fix(ms-ai-architect): RX-KB1 strip stale plain-Verified pipe-tails (87) + audit-deteksjon [skip-docs]

De 87 referansefilene bar en plain-text `| Verified: <dato>`-hale på **Last updated:**-linjen
i 500B-header-vinduet — usynlig for den bold-only kontrakt-stacken (kb-headers.mjs / audit
RE_VERIFIED), og claimet en verifisering judgen aldri gjorde (samme poison-klasse som de 14
bold **Verified:** MCP Spor 1 fjernet). Uhåndtert springer den også dual-Verified-fellen: R7s
insertVerifiedFields ville stemplet en bold-verdi ved siden av den plain → to motstridende
provenance-claims per fil.

- ny driver strip-stale-verified-pipe.mjs: frosset 87-manifest (18 advisor + 45 eng + 8 gov +
  16 sec), pure verdi-bevarende strip (kun ` | Verified: …`-halen; **Last updated:**-dato
  byte-eksakt), hard per-fil-invariant (linjeantall uendret, body byte-identisk, dato bevart),
  idempotent, atomicWriteSync (RX-OPS2 recovery-kontrakt).
- audit-corpus-headers.mjs: ny plain-Verified-deteksjon (RE_PLAIN_VERIFIED + plainVerifiedPipe)
  — gjør M4-blindheten synlig så en stale plain-hale ikke kan gjenoppstå stille (non-advisor scope).
- 87 filer strippet; plain Verified i vinduet 0/389; live-audit plainVerifiedPipe 0.

Mekanisme: +15 tester (12 strip + 3 audit). Suite 875→890 exit 0. validate-plugin.sh 250/0.

Utsatt → RX-KB1b: footer-dato-avvik + label-whitelist (annen dialekt, flag-to-human).

scripts/kb-update/audit-corpus-headers.mjs

@@ -45,6 +45,14 @@ const RE_STATUS = /\*\*Status:\*\*\s*\S/i;
 const RE_VERIFIED = /\*\*Verified:\*\*\s*([^|\n]*)/;
 const RE_CLEAN_DATE = /^\d{4}-\d{2}(-\d{2})?$/;
 
+// PLAIN (non-bold) `Verified:` in the header window — the RX-KB1 poison class: a `| Verified:
+// <date>` tail on the **Last updated:** line, claiming a verification the judge never made and
+// INVISIBLE to the bold-only RE_VERIFIED above (this blindness was M4). The `[^*]` guard keeps
+// a bold `**Verified:**` from matching (its 'V' is preceded by '*'). Surfaced as a separate
+// signal so a stale plain tail can never silently re-enter the corpus (strip-stale-verified-
+// pipe.mjs removes the current 87; this detects any reappearance within the non-advisor scope).
+const RE_PLAIN_VERIFIED = /(?:^|[^*])Verified:/m;
+
 /** Audit a single file's content. Pure. */
 function auditContent(content) {
   const head = content.slice(0, HEADER_REGION_BYTES);
@@ -74,6 +82,7 @@ function auditContent(content) {
     lastUpdatedEnglish: RE_LAST_UPDATED.test(content),
     dialect,
     verified,
+    plainVerified: RE_PLAIN_VERIFIED.test(head),
   };
 }
 
@@ -95,6 +104,7 @@ export function auditHeaders(paths, readFile = (p) => readFileSync(p, 'utf8')) {
     verifiedNonDate: 0,
     verifiedPipe: 0,
     verifiedDuplicate: 0,
+    plainVerifiedPipe: 0,
     missingTitle: 0,
     missingStatus: 0,
     missingEnglishLastUpdated: 0,
@@ -120,6 +130,7 @@ export function auditHeaders(paths, readFile = (p) => readFileSync(p, 'utf8')) {
       if (r.verified.pipe) aggregate.verifiedPipe++;
       if (r.verified.duplicateWithinHeaderRegion) aggregate.verifiedDuplicate++;
     }
+    if (r.plainVerified) aggregate.plainVerifiedPipe++;
     if (!r.title) aggregate.missingTitle++;
     if (!r.status) aggregate.missingStatus++;
     if (!r.lastUpdatedEnglish) aggregate.missingEnglishLastUpdated++;
@@ -172,6 +183,7 @@ function main(argv) {
     console.log(`Corpus header audit — ${a.files} non-advisor reference files`);
     console.log(`  Verified header present: ${a.verifiedPresent} (date: ${a.verifiedDate}, stale non-date: ${a.verifiedNonDate})`);
     console.log(`  Verified pipe rows: ${a.verifiedPipe}, duplicates within 500B: ${a.verifiedDuplicate}`);
+    console.log(`  Plain (non-bold) Verified tails (RX-KB1 poison class): ${a.plainVerifiedPipe}`);
     console.log(`  Missing English Last updated: ${a.missingEnglishLastUpdated}`);
     console.log(`  Missing Status: ${a.missingStatus}`);
     console.log(`  Missing title: ${a.missingTitle}`);