chore(deps): bump criterion from 0.5.1 to 0.8.2

.githooks/README.md

@@ -12,12 +12,36 @@ never seems to fire, check that setting first.
 
 | Hook | What it does |
 |---|---|
-| `pre-commit` | Runs `cargo fmt` and stages the result, so CI's fmt check can't fail. |
+| `pre-commit` | Runs `cargo fmt` and stages the result, so CI's fmt check can't fail. Then runs the branch-aware root-md allowlist guard (see below) — on `develop`/`master`, `AGENTS.md`/`CLAUDE.md` are not allowlisted, so (re)introducing them via a direct commit or conflict resolution is blocked. |
+| `pre-merge-commit` | Runs the same root-md allowlist guard on the merge result — a clean merge never invokes `pre-commit`, so this is the gate that stops `AGENTS.md`/`CLAUDE.md` riding a clean feature→`develop` merge onto the integration branch. |
 | `pre-push` | Blocks direct pushes to `master`; runs the QC gate (skipped when the branch changes no Rust); scans tracked files for customer references. |
-| `post-checkout` | Creates `AGENTS.md` from `AGENTS.develop.md` on branch switch, if absent. |
+| `post-checkout` | Branch-local agent-file lifecycle: on a feature branch, creates `AGENTS.md` from `AGENTS.develop.md` plus the `CLAUDE.md` pointer when absent; on `develop`/`master`, removes untracked `AGENTS.md`/`CLAUDE.md` leftovers. No-op on detached HEAD. |
 
 Any hook can be bypassed with `git push --no-verify` / `git commit --no-verify`.
 
+## Root-md allowlist guard (`pre-commit`)
+
+Agents love dropping `*.md` files (diagnoses, plans, worklogs, test scenarios)
+at the repo root. The `pre-commit` hook rejects any commit that **introduces**
+(added/copied/renamed) a root-level `*.md` outside this allowlist:
+
+- `AGENTS.develop.md` — agent instructions reference (always allowed)
+- `AGENTS.md`, `CLAUDE.md` — branch-local agent working files: allowlisted on
+  feature branches only. They are dropped at feature finalization; on
+  `develop`/`master` introducing them is rejected, merge commits included.
+- `README.md`, `README_CSharp.md` — user-facing docs
+- `CHANGELOG.md`, `RELEASING.md` — release infrastructure
+
+Everything else belongs in **`.docs/`** (gitignored, local-only) — see
+AGENTS.develop.md, section *Root file hygiene (markdown)*. The guard itself
+lives in [`lib/root-md-guard.sh`](lib/root-md-guard.sh), shared by
+`pre-commit` and `pre-merge-commit`; its behavior is pinned by
+`scripts/test-githooks.sh`. Only introductions are
+checked: modifying an already-tracked stray is only possible after a
+deliberate `--no-verify` bypass, where the file itself — not the commit — is
+the violation. Dot-folders (`.githooks/`, `.github/`, `.claude/`, …) are out
+of scope: a root-level file cannot be inside one.
+
 ## `customer-patterns.local`
 
 The `pre-push` leak scan reads its patterns from `.githooks/customer-patterns.local`

.githooks/lib/root-md-guard.sh

@@ -0,0 +1,67 @@
+# root-md-guard.sh — shared root-md allowlist guard (sourced, never executed).
+# Used by pre-commit (direct commits, conflict resolutions) and
+# pre-merge-commit (clean merges never invoke pre-commit).
+#
+# The repo root keeps only its sanctioned markdown files (AGENTS.develop.md,
+# section "Root file hygiene (markdown)"). Anything else — diagnoses, plans,
+# test scenarios, worklogs — belongs in .docs/ (gitignored, local-only).
+#
+# The allowlist is branch-aware: AGENTS.md and CLAUDE.md are branch-local
+# working files, dropped at feature finalization — on develop/master they are
+# NOT allowlisted, so introducing them there is rejected, clean merge or not.
+#
+# Only introductions are checked (added/copied/renamed). Modifying an already
+# tracked stray is only possible after a deliberate --no-verify bypass — the
+# file itself is the violation then, and review catches it. Dot-folders
+# (.githooks/, .github/, .claude/, ...) are out of scope by construction: a
+# root-level file cannot be inside one.
+#
+# bash (not sh): process substitution. macOS bash 3.2 compatible.
+
+root_md_guard() {
+    # git branch --show-current: empty on detached HEAD (unborn HEAD prints
+    # the branch name — harmless feature-branch treatment). rev-parse
+    # --abbrev-ref would print "HEAD" when detached — creating branch-local
+    # files there would later block rebase/bisect checkouts of commits that
+    # track them — and exits 128 on unborn HEAD, killing a set -e caller
+    # mid-hook.
+    BRANCH=$(git branch --show-current 2>/dev/null || true)
+    case "$BRANCH" in
+        develop|master)
+            ALLOWED_ROOT_MD="AGENTS.develop.md README.md README_CSharp.md CHANGELOG.md RELEASING.md"
+            ;;
+        *)
+            ALLOWED_ROOT_MD="AGENTS.md AGENTS.develop.md CLAUDE.md README.md README_CSharp.md CHANGELOG.md RELEASING.md"
+            ;;
+    esac
+
+    while IFS= read -r staged; do
+        # root level = no slash anywhere in the staged (post-rename) path
+        case "$staged" in
+            */*) continue ;;
+        esac
+        # tr, not ${var,,}: the parameter-expansion lowercase needs bash >= 4 and
+        # stock macOS still ships bash 3.2, where it is a fatal "bad substitution"
+        # that would block EVERY commit containing a root-level file.
+        case "$(printf '%s' "$staged" | tr 'A-Z' 'a-z')" in
+            *.md) ;;
+            *) continue ;;
+        esac
+        for allowed in $ALLOWED_ROOT_MD; do
+            [ "$staged" = "$allowed" ] && continue 2
+        done
+        echo ""
+        echo "guard: BLOCKED — root-level '$staged' is not on the md allowlist for branch '${BRANCH:-detached}'."
+        echo "  Root markdown is limited to: $ALLOWED_ROOT_MD"
+        echo "  AGENTS.md/CLAUDE.md are branch-local: feature branches only, dropped at finalization."
+        echo "  Diagnoses, plans, worklogs and test scenarios belong in .docs/ (gitignored)."
+        echo "  See AGENTS.develop.md, section \"Root file hygiene (markdown)\"."
+        echo "  Deliberate? Use: git commit --no-verify / git merge --no-verify"
+        echo ""
+        return 1
+# core.quotePath=false: with the default (true), git C-quotes non-ASCII paths
+# (DIAGNOSE_ü.md -> "DIAGNOSE_\303\274.md"), and the quoted trailing `"` makes
+# the *.md pattern miss — a stray with a non-ASCII name would sail through.
+    done < <(git -c core.quotePath=false diff --cached --name-only --diff-filter=ACR)
+    return 0
+}

.githooks/post-checkout

@@ -1,16 +1,51 @@
 #!/bin/sh
-# post-checkout hook — auto-create AGENTS.md from AGENTS.develop.md on branch switch.
+# post-checkout hook — branch-local AGENTS.md/CLAUDE.md lifecycle on branch switch.
 # Runs after: git checkout, git switch, git checkout -b
 #
-# Only copies if AGENTS.md does not yet exist — never overwrites an existing work plan.
+# Feature branches: create AGENTS.md from AGENTS.develop.md plus the CLAUDE.md
+# pointer when absent — never overwrites an existing work plan (plans are
+# tracked on the branch and restored by git itself on switch).
+#
+# develop/master: these branches carry NO AGENTS.md/CLAUDE.md (dropped at
+# feature finalization). Untracked local leftovers are deleted so a stale plan
+# from a previous feature checkout cannot leak into integration-branch work.
 #
 # Installed via `git config core.hooksPath .githooks` — see .githooks/README.md.
 
 AGENTS_DEVELOP="AGENTS.develop.md"
 AGENTS_MD="AGENTS.md"
+CLAUDE_MD="CLAUDE.md"
 
 # $3 is 1 for branch checkout, 0 for file checkout — only act on branch switches
-if [ "$3" = "1" ] && [ -f "$AGENTS_DEVELOP" ] && [ ! -f "$AGENTS_MD" ]; then
-    cp "$AGENTS_DEVELOP" "$AGENTS_MD"
-    echo "[hook] Created AGENTS.md from AGENTS.develop.md"
-fi
+[ "$3" = "1" ] || exit 0
+
+BRANCH=$(git branch --show-current 2>/dev/null)
+
+# Empty on detached HEAD (bisect/rebase steps) — no lifecycle there: files
+# created on a detached HEAD would block later checkouts of any commit that
+# tracks them ("untracked working tree files would be overwritten").
+# (On unborn HEAD git prints the branch name — harmless feature-branch
+# treatment, self-heals on the next develop/master checkout.)
+[ -n "$BRANCH" ] || exit 0
+
+case "$BRANCH" in
+    develop|master)
+        for f in "$AGENTS_MD" "$CLAUDE_MD"; do
+            # only untracked leftovers — a tracked file is managed by git itself
+            if [ -f "$f" ] && ! git ls-files --error-unmatch "$f" >/dev/null 2>&1; then
+                rm -f "$f"
+                echo "[hook] Removed untracked $f (integration branches keep no agent files)"
+            fi
+        done
+        ;;
+    *)
+        if [ -f "$AGENTS_DEVELOP" ] && [ ! -f "$AGENTS_MD" ]; then
+            cp "$AGENTS_DEVELOP" "$AGENTS_MD"
+            echo "[hook] Created AGENTS.md from AGENTS.develop.md"
+        fi
+        if [ ! -f "$CLAUDE_MD" ]; then
+            printf 'Read AGENTS.md.\n' > "$CLAUDE_MD"
+            echo "[hook] Created CLAUDE.md pointer"
+        fi
+        ;;
+esac

.githooks/pre-commit

@@ -1,7 +1,8 @@
 #!/bin/bash
-# pre-commit hook: format Rust code only.
+# pre-commit hook: format Rust code + root-md allowlist guard.
 #
-# Runs `cargo fmt` and stages any reformatting so CI's fmt-check can't fail.
+# 1. Runs `cargo fmt` and stages any reformatting so CI's fmt-check can't fail.
+# 2. Rejects commits that introduce a root-level *.md outside the allowlist.
 #
 # Installed via `git config core.hooksPath .githooks` — see .githooks/README.md.
 #
@@ -27,4 +28,11 @@ if [ -n "$FMT_CHANGED" ]; then
     echo "pre-commit: staged rustfmt changes ($FMT_CHANGED)"
 fi
 
+# --- root-md allowlist guard -------------------------------------------------
+# Branch-aware (AGENTS.md/CLAUDE.md are feature-branch-only, dropped at
+# finalization). Shared with pre-merge-commit via lib/root-md-guard.sh —
+# rationale and allowlist live there; see .githooks/README.md.
+. "$(dirname "$0")/lib/root-md-guard.sh"
+root_md_guard || exit 1
+
 exit 0

.githooks/pre-merge-commit

@@ -0,0 +1,11 @@
+#!/bin/bash
+# pre-merge-commit hook — branch-aware root-md allowlist guard on the merge
+# result. A CLEAN merge never invokes pre-commit, so without this gate
+# AGENTS.md/CLAUDE.md could ride a clean feature→develop merge back onto the
+# integration branch.
+#
+# Installed via `git config core.hooksPath .githooks` — see .githooks/README.md.
+
+. "$(dirname "$0")/lib/root-md-guard.sh"
+root_md_guard || exit 1
+exit 0

.github/dependabot.yml

@@ -0,0 +1,24 @@
+# Weekly dependency refresh — replaces reactive minimum-fix patching.
+# Grouped so minor+patch ride one PR; majors stay individual for review.
+# target-branch: dependabot always opens (and rebases) PRs against develop —
+# without it the base resets to the repo default (master) on every rebase.
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      cargo-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/agent-files-check.yml

@@ -0,0 +1,55 @@
+name: Agent files check
+
+# AGENTS.md and CLAUDE.md are branch-local agent working files: tracked on
+# feature branches while building, dropped at finalization (git rm before the
+# PR — see AGENTS.develop.md, "For agents starting a new feature branch").
+# They must never reach develop or master.
+#
+# Locally the branch-aware pre-commit / pre-merge-commit hooks enforce this;
+# this check is the server-side net for PRs merged via the GitHub UI or from
+# clones without hooks installed (core.hooksPath unset = no hooks run at all).
+#
+# Visible PR check (red X), consistent with changelog-check: this repo's
+# merges routinely go through `gh pr merge --admin`, which would bypass a
+# required check just the same. No label bypass exists on purpose: the only
+# correct fix is dropping the files from the PR head.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [develop, master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agent-files-check-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  no-agent-files:
+    runs-on: ubuntu-latest
+    steps:
+      # pin@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: PR head must not carry root AGENTS.md / CLAUDE.md
+        env:
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          BAD=""
+          for f in AGENTS.md CLAUDE.md; do
+            if git cat-file -e "$HEAD_SHA:$f" 2>/dev/null; then
+              BAD="$BAD $f"
+              echo "::error::$f exists at the PR head — branch-local agent file, must not reach develop/master."
+            fi
+          done
+          if [ -n "$BAD" ]; then
+            echo "::error::Run the branch finalization step: git rm$BAD, commit, push."
+            exit 1
+          fi
+          echo "No root AGENTS.md/CLAUDE.md at the PR head — good."

.github/workflows/bump-develop.yml

@@ -26,17 +26,19 @@ name: Bump develop version
 #      actions/create-github-app-token instead of the secret below.
 # Until CI_PAT exists, every run fails fast at checkout (empty token).
 
+# `pull_request_target` (not `pull_request`): fork PRs run `pull_request`
+# WITHOUT repo secrets, so CI_PAT is empty and checkout fails
+# ("Input required and not supplied: token" — seen on fork PR #220).
+# pull_request_target runs in base-repo context WITH secrets. Safe here: the
+# workflow file comes from develop (never from the PR) and this job checks out
+# `ref: develop` only — the PR's code is never executed or checked out.
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
     branches: [develop]
 
-permissions:
-  contents: write
-
-# Serialize concurrent merges so each one gets its own bump. cancel-in-progress:
-# false → a queued run waits, then re-reads a fresh develop (already carrying the
-# previous bump) before bumping again. So N rapid merges → N patch bumps.
+# Aikido 30640694: no workflow-level permissions; the single job below gets
+# exactly what it needs (contents:write for the bump push).
 concurrency:
   group: bump-develop
   cancel-in-progress: false
@@ -46,6 +48,8 @@ jobs:
     # Only when the PR was actually merged (closed-without-merge is a no-op).
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout develop
         # pin@v4
@@ -56,6 +60,9 @@ jobs:
           # the "block develop" ruleset may push to develop. See SETUP note above.
           # Passing `token:` also persists those creds so `git push` below works.
           token: ${{ secrets.CI_PAT }}
+          # Aikido 35039595: explicit intent — this job DOES push the bump commit,
+          # so credentials must persist (see "How do I fix it?" guidance).
+          persist-credentials: true
 
       - name: Compute next patch version
         id: ver