feat(ms-ai-architect): R22 decision-b Enhet 3 — Status-backfill 25 none + ai-act dual-header-dedup 4 (Missing Status/Last-updated 29+4→0) [skip-docs]

To operasjoner, én økt (⊥ R7), begge ren metadata-normalisering (verdi aldri fabrikkert).

Premiss-korreksjon (ground truth 2026-07-07): roadmap sa «27 none + 4 ai-act».
Målt: 29 mangler bold **Status:** = 25 rene none + 4 ai-act (plain Status: GA).
De «27» inkluderte 2 for mye — 2 filer (custom-dashboards-ai-operations,
zero-trust-ai-services) har bold **Status:** KUN forbi byte 500 (present for
full-fil-audit, usynlig for 500B header-parser) → egen header-slanking-residual
(§8-register), utenfor Enhet 3.

Op A — Status-backfill 25 rene none: utvidet backfill-status.mjs MANIFEST 14→39
(samme statusForFile + insertMetaField + hard per-fil-invariant, idempotent skip
på de 14 R21-gjorte). Alle 25 → **Status:** Established Practice (ingen matcher
template|matrix|benchmarks|register). Diff +25/-0.

Op B — ai-act dual-header-dedup (4 filer): ny driver dedup-plain-header.mjs + 2
rene primitiver i transform.mjs — boldifyPlainField (plain→bold, verdi bevart
byte-eksakt, header-scoped, idempotent) + dropRedundantPlainField (sletter plain
KUN når bold m/ identisk verdi beviser redundans; kaster ved avvik/manglende bold).
Per fil: plain Last updated: + Status: GA → bold (2026-06-18/2026-02, GA bevart),
redundant plain Category: fjernet. Hard per-fil-invariant (net -1 linje, begge
felt bold m/ bevart verdi, ingen plain-header igjen, body byte-identisk). Diff -12/+8.

Verifisering: test-backfill-status 8/8 + test-dedup-plain-header 13/13; audit
Missing Status 29→0, Missing English Last updated 4→0; skills-diff 29 filer
+33/-12 (kun **Status:** + 8 bold-swaps), diff-kontekst inspisert per fil; begge
drivere idempotent (re-run 0 writes); suite 806/806 exit 0; none=8 uendret (Enhet 4).

scripts/kb-update/lib/transform.mjs

@@ -418,6 +418,88 @@ export function insertMetaField(content, label, value) {
   return lines.join('\n');
 }
 
+// Header region ends at the first horizontal rule or `## ` section — mirrors the body
+// boundary the anchor loops above use. A plain-text meta line below this is genuine prose.
+function headerEndIndex(lines) {
+  for (let i = 0; i < lines.length; i++) {
+    if (/^##\s/.test(lines[i]) || /^---\s*$/.test(lines[i])) return i;
+  }
+  return lines.length;
+}
+
+/**
+ * Normalize a PLAIN-TEXT header field — `<label>: <value>` — to the house bold form
+ * `**<label>:** <value>`, PRESERVING the authored value byte-exact (Enhet 3 Op B dedup
+ * primitive for the dual-header ai-act-* files). Unlike insertMetaField this never derives a
+ * value: it only re-decorates a line the author already wrote. Acts on the FIRST plain match
+ * in the header region only (a `Status:` in body prose is untouched). Idempotent: if a bold
+ * `**<label>:**` already sits in the header the content is returned unchanged; likewise if no
+ * plain line exists. Body (from the first `## `/`---`) is byte-identical.
+ *
+ * @param {string} content — full existing file content
+ * @param {string} label — the label WITHOUT decoration, e.g. 'Last updated'
+ * @returns {string} content with the plain line re-decorated, or unchanged
+ * @throws if label is blank
+ */
+export function boldifyPlainField(content, label) {
+  const s = String(content ?? '');
+  const lab = String(label ?? '').trim();
+  if (lab === '') throw new Error('boldifyPlainField: label is required');
+  const esc = lab.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const boldRe = new RegExp('^\\s*\\*\\*' + esc + ':\\*\\*', 'i');
+  const plainRe = new RegExp('^\\s*' + esc + ':\\s*(\\S.*?)\\s*$', 'i');
+
+  const lines = s.split('\n');
+  const end = headerEndIndex(lines);
+  let plainIdx = -1;
+  for (let i = 0; i < end; i++) {
+    if (boldRe.test(lines[i])) return s; // idempotent: already bold → unchanged
+    if (plainIdx === -1 && plainRe.test(lines[i])) plainIdx = i;
+  }
+  if (plainIdx === -1) return s; // no plain line → unchanged
+  const val = plainRe.exec(lines[plainIdx])[1];
+  lines[plainIdx] = `**${lab}:** ${val}`;
+  return lines.join('\n');
+}
+
+/**
+ * Remove a PLAIN-TEXT header field — `<label>: <value>` — that is provably redundant with an
+ * existing bold `**<label>:** <value>` carrying the IDENTICAL value (Enhet 3 Op B dedup
+ * primitive). Refuses to guess: if no bold field exists, or the bold and plain values differ,
+ * it THROWS (that is a human decision, never an auto-delete). No-op if the plain line is absent
+ * (idempotent). Operates in the header region only; body is byte-identical.
+ *
+ * @param {string} content — full existing file content
+ * @param {string} label — the label WITHOUT decoration, e.g. 'Category'
+ * @returns {string} content with the redundant plain line removed, or unchanged
+ * @throws if label is blank, no bold field proves redundancy, or the values differ
+ */
+export function dropRedundantPlainField(content, label) {
+  const s = String(content ?? '');
+  const lab = String(label ?? '').trim();
+  if (lab === '') throw new Error('dropRedundantPlainField: label is required');
+  const esc = lab.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const boldRe = new RegExp('^\\s*\\*\\*' + esc + ':\\*\\*\\s*(\\S.*?)\\s*$', 'i');
+  const plainRe = new RegExp('^\\s*' + esc + ':\\s*(\\S.*?)\\s*$', 'i');
+
+  const lines = s.split('\n');
+  const end = headerEndIndex(lines);
+  let boldVal = null;
+  let plainIdx = -1;
+  let plainVal = null;
+  for (let i = 0; i < end; i++) {
+    const bm = boldRe.exec(lines[i]);
+    if (bm && boldVal === null) boldVal = bm[1];
+    const pm = plainRe.exec(lines[i]);
+    if (pm && plainIdx === -1) { plainIdx = i; plainVal = pm[1]; }
+  }
+  if (plainIdx === -1) return s; // nothing to drop (idempotent)
+  if (boldVal === null) throw new Error(`dropRedundantPlainField: no bold **${lab}:** to prove redundancy for plain '${plainVal}'`);
+  if (boldVal !== plainVal) throw new Error(`dropRedundantPlainField: plain '${plainVal}' ≠ bold '${boldVal}' — not redundant, human decision`);
+  lines.splice(plainIdx, 1);
+  return lines.join('\n');
+}
+
 /**
  * Surgically insert-or-update ONLY the `**Verified:**` and `**Verified by:**` header lines
  * on an EXISTING KB file — the R7–R10 born-verified STAMP primitive. Unlike composeKbFile