feat(okf): one bundle-id rule, reconciled against the mount and origin-marked

[skip-docs] — the invariant row for this plan lands in Step 13, where the mutations
that force it have been measured. Documenting a seam before its measurement is
the claim-without-evidence class this repo writes rows against.

Co-Authored-By: Claude <claude-opus-5>

src/portfolio_optimiser/run.py

@@ -658,6 +658,10 @@ async def run_project(
     #     before the amendment (every commons-owned golden) is legitimately un-anchored -> None =
     #     pre-S4.0 behaviour. A baseline that exists but is malformed still raises (fail-closed).
     if bundle_dir is not None:
+        # ONE bundle-id rule (Step 10): the base is reconciled against the mount it was opened
+        # from, HERE rather than in ``explore._bundle_index``, which stays pure and does no I/O.
+        # A base that declares an id its mount does not carry is refused before anything is spent.
+        okf.reconcile_bundle_id(bundle_dir)
         bundle = okf.navigate_bundle(bundle_dir)
         project = _project_from_bundle(bundle_dir, project_id, bundle=bundle)
         baseline = okf.load_optional_cost_baseline(bundle_dir)
@@ -1511,7 +1515,11 @@ async def run_mandate_across_bundles(
     """
     by_id: dict[str, str] = {}
     for raw in bundle_dirs:
-        bundle_id = Path(raw).name
+        # The ONE derivation rule (Step 10) — this used to be a second private copy of
+        # ``Path(raw).name``, free to drift from ``explore``'s. The REFUSAL below stays local:
+        # ``MandateRoutingError`` is this door's class, ``ExplorationError`` is explore's, and
+        # unifying the derivation is not the same as unifying the two doors' error vocabularies.
+        bundle_id = okf.reconcile_bundle_id(raw).id
         if bundle_id in by_id:
             # The same refusal ``explore._bundle_index`` makes, for the same reason: the id is how
             # the mandate names a base, so two bases answering to one name would let an approach be