[rmcdaniel]

Refuse tracked root or nested .claude/settings.local.json before the documentation boundary opens file contents. Carry the exact central guard from .github@d3b990dac1cb076b88c95e0768cf757f39c3ded2, add root/nested ignores, and run its controls in the ordinary PR/protected-push boundary workflow. Existing content and commit-metadata scans still run for permitted trees.

Five focused test methods pass, covering tracked root/nested/newline/dependency paths, ignored untracked files, allowed near-names, a pre-existing tracked copy after an unrelated commit, and preservation of the existing content rule. The original boundary fails all five tracked-path counterfactuals. The copied guard bytes match central source exactly (SHA256 recorded in the qualification receipt). No operator settings were read; all fixtures are disposable synthetic files.

Part of durable-workflow/.github#355 . This delivers only the documentation consumer; the remaining repository rollout stays open.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Merged as cc6727d after all11 exact-head checks passed, including the source boundary, executable documentation contracts, protocol catalog, CodeQL and Sonar. Protected-main qualification is now running. This is the documentation consumer of central#355; remaining consumers stay open.