diff --git a/DESIGN.md b/DESIGN.md
index cdddefd..468c96c 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -6,7 +6,7 @@ Kubernetes plugin + built-in terminal) with a purpose-built tool that does exact
 five things well:
 
 1. One tab per project, where a project is a cloned git repository of manifests.
-2. A file tree with git change awareness, plus pull / commit / push and diffs.
+2. A file tree with git change awareness, plus pull / push and diffs.
 3. Light, schema-aware YAML editing and markdown viewing/editing.
 4. Diff-before-apply Kubernetes workflows for plain YAML and Helm charts.
 5. A first-class embedded terminal for running Claude Code per project.
@@ -102,7 +102,8 @@ One process, three layers:
 - **Project registry** — the list of managed repos and their per-project settings
   (§4). Owns lifecycle: add (clone or point at existing checkout), open, remove.
 - **Git service** — wraps `git` invocations per project: `status --porcelain=v2`,
-  `diff`, `log`, `pull`, `push`, `commit`, branch info. Emits change events.
+  `diff`, `log`, `pull`, `push`, branch info. Emits change events. Nothing here
+  writes the index — see §7.
 - **FS watcher** — fsnotify on each open project's worktree and `.git/HEAD` /
   `.git/refs`; debounced events drive tree badges and editor reload prompts.
   Polling fallback where fsnotify is unreliable (network mounts).
@@ -125,7 +126,7 @@ One process, three layers:
 
 Two channels, chosen by payload profile:
 
-- **Wails bindings** for RPC (open file, git commit, run apply, get project
+- **Wails bindings** for RPC (open file, git pull, run apply, get project
   list): request/response, typed, low volume.
 - **Loopback WebSocket server** (127.0.0.1, random port, per-launch bearer token
   required on connect) for streams: PTY input/output (binary frames), live
@@ -250,12 +251,18 @@ both ways from the UI without an explicit switch.
 v1 scope mirrors actual daily use, not a git client:
 
 - Status-driven tree badges and a changes list per project.
-- Stage/unstage, commit (with message editor), pull (rebase per repo config),
-  push, current branch + ahead/behind in the status bar.
+- Pull (rebase per repo config), push, current branch + ahead/behind in the status bar.
 - Diff viewer for working-tree changes and for a file's last commit.
 - Branch switching (existing branches). Branch creation, log browsing, stash,
   and history tooling are v1.x (§10).
 
+**Staging and committing are not m6t's.** The agent in the terminal (§5) does that
+work, running the user's own `git` in the user's own worktree — so m6t offers no commit
+box and no stage/unstage control, and its bound surface has no method that writes the
+index. Two writers of one index, only one of which the agent can see, is two tools
+disagreeing about one repository. The changes list still groups staged and unstaged
+separately, because that is what `git status` reports whoever put the paths there.
+
 All operations run the system `git`; failures surface stderr verbatim (the user
 knows how to read git errors — do not translate them).
 
diff --git a/README.md b/README.md
index ab70f47..81fbb99 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,8 @@ Managing fleets of manifest repos doesn't need an IDE — it needs a small set o
 things done extremely well:
 
 - **Projects** — each cloned manifest repo is a top-level tab.
-- **Git** — status badges in the file tree, pull / commit / push, proper diffs.
+- **Git** — status badges in the file tree, pull / push, proper diffs. Committing
+  is the terminal agent's job, not m6t's (DESIGN.md §7).
 - **Editing** — CodeMirror-based YAML with Kubernetes schema diagnostics, and
   markdown preview. Light by design.
 - **Apply** — every cluster mutation goes validate → diff → confirm → apply,
diff --git a/frontend/src/App.test.tsx b/frontend/src/App.test.tsx
index c50ed2a..9f096ba 100644
--- a/frontend/src/App.test.tsx
+++ b/frontend/src/App.test.tsx
@@ -25,9 +25,6 @@ import { MODIFIED, emptyStatus } from "./lib/git";
 function stubGit(overrides: Partial<Git> = {}): Git {
   return {
     status: () => Promise.resolve(emptyStatus()),
-    stage: () => Promise.resolve(),
-    unstage: () => Promise.resolve(),
-    commit: () => Promise.resolve(),
     pull: () => Promise.resolve(),
     push: () => Promise.resolve(),
     checkout: () => Promise.resolve(),
@@ -614,37 +611,39 @@ describe("the git operations (#9)", () => {
   /** A repository whose status changes when the seam is written to, so the
    * refresh-after-an-operation contract is observable rather than asserted on
    * a call count. */
-  function stagingGit() {
-    let staged = false;
+  function pullingGit() {
+    let pulled = false;
     const empty = emptyStatus();
     const branch = { ...empty.branch, name: "main", upstream: "origin/main" };
     const status = () =>
       Promise.resolve({
         ...empty,
         branch,
-        files: [
-          {
-            path: "a.yaml",
-            staged: staged ? MODIFIED : "",
-            worktree: staged ? "" : MODIFIED,
-            conflicted: false,
-            origPath: "",
-          },
-        ],
+        files: pulled
+          ? []
+          : [
+              {
+                path: "a.yaml",
+                staged: "",
+                worktree: MODIFIED,
+                conflicted: false,
+                origPath: "",
+              },
+            ],
       });
-    const stage = vi.fn(() => {
-      staged = true;
+    const pull = vi.fn(() => {
+      pulled = true;
       return Promise.resolve();
     });
-    return { seam: stubGit({ status, stage, branches: () => Promise.resolve(["main"]) }), stage };
+    return { seam: stubGit({ status, pull, branches: () => Promise.resolve(["main"]) }), pull };
   }
 
-  // The composition test: the panel's button, the ops hook, the seam, and the
-  // status re-read that makes the row move. Each of those has its own unit
-  // test; this is the only thing that fails when they are wired to each other
-  // wrongly.
-  it("stages a file from the changes panel and shows the result", async () => {
-    const { seam, stage } = stagingGit();
+  // The composition test: the branch bar's button, the ops hook, the seam, and
+  // the status re-read that makes the row go away. Each of those has its own
+  // unit test; this is the only thing that fails when they are wired to each
+  // other wrongly.
+  it("pulls from the branch bar and shows the result", async () => {
+    const { seam, pull } = pullingGit();
     render(
       <App
         load={attached}
@@ -653,18 +652,51 @@ describe("the git operations (#9)", () => {
       />,
     );
 
-    const button = await screen.findByRole("button", { name: "Stage a.yaml" });
+    // The button renders disabled first — the initial status has no upstream —
+    // and only becomes usable once the real one lands.
+    const button = await screen.findByRole("button", { name: "Pull" });
+    await waitFor(() => {
+      expect((button as HTMLButtonElement).disabled).toBe(false);
+    });
+    expect(screen.getByRole("button", { name: "Unstaged: a.yaml" })).toBeDefined();
+
     fireEvent.click(button);
 
     await waitFor(() => {
-      expect(stage).toHaveBeenCalledWith("/w/infra", ["a.yaml"]);
+      expect(pull).toHaveBeenCalledWith("/w/infra");
     });
-    // The row moved groups, which only happens if the operation triggered a
+    // The row went away, which only happens if the operation triggered a
     // re-read of the status.
     await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Staged: a.yaml" })).toBeDefined();
+      expect(screen.queryByRole("button", { name: "Unstaged: a.yaml" })).toBeNull();
     });
-    expect(screen.queryByRole("button", { name: "Unstaged: a.yaml" })).toBeNull();
+  });
+
+  // The commit box and the stage/unstage controls are gone (#39): what records
+  // work is the agent in the terminal, and this is the assertion that fails if
+  // one of them comes back through a component the workbench still renders.
+  it("offers no control anywhere that writes the index", async () => {
+    const { seam } = pullingGit();
+    render(
+      <App
+        load={attached}
+        endpoint={pending}
+        backend={{ registry: fakeRegistry([project("infra", "/w/infra")]), git: seam }}
+      />,
+    );
+
+    // A changed file on screen, so the panel is rendering rows rather than
+    // being absent for some unrelated reason.
+    await screen.findByRole("button", { name: "Unstaged: a.yaml" });
+
+    // Exact names, not a prefix: a row's own accessible name starts with
+    // "Unstaged:", so a prefix match would find the row and pass for the wrong
+    // reason.
+    for (const name of ["Stage a.yaml", "Unstage a.yaml", "Stage all", "Unstage all", "Commit"]) {
+      expect(screen.queryByRole("button", { name })).toBeNull();
+    }
+    expect(screen.queryByLabelText("Commit subject")).toBeNull();
+    expect(screen.queryByLabelText("Commit body")).toBeNull();
   });
 
   // A failed operation reaches the user with git's own words in it — the whole
diff --git a/frontend/src/components/ChangesPanel.test.tsx b/frontend/src/components/ChangesPanel.test.tsx
index a48952a..8be7f21 100644
--- a/frontend/src/components/ChangesPanel.test.tsx
+++ b/frontend/src/components/ChangesPanel.test.tsx
@@ -30,9 +30,6 @@ function renderPanel(props: Partial<ChangesPanelProps> = {}) {
     status: emptyStatus(),
     error: null,
     onOpenFile: vi.fn(),
-    onStage: vi.fn(),
-    onUnstage: vi.fn(),
-    busy: false,
     ...props,
   };
   render(<ChangesPanel {...merged} />);
@@ -92,80 +89,45 @@ describe("the changes list", () => {
   });
 });
 
-describe("staging from the panel", () => {
-  it("stages one file from its unstaged row", () => {
-    const { onStage } = renderPanel({
-      status: statusOf([file("a.yaml", { worktree: MODIFIED })]),
-    });
-
-    fireEvent.click(screen.getByRole("button", { name: "Stage a.yaml" }));
-
-    expect(onStage).toHaveBeenCalledWith(["a.yaml"]);
-  });
-
-  it("unstages one file from its staged row", () => {
-    const { onUnstage } = renderPanel({
-      status: statusOf([file("a.yaml", { staged: ADDED })]),
-    });
-
-    fireEvent.click(screen.getByRole("button", { name: "Unstage a.yaml" }));
-
-    expect(onUnstage).toHaveBeenCalledWith(["a.yaml"]);
-  });
-
-  // The group action sends every path in that group in one call, so the whole
-  // group moves in one git invocation rather than one per row.
-  it("stages a whole group at once", () => {
-    const { onStage } = renderPanel({
+describe("what the panel does not do", () => {
+  // The panel reports; the agent in the terminal writes (#39). A button here
+  // would be a second writer of the index that the agent cannot see.
+  it("offers no staging control on any row", () => {
+    renderPanel({
       status: statusOf([
         file("a.yaml", { worktree: MODIFIED }),
-        file("b.yaml", { worktree: UNTRACKED }),
+        file("b.yaml", { staged: ADDED }),
+        file("new.yaml", { staged: RENAMED, origPath: "old.yaml" }),
       ]),
     });
 
-    fireEvent.click(screen.getByRole("button", { name: "Stage all" }));
-
-    expect(onStage).toHaveBeenCalledWith(["a.yaml", "b.yaml"]);
-  });
-
-  // A file staged and then edited again is one row in each group, and each
-  // row's action moves only its own side.
-  it("offers both actions for a file that is in both groups", () => {
-    const { onStage, onUnstage } = renderPanel({
-      status: statusOf([file("a.yaml", { staged: ADDED, worktree: MODIFIED })]),
-    });
-
-    fireEvent.click(screen.getByRole("button", { name: "Stage a.yaml" }));
-    fireEvent.click(screen.getByRole("button", { name: "Unstage a.yaml" }));
-
-    expect(onStage).toHaveBeenCalledWith(["a.yaml"]);
-    expect(onUnstage).toHaveBeenCalledWith(["a.yaml"]);
-  });
-
-  // A rename is one row and two paths. Unstaging only the new name after a
-  // `git mv` leaves the old one staged as a deletion, which the next commit
-  // would carry out.
-  it("unstages both halves of a rename", () => {
-    const { onUnstage } = renderPanel({
-      status: statusOf([file("new.yaml", { staged: RENAMED, origPath: "old.yaml" })]),
-    });
-
-    fireEvent.click(screen.getByRole("button", { name: "Unstage new.yaml" }));
-
-    expect(onUnstage).toHaveBeenCalledWith(["new.yaml", "old.yaml"]);
-  });
-
-  // git serializes on the index, so a second click during an operation buys a
-  // lock error rather than a second operation.
-  it("disables every action while an operation is in flight", () => {
-    const { onStage } = renderPanel({
-      status: statusOf([file("a.yaml", { worktree: MODIFIED })]),
-      busy: true,
+    // Exact names, not a prefix: every row's own accessible name starts with
+    // "Staged:" or "Unstaged:", so a prefix match would find the rows and pass
+    // for the wrong reason.
+    for (const name of [
+      "Stage a.yaml",
+      "Unstage b.yaml",
+      "Unstage new.yaml",
+      "Stage all",
+      "Unstage all",
+    ]) {
+      expect(screen.queryByRole("button", { name })).toBeNull();
+    }
+  });
+
+  // Every row is the button that opens its file, and nothing else is.
+  it("renders one button per row", () => {
+    renderPanel({
+      status: statusOf([
+        file("a.yaml", { worktree: MODIFIED }),
+        file("b.yaml", { staged: ADDED }),
+      ]),
     });
 
-    fireEvent.click(screen.getByRole("button", { name: "Stage a.yaml" }));
-
-    expect(onStage).not.toHaveBeenCalled();
+    expect(screen.getAllByRole("button").map((b) => b.getAttribute("aria-label"))).toEqual([
+      "Staged: b.yaml",
+      "Unstaged: a.yaml",
+    ]);
   });
 });
 
@@ -179,12 +141,12 @@ describe("conflicts", () => {
     expect(screen.getByRole("status").textContent).toContain("Resolve these in the terminal");
   });
 
-  // `git add` on a conflicted file means "I have resolved this". A user who
-  // has not should not be one misclick from claiming so.
-  it("gives a conflicted row no staging action", () => {
+  // A conflicted path groups with unstaged for badge purposes, but it belongs
+  // to its own section here: an unmerged file is not an ordinary edit waiting
+  // to be listed beside one.
+  it("keeps a conflicted path out of the unstaged group", () => {
     renderPanel({ status: statusOf([file("a.yaml", { conflicted: true })]) });
 
-    expect(screen.queryByRole("button", { name: "Stage a.yaml" })).toBeNull();
     expect(screen.queryByText("Unstaged")).toBeNull();
   });
 
diff --git a/frontend/src/components/ChangesPanel.tsx b/frontend/src/components/ChangesPanel.tsx
index 3726403..89c318c 100644
--- a/frontend/src/components/ChangesPanel.tsx
+++ b/frontend/src/components/ChangesPanel.tsx
@@ -1,14 +1,10 @@
 import type { FileStatus, Status } from "../lib/git";
 import { NOT_A_REPOSITORY, NO_GIT } from "../lib/git";
 import { fileBadge, groupChanges } from "../lib/gitStatus";
-import { conflictedFiles, pathsOf, pathsOfAll } from "../lib/gitOps";
+import { conflictedFiles } from "../lib/gitOps";
 import { iconKind } from "../lib/tree";
 import { FileIcon } from "./Icon";
 
-/** What a row's action button does, which is the only thing that differs
- * between the two groups. */
-type RowAction = "stage" | "unstage" | "none";
-
 export interface ChangesPanelProps {
   readonly status: Status;
   /** A real git failure, as opposed to the two degraded states the status
@@ -17,37 +13,30 @@ export interface ChangesPanelProps {
   /** Opens a changed file in the editor — the same intent the file tree
    * emits, so a row here and a row there do the same thing. */
   readonly onOpenFile: (path: string) => void;
-  /** Adds paths to the index (#9). */
-  readonly onStage: (paths: readonly string[]) => void;
-  /** Removes paths from the index, leaving the working tree alone (#9). */
-  readonly onUnstage: (paths: readonly string[]) => void;
-  /** An operation is in flight; every action disables until it lands. */
-  readonly busy: boolean;
 }
 
 /**
  * The per-project changes list (DESIGN.md §7): every path git reports,
- * grouped staged and unstaged, each row with the one action that moves it to
- * the other group.
+ * grouped staged and unstaged, each row opening the file it names.
  *
  * It sits under the file tree rather than beside it because the two answer
  * different questions about the same repository — "what is in here" and "what
  * have I touched" — and a user looking for the second should not have to
  * expand directories to find it.
+ *
+ * It reports and it does not write (#39). The rows used to carry stage and
+ * unstage buttons; what records work in m6t is the agent in the terminal
+ * below, running the user's own git, and a button here would be a second
+ * writer of the index that the agent cannot see. The staged/unstaged grouping
+ * stays because it is what git reports — a path in the index and a path only
+ * on disk are different facts, whoever put them there.
  */
-export function ChangesPanel({
-  status,
-  error,
-  onOpenFile,
-  onStage,
-  onUnstage,
-  busy,
-}: ChangesPanelProps) {
+export function ChangesPanel({ status, error, onOpenFile }: ChangesPanelProps) {
   const { staged, unstaged } = groupChanges(status);
   const conflicts = conflictedFiles(status);
   // A conflicted path groups with unstaged for badge purposes, but it gets its
-  // own section here: staging one marks it resolved, which is a decision, not
-  // the routine move the same button makes on an ordinary edit.
+  // own section here: it is the one state that stops a pull and a branch
+  // switch, and it needs to say where to go about it.
   const editable = unstaged.filter((f) => !f.conflicted);
 
   return (
@@ -70,22 +59,8 @@ export function ChangesPanel({
       {status.availability !== NO_GIT && status.availability !== NOT_A_REPOSITORY && (
         <>
           <Conflicts files={conflicts} onOpenFile={onOpenFile} />
-          <ChangeGroup
-            label="Staged"
-            files={staged}
-            action="unstage"
-            busy={busy}
-            onOpenFile={onOpenFile}
-            onAct={onUnstage}
-          />
-          <ChangeGroup
-            label="Unstaged"
-            files={editable}
-            action="stage"
-            busy={busy}
-            onOpenFile={onOpenFile}
-            onAct={onStage}
-          />
+          <ChangeGroup label="Staged" files={staged} onOpenFile={onOpenFile} />
+          <ChangeGroup label="Unstaged" files={editable} onOpenFile={onOpenFile} />
           {staged.length === 0 && unstaged.length === 0 && (
             <p className="changes__empty">Nothing changed.</p>
           )}
@@ -105,9 +80,7 @@ interface ConflictsProps {
  *
  * v1 ships no merge tool (DESIGN.md §7), and the terminal below is a real
  * shell in this repository — so the honest thing to show is where to go, not
- * a button that would pretend to resolve something. The rows have no action
- * for the same reason: `git add` on a conflicted file means "I have resolved
- * this", and a user who has not should not be one misclick from claiming so.
+ * a button that would pretend to resolve something.
  */
 function Conflicts({ files, onOpenFile }: ConflictsProps) {
   if (files.length === 0) {
@@ -119,13 +92,16 @@ function Conflicts({ files, onOpenFile }: ConflictsProps) {
         Conflicted <span className="changes__count">{files.length}</span>
       </h3>
       <p className="changes__hint" role="status">
-        Resolve these in the terminal, then stage them. m6t has no merge tool.
+        Resolve these in the terminal. m6t has no merge tool.
       </p>
       <ul className="changes__list">
         {files.map((file) => (
-          <Row key={`conflict:${file.path}`} file={file} label="Conflicted">
-            <FileButton file={file} label="Conflicted" onOpenFile={onOpenFile} />
-          </Row>
+          <ChangeRow
+            key={`conflict:${file.path}`}
+            file={file}
+            label="Conflicted"
+            onOpenFile={onOpenFile}
+          />
         ))}
       </ul>
     </>
@@ -135,77 +111,43 @@ function Conflicts({ files, onOpenFile }: ConflictsProps) {
 interface ChangeGroupProps {
   readonly label: string;
   readonly files: readonly FileStatus[];
-  readonly action: RowAction;
-  readonly busy: boolean;
   readonly onOpenFile: (path: string) => void;
-  readonly onAct: (paths: readonly string[]) => void;
 }
 
-/** One group's rows, with a group-level action in the heading. An empty group
- * renders nothing at all rather than a heading over a blank space. */
-function ChangeGroup({ label, files, action, busy, onOpenFile, onAct }: ChangeGroupProps) {
+/** One group's rows. An empty group renders nothing at all rather than a
+ * heading over a blank space. */
+function ChangeGroup({ label, files, onOpenFile }: ChangeGroupProps) {
   if (files.length === 0) {
     return null;
   }
-  const verb = action === "stage" ? "Stage" : "Unstage";
   return (
     <>
       <h3 className="changes__group">
         {label} <span className="changes__count">{files.length}</span>
-        <button
-          type="button"
-          className="changes__all"
-          disabled={busy}
-          onClick={() => {
-            onAct(pathsOfAll(files));
-          }}
-        >
-          {verb} all
-        </button>
       </h3>
       <ul className="changes__list">
         {files.map((file) => (
-          <Row key={`${label}:${file.path}`} file={file} label={label}>
-            <FileButton file={file} label={label} onOpenFile={onOpenFile} />
-            <button
-              type="button"
-              className="changes__action"
-              // The glyph is a glyph; the accessible name says which file.
-              aria-label={`${verb} ${file.path}`}
-              title={verb}
-              disabled={busy}
-              onClick={() => {
-                onAct(pathsOf(file));
-              }}
-            >
-              {action === "stage" ? "+" : "−"}
-            </button>
-          </Row>
+          <ChangeRow
+            key={`${label}:${file.path}`}
+            file={file}
+            label={label}
+            onOpenFile={onOpenFile}
+          />
         ))}
       </ul>
     </>
   );
 }
 
-/** One row's frame. */
-function Row({
-  file,
-  label,
-  children,
-}: {
-  readonly file: FileStatus;
-  readonly label: string;
-  readonly children: React.ReactNode;
-}) {
-  return (
-    <li className="changes__item" data-testid={`change:${label}:${file.path}`}>
-      {children}
-    </li>
-  );
-}
-
-/** The part of a row that opens the file. */
-function FileButton({
+/**
+ * One row: the whole thing opens the file it names.
+ *
+ * The row used to be a frame around a path button and an action button, which
+ * is why the two were separate components. With the action gone (#39) the row
+ * is the button, and the list reads as paths rather than as a column of
+ * controls.
+ */
+function ChangeRow({
   file,
   label,
   onOpenFile,
@@ -215,25 +157,27 @@ function FileButton({
   readonly onOpenFile: (path: string) => void;
 }) {
   return (
-    <button
-      type="button"
-      className="changes__row"
-      // The badge is a glyph, so the row says in words what it means.
-      aria-label={`${label}: ${file.path}`}
-      onClick={() => {
-        onOpenFile(file.path);
-      }}
-    >
-      {/* data-badge rather than a modifier class: a badge can be `?`, which is
-          not usable in a class-selector name. */}
-      <span className="changes__badge" data-badge={fileBadge(file)} aria-hidden="true">
-        {fileBadge(file)}
-      </span>
-      <span className="changes__icon">
-        <FileIcon kind={iconKind(file.path, false)} />
-      </span>
-      <span className="changes__path">{file.path}</span>
-      {file.origPath !== "" && <span className="changes__origin">← {file.origPath}</span>}
-    </button>
+    <li>
+      <button
+        type="button"
+        className="changes__row"
+        // The badge is a glyph, so the row says in words what it means.
+        aria-label={`${label}: ${file.path}`}
+        onClick={() => {
+          onOpenFile(file.path);
+        }}
+      >
+        {/* data-badge rather than a modifier class: a badge can be `?`, which
+            is not usable in a class-selector name. */}
+        <span className="changes__badge" data-badge={fileBadge(file)} aria-hidden="true">
+          {fileBadge(file)}
+        </span>
+        <span className="changes__icon">
+          <FileIcon kind={iconKind(file.path, false)} />
+        </span>
+        <span className="changes__path">{file.path}</span>
+        {file.origPath !== "" && <span className="changes__origin">← {file.origPath}</span>}
+      </button>
+    </li>
   );
 }
diff --git a/frontend/src/components/CommitBox.test.tsx b/frontend/src/components/CommitBox.test.tsx
deleted file mode 100644
index cbce4fc..0000000
--- a/frontend/src/components/CommitBox.test.tsx
+++ /dev/null
@@ -1,155 +0,0 @@
-import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import type { FileStatus, Status } from "../lib/git";
-import { ADDED, MODIFIED, NOT_A_REPOSITORY, emptyStatus } from "../lib/git";
-import { CommitBox } from "./CommitBox";
-
-afterEach(cleanup);
-
-function file(path: string, overrides: Partial<FileStatus> = {}): FileStatus {
-  return { path, staged: "", worktree: "", conflicted: false, origPath: "", ...overrides };
-}
-
-function statusOf(files: FileStatus[]): Status {
-  return { ...emptyStatus(), files };
-}
-
-function renderBox(status: Status, onCommit = vi.fn(() => Promise.resolve(true)), busy = false) {
-  render(<CommitBox status={status} onCommit={onCommit} busy={busy} />);
-  return onCommit;
-}
-
-const subjectField = () => screen.getByRole("textbox", { name: "Commit subject" });
-const bodyField = () => screen.getByRole("textbox", { name: "Commit body" });
-const commitButton = () => screen.getByRole("button", { name: "Commit" });
-
-describe("committing", () => {
-  it("sends the subject and body as one message", async () => {
-    const onCommit = renderBox(statusOf([file("a.yaml", { staged: ADDED })]));
-
-    fireEvent.change(subjectField(), { target: { value: "add the deployment" } });
-    fireEvent.change(bodyField(), { target: { value: "Because X." } });
-    fireEvent.click(commitButton());
-
-    await waitFor(() => {
-      expect(onCommit).toHaveBeenCalledWith("add the deployment\n\nBecause X.");
-    });
-  });
-
-  it("clears the editor once the commit is recorded", async () => {
-    renderBox(statusOf([file("a.yaml", { staged: ADDED })]));
-
-    fireEvent.change(subjectField(), { target: { value: "add the deployment" } });
-    fireEvent.click(commitButton());
-
-    await waitFor(() => {
-      expect((subjectField() as HTMLInputElement).value).toBe("");
-    });
-  });
-
-  // A draft thrown away on a failed commit is a draft the user has to retype,
-  // and "nothing to commit" is a failure they will immediately want to retry.
-  it("keeps the draft when the commit fails", async () => {
-    const onCommit = vi.fn(() => Promise.resolve(false));
-    renderBox(statusOf([file("a.yaml", { staged: ADDED })]), onCommit);
-
-    fireEvent.change(subjectField(), { target: { value: "add the deployment" } });
-    fireEvent.click(commitButton());
-
-    await waitFor(() => {
-      expect(onCommit).toHaveBeenCalled();
-    });
-    expect((subjectField() as HTMLInputElement).value).toBe("add the deployment");
-  });
-});
-
-describe("the disabled button", () => {
-  it("is enabled with a subject and something staged", () => {
-    renderBox(statusOf([file("a.yaml", { staged: ADDED })]));
-    fireEvent.change(subjectField(), { target: { value: "s" } });
-
-    expect((commitButton() as HTMLButtonElement).disabled).toBe(false);
-    expect(screen.queryByTestId("commit-blocked")).toBeNull();
-  });
-
-  // A disabled control with no explanation is the thing users file bugs about.
-  it("says why with nothing staged", () => {
-    const onCommit = renderBox(statusOf([file("a.yaml", { worktree: MODIFIED })]));
-    fireEvent.change(subjectField(), { target: { value: "s" } });
-
-    expect((commitButton() as HTMLButtonElement).disabled).toBe(true);
-    expect(screen.getByTestId("commit-blocked").textContent).toBe("Stage something to commit.");
-
-    fireEvent.click(commitButton());
-    expect(onCommit).not.toHaveBeenCalled();
-  });
-
-  it("says why with no subject typed", () => {
-    renderBox(statusOf([file("a.yaml", { staged: ADDED })]));
-
-    expect((commitButton() as HTMLButtonElement).disabled).toBe(true);
-    expect(screen.getByTestId("commit-blocked").textContent).toBe("A commit needs a subject line.");
-  });
-
-  it("says why while a conflict is open", () => {
-    renderBox(
-      statusOf([file("a.yaml", { conflicted: true }), file("b.yaml", { staged: ADDED })]),
-    );
-    fireEvent.change(subjectField(), { target: { value: "s" } });
-
-    expect(screen.getByTestId("commit-blocked").textContent).toBe(
-      "Resolve the conflicted files before committing.",
-    );
-  });
-
-  it("is disabled while an operation is in flight", () => {
-    renderBox(statusOf([file("a.yaml", { staged: ADDED })]), vi.fn(() => Promise.resolve(true)));
-    fireEvent.change(subjectField(), { target: { value: "s" } });
-    cleanup();
-
-    renderBox(
-      statusOf([file("a.yaml", { staged: ADDED })]),
-      vi.fn(() => Promise.resolve(true)),
-      true,
-    );
-
-    expect((commitButton() as HTMLButtonElement).disabled).toBe(true);
-  });
-});
-
-describe("what is staged", () => {
-  it("counts the staged files", () => {
-    renderBox(
-      statusOf([file("a.yaml", { staged: ADDED }), file("b.yaml", { staged: MODIFIED })]),
-    );
-
-    expect(screen.getByTestId("commit-staged").textContent).toBe("2 files staged");
-  });
-
-  it("uses the singular for one", () => {
-    renderBox(statusOf([file("a.yaml", { staged: ADDED })]));
-
-    expect(screen.getByTestId("commit-staged").textContent).toBe("1 file staged");
-  });
-
-  it("says nothing is staged when nothing is", () => {
-    renderBox(emptyStatus());
-
-    expect(screen.getByTestId("commit-staged").textContent).toBe("nothing staged");
-  });
-});
-
-// A project that is not a repository has nothing to commit to. The changes
-// panel already explains why; a commit form beside that message would be a
-// control that could never work.
-it("renders nothing when git has no answer for the project", () => {
-  render(
-    <CommitBox
-      status={{ ...emptyStatus(), availability: NOT_A_REPOSITORY }}
-      onCommit={vi.fn(() => Promise.resolve(true))}
-      busy={false}
-    />,
-  );
-
-  expect(screen.queryByRole("button", { name: "Commit" })).toBeNull();
-});
diff --git a/frontend/src/components/CommitBox.tsx b/frontend/src/components/CommitBox.tsx
deleted file mode 100644
index 3188d7c..0000000
--- a/frontend/src/components/CommitBox.tsx
+++ /dev/null
@@ -1,101 +0,0 @@
-import { useState } from "react";
-import type { Status } from "../lib/git";
-import { AVAILABLE } from "../lib/git";
-import type { CommitDraft } from "../lib/gitOps";
-import { EMPTY_DRAFT, commitBlockedReason, commitMessage, stagedPaths } from "../lib/gitOps";
-
-export interface CommitBoxProps {
-  readonly status: Status;
-  /** Records the index. Resolves true when the commit was made, which is what
-   * clears the editor — a draft dropped on a failed commit is a draft the
-   * user has to retype. */
-  readonly onCommit: (message: string) => Promise<boolean>;
-  readonly busy: boolean;
-}
-
-/**
- * The commit message editor (DESIGN.md §7): a subject line, an optional body,
- * and a button that is disabled with a reason.
- *
- * Two fields rather than one textarea because the subject is not just the
- * first line — it is what every log, every blame and every PR title shows, and
- * a separate input is what makes its length visible while it is being typed.
- *
- * Signing is not mentioned anywhere here. Whether a commit is signed is the
- * repository's `commit.gpgsign`, m6t runs the user's own git, and a checkbox
- * offering to override it would be m6t having an opinion about a policy it did
- * not set.
- */
-export function CommitBox({ status, onCommit, busy }: CommitBoxProps) {
-  const [draft, setDraft] = useState<CommitDraft>(EMPTY_DRAFT);
-
-  if (status.availability !== AVAILABLE) {
-    return null;
-  }
-
-  const blocked = commitBlockedReason(status, draft);
-  const staged = stagedPaths(status).length;
-
-  const submit = () => {
-    void onCommit(commitMessage(draft)).then((committed) => {
-      if (committed) {
-        setDraft(EMPTY_DRAFT);
-      }
-    });
-  };
-
-  return (
-    <section className="commit" aria-label="Commit">
-      <input
-        type="text"
-        className="commit__subject"
-        aria-label="Commit subject"
-        placeholder="Summary"
-        value={draft.subject}
-        disabled={busy}
-        onChange={(event) => {
-          setDraft((current) => ({ ...current, subject: event.target.value }));
-        }}
-      />
-      <textarea
-        className="commit__body"
-        aria-label="Commit body"
-        placeholder="Description (optional)"
-        rows={3}
-        value={draft.body}
-        disabled={busy}
-        onChange={(event) => {
-          setDraft((current) => ({ ...current, body: event.target.value }));
-        }}
-      />
-      <div className="commit__actions">
-        <button
-          type="button"
-          className="commit__submit"
-          disabled={busy || blocked !== null}
-          // The button is disabled, so its own tooltip would never appear on
-          // hover in most browsers; the reason is rendered below as well.
-          title={blocked ?? `Commit ${String(staged)} staged file(s)`}
-          onClick={submit}
-        >
-          Commit
-        </button>
-        <span className="commit__staged" data-testid="commit-staged">
-          {stagedLabel(staged)}
-        </span>
-      </div>
-      {blocked !== null && (
-        <p className="commit__blocked" data-testid="commit-blocked">
-          {blocked}
-        </p>
-      )}
-    </section>
-  );
-}
-
-function stagedLabel(count: number): string {
-  if (count === 0) {
-    return "nothing staged";
-  }
-  return count === 1 ? "1 file staged" : `${String(count)} files staged`;
-}
diff --git a/frontend/src/components/Workbench.tsx b/frontend/src/components/Workbench.tsx
index 6662a09..743c603 100644
--- a/frontend/src/components/Workbench.tsx
+++ b/frontend/src/components/Workbench.tsx
@@ -9,7 +9,6 @@ import {
 import { FileTree } from "./FileTree";
 import { BranchBar } from "./BranchBar";
 import { ChangesPanel } from "./ChangesPanel";
-import { CommitBox } from "./CommitBox";
 import { PaneSeparator } from "./PaneSeparator";
 import type { Project } from "../lib/projects";
 import type { FileTreeController } from "../lib/useFileTree";
@@ -30,8 +29,8 @@ export interface WorkbenchProps {
   readonly tree: FileTreeController;
   /** This project's git status (#8): tree badges and the changes list. */
   readonly git: GitStatusController;
-  /** The mutating git loop for this project (#9): stage, commit, pull, push,
-   * branch switch. */
+  /** The mutating git loop for this project (#9): pull, push, branch switch.
+   * Staging and committing are the terminal agent's, not m6t's (#39). */
   readonly gitOps: GitOpsController;
   /** The open-file intent a tree selection emits; the editor strip acts on it. */
   readonly onOpenFile: (path: string) => void;
@@ -89,15 +88,7 @@ export function Workbench({
           onPush={gitOps.push}
           onDismissError={gitOps.dismissError}
         />
-        <ChangesPanel
-          status={git.status}
-          error={git.error}
-          onOpenFile={onOpenFile}
-          onStage={gitOps.stage}
-          onUnstage={gitOps.unstage}
-          busy={gitOps.busy}
-        />
-        <CommitBox status={git.status} onCommit={gitOps.commit} busy={gitOps.busy} />
+        <ChangesPanel status={git.status} error={git.error} onOpenFile={onOpenFile} />
       </aside>
 
       <PaneSeparator
diff --git a/frontend/src/lib/git.ts b/frontend/src/lib/git.ts
index a092ab5..83c0a73 100644
--- a/frontend/src/lib/git.ts
+++ b/frontend/src/lib/git.ts
@@ -1,13 +1,10 @@
 import {
   GitBranches,
   GitCheckout,
-  GitCommit,
   GitPull,
   GitPush,
   GitRemotes,
-  GitStage,
   GitStatus,
-  GitUnstage,
 } from "../../wailsjs/go/app/App";
 
 /**
@@ -82,12 +79,14 @@ export const UNTRACKED = "untracked";
  * the write changes `.git`, the watcher publishes a `git` event for it
  * (PROTOCOL.md §5), and the status is read back through `status`. One source
  * for what the repository looks like, not two that can disagree.
+ *
+ * Staging and committing are absent, and the absence is the decision (#39):
+ * what records work in m6t is the agent in the terminal below, running the
+ * user's own git in the user's own worktree. A seam method for it would be a
+ * second writer of the index that the agent cannot see.
  */
 export interface Git {
   status: (root: string) => Promise<Status>;
-  stage: (root: string, paths: string[]) => Promise<void>;
-  unstage: (root: string, paths: string[]) => Promise<void>;
-  commit: (root: string, message: string) => Promise<void>;
   pull: (root: string) => Promise<void>;
   /** `remote` takes effect only when `setUpstream` is true; otherwise the
    * repository's own push configuration decides where the branch goes. */
@@ -100,9 +99,6 @@ export interface Git {
 /** The git seam backed by the generated Wails bindings. */
 export const wailsGit: Git = {
   status: (root) => GitStatus(root),
-  stage: (root, paths) => GitStage(root, paths),
-  unstage: (root, paths) => GitUnstage(root, paths),
-  commit: (root, message) => GitCommit(root, message),
   pull: (root) => GitPull(root),
   push: (root, remote, setUpstream) => GitPush(root, remote, setUpstream),
   checkout: (root, branch) => GitCheckout(root, branch),
diff --git a/frontend/src/lib/gitOps.test.ts b/frontend/src/lib/gitOps.test.ts
index 484d875..9c00f21 100644
--- a/frontend/src/lib/gitOps.test.ts
+++ b/frontend/src/lib/gitOps.test.ts
@@ -6,24 +6,17 @@ import {
   MODIFIED,
   NOT_A_REPOSITORY,
   NO_GIT,
-  RENAMED,
   UNTRACKED,
   emptyStatus,
 } from "./git";
 import {
   checkoutBlockedReason,
-  commitBlockedReason,
-  commitMessage,
   conflictedFiles,
   defaultRemote,
-  hasMessage,
   isDirty,
   needsUpstream,
-  pathsOf,
-  pathsOfAll,
   pullBlockedReason,
   pushBlockedReason,
-  stagedPaths,
 } from "./gitOps";
 
 function file(path: string, overrides: Partial<FileStatus> = {}): FileStatus {
@@ -35,123 +28,19 @@ function statusOf(files: FileStatus[], branch: Partial<Branch> = {}): Status {
   return { ...empty, branch: { ...empty.branch, name: "main", ...branch }, files };
 }
 
-describe("building the commit message", () => {
-  it("separates the subject from the body with a blank line", () => {
-    expect(commitMessage({ subject: "add the deployment", body: "Because X." })).toBe(
-      "add the deployment\n\nBecause X.",
-    );
-  });
-
-  // A subject with two trailing newlines makes `git log --format=%b` report a
-  // body of whitespace where there is none.
-  it("is just the subject when there is no body", () => {
-    expect(commitMessage({ subject: "add the deployment", body: "   \n" })).toBe(
-      "add the deployment",
-    );
-  });
-
-  it("trims each field", () => {
-    expect(commitMessage({ subject: "  subject  ", body: "  body  " })).toBe("subject\n\nbody");
-  });
-
-  // The body alone is not a message: a commit with a blank subject shows up as
-  // an empty row in every log.
-  it("needs a subject", () => {
-    expect(hasMessage({ subject: "", body: "a body" })).toBe(false);
-    expect(hasMessage({ subject: "   ", body: "a body" })).toBe(false);
-    expect(hasMessage({ subject: "s", body: "" })).toBe(true);
-  });
-});
-
-describe("what is staged", () => {
-  it("lists the paths whose index side differs", () => {
-    const status = statusOf([
-      file("staged.yaml", { staged: ADDED }),
-      file("edited.yaml", { worktree: MODIFIED }),
-      file("both.yaml", { staged: ADDED, worktree: MODIFIED }),
-    ]);
-
-    expect(stagedPaths(status)).toEqual(["staged.yaml", "both.yaml"]);
-  });
-
-  // An unmerged path has no index-versus-HEAD split to report, so counting it
-  // as staged would enable a commit of a half-merged tree.
-  it("excludes conflicted paths", () => {
-    expect(stagedPaths(statusOf([file("a.yaml", { conflicted: true })]))).toEqual([]);
-  });
-
-  it("collects the conflicted paths on their own", () => {
+describe("the conflicted paths", () => {
+  it("collects them on their own", () => {
     const status = statusOf([
       file("a.yaml", { conflicted: true }),
       file("b.yaml", { worktree: MODIFIED }),
+      file("c.yaml", { staged: ADDED }),
     ]);
 
     expect(conflictedFiles(status).map((f) => f.path)).toEqual(["a.yaml"]);
   });
-});
-
-describe("the paths a row's action acts on", () => {
-  it("is just the path for an ordinary change", () => {
-    expect(pathsOf(file("a.yaml", { worktree: MODIFIED }))).toEqual(["a.yaml"]);
-  });
-
-  // Unstaging only `new.yaml` after a `git mv` leaves `old.yaml` staged as a
-  // deletion — a change the user did not ask for, sitting in the index, that
-  // the next commit would carry out.
-  it("includes a rename's source, so half a rename is never left staged", () => {
-    expect(pathsOf(file("new.yaml", { staged: RENAMED, origPath: "old.yaml" }))).toEqual([
-      "new.yaml",
-      "old.yaml",
-    ]);
-  });
-
-  // A rename's source can also be another row's path, and passing the same
-  // pathspec twice is a pointless argument rather than a wrong one — but the
-  // group action is the one place it would happen every time.
-  it("deduplicates across a group", () => {
-    const files = [
-      file("new.yaml", { staged: RENAMED, origPath: "old.yaml" }),
-      file("old.yaml", { staged: DELETED }),
-    ];
-
-    expect(pathsOfAll(files)).toEqual(["new.yaml", "old.yaml"]);
-  });
-});
-
-describe("blocking a commit", () => {
-  it("allows one with a subject and something staged", () => {
-    const status = statusOf([file("a.yaml", { staged: ADDED })]);
-
-    expect(commitBlockedReason(status, { subject: "add a", body: "" })).toBeNull();
-  });
-
-  it("blocks with nothing staged", () => {
-    const status = statusOf([file("a.yaml", { worktree: MODIFIED })]);
-
-    expect(commitBlockedReason(status, { subject: "add a", body: "" })).toBe(
-      "Stage something to commit.",
-    );
-  });
-
-  it("blocks with no subject", () => {
-    const status = statusOf([file("a.yaml", { staged: ADDED })]);
-
-    expect(commitBlockedReason(status, { subject: "  ", body: "a body" })).toBe(
-      "A commit needs a subject line.",
-    );
-  });
 
-  // Committing a half-merged tree is the mistake worth naming first, so a
-  // conflict outranks the other two reasons.
-  it("blocks on a conflict even when something else is staged and typed", () => {
-    const status = statusOf([
-      file("a.yaml", { conflicted: true }),
-      file("b.yaml", { staged: ADDED }),
-    ]);
-
-    expect(commitBlockedReason(status, { subject: "ship it", body: "" })).toBe(
-      "Resolve the conflicted files before committing.",
-    );
+  it("is empty on a tree with nothing unmerged", () => {
+    expect(conflictedFiles(statusOf([file("a.yaml", { worktree: MODIFIED })]))).toEqual([]);
   });
 });
 
diff --git a/frontend/src/lib/gitOps.ts b/frontend/src/lib/gitOps.ts
index d82d457..393aad4 100644
--- a/frontend/src/lib/gitOps.ts
+++ b/frontend/src/lib/gitOps.ts
@@ -9,64 +9,11 @@ import { AVAILABLE, UNTRACKED } from "./git";
  * deciding what may be called. The split is the one `gitStatus.ts` already
  * uses, and it is what lets "a dirty worktree blocks a branch switch" be a
  * test over a value instead of a test that renders a dropdown.
- */
-
-/** A commit message, as the two fields the editor shows. */
-export interface CommitDraft {
-  readonly subject: string;
-  readonly body: string;
-}
-
-export const EMPTY_DRAFT: CommitDraft = { subject: "", body: "" };
-
-/**
- * Joins a draft into the message git receives: subject, a blank line, body —
- * the convention every git tool reads a commit by.
- *
- * A draft with no body produces just the subject rather than a subject with
- * two trailing newlines, so `git log --format=%b` on it is empty instead of
- * whitespace.
- */
-export function commitMessage(draft: CommitDraft): string {
-  const subject = draft.subject.trim();
-  const body = draft.body.trim();
-  return body === "" ? subject : `${subject}\n\n${body}`;
-}
-
-/** Whether a draft has enough in it to be a commit message. The body alone is
- * not enough: a commit whose subject line is blank shows up as an empty row in
- * every log. */
-export function hasMessage(draft: CommitDraft): boolean {
-  return draft.subject.trim() !== "";
-}
-
-/**
- * The paths one row's action has to act on.
- *
- * A rename is one row and two paths, and sending only the one the row is named
- * after leaves the other half of the rename behind. Unstaging `new.yaml` alone
- * after a `git mv` leaves `old.yaml` **staged as a deletion** — a change the
- * user did not ask for, sitting in the index, that a later commit would carry
- * out. Staging has the mirror problem: the new name arrives without the old
- * one's removal.
  *
- * A copy's source is unchanged in the index, so including it is a no-op rather
- * than a special case worth branching on.
+ * Nothing here decides anything about staging or committing (#39). The UI has
+ * no control for either, so a rule about when one would be allowed would be a
+ * rule with no control to gate.
  */
-export function pathsOf(file: FileStatus): string[] {
-  return file.origPath === "" ? [file.path] : [file.path, file.origPath];
-}
-
-/** Every path a group's action has to act on, deduplicated: a rename's source
- * can also be another row's path. */
-export function pathsOfAll(files: readonly FileStatus[]): string[] {
-  return [...new Set(files.flatMap(pathsOf))];
-}
-
-/** The paths staged for commit. */
-export function stagedPaths(status: Status): readonly string[] {
-  return status.files.filter((f) => !f.conflicted && f.staged !== "").map((f) => f.path);
-}
 
 /** Every unmerged path. These get their own group and their own instruction:
  * v1 has no in-app merge tool, and resolution happens in the terminal. */
@@ -74,27 +21,6 @@ export function conflictedFiles(status: Status): readonly FileStatus[] {
   return status.files.filter((f) => f.conflicted);
 }
 
-/**
- * Why the commit button is disabled, or null when it is not.
- *
- * A reason rather than a boolean because a disabled control with no
- * explanation is the thing users file bugs about. The order is the order a
- * user hits them: a conflict outranks an empty index, because committing a
- * half-merged tree is the mistake worth naming first.
- */
-export function commitBlockedReason(status: Status, draft: CommitDraft): string | null {
-  if (conflictedFiles(status).length > 0) {
-    return "Resolve the conflicted files before committing.";
-  }
-  if (stagedPaths(status).length === 0) {
-    return "Stage something to commit.";
-  }
-  if (!hasMessage(draft)) {
-    return "A commit needs a subject line.";
-  }
-  return null;
-}
-
 /**
  * Whether the worktree has changes a branch switch could disturb.
  *
@@ -113,7 +39,8 @@ export function isDirty(status: Status): boolean {
  * Why the branch switcher is disabled, or null when it is not.
  *
  * The dirty check is m6t's, made before git runs, so the message names what to
- * do about it. git would refuse a checkout that overwrote a change on its own,
+ * do about it — in the terminal, which is where committing and stashing both
+ * happen (#39). git would refuse a checkout that overwrote a change on its own,
  * but only for the files that collide — a switch that silently carried half
  * the user's edits onto another branch is the case this closes.
  */
diff --git a/frontend/src/lib/useGitOps.test.ts b/frontend/src/lib/useGitOps.test.ts
index e389d56..093df58 100644
--- a/frontend/src/lib/useGitOps.test.ts
+++ b/frontend/src/lib/useGitOps.test.ts
@@ -20,9 +20,6 @@ type SpiedGit = { [K in keyof Git]: Mock<Git[K]> };
 function fakeGit(overrides: Partial<Git> = {}): SpiedGit {
   const seam: SpiedGit = {
     status: vi.fn(() => Promise.resolve(emptyStatus())),
-    stage: vi.fn(() => Promise.resolve()),
-    unstage: vi.fn(() => Promise.resolve()),
-    commit: vi.fn(() => Promise.resolve()),
     pull: vi.fn(() => Promise.resolve()),
     push: vi.fn(() => Promise.resolve()),
     checkout: vi.fn(() => Promise.resolve()),
@@ -46,16 +43,16 @@ async function mount(git: ReturnType<typeof fakeGit>, onChanged = vi.fn()) {
 }
 
 describe("running an operation", () => {
-  it("stages the paths it is given", async () => {
+  it("checks out the branch it is given", async () => {
     const git = fakeGit();
     const { result } = await mount(git);
 
     act(() => {
-      result.current.stage(["a.yaml", "b.yaml"]);
+      result.current.checkout("feature/x");
     });
 
     await waitFor(() => {
-      expect(git.stage).toHaveBeenCalledWith("/w/infra", ["a.yaml", "b.yaml"]);
+      expect(git.checkout).toHaveBeenCalledWith("/w/infra", "feature/x");
     });
   });
 
@@ -79,7 +76,7 @@ describe("running an operation", () => {
     const { result, onChanged } = await mount(git);
 
     act(() => {
-      result.current.unstage(["a.yaml"]);
+      result.current.push("", false);
     });
 
     await waitFor(() => {
@@ -106,36 +103,19 @@ describe("running an operation", () => {
 
   it("carries git's own message verbatim", async () => {
     const git = fakeGit({
-      commit: vi.fn(() =>
-        Promise.reject(new Error("git commit in /w/infra: nothing to commit, working tree clean")),
+      push: vi.fn(() =>
+        Promise.reject(new Error("git push in /w/infra: failed to push some refs")),
       ),
     });
     const { result } = await mount(git);
 
-    await act(async () => {
-      await result.current.commit("subject");
-    });
-
-    expect(result.current.error).toBe(
-      "git commit in /w/infra: nothing to commit, working tree clean",
-    );
-  });
-
-  it("reports whether a commit was recorded, so the editor keeps a failed draft", async () => {
-    const git = fakeGit({ commit: vi.fn(() => Promise.reject(new Error("nothing to commit"))) });
-    const { result } = await mount(git);
-
-    let committed: boolean | null = null;
-    await act(async () => {
-      committed = await result.current.commit("subject");
+    act(() => {
+      result.current.push("", false);
     });
-    expect(committed).toBe(false);
 
-    git.commit.mockImplementation(() => Promise.resolve());
-    await act(async () => {
-      committed = await result.current.commit("subject");
+    await waitFor(() => {
+      expect(result.current.error).toBe("git push in /w/infra: failed to push some refs");
     });
-    expect(committed).toBe(true);
   });
 
   it("clears a previous failure when the next operation succeeds", async () => {
@@ -150,7 +130,7 @@ describe("running an operation", () => {
     });
 
     act(() => {
-      result.current.stage(["a.yaml"]);
+      result.current.checkout("main");
     });
     await waitFor(() => {
       expect(result.current.error).toBeNull();
@@ -207,10 +187,10 @@ describe("running an operation", () => {
     const { result } = renderHook(() => useGitOps(null, vi.fn(), git));
 
     act(() => {
-      result.current.stage(["a.yaml"]);
+      result.current.pull();
     });
 
-    expect(git.stage).not.toHaveBeenCalled();
+    expect(git.pull).not.toHaveBeenCalled();
     expect(git.branches).not.toHaveBeenCalled();
   });
 });
diff --git a/frontend/src/lib/useGitOps.ts b/frontend/src/lib/useGitOps.ts
index 2c09f2e..995b795 100644
--- a/frontend/src/lib/useGitOps.ts
+++ b/frontend/src/lib/useGitOps.ts
@@ -16,6 +16,11 @@ import { wailsGit } from "./git";
  * fails. A failed pull is the case that makes this necessary rather than
  * cosmetic: it exits non-zero *and* leaves conflicted files behind, so the
  * panel that has to show them is only correct if a failure refreshes too.
+ *
+ * The three operations that write the index — stage, unstage, commit — are
+ * not here (#39). They belong to the agent in the terminal, which runs the
+ * user's own git; two writers of one index, only one of which the agent can
+ * see, is a disagreement waiting to happen.
  */
 export interface GitOpsController {
   /** An operation is in flight. Every control disables on it: git serializes
@@ -29,12 +34,6 @@ export interface GitOpsController {
   /** Configured remotes, for the first-push prompt. */
   readonly remotes: readonly string[];
   readonly dismissError: () => void;
-  readonly stage: (paths: readonly string[]) => void;
-  readonly unstage: (paths: readonly string[]) => void;
-  /** Resolves true when the commit was recorded, so the caller can clear the
-   * message editor — and only then. A draft thrown away on a failed commit is
-   * a draft the user has to retype. */
-  readonly commit: (message: string) => Promise<boolean>;
   readonly pull: () => void;
   readonly push: (remote: string, setUpstream: boolean) => void;
   readonly checkout: (branch: string) => void;
@@ -94,7 +93,12 @@ export function useGitOps(
   }, [root, listRefs]);
 
   /**
-   * Runs one operation and reports whether it succeeded.
+   * Runs one operation, leaving its outcome in `error`.
+   *
+   * Nothing is returned. The three operations left all report the same way —
+   * git's own message in `error`, the new state through the status re-read
+   * below — so a success flag would be a second channel for what `error`
+   * already says, and no caller has anything to do with it.
    *
    * The busy flag is not a lock. Two operations cannot overlap through the UI
    * because everything disables on it, and if they somehow did, git's own
@@ -103,23 +107,21 @@ export function useGitOps(
    * repository.
    */
   const run = useCallback(
-    async (operation: (root: string) => Promise<void>): Promise<boolean> => {
+    async (operation: (root: string) => Promise<void>): Promise<void> => {
       const reading = target.current;
       if (reading === null) {
-        return false;
+        return;
       }
       setBusy(true);
       setError(null);
       try {
         await operation(reading);
-        return true;
       } catch (failure: unknown) {
         // Dropped when the project changed underneath: the message would name
         // a repository that is no longer on screen.
         if (target.current === reading) {
           setError(describeError(failure));
         }
-        return false;
       } finally {
         // Unconditional, unlike the error above. `busy` belongs to the
         // controller, not to the project: gating it on the project still
@@ -137,25 +139,6 @@ export function useGitOps(
     [listRefs],
   );
 
-  const stage = useCallback(
-    (paths: readonly string[]) => {
-      void run((at) => seam.current.stage(at, [...paths]));
-    },
-    [run],
-  );
-
-  const unstage = useCallback(
-    (paths: readonly string[]) => {
-      void run((at) => seam.current.unstage(at, [...paths]));
-    },
-    [run],
-  );
-
-  const commit = useCallback(
-    (message: string) => run((at) => seam.current.commit(at, message)),
-    [run],
-  );
-
   const pull = useCallback(() => {
     void run((at) => seam.current.pull(at));
   }, [run]);
@@ -184,9 +167,6 @@ export function useGitOps(
     branches,
     remotes,
     dismissError,
-    stage,
-    unstage,
-    commit,
     pull,
     push,
     checkout,
diff --git a/frontend/src/style.css b/frontend/src/style.css
index a124792..2dc163d 100644
--- a/frontend/src/style.css
+++ b/frontend/src/style.css
@@ -1105,12 +1105,12 @@ button:hover {
 }
 
 /* =============================================================================
-   Git operations: branch bar, row actions, commit box (#9)
+   Git operations: the branch bar (#9, #39)
    ========================================================================== */
 
 /* The sidebar is one column of stacked sections. The changes list is the only
-   one that scrolls; the branch bar and the commit box are fixed chrome around
-   it, so a long changes list never pushes the Commit button off the bottom. */
+   one that scrolls; the branch bar is fixed chrome beside it, so a long
+   changes list never pushes Pull and Push off the bottom. */
 .branchbar {
   display: flex;
   flex-wrap: wrap;
@@ -1196,64 +1196,6 @@ button:hover {
   font-size: var(--m6t-font-size-sm);
 }
 
-/* The group-level action sits at the far end of its heading, where it reads as
-   belonging to the group rather than to the first row under it. */
-.changes__all {
-  margin-left: auto;
-  padding: 0 var(--m6t-space-2);
-  border: none;
-  background: none;
-  color: var(--m6t-muted);
-  font: inherit;
-  font-size: var(--m6t-font-size-sm);
-  text-transform: none;
-  letter-spacing: normal;
-}
-
-.changes__all:hover:not(:disabled) {
-  color: var(--m6t-accent);
-}
-
-.changes__item {
-  display: flex;
-  align-items: center;
-}
-
-/* The row takes the space; the action keeps its own and appears on hover, the
-   same discipline the tree's menu button follows — so the list reads as paths
-   rather than as a column of buttons. */
-.changes__item .changes__row {
-  min-width: 0;
-  flex: 1;
-}
-
-.changes__action {
-  flex: none;
-  width: var(--m6t-space-6);
-  height: var(--m6t-row);
-  padding: 0;
-  border: none;
-  border-radius: 0;
-  background: none;
-  color: var(--m6t-muted);
-  opacity: 0;
-}
-
-.changes__item:hover .changes__action,
-.changes__item:focus-within .changes__action {
-  opacity: 1;
-}
-
-.changes__action:hover:not(:disabled) {
-  color: var(--m6t-accent);
-}
-
-.changes__action:disabled,
-.changes__all:disabled {
-  cursor: default;
-  opacity: 0.4;
-}
-
 .changes__group--conflict {
   color: var(--m6t-git-conflict);
 }
@@ -1264,67 +1206,3 @@ button:hover {
   color: var(--m6t-muted);
   font-size: var(--m6t-font-size-sm);
 }
-
-.commit {
-  display: flex;
-  flex-direction: column;
-  gap: var(--m6t-space-2);
-  flex: none;
-  padding: var(--m6t-space-3);
-  border-top: 1px solid var(--m6t-border);
-}
-
-.commit__subject,
-.commit__body {
-  padding: var(--m6t-space-2);
-  border: 1px solid var(--m6t-border);
-  border-radius: var(--m6t-radius);
-  background: var(--m6t-bg);
-  color: inherit;
-  font: inherit;
-  font-size: var(--m6t-font-size-sm);
-}
-
-.commit__subject:focus-visible,
-.commit__body:focus-visible {
-  border-color: var(--m6t-accent);
-  outline: none;
-}
-
-/* The body is prose the user may have pasted a manifest into, so it resizes
-   vertically and never horizontally — a sidebar that widens itself would move
-   the editor out from under the pointer. */
-.commit__body {
-  resize: vertical;
-  font-family: var(--m6t-font-mono);
-}
-
-.commit__actions {
-  display: flex;
-  align-items: center;
-  gap: var(--m6t-space-3);
-}
-
-.commit__submit {
-  height: var(--m6t-row);
-  font-size: var(--m6t-font-size-sm);
-}
-
-.commit__submit:disabled {
-  cursor: default;
-  opacity: 0.5;
-}
-
-.commit__submit:disabled:hover {
-  border-color: var(--m6t-border);
-}
-
-.commit__staged,
-.commit__blocked {
-  color: var(--m6t-muted);
-  font-size: var(--m6t-font-size-sm);
-}
-
-.commit__blocked {
-  margin: 0;
-}
diff --git a/frontend/wailsjs/go/app/App.d.ts b/frontend/wailsjs/go/app/App.d.ts
index b352d1e..787f6ad 100755
--- a/frontend/wailsjs/go/app/App.d.ts
+++ b/frontend/wailsjs/go/app/App.d.ts
@@ -18,20 +18,14 @@ export function GitBranches(arg1:string):Promise<Array<string>>;
 
 export function GitCheckout(arg1:string,arg2:string):Promise<void>;
 
-export function GitCommit(arg1:string,arg2:string):Promise<void>;
-
 export function GitPull(arg1:string):Promise<void>;
 
 export function GitPush(arg1:string,arg2:string,arg3:boolean):Promise<void>;
 
 export function GitRemotes(arg1:string):Promise<Array<string>>;
 
-export function GitStage(arg1:string,arg2:Array<string>):Promise<void>;
-
 export function GitStatus(arg1:string):Promise<git.Status>;
 
-export function GitUnstage(arg1:string,arg2:Array<string>):Promise<void>;
-
 export function ListDirectory(arg1:string,arg2:string):Promise<Array<watch.Entry>>;
 
 export function OpenTerminal(arg1:string,arg2:number,arg3:number):Promise<string>;
diff --git a/frontend/wailsjs/go/app/App.js b/frontend/wailsjs/go/app/App.js
index 7a9effd..2a4e136 100755
--- a/frontend/wailsjs/go/app/App.js
+++ b/frontend/wailsjs/go/app/App.js
@@ -26,10 +26,6 @@ export function GitCheckout(arg1, arg2) {
   return window['go']['app']['App']['GitCheckout'](arg1, arg2);
 }
 
-export function GitCommit(arg1, arg2) {
-  return window['go']['app']['App']['GitCommit'](arg1, arg2);
-}
-
 export function GitPull(arg1) {
   return window['go']['app']['App']['GitPull'](arg1);
 }
@@ -42,18 +38,10 @@ export function GitRemotes(arg1) {
   return window['go']['app']['App']['GitRemotes'](arg1);
 }
 
-export function GitStage(arg1, arg2) {
-  return window['go']['app']['App']['GitStage'](arg1, arg2);
-}
-
 export function GitStatus(arg1) {
   return window['go']['app']['App']['GitStatus'](arg1);
 }
 
-export function GitUnstage(arg1, arg2) {
-  return window['go']['app']['App']['GitUnstage'](arg1, arg2);
-}
-
 export function ListDirectory(arg1, arg2) {
   return window['go']['app']['App']['ListDirectory'](arg1, arg2);
 }
diff --git a/godobject_budget_test.go b/godobject_budget_test.go
index a98c14d..4b708c5 100644
--- a/godobject_budget_test.go
+++ b/godobject_budget_test.go
@@ -161,7 +161,15 @@ const (
 	// ceiling cares about: folding the heads into ListDirectory's reply would
 	// have made every directory expansion pay for file reads it usually does
 	// not need, which is the cost the lazy classification exists to avoid.
-	maxAppMethods = 24
+	//
+	// 24 -> 21 in #39, the first time this ceiling has come down. GitStage,
+	// GitUnstage and GitCommit are gone because the UI they existed for is
+	// gone: what records work in m6t is the agent in the terminal, running
+	// the user's own git. The #9 note above argued that each of the eight was
+	// a request with an answer and no throughput, which was true and is not
+	// the test these three failed — they failed the older one, that the bound
+	// surface is only what the UI calls.
+	maxAppMethods = 21
 
 	// appCoordinatorType is the struct these ceilings bound.
 	appCoordinatorType = "App"
diff --git a/internal/app/git.go b/internal/app/git.go
index 94ca5f0..7831513 100644
--- a/internal/app/git.go
+++ b/internal/app/git.go
@@ -31,9 +31,17 @@ func (*App) GitStatus(root string) (git.Status, error) {
 }
 
 // The mutating half of DESIGN.md §7. Each of these is one operation the
-// changes panel or the branch bar puts a control on, and each is a thin pass
-// through to internal/git — the binding layer composes services, it does not
-// implement them.
+// branch bar puts a control on, and each is a thin pass through to
+// internal/git — the binding layer composes services, it does not implement
+// them.
+//
+// Staging and committing are deliberately absent (#39). The bound surface is
+// the API (CLAUDE.md) and it is only what the UI calls; the UI has no control
+// that writes the index, because m6t's answer to "record this work" is the
+// agent in the terminal, running the user's own git in the user's own
+// worktree. A binding kept for a caller that does not exist would be a second
+// writer of the index, reachable from the bridge, that the agent cannot see.
+// What is left is what the branch bar still puts a button on.
 //
 // None of them returns a status. The mutation changes .git, the watcher
 // publishes a `git` event for it (PROTOCOL.md §5), and the frontend reads the
@@ -48,30 +56,6 @@ func (*App) GitStatus(root string) (git.Status, error) {
 // with git's: the first line a user reads should say which button they
 // pressed, and git's explanation should be the rest of it.
 
-// GitStage adds paths to the index.
-func (*App) GitStage(root string, paths []string) error {
-	if err := git.Stage(root, paths); err != nil {
-		return fmt.Errorf("staging in %s: %w", root, err)
-	}
-	return nil
-}
-
-// GitUnstage removes paths from the index, leaving the working tree alone.
-func (*App) GitUnstage(root string, paths []string) error {
-	if err := git.Unstage(root, paths); err != nil {
-		return fmt.Errorf("unstaging in %s: %w", root, err)
-	}
-	return nil
-}
-
-// GitCommit records the index under message.
-func (*App) GitCommit(root, message string) error {
-	if err := git.Commit(root, message); err != nil {
-		return fmt.Errorf("committing in %s: %w", root, err)
-	}
-	return nil
-}
-
 // GitPull integrates the upstream branch, honoring the repository's own
 // rebase configuration.
 func (*App) GitPull(root string) error {
diff --git a/internal/app/git_test.go b/internal/app/git_test.go
index 8cac2f9..1ffd88d 100644
--- a/internal/app/git_test.go
+++ b/internal/app/git_test.go
@@ -95,57 +95,15 @@ func TestGitStatusWrapsARealFailureWithTheProjectPath(t *testing.T) {
 // A stub here would prove only that this file calls internal/git — which the
 // one-line bodies already show — while these prove the operation reaches the
 // user's repository and that the status the UI reads back agrees with it.
-func TestGitStageAndUnstageMoveAPathThroughTheIndex(t *testing.T) {
-	a := testApp(t)
-	dir := gitRepoDir(t)
-	writeManifest(t, dir, "deploy.yaml", "kind: Deployment\n")
-
-	if err := a.GitStage(dir, []string{"deploy.yaml"}); err != nil {
-		t.Fatalf("GitStage: %v", err)
-	}
-	if got := stagedState(t, a, dir, "deploy.yaml"); got != git.StateAdded {
-		t.Fatalf("staged = %q, want %q", got, git.StateAdded)
-	}
-
-	if err := a.GitUnstage(dir, []string{"deploy.yaml"}); err != nil {
-		t.Fatalf("GitUnstage: %v", err)
-	}
-	if got := stagedState(t, a, dir, "deploy.yaml"); got != "" {
-		t.Errorf("staged = %q, want nothing staged", got)
-	}
-}
-
-func TestGitCommitClearsTheChangesList(t *testing.T) {
-	a := testApp(t)
-	dir := gitRepoDir(t)
-	writeManifest(t, dir, "deploy.yaml", "kind: Deployment\n")
-
-	if err := a.GitStage(dir, []string{"deploy.yaml"}); err != nil {
-		t.Fatalf("GitStage: %v", err)
-	}
-	if err := a.GitCommit(dir, "add the deployment"); err != nil {
-		t.Fatalf("GitCommit: %v", err)
-	}
-
-	status, err := a.GitStatus(dir)
-	if err != nil {
-		t.Fatalf("GitStatus: %v", err)
-	}
-	if len(status.Files) != 0 {
-		t.Errorf("files = %+v, want a clean tree", status.Files)
-	}
-}
-
+//
+// The commit the fixture needs is made with runRepoGit, the way the terminal
+// agent makes one: there is no commit binding to make it with (#39).
 func TestGitBranchesAndCheckoutSwitchThroughTheBinding(t *testing.T) {
 	a := testApp(t)
 	dir := gitRepoDir(t)
 	writeManifest(t, dir, "deploy.yaml", "kind: Deployment\n")
-	if err := a.GitStage(dir, []string{"deploy.yaml"}); err != nil {
-		t.Fatalf("GitStage: %v", err)
-	}
-	if err := a.GitCommit(dir, "first"); err != nil {
-		t.Fatalf("GitCommit: %v", err)
-	}
+	runRepoGit(t, dir, "add", "-A")
+	runRepoGit(t, dir, "commit", "-qm", "first")
 	runRepoGit(t, dir, "branch", "feature/x")
 
 	branches, err := a.GitBranches(dir)
@@ -188,11 +146,11 @@ func TestGitOperationsSurfaceGitsOwnWords(t *testing.T) {
 	a := testApp(t)
 	dir := gitRepoDir(t)
 
-	err := a.GitCommit(dir, "nothing is staged")
+	err := a.GitPush(dir, "", false)
 	if err == nil {
-		t.Fatal("GitCommit succeeded with an empty index")
+		t.Fatal("GitPush succeeded with no remote configured")
 	}
-	if !strings.Contains(err.Error(), "nothing to commit") {
+	if !strings.Contains(err.Error(), "No configured push destination") {
 		t.Errorf("error = %q, want git's own explanation", err)
 	}
 	if !strings.Contains(err.Error(), dir) {
@@ -202,13 +160,10 @@ func TestGitOperationsSurfaceGitsOwnWords(t *testing.T) {
 
 // The bound surface is a public API (CLAUDE.md), so it is checked here and not
 // only in the UI that normally calls it.
-func TestGitStageRejectsAPathOutsideTheRepository(t *testing.T) {
+func TestGitOperationsRejectRefsGitWouldReadAsOptions(t *testing.T) {
 	a := testApp(t)
 	dir := gitRepoDir(t)
 
-	if err := a.GitStage(dir, []string{"../../etc/hosts"}); !errors.Is(err, git.ErrOutsideRoot) {
-		t.Errorf("GitStage(..) = %v, want ErrOutsideRoot", err)
-	}
 	if err := a.GitCheckout(dir, "--orphan"); !errors.Is(err, git.ErrInvalidRef) {
 		t.Errorf("GitCheckout(--orphan) = %v, want ErrInvalidRef", err)
 	}
@@ -256,22 +211,6 @@ func runRepoGit(t *testing.T, dir string, args ...string) {
 	}
 }
 
-// stagedState reads one path's index-side state back through the binding, so
-// the assertion goes through the same call the UI makes.
-func stagedState(t *testing.T, a *App, dir, path string) git.State {
-	t.Helper()
-	status, err := a.GitStatus(dir)
-	if err != nil {
-		t.Fatalf("GitStatus: %v", err)
-	}
-	for _, f := range status.Files {
-		if f.Path == path {
-			return f.Staged
-		}
-	}
-	return ""
-}
-
 // The composition test for #8's wiring.
 //
 // internal/watch is tested against its own Events seam and internal/stream
diff --git a/internal/git/ops.go b/internal/git/ops.go
index d510ffa..780dc98 100644
--- a/internal/git/ops.go
+++ b/internal/git/ops.go
@@ -3,15 +3,20 @@ package git
 import (
 	"errors"
 	"fmt"
-	"io/fs"
-	"path"
-	"path/filepath"
 	"strings"
 )
 
-// The daily git loop (DESIGN.md §7): stage, unstage, commit, pull, push and
-// branch switch. status.go is the reading half of the same section; this is
-// the half that writes.
+// The daily git loop (DESIGN.md §7): pull, push and branch switch. status.go
+// is the reading half of the same section; this is the half that writes.
+//
+// Staging and committing are not here, and their absence is a decision rather
+// than an omission (#39). m6t's answer to "record this work" is the agent in
+// the embedded terminal, running the user's own git in the user's own
+// worktree; a second writer of the index, driven from the UI and invisible to
+// that agent, is two tools disagreeing about one repository. What survives is
+// what the branch bar still puts a button on, and none of it writes the index:
+// pull and push move refs, and a checkout is gated behind a dirty-worktree
+// rule the UI computes from the status it already holds.
 //
 // Every operation here is one invocation of the system git with an argv slice.
 // Nothing is composed out of several calls behind the user's back, because a
@@ -24,85 +29,19 @@ import (
 // process would protect against only one of the two writers while implying it
 // protected against both. A lock collision surfaces as git's own message.
 
-// Argument failures. These are rejections, not git failures: no subprocess
-// runs. They exist because the bound surface is a public API (CLAUDE.md) and
-// the frontend is not the only thing that can reach it — a path argument is
-// checked here rather than trusted because it came from a status this package
-// produced.
-var (
-	// ErrNoPaths is an operation given nothing to act on.
-	ErrNoPaths = errors.New("no paths given")
-
-	// ErrOutsideRoot is a path that does not name something inside the
-	// worktree: absolute, containing "..", or naming .git itself.
-	ErrOutsideRoot = errors.New("path is outside the repository")
-
-	// ErrEmptyMessage is a commit whose message has no content. git refuses
-	// this too; catching it here keeps the UI's disabled-button rule and the
-	// backend's rule from being able to disagree.
-	ErrEmptyMessage = errors.New("commit message is empty")
-
-	// ErrInvalidRef is a branch or remote name git could read as an option or
-	// as something other than a ref.
-	ErrInvalidRef = errors.New("not a valid branch or remote name")
-)
-
-// gitDir is the one directory inside a worktree no operation may name.
-const gitDir = ".git"
-
-// rejectedFormat is the shape of every argument rejection above: what was
-// given, then why. One constant because revive counts repeats of a literal,
-// and because the four rejections should read alike when a user hits one.
-const rejectedFormat = "resolving %s: %w"
-
-// Stage adds paths to the index — the "stage" half of the changes panel.
-//
-// A deleted path stages its deletion and a conflicted path is marked
-// resolved, both of which are `git add`'s own behavior and both of which are
-// what the button means where it appears.
-func Stage(root string, paths []string) error {
-	specs, err := pathspecs(paths)
-	if err != nil {
-		return err
-	}
-	return mutate(root, invocation{}, append([]string{"add", "--"}, specs...)...)
-}
-
-// Unstage removes paths from the index, leaving the working tree alone.
-//
-// `git reset` rather than `git restore --staged`: restore resolves HEAD, so on
-// a repository with no commits yet it fails outright, and the first thing a
-// user does in a fresh repository is stage the wrong file.
-func Unstage(root string, paths []string) error {
-	specs, err := pathspecs(paths)
-	if err != nil {
-		return err
-	}
-	// -q because reset prints the unstaged paths to stdout on success and
-	// nothing reads them.
-	return mutate(root, invocation{}, append([]string{"reset", "-q", "--"}, specs...)...)
-}
-
-// Commit records the index under message.
+// ErrInvalidRef is a branch or remote name git could read as an option or as
+// something other than a ref.
 //
-// The message goes in on stdin rather than as `-m`: it is multi-line prose of
-// no bounded length, and stdin is the one channel that cannot run into an argv
-// limit or end up in the log line runWith writes.
-//
-// Nothing is passed about signing. Whether a commit is signed is
-// `commit.gpgsign` in the user's own config, and this is the user's own git —
-// a flag here would override a repository policy m6t has no business having an
-// opinion about.
-func Commit(root, message string) error {
-	if strings.TrimSpace(message) == "" {
-		return ErrEmptyMessage
-	}
-	// --cleanup=whitespace is what `default` already does for a message given
-	// on stdin; saying it outright means a future change to git's default
-	// cannot silently start stripping lines that begin with "#" out of a
-	// message the user typed.
-	return mutate(root, invocation{stdin: message}, "commit", "--cleanup=whitespace", "-F", "-")
-}
+// It is a rejection, not a git failure: no subprocess runs. It exists because
+// the bound surface is a public API (CLAUDE.md) and the frontend is not the
+// only thing that can reach it — a ref argument is checked here rather than
+// trusted because it came from a list this package produced.
+var ErrInvalidRef = errors.New("not a valid branch or remote name")
+
+// rejectedFormat is the shape of an argument rejection: what was given, then
+// why. One constant because revive counts repeats of a literal, and because
+// every rejection should read alike when a user hits one.
+const rejectedFormat = "resolving %s: %w"
 
 // Pull integrates the upstream branch, honoring the repository's own
 // pull.rebase and branch.<name>.rebase configuration (DESIGN.md §7). No
@@ -202,48 +141,6 @@ func lines(out string) []string {
 	return found
 }
 
-// pathspecs turns caller paths into pathspecs git will treat as literal file
-// names.
-//
-// The `:(literal)` prefix is the load-bearing part. A bare path is a *glob*:
-// git reads `weird[1].yaml` as a character class and stages nothing, and a
-// path beginning with `-` is read as an option even after `--`, because `--`
-// separates revisions from pathspecs and does not stop magic from being
-// parsed. `:(literal)` says the rest of the string is the name, exactly.
-func pathspecs(paths []string) ([]string, error) {
-	if len(paths) == 0 {
-		return nil, ErrNoPaths
-	}
-	specs := make([]string, 0, len(paths))
-	for _, p := range paths {
-		clean, err := relative(p)
-		if err != nil {
-			return nil, err
-		}
-		specs = append(specs, ":(literal)"+clean)
-	}
-	return specs, nil
-}
-
-// relative validates one caller path and returns its slash-separated form.
-//
-// fs.ValidPath is the authoritative syntactic check — the same one
-// internal/watch validates against — and it refuses absolute paths, ".." and
-// the other shapes fs.FS forbids on every platform. "." is refused on top of
-// it: it names the whole worktree, and an operation that quietly staged
-// everything when given an empty-looking argument is the kind of thing a user
-// discovers after committing it.
-func relative(relPath string) (string, error) {
-	clean := path.Clean(filepath.ToSlash(relPath))
-	if !fs.ValidPath(clean) || clean == "." {
-		return "", fmt.Errorf(rejectedFormat, relPath, ErrOutsideRoot)
-	}
-	if clean == gitDir || strings.HasPrefix(clean, gitDir+"/") {
-		return "", fmt.Errorf(rejectedFormat, relPath, ErrOutsideRoot)
-	}
-	return clean, nil
-}
-
 // validateRef rejects a branch or remote name git could read as something
 // other than a name.
 //
diff --git a/internal/git/ops_test.go b/internal/git/ops_test.go
index ed6bb44..621948e 100644
--- a/internal/git/ops_test.go
+++ b/internal/git/ops_test.go
@@ -3,7 +3,6 @@ package git
 import (
 	"errors"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -45,185 +44,6 @@ func fileIn(status Status, path string) FileStatus {
 	return FileStatus{}
 }
 
-func TestStageMovesAPathToTheIndex(t *testing.T) {
-	dir := commitFixture(t)
-	writeFixtureFile(t, dir, "a.yaml", "one\ntwo\n")
-
-	if err := Stage(dir, []string{"a.yaml"}); err != nil {
-		t.Fatalf("Stage: %v", err)
-	}
-
-	got := fileIn(statusOf(t, dir), "a.yaml")
-	if got.Staged != StateModified {
-		t.Errorf("staged = %q, want %q", got.Staged, StateModified)
-	}
-	if got.Worktree != "" {
-		t.Errorf("worktree = %q, want it clean after staging", got.Worktree)
-	}
-}
-
-// The pathspec test that justifies :(literal). A bare `weird[1].yaml` is a
-// glob to git: it matches nothing, git exits 128 with "did not match any
-// files", and the file stays unstaged. Without the magic prefix this fails.
-func TestStageHandlesAPathThatLooksLikeAGlob(t *testing.T) {
-	dir := commitFixture(t)
-	writeFixtureFile(t, dir, "weird[1].yaml", "glob\n")
-
-	if err := Stage(dir, []string{"weird[1].yaml"}); err != nil {
-		t.Fatalf("Stage: %v", err)
-	}
-
-	if got := fileIn(statusOf(t, dir), "weird[1].yaml"); got.Staged != StateAdded {
-		t.Errorf("staged = %q, want %q — the glob characters were interpreted", got.Staged, StateAdded)
-	}
-}
-
-// The other half: `--` does not stop git from parsing pathspec magic, so a
-// path beginning with "-" needs the same prefix to be inert.
-func TestStageHandlesAPathThatLooksLikeAnOption(t *testing.T) {
-	dir := commitFixture(t)
-	writeFixtureFile(t, dir, "-dash.yaml", "dash\n")
-
-	if err := Stage(dir, []string{"-dash.yaml"}); err != nil {
-		t.Fatalf("Stage: %v", err)
-	}
-
-	if got := fileIn(statusOf(t, dir), "-dash.yaml"); got.Staged != StateAdded {
-		t.Errorf("staged = %q, want %q", got.Staged, StateAdded)
-	}
-}
-
-func TestStageRecordsADeletion(t *testing.T) {
-	dir := commitFixture(t)
-	if err := os.Remove(filepath.Join(dir, "a.yaml")); err != nil {
-		t.Fatalf("removing a.yaml: %v", err)
-	}
-
-	if err := Stage(dir, []string{"a.yaml"}); err != nil {
-		t.Fatalf("Stage: %v", err)
-	}
-
-	if got := fileIn(statusOf(t, dir), "a.yaml"); got.Staged != StateDeleted {
-		t.Errorf("staged = %q, want %q", got.Staged, StateDeleted)
-	}
-}
-
-func TestUnstageLeavesTheWorkingTreeAlone(t *testing.T) {
-	dir := commitFixture(t)
-	writeFixtureFile(t, dir, "a.yaml", "one\ntwo\n")
-	runFixtureGit(t, dir, "add", "-A")
-
-	if err := Unstage(dir, []string{"a.yaml"}); err != nil {
-		t.Fatalf("Unstage: %v", err)
-	}
-
-	got := fileIn(statusOf(t, dir), "a.yaml")
-	if got.Staged != "" {
-		t.Errorf("staged = %q, want nothing staged", got.Staged)
-	}
-	if got.Worktree != StateModified {
-		t.Errorf("worktree = %q, want the edit still on disk", got.Worktree)
-	}
-	if content := readFixtureFile(t, dir, "a.yaml"); content != "one\ntwo\n" {
-		t.Errorf("a.yaml = %q, want the edit intact", content)
-	}
-}
-
-// Why Unstage is `git reset` and not `git restore --staged`: restore resolves
-// HEAD, which does not exist yet in a repository whose first commit has not
-// been made. Staging the wrong file into a fresh repository is a normal thing
-// to do and has to be undoable.
-func TestUnstageWorksBeforeTheFirstCommit(t *testing.T) {
-	dir := initRepo(t)
-	writeFixtureFile(t, dir, "a.yaml", "one\n")
-	runFixtureGit(t, dir, "add", "-A")
-
-	if err := Unstage(dir, []string{"a.yaml"}); err != nil {
-		t.Fatalf("Unstage on an unborn branch: %v", err)
-	}
-
-	if got := fileIn(statusOf(t, dir), "a.yaml"); got.Worktree != StateUntracked {
-		t.Errorf("a.yaml = %+v, want it back to untracked", got)
-	}
-}
-
-func TestStageRejectsAPathOutsideTheWorktree(t *testing.T) {
-	dir := commitFixture(t)
-
-	for _, escape := range []string{"../outside.yaml", "/etc/hosts", ".git/config", "."} {
-		if err := Stage(dir, []string{escape}); !errors.Is(err, ErrOutsideRoot) {
-			t.Errorf("Stage(%q) = %v, want ErrOutsideRoot", escape, err)
-		}
-	}
-}
-
-func TestStageRejectsAnEmptyPathList(t *testing.T) {
-	if err := Stage(commitFixture(t), nil); !errors.Is(err, ErrNoPaths) {
-		t.Errorf("Stage(nil) = %v, want ErrNoPaths", err)
-	}
-}
-
-func TestCommitRecordsTheIndex(t *testing.T) {
-	dir := commitFixture(t)
-	writeFixtureFile(t, dir, "a.yaml", "one\ntwo\n")
-	runFixtureGit(t, dir, "add", "-A")
-
-	if err := Commit(dir, "subject line\n\nA body paragraph.\n"); err != nil {
-		t.Fatalf("Commit: %v", err)
-	}
-
-	if files := statusOf(t, dir).Files; len(files) != 0 {
-		t.Errorf("files = %+v, want a clean tree after committing", files)
-	}
-	if subject := gitOutput(t, dir, "log", "-1", "--format=%s"); subject != "subject line" {
-		t.Errorf("subject = %q, want the message's first line", subject)
-	}
-	if body := gitOutput(t, dir, "log", "-1", "--format=%b"); !strings.Contains(body, "A body paragraph.") {
-		t.Errorf("body = %q, want the message's body", body)
-	}
-}
-
-// --cleanup=whitespace, not strip: a line beginning with "#" is content in a
-// message the user typed, not a comment to discard. A YAML snippet pasted into
-// a commit body is the case this protects.
-func TestCommitKeepsAHashLineInTheMessage(t *testing.T) {
-	dir := commitFixture(t)
-	writeFixtureFile(t, dir, "a.yaml", "one\ntwo\n")
-	runFixtureGit(t, dir, "add", "-A")
-
-	if err := Commit(dir, "subject\n\n# not a comment\n"); err != nil {
-		t.Fatalf("Commit: %v", err)
-	}
-
-	if body := gitOutput(t, dir, "log", "-1", "--format=%b"); !strings.Contains(body, "# not a comment") {
-		t.Errorf("body = %q, want the hash line kept", body)
-	}
-}
-
-func TestCommitRejectsAnEmptyMessage(t *testing.T) {
-	dir := commitFixture(t)
-
-	for _, blank := range []string{"", "   ", "\n\n\t\n"} {
-		if err := Commit(dir, blank); !errors.Is(err, ErrEmptyMessage) {
-			t.Errorf("Commit(%q) = %v, want ErrEmptyMessage", blank, err)
-		}
-	}
-}
-
-// Nothing staged is git's refusal to report, and the user has to see git's
-// own words rather than a sentence m6t invented (DESIGN.md §7).
-func TestCommitWithNothingStagedSurfacesGitsRefusal(t *testing.T) {
-	dir := commitFixture(t)
-
-	err := Commit(dir, "nothing to record")
-	if err == nil {
-		t.Fatal("Commit succeeded with an empty index")
-	}
-	if !strings.Contains(err.Error(), "nothing to commit") {
-		t.Errorf("error = %q, want git's own explanation", err)
-	}
-}
-
 func TestBranchesListsLocalBranchesOnly(t *testing.T) {
 	dir := commitFixture(t)
 	runFixtureGit(t, dir, "branch", "feature/x")
@@ -376,10 +196,16 @@ func TestPushWithoutUpstreamSurfacesGitsRefusal(t *testing.T) {
 	}
 }
 
-// The full loop of the acceptance criteria, against a real remote: stage,
-// commit, push to a branch with no upstream, then pull a commit back. The
-// remote is a bare repository on disk — a real git remote over the file
-// transport, so nothing here is stubbed except the network.
+// The full loop of the acceptance criteria, against a real remote: commit in
+// the worktree the way the terminal agent does, push to a branch with no
+// upstream, then pull a commit back. The remote is a bare repository on disk —
+// a real git remote over the file transport, so nothing here is stubbed except
+// the network.
+//
+// The commit is made with runFixtureGit rather than through this package,
+// because this package no longer records commits (#39): what the loop has to
+// prove is that Push and Pull cope with work that arrived from outside m6t,
+// which is now the only way work arrives.
 func TestTheFullLoopAgainstARemote(t *testing.T) {
 	remote := t.TempDir()
 	runFixtureGit(t, remote, "init", "-q", "--bare", "-b", "main")
@@ -388,12 +214,8 @@ func TestTheFullLoopAgainstARemote(t *testing.T) {
 	runFixtureGit(t, dir, "remote", "add", "origin", remote)
 
 	writeFixtureFile(t, dir, "a.yaml", "one\ntwo\n")
-	if err := Stage(dir, []string{"a.yaml"}); err != nil {
-		t.Fatalf("Stage: %v", err)
-	}
-	if err := Commit(dir, "edit a.yaml"); err != nil {
-		t.Fatalf("Commit: %v", err)
-	}
+	runFixtureGit(t, dir, "add", "-A")
+	runFixtureGit(t, dir, "commit", "-qm", "edit a.yaml")
 	if err := Push(dir, "origin", true); err != nil {
 		t.Fatalf("Push --set-upstream: %v", err)
 	}
@@ -517,17 +339,3 @@ func readFixtureFile(t *testing.T, dir, name string) string {
 	}
 	return string(content)
 }
-
-// gitOutput runs a reading git command against a fixture and returns its
-// trimmed stdout — the assertions that have to look at what was actually
-// recorded rather than at what Load reports about the worktree.
-func gitOutput(t *testing.T, dir string, args ...string) string {
-	t.Helper()
-	cmd := exec.CommandContext(t.Context(), "git", append([]string{"-C", dir}, args...)...)
-	cmd.Env = append(os.Environ(), "LC_ALL=C", "GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null")
-	out, err := cmd.Output()
-	if err != nil {
-		t.Fatalf("fixture: git %s: %v", strings.Join(args, " "), err)
-	}
-	return strings.TrimSpace(string(out))
-}
diff --git a/internal/git/run.go b/internal/git/run.go
index b5a9211..5ca93ec 100644
--- a/internal/git/run.go
+++ b/internal/git/run.go
@@ -59,8 +59,8 @@ var (
 
 // invocation is how one git call differs from the default one.
 //
-// The zero value is a mutating, local call with no input — the shape every
-// operation in ops.go wants — so only the exceptions have to say anything.
+// The zero value is a mutating, local call — the shape Checkout wants — so
+// only the exceptions have to say anything.
 type invocation struct {
 	// readOnly adds --no-optional-locks, which stops git from refreshing the
 	// index as a side effect of reading it. It is what keeps the status
@@ -68,17 +68,13 @@ type invocation struct {
 	// watches .git, so a read that wrote .git/index would publish a change,
 	// which would trigger another read, forever.
 	//
-	// A mutating call must NOT set it. Those write the index on purpose, and
-	// the resulting event is the notification the UI needs to refresh.
+	// A mutating call must NOT set it. Those change .git on purpose, and the
+	// resulting event is the notification the UI needs to refresh.
 	readOnly bool
 
 	// network extends the deadline to networkTimeout for a call that talks to
 	// a remote.
 	network bool
-
-	// stdin is fed to git and closed. It carries a commit message, which is
-	// the one input too large and too free-form to be an argv element.
-	stdin string
 }
 
 // runGit invokes git inside root as a read-only call and returns its standard
@@ -93,9 +89,7 @@ func runGit(root string, args ...string) (string, error) {
 // so a worktree path containing shell metacharacters is inert
 // (.semgrep/go-security.yml enforces the no-shell half of this). The argv is
 // logged, as CLAUDE.md requires of every external binary: what the app ran on
-// the user's repository is the first thing anyone debugging it needs. stdin is
-// deliberately not logged — it is a commit message, which is the user's prose
-// and not part of what was run.
+// the user's repository is the first thing anyone debugging it needs.
 func runWith(root string, call invocation, args ...string) (string, error) {
 	binary, err := exec.LookPath(binaryName)
 	if err != nil {
@@ -110,11 +104,12 @@ func runWith(root string, call invocation, args ...string) (string, error) {
 
 	cmd := exec.CommandContext(ctx, binary, argv...)
 	cmd.Env = commandEnv()
-	// Always a reader, never the inherited stdin: a git that reached the
+	// An empty reader, never the inherited stdin: a git that reached the
 	// user's terminal would be reading keystrokes meant for a shell in
-	// another pane. An operation with no input gets an empty one, which is
-	// what makes a remote asking for a password fail instead of hang.
-	cmd.Stdin = strings.NewReader(call.stdin)
+	// another pane. Nothing here has input to give it — no operation writes
+	// the index (#39) — and an empty stdin is what makes a remote asking for
+	// a password fail instead of hang.
+	cmd.Stdin = strings.NewReader("")
 
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout = &stdout
@@ -135,6 +130,14 @@ func runWith(root string, call invocation, args ...string) (string, error) {
 // which is exactly the loss of detail DESIGN.md §7 forbids. stderr still wins
 // when both are set — when git has something to say about a failure, that is
 // where it says it.
+//
+// That instance is no longer reachable: this package stopped running `git
+// commit` in #39, and none of pull, push or checkout was observed choosing
+// stdout for a failure. It stays anyway, because which stream carries the
+// reason is git's decision per subcommand rather than this package's, and the
+// failure mode of guessing wrong is silent — an error box with "exit status 1"
+// in it and no way to find out what happened. Five lines and a unit test is
+// the cheaper side of that trade.
 func explanation(stdout, stderr string) string {
 	if strings.TrimSpace(stderr) != "" {
 		return stderr
diff --git a/internal/git/run_test.go b/internal/git/run_test.go
index 76fae3f..54958b8 100644
--- a/internal/git/run_test.go
+++ b/internal/git/run_test.go
@@ -257,6 +257,10 @@ func TestNetworkInvocationsGetTheLongerDeadline(t *testing.T) {
 // git does not always fail on stderr: `git commit` with an empty index exits
 // non-zero and explains itself on stdout. Reporting only stderr would hand the
 // user "exit status 1", which is the loss of detail DESIGN.md §7 forbids.
+//
+// This is the only test of the stdout branch since #39 took `git commit` out
+// of the package — no remaining subcommand was observed picking stdout for a
+// failure. See explanation's own comment for why the branch stays.
 func TestExplanationFallsBackToStdout(t *testing.T) {
 	if got := explanation("nothing to commit\n", ""); got != "nothing to commit\n" {
 		t.Errorf("explanation = %q, want stdout when stderr is empty", got)
diff --git a/package_budget_test.go b/package_budget_test.go
index d432d9c..4a54a1b 100644
--- a/package_budget_test.go
+++ b/package_budget_test.go
@@ -47,8 +47,16 @@ var structuralPins = map[string]packagePin{
 		why: "Wails binding layer: the bound object, the window options, and the adapters that join sibling services",
 	},
 	"internal/git": {
-		loc: 1000, exported: 27,
-		why: "git service: both halves of DESIGN.md §7 over the system git — porcelain v2 status with its two degraded states reported as values rather than errors, and the daily loop that writes (stage, unstage, commit, pull, push, branch switch)",
+		// 27 -> 21 exported and 1000 -> 900 LOC in #39. Stage, Unstage,
+		// Commit and the three argument errors only they could return
+		// (ErrNoPaths, ErrOutsideRoot, ErrEmptyMessage) are gone: the UI has
+		// no control that writes the index, so under the no-vaporware rule
+		// the service methods behind those controls are not "kept for #35",
+		// they are unreachable code. Both figures ratchet down rather than
+		// standing still, because a ceiling left where a package used to be
+		// is room for the next thing to move in unnoticed.
+		loc: 900, exported: 21,
+		why: "git service: both halves of DESIGN.md §7 over the system git — porcelain v2 status with its two degraded states reported as values rather than errors, and the writes the terminal is a bad place for (pull, push, branch switch)",
 	},
 	"internal/buildinfo": {
 		loc: 150, exported: 2,