fix(B4): the roadmap remedy had zero callers, and the hook that would run it exits 2 on its own line 4

[noahgift]

Ticket — #3047 (bse-001, needs-pmat-id — BSE mints no pmat ids). Refs PMAT-980, G-6, #2874.

Claim — B4 (roadmap churn). Two defects, both "a result nothing measured": the repo's
own remedy had zero callers, and the hook that would call it could not run.

Measured before (basis=)

guard-tree is red on #3025, instance A's only MERGEABLE open PP-066 PR, for one entry:

basis=$ bash scripts/check_roadmap_diff_additive.sh $(git merge-base origin/main pr3025) pr3025
VIOLATION reserialised: id=PMAT-1077 (bytes differ, no field actually changed)
reserialised=1 first_ids=PMAT-1077
roadmap-diff: base=818 head=824 added=6 lifecycle=36 reserialised=1 deleted=0

→ guard-tree failed: failure → gate exit 1 (run 34200927021, jobs 101979274909 / 101989986640).

basis=$ git grep -n 'roadmap_trim' origin/main
contracts/apr-roadmap-additive-diff-v1.yaml  4 hits — prose + a `remedy:` field
docs/audits/impl-PMAT-980-receipt.md         2 hits — prose
scripts/check_roadmap_diff_additive.sh:25,421  the RED footer's own text
scripts/roadmap_trim.py                        its own docstring
→ ZERO call sites in a hook, a Makefile target or a workflow.

basis=$ ls -l /bin/sh ; /bin/sh .githooks/pre-commit ; echo $?
/bin/sh -> dash
.githooks/pre-commit: 4: set: Illegal option -o pipefail
2

#!/bin/sh + set -euo pipefail. Following the install line in the hook's own header
refused every commit before cargo fmt — an unpassable gate, which is why
core.hooksPath on this box points at a hand-installed chain instead.

Change

• check_roadmap_diff_additive.sh --staged judges the INDEX. git write-tree makes the
  staged content a real tree object; roadmap_diff.py already resolves any ref via
  git show <ref>:<file>. So this is the identical rule set CI applies, against exactly the
  bytes about to be committed — one implementation, two entry points. A second copy of the rule
  list here is precisely how bashrs#266 happened.
• The base is plain merge-base(origin/main, HEAD), not resolve_base, and the reason is
  written at the divergence: resolve_base's push-shape branch exists because a commit judged
  against itself passes vacuously, which cannot arise when the head is the index tree. On a
  branch freshly cut from main it returns the tip's PARENT and attributes main's own entries to
  this commit.
• .githooks/pre-commit: bash shebang; roadmap guard first (cheapest check, costliest miss).
  rc 2 = "this box cannot judge" → warn, do not block: guard-tree still refuses, so nothing
  goes silently green.

Self-test (both polarities)

bash scripts/check_roadmap_diff_additive.sh --self-test → 22/22 rows (was 18).
Rows 19–22 are --staged, run in a scratch repo carrying the real scripts in a real layout —
REPO_ROOT comes from BASH_SOURCE, so the guard under test is genuinely this file running
somewhere it was not born, not a seam that exists only for tests. The scratch repos set
core.hooksPath=/dev/null: the case table judges this guard, not the developer's hook install.

row	polarity
19	an appended entry in the index → PASS added=1
20	a re-serialisation in the index → FAIL, naming roadmap_trim.py
21	no staged roadmap → fast PASS, by name
22	HEAD is the origin/main tip → base is the TIP, asserted by sha, not its parent

Mutation (RED → GREEN)

Run locally; both mutations are caught, and by the row designed to catch them.

mutation	effect	verdict
M1 base ← resolve_base HEAD	row 22 rc 0→1 (main's own re-serialisation attributed to this commit); rows 19,20 rc→2	SELF-TEST FAILED
M2 run_check … || true (the gate cannot fail)	row 20 rc 1→0	SELF-TEST FAILED
restored	—	22/22 rows

Row 22 asserts the PASS and the printed base sha, so it cannot pass for the wrong reason.

Queries at the change site

The git grep roadmap_trim census and the dash probe are both quoted in the file headers they
justify — check_roadmap_diff_additive.sh's usage block and .githooks/pre-commit's shebang
comment — so the next reader who is tempted to "simplify" either one meets the measurement first.

Predicted after

A pmat work add re-serialisation is refused at git commit, naming the one-command remedy,
instead of surfacing as a red required check ~11 min after push. Six of eight open pp-066 PRs
carry roadmap mints and queue up behind this same wall as they rebase.

Writes

scripts/check_roadmap_diff_additive.sh, .githooks/pre-commit. No roadmap.yaml, no
workflow, no crates/, no PP-066 row file. Two files.

Known, and deliberately not fixed here

core.hooksPath on this box is /home/noah/src/aprender/.git/hooks-apr, an apr-agent chain that
execs the pmat-managed $GIT_DIR/hooks/pre-commit and never reads .githooks/. So this hook
is correct in the repo and inert on this machine until git config core.hooksPath .githooks
— which is the same defect class one layer up, and is why the audit doc records it as measured
rather than as done. Changing a developer's local hooks install is not a change to make
unilaterally inside a PR; guard-tree remains the authority either way.

Closes #3047.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EeUX4ymyt8XhjXbtTuNH8L

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3048 head=3804b0c8b6c75c88eee874bfa4dff9cc0c161323 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): three PASS — agreed

{
 "ticket": "PMAT-1090",
 "head": "6b90c14437ad98588b1fa3a9c5e79eb93ef94da4",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 1
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}