What broke
The primary checkout was six commits behind the remote, and a mission was launched with a flag that had been removed on the branch it ran from. The gap was found by a reader noticing one flag, which is not a control. Another day, an uncommitted edit to the capability document became the policy every mission was validated against, and it existed on one disk.
The rule it paid for
Fetch first; resolve the governance ref to a commit once; read every policy out of that commit; create the worktree from the same commit; print the SHA on every path.