fix(board): the column vocabulary stops being an engine constant

.serena/memories/core.md

@@ -74,6 +74,19 @@ err)` takes **both** channels and the resolved `Mode`, so a verb can write a
   `-J`?), and a flag carries `hidden` plus `Rung` — which §3 ladder rung it
   selects — so "is this a ladder flag" is a column rather than a naming
   convention, and the ladder's totality is a census test.
+- `board.rs` — the board's COLUMN VOCABULARY, resolved from the `[board]` table
+  rather than held as engine constants (CLOUD-1623, non-negotiable rule 1).
+  `landed` and `claim` decided over one tracker's words — Linear's
+  Todo/In Progress/In Review/Done — so on any other board every comparison was
+  false: `is_started` never fired, the landed-honesty sweep reported zero
+  findings over a board full of dishonest columns, and `claim` never refused.
+  `Columns::resolve` reads the table and `board_columns` in `lib.rs` is
+  `board_grammar`'s sibling. The load-bearing rule is that an undeclared column
+  refuses BY NAME and never falls back to this repository's words — a default
+  would restore the property that made the original defect unobservable, the
+  dead path and the working path answering identically. An EMPTY `started` set
+  is undeclared for the same reason: a set matching nothing reports every row as
+  not-advanced, which is the silent all-clear.
 - `bot.rs` — the bot lane, retired off `mise-tasks/bot-issue.sh` (CLOUD-1295).
   Two halves in one module: the PREDICATES — is this PR one of the lane's, which
   manifests it touched, what Conventional type its subject declares, whether a

batten.toml

@@ -3723,6 +3723,49 @@ exclude = "^// (carried|subsumed|changed|withdrawn): "
 severity = "deny"
 scope = "tree"
 
+# The rule-2 half of CLOUD-1623: the board's column names left the engine, and
+# this is what refuses the next one. They arrived in the first place because
+# nothing refused them, and this file already carries the measured cost of that
+# shape one row up — twenty issue-key derivations accumulated because nothing
+# refused the twenty-first before it was typed.
+#
+# WHY THIS MATCHES THE COMPARISON AND NOT THE VOCABULARY, which is the whole
+# design and the reason the obvious row is unlandable. Measured over `crates/**`
+# at 32f9876: the four column literals occur 126 TIMES across 18 files, nearly
+# all of them legitimate — integration fixtures building board payloads
+# (`landed_check.rs` 19, `claim.rs` 25, `board_receipts.rs` 12), unit-test
+# vocabulary, and prose recording why a column is in the started set. A row
+# banning the WORDS would fire on every one of them, so it would either never
+# land or land with an exemption list longer than the rule.
+#
+# The violation was never the word. It was COMPARING A STATUS AGAINST A LITERAL
+# — `self.status == "In Progress"` — because that is the line that decides, and
+# the line that answers false on every other board while reading as a clean
+# sweep. So the regex is the comparison shape, in both operand orders, and it
+# reaches exactly the construct `board::Columns` exists to replace.
+#
+# IT LANDS AT ZERO, and that is a measurement rather than a hope: after the seam
+# commit the only match in the tree was `board.rs`'s own anti-vacuity test
+# asserting that a foreign board's set does not contain this one's word, and
+# that assertion was rewritten to compare the whole set — a stronger claim,
+# since a negative assertion also passes for a resolver that dropped every
+# column. So the row needs no `exclude`, which is the shape to prefer: an
+# exemption is where the next violation hides.
+#
+# `checks_green.rs`'s `status != "completed"` and `hk.rs`'s `!= "included"` are
+# deliberately NOT reached. They compare a check run's state and a plan's state,
+# which are a forge's and this engine's own vocabularies rather than a
+# tracker's — a row keyed on the bare word `status` would have caught both and
+# taught the next reader that the ban is about the field name.
+[[rule]]
+id = "config name other"
+kind = "forbid"
+glob = "crates/**"
+regex = '(==|!=)\s*"(Todo|Backlog|In Progress|In Review|Done)"|"(Todo|Backlog|In Progress|In Review|Done)"\s*(==|!=)'
+severity = "deny"
+scope = "tree"
+no_fix_reason = "read the column from the `[board]` table through `board::Columns` and compare against that; a board's column name in the core is rule 1's violation, and an undeclared column is could-not-look rather than a default"
+
 # The fixture corpus must stay repo-agnostic (CLOUD-63). The corpus exists so
 # coverage stops implicitly depending on *this* repository, which a fixture
 # naming this repository's origin would quietly undo.
@@ -8890,6 +8933,48 @@ verified_by = ["verify", "linear-check"]
 [ready]
 prose_dialect_required_from = "2026-09-02T00:00:00.000Z"
 
+# THIS BOARD'S COLUMN VOCABULARY (CLOUD-1623). These four words were `const`s in
+# `crates/batten/src/landed.rs` and `claim.rs` — non-negotiable rule 1's worst
+# violation in the tree, because the failure is silent in the direction that
+# matters. Off a board spelling its columns this way every comparison is false:
+# `is_started` never fires, so the landed-honesty sweep reports ZERO FINDINGS
+# over a board full of dishonest columns, and `claim` never refuses. A gate that
+# cannot fire and a gate that found nothing emit the same bytes.
+#
+# THE ENGINE HOLDS NO DEFAULT FOR THESE, deliberately. An undeclared column is
+# could-not-look named by key, never a fallback to these values — a fallback
+# would put this repository's vocabulary back in the engine with one more step in
+# front of it, and restore exactly the property that made the original defect
+# unobservable. `crates/batten/src/board.rs` carries that reasoning.
+#
+# VALUES RATHER THAN `[[pattern]]` ROWS, per CLOUD-472's precedent one table up: a
+# column is matched by EQUALITY against the string the tracker echoes back, not by
+# a regex over it. The registry exists so one CONCEPT has one spelling; a literal
+# the round trip returns verbatim is a value.
+[board]
+# The ready queue: `claim check` refuses a row that is not sitting here.
+ready = "Todo"
+# Pulled. Both `landed check`'s behind-git direction and the abandonment drain
+# select on this one.
+in_progress = "In Progress"
+# Where a row whose work is already on `main` is asked to move.
+review = "In Review"
+# Every column meaning "somebody has this, or it landed, or it shipped".
+#
+# `Done` IS IN THE SET, AND LEAVING IT OUT WAS A MEASURED DEFECT (CLOUD-1458).
+# The engine constant read `["In Progress", "In Review"]`, so a declined key that
+# reached Done escaped the sweep entirely — and Done is RELEASED, where the claim
+# is strongest and the lie therefore costs most. Measured on that gate's own two
+# rows: CLOUD-186 and CLOUD-1127 were declined with `DO-NOT-CLOSE` in the body of
+# the pull request that landed the module, advanced to In Review by the merge,
+# moved back by hand, and advanced to Done by a release 2026-09-05T02:52:56Z —
+# past the far edge of a predicate written the day before.
+#
+# `Backlog` and `Todo` stay OUT, because they are the ready queue: a declined key
+# sitting there is `DO-NOT-CLOSE` working, and refusing it would make the marker
+# unwritable.
+started = ["In Progress", "In Review", "Done"]
+
 # ACCEPTED INVOCATION-LATENCY REGRESSIONS (CLOUD-1163 unit 10), transcribed
 # verbatim off the `EXEMPT` heredoc of the retired `mise-tasks/perf-compare.sh`.
 #