Docs: record Phase Upsilon W1; carry forward W2/W3 constraints; SEPT_VERIFY section 7

docs/PLAN.md

@@ -425,12 +425,11 @@ built.
 | **E4** | Where do items pointing at temp files end up after save, with copy ticked and with it unticked? |
 | **E5** | Does save-at-close give the extension no tick? (If so, the load-time trigger is the only one that catches that case) |
 
-### Υ-W1 — The bank-root seam *(IN PROGRESS — dispatched 2026-09-25)*
+### Υ-W1 — The bank-root seam *(complete)*
 
-| Track | Owns |
-|---|---|
-| **T1** `bank-root-seam` | Pure `bankRootFor` plus ONE shell resolver, `bankRootOf(ReaProject*)`. It replaces the extension's ~12 copies of "EnumProjects → `.rpp` dir". **No behaviour change** |
-| **T2** `instrument-own-project` | The instrument resolves ITS OWN project instead of the active tab (**a real bug fix**: today it reads the active tab), with an ordered list of candidate roots |
+Both tracks landed 2026-09-25 — **T1 `bank-root-seam`** (`bankRootFor` / `bankRootOf`) and
+**T2 `instrument-own-project`** (the instrument resolves its own project; ordered candidate
+roots in `sample_roots`). See `docs/COMPLETED.md`. Nothing to dispatch.
 
 ### Υ-W2 — Unsaved ext state, and the migration *(gated on E1; E2 shapes it)*
 
@@ -439,6 +438,20 @@ built.
 | **T1** `unsaved-ext-state` | Lift the ext-state refusal for unsaved projects; create the temp root lazily; add the `unsaved_bank_root` key; update the ext-state contract text (Υ-D4, Υ-D5) |
 | **T2** `first-save-migration` | `migrateUnsavedBank` and both of its triggers (timer-poll transition, load-time breadcrumb); the console notice for items still pointing into temp (Υ-D1, Υ-D2, Υ-D3) |
 
+Carry-forward constraints from Υ-W1:
+
+- **T1 must not make `bankRootOf` return the temp root before T2's `migrateUnsavedBank` owns
+  the first-save path.** Today's `session.cpp` Save-As branch classifies first save as
+  `SaveAsRelocate` and would call `relocateBankFolder`, which copies with `overwrite_existing`
+  (A1) — violating "never overwrites silently". Either land T1 and T2 together, or guard
+  `SaveAsRelocate` when the old root came from the unsaved branch.
+- **T1: keep the unsaved branch cheap.** `bankRootOf(nullptr)` runs on every panel paint and
+  audition start; once it reads `unsaved_bank_root` ext state, keep that lookup cheap or cache
+  it on the session, invalidated on the project-change transition.
+- **Instrument side:** `readFromFirstRoot` falls through on a zero-byte read, not only a
+  missing file — decide deliberately whether an empty project-folder file should fall back to a
+  same-named temp-root file.
+
 ### Υ-W3 — Lift the refusals, then the leftovers
 
 | Track | Owns |
@@ -446,6 +459,12 @@ built.
 | **T1** `lift-unsaved-refusals` | Every refusal on an unsaved-project surface (Υ-D7, Υ-D8). Closes the `docs/TODO.md` entries "The capture path ignores `saveToActiveProject`'s return at four sites" and "`RunCaptureItemAssign`'s undo point does not follow the pattern its comment claims" |
 | **T2** `reclaim-unsaved-leftovers` *(later)* | Υ-D6's confirmed, dry-run-first reclaim action in the prune family |
 
+Carry-forward constraint from Υ-W1:
+
+- **T1: prune's own saved-project check (`prune_fs.cpp`) is not named by any track.** Decide
+  explicitly whether prune refuses on an unsaved project or re-keys on `bankRootOf` — an open
+  question for Daniel.
+
 ### Pre-existing issues the design pass found — for awareness, NOT in scope
 
 | # | Issue |