From 5d5ff8ef157d6b976d87c27aef985ca73faaaa32 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Fri, 9 Oct 2026 20:24:15 +0200
Subject: [PATCH 1/3] fix(ratchet): a pull_request re-run judges against its
 merge commit's first parent, not main's moving tip

Refs #4983

A pull_request run checks out GitHub's merge commit at depth 1, so there
is no merge-base and every baseline ratchet fell back to the origin/main
TIP. A re-run keeps the old merge commit but fetches main fresh, so once
main moves, main's own shrinks read as this PR's growth and an unchanged
PR turns red on files it never touched (#4970 run 37945794011, m17).

- lib_baseline_ratchet.sh: new FIRSTPARENT comparand, ahead of TIP, only
  for origin/main, only with no merge-base, only when the event is
  pull_request and HEAD is GITHUB_SHA with two or more parents. The
  parent is read from the commit object (HEAD^1 does not resolve under a
  depth-1 graft). Fail-closed: parent not fetched -> UNRESOLVABLE with a
  fetch-by-sha hint, never the tip; parent lacks the path -> BOOTSTRAP or
  ABSENT, never the tip.
- ci/sections.yml (guard-tree and guard-cargo setup steps): on
  pull_request, fetch that first parent at depth 1.
- census, complexity and readme callers: FIRSTPARENT admitted by census;
  UNRESOLVABLE hints name the fetch that resolves the ref.

Red/green: ratchet_semantics_test.sh --class complexity C8 (control: the
tip path reproduces the false red), C9 (parent unfetched -> RED at
preflight, nothing measured), C10 (re-run GREEN on FIRSTPARENT), C11
(first run gives the same verdict on both paths), C12 (registered
mutation at RATCHET-FIRSTPARENT-MUTATION-POINT turns C10 RED again).
check_baseline_ratchets.sh --self-test gains 10 resolver/end-to-end rows;
the same mutation turns 5 of them RED.

Agent: aprender-a7n

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ci/sections.yml                         |  36 ++++++--
 scripts/check_baseline_ratchets.sh      | 101 ++++++++++++++++++++++
 scripts/check_census_derived.sh         |   4 +-
 scripts/check_complexity_ratchet.sh     |   2 +-
 scripts/check_readme_claims.sh          |   2 +-
 scripts/lib_baseline_ratchet.sh         |  59 ++++++++++++-
 scripts/tests/ratchet_semantics_test.sh | 108 ++++++++++++++++++++++++
 7 files changed, 298 insertions(+), 14 deletions(-)

diff --git a/ci/sections.yml b/ci/sections.yml
index 249aedae8c..7f27b365d6 100644
--- a/ci/sections.yml
+++ b/ci/sections.yml
@@ -1147,10 +1147,12 @@ jobs:
       # never as "no growth", so the mistake would have been loud rather than
       # silent. It is still a mistake. One fetch, before all of them.
       #
-      # fetch-depth is 1 here, so the merge-base is usually unavailable and the
-      # ratchets fall back to the origin/main TIP. That is the STRICTER
-      # comparand, and it means the CI path is the tip path: a local run that
-      # passes on the merge-base can still red here, and CI is authoritative.
+      # fetch-depth is 1 here, so the merge-base is usually unavailable. On a
+      # pull_request run the ratchets then compare against the first parent of
+      # the run's merge commit (#4983), fetched below; on every other event
+      # without a merge-base they fall back to the origin/main TIP, the STRICTER
+      # comparand. A local run that passes on the merge-base can still red
+      # here, and CI is authoritative.
       - id: guard-setup
         name: Fetch origin/main as the comparand for every ratchet in this job
         run: |
@@ -1159,6 +1161,14 @@ jobs:
           # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
           # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
           if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
+          # pull_request shape (#4983): HEAD is GitHub's merge commit, and its FIRST PARENT is the main
+          # this run merged the PR onto. A re-run keeps that commit but the fetch above brings main's
+          # NEW tip, so the ratchets judge against that parent (scripts/lib_baseline_ratchet.sh
+          # FIRSTPARENT), never the moving tip. Not fetched, every ratchet fails UNRESOLVABLE.
+          if [ "${GITHUB_EVENT_NAME:-}" = pull_request ]; then
+            p1=$(git cat-file -p HEAD | awk '/^parent /{ n++; if (n == 1) p = $2 } /^$/{ exit } END { if (n >= 2) print p }')
+            if [ -n "$p1" ] && ! git cat-file -e "${p1}^{commit}" 2>/dev/null; then git fetch --no-tags --depth=1 origin "$p1"; fi
+          fi
       # #4415 (operator A4, 2026-09-25): ONE step runs every guard step of guard-tree-steps
       # below, keeps going past a red one, and reports every failure. GitHub would
       # stop this job at its first red step, and the others would never be seen.
@@ -1685,10 +1695,12 @@ jobs:
       # never as "no growth", so the mistake would have been loud rather than
       # silent. It is still a mistake. One fetch, before all of them.
       #
-      # fetch-depth is 1 here, so the merge-base is usually unavailable and the
-      # ratchets fall back to the origin/main TIP. That is the STRICTER
-      # comparand, and it means the CI path is the tip path: a local run that
-      # passes on the merge-base can still red here, and CI is authoritative.
+      # fetch-depth is 1 here, so the merge-base is usually unavailable. On a
+      # pull_request run the ratchets then compare against the first parent of
+      # the run's merge commit (#4983), fetched below; on every other event
+      # without a merge-base they fall back to the origin/main TIP, the STRICTER
+      # comparand. A local run that passes on the merge-base can still red
+      # here, and CI is authoritative.
       - name: Fetch origin/main as the comparand for every ratchet in this job
         run: |
           git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
@@ -1696,6 +1708,14 @@ jobs:
           # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
           # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
           if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
+          # pull_request shape (#4983): HEAD is GitHub's merge commit, and its FIRST PARENT is the main
+          # this run merged the PR onto. A re-run keeps that commit but the fetch above brings main's
+          # NEW tip, so the ratchets judge against that parent (scripts/lib_baseline_ratchet.sh
+          # FIRSTPARENT), never the moving tip. Not fetched, every ratchet fails UNRESOLVABLE.
+          if [ "${GITHUB_EVENT_NAME:-}" = pull_request ]; then
+            p1=$(git cat-file -p HEAD | awk '/^parent /{ n++; if (n == 1) p = $2 } /^$/{ exit } END { if (n >= 2) print p }')
+            if [ -n "$p1" ] && ! git cat-file -e "${p1}^{commit}" 2>/dev/null; then git fetch --no-tags --depth=1 origin "$p1"; fi
+          fi
       # DOCKER CREATES A MISSING BIND SOURCE AS root:root, AND `--user` ALONE
       # THEN EACCESs ON IT. The per-RUN target path is fresh every run, so a
       # container that mounts it and drops to the runner's uid cannot write
diff --git a/scripts/check_baseline_ratchets.sh b/scripts/check_baseline_ratchets.sh
index 2952390bb2..3a8ea7fc31 100644
--- a/scripts/check_baseline_ratchets.sh
+++ b/scripts/check_baseline_ratchets.sh
@@ -372,6 +372,107 @@ if [ "${1:-}" = "--self-test" ] || [ "${1:-}" = "--selftest" ]; then
                 bad=1
             fi
 
+            # FIRSTPARENT (#4983): a pull_request re-run. CI checks out GitHub's
+            # merge commit at depth 1, so there is no merge-base, and the re-run
+            # fetches origin/main fresh. Here main moved on and SHRANK the
+            # baseline (b deleted). Against the tip, the PR "appends" b, an
+            # entry it never touched; against the first parent, it changed
+            # nothing. The shallow clone is its own repository under $TD.
+            SC="$TD/shallow"
+            if git -C "$SR" checkout -q -b fp-pr "$SR_BASE" >/dev/null 2>&1 \
+               && printf 'pr edit\n' > "$SR/scripts/unrelated.txt" \
+               && git -C "$SR" -c commit.gpgsign=false commit -qam 'pr: unrelated edit' >/dev/null 2>&1 \
+               && SR_X=$(git -C "$SR" rev-parse HEAD) \
+               && git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1 \
+               && git -C "$SR" -c commit.gpgsign=false merge -q --no-ff --no-edit "$SR_X" >/dev/null 2>&1 \
+               && SR_M=$(git -C "$SR" rev-parse HEAD) \
+               && git -C "$SR" update-ref refs/pull/1/merge "$SR_M" \
+               && git -C "$SR" checkout -q --detach "$SR_NOBASE" >/dev/null 2>&1 \
+               && git -C "$SR" -c commit.gpgsign=false merge -q --no-ff --no-edit "$SR_BASE" >/dev/null 2>&1 \
+               && SR_M2=$(git -C "$SR" rev-parse HEAD) \
+               && git -C "$SR" update-ref refs/pull/2/merge "$SR_M2" \
+               && git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1 \
+               && printf '# header\na\n' > "$SR/$P" \
+               && git -C "$SR" -c commit.gpgsign=false commit -qam 'main: shrink the baseline' >/dev/null 2>&1 \
+               && git -C "$SR" update-ref refs/heads/fp-main "$(git -C "$SR" rev-parse HEAD)" \
+               && git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1 \
+               && git -C "$SR" config uploadpack.allowAnySHA1InWant true \
+               && git init -q "$SC" >/dev/null 2>&1 \
+               && [ "$(git -C "$SC" rev-parse --absolute-git-dir 2>/dev/null)" = "$SC/.git" ] \
+               && git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" '+refs/pull/1/merge:refs/remotes/pull/1/merge' >/dev/null 2>&1 \
+               && git -C "$SC" checkout -q --detach refs/remotes/pull/1/merge >/dev/null 2>&1 \
+               && git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" '+refs/heads/fp-main:refs/remotes/origin/main' >/dev/null 2>&1 \
+               && [ -z "$(git -C "$SC" merge-base HEAD origin/main 2>/dev/null)" ] \
+               && ! git -C "$SC" cat-file -e "${SR_BASE}^{commit}" 2>/dev/null; then
+
+                fp_row() { # fp_row <label> <want-mode> <want-ref|-> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                    local got ref
+                    got=$(GITHUB_EVENT_NAME="$4" GITHUB_SHA="$5" baseline_ratchet_resolve "$SC" origin/main "$P")
+                    ref=${got##*$'\t'}
+                    got=${got%%$'\t'*}
+                    rows=$((rows + 1))
+                    if [ "$got" != "$2" ] || { [ "$3" != - ] && [ "$ref" != "$3" ]; }; then
+                        printf 'FAIL  %-46s want %s %s got %s %s\n' "$1" "$2" "$3" "$got" "$ref"
+                        bad=1
+                    fi
+                }
+                fp_e2e() { # fp_e2e <label> <want-rc> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                    local got
+                    ( GITHUB_EVENT_NAME="$3" GITHUB_SHA="$4" BASELINE_RATCHET_BASE_REF=origin/main \
+                      baseline_ratchet_check "$SC" "$P" set ) >/dev/null 2>&1
+                    got=$?
+                    rows=$((rows + 1))
+                    if [ "$got" != "$2" ]; then
+                        printf 'FAIL  %-46s want rc=%s got rc=%s\n' "$1" "$2" "$got"
+                        bad=1
+                    fi
+                }
+                # Controls: the tip path is unchanged off the event, and it
+                # carries the false red this fix removes.
+                fp_row 'firstparent: push event keeps TIP'        TIP          origin/main push         "$SR_M"
+                fp_e2e 'firstparent: tip blames PR for main shrink' 1                      push         "$SR_M"
+                # A head that is not the event's own merge commit is never read.
+                fp_row 'firstparent: HEAD != GITHUB_SHA keeps TIP' TIP         origin/main pull_request "$SR_X"
+                # Fail-closed: the parent not fetched is UNRESOLVABLE, never TIP.
+                fp_row 'firstparent: parent unfetched -> UNRESOLVABLE' UNRESOLVABLE "$SR_BASE" pull_request "$SR_M"
+                fp_e2e 'firstparent: parent unfetched -> rc 1'    1                      pull_request "$SR_M"
+                if git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" "$SR_BASE" >/dev/null 2>&1 \
+                   && [ -z "$(git -C "$SC" merge-base HEAD origin/main 2>/dev/null)" ]; then
+                    fp_row 'firstparent: parent fetched -> FIRSTPARENT' FIRSTPARENT "$SR_BASE" pull_request "$SR_M"
+                    fp_e2e 'firstparent: re-run after main moved'  0                      pull_request "$SR_M"
+                else
+                    printf 'FAIL  firstparent: the first parent could not be fetched, or it made a\n'
+                    printf '      merge-base resolve. FIRSTPARENT is UNTESTED. Not a skip.\n'
+                    bad=1
+                fi
+                # A single-parent head (a merge_group squash) has no first
+                # parent to trust: it keeps TIP.
+                if git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" "$SR_X" >/dev/null 2>&1 \
+                   && git -C "$SC" checkout -q --detach "$SR_X" >/dev/null 2>&1; then
+                    fp_row 'firstparent: single-parent head keeps TIP' TIP     origin/main pull_request "$SR_X"
+                else
+                    printf 'FAIL  firstparent: the single-parent head could not be checked out. UNTESTED.\n'
+                    bad=1
+                fi
+                # The base the PR was merged onto has no baseline: the PR
+                # introduces it. The tip, which has one, is NOT consulted.
+                if git -C "$SC" fetch -q --no-tags --depth=1 "file://$SR" '+refs/pull/2/merge:refs/remotes/pull/2/merge' "$SR_NOBASE" >/dev/null 2>&1 \
+                   && git -C "$SC" checkout -q --detach refs/remotes/pull/2/merge >/dev/null 2>&1; then
+                    fp_row 'firstparent: parent lacks file -> BOOTSTRAP' BOOTSTRAP "$SR_NOBASE" pull_request "$SR_M2"
+                    mv "$SC/$P" "$SC/$P.hidden"
+                    fp_row 'firstparent: not in tree either -> ABSENT' ABSENT    "$SR_NOBASE" pull_request "$SR_M2"
+                    mv "$SC/$P.hidden" "$SC/$P"
+                else
+                    printf 'FAIL  firstparent: the second merge commit could not be checked out. UNTESTED.\n'
+                    bad=1
+                fi
+            else
+                printf 'FAIL  resolve FIRSTPARENT UNTESTED — the shallow re-run clone could\n'
+                printf '      not be built, and a pull_request re-run is that shape. Not a skip.\n'
+                bad=1
+            fi
+            git -C "$SR" checkout -q --detach "$SR_BASE" >/dev/null 2>&1
+
             # END TO END, through the public entry point, on a real repository:
             # append -> RED, delete -> GREEN, unchanged -> GREEN.
             e2e_row() { # e2e_row <label> <want-rc> <content>
diff --git a/scripts/check_census_derived.sh b/scripts/check_census_derived.sh
index bfa137f4bf..c30b2cccd3 100644
--- a/scripts/check_census_derived.sh
+++ b/scripts/check_census_derived.sh
@@ -103,10 +103,10 @@ touch_check() { # touch_check ROOT BRANCH -> 0 not touched (or train); 1 touched
     res=$(baseline_ratchet_resolve "$root" "$BASELINE_RATCHET_BASE_REF" "$CENSUS_PATH")
     mode=${res%%$'\t'*}; ref=${res##*$'\t'}
     case "$mode" in
-        MERGEBASE | TIP) ;;
+        MERGEBASE | FIRSTPARENT | TIP) ;;
         *)
             printf 'FAIL  comparand %s resolved %s for %s: whether this branch edits the census is UNMEASURED, and that is not "untouched".\n' "$ref" "$mode" "$CENSUS_PATH"
-            printf '      In CI: git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+            printf '      In CI: %s\n' "$(baseline_ratchet_fetch_hint "$ref")"
             return 1 ;;
     esac
     # Committed changes AND the working tree, so a local run sees an unstaged edit too.
diff --git a/scripts/check_complexity_ratchet.sh b/scripts/check_complexity_ratchet.sh
index 11bd3282dd..997b1c699a 100755
--- a/scripts/check_complexity_ratchet.sh
+++ b/scripts/check_complexity_ratchet.sh
@@ -675,7 +675,7 @@ REF=${RESOLUTION##*$'\t'}
 case "$MODE" in
     UNRESOLVABLE)
         printf 'FAIL PREFLIGHT: cannot resolve the comparand ref <%s>, so complexity is UNMEASURED against anything. That is not "no growth", and it is not degraded to comparing this branch against itself.\n' "$REF" >&2
-        printf '     In CI, before this guard runs:  git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n' >&2
+        printf '     In CI, before this guard runs:  %s\n' "$(baseline_ratchet_fetch_hint "$REF")" >&2
         exit 1 ;;
     ABSENT | BOOTSTRAP)
         printf 'FAIL PREFLIGHT: <%s> carries no %s/ tree, so there is no comparand to measure. A missing comparand is not "no growth".\n' "$REF" "$CX_COMPARAND_PATH" >&2
diff --git a/scripts/check_readme_claims.sh b/scripts/check_readme_claims.sh
index 3434564d04..e5ec7b557c 100755
--- a/scripts/check_readme_claims.sh
+++ b/scripts/check_readme_claims.sh
@@ -377,7 +377,7 @@ check_contract_count() {
   case "$mode" in
     UNRESOLVABLE)
       { printf 'FAIL FALSIFY-README-002 contract_count: PREFLIGHT — cannot resolve the comparand ref <%s>, so the count is UNMEASURED against anything. That is not "no drift", and it is not degraded to comparing this branch against itself.\n' "$ref"
-        printf '     In CI, before this guard runs:  git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'; } >&2
+        printf '     In CI, before this guard runs:  %s\n' "$(baseline_ratchet_fetch_hint "$ref")"; } >&2
       return 1 ;;
     ABSENT|BOOTSTRAP)
       printf 'FAIL FALSIFY-README-002 contract_count: PREFLIGHT — <%s> carries no contracts/ tree, so there is no comparand to diff against. A missing comparand is not "no drift".\n' "$ref" >&2
diff --git a/scripts/lib_baseline_ratchet.sh b/scripts/lib_baseline_ratchet.sh
index 68a2bffc14..fcc1fe087e 100644
--- a/scripts/lib_baseline_ratchet.sh
+++ b/scripts/lib_baseline_ratchet.sh
@@ -56,6 +56,14 @@
 #     stronger (it also forbids re-adding an entry main has already deleted).
 #     The cost is a false red on a branch behind a main that already shrank the
 #     baseline; the remedy is `git rebase origin/main`, and the FAIL says so.
+#   * FIRSTPARENT comes before the tip on a pull_request run whose HEAD is the
+#     event's own merge commit (#4983). That commit's first parent is the main
+#     GitHub merged the PR onto. A re-run keeps that merge commit but fetches
+#     origin/main fresh, so on the tip path main's own deletions since then read
+#     as this PR's growth, and an unchanged PR turns red. The first parent is
+#     fixed for the life of the run and chosen by GitHub, not the PR author. Not
+#     fetched, it is UNRESOLVABLE (hard failure), never the tip. Fetched but
+#     lacking the path, the tip is skipped too (BOOTSTRAP or ABSENT below).
 #   * if NEITHER resolves, this is a HARD FAILURE. It never degrades to
 #     comparing the branch against itself, which would disarm every ratchet
 #     silently — the exact failure this library is about.
@@ -453,8 +461,31 @@ _br_cmp_keyed2() { # _br_cmp_keyed2 <base-file> <cur-file>  (lines are <key> <in
 # CALLER decides, so that "could not resolve" is a loud verdict row rather than
 # a swallowed error.
 
+# The first parent of HEAD, printed only when HEAD is this pull_request run's
+# own merge commit: the event is pull_request, HEAD is GITHUB_SHA, and HEAD has
+# two or more parents. Anything else prints nothing. The parent is read from
+# the commit object, not from HEAD^1, which a depth-1 graft cannot resolve.
+_br_event_merge_first_parent() { # _br_event_merge_first_parent <root>
+    local root="$1" head
+    [ "${GITHUB_EVENT_NAME:-}" = pull_request ] || return 0
+    head=$(git -C "$root" rev-parse --verify --quiet 'HEAD^{commit}' 2>/dev/null) || return 0
+    [ -n "${GITHUB_SHA:-}" ] && [ "$head" = "$GITHUB_SHA" ] || return 0
+    git -C "$root" cat-file -p "$head" 2>/dev/null |
+        LC_ALL=C awk '/^parent /{ n++; if (n == 1) p = $2 } /^$/{ exit } END { if (n >= 2) print p }'
+}
+
+# The fetch that makes an UNRESOLVABLE comparand resolvable. A full sha is a
+# merge commit's first parent; anything else is the protected branch.
+baseline_ratchet_fetch_hint() { # baseline_ratchet_fetch_hint <ref>
+    if printf '%s' "$1" | LC_ALL=C grep -qE '^[0-9a-f]{40}$'; then
+        printf 'git fetch --no-tags --depth=1 origin %s\n' "$1"
+    else
+        printf 'git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+    fi
+}
+
 baseline_ratchet_resolve() { # baseline_ratchet_resolve <root> <ref> <path>
-    local root="$1" ref="$2" path="$3" mb
+    local root="$1" ref="$2" path="$3" mb p1
     if ! git -C "$root" rev-parse --verify --quiet "${ref}^{commit}" >/dev/null 2>&1; then
         printf 'UNRESOLVABLE\t%s\n' "$ref"
         return 0
@@ -464,6 +495,29 @@ baseline_ratchet_resolve() { # baseline_ratchet_resolve <root> <ref> <path>
         printf 'MERGEBASE\t%s\n' "$mb"
         return 0
     fi
+    # FIRSTPARENT (#4983): see the header. Only for the protected ref and only
+    # when no merge-base exists, so every shape that resolves one is unchanged.
+    if [ -z "$mb" ] && [ "$ref" = "origin/main" ]; then
+        p1=$(_br_event_merge_first_parent "$root") # RATCHET-FIRSTPARENT-MUTATION-POINT
+        if [ -n "$p1" ]; then
+            if ! git -C "$root" cat-file -e "${p1}^{commit}" 2>/dev/null; then
+                printf 'UNRESOLVABLE\t%s\n' "$p1"
+                return 0
+            fi
+            if git -C "$root" cat-file -e "${p1}:${path}" 2>/dev/null; then
+                printf 'FIRSTPARENT\t%s\n' "$p1"
+                return 0
+            fi
+            # The base this PR was merged onto has no such file: the tip would
+            # judge the PR against a main it was never merged onto, so skip it.
+            if [ -f "$root/$path" ]; then
+                printf 'BOOTSTRAP\t%s\n' "$p1"
+                return 0
+            fi
+            printf 'ABSENT\t%s\n' "$p1"
+            return 0
+        fi
+    fi
     if git -C "$root" cat-file -e "${ref}:${path}" 2>/dev/null; then
         printf 'TIP\t%s\n' "$ref"
         return 0
@@ -529,7 +583,7 @@ baseline_ratchet_check() {
             printf '               for %s is UNMEASURED. It is NOT degraded to\n' "$path"
             printf '               comparing this branch against itself — that disarms the\n'
             printf '               ratchet silently. In CI, before this guard runs:\n'
-            printf '               git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+            printf '               %s\n' "$(baseline_ratchet_fetch_hint "$ref")"
             return 1 ;;
         BOOTSTRAP)
             printf 'REPORT ratchet %s is NOT ARMED on this commit: %s carries\n' "$path" "$ref"
@@ -591,6 +645,7 @@ baseline_ratchet_check() {
     case "$mode" in
         MERGEBASE) how="merge-base with $BASELINE_RATCHET_BASE_REF" ;;
         TIP)       how="tip of $BASELINE_RATCHET_BASE_REF (no merge-base available; stricter)" ;;
+        FIRSTPARENT) how="first parent of this pull request's merge commit, $ref (the main it was merged onto; the same on every re-run)" ;;
         *)         how="$mode" ;;
     esac
     note="protected; a pull request cannot rewrite it"
diff --git a/scripts/tests/ratchet_semantics_test.sh b/scripts/tests/ratchet_semantics_test.sh
index 47c18e86d9..30868916c5 100755
--- a/scripts/tests/ratchet_semantics_test.sh
+++ b/scripts/tests/ratchet_semantics_test.sh
@@ -398,6 +398,114 @@ run_complexity() {
   else
     bad "C7  mutation NOT demonstrated: the mutant still exits $rc on the improvement fixture, so C3 does not discriminate 'measured comparand' from 'file on disk'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
   fi
+
+  # --- C8-C11: A RE-RUN AFTER MAIN MOVED (#4983) ---------------------------
+  # A pull_request run checks out GitHub's merge commit M at depth 1: first
+  # parent B1 (the main it was merged onto), second parent the PR head. A
+  # re-run keeps M but fetches origin/main fresh. Here main then moved to B2,
+  # which fixed cognitive_only (cognitive 28 -> 3), a function this PR never
+  # touches. Judged against the moving tip, M "adds" an offender; judged
+  # against B1, it adds nothing. The clone is shallow, as CI's is, so there
+  # is no merge-base and the resolver is past its MERGEBASE branch.
+  local CO="$WORK/cx8-origin" CC="$WORK/cx8-clone" B1 X M B2 FP_ENV
+  cx_fixture "$CO" || die "C8 origin fixture could not be built"
+  B1=$(git_fx "$CO" rev-parse HEAD) || die "C8: no B1"
+  git_fx "$CO" checkout -q -b pr >/dev/null 2>&1 || die "C8: cannot branch the PR"
+  cx_lib '0.0.0-shim' 'branchy 35 34' 'cognitive_only 8 28' 'tidy 2 0' > "$CO/src/lib.rs" || die "C8: cannot write the PR edit"
+  cx_commit "$CO" 'pr: an unrelated edit under both thresholds' || die "C8: PR commit failed"
+  X=$(git_fx "$CO" rev-parse HEAD) || die "C8: no X"
+  git_fx "$CO" checkout -q --detach "$B1" >/dev/null 2>&1 || die "C8: cannot return to B1"
+  git_fx "$CO" merge -q --no-ff --no-edit "$X" >/dev/null 2>&1 || die "C8: cannot build the merge commit"
+  M=$(git_fx "$CO" rev-parse HEAD) || die "C8: no M"
+  [ "$(git_fx "$CO" rev-parse "$M^1")" = "$B1" ] || die "C8: M's first parent is not B1"
+  git_fx "$CO" update-ref refs/pull/1/merge "$M" || die "C8: cannot publish refs/pull/1/merge"
+  git_fx "$CO" checkout -q --detach "$B1" >/dev/null 2>&1 || die "C8: cannot return to B1 for main"
+  cx_lib '0.0.0-shim' 'branchy 35 34' 'cognitive_only 3 3' 'tidy 1 0' > "$CO/src/lib.rs" || die "C8: cannot write B2"
+  cx_commit "$CO" 'main: fix cognitive_only after the PR was merged onto B1' || die "C8: B2 commit failed"
+  B2=$(git_fx "$CO" rev-parse HEAD) || die "C8: no B2"
+  git_fx "$CO" update-ref refs/heads/main "$B2" || die "C8: cannot move main to B2"
+  git_fx "$CO" config uploadpack.allowAnySHA1InWant true || die "C8: cannot allow a fetch by sha"
+
+  # The shallow clone: its OWN repository under $WORK, never a worktree of
+  # this one (a shallow fetch writes .git/shallow into the common dir).
+  GIT_TERMINAL_PROMPT=0 git init -q --template="$WORK/empty-template" "$CC" >/dev/null 2>&1 || die "C8: clone init failed"
+  [ "$(git -C "$CC" rev-parse --absolute-git-dir 2>/dev/null)" = "$CC/.git" ] || die "C8: $CC is not its own repository"
+  git_fx "$CC" fetch -q --no-tags --depth=1 "file://$CO" '+refs/pull/1/merge:refs/remotes/pull/1/merge' >/dev/null 2>&1 || die "C8: depth-1 fetch of M failed"
+  git_fx "$CC" checkout -q --detach refs/remotes/pull/1/merge >/dev/null 2>&1 || die "C8: cannot check out M"
+  git_fx "$CC" fetch -q --no-tags --depth=1 "file://$CO" '+refs/heads/main:refs/remotes/origin/main' >/dev/null 2>&1 || die "C8: depth-1 fetch of main failed"
+  [ "$(git_fx "$CC" rev-parse HEAD)" = "$M" ] && [ "$(git_fx "$CC" rev-parse origin/main)" = "$B2" ] \
+    && [ -z "$(git_fx "$CC" merge-base HEAD origin/main 2>/dev/null)" ] \
+    && ! git_fx "$CC" cat-file -e "${B1}^{commit}" 2>/dev/null \
+    || die "C8: the clone is not the re-run shape (HEAD=M, origin/main=B2, no merge-base, B1 unfetched)"
+  FP_ENV=(GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$M")
+
+  # C8: CONTROL. Not a pull_request event, so the comparand is the moved tip
+  # and the PR is blamed for main's fix. This is the #4983 false red; it must
+  # reproduce here, or C10's GREEN below proves nothing.
+  out=$(cx_run "$CC" check_complexity_ratchet.sh GITHUB_EVENT_NAME=push "GITHUB_SHA=$M"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE '^  comparand   TIP ' <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C8  control: on the tip path the re-run blames this PR for a function only main changed (the #4983 false red, reproduced)"
+  else
+    bad "C8  control: rc=$rc, wanted 1, 'comparand   TIP' and 'RED    NEW      src/lib.rs::cognitive_only'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C9: the first parent is not in the clone. Fail-closed: UNRESOLVABLE at
+  # preflight, B1 and its fetch named, nothing measured, and NOT the tip.
+  out=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -q 'FAIL PREFLIGHT' <<<"$out" \
+     && grep -q "cannot resolve the comparand ref <$B1>" <<<"$out" \
+     && grep -q "git fetch --no-tags --depth=1 origin $B1" <<<"$out" \
+     && ! grep -qE '^  measured    base ' <<<"$out"; then
+    ok "C9  first parent not fetched: RED at preflight, the parent and its fetch named, NO measurement and no tip fallback"
+  else
+    bad "C9  unfetched first parent: rc=$rc, wanted 1, a PREFLIGHT failure naming $B1 and its fetch, and no measurement line"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C10: the CI step fetches the first parent; the re-run is GREEN against B1.
+  git_fx "$CC" fetch -q --no-tags --depth=1 "file://$CO" "$B1" >/dev/null 2>&1 || die "C10: depth-1 fetch of B1 failed"
+  [ -z "$(git_fx "$CC" merge-base HEAD origin/main 2>/dev/null)" ] || die "C10: fetching B1 made a merge-base resolve; the row would not test FIRSTPARENT"
+  out=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 0 ] && grep -qE "^  comparand   FIRSTPARENT +${B1:0:7}" <<<"$out" \
+     && grep -q '^PASS (D2)' <<<"$out"; then
+    ok "C10 re-run after main moved: comparand FIRSTPARENT = B1, GREEN"
+  else
+    bad "C10 re-run: rc=$rc, wanted 0, 'comparand   FIRSTPARENT ${B1:0:7}' and 'PASS (D2)'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C11: the FIRST run, when origin/main was still B1, gives the same verdict
+  # on both paths: the old tip path and the first-parent path.
+  git_fx "$CC" update-ref refs/remotes/origin/main "$B1" || die "C11: cannot pin origin/main to B1"
+  out=$(cx_run "$CC" check_complexity_ratchet.sh GITHUB_EVENT_NAME= GITHUB_SHA=); rc=$?
+  local out2 rc2
+  out2=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc2=$?
+  if [ "$rc" -eq 0 ] && grep -qE '^  comparand   TIP ' <<<"$out" && grep -q '^PASS (D2)' <<<"$out" \
+     && [ "$rc2" -eq 0 ] && grep -qE '^  comparand   FIRSTPARENT ' <<<"$out2" && grep -q '^PASS (D2)' <<<"$out2"; then
+    ok "C11 first run (origin/main = B1): GREEN on the tip path and on the first-parent path, the same verdict as the re-run"
+  else
+    bad "C11 first run: rc=$rc (tip) / rc=$rc2 (first parent), wanted 0 and 'PASS (D2)' on both"$'\n'"$(printf '%s\n%s' "$out" "$out2" | sed 's/^/        /')"
+  fi
+  git_fx "$CC" update-ref refs/remotes/origin/main "$B2" || die "C11: cannot move origin/main back to B2"
+
+  # C12: THE REGISTERED MUTATION of the fix. Blank the first parent at its
+  # marked line (a copy of the lib in the clone; the repo's file is not
+  # touched) and C10's re-run must go back to the C8 false red.
+  cp "$CC/scripts/lib_baseline_ratchet.sh" "$WORK/cx8-lib.orig" || die "C12: cannot save the lib"
+  if sed 's|^\( *\)p1=\$(_br_event_merge_first_parent "\$root") # RATCHET-FIRSTPARENT-MUTATION-POINT$|\1p1=""|' \
+        "$WORK/cx8-lib.orig" > "$CC/scripts/lib_baseline_ratchet.sh" \
+     && grep -qE '^ +p1=""$' "$CC/scripts/lib_baseline_ratchet.sh" \
+     && ! grep -q 'RATCHET-FIRSTPARENT-MUTATION-POINT' "$CC/scripts/lib_baseline_ratchet.sh"; then
+    ok "C12 the first-parent mutation point is present in the shipped lib and the mutant was derived from a COPY of it"
+  else
+    bad "C12 the mutation could not be derived: no '# RATCHET-FIRSTPARENT-MUTATION-POINT' line in scripts/lib_baseline_ratchet.sh"
+  fi
+  out=$(cx_run "$CC" check_complexity_ratchet.sh "${FP_ENV[@]}"); rc=$?
+  cp "$WORK/cx8-lib.orig" "$CC/scripts/lib_baseline_ratchet.sh" || die "C12: cannot restore the lib"
+  if [ "$rc" -eq 1 ] && grep -q 'RED    NEW      src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C12 mutation caught: without the first parent the re-run is RED again on main's own fix, so C10's GREEN is load-bearing"
+  else
+    bad "C12 mutation NOT demonstrated: the mutant exits $rc on the re-run fixture, so C10 does not discriminate first parent from tip"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
 }
 
 # ===========================================================================

From 45d43fef6553e832b9eb33585566f37c1eda9011 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Fri, 9 Oct 2026 20:33:34 +0200
Subject: [PATCH 2/3] fix(guards): #4983 the fabricated-baselines ledger
 ratchet takes the first-parent comparand too

The q-4983 sign-off round's minority lane found a second resolver with the same
defect in the same guard job: check_no_fabricated_baselines.sh had its own
resolve_base_ref, merge-base then the origin/main TIP. On a pull_request re-run
after main shrank the Rust ledger, the PR's merge commit still carried the
removed entries, so the ledger read as GROWN on a PR that never touched it.

It now sources scripts/lib_baseline_ratchet.sh and takes the same FIRSTPARENT
step: only with no merge-base, ref origin/main, a pull_request event and
HEAD == GITHUB_SHA with two or more parents. Fail-closed as before: the first
parent not fetched is UNRESOLVABLE, and fetched without the ledger it is ABSENT
(this ledger has no bootstrap). Neither falls through to the tip. The
UNRESOLVABLE text prints the fetch that is actually missing.

Red/green, --selftest comparand table 3 -> 12 rows, all green with the event
unset and with GITHUB_EVENT_NAME=pull_request. Rows: push keeps TIP and its
verdict reds on main's shrink (the defect, reproduced); HEAD != GITHUB_SHA keeps
TIP; parent unfetched -> UNRESOLVABLE, rc 1; parent fetched -> FIRSTPARENT and
the re-run verdict is green; a single-parent head keeps TIP; a parent without
the ledger -> ABSENT. Mutation: blanking p1 at
FABBASE-FIRSTPARENT-MUTATION-POINT turns 4 rows RED (UNRESOLVABLE, FIRSTPARENT,
re-run verdict, ABSENT all read TIP). The full scan still passes (36 entries,
0 added, 0 removed vs the merge-base).

Refs #4983

Agent: aprender-a7n
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/check_no_fabricated_baselines.sh | 133 ++++++++++++++++++++++-
 1 file changed, 131 insertions(+), 2 deletions(-)

diff --git a/scripts/check_no_fabricated_baselines.sh b/scripts/check_no_fabricated_baselines.sh
index 104c7a2538..52e6153660 100755
--- a/scripts/check_no_fabricated_baselines.sh
+++ b/scripts/check_no_fabricated_baselines.sh
@@ -58,6 +58,9 @@
 # named, not quietly dropped.
 set -uo pipefail
 cd "$(dirname "$0")/.." || exit 2
+# The comparand's first-parent step and its fetch hint (#4983) are shared with
+# every baseline ratchet: one definition, so a fix to one cannot miss the other.
+. scripts/lib_baseline_ratchet.sh || exit 2
 
 # ---------------------------------------------------------------------------
 # MODES, AND WHY AN UNKNOWN ARGUMENT IS FATAL.
@@ -549,6 +552,12 @@ ledger_verdict() { # ledger_verdict <ledger-file> <hits-file>  -> rc 0 iff clean
 #     shrunk the ledger; the remedy is `git rebase origin/main`, and the FAIL
 #     text says so. A green local run can therefore red in CI. CI is the
 #     authoritative one.
+#   * FIRSTPARENT comes before the tip on a pull_request run whose HEAD is the
+#     event's own merge commit (#4983): its first parent is the main this run
+#     merged the PR onto, and a re-run keeps that commit while fetching a newer
+#     tip. Against the tip, main's own shrink read as growth in the PR; against
+#     the first parent, a re-run gives the first run's verdict. Not fetched, it
+#     is UNRESOLVABLE; fetched without the ledger, ABSENT. Never the tip.
 #   * If NEITHER resolves, this is a hard failure. It never degrades to comparing
 #     the branch against itself: that would disarm the ratchet permanently and
 #     silently, which is the failure mode this whole guard is about.
@@ -559,7 +568,7 @@ ledger_verdict() { # ledger_verdict <ledger-file> <hits-file>  -> rc 0 iff clean
 BASE_REF="${FABBASE_BASE_REF:-origin/main}"
 
 resolve_base_ref() { # resolve_base_ref <root> <ref> -> "<MODE>\t<commit-ish>"
-    local root="$1" ref="$2" mb
+    local root="$1" ref="$2" mb p1
     if ! git -C "$root" rev-parse --verify --quiet "${ref}^{commit}" >/dev/null 2>&1; then
         printf 'UNRESOLVABLE\t%s\n' "$ref"; return 0
     fi
@@ -567,6 +576,18 @@ resolve_base_ref() { # resolve_base_ref <root> <ref> -> "<MODE>\t<commit-ish>"
     if [ -n "$mb" ] && git -C "$root" cat-file -e "${mb}:${RUST_LEDGER}" 2>/dev/null; then
         printf 'MERGEBASE\t%s\n' "$mb"; return 0
     fi
+    if [ -z "$mb" ] && [ "$ref" = "origin/main" ]; then
+        p1=$(_br_event_merge_first_parent "$root") # FABBASE-FIRSTPARENT-MUTATION-POINT
+        if [ -n "$p1" ]; then
+            if ! git -C "$root" cat-file -e "${p1}^{commit}" 2>/dev/null; then
+                printf 'UNRESOLVABLE\t%s\n' "$p1"; return 0
+            fi
+            if git -C "$root" cat-file -e "${p1}:${RUST_LEDGER}" 2>/dev/null; then
+                printf 'FIRSTPARENT\t%s\n' "$p1"; return 0
+            fi
+            printf 'ABSENT\t%s\n' "$p1"; return 0
+        fi
+    fi
     if git -C "$root" cat-file -e "${ref}:${RUST_LEDGER}" 2>/dev/null; then
         printf 'TIP\t%s\n' "$ref"; return 0
     fi
@@ -627,7 +648,7 @@ rust_ledger_sweep() {
             printf 'FAIL  ledger   cannot resolve the comparand ref <%s>, so shrink-only is\n' "$ref"
             printf '               UNMEASURED. It is NOT degraded to comparing this branch\n'
             printf '               against itself — that disarms the ratchet silently. In CI:\n'
-            printf '               git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main\n'
+            printf '               %s\n' "$(baseline_ratchet_fetch_hint "$ref")"
             rc=1
             return ;;
         ABSENT)
@@ -652,6 +673,7 @@ rust_ledger_sweep() {
     case "$mode" in
         MERGEBASE) how="merge-base with $BASE_REF" ;;
         TIP)       how="tip of $BASE_REF (no merge-base available; stricter)" ;;
+        FIRSTPARENT) how="first parent of this pull request's merge commit (the main it was merged onto; the same on every re-run)" ;;
         *)         how="$mode" ;;
     esac
     note="protected; a pull request cannot rewrite it"
@@ -894,6 +916,113 @@ if mkdir -p "$sr/scripts" \
         sr_case 'ref does not exist'   UNRESOLVABLE 'refs/heads/no-such-branch-xyzzy'
         sr_case 'ref predates ledger'  ABSENT       "$sr_noledger"
         sr_case 'ref carries ledger'   MERGEBASE    HEAD
+        # FIRSTPARENT (#4983): a pull_request re-run. CI checks out GitHub's
+        # merge commit at depth 1 (no merge-base) and fetches origin/main fresh.
+        # Here main moved on and SHRANK the ledger: against the tip, the PR
+        # "adds" crates/a.rs:1, an entry it never touched; against the first
+        # parent it changed nothing. The shallow clone is its own repository.
+        sr_base=$(git -C "$sr" rev-parse HEAD)
+        sc="$TMPD/shallow"
+        if git -C "$sr" checkout -q -b fp-pr "$sr_base" >/dev/null 2>&1 \
+           && printf 'pr edit\n' > "$sr/scripts/unrelated.txt" \
+           && git -C "$sr" -c commit.gpgsign=false commit -qam 'pr: unrelated edit' >/dev/null 2>&1 \
+           && sr_x=$(git -C "$sr" rev-parse HEAD) \
+           && git -C "$sr" checkout -q --detach "$sr_base" >/dev/null 2>&1 \
+           && git -C "$sr" -c commit.gpgsign=false merge -q --no-ff --no-edit "$sr_x" >/dev/null 2>&1 \
+           && sr_m=$(git -C "$sr" rev-parse HEAD) \
+           && git -C "$sr" update-ref refs/pull/1/merge "$sr_m" \
+           && git -C "$sr" checkout -q --detach "$sr_noledger" >/dev/null 2>&1 \
+           && git -C "$sr" -c commit.gpgsign=false merge -q --no-ff --no-edit "$sr_base" >/dev/null 2>&1 \
+           && sr_m2=$(git -C "$sr" rev-parse HEAD) \
+           && git -C "$sr" update-ref refs/pull/2/merge "$sr_m2" \
+           && git -C "$sr" checkout -q --detach "$sr_base" >/dev/null 2>&1 \
+           && printf '# header\n' > "$sr/$RUST_LEDGER" \
+           && git -C "$sr" -c commit.gpgsign=false commit -qam 'main: shrink the ledger' >/dev/null 2>&1 \
+           && git -C "$sr" update-ref refs/heads/fp-main "$(git -C "$sr" rev-parse HEAD)" \
+           && git -C "$sr" config uploadpack.allowAnySHA1InWant true \
+           && git init -q "$sc" >/dev/null 2>&1 \
+           && [ "$(git -C "$sc" rev-parse --absolute-git-dir 2>/dev/null)" = "$sc/.git" ] \
+           && git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" '+refs/pull/1/merge:refs/remotes/pull/1/merge' >/dev/null 2>&1 \
+           && git -C "$sc" checkout -q --detach refs/remotes/pull/1/merge >/dev/null 2>&1 \
+           && git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" '+refs/heads/fp-main:refs/remotes/origin/main' >/dev/null 2>&1 \
+           && [ -z "$(git -C "$sc" merge-base HEAD origin/main 2>/dev/null)" ] \
+           && ! git -C "$sc" cat-file -e "${sr_base}^{commit}" 2>/dev/null; then
+            fp_case() { # fp_case <label> <want-mode> <want-ref|-> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                local got ref
+                got=$(GITHUB_EVENT_NAME="$4" GITHUB_SHA="$5" resolve_base_ref "$sc" origin/main)
+                ref=${got##*$'\t'}
+                got=${got%%$'\t'*}
+                sr_rows=$((sr_rows + 1))
+                if [ "$got" != "$2" ] || { [ "$3" != - ] && [ "$ref" != "$3" ]; }; then
+                    printf 'FAIL  comparand %-40s want %s %s got %s %s\n' "$1" "$2" "$3" "$got" "$ref"
+                    tbl_bad=1
+                fi
+            }
+            fp_verdict() { # fp_verdict <label> <want-rc> <GITHUB_EVENT_NAME> <GITHUB_SHA>
+                # The sweep's own decision on that comparand: UNRESOLVABLE and
+                # ABSENT fail, any other mode is the shrink-only comparison.
+                local got mode ref
+                got=$(GITHUB_EVENT_NAME="$3" GITHUB_SHA="$4" resolve_base_ref "$sc" origin/main)
+                mode=${got%%$'\t'*}
+                ref=${got##*$'\t'}
+                case "$mode" in
+                    UNRESOLVABLE|ABSENT) got=1 ;;
+                    *)
+                        if git -C "$sc" show "${ref}:${RUST_LEDGER}" > "$TMPD/fp_base" 2>/dev/null; then
+                            ledger_entries_of "$TMPD/fp_base" > "$TMPD/fp_base_entries"
+                            ledger_entries_of "$sc/$RUST_LEDGER" > "$TMPD/fp_cur_entries"
+                            ledger_shrink_only "$TMPD/fp_base_entries" "$TMPD/fp_cur_entries" >/dev/null
+                            got=$?
+                        else
+                            got=1
+                        fi ;;
+                esac
+                sr_rows=$((sr_rows + 1))
+                if [ "$got" != "$2" ]; then
+                    printf 'FAIL  comparand %-40s want rc=%s got rc=%s\n' "$1" "$2" "$got"
+                    tbl_bad=1
+                fi
+            }
+            # Controls: the tip path is unchanged off the event, and it carries
+            # the false red this fix removes.
+            fp_case    'push event keeps TIP'             TIP          origin/main push         "$sr_m"
+            fp_verdict 'tip blames PR for main shrink'    1                        push         "$sr_m"
+            # A head that is not the event's own merge commit is never read.
+            fp_case    'HEAD != GITHUB_SHA keeps TIP'     TIP          origin/main pull_request "$sr_x"
+            # Fail-closed: the parent not fetched is UNRESOLVABLE, never TIP.
+            fp_case    'parent unfetched -> UNRESOLVABLE' UNRESOLVABLE "$sr_base"  pull_request "$sr_m"
+            fp_verdict 'parent unfetched -> rc 1'         1                        pull_request "$sr_m"
+            if git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" "$sr_base" >/dev/null 2>&1 \
+               && [ -z "$(git -C "$sc" merge-base HEAD origin/main 2>/dev/null)" ]; then
+                fp_case    'parent fetched -> FIRSTPARENT' FIRSTPARENT "$sr_base"  pull_request "$sr_m"
+                fp_verdict 're-run after main moved'       0                       pull_request "$sr_m"
+            else
+                printf 'FAIL  comparand: the first parent could not be fetched, or it made a\n'
+                printf '      merge-base resolve. FIRSTPARENT is UNTESTED. Not a skip.\n'
+                tbl_bad=1
+            fi
+            # A single-parent head (a merge_group squash) keeps TIP.
+            if git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" "$sr_x" >/dev/null 2>&1 \
+               && git -C "$sc" checkout -q --detach "$sr_x" >/dev/null 2>&1; then
+                fp_case    'single-parent head keeps TIP'  TIP         origin/main pull_request "$sr_x"
+            else
+                printf 'FAIL  comparand: the single-parent head could not be checked out. UNTESTED.\n'
+                tbl_bad=1
+            fi
+            # The main the PR was merged onto has no ledger. There is no
+            # bootstrap here, and the tip, which has one, is NOT consulted.
+            if git -C "$sc" fetch -q --no-tags --depth=1 "file://$sr" '+refs/pull/2/merge:refs/remotes/pull/2/merge' "$sr_noledger" >/dev/null 2>&1 \
+               && git -C "$sc" checkout -q --detach refs/remotes/pull/2/merge >/dev/null 2>&1; then
+                fp_case    'parent lacks ledger -> ABSENT' ABSENT      "$sr_noledger" pull_request "$sr_m2"
+            else
+                printf 'FAIL  comparand: the second merge commit could not be checked out. UNTESTED.\n'
+                tbl_bad=1
+            fi
+        else
+            printf 'FAIL  comparand FIRSTPARENT UNTESTED — the shallow re-run clone could\n'
+            printf '      not be built, and a pull_request re-run is that shape. Not a skip.\n'
+            tbl_bad=1
+        fi
     else
         printf 'FAIL  comparand table: could not commit in the scratch repo, so the\n'
         printf '      UNRESOLVABLE/ABSENT branches are UNTESTED. That is not a skip.\n'

From 0527930f15a2eb0e43d7dbcf3b85e297845fd811 Mon Sep 17 00:00:00 2001
From: Noah Gift <noah.gift@gmail.com>
Date: Fri, 9 Oct 2026 20:52:24 +0200
Subject: [PATCH 3/3] fix(guards): pin origin/main to the run's build base, so
 a re-run judges the tree it built against the main it was built on

Every ratchet in guard-tree and guard-cargo compares the PR's tree with
origin/main, and the setup step fetched main's TIP at depth 1. The tip moves
while the merge commit does not, so a run that starts after main shrank a
baseline or fixed a function goes red on lines the PR never touched:

- #4813: the pipe-into-grep-q ledger read 62 on the PR against 60 on a tip
  that had moved on.
- #4983: #4970's complexity step, run 37945794011 attempt 2, checked out the
  unchanged merge commit 60a59031 and judged it against main's moved tip
  acd599e52. Attempt 1 and attempt 2 of the same commit disagreed.

scripts/ci/pin_build_base.sh now replaces both jobs' fetch step. It points
refs/remotes/origin/main at the commit this run was BUILT on:

- pull_request: HEAD's first parent. HEAD must be a two-parent merge whose
  second parent is pull_request.head.sha, else the pin refuses.
- merge_group: merge_group.base_sha.
- any other event: the tip, deepened by one on push.

On any doubt it prints ::error::pin_build_base and exits 1, so the guards
skip RED, never green. Its --self-test (22 rows) runs in guard-tree before the
pin.

The library's own first-parent comparand (FIRSTPARENT, the commits before
this one) stays as defence in depth: with the pin in place the tip path and
FIRSTPARENT name the same commit. The pin also covers readers of origin/main
that do not use the library, and the merge queue.

Falsifier (ratchet_semantics_test.sh --class complexity, 22 checks, 0 failed):
- C14: a stale-merge re-run, pinned, goes GREEN on the tip path (TIP = B1).
- C15: a real complexity rise, pinned, stays RED (RED NEW newbie, TIP = B1).
- C13: the same rise stays RED on the library's FIRSTPARENT path.
- C16: a planted mutant of the pin (its pull_request arm disabled) turns the
  stale re-run RED again, against B2.

Measured mutants:
- MA (library first parent forced to HEAD): C9, C10, C12, C13 fail.
- MB (pin takes parents[1]): C14 and C15 fail. C15 wanted 1, so the real rise
  went green under it.

Also green on this head: the readme (12/0) and satd (10/0) classes,
check_baseline_ratchets --selftest, check_no_fabricated_baselines, the
fat_driver self-test (60/60), check_sourced_libs_option_neutral, and the 13
ci/sections.yml guards.

Refs #4861
Refs #4983
Refs #3997

Agent: aprender-df
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ci/sections.yml                         |  79 +++++-----
 scripts/ci/pin_build_base.sh            | 187 ++++++++++++++++++++++++
 scripts/lib_baseline_ratchet.sh         |   5 +
 scripts/tests/ratchet_semantics_test.sh | 101 +++++++++++++
 4 files changed, 330 insertions(+), 42 deletions(-)
 create mode 100755 scripts/ci/pin_build_base.sh

diff --git a/ci/sections.yml b/ci/sections.yml
index 7f27b365d6..188f01f568 100644
--- a/ci/sections.yml
+++ b/ci/sections.yml
@@ -1147,28 +1147,34 @@ jobs:
       # never as "no growth", so the mistake would have been loud rather than
       # silent. It is still a mistake. One fetch, before all of them.
       #
-      # fetch-depth is 1 here, so the merge-base is usually unavailable. On a
-      # pull_request run the ratchets then compare against the first parent of
-      # the run's merge commit (#4983), fetched below; on every other event
-      # without a merge-base they fall back to the origin/main TIP, the STRICTER
-      # comparand. A local run that passes on the merge-base can still red
-      # here, and CI is authoritative.
+      # #4861 + #4983: origin/main is pinned to the commit this tree was BUILT
+      # on, not fetched at its tip. fetch-depth is 1 here, so the merge-base is
+      # usually unavailable and the ratchets read origin/main as it stands.
+      # Fetched at the tip, a run that started after main shrank a baseline or
+      # fixed a function judged a merge commit built before that change against
+      # it: #4813 went red (pipe_grep_q_baseline.txt 62 vs 60, a file it never
+      # touched), and #4970's re-run went red on m17 complexity (checkout at
+      # 60a59031, compared against acd599e52), while a re-run rebuilds the SAME
+      # merge commit. Pinned per event (scripts/ci/pin_build_base.sh):
+      #   pull_request  the merge commit's first parent, checked against the PR head
+      #   merge_group   merge_group.base_sha, as the refinement-gate pin does
+      #   otherwise     the tip, deepened by one on push (resolve_base.sh judges a
+      #                 push against HEAD's first parent: HEAD vs HEAD would pass
+      #                 vacuously, the G-10 quorum's finding)
+      # The shared ratchet library takes the same first parent on its own
+      # (scripts/lib_baseline_ratchet.sh FIRSTPARENT), so a lib ratchet and a
+      # script that reads origin/main directly cannot disagree. A PR that adds
+      # back an entry main has since deleted is still refused by its
+      # merge_group run, which builds on main as it merges. The pin refuses,
+      # and every guard below is skipped red, when the event names no build base.
       - id: guard-setup
-        name: Fetch origin/main as the comparand for every ratchet in this job
-        run: |
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
-          # push shape: HEAD IS the origin/main tip, so every differential ratchet judges it against
-          # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
-          # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
-          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
-          # pull_request shape (#4983): HEAD is GitHub's merge commit, and its FIRST PARENT is the main
-          # this run merged the PR onto. A re-run keeps that commit but the fetch above brings main's
-          # NEW tip, so the ratchets judge against that parent (scripts/lib_baseline_ratchet.sh
-          # FIRSTPARENT), never the moving tip. Not fetched, every ratchet fails UNRESOLVABLE.
-          if [ "${GITHUB_EVENT_NAME:-}" = pull_request ]; then
-            p1=$(git cat-file -p HEAD | awk '/^parent /{ n++; if (n == 1) p = $2 } /^$/{ exit } END { if (n >= 2) print p }')
-            if [ -n "$p1" ] && ! git cat-file -e "${p1}^{commit}" 2>/dev/null; then git fetch --no-tags --depth=1 origin "$p1"; fi
-          fi
+        name: Pin origin/main to this run's build base, the comparand for every ratchet in this job (#4861)
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          MG_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+        run: |
+          bash scripts/ci/pin_build_base.sh --self-test
+          bash scripts/ci/pin_build_base.sh
       # #4415 (operator A4, 2026-09-25): ONE step runs every guard step of guard-tree-steps
       # below, keeps going past a red one, and reports every failure. GitHub would
       # stop this job at its first red step, and the others would never be seen.
@@ -1695,27 +1701,16 @@ jobs:
       # never as "no growth", so the mistake would have been loud rather than
       # silent. It is still a mistake. One fetch, before all of them.
       #
-      # fetch-depth is 1 here, so the merge-base is usually unavailable. On a
-      # pull_request run the ratchets then compare against the first parent of
-      # the run's merge commit (#4983), fetched below; on every other event
-      # without a merge-base they fall back to the origin/main TIP, the STRICTER
-      # comparand. A local run that passes on the merge-base can still red
-      # here, and CI is authoritative.
-      - name: Fetch origin/main as the comparand for every ratchet in this job
-        run: |
-          git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main
-          # push shape: HEAD IS the origin/main tip, so every differential ratchet judges it against
-          # its FIRST PARENT (scripts/lib/resolve_base.sh: HEAD vs HEAD would pass vacuously, the
-          # G-10 quorum's finding), and a depth-1 checkout has not fetched that parent. Deepen by one.
-          if [ "${GITHUB_EVENT_NAME:-}" = push ]; then git fetch --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main; fi
-          # pull_request shape (#4983): HEAD is GitHub's merge commit, and its FIRST PARENT is the main
-          # this run merged the PR onto. A re-run keeps that commit but the fetch above brings main's
-          # NEW tip, so the ratchets judge against that parent (scripts/lib_baseline_ratchet.sh
-          # FIRSTPARENT), never the moving tip. Not fetched, every ratchet fails UNRESOLVABLE.
-          if [ "${GITHUB_EVENT_NAME:-}" = pull_request ]; then
-            p1=$(git cat-file -p HEAD | awk '/^parent /{ n++; if (n == 1) p = $2 } /^$/{ exit } END { if (n >= 2) print p }')
-            if [ -n "$p1" ] && ! git cat-file -e "${p1}^{commit}" 2>/dev/null; then git fetch --no-tags --depth=1 origin "$p1"; fi
-          fi
+      # #4861 + #4983: origin/main is pinned to the commit this tree was BUILT
+      # on, not fetched at its tip -- the same pin, for the same reason, as
+      # guard-tree's guard-setup (which also runs the pin's self-test; this job
+      # only pins). m17's complexity ratchet is the #4983 case: a re-run of an
+      # unchanged PR judged against main's moved tip went red.
+      - name: Pin origin/main to this run's build base, the comparand for every ratchet in this job (#4861)
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          MG_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+        run: bash scripts/ci/pin_build_base.sh
       # DOCKER CREATES A MISSING BIND SOURCE AS root:root, AND `--user` ALONE
       # THEN EACCESs ON IT. The per-RUN target path is fresh every run, so a
       # container that mounts it and drops to the runner's uid cannot write
diff --git a/scripts/ci/pin_build_base.sh b/scripts/ci/pin_build_base.sh
new file mode 100755
index 0000000000..d27f616096
--- /dev/null
+++ b/scripts/ci/pin_build_base.sh
@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# pin_build_base.sh — pin refs/remotes/origin/main to the commit this run's tree was BUILT on.
+# It is the comparand every ratchet in guard-tree and guard-cargo reads (#4861).
+#
+# Both sections used to fetch the origin/main TIP when they started. A section can start hours
+# after the merge commit it judges was built, so a branch that never touched a baseline went red
+# when main shrank that baseline in between. #4813: built on 358e9d4d11, where
+# pipe_grep_q_baseline.txt records 62; the section started when main's tip was ece9e563bd, after
+# da7059c5c7 shrank it to 60; `GREW` 62 vs 60, in a file #4813 does not touch. A re-run builds
+# the same merge commit, so the false red survives every re-run. #4983 is the same defect on a
+# RE-RUN: #4970's m17 complexity step, attempt 2, judged its unchanged merge commit against main's
+# moved tip acd599e52 and went red where attempt 1 had not. The shared ratchet library also takes
+# the merge commit's first parent on its own (scripts/lib_baseline_ratchet.sh FIRSTPARENT); this
+# pin covers every reader of origin/main, library or not, and the merge queue.
+#
+#   pull_request  the merge commit's FIRST parent. HEAD must be a two-parent merge commit whose
+#                 second parent is the PR head (PR_HEAD_SHA); any other HEAD names no build base,
+#                 and this refuses rather than guess one.
+#   merge_group   merge_group.base_sha (MG_BASE_SHA), as the refinement-gate pin does. The queue
+#                 builds on main as it merges, so an entry main already deleted that a PR adds
+#                 back is still refused there.
+#   otherwise     the origin/main tip, deepened by one on push: scripts/lib/resolve_base.sh judges
+#                 a push against HEAD's first parent, and a depth-1 checkout has not fetched it.
+#
+# EXIT 0 pinned · 1 refused (no build base can be named) or a fetch failed · 64 usage
+#
+#   PR_HEAD_SHA=<sha> MG_BASE_SHA=<sha> bash scripts/ci/pin_build_base.sh [--self-test]
+set -euo pipefail
+
+ZERO=0000000000000000000000000000000000000000
+
+is_sha() { [[ ${1:-} =~ ^[0-9a-f]{40}$ ]] && [ "$1" != "$ZERO" ]; }
+
+refuse() {
+    printf '::error::pin_build_base: %s\n' "$1"
+    return 1
+}
+
+pin() { # pin <repo dir>: pins origin/main there for $GITHUB_EVENT_NAME
+    local dir="$1" ev="${GITHUB_EVENT_NAME:-}" base how
+    local parents=()
+    case "$ev" in
+        pull_request) # PIN-BUILD-BASE-MUTATION-POINT
+            mapfile -t parents < <(git -C "$dir" cat-file -p 'HEAD^{commit}' 2>/dev/null | awk '/^$/{exit} /^parent /{print $2}')
+            [ "${#parents[@]}" -eq 2 ] \
+                || refuse "pull_request: HEAD has ${#parents[@]} parent(s), not 2. Only refs/pull/N/merge names its build base." || return 1
+            is_sha "${PR_HEAD_SHA:-}" || refuse "pull_request: no PR head sha (PR_HEAD_SHA='${PR_HEAD_SHA:-}')" || return 1
+            [ "${parents[1]}" = "$PR_HEAD_SHA" ] \
+                || refuse "pull_request: HEAD's second parent ${parents[1]} is not the PR head $PR_HEAD_SHA, so HEAD is not this PR's merge commit" || return 1
+            base="${parents[0]}"; how="first parent of the merge commit"
+            ;;
+        merge_group)
+            is_sha "${MG_BASE_SHA:-}" || refuse "merge_group: no base_sha (MG_BASE_SHA='${MG_BASE_SHA:-}')" || return 1
+            base="$MG_BASE_SHA"; how="merge_group.base_sha"
+            ;;
+        *)
+            git -C "$dir" fetch -q --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
+            if [ "$ev" = push ]; then
+                git -C "$dir" fetch -q --no-tags --deepen=1 origin +refs/heads/main:refs/remotes/origin/main || return 1
+            fi
+            printf 'comparand: %s pinned as origin/main (the tip; event %s)\n' "$(git -C "$dir" rev-parse 'origin/main^{commit}')" "${ev:-none}"
+            return 0
+            ;;
+    esac
+    git -C "$dir" fetch -q --no-tags --depth=1 origin "$base" || refuse "cannot fetch the build base $base" || return 1
+    git -C "$dir" update-ref refs/remotes/origin/main "$base"
+    [ "$(git -C "$dir" rev-parse 'origin/main^{commit}')" = "$base" ] || refuse "origin/main does not read back as $base" || return 1
+    printf 'comparand: %s pinned as origin/main (%s; event %s)\n' "$base" "$how" "$ev"
+}
+
+# ---------------------------------------------------------------------------
+# The case table. Scratch origin + depth-1 clones, the shape actions/checkout leaves. The #4813
+# rows run the REAL scripts/lib_baseline_ratchet.sh: the old tip comparand is RED on a PR that
+# never touched the baseline, the build base is GREEN, and a PR that grows it is still RED.
+self_test() {
+    local here; here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
+    local lib="$here/scripts/lib_baseline_ratchet.sh"
+    [ -f "$lib" ] || { printf 'FAIL  self-test: %s is missing\n' "$lib"; return 1; }
+    TD=$(mktemp -d); trap 'rm -rf "${TD:?}"' EXIT
+    local o="$TD/origin.git" w="$TD/w" u="file://$TD/origin.git"
+    local c0 prh m c2 grh m2 ok=0 bad=0
+    g() { git -C "$w" -c user.name=st -c user.email=st@example.invalid -c commit.gpgsign=false "$@"; }
+    git init -q --template= --bare -b main "$o"
+    git -C "$o" config uploadpack.allowReachableSHA1InWant true
+    git init -q --template= -b main "$w"
+    printf '# count\n62\n' > "$w/r_baseline.txt"; g add -A; g commit -q -m c0; c0=$(g rev-parse HEAD)
+    g push -q "$u" main
+    # The PR: off c0, and it never touches the baseline. GitHub's merge commit: c0 first, PR head second.
+    g checkout -q -b pr; printf 'pr\n' > "$w/pr.txt"; g add -A; g commit -q -m pr; prh=$(g rev-parse HEAD)
+    g checkout -q --detach "$c0"; g merge -q --no-ff --no-edit pr; m=$(g rev-parse HEAD)
+    g push -q "$u" "$m:refs/pull/1/merge"
+    # main moves on AFTER that build: it shrinks the baseline 62 -> 60 (#4813).
+    g checkout -q main; printf '# count\n60\n' > "$w/r_baseline.txt"; g add -A; g commit -q -m c2; c2=$(g rev-parse HEAD)
+    g push -q "$u" main
+    # A PR built on c2 that GROWS the baseline 60 -> 61.
+    g checkout -q -b grow; printf '# count\n61\n' > "$w/r_baseline.txt"; g add -A; g commit -q -m grow; grh=$(g rev-parse HEAD)
+    g checkout -q --detach "$c2"; g merge -q --no-ff --no-edit grow; m2=$(g rev-parse HEAD)
+    g push -q "$u" "$m2:refs/pull/2/merge"
+
+
+    clone_at() { # clone_at <name> <sha>: a depth-1 clone checked out at <sha>, the shape actions/checkout leaves
+        local d="$TD/$1"
+        [ ! -e "$d" ] || { printf 'FAIL  self-test: clone %s reused; a row would judge another row'"'"'s pin\n' "$1" >&2; return 1; }
+        git init -q --template= "$d" && git -C "$d" remote add origin "$u" \
+            && git -C "$d" fetch -q --no-tags --depth=1 origin "$2" && git -C "$d" checkout -q --detach FETCH_HEAD \
+            || { printf 'FAIL  self-test: cannot build clone %s at %s\n' "$1" "$2" >&2; return 1; }
+        printf '%s' "$d"
+    }
+    run_pin() { # run_pin <dir> <event> <pr head> <mg base> -> pin's rc; PINNED = origin/main after, or "unset"
+        local rc=0
+        ( GITHUB_EVENT_NAME="$2" PR_HEAD_SHA="$3" MG_BASE_SHA="$4" pin "$1" ) > "$TD/last.log" 2>&1 || rc=$?
+        PINNED=$(git -C "$1" rev-parse -q --verify 'refs/remotes/origin/main^{commit}' 2>/dev/null) || PINNED=unset
+        return "$rc"
+    }
+    ratchet() { # ratchet <dir> [VAR=value ...] -> the real library's verdict on r_baseline.txt: "<rc> <GREW|ok|other>"
+        # The runner's own GITHUB_EVENT_NAME/GITHUB_SHA never leak in: a row names the event it judges.
+        local dir="$1" rc=0 says=other; shift
+        ( unset BASELINE_RATCHET_BASE_REF GITHUB_EVENT_NAME GITHUB_SHA; [ "$#" -eq 0 ] || export "$@"
+          . "$lib" || exit 2; baseline_ratchet_check "$dir" r_baseline.txt count ) \
+            > "$TD/last.log" 2>&1 || rc=$?
+        if grep -q 'GREW' "$TD/last.log"; then says="GREW:$(sed -nE 's/.*count rose ([0-9]+ -> [0-9]+).*/\1/p' "$TD/last.log" | tr ' ' _)"
+        elif grep -q '^ok    ratchet' "$TD/last.log"; then says=ok; fi
+        printf '%s %s' "$rc" "$says"
+    }
+    row() { # row LABEL GOT WANT
+        if [ "$2" = "$3" ]; then ok=$((ok + 1)); printf 'ok    %s\n' "$1"
+        else bad=$((bad + 1)); printf 'FAIL  %s: got <%s>, want <%s>\n' "$1" "$2" "$3"; sed 's/^/        /' "$TD/last.log"; fi
+    }
+    said() { # said <text>: did the last run name its cause? A refusal is an andon, and an andon names why
+        if grep -qF -- "$1" "$TD/last.log"; then printf 'says-cause'; else printf 'cause-missing'; fi
+    }
+    local d rc bogus PINNED nbad=0
+
+    d=$(clone_at pr1 "$m"); rc=0; run_pin "$d" pull_request "$prh" "" || rc=$?
+    row "pull_request pins the merge commit's first parent" "$rc $PINNED" "0 $c0"
+    row "#4813 shape, build base: the PR never touched the baseline, ratchet GREEN" "$(ratchet "$d")" "0 ok"
+    row "the library's own first-parent path (#4983) gives the pin's verdict" \
+        "$(ratchet "$d" GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$m") $(said "first parent of this pull request's merge commit, $c0")" "0 ok says-cause"
+    d=$(clone_at tip1 "$m"); rc=0; run_pin "$d" workflow_dispatch "" "" || rc=$?
+    row "#4813 shape, the old tip comparand: the same PR is RED, 62 vs main's 60" "$rc $PINNED $(ratchet "$d")" "0 $c2 1 GREW:60_->_62"
+
+    d=$(clone_at pr2 "$m2"); rc=0; run_pin "$d" pull_request "$grh" "" || rc=$?
+    row "pull_request on a PR built on c2 pins c2" "$rc $PINNED" "0 $c2"
+    row "a PR that grows the baseline is still RED against its build base" "$(ratchet "$d")" "1 GREW:60_->_61"
+    row "... and still RED on the library's first-parent path" \
+        "$(ratchet "$d" GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$m2")" "1 GREW:60_->_61"
+
+    d=$(clone_at single "$prh"); rc=0; run_pin "$d" pull_request "$prh" "" || rc=$?
+    row "pull_request on a single-parent HEAD (checkout of the PR head) refuses and pins nothing" \
+        "$rc $PINNED $(said 'HEAD has 1 parent(s), not 2')" "1 unset says-cause"
+    d=$(clone_at wronghead "$m"); rc=0; run_pin "$d" pull_request "$c2" "" || rc=$?
+    row "pull_request whose second parent is not the PR head refuses" \
+        "$rc $PINNED $(said 'is not the PR head')" "1 unset says-cause"
+    d=$(clone_at swapped "$m"); rc=0; run_pin "$d" pull_request "$c0" "" || rc=$?
+    row "pull_request naming the FIRST parent as the PR head refuses" \
+        "$rc $PINNED $(said 'is not the PR head')" "1 unset says-cause"
+    d=$(clone_at nohead "$m"); rc=0; run_pin "$d" pull_request "" "" || rc=$?
+    row "pull_request with no PR head sha refuses" "$rc $PINNED $(said 'no PR head sha')" "1 unset says-cause"
+
+    d=$(clone_at mg "$m2"); rc=0; run_pin "$d" merge_group "" "$c2" || rc=$?
+    row "merge_group pins base_sha" "$rc $PINNED" "0 $c2"
+    for bogus in "" "$ZERO" main "${c2:0:39}" "${c2^^}"; do
+        nbad=$((nbad + 1)); d=$(clone_at "mgbad$nbad" "$m2"); rc=0; run_pin "$d" merge_group "" "$bogus" || rc=$?
+        row "merge_group with base_sha <${bogus:0:12}> refuses" "$rc $PINNED $(said 'merge_group: no base_sha')" "1 unset says-cause"
+    done
+    d=$(clone_at mgmissing "$m2"); rc=0; run_pin "$d" merge_group "" "$(printf '%040d' 7)" || rc=$?
+    row "merge_group whose base_sha origin does not have refuses" \
+        "$rc $PINNED $(said 'cannot fetch the build base')" "1 unset says-cause"
+
+    d=$(clone_at push "$c2"); rc=0; run_pin "$d" push "" "" || rc=$?
+    row "push pins the tip" "$rc $PINNED" "0 $c2"
+    row "push deepens by one: the tip's first parent is fetched" \
+        "$(git -C "$d" rev-parse -q --verify 'origin/main^1^{commit}' 2>/dev/null || printf none)" "$c0"
+    d=$(clone_at wd "$m"); rc=0; run_pin "$d" workflow_dispatch "" "" || rc=$?
+    row "workflow_dispatch pins the tip" "$rc $PINNED" "0 $c2"
+    rc=0; run_pin "$TD/pr1" pull_request "$prh" "" || rc=$?
+    row "pinning twice is idempotent" "$rc $PINNED" "0 $c0"
+
+    printf 'pin_build_base self-test: %s ok, %s bad\n' "$ok" "$bad"
+    [ "$bad" -eq 0 ] && [ "$ok" -ge 22 ]
+}
+
+case "${1:-}" in
+    --self-test) self_test ;;
+    "") pin "$(git rev-parse --show-toplevel)" ;;
+    *) printf 'usage: %s [--self-test]\n' "$0" >&2; exit 64 ;;
+esac
diff --git a/scripts/lib_baseline_ratchet.sh b/scripts/lib_baseline_ratchet.sh
index fcc1fe087e..8884a00ab7 100644
--- a/scripts/lib_baseline_ratchet.sh
+++ b/scripts/lib_baseline_ratchet.sh
@@ -56,6 +56,11 @@
 #     stronger (it also forbids re-adding an entry main has already deleted).
 #     The cost is a false red on a branch behind a main that already shrank the
 #     baseline; the remedy is `git rebase origin/main`, and the FAIL says so.
+#     In guard-tree and guard-cargo the "tip" is no longer fetched live: since
+#     #4861 scripts/ci/pin_build_base.sh pins origin/main to the run's build
+#     base (a pull_request merge commit's first parent, merge_group.base_sha in
+#     the queue, the tip on any other event), so there the tip path and
+#     FIRSTPARENT name the same commit.
 #   * FIRSTPARENT comes before the tip on a pull_request run whose HEAD is the
 #     event's own merge commit (#4983). That commit's first parent is the main
 #     GitHub merged the PR onto. A re-run keeps that merge commit but fetches
diff --git a/scripts/tests/ratchet_semantics_test.sh b/scripts/tests/ratchet_semantics_test.sh
index 30868916c5..89a0d09f41 100755
--- a/scripts/tests/ratchet_semantics_test.sh
+++ b/scripts/tests/ratchet_semantics_test.sh
@@ -506,6 +506,107 @@ run_complexity() {
   else
     bad "C12 mutation NOT demonstrated: the mutant exits $rc on the re-run fixture, so C10 does not discriminate first parent from tip"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
   fi
+
+  # --- C13-C16: A REAL RISE STAYS RED ON THE SAME RE-RUN (#4983, #4861) ----
+  # C10's GREEN must not be bought by going blind. A second PR, merged onto
+  # the same B1 and re-run after main moved to B2, lands a function over both
+  # thresholds: it is RED on the first-parent path (C13) and on the pinned
+  # origin/main a non-library reader sees (C15), and main's own fix to
+  # cognitive_only is blamed on neither PR. C14 is the stale re-run on the
+  # pinned path, and C16 is the pin's registered mutation. The pin needs an
+  # `origin` remote, so these clones carry one; CC above does not.
+  cx_rerun_clone() { # cx_rerun_clone <dir> <pull number> <merge sha>: HEAD = merge, origin/main = B2, depth 1
+    GIT_TERMINAL_PROMPT=0 git init -q --template="$WORK/empty-template" "$1" >/dev/null 2>&1 || return 1
+    [ "$(git -C "$1" rev-parse --absolute-git-dir 2>/dev/null)" = "$1/.git" ] || return 1
+    git_fx "$1" remote add origin "file://$CO" || return 1
+    git_fx "$1" fetch -q --no-tags --depth=1 origin "+refs/pull/$2/merge:refs/remotes/pull/$2/merge" >/dev/null 2>&1 || return 1
+    git_fx "$1" checkout -q --detach "refs/remotes/pull/$2/merge" >/dev/null 2>&1 || return 1
+    git_fx "$1" fetch -q --no-tags --depth=1 origin '+refs/heads/main:refs/remotes/origin/main' >/dev/null 2>&1 || return 1
+    [ "$(git_fx "$1" rev-parse HEAD)" = "$3" ] && [ "$(git_fx "$1" rev-parse origin/main)" = "$B2" ] \
+      && [ -z "$(git_fx "$1" merge-base HEAD origin/main 2>/dev/null)" ]
+  }
+  cx_pin() { # cx_pin <dir> <pr head> [pin script]: scripts/ci/pin_build_base.sh as CI runs it on a pull_request
+    ( cd "$1" && env GITHUB_EVENT_NAME=pull_request PR_HEAD_SHA="$2" MG_BASE_SHA= \
+        bash "${3:-$ROOT/scripts/ci/pin_build_base.sh}" ) 2>&1
+  }
+  local X3 M3 CC3="$WORK/cx13-clone" CC4="$WORK/cx14-clone" CC5="$WORK/cx16-clone" TIP_ENV=(GITHUB_EVENT_NAME= GITHUB_SHA=)
+  git_fx "$CO" checkout -q -b pr3 "$B1" >/dev/null 2>&1 || die "C13: cannot branch the second PR off B1"
+  cx_lib '0.0.0-shim' 'branchy 35 34' 'cognitive_only 8 28' 'tidy 1 0' 'newbie 40 40' > "$CO/src/lib.rs" || die "C13: cannot write the PR edit"
+  cx_commit "$CO" 'pr3: land a function over both thresholds' || die "C13: PR commit failed"
+  X3=$(git_fx "$CO" rev-parse HEAD) || die "C13: no X3"
+  git_fx "$CO" checkout -q --detach "$B1" >/dev/null 2>&1 || die "C13: cannot return to B1"
+  git_fx "$CO" merge -q --no-ff --no-edit "$X3" >/dev/null 2>&1 || die "C13: cannot build the merge commit"
+  M3=$(git_fx "$CO" rev-parse HEAD) || die "C13: no M3"
+  [ "$(git_fx "$CO" rev-parse "$M3^1")" = "$B1" ] || die "C13: M3's first parent is not B1"
+  git_fx "$CO" update-ref refs/pull/3/merge "$M3" || die "C13: cannot publish refs/pull/3/merge"
+  [ "$(git_fx "$CO" rev-parse refs/heads/main)" = "$B2" ] || die "C13: main is not B2"
+
+  # C13: the first-parent path, B1 fetched as CI's setup step does.
+  cx_rerun_clone "$CC3" 3 "$M3" || die "C13: the clone is not the re-run shape (HEAD=M3, origin/main=B2, no merge-base)"
+  git_fx "$CC3" fetch -q --no-tags --depth=1 origin "$B1" >/dev/null 2>&1 || die "C13: depth-1 fetch of B1 failed"
+  out=$(cx_run "$CC3" check_complexity_ratchet.sh GITHUB_EVENT_NAME=pull_request "GITHUB_SHA=$M3"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE "^  comparand   FIRSTPARENT +${B1:0:7}" <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::newbie' <<<"$out" \
+     && ! grep -qE 'RED +[A-Z]+ +src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C13 re-run of a PR that lands an offender: comparand FIRSTPARENT = B1, RED on that function and on nothing of main's"
+  else
+    bad "C13 real rise on the re-run: rc=$rc, wanted 1, 'comparand   FIRSTPARENT ${B1:0:7}', 'RED    NEW      src/lib.rs::newbie' and no cognitive_only row"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C14: the stale re-run (the C8 PR) on the PINNED path: origin/main = B1, so a
+  # reader of origin/main that never asks the library for a first parent gets
+  # C10's verdict too. The check runs with no event, i.e. on the tip path.
+  cx_rerun_clone "$CC4" 1 "$M" || die "C14: the clone is not the re-run shape (HEAD=M, origin/main=B2, no merge-base)"
+  out=$(cx_pin "$CC4" "$X"); rc=$?
+  if [ "$rc" -eq 0 ] && [ "$(git_fx "$CC4" rev-parse origin/main)" = "$B1" ]; then
+    ok "C14 the pin on the stale re-run: origin/main = B1, the merge commit's first parent"
+  else
+    bad "C14 the pin on the stale re-run: rc=$rc, origin/main=$(git_fx "$CC4" rev-parse origin/main 2>&1), wanted 0 and B1 (${B1:0:7})"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+  out=$(cx_run "$CC4" check_complexity_ratchet.sh "${TIP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 0 ] && grep -qE "^  comparand   TIP +${B1:0:7}" <<<"$out" && grep -q '^PASS (D2)' <<<"$out"; then
+    ok "C14 stale re-run, origin/main pinned to the build base: tip path reads B1, GREEN"
+  else
+    bad "C14 pinned re-run: rc=$rc, wanted 0, 'comparand   TIP ${B1:0:7}' and 'PASS (D2)'"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C15: the real rise on the pinned path. A fresh pin on CC3 (B1 is fetched
+  # there already; the pin fetches it again and moves origin/main to it).
+  out=$(cx_pin "$CC3" "$X3"); rc=$?
+  if [ "$rc" -eq 0 ] && [ "$(git_fx "$CC3" rev-parse origin/main)" = "$B1" ]; then
+    ok "C15 the pin on the real rise: origin/main = B1, the merge commit's first parent"
+  else
+    bad "C15 the pin on the real rise: rc=$rc, origin/main=$(git_fx "$CC3" rev-parse origin/main 2>&1), wanted 0 and B1 (${B1:0:7})"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+  out=$(cx_run "$CC3" check_complexity_ratchet.sh "${TIP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE "^  comparand   TIP +${B1:0:7}" <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::newbie' <<<"$out" \
+     && ! grep -qE 'RED +[A-Z]+ +src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C15 real rise, origin/main pinned to the build base: tip path reads B1, RED on the PR's function only"
+  else
+    bad "C15 pinned real rise: rc=$rc, wanted 1, 'comparand   TIP ${B1:0:7}', 'RED    NEW      src/lib.rs::newbie' and no cognitive_only row"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
+
+  # C16: THE PIN'S REGISTERED MUTATION. A copy of pin_build_base.sh whose
+  # pull_request case is unreachable falls through to the tip, and C14's
+  # stale re-run must go back to the C8 false red.
+  if sed 's|^\( *\)pull_request) # PIN-BUILD-BASE-MUTATION-POINT$|\1pull_request_MUTANT)|' \
+        "$ROOT/scripts/ci/pin_build_base.sh" > "$WORK/pin-mutant.sh" \
+     && grep -qE '^ +pull_request_MUTANT\)$' "$WORK/pin-mutant.sh" \
+     && ! grep -q 'PIN-BUILD-BASE-MUTATION-POINT' "$WORK/pin-mutant.sh"; then
+    ok "C16 the pin's mutation point is present in the shipped script and the mutant was derived from a COPY of it"
+  else
+    bad "C16 the mutation could not be derived: no '# PIN-BUILD-BASE-MUTATION-POINT' line in scripts/ci/pin_build_base.sh"
+  fi
+  cx_rerun_clone "$CC5" 1 "$M" || die "C16: the clone is not the re-run shape (HEAD=M, origin/main=B2, no merge-base)"
+  out=$(cx_pin "$CC5" "$X" "$WORK/pin-mutant.sh"); rc=$?
+  out=$(cx_run "$CC5" check_complexity_ratchet.sh "${TIP_ENV[@]}"); rc=$?
+  if [ "$rc" -eq 1 ] && grep -qE "^  comparand   TIP +${B2:0:7}" <<<"$out" \
+     && grep -q 'RED    NEW      src/lib.rs::cognitive_only' <<<"$out"; then
+    ok "C16 mutation caught: without the pull_request pin the stale re-run reads B2 and is RED on main's own fix, so C14's GREEN is load-bearing"
+  else
+    bad "C16 mutation NOT demonstrated: the mutant pin leaves rc=$rc on the stale re-run, so C14 does not discriminate build base from tip"$'\n'"$(printf '%s' "$out" | sed 's/^/        /')"
+  fi
 }
 
 # ===========================================================================