docs: multi-base som invariant + den ende-til-ende-sloeyfa som beviser den (ORDRE 20260825T080753Z)

CLAUDE.md-invarianten «Multi-base er en PARTISJON, aldri en videre
run_project-signatur» baerer hele designet: den strukturelle grunnen til at
run_project ikke KAN ta flere bundle_dir (fire enkeltverdier avledet fra DEN
basen), de tre soemmene, hvorfor dispatchen ikke tar project_id, de tolv maalte
mutasjonene, og de fire uttalte aerlighets-grensene - inkludert at CLI-en er
BEVISST uroert (§ C.8 ber om ETT nytt kallsted i run.py, levert i 57; et
repeterbart --bundle-dir er en NY operatoerflate og en egen beslutning).

README faar multi-base-doeren beskrevet der --explore alt er beskrevet, med den
samme nekten uttalt for en leser som ikke leser CLAUDE.md: en hypotese som ikke
navngir noen base blir NEKTET naar flere er konfigurert, aldri rutet til en
gjetning.

T22 er ende-til-ende-vitnet, og det eneste stedet de tre soemmene moetes:
prompt + TO baser -> hypotesiseren former to retninger og navngir hver sin base
-> route_by_bundle partisjonerer -> hver base sin run_project svarer for SIN
hypotese og ingen andres. Assertet paa COVERAGE-radene, ikke paa kall-argumenter,
fordi det er rapporten en fagperson faktisk leser: en approach som havnet i feil
base ville fortsatt sett evaluert ut.

1021 passed / 5 skipped; golden demo-transcript.stdout byte-uendret
(ea8c534773acdbe41ae68f2c55724d69aaf8be4f); mypy/ruff rene.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L3YHobQC3WzYVoxSgZus4d

README.md

@@ -443,6 +443,17 @@ when the seam is detached, so the loop cannot silently degrade into theater.
   The hosted surface takes the same door as `explore_prompt` + `explore_contract` on
   `POST /invocations`.
 
+  **Several knowledge bases (library API).** An exploration may be given more than one base
+  (`explore(..., bundle_dirs=[a, b])`). Each approach it shapes records which base it belongs to
+  (`Approach.bundle_id`), and `run_mandate_across_bundles(mandate, bundle_dirs, ...)` then runs the
+  pipeline **once per base** — the ordinary `run_project`, with that base's own sub-mandate, and
+  with each run's project read from that base's own `validator-input.json`. `run_project` itself
+  still takes one `bundle_dir`, deliberately: it derives the project, the validator's cost
+  baseline, the agents' read context and the retrieval key from the base it is handed, so a second
+  directory on that call would mean silently picking one of them. A hypothesis that names no base
+  is refused when several are configured, rather than routed to a guess. The CLI's `--bundle-dir`
+  stays single-valued; multi-base is a library door today.
+
   `--semantic-retrieval` (S3.1) is an **opt-in** ranking change, **off by default**. Off, prior
   verdicts are ranked exactly as before: a structural score over the affected cost-code set,
   measure type and magnitude bucket, with surface text deliberately excluded. On, that score is