diff --git a/AGENTS.md b/AGENTS.md
index ae12100b..95689a82 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,7 +74,7 @@ UniDesk 以主 server 为统一入口。本文件只做自动加载的顶级索
 
 - CLI 与 route: `docs/reference/cli.md`。
 - 文档治理与过程蒸馏: `docs/reference/docs-governance.md`。
-- DevOps hygiene、source truth、worktree 语义合并与清理: `docs/reference/devops-hygiene.md`。
+- DevOps hygiene、source truth、worktree 稳定本地状态、语义合并与清理: `docs/reference/devops-hygiene.md`。
 - 开发环境和 D601/Master 边界: `docs/reference/dev-environment.md`。
 - HWLAB: `docs/reference/hwlab.md`。
 - AgentRun: `docs/reference/agentrun.md`。
diff --git a/docs/reference/devops-hygiene.md b/docs/reference/devops-hygiene.md
index e24d1309..ab0c243d 100644
--- a/docs/reference/devops-hygiene.md
+++ b/docs/reference/devops-hygiene.md
@@ -52,6 +52,14 @@ If a manual repair is needed to unblock the platform, the durable fix must be co
 
 固定主 repo 是 source truth anchor，不是源码/运行面 scratch 区。会产生源码、配置、issue closeout、部署脚本、验收产物或高风险 dad-dev / post-task 交付的工作，执行前必须先从目标 fixed repo 的最新 remote/base 创建任务专属 `.worktree/<task>`，后续编辑、验证、提交、push 和受控 CLI 写操作都在该 worktree 内完成。UniDesk 任务 worktree 必须通过 `bun scripts/cli.ts dev-env worktree add .worktree/<task> --branch <branch> [--from origin/master]` 创建，让 `.worktreecopy` 白名单内的本地配置自动复制到新 worktree；fixed repo 只用于 `git fetch`、`git status`、快进同步、读取规则和这个受控创建入口。其中已有的并行未提交修改默认保持不动，不纳入当前任务，也不要用 reset、checkout 或删除来“清理”。
 
+## Worktree-Independent Local State
+
+Tracked source, YAML and scripts belong to the selected checkout; operator credentials and mutable runtime state do not. UniDesk's canonical owner-level roots are `/root/.unidesk/.env` for credentials and `/root/.unidesk/.state` for mutable state, caches, generated artifacts and Secret source files. YAML `sourceRef`, CLI path configuration and source defaults that consume these materials must use those fixed absolute roots. They must not derive the path from `process.cwd()`, the module's task-worktree root, or a relative `.env`/`.state` path.
+
+`/root/unidesk/.env` and `/root/unidesk/.state` are compatibility symlinks to the canonical owner-level roots. They preserve old main-worktree entrypoints but are not source authority. `.worktreecopy` must not copy either tree, and task worktrees must not receive private copies or task-specific compatibility links. A command that fails only because a task worktree lacks `.env`, `.state`, `secrets`, cache or generated state has a path-contract defect: fix the owning config/helper to consume the canonical absolute path before continuing the original operation.
+
+When diagnosing a missing worktree file, first classify ownership. A tracked file is repaired through remote/base synchronization; an ephemeral test fixture uses an explicit temporary directory; durable local credentials or state move to the canonical owner-level root and are referenced absolutely. Never repair the latter by copying secrets/state into every worktree, silently falling back to the current directory, embedding values in Git, or maintaining divergent per-worktree data. A migration must preserve existing contents, keep the canonical directories owner-only, verify the resolved symlink target and data size, and leave the main-repo compatibility symlink in place.
+
 开始使用任何固定主/目标 worktree 时，如果发现它落后 remote/base，必须先完成 source-truth 同步再继续分析或创建任务 worktree：若工作区有脏改，先用 `git stash push -u` 保存当前脏改（包括 untracked），再执行 `git pull --ff-only <remote> <branch>` 快进，随后 `git stash apply` 并按快进后的语义合并冲突或重复内容；若工作区 clean，则直接 `git pull --ff-only`。这个 stash 是保护并行修改以便固定主 repo 回到最新 source truth，不是清理、丢弃或隐式接管并行任务；apply 后只提交当前任务明确相关的文件，其他并行修改继续保留原状。不得在落后的固定 worktree 上继续源码分析、创建任务分支、修改代码或给 issue 写基于旧源码的结论。
 
 固定 worktree 对齐 remote 是硬前置，不是建议项。`git status` clean、运行面 healthy、CI/CD snapshot 对齐或历史 PipelineRun 通过，都不能替代固定工作区自身的 remote/base 对齐检查；只要 HEAD 与声明 remote/base 不一致、`remoteUpToDate=false`、ahead/behind/diverged 或受控 source-workspace 状态返回 not-ready，就必须先修复固定工作区或改用从最新 remote/base 创建的干净 anchor。禁止从未对齐的固定 worktree 创建任务 worktree、开测试 PR、运行 repo 内验证或写 closeout 结论。
diff --git a/docs/reference/nc01.md b/docs/reference/nc01.md
index af5e1d4d..bd448fd7 100644
--- a/docs/reference/nc01.md
+++ b/docs/reference/nc01.md
@@ -38,7 +38,7 @@ When exporting legacy PostgreSQL data, do not stream Markdown bodies as plain JS
 
 ## GitHub Token
 
-The local GitHub token source is `/root/.unidesk/.env/gh_token.txt`. It must be stored as a bare token and consumed through controlled YAML/sourceRef or temporary non-printing credential helpers. Do not place the token in command argv, logs, committed files, or rendered manifests. `/root/unidesk/.env` is only a compatibility symlink to the canonical owner directory; worktrees must use the absolute source path instead of copying credentials.
+The local GitHub token source is `/root/.unidesk/.env/gh_token.txt`. It must be stored as a bare token and consumed through controlled YAML/sourceRef or temporary non-printing credential helpers. Do not place the token in command argv, logs, committed files, or rendered manifests. NC01 follows the canonical owner-level state and compatibility-symlink contract in [Worktree-Independent Local State](devops-hygiene.md#worktree-independent-local-state); worktrees consume `/root/.unidesk/.env` and `/root/.unidesk/.state` through fixed absolute paths instead of copied local trees.
 
 ## Public Exposure