Development record

06-delivery/02-verification-matrix.md:48 says include and exclude are resolved from the bundler's own rules and, as staged, that the launch core reads no per-repo allow-file. internal/core/launch/includes.go:14 reads .abcd/config/launch-payload.json, and 04-surfaces/04-launch.md:508-510 calls that list the only mechanism that can put a path into the release artefact. Only the structural deny of .abcd/ is the bundler's own, and the file cannot override that.