Run the recipe in a copy and prove the original is byte-identical

Plain but effective: copy, run in the copy, compare hashes against the original. 'It looked unchanged' is not evidence; a hash is.

Step one: fingerprint the original

cd /path/to/project && find . -type f -not -path './.git/*' -exec sha256sum {} + | sort > /tmp/before.txt
wc -l /tmp/before.txt

Note the line count; it is your file count for later comparison.

Step two: copy and switch workspace

cp -r /path/to/project /tmp/project-trial
cd /tmp/project-trial

Start the session inside the copy. With the workspace pointed at the copy, workspace-write permits writes there and nowhere else — that mechanism is what protects the original, not the model's goodwill.

Step three: run the recipe

Use one that definitely writes:

In this directory generate FILES.md listing every .md file and its first line. Do not modify any existing file.

Step four: compare fingerprints

cd /path/to/project && find . -type f -not -path './.git/*' -exec sha256sum {} + | sort > /tmp/after.txt
diff /tmp/before.txt /tmp/after.txt && echo 'original unchanged'

No output plus that echo is proof. Diff output means it did touch the original — and then the problem is not a disobedient model but a misconfigured workspace.

Step five: see what the copy gained

cd /tmp/project-trial && git status --short 2>/dev/null || find . -newer /tmp/before.txt -type f | head -20

Git if available, modification time otherwise. This yields a list of touched files, far more useful than a 'done'.