[hzw0813]

Findings

Audited main after #70 (72211d9) and the production-readiness audit. A committed submodule pointer update produced an empty-change report because all diffs ignored submodules. Python discovery could cross nested-repository boundaries, and immutable root checks could consume nested dirty/untracked inputs that the alignment gate never bound.

Six new regression cases fail against the baseline distribution.

Changes

• Report gitlink additions, updates, renames, deletions, and file-type transitions from bounded raw Git mode/path records. Override local submodule-ignore and nested-diff preferences.
• Keep gitlinks unknown and metadata-only, with additive submodule: true, zero source-line counts, and no source hunks. Passing root checks, test-map declarations, and LCOV cannot verify nested contents.
• Exclude gitlinks from structural candidates and submodules/embedded repositories from Python discovery, including removed pointers with checkouts left behind.
• Reject immutable --run-checks selections containing indexed submodules before execution. Static immutable analysis and explicit working-tree execution remain available.
• Explain nested dirty-state scope in reports, including the bounded GitHub summary; update architecture, security, verification docs, changelog, audit, and generated distribution.

No runtime dependencies, network calls, telemetry, uploads, LLM dependency, or automatic execution were added. No recursive submodule operations are introduced.

Validation

• Local Linux / Node 24: 182 tests passed; lint/typecheck passed.
• Six new cases failed against the pre-change distribution; the focused suite passed after implementation.
• npm run dogfood: all four checks passed, seven compiled targets observed, source evidence correctly partial.
• npm run demo: all four asserted scenarios passed.
• npm run test:action: passed, including production-only install and static-default behavior.
• npm pack --dry-run: passed, including the repeated test/build lifecycle.
• Clean-build parity: all 100 generated files matched; git diff --check passed.
• CI run 35713217456: all 12 applicable jobs passed—Linux/macOS/Windows × Node 22/24/26 (tests and packaging), generated-dist parity, PR dogfood, and source Action smoke. Windows reports 173 passed and 9 expected platform skips. The published-release Action smoke is push-only and was intentionally skipped.

Compatibility and remaining limitations

Submodules are not recursively analyzed. Content-only nested dirtiness is intentionally omitted from repository dirty status and disclosed in reports. Gitlink-to-file transitions remain conservative metadata-only assessments. Immutable execution is more restrictive until nested inputs can be snapshot-bound; explicitly enabled working-tree root commands may still execute nested code, but cannot verify gitlink changes.

Snapshot isolation, concurrent-mutation protection, broader monorepo/runner support, and unsupported module-resolution cases remain follow-ups. This is a focused correctness pass, not a claim of complete production readiness.

Draft for review; do not merge automatically.