CB-WP-0004 T04: fact registry and make facts-check — DFD gets a gate

Duplicated-fact drift is the fourth error class and the only one with no
executable rule. No positive control catches it (both copies are
internally consistent) and re-derivation does not either (the copy
reproduces whatever it was copied from). It is caught only by reading a
copy against its source, which nothing in the loop required.

facts.toml holds 15 facts and is GENERATED by `make facts-gen` from
cb-cost, dep-weight and rule-coverage. The trap this task named — a
hand-maintained registry that becomes another drifting copy — is closed
by facts-check re-running the instruments and failing when the committed
registry disagrees with them. A stale registry cannot certify stale
artifacts.

An artifact quoting a fact tags it: **$93.15** <!-- fact --> with the key.
17 occurrences across 5 artifacts are now checked.

Falsified before being believed: changing CostAccounting.md line 158 from
$93.15 to $92.87 — the exact historical drift — produced exit 1 naming
the file, the line and the expected value. Tested against the class it
exists to catch, on a real artifact, not only in its self-test.

It then caught a live tag inside its own documentation example in
InnerLoop.md within the hour. Third time a gate has failed on its own
pass's work.

What it does not close is stated rather than implied: 22 untagged literal
copies remain and are reported, not failed. Tagging is opt-in, a number
can legitimately recur, and a gate that fires on coincidence gets routed
around. Naming the uncovered surface beats claiming the class is closed.

InnerLoop single-source-of-fact moves from prose to executable — v1.3.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

specs/CostAccounting.md

@@ -135,7 +135,7 @@ Each row names the command that produces its number, per InnerLoop §Step 4.
 
 | ID | Metric | Target | Instrument |
 |---|---|---|---|
-| **AC-1** | reproduces the pinned CB-WP-0001 total | **$93.15** = $92.03 main + $1.11 subagent | `make cost-pin` |
+| **AC-1** | reproduces the pinned CB-WP-0001 total | **$93.15** = $92.03 main + $1.11 subagent | `make cost-pin` | <!-- fact:pinned_total --><!-- fact:pinned_main --><!-- fact:pinned_subagent -->
 | **AC-2** | reconciliation residual (CA-14) | **$0.00** exactly | same command, `reconciled: ok` line |
 | **AC-3** | unattributed share reported (CA-10) | present, and **32.4%** on the pinned run | `cb-cost --pin fc76445 --by-task` |
 | **AC-4** | composition reported (CA-13) | all five components present | `cb-cost --pin fc76445 --composition` |
@@ -155,7 +155,7 @@ assertion against a fixture whose expected value is known and fails loudly;
 Per InnerLoop §Step 4, the acceptance table is checked against the
 contracts in this same spec:
 
-- AC-1's $93.15 is reachable only if CA-06 holds (both trees enumerated).
+- AC-1's $93.15 is reachable only if CA-06 holds (both trees enumerated). <!-- fact:pinned_total -->
   Under a main-file-only collector the target is unreachable — this is the
   defect the adversarial review caught, where a target of $92.21 would have
   been hit *only* by a broken collector.

specs/InnerLoop.md

@@ -1,7 +1,11 @@
 # The Inner Loop — Assimilate and Surpass
 
-Status: **v1.2** — corrected from CB-WP-0003 (loop hardening) on
-2026-07-31. Changes from v1.1: single source of fact; review targets the
+Status: **v1.3** — corrected from CB-WP-0004 (mechanical work) on
+2026-07-31. Change from v1.2: single source of fact is now executable
+(`make facts-check`, CB-WP-0004 T04), giving the duplicated-fact-drift
+class its first gate.
+
+v1.2 changes from v1.1: single source of fact; review targets the
 harness and states its sampling limit; correction vs retarget; the chaos
 roll's calibration window; the live cost budget. The design goal is now
 stated: **optimize for cheap correction, not for exhaustive prevention.**
@@ -39,7 +43,16 @@ command so re-running is free.
 > acceptance figure had to be chased across three artifacts each time it
 > moved. No positive control catches this — both copies are internally
 > consistent — and re-derivation does not either, because the copy
-> reproduces whatever it was copied from.)* The loop's own optimization target is **agentic efficiency**:
+> reproduces whatever it was copied from.)*
+>
+> **Now executable (v1.3, CB-WP-0004 T04):** `make facts-check`. `facts.toml`
+> is generated from the instruments, never edited; an artifact quoting a
+> registry value tags it `<!-- fact:<key> -->` and the gate fails when the
+> two disagree. Untagged literal copies are reported, not failed — that is
+> the drift surface still uncovered, and naming it is more useful than
+> pretending it is closed.
+
+The loop's own optimization target is **agentic efficiency**:
 every artifact it produces must be small enough to load whole, structured
 enough to act on without interpretation, and falsifiable enough that an
 agent can judge its own work without a human in the iteration.

specs/MetricsAndScenarios.md

@@ -56,7 +56,7 @@ rule 4).
 a rule a scenario claims should also appear in the aggregate source, or
 the claim rests on a tag and nothing else.
 
-Measured 2026-07-31: **49 of 58** claimed rules are named in
+Measured 2026-07-31: **49 of 58** claimed rules are named in <!-- fact:gr_linked --><!-- fact:gr_rules -->
 `games/ground/src/lib.rs`. **Unmet**, target 58. The nine unlinked:
 
 ```text