CB-WP-0005 T02: M-D1-MUT — 4 of 14 acceptance rows are enforced

For each acceptance row in GameKernel §5, invert the property and require
the verifying command to go red. adapted:mutation-testing, with the
denominator changed from source lines to acceptance rows.

  M-D1-MUT: 4/14 rows enforced
    PARTIAL       2   (AM-7, AM-8 — some clauses live, some inert)
    unmutatable   8   (no property to invert, reason stated per row)
    SURVIVED      0

Two corrections to our own numbers. There are 14 rows, not the twelve
ADR-0005 and CB-WP-0005 both asserted — AM-4 splits into a/b/c. And the
prediction of 9-of-12 (75%) becomes >=10 of 14; measured 4 (29%), badly
unmet. No target moved in this commit.

The second correction matters more. My first run reported two SURVIVED
rows and both were my own no-op mutations: `pub struct NullRng;` ->
`pub struct NullRng {}` is semantically identical, and renaming
max_age_days does nothing because CA-17 reads it with a default of 90.
Both would have been published as "this row asserts nothing" — a false
accusation against code that is fine. Replaced with real inversions (a
per-construction counter in the ChaCha seed; reverting AC-9's output
resolution to the first-wins bug it was fixed for), after which both go
red. T08 asks whether writing a weak mutation is the new grep. It is,
demonstrably, on the first attempt.

The finding is larger than the workplan assumed. 8 of 14 rows are
unmutatable — AM-2, AM-3, AM-4c, AM-5, AM-6, AM-9, AM-10, AM-11 have no
instrument at all. AM-6 is the sharpest: nothing in the workspace
compares any number to 100,000 events/s, the headline throughput claim.
The problem is not three unimplemented rules, it is that more than half
the acceptance table has nothing behind it.

Harness controls: a stale find-string reports HARNESS-BROKEN rather than
scoring the baseline as the mutant; a red baseline reports inconclusive
rather than red; the tree is restored in a finally and the restoration is
verified. Not in `make all` — it rebuilds the workspace once per row.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -24,7 +24,7 @@ TOOLS := $(REPO)/tools
 # Every cargo recipe runs at the repo root; the shell does not persist cd.
 IN_REPO := cd $(REPO) &&
 
-.PHONY: check test sim bench bench-test coverage dep-weight cost cost-test cost-pin cost-budget cost-mix loop-lint self-tests env-test task-done status facts-check facts-gen loc all
+.PHONY: check test sim bench bench-test coverage dep-weight cost cost-test cost-pin cost-budget cost-mix loop-lint self-tests env-test task-done status facts-check facts-gen mutation-check loc all
 
 ## fmt + clippy (deny warnings) + HashMap deny-lint
 check:
@@ -64,6 +64,7 @@ self-tests:
 	$(PY) $(TOOLS)/task-done.py --self-test
 	$(PY) $(TOOLS)/status.py --self-test
 	$(PY) $(TOOLS)/facts.py --self-test
+	$(PY) $(TOOLS)/mutation-check.py --self-test
 
 # T01 positive control: prove the environment fix, do not assume it. Runs
 # every tool from a foreign working directory with a PATH that has no
@@ -82,6 +83,13 @@ env-test:
 	@$(MAKE) -C $(REPO) coverage >/dev/null \
 	  && echo "  [ok ] make -C <repo> works from any directory"
 
+# M-D1-MUT (CB-WP-0005 T02): invert each acceptance row's property and
+# require the verifying command to go red. Deliberately NOT in `make all`:
+# it rebuilds the workspace once per mutated row. Run it on demand and in
+# CI, not in the inner loop.
+mutation-check:
+	$(PY) $(TOOLS)/mutation-check.py $(ARGS)
+
 # T04: single source of fact (InnerLoop v1.2) — the DFD gate.
 # facts.toml is GENERATED; facts-check fails if it disagrees with the
 # instruments, or if a tagged artifact disagrees with it.