Development record

2026-07-30 — iss-169: the visibility-driven `.gitignore` block now carries the brief's §1 table verbatim — private ignores `.abcd/.work.local/` only, public ignores the anchored `/.abcd/` plus the legacy root-level `/memory/` (the leading slash pins each public entry to the repo root; an unanchored pattern matches at any depth and would also ignore nested paths such as an `internal/memory/` source package) — replacing a phantom root-level `.work/` that appeared under both visibilities. The brief was checked first and is current: the tier table directly above §1 commits `.abcd/development/` and `.abcd/work/` and gitignores the local tier, so the code alone had drifted, and the issue's hedge that the public set "needs rethinking" resolves to a path fix, not a policy question. Under public no separate `.abcd/.work.local/` entry is needed because `.abcd/` subsumes it — visibility stays one switch with no per-subdirectory exceptions. Upgrade needs no migration verb: `gitignoreBlockDrifts` compares set-wise so an old block reads as drift, and `applyVisibilityBlock` already strips every block before writing the canonical one; the test pins that shape for both visibilities. This closes an installer-versus-auditor contradiction — `three-tier-layout` asserts the local tier is gitignored, which the installer's own output guaranteed it was not.