diff --git a/CHANGELOG.md b/CHANGELOG.md
index 482aecd..03b1558 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 * MINOR version when you add functionality in a backwards-compatible manner, and
 * PATCH version when you make backwards-compatible bug fixes.
 
+## Unreleased
+
+- fix: `/coding:commit` § 2d — document that untracked files must be `git add`-ed before the pathspec commit; a commit pathspec matches only tracked paths, so every commit introducing a new file failed with `did not match any file(s) known to git`
+
 ## v0.49.0
 
 - feat: Wire the `--security` security-review mode into the review commands (`/coding:pr-review`, `/coding:code-review`, `/coding:local-review`) — activates the dormant selector-mode security extension (recon-derived session-local `/tmp/security-model.json`, six classifier trait groups with non-negotiable authz over-selection and deterministic invariant selection, verifier-gated high-severity findings, derived blocking, `SECURITY_MODEL_FILE` citation validation); JSON-rendered `Security Findings` + `Security Model` provenance report sections; PR-mode diff anchoring (pr-review/local-review) / whole-repo audit scope (code-review); fail-closed dependency toolchain pass; finalize acceptance scenarios 007-010 and register the mode in README.md
diff --git a/commands/commit.md b/commands/commit.md
index 9d5f4c0..9182278 100644
--- a/commands/commit.md
+++ b/commands/commit.md
@@ -207,6 +207,17 @@ Pathspec placement matters: `git commit -m "msg" -- <paths>` works, `git commit
 
 `git add <paths>` alone is NOT sufficient — a later bare `git commit` still commits whatever was already staged. The `--` pathspec on the commit itself is what bounds it.
 
+**Untracked files must be `git add`-ed first.** A commit pathspec matches only paths git already knows, so a brand-new file is rejected outright — `error: pathspec '<file>' did not match any file(s) known to git` — and the whole commit fails. This hits every commit that introduces a new file, which is most feature work. It reads like a contradiction of the line above; it is not. Both hold: `git add` is required to make a new path commit-able, and the `--` pathspec is required to bound what gets committed.
+
+Sequence when any path is untracked:
+
+```bash
+git diff --cached --name-only          # must be empty, or only yours — abort if a sibling session pre-staged something
+git add <new paths>
+git diff --cached --name-only          # confirm only your paths are staged
+git commit -m "msg" -- <all paths>     # pathspec still bounds the commit
+```
+
 **Exception — after `git rm --cached`:** do not use a pathspec (it commits working-tree state and silently re-adds files staged for deletion). Confirm `git diff --cached --name-only` lists only the intended deletions, then run a bare `git commit`.
 
 ### 3. Detect Pipeline-Only Changes