diff --git a/.claude/agents/mesh-code-reviewer.md b/.claude/agents/mesh-code-reviewer.md
index b3fa5180..5f75602b 100644
--- a/.claude/agents/mesh-code-reviewer.md
+++ b/.claude/agents/mesh-code-reviewer.md
@@ -35,6 +35,12 @@ against the records, never limits on what you check: a ruling that contradicts a
   differs between the change and the trunk), or with a manifest it refuses or holds: the merge check would fail
   on it only after a full build.
 
+**Prove it against the live mesh, never a re-creation.** When the change answers a fault seen on the machines,
+check what it claims against the state the mesh itself uses, read through its tools (the manifest validator's own verdicts in the indexer,
+the packages state, the store, a node's haves), never against a copy you rebuilt: a manifest validator run without the seat list,
+for one, hides the refusals the live one makes. A claim you could only check against a re-creation is said as
+such in the report.
+
 Anything else (hardening, a further case, a nicer form) is a note, never a round. Read only: no edits, no git
 write, no verb that writes, never ssh. Use a temporary directory under `/var/tmp`.
 
diff --git a/.claude/agents/mesh-developer.md b/.claude/agents/mesh-developer.md
index bb740360..0f7e9540 100644
--- a/.claude/agents/mesh-developer.md
+++ b/.claude/agents/mesh-developer.md
@@ -29,7 +29,8 @@ only: never push, never open a pull request, never call a verb that writes on th
 ssh, never a shell helper for the mesh. Tests: every change carries a test that fails without it (check it);
 rows or subtests in existing tests where the repository is over the test budget the instructions set; no real
 sleeping. Run `go vet ./...`, `go vet -tags integration ./...` and `go test ./...` in every touched module as
-the running checker places siblings (playbook 07). Use a temporary directory under `/var/tmp` (TMPDIR). Before you
+the running checker places siblings (playbook 07). Use a temporary directory under `/var/tmp` (TMPDIR). Place siblings with `go.work` `use` lines or `replace` directives pointing at their worktree paths; never make a
+symbolic link anywhere (the mesh's hard rules: nobody creates symlinks), not even under `/var/tmp`. Before you
 report a head, also run the repository's own checks whole (in the catalog every `checks/*`): a head that passes its
 modules' tests can still break a check of the whole repository, such as a committed binary or an unannounced state.
 When the change touches any `module.json`, in any repository, run the manifest validator as the checker does: the