test(catalog): flip red-nested-key -> green-nested-key (okr's checker converged)

okr closed patch-lane #2 (commit 35a0bb8): scripts/okf-check.mjs now reads
type: at root level only, so a type nested only in a sources[] entry no
longer passes as typed. Both implementations now agree the fixture's
concept is untyped, so the manifest's own note2 prediction ("flips to
'agree' only if okr scopes the checker's reader without touching inject")
has come true. Renamed the fixture (manifest key + corpus directory) to
match the red-*/green-* naming convention the parity unit test enforces,
and updated okf-frontmatter.mjs's header comment to match.

check-okf-parity.mjs: 10/10 fixtures pass. Full suite: 120/120.

scripts/okf-frontmatter.mjs

@@ -7,12 +7,13 @@
 // two have diverged and are no longer byte-identical (parity is the parity-gate's job,
 // not this file's).
 //
-// SECOND, DELIBERATE DIVERGENCE (2026-08-01): the key is anchored at column 0 here, while
-// okr keeps `^\s*key:`. That is not okr lagging — their reader is SHARED, and the nested
-// match is load-bearing for their injector (lib/frontmatter.mjs:7-9 -> inject:69). A
-// conformance checker needs the opposite: §4.1's keys are top-level, and `sources[]`
-// entries carry their own `resource`/`title`/`type`. Pinned as parity fixture
-// `red-nested-key`.
+// SECOND DIVERGENCE, NOW CLOSED ON OKR'S CHECKER SIDE (2026-08-01, converged 2026-08-09):
+// the key is anchored at column 0 here. okr's shared reader (lib/frontmatter.mjs) still
+// keeps `^\s*key:` — that lookup remains load-bearing for their injector
+// (lib/frontmatter.mjs:7-9 -> inject:69) — but okr's patch-lane #2 (commit 35a0bb8) scoped
+// their CHECKER's caller (okf-check.mjs) to root-level fields only, so the two checkers now
+// agree: §4.1's keys are top-level, and `sources[]` entries carry their own
+// `resource`/`title`/`type`. Pinned as parity fixture `green-nested-key`.
 
 const FM_RE = /^---\n([\s\S]*?)\n---/;
 

test/okf-parity-corpus/manifest.json

@@ -32,11 +32,11 @@
       "note": "Root index.md carries a layout snapshot (kb-layout-2026-06) in okf_version instead of the upstream version -> catalog enforces the §3 shape rule and FAILs, okr still pure-echoes the value and passes (their CHANGELOG 1.8.1: 'verdiene valideres fortsatt ikke'). Otherwise clean, so the divergence isolates the marker axis. EXPECTED TO FLIP TO 'agree' once okr mirrors the enforcement — this expectation encodes okr's lag, not a permanent design split.",
       "note2": "This axis was invisible until the parity signature carried the shape VERDICT: comparing the okf_version value alone reads 'agree' precisely when the impls disagree about whether that value is acceptable."
     },
-    "red-nested-key": {
+    "green-nested-key": {
       "axis": "key-scope",
-      "expected": "diverge",
-      "note": "A concept with NO top-level `type:` whose only `type:` sits in a block-form `sources[]` entry -> catalog anchors the key at column 0 (okf-frontmatter.mjs, 2026-08-01) and reports it untyped + FAILs; okr's `^\\s*key:` reads the nested entry and passes it as typed. §4.1 makes `type` the only always-required field, and SPEC.md:467-469 names top-level `resource` and `sources[].resource` as DISTINCT fields, so the nested match is a false negative on the required axis.",
-      "note2": "NOT symmetrical with the other red fixtures: okr's nested lookup is DELIBERATE and load-bearing for their injector (lib/frontmatter.mjs:7-9 -> inject:69). The shared module has one caller that needs nested and one (scripts/okf-check.mjs:101) that must not — so this expectation encodes a real design split, not merely okr's lag. Flips to 'agree' only if okr scopes the checker's reader without touching inject."
+      "expected": "agree",
+      "note": "A concept with NO top-level `type:` whose only `type:` sits in a block-form `sources[]` entry -> catalog anchors the key at column 0 (okf-frontmatter.mjs, 2026-08-01) and reports it untyped + FAILs. okr's `scripts/okf-check.mjs` used to read the nested `sources[].type` via a `^\\s*key:` scan and pass it as typed; okr's patch-lane #2 (commit 35a0bb8) scoped the CHECKER's reader to root-level fields only, so it now agrees with catalog that the file is untyped. §4.1 makes `type` the only always-required field, and SPEC.md:467-469 names top-level `resource` and `sources[].resource` as DISTINCT fields — the nested match was a false negative on the required axis; that false negative is now closed on okr's side.",
+      "note2": "The nested-tolerant reader still exists in okr's shared `lib/frontmatter.mjs` and stays load-bearing for their injector (inject:69) — patch-lane #2 scoped only the CHECKER's caller (okf-check.mjs:101), exactly the split this fixture's prior note predicted as the only path to 'agree'. Flips back to 'diverge' only if okr's injector-side nested lookup ever leaks into the checker again."
     },
     "green-hierarchical": {
       "axis": "tree-hierarchical",