p='traceable-reqs.toml'
b=open(p,'rb').read(); crlf=b'\r\n' in b; s=b.decode().replace('\r\n','\n')
a='trust anchor OVERRIDDEN (identity/release-keys.json, key <id>, channel <ch>, expires <date|EXPIRED>)'
assert s.count(a)==1
s=s.replace(a,'trust anchor OVERRIDDEN (identity/release-keys.json, key <ids>, channel <ch>)')
i=s.index('id = "REQ-UPDATE-STATUS-TRUST-ANCHOR"')
j=s.index('an EXPIRED override is still reported as present',i)
k=s.index('the failure this exists to kill.',j)+len('the failure this exists to kill.')
print(repr(s[j-40:j])); print(repr(s[k:k+60]))
s=s[:j]+'The line declares NO expiry, because the trust path has none to read: release-keys.json carries keys, revoked and channel only, and the one enforced expiry in the release path is the signed metadata\'s per-release expires_at_ms, which belongs to a staged release and not to the anchor. A displayed-but-unenforced expiry would be a false trust signal at the exact place the point is trust; if key expiry is wanted it is a trust-policy change shipping the field AND its enforcement in one request, not a status cosmetic.'+s[k:]
if crlf: s=s.replace('\n','\r\n')
open(p,'wb').write(s.encode())