fix(#3645): tracked-source rule for planner/pattern-mapper path resolution (#3728)

* test(#3645): failing-first agent tracked-source contract rows

* fix(#3645): tracked-source rule for planner and pattern-mapper paths

* Revert "fix(#3645): tracked-source rule for planner and pattern-mapper paths"

This reverts commit 61f05e947bbdaf3b4897240c3819d349215744fb.

* fix(#3645): tracked-source rule at the spawn seam and mapper gate

* fix(#3645): review fixes - bounded block, ack merge assertion, git wording

* fix(#3645): fit the tracked-source block under the 1168 ceiling

* chore(#3645): backfill changeset pr number

---------

Co-authored-by: sim <sim@local>

agents/gsd-pattern-mapper.md

@@ -116,6 +116,17 @@ Grep("router\.(get|post|put|delete)", type: "ts")
 3. Different role, same data flow — partial match
 4. Most recently modified — prefer current patterns over legacy
 
+**Tracked-source gate (#3645):** every analog path you name must be git-TRACKED
+source, never a gitignored install/runtime mirror (e.g. `<root>/.gsd/capabilities/
+<id>/...` synced from a plugin's tracked tree). Before naming an analog whose
+file exists on disk, verify `git ls-files -- <path>` prints it (non-empty =
+tracked); if the closest analog is a gitignored mirror, substitute its tracked
+origin (e.g. `plugins/*/.gsd/capabilities/<id>/...`, or root
+`capabilities/<id>/...`). PATTERNS.md must never emit mirror paths — the
+planner builds later phases on your output, so one mirror path self-propagates
+across phases and the executor's edits die on the next capability sync. For
+files inside a nested submodule, run the check from within the submodule.
+
 ## Step 4: Extract Patterns from Analogs
 
 **Never re-read the same range.** For small files (≤ 2,000 lines), one `Read` call is enough — extract everything in that pass. For large files, multiple non-overlapping targeted reads are fine; what is forbidden is re-reading a range already in context.