feat(verdicts): key each verdict on its own candidate, not the bundle's one IR projection (S3.2)

seed_store_from_bundle keyed EVERY `type: verdict` file on bundle_candidate_features — the single
candidate the bundle's validator-input.json describes. A bundle carrying verdicts about several
candidates collapsed them onto one key, so a verdict about candidate B scored a perfect structural
match against candidate A's query and could be folded into A's hypothesis prompt. The ExpeL
substrate was single-candidate by construction.

A verdict file may now carry its own structural key in frontmatter (affected_codes / measure_type /
claimed_saving_nok); absent, keying falls back to the bundle candidate, so every pre-S3.2 seed keeps
working unchanged. promote_verdict writes the three fields, so a promoted verdict — frequently about
a different candidate than the target bundle's projection — does not impersonate that candidate.

Semantics decided HERE, not pulled: commons' seeding rule (method-spec §3 Steg 1 + bundle example)
has not arrived; we said we would build locally first. D7 mirroring stays open.

- ALL THREE fields or none. A partial declaration raises VerdictFrontmatterError rather than merging
  with the bundle candidate, which would mint a key belonging to NEITHER candidate. Validation,
  never repair (mirrors write_concept_file); the tolerant-skip rule belongs to the RAW inbox layer.
- claimed_saving_nok parses via json.loads — the SAME literal rule the IR projection went through —
  and is written back with str() of the raw value. _mint_id hashes that value, so 30000 and 30000.0
  are different keys; a normalising writer would split one candidate's signal across two ids.
- The structural key is signal-free, so it does not weaken the Step-8 no-leak property (Test C green).

Load-bearing MEASURED, five mutations all red: detach per-verdict keying · detach the fields
promote_verdict writes · make a partial/unparseable key tolerant · normalise the magnitude on write ·
remove the fallback (control — breaks the step1 suite at collection, proving the fallback bears load).

589 -> 597 tests. Full gate green (pytest, ruff, mypy).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QkjvTTxrg9LTrmghebfiij

tests/test_step8_promotion_loadbearing.py

@@ -33,11 +33,13 @@ import pytest
 
 from portfolio_optimiser import okf
 from portfolio_optimiser.verdicts import (
+    ExpeLContextProvider,
     ProposalFeatures,
     PromotionRefused,
     Verdict,
     bundle_candidate_features,
     promote_verdict,
+    seed_store_from_bundle,
 )
 
 BUNDLE_DIR = Path(__file__).resolve().parents[1] / "shared" / "examples" / "bygg-energi-mikro"
@@ -172,3 +174,87 @@ def test_promoted_signal_stays_out_of_bundle_context(tmp_path) -> None:
     # though it IS present in the bundle (just excluded from context, like the seed verdict):
     assert _MARKER in okf.parse_frontmatter(path)["description"]
     assert path.name in {f.name for f in bundle.verdicts}
+
+
+# --- Test D (S3.2): the promoted verdict carries its OWN structural key --------------------------
+
+
+def test_promoted_verdict_about_another_candidate_keeps_its_own_key(tmp_path) -> None:
+    """S3.2 ROUND-TRIP: a promoted verdict is frequently about a DIFFERENT candidate than the one
+    the target bundle's IR projection describes. ``promote_verdict`` therefore writes the verdict's
+    own structural key, and ``seed_store_from_bundle`` reads it back — so the promoted verdict does
+    not impersonate the bundle candidate in the next run's retrieval.
+
+    RED if ``promote_verdict`` stops writing the three structural fields (the promoted verdict then
+    falls back to the bundle candidate's key and its marker reaches that candidate's prompt)."""
+    bundle_dir = _copy_bundle(tmp_path)
+    other_marker = "realiseringsgrad=0.19"
+    other_candidate = Verdict(
+        id="STEG8-OTHER-CANDIDATE",
+        proposal_features=ProposalFeatures(
+            affected_codes=frozenset({"05.2", "03.1"}),
+            measure_type="Redusert asfalttykkelse",
+            claimed_saving_nok=900000,
+        ),
+        decision="approved",
+        rationale=f"asfalttiltak godkjent med kraftig realiseringskorreksjon ({other_marker})",
+    )
+
+    path = promote_verdict(
+        bundle_dir, other_candidate, approver="persona", experiment="exp-D", timestamp="2026-06-30"
+    )
+
+    fm = okf.parse_frontmatter(path)
+    assert fm["affected_codes"] == "[03.1, 05.2]"  # sorted -> deterministic bytes
+    assert fm["measure_type"] == "Redusert asfalttykkelse"
+    assert fm["claimed_saving_nok"] == "900000"
+
+    # The round trip: the next run's seed keys it on ITS candidate, so it does not surface for the
+    # bundle's own (LED) candidate.
+    store = seed_store_from_bundle(bundle_dir)
+    query = bundle_candidate_features(bundle_dir)
+    fewshot = ExpeLContextProvider(store, query, k=1).format_fewshot()
+    assert other_marker not in fewshot, (
+        "a promoted verdict about a different candidate reached this candidate's hypothesis "
+        "prompt — the promoted file is not carrying its own structural key:\n" + fewshot
+    )
+    # Keyed on the promoted candidate's STRUCTURAL fields (``description`` is surface text, outside
+    # both the similarity score and the minted id — the seeder fills it from ``measure_type``).
+    keys = {
+        (v.proposal_features.affected_codes, v.proposal_features.measure_type)
+        for v in store.verdicts
+    }
+    assert (frozenset({"05.2", "03.1"}), "Redusert asfalttykkelse") in keys, (
+        f"the promoted verdict was seeded with the wrong structural key; got {keys}"
+    )
+
+
+def test_promotion_round_trip_preserves_the_key_for_the_bundles_own_candidate(tmp_path) -> None:
+    """S3.2 IDENTITY: promoting a verdict about the bundle's OWN candidate must re-seed to exactly
+    the key the pre-S3.2 fallback produced — same codes, same measure, same magnitude TYPE.
+
+    Otherwise a candidate's learning signal splits across two keys over time (the promoted verdicts
+    under one, the hand-authored seeds under the fallback), and neither retrieves the other. The
+    magnitude is asserted on its exact value AND type because ``_mint_id`` hashes the raw value:
+    ``30000`` and ``30000.0`` are different ids."""
+    bundle_dir = _copy_bundle(tmp_path)
+    candidate = bundle_candidate_features(bundle_dir)
+    promote_verdict(
+        bundle_dir,
+        _approved_verdict(bundle_dir),
+        approver="persona",
+        experiment="exp-E",
+        timestamp="2026-06-30",
+    )
+
+    promoted = [v for v in seed_store_from_bundle(bundle_dir).verdicts if _MARKER in v.rationale]
+    assert len(promoted) == 1, f"expected exactly the promoted verdict, got {len(promoted)}"
+    seeded = promoted[0].proposal_features
+
+    assert seeded.affected_codes == candidate.affected_codes
+    assert seeded.measure_type == candidate.measure_type
+    assert seeded.claimed_saving_nok == candidate.claimed_saving_nok
+    assert type(seeded.claimed_saving_nok) is type(candidate.claimed_saving_nok), (
+        f"magnitude type changed across the round trip: {seeded.claimed_saving_nok!r} vs "
+        f"{candidate.claimed_saving_nok!r} — _mint_id hashes the raw value, so this splits the id"
+    )