fix(pm): post-stamped refuses a token it cannot render - #18286

Fixes #18284

The defect

scripts/pm/post-stamped.mjs recognised its two tokens with QUOTED_TOKEN_RE
({{WAS:([^{}]*)}}) and caught the rest with a post-substitution leftover scan
over ANY_TOKEN_RE ({{[^{}]*}}). Both spell their payload [^{}]*, so a
token-shaped opener whose payload carries a brace, or one that never closes
at all, matched neither: it was not substituted, because nothing recognised it,
and it was not refused, because the leftover scan could not see it. It was
copied to the board verbatim.

The filed reading is the seat's own artefact: a quoted slot was filled from a
shell variable, the read failed, and the variable held a multi-line Node dump —
which carries braces. Reproduced here on the unpatched tool at fe0ae5c1:

$ node scripts/pm/post-stamped.mjs --dry-run --comment=18284 --file=dump.md ; echo "EXIT=$?"
post-stamped: DRY RUN — nothing was written. 0 token(s) substituted with
`2026-09-15T08:18Z`, 0 quoted stamp(s) rendered verbatim. Target would be
objectstack-ai/objectstack#18284 (comment).
EXIT=0

…and its stdout was the body it would have written, opener, dump and closer
intact. Same fixture after the patch, EXIT=2, nothing on stdout:

post-stamped: REFUSED — 1 double-brace opener(s) in this body are not tokens this tool
  can render. Nothing was written.
  1. [brace-in-payload] a brace inside the payload, so no token ends here — `{{WAS:[eval]:1\nJSON.parse(process.env.LANDED).mergedAt\n     …`

What changed

The check moved ahead of substitution and changed what it walks: not the
tokens a regex happens to match, but every {{ in the body, positionally —
because the defect is precisely an opener no regex in the file matches, so a
scan built out of those same regexes would walk past it again. Each opener must
be {{NOW}} or a {{WAS:…}} whose payload is brace-free and closed. Four
shapes are refused and named: unknown-token-name, unclosed-opener,
brace-in-payload, nested-opener. The refusal prints the offending span
clipped to 60 bytes with control characters escaped, so a payload that arrived
from a shell read gone wrong stays readable; the same renderer is now applied to
the existing quoted-not-a-stamp detail, which used to inline a raw multi-line
dump into a numbered row.

The scan judges shape and stops. Whether an admitted payload is an instant,
and one the clock has reached, stays with stampRefusals — two places deciding
"what is a quoted stamp" is two spellings of one decision. What the scan gives
that rule is the thing it could not previously assume: that maskQuotedStamps
consumed every opener, so the bare-stamp scan underneath is reading prose and
not the inside of a token nobody could parse. That ordering is pinned: an
unclosed opener on the opening line is reported as the opener it is, not as the
positional refusal the unmasked payload would otherwise raise.

The post-substitution leftover check is gone rather than kept beside the
scan: after the scan every opener is consumed and the two substituted stamps
carry no braces, so it could never fire, and a check that cannot fire is a check
nobody maintains. Its kind (unknown-token), its exit code and the two
sentences callers read are preserved on the new refusal.

No accepted form is narrowed. The forms the tool took before — {{NOW}}
exactly; {{WAS:…}} with a payload that is one protocolStamps match and
nothing else, minute- or seconds-grained, surrounding whitespace tolerated —
all still clear the scan, each pinned by a case. A bare stamp in prose is still
not an opener's business, and a token inside backticks is still substituted:
there has never been an escape form and the scan does not invent one.

--dry-run and the live write take the same refusal, because both run through
renderBody. The DRY RUN line, the read-back delta note, the --ack-through
rule and the footer policy are untouched.

Verification

• Self-test 117 → 152 cases, 8 → 9 batteries; SELF_TEST_BATTERY_FLOOR
  raised 8 → 9 so a deleted battery is still caught. New battery: the opener
  scan: every {{ is a token this tool renders, or the body is refused (35
  cases) — the filed repro, a multi-line payload, an unknown token name, an
  unclosed opener, nested and doubled openers, the valid-pair control, the
  no-narrowing controls, the no-escape-hatch controls, and the span renderer.
• Reverse verification by ablation from the committed state: the base blob was
  checked out over the file, its presence proved by git hash-object against
  fe0ae5c1:scripts/pm/post-stamped.mjs (and grep -c unrecognisedOpeners → 0),
  the fixture run, then git checkout HEAD -- restored and git diff HEAD
  proved empty. Both readings are quoted above.
• All 32 commands from node scripts/pm/dispatch-gates.mjs --commands exit 0,
  plus node scripts/pm/post-stamped.mjs --self-test,
  node scripts/check-self-test-wired.mjs and ESLint on the file.
• No changeset: nothing published moves. scripts/pm/** is not in any package's
  files[].

Acceptance notes

Noted, not filed — nothing in this PR's path touches them and no queued card
covers the file:

• The tool's usage text and header describe the quoted payload as
  YYYY-MM-DDThh:mmZ, while the shape actually accepted is
  PROTOCOL_STAMP_RE, whose seconds group is optional. The seconds grain is
  deliberate and pinned by an existing case; only the prose is narrower than the
  contract. Documentation nit, left alone rather than widened in a fix PR.

One reproducible defect found while reading the payload rules is reported in the
terminal report for the seat to file, with dedupe words: a quoted payload that
matches the stamp shape but names an impossible date is accepted and rendered
verbatim, because stampSpan returns null for it and stampIsFuture reads
null as "not future". It is a different failure mode from this card's —
rendered-but-unvalidated rather than neither-rendered-nor-refused — so it is not
fixed here.

Generated by Claude Code