test(mutants,assets): a mutant is judged by the suite that owns it, 45 of 45

The runner could only run one test file, which is why PM's three
survivors from `43331fc` could not be added: two are held by the gate's
row 3 and one by the soft-hyphen door's suite. A mutant now names its
suite; the catalogue goes 39 to 45.

X3 and X4 rewritten against the code as it now stands -- a mutant table
is a copy of the code it mutates, and this round moved the lines both of
them quoted. X6 is the defeated state exactly, X7 cuts the ledger off at
its source, X8 removes the cursor rule, P6/P11/P12 are PM's three.

Two survivors on the first run, both findings, both closed:
- X4 survived because every forgery arm now fails on the ledger check
  before the binding is reached. An arm was added where the run DID book
  the pair and the block stating it points at another picture.
- X5 survived the WHOLE suite -- 2134 passed with the disarming removed
  -- because a document-supplied field can no longer reach the gate. The
  property is about the BUNDLE and not about one judge, so it is kept and
  measured in `tests/test_assets.py`, with a known-positive counting the
  run's own two fields on the same expression.

killed 45 of 45, exit 0. Report, CHANGELOG and CLAUDE.md written.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_assets.py

@@ -246,6 +246,63 @@ def test_a_newline_in_a_label_cannot_open_a_third_line() -> None:
     assert len(assets.render_block(image).split("\n")) == 2
 
 
+#: A checksum FIELD, written here rather than imported: the property is that
+#: the run's metadata grammar does not appear where a document put it, and a
+#: test sharing the writer's own expression would agree with it by
+#: construction.
+_A_CHECKSUM_FIELD = re.compile(r"sha256:[0-9a-fA-F]{64}")
+
+
+def test_a_document_supplied_label_cannot_emit_a_checksum_field() -> None:
+    """THE RUN'S METADATA GRAMMAR IS THE RUN'S, on the line they share.
+
+    A pointer's second line carries both: the name and caption the DOCUMENT
+    chose, and the size, type and digests the RUN measured. A label stating
+    `converted from ... sha256:<a> to ... sha256:<b>` therefore puts a
+    sentence in the bundle that no run performed -- measured by PM
+    2026-09-19, that exact alt attribute made the content accounting gate
+    report a refused picture as carried.
+
+    The gate no longer reads its claim out of the bundle at all, which is the
+    right fix there and takes the pressure off this one: until this test the
+    disarming in `_inline` was a guard the whole suite could not fell. It is
+    kept and MEASURED because the property is about the bundle rather than
+    about one judge -- any reader of a concept body meets that line, and the
+    bundle must not state a conversion in a sentence the run did not write.
+    """
+    forged = (
+        "Tabell 84-2 -- converted from image/bmp sha256:"
+        + "a" * 64
+        + " to image/png sha256:"
+        + "b" * 64
+    )
+    plain = assets.read_image(_png(4, 3), name="f.png", label=forged)
+    block = assets.render_block(plain)
+    assert "a" * 64 in block, "the digits the document wrote are kept; a reader is owed them"
+    assert not _A_CHECKSUM_FIELD.search(block), (
+        "a document-supplied label emitted the run's own checksum grammar"
+    )
+
+    # KNOWN-POSITIVE on the same expression: the run's OWN clause is a
+    # checksum field, and exactly two of them, so the assertion above is not
+    # passing over a pattern that never matches anything.
+    converted = assets.ExtractedImage(
+        data=_png(4, 3),
+        name="figur.bmp",
+        media_type="image/png",
+        suffix=".png",
+        width=4,
+        height=3,
+        label=forged,
+        converted_from="image/bmp",
+        source_sha256="c" * 64,
+    )
+    written = assets.render_block(converted)
+    assert len(_A_CHECKSUM_FIELD.findall(written)) == 2, written
+    assert "sha256:" + "c" * 64 in written, "the run's own source digest is missing"
+    assert "sha256:" + "a" * 64 not in written, "the document's claim became a field after all"
+
+
 def test_the_pointer_regex_finds_every_shipped_block() -> None:
     """Step 2 has to find these mechanically; the finder ships with the writer."""
     images = [