feat(validator): anchor the deterministic gate to the project's real cost baseline (S4.0)

Every stage of validate_proposal reasoned only about numbers the proposal itself
supplied, so an internally-consistent hallucination cleared the whole gate (F3).
A new stage 0 reconciles each affected_item against the project's CostBaseline
before the CBC solve: an unknown cost code is rejected, and a real code carrying
a quantity/unit_cost outside the configured tolerance (5% default, relative to
the baseline value) is rejected. Validation, never repair.

The baseline argument is OPTIONAL (None = pre-S4.0 behaviour), but both run
paths set it: the road path projects project.cost_items, the bundle path loads
cost-baseline.json when the bundle ships one. Bundles written before the
amendment stay un-anchored, so the commons-owned goldens run byte-identically;
a baseline that exists but is malformed still raises on both loaders.

F8: the method-specific cap now comes from the METHOD_CAPS registry (measure
type -> fraction, injectable) instead of an energy_efficiency string comparison.

The baseline format and tolerance semantics were decided locally — the commons
amendment (D-A pt. 2) never arrived, exactly as in S3.2. D7 mirroring stays open.

Three portfolio fixtures quoted cost codes belonging to OTHER projects; the new
gate caught them. They now quote each project's own lines, and the two copied
REPLIES tables import the single source instead of drifting from it.

Load-bearing measured (tests/test_s40_cost_baseline_loadbearing.py), six
mutations all red: detach the reconciliation stage; detach the magnitude
tolerance; detach the road wiring; detach the bundle wiring; ignore the injected
cap registry; make the optional loader tolerant of malformed content. Control:
with the road wiring detached the repaired portfolio fixtures still pass, so
they are not masking the seam. 597 -> 612 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JdwK7bQ4BZkWH4t8MRDKb4

src/portfolio_optimiser/generate.py

@@ -28,7 +28,7 @@ from agent_framework import BaseChatClient, Message
 from pydantic import ValidationError
 
 from portfolio_optimiser.budget import TokenMeter
-from portfolio_optimiser.ir import SavingsProposal
+from portfolio_optimiser.ir import CostBaseline, SavingsProposal
 from portfolio_optimiser.reference_domain import Project
 from portfolio_optimiser.validator import (
     Rejection,
@@ -110,6 +110,7 @@ async def generate_via_llm(
     meter: TokenMeter,
     *,
     max_attempts: int = 3,
+    baseline: CostBaseline | None = None,
 ) -> ValidatedProposal | Rejection:
     """Async LLM path: non-streaming chat -> parse -> validate, with TWO bounded retry kinds,
     the meter checked in this loop:
@@ -123,7 +124,12 @@ async def generate_via_llm(
 
     The only per-attempt falsifier here is the deterministic validator (the numbers). The
     checker is a run-level, one-shot signal (run.py, before generation); seeding generation
-    with the checker critique is separately scoped and NOT done here. Returns
+    with the checker critique is separately scoped and NOT done here.
+
+    ``baseline`` (S4.0) is handed straight to ``validate_proposal``, so a fabricated cost line is
+    falsified per ATTEMPT like any other rejection — and its reason feeds the next attempt's prompt
+    through the SAME informed-refinement path (Step 5), which is why no new loop appears here.
+    Returns
     ``ValidatedProposal | Rejection``; never a malformed proposal; raises ``BudgetExceeded``
     when the meter cap is crossed."""
 
@@ -146,7 +152,7 @@ async def generate_via_llm(
         # accumulated history (bounded prompt growth).
         messages = _build_messages(project, context, prior_rejection=last)
         candidate = await _fetch_parsed(messages)
-        result = validate_proposal(candidate)
+        result = validate_proposal(candidate, baseline=baseline)
         if isinstance(result, ValidatedProposal):
             return result
         last = result