diff --git a/dev-claude-plugin/0009/SESSION-0009.0-TRANSCRIPT-2026-06-04T00-13--INPROGRESS.md b/dev-claude-plugin/0009/SESSION-0009.0-TRANSCRIPT-2026-06-04T00-13--INPROGRESS.md
index 8297d87..fa83216 100644
--- a/dev-claude-plugin/0009/SESSION-0009.0-TRANSCRIPT-2026-06-04T00-13--INPROGRESS.md
+++ b/dev-claude-plugin/0009/SESSION-0009.0-TRANSCRIPT-2026-06-04T00-13--INPROGRESS.md
@@ -10,4 +10,38 @@
 
 ## Launch prompt
 
-_(launch prompt not captured at claim time)_
+`/wgl-coding-session-init` → operator picked open follow-up **#1: the memory-write
+settings carve-out**.
+
+## Plan
+
+Make this project's auto-memory dir (`~/.claude/projects/<repo>/memory/`)
+writable by the Edit/Write tools so memory no longer needs a Bash workaround,
+without weakening protection on the genuinely sensitive parts of `~/.claude/`.
+
+Key finding (claude-code-guide / official docs): Claude Code evaluates
+permissions **deny → ask → allow; deny always wins**, there is no negation
+syntax, and specificity is irrelevant. So the memory note's stated "clean fix"
+(an `allow` carve-out alone) does NOT work while the blanket
+`Edit/Write(/Users/benstull/.claude/**)` deny stands. The deny must be narrowed.
+
+Steps:
+1. Narrow the blanket `~/.claude/**` deny → target only sensitive paths:
+   `settings.json`, `settings.local.json`, `.credentials.json`, `plugins/**`,
+   `skills/**`, `commands/**`, `wiggleverse.md`.
+2. Add self-documenting allow carve-out
+   `Edit/Write(/Users/benstull/.claude/projects/**/memory/**)`.
+3. Verify: JSON valid; memory path matches no deny; `settings.json` still denied;
+   Write tool reaches the memory dir mid-session with no prompt.
+
+Scope note: user-level config change (`~/.claude/settings.json`), NOT a
+plugin-repo change — no commit here, no `plugin.json` version bump.
+
+## Outcome
+
+Done. Blanket deny narrowed + allow carve-out added; JSON validated; memory path
+confirmed writable mid-session (throwaway `.perm-check` write succeeded with no
+Bash, no prompt, then removed). Project memory updated to mark the follow-up
+fixed. Side effect: pure runtime/scratch dirs under `~/.claude` (cache/,
+sessions/, tasks/, …) are now writable too — acceptable; the deny's real purpose
+was config/credentials/installed-code/customizations, all still denied.