plan(0.5.11): prove the isolated-env recipe end to end

The UV_PROJECT_ENVIRONMENT mechanism was verified earlier; the environment
recipe was not. Running it revealed uv sync alone does not produce a runnable
test environment: 9 failed and 78 errors, all PII, because en_core_web_lg is
not a declared dependency. It is installed out of band per operations.md, so a
fresh sync never fetches it. Installing it turned the same suite green at 3107
passed, matching the live environment exactly.

The plan now carries the executed recipe rather than a sketch, including the
spaCy step, the 3.12 interpreter pin (a fresh redirected env defaults to 3.11),
and a durable venv location outside both the repo and any session-scoped temp
dir.

Isolation is proven rather than asserted: after a full sync, a full suite run,
and a package install in the redirected environment, the live venv was
unchanged — 1.5G, fathomdb still 0.3.1, spaCy model intact — and the proxy
stayed active throughout.

Author: coreyt

dev/plans/0.5.11-plan.md

@@ -111,20 +111,44 @@ it. That is the exact failure mode the worktree exists to prevent.
 working: it created and used an isolated environment, leaving the live venv
 untouched (confirmed 1.5G and importing afterwards).
 
+### The working recipe, executed end to end
+
+`uv sync` alone does **not** produce a runnable test environment. Verified by
+running the full suite in a fresh isolated venv: **9 failed, 78 errors**, every
+one of them PII, because `en_core_web_lg` is not a declared dependency — it is
+installed out of band (see `docs/operations.md`) and so `uv sync` never fetches
+it. Adding it turned the same suite green at **3107 passed**, matching the live
+environment exactly.
+
 ```bash
 git worktree add .claude/worktrees/0.5.11 -b 0.5.11
-export UV_PROJECT_ENVIRONMENT=/path/outside/the/repo/0.5.11-venv
-uv run --python 3.12 ...   # pin 3.12; uv otherwise picked 3.11 for a fresh env
+cd .claude/worktrees/0.5.11
+
+# Durable location — NOT the repo, and not a session-scoped temp dir
+export UV_PROJECT_ENVIRONMENT="$HOME/.cache/airlock-venvs/0.5.11"
+
+uv sync --python 3.12 --all-extras          # pin 3.12; a fresh env defaults to 3.11
+uv pip install --python "$UV_PROJECT_ENVIRONMENT/bin/python" \
+  "https://github.com/explosion/spacy-models/releases/download/en_core_web_lg-3.8.0/en_core_web_lg-3.8.0-py3-none-any.whl"
+
+UV_PROJECT_ENVIRONMENT="$HOME/.cache/airlock-venvs/0.5.11" uv run --no-sync pytest -m "not live" -q
 ```
 
-Two practical notes:
+Notes worth keeping:
 
+- **Export `UV_PROJECT_ENVIRONMENT` for every command in the worktree**, including
+  `pytest`. Forgetting it on a single `uv run` is what would sync the live venv.
 - **Pin the interpreter.** A fresh redirected environment defaulted to CPython
   3.11.15; the project runs 3.12.
+- **Sizes:** isolated env 912M before the spaCy model, ~1.3G after; the live venv
+  is 1.5G. Disk is not a constraint here (409G free).
 - **The symlink shortcut is still fine for packs that change no dependencies**
-  (C-1 is pure TUI work). It avoids rebuilding a 1.5G environment, 425M of which
-  is the `en_core_web_lg` spaCy model. Use it there and only there — never for
-  A-1.
+  (C-1 is pure TUI work) — it avoids rebuilding the environment entirely. Use it
+  there and only there; never for A-1.
+
+**Proof of isolation:** after a full sync, a full suite run, and a package
+install in the redirected environment, the live venv was unchanged — still 1.5G,
+still `fathomdb 0.3.1`, spaCy model intact — and the proxy stayed `active`.
 
 ---