feat(p21): the PROJECT carries the price, so a run against a road normal can be anchored

Four paid stress rounds ran entirely UN-ANCHORED, all of them, because the one file
loader reads cost-baseline.json out of the BUNDLE and no vegnormal ships one: N100,
N200, N500 and R761 are knowledge, and knowledge carries requirements, never amounts.
The validator's stage 0 -- the one stage that tells an invented cost line from a line
this project actually buys -- was skipped in every single run, so "validated" could not
mean what it says. P20 G1/G2 measured real R761 process numbers (12.11 three times on
Soraasen, 1.1.1 on Lindaas) validating with amounts nobody had anywhere.

--cost-baseline FILE is PM decision (e), taken over the three alternatives P20 wrote
down. A LOADED object, never a path (prepass_payload's rule): the CLI owns the file and
loads it ONCE, so the notice, the stamp and every base of an --across-bundle pass all
descend from one read. ONE parse, two doors -- load_cost_baseline delegates to
load_cost_baseline_file -- while safe_resolve stays on the bundle door alone, because a
project's own schedule is legitimately outside every base. No tolerant twin: this path
exists only because an operator NAMED a file.

DEL B: five anchored context sets, a1-a3 with their line and a4 with none, so stage 0 is
what catches the falsification arm. THE ORDER'S OWN ARM (h) WAS FELLED BY MEASUREMENT:
"no baseline code is a requirement number the base declares" is measured 0 of 4 on the
project-coded sets and 5 of 5 on kontrakt-sorasen -- which is what R761 Prosesskoden IS,
a bill of quantities priced BY process code. The complement keeps both, and the order's
own mutation still bites.

DEL B3: the judge reports anchored (off the run's own stamp), priced per row, and WHICH
falsifier caught the falsification arm.

Load-bearing MEASURED, five mutations all red against the WHOLE suite, green control
1850/5 (from 1809/5, superset, 0 removed), golden byte-unchanged:
A3(i) the flag is read but the baseline is unused (3 red) . A3(ii) only the first base
gets it (1) . A3(iii) report_forbidden drops it (1) . B2(i) a4 gets a line (1, arm (g)
alone) . B2(ii) a code swapped to 12.11 (2, arms (f) and (h)).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/portfolio_optimiser/validator.py

@@ -670,6 +670,42 @@ def validate_proposal(
     return ValidatedProposal(proposal=proposal, p10=p10, p50=p50, p90=p90, nominal_feasible=nominal)
 
 
+#: P21 B3 — which falsifier a ``Rejection`` came from, keyed on the SENTENCES this module writes.
+#:
+#: It lives HERE, next to the wordings, and never in the judge: a second copy of "what a stage 0
+#: refusal looks like" would be free to drift from the sentence the validator actually emits, and
+#: the reader most likely to be misled is the one re-judging a paid run months later (kø-(p)).
+#:
+#: In PIPELINE order, which is also the only order that can be right: ``validate_proposal`` returns
+#: at the FIRST failing stage, so one reason carries violations from exactly one of them.
+_REJECTION_STAGES: Final = (
+    ("stage0-baseline", ("cost baseline (", "tolerance around the baseline ")),
+    ("stage0b-grounding", ("ungrounded identifier ",)),
+    ("stage4-p90", ("exceeds P90 feasible",)),
+    ("stage4b-nominal", ("exceeds the nominal feasible",)),
+    ("stage5-method-cap", ("method cap",)),
+)
+
+
+def rejection_stage(reason: str) -> str:
+    """Which stage of the deterministic gate wrote ``reason`` — ``"other"`` when none did.
+
+    A REPORT, never a gate: nothing branches on the answer, so an unrecognised sentence costs a
+    label and not a verdict. That is why ``"other"`` is an honest answer here and would not be one
+    inside the pipeline.
+
+    The measured reason it exists (P21 B3). Before a project price schedule, the ``must_refuse``
+    arm of every context set fell — when it fell at all — on stage 0b, P7's grounding check, which
+    can only say "this identifier is not in the delivered text". Stage 0 is the one stage that
+    knows what the PROJECT buys, and it was skipped in every paid run measured, because no road
+    normal ships a ``cost-baseline.json``. Saying which stage caught the falsification arm is how a
+    reader can tell an anchored refusal from an un-anchored one that happened to land."""
+    for stage, markers in _REJECTION_STAGES:
+        if any(marker in reason for marker in markers):
+            return stage
+    return "other"
+
+
 def self_repair(
     generate: Callable[[int], SavingsProposal],
     *,