feat(policy)!: a refusal is typed, overrides are issued, and the shell tier retires behind the migration gate

.claude/rules/policy-modules.md

@@ -39,6 +39,41 @@ from the rule's name. `policy test`'s coverage binds on that literal, because a
 `test_<id>` naming convention would be satisfied by a test that never touches the
 predicate.
 
+## A refusal is `{rule, verdict, subjects}` — there is no `msg`
+
+Refused at **load**, in both directions, so this belongs with the shape rules
+above rather than with the authoring judgement below.
+
+```rego
+violation contains {
+	"rule": "shell-rule-retired",
+	"verdict": "V-SHELL-RULE-EDITED",
+	"subjects": [{"path": path}],
+} if { ... }
+```
+
+`verdict` is a **token** the `[[verdict]]` registry declares; the prose that used
+to live in `msg` lives there, once, where a gate can read it. A module binding
+`msg` fails to load and says which key; so does one raising a token no row
+declares, one raising a token declared as a tombstone, and one that **composes**
+its verdict with `sprintf` — a class a reader cannot look up is not a class. The
+other direction is refused too: a `[[verdict]]` row nothing raises fails the load,
+because a class no gate reaches reads as coverage while its routes have never been
+walked.
+
+The measured reason (CLOUD-1050): `msg` was a `String`, so a refusal naming no
+remedy, naming a task that does not exist, or offering an override with no
+precondition were all _expressible and none checkable_. Two of those were live in
+this repository when the row was written.
+
+`subjects` is optional and ordered, and every member is a **tagged pointer** —
+`{path}`, `{path, line}`, `{count}`, `{artifact}` — never prose, which is what
+makes non-negotiable rule 4 structural here rather than a habit each module keeps.
+The **first path-bearing subject becomes the finding's own pointer**, so the order
+is a statement about which one a reader should follow first; a class with nothing
+to point at omits the key rather than inventing one. The bare-string `deny`
+channel carries a token too, and is held to the same registry.
+
 ## Patterns come from `[[pattern]]`, never inline
 
 An inline regex is **refused at load**. A pattern is a `[[pattern]]` row read as
@@ -65,13 +100,23 @@ own suite green, and enforced nothing.
 A **tree**-scoped module (`scope = "tree"`, run by `batten check`) reads
 `input.tree.documents`, `input.tree.lines`, `input.tree.invocations`,
 `input.tree.uses`, `input.tree.tracked`, `input.tree.missing`,
-`input.tree.produced`, `input.tree.landing`, and the git family —
+`input.tree.produced`, `input.tree.records`, `input.tree.landing`, and the git
+family —
 `input.tree.git-head`, `input.tree.git-refs`, `input.tree.git-ranges`,
 `input.tree.git-remote`, `input.tree.git-status`.
 
 A **mediated-call** module (`scope = "mediated_call"`, run by `batten hook`)
-reads `input.call.command`, `input.call.event`, `input.call.operation` and
-`input.call.writes`, plus the `facts` object.
+reads `input.call.command`, `input.call.event`, `input.call.operation`,
+`input.call.writes`, `input.call["final-message"]`, `input.call.transcript` and
+`input.call["stop-repeat"]`, plus the `facts` object.
+
+The last three are the **Stop** projections (CLOUD-1051) and every one is `null`
+on every other event, which is the three-valued read working rather than a gap: a
+module asking for them at `pre-tool` gets undefined, Rego reads undefined as
+_does not hold_, and a Stop predicate therefore cannot fire on a tool call. They
+are `call` fields rather than facts because nothing resolves them — the harness
+hands them over. `transcript` is the **path**, never a byte of the session; a
+module wanting the contents asks for a fact the engine resolves.
 
 `schema/policy-input.schema.json` and `schema/policy-call.schema.json` are the
 authority and are generated — do not hand-edit either, and do not restate the key

.claude/rules/toolchain.md

@@ -287,43 +287,48 @@ call` with no `CLOUD-*` key **in that same paragraph** stops the lap. Two open
   dropped; one shape survived, firing once, correctly.
 - `filed-here-check` is that stop's sibling, and the second half of CLOUD-514:
   `deferral-check` prices a decision left with no home, this prices a home opened
-  instead of a fix. `board-write-record` (a `PostToolUse` body) records every row
-  this branch put on the board — kind, id, the tracker's `updatedAt`, the
-  `ready-lint` verdict over the body the **tracker returned**, and the diff
-  overlap — and `land` calls this beside `deferral-check`, refusing when a row
-  this branch CREATED was stored `unready`. Three states rather than two: `ready` passes, `unready` refuses, and
-  `-` — the recorder could not lint — passes, because reading "not answered" as
-  "refused" turns a verdict about the environment into one about the row.
-  Comments are recorded and never gated: a comment on the row that already owns a
-  finding is the honest common case, and pricing it pushes the pressure toward
-  silence, which is the failure `finding-sink-check` exists to catch.
-  **A second refusal prices PROXIMITY** (`filed-over-own-diff`, CLOUD-514 phase
-  3), because the first prices only refinement and a Ready block is prose —
-  measured, four rows filed in three and a half minutes and every one recorded
-  `ready`, so the toll certified the punts instead of reversing them. The
-  recorder's fifth column is `board-diff-overlap`: the tracked paths the row's
-  body names intersected with `origin/main...HEAD`, basenames resolved (exact
-  matching found none of the three real rows) and an ambiguous one resolving to
-  nothing. Non-zero stops the lap, and the load-bearing difference is that there
-  is **no prose remedy** — fix it here, comment on the row that owns it, file it
-  after landing from a clean tree, or `BATTEN_FILED_HERE_OVERLAP=1`, which
-  records which rows it overrode. It prices filing against **the diff** and
-  claims nothing wider: a punt about code the branch never touched is invisible
-  to it. The verdict is unforgeable by the author for the reason the receipt pattern usually is not —
+  instead of a fix. **Both halves are the engine's since CLOUD-1051.** A
+  `[[recorder]]` row records every row this branch put on the board — kind, id,
+  the tracker's `updatedAt`, the `ready-lint` verdict over the body the **tracker
+  returned**, the diff overlap and §1's paths — and `policy/filed-here.rego`
+  decides over it, declaring two predicates because a row can earn both.
+  `filed-unrefined` refuses a row this branch CREATED and stored `unready`. Three
+  states rather than two: `ready` passes, `unready` refuses, and `-` — the
+  recorder could not lint — passes, because reading "not answered" as "refused"
+  turns a verdict about the environment into one about the row. Comments are
+  recorded and never gated: a comment on the row that already owns a finding is
+  the honest common case, and pricing it pushes the pressure toward silence,
+  which is the failure `finding-sink-check` exists to catch.
+  **`filed-over-own-diff` prices PROXIMITY**, because the first prices only
+  refinement and a Ready block is prose — measured, four rows filed in three and
+  a half minutes and every one recorded `ready`, so the toll certified the punts
+  instead of reversing them. The overlap column is `board-diff-overlap`'s: the
+  tracked paths the row's body names, basenames resolved (exact matching found
+  none of the three real rows), intersected at READ time with the branch's own
+  `base-delta`. Three exemptions, each measured: a row the PR closes (without it
+  every honest file-then-fix needs an override), a row recorded before the
+  branch's base (3 of 3 refusals on one PR), and a row whose §1 names none of the
+  diff (citing is not claiming). The load-bearing difference from the first
+  refusal is that there is **no prose remedy** — fix it here, comment on the row
+  that owns it, file it after landing from a clean tree, or spend a declared
+  override. It prices filing against **the diff** and claims nothing wider: a
+  punt about code the branch never touched is invisible to it. The verdict is
+  unforgeable by the author for the reason the receipt pattern usually is not —
   `ready-lint` over a payload the caller assembles was measured green three times
   against text in a local file, once under an id no row carried. Fails open on an
-  absent record, and a branch predating the recorder can never have one: the store
-  lives under `$GIT_DIR`, is never committed, and dies with the container — which
-  is also why no fleet-wide firing rate is measurable. Bypass:
-  `BATTEN_FILED_HERE_BYPASS=1`. **`--checklist` is a third mode over the same
-  parse** (CLOUD-97): it enumerates EVERY row this branch filed, marks the ones
-  whose named paths intersect the diff, and asks the agent to affirm each is
-  independent work rather than a punt. A sibling of `--advisory`, never a
-  widening of it — that predicate is measured and mutation-gated, and retuning a
-  gate by editing the question it answers is not a refactor. Both nudge modes
-  print pointers on **stderr**, because this file's stdout carries its own
-  summary lines and a stdout capture reads "no board writes recorded" as a
-  checklist of one row.
+  absent record, and a branch predating the recorder can never have one: the
+  store lives under `$GIT_DIR`, is never committed, and dies with the container —
+  which is also why no fleet-wide firing rate is measurable.
+  **Both environment variables are gone rather than ported** (CLOUD-1051):
+  `BATTEN_FILED_HERE_BYPASS` and `BATTEN_FILED_HERE_OVERLAP` were knowable
+  strings anyone could spend without articulating anything, and the override is
+  `V-FILED-OVER-OWN-DIFF`'s declared route with its precondition, issued and
+  spent through `batten override request`/`spend`. `land` still calls
+  `mise run filed-here-check` by name — an inline `batten check` on that row now
+  — so that call site is byte-identical and `land.sh` never
+  entered the changed-file set. The PR body reaches the predicate as a RECORD
+  rather than on stdin, because `check` is declared `read` and has no stdin
+  channel: the boundary captures what `gh pr view --jq .body` returned.
 - `unlanded-check` is the end-of-turn half nobody had (CLOUD-97), and it decides
   NOTHING: `completion.unlanded` — a completion marker in the session transcript
   with no patch-id-equivalent commit on the landing target — is the engine's
@@ -338,19 +343,30 @@ call` with no `CLOUD-*` key **in that same paragraph** stops the lap. Two open
   sha: the finding holds while the work is unlanded, so an unsuppressed rule
   repeats one pointer every turn until nobody reads it, and a new commit is a new
   answer to the question. Bypass: `BATTEN_UNLANDED_CHECK_BYPASS=1`, which the
-  `state record` call in `stop-guard` rides too — a caller who switched the rule
-  off should not still pay a tree walk per turn for an answer nobody reads.
-- **`stop-guard` ends every turn with a question now.** It ran four rules and
-  then exited silently, and silence is the common case — so the most valuable
-  thing it could say was the thing it never said. Each rule fires only on a shape
-  somebody enumerated and measured recall is the weak half of all of them; the
-  bare `done?` has no recall problem, and `finding-sink-check`'s header already
-  records it surfacing nine real findings in one session while carrying no
-  information at all. It is last and mutually exclusive with the rest: a turn
-  already handed a pointer has been asked something more specific. The cost is
-  one model round trip on a turn that would otherwise have ended, bounded to one
-  per turn by `stop_hook_active`; the registration went from ~28ms to
-  ~330-440ms, nearly all of it the `state record` call the fourth rule rests on.
+  engine's own `state record` call at `Stop` rides too — a caller who switched
+  the rule off should not still pay a tree walk per turn for an answer nobody
+  reads.
+- **The end of turn is the engine's since CLOUD-1051**, and `stop-guard.sh` is
+  **deleted** rather than still runnable. `batten hook` already registers at
+  `Stop`; its five rules live there now, ranked and emitting **at most one**,
+  because two nudges on one turn is how a channel stops being read. The first is
+  `policy/stop-posture.rego` — the output-posture tell, a `mediated_call` module
+  over `input.call["final-message"]`. The other four cannot be modules (three
+  spawn a sibling program, one reads the tree, and `RuleKind::scopes` pairs every
+  spawning kind with `RuleScope::Tree` alone), so they are `stop_nudges` in
+  `lib.rs`, keeping the order the shell ranked them in — by MEASURED precision,
+  `stop-posture` at 3/3 leading `finding-sink` at 1/1, with the three unmeasured
+  below. `finding-sink-check.sh` and `unlanded-check.sh` are spawned unchanged,
+  with the same stdin the bash gave them, which is what bounds the cascade. The
+  recursion bound is the payload's `stop_hook_active`, never a state file; the
+  channel is `additionalContext`, never exit 2, because CLOUD-97 and CLOUD-219
+  each ruled a deny out independently and `Event::carries_a_verdict` is now the
+  one authority both producers ask. Everything fails open. Bypass:
+  `BATTEN_STOP_GUARD_BYPASS=1`, one hatch for the set rather than one per rule.
+  **The closing question is gone** (CLOUD-888): it was an unconditional fallback,
+  so the five rules decided only WHICH nudge fired and never WHETHER one did, and
+  a constant has zero mutual information with the thing it is meant to detect. An
+  empty answer is an answer, and silence is what keeps the channel credible.
 - **`claim-guard` is retired** (CLOUD-444); the pull-time half of the pair the
   key rule finishes (CLOUD-272) is now the `claim-needs-receipt` row in
   `batten.toml` — a `receipt` rule with `trigger = "write"` and `key = "branch"`.

.claude/settings.json

@@ -34,15 +34,6 @@
             "command": "batten hook --harness claude-code"
           }
         ]
-      },
-      {
-        "matcher": ".*save_issue|.*save_comment",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "$CLAUDE_PROJECT_DIR/mise-tasks/board-write-record.sh"
-          }
-        ]
       }
     ],
     "Stop": [
@@ -53,14 +44,6 @@
             "command": "batten hook --harness claude-code"
           }
         ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "$CLAUDE_PROJECT_DIR/mise-tasks/stop-guard.sh"
-          }
-        ]
       }
     ],
     "SessionStart": [

.github/workflows/ci.yml

@@ -98,6 +98,52 @@ jobs:
           # non-zero; this is what makes that true at the call site too.
           bash -c "$body" || exit 0
 
+      # RECLAIM RUNNER DISK, BEFORE ANYTHING WRITES ITS OWN GIGABYTES.
+      #
+      # Measured on this tree: a full `mise run ci` leaves `target/debug` at
+      # 14 GB (`target/` at 21 GB), and every `crates/batten/tests/*.rs` is a
+      # separately linked binary, so that grows with the test surface. Twice, on
+      # the same head, this job died ~20 minutes into `mise run ci` with the step
+      # still `in_progress`, no annotations, and NO LOG ARCHIVE AT ALL — a 404 on
+      # the job's logs is what a runner that cannot write looks like. The same
+      # task with `BATTEN_STEP_RECEIPT_BYPASS=1` (so nothing answers from a
+      # receipt, as under CI) exits 0 locally in 988s, and this workflow passes
+      # on other branches, so the failure is this tree's size rather than the
+      # gate. Reclaiming the preinstalled toolchains this repository never uses
+      # is the cheapest thing that could make that true.
+      #
+      # SECOND, NEVER FIRST. `ci-local-parity` property 7 asserts the first step
+      # of a `needs:`-less job is the landing lease, matched by name — and the
+      # lease belongs first on its own merits: a run this branch is not
+      # authorised to make should not spend even this.
+      #
+      # A BARE STEP, NEVER A `mise` TASK. Property 3 requires every `mise run
+      # <task>` a workflow names to be one `mise run verify` also runs, so a
+      # `mise run free-disk` would oblige a contributor's laptop to delete
+      # `/usr/local/lib/android`. The honest shape names no task, exactly as the
+      # lease step and the slow-tier decision below do.
+      #
+      # `|| true` because this is a mitigation and never a gate: a path absent
+      # from some future runner image must not red a required check.
+      #
+      # The summary writes are the diagnostic that SURVIVES. A job log is lost
+      # when the runner dies; a step summary is uploaded when its step ends, so
+      # the reading below is durable evidence even if the job dies twenty minutes
+      # later — which is what makes the next run a measurement rather than
+      # another guess.
+      - name: Reclaim runner disk before the build
+        run: |
+          {
+            echo "### disk before"
+            df -h /
+          } >>"$GITHUB_STEP_SUMMARY"
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \
+            /usr/local/share/boost /usr/share/swift || true
+          {
+            echo "### disk after"
+            df -h /
+          } >>"$GITHUB_STEP_SUMMARY"
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # tests/bats — the shell test runner. Without it `mise run test:bats`

.regal/config.yaml

@@ -14,6 +14,12 @@
 rules:
   default:
     level: ignore
+  abi:
+    # CLOUD-1050. `error` for the sibling's reason: the default `--fail-level` is
+    # `error`, so a warning here would report the defect and exit 0 — the
+    # silent-pass shape both custom rules exist to close.
+    refusal-is-typed:
+      level: error
   schemas:
     every-package-binds-input:
       # `error` rather than `warning`: `mise exec -- regal lint`'s default