The audit-marker negation guard survives a line break

[b7n0de]

Found by triggering it

_positive_audit_marker decides whether a release has recorded its pre-tag adversarial audit. RT10-PRETAG-02 already stops a negated marker from counting — "the audit did NOT run" must not certify anything. The scope of "not negated" was the physical line, and that is where it breaks.

While writing an honest retraction into a release candidate's CHANGELOG — a paragraph whose whole point is that the audit had not finished — the gate flipped to {"ok": true, "changelog_records_audit": true} and stayed there for about two minutes. The two lines that did it:

…never shipped a user-facing CLI flag in a patch release. That claim was falsified during the pre-tag
adversarial audit and is retracted here rather than quietly deleted: four patch releases have shipped

Line two opens with adversarial and carries no negation token. The words that take it back — never, and the fact that the run was still going — sit on line one. Nothing was crafted to defeat the guard; ordinary prose wrapping at 110 columns did it.

That is the sharp edge of this class: the guard is most easily defeated by exactly the kind of careful, self-critical writing this project requires of itself. A tag could have been cut on the strength of a sentence admitting the release was not ready.

The fix, and the one that looked right and isn't

Paragraph scope (blank-line separated) instead of line scope.

rule	on the live case	on the committed audit_artifacts/370/ record
line-scoped (before)	True ← the defect	True
sentence-scoped	True ← does not close it	True
paragraph-scoped (this PR)	False	True

Sentence scope was measured first and rejected. It still returns True on the block above, because falsified is not a negation token and the sentence carrying adversarial genuinely contains none. A finer scope does not help when the negation lives in the surrounding argument rather than in a word. Recorded here because the obvious fix looks right and is not.

Why this is safe

A paragraph contains its lines, so widening the scope can only bring more negation tokens into view, never fewer. No text the old rule rejected can be accepted by the new one. That monotonicity is asserted over a corpus in test_the_new_scope_is_strictly_stricter rather than argued — "obviously monotone" is how a loosening gets in.

The counter-direction matters just as much, because a stricter gate that rejects genuine records is simply a different defect. The committed audit_artifacts/370/pre_tag_adversarial_audit_370.md still passes: its opening paragraph pairs the claim with a "NOT a substitute for the external audit" disclaimer and is correctly not counted, while the later "Six diverse falsification-first lenses …" paragraph carries the marker cleanly and is the attestation. House style survives. test_a_separate_paragraph_still_carries_its_own_attestation holds the boundary from the other side, so paragraph scope cannot silently become file scope.

Revert probe

	with the fix	fix stashed out
tests/test_audit_marker_line_wrap.py	9 passed, 14 subtests	3 failed, 6 passed
tests/test_roadmap_frontload_foundations.py	19 passed	19 passed (unchanged)

The three that go red are exactly the ones that name the property: the live case, the paragraph split, and the meta-test. ruff clean.

Honest limit

This still infers a fact from free prose, and prose inference stays defeatable in principle. The durable answer is an explicit attestation token that means one thing — pre-tag-adversarial-audit: RUN | version=X.Y.Z — which #139 already moves to. This PR narrows a live hole in the mechanism that guards releases today; it does not claim to have made prose inference sound. If #139 lands first, this becomes redundant rather than wrong, and can be closed.