docs(policy): clarify _localsetup as framework-owned and immutable for mutable user state

_localsetup/skills/localsetup-context/SKILL.md

@@ -8,10 +8,10 @@ metadata:
 # Localsetup v2 - Framework context (skill)
 
 ## Overview
-Localsetup v2 is deployed at `_localsetup/`. Framework and context are repo-local (mobile, backup-able). Engine = _localsetup/; user data = repo-local. Use Git hashes for PRDs/specs (see [GIT_TRACEABILITY.md](../../docs/GIT_TRACEABILITY.md)).
+Localsetup v2 is deployed at `_localsetup/`. The framework is repo-local and mobile, but mutable user/project state should live in stable repo-level paths outside `_localsetup/`. Engine = _localsetup/. Use Git hashes for PRDs/specs (see [GIT_TRACEABILITY.md](../../docs/GIT_TRACEABILITY.md)).
 
 ## Invariants
-- **Engine/repo separation:** Never commit repo-local secrets or PII. Use _localsetup/lib/data_paths.sh (or equivalent) for path resolution. Framework lives at _localsetup/; upgrades replace that folder.
+- **Engine/repo separation:** Never commit repo-local secrets or PII. Use _localsetup/lib/data_paths.sh (or equivalent) for path resolution. Framework lives at _localsetup/; upgrades replace that folder. Never store mutable memory, reminders, backlog, or temporary notes under `_localsetup/`.
 - **Documentation:** _localsetup/docs/ only for framework docs. Check document status before assuming implemented.
 - **Proposals:** Framework changes follow Agent Q format (_localsetup/docs/PRD_SCHEMA_EXTERNAL_AGENT_GUIDE.md).
 - **Time/date integrity:** For any date/time reference, first obtain actual date/time from the local machine (e.g. `date` on Linux/macOS, `Get-Date` in PowerShell on Windows). Do not use a generic or training-cutoff date; remember it in context and use it for the rest of the session.

_localsetup/templates/codex/AGENTS.md

@@ -1,10 +1,10 @@
 # Localsetup v2  - Agent context (Codex)
 
 ## Overview
-Localsetup v2 is deployed into this repo at `_localsetup/`. Framework and context are repo-local (mobile, backup-able). Engine = _localsetup/; user data = repo-local. Attach git hash when referencing PRDs/specs (see [_localsetup/docs/GIT_TRACEABILITY.md](../_localsetup/docs/GIT_TRACEABILITY.md)).
+Localsetup v2 is deployed into this repo at `_localsetup/`. The framework is repo-local and mobile, but mutable user/project state should live in stable repo-level paths outside `_localsetup/`. Engine = _localsetup/. Attach git hash when referencing PRDs/specs (see [_localsetup/docs/GIT_TRACEABILITY.md](../_localsetup/docs/GIT_TRACEABILITY.md)).
 
 ## Invariants
-- Engine/repo separation: no secrets/PII in commits. Paths via _localsetup/lib/data_paths.sh. Framework at _localsetup/.
+- Engine/repo separation: no secrets/PII in commits. Paths via _localsetup/lib/data_paths.sh. Framework at _localsetup/. Do not store mutable memory, reminders, backlog, temporary notes, or run outputs under `_localsetup/`.
 - Documentation: _localsetup/docs/ only for framework docs. Check doc status (ACTIVE/PROPOSAL) before assuming implemented.
 - Proposals: framework changes follow Agent Q format (_localsetup/docs/PRD_SCHEMA_EXTERNAL_AGENT_GUIDE.md).
 - Time/date integrity: for any date/time reference, first get actual date/time from the local machine (e.g. `date` on Linux/macOS, `Get-Date` in PowerShell on Windows). Do not use a generic or training-cutoff date; remember it and use it for the rest of the session.

_localsetup/templates/kilo/AGENTS.md

@@ -2,13 +2,13 @@
 
 ## Overview
 
-Localsetup v2 is a universal, cross-platform agentic workflow engine. It is **deployed into the client repository** at `_localsetup/`. All framework code and repo-local context live in the repo so the deployment is mobile and backup-able. Engine = contents of _localsetup/; user/context data = repo-local (under _localsetup/ or repo-level path). Git coupling: attach git hash when referencing PRDs, specs, or outcomes. See _localsetup/docs/GIT_TRACEABILITY.md.
+Localsetup v2 is a universal, cross-platform agentic workflow engine. It is **deployed into the client repository** at `_localsetup/`. Framework code lives under `_localsetup/`, while mutable user/project state must live in stable repo-level paths outside `_localsetup/` so it survives framework refreshes. Git coupling: attach git hash when referencing PRDs, specs, or outcomes. See _localsetup/docs/GIT_TRACEABILITY.md.
 
 Kilo CLI uses `AGENTS.md` as the project initialization file at repo root.
 
 ## Invariants (always apply)
 
-- **Engine/repo separation:** Never commit repo-local secrets or PII. Use _localsetup/lib/data_paths.sh (or equivalent) for path resolution. Framework lives at _localsetup/; upgrades replace that folder.
+- **Engine/repo separation:** Never commit repo-local secrets or PII. Use _localsetup/lib/data_paths.sh (or equivalent) for path resolution. Framework lives at _localsetup/; upgrades replace that folder. Do not store mutable memory, reminders, backlog items, temp notes, or run outputs under `_localsetup/`; use stable repo-level locations instead.
 - **Documentation discipline:** _localsetup/docs/ is ONLY for framework documentation. Check document status (ACTIVE/PROPOSAL/DRAFT) before assuming a feature is implemented.
 - **Proposals:** Any change to the framework must follow the Agent Q format; see _localsetup/docs/PRD_SCHEMA_EXTERNAL_AGENT_GUIDE.md.
 - **Time/date integrity:** For any date or time reference (e.g. "today", year in a search, timestamps), first obtain the actual date/time from the local machine using a platform-appropriate command (e.g. `date` on Linux/macOS, `Get-Date` in PowerShell on Windows). Do not use a generic or training-cutoff date (e.g. 2024 when the current year is different). Remember the obtained date/time in context and use it consistently for the remainder of the session.

_localsetup/templates/opencode/AGENTS.md

@@ -1,12 +1,12 @@
 # Localsetup v2  - Agent context (OpenCode)
 
 ## Overview
-Localsetup v2 is deployed into this repo at `_localsetup/`. Framework and context are repo-local (mobile, backup-able). Engine = _localsetup/; user data = repo-local. Attach git hash when referencing PRDs/specs (see [_localsetup/docs/GIT_TRACEABILITY.md](../_localsetup/docs/GIT_TRACEABILITY.md)).
+Localsetup v2 is deployed into this repo at `_localsetup/`. The framework is repo-local and mobile, but mutable user/project state should live in stable repo-level paths outside `_localsetup/`. Engine = _localsetup/. Attach git hash when referencing PRDs/specs (see [_localsetup/docs/GIT_TRACEABILITY.md](../_localsetup/docs/GIT_TRACEABILITY.md)).
 
 OpenCode uses `AGENTS.md` as the project initialization file. This context is loaded automatically when OpenCode initializes in this repo.
 
 ## Invariants
-- Engine/repo separation: no secrets/PII in commits. Paths via _localsetup/lib/data_paths.sh. Framework at _localsetup/.
+- Engine/repo separation: no secrets/PII in commits. Paths via _localsetup/lib/data_paths.sh. Framework at _localsetup/. Do not store mutable memory, reminders, backlog, temporary notes, or run outputs under `_localsetup/`.
 - Documentation: _localsetup/docs/ only for framework docs. Check doc status (ACTIVE/PROPOSAL) before assuming implemented.
 - Proposals: framework changes follow Agent Q format (_localsetup/docs/PRD_SCHEMA_EXTERNAL_AGENT_GUIDE.md).
 - Time/date integrity: for any date/time reference, first get actual date/time from the local machine (e.g. `date` on Linux/macOS, `Get-Date` in PowerShell on Windows). Do not use a generic or training-cutoff date; remember it and use it for the rest of the session.