fix: keep repositories outside Syncthing

docs/plans/workflow-system.md

@@ -27,6 +27,9 @@ empirical, credential, hardware, and approval gates into one checklist only
 after no autonomous work remains. A single pilot reaching its user gate does
 not make it the global next step while another pilot can still progress.
 
+Never place repositories or worktrees under `~/sync`; synchronize authored
+artifacts instead. The folder's sole ignore pattern is the local `.zk` state.
+
 ## Current checkpoint
 
 - Tranche: autonomous consolidation across repositories, tools, and pilots
@@ -75,8 +78,9 @@ not make it the global next step while another pilot can still progress.
   path. The user selected Fossify's native `recordings/inbox` destination, and
   the new event-driven Orion CPU pipeline passes an isolated transcription of
   that recording without modifying or exposing its contents. A pathological
-  synchronized `.devenv` tree was removed from the Pixel and is now ignored by
-  the Nix-owned Syncthing folder on Linux peers.
+  synchronized repository tree was removed from the Pixel. Repositories are now
+  explicitly outside the Syncthing boundary instead of relying on an expanding
+  generated-directory ignore list.
 - Next: activate and validate the Orion transcription owner, then retire the
   retained Zenith timer. Activate the batched Zenith desktop changes once that
   migration is ready, while independent external pilots continue as inputs
@@ -224,9 +228,12 @@ Polaris:
   no malformed top-level entry or filesystem failure was found. With the
   Syncthing-Fork folder paused and explicit approval, ADB atomically renamed and
   then permanently deleted only that exact tree. The live and temporary paths
-  are absent. The shared Syncthing configuration now ignores `**/.devenv` so
-  generated devenv state cannot recur from a Linux peer; flake evaluation and
-  no-link Zenith and Orion builds pass.
+  are absent. A later Files hang was isolated to the remaining stale `Sync`
+  tree, which included a repository with a very large `node_modules`; that
+  1.7 GiB quarantined tree was permanently removed with explicit approval, and
+  both its visible and hidden paths are absent. The durable rule is that
+  repositories and worktrees never enter `~/sync`; the
+  shared folder therefore keeps only its intentional `**/.zk` ignore.
 - `rules-service` now has a non-mutating direnv shell, minimal Nix toolchain and
   formatting check, native Cargo recipes, factual repository instructions,
   one `.http` request collection, explicit test/live deployment paths, and a

modules/capabilities/syncthing.nix

@@ -39,10 +39,7 @@ in
               path = "${config.home.homeDirectory}/sync";
               label = "sync";
               devices = builtins.attrNames syncDevices;
-              ignorePatterns = [
-                "**/.devenv"
-                "**/.zk"
-              ];
+              ignorePatterns = [ "**/.zk" ];
             };
             bruno = {
               path =