fix(I-26): spec_conformance.sh — a §12 expiry is the Expires marker, never the first date in the cell; rows past expiry are RED (the §4 andon); derived_expiries.json regenerated (row 1 → 2026-09-19) (PMAT-974, #2889)

[noahgift]

PP-066 DAG row I-26 (issue #2889; S0-2's expiry finding; epic #2873; ticket PMAT-974; owner spec-owner; receipt docs/audits/impl-PMAT-974-receipt.md, status: partial until merged).

The defect (S0-2): the PP-29 scanner took the FIRST date in a §12 root cell — master row 1's "lambda witness taken 2026-09-02" — and ignored its Expires **2026-09-19** marker; derived_expiries.json put row 1 (and rows 13/15/18/19, derived from it) at 2026-09-02. Five rows sat past expiry at HEAD and nothing was RED: the §4 andon was not wired.

What lands: the expiry is the Expires YYYY-MM-DD marker, never the first date (scripts/lib/spec_conformance.py); a non-discharged row past its derived expiry is RED in spec_conformance.sh (SPEC_CONFORMANCE_TODAY pins the clock for the case table); evidence/parity/derived_expiries.json regenerated by the script's own --write — row 1 expires 2026-09-19, rows 13/15/19 derive from it, 18 from 15. --selftest rows expiry_marker_wins and expired_row_is_red (RED first at c37fe3b; 42 rows green after). Contract: an invariant under expiries_derive_from_the_dag and FALSIFY-PP-LLAMA-001-CONFORMANCE-011 in contracts/pp-llama-001-spec-conformance-v1.yaml (existing contract).

Acceptance, re-run by the orchestrator on 69d6a5a

A_i	rc
bash scripts/spec_conformance.sh --selftest (carries expiry_marker_wins and expired_row_is_red)	0 (42 rows)
bash scripts/spec_conformance.sh at HEAD (real clock) — non-zero iff a non-discharged row is past expiry	0: nothing expired today
python3 over evidence/parity/derived_expiries.json: row 1 → 2026-09-19; 13/15/19 ← 1; 18 ← 15	as predicted
bashrs lint (0 errors) · pv validate · pv lint · check_contract_test_binding.sh · check_contract_enforcement.sh · check_no_claim_literals.sh · check_perf_claims_cite_receipts.sh · check_roadmap_diff_additive.sh · check_readme_claims.sh	0 each

Mutation — RED, then restored GREEN: EXPIRES_MARKER replaced by a bare date regex → expiry_marker_wins BROKE: expected 2026-09-19 got [2026-09-02]; restored → green.

Finding: with the marker honoured, master rows 1, 13, 15, 18 and 19 all expire 2026-09-19 — thirteen days out; the andon now fires the day after (D-4: master dates stand). Receipt for this PR itself: advisory, not produced (driver A1).

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3009 head=007cc17ed6f59445406e6b96a15731551d75cc09 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.