diff --git a/ci/sections.yml b/ci/sections.yml
index 249aedae8c..188f01f568 100644
--- a/ci/sections.yml
+++ b/ci/sections.yml
@@ -1147,18 +1147,34 @@ jobs:
       # never as "no growth", so the mistake would have been loud rather than
       # silent. It is still a mistake. One fetch, before all of them.
       #
-      # fetch-depth is 1 here, so the merge-base is usually unavailable and the
-      # ratchets fall back to the origin/main TIP. That is the STRICTER
-      # comparand, and it means the CI path is the tip path: a local run that
-      # passes on the merge-base can still red here, and CI is authoritative.
+      # #4861 + #4983: origin/main is pinned to the commit this tree was BUILT
+      # on, not fetched at its tip. fetch-depth is 1 here, so the merge-base is
+      # usually unavailable and the ratchets read origin/main as it stands.
+      # Fetched at the tip, a run that started after main shrank a baseline or
+      # fixed a function judged a merge commit built before that change against
+      # it: #4813 went red (pipe_grep_q_baseline.txt 62 vs 60, a file it never
+      # touched), and #4970's re-run went red on m17 complexity (checkout at
+      # 60a59031, compared against acd599e52), while a re-run rebuilds the SAME
+      # merge commit. Pinned per event (scripts/ci/pin_build_base.sh):
+      #   pull_request  the merge commit's first parent, checked against the PR head
+      #   merge_group   merge_group.base_sha, as the refinement-gate pin does
+      #   otherwise     the tip, deepened by one on push (resolve_base.sh judges a
+      #                 push against HEAD's first parent: HEAD vs HEAD would pass
+      #                 vacuously, the G-10 quorum's finding)
+      # The shared ratchet library takes the same first parent on its own
+      # (scripts/lib_baseline_ratchet.sh FIRSTPARENT), so a lib ratchet and a
+      # script that reads origin/main directly cannot disagree. A PR that adds
+      # back an entry main has since deleted is still refused by its
+      # merge_group run, which builds on main as it merges. The pin refuses,
+      # and every guard below is skipped red, when the event names no build base.
       - id: guard-setup
-        name: Fetch origin/main as the comparand for every ratchet in this job
+        name: Pin origin/main to this run's build base, the comparand for every ratchet in this job (#4861)
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          MG_BASE_SHA: ${{ github.event.merge_group.base_sha }}
         run: |
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
-          # push shape: HEAD IS the origin/main tip, so every differential ratchet judges it against
-          # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
-          # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
-          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
+          bash scripts/ci/pin_build_base.sh --self-test
+          bash scripts/ci/pin_build_base.sh
       # #4415 (operator A4, 2026-09-25): ONE step runs every guard step of guard-tree-steps
       # below, keeps going past a red one, and reports every failure. GitHub would
       # stop this job at its first red step, and the others would never be seen.
@@ -1685,17 +1701,16 @@ jobs:
       # never as "no growth", so the mistake would have been loud rather than
       # silent. It is still a mistake. One fetch, before all of them.
       #
-      # fetch-depth is 1 here, so the merge-base is usually unavailable and the
-      # ratchets fall back to the origin/main TIP. That is the STRICTER
-      # comparand, and it means the CI path is the tip path: a local run that
-      # passes on the merge-base can still red here, and CI is authoritative.
-      - name: Fetch origin/main as the comparand for every ratchet in this job
-        run: |
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
-          # push shape: HEAD IS the origin/main tip, so every differential ratchet judges it against
-          # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
-          # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
-          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
+      # #4861 + #4983: origin/main is pinned to the commit this tree was BUILT
+      # on, not fetched at its tip -- the same pin, for the same reason, as
+      # guard-tree's guard-setup (which also runs the pin's self-test; this job
+      # only pins). m17's complexity ratchet is the #4983 case: a re-run of an
+      # unchanged PR judged against main's moved tip went red.
+      - name: Pin origin/main to this run's build base, the comparand for every ratchet in this job (#4861)
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          MG_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+        run: bash scripts/ci/pin_build_base.sh
       # DOCKER CREATES A MISSING BIND SOURCE AS root:root, AND `--user` ALONE
       # THEN EACCESs ON IT. The per-RUN target path is fresh every run, so a
       # container that mounts it and drops to the runner's uid cannot write
diff --git a/scripts/check_baseline_ratchets.sh b/scripts/check_baseline_ratchets.sh
index 2952390bb2..3a8ea7fc31 100644
--- a/scripts/check_baseline_ratchets.sh
+++ b/scripts/check_baseline_ratchets.sh
@@ -372,6 +372,107 @@ if [ "${1:-}" = "--self-test" ] || [ "${1:-}" = "--selftest" ]; then
                 bad=1
             fi
 
+            # FIRSTPARENT (#4983): a pull_request re-run. CI checks out GitHub's
+            # merge commit at depth 1, so there is no merge-base, and the re-run
+            # fetches origin/main fresh. Here main moved on and SHRANK the
+            # baseline (b deleted). Against the tip, the PR "appends" b, an
+            # entry it never touched; against the first parent, it changed
+            # nothing. The shallow clone is its own repository under $TD.
+            SC="$TD/shallow"
+            if git -C "$SR" checkout -q -b fp-pr "$SR_BASE" >/dev/null 2>&1 \
+               && printf 'pr edit\n' > "$SR/scripts/unrelated.txt" \
+               && git -C "$SR" -c commit.gpgsign=false commit -qam 'pr: unrelated edit' >/dev/null 2>&1 \
+               && SR_X=$(git -C "$SR" rev-parse HEAD) \
+               && git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1 \
+               && git -C "$SR" -c commit.gpgsign=false merge -q --no-ff --no-edit "$SR_X" >/dev/null 2>&1 \
+               && SR_M=$(git -C "$SR" rev-parse HEAD) \
+               && git -C "$SR" update-ref refs/pull/1/merge "$SR_M" \
+               && git -C "$SR" checkout -q --detach "$SR_NOBASE" >/dev/null 2>&1 \
+               && git -C "$SR" -c commit.gpgsign=false merge -q --no-ff --no-edit "$SR_BASE" >/dev/null 2>&1 \
+               && SR_M2=$(git -C "$SR" rev-parse HEAD) \
+               && git -C "$SR" update-ref refs/pull/2/merge "$SR_M2" \
+               && git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1 \
+               && printf '# header\na\n' > "$SR/$P" \
+               && git -C "$SR" -c commit.gpgsign=false commit -qam 'main: shrink the baseline' >/dev/null 2>&1 \
+               && git -C "$SR" update-ref refs/heads/fp-main "$(git -C "$SR" rev-parse HEAD)" \
+               && git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1 \
+               && git -C "$SR" config uploadpack.allowAnySHA1InWant true \
+               && git init -q "$SC" >/dev/null 2>&1 \
+               && [ "$(git -C "$SC" rev-parse --absolute-git-dir 2>/dev/null)" = "$SC/.git" ] \
+               && git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" '+refs/pull/1/merge:refs/remotes/pull/1/merge' >/dev/null 2>&1 \
+               && git -C "$SC" checkout -q --detach refs/remotes/pull/1/merge >/dev/null 2>&1 \
+               && git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" '+refs/heads/fp-main:refs/remotes/origin/main' >/dev/null 2>&1 \
+               && [ -z "$(git -C "$SC" merge-base HEAD origin/main 2>/dev/null)" ] \
+               && ! git -C "$SC" cat-file -e "${SR_BASE}^{commit}" 2>/dev/null; then
+
+                fp_row() { # fp_row <label> <want-mode> <want-ref|-> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                    local got ref
+                    got=$(GITHUB_EVENT_NAME="$4" GITHUB_SHA="$5" baseline_ratchet_resolve "$SC" origin/main "$P")
+                    ref=${got##*$'\t'}
+                    got=${got%%$'\t'*}
+                    rows=$((rows + 1))
+                    if [ "$got" != "$2" ] || { [ "$3" != - ] && [ "$ref" != "$3" ]; }; then
+                        printf 'FAIL  %-46s want %s %s got %s %s\n' "$1" "$2" "$3" "$got" "$ref"
+                        bad=1
+                    fi
+                }
+                fp_e2e() { # fp_e2e <label> <want-rc> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                    local got
+                    ( GITHUB_EVENT_NAME="$3" GITHUB_SHA="$4" BASELINE_RATCHET_BASE_REF=origin/main \
+                      baseline_ratchet_check "$SC" "$P" set ) >/dev/null 2>&1
+                    got=$?
+                    rows=$((rows + 1))
+                    if [ "$got" != "$2" ]; then
+                        printf 'FAIL  %-46s want rc=%s got rc=%s\n' "$1" "$2" "$got"
+                        bad=1
+                    fi
+                }
+                # Controls: the tip path is unchanged off the event, and it
+                # carries the false red this fix removes.
+                fp_row 'firstparent: push event keeps TIP'        TIP          origin/main push         "$SR_M"
+                fp_e2e 'firstparent: tip blames PR for main shrink' 1                      push         "$SR_M"
+                # A head that is not the event's own merge commit is never read.
+                fp_row 'firstparent: HEAD != GITHUB_SHA keeps TIP' TIP         origin/main pull_request "$SR_X"
+                # Fail-closed: the parent not fetched is UNRESOLVABLE, never TIP.
+                fp_row 'firstparent: parent unfetched -> UNRESOLVABLE' UNRESOLVABLE "$SR_BASE" pull_request "$SR_M"
+                fp_e2e 'firstparent: parent unfetched -> rc 1'    1                      pull_request "$SR_M"
+                if git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" "$SR_BASE" >/dev/null 2>&1 \
+                   && [ -z "$(git -C "$SC" merge-base HEAD origin/main 2>/dev/null)" ]; then
+                    fp_row 'firstparent: parent fetched -> FIRSTPARENT' FIRSTPARENT "$SR_BASE" pull_request "$SR_M"
+                    fp_e2e 'firstparent: re-run after main moved'  0                      pull_request "$SR_M"
+                else
+                    printf 'FAIL  firstparent: the first parent could not be fetched, or it made a\n'
+                    printf '      merge-base resolve. FIRSTPARENT is UNTESTED. Not a skip.\n'
+                    bad=1
+                fi
+                # A single-parent head (a merge_group squash) has no first
+                # parent to trust: it keeps TIP.
+                if git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" "$SR_X" >/dev/null 2>&1 \
+                   && git -C "$SC" checkout -q --detach "$SR_X" >/dev/null 2>&1; then
+                    fp_row 'firstparent: single-parent head keeps TIP' TIP     origin/main pull_request "$SR_X"
+                else
+                    printf 'FAIL  firstparent: the single-parent head could not be checked out. UNTESTED.\n'
+                    bad=1
+                fi
+                # The base the PR was merged onto has no baseline: the PR
+                # introduces it. The tip, which has one, is NOT consulted.
+                if git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" '+refs/pull/2/merge:refs/remotes/pull/2/merge' "$SR_NOBASE" >/dev/null 2>&1 \
+                   && git -C "$SC" checkout -q --detach refs/remotes/pull/2/merge >/dev/null 2>&1; then
+                    fp_row 'firstparent: parent lacks file -> BOOTSTRAP' BOOTSTRAP "$SR_NOBASE" pull_request "$SR_M2"
+                    mv "$SC/$P" "$SC/$P.hidden"
+                    fp_row 'firstparent: not in tree either -> ABSENT' ABSENT    "$SR_NOBASE" pull_request "$SR_M2"
+                    mv "$SC/$P.hidden" "$SC/$P"
+                else
+                    printf 'FAIL  firstparent: the second merge commit could not be checked out. UNTESTED.\n'
+                    bad=1
+                fi
+            else
+                printf 'FAIL  resolve FIRSTPARENT UNTESTED — the shallow re-run clone could\n'
+                printf '      not be built, and a pull_request re-run is that shape. Not a skip.\n'
+                bad=1
+            fi
+            git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1
+
             # END TO END, through the public entry point, on a real repository:
             # append -> RED, delete -> GREEN, unchanged -> GREEN.
             e2e_row() { # e2e_row <label> <want-rc> <content>
diff --git a/scripts/check_census_derived.sh b/scripts/check_census_derived.sh
index bfa137f4bf..c30b2cccd3 100644
--- a/scripts/check_census_derived.sh
+++ b/scripts/check_census_derived.sh
@@ -103,10 +103,10 @@ touch_check() { # touch_check ROOT BRANCH -> 0 not touched (or train); 1 touched
     res=$(baseline_ratchet_resolve "$root" "$BASELINE_RATCHET_BASE_REF" "$CENSUS_PATH")
     mode=${res%%$'\t'*}; ref=${res##*$'\t'}
     case "$mode" in
-        MERGEBASE | TIP) ;;
+        MERGEBASE | FIRSTPARENT | TIP) ;;
         *)
             printf 'FAIL  comparand %s resolved %s for %s: whether this branch edits the census is UNMEASURED, and that is not "untouched".\n' "$ref" "$mode" "$CENSUS_PATH"
-            printf '      In CI: git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+            printf '      In CI: %s\n' "$(baseline_ratchet_fetch_hint "$ref")"
             return 1 ;;
     esac
     # Committed changes AND the working tree, so a local run sees an unstaged edit too.
diff --git a/scripts/check_complexity_ratchet.sh b/scripts/check_complexity_ratchet.sh
index 11bd3282dd..997b1c699a 100755
--- a/scripts/check_complexity_ratchet.sh
+++ b/scripts/check_complexity_ratchet.sh
@@ -675,7 +675,7 @@ REF=${RESOLUTION##*$'\t'}
 case "$MODE" in
     UNRESOLVABLE)
         printf 'FAIL PREFLIGHT: cannot resolve the comparand ref <%s>, so complexity is UNMEASURED against anything. That is not "no growth", and it is not degraded to comparing this branch against itself.\n' "$REF" >&2
-        printf '     In CI, before this guard runs:  git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n' >&2
+        printf '     In CI, before this guard runs:  %s\n' "$(baseline_ratchet_fetch_hint "$REF")" >&2
         exit 1 ;;
     ABSENT | BOOTSTRAP)
         printf 'FAIL PREFLIGHT: <%s> carries no %s/ tree, so there is no comparand to measure. A missing comparand is not "no growth".\n' "$REF" "$CX_COMPARAND_PATH" >&2
diff --git a/scripts/check_no_fabricated_baselines.sh b/scripts/check_no_fabricated_baselines.sh
index 104c7a2538..52e6153660 100755
--- a/scripts/check_no_fabricated_baselines.sh
+++ b/scripts/check_no_fabricated_baselines.sh
@@ -58,6 +58,9 @@
 # named, not quietly dropped.
 set -uo pipefail
 cd "$(dirname "$0")/.." || exit 2
+# The comparand's first-parent step and its fetch hint (#4983) are shared with
+# every baseline ratchet: one definition, so a fix to one cannot miss the other.
+. scripts/lib_baseline_ratchet.sh || exit 2
 
 # ---------------------------------------------------------------------------
 # MODES, AND WHY AN UNKNOWN ARGUMENT IS FATAL.
@@ -549,6 +552,12 @@ ledger_verdict() { # ledger_verdict <ledger-file> <hits-file>  -> rc 0 iff clean
 #     shrunk the ledger; the remedy is `git rebase origin/main`, and the FAIL
 #     text says so. A green local run can therefore red in CI. CI is the
 #     authoritative one.
+#   * FIRSTPARENT comes before the tip on a pull_request run whose HEAD is the
+#     event's own merge commit (#4983): its first parent is the main this run
+#     merged the PR onto, and a re-run keeps that commit while fetching a newer
+#     tip. Against the tip, main's own shrink read as growth in the PR; against
+#     the first parent, a re-run gives the first run's verdict. Not fetched, it
+#     is UNRESOLVABLE; fetched without the ledger, ABSENT. Never the tip.
 #   * If NEITHER resolves, this is a hard failure. It never degrades to comparing
 #     the branch against itself: that would disarm the ratchet permanently and
 #     silently, which is the failure mode this whole guard is about.
@@ -559,7 +568,7 @@ ledger_verdict() { # ledger_verdict <ledger-file> <hits-file>  -> rc 0 iff clean
 BASE_REF="${FABBASE_BASE_REF:-origin/main}"
 
 resolve_base_ref() { # resolve_base_ref <root> <ref> -> "<MODE>\t<commit-ish>"
-    local root="$1" ref="$2" mb
+    local root="$1" ref="$2" mb p1
     if ! git -C "$root" rev-parse --verify --quiet "${ref}^{commit}" >/dev/null 2>&1; then
         printf 'UNRESOLVABLE\t%s\n' "$ref"; return 0
     fi
@@ -567,6 +576,18 @@ resolve_base_ref() { # resolve_base_ref <root> <ref> -> "<MODE>\t<commit-ish>"
     if [ -n "$mb" ] && git -C "$root" cat-file -e "${mb}:${RUST_LEDGER}" 2>/dev/null; then
         printf 'MERGEBASE\t%s\n' "$mb"; return 0
     fi
+    if [ -z "$mb" ] && [ "$ref" = "origin/main" ]; then
+        p1=$(_br_event_merge_first_parent "$root") # FABBASE-FIRSTPARENT-MUTATION-POINT
+        if [ -n "$p1" ]; then
+            if ! git -C "$root" cat-file -e "${p1}^{commit}" 2>/dev/null; then
+                printf 'UNRESOLVABLE\t%s\n' "$p1"; return 0
+            fi
+            if git -C "$root" cat-file -e "${p1}:${RUST_LEDGER}" 2>/dev/null; then
+                printf 'FIRSTPARENT\t%s\n' "$p1"; return 0
+            fi
+            printf 'ABSENT\t%s\n' "$p1"; return 0
+        fi
+    fi
     if git -C "$root" cat-file -e "${ref}:${RUST_LEDGER}" 2>/dev/null; then
         printf 'TIP\t%s\n' "$ref"; return 0
     fi
@@ -627,7 +648,7 @@ rust_ledger_sweep() {
             printf 'FAIL  ledger   cannot resolve the comparand ref <%s>, so shrink-only is\n' "$ref"
             printf '               UNMEASURED. It is NOT degraded to comparing this branch\n'
             printf '               against itself — that disarms the ratchet silently. In CI:\n'
-            printf '               git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+            printf '               %s\n' "$(baseline_ratchet_fetch_hint "$ref")"
             rc=1
             return ;;
         ABSENT)
@@ -652,6 +673,7 @@ rust_ledger_sweep() {
     case "$mode" in
         MERGEBASE) how="merge-base with $BASE_REF" ;;
         TIP)       how="tip of $BASE_REF (no merge-base available; stricter)" ;;
+        FIRSTPARENT) how="first parent of this pull request's merge commit (the main it was merged onto; the same on every re-run)" ;;
         *)         how="$mode" ;;
     esac
     note="protected; a pull request cannot rewrite it"
@@ -894,6 +916,113 @@ if mkdir -p "$sr/scripts" \
         sr_case 'ref does not exist'   UNRESOLVABLE 'refs/heads/no-such-branch-xyzzy'
         sr_case 'ref predates ledger'  ABSENT       "$sr_noledger"
         sr_case 'ref carries ledger'   MERGEBASE    HEAD
+        # FIRSTPARENT (#4983): a pull_request re-run. CI checks out GitHub's
+        # merge commit at depth 1 (no merge-base) and fetches origin/main fresh.
+        # Here main moved on and SHRANK the ledger: against the tip, the PR
+        # "adds" crates/a.rs:1, an entry it never touched; against the first
+        # parent it changed nothing. The shallow clone is its own repository.
+        sr_base=$(git -C "$sr" rev-parse HEAD)
+        sc="$TMPD/shallow"
+        if git -C "$sr" checkout -q -b fp-pr "$sr_base" >/dev/null 2>&1 \
+           && printf 'pr edit\n' > "$sr/scripts/unrelated.txt" \
+           && git -C "$sr" -c commit.gpgsign=false commit -qam 'pr: unrelated edit' >/dev/null 2>&1 \
+           && sr_x=$(git -C "$sr" rev-parse HEAD) \
+           && git -C "$sr" checkout -q --detach "$sr_base" >/dev/null 2>&1 \
+           && git -C "$sr" -c commit.gpgsign=false merge -q --no-ff --no-edit "$sr_x" >/dev/null 2>&1 \
+           && sr_m=$(git -C "$sr" rev-parse HEAD) \
+           && git -C "$sr" update-ref refs/pull/1/merge "$sr_m" \
+           && git -C "$sr" checkout -q --detach "$sr_noledger" >/dev/null 2>&1 \
+           && git -C "$sr" -c commit.gpgsign=false merge -q --no-ff --no-edit "$sr_base" >/dev/null 2>&1 \
+           && sr_m2=$(git -C "$sr" rev-parse HEAD) \
+           && git -C "$sr" update-ref refs/pull/2/merge "$sr_m2" \
+           && git -C "$sr" checkout -q --detach "$sr_base" >/dev/null 2>&1 \
+           && printf '# header\n' > "$sr/$RUST_LEDGER" \
+           && git -C "$sr" -c commit.gpgsign=false commit -qam 'main: shrink the ledger' >/dev/null 2>&1 \
+           && git -C "$sr" update-ref refs/heads/fp-main "$(git -C "$sr" rev-parse HEAD)" \
+           && git -C "$sr" config uploadpack.allowAnySHA1InWant true \
+           && git init -q "$sc" >/dev/null 2>&1 \
+           && [ "$(git -C "$sc" rev-parse --absolute-git-dir 2>/dev/null)" = "$sc/.git" ] \
+           && git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" '+refs/pull/1/merge:refs/remotes/pull/1/merge' >/dev/null 2>&1 \
+           && git -C "$sc" checkout -q --detach refs/remotes/pull/1/merge >/dev/null 2>&1 \
+           && git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" '+refs/heads/fp-main:refs/remotes/origin/main' >/dev/null 2>&1 \
+           && [ -z "$(git -C "$sc" merge-base HEAD origin/main 2>/dev/null)" ] \
+           && ! git -C "$sc" cat-file -e "${sr_base}^{commit}" 2>/dev/null; then
+            fp_case() { # fp_case <label> <want-mode> <want-ref|-> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                local got ref
+                got=$(GITHUB_EVENT_NAME="$4" GITHUB_SHA="$5" resolve_base_ref "$sc" origin/main)
+                ref=${got##*$'\t'}
+                got=${got%%$'\t'*}
+                sr_rows=$((sr_rows + 1))
+                if [ "$got" != "$2" ] || { [ "$3" != - ] && [ "$ref" != "$3" ]; }; then
+                    printf 'FAIL  comparand %-40s want %s %s got %s %s\n' "$1" "$2" "$3" "$got" "$ref"
+                    tbl_bad=1
+                fi
+            }
+            fp_verdict() { # fp_verdict <label> <want-rc> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                # The sweep's own decision on that comparand: UNRESOLVABLE and
+                # ABSENT fail, any other mode is the shrink-only comparison.
+                local got mode ref
+                got=$(GITHUB_EVENT_NAME="$3" GITHUB_SHA="$4" resolve_base_ref "$sc" origin/main)
+                mode=${got%%$'\t'*}
+                ref=${got##*$'\t'}
+                case "$mode" in
+                    UNRESOLVABLE|ABSENT) got=1 ;;
+                    *)
+                        if git -C "$sc" show "${ref}:${RUST_LEDGER}" > "$TMPD/fp_base" 2>/dev/null; then
+                            ledger_entries_of "$TMPD/fp_base" > "$TMPD/fp_base_entries"
+                            ledger_entries_of "$sc/$RUST_LEDGER" > "$TMPD/fp_cur_entries"
+                            ledger_shrink_only "$TMPD/fp_base_entries" "$TMPD/fp_cur_entries" >/dev/null
+                            got=$?
+                        else
+                            got=1
+                        fi ;;
+                esac
+                sr_rows=$((sr_rows + 1))
+                if [ "$got" != "$2" ]; then
+                    printf 'FAIL  comparand %-40s want rc=%s got rc=%s\n' "$1" "$2" "$got"
+                    tbl_bad=1
+                fi
+            }
+            # Controls: the tip path is unchanged off the event, and it carries
+            # the false red this fix removes.
+            fp_case    'push event keeps TIP'             TIP          origin/main push         "$sr_m"
+            fp_verdict 'tip blames PR for main shrink'    1                        push         "$sr_m"
+            # A head that is not the event's own merge commit is never read.
+            fp_case    'HEAD != GITHUB_SHA keeps TIP'     TIP          origin/main pull_request "$sr_x"
+            # Fail-closed: the parent not fetched is UNRESOLVABLE, never TIP.
+            fp_case    'parent unfetched -> UNRESOLVABLE' UNRESOLVABLE "$sr_base"  pull_request "$sr_m"
+            fp_verdict 'parent unfetched -> rc 1'         1                        pull_request "$sr_m"
+            if git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" "$sr_base" >/dev/null 2>&1 \
+               && [ -z "$(git -C "$sc" merge-base HEAD origin/main 2>/dev/null)" ]; then
+                fp_case    'parent fetched -> FIRSTPARENT' FIRSTPARENT "$sr_base"  pull_request "$sr_m"
+                fp_verdict 're-run after main moved'       0                       pull_request "$sr_m"
+            else
+                printf 'FAIL  comparand: the first parent could not be fetched, or it made a\n'
+                printf '      merge-base resolve. FIRSTPARENT is UNTESTED. Not a skip.\n'
+                tbl_bad=1
+            fi
+            # A single-parent head (a merge_group squash) keeps TIP.
+            if git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" "$sr_x" >/dev/null 2>&1 \
+               && git -C "$sc" checkout -q --detach "$sr_x" >/dev/null 2>&1; then
+                fp_case    'single-parent head keeps TIP'  TIP         origin/main pull_request "$sr_x"
+            else
+                printf 'FAIL  comparand: the single-parent head could not be checked out. UNTESTED.\n'
+                tbl_bad=1
+            fi
+            # The main the PR was merged onto has no ledger. There is no
+            # bootstrap here, and the tip, which has one, is NOT consulted.
+            if git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" '+refs/pull/2/merge:refs/remotes/pull/2/merge' "$sr_noledger" >/dev/null 2>&1 \
+               && git -C "$sc" checkout -q --detach refs/remotes/pull/2/merge >/dev/null 2>&1; then
+                fp_case    'parent lacks ledger -> ABSENT' ABSENT      "$sr_noledger" pull_request "$sr_m2"
+            else
+                printf 'FAIL  comparand: the second merge commit could not be checked out. UNTESTED.\n'
+                tbl_bad=1
+            fi
+        else
+            printf 'FAIL  comparand FIRSTPARENT UNTESTED — the shallow re-run clone could\n'
+            printf '      not be built, and a pull_request re-run is that shape. Not a skip.\n'
+            tbl_bad=1
+        fi
     else
         printf 'FAIL  comparand table: could not commit in the scratch repo, so the\n'
         printf '      UNRESOLVABLE/ABSENT branches are UNTESTED. That is not a skip.\n'
diff --git a/scripts/check_readme_claims.sh b/scripts/check_readme_claims.sh
index 3434564d04..e5ec7b557c 100755
--- a/scripts/check_readme_claims.sh
+++ b/scripts/check_readme_claims.sh
@@ -377,7 +377,7 @@ check_contract_count() {
   case "$mode" in
     UNRESOLVABLE)
       { printf 'FAIL FALSIFY-README-002 contract_count: PREFLIGHT — cannot resolve the comparand ref <%s>, so the count is UNMEASURED against anything. That is not "no drift", and it is not degraded to comparing this branch against itself.\n' "$ref"
-        printf '     In CI, before this guard runs:  git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'; } >&2
+        printf '     In CI, before this guard runs:  %s\n' "$(baseline_ratchet_fetch_hint "$ref")"; } >&2
       return 1 ;;
     ABSENT|BOOTSTRAP)
       printf 'FAIL FALSIFY-README-002 contract_count: PREFLIGHT — <%s> carries no contracts/ tree, so there is no comparand to diff against. A missing comparand is not "no drift".\n' "$ref" >&2
diff --git a/scripts/ci/pin_build_base.sh b/scripts/ci/pin_build_base.sh
new file mode 100755
index 0000000000..d27f616096
--- /dev/null
+++ b/scripts/ci/pin_build_base.sh
@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# pin_build_base.sh — pin refs/remotes/origin/main to the commit this run's tree was BUILT on.
+# It is the comparand every ratchet in guard-tree and guard-cargo reads (#4861).
+#
+# Both sections used to fetch the origin/main TIP when they started. A section can start hours
+# after the merge commit it judges was built, so a branch that never touched a baseline went red
+# when main shrank that baseline in between. #4813: built on 358e9d4d11, where
+# pipe_grep_q_baseline.txt records 62; the section started when main's tip was ece9e563bd, after
+# da7059c5c7 shrank it to 60; `GREW` 62 vs 60, in a file #4813 does not touch. A re-run builds
+# the same merge commit, so the false red survives every re-run. #4983 is the same defect on a
+# RE-RUN: #4970's m17 complexity step, attempt 2, judged its unchanged merge commit against main's
+# moved tip acd599e52 and went red where attempt 1 had not. The shared ratchet library also takes
+# the merge commit's first parent on its own (scripts/lib_baseline_ratchet.sh FIRSTPARENT); this
+# pin covers every reader of origin/main, library or not, and the merge queue.
+#
+#   pull_request  the merge commit's FIRST parent. HEAD must be a two-parent merge commit whose
+#                 second parent is the PR head (PR_HEAD_SHA); any other HEAD names no build base,
+#                 and this refuses rather than guess one.
+#   merge_group   merge_group.base_sha (MG_BASE_SHA), as the refinement-gate pin does. The queue
+#                 builds on main as it merges, so an entry main already deleted that a PR adds
+#                 back is still refused there.
+#   otherwise     the origin/main tip, deepened by one on push: scripts/lib/resolve_base.sh judges
+#                 a push against HEAD's first parent, and a depth-1 checkout has not fetched it.
+#
+# EXIT 0 pinned · 1 refused (no build base can be named) or a fetch failed · 64 usage
+#
+#   PR_HEAD_SHA=<sha> MG_BASE_SHA=<sha> bash scripts/ci/pin_build_base.sh [--self-test]
+set -euo pipefail
+
+ZERO=0000000000000000000000000000000000000000
+
+is_sha() { [[ ${1:-} =~ ^[0-9a-f]{40}$ ]] && [ "$1" != "$ZERO" ]; }
+
+refuse() {
+    printf '::error::pin_build_base: %s\n' "$1"
+    return 1
+}
+
+pin() { # pin <repo dir>: pins origin/main there for $GITHUB_EVENT_NAME
+    local dir="$1" ev="${GITHUB_EVENT_NAME:-}" base how
+    local parents=()
+    case "$ev" in
+        pull_request) # PIN-BUILD-BASE-MUTATION-POINT
+            mapfile -t parents < <(git -C "$dir" cat-file -p 'HEAD^{commit}' 2>/dev/null | awk '/^$/{exit} /^parent /{print $2}')
+            [ "${#parents[@]}" -eq 2 ] \
+                || refuse "pull_request: HEAD has ${#parents[@]} parent(s), not 2. Only refs/pull/N/merge names its build base." || return 1
+            is_sha "${PR_HEAD_SHA:-}" || refuse "pull_request: no PR head sha (PR_HEAD_SHA='${PR_HEAD_SHA:-}')" || return 1
+            [ "${parents[1]}" = "$PR_HEAD_SHA" ] \
+                || refuse "pull_request: HEAD's second parent ${parents[1]} is not the PR head $PR_HEAD_SHA, so HEAD is not this PR's merge commit" || return 1
+            base="${parents[0]}"; how="first parent of the merge commit"
+            ;;
+        merge_group)
+            is_sha "${MG_BASE_SHA:-}" || refuse "merge_group: no base_sha (MG_BASE_SHA='${MG_BASE_SHA:-}')" || return 1
+            base="$MG_BASE_SHA"; how="merge_group.base_sha"
+            ;;
+        *)
+            git -C "$dir" fetch -q --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
+            if [ "$ev" = push ]; then
+                git -C "$dir" fetch -q --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
+            fi
+            printf 'comparand: %s pinned as origin/main (the tip; event %s)\n' "$(git -C "$dir" rev-parse 'origin/main^{commit}')" "${ev:-none}"
+            return 0
+            ;;
+    esac
+    git -C "$dir" fetch -q --no-tags --depth=1 origin "$base" || refuse "cannot fetch the build base $base" || return 1
+    git -C "$dir" update-ref refs/remotes/origin/main "$base"
+    [ "$(git -C "$dir" rev-parse 'origin/main^{commit}')" = "$base" ] || refuse "origin/main does not read back as $base" || return 1
+    printf 'comparand: %s pinned as origin/main (%s; event %s)\n' "$base" "$how" "$ev"
+}
+
+# ---------------------------------------------------------------------------
+# The case table. Scratch origin + depth-1 clones, the shape actions/checkout leaves. The #4813
+# rows run the REAL scripts/lib_baseline_ratchet.sh: the old tip comparand is RED on a PR that
+# never touched the baseline, the build base is GREEN, and a PR that grows it is still RED.
+self_test() {
+    local here; here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
+    local lib="$here/scripts/lib_baseline_ratchet.sh"
+    [ -f "$lib" ] || { printf 'FAIL  self-test: %s is missing\n' "$lib"; return 1; }
+    TD=$(mktemp -d); trap 'rm -rf "${TD:?}"' EXIT
+    local o="$TD/origin.git" w="$TD/w" u="file://$TD/origin.git"
+    local c0 prh m c2 grh m2 ok=0 bad=0
+    g() { git -C "$w" -c user.name=st -c user.email=st@example.invalid -c commit.gpgsign=false "$@"; }
+    git init -q --template= --bare -b main "$o"
+    git -C "$o" config uploadpack.allowReachableSHA1InWant true
+    git init -q --template= -b main "$w"
+    printf '# count\n62\n' > "$w/r_baseline.txt"; g add -A; g commit -q -m c0; c0=$(g rev-parse HEAD)
+    g push -q "$u" main
+    # The PR: off c0, and it never touches the baseline. GitHub's merge commit: c0 first, PR head second.
+    g checkout -q -b pr; printf 'pr\n' > "$w/pr.txt"; g add -A; g commit -q -m pr; prh=$(g rev-parse HEAD)
+    g checkout -q --detach "$c0"; g merge -q --no-ff --no-edit pr; m=$(g rev-parse HEAD)
+    g push -q "$u" "$m:refs/pull/1/merge"
+    # main moves on AFTER that build: it shrinks the baseline 62 -> 60 (#4813).
+    g checkout -q main; printf '# count\n60\n' > "$w/r_baseline.txt"; g add -A; g commit -q -m c2; c2=$(g rev-parse HEAD)
+    g push -q "$u" main
+    # A PR built on c2 that GROWS the baseline 60 -> 61.
+    g checkout -q -b grow; printf '# count\n61\n' > "$w/r_baseline.txt"; g add -A; g commit -q -m grow; grh=$(g rev-parse HEAD)
+    g checkout -q --detach "$c2"; g merge -q --no-ff --no-edit grow; m2=$(g rev-parse HEAD)
+    g push -q "$u" "$m2:refs/pull/2/merge"
+
+
+    clone_at() { # clone_at <name> <sha>: a depth-1 clone checked out at <sha>, the shape actions/checkout leaves
+        local d="$TD/$1"
+        [ ! -e "$d" ] || { printf 'FAIL  self-test: clone %s reused; a row would judge another row'"'"'s pin\n' "$1" >&2; return 1; }
+        git init -q --template= "$d" && git -C "$d" remote add origin "$u" \
+            && git -C "$d" fetch -q --no-tags --depth=1 origin "$2" && git -C "$d" checkout -q --detach FETCH_HEAD \
+            || { printf 'FAIL  self-test: cannot build clone %s at %s\n' "$1" "$2" >&2; return 1; }
+        printf '%s' "$d"
+    }
+    run_pin() { # run_pin <dir> <event> <pr head> <mg base> -> pin's rc; PINNED = origin/main after, or "unset"
+        local rc=0
+        ( GITHUB_EVENT_NAME="$2" PR_HEAD_SHA="$3" MG_BASE_SHA="$4" pin "$1" ) > "$TD/last.log" 2>&1 || rc=$?
+        PINNED=$(git -C "$1" rev-parse -q --verify 'refs/remotes/origin/main^{commit}' 2>/dev/null) || PINNED=unset
+        return "$rc"
+    }
+    ratchet() { # ratchet <dir> [VAR=value ...] -> the real library's verdict on r_baseline.txt: "<rc> <GREW|ok|other>"
+        # The runner's own GITHUB_EVENT_NAME/GITHUB_SHA never leak in: a row names the event it judges.
+        local dir="$1" rc=0 says=other; shift
+        ( unset BASELINE_RATCHET_BASE_REF GITHUB_EVENT_NAME GITHUB_SHA; [ "$#" -eq 0 ] || export "$@"
+          . "$lib" || exit 2; baseline_ratchet_check "$dir" r_baseline.txt count ) \
+            > "$TD/last.log" 2>&1 || rc=$?
+        if grep -q 'GREW' "$TD/last.log"; then says="GREW:$(sed -nE 's/.*count rose ([0-9]+ -> [0-9]+).*/\1/p' "$TD/last.log" | tr ' ' _)"
+        elif grep -q '^ok    ratchet' "$TD/last.log"; then says=ok; fi
+        printf '%s %s' "$rc" "$says"
+    }
+    row() { # row LABEL GOT WANT
+        if [ "$2" = "$3" ]; then ok=$((ok + 1)); printf 'ok    %s\n' "$1"
+        else bad=$((bad + 1)); printf 'FAIL  %s: got <%s>, want <%s>\n' "$1" "$2" "$3"; sed 's/^/        /' "$TD/last.log"; fi
+    }
+    said() { # said <text>: did the last run name its cause? A refusal is an andon, and an andon names why
+        if grep -qF -- "$1" "$TD/last.log"; then printf 'says-cause'; else printf 'cause-missing'; fi
+    }
+    local d rc bogus PINNED nbad=0
+
+    d=$(clone_at pr1 "$m"); rc=0; run_pin "$d" pull_request "$prh" "" || rc=$?
+    row "pull_request pins the merge commit's first parent" "$rc $PINNED" "0 $c0"
+    row "#4813 shape, build base: the PR never touched the baseline, ratchet GREEN" "$(ratchet "$d")" "0 ok"
+    row "the library's own first-parent path (#4983) gives the pin's verdict" \
+        "$(ratchet "$d" GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$m") $(said "first parent of this pull request's merge commit, $c0")" "0 ok says-cause"
+    d=$(clone_at tip1 "$m"); rc=0; run_pin "$d" workflow_dispatch "" "" || rc=$?
+    row "#4813 shape, the old tip comparand: the same PR is RED, 62 vs main's 60" "$rc $PINNED $(ratchet "$d")" "0 $c2 1 GREW:60_->_62"
+
+    d=$(clone_at pr2 "$m2"); rc=0; run_pin "$d" pull_request "$grh" "" || rc=$?
+    row "pull_request on a PR built on c2 pins c2" "$rc $PINNED" "0 $c2"
+    row "a PR that grows the baseline is still RED against its build base" "$(ratchet "$d")" "1 GREW:60_->_61"
+    row "... and still RED on the library's first-parent path" \
+        "$(ratchet "$d" GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$m2")" "1 GREW:60_->_61"
+
+    d=$(clone_at single "$prh"); rc=0; run_pin "$d" pull_request "$prh" "" || rc=$?
+    row "pull_request on a single-parent HEAD (checkout of the PR head) refuses and pins nothing" \
+        "$rc $PINNED $(said 'HEAD has 1 parent(s), not 2')" "1 unset says-cause"
+    d=$(clone_at wronghead "$m"); rc=0; run_pin "$d" pull_request "$c2" "" || rc=$?
+    row "pull_request whose second parent is not the PR head refuses" \
+        "$rc $PINNED $(said 'is not the PR head')" "1 unset says-cause"
+    d=$(clone_at swapped "$m"); rc=0; run_pin "$d" pull_request "$c0" "" || rc=$?
+    row "pull_request naming the FIRST parent as the PR head refuses" \
+        "$rc $PINNED $(said 'is not the PR head')" "1 unset says-cause"
+    d=$(clone_at nohead "$m"); rc=0; run_pin "$d" pull_request "" "" || rc=$?
+    row "pull_request with no PR head sha refuses" "$rc $PINNED $(said 'no PR head sha')" "1 unset says-cause"
+
+    d=$(clone_at mg "$m2"); rc=0; run_pin "$d" merge_group "" "$c2" || rc=$?
+    row "merge_group pins base_sha" "$rc $PINNED" "0 $c2"
+    for bogus in "" "$ZERO" main "${c2:0:39}" "${c2^^}"; do
+        nbad=$((nbad + 1)); d=$(clone_at "mgbad$nbad" "$m2"); rc=0; run_pin "$d" merge_group "" "$bogus" || rc=$?
+        row "merge_group with base_sha <${bogus:0:12}> refuses" "$rc $PINNED $(said 'merge_group: no base_sha')" "1 unset says-cause"
+    done
+    d=$(clone_at mgmissing "$m2"); rc=0; run_pin "$d" merge_group "" "$(printf '%040d' 7)" || rc=$?
+    row "merge_group whose base_sha origin does not have refuses" \
+        "$rc $PINNED $(said 'cannot fetch the build base')" "1 unset says-cause"
+
+    d=$(clone_at push "$c2"); rc=0; run_pin "$d" push "" "" || rc=$?
+    row "push pins the tip" "$rc $PINNED" "0 $c2"
+    row "push deepens by one: the tip's first parent is fetched" \
+        "$(git -C "$d" rev-parse -q --verify 'origin/main^1^{commit}' 2>/dev/null || printf none)" "$c0"
+    d=$(clone_at wd "$m"); rc=0; run_pin "$d" workflow_dispatch "" "" || rc=$?
+    row "workflow_dispatch pins the tip" "$rc $PINNED" "0 $c2"
+    rc=0; run_pin "$TD/pr1" pull_request "$prh" "" || rc=$?
+    row "pinning twice is idempotent" "$rc $PINNED" "0 $c0"
+
+    printf 'pin_build_base self-test: %s ok, %s bad\n' "$ok" "$bad"
+    [ "$bad" -eq 0 ] && [ "$ok" -ge 22 ]
+}
+
+case "${1:-}" in
+    --self-test) self_test ;;
+    "") pin "$(git rev-parse --show-toplevel)" ;;
+    *) printf 'usage: %s [--self-test]\n' "$0" >&2; exit 64 ;;
+esac
diff --git a/scripts/lib_baseline_ratchet.sh b/scripts/lib_baseline_ratchet.sh
index 68a2bffc14..8884a00ab7 100644
--- a/scripts/lib_baseline_ratchet.sh
+++ b/scripts/lib_baseline_ratchet.sh
@@ -56,6 +56,19 @@
 #     stronger (it also forbids re-adding an entry main has already deleted).
 #     The cost is a false red on a branch behind a main that already shrank the
 #     baseline; the remedy is `git rebase origin/main`, and the FAIL says so.
+#     In guard-tree and guard-cargo the "tip" is no longer fetched live: since
+#     #4861 scripts/ci/pin_build_base.sh pins origin/main to the run's build
+#     base (a pull_request merge commit's first parent, merge_group.base_sha in
+#     the queue, the tip on any other event), so there the tip path and
+#     FIRSTPARENT name the same commit.
+#   * FIRSTPARENT comes before the tip on a pull_request run whose HEAD is the
+#     event's own merge commit (#4983). That commit's first parent is the main
+#     GitHub merged the PR onto. A re-run keeps that merge commit but fetches
+#     origin/main fresh, so on the tip path main's own deletions since then read
+#     as this PR's growth, and an unchanged PR turns red. The first parent is
+#     fixed for the life of the run and chosen by GitHub, not the PR author. Not
+#     fetched, it is UNRESOLVABLE (hard failure), never the tip. Fetched but
+#     lacking the path, the tip is skipped too (BOOTSTRAP or ABSENT below).
 #   * if NEITHER resolves, this is a HARD FAILURE. It never degrades to
 #     comparing the branch against itself, which would disarm every ratchet
 #     silently — the exact failure this library is about.
@@ -453,8 +466,31 @@ _br_cmp_keyed2() { # _br_cmp_keyed2 <base-file> <cur-file>  (lines are <key> <in
 # CALLER decides, so that "could not resolve" is a loud verdict row rather than
 # a swallowed error.
 
+# The first parent of HEAD, printed only when HEAD is this pull_request run's
+# own merge commit: the event is pull_request, HEAD is GITHUB_SHA, and HEAD has
+# two or more parents. Anything else prints nothing. The parent is read from
+# the commit object, not from HEAD^1, which a depth-1 graft cannot resolve.
+_br_event_merge_first_parent() { # _br_event_merge_first_parent <root>
+    local root="$1" head
+    [ "${GITHUB_EVENT_NAME:-}" = pull_request ] || return 0
+    head=$(git -C "$root" rev-parse --verify --quiet 'HEAD^{commit}' 2>/dev/null) || return 0
+    [ -n "${GITHUB_SHA:-}" ] && [ "$head" = "$GITHUB_SHA" ] || return 0
+    git -C "$root" cat-file -p "$head" 2>/dev/null |
+        LC_ALL=C awk '/^parent /{ n++; if (n == 1) p = $2 } /^$/{ exit } END { if (n >= 2) print p }'
+}
+
+# The fetch that makes an UNRESOLVABLE comparand resolvable. A full sha is a
+# merge commit's first parent; anything else is the protected branch.
+baseline_ratchet_fetch_hint() { # baseline_ratchet_fetch_hint <ref>
+    if printf '%s' "$1" | LC_ALL=C grep -qE '^[0-9a-f]{40}$'; then
+        printf 'git fetch --no-tags --depth=1 origin %s\n' "$1"
+    else
+        printf 'git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+    fi
+}
+
 baseline_ratchet_resolve() { # baseline_ratchet_resolve <root> <ref> <path>
-    local root="$1" ref="$2" path="$3" mb
+    local root="$1" ref="$2" path="$3" mb p1
     if ! git -C "$root" rev-parse --verify --quiet "${ref}^{commit}" >/dev/null 2>&1; then
         printf 'UNRESOLVABLE\t%s\n' "$ref"
         return 0
@@ -464,6 +500,29 @@ baseline_ratchet_resolve() { # baseline_ratchet_resolve <root> <ref> <path>
         printf 'MERGEBASE\t%s\n' "$mb"
         return 0
     fi
+    # FIRSTPARENT (#4983): see the header. Only for the protected ref and only
+    # when no merge-base exists, so every shape that resolves one is unchanged.
+    if [ -z "$mb" ] && [ "$ref" = "origin/main" ]; then
+        p1=$(_br_event_merge_first_parent "$root") # RATCHET-FIRSTPARENT-MUTATION-POINT
+        if [ -n "$p1" ]; then
+            if ! git -C "$root" cat-file -e "${p1}^{commit}" 2>/dev/null; then
+                printf 'UNRESOLVABLE\t%s\n' "$p1"
+                return 0
+            fi
+            if git -C "$root" cat-file -e "${p1}:${path}" 2>/dev/null; then
+                printf 'FIRSTPARENT\t%s\n' "$p1"
+                return 0
+            fi
+            # The base this PR was merged onto has no such file: the tip would
+            # judge the PR against a main it was never merged onto, so skip it.
+            if [ -f "$root/$path" ]; then
+                printf 'BOOTSTRAP\t%s\n' "$p1"
+                return 0
+            fi
+            printf 'ABSENT\t%s\n' "$p1"
+            return 0
+        fi
+    fi
     if git -C "$root" cat-file -e "${ref}:${path}" 2>/dev/null; then
         printf 'TIP\t%s\n' "$ref"
         return 0
@@ -529,7 +588,7 @@ baseline_ratchet_check() {
             printf '               for %s is UNMEASURED. It is NOT degraded to\n' "$path"
             printf '               comparing this branch against itself — that disarms the\n'
             printf '               ratchet silently. In CI, before this guard runs:\n'
-            printf '               git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+            printf '               %s\n' "$(baseline_ratchet_fetch_hint "$ref")"
             return 1 ;;
         BOOTSTRAP)
             printf 'REPORT ratchet %s is NOT ARMED on this commit: %s carries\n' "$path" "$ref"
@@ -591,6 +650,7 @@ baseline_ratchet_check() {
     case "$mode" in
         MERGEBASE) how="merge-base with $BASELINE_RATCHET_BASE_REF" ;;
         TIP)       how="tip of $BASELINE_RATCHET_BASE_REF (no merge-base available; stricter)" ;;
+        FIRSTPARENT) how="first parent of this pull request's merge commit, $ref (the main it was merged onto; the same on every re-run)" ;;
         *)         how="$mode" ;;
     esac
     note="protected; a pull request cannot rewrite it"
diff --git a/scripts/tests/ratchet_semantics_test.sh b/scripts/tests/ratchet_semantics_test.sh
index 47c18e86d9..89a0d09f41 100755
--- a/scripts/tests/ratchet_semantics_test.sh
+++ b/scripts/tests/ratchet_semantics_test.sh
@@ -398,6 +398,215 @@ run_complexity() {
   else
     bad "C7  mutation NOT demonstrated: the mutant still exits $rc on the improvement fixture, so C3 does not discriminate 'measured comparand' from 'file on disk'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
   fi
+
+  # --- C8-C11: A RE-RUN AFTER MAIN MOVED (#4983) ---------------------------
+  # A pull_request run checks out GitHub's merge commit M at depth 1: first
+  # parent B1 (the main it was merged onto), second parent the PR head. A
+  # re-run keeps M but fetches origin/main fresh. Here main then moved to B2,
+  # which fixed cognitive_only (cognitive 28 -> 3), a function this PR never
+  # touches. Judged against the moving tip, M "adds" an offender; judged
+  # against B1, it adds nothing. The clone is shallow, as CI's is, so there
+  # is no merge-base and the resolver is past its MERGEBASE branch.
+  local CO="$WORK/cx8-origin" CC="$WORK/cx8-clone" B1 X M B2 FP_ENV
+  cx_fixture "$CO" || die "C8 origin fixture could not be built"
+  B1=$(git_fx "$CO" rev-parse HEAD) || die "C8: no B1"
+  git_fx "$CO" checkout -q -b pr >/dev/null 2>&1 || die "C8: cannot branch the PR"
+  cx_lib '0.0.0-shim' 'branchy 35 34' 'cognitive_only 8 28' 'tidy 2 0' > "$CO/src/lib.rs" || die "C8: cannot write the PR edit"
+  cx_commit "$CO" 'pr: an unrelated edit under both thresholds' || die "C8: PR commit failed"
+  X=$(git_fx "$CO" rev-parse HEAD) || die "C8: no X"
+  git_fx "$CO" checkout -q --detach "$B1" >/dev/null 2>&1 || die "C8: cannot return to B1"
+  git_fx "$CO" merge -q --no-ff --no-edit "$X" >/dev/null 2>&1 || die "C8: cannot build the merge commit"
+  M=$(git_fx "$CO" rev-parse HEAD) || die "C8: no M"
+  [ "$(git_fx "$CO" rev-parse "$M^1")" = "$B1" ] || die "C8: M's first parent is not B1"
+  git_fx "$CO" update-ref refs/pull/1/merge "$M" || die "C8: cannot publish refs/pull/1/merge"
+  git_fx "$CO" checkout -q --detach "$B1" >/dev/null 2>&1 || die "C8: cannot return to B1 for main"
+  cx_lib '0.0.0-shim' 'branchy 35 34' 'cognitive_only 3 3' 'tidy 1 0' > "$CO/src/lib.rs" || die "C8: cannot write B2"
+  cx_commit "$CO" 'main: fix cognitive_only after the PR was merged onto B1' || die "C8: B2 commit failed"
+  B2=$(git_fx "$CO" rev-parse HEAD) || die "C8: no B2"
+  git_fx "$CO" update-ref refs/heads/main "$B2" || die "C8: cannot move main to B2"
+  git_fx "$CO" config uploadpack.allowAnySHA1InWant true || die "C8: cannot allow a fetch by sha"
+
+  # The shallow clone: its OWN repository under $WORK, never a worktree of
+  # this one (a shallow fetch writes .git/shallow into the common dir).
+  GIT_TERMINAL_PROMPT=0 git init -q --template="$WORK/empty-template" "$CC" >/dev/null 2>&1 || die "C8: clone init failed"
+  [ "$(git -C "$CC" rev-parse --absolute-git-dir 2>/dev/null)" = "$CC/.git" ] || die "C8: $CC is not its own repository"
+  git_fx "$CC" fetch -q --no-tags --depth=1 "file://$CO" '+refs/pull/1/merge:refs/remotes/pull/1/merge' >/dev/null 2>&1 || die "C8: depth-1 fetch of M failed"
+  git_fx "$CC" checkout -q --detach refs/remotes/pull/1/merge >/dev/null 2>&1 || die "C8: cannot check out M"
+  git_fx "$CC" fetch -q --no-tags --depth=1 "file://$CO" '+refs/heads/main:refs/remotes/origin/main' >/dev/null 2>&1 || die "C8: depth-1 fetch of main failed"
+  [ "$(git_fx "$CC" rev-parse HEAD)" = "$M" ] && [ "$(git_fx "$CC" rev-parse origin/main)" = "$B2" ] \
+    && [ -z "$(git_fx "$CC" merge-base HEAD origin/main 2>/dev/null)" ] \
+    && ! git_fx "$CC" cat-file -e "${B1}^{commit}" 2>/dev/null \
+    || die "C8: the clone is not the re-run shape (HEAD=M, origin/main=B2, no merge-base, B1 unfetched)"
+  FP_ENV=(GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$M")
+
+  # C8: CONTROL. Not a pull_request event, so the comparand is the moved tip
+  # and the PR is blamed for main's fix. This is the #4983 false red; it must
+  # reproduce here, or C10's GREEN below proves nothing.
+  out=$(cx_run "$CC" check_complexity_ratchet.sh GITHUB_EVENT_NAME=push "GITHUB_SHA=$M"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE '^  comparand   TIP ' <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C8  control: on the tip path the re-run blames this PR for a function only main changed (the #4983 false red, reproduced)"
+  else
+    bad "C8  control: rc=$rc, wanted 1, 'comparand   TIP' and 'RED    NEW      src/lib.rs::cognitive_only'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C9: the first parent is not in the clone. Fail-closed: UNRESOLVABLE at
+  # preflight, B1 and its fetch named, nothing measured, and NOT the tip.
+  out=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -q 'FAIL PREFLIGHT' <<<"$out" \
+     && grep -q "cannot resolve the comparand ref <$B1>" <<<"$out" \
+     && grep -q "git fetch --no-tags --depth=1 origin $B1" <<<"$out" \
+     && ! grep -qE '^  measured    base ' <<<"$out"; then
+    ok "C9  first parent not fetched: RED at preflight, the parent and its fetch named, NO measurement and no tip fallback"
+  else
+    bad "C9  unfetched first parent: rc=$rc, wanted 1, a PREFLIGHT failure naming $B1 and its fetch, and no measurement line"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C10: the CI step fetches the first parent; the re-run is GREEN against B1.
+  git_fx "$CC" fetch -q --no-tags --depth=1 "file://$CO" "$B1" >/dev/null 2>&1 || die "C10: depth-1 fetch of B1 failed"
+  [ -z "$(git_fx "$CC" merge-base HEAD origin/main 2>/dev/null)" ] || die "C10: fetching B1 made a merge-base resolve; the row would not test FIRSTPARENT"
+  out=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 0 ] && grep -qE "^  comparand   FIRSTPARENT +${B1:0:7}" <<<"$out" \
+     && grep -q '^PASS (D2)' <<<"$out"; then
+    ok "C10 re-run after main moved: comparand FIRSTPARENT = B1, GREEN"
+  else
+    bad "C10 re-run: rc=$rc, wanted 0, 'comparand   FIRSTPARENT ${B1:0:7}' and 'PASS (D2)'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C11: the FIRST run, when origin/main was still B1, gives the same verdict
+  # on both paths: the old tip path and the first-parent path.
+  git_fx "$CC" update-ref refs/remotes/origin/main "$B1" || die "C11: cannot pin origin/main to B1"
+  out=$(cx_run "$CC" check_complexity_ratchet.sh GITHUB_EVENT_NAME= GITHUB_SHA=); rc=$?
+  local out2 rc2
+  out2=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc2=$?
+  if [ "$rc" -eq 0 ] && grep -qE '^  comparand   TIP ' <<<"$out" && grep -q '^PASS (D2)' <<<"$out" \
+     && [ "$rc2" -eq 0 ] && grep -qE '^  comparand   FIRSTPARENT ' <<<"$out2" && grep -q '^PASS (D2)' <<<"$out2"; then
+    ok "C11 first run (origin/main = B1): GREEN on the tip path and on the first-parent path, the same verdict as the re-run"
+  else
+    bad "C11 first run: rc=$rc (tip) / rc=$rc2 (first parent), wanted 0 and 'PASS (D2)' on both"$'\n'"$(printf '%s\n%s' "$out" "$out2" | sed 's/^/        /')"
+  fi
+  git_fx "$CC" update-ref refs/remotes/origin/main "$B2" || die "C11: cannot move origin/main back to B2"
+
+  # C12: THE REGISTERED MUTATION of the fix. Blank the first parent at its
+  # marked line (a copy of the lib in the clone; the repo's file is not
+  # touched) and C10's re-run must go back to the C8 false red.
+  cp "$CC/scripts/lib_baseline_ratchet.sh" "$WORK/cx8-lib.orig" || die "C12: cannot save the lib"
+  if sed 's|^\( *\)p1=\$(_br_event_merge_first_parent "\$root") # RATCHET-FIRSTPARENT-MUTATION-POINT$|\1p1=""|' \
+        "$WORK/cx8-lib.orig" > "$CC/scripts/lib_baseline_ratchet.sh" \
+     && grep -qE '^ +p1=""$' "$CC/scripts/lib_baseline_ratchet.sh" \
+     && ! grep -q 'RATCHET-FIRSTPARENT-MUTATION-POINT' "$CC/scripts/lib_baseline_ratchet.sh"; then
+    ok "C12 the first-parent mutation point is present in the shipped lib and the mutant was derived from a COPY of it"
+  else
+    bad "C12 the mutation could not be derived: no '# RATCHET-FIRSTPARENT-MUTATION-POINT' line in scripts/lib_baseline_ratchet.sh"
+  fi
+  out=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc=$?
+  cp "$WORK/cx8-lib.orig" "$CC/scripts/lib_baseline_ratchet.sh" || die "C12: cannot restore the lib"
+  if [ "$rc" -eq 1 ] && grep -q 'RED    NEW      src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C12 mutation caught: without the first parent the re-run is RED again on main's own fix, so C10's GREEN is load-bearing"
+  else
+    bad "C12 mutation NOT demonstrated: the mutant exits $rc on the re-run fixture, so C10 does not discriminate first parent from tip"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # --- C13-C16: A REAL RISE STAYS RED ON THE SAME RE-RUN (#4983, #4861) ----
+  # C10's GREEN must not be bought by going blind. A second PR, merged onto
+  # the same B1 and re-run after main moved to B2, lands a function over both
+  # thresholds: it is RED on the first-parent path (C13) and on the pinned
+  # origin/main a non-library reader sees (C15), and main's own fix to
+  # cognitive_only is blamed on neither PR. C14 is the stale re-run on the
+  # pinned path, and C16 is the pin's registered mutation. The pin needs an
+  # `origin` remote, so these clones carry one; CC above does not.
+  cx_rerun_clone() { # cx_rerun_clone <dir> <pull number> <merge sha>: HEAD = merge, origin/main = B2, depth 1
+    GIT_TERMINAL_PROMPT=0 git init -q --template="$WORK/empty-template" "$1" >/dev/null 2>&1 || return 1
+    [ "$(git -C "$1" rev-parse --absolute-git-dir 2>/dev/null)" = "$1/.git" ] || return 1
+    git_fx "$1" remote add origin "file://$CO" || return 1
+    git_fx "$1" fetch -q --no-tags --depth=1 origin "+refs/pull/$2/merge:refs/remotes/pull/$2/merge" >/dev/null 2>&1 || return 1
+    git_fx "$1" checkout -q --detach "refs/remotes/pull/$2/merge" >/dev/null 2>&1 || return 1
+    git_fx "$1" fetch -q --no-tags --depth=1 origin '+refs/heads/main:refs/remotes/origin/main' >/dev/null 2>&1 || return 1
+    [ "$(git_fx "$1" rev-parse HEAD)" = "$3" ] && [ "$(git_fx "$1" rev-parse origin/main)" = "$B2" ] \
+      && [ -z "$(git_fx "$1" merge-base HEAD origin/main 2>/dev/null)" ]
+  }
+  cx_pin() { # cx_pin <dir> <pr head> [pin script]: scripts/ci/pin_build_base.sh as CI runs it on a pull_request
+    ( cd "$1" && env GITHUB_EVENT_NAME=pull_request PR_HEAD_SHA="$2" MG_BASE_SHA= \
+        bash "${3:-$ROOT/scripts/ci/pin_build_base.sh}" ) 2>&1
+  }
+  local X3 M3 CC3="$WORK/cx13-clone" CC4="$WORK/cx14-clone" CC5="$WORK/cx16-clone" TIP_ENV=(GITHUB_EVENT_NAME= GITHUB_SHA=)
+  git_fx "$CO" checkout -q -b pr3 "$B1" >/dev/null 2>&1 || die "C13: cannot branch the second PR off B1"
+  cx_lib '0.0.0-shim' 'branchy 35 34' 'cognitive_only 8 28' 'tidy 1 0' 'newbie 40 40' > "$CO/src/lib.rs" || die "C13: cannot write the PR edit"
+  cx_commit "$CO" 'pr3: land a function over both thresholds' || die "C13: PR commit failed"
+  X3=$(git_fx "$CO" rev-parse HEAD) || die "C13: no X3"
+  git_fx "$CO" checkout -q --detach "$B1" >/dev/null 2>&1 || die "C13: cannot return to B1"
+  git_fx "$CO" merge -q --no-ff --no-edit "$X3" >/dev/null 2>&1 || die "C13: cannot build the merge commit"
+  M3=$(git_fx "$CO" rev-parse HEAD) || die "C13: no M3"
+  [ "$(git_fx "$CO" rev-parse "$M3^1")" = "$B1" ] || die "C13: M3's first parent is not B1"
+  git_fx "$CO" update-ref refs/pull/3/merge "$M3" || die "C13: cannot publish refs/pull/3/merge"
+  [ "$(git_fx "$CO" rev-parse refs/heads/main)" = "$B2" ] || die "C13: main is not B2"
+
+  # C13: the first-parent path, B1 fetched as CI's setup step does.
+  cx_rerun_clone "$CC3" 3 "$M3" || die "C13: the clone is not the re-run shape (HEAD=M3, origin/main=B2, no merge-base)"
+  git_fx "$CC3" fetch -q --no-tags --depth=1 origin "$B1" >/dev/null 2>&1 || die "C13: depth-1 fetch of B1 failed"
+  out=$(cx_run "$CC3" check_complexity_ratchet.sh GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$M3"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE "^  comparand   FIRSTPARENT +${B1:0:7}" <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::newbie' <<<"$out" \
+     && ! grep -qE 'RED +[A-Z]+ +src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C13 re-run of a PR that lands an offender: comparand FIRSTPARENT = B1, RED on that function and on nothing of main's"
+  else
+    bad "C13 real rise on the re-run: rc=$rc, wanted 1, 'comparand   FIRSTPARENT ${B1:0:7}', 'RED    NEW      src/lib.rs::newbie' and no cognitive_only row"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C14: the stale re-run (the C8 PR) on the PINNED path: origin/main = B1, so a
+  # reader of origin/main that never asks the library for a first parent gets
+  # C10's verdict too. The check runs with no event, i.e. on the tip path.
+  cx_rerun_clone "$CC4" 1 "$M" || die "C14: the clone is not the re-run shape (HEAD=M, origin/main=B2, no merge-base)"
+  out=$(cx_pin "$CC4" "$X"); rc=$?
+  if [ "$rc" -eq 0 ] && [ "$(git_fx "$CC4" rev-parse origin/main)" = "$B1" ]; then
+    ok "C14 the pin on the stale re-run: origin/main = B1, the merge commit's first parent"
+  else
+    bad "C14 the pin on the stale re-run: rc=$rc, origin/main=$(git_fx "$CC4" rev-parse origin/main 2>&1), wanted 0 and B1 (${B1:0:7})"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+  out=$(cx_run "$CC4" check_complexity_ratchet.sh "${TIP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 0 ] && grep -qE "^  comparand   TIP +${B1:0:7}" <<<"$out" && grep -q '^PASS (D2)' <<<"$out"; then
+    ok "C14 stale re-run, origin/main pinned to the build base: tip path reads B1, GREEN"
+  else
+    bad "C14 pinned re-run: rc=$rc, wanted 0, 'comparand   TIP ${B1:0:7}' and 'PASS (D2)'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C15: the real rise on the pinned path. A fresh pin on CC3 (B1 is fetched
+  # there already; the pin fetches it again and moves origin/main to it).
+  out=$(cx_pin "$CC3" "$X3"); rc=$?
+  if [ "$rc" -eq 0 ] && [ "$(git_fx "$CC3" rev-parse origin/main)" = "$B1" ]; then
+    ok "C15 the pin on the real rise: origin/main = B1, the merge commit's first parent"
+  else
+    bad "C15 the pin on the real rise: rc=$rc, origin/main=$(git_fx "$CC3" rev-parse origin/main 2>&1), wanted 0 and B1 (${B1:0:7})"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+  out=$(cx_run "$CC3" check_complexity_ratchet.sh "${TIP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE "^  comparand   TIP +${B1:0:7}" <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::newbie' <<<"$out" \
+     && ! grep -qE 'RED +[A-Z]+ +src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C15 real rise, origin/main pinned to the build base: tip path reads B1, RED on the PR's function only"
+  else
+    bad "C15 pinned real rise: rc=$rc, wanted 1, 'comparand   TIP ${B1:0:7}', 'RED    NEW      src/lib.rs::newbie' and no cognitive_only row"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C16: THE PIN'S REGISTERED MUTATION. A copy of pin_build_base.sh whose
+  # pull_request case is unreachable falls through to the tip, and C14's
+  # stale re-run must go back to the C8 false red.
+  if sed 's|^\( *\)pull_request) # PIN-BUILD-BASE-MUTATION-POINT$|\1pull_request_MUTANT)|' \
+        "$ROOT/scripts/ci/pin_build_base.sh" > "$WORK/pin-mutant.sh" \
+     && grep -qE '^ +pull_request_MUTANT\)$' "$WORK/pin-mutant.sh" \
+     && ! grep -q 'PIN-BUILD-BASE-MUTATION-POINT' "$WORK/pin-mutant.sh"; then
+    ok "C16 the pin's mutation point is present in the shipped script and the mutant was derived from a COPY of it"
+  else
+    bad "C16 the mutation could not be derived: no '# PIN-BUILD-BASE-MUTATION-POINT' line in scripts/ci/pin_build_base.sh"
+  fi
+  cx_rerun_clone "$CC5" 1 "$M" || die "C16: the clone is not the re-run shape (HEAD=M, origin/main=B2, no merge-base)"
+  out=$(cx_pin "$CC5" "$X" "$WORK/pin-mutant.sh"); rc=$?
+  out=$(cx_run "$CC5" check_complexity_ratchet.sh "${TIP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE "^  comparand   TIP +${B2:0:7}" <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C16 mutation caught: without the pull_request pin the stale re-run reads B2 and is RED on main's own fix, so C14's GREEN is load-bearing"
+  else
+    bad "C16 mutation NOT demonstrated: the mutant pin leaves rc=$rc on the stale re-run, so C14 does not discriminate build base from tip"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
 }
 
 # ===========================================================================