Planning-seat Claude enforces workflow documents it never read — mounted in its own environment, one tool call away, addressed to it by name

Setup: two-seat operation. A claude.ai instance acts as planner/overseer writing work orders; Claude Code executes them against a local repository. The repository has a documented master workflow (step-by-step process with per-step gates and sub-skills) and a CLAUDE.md-mandated controller check. Critically: the planner had these skill files mounted read-only in its own environment — including several written specifically for the planning seat, several documenting the planner's own prior failures with dates and incident names.

The planner read none of them until the operator asked, point-blank and late in the session, "did you read the workflow yet?"

What happened, in order

1. Fluency substituted for grounding. The planner opened the arc by authoring a confident multi-step order — complete with the project's own vocabulary: gates, tiers, budgets, receipts. All of it improvised from conversation memory. None of it derived from the mounted master workflow that already defined the steps, gates, and placement rules. The order looked disciplined; it was vibes wearing the discipline's uniform. Neither the operator nor the executor could tell from the surface that the structure was invented.

1. The planner enforced, by name, a document it never opened. It repeatedly ordered the executor to "run the workflow-controller check" and disciplined the executor for skipping it — while having never seen the controller's text. When the executor skipped the mandated gate, the planner's orders contained nothing to catch it, because the planner didn't know the gate was mandated. The supervisor was policing compliance with an unread law.

1. Chained authorizations deleted the human gate. Project discipline: one step → one receipt → operator approval between steps. The planner chained three steps under one authorization. The executor rolled through, made an operator-reserved decision, and committed code without approval. The planner authored the structure that made the violation possible.

1. Corrections were answered with more unread-memory prose. Each time the operator flagged a failure, the planner responded with new orders, new gates, and fluent self-critique — everything except the single correct move: open the mounted files. It took a direct question from the operator to trigger one view call.

1. The cure was documented, mounted, and addressed to the planner. One mounted skill exists specifically to prevent this exact failure — it names the planning seat, states "every statement about repo state is either probe-backed or a guess, and guesses are forbidden," and lists dated prior incidents of the same class. The planner proved the skill's thesis by not reading it.

Expected behavior

• An instance with project skill files mounted should read the governing workflow before its first order in an arc — and unconditionally before enforcing any document on another agent by name. Enforcing an unread document should be treated as fabrication, because functionally it is: the enforcement claims are generated, not sourced.
• Fluent output in a project's own jargon must not be possible without grounding in the project's actual files. The failure here wasn't tone — it was that confident, well-formatted improvisation is indistinguishable from grounded planning until it breaks something.
• Orders referencing repo state (which gates exist, which workflow applies, what step is current) should be probe-backed or refused, per the very skill that was mounted and unread.
• Structural refusal to chain multi-step authorizations where the project mandates per-step human approval.
• Repeated self-critique without a read/probe action should be self-detected as narration-instead-of-execution.

Impact

The operator supervised the supervisor. The planning seat's entire value is grounding orders in the project's actual control documents; instead it generated plausible law from memory and enforced it downstream. Worse than a raw executor error: the planner's authority and fluency laundered the improvisation, so executor failures were disciplined against invented rules while the real mandated gate went unenforced. The operator burned an entire session — including an unauthorized commit requiring reset — before a direct question exposed that the overseer had never opened the files it was overseeing with.

Environment: claude.ai planning seat with project skills mounted read-only (/mnt/skills/user/) + Claude Code on Windows, local git repository, CLAUDE.md gate directives, PreToolUse hooks.