CB-WP-0005 T01: spec->code link over every numbered spec and every crate

AGGREGATE becomes a list of source roots and rule patterns become
per-spec, so the link runs over every numbered spec x every crate rather
than GroundRules.md x games/ground/src/lib.rs.

The prediction held on the first run:

  AM-1b kernel spec->code link: 15/18 (83%) across 10 source files
    unlinked: K10 K14 K18

Kernel rules are link-only by design, and the output says so: they are
kernel invariants with no aggregate, setup preset or command vocabulary,
so scenarios/kernel/*.yaml with covers: [K11] would be a tag in a
directory the runner cannot dispatch. Claiming scenario coverage for them
is the inflation this gate exists to prevent.

Per ADR-0005 §5 the kernel arm reports without feeding the exit code
until 2026-08-31, then binds — the date in the tool, not in prose, with
days remaining printed every run, because open-ended "gate it later" is
how AM-4's targets went unratified for four workplans. The self-test
asserts the gate returns 0 before that date and 2 after.

The zero-rules positive control is replicated on the new denominator: a
kernel regex that stops matching aborts rather than printing 0/0 as
though it were 100%.

The self-test passed while the tool was completely broken. A print(
inside say() became say(), so every real `make coverage` died with
RecursionError while --self-test reported all-ok — it only ever called
kernel_arm(quiet=True) and never executed the reporting path. The control
named the behaviour and did not assert it, which is precisely what this
workplan is about. Fixed by exercising the loud path and asserting it
prints, then verified by re-breaking say() and confirming both new checks
go red. Seventh instance of the harness-does-nothing shape, in the tool
written to find that shape.

Also caught by its own gate: a self-test label that printed "0 K-ids"
beside a passing ">5" assertion, because the detail string rebuilt the
pattern with different escaping. A label that contradicts its own check
is worse than no label.

k_rules, k_linked and k_unlinked are registered facts under facts-check.
A limit of that checker is recorded rather than patched: it is
line-based, so a tagged value that prose-wraps fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/CB-WP-0005-assertion-coverage.md

@@ -66,6 +66,42 @@ output:
 **Refuted if** any numbered rule in any spec is still unnamed in source
 after the pass and the tool does not say so.
 
+**Delivered, and the prediction held on the first run:**
+
+```text
+AM-1b kernel spec->code link: 15/18 (83%) K-rules named across 10 source files
+  NOTE: link only — K-rules are kernel invariants with no scenario
+        mechanism; and this counts names, not assertions
+  gate: reporting only for 31 more day(s), binds 2026-08-31 (ADR-0005 §5)
+  unlinked (declared in the spec, named nowhere in source):
+    K10 K14 K18
+```
+
+`AGGREGATE` is now a list of source roots, rule patterns are per-spec, and
+the link runs over every numbered spec × every crate. The binding date
+lives in the tool and the days remaining are printed every run. The
+kernel figures (`k_rules`, `k_linked`, `k_unlinked`) are registered facts,
+so they are under `make facts-check` from the day they first exist rather
+than after they drift.
+
+**The self-test passed while the tool was completely broken.** A
+`print(` inside `say()` was rewritten to `say(`, so every real
+`make coverage` died with `RecursionError` — while `--self-test` reported
+all-ok, because it only ever called `kernel_arm(quiet=True)` and never
+executed the reporting path.
+
+That is this task's own thesis in miniature: **the control named the
+behaviour and did not assert it.** Fixed by exercising the loud path under
+`redirect_stdout` and asserting it prints, and verified by re-breaking
+`say()` and confirming the two new checks go red. Seventh instance of the
+harness-does-nothing shape, found in the tool written to find that shape.
+
+**A limit of `facts-check` surfaced here and is recorded, not patched:**
+the check is line-based, so a tagged value that prose-wraps onto the next
+line fails. It cost three edits to place two tags. Reported for T07 —
+either the checker spans a paragraph, or the rule is stated as
+"tagged values must not wrap".
+
 ## Task: M-D1-MUT — one mutation per acceptance row
 
 ```task