PR #495 follow-ups: #490's systemic half dies with the issue on merge nf-ay4x ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/498 by tools/beads/import_github.py's reconcile pass.

Suggestions from ninefold-reviewer's review of #495 (result=CONVERGED at b3b04f1). Unclaimed and unlabelled — inert backlog, per CLAUDE.md. Nothing here blocked that merge; the restoration itself verified byte-exact.

1. #490's systemic half needs a home that survives Closes #490

#495 carries Closes #490, so the squash-merge closes #490. That is correct for the restoration — which is done — but #490's closing section is the *only* place in the tracker where the proposed guard against a repeat is written down. Verified: no other open issue mentions it (preflight, commit on the branch touches, declared scope all return #490 alone; #479, #481 and #416 are adjacent but different mechanisms). Triage only reads open issues, so on merge the idea leaves the backlog silently.

Both #495's body and its comment on #490 say the idea is "left on that issue" / "Leaving it here for a triage round" — which is the right call about scope, and the reason for this issue rather than a change to that branch. Filing it here is what makes those sentences true; with this issue in place, Closes #490 is safe to keep.

The idea, restated so it stands alone:

> a merge_pr preflight that flags paths in the diff which no commit on the branch touches

Concretely, on a PR whose branch has been rebuilt: compare the set of paths in git diff origin/main..HEAD against the union of paths touched by the branch's own commits. A path in the first set and not the second means the branch is carrying a tree it never authored — which is exactly the tree-snapshot-squash signature (git reset --soft origin/main from an old tip) that put #472's silent revert of #435 onto main for a day.

Why nothing else catches it, from #490: presubmit --all gates code and a doc revert compiles; probe_gate is post-merge and sweeps probes, not content; the feedback ledger checks replies, not the diff; and human review saw 91f818c while 636bf83 merged, with dismiss_stale_reviews_on_push off by design.

Two live data points, one day apart, both this shape: - #472's rebuild — 58 lines of docs silently reverted, found days later by review of the *causing* PR. - #495's own first push — five unrelated files swept in by git add -A on a branch cut mid-flight, self-caught in minutes ([correction comment](https://github.com/cfsh/ninefold/pull/495#issuecomment-5174439032)). Same defect class: a commit carrying a tree it was never meant to carry, with a description that reads correctly.

The second is the useful one for design — it says the check wants to fire on *additions* the branch didn't author as well as deletions, so "paths no commit on the branch touches" is the right predicate rather than "paths with pure deletions".

Open question worth settling before building: whether this belongs in merge_pr (late — the reviewed sha is already the merged sha by then) or as a push-time / PR-open-time check (earlier, but there is no CI here to run it — see #417). Related: #481, #416, #490.