fix(diff): subtract baseline for no-team; report skipped no-team queries

Two review findings on #56:

- The no-team diff ignored the baseline, so a policy, profile, or script
  change that was merged to the base branch but not yet deployed was reported
  again on every later MR. It is now subtracted like any other team's. The
  baseline's no-team file is matched on no-team identity rather than display
  name, since the base and MR branches can spell it differently ("No team" vs
  "Unassigned") -- exactly what happens in the MR that migrates a repo from
  the teams/ layout to fleets/.

- `queries:` in a no-team file were dropped silently. Fleet scopes queries to
  a real team or to the global scope, so they cannot be diffed there; the plan
  now says so, matching how skipped software is reported.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEpzMNJnGaBLAfrPeqknCy

Author: robbiet480

docs/Architecture.md

@@ -89,7 +89,7 @@ Walks `teams/*.yml`, resolves `path:` references, produces `ParsedRepo`. Also pa
 
 Compares `FleetState` (API) vs `ParsedRepo` (YAML). Produces `[]DiffResult` per team + a `(global)` result when `default.yml` is present.
 
-Fleet's "hosts on no team" bucket is absent from `GET /teams`, so it is fetched separately (`team_id=0`) and diffed like any other team for policies, profiles, and scripts. Software is reported as skipped there: Fleet exposes configured software only through the teams list. When the bucket was not fetched, the diff falls back to summarizing what the repo configures for it.
+Fleet's "hosts on no team" bucket is absent from `GET /teams`, so it is fetched separately (`team_id=0`) and diffed like any other team for policies, profiles, and scripts, baseline subtraction included. Software and queries are reported as skipped there: Fleet exposes configured software only through the teams list, and scopes queries to a real team or the global scope. When the bucket was not fetched, the diff falls back to summarizing what the repo configures for it.
 
 | Resource | Match key | Diff fields |
 |----------|-----------|-------------|

internal/diff/differ.go

@@ -216,6 +216,40 @@ func diffNoTeam(result *DiffResult, current *api.NoTeam, proposed parser.ParsedT
 			fmt.Sprintf("software diff skipped: %d software items configured, but Fleet does not report software for hosts on no team", n))
 	}
 
+	// Fleet scopes queries to a real team or to the global scope, so a
+	// no-team file cannot own them. The parser still accepts `queries:` and
+	// `reports:` in any team file, so say plainly that these are not diffed
+	// instead of dropping them without a word.
+	if n := len(proposed.Queries); n > 0 {
+		result.Errors = append(result.Errors,
+			fmt.Sprintf("queries diff skipped: %d queries configured, but Fleet has no query scope for hosts on no team", n))
+	}
+
+	// Subtract changes that already exist between the base branch and Fleet,
+	// so a no-team change that is merged but not yet deployed is not reported
+	// again on every later MR.
+	if cfg.baseline != nil {
+		if baseTeam, ok := findBaselineNoTeam(cfg.baseline); ok {
+			base := DiffResult{}
+			if !current.PoliciesUnavailable {
+				base.Policies = diffPolicies(current.Policies, baseTeam.Policies)
+			}
+			if !current.ProfilesUnavailable {
+				base.Profiles, _ = diffProfiles(current.Profiles, baseTeam.Profiles, nil)
+			}
+			if !current.ScriptsUnavailable {
+				base.Scripts = diffScripts(current.Scripts, baseTeam.Scripts)
+			}
+			result.Policies = subtractResourceDiff(result.Policies, base.Policies)
+			result.Profiles = subtractResourceDiff(result.Profiles, base.Profiles)
+			result.Scripts = subtractResourceDiff(result.Scripts, base.Scripts)
+			vlog(cfg.verbose, "[%s] after baseline subtraction: policies=%s profiles=%s scripts=%s",
+				proposed.Name, rdSummary(result.Policies), rdSummary(result.Profiles), rdSummary(result.Scripts))
+		} else {
+			vlog(cfg.verbose, "[%s] no baseline no-team file found", proposed.Name)
+		}
+	}
+
 	vlog(cfg.verbose, "[%s] no-team diff: policies=%s profiles=%s scripts=%s",
 		proposed.Name, rdSummary(result.Policies), rdSummary(result.Profiles), rdSummary(result.Scripts))
 }
@@ -537,6 +571,19 @@ func filterChanges(changes []ResourceChange, keep func(string) bool) []ResourceC
 // ---------- Baseline subtraction ----------
 
 // findBaselineTeam looks up a team by name in the baseline parsed repo.
+// findBaselineNoTeam returns the baseline's no-team file. It matches on the
+// no-team identity rather than the display name, because the base branch and
+// the MR branch may spell it differently ("No team" vs "Unassigned") -- for
+// instance in the MR that migrates a repo from the teams/ layout to fleets/.
+func findBaselineNoTeam(baseline *parser.ParsedRepo) (parser.ParsedTeam, bool) {
+	for _, t := range baseline.Teams {
+		if parser.IsNoTeam(t.Name, t.SourceFile) {
+			return t, true
+		}
+	}
+	return parser.ParsedTeam{}, false
+}
+
 func findBaselineTeam(baseline *parser.ParsedRepo, name string) (parser.ParsedTeam, bool) {
 	for _, t := range baseline.Teams {
 		if strings.EqualFold(t.Name, name) {

internal/diff/differ_test.go

@@ -2491,3 +2491,73 @@ func TestDiffNoTeamSoftwareIsReportedAsSkipped(t *testing.T) {
 		t.Errorf("missing software skip note in %v", r.Errors)
 	}
 }
+
+// A no-team change that is already merged to the base branch but not yet
+// deployed must not be reported again on every later MR.
+func TestDiffNoTeamBaselineSubtraction(t *testing.T) {
+	current := &api.FleetState{
+		Teams:  []api.Team{},
+		Labels: []api.Label{},
+		NoTeam: &api.NoTeam{
+			Policies: []api.Policy{{Name: "Existing", Query: "SELECT 1;"}},
+			Scripts:  []api.Script{{ID: 1, Name: "keep.sh", Content: "echo one\n"}},
+		},
+	}
+
+	// Already on the base branch: the added policy and the edited script.
+	baseline := &parser.ParsedRepo{Teams: []parser.ParsedTeam{{
+		Name:       "No team",
+		SourceFile: "teams/no-team.yml",
+		Policies: []parser.ParsedPolicy{
+			{Name: "Existing", Query: "SELECT 1;"},
+			{Name: "Merged not deployed", Query: "SELECT 2;"},
+		},
+		Scripts: []parser.ParsedScript{{Name: "keep.sh", Content: "echo one\necho two\n"}},
+	}}}
+
+	// The MR adds one more policy on top of the base branch's state. The
+	// branch spells the bucket differently, which must not defeat matching.
+	proposed := &parser.ParsedRepo{Teams: []parser.ParsedTeam{{
+		Name:       "Unassigned",
+		SourceFile: "fleets/unassigned.yml",
+		Policies: []parser.ParsedPolicy{
+			{Name: "Existing", Query: "SELECT 1;"},
+			{Name: "Merged not deployed", Query: "SELECT 2;"},
+			{Name: "New in this MR", Query: "SELECT 3;"},
+		},
+		Scripts: []parser.ParsedScript{{Name: "keep.sh", Content: "echo one\necho two\n"}},
+	}}}
+
+	r := Diff(current, proposed, nil, nil, WithBaseline(baseline))[0]
+
+	if len(r.Policies.Added) != 1 || r.Policies.Added[0].Name != "New in this MR" {
+		t.Errorf("policies added: got %+v, want only the MR's own addition", r.Policies.Added)
+	}
+	if !r.Scripts.IsEmpty() {
+		t.Errorf("scripts: got %+v, want empty (the edit is already on the base branch)", r.Scripts)
+	}
+}
+
+func TestDiffNoTeamQueriesAreReportedAsSkipped(t *testing.T) {
+	current := &api.FleetState{Teams: []api.Team{}, Labels: []api.Label{}, NoTeam: &api.NoTeam{}}
+	proposed := &parser.ParsedRepo{Teams: []parser.ParsedTeam{{
+		Name:       "No team",
+		SourceFile: "teams/no-team.yml",
+		Queries:    []parser.ParsedQuery{{Name: "Q1"}, {Name: "Q2"}},
+	}}}
+
+	r := Diff(current, proposed, nil, nil)[0]
+
+	if !r.Queries.IsEmpty() {
+		t.Errorf("queries: got %+v, want empty (Fleet has no no-team query scope)", r.Queries)
+	}
+	found := false
+	for _, e := range r.Errors {
+		if strings.Contains(e, "queries diff skipped: 2 queries configured") {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("missing query skip note in %v", r.Errors)
+	}
+}