Handoff doc + CLAUDE.md and requirements.md refresh

Adds docs/handoff/20260508-handoff-2.md describing the state at
the end of this session: ADR-0015 designed, Iterations 1-4 of
track 2 shipped (file-backed projects with auto-named [temp]
dirs, per-command write-through, rebuild from text on missing
.db, save/save as/new/load/rebuild commands with modal dialogs
and project switching), plus the cleanup pass (--help, in-app
help, post-rebuild message, unmodified-temp cleanup) and the
safety hardening of safely_delete_temp_project. Lists the
next-up moves (Iteration 5: export/import, Iteration 6:
--resume + persistent input history + migration scaffold) and
an end-to-end smoke test.

requirements.md: marks P1-P5, P-NAME-1/2/3, F1, F2, U3, L1 as
[x] with iteration references; adds P-CLEAN-1 for the safe
cleanup; updates A1, I2, H3, L1a progress notes.

CLAUDE.md: updates the project-storage decisions and
deferred-items entry to reflect what's now live vs. still
pending.

CLAUDE.md

@@ -33,16 +33,26 @@ Current decisions at a glance (each backed by an ADR):
   simple to advanced (ADR-0003). No other sigils.
 - **Project format:** `project.yaml` + `data/<table>.csv` +
   `history.log`; `playground.db` is a derived artifact (ADR-0004,
-  amended by ADR-0015).
-  *(Format defined; runtime semantics defined in ADR-0015; track 2
-  implementation pending.)*
+  amended by ADR-0015). Implemented through Iteration 4 +
+  cleanup; export/import (Iter 5) and migration framework /
+  --resume / persistent input history (Iter 6) pending.
 - **Project storage runtime:** every command persists through to
   db + yaml + csv + history.log in one execution context, gated
   by the combined db persistence logic; commit-db-last ordering
   for crash-recoverable state; existence-only load + explicit
   `rebuild` command; in-TUI list-with-browse load picker; lock
   file for single-instance enforcement; persistence failures
-  are fatal (banner + quit) (ADR-0015).
+  are fatal (banner + quit) (ADR-0015). Empty tables produce no
+  CSV. CSV reader hand-rolled to preserve NULL-vs-empty
+  distinction. Temp projects are marked by a literal `[temp]`
+  segment in their directory name (validate_user_name rejects
+  brackets, so user-named projects can never collide).
+- **Temp project cleanup:** unmodified empty temps
+  (kind=Temp, empty schema, empty data dir) are auto-deleted
+  on switch and on quit by `safely_delete_temp_project`,
+  which stacks containment / symlink-rejection /
+  `[temp]`-marker / contents-allowlist guards. Anything
+  unexpected → refuse, never delete the wrong thing.
 - **Types:** `text`, `int`, `real`, `decimal`, `bool`, `date`,
   `datetime`, `blob`, `serial`, `shortid`. Compound primary keys
   supported. No real UUIDs (ADR-0005). FK column type
@@ -155,11 +165,11 @@ Key invariants in the code:
 These are explicitly tracked (mostly in `requirements.md`) but
 not yet implemented:
 
-- **Project storage** (track 2 / P-series, F-series, P-NAME-*):
-  file-backed projects, save/load/new/rebuild/export/import,
-  persistent history, project-name display + prettifier. Format
-  is fully designed in ADR-0004 (with amendments) and runtime
-  semantics in ADR-0015; implementation is the next iteration.
+- **Project storage** (track 2): largely implemented through
+  Iteration 4 + cleanup pass + safety hardening (Iterations
+  1–4 of ADR-0015). Pending pieces: `export` / `import` (Iter
+  5), `--resume` + persistent input history hydration +
+  migration framework scaffold (Iter 6).
 - **Complex WHERE expressions** (C5a): AND/OR/comparison/LIKE
   in UPDATE/DELETE/show-data filters. The bridge from DSL
   fluency to real SQL.