chore: stop iCloud duplicates and internal docs from reaching the index

[JasonYeYuhe]

Follow-up to the git add -A incident of 2026-08-07 (#421, closed). That PR pushed 176 untracked files to this public repo. scripts/check_no_internal_docs.sh caught it and the branch was deleted, but the commit is still reachable through GitHub's PR refs — and nothing upstream of that gate had changed, so the same command would do the same thing again today.

What was actually still broken

I re-fetched the closed PR's head and measured it rather than trusting the summary:

class	count	still unignored before this PR
internal documents matching the CI gate's patterns	141	all 141
iCloud Drive " 2" / " 3" collision copies	21	all 21
every path in that commit	176	176

Two distinct holes:

Root-anchoring. The 2026-07-31 ignore list says "root-anchored so docs/ content is unaffected". 50 of the 141 documents were not at the root — 49 under docs/, plus MachineRootHelper/SHIP_RUNBOOK.md. The anchoring was the hole.

PROJECT_FIX_* had no entry at all — and it was 91 of the other 141. The largest single class, and the one the working habit still produces.

The patterns are now un-anchored and mirror LAYER 1 of check_no_internal_docs.sh, so the ignore file and the gate block the same set instead of each covering what the other misses. Only the gate matches case-insensitively; the comment says why that asymmetry is left in place rather than papered over.

iCloud duplicates. 21 files, including scripts/check_no_internal_docs 2.sh — a stale copy of the gate itself — and two duplicates of migrate_v0.72_provider_accounts. That last one is the shape that actually costs something later: migrations are matched by number and are the only record of what has run against production, so a second v0.72 turns "did v0.72 run?" into "which v0.72?" (AGENTS.md).

Verification

• Zero tracked files are masked: git ls-files -z | xargs -0 git check-ignore returns nothing.
• 19 positive cases confirmed ignored, 11 negative cases (README.md, docs/index.html, scripts/dev/doctor.sh, submit_v1_10_8.py, a future migrate_v0.74_*.sql, …) confirmed not ignored.
• Directory-level dupes (spike/Sources 2/) and extensionless ones (test_codable 2) covered, both seen in the bad commit.
• check_no_internal_docs.sh ✓ · check_migration_numbers.sh ✓ (73 migrations, all unique).
• Trade-off accepted knowingly: a future legitimate Figure 2.png will be ignored — but git add on it fails out loud ("paths are ignored by one of your .gitignore files") rather than dropping it silently, and git add -f is the override.

Working-tree cleanup (not in this diff — untracked files)

14 untracked files deleted from the working tree, each diffed against its canonical sibling first. 12 were byte-identical iCloud copies. The two that were not:

• scripts/dev/doctor 2.sh — a strict subset of tracked doctor.sh; its unique content is the pre-fix(doctor): report a locked screen as locked, not as a missing credential #421 "the profile evaporated" wording that the locked-screen fix replaced.
• CLI Pulse Bar/CLI Pulse Bar/AnonymousTelemetryCoordinator.swift — the pre-fix: activation was never sent on the launch that shows the disclosure #418 copy left behind at the old app-target path when the type moved to CLIPulseCore. Superseded (the CLIPulseCore version adds the public API and the test seam) and referenced zero times in project.pbxproj, so it was never compiled.

Three untracked files were deliberately kept and are now ignored, with a comment each explaining why: xcode_devid_fan_embed.sh (local-only build phase wired by an uncommitted pbxproj edit), scripts/dev/*_tmp.* (AI review prompts that quote internal DEV_PLANs while carrying none of the names the gate greps for), and submit_v1_10_7.py (a dead 2026-04 one-off, nobody's duplicate — safe to delete, so not deleted here).

One thing this PR does not fix

~50 internal documents at the repo root (DEV_PLAN_*, HANDOFF_*, CODEX_*, PROJECT_REVIEW_*, …) exist on this machine and are not in cli-pulse-internal — I checked all 175 blobs in that repo, not just private-repo-root-docs/. They are safely ignored here, so they are not a staging hazard, but this working tree is currently their only copy outside the pre-2026-07-31 git history. Left in place deliberately; deleting them would have destroyed the only copy.

🤖 Generated with Claude Code