docs(conformance): record that the matcher debt is half paid

The content-scan half of the 'stop keying on doc-header tokens' follow-up is done
(ci/touched-requirements.sh). The path-map half remains: clusters/* and ci/* are
still keyed wholesale to R-ENV-02 + R-GITOPS-01, which is why those two stay in
DOCUMENTED_GAPS. Notes the accepted consequence for header-declared manifests.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

DECISIONS-LOG.md

@@ -1064,6 +1064,12 @@ LiveMigratable). Conformance scaffold coverage **36/51 (70.6%)**.
    second rule the log cannot record which requirements a change concerned without thereby claiming
    to have touched them, and the very commit that explains a mis-attribution re-triggers it.
    Removed lines still count (deleting a `conformance.home.k3s/R-*` tag touches that requirement too).
+   **Known consequence, accepted:** a manifest whose *header* declares the requirements it serves
+   (e.g. `platform/keycloak/keycloak-realm-import.yaml`) no longer contributes those IDs unless the
+   change touches a line carrying them. That is the intended semantics — the harness debt was
+   written as "stop keying on **doc-header tokens**" — and the authoritative signal, a test's
+   `conformance.home.k3s/R-*` label, is still detected. Verified: a range spanning conformance and
+   platform YAML changes still resolves R-NET-01, R-OBS-02/04, R-STATE-01/02 and R-TEST-01..04.
    **This is a gate-semantics change — flagged for review.** It is a tightening of attribution, not
    a weakening: no requirement is exempted, `DOCUMENTED_GAPS` is untouched, authoritative
    declarations (test tags, Kyverno policies, ServiceDefinitions) all live in YAML on lines a real

conformance/run.sh

@@ -60,9 +60,18 @@ FORCE_NO_CLUSTER=0
 #                                    path-map keys to it, so editing any ci/ file (SPEC_PIN
 #                                    adoption included) would false-block.
 # These are visible GAPs, not hidden — removing them from this list is the right move the
-# moment WS-TEST adds their verifying tests. FOLLOW-UP (WS-TEST): the deeper fix is to make
-# the path->requirement matcher stop keying on doc-header tokens so real requirements need
-# not be exempted; tracked as a harness debt item, not resolved here.
+# moment WS-TEST adds their verifying tests.
+#
+# FOLLOW-UP (WS-TEST) — HALF DONE. The debt was "make the matcher stop keying on doc-header
+# tokens so real requirements need not be exempted". The CONTENT-SCAN half is now fixed in
+# ci/touched-requirements.sh: it scans the added/removed lines of the diff, and skips *.md, so
+# a requirement named in a header or in prose no longer counts as a declaration. Consequence
+# to be aware of: a manifest whose HEADER declares the requirements it serves no longer
+# contributes those IDs unless the change actually touches a line carrying them — the
+# authoritative signal is the `conformance.home.k3s/R-*` label on a test, which still is.
+# The PATH-MAP half remains: ci/touched-requirements.sh keys clusters/* and ci/* to
+# R-ENV-02 + R-GITOPS-01 wholesale, which is why those two must stay exempted here. Tighten
+# the path map (or scaffold the two requirements) and this list shrinks to R-STATE-02.
 DOCUMENTED_GAPS="R-STATE-02 R-ENV-02 R-GITOPS-01"
 
 usage() { sed -n '2,40p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }