test(okf): lock link_in_index success-path byte/order preservation + honest shared_root claim

pkt.2 — coverage gap (green-but-dead): link_in_index preserves the existing
index byte-for-byte and in order on the SUCCESS path by construction, but
nothing asserted it. Byte-equality was checked only on the REFUSAL path
(test_step8_promotion_loadbearing.py Test A); other tests check mere line
MEMBERSHIP. A writer that kept every link but reordered/rewrote the existing
body would pass the whole suite — the exact ingest-spec §6 / Step-8 promotion
invariant we rely on (promoted verdict links survive re-ingest byte-for-byte).
New test uses deliberately non-sorted existing links; proven load-bearing (a
temporary `sorted()` reorder mutation flips it RED, then reverted). Test-only,
no production change.

pkt.4 — shared_root.py docstring overclaimed "Every MAF-side consumer resolves
through this ONE seam". Verified: both runtime consumers (persona, simulation)
do route through shared_root(); the 15 test modules hardcode the in-repo
fixture path deliberately (a test needing the real fixture must not be
redirected by a production env var). Scoped the claim to "runtime consumer"
rather than churning 15 test files to make a false claim true.

Full suite 415 passed, ruff + mypy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HVHLJuwBzp7MXkrUXJYARS

src/portfolio_optimiser/shared_root.py

@@ -1,8 +1,10 @@
 """Resolver for the location of the shared framework-neutral core (S3, R1-forberedelse).
 
 ``shared/`` is today an in-repo directory, but is slated for extraction into its own commons repo
-(R1/S4). Every MAF-side consumer resolves its location through this ONE seam so the extraction is
-a re-point (env var), not a code change. Pure stdlib — the shared core itself stays framework-free.
+(R1/S4). Every MAF-side runtime consumer (``persona``, ``simulation``) resolves its location through
+this ONE seam so the extraction is a re-point (env var), not a code change. Test fixtures pointing at
+the real in-repo bundle hardcode the path deliberately — they must not be redirected by a production
+env var. Pure stdlib — the shared core itself stays framework-free.
 """
 
 from __future__ import annotations

tests/test_okf.py

@@ -246,6 +246,25 @@ def test_link_in_index_is_idempotent(tmp_path) -> None:
     assert body.count("(promoted-verdict-x.md)") == 1
 
 
+def test_link_in_index_success_preserves_existing_bytes_and_order(tmp_path) -> None:
+    """LOAD-BEARING (ingest-spec §6 byte-preservation, Step-8 promotion invariant): on the SUCCESS
+    path (a link IS added), ``link_in_index`` preserves the pre-existing index byte-for-byte AND in
+    order, appending ONLY the new bullet. Existing coverage asserts byte-equality solely on the
+    REFUSAL path (``test_step8_promotion_loadbearing.py`` Test A) and mere line MEMBERSHIP elsewhere,
+    so a writer that kept every link but reordered/rewrote the existing body would pass the whole
+    suite. The existing links are deliberately NON-sorted so a reordering mutation (e.g. ``sorted``)
+    flips this RED."""
+    original = (
+        "---\ntype: index\n---\n\n# Bundle\n\n"
+        "- [zeta](zeta.md)\n- [alpha](alpha.md)\n- [mid](mid.md)\n"
+    )
+    (tmp_path / "index.md").write_text(original, encoding="utf-8")
+    added = okf.link_in_index(str(tmp_path), "promoted-verdict-x.md", "Promotert")
+    assert added is True
+    result = (tmp_path / "index.md").read_text(encoding="utf-8")
+    assert result == original + "- [Promotert](promoted-verdict-x.md)\n"
+
+
 @pytest.mark.parametrize("module_name", _MAF_FREE_MODULES)
 def test_okf_is_maf_free(module_name: str) -> None:
     """D7 portability: each framework-neutral module IMPORTS no ``agent_framework`` / ``mcp`` (a