docs: plan the worktree store, after two reviews and a planning interview

.abcd/development/brief/04-surfaces/README.md

@@ -37,7 +37,7 @@ are wiring rather than user-facing surface are listed separately under
 | 22 | `/abcd:site` | shipped | Render the project website from the repository's own text, and gate what it publishes | [`22-site.md`](22-site.md) |
 | 23 | `/abcd:reading` | shipped | Assemble what a cold reading may see, prove it, and validate what comes back | [`23-reading.md`](23-reading.md) |
 | 24 | `/abcd:decide` | shipped | Mint a decision record with its id, date and skeleton, ready to write the decision into | [`24-decide.md`](24-decide.md) |
-| 25 | `/abcd:worktree` | staged | Keep session and agent worktrees in a machine-scoped store rather than beside the checkout (design target — [itd-2609091014076309](../../intents/drafts/itd-2609091014076309-session-and-agent-worktrees-live-in-a-machine-scoped-store-t.md)) | [`../05-internals/03-configuration.md` § The worktree store](../05-internals/03-configuration.md#the-worktree-store) |
+| 25 | `/abcd:worktree` | staged | Keep session and agent worktrees in a machine-scoped store rather than beside the checkout (design target — [itd-2609091014076309](../../intents/planned/itd-2609091014076309-session-and-agent-worktrees-live-in-a-machine-scoped-store-t.md)) | [`../05-internals/03-configuration.md` § The worktree store](../05-internals/03-configuration.md#the-worktree-store) |
 | 26 | `/abcd:mode` | shipped | Say whose answer the agent loop is waiting on, so the status line and the board show it | [`08-abcd.md`](08-abcd.md) |
 | 27 | `/abcd:implement` | shipped | Share one autonomous run between two sessions: claim a record before its lane, keep the second session inside its bounds, and compare the ways of dividing the work from the run log | [`27-implement.md`](27-implement.md) |
 | 28 | `/abcd:peers` | shipped | See what the sibling worktrees and local branches hold before capturing, fixing or filing anything | [`08-abcd.md`](08-abcd.md) |

.abcd/development/brief/05-internals/03-configuration.md

@@ -365,7 +365,7 @@ apart. Three properties are load-bearing:
 
 ## The worktree store
 
-**Design target (itd-2609091014076309, `intents/drafts/`; unbuilt).** No
+**Design target (itd-2609091014076309, `intents/planned/`; unbuilt).** No
 `worktree` verb exists in the shipped binary, and nothing in it creates or reads
 this store. What follows is the layout the intent commits to, on the rule
 [adr-2609091248200336](../../decisions/adrs/2609091248200336-a-tool-never-creates-directories-in-user-owned-project-space.md)
@@ -398,6 +398,25 @@ Three properties are load-bearing, and each is the intent's to deliver:
 Worktrees already sitting beside a checkout are outside the store by definition:
 listed as such, never moved, and retired by the user's own `git worktree remove`.
 
+**One primitive owns the store and its notes archive.** One package under `ahoy`
+derives the lane from the root commit, makes every level of
+`~/.abcd/worktrees/<root-sha>/` and of the notes archive
+`~/.abcd/notes/<root-sha>/` one at a time as a real directory that is the
+caller's alone, and adds, lists and removes worktrees through git. The build
+loop's lanes are made through it, so a worktree enters the store one way. Before
+`prune` removes a worktree it moves the worktree's git-ignored
+`.abcd/.work.local/` into `~/.abcd/notes/<root-sha>/<UTC timestamp>-<name>/`
+beside a manifest, redacted on write by the transcript store's pass; nothing
+reclaims the archive.
+
+**Invariant: the store deletes only what passes its proof of belonging.** A
+directory leaves the lane only when git lists it as a worktree of this
+repository, its real path lies inside this repository's lane, and its own common
+directory is this checkout's; anything else is reported and left in place, and no
+removal is forced. It is the reclaim half of
+[adr-2609091248200336](../../decisions/adrs/2609091248200336-a-tool-never-creates-directories-in-user-owned-project-space.md):
+a tool that must not create in the user's space must not delete there either.
+
 ## The two `.abcd/` scopes
 
 `.abcd/` is **one namespace pattern instantiated at two scopes**. abcd lives in

.abcd/development/brief/06-delivery/03-out-of-scope.md

@@ -109,7 +109,6 @@ gate. That is what keeps "not hand-counted" true after the day it was written.
 - `itd-2609151838327688` — an opt-in adapter to a local message broker brings push delivery and cross-machine reach to the session mailbox (sequenced after the mailbox)
 - `itd-2609151541116052` — every question an interview puts to a human shows the thing being decided before it asks, at every step (refines itd-201)
 - `itd-2609151658486398` — a release cut publishes the security advisories its fixes close, and closes those resolved as won't-fix (the publication step the 2026-08-27 advisory-handling pilot named as its target)
-- `itd-2609091014076309` — Session and agent worktrees live in a machine-scoped store (`~/.abcd/worktrees/<root-sha>/<name>/`) that abcd lists and reclaims, never beside the user's own projects (the rule is adr-2609091248200336; `builds_on` itd-118, whose worktree clause it supplies the store and the reclaim verb for)
 - `itd-2609091416304128` — `capture resolve` and `capture wontfix` refuse a record already terminal at the local `origin/main` ref as last fetched, stating the ref's age and performing no fetch; the same judgement rendered read-only on `abcd <record-id>` (split from itd-2609091034175565 on the same ruling; the third clause of iss-2609020716570699's remedy, RS001's answer moved earlier)
 - `itd-2609091034175565` — A record says who is working on it before anyone else starts: the claim verb, the session lease and the write-verb refusals, with the `claimed_by` stamp bounded by a two-release migration (promoted from iss-2609020716570699; the read-only listing and the upstream refusal were split out on 2026-09-09; not ready — carries the refusal-surface, liveness and pushed-price questions as open questions)
 - `itd-2609150819439571` — errata as a fourth terminal disposition on a durable record, appended rather than edited, so a correction is distinguishable from the error it corrects (promoted from iss-2609100505146979)

.abcd/development/decisions/adrs/2609091014087993-a-tool-never-creates-directories-in-user-owned-project-space.md

@@ -77,7 +77,7 @@ is invisible to `ls` where the user works, which is the point, and the price
 of that invisibility is a verb that lists what the store holds and a verb that
 reclaims what is spent, with a line on the status board so the user learns the
 count without asking. A store nobody can list is the same pile somewhere less
-visible. [itd-2609091014076309](../../intents/drafts/itd-2609091014076309-session-and-agent-worktrees-live-in-a-machine-scoped-store-t.md)
+visible. [itd-2609091014076309](../../intents/planned/itd-2609091014076309-session-and-agent-worktrees-live-in-a-machine-scoped-store-t.md)
 carries the worktree store, its list verb, its prune verb and the board line;
 until it ships, the rule is followed by hand and says so in the principle.
 

.abcd/development/decisions/adrs/2609091248200336-a-tool-never-creates-directories-in-user-owned-project-space.md

@@ -56,7 +56,7 @@ gives the original record and the principle as its grounds, refuses the
 sibling and in-checkout forms, and says in as many words that the store has no
 verbs: a plain `git worktree add` aimed at the path, with nothing to enumerate
 the lane or prune a spent worktree until
-[itd-2609091014076309](../../intents/drafts/itd-2609091014076309-session-and-agent-worktrees-live-in-a-machine-scoped-store-t.md)
+[itd-2609091014076309](../../intents/planned/itd-2609091014076309-session-and-agent-worktrees-live-in-a-machine-scoped-store-t.md)
 ships. That made the normative clause true. What it left is a Consequence
 bullet that reads as though the whole edit is still ahead, when its location
 half is behind and only its verb half remains, and nothing in the record says