feat: gate triage sources on a per-project :TRIAGE_SOURCES: declaration

The general triage plugins (personal Gmail, cmail, calendar, Telegram, GitHub PRs) are template-synced into every project, so the old "plugins present" probe self-activated triage everywhere. The sentry live trial caught it reaching personal inboxes from a project that isn't a triage target. Now a general plugin activates only when the project names its basename in a :TRIAGE_SOURCES: line in notes.org Workflow State. A project-specific plugin stays active by presence. The gate lives in triage-intake Phase 0, so it fixes the interactive over-pull too, and sentry's pass-3 probe reads the same signal.

Presence is capability, the declaration is activation. A project that declares nothing and owns no project plugin pulls nothing. Migration handoffs went to home and work. rulesets correctly declares nothing.

1 files changed, 8 insertions, 5 deletions

diff --git a/docs/specs/2026-07-20-triage-source-activation-spec.org b/docs/specs/2026-07-20-triage-source-activation-spec.org
index f5c339c..dce1ec1 100644
--- a/docs/specs/2026-07-20-triage-source-activation-spec.org
+++ b/docs/specs/2026-07-20-triage-source-activation-spec.org
@@ -4,10 +4,11 @@
 #+TODO: TODO | DONE
 #+TODO: DRAFT READY DOING | IMPLEMENTED SUPERSEDED CANCELLED
 
-* DRAFT triage source activation
+* IMPLEMENTED triage source activation
 :PROPERTIES:
 :ID:       af73ef0b-cd1d-46f1-9e1d-62695733a4de
 :END:
+- 2026-07-20 Mon @ 13:42:32 -0500 — READY (Craig approved after his read, both open decisions resolved via cj comments: declaration format "good. approved", interactive gate "all of them") → built and IMPLEMENTED same session. Phase 0 activation gate in triage-intake.org, sentry pass-3 probe, engine-intro documentation (the template notes.org has no Workflow State block, so the declaration is documented in triage-intake.org rather than there — deviation from the drafted Phase 3), migration handoffs to home + work, a manual-testing entry. Canonical + mirror synced.
 - 2026-07-20 Mon @ 08:43:23 -0500 — drafted during the morning sentry review. The activation model converged live with Craig off the sentry live-trial finding. DRAFT pending his deep read.
 
 * Metadata
@@ -96,11 +97,13 @@ An undeclared general source is never pulled. Opt-in is explicit; there is no "p
 CLOSED: [2026-07-20 Mon]
 The change can't guess a project's intended source set, and cross-project auto-edits violate the boundary rule.
 
-** VERIFY Declaration format — =:TRIAGE_SOURCES:= space-separated basenames in notes.org Workflow State
-Proposed. Mirrors =:COMMIT_AUTONOMY:=. Open sub-questions: does an empty-but-present marker need to differ from an absent one (e.g. "declared none, on purpose" vs "never configured")? Should a project-specific-only project carry the marker at all, or is its absence correct there?
+** DONE Declaration format — =:TRIAGE_SOURCES:= space-separated basenames in notes.org Workflow State
+CLOSED: [2026-07-20 Mon]
+Approved by Craig (2026-07-20). =:TRIAGE_SOURCES: personal-gmail cmail= in notes.org Workflow State, mirroring =:COMMIT_AUTONOMY:=. An empty-but-present marker and an absent one are treated identically — both mean "no general sources active" — so there's no need to distinguish them. A project-specific-only project carries no marker; its absence is correct, since those plugins activate by presence.
 
-** VERIFY Should interactive triage adopt the same gate, or only unattended?
-Recommended: same gate both paths (one activation layer). Craig to confirm — the alternative is gating only the sentry pass and leaving interactive as run-all-discovered, which is less clean but avoids changing a path he drives by hand.
+** DONE Interactive triage adopts the same gate as unattended
+CLOSED: [2026-07-20 Mon]
+Craig: "all of them" (2026-07-20). The activation gate lives in triage-intake Phase 0 and applies to every path — interactive and unattended alike — so running triage by hand in a project also respects its =:TRIAGE_SOURCES:= declaration. One activation layer, no per-path special-casing.
 
 * Implementation Phases