tenant.openagents/omega

diff --git a/script/bundle-omega-rc b/script/bundle-omega-rc
index cfe4cd68d5..28beaaf725 100755
--- a/script/bundle-omega-rc
+++ b/script/bundle-omega-rc
@@ -874,13 +874,21 @@ import subprocess
874874 from pathlib import Path
875875 
876876 
877-def worktree_is_dirty() -> bool:
878-    """Ask git whether the tree this candidate was built from was recorded.
879-
880-    `require_clean_checkout` refuses to start a build from a dirty tree, so
881-    this normally answers false — but it has to be *read*, not asserted. It was
882-    a Python literal, which made a provenance field that cannot disagree with
883-    the build no matter what the tree held.
877+def worktree_state() -> tuple[bool, list[str]]:
878+    """Read whether the tree this candidate was built from was recorded.
879+
880+    `require_clean_checkout` refuses to *start* from a dirty tree, so anything
881+    seen here appeared during the build. This runs after packaging, and the
882+    build generates `assets/licenses.md` through `script/generate-licenses`,
883+    which is untracked — so every candidate recorded `dirty: true` on the
884+    strength of its own output.
885+
886+    That reads as "the commit does not determine these bytes", which is the
887+    opposite of true, and an independent reviewer correctly treated it as
888+    weakening the source binding. A bare boolean cannot tell a reviewer which
889+    reading applies, so the entries are recorded beside it: a tracked
890+    modification really does break the commit-to-bytes binding, an untracked
891+    build output does not.
884892     """
885893     status = subprocess.run(
886894         ["git", "status", "--porcelain"],
@@ -888,9 +896,12 @@ def worktree_is_dirty() -> bool:
888896         text=True,
889897         check=True,
890898     )
891-    return bool(status.stdout.strip())
899+    entries = [line for line in status.stdout.splitlines() if line.strip()]
900+    tracked = [line for line in entries if not line.startswith("??")]
901+    return bool(tracked), entries
892902 
893903 
904+source_is_dirty, worktree_entries = worktree_state()
894905 icons = json.loads(os.environ["OMEGA_RC_ICON_JSON"])
895906 packaged_bindings = json.loads(os.environ["OMEGA_RC_PACKAGED_BINDINGS_JSON"])
896907 upstream = os.environ.get("OMEGA_RC_UPSTREAM_COMMIT") or None
@@ -932,7 +943,11 @@ record = {
932943     "source": {
933944         "commit": os.environ["OMEGA_RC_COMMIT"],
934945         "upstream_commit": upstream,
935-        "dirty": worktree_is_dirty(),
946+        # True only for a *tracked* modification, which is what actually
947+        # breaks the commit-to-bytes binding. The entries are recorded beside
948+        # it so a reader never has to guess which kind they are looking at.
949+        "dirty": source_is_dirty,
950+        "worktree_entries": worktree_entries,
936951         "repository": "https://github.com/OpenAgentsInc/omega",
937952     },
938953     "toolchains": {