writ's templates end in .tmpl: .template is a generic word other tools use, and writ renders their files #974

Ruled 2026-09-29: writ's templates end in .tmpl. In the owner's words: "Let's do as you propose. .tmpl for writ templates." .template is left to other tools.

Why

writ claims every file ending in .template (cmd/writ/writ/tree/node.go:52-54): it renders the file as a Go template and deploys it as a copy with the suffix stripped. .template is a generic word that other tools use for their own templates. personal's New-LocationConfig reads templates/certificate-request.conf.template, an envsubst template with ${VAR} placeholders and no {{ }}. writ renders it into certificate-request.conf, so the script never finds its file (personal#237).

Prior art, weighed with the owner:

• chezmoi, the dotfile manager closest to writ, renders a file ending .tmpl as a Go template and deploys it without the suffix: writ's behavior, under that name. .tmpl is also the common suffix in Go code and in Go editor tooling.
• The official nginx image runs envsubst over *.template: the precedent for leaving .template to other tools.

Scope

The suffix changes everywhere writ reads it. .template.sops becomes .tmpl.sops.

• cmd/writ/writ/tree/node.go:30-32 (the doc comment) and :52-53 (the rule).
• pkg/sops/decrypt.go:80-82, which strips the rendering suffix to infer the document's format.
• The tests that name the suffix: cmd/writ/writ/tree/tree_test.go, pkg/sops/decrypt_test.go, and the deploy, readback, reconcile, upgrade, decommission and sops integration tests.
• The scenario fixture cmd/writ/testdata/personal-repo/Home/noblefactor.Unix/.config/scenario/writ.conf.template.
• docs/guides/writ/repositories.md:124, and any guide that names the suffix.

No layer holds a writ template today. The only .template in personal, noblefactor-ops or devlore-cli's Home is personal's certificate request, which is not one. So no layer file is renamed. Once writ stops claiming .template, the certificate template deploys as a link under its own name, and personal#237 needs no change in personal.

Out of scope: star's code-generation templates (star/extensions/com.noblefactor.devlore.Actions/templates/*.go.template) and packaging/macports/Portfile.template. They are Go templates, but other tools read them, not writ.

Convergence

On every machine that has deployed personal, writ's rendered copy ~/.local/bin/templates/certificate-request.conf is left behind when the source starts deploying as a link. It's removed after the deploy (agent rule 5), per machine.

Plan and design documents

Epic: #447 · Feature: #463