feat(board): price filing a row against the branch's own diff (CLOUD-514)

.claude/rules/toolchain.md

@@ -274,16 +274,28 @@ call` with no `CLOUD-*` key **in that same paragraph** stops the lap. Two open
 - `filed-here-check` is that stop's sibling, and the second half of CLOUD-514:
   `deferral-check` prices a decision left with no home, this prices a home opened
   instead of a fix. `board-write-record` (a `PostToolUse` body) records every row
-  this branch put on the board — kind, id, the tracker's `updatedAt`, and the
-  `ready-lint` verdict over the body the **tracker returned** — and `land` calls
-  this beside `deferral-check`, refusing when a row this branch CREATED was stored
-  `unready`. Three states rather than two: `ready` passes, `unready` refuses, and
+  this branch put on the board — kind, id, the tracker's `updatedAt`, the
+  `ready-lint` verdict over the body the **tracker returned**, and the diff
+  overlap — and `land` calls this beside `deferral-check`, refusing when a row
+  this branch CREATED was stored `unready`. Three states rather than two: `ready` passes, `unready` refuses, and
   `-` — the recorder could not lint — passes, because reading "not answered" as
   "refused" turns a verdict about the environment into one about the row.
   Comments are recorded and never gated: a comment on the row that already owns a
   finding is the honest common case, and pricing it pushes the pressure toward
-  silence, which is the failure `finding-sink-check` exists to catch. The verdict
-  is unforgeable by the author for the reason the receipt pattern usually is not —
+  silence, which is the failure `finding-sink-check` exists to catch.
+  **A second refusal prices PROXIMITY** (`filed-over-own-diff`, CLOUD-514 phase
+  3), because the first prices only refinement and a Ready block is prose —
+  measured, four rows filed in three and a half minutes and every one recorded
+  `ready`, so the toll certified the punts instead of reversing them. The
+  recorder's fifth column is `board-diff-overlap`: the tracked paths the row's
+  body names intersected with `origin/main...HEAD`, basenames resolved (exact
+  matching found none of the three real rows) and an ambiguous one resolving to
+  nothing. Non-zero stops the lap, and the load-bearing difference is that there
+  is **no prose remedy** — fix it here, comment on the row that owns it, file it
+  after landing from a clean tree, or `BATTEN_FILED_HERE_OVERLAP=1`, which
+  records which rows it overrode. It prices filing against **the diff** and
+  claims nothing wider: a punt about code the branch never touched is invisible
+  to it. The verdict is unforgeable by the author for the reason the receipt pattern usually is not —
   `ready-lint` over a payload the caller assembles was measured green three times
   against text in a local file, once under an id no row carried. Fails open on an
   absent record, and a branch predating the recorder can never have one: the store

mise-tasks/board-diff-overlap

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+#MISE description="Effect: how many paths an issue body names that this branch is also changing (body on stdin; prints the count and the paths)"
+#
+# CLOUD-514's missing half. `filed-here-check` charges a new row a complete Ready
+# block, on the theory that filing is cheap and fixing is expensive so the toll
+# reverses the arithmetic. Its own header stated the bound honestly: it prices
+# "without anything judging whether a given spin-off was lazy", and "it does not
+# compare the row to the diff".
+#
+# WHY THE TOLL DID NOT BITE. Measured 2026-08-20: four rows filed in three and a
+# half minutes, then twelve spent writing four Ready blocks to pay for them, and
+# `board-write-record` recorded every one `ready`. A toll denominated in PROSE is
+# denominated in the one currency an agent has without limit, so it reversed
+# nothing — it certified the punts. CLOUD-514 wrote the re-open predicate this
+# satisfies ("a Ready block written to satisfy `ready-lint` rather than to be
+# worked"), and its acceptance — "the cheapest path through the gate for a defect
+# in the branch's own diff is to fix it" — was unmet.
+#
+# WHAT THIS DECIDES, AND WHY IT IS NOT A JUDGEMENT. One fact: how many paths the
+# body names that this branch is also changing. A set intersection over two file
+# lists, the shape the protected-path gate already uses ({verb} x {protected}).
+# It scores no prose, compares no semantics and infers no intent, so
+# non-negotiable 3 holds. Whether a given spin-off was lazy stays exactly as
+# unjudged as `filed-here-check` leaves it.
+#
+# BASENAMES RESOLVE, AND THAT IS MEASURED RATHER THAN ASSUMED. Bodies here write
+# `git.rs:107`, not `crates/batten/src/git.rs`. Against the three rows this was
+# built from, exact path matching finds ZERO and basename resolution finds all
+# three — so exact matching would have shipped a sensor blind to its own corpus.
+# An AMBIGUOUS basename resolves to NOTHING rather than to a guess, which is the
+# "could not look" reading this repo draws everywhere; 28 of 530 tracked
+# basenames are ambiguous in this tree.
+#
+# POINTER-ONLY IS STRUCTURAL, not careful: only paths TRACKED IN THIS REPOSITORY
+# can reach the output, so a body's prose, a customer name or a pasted credential
+# cannot (non-negotiable 4).
+#
+# The Python is inline for `macos-link-check`'s reason — one file, so the code
+# and the mutations that corrupt it cannot drift into two authorities — but fed
+# through a QUOTED heredoc rather than `-c "…"`, so nothing inside it is subject
+# to a second round of shell expansion. Both inputs arrive as env vars, which
+# leaves stdin free for the script itself.
+#
+# Usage: board-diff-overlap   (an issue body on stdin)
+# Prints: `<count> <path>...` on success, or `-` when it could not look.
+# Exit 0 always — this is a sensor; `filed-here-check` is the gate.
+#
+# The mutation drops the basename arm, which is the whole reason it sees
+# anything: every body in the corpus names `git.rs`, not the tracked path.
+#MUTANT overlap-exact-only|s/^    cands = by_base.get(.*)$/    cands = []/|a short form resolves to the tracked path
+# And an ambiguous basename must stay unresolved: guessing one of several is a
+# wrong answer wearing a right answer's shape.
+#MUTANT overlap-guesses-ambiguous|s/if len(cands) == 1:/if len(cands) >= 1:/|an ambiguous basename resolves to nothing
+# The intersection is with what this branch CHANGES, not with what it tracks. Drop
+# that term and every row naming any file in the repository is refused, which is a
+# gate nobody can work under and therefore a gate that gets switched off.
+#MUTANT overlap-ignores-the-diff|s/^overlap = sorted(named & changed)$/overlap = sorted(named)/|a row naming only untouched files reports nothing
+set -uo pipefail
+
+body=$(cat) || {
+	echo -
+	exit 0
+}
+[ -n "$body" ] || {
+	echo -
+	exit 0
+}
+
+# Both halves come from git, and either being unavailable is "could not look".
+changed=$(git diff --name-only origin/main...HEAD 2>/dev/null) || {
+	echo -
+	exit 0
+}
+tracked=$(git ls-files 2>/dev/null) || {
+	echo -
+	exit 0
+}
+[ -n "$tracked" ] || {
+	echo -
+	exit 0
+}
+
+BODY="$body" CHANGED="$changed" TRACKED="$tracked" python3 - <<'PY' 2>/dev/null || echo -
+import collections
+import os
+import re
+
+tracked = [line for line in os.environ["TRACKED"].splitlines() if line]
+changed = {line for line in os.environ["CHANGED"].splitlines() if line}
+body = os.environ["BODY"]
+
+by_base = collections.defaultdict(list)
+for path in tracked:
+    by_base[path.rsplit("/", 1)[-1]].append(path)
+exact = set(tracked)
+
+# Three shapes, because bodies here use all three: a dotted path or filename, a
+# backticked `mise-tasks/<task>`, and a bare backticked task name with no
+# extension at all.
+tokens = set(re.findall(r"[A-Za-z0-9_][A-Za-z0-9_./-]*\.[A-Za-z0-9]+", body))
+tokens |= set(re.findall(r"`(mise-tasks/[A-Za-z0-9_.-]+)`", body))
+tokens |= {m for m in re.findall(r"`([a-z0-9][a-z0-9-]{3,})`", body) if m in by_base}
+
+named = set()
+for token in tokens:
+    token = token.rstrip(".,;:")
+    if token in exact:
+        named.add(token)
+        continue
+    cands = by_base.get(token.rsplit("/", 1)[-1], [])
+    # Exactly one candidate resolves. Several is ambiguous and resolves to none:
+    # guessing which file was meant is a wrong answer wearing a right one's shape.
+    if len(cands) == 1:
+        named.add(cands[0])
+
+overlap = sorted(named & changed)
+print(f"{len(overlap)} {' '.join(overlap)}".strip() if overlap else "0")
+PY

mise-tasks/board-write-record

@@ -44,8 +44,24 @@
 # board does not have.
 #
 # POINTER-ONLY IS LOAD-BEARING HERE (non-negotiable 4), not decorative: the text
-# this reads is the entire issue body. Four fields reach the file — kind, id,
-# updatedAt, verdict — and nothing is ever printed.
+# this reads is the entire issue body. Five fields reach the file — kind, id,
+# updatedAt, verdict, and the diff overlap — and nothing is ever printed.
+#
+# THE FIFTH FIELD IS PHASE 3 (CLOUD-514), and it is what the first two phases
+# left out. The `verdict` column prices REFINEMENT: it asks whether the new row
+# was written to Ready. It cannot ask the question the issue's acceptance is
+# actually about — whether the row names code THIS BRANCH IS HOLDING OPEN —
+# because a Ready block is prose, and prose is the one currency an agent has
+# without limit. Measured 2026-08-20 on this branch: four rows filed in three and
+# a half minutes, twelve more spent writing four Ready blocks, and every one
+# recorded `ready`. The toll did not reverse the arithmetic; it certified it.
+#
+# So the overlap column records how many paths the row's body names that
+# `origin/main...HEAD` is also changing — `mise-tasks/board-diff-overlap`, which
+# owns the predicate and its measurement. It is recorded for a groom as well as a
+# create, for the same reason the verdict is: a later reading of the same row by
+# the same mechanism is simply the current one. Pointer-only holds by
+# construction there — only paths tracked in this repository can appear.
 #
 # FAILS OPEN AND SILENT on everything it cannot establish. A recorder that
 # blocked or noised a board write would cause the failure `finding-sink-check`
@@ -67,6 +83,10 @@
 # comment too, so an issue-key column fills with comment uuids and sink 2 becomes
 # unobservable while every count still looks right.
 #MUTANT comment-id-from-response|s/^if \[ "\$kind" = comment \]; then$/if false; then/|records the issue key its input names
+# The mutation stops asking the diff question at all, so every row records `-`
+# and `filed-here-check` reads "could not look" for a row filed straight over the
+# branch's own open files — phase 3 wired shut while every count still looks right.
+#MUTANT overlap-never-measured|s/^\t\toverlap=\$(printf .*$/\t\toverlap=-/|a row whose body names a changed file records a non-zero overlap
 set -uo pipefail
 
 #
@@ -218,10 +238,23 @@ if [ "$kind" = issue ]; then
 	fi
 fi
 
+# THE DIFF COLUMN. `-` is "could not look" here exactly as it is for the verdict:
+# outside a checkout, no `origin/main` to diff against, or a body the tracker did
+# not return. The description read is the tracker's RESPONSE, not the caller's
+# argument, so it is unforgeable for the same reason the verdict is.
+overlap=-
+if [ "$kind" = issue ]; then
+	description=$(jq -r '.description // empty' <<<"$row" 2>/dev/null) || description=""
+	if [ -n "$description" ]; then
+		overlap=$(printf '%s' "$description" | "$(dirname -- "${BASH_SOURCE[0]}")/board-diff-overlap" 2>/dev/null) || overlap=-
+	fi
+	[ -n "$overlap" ] || overlap=-
+fi
+
 mkdir -p "$git_dir/batten-receipts" 2>/dev/null || exit 0
 # Slashes are the one character a filename cannot carry; the substitution matches
 # every other branch-keyed receipt here.
 record="$git_dir/batten-receipts/board-writes.${branch//\//-}"
-printf '%s %s %s %s\n' "$kind" "$id" "$updated" "$verdict" >>"$record" 2>/dev/null || exit 0
+printf '%s %s %s %s %s\n' "$kind" "$id" "$updated" "$verdict" "$overlap" >>"$record" 2>/dev/null || exit 0
 
 exit 0