fix: a new workspace no longer inherits CodeCartographer's own project state (B16, B17)

[TheAmericanMaker]

A new workspace was starting with ~40 KB of CodeCartographer's own project history presented as its own — and one consequence was behavioral, not cosmetic.

The bug

This repository's .codecarto/ is two things at once: the template copied into a user's repo on init, and CodeCartographer's own live workspace. Init copied it wholesale. A fresh codecarto_init on any repository produced:

File	What the user got
BACKLOG.md	15 KB — CodeCartographer's own 17 framework deferrals (B1–B17)
THREAD_LOG.md	the framework's session index, with its entries
closeouts/2026-05-02-framework-feedback-pass.md	12.8 KB closeout from a session where CodeCartographer analyzed itself
CHANGELOG-2026-05-02-feedback-pass.md	10 KB changelog of that same session

All four are in REFRESH_EXCLUDED_TOP_LEVEL / excluded dirs — treated as user-owned — so nothing ever cleaned them up.

The behavioral part. GUIDE.md §First-Time Project Setup keys on "no closeouts in closeouts/, CONVENTIONS.md and DECISIONS.md missing or still template skeletons" to decide whether to adopt the orchestrator role by default. Because a closeout shipped, closeouts/ was never empty on a brand-new workspace — so the detection said "not the first LLM to touch this project," suppressing the default that #97/#98 deliberately established.

Verified against a real handleInit before and after: closeouts/ went from one inherited file to [], and BACKLOG.md from 15,175 bytes of framework deferrals to a 1,957-byte project skeleton.

The fix

• copyPackagedWorkspace() in core/workspace.ts copies the template through a filter that skips the four orchestrator files and the contents of closeouts/. Both init paths (MCP and Pi) now go through it instead of a raw cp.
• closeouts/ is created explicitly rather than by the copy — npm tarballs carry no empty directories, and a missing directory reads differently to anything that lists it.
• ORCHESTRATOR_FILES gains BACKLOG.md and THREAD_LOG.md, seeded from two new templates.
• package.json negates the same paths, so the tarball stops transporting them either.
• CHANGELOG-2026-05-02-feedback-pass.md moves to docs/, where framework history belongs.

Existing workspaces are untouched — refresh already treated all four files as user-owned.

Two backlog items ride along

Both were this bug seen from the inside, so they land with it:

• B16 — templates/backlog-project.md carries the entry shape the item specified (rationale, raised-by, preconditions, smallest viable form), and GUIDE.md distinguishes the project backlog from the framework's under Trust Boundaries.
• B17 — the spec-delta SKILL now states that DEFER goes to BACKLOG.md with no D number, that a refinement made while applying is a decision recorded in the audit file's Decisions Beyond Triage section, and that an existing D entry's disposition is updated in place rather than superseded.

Verification

408 tests pass, build clean. New tests/init-workspace-isolation.test.mjs pins: a fresh workspace has an empty closeouts/; no orchestrator file carries real entries (as opposed to a template's illustrative examples); the seeded backlog is the template, not the framework's list; every ORCHESTRATOR_FILES entry has a template that actually exists to seed from; and package.json negates each path.

Branched off main, independent of #154.

🤖 Generated with Claude Code