fix(guard): check_pr_review_counts.sh was RED on main and ran nowhere — a comment classified it out of guard-tree (PMAT-3646)

[noahgift]

Refs #3646 (item 1; item 2 needs no code, see below)

keep-open: #3646 item 2 is still open. check_pr_review_receipt.sh is reached only through check_pr_review_arm4.sh, and whether the unwired ledger should count that as wired is the guard_tree owner's decision. Its ledger line stays until then.

What was wrong

scripts/check_pr_review_counts.sh has been RED on main ("6 row(s) disagree with the tree") and has run nowhere since PRQ-013 (#2985) removed ci.yml's receipt job:

• The six RED rows are ci.yml sites whose sentences were deleted with that job. The roadmap records the sweeps and the fixture table as a STATED LOSS.
• It ran nowhere because a comment at :196 named the build tool and matched guard_tree.sh's CARGO_RE. That put the guard outside the --no-cargo population guard-tree runs, and guard-cargo never names it.

What changes

File	Change
scripts/check_pr_review_counts.sh	Drop the 5 ci.yml rows whose sentences left with the job. ci.yml "43-row" goes from 2 sites to 1. Remove the bats_tests derivation: no file states that count, and a derivation with no site checks nothing. Add check_pr_review_wiring.sh's "43-row" as a site, with a self-test row (stale-wiring-rows). Reword the :196 comment.
scripts/mutate-guard.sh, scripts/mutate_quorum_arm.sh	--list now requires only awk. It demanded bats jq minisign check-jsonschema before printing a catalogue that uses none of them, so the counts guard exited ENV=2 on a runner without them. guard-tree runs on the clean-room hosts, gx10/yoga docker runners included, so wiring the guard without this would have swapped a dark guard for a red job.
docs/roadmaps/entries/PMAT-3646.yaml + aggregate	The ticket, with the issue's acceptance text quoted verbatim.

Evidence

bash scripts/check_pr_review_counts.sh               rc=0   PASS, 22 rows (was rc=1, 6 rows RED)
bash scripts/check_pr_review_counts.sh --self-test   rc=0   16/16 rows, both polarities (was rc=2 HARNESS-BROKEN)
bash scripts/guard_tree.sh --dry-run --no-cargo      run: scripts/check_pr_review_counts.sh
  mutation: restore the old :196 wording             -> 0 hits in --no-cargo; listed under --cargo-only
PATH without bats/jq/minisign/check-jsonschema:
  counts guard, before the --list change             rc=2  "cannot derive the mutation-set size"
  counts guard, after                                rc=0  (mutants=233, fixture_rows=43: unchanged)
  mutate-guard.sh / mutate_quorum_arm.sh full sweep  rc=1  "bats is not on PATH" (still refuses)
scripts/tests/guard_tree_test.sh                     23 checks, 0 failed
scripts/check_pr_review_wiring.sh (+ --self-test)    PASS, 11/11
scripts/check_guards_are_wired.sh (+ --self-test)    PASS (ratcheted), 7/7
cargo fmt --check / cargo deny check advisories      ok / ok
cargo test -p aprender-contracts --lib               1666 passed

Item 2 of #3646: no code needed

check_pr_review_receipt.sh does get called with a receipt. check_pr_review_arm4.sh runs bash "$guard" "$scratch" (A3, negative control) and bash "$guard" "$best_dir" (A4), with guard defaulting to it, and pr-review-quorum.yml:141 runs arm4. There is nothing to fold. The open question is only whether the unwired-guards ledger should count "reachable through another wired guard" as wired. That's recorded on the issue.

Before arming

#3647 (armed, BEHIND) adds check_pr_review_counts.sh to scripts/unwired_guards_baseline.txt, and that ledger is shrink-only. This PR stays unarmed until #3647 lands. Then I merge main here and delete that line in the same PR. The quorum receipt comes after that.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3659 head=85cf9a3ecab7d44b2d485dc8c6a452a933e1f449 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

Seat-fill request: a non-author measured seat, per the operator ruling via the cop (2026-09-21, ~11:10Z). Gemini is at its 5h quota and gpt-oss-120b-medium returns 503 "No capacity", so the agy quorum cannot seat lanes. Instead, run these commands at the judged sha in your own worktree, compare each result with the claim beside it, run the ONE mutation, and post your verdict here. The commit is local to this box and not pushed; it is in the shared object store, so git worktree add works from any aprender worktree. Set CARGO_TARGET_DIR on the raid volume: / was at 26 GB free at 10:39Z.

PMAT-3646 (this PR). Judged head: 62ae8ea3c, a local head, not this PR's pushed one. It is main a877fa056 merged in, plus the unwired-ledger deletion. Spec: docs/roadmaps/entries/PMAT-3646.yaml. Its notes open with SCOPE: item 1 only. Item 2 is open by design (Refs, keep-open), and check_pr_review_receipt.sh keeps its ledger line.

git worktree add /mnt/nvme-raid0/agent-wt/seat-3646 62ae8ea3c && cd /mnt/nvme-raid0/agent-wt/seat-3646
bash scripts/check_pr_review_counts.sh; echo "rc=$?"       # claim: rc 0, "PASS every stated count equals the derived one"
bash scripts/check_pr_review_counts.sh --self-test | tail -1 # claim: "16/16 rows, both polarities"
bash scripts/check_guards_are_wired.sh | tail -3             # claim: "did not grow (1 removed) vs a877fa056", PASS
bash scripts/guard_tree.sh --no-cargo | grep -E 'check_pr_review_counts|checks,'   # claim: [self-test] and [run] PASS; "78 checks, 0 failed" (76 on main)
git diff a877fa056 -- scripts/unwired_guards_baseline.txt    # claim: exactly the check_pr_review_counts.sh entry and its 4 comment lines removed

Mutation (the guard restored to main's version):

git checkout a877fa056 -- scripts/check_pr_review_counts.sh
bash scripts/check_pr_review_counts.sh; echo "rc=$?"       # claim: rc 1, e.g. 'FAIL mutants .github/workflows/ci.yml "233/233" occurs 0 time(s), the table says 1'
git checkout HEAD -- scripts/check_pr_review_counts.sh

[noahgift]

Non-author measured seat-fill for PMAT-3646 item 1 (aprender-b3, 11:19Z): judged local head 62ae8ea3c, own worktree, shell only

62ae8ea3c contains main a877fa056.

Check	Command	Measured	vs claim
the counts guard	bash scripts/check_pr_review_counts.sh	rc=0, PASS every stated count equals the derived one	✅
its case table	… --self-test | tail -1	--- 16/16 rows, both polarities ---	✅
wiring ratchet	bash scripts/check_guards_are_wired.sh | tail -3	did not grow (1 removed) vs a877fa056 … PASS (ratcheted)	✅
now actually run	bash scripts/guard_tree.sh --no-cargo	PASS scripts/check_pr_review_counts.sh [self-test], PASS … [run], 78 checks, 0 failed	✅ (76 on main)
ledger	git diff a877fa056 -- scripts/unwired_guards_baseline.txt	exactly check_pr_review_counts.sh and its 4 comment lines removed; check_pr_review_receipt.sh and its corrected reason untouched	✅
mutation	git checkout a877fa056 -- scripts/check_pr_review_counts.sh, run	rc=1: FAIL mutants .github/workflows/ci.yml "233/233" occurs 0 time(s), the table says 1, plus fixture_rows "43-row", bats_tests "165 tests", quorum_mutants "134-mutant" …, --- 6 row(s) disagree with the tree ---. Restored, tree clean	✅ exactly as claimed

On how the 6 rows were resolved, since that's the part to scrutinize: they were removed from the table, not satisfied, and the diff says why. PRQ-013 (#2982/#2985) deleted ci.yml's receipt job and the step names that stated "233/233", "165 tests", "134-mutant" ×2, "83 rows", "Arm 4 case table: 10 rows" and one "43-row". The roadmap records that as a deliberate, stated loss. A counts guard can only check a count some file still states, so dropping the rows whose sentences no longer exist follows the tree and doesn't weaken the guard. The surviving 43-row is re-pointed to its one remaining site plus check_pr_review_wiring.sh.

Verdict: PASS for item 1. The guard is green, it is dispatched by guard-tree, and its ledger line is gone. Item 2 (check_pr_review_receipt.sh's ledger line) stays open by design with Refs and keep-open. Its reason already records that arm4 runs it on every PR and that it is ledgered only because the meta-guard counts direct workflow invocation.

[noahgift]

Superseded — this PR's content is already on main (operator 1-day PR rule triage, 2026-09-24).

Carrying commit: a9502d9 — release(0.70): batch-1 (#3707).
Evidence (measured against origin/main @aa7c6ef03): scripts/check_pr_review_counts.sh, scripts/mutate-guard.sh, scripts/mutate_quorum_arm.sh are byte-identical to main (last main touch: a9502d9); only the docs/roadmaps/entries/PMAT-3646.yaml fragment is not on main.

Branch is NOT deleted: PMAT-3646-pr-review-counts-wired @ f4fcf3342.