@@ -432,3 +432,10 @@ Run from the branch worktree; `Q` is `package/dist/bin/quarto` (`quarto.cmd` on
 - Minor, deferred: `git diff -U0 -- <path>` treats the path as a pathspec (`src/[id].ts` picks up another file's hunks: wrong line numbers only, never counts); `--literal-pathspecs` would fix it. No tracked in-scope path contains `[ ] * ? :` today.
 - Minor, deferred: `git diff` is run without `--no-color --no-ext-diff`, so a user git config (`color.diff=always`, `diff.external`) can empty `addedLines` in local runs; CI is unaffected.
 - Minor, deferred: the CLI exit-code contract and the stdout summary fallback are covered only by manual Verification 5; no test covers a report with both errors and warnings, or that "Expected counts after merge" lists only scopes with warnings.
+
+### 2026-10-22: review fix after the whole-branch review
+
+- Defect: the "main is above the baseline" notice compared the base counts (current minus delta) with the PR's own baseline. A PR that lowers `src` 994 → 993 and commits the lowered baseline got `main is above tools/runtime-boundary-baseline.json (src Deno.* calls 994 > 993); not caused by this PR, a maintainer fixes main`, which every count-lowering migration PR would see. Reproduced at the CLI before the fix (probe edit `Deno.stdout` → `Deno .stdout` in an unrelated command file plus `--update-baseline`, then `--against HEAD`; both files restored with `git checkout --` after checking the diffs).
+- Fix: delta mode passes `renderDelta` the baseline committed at the `--against` revision, read by the new exported `baselineAt` (`git cat-file -e` to detect an absent file, fallback to the working-tree baseline for a revision from before the ratchet; a malformed baseline exits 2). New export, not in the plan: needed to unit-test the logic with a real temp git repository. After: probe PR prints no notice, V3 still prints `main is above … (tests Deno.* calls 832 > 826)`, `unit/tools/check-runtime-boundary.test.ts` → 36 passed.
+- Correction to the earlier note on the `execProcess` decoder: counts are not always unaffected. A corrupted path from `git diff --name-only` or the untracked list fails both the `ls-tree` membership check and the disk read, so the file contributes nothing and a covered increase in it would be missed silently; only a corrupted `ls-tree` entry over-reports. Still 0 tracked non-ASCII paths, and the fix stays a separate bug on main (backported to v1.10).
+- Open, needs a decision: a covered `Deno.build.os` added under `src/core/lib/` (browser-shared: the YAML-intelligence web worker imports it, so it cannot import `src/deno_ral/platform.ts`) gets a blocking error with a hint that cannot compile there. PR 19 plans a runtime-neutral probe for the two existing uses (`errors.ts`, `colors.ts`).
@@ -16,6 +16,7 @@ import { execProcess } from "../../../src/core/process.ts";
 import { createTempContext } from "../../../src/core/temp.ts";
 import {
   acceptIncrease,
+  baselineAt,
   compareToBaseline,
   countScope,
   countText,
@@ -636,3 +637,26 @@ unitTest("check-runtime-boundary - gitChanges handles more changed paths than fi
     temp.cleanup();
   }
 });
+
+unitTest("check-runtime-boundary - baselineAt reads the baseline committed at the revision, not the working tree's", async () => {
+  const temp = createTempContext();
+  try {
+    const root = temp.createDir();
+    await makeGitRepo(root);
+    assertEquals(await baselineAt(root, "HEAD"), undefined);
+
+    const committed = { "src": { denoCalls: 994, stdImportFiles: 49 } };
+    writeFixture(root, "tools/runtime-boundary-baseline.json", JSON.stringify(committed));
+    await git(root, "add", ".");
+    await git(root, "-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", "commit", "-m", "baseline");
+    writeFixture(root, "tools/runtime-boundary-baseline.json", JSON.stringify({ "src": { denoCalls: 993, stdImportFiles: 49 } }));
+    assertEquals(await baselineAt(root, "HEAD"), committed);
+
+    writeFixture(root, "tools/runtime-boundary-baseline.json", `{"src":{"denoCalls":1}}`);
+    await git(root, "add", ".");
+    await git(root, "-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", "commit", "-m", "malformed");
+    await assertRejects(() => baselineAt(root, "HEAD"), Error, "baseline");
+  } finally {
+    temp.cleanup();
+  }
+});
@@ -683,6 +683,21 @@ export async function gitChanges(
   return changes;
 }
 
+/** The baseline committed at `rev`, or undefined when that revision has none (it predates the ratchet).
+ * Throws for a malformed baseline, like parseBaseline. */
+export async function baselineAt(
+  root: string,
+  rev: string,
+): Promise<Baseline | undefined> {
+  const spec = `${rev}:${kBaselineRelPath}`;
+  try {
+    await runGit(root, ["cat-file", "-e", spec]);
+  } catch {
+    return undefined;
+  }
+  return parseBaseline(await runGit(root, ["show", spec]));
+}
+
 const isCount = (n: unknown) => Number.isInteger(n) && (n as number) >= 0;
 
 /** Parses a baseline file, rejecting any scope without a non-negative integer for each field:
@@ -798,7 +813,15 @@ if (import.meta.main) {
       console.error((e as Error).message);
       Deno.exit(2);
     }
-    const rendered = renderDelta(diffChanges(changes), current, baseline);
+    // "main is above its baseline" is about the base revision's baseline: the PR's own
+    // baseline may already be lowered or raised.
+    let baseBaseline = baseline;
+    try {
+      baseBaseline = (await baselineAt(root, against)) ?? baseline;
+    } catch (e) {
+      usage(`cannot use ${kBaselineRelPath} at ${against}: ${(e as Error).message}`);
+    }
+    const rendered = renderDelta(diffChanges(changes), current, baseBaseline);
     for (const message of rendered.notices) {
       notice(message);
     }