Fix loadability, and put the deferred analysis where the work is

loop-lint failed: CB-WP-0005 was 401 lines against a ~400 limit, one over,
after the status-vocabulary note. Pushed before checking — my error; the
gate caught it on the next run.

The fix is not a trim. The gate exposed a circular reference I had
created: CB-WP-0005's cancelled tasks held the full analysis while
CB-WP-0006 pointed back at them for detail, so the live workplan deferred
to a cancelled one. The analysis now lives in CB-WP-0006 Phase B next to
the work, and CB-WP-0005 keeps a forward pointer per task. One copy,
single source of fact, and the reference points forward.

CB-WP-0006 T05 and T06 gain the detail that moved: K9's mutation proof and
what its acceptance property actually is, K11's detection clause and
budget attribution, and the D2 correction the reviewer forced — the bundle
is not "a directory of four files" but a change to the runner's data flow,
because scenario.rs creates an EventLog, appends to it and never reads it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/CB-WP-0005-assertion-coverage.md

@@ -244,102 +244,46 @@ downgrade inline, so a reader of the spec cannot reach the old claim.
 > one: *these* task records are superseded, and equivalents live in
 > CB-WP-0006 T05–T07. The work is deferred, not abandoned.
 
-## Phase C — implement what the instruments expose (deferred)
+## Phase C — implement what the instruments expose (cancelled here)
 
-## Task: K9 and K11 — durable log, LogStore port, real conformance suite
+The three tasks below were written in full, then cancelled unstarted. Their
+analysis now lives where the work will happen — **[CB-WP-0006](CB-WP-0006-instrument-the-table.md)
+Phase B** — rather than here, so there is one copy and it is next to the
+code it describes. What each was, and what it became:
+
+## Task: K9 and K11 — durable log, LogStore port, conformance suite
 
 ```task
 id: CB-WP-0005-T04
 status: cancel
-priority: high
 state_hub_task_id: "35876b28-97ac-4379-bb71-72e74c4116d4"
 ```
 
-**K9** currently round-trips a `BTreeMap<String, u8>` with `EventSeq(17)`
-as a literal. Deliver the real property: *snapshot at seq N + events
-N+1..M ≡ genesis fold*, on `GroundState`, hash-compared.
-
-**K11** — append-only, length-prefixed, versioned framing, with a
-truncated tail **detected**. Reimplemented, not assimilated (ADR-0005 §2):
-~100 lines against a format Kafka and EventStore converged on
-independently. Charged to **AM-4a** (shipped runtime, 1.5% headroom) and
-adds no dependency.
-
-**The port** (ADR-0005 §3): a `LogStore` trait with a shared
-`fn conformance<S: LogStore>(…)` driven by an in-memory impl **and** a
-file-backed impl. Retro-fit the same shape to `KernelRng`, whose pair is
-currently exercised by two separate non-shared tests — which is why AM-11
-was never earned.
-
-Negative controls, not optional: truncate by one byte → reject; corrupt
-the length prefix → reject. K11's operative clause is *detection*.
+K9's acceptance property is mutation-proven unasserted; K11 has no durable
+format; AM-11's conformance suite does not exist. → **CB-WP-0006 T05**.
 
 ## Task: K10 — the replay bundle and `--replay`
 
 ```task
 id: CB-WP-0005-T05
 status: cancel
-priority: high
 state_hub_task_id: "8592b6e7-8b83-4b47-b310-90e16a35eb6a"
 ```
 
-INTENT design decision **8 of 10**, unimplemented. `cb-sim` has no flag
-parsing at all, so `--replay` has nowhere to go yet.
+INTENT design decision 8 of 10, unimplemented; four controls required
+verbatim from ADR-0005 §6. → **CB-WP-0006 T06**.
 
-D2 note carried from the review: this is **not** "a directory of four
-files". `scenario.rs` creates an `EventLog`, appends to it and never reads
-it — the one production instantiation of the K11 log is a write-only sink.
-`Pass` carries the *end* state, not an initial snapshot, and failures are a
-formatted `String`, not structured expected-vs-actual. Plumb the log out of
-`execute`, capture an initial snapshot, restructure `RunOutcome::Failed`.
-
-The bundle writer is **dev-only** behind the `scenarios` feature and is
-charged to **AM-4b** (9.4% headroom), not AM-4a.
-
-**Four controls, from ADR-0005 §6, verbatim and all required:**
-
-1. a committed **deliberately-failing fixture** scenario, plus an
-   assertion that bundles produced `> 0` and equals expected failures —
-   all 21 scenarios pass today, so a corpus sweep verifies zero bundles
-   and prints `ok`;
-2. the comparison hash **read out of the bundle**, written by the first
-   process — never recomputed in the second, which is `assert_eq!(h, h)`
-   and the AM-7 defect exactly;
-3. truncate-by-one-byte and corrupt-length-prefix rejection;
-4. a **mutated-seed** control: change the manifest seed and the replay
-   must fail to reproduce. A round-trip that cannot fail proves nothing.
-
-## Task: K14 and K18 — implement, or amend the spec and say why
+## Task: K14 and K18 — implement, or amend the spec
 
 ```task
 id: CB-WP-0005-T06
 status: cancel
-priority: medium
-state_hub_task_id: "774b1c8a-71c1-4e0a-91b1-0247a3e397cf"
+state_hub_task_id: "774b1c8a-3b26-4c4f-a2c8-46cb0b7ba5a7"
 ```
 
-Both are named nowhere in source, and both have an honest second option
-that must be considered rather than assumed away.
-
-**K14** — "one commit window per Select". `CommitWindow` exists, has zero
-non-test users, and `games/ground` does not import it; GROUND collects
-selections in its own aggregate. Either wire GROUND through the runtime
-primitive as K14 requires, **or** amend K14 to describe what the kernel
-actually guarantees and record why the primitive stays. A dead abstraction
-certified by a test that exercises only itself is worse than no
-abstraction — it is an AM-11-shaped claim waiting to be quoted.
-
-**K18** — "Criterion benches driving the same scenario format". The bench
-hardcodes commands in Rust and never touches `ScenarioFile`, and
-`benchmarks/` contains only `baselines/model-prices.toml` against a spec
-that says benches live there. Either drive the bench from scenario files,
-**or** amend K18 and MetricsAndScenarios §3 to match reality.
-
-Whichever way each goes, the outcome is a rule and an implementation that
-agree. Deleting a rule to make a gate green is forbidden; deleting a rule
-*with an argument*, recorded, is a legitimate outcome and the more likely
-one for K18.
-
+`CommitWindow` has zero non-test users; the bench never touches
+`ScenarioFile`. Implement, or amend with a recorded argument. →
+**CB-WP-0006 T07**.
 ## Phase D — measure it, then say what the loop should change
 
 ## Task: control loop — did the numbers get worse, then better?

workplans/CB-WP-0006-instrument-the-table.md

@@ -128,11 +128,11 @@ threshold *after* seeing that movement would be the retarget InnerLoop
 
 ## Phase B — the kernel work inherited from CB-WP-0005
 
-> These three carry their full analysis in
-> [CB-WP-0005](CB-WP-0005-assertion-coverage.md) Phase C, where they were
-> written and then deferred unstarted. They are summarized here; read that
-> file for the detail, the four replay controls, and the D2 correction on
-> what the bundle writer actually requires.
+> These three were written in [CB-WP-0005](CB-WP-0005-assertion-coverage.md)
+> Phase C and cancelled unstarted. Their analysis lives **here**, next to
+> the work — CB-WP-0005 keeps only a forward pointer, so there is one copy.
+> The normative controls are in
+> [ADR-0005](../decisions/ADR-0005-assertion-coverage-and-replay.md) §6.
 
 ## Task: K9 and K11 — durable log, LogStore port, real conformance suite
 
@@ -143,9 +143,20 @@ priority: high
 state_hub_task_id: "2a357dbf-3861-499d-a12e-f7682b7332f6"
 ```
 
-Inherited from CB-WP-0005 T04. K9's acceptance property (snapshot at N +
-events N+1..M ≡ genesis fold) is mutation-proven unasserted; K11 has no
-durable format at all. The `LogStore` port with a shared
+**K9** — the acceptance property is *snapshot at seq N + events N+1..M ≡
+genesis fold*, hash-compared, on `GroundState`. What exists instead is one
+test round-tripping a `BTreeMap<String, u8>` with `EventSeq(17)` as a
+literal: no game aggregate, no events applied, no from-genesis comparison.
+Mutation-proven — making `Snapshot::take` discard its `EventSeq` leaves the
+test green, so the half of K9 that says "+ the EventId it includes" is
+unverified. `Snapshot` has no callers outside its own test.
+
+**K11** — append-only, length-prefixed, versioned framing, with a truncated
+tail **detected**; the operative clause is *detection*, so truncate-by-one-
+byte and corrupt-length-prefix rejection are required, not optional.
+Reimplemented rather than assimilated (ADR-0005 §2): ~100 lines against a
+format Kafka and EventStore converged on independently, adding no
+dependency, charged to **AM-4a** (shipped runtime, 1.5% headroom). The `LogStore` port with a shared
 `fn conformance<S: LogStore>(…)`, retro-fitted to `KernelRng`, is what
 finally earns **AM-11** — currently downgraded to unmet because the pair
 exists and the suite does not.
@@ -162,11 +173,21 @@ priority: high
 state_hub_task_id: "d459444d-41be-40c5-9101-7a8420b42fb6"
 ```
 
-Inherited from CB-WP-0005 T05. INTENT design decision 8 of 10,
-unimplemented. All four controls from ADR-0005 §6 are required verbatim,
-including the two the adversarial reviewer supplied: truncate-by-one-byte
-rejection, and a mutated-seed control so the round-trip is capable of
-failing.
+INTENT design decision 8 of 10, unimplemented. `cb-sim` has no flag
+parsing at all, so `--replay` has nowhere to go yet.
+
+**This is not "a directory of four files"** — the D2 correction the
+adversarial review forced. `scenario.rs` creates an `EventLog`, appends to
+it and never reads it: the one production instantiation of the K11 log is a
+write-only sink. `Pass` carries the *end* state, not an initial snapshot,
+and failures are a formatted `String`, not structured expected-vs-actual.
+Plumb the log out of `execute`, capture an initial snapshot, restructure
+`RunOutcome::Failed`. The writer is **dev-only** behind the `scenarios`
+feature and is charged to **AM-4b** (9.4% headroom), not AM-4a.
+
+All four controls from ADR-0005 §6 are required verbatim, including the two
+the reviewer supplied: truncate-by-one-byte rejection, and a mutated-seed
+control so the round-trip is capable of failing.
 
 Fixing this is also what lets **AM-7's withdrawn `hash-identical`
 clause** be re-earned, since a real replay is what the clause was always