docs: harden the worktree recipe with --no-track; correct the stale no-mechanical-backstop claim

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code

[zhuangjianguo]

Fixes#6880
Part of #6866 — its half 1 stays open (implementation tracked there) and is untouched here.

Two instruction-file corrections on the same governed face, folded into one PR because they
land in the same file and would otherwise be hard-serial.

1. The worktree recipe now specifies --no-track (the anchor card)

Byte-level insert into the two prescribed spellings, net 0 lines:

• CLAUDE.md:16 — the fenced recipe.
• AGENTS.md:234 — the same recipe inline.

(Placeholders written as words here; the files use angle-bracket placeholders.)

Plain -b writes the new branch's upstream keys — branch.NAME.remote and
branch.NAME.merge — into the one .git/config that every linked worktree of a repo
shares. That write can fail after the branch is created, leaving a branch with no
worktree: a half state in the very first step of the recipe, and one the error text does not
name. Read as "the whole command failed", the retry hits branch already exists and reads
as a second, unrelated problem; read as "the worktree exists", the agent starts editing the
shared primary checkout — the single thing the worktree-first rule exists to prevent.

The measured basis is the anchor card's git 2.43.0 table, cited rather than re-derived:
--no-track removes the config write and still bases the worktree on origin/main;
explicit git pull origin main is unaffected (it uses the given refspec, never
branch.NAME.merge), and git push -u origin BRANCH — already the prescribed first push —
sets an upstream one command later.

This PR ate its own dogfood: its worktree was created with the hardened recipe.

Scope pin honoured (anchor triage, comment 5473464940)

p2 · pm:queue · domain:skills — scope pinned to the FLAG INSERT ONLY. [...] ⛔ The
prose extension (naming .git/config beside refs/stash / refs/remotes/*) is NOT in
scope here: its objectstack companion #13052-A is HELD for corpus audit objectstack#13597,
and the shared-namespace prose should be shaped by that audit in both repos at once.

No shared-namespace prose was extended. .git/config appears nowhere new in the
instruction text.

2. The "no mechanical backstop" paragraph, corrected in place (#6866 half 2)

Scope pin honoured (comment 5473466315)

Half 2 [...] is a plain correction and stays dispatchable now, independent of half 1:
name the guard, its report-only-vs-blocking state (#6596 still pm:awaiting-maintainer),
and its coverage, per the paragraph's own 「它会写在这里」 promise. Governed file ⇒ draft,
human merge.

The paragraph re-derived to AGENTS.md:433 (the card's :392 had drifted). Claim by claim,
measured on this branch's base:

claim in the paragraph	verdict
"this repo has NO mechanical backstop, this paragraph is all there is"	FALSE — the guard workflow is live
no CODEOWNERS (verified: the file does not exist)	still TRUE — absent at every candidate path
no required check on the governed surface	still TRUE — the ruleset toggle is pending on #6596
no hook on the governed surface	still TRUE
no post-merge audit lists governed merges for anyone	FALSE
the sibling repo's audit "does not cover this repo"	FALSE — it has covered four governed repos since objectstack#9619
a violation "succeeds silently, nobody is notified"	FALSE — the guard reports on every PR
"a backstop this paragraph does not name is a backstop that does not exist"	self-referential closure — removed

Two of those were not in the card and turned up while reading: the audit-coverage sentence
is false for the same reason the headline claim is, and it sits in the same paragraph, so
leaving it would have meant knowingly shipping a corrected paragraph that still asserts a
measured-false absence.

⭐ The sharpest corroboration is internal: the same file already named the guard 59 lines
above, at AGENTS.md:372-376, as the workflow a tree enumeration missed. The document
contradicted itself, and the half asserting the absence was the half written to be trusted
absolutely.

The replacement keeps every claim that is still true, then names the guard
(.github/workflows/governed-surface-guard.yml, check Governed Surface Queue Guard,
predicate in scripts/check-governed-queue-guard.mjs), states both legs — the
pull_request leg deliberately exits 0, so green does not mean ungoverned, which is the
misread this paragraph would otherwise invite — records that the refusing merge_group leg
only reports until the ruleset toggle is flipped, and points coverage at the script's own
GOVERNED_SURFACES rather than restating a closed inventory that goes stale the next time a
guard is added. That last part is the paragraph's own promise being kept in a form that
cannot rot the same way.

The divergence clause (amended at 623b713)

The paragraph's closing clause originally described the guard-vs-carve-out divergence as an
open adjudication. That was stale on arrival: the maintainer had already ruled it on
2026-08-30 (第 5 场决裁批 #7, verbatim 「批 #7 同意」 — Option A, ui#6866 comment
5469339478). The clause now records the ruling itself — published skills/** is governed,
the guard's reading is the ruled one, implementation pending on #6866 — and forbids acting
on the carve-out until that lands. The carve-out sentences at AGENTS.md:419/:421 remain
byte-identical in this PR; their Option-A rewrite is #6866's follow-up implementation,
deliberately not folded in here.

Not in this PR

• [finding] AGENTS.md's governed-surface section disagrees with the fleet on root skills/** — and its "this repo has NO mechanical backstop" paragraph is now false, the guard workflow it promised to mention is live #6866 half 1's implementation — the Option-A rewrite of the carve-out. Tracked on that card, serial behind this PR.
• The .git/config shared-namespace prose extension — deferred to objectstack#13597.
• The two enforcement hooks still emit the unhardened recipe as their remediation text
  (.claude/hooks/guard-main-checkout.sh:57 and
  .claude/hooks/guard-main-checkout-bash.sh:544). That is the text an agent reads at the
  exact moment it is about to run the command, so the hazard survives there. Carded as
  [finding] guard-main-checkout hooks' remediation text still teaches the unhardened worktree recipe (no --no-track) — the copy an agent reads at the moment of the blocked action #6977 (this repo) and objectstack#13663 (the twins there, which also base on unfetched
  local main). The historical changeset .changeset/6208-worktree-recipe-fetch-base.md
  quotes the old form and was deliberately left alone — it is a record of a past change,
  not a prescription.

Validation

Round 1 at 64d6421, amend re-run at 623b713; exit codes captured before any pipe.

check	exit	verdict line
check:control-bytes	0	✅ check-control-bytes: OK (scanned 5804 tracked text file(s); skipped 85 binary).
check:doc-fences	0	✅ check:doc-fences — every TypeScript block in 224 document(s) is fenced ts/tsx/typescript
check:governed-queue-guard	0	OK check-governed-queue-guard self-test: 132 cases pass
check-changeset-presence.mjs	0	✅ No source of a released package changed in this range, so no changeset is owed.
check-doc-links.mjs	0	Links are valid across 17 scan roots.
all 4 hook self-tests	0	121 passed, 0 failed · 41 passed, 0 failed · 36 passed, 0 failed

Anchored greps with positive controls (after the amend): --no-track1 in each file;
本仓没有任何机械兜底0; 本段没点名的兜底工具0; 这一分歧在 #6866 待维护者裁决0;
批 #71; controls — 受管面 in AGENTS.md7; PreToolUse5;
guard-shared-stash.sh in CLAUDE.md1. Line totals unchanged: CLAUDE.md 51,
AGENTS.md 489 — net 0 lines in both.

The guard, run against this PR's own file list, agrees with what the new paragraph says
about it:

⛔ GOVERNED — 2 of 3 path(s) are on a governed surface:
AGENTS.md x1 — the repo-root agent instruction file
CLAUDE.md x1 — the repo-root Claude instruction file
⛔ Do not flip it ready, enqueue it, or arm auto-merge. Park it as a DRAFT and leave the
merge to the maintainer; a human merge IS the review record for a governed surface.

Landing

Governed surface ⇒ draft, human merge (pm:awaiting-maintainer per 批 #7's execution
note). ⛔ Not flipped ready, not enqueued, no auto-merge. The changeset carries empty
frontmatter — this repo's measured form for a non-publishing change (precedent:
.changeset/6208-worktree-recipe-fetch-base.md, the same change class).

Generated by Claude Code