feat(validator): anchor the deterministic gate to the project's real cost baseline (S4.0)

Every stage of validate_proposal reasoned only about numbers the proposal itself
supplied, so an internally-consistent hallucination cleared the whole gate (F3).
A new stage 0 reconciles each affected_item against the project's CostBaseline
before the CBC solve: an unknown cost code is rejected, and a real code carrying
a quantity/unit_cost outside the configured tolerance (5% default, relative to
the baseline value) is rejected. Validation, never repair.

The baseline argument is OPTIONAL (None = pre-S4.0 behaviour), but both run
paths set it: the road path projects project.cost_items, the bundle path loads
cost-baseline.json when the bundle ships one. Bundles written before the
amendment stay un-anchored, so the commons-owned goldens run byte-identically;
a baseline that exists but is malformed still raises on both loaders.

F8: the method-specific cap now comes from the METHOD_CAPS registry (measure
type -> fraction, injectable) instead of an energy_efficiency string comparison.

The baseline format and tolerance semantics were decided locally — the commons
amendment (D-A pt. 2) never arrived, exactly as in S3.2. D7 mirroring stays open.

Three portfolio fixtures quoted cost codes belonging to OTHER projects; the new
gate caught them. They now quote each project's own lines, and the two copied
REPLIES tables import the single source instead of drifting from it.

Load-bearing measured (tests/test_s40_cost_baseline_loadbearing.py), six
mutations all red: detach the reconciliation stage; detach the magnitude
tolerance; detach the road wiring; detach the bundle wiring; ignore the injected
cap registry; make the optional loader tolerant of malformed content. Control:
with the road wiring detached the repaired portfolio fixtures still pass, so
they are not masking the seam. 597 -> 612 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JdwK7bQ4BZkWH4t8MRDKb4

README.md

@@ -71,7 +71,9 @@ One run, one project, eight steps — with the learning loop closing across runs
 2. **Hypothesise** — one typed candidate measure (strict IR, fail-fast schema).
 3. **Debate** — a maker-checker pair argues the reasoning (round-capped).
 4. **Validate** — two falsifiers on the same candidate: the **deterministic validator** gates
-   the numbers (blocking, never optional) and the **checker** gates the reasoning.
+   the numbers (blocking, never optional) and the **checker** gates the reasoning. The validator
+   is anchored to the project's declared cost baseline, so a proposal cannot invent the cost
+   lines it claims to save against.
 5. **Refine** — a rejected attempt retries *informed* by the rejection reason, under hard
    attempt and token caps. Unbounded loops are forbidden everywhere.
 6. **Propose or discard** — a validated proposal with risk percentiles, or a typed rejection.
@@ -149,6 +151,18 @@ when the seam is detached, so the loop cannot silently degrade into theater.
   the merge would produce a key belonging to neither. `promote_verdict` writes all three, so a
   promoted verdict about one candidate never surfaces for another.
 
+  A bundle may also ship a **`cost-baseline.json`** — the project's actual cost lines,
+  `{code: {quantity, unit_cost}}` — and when it does, the deterministic validator reconciles every
+  affected item of a proposal against it before anything else runs. A cost code the project does not
+  have is rejected, and so is a real code carrying a quantity or unit cost outside the configured
+  tolerance (5% by default, relative to the baseline value). Without it, every stage of the gate
+  reasons only about numbers the proposal supplied itself, so an internally consistent hallucination
+  passes. The reconciliation validates; it never repairs a proposal into the baseline. A bundle that
+  ships no baseline is simply un-anchored and runs exactly as before, while a baseline that is
+  present but malformed is an error rather than a silent fall-back to un-anchored. On the
+  reference-domain (non-bundle) path the project's own cost items are the baseline, so those runs
+  are always anchored.
+
   The **prior-verdict fold — the learning step — happens only on the `--bundle-dir` path**; a
   plain `--docs-dir`-only run is single-shot (no fold). `--decision`/`--rationale` apply to the
   single-project path only and are inert in portfolio mode. **`--outbox-dir` must differ from