Registered submodules can ignore pointer changes strongly enough that git add leaves the parent index unchanged. The finish flow now stages the exact nested HEAD with git update-index --cacheinfo after validating the parent path is already a 160000 gitlink.

Constraint: Parent repositories can hide submodule diffs through both diff.ignoreSubmodules and submodule.<path>.ignore.

Rejected: Keep using git add after SHA detection | live dogfood showed git add can still leave the gitlink index unchanged.

Confidence: high

Scope-risk: narrow

Directive: Parent gitlink staging is intentionally cacheinfo-based and limited to existing 160000 entries only.

Tested: bash -n scripts/agent-branch-finish.sh; bash -n templates/scripts/agent-branch-finish.sh; node --test test/finish.test.js; openspec validate agent-codex-auto-commit-parent-subrepo-upgrades-2026-04-23-11-59 --strict; git diff --check

Not-tested: Full npm test after cacheinfo follow-up; full suite passed before the dogfood fixes