diff --git a/.claude/scripts/sync.sh b/.claude/scripts/sync.sh
index 26d22d4..8ad2db6 100755
--- a/.claude/scripts/sync.sh
+++ b/.claude/scripts/sync.sh
@@ -205,6 +205,16 @@ if [ -f ".gitmodules" ] && git config --file .gitmodules --get-regexp '^submodul
         fi
         # Populate if missing (fresh clone) at the pinned commit.
         git submodule update --init -- "$ppath" >/dev/null 2>&1
+        # Reconcile this submodule's git identity to match identity.json — same
+        # guarantee the parent repo gets at sync.sh:157-158. Without this, commits
+        # in newly-cloned submodules land under the system default (e.g.
+        # "<unix-user> @<hostname>") instead of the actual human. Skip if
+        # identity.json was unreadable (USER_DISPLAY left at "unknown").
+        # Drift incident that motivated this: youtube-sync-docker commits
+        # ef903c8 + fdff0a7 from GURU-KALI 2026-05-31.
+        if [ "$USER_DISPLAY" != "unknown" ]; then
+            (cd "$ppath" && reconcile_git_identity "$USER_DISPLAY" "$USER_EMAIL") || true
+        fi
     done < <(git config --file .gitmodules --get-regexp '^submodule\..*\.path$')
 
     # Advance each initialized submodule to its remote branch tip.