derived_from_description leaks into artifacts that declare no provenance

[dieterbaier]

Problem

derived_from_description is set as an AsciiDoc attribute by each artifact's
generated attributes fragment and is never unset. AsciiDoc attributes persist
for the rest of the document once defined, so every artifact rendered after
one that carries provenance inherits it.

Artifacts guard their provenance block with ifdef::derived_from_description[],
which is exactly the condition that stays true. The guard therefore fires for
artifacts that have no derived_from metadata at all, and prints someone
else's origin under their own Derived from heading.

Evidence

In the rendered build/architecture/index.html, under the Derived from
heading of two artifacts that declare no derived_from in their front matter:

Artifact	Renders
QS-004-ai-suggestion-reviewability	ADR-008's provenance text
R-001-ai-suggestions-as-truth	ADR-008's provenance text

Both should render nothing. Neither has a derived_from key.

This is not new: on main the same two artifacts display ADR-007's provenance
instead, because ADR-007 was the last artifact with provenance rendered before
them. Adding an artifact with derived_from does not create the defect, it
changes which text leaks and where the leak starts.

Cause

scripts/validate-metamodel.rb writes :derived_from_description: into
generated/<anchor>-attributes.adoc for artifacts that have provenance, and
writes no counterpart for artifacts that do not. A fragment that does not set
the attribute also does not clear it.

Candidate fixes

• Have every artifact's attributes fragment unset the attribute when the
  artifact has no provenance (:!derived_from_description:), so each fragment
  leaves the document in a known state rather than depending on what ran before
  it. This is the smallest change and makes the fragments self-contained.
• Or scope the provenance rendering so it cannot depend on document order at
  all.

Prefer whichever keeps the fragments independent of their include position;
order-dependence is what made this invisible for so long.

Behaviour specification

features/documentation-generation.feature specifies that metadata is exposed
as attributes; it does not specify that a fragment clears what it does not set.
That is the gap. bdd-specification applies: add a scenario for an artifact
without provenance rendered after one with provenance, asserting that no
Derived from text appears, and bridge it into the existing tests.

Acceptance criteria

• An artifact without derived_from renders no provenance, whatever
  precedes it in the assembled document.
• An artifact with derived_from still renders its own.
• A scenario covers the leak case and is bridged to a test.
• QS-004 and R-001 render no Derived from text in the built HTML.
• Existing generator tests keep passing.

Origin

Found on 2026-09-04 by an independent Convergence Check on #88, and confirmed
in the rendered output for both branch and main.

[dieterbaier]

Exact figure, derived from the rendered output

Verified against build/architecture/index.html rather than estimated.

The render contains 15 Derived from headings. Three are legitimate — ADR-007, ADR-008 and R-007 are the only artifacts declaring derived_from in their front matter — and one is the ADR index's table column header, not a block.

That leaves 11 leaked blocks, on artifacts that declare no provenance at all:

QS-001, QS-002, QS-003, QS-004, QS-005, R-001, R-002, R-003, R-004, R-005, R-006.

The count is the same on main, where those eleven render ADR-007's provenance instead of ADR-008's — which is the ordering dependence this issue describes: the last artifact with provenance rendered before them wins.

One related case for the same fix: DOC-04001-metamodel declares derived_from but renders no provenance block, because its source carries no ifdef guard. Same family — a fragment that does not clear what it does not set, and a guard that is missing where it is wanted.

Found while an independent Convergence Check on #88 rejected an approximate count in that pull request's body. The number belongs here, in the issue about the defect, rather than in delivery prose that goes stale.