S4.0, the fifth D7 mirroring candidate, measured with scripts/mutation_harness.py
against the real tree. C-F3 says "nothing in the bundle format carries a cost
baseline to reconcile against". Measured, that is too strong: validator-input.json
carries ENERGI-TOTAL-EL at 300 000 NOK and it is loaded on every run path. The
defect is not that the baseline is missing -- it is that no path connects it to
the judge.
A SavingsProposal comes into being in exactly three places (model-authored parse,
bundle baseline, re-read output; AST-measured over all 27 src files, positive
control: the same query finds validate_proposal's one call site). Only the first
reaches the validator. The only field read off the baseline directly is
project_id; the quantities, unit costs and uncertainty bands are schema-validated
and never read again.
Seven mutations, every one green-before/red-after with the restore sha256-verified
from disk:
M1 baseline swapped for the weakest schema-valid variant -- 3 targets RED,
all 974 pre-existing tests GREEN in both runs
M2 the carried annotation narrowed to object -- AST ratchet RED, behaviour GREEN
M3 the S10 path stops loading the baseline -- loader population RED
M4 the validator gains a baseline parameter -- signature ratchet RED, golden GREEN
M5 the call-site argument becomes a keyword -- provenance control RED
M6 fail-closed code-set gate (the gated fix's own shape) -- boundary RED, golden GREEN
M7 retrieval stops reading the codes -- disjointness RED
M4 and M6 leaving the golden green is itself the finding that S4.0 is
golden-compatible when D-A pkt. 2 lands.
A measuring trap was caught by the harness rather than by memory: the first M1
flattened the cost lines to 1.0x1.0, which broke the IR invariant (claim 30 000 >
total 1.0) and turned the run-entrance tests red. That redness attributed to
pydantic, not to the seam. The collateral control refused the proof.
New beyond C-F3: the fabricated line's code set is DISJOINT from the bundle's, and
retrieval computes that disjointness to rank experience. The system holds the
evidence that would expose the fabrication and spends it on ranking, never on
deciding.
No src/ change -- the fix is GATED on D-A pkt. 2 plus a commons amendment. Tests
pin the boundary so the gated work must arrive as a visible red test.
974 -> 984, strict superset, 0 node ids lost.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Kjell Tore Guttormsen
b955bf274e