feat(ms-ai-architect): R21 — Status-backfill på 14 advisor-ref-filer (redusert scope etter premiss-korreksjon) [skip-docs]

Manifest-drevet applier (scripts/kb-update/backfill-status.mjs) over den testede
insertMetaField-primitiven + ny ren regel statusForFile (filnavn-token → Reference/
Established Practice, operatør-godkjent vokabular). 7 Reference + 7 Established Practice.
Hard per-fil-invariant (én linje, body byte-identisk), idempotent, isMain-guard. 7 tester.

Premiss-korreksjon (auditHeaders, ground-truth 2026-07-06): ekte not-due-restanse er
21 Status + 26 Last-updated (STATE sa 21/22). «0 har norsk dato» var falskt — 21/26
Last-updated-gap bærer allerede Sist oppdatert/Dato → relabel-residual; 5 datoløse gir
«i dag» ved naiv git → utsatt. 4 dual-header ai-act-*-filer med plain-text «Status: GA»
fanget i diff-inspeksjon → revertert (unngår duplikat/motsigelse) → residual (samme
plain-blokk ga R20 duplikat Category). Korrigert residual logget i roadmap §R21.

Verifisering: test-backfill-status 7/7; git diff +14/-0 (kun Status-linjer, body
byte-identisk); not-due Status-missing 21→3; full suite 771/771 exit 0.

scripts/kb-update/backfill-status.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// Backfill **Status:** on the 14 English-dialect advisor reference files that carry NO
+// status label (R21 — base-field pre-pass del 2, ⊥ R7).
+//
+// Ground truth 2026-07-06 (premiss-verified): of the not-due (146) corpus, 21 files lack a
+// bold **Status:**. Of those, 3 are Norwegian-dialect (an English Status would mix dialects)
+// and 4 (ms-ai-governance/responsible-ai/ai-act-*) carry a PLAIN-TEXT `Status: GA` in a second
+// dual-header block that the bold-only regex does not see — inserting a bold **Status:** there
+// duplicates/contradicts it. All 7 (3 + 4) are DEFERRED to the decision-b dialect/dual-header
+// residual (the same plain block is why R20 duplicated **Category:** on those 4). The clean
+// remainder is 14 advisor/architecture files. All 26 not-due Last-updated gaps are also deferred
+// (21 already carry a Norwegian date → relabel; 5 are git-unreliable post-R20-churn). This
+// applier writes ONLY those 14 Status lines — never a date, never into a Norwegian/dual-header file.
+//
+// Value rule (operator-approved vocabulary, 2026-07-06): statusForFile() — a filename-token
+// map within {Reference, Established Practice}. Reuses the tested insertMetaField primitive,
+// with a hard per-file invariant asserted BEFORE any write (exactly one line inserted, it is
+// the Status line, body byte-identical). Idempotent: a file already carrying **Status:** is
+// skipped, so a re-run is a no-op. Aborts and writes nothing on any drift or invariant breach.
+//
+// Usage:  node scripts/kb-update/backfill-status.mjs [--dry]
+import { readFileSync, writeFileSync, existsSync, realpathSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { insertMetaField } from './lib/transform.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PLUGIN_ROOT = join(__dirname, '..', '..');
+
+export const ALLOWED_STATUS = ['Reference', 'Established Practice'];
+
+// Status label is absent in the header region ⇒ the file needs backfilling. Mirrors
+// audit-corpus-headers.mjs RE_STATUS (the same guard the header audit reads).
+const RE_STATUS = /\*\*Status:\*\*\s*\S/i;
+
+/**
+ * Deterministic descriptive-class rule for a not-due reference file (pure).
+ * Reusable artifacts (templates, lookup matrices, benchmark tables, registers) are a
+ * `Reference`; methodology / patterns / checklists / obligation guides are `Established
+ * Practice`. Keys on the BASENAME only, so an ancestor folder token never flips a file.
+ * @param {string} relOrBase — plugin-relative path or bare basename
+ * @returns {'Reference'|'Established Practice'}
+ */
+export function statusForFile(relOrBase) {
+  const base = basename(String(relOrBase ?? ''));
+  return /(?:template|matrix|benchmarks|register)/i.test(base) ? 'Reference' : 'Established Practice';
+}
+
+// Frozen manifest — the 18 scope-confirmed targets (not-due ∩ missing-**Status:** ∩
+// English-dialect), verified against ground truth 2026-07-06. Each value is derived by
+// statusForFile() and re-asserted below, so the manifest can never drift from the rule.
+const TARGET_PATHS = [
+  'skills/ms-ai-advisor/references/architecture/adr-template.md',
+  'skills/ms-ai-advisor/references/architecture/ai-utredning-template.md',
+  'skills/ms-ai-advisor/references/architecture/alternativanalyse-methodology.md',
+  'skills/ms-ai-advisor/references/architecture/capacity-feasibility-benchmarks.md',
+  'skills/ms-ai-advisor/references/architecture/cost-models.md',
+  'skills/ms-ai-advisor/references/architecture/decision-trees.md',
+  'skills/ms-ai-advisor/references/architecture/diagram-prompt-templates.md',
+  'skills/ms-ai-advisor/references/architecture/licensing-matrix.md',
+  'skills/ms-ai-advisor/references/architecture/migration-patterns.md',
+  'skills/ms-ai-advisor/references/architecture/poc-template.md',
+  'skills/ms-ai-advisor/references/architecture/public-sector-checklist.md',
+  'skills/ms-ai-advisor/references/architecture/regional-availability-verification.md',
+  'skills/ms-ai-advisor/references/architecture/security.md',
+  'skills/ms-ai-advisor/references/architecture/source-traceability-assumption-register.md',
+];
+export const MANIFEST = TARGET_PATHS.map((path) => ({ path, status: statusForFile(path) }));
+
+function run({ dry }) {
+  const planned = [];
+  const skipped = [];
+  const missing = [];
+
+  for (const { path: rel, status } of MANIFEST) {
+    if (!ALLOWED_STATUS.includes(status)) throw new Error(`ABORT ${rel}: status '${status}' not in allowed set`);
+    if (status !== statusForFile(rel)) throw new Error(`ABORT ${rel}: manifest/rule mismatch`);
+    const abs = join(PLUGIN_ROOT, rel);
+    if (!existsSync(abs)) { missing.push(rel); continue; }
+    const old = readFileSync(abs, 'utf8');
+    if (RE_STATUS.test(old.slice(0, 500))) { skipped.push(rel); continue; } // idempotent
+
+    const out = insertMetaField(old, 'Status', status);
+    // Hard invariant: exactly one line inserted (the Status line), body byte-identical.
+    const o = old.split('\n');
+    const n = out.split('\n');
+    if (n.length !== o.length + 1) throw new Error(`ABORT ${rel}: not exactly one line inserted`);
+    let d = 0;
+    while (d < o.length && o[d] === n[d]) d++;
+    if (n[d] !== `**Status:** ${status}`) throw new Error(`ABORT ${rel}: inserted line mismatch → ${JSON.stringify(n[d])}`);
+    if (o.slice(d).join('\n') !== n.slice(d + 1).join('\n')) throw new Error(`ABORT ${rel}: body not byte-identical below the insertion`);
+    planned.push({ rel, status, out });
+  }
+
+  if (missing.length) {
+    console.error(`ABORT — ${missing.length} manifest target(s) not found (corpus drift):`);
+    missing.forEach((m) => console.error('  ' + m));
+    process.exit(1);
+  }
+  if (planned.length + skipped.length !== MANIFEST.length) {
+    throw new Error(`ABORT — accounted ${planned.length + skipped.length} ≠ manifest ${MANIFEST.length}`);
+  }
+
+  const byStatus = {};
+  for (const p of planned) byStatus[p.status] = (byStatus[p.status] || 0) + 1;
+  console.log(`Manifest: ${MANIFEST.length} | to insert: ${planned.length} | already present (skipped): ${skipped.length}`);
+  for (const [s, n] of Object.entries(byStatus).sort()) console.log(`  ${n}  Status: ${s}`);
+
+  if (dry) {
+    console.log('\n(dry run — no writes)');
+    for (const p of planned) console.log(`  + ${p.rel}  →  **Status:** ${p.status}`);
+    return;
+  }
+  for (const p of planned) writeFileSync(join(PLUGIN_ROOT, p.rel), p.out);
+  console.log(`\nWrote ${planned.length} files.`);
+}
+
+const isMain = (() => {
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+})();
+if (isMain) run({ dry: process.argv.includes('--dry') });