Fix loadability, and put the deferred analysis where the work is

loop-lint failed: CB-WP-0005 was 401 lines against a ~400 limit, one over,
after the status-vocabulary note. Pushed before checking — my error; the
gate caught it on the next run.

The fix is not a trim. The gate exposed a circular reference I had
created: CB-WP-0005's cancelled tasks held the full analysis while
CB-WP-0006 pointed back at them for detail, so the live workplan deferred
to a cancelled one. The analysis now lives in CB-WP-0006 Phase B next to
the work, and CB-WP-0005 keeps a forward pointer per task. One copy,
single source of fact, and the reference points forward.

CB-WP-0006 T05 and T06 gain the detail that moved: K9's mutation proof and
what its acceptance property actually is, K11's detection clause and
budget attribution, and the D2 correction the reviewer forced — the bundle
is not "a directory of four files" but a change to the runner's data flow,
because scenario.rs creates an EventLog, appends to it and never reads it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/CB-WP-0006-instrument-the-table.md

@@ -128,11 +128,11 @@ threshold *after* seeing that movement would be the retarget InnerLoop
 
 ## Phase B — the kernel work inherited from CB-WP-0005
 
-> These three carry their full analysis in
-> [CB-WP-0005](CB-WP-0005-assertion-coverage.md) Phase C, where they were
-> written and then deferred unstarted. They are summarized here; read that
-> file for the detail, the four replay controls, and the D2 correction on
-> what the bundle writer actually requires.
+> These three were written in [CB-WP-0005](CB-WP-0005-assertion-coverage.md)
+> Phase C and cancelled unstarted. Their analysis lives **here**, next to
+> the work — CB-WP-0005 keeps only a forward pointer, so there is one copy.
+> The normative controls are in
+> [ADR-0005](../decisions/ADR-0005-assertion-coverage-and-replay.md) §6.
 
 ## Task: K9 and K11 — durable log, LogStore port, real conformance suite
 
@@ -143,9 +143,20 @@ priority: high
 state_hub_task_id: "2a357dbf-3861-499d-a12e-f7682b7332f6"
 ```
 
-Inherited from CB-WP-0005 T04. K9's acceptance property (snapshot at N +
-events N+1..M ≡ genesis fold) is mutation-proven unasserted; K11 has no
-durable format at all. The `LogStore` port with a shared
+**K9** — the acceptance property is *snapshot at seq N + events N+1..M ≡
+genesis fold*, hash-compared, on `GroundState`. What exists instead is one
+test round-tripping a `BTreeMap<String, u8>` with `EventSeq(17)` as a
+literal: no game aggregate, no events applied, no from-genesis comparison.
+Mutation-proven — making `Snapshot::take` discard its `EventSeq` leaves the
+test green, so the half of K9 that says "+ the EventId it includes" is
+unverified. `Snapshot` has no callers outside its own test.
+
+**K11** — append-only, length-prefixed, versioned framing, with a truncated
+tail **detected**; the operative clause is *detection*, so truncate-by-one-
+byte and corrupt-length-prefix rejection are required, not optional.
+Reimplemented rather than assimilated (ADR-0005 §2): ~100 lines against a
+format Kafka and EventStore converged on independently, adding no
+dependency, charged to **AM-4a** (shipped runtime, 1.5% headroom). The `LogStore` port with a shared
 `fn conformance<S: LogStore>(…)`, retro-fitted to `KernelRng`, is what
 finally earns **AM-11** — currently downgraded to unmet because the pair
 exists and the suite does not.
@@ -162,11 +173,21 @@ priority: high
 state_hub_task_id: "d459444d-41be-40c5-9101-7a8420b42fb6"
 ```
 
-Inherited from CB-WP-0005 T05. INTENT design decision 8 of 10,
-unimplemented. All four controls from ADR-0005 §6 are required verbatim,
-including the two the adversarial reviewer supplied: truncate-by-one-byte
-rejection, and a mutated-seed control so the round-trip is capable of
-failing.
+INTENT design decision 8 of 10, unimplemented. `cb-sim` has no flag
+parsing at all, so `--replay` has nowhere to go yet.
+
+**This is not "a directory of four files"** — the D2 correction the
+adversarial review forced. `scenario.rs` creates an `EventLog`, appends to
+it and never reads it: the one production instantiation of the K11 log is a
+write-only sink. `Pass` carries the *end* state, not an initial snapshot,
+and failures are a formatted `String`, not structured expected-vs-actual.
+Plumb the log out of `execute`, capture an initial snapshot, restructure
+`RunOutcome::Failed`. The writer is **dev-only** behind the `scenarios`
+feature and is charged to **AM-4b** (9.4% headroom), not AM-4a.
+
+All four controls from ADR-0005 §6 are required verbatim, including the two
+the reviewer supplied: truncate-by-one-byte rejection, and a mutated-seed
+control so the round-trip is capable of failing.
 
 Fixing this is also what lets **AM-7's withdrawn `hash-identical`
 clause** be re-earned, since a real replay is what the clause was always