fix: refute (ar)'s intake finding; fix the D20 gloss class; add X-Robots-Tag on *.pdf

Pouya's rulings of 2026-09-03, in five parts.

1. THE INTAKE FORM IS NOT BROKEN. (ar) was wrong. docs/09 §7.1 verbatim —
POST /api/intake with an Origin header — returns 303 to /contact/could-not-send/
with access-control-allow-origin echoed; the same probe without Origin returns
403. A bare POST 403s BY DESIGN and §7.1 says so three lines below the probe it
prescribes: "403 means the Origin header did not arrive". The earlier finding
read a status code without reading the document that defines it. Second time in
two days. CLAUDE.md's instrument list goes eight to nine. D20 findings 12 and 19
fall with it; §7.2 (that both emails arrive) is still owed.

The correction is APPENDED as entry (as); (ar) stands unedited.

2. The privacy retention comment was stale, not a defect — superseded by his
decision to publish and confirm after launch, reading from 2026-09-04. Reworded;
the TODO(pouya) came off with the gate it enforced. The mechanism finding
survives: it was a JSX comment, stripped by Astro, so no build or deploy path
could see it. A publication gate that lives only in a stripped comment is not a
gate. §9 Q60 corrected.

3. The gloss class is fixed — 15 of the 20 D20 findings, 14 distinct edits across
9 files, under the rule "the gloss may say no more than the extract says; no new
claims, no new sources". Swept three unpublished insights drafts too, and
corrected the wrong CAA attribution at its source in docs/reference/, which is
where a fixed page re-seeds. /bio/ changed, so the committed PDF is regenerated
(89,549 B, 1 page asserted). Three findings outstanding: 10 needs a ruling, 11 is
ruled and owed via Q60, 13 needs him to have said it. R1 is not one of the twenty.

4. X-Robots-Tag cannot be done with S3 object metadata — --metadata writes user
metadata, returned as x-amz-meta-x-robots-tag, which no crawler reads. Built as
the CloudFront response-headers policy docs/06 has specified all along:
configure.mjs section 4. It needs a --apply run, not a deploy. The policy is
cloned from whatever is attached at run time and reconciled on every run, because
a response-headers policy replaces rather than merges.

5. Headshot deferred as an open non-defect. The master and the srcset ladder are
both fine; Astro passes no quality, so AVIF encodes at sharp's default 50 and is
served first.

Two review rounds, 29 findings, all resolved, none declined; stopped at two per
D19. NINE of round 2's fourteen were defects in round 1's own repairs — including
a fix that harmonised both /fees/ rows onto wording that was itself unregistered,
publishing an unsourced fee term twice where it had been once.

Gates, exit status read for each: check 0 (0 errors, 0 warnings, 0 hints),
build 0 (23 pages), check:claims 0, check:intake 0, og:proof 0, lint 0, minifier
grep exit 1, router.test.mjs 30/30. Lighthouse NOT run. Nothing deployed and
nothing applied to the distribution.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

src/content/insights/bill-40-grid-connection-disputes.mdx

@@ -56,7 +56,7 @@ So one date sorts a pipeline into two regimes, and the requirements the later on
 
 The mechanics of getting connected sit outside Bill 40, and they are what a supply agreement or a construction programme is quietly dated against.
 
-The IESO's own description of the connection process sets out up to six stages, beginning with preparing the application and ending after the equipment is registered and tested. A transmitter's connections are generally subject to all six; a distributor's may be subject only to the first three. The umbrella name is connection assessment and approval. The IESO decides whether an application qualifies for a system impact assessment or an expedited one, and the transmitter generally runs its own customer impact assessment after the IESO's draft report, under a separate agreement. The final report goes out with either a notification of conditional approval or a notification of disapproval with reasons.
+The IESO's own description of the connection process sets out up to six stages, beginning with preparing the application and ending after the equipment is registered and tested. A transmitter's connections are generally subject to all six; a distributor's may be subject only to the first three. The IESO decides whether an application qualifies for a system impact assessment or an expedited one, and the transmitter generally runs its own customer impact assessment after the IESO's draft report, under a separate agreement. The final report goes out with either a notification of conditional approval or a notification of disapproval with reasons.
 
 There is no queue. The IESO states in terms that it is not using an interconnection queue, and works instead from the concept of committed projects defined in its Market Manual 1.4. An argument built on a project's place in line is an argument about nothing.
 

src/content/insights/ontario-data-centre-build-out-disputes.mdx

@@ -19,11 +19,11 @@ There is a connection: an assessment run by the Independent Electricity System O
 
 Each has a different decision-maker, a different vocabulary, and a different idea of what a deadline is. They converge on the date the facility can energise. That convergence is the shape of the dispute, and a dispute clause drafted for one of the three contracts alone will not hold it.
 
-## What the connection assessment and approval process is
+## How a connection is assessed and approved
 
-The terminology is precise and the wrong word travels badly, so it is worth taking from the IESO's own description of the connection process. The umbrella is connection assessment and approval, or CAA. Within it the IESO performs a System Impact Assessment (SIA), or an expedited SIA where the application qualifies, and assigns a unique CAA ID. The transmitter performs a Customer Impact Assessment (CIA), which the IESO says the transmitter generally initiates after the draft SIA report. The SIA agreement is prepared in accordance with section 6.1.15.3 of chapter 0.4 of the Market Rules. The IESO issues a draft SIA report to the applicant and the transmitter for comment, then a final report, and with it either a Notification of Conditional Approval or a Notification of Disapproval with Reasons.
+The terminology is precise and the wrong word travels badly, so it is worth taking from the IESO's own description of the connection process. Obtaining conditional approval runs through the IESO's and transmitter's connection assessment and approval (CAA) process. Within it the IESO performs a System Impact Assessment (SIA), or an expedited SIA where the application qualifies, and assigns a unique CAA ID. The transmitter performs a Customer Impact Assessment (CIA), which the IESO says the transmitter generally initiates after the draft SIA report. The SIA agreement is prepared in accordance with section 6.1.15.3 of chapter 0.4 of the Market Rules. The IESO issues a draft SIA report to the applicant and the transmitter for comment, then a final report, and with it either a Notification of Conditional Approval or a Notification of Disapproval with Reasons.
 
-The published process runs to as many as six stages. Connections to a transmitter's system are generally subject to all six; connections to a distributor's system may be subject only to the first three. On the IESO's own figures, obtaining conditional approval "typically takes one year", registering equipment "takes at least three months", and the whole process can run "anywhere from a few months for small modifications to existing facilities, to more than three years for major modifications or to connect new facilities".
+The IESO's published connection process runs to as many as six stages. Connections to a transmitter's system are generally subject to all six; connections to a distributor's system may be subject only to the first three. On the IESO's own figures, obtaining conditional approval "typically takes one year", registering equipment "takes at least three months", and the whole process can run "anywhere from a few months for small modifications to existing facilities, to more than three years for major modifications or to connect new facilities".
 
 Two features matter to anyone drafting a dispute clause. The SIA assesses the proposed connection's impact on the reliability of the integrated power system; what comes out of it is a report and a notification, not a ruling between parties. And there is no ordered line to be moved up. The IESO says so in terms in its connection-process FAQ: it works from "committed projects", a concept defined in section 3.3 of Market Manual 1.4, Connection Assessment and Approval, each assessment following section 5.8 of the same manual. The four IESO connection-process pages read for this piece describe only the six-stage process; no large-load or data-centre variant appears. This is the process I write about under [energy, grid and regulatory disputes](/practice/energy/).
 

src/content/insights/what-a-system-impact-assessment-evaluates.mdx

@@ -24,9 +24,9 @@ or modifications to facilities connected to a transmitter's system are subject
 to the IESO's system impact assessment (SIA) and the transmitter's customer
 impact assessment (CIA)." Two documents, two authors. The IESO conducts the SIA.
 The transmitter conducts the CIA. Treating the pair as one exhibit loses the
-distinction most of these disputes turn on. The umbrella name is the connection
-assessment and approval process, CAA in the IESO's usage, and each application
-is given a unique CAA ID.
+distinction most of these disputes turn on. Both sit in the IESO's and
+transmitter's connection assessment and approval process, CAA in the IESO's
+usage, and each application is given a unique CAA ID.
 
 ## What the assessment is actually of
 

src/data/practice-pages.ts

@@ -151,7 +151,7 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
         paragraphs: [
           {
             lead: 'Interim adjudication.',
-            text: 'Part II.1 of the Construction Act — "Construction Dispute Interim Adjudication" — has been in force since 1 October 2019. An adjudicator must determine the referred matter no later than 30 days after receiving the referring party\'s documents, and a determined amount is payable within 15 days of the determination being communicated. Judicial review is available only with leave of the Divisional Court.',
+            text: 'Part II.1 of the Construction Act — "Construction Dispute Interim Adjudication" — has been in force since 1 October 2019. An adjudicator must determine the referred matter no later than 30 days after receiving the referring party\'s documents, unless that date is extended in the way the Act allows. A determined amount is payable within 15 days of the determination being communicated. Judicial review is available only with leave of the Divisional Court.',
           },
           {
             lead: 'A designated authority runs it.',
@@ -177,7 +177,7 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
             text: 'Ontario Power Generation holds a licence to construct a BWRX-300 small modular reactor at Darlington, granted by the Canadian Nuclear Safety Commission in April 2025, and applied in March 2026 for a licence to operate it. Bruce Power has a federal impact assessment under way for the Bruce C project, aimed at creating an option for up to 4,800 megawatts at the existing site, with reactor technology not yet selected.',
           },
           {
-            text: 'Programmes on that scale run for years, through dozens of trade contracts, and they produce exactly the disputes above. This practice is built to facilitate procurement and subcontract disputes on that pipeline. I am naming it as the shape of the market, not as a list of files — nothing here is a claim to be on any of these projects.',
+            text: 'Programmes on that scale run for years, through dozens of trade contracts. This practice is built to facilitate procurement and subcontract disputes on that pipeline. I am naming it as the shape of the market, not as a list of files — nothing here is a claim to be on any of these projects.',
           },
         ],
       },
@@ -255,8 +255,8 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
             text: 'The Personal Information Protection and Electronic Documents Act remains the federal private-sector privacy statute. Bill C-27, which would have enacted the Consumer Privacy Protection Act and the Artificial Intelligence and Data Act, died without royal assent when the session ended, and was not reinstated. A newer bill — C-36, for a Protecting Privacy and Consumer Data Act — was introduced in June 2026 and was at second reading when this page was written. Canada has no federal AI statute.',
           },
           {
-            lead: 'Ontario has one AI instrument, and it is mostly not switched on.',
-            text: 'The Enhancing Digital Security and Trust Act, 2024 conditions each of its artificial-intelligence obligations on regulations prescribing who they apply to and when. Two regulations have been made under it — one on cyber security, one on digital technology affecting people under 18 — and neither is the AI one.',
+            lead: "Ontario's AI-relevant statute has its artificial-intelligence obligations switched off.",
+            text: 'The Enhancing Digital Security and Trust Act, 2024 conditions the artificial-intelligence obligations in its section 5 on regulations prescribing which public sector entities they apply to and in what circumstances. Two regulations have been made under it — one on cyber security, one on digital technology affecting people under 18 — and neither is the AI one.',
           },
           {
             /* THE LEAD WAS "And no federal or Ontario statute requires data to
@@ -337,7 +337,7 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
     disputeTypes: [
       {
         name: 'Connection assessment',
-        body: "Disputes arising out of the IESO connection assessment and approval process — the system impact assessment, the transmitter's customer impact assessment, and the conditions attached to either.",
+        body: "Disputes arising out of the IESO's and transmitter's connection assessment and approval process — the system impact assessment, the transmitter's customer impact assessment, and the conditions attached to either.",
       },
       {
         name: 'Leave to construct',
@@ -386,7 +386,7 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
           },
           {
             lead: 'Connection runs through the IESO, and it is not a queue.',
-            text: 'The IESO operates a six-stage connection process and calls it connection assessment and approval. An application is assessed by system impact assessment, and the transmitter generally runs a customer impact assessment after the draft. The IESO states plainly that it does not use an interconnection queue — it works from a defined set of committed projects instead, so "our place in the queue" describes nothing.',
+            text: 'The IESO operates a connection process of up to six stages. An application is assessed by system impact assessment, and the transmitter generally runs a customer impact assessment after the draft. The IESO states plainly that it does not use an interconnection queue — it works from a defined set of committed projects instead, so "our place in the queue" describes nothing.',
           },
           {
             lead: 'And large loads now have their own gate.',
@@ -407,7 +407,7 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
                the extract's *quotations* rather than against its adversarial
                check. R18(b) tracks this fact as volatile; that is a different
                problem from never having been established. */
-            text: 'Section 28.1 of the Electricity Act, 1998 came into force on 11 December 2025 and creates a connection-approval requirement for a "specified load facility", a category defined to include data centres meeting criteria that may be set by regulation. The enabling section is in force; the Ministry\'s August 2026 consultation still described the connection-approval regulation as under consideration, and described it as something the province was considering drafting. That consultation, on an assessment framework for new data centres, ran a comment period to 12 September 2026.',
+            text: 'Section 28.1 of the Electricity Act, 1998 came into force on 11 December 2025. It bars a transmitter or distributor from connecting a "specified load facility" unless it is satisfied that the connection requirements the regulations specify have been complied with. That category is defined to include data centres meeting criteria that may be set by regulation. The enabling section is in force; the Ministry\'s August 2026 consultation still described the connection-approval regulation as under consideration, and described it as something the province was considering drafting. That consultation, on an assessment framework for new data centres, ran a comment period to 12 September 2026.',
           },
         ],
         note: "Described so the process is legible, not applied to anyone's file — and the terms above are the ones these bodies actually use. Sourced in docs/reference/ontario-energy-regulatory.md.",
@@ -460,8 +460,8 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
         body: 'Whether an impairment falls inside the minor injury definition, and the monetary limit that follows if it does.',
       },
       {
-        name: 'Treatment and assessment plans',
-        body: 'Denied or partially approved plans, competing assessments, and disputes about the reasonableness and necessity of proposed treatment.',
+        name: 'Medical and rehabilitation benefits',
+        body: 'Which treatment, services or goods are payable, and the conditions a guideline may attach to them.',
       },
       {
         name: 'Catastrophic impairment',
@@ -608,7 +608,7 @@ export const PRACTICE_PAGES: Record<PracticeSlug, PracticePage> = {
           },
           {
             lead: 'And the end of the road.',
-            text: 'Both statutes also provide for the company to be wound up, or liquidated and dissolved, including on the ground that it is just and equitable, and the Ontario Partnerships Act lets a partner apply to the court to dissolve a partnership on grounds that include conduct making it not reasonably practicable to carry on business together.',
+            text: 'Both statutes also provide for the company to be wound up, or liquidated and dissolved, including on the ground that it is just and equitable, and the Ontario Partnerships Act lets a partner apply to the court to dissolve a partnership on grounds that include conduct by a partner other than the one suing, in matters relating to the partnership business, that makes it not reasonably practicable for the other partners to carry on the business in partnership with that partner.',
           },
           {
             lead: 'One provision points the other way.',

src/pages/bio.astro

@@ -136,12 +136,18 @@ const PROCESSES = [
                 never appear in the same element, so no proximity grep reaches
                 it — and it was found by reading the rendered PDF. The scope
                 belongs on the arbitration clause alone, where Q39's legal gate
-                puts it. */
+                puts it.
+
+                ⚠️ AND THE VERB IS `accept appointments`, NOT `act as`. §4
+                verifies exactly one practised role — "Mediator" — and says in
+                terms that "Arbitrator" as a practised role is NOT a row; what it
+                verifies is that appointments are ACCEPTED. `/` and `/about/`
+                carry the same construction. */
             }
-            I act as a neutral — as a mediator, as an arbitrator in commercial matters,
-            and in med-arb where the parties want one neutral across both phases.
-            I read the contract and the technical record underneath it rather than
-            either side's summary of them.
+            I act as a neutral. I accept appointments as a mediator, as an arbitrator
+            in commercial matters, and in med-arb where the parties want one neutral
+            across both phases. I read the contract and the technical record underneath
+            it rather than either side's summary of them.
           </p>
           <p>
             I am {ROLE.title} at {BOUTIQUE}, with {ROLE.litigationLine} across

src/pages/fees.astro

@@ -131,12 +131,12 @@ const ARBITRATION_ROWS = [
   },
   {
     item: 'Documents-only or expedited — simple',
-    detail: 'Flat fee, agreed in the first procedural order.',
+    detail: 'Flat fee.',
     fee: money(FEES.arbitration.documentsOnlySimple),
   },
   {
     item: 'Documents-only or expedited — complex',
-    detail: 'Flat fee. Which band applies is settled before the appointment.',
+    detail: 'Flat fee.',
     fee: money(FEES.arbitration.documentsOnlyComplex),
   },
 ];

src/pages/legal/privacy.astro

@@ -44,8 +44,12 @@
  *     record is ever deleted.** Only a record written with a near-future `ttl`
  *     and watched to vanish proves that. docs/05's definition of done carries
  *     "TTL set and verified by test record" and `docs/06`'s cutover checklist
- *     names this page as what that item protects. **Both halves before this page
- *     is public.** See the TODO(pouya) on the retention section below, and §9 Q60.
+ *     names this page as what that item protects. ⚠️ **This read "both halves
+ *     before this page is public" and the page went public first — Pouya's
+ *     ruling of 2026-09-03: publish, then confirm the deletion, reading from
+ *     2026-09-04.** So the second half is now owed rather than pending, which is
+ *     a weaker position and is recorded as one. See the comment on the retention
+ *     section below, and §9 Q60.
  *
  * ⚠️ **NO LICENSURE CLAIM AND NO ANSWER TO THE CAPACITY QUESTION.** A privacy
  * policy is where "legal advice" phrasing arrives by convention. §4 records
@@ -81,7 +85,7 @@ const RETENTION_MONTHS = 24;
 
 /** Bump this on ANY substantive edit. A privacy policy with a stale date is a
  *  policy a reader cannot tell they are reading an old version of. */
-const LAST_UPDATED = '2 September 2026';
+const LAST_UPDATED = '3 September 2026';
 
 /* Rendered from the form's own field list, so the two cannot drift. `consent`
    and the honeypot are absent from `INTAKE_FIELDS` deliberately and are
@@ -226,15 +230,15 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
 
         <h2>How long it is kept</h2>
         {
-          /* TODO(pouya): has a test record been written to the intake table with a
-             near-future `ttl` and OBSERVED TO DISAPPEAR? AGENTS.md §9 Q60. The
-             sentence below asserts a MECHANISM, not just a period, and the
-             setting being on does not prove the mechanism runs. The table
-             setting is confirmed — §7 holds that status and this comment does
-             not restate it, because it did restate it once and went stale within
-             the day (§12 R19). Do not answer this from the handler code, which
-             only writes the attribute. This page must not go public until a
-             deletion has actually been seen. */
+          /* The sentence below asserts a MECHANISM, not just a period, and the
+             mechanism is still unobserved — AGENTS.md §9 Q60, open. **Pouya
+             ruled 2026-09-03 that the page publishes now and the deletion is
+             confirmed after launch**; the observation window opened 2026-09-02
+             and the earliest useful reading is 2026-09-04 (`docs/09` Part 10).
+             That decision is why this is no longer a `TODO(pouya)`. The table
+             setting lives in §7 and is deliberately not restated here — it was
+             once, and went stale within the day (§12 R19). Do not answer Q60
+             from the handler code, which only writes the attribute. */
         }
         <p>
           <strong>{RETENTION_MONTHS} months from the date you send it</strong>,
@@ -307,15 +311,18 @@ const COLLECTED = INTAKE_FIELDS.map((field) => field.label);
               {ANALYTICS.provider === 'plausible' ? 'Plausible' : 'Fathom'},
               which is cookieless and collects no personal information and no
               cross-site identifiers. There is nothing to consent to and no
-              banner, because nothing is stored on your device.
+              banner, because it sets no cookies and stores no identifier on
+              your device.
             </p>
           ) : (
             <p>
               <strong>This site sets no cookies and runs no analytics.</strong>
-              There is no tracking script on any page, nothing is stored on your
-              device, and there is therefore nothing to consent to and no
-              banner. If that changes, this page changes on the same day and its
-              last updated date moves with it.
+              There is no tracking script on any page, and there is therefore
+              nothing to consent to and no banner. If cookies or analytics are
+              ever introduced, this page changes on the same day and its last
+              updated date moves with it. Your browser does cache this site's
+              fonts, stylesheets and images for up to a year so a return visit
+              loads faster, and those are the same files for every visitor.
             </p>
           )
         }

src/pages/legal/terms.astro

@@ -52,7 +52,7 @@ const ldImage = await getImage({
 const graph = pageGraph(new URL(ldImage.src, Astro.site).href);
 
 /** Bump on any substantive edit. See the note on the privacy page. */
-const LAST_UPDATED = '31 August 2026';
+const LAST_UPDATED = '3 September 2026';
 ---
 
 <BaseLayout
@@ -152,9 +152,9 @@ const LAST_UPDATED = '31 August 2026';
           belong to that institution and are marked as quotations.
         </p>
         <p>
-          Links out go to sources — statutes, regulators, tribunals and
-          institutions. I do not control those sites and am not responsible for
-          what they say.
+          Links out go to an institution's published rules and to my LinkedIn
+          profile. I do not control those sites and am not responsible for what
+          they say.
         </p>
 
         <h2>Changes</h2>

src/pages/mediation.astro

@@ -220,15 +220,18 @@ const FORMATS = [
         }
         <Undertaking>{CONDUCT_UNDERTAKINGS.mediationCaucus}</Undertaking>
         {
-          /* The without-prejudice question is answered by pointing, not by
-            characterising legal effect. AGENTS.md §4 bars this repository from
-            concluding a proposition of law, and docs/03's `[unestablished]`
-            pattern says to write around the capacity question. */
+          /* WITHOUT PREJUDICE IS ATTRIBUTED TO THE AGREEMENT, NEVER ASSERTED
+            AS LAW — and it may be narrowed but NOT deleted. §4 bars this
+            repository from concluding a proposition of law, and no extract
+            establishes the effect. But docs/01 §/mediation/ item 5 requires the
+            without-prejudice framing and docs/03 keeps the term as permitted,
+            so removing it breaches the spec that requires it. */
         }
         <p>
-          Mediation is conducted on a without-prejudice basis. What that means
-          for a particular file, and what survives it, is a question for each
-          party's own counsel rather than for the neutral.
+          Whether the session is without prejudice, and what that covers, is
+          settled by the agreement to mediate. What being without prejudice
+          means for a particular file, and what survives the session, is a
+          question for each party's own counsel rather than for the neutral.
         </p>
       </div>
     </div>