fix(G-10, PR-A): the shipped-path ratchet runs under ONE pinned analyser — stamped baseline, differential HEAD vs base under the same binary, never the tree against itself (PMAT-1059)

[noahgift]

PP-066 DAG row G-10 · ticket PMAT-1059 · Refs #2999 · epic #2873 · PR-A of three (G-10b pin guard, G-10c sweep follow). Receipt: docs/audits/impl-PMAT-1059-receipt.md (status: partial until merged).

Root cause, cited from the job logs (not inferred)

run	shape	analyser line in the log	ratchet step
34011762858 main @ 027ed88, 04:35Z	push	pmat: /home/noah/.cargo/bin/pmat (pmat 3.31.0)	SKIPPED (proven): pmat 3.31.0 cannot run this analysis. → success
34018449576 #3008, 07:53Z	pull_request	pmat: /home/noah/.cargo/bin/pmat (pmat 3.37.0)	pmat is capable (pmat 3.37.0) -- the ratchet is ARMED and blocking. → FAIL: shipped machine-specific paths grew 277 -> 317.

The runner's analyser moved between those two runs (paiml/infra machines/intel/forjar.yaml pins 3.37.0, PMAT-231). The baseline 277 named no instrument; 3.37.0 and 3.38.0 both count 317 on the unchanged tree. Main was vacuously green; every PR since is red for a defect none introduced. The instrument is part of the number.

What this PR does

1. scripts/pmat_bin.sh — the ONE pin (PMAT_PIN=3.37.0). Resolves PMAT_BIN_OVERRIDE, ~/.local/pmat/<pin>/bin/pmat, then PATH — and accepts a binary only if it reports the pin; otherwise returns 1 naming every version tried. Option-neutral (sourced), zsh-safe (array candidates).
2. scripts/hardcoded_path_shipped_baseline.txt gains pmat_version: and basis:. Both are INVALID/UNMEASURED by design: the 277 was never measured under a named binary. No baseline raise. The re-baseline is PMAT-1061, stamped, its own PR.
3. scripts/check_hardcoded_paths.sh --full-if-capable — an absolute compare only under a matching stamp. Otherwise REPORT BASELINE-STALE{old,new} / BASELINE-INVALID and the verdict is the differential: HEAD and merge-base scanned under the same binary, delta ≤ 0 PASS, a positive delta FAILS naming the added paths. A stamp bumped without a re-measurement is refused. No base → RED. No analyser at the pin → FAIL (ENV), never PASS.
4. Never the tree against itself (the review quorum's blocking finding, confirmed from the main run's own log where G-6's guard printed base=027ed889d … head=HEAD — the base was the pushed commit): on the push shape scripts/lib/resolve_base.sh names HEAD's first parent and refuses when it is not fetched; ci.yml deepens the depth-1 checkout by one on push. The resolver is G-6's, extracted verbatim and now shared, so both differential guards judge against one base.
5. Contract contracts/apr-pinned-analyser-ratchet-v1.yaml (kind: pattern; PIN-OB-001..004 ↔ PIN-F-001..004, 1:1). pv validate: valid.
6. ci.yml: the ratchet step reads the pin; the fetch step deepens on push. No new jobs, no required-check change.

Mutations — RED then GREEN, each observed

mutation	RED (observed)	GREEN (observed)
live: append pub const MUTATION_PROBE: &str = "/home/probe/models/x.gguf"; to crates/apr-cli/src/main.rs, run --full-if-capable under the pin	differential: base 027ed889d = 317 shipped; HEAD = 318 shipped; delta +1 → FAIL … crates/apr-cli/src/main.rs|/home/probe/models/x.gguf rc=1	reverted → delta +0 → PASS (differential, delta +0) rc=0
R2 / R4 (+1 path under a matching / stale stamp)	RED by the absolute compare / by the differential naming src/f8.rs|fixture://p8	R1 / R3 PASS at delta 0
R5 INVALID stamp compared as a number · R6 stamp bumped while count: stands	REPORT + differential (never compared) · A stamp is not a measurement rc=1	—
R7 no base nameable · R8 no analyser at the pin	RED by name (cannot resolve the comparand ref) · FAIL (ENV) rc=1	—
R9–R11 push shape (HEAD is the origin/main tip): delta 0 · +1 vs the first parent · parent not fetched (depth-1 clone)	R10 RED naming the path · R11 RED never the tree against itself	R9 PASS against the first parent
G-6 resolver rows 16–17 (push shape → first parent; parent not fetched → refused by name)	row 17 refused	row 16 first parent
my own finding: R7 had passed by an unbound-variable death (PROG=x . file does not outlive the . builtin; $PROG unset under set -u inside resolve_base)	reproduced with a two-line fixture	plain assignment + defaulted PROG; R7 now asserts the refusal text
comm: input is not in sorted order on the first live mutation (sort under LC_ALL=C, comm under the user locale)	observed	LC_ALL=C comm → the path is named

Case tables: bash scripts/check_hardcoded_paths.sh --self-test → 16/16 (5 contract rows + R1–R11) · bash scripts/check_roadmap_diff_additive.sh --self-test → 17/17.

Acceptance, re-run by the orchestrator (the quorum lanes ran no commands; every lane claim was re-verified)

bash scripts/check_hardcoded_paths.sh --self-test          # SELF-TEST PASSED, rc 0
bash scripts/check_roadmap_diff_additive.sh --self-test    # 17/17 rows, rc 0
bash scripts/check_guards_are_wired.sh                     # PASS (ratcheted), rc 0
bash -c '. scripts/pmat_bin.sh && echo $PMAT $PMAT_VERSION' # /home/noah/.local/pmat/3.37.0/bin/pmat 3.37.0 (same under zsh)
bash scripts/check_hardcoded_paths.sh --full-if-capable    # REPORT BASELINE-INVALID → differential delta +0 → PASS, rc 0
pv validate contracts/apr-pinned-analyser-ratchet-v1.yaml  # valid (via scripts/pv_bin.sh)
check_baseline_ratchets · check_sourced_libs_option_neutral · check_shell_lint_ratchet (9→8) · check_readme_claims · check_no_claim_literals  # PASS

Review quorum

3 agy lanes, review-only, verdict 3/3 do-not-implement-as-written on the pre-fold diff; the blocking finding (vacuous HEAD-vs-HEAD on the push shape) is confirmed and fixed above; the 1:1 obligation mapping applied; lane 1's dissent (the stored-count shrink-only ratchet blocks a rising re-baseline) is recorded as PMAT-1061's precondition. Full disposition table in the receipt.

Deployment precondition (why this is green on the runner)

The runner's PATH pmat is 3.37.0 (the log line above) and ~/.local/pmat/ does not exist there → the resolver's third candidate takes it. The baseline is INVALID → the differential runs: HEAD vs merge-base (pull_request / merge_group) or vs the first parent (push, deepened). Expected on this PR: REPORT BASELINE-INVALID + delta +0 + PASS.

Not in this PR

G-10b (check_pmat_pinned.sh, 281 shrink-only) · G-10c (the sweep to 0) · PMAT-1061 (stamped re-baseline; needs a "stamped series" rule in the baseline kind table). All preserved on agent/G-10-full.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3011 head=0c35f8cfb0f7733c5cfe0471c3d8e22f63e24ccc verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.