after moving all to cipher

worker-toolkit-stocks-in-the-future/scripts/check-workspace-sync.sh

@@ -132,9 +132,13 @@ git --git-dir="$GITDIR" "${GIT_FLAGS[@]}" read-tree "$RESOLVED_SHA"
 
 # `.zeta-siblings/` is staged INTO the workspace by build-workspace.sh on some
 # toolkits (bundled sibling deps) — a build artifact, never part of the patch.
+# `.raccoon-setup-done` is run-app's per-repo first-use setup marker (polyglot
+# toolkits) — authoring-machine state, never task content. run-app git-ignores
+# it via the repo's .git/info/exclude, but this script diffs through a
+# throwaway --git-dir that never reads that file, so exclude it here too.
 # The leading `.` positive pathspec is load-bearing: several git commands
 # reject a pathspec made of nothing but exclusions.
-EXCLUDES=("." ":(exclude).zeta-siblings")
+EXCLUDES=("." ":(exclude).zeta-siblings" ":(exclude).raccoon-setup-done")
 
 cd "$WORKSPACE"
 export GIT_WORK_TREE="$WORKSPACE"