docs(phase-33.5): task 12 — kit part 3: decomp-architect/SETUP.md (Step 0 contract with the write-scope guardrails; Step 1 the PA-2.0 pin, the ladder-in-constitution check, the §E precondition, Path A only, the Phase-0.5 phase file; Step 2 the interview + the answers: file contract; Step 3 the firewall with the planted-fixture negative control and the check-ignore probes; Step 4 layout; Step 5 bootstrap + the checkpoint commit; Step 6 the flywheel documents that outlive the package; Step 7 the registry seed inserted before §E′ with the renumber fallback; Step 8 the overlays by marker + config templates instead of a live settings/mcp merge + the skeletons; Step 9 the memory seed; Step 10 the leftover-placeholder audit, the sorted install manifest, PhaseEnd_Phase0.5, the close commit, the five-part final message, hard stop; install manifest; troubleshooting); class 7 of the firewall gains /.claude-state/transcripts/ (a decomp's transcripts quote the target) and the scratch block re-includes .run/README.md — wiki fence + template re-extracted (75 lines identical); pa-overlays Block 7 → config/decomp-hooks.snippet.json + config/mcp.json.template (no comment keys in JSON); PLACEHOLDERS "Filled" wording aligned with the steps; verify: kit_lint OK over 44 files, doc_links --strict rc 0, 19/19 PA installer mechanisms with counterparts, 12/12 markers present in their templates, all placeholders named, every Step reference resolves; log + checkpoint (NEXT = task 13, the dry-run, xHigh)

docs/wiki/The-ROM-firewall.md

@@ -83,7 +83,10 @@ copies are identical). Adjust the path names to your layout; do not delete a cla
 /tools/psyq/
 
 # 7. Session transcripts — they quote the target's disassembly; keep them out of any public tree
+#    (a governance system that keeps the agent's transcripts inside the repository writes them under
+#    .claude-state/transcripts/ — ignored here; the memory files beside them stay tracked)
 /session-archive/
+/.claude-state/transcripts/
 
 # 8. Training data and weights derived from the target
 /datasets/
@@ -102,6 +105,7 @@ copies are identical). Adjust the path names to your layout; do not delete a cla
 # ---- irreplaceable work. Rule of thumb: commit what a rerun CANNOT reproduce (hand analysis,      ----
 # ---- harnesses, ledgers, the recorded contract run); leave what a script regenerates ignored.    ----
 /.run/*
+!/.run/README.md
 # One dated block per exception — re-include the directory, re-exclude its contents, re-include
 # the wanted files — under a comment naming the phase, the session and the rule. For example:
 #   # P<N> <task> (<session>, <date>): the recorded contract run's per-step logs. Evidence, tracked.