@@ -78,13 +78,15 @@ codebase-memory-cli config get auto_index
 codebase-memory-cli config set auto_index true
 codebase-memory-cli config set auto_index_limit 50000
 codebase-memory-cli config set watcher_enabled false
+codebase-memory-cli config set ignore_worktrees true
 codebase-memory-cli config set doc_candidates false
 codebase-memory-cli config reset doc_candidates
 ```
 
 `doc_candidates` is `auto` by default: unset, the index mode decides. A single
 `codebase-memory-cli index --doc-candidates true|false` also overrides it for
-that index only.
+that index only. With `ignore_worktrees` on, `codebase-memory-cli index
+--index-worktree` indexes a linked git worktree for that one call.
 
 Current keys:
 
@@ -94,6 +96,7 @@ Current keys:
 | `auto_index_limit` | `50000` | Maximum file count allowed for automatic indexing of a new project. |
 | `auto_watch` | `true` | Register an active project with the retained background watcher when a warm runtime/hook integration supplies project context. A daemon-started watcher can retain registered projects after the initiating session ends until daemon shutdown, project deletion/root disappearance, or this setting is disabled. The ordinary one-shot CLI does not require this. |
 | `doc_candidates` | `auto` | Score documentation sections against code to store doc<->code candidates (the possible targets of a section, and the sections that may describe a function or file, each with a judged probability). Unset (`auto`), the index mode decides: on for `full` indexes (the default mode), off for `moderate` and `fast`. Set `true` or `false` to choose for every mode; `config reset doc_candidates` returns to `auto`. The scoring grows with sections x functions: under a second up to ~100k functions, ~15 s at ~400k, ~3 minutes on the Linux kernel. Off stores no candidates and leaves the rest of the graph unchanged; on in `fast` mode stores candidates without adding `fast`'s skipped `SIMILAR_TO` / `SEMANTICALLY_RELATED` edges. `codebase-memory-cli index --doc-candidates true|false` sets it for a single index and wins over this setting. Applies from the next index. |
+| `ignore_worktrees` | `false` | Skip linked git worktrees when indexing automatically, and refuse an explicit `codebase-memory-cli index` of one unless `--index-worktree` is passed. See [`ignore_worktrees`](#ignore_worktrees). |
 | `watch_non_git` | `false` | Poll non-Git roots with the indexer discovery rules and an adaptive file-tree scan. Skipped paths, including `.codebase-memory/`, do not trigger indexing. The first poll after daemon startup reindexes once; later changes trigger one reindex. This walks the whole tree each poll and is read when the daemon starts. |
 | `watcher_enabled` | `true` | Master switch for the retained background watcher subsystem. Set `false` to stop its poll thread/project registration. Reindex manually with `codebase-memory-cli index` when disabled. |
 | `index_max_files` | `off` | Optional maximum number of accepted source files in one discovery run. |
@@ -132,24 +135,24 @@ stored index of what is largely the same repository.
 Enable the key to keep those checkouts out of the index:
 
 ```bash
-codebase-memory-mcp config set ignore_worktrees true
+codebase-memory-cli config set ignore_worktrees true
 ```
 
 With it enabled:
 
 - automatic indexing skips a session whose root is a linked worktree;
 - the `hook-augment` context says the worktree is unindexed on purpose instead
-  of telling the agent to run `index_repository`;
-- an explicit `index_repository` call on a linked worktree is refused, and names
-  both ways forward — pass `index_worktree=true` for that one call, or turn the
-  key back off.
+  of telling the agent to run `codebase-memory-cli index`;
+- an explicit `codebase-memory-cli index` of a linked worktree is refused with an
+  error that names both ways forward: pass `--index-worktree` for that one call,
+  or run `codebase-memory-cli config set ignore_worktrees false`.
 
 The main checkout of the same repository is unaffected, as are ordinary clones
 and submodules. Detection is git plumbing only: a linked worktree's `.git` is a
 file pointing at a gitdir that contains a `commondir` entry.
 
 A subdirectory counts as the worktree it sits in. Detection walks up from the
-given path to the nearest `.git` entry, so `index_repository` on any
+given path to the nearest `.git` entry, so `codebase-memory-cli index` on any
 subdirectory of a linked worktree is refused the same way, and a session root or
 hook working directory inside one is treated as that worktree. The walk stops at
 the first `.git` it finds; a main checkout or a submodule ends it as "not a
 
@@ -283,7 +283,7 @@ for lang in $ALL_LANGS; do                      # ALL_LANGS = full 159-name list
   # --- step 2: cold index in the main channel, TIMED (key metric) ---
   t0=$(now_ms)
   CBM_BENCH_KEEP_RUNTIME=1 \
-  scripts/benchmark-index.sh ~/.local/bin/codebase-memory-mcp "$lang" /tmp/bench/"$lang" /tmp/eval-results
+  scripts/benchmark-index.sh ~/.local/bin/codebase-memory-cli "$lang" /tmp/bench/"$lang" /tmp/eval-results
   index_ms=$(( $(now_ms) - t0 ))                 # clone+index wall-clock → manifest + report (§5)
   # The harness indexes into a run-private root (#1696). CBM_BENCH_KEEP_RUNTIME leaves that
   # root behind on success and records its paths; the graph session in steps 4-7 must be
@@ -878,7 +878,7 @@ scripts/clone-bench-repos.sh /tmp/bench
 mkdir -p /tmp/eval-results
 for lang in $ALL_LANGS; do
   CBM_BENCH_KEEP_RUNTIME=1 \
-  scripts/benchmark-index.sh ~/.local/bin/codebase-memory-mcp "$lang" /tmp/bench/"$lang" /tmp/eval-results
+  scripts/benchmark-index.sh ~/.local/bin/codebase-memory-cli "$lang" /tmp/bench/"$lang" /tmp/eval-results
 done
 
 # 3. Cross-repo pass for the 9 LSP pairs (index each service dir, then cross-repo-intelligence)
 
@@ -104,10 +104,12 @@ codebase-memory-cli status --project PROJECT_NAME --verbose
 ```
 
 Confirm that `root_path` is `GRAPH_REPO`, `git.head_sha` is `SHA`, and the Git
-context is detached. `index_status` describes the project root and its current
-filesystem Git context; it does **not** by itself prove that indexed records
-were produced from that revision. The immediately preceding successful fresh
-`index_repository` call is the freshness requirement.
+context is detached. The verbose `freshness` object compares the checkout SHA
+recorded when the index was written with the live HEAD and a bounded worktree
+status; `verdict` is `current`, `stale`, or `unknown` (report-only, it never
+indexes). Treat anything other than `current` as not proven. The immediately
+preceding successful fresh `index_repository` call remains the freshness
+requirement.
 
 Finally, run one or more representative queries whose expected symbols you
 have verified directly at the recorded SHA:
 
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # Index a single benchmark repository and capture metrics.
-# Usage: benchmark-index.sh <binary> <lang> <repo_path> <results_dir>
+# Usage: benchmark-index.sh <codebase-memory-cli binary> <lang> <repo_path> <results_dir>
 
 BINARY="${1:?Usage: benchmark-index.sh <binary> <lang> <repo_path> <results_dir>}"
 LANG="${2:?}"
@@ -66,10 +66,6 @@ DAEMON_START_LOG="$BENCH_TMP/daemon-start.log"
 
 # Resolve symlinks
 REPO=$(cd "$REPO" && pwd -P)
-# One pre-escaped spelling of the path for every request below, the way the
-# soak harness builds its own: a repository path may legitimately contain a
-# quote or a backslash, and hand-built JSON turns that into a parse error.
-REPO_JSON=$(python3 -c 'import json,sys; print(json.dumps(sys.argv[1]))' "$REPO")
 
 # Elapsed time is read from a monotonic clock, never the wall clock: an NTP
 # step mid-run would otherwise skew — or negate — a figure whose whole purpose
@@ -115,7 +111,12 @@ fi
 # Index via CLI and capture timing
 START_MS=$(bench_now_ms)
 
-INDEX_JSON=$("$BINARY" index "$REPO" --mode full --json 2>/dev/null || echo '{"error":"index failed"}')
+# The path is one argv element, so a quote or backslash in it needs no escaping.
+# The exit status is kept (a bare `|| echo` would hide it) and stderr goes to
+# INDEX_ERR for the failure path below.
+INDEX_RC=0
+INDEX_JSON=$("$BINARY" index "$REPO" --mode full --json 2>"$INDEX_ERR") || INDEX_RC=$?
+[ -n "$INDEX_JSON" ] || INDEX_JSON='{"error":"index failed"}'
 
 END_MS=$(bench_now_ms)
 ELAPSED=$((END_MS - START_MS))
 
@@ -3,7 +3,7 @@
 # codebase-memory-cli binary to measure regex / BM25 search performance.
 #
 # Usage:
-#   scripts/benchmark-search-graph.sh <binary-path> <project-name>
+#   scripts/benchmark-search-graph.sh <binary-path> <repo-path>
 
 set -euo pipefail
 
@@ -30,20 +30,14 @@ if ! "$BINARY" daemon start >"$DAEMON_START_LOG" 2>&1; then
     fi
     exit 1
 fi
-# One pre-escaped spelling of the path, the way the soak harness builds its
-# own: a repository path may legitimately contain a quote or a backslash, and
-# hand-built JSON turns that into a parse error.
-REPO_JSON=$(python3 -c 'import json,sys; print(json.dumps(sys.argv[1]))' "$REPO")
 # Index and parse keep their stderr instead of discarding it: without it the
 # failure below names only its symptom, and the cause — an unreadable
-# repository, a refused daemon, a malformed envelope — is unrecoverable.
-INDEX_JSON=$("$BINARY" cli index_repository "{\"repo_path\":$REPO_JSON,\"mode\":\"full\"}" \
-    2>"$INDEX_ERR" || echo '{}')
+# repository, a refused daemon, a malformed envelope — is unrecoverable. The
+# repository path is one argv element, so a quote or backslash needs no escaping.
+INDEX_JSON=$("$BINARY" index "$REPO" --mode full --json 2>"$INDEX_ERR" || echo '{}')
 PROJECT=$(echo "$INDEX_JSON" | python3 -c "
 import json, sys
 d = json.load(sys.stdin)
-if 'content' in d:
-    d = json.loads(d['content'][0]['text'])
 print(d.get('project', ''))
 " 2>>"$INDEX_ERR" || echo "")
 if [ -z "$PROJECT" ]; then
 
@@ -23,6 +23,8 @@
 #include "foundation/constants.h"
 #include "foundation/mem.h"
 #include "foundation/platform.h"
+#include "foundation/str_util.h"
+#include "git/git_context.h"
 #include "pipeline/pipeline.h"
 #include "yyjson/yyjson.h"
 
@@ -1715,6 +1717,53 @@ static bool ha_invocation_supported(ha_lifecycle_dialect_t dialect, const char *
 static CBM_TLS int *g_ha_worktree_gate_counter = NULL;
 #endif
 
+/* Reads ignore_worktrees from the runtime config store only when the store
+ * already exists: the hook must not create _config.db as a side effect, and
+ * with the key off (the default) it does nothing else for worktrees. */
+static bool ha_ignore_worktrees_enabled(void) {
+    const char *cache_dir = cbm_resolve_cache_dir();
+    if (!cache_dir || !cache_dir[0]) {
+        return false;
+    }
+    char db_path[4096];
+    int written = snprintf(db_path, sizeof(db_path), "%s/" CBM_CONFIG_DB_FILENAME, cache_dir);
+    if (written <= 0 || (size_t)written >= sizeof(db_path) || !cbm_file_exists(db_path)) {
+        return false;
+    }
+    cbm_config_t *cfg = cbm_config_open(cache_dir);
+    bool enabled = cbm_config_get_bool(cfg, CBM_CONFIG_IGNORE_WORKTREES, false);
+    cbm_config_close(cfg);
+    return enabled;
+}
+
+/* Project resolution once ignore_worktrees is on; the caller runs this only
+ * after reading the key. A symlink alias has no .git of its own, so cwd is
+ * canonicalized as the index operation does before the same gate. A linked
+ * worktree is refused even inside an indexed checkout or another linked
+ * worktree, so a match is kept only when its root belongs to this cwd's own
+ * linked worktree, not a parent graph. */
+static char *ha_resolve_project_ignoring_worktrees(const char *cwd, bool *drop_ancestor,
+                                                   bool *worktree_ignored) {
+#ifdef CBM_CLI_ENABLE_TEST_API
+    if (g_ha_worktree_gate_counter) {
+        (*g_ha_worktree_gate_counter)++;
+    }
+#endif
+    char canonical_cwd[4096];
+    if (ha_canonical_path(cwd, canonical_cwd, sizeof(canonical_cwd))) {
+        cwd = canonical_cwd;
+    }
+    char project_root[4096];
+    project_root[0] = '\0';
+    char *project = ha_resolve_indexed_project_with_root(cwd, project_root, sizeof(project_root));
+    bool linked = cbm_git_is_linked_worktree(cwd);
+    /* Drop a parent graph without a second free(): this file's raw free count
+     * is ratcheted, and the caller's single free(project) still releases it. */
+    *drop_ancestor = linked && project && !cbm_git_same_linked_worktree(cwd, project_root);
+    *worktree_ignored = linked && (!project || *drop_ancestor);
+    return project;
+}
+
 static char *ha_lifecycle_json_from_root(const char *session_root, yyjson_val *root,
                                          const char *forced_event, ha_lifecycle_dialect_t dialect) {
     if (!root || !yyjson_is_obj(root)) {
@@ -1728,10 +1777,14 @@ static char *ha_lifecycle_json_from_root(const char *session_root, yyjson_val *r
     char cwd_buffer[4096];
     const char *cwd =
         ha_normalized_cwd_with_root(root, session_root, cwd_buffer, sizeof(cwd_buffer));
-    char *project = cwd ? ha_resolve_indexed_project(cwd) : NULL;
-    /* Upstream #1430 worktree gate; set by the ignore_worktrees resolution. */
     bool drop_ancestor = false;
     bool worktree_ignored = false;
+    char *project = NULL;
+    if (cwd && ha_ignore_worktrees_enabled()) {
+        project = ha_resolve_project_ignoring_worktrees(cwd, &drop_ancestor, &worktree_ignored);
+    } else if (cwd) {
+        project = ha_resolve_indexed_project(cwd);
+    }
 
     char context[2048];
     const char *scope = "Session";
 
@@ -18,6 +18,7 @@
 #include "foundation/platform.h"
 #include "foundation/str_util.h"
 #include "foundation/workspace.h"
+#include "git/git_context.h"
 #include "pipeline/artifact.h"
 #include "pipeline/pipeline.h"
 #include "store/store.h"
@@ -1319,6 +1320,27 @@ static bool index_call_mode_arg(const char *json, const char *key, bool *out) {
     return valid;
 }
 
+/* ignore_worktrees: an explicit index of a linked worktree is refused, not
+ * silently skipped; index_worktree overrides it for this call. Fills error and
+ * returns true on refusal. Reads no config unless repo_path is a linked
+ * worktree. */
+static bool index_worktree_refused(const char *json, const char *repo_path, char *error,
+                                   size_t error_size) {
+    if (index_bool_arg(json, "index_worktree") || !cbm_git_is_linked_worktree(repo_path)) {
+        return false;
+    }
+    cbm_config_t *config = cbm_config_open(cbm_resolve_cache_dir());
+    bool ignore_worktrees = cbm_config_get_bool(config, CBM_CONFIG_IGNORE_WORKTREES, false);
+    cbm_config_close(config);
+    if (ignore_worktrees) {
+        snprintf(error, error_size,
+                 "repo_path is a linked git worktree and ignore_worktrees is enabled. Pass "
+                 "--index-worktree to index it anyway, or run: codebase-memory-cli config set "
+                 "ignore_worktrees false");
+    }
+    return ignore_worktrees;
+}
+
 cbm_operation_result_t cbm_index_operation_execute(const char *args_json,
                                                    const cbm_operation_runtime_t *runtime) {
     const char *json = args_json ? args_json : "{}";
@@ -1360,7 +1382,8 @@ cbm_operation_result_t cbm_index_operation_execute(const char *args_json,
                                    : getenv("CBM_ALLOWED_ROOT");
     char boundary[CBM_SZ_1K];
     if (!cbm_workspace_root_allowed(repo_path, cbm_workspace_home_dir(), cbm_workspace_cache_dir(),
-                                    allowed_root, boundary, sizeof(boundary))) {
+                                    allowed_root, boundary, sizeof(boundary)) ||
+        (!status_mode && index_worktree_refused(json, repo_path, boundary, sizeof(boundary)))) {
         free(repo_path);
         return index_text_error(boundary);
     }