@@ -102,6 +102,10 @@ Every reproduced race requires a failing-before and passing-after regression. As
 - When a subprocess reports a problem only as a warning and carries on, decide pass or fail by what each message means for the result, not by whether anything was printed: fail on messages that mean it did less than it should (for example could not read a path), and let through messages about harmless input the agent controls. Test both a benign case and a failing case, and filter the output as it arrives so that no volume of benign messages can push a failure out of a bounded buffer.
 - Quote or escape agent-controlled text (file names, paths, branch names) wherever it lands in output that people or tools parse, such as diffs, notices, logs or reports, so it cannot forge that output's structure.
 - A hardened Git invocation must also keep Git out of nested repositories and populated submodules, whose own config and hooks are the agent's: pass `--ignore-submodules` on the command line (the config default does not bind plumbing or override `.gitmodules`), and never run Git with a nested repository as its working directory.
+- Decide a filesystem fact (whether a name exists, where a link resolves, what a path's entries are) on the file system that will serve it, not on a copy. A host that folds case or Unicode normalization, or decodes names as text, answers differently from the container's; check links and names inside the container, as its kernel resolves them, by raw bytes.
+- Never infer that agent-written content is unchanged from timestamps, sizes or an index's stat cache: not every write moves them (tmpfs, for one). Compare the content itself.
+- Hand agent-chosen names to tools as literal data: disable or sidestep pathspec magic (a leading `:`), quote them in the tool's own input format (a leading `"` in `--stdin-paths`), pass them as bytes, and keep empty fields when splitting NUL-separated output. Check a name's safety only where it is reported, never refusing unchanged input for a name the report never carries.
+- Check a trust root before anything reads it. When a tool reads config or rules from storage an agent could have reached (Git and the metadata volume), compare that storage with its trusted baseline first, and run nothing if it changed.
 
 ## Blinded experiments
 
 
@@ -9,7 +9,7 @@ import { BASE_IMAGE, CLAUDE_VERSION, CODEX_VERSION } from './image.ts';
 import { taskFilesystemOwner } from './storage.ts';
 import { hasOwnerLabels, ownerLabels } from '../labels.ts';
 import { assertPhasePolicy } from '../policy.ts';
-export { prepareTaskFilesystems, removeTaskFilesystems } from './storage.ts';
+export { prepareTaskFilesystems, removeTaskFilesystems, UnusableRepositoryError } from './storage.ts';
 export type { TaskFilesystems, TaskStorageLimits } from './storage.ts';
 
 const validateSecrets = (profile: ContainerProfile, secrets: Readonly<Record<string, string>>) => {
 
@@ -24,7 +24,10 @@ export interface UnownedResource extends RecoveredResource {
   readonly reason: 'no-runner-label' | 'unknown-kind' | 'inconsistent-storage';
 }
 export interface RecoveryReport {
-  /** Agent containers, egress proxies, seeders, export containers and networks of this runner, now confirmed gone. */
+  /**
+   * Agent containers, egress proxies, seeders, export and inspection containers and networks of this runner, now
+   * confirmed gone.
+   */
   readonly removed: readonly RecoveredResource[];
   /** One handle per task-storage allocation of this runner, kept whole for export and `removeTaskFilesystems`. */
   readonly storage: readonly RecoveredTaskStorage[];
@@ -119,8 +122,8 @@ const removeById = async (resource: RecoveredResource, remaining: () => number)
 
 /**
  * Crash recovery for one database (#51 item 4). Acts only on objects whose `io.codeboost.runner` label is
- * `runnerOwner`: it removes agent containers, egress proxies, seeders, export containers and networks, and resolves
- * only once they are gone. It keeps task storage whole (volumes and keeper) and returns a recovery handle per
+ * `runnerOwner`: it removes agent containers, egress proxies, seeders, export and inspection containers and networks,
+ * and resolves only once they are gone. It keeps task storage whole (volumes and keeper) and returns a recovery handle per
  * allocation. Objects from older builds without a runner label, and anything it does not recognise, are reported and
  * never touched.
  *
@@ -181,8 +184,9 @@ export async function recoverLeftovers(runnerOwner: string, timeoutMs = 120_000)
   for (const resource of owned.container) {
     const kind = kindOf(resource);
     if (kind === 'storage:keeper') keep(resource, 'keeper');
-    // Seeders and export containers are transient: a leftover one is removed, never kept with the storage.
-    else if (kind === 'storage:seeder' || kind === 'storage:export' || kind === 'agent' || kind === 'egress')
+    // Seeders, export and inspection containers are transient: a leftover one is removed, never kept with the storage.
+    else if (kind === 'storage:seeder' || kind === 'storage:export' || kind === 'storage:inspect' || kind === 'agent'
+      || kind === 'egress')
       remove.push(resource);
     else unknown(resource);
   }
 
@@ -68,9 +68,10 @@ Use only these entry points to run an agent:
    if not, it removes what it made and refuses. Cleanup removes an object by the ID captured at its create, even if
    its labels are wrong; an object found only by name (including task storage) must carry all three owner labels. Call
    `removeTaskFilesystems` when the task ends. It refuses a repository that has a
-   symbolic link with an absolute target or a target outside the checkout, before it
-   creates any storage. Report this to the user as a repository the agent cannot run
-   on; do not retry it.
+   symbolic link with an absolute target or one that can lead outside the checkout (resolved in the container as its
+   kernel would, even once the agent creates a missing directory on the way), or any link in its Git metadata; the
+   seeder checks this and the allocation removes what it made, then throws an `UnusableRepositoryError`. Report
+   this to the user as a repository the agent cannot run on; do not retry it.
 3. `captureInvocation` freezes the request. Capture each attempt ID once. A new
    attempt needs a new attempt ID.
 4. `startCodexInvocation` or `startClaudeInvocation` returns a handle at once and runs
@@ -80,17 +81,48 @@ Use only these entry points to run an agent:
    call. The request carries `networkAllocationId`, a UUID you choose for the vendor network. Pass the vendor
    credential only as the function argument.
 5. To keep a stopped writable attempt's partial output, call `exportTaskDiff(storage, { base, imageId })` before
-   `removeTaskFilesystems`. `base` is the full ID of the last commit codeboost made in that storage. It returns at
-   most 1 MiB of diff (`truncated` says whether it was cut), and takes `signal` and a deadline for the Docker work.
+   `removeTaskFilesystems`. `base` is the full ID of the commit the storage was seeded from (the clone's head). For a
+   recovery handle, also pass the `metadataBaseline` you recorded (step 6). It returns at most 1 MiB of diff
+   (`truncated` says whether it was cut), and takes `signal` and a deadline for the Docker work.
    A changed file over 8 MiB, an untracked nested repository, a path Git will not add, an entry named `.git`, a fifo
    or socket, an ignored untracked path, a submodule directory with content, and a changed file whose `ident` or
    `working-tree-encoding` attribute changes what the diff shows each appear as a `codeboost:` notice line. When Git
    fails, the error carries Git's last two error lines.
-6. After a crash or restart, call `recoverLeftovers(runnerOwner)` (`agents/recovery.ts`) while holding the
+6. To audit what a writable attempt changed (#66, `agents/container/changes.ts`):
+   - **Record the baseline.** The storage value carries `metadataBaseline`, a digest of the metadata volume that the
+     seeder takes as its last step. Record it with the allocation. `snapshotDeclaredLinks`, `inspectTaskChanges` and
+     `exportTaskDiff` each check the metadata against it before running any Git command, and need it back
+     (`metadataBaseline`) for a recovery handle.
+   - **Before launch**, call `snapshotDeclaredLinks(storage, paths, { imageId })` with the item's declared paths.
+     For each declared symlink it records where it resolves, one part at a time as the kernel would, and the state of
+     the target and everything beneath it. A link on the way, a target that is a link, or a link inside a directory
+     target shows as `through-link`. Do not launch an item with a `through-link` declared link: a write through it
+     lands somewhere its target does not cover. Keep the result.
+   - **After the handle settles**, call `inspectTaskChanges(storage, { base, linkSnapshot, imageId })`. It returns the
+     change manifest: every difference between the work tree and `base`, read without following links, with content
+     IDs as a commit would store them. New ignored files, fifos and entries under a `.git` part are listed; a new
+     directory that `base`'s own ignore rules ignore, with no tracked entry beneath it, is one entry (`ignored: true`). It also returns `agentCommits`,
+     `metadataChanged`, `linkTargetChanges`, `nestedGitlinkContent` and `digest`. If the metadata changed, no Git
+     command runs: the manifest has `metadataChanged: true` and every other list empty.
+   - **Needs human.** The metadata is read-only to agents, so any agent commit or metadata change means a protection
+     failed. Route it to needs human, as for link target changes and nested gitlink content.
+   - **Refusals.** It refuses, and never returns part of the answer, when:
+     - there are more than 10,000 changes (a populated submodule counts as one);
+     - a name or link target it reports is longer than 1,024 bytes, is not strict UTF-8, or holds a Unicode control,
+       format, line or paragraph separator, or unassigned character (unchanged names are never checked);
+     - the recorded targets hold more than 20,000 entries;
+     - it cannot read something;
+     - `base` is not a commit in the storage, or Git fails;
+     - for a snapshot, the metadata changed since seeding (an export refuses then too).
+
+     Treat a refusal as needs human.
+   - **Both calls** run in a read-only container with no network, take `signal`, `onProcessGroup` and `timeoutMs`
+     (default 120 s), and settle only after their container is gone.
+7. After a crash or restart, call `recoverLeftovers(runnerOwner)` (`agents/recovery.ts`) while holding the
    database's single-runner lock and before admitting work. It touches only objects labelled with that runner
-   token. It removes agent containers, egress proxies, seeders, export containers and networks, and resolves once they are gone. It keeps
-   task storage whole (both volumes and the keeper) and returns one recovery handle per allocation, carrying its
-   attempt and allocation IDs. `removeTaskFilesystems` accepts a handle as it accepts the value
+   token. It removes agent containers, egress proxies, seeders, export and inspection containers and networks, and
+   resolves once they are gone. It keeps task storage whole (both volumes and the keeper) and returns one recovery
+   handle per allocation, carrying its attempt and allocation IDs. `removeTaskFilesystems` accepts a handle as it accepts the value
    `prepareTaskFilesystems` returned. D issues a handle only after checking every part's owner labels. Objects without
    a runner label (from older builds), objects of this runner that D does not create, and storage whose parts
    disagree are listed in `unowned` and never touched. An object counts as D's only with exactly one kind label,