path_claim_check: apply_baseline reads the MISSING set once, not four times

The ledger attach loop already visits every MISSING row, and the old return
statement then re-walked missing.values() three more times to recover matched,
new and tolerated. Those three tallies are now accumulated in the attach pass
itself: known and new are exact complements within one row, and matched /
tolerated are read from the record just written. Four traversals of the row
set become one.

Output is unchanged, and that is measured rather than asserted. Against
54961d4's copy of the same tool, twelve invocations over the live worktree are
byte-identical in stdout, stderr, exit code and --json payload: default,
--json, --only missing|docrel|external, --context, --fail-on-missing, an empty
ledger (the `new` list, all 14 counted), the same graded (rc 1, not 0 and not
2), a ledger row naming a class outside the closed set (rc 2), a truncated
ledger (matched/tolerated/dead at once), and a non-HEAD --rev. Selftest is
31/31 on both copies.

No speed claim: five timed runs put HEAD at 6.94/6.92s median and this at
6.70/6.90s -- inside the noise, because the 1598-path filesystem scan dominates
the row walk. The change buys passes, not milliseconds.

tools/path_claim_check.py

@@ -430,12 +430,27 @@ def load_baseline(path):
 def apply_baseline(rows, ledger):
     """Attach the ledger to each MISSING row; report what moved on both sides."""
     missing = {p: r for p, r in rows.items() if r["verdict"] == "MISSING"}
+    # A single FUSED census pass does both jobs the original split across four
+    # traversals: it attaches each row's baseline record AND accumulates the
+    # matched count, the new-path list, and the tolerated class Counter in the
+    # same iteration. `known` and `new` are exact complements within one row, so
+    # the tally is read from the record just written -- no second pass is needed.
+    # The report renders `new` sorted and `tolerated` via sorted(.items()), so
+    # neither traversal order nor the merge can move a byte of output.
+    matched = 0
+    new = []
+    tolerated = collections.Counter()
     for p, row in missing.items():
         if p in ledger:
-            row["baseline"] = {"known": True, "class": ledger[p][0],
-                               "reason": ledger[p][1], "new": False}
+            cls, reason = ledger[p]
+            row["baseline"] = {"known": True, "class": cls,
+                               "reason": reason, "new": False}
+            matched += 1
+            tolerated[cls] += 1
         else:
-            row["baseline"] = {"known": False, "class": None, "reason": None, "new": True}
+            row["baseline"] = {"known": False, "class": None,
+                               "reason": None, "new": True}
+            new.append(p)
     cleared = sorted(p for p in ledger if p in rows and rows[p]["verdict"] == "EXISTS")
     # A row the second base now resolves is cleared too, but it says so: the
     # path is true at the citing document's directory, not at the repo root, and
@@ -443,13 +458,10 @@ def apply_baseline(rows, ledger):
     cleared_docrel = sorted(p for p in ledger
                             if p in rows and rows[p]["verdict"] == "DOCREL")
     dead = sorted(p for p in ledger if p not in rows)
-    return {"entries": len(ledger), "matched": sum(1 for r in missing.values()
-                                                   if r["baseline"]["known"]),
-            "new": sorted(p for p, r in missing.items() if r["baseline"]["new"]),
+    return {"entries": len(ledger), "matched": matched,
+            "new": sorted(new),
             "cleared": cleared, "cleared_docrel": cleared_docrel, "dead": dead,
-            "tolerated": collections.Counter(r["baseline"]["class"]
-                                             for r in missing.values()
-                                             if r["baseline"]["known"])}
+            "tolerated": tolerated}
 
 
 def report(rows, stats, rev, sha, corpus, ledger, path, only, context):