roadmap: secure-zone guard frisk + age/storage potency model

- Secure-zone checkpoints frisk guards too -> the counter-play to a bent warden
  smuggling contraband in. Wires corruption <-> secure zones <-> the search loop.
- Potency = age + storage (sealed/open), never container size. Topping up dilutes
  age (volume-weighted), so a shared bucket stays fresh while a hidden jar ages to
  full potency -- "a jar of old piss and a bucket of fresh" both make sense.

ROADMAP.md

@@ -229,6 +229,10 @@ ideology-driven *decision*, not another timer.
   - **Bent wardens smuggle IN.** A corrupt/bribed/romantically-entangled warden becomes a **supply
     route** — they hand contraband TO a prisoner (the `Conceal` door already noted in Contraband as
     "a bent warden"). This is the corruption payoff and the thing that feeds a Gang's network.
+  - **Secure zones are the counter-play.** A search-zone checkpoint frisks *anyone* passing through,
+    **guards included** — so a bent warden carrying contraband in can be caught at the door. This
+    wires corruption ↔ secure zones (the generalized secure-area search) ↔ the search loop: the same
+    `JobDriver_SearchPawn` that turns over a prisoner turns over a guard at a checkpoint.
 
   Self-complete (reads vanilla traits/mood/relationships); no dependency. This is where the
   contraband loop stops being "the game vs. the player" and becomes "the player's own guards, who
@@ -300,6 +304,16 @@ built on the existing `SubstanceDef` (data) + `CompVessel` (delivery) + `CompFer
 Staged so each ships green: **hooch → liquid-container fermentation → mixing.** The vessel data model
 is built mixture-capable and site-aware from the start so none of it is a later refactor.
 
+**Potency model (corrected 2026-07-15): age + storage, NOT container size.** A liquid's potency is a
+function of how long it has fermented and how it is stored (a *sealed* vessel ripens and holds; an
+*open* one ferments differently and loses to evaporation) — never of how big the container is. Size
+already only drives fill-time and blast (VesselProfile), so `CompFerment.Potency` stays age-driven;
+the correction is that **topping up dilutes age**. A shared bucket/carboy that several prisoners keep
+using stays *fresh* (each fresh addition pulls the volume-weighted average age down), while a jar one
+prisoner fills once and hides *ages to full potency*. So "a jar of old piss and a bucket of fresh"
+both make sense — it is the usage pattern, not the vessel, that decides. Implementation: track age as
+a volume-weighted average, diluted on each add; sealed/open scales the ripen rate.
+
 ## Compatibility — the non-negotiable
 
 The suite must load and run cleanly alongside the **all-time most-subscribed Workshop mods**, not