fix(plan): decide amend-vs-narrow by pattern containment, not tree snapshot - #12

The bug

Assigning an owner to all build.gradle files gave that owner an entire directory.

# before
* @team_a
path/app/* @team_b

# add_owner(*.gradle, @gradle) produced
* @team_a
*.gradle @team_a @gradle
path/app/* @team_b @gradle      # <-- @gradle now owns the whole path

The planner amended a rule in place whenever every tracked file that rule won was inside the scope. That's a property of the current commit — but a CODEOWNERS rule governs files that don't exist yet. path/app/build.gradle happened to be the only tracked file under path/app/, so the rule looked scope-sized and got widened.

This is the amend decision, which #8 did not touch — #8 fixed the derivation side (intersectPattern). Verified against current main: the case above still reproduces, as do the two below.

The same snapshot reasoning was in remove_owner, and in set_owners via matchSetEquals, where it silently transferred a whole directory's ownership away from its owner:

# main today: set_owners(/svc/sub/, [@g]) over "* @a / /svc/ @b"
* @a
/svc/ @g          # <-- @b lost the entire /svc/ tree

The fix

pattern.Contains(outer, inner) — sound containment of the pattern languages. Patterns are tokenized into segment sequences using the same normalization the matcher compiles (extracted as normalizeSegs, so the two can't drift), then walked for containment. It's deliberately incomplete: false means "unproven", never "disjoint".

Two subtleties the brute-force soundness test caught, both of which had produced wrong answers:

• A trailing slash does not anchor a single-segment pattern. docs/ gets an implicit leading **/, so it matches web/docs/spec.md. A textual prefix check read it as root-anchored and amended it for the scope /docs/.
• A final * compiles through a different arm than a final glob. /x/* matches exactly one level, while /x/foo also matches everything beneath it.

This builds on #8 rather than replacing it: deriveIntersection is #8's intersectPattern unchanged, including its anchoring-aware ruleDirPrefix and scopeContainedInRule. The new layer proves each candidate stays inside both the scope and the rule before returning it.

# after
* @team_a
*.gradle @team_a @gradle
path/app/* @team_b
path/app/*.gradle @team_b @gradle

One disclosed compromise

CODEOWNERS cannot express dir/* ∩ *.gradle: there's no way to say "one level and matching the glob", because dir/*.gradle also matches files under a directory named .gradle. Ordering can't resolve it either — both paths match both patterns, so last-match-wins moves them together.

#8's ruleDirPrefix rejects dir/* rules outright, which would make the reported case refuse once the amend bug is fixed. So the narrowing rule is emitted with a warning naming the residual. It can never leak the new owner out of scope or withhold it where due; only a co-owner can be wrong. Where the rule's reach is expressible (/svc → /svc/**/*.gradle) the derivation is proven and silent.

Verification

• make all green — 144 tests, including all of plan: derive narrowing for file-glob scopes across directory rules (shape 4) #8's test files unmodified
• Existing tests unchanged, all additions (plan_test.go: +275 / −0)
• 8 of the 9 new planner tests fail on unmodified main; the 9th (TestR6_DirectoryNameScopeConverges) passes and is kept as a regression guard
• 500k-case differential fuzz vs. the hmarr/codeowners oracle: 0 mismatches
• plan → apply → plan is idempotent (exit 1) across every new derivation shape
• internal/pattern/contains_test.go brute-forces soundness over a pattern × path universe

Follow-ups (not in this PR)

Two pre-existing snapshot bugs of the same family, left alone because they change the tool's contract (the invariants are defined over the tracked tree):

• synthSet's recapture check inserts above a rule that will capture future in-scope files
• granting a directory only covers depths that already contain files, so deeper files added later never get the owner

🤖 Generated with Claude Code