, only while the person runs it, and only for people the person lets inrelated
adr-2610050711287503abcd reaches the harness's user settings only for the status line, with consentrelated
itd-148Every change starts in its own worktree in abcd's store: the primary checkout is a read-only surface, and abcd blocks mutations there for every session but a declared coordinatorrelated
itd-2609091034175565Before an agent starts on an item, it reserves it on the shared remote, and everyone who works on the project sees the reservationrelated
itd-2610161621364075The agents abcd launches on its own work inside a sandbox the operating system enforcesrelated

mentions21

adr-2609151138420062The decisions log is a folder of minted records, not one appended file
adr-2610031751066232The transcript store is spelled under the renamed home, `~/.abcd.noindex/transcripts/<root-sha>/`, and the rest of its decision is unchanged
adr-2610110925465593Decisions are one flat file each and the single log is retired
dcn-26090900000000032026-09-09 — adr-2609091014087993 is superseded by adr-2609091248200336, which states the split its Consequences left unstated (maintainer, ruling option (b) on iss-2609091129426411 against accepting the bullet as a prediction fulfilled in two steps or reverting the `AGENTS.md` edit): the location half of the worktree rule binds now — § Concurrent sessions names `~/.abcd/worktrees/<root-sha>/<name>/` and refuses the sibling and in-checkout forms, as of `805bb023` — and the verb half binds when the store ships, because the original's deferral was about naming a VERB that does not exist, never a location plain git already reaches. The successor carries the trust rule, its five declarations and its rejected alternatives whole, and folds in the helper correction iss-2609091155525689 owed the same original, since an original's `superseded_by` names one record. The original's decision text is untouched; only its status and its forward link change.
dcn-26090900000000042026-09-09 — adr-2609090717039680 is superseded by adr-2609091248201071, one record for that original alone (maintainer, ruling on iss-2609091155525689 that each record describing the real-dir helper at its pre-consolidation home gets its own successor rather than one record covering both). The mechanism is unchanged and its home moved: `24c2f2e3` consolidated the three `ensureRealDir` copies into `fsutil.EnsureRealDir` / `EnsureRealDirAll`, so `internal/core/history` owns the store's layout and mode and calls the primitive for the create-then-prove step. Rejected: describing the mechanism and naming no symbol, which is the reading under which a fourth copy is a faithful implementation of the record.
dcn-26092900000000072026-09-29 — The product thinker answered twenty-six owed rulings and the published-history question in one interview, asked one at a time by orchestrator abcd-23 of autonomous run A (recorded by lane recRulings for orchestrator abcd-cb). The answers are kept verbatim in the local-tier file `.abcd/.work.local/scratch/reports/rulings-answered-2609-29.md`, dated 2026-09-29, and are restated here because that file is not committed. Published history is left as it is, with no rewrite. The build loop's fidelity audit runs once, on the lane that closes the spec, over the whole delivery (AI). On the vendor denylist the product thinker answered, verbatim: "I think we need an allow list rather than trying to catch a deny list." The interviewer's reading of that answer, recorded as a reading and not as the product thinker's words, is that the per-provider allowlist is the control and the vendor denylist is not extended to chase spellings, with whether the bundled `anthropic/*` entry stays as a backstop left to the technical facilitator (AA(a)). Only a route the person set up on their own machine may use their paid key, and a repository's own route to it is refused, which replaces the route half of itd-2609081951381895 decision 8 (AA(b)). The live site setup, the API adapter and the decision adapter may each close on tests against a simulated service, with the live paid check recorded as owed to a person (iss-2609291925387011, iss-2609291925393913, iss-2609291925398978). itd-111's last criterion is met by an agent's timing check on macOS plus the Linux CI run, so the intent may be finished. Automated dependency updates are switched on, pushed with a personal or app token the person creates and stores as a repository secret (itd-2609221842494980; creating the token is the person's act, and the lane builds everything else and names the secret it expects). itd-6 adds a Go MCP module, proposed for the person's explicit sign-off before it is fetched; closing itd-6 on a fake server was not ruled in this interview. (A later answer the same day, H1b in the local-tier file `.abcd/.work.local/scratch/reports/rulings-answered-2609-29-b.md`, dated 2026-09-29, rules that it is not: itd-6 is finished only after running once against the real RepoPrompt app, a check owed to a person.) For itd-148: the store under the home folder wins (adr-2609091248200336); the store draft itd-2609091014076309 owns add, list and clean-up and itd-148 uses them; a session that declares itself the coordinator is exempt from the write block in the primary checkout and every other session is blocked; and the store draft is planned first, with nothing from the store draft, the merged-worktree clean-up included, built before its planning interview (Q4). itd-148's own wait is not part of that ruling: it follows from Q2, because itd-148 uses the store's verbs, and is carried by the `blocked_by` below. itd-148 and spc-42 are rewritten to match in this change, and itd-148 is now `blocked_by` the store draft. A release retrospective is seeded from a release, the intents a tag shipped (AD); itd-24 and its spec are rewritten to the release in this change. An unpointed route is refused naming the one setting to add, as built in 35100512e, so AC11 of itd-2609170822093401 is complete (BR1). A missed target becomes `next`, whatever the following release is numbered (BS1). Spec pieces keep "step" and the lane stages are renamed, a breaking change to the JSON fields `step`, `performed` and `refusal.step` that resolves iss-2609291313276243 and corrects the glossary entry `core/step.md` (BU1), and the old command spellings are removed in that same breaking release (BT1). The text board shows Later as a count only while the site and `--json` keep the full list (BV1), and an intent in progress appears only under Now (BV2). A pause of zero is allowed (BW1); drain stays in the agents' help list until it runs end to end (BX1); a managed repository must hold the drain eligibility decision in its own record, and drain refuses there until it does (BX2); a capture without a remedy is refused (BX3), which tightens the one-line capture friction `commands/capture.md` promises, so the lane that builds it reconciles that page, the principle wording and every caller that files a capture; a run's pick reason keeps the shared `pursued:` kind with its marker (BZ1); and an intent whose blocker was superseded waits on the successor, transitively (BZ2). The five itd-48 follow-ups are planned as one intent, drafted as itd-2609291923559186 (BT2), and all warn rules share one shrink-only baseline file in which a new warning fails, drafted as itd-2609291924469783 (BT3); both drafts wait on their planning interviews. Each ruling that contradicts a shipped behaviour or another record is amended in the change that builds it, not here. itd-7's planning interview stays owed.
iss-2608261331317889TestPayloadTreeImplementationsResolveIdentically failed transiently during a pre-push preflight with 'the payload carries 109 rejected file(s)', then passed in isolation minutes later with an identical two-markdown-file diff and a clean tree. Between the two runs a peer session created .claude/worktrees/pr513-conflicts in the shared checkout, so the plausible mechanism is the payload walk sweeping a sibling worktree mid-population — the iss-213 class (a peer's activity silently invalidating a verification result), now reaching the payload scan through the preflight gate. Not reproduced deterministically; captured as a sighting so the flake has a marker if it recurs.
iss-2609020721142452Worktrees for parallel lanes are created one directory above the repository (../abcd-wt-<lane>, ../abcd-f185, ../abcd-integration), which litters the parent directory with a dozen sibling checkouts named by convention only, leaves them behind when a session dies (21 spent worktrees, 1.4G, were removed by hand on 2026-09-01), and gives nothing a stable place to look for them. Assessment of where they should go: (1) inside the repository under .abcd/.work.local/worktrees/ keeps them with their owner and gitignored, but a worktree inside the main working tree is walked by every tree scan (the payload gate, name-guard, docs-lint), which already flakes during worktree creation (iss-2608261331317889) and would slow every gate; (2) under the user-level home, ~/.abcd/worktrees/<root-sha>/<branch-slug>/, keyed the way the history store already keys a repository by its root commit, keeps them out of every scan, survives a session, and gives an abcd verb a place to list, prune and reattach them; (3) the git default (anywhere) is the status quo. Option 2 fits the existing home layout and the one-canonical-primitive rule (the root-sha keying exists), and it makes the concurrent-sessions convention in AGENTS.md checkable: a session lists its peers' worktrees by reading one directory. It needs: a verb or documented one-liner (abcd worktree add <lane> / list / prune), the AGENTS.md convention updated, the lane brief updated, and a prune rule for worktrees whose branch is merged.
iss-2609091129426411adr-2609091014087993 says two things about `AGENTS.md` that cannot both be read at face value. Among its normative clauses, in the present indicative: "`AGENTS.md`'s concurrent-sessions convention names the store as the place a session's worktree goes, and names no sibling-directory form." Among its Consequences: "The concurrent-sessions convention gains the store as the place a worktree goes, and loses any wording that reads as a sibling directory. That edit lands with the intent, because a convention naming a verb that does not exist is a phantom gate." The first states as fact what the second schedules, and when the ADR was accepted neither was true of the file: § Concurrent sessions was byte-unchanged, named no store, and treated creating a worktree inside the checkout as ordinary — the shape the ADR rejects as its alternative 2.
iss-2609091155525689Two accepted decision records describe the directory primitive as it stood before the consolidation, and this repository supersedes rather than amends, so each owes a correction rather than an edit. adr-2609090717039680 (the transcript corpus is a sibling store that creates itself) names ensureRealDir as a helper of internal/core/history and presents its behaviour — walks the chain top-down, os.Mkdir per level rather than MkdirAll, re-verifies every level on every resolve — as a property of that package. Every one of those behaviours still holds, and the symbol does not: it is fsutil.EnsureRealDir, called in a loop, and the package that used to own the sequence now owns only the layout. A reader following the ADR to the code finds nothing at the name it gives. adr-2609091014087993 (a tool never creates directories in user-owned project space) commits a future machine-scoped worktree store to creating itself one level at a time, never through a symlink, exactly as the transcript store does. That sentence is now satisfied by calling the canonical primitive, and it was the reading of it that would have produced a fourth copy: it describes a mechanism where it could name the thing that implements it. What is owed is one correction record covering both — the mechanism is unchanged, the home moved, and a store that wants this behaviour calls internal/fsutil rather than reproducing it. Detector: an ADR that names a package-local symbol should not survive that symbol's removal, which no gate currently checks; the record-lint rule family has no cross-reference from decision prose to Go identifiers.
iss-2609110944498549**Maintainer ruling, 2026-09-11: `ahoy install` must not write abcd by name into
iss-2609240227595724itd-33 (draft, written 2026-07-06) runs against three later rulings, which its planning interview has to settle. (1) adr-2609091248200336 (2026-09-09): agent and session state is machine-scoped under ~/.abcd/ keyed on the root commit, and the checkout holds only its declared tiers; itd-33 puts per-machine live state and locks (active-work.json, *.lock) in a new .abcd/coordination/ directory inside the checkout, which is no declared tier, beside a committed audit/ log. The shipped claim of itd-2609221656373558 already keeps its run store outside the repository. (2) The basics-plus-adapter principle (principles/basics-built-in-adapters-bring-power.md, 2026-09-15): every capability ships a basic form and offers an opt-in adapter for the full form; itd-33 is always on with no opt-out and rules out any external route, so it offers no adapter. This one is a tension in spirit: the principle's letter does not forbid an always-on basic. (3) itd-2609221656361680 Decision 4, identity in the inbox and a fingerprint in the record: anything committed carries the root-commit key and a generic description; itd-33's committed audit log names the person from git config on every agent_registered event and in resolved_by_human. Decision 4's letter governs the managed-repository reports; applying it here is by extension. The register ruling (itd-2609150819440345 Decision 1, the register is where claims live) overlaps its claim model too. Distinct from iss-2608230943533581, which asks for the coordination SOTA sweep.
iss-2610040732240935Record pages scroll sideways at 360 px whenever a record's title or source path holds a long unbroken token, and the overflow audit cannot see it. Every ADR minted with a timestamp id shows its source path, .abcd/development/decisions/adrs/<16 digits>-<slug>.md, as one mono span in the side panel's reclinks paragraph, and the run up to the first hyphen is about fifty characters with no break opportunity: /record/adr/adr-2609091248200336/ measures scrollWidth 374 at 360 px. adr-2610031751065746 and adr-2610031751066232 also carry a home-relative path in their titles, which overflows the record page's h1 (scrollWidth 455). The stylesheet sets no overflow-wrap on body, the title or reclinks, so a block whose text has nowhere to break widens the page. The site-screenshots audit samples only the lowest-numbered record of each type (adr-1, itd-1, iss-1), whose paths and titles are short, so these pages have overflowed since timestamp ADRs began without the job noticing.
itd-2610030720038073abcd keeps its home folder out of desktop indexing by default
itd-2610030814013772abcd's projects keep one conventions file, AGENTS.md, and Claude Code reads it directly
itd-2611011151475128Every documentation surface is rendered from its one home
spc-42every-change-starts-in-its-own-worktree-the-primary-checkout
spc-2609301811532881The worktree store: `abcd ahoy worktree add|list|prune`, one lane primitive, and a notes archive beside it
spc-2610031309233367abcd-keeps-its-home-folder-out-of-desktop-search-by-default
spc-2610110931381316append-only-logs-conflict-on-every-merge
the-users-directory-is-theirsThe user's directory is theirs