fix(mandate): den TREDJE doera som aapner en base faar sitt eget vitne, og ingen fabrikkert identitet

To funn fra review foer lukking av ordren.

(1) evaluate_mandate_candidates kaller assert_declared_ids_agree, men INGEN
mutasjon beviste det. S7a-3-raden enumererer doerene med vilje ("separat gir
den sin egen mutasjon per doer") fordi en uvitnet kopi kan regrere ALENE mens
de to andre staar groenne. En base hvis konsepter erklaerer to korpus ville
ellers rutet paa reconcile_bundle_id sin fallback og produsert en kandidat
tilskrevet en omstridt identitet. M16 -> 1 roed.

MAALINGEN KORRIGERTE TESTEN: foerste form erklaerte de to id-ene paa
rot-index.md og den ene konseptfila, og sto GROENN - S7a-3 holdt rot-indeksen
UTENFOR enighets-settet med vilje, fordi konsept-slaar-index er en
PRESEDENS-regel: en index i utakt med sine konsepter er fallbacken som taper,
ikke to konsepter som kolliderer. Armen bruker naa TO konseptfiler.

(2) project_id=args.project_id or "" er erstattet av en assert. Unaabar i dag
(required-args-guarden fyrer langt over), men "" ville naadd
derive_cost_baseline og myntet en CostBaseline(project_id="") - en fabrikkert
identitet, som er nettopp formen cost_baseline_anchored er
paakrevd-uten-default for aa forby. Asserten sier det i stedet for en default
som stille er uenig med den.

Load-bearing MAALT paa nytt: 16 mutasjoner, 15 ROEDE mot HELE suiten + groenn
kontroll 1275/5.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/portfolio_optimiser/run.py

@@ -2873,11 +2873,17 @@ def main(argv: list[str] | None = None) -> int:
     if args.proposals_from_mandate:
         assert mandate is not None  # narrowed by the --mandate refusal above
         assert args.bundle_dir is not None  # narrowed by --derive-cost-baseline's requirement
+        # NARROWED, never defaulted. ``args.project_id or ""`` would reach
+        # ``derive_cost_baseline`` and mint a ``CostBaseline(project_id="")`` — a fabricated
+        # identity, which is the shape ``cost_baseline_anchored`` is required-without-default to
+        # forbid. Unreachable today (the required-args guard fires far above), so this is the
+        # assert that says so rather than a default that quietly disagrees with it.
+        assert args.project_id is not None  # narrowed by the required-args guard
         try:
             coverage = evaluate_mandate_candidates(
                 mandate,
                 bundle_dir=args.bundle_dir,
-                project_id=args.project_id or "",
+                project_id=args.project_id,
             )
         except (
             MandateCandidateError,

tests/test_proposal_from_mandate_loadbearing.py

@@ -269,6 +269,48 @@ def _declaring_base(tmp_path: Path, declared: str) -> str:
     return str(root)
 
 
+def test_a_base_whose_concepts_declare_two_corpora_is_refused_at_this_door_too(
+    tmp_path: Path,
+) -> None:
+    """The THIRD door that opens a base gets its own witness (S7a-3 pkt. 1's rule, which enumerates
+    ``run_project`` and ``read_bundle`` separately for exactly this reason: "separat gir den sin
+    egen mutasjon per dør").
+
+    Without the check the base would route on ``reconcile_bundle_id``'s own precedence and produce a
+    candidate attributed to a contested identity — the defect the agreement gate exists to stop, and
+    an unwitnessed call here would let this door regress alone while the other two stayed green.
+
+    TWO CONCEPT files, never a concept disagreeing with the root ``index.md``: S7a-3 kept the root
+    index OUT of the agreement set deliberately (concept-beats-index is a PRECEDENCE rule, so an
+    index out of step with its concepts is the fallback losing, not a collision). A first version of
+    this arm declared the two ids on the index and the one concept and stayed green for exactly that
+    reason — the measurement corrected the test."""
+    import shutil
+
+    root = tmp_path / "two-corpora"
+    shutil.copytree(_PRICED, root)
+    schedule = root / "prisskjema-SYNTETISK.md"
+    schedule.write_text(
+        schedule.read_text(encoding="utf-8").replace(
+            "---\ntype:", "---\nbundle_id: corpus-a\ntype:", 1
+        ),
+        encoding="utf-8",
+    )
+    (root / "notat.md").write_text(
+        '---\nbundle_id: corpus-b\ntype: document\ntitle: "Notat"\n---\n\nEt notat.\n',
+        encoding="utf-8",
+    )
+    index = root / "index.md"
+    index.write_text(
+        index.read_text(encoding="utf-8") + "\nOgsaa [notat](notat.md).\n", encoding="utf-8"
+    )
+
+    with pytest.raises(okf.BundleIdMismatch):
+        run.evaluate_mandate_candidates(
+            _mandate(_approach()), bundle_dir=str(root), project_id=_PROJECT
+        )
+
+
 def test_routing_follows_the_declared_id_and_refuses_the_mount_name(tmp_path: Path) -> None:
     """Routing is not re-implemented here: ``route_by_bundle`` is called with the base's DECLARED id
     (S7a-3 pkt. 1), so a base delivered under a directory name of its own routes as ITSELF.