feat(ms-ai-architect): R22 decision-b Enhet 3 — Status-backfill 25 none + ai-act dual-header-dedup 4 (Missing Status/Last-updated 29+4→0) [skip-docs]

To operasjoner, én økt (⊥ R7), begge ren metadata-normalisering (verdi aldri fabrikkert).

Premiss-korreksjon (ground truth 2026-07-07): roadmap sa «27 none + 4 ai-act».
Målt: 29 mangler bold **Status:** = 25 rene none + 4 ai-act (plain Status: GA).
De «27» inkluderte 2 for mye — 2 filer (custom-dashboards-ai-operations,
zero-trust-ai-services) har bold **Status:** KUN forbi byte 500 (present for
full-fil-audit, usynlig for 500B header-parser) → egen header-slanking-residual
(§8-register), utenfor Enhet 3.

Op A — Status-backfill 25 rene none: utvidet backfill-status.mjs MANIFEST 14→39
(samme statusForFile + insertMetaField + hard per-fil-invariant, idempotent skip
på de 14 R21-gjorte). Alle 25 → **Status:** Established Practice (ingen matcher
template|matrix|benchmarks|register). Diff +25/-0.

Op B — ai-act dual-header-dedup (4 filer): ny driver dedup-plain-header.mjs + 2
rene primitiver i transform.mjs — boldifyPlainField (plain→bold, verdi bevart
byte-eksakt, header-scoped, idempotent) + dropRedundantPlainField (sletter plain
KUN når bold m/ identisk verdi beviser redundans; kaster ved avvik/manglende bold).
Per fil: plain Last updated: + Status: GA → bold (2026-06-18/2026-02, GA bevart),
redundant plain Category: fjernet. Hard per-fil-invariant (net -1 linje, begge
felt bold m/ bevart verdi, ingen plain-header igjen, body byte-identisk). Diff -12/+8.

Verifisering: test-backfill-status 8/8 + test-dedup-plain-header 13/13; audit
Missing Status 29→0, Missing English Last updated 4→0; skills-diff 29 filer
+33/-12 (kun **Status:** + 8 bold-swaps), diff-kontekst inspisert per fil; begge
drivere idempotent (re-run 0 writes); suite 806/806 exit 0; none=8 uendret (Enhet 4).

scripts/kb-update/backfill-status.mjs

@@ -1,22 +1,26 @@
 #!/usr/bin/env node
-// Backfill **Status:** on the 14 English-dialect advisor reference files that carry NO
-// status label (R21 — base-field pre-pass del 2, ⊥ R7).
+// Backfill **Status:** on English-dialect reference files that carry NO status label
+// (R21 + Enhet 3 — base-field pre-pass, ⊥ R7). Single mechanism for the whole corpus.
 //
-// Ground truth 2026-07-06 (premiss-verified): of the not-due (146) corpus, 21 files lack a
-// bold **Status:**. Of those, 3 are Norwegian-dialect (an English Status would mix dialects)
-// and 4 (ms-ai-governance/responsible-ai/ai-act-*) carry a PLAIN-TEXT `Status: GA` in a second
-// dual-header block that the bold-only regex does not see — inserting a bold **Status:** there
-// duplicates/contradicts it. All 7 (3 + 4) are DEFERRED to the decision-b dialect/dual-header
-// residual (the same plain block is why R20 duplicated **Category:** on those 4). The clean
-// remainder is 14 advisor/architecture files. All 26 not-due Last-updated gaps are also deferred
-// (21 already carry a Norwegian date → relabel; 5 are git-unreliable post-R20-churn). This
-// applier writes ONLY those 14 Status lines — never a date, never into a Norwegian/dual-header file.
+// Scope (ground-truth measured 2026-07-06 → extended 2026-07-07):
+//   R21     — 14 advisor/architecture files (the clean not-due remainder; 3 Norwegian-dialect
+//             and 4 dual-header ai-act-* files were held back — see below).
+//   Enhet 3 — +25 non-advisor files whose header carries no **Status:** at all (audit dialect
+//             'none' for Status). Measured 25 — NOT the roadmap's "27": 2 of that count are
+//             files whose bold **Status:** sits PAST byte 500 (present, but invisible to the
+//             500-byte header parser), a separate header-slanking residual, not a missing field.
+//   Still OUT — the 4 ms-ai-governance/responsible-ai/ai-act-* files carry a PLAIN-TEXT
+//             `Status: GA` in a dual-header block. Inserting a derived bold **Status:** there
+//             would duplicate/contradict the authored value; they are handled by the plain→bold
+//             dedup driver (dedup-plain-header.mjs), which PRESERVES `GA` rather than deriving.
 //
-// Value rule (operator-approved vocabulary, 2026-07-06): statusForFile() — a filename-token
-// map within {Reference, Established Practice}. Reuses the tested insertMetaField primitive,
-// with a hard per-file invariant asserted BEFORE any write (exactly one line inserted, it is
-// the Status line, body byte-identical). Idempotent: a file already carrying **Status:** is
-// skipped, so a re-run is a no-op. Aborts and writes nothing on any drift or invariant breach.
+// This applier writes ONLY a derived bold **Status:** line — never a date, never into a
+// dual-header ai-act file. Value rule (operator-approved vocabulary): statusForFile() — a
+// filename-token map within {Reference, Established Practice}. Reuses the tested insertMetaField
+// primitive, with a hard per-file invariant asserted BEFORE any write (exactly one line
+// inserted, it is the Status line, body byte-identical). Idempotent: a file already carrying
+// **Status:** in its header window is skipped, so a re-run — including the 14 R21 files already
+// applied — is a no-op. Aborts and writes nothing on any drift or invariant breach.
 //
 // Usage:  node scripts/kb-update/backfill-status.mjs [--dry]
 import { readFileSync, writeFileSync, existsSync, realpathSync } from 'node:fs';
@@ -46,10 +50,12 @@ export function statusForFile(relOrBase) {
   return /(?:template|matrix|benchmarks|register)/i.test(base) ? 'Reference' : 'Established Practice';
 }
 
-// Frozen manifest — the 18 scope-confirmed targets (not-due ∩ missing-**Status:** ∩
-// English-dialect), verified against ground truth 2026-07-06. Each value is derived by
-// statusForFile() and re-asserted below, so the manifest can never drift from the rule.
+// Frozen manifest — the 39 scope-confirmed targets (missing-**Status:** ∩ English-dialect ∩
+// not a dual-header ai-act file), verified against ground truth (R21: 14 advisor 2026-07-06;
+// Enhet 3: +25 non-advisor 2026-07-07). Each value is derived by statusForFile() and re-asserted
+// below, so the manifest can never drift from the rule.
 const TARGET_PATHS = [
+  // R21 — 14 advisor/architecture files (already applied; re-run skips them idempotently).
   'skills/ms-ai-advisor/references/architecture/adr-template.md',
   'skills/ms-ai-advisor/references/architecture/ai-utredning-template.md',
   'skills/ms-ai-advisor/references/architecture/alternativanalyse-methodology.md',
@@ -64,6 +70,32 @@ const TARGET_PATHS = [
   'skills/ms-ai-advisor/references/architecture/regional-availability-verification.md',
   'skills/ms-ai-advisor/references/architecture/security.md',
   'skills/ms-ai-advisor/references/architecture/source-traceability-assumption-register.md',
+  // Enhet 3 — 25 non-advisor files with no **Status:** at all (all → Established Practice).
+  'skills/ms-ai-engineering/references/mlops-genaiops/cost-optimization-mlops-pipelines.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/feedback-loops-continuous-improvement.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/genaiops-llm-specific-practices.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/governance-audit-ml-operations.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/inferencing-optimization-caching.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/infrastructure-as-code-mlops.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/llm-evaluation-production.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/mlops-security-access-control.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/mlops-teams-collaboration-tools.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/model-deployment-strategies-azure.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/monitoring-observability-ml-systems.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/prompt-flow-production-deployment.md',
+  'skills/ms-ai-engineering/references/mlops-genaiops/responsible-ai-mlops-integration.md',
+  'skills/ms-ai-governance/references/monitoring-observability/anomaly-detection-ai-systems.md',
+  'skills/ms-ai-governance/references/monitoring-observability/azure-monitor-setup-ai-workloads.md',
+  'skills/ms-ai-governance/references/monitoring-observability/log-analytics-kql-ai-queries.md',
+  'skills/ms-ai-governance/references/monitoring-observability/token-usage-tracking-attribution.md',
+  'skills/ms-ai-governance/references/responsible-ai/ai-center-of-excellence-setup.md',
+  'skills/ms-ai-governance/references/responsible-ai/ai-governance-structure-framework.md',
+  'skills/ms-ai-governance/references/responsible-ai/red-teaming-ai-models.md',
+  'skills/ms-ai-security/references/ai-security-engineering/ai-red-team-operations-practical.md',
+  'skills/ms-ai-security/references/ai-security-engineering/data-leakage-prevention-ai.md',
+  'skills/ms-ai-security/references/ai-security-engineering/secure-model-deployment-hardening.md',
+  'skills/ms-ai-security/references/ai-security-engineering/security-copilot-integration.md',
+  'skills/ms-ai-security/references/ai-security-engineering/supply-chain-security-ai-models.md',
 ];
 export const MANIFEST = TARGET_PATHS.map((path) => ({ path, status: statusForFile(path) }));