feat: track working/ from creation, gitignore temp/ in both modes

working/ is the tracked home of in-progress work, version-controlled from creation rather than staged locally until it graduates. Filing on completion reorganizes durable artifacts into permanent homes. It doesn't mark when they became durable. Ephemeral, disposable artifacts go in a gitignored temp/ (or /tmp), never working/.

install-ai.sh emits a temp/ ignore in both track and gitignore modes. Ephemerality is independent of whether a project tracks its .ai/ tooling, so temp/ rides neither the track .gitkeep step nor the gitignore-only tooling block. working/ is never ignored, on purpose. sweep-gitignore-tooling.sh backfills temp/ as a separate mode-independent pass, not an IGNORE_SET member: folding it into that set would skip every track-mode project, the set that most needs it.

While implementing I confirmed the canonical machinery never ignored working/ (the tooling set is only .ai/ .claude/ CLAUDE.md AGENTS.md), so a project that ignored working/ did so as a local deviation.

Documents the convention in working-files.md and mirrors it in protocols.org. 7 new bats cover temp/ in both modes, never working/, and idempotency.

1 files changed, 12 insertions, 8 deletions

diff --git a/todo.org b/todo.org
index 5bfa77f..cf9e878 100644
--- a/todo.org
+++ b/todo.org
@@ -75,14 +75,18 @@ What we're verifying: the morning teardown reviews and merges cleanly, nothing r
 - Confirm main was never pushed to during the night and the approval queue was walked.
 Expected: the night's work is reviewable as one branch, merges by choice, and main stayed clean throughout.
 
-** VERIFY [#B] working/ tracked-from-creation + gitignored temp/ :feature:
-Craig's ruling relayed from .emacs.d (2026-07-19): working/ is version-controlled from creation (not excluded until graduation); ephemeral artifacts go in a gitignored temp/ or /tmp; graduation reorganizes durable artifacts into permanent homes rather than marking when they become durable. Parked by sentry (shared-asset + convention change with a design decision), not applied unattended.
-
-Prepared proposal + findings: [[file:working/sentry-2026-07-19-working-files-ruling/proposed.org][working/sentry-2026-07-19-working-files-ruling/proposed.org]].
-
-Two findings that shape the work: (1) the canonical install/sweep machinery already never gitignores working/ — the tooling set is only =.ai/ .claude/ CLAUDE.md AGENTS.md=, so "track working/ across projects" is already the default; .emacs.d's =/working/= ignore was a local deviation. (2) temp/ is a new pattern needing a design call — it must be gitignored in BOTH track and gitignore modes (ephemeral regardless of tooling-track choice), so it's orthogonal to the personal-tooling set. That call is Craig's; recommendation is in the proposal.
-
-Files to touch on approval: =claude-rules/working-files.md= (convention text), =scripts/install-ai.sh= + =scripts/sweep-gitignore-tooling.sh= (temp/ ignore in both modes), =.ai/protocols.org= Working-Files Convention section (one-line mirror). Not :solo: — carries the temp/-placement design decision.
+** DONE [#B] working/ tracked-from-creation + gitignored temp/ :feature:
+CLOSED: [2026-07-20 Mon]
+Craig's ruling relayed from .emacs.d (2026-07-19): working/ is version-controlled from creation (not excluded until graduation); ephemeral artifacts go in a gitignored temp/ or /tmp; graduation reorganizes durable artifacts into permanent homes rather than marking when they become durable.
+
+Implemented (Shape A) during the morning sentry review, 2026-07-20:
+- =claude-rules/working-files.md=: added "working/ Is Version-Controlled From Creation" section (tracked-from-creation, graduation-is-a-move, temp/ for ephemeral).
+- =.ai/protocols.org= (canonical + mirror): one-paragraph mirror in the Working-Files Convention section.
+- =scripts/install-ai.sh=: emits a =temp/= ignore block in BOTH track and gitignore modes; working/ never ignored. Idempotent.
+- =scripts/sweep-gitignore-tooling.sh=: separate mode-independent temp/ backfill pass (a distinct loop, not an IGNORE_SET member — that would skip track-mode projects, the set that most needs it).
+- Tests: 3 new install-ai bats + 4 new sweep bats (temp/ in both modes, never working/, idempotent). Suite green, 384 bats ok.
+
+Finding confirmed at implementation: the canonical machinery already never ignored working/ (tooling set is only =.ai/ .claude/ CLAUDE.md AGENTS.md=), so .emacs.d's =/working/= ignore was a purely local deviation. The staged proposal at =working/sentry-2026-07-19-working-files-ruling/= is now spent — a filing/cleanup candidate.
 
 ** TODO [#C] Polyglot projects — supported, or refused? :spec:
 SCHEDULED: <2026-07-20 Mon>