fix(corpus): the root index links the bundle's own log

Measured on the K2 artifact by a consumer: `log.md` was on disk and no
index named it, so a reader entering the bundle at `index.md` -- the walk
section 8 exists to support -- never reached the one file carrying `N`.

Stated as a LOCAL choice rather than conformance, because it is one.
Upstream's own bundles do not link their log: measured at `9a15b13`, 0 of
the 24 shipped `index.md` files name the single `log.md` in the set, with
the same grep form finding `tables/index.md` in 4 of them as the
known-positive control. That shows the link is not REQUIRED -- not that
it is disallowed. `docs/plan/okf-v0.2-alignment.md` P1-F6 already
recorded the upstream shape; a line there now separates the two claims,
since reserved names still stay out of an `entries_match_directory`
listing and this profile has that off.

It lives in the harness because the library cannot make it. The log's
content IS the run's outcome, so it cannot exist when the indexes are
projected, and an index that enumerated it off the directory would gain
the link only from the second run onward -- breaking
rebuild-equals-incremental, the property the segmented bundle is built
on.

The membership test is load-bearing and was measured, not assumed. The
two reprojections disagree about this line: the per-directory one drops
every managed entry before re-emitting its block, while the flat one
keeps a managed line whose target is not an owned concept, deliberately,
so that a regex cannot delete curated content. Appending unconditionally
therefore doubled the entry on the second unsegmented run, which is why
both run modes are pinned separately.

1052 -> 1054 tests. `mypy --strict` clean, `ruff` clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/okf_corpus_run.py

@@ -68,6 +68,12 @@ __all__ = [
 
 HARNESS_ID = "okf-corpus-run"
 
+# The log's name and title in ONE place, because two of them now read it: the
+# file's own frontmatter and the root index entry that points at it. Two
+# literals would let the link's label drift away from the thing it labels.
+LOG_NAME = "log.md"
+LOG_TITLE = "Corpus run history"
+
 
 def is_degenerate(text: str) -> bool:
     """Zero characters after stripping whitespace. The whole rule, in one line.
@@ -196,10 +202,10 @@ class CorpusReport:
         lines = [
             "---",
             "type: Log",
-            "title: Corpus run history",
+            f"title: {LOG_TITLE}",
             "---",
             "",
-            "# Corpus run history",
+            f"# {LOG_TITLE}",
             "",
             f"## {self.ingested_at[:10]}",
             "",
@@ -369,6 +375,47 @@ def parse_args(argv: list[str] | None) -> argparse.Namespace:
     return parser.parse_args(argv)
 
 
+def link_log_in_root_index(bundle: Path, profile: BundleProfile) -> None:
+    """Point the root index at the log, so the walk section 8 supports reaches it.
+
+    Measured on the K2 artifact: the bundle carried a conformant root `log.md`
+    that no index named, so a consumer entering at `index.md` never reached the
+    one file carrying `N`.
+
+    A LOCAL choice, not a conformance requirement, and the difference is worth
+    stating rather than implying. Section 9 puts `log.md` at any level and
+    section 8 has an index enumerate its directory's contents, but upstream's
+    own bundles do not link it: measured at `9a15b13`, 0 of the 24 shipped
+    `index.md` files name the single `log.md` in the set. Upstream therefore
+    shows the link is not REQUIRED -- not that it is disallowed.
+
+    It belongs to the harness and not the library. The log's content IS the
+    run's outcome, so it cannot exist when the indexes are projected; an index
+    that enumerated it off the directory would gain the link only from the
+    second run onward and break rebuild-equals-incremental, the property the
+    segmented bundle is built on. Writing it after the log instead keeps both
+    runs identical.
+
+    THE MEMBERSHIP TEST IS LOAD-BEARING, and measured rather than assumed: the
+    two reprojections do not treat this line the same way. The per-directory
+    one drops every managed line before re-emitting its block, so the link is
+    gone by the time this runs. The flat one keeps a managed line whose target
+    is not an owned concept -- deliberately, because claiming somebody else's
+    link on the strength of a regex would delete curated content -- so `log.md`
+    survives there. Appending unconditionally therefore doubled the entry on
+    the second unsegmented run. Re-writing the line only when it is absent is
+    idempotent under both, without either side having to know about the other.
+    """
+    index_path = bundle / profile.index.name
+    if not index_path.is_file():
+        return
+    body = index_path.read_text(encoding="utf-8")
+    link = profile.index.render_link(LOG_TITLE, LOG_NAME) + "\n"
+    if link in body.splitlines(keepends=True):
+        return
+    index_path.write_text(body + link, encoding="utf-8", newline="")
+
+
 def main(argv: list[str] | None = None) -> int:
     args = parse_args(argv)
     if not args.corpus.is_dir():
@@ -422,7 +469,8 @@ def main(argv: list[str] | None = None) -> int:
     # harness's output directory would leave the bundle exactly as unverifiable
     # as it was before.
     bundle.mkdir(parents=True, exist_ok=True)
-    (bundle / "log.md").write_text(report.render_log(), encoding="utf-8", newline="")
+    (bundle / LOG_NAME).write_text(report.render_log(), encoding="utf-8", newline="")
+    link_log_in_root_index(bundle, profile)
     print(report.render())
     if report.unaccounted or report.merged + report.rejected != report.n:
         print(