diff --git a/conductor/tier2/commands/tier-2-auto-execute.md b/conductor/tier2/commands/tier-2-auto-execute.md
index afa1c859..602acdf1 100644
--- a/conductor/tier2/commands/tier-2-auto-execute.md
+++ b/conductor/tier2/commands/tier-2-auto-execute.md
@@ -16,13 +16,13 @@ Optional flags: `--resume` (continue from last completed task), `--toast` (Windo
 
 1. **Verify sandbox is active.** This slash command must be invoked from a sandboxed OpenCode session. If `manual-slop_get_ui_performance` returns an error or the run_tier2_sandboxed.ps1 wrapper is not in the parent process, refuse to start.
 2. **Load the track spec.** Read `conductor/tracks/<track-name>/spec.md` and `plan.md` from the current branch. If the track does not exist, abort.
-3. **Check for a previous run.** If `<app-data>/tier2/<track-name>/state.json` exists AND `--resume` is NOT set, abort with: "Previous run found for this track. Use `--resume` to continue, or delete the state file to start fresh."
+3. **Check for a previous run.** If `scripts/tier2/state/<track-name>/state.json` exists AND `--resume` is NOT set, abort with: "Previous run found for this track. Use `--resume` to continue, or delete the state file to start fresh."
 
 ## Protocol
 
 1. `git fetch origin master` (NOTE: this repo uses `master`, not `main`; added 2026-06-17)
 2. `git switch -c tier2/<track-name> origin/master` (NOT `git checkout` - it is banned)
-3. Initialize failcount state at `<app-data>/tier2/<track-name>/state.json` (use `load_state` or fresh state)
+3. Initialize failcount state at `scripts/tier2/state/<track-name>/state.json` (use `load_state` or fresh state)
 4. For each task in `plan.md`:
    a. Red: delegate test creation to @tier3-worker
    b. Run tests via `uv run python scripts/run_tests_batched.py` (NEVER `uv run pytest` directly; the batched runner provides tier filtering, parallelization, and the summary table — added 2026-06-17)
@@ -43,7 +43,7 @@ Optional flags: `--resume` (continue from last completed task), `--toast` (Windo
 - **Line endings:** preserve existing (CRLF stays CRLF, LF stays LF)
 - **Throw-away scripts:** write to `scripts/tier2/artifacts/<track-name>/`, NOT the base directory
 - **Run-time expectation:** tracks are 1-4 hours. If context runs out, note progress to disk and continue.
-- **Temp files** (added 2026-06-17): NEVER write to `C:\Users\Ed\AppData\Local\Temp\` or `%TEMP%`. Use `C:\Users\Ed\AppData\Local\manual_slop\tier2\` for scratch / audit-output / intermediate files. The bash deny `*AppData\Local\Temp\*` will block writes; the OpenCode session's outer guard will fire the "ask" prompt for reads — both halt autonomous ops.
+- **Temp files** (added 2026-06-17, rewritten 2026-06-18): All scratch, state, audit-output, and intermediate files MUST live INSIDE the Tier 2 clone. Default locations: `scripts/tier2/state/<track>/state.json` for failcount state, `scripts/tier2/failures/` for failure reports, `scripts/tier2/artifacts/<track>/` for throwaway scripts. **NEVER USE APPDATA** — the `C:\Users\Ed\AppData\...` tree is OFF-LIMITS. The `*AppData\\*` bash deny rule enforces this.
 
 ## Hard Bans (enforced by 3 layers)
 
@@ -52,4 +52,4 @@ Optional flags: `--resume` (continue from last completed task), `--toast` (Windo
 - `git checkout*` (any form) — denied; use `git switch` instead
 - `git reset*` (any form) — denied
 
-Filesystem access is restricted to the Tier 2 clone + `<app-data>/manual_slop/tier2/`. The Windows restricted token blocks reads/writes outside these paths at the OS level.
+Filesystem access is restricted to the Tier 2 clone (`C:\projects\manual_slop_tier2\`). The Windows restricted token blocks reads/writes outside this path at the OS level. **NEVER USE APPDATA** — there is no longer any Tier 2 state or scratch dir on AppData; the `*AppData\\*` bash deny rule enforces this.