FUTURE: mm-worktree-task should enforce the worktree boundary

FUTURE.md

@@ -75,3 +75,15 @@ This is where the user's explicit ask sits, and where it's easy to go wrong:
 - **Idea:** `mm-worktree-task <slug> <brief-file> [--tools "Bash(npx *)"] [--timeout 1800]`: creates `.claude/worktrees/mm-<slug>` on branch `mm/<slug>` from main, prepends the preamble, launches `ask-minimax-run` detached with `--add-dir <report-dir>` so the report can be written outside the worktree, appends `slug rc elapsed` to a launch log, and prints the paths to poll. `--dryrun` shows the assembled prompt and the command.
 - **Also fix in `ask-minimax-run`:** set `CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1` (or `CLAUDE_CODE_MAX_CONTEXT_TOKENS`) — `MiniMax-M3` is not in the Claude Code model catalog, so every run warns and pins auto-compact at 200k.
 - **Depends on:** spec + test per repo conventions; agreement on the preamble text (keep it in `data/mm-worktree-task/preamble.md`).
+
+## `mm-worktree-task` — enforce the worktree boundary
+
+- **Problem:** 2026-09-24, round 1 of `spec-revocation-check` wrote untracked drafts into the MAIN
+  small-scripts checkout although the brief forbade it; the report did not mention it. The worktree
+  boundary is advisory. (Same class as the 2026-09-22 hugo-accelerator checkout deletion.)
+- **Idea:** record `git status --porcelain` (plus untracked) of the main checkout before launch, diff it
+  after the sub-session exits, and append a `BOUNDARY VIOLATION` section to the result file (like the
+  `--gate` MISMATCH flag). Stronger: run the sub-session under a sandbox that mounts only the worktree
+  writable (bubblewrap / landlock).
+- **Open questions:** siblings the agent could reach (read-only exports already recommended); how to
+  treat legitimate writes to `/run/user/1000/mm-worktree-task/<repo>/`.