diff --git a/governance/REPOS.yaml b/governance/REPOS.yaml
index ee5aa0a..0888a0c 100644
--- a/governance/REPOS.yaml
+++ b/governance/REPOS.yaml
@@ -63,6 +63,13 @@ repos:
     role: 产品仓——短视频导演工具（ADR-0021：线上存在但未申报=GM-4 漂移，补申报；治理面
       随首个正式 PR 落地 AGENTS.md/CODEOWNERS 接入）
 
+  - name: Script_Writer
+    layer: L2
+    visibility: public
+    status: active
+    role: 产品仓——剧本创作工具（ADR-0021：建仓未申报=GM-4 漂移，补申报；治理面随首个
+      正式 PR 落地 AGENTS.md/CODEOWNERS 接入，路径同 Shorts_Director）
+
   - name: AI_Web_School
     layer: L2
     visibility: public
diff --git a/governance/apply.sh b/governance/apply.sh
index 3f70547..2f84317 100755
--- a/governance/apply.sh
+++ b/governance/apply.sh
@@ -69,8 +69,9 @@ for f in "$DIR"/rulesets/*.json; do
 done
 
 echo "==> 2/5 Actions 允许策略 + 白名单"
+# enabled_repositories 为 org 级 PUT 必填字段（ADR-0021：缺失即 422——apply 长期"静默 FAIL 一项"）
 code=$(api -o /dev/null -w '%{http_code}' -X PUT "https://api.github.com/orgs/$ORG/actions/permissions" \
-  -d '{"enabled": true, "allowed_actions": "selected"}')
+  -d "$(jq -c '.actions_policy | {enabled_repositories, allowed_actions}' "$EXPECTED")")
 expect_ok "actions permissions" "$code"
 code=$(api -o /dev/null -w '%{http_code}' -X PUT "https://api.github.com/orgs/$ORG/actions/permissions/selected-actions" \
   -d "$(jq -c '.actions_policy | {github_owned_allowed, verified_allowed, patterns_allowed}' "$EXPECTED")")
diff --git a/governance/drift-check.sh b/governance/drift-check.sh
index ede783d..31099ae 100755
--- a/governance/drift-check.sh
+++ b/governance/drift-check.sh
@@ -53,6 +53,9 @@ EXTRA=$(jq -c --argjson known "$(jq -s '[.[].name]' "$DIR"/rulesets/*.json)" \
 AP=$(api "https://api.github.com/orgs/$ORG/actions/permissions")
 [[ "$(jq -r .allowed_actions <<<"$AP")" == "$(jq -r .actions_policy.allowed_actions "$EXPECTED")" ]] \
   || drift "allowed_actions=$(jq -r .allowed_actions <<<"$AP")"
+# enabled_repositories 同检（ADR-0021）：apply §2 写该字段而 check 不验=修复回路盲区
+[[ "$(jq -r .enabled_repositories <<<"$AP")" == "$(jq -r .actions_policy.enabled_repositories "$EXPECTED")" ]] \
+  || drift "enabled_repositories=$(jq -r .enabled_repositories <<<"$AP") ≠ expected $(jq -r .actions_policy.enabled_repositories "$EXPECTED")"
 
 SA=$(api "https://api.github.com/orgs/$ORG/actions/permissions/selected-actions")
 [[ "$(jq -c '{github_owned_allowed, verified_allowed, patterns_allowed}' <<<"$SA")" == \
diff --git a/governance/expected-state.json b/governance/expected-state.json
index 5700ebc..fb0aeaf 100644
--- a/governance/expected-state.json
+++ b/governance/expected-state.json
@@ -16,7 +16,8 @@
       "ossf/scorecard-action"
     ],
     "default_workflow_permissions": "read",
-    "default_workflow_permissions_can_approve": false
+    "default_workflow_permissions_can_approve": false,
+    "enabled_repositories": "all"
   },
   "code_security": {
     "configuration_name": "GitHub recommended",
@@ -49,10 +50,20 @@
     ]
   },
   "direct_push_exemptions": {
-    "comment": "§8 直推检测豁免=已经 ADR 追认回填的破玻璃直推（事件定性见 ADR-0017：两次误直推净变更仅为 Trae IDE 分享 zip 与误入的 agent-registry gitlink，彼时 PR 流程已运转——diff 证据 f3974a6...416f5f5；并非'初始建仓导入'，勘误见 ADR-0016 附录）。豁免机制=GM-2 破玻璃回填的机器可读形式（ADR-0016 附录）：逐完整 SHA 登记，新直推不可能搭便车；豁免须有 ADR 背书，不得口头/临时豁免。",
+    "comment": "§8 直推检测豁免——两类，均须 ADR 背书，逐完整 SHA 登记（新直推不可能搭便车）：(a) 破玻璃直推回填：GM-2 破玻璃的机器可读回填形式（ADR-0016 附录），事件定性见 ADR-0017（.github 两条：净变更仅为 Trae IDE 分享 zip 与误入 gitlink，彼时 PR 流程已运转）；(b) 建仓 bootstrap 初始 commit（ADR-0021）：仓库创建时序上分支/PR 尚不存在、不可能走 PR——Shorts_Director/agent-tools/Script_Writer 的 Initial commit 类（含 GitHub UI 建仓附带的 README 编辑 commit），登记为豁免而非追认破玻璃。",
     ".github": [
       "9b056b3a925038484a8f6655ea45f81f071d5df6",
       "416f5f57fd459f6ece3587f3aa20b772148ad335"
+    ],
+    "Shorts_Director": [
+      "d81fea9db47e065fd2bd5211dd1a8e3c26589f41",
+      "014f38986ee5338fe0d7e3ea260c9a4f289af401"
+    ],
+    "agent-tools": [
+      "1050459443ce0373cffff7788c668d6f5dec0048"
+    ],
+    "Script_Writer": [
+      "3446a39a0e2ec7527cab4e6da87b6e6ee0199fa7"
     ]
   }
 }