feat: build steps 7a-10 — the site is complete and reviewable at 22 pages

Steps 7a through 10 as one authorised run. Nothing deployed (D11).

7a  Lighthouse returns as `lighthouse@13.4.1` + `chrome-launcher`, NOT
    `@lhci/cli`. AGENTS.md §7's advisory attribution was wrong: the carriers
    were @lhci/cli's own `tmp` and @puppeteer/browsers' `extract-zip`, not
    Lighthouse, which audits clean. A deliberate deviation from R11's literal
    trigger, recorded with what it costs. Local gate; CI has no Chrome.

7b  OG card generator (satori + sharp) discharges R15 — 20 typed cards plus
    per-article cards; the portrait stays on / and /about/ by Q40. Insights
    plumbing: ArticleCard, Prose, the index, the article route, articleGraph,
    and /'s section 7. Card copy is constrained structurally because text in a
    JPEG cannot be grepped by check:claims: every headline IS its page's <h1>,
    enforced by `npm run og:proof`.

7c  Five drafted launch articles, draft: true / reviewedByPouya: false. An
    independent compliance audit returned 76 findings and 57 unsourced
    assertions; all blocking and should-fix applied.

8   /contact/, the intake form, and backend/intake/ (undeployed). Plain HTML
    POST to a same-origin /api/intake with a 303 redirect, so the form works
    with zero JavaScript. docs/05 records three deliberate deviations.

9   /fees/ on Q59's ruling — overtime runs from the session cap, and the
    reservation point ships adjacent to the rate. One-page PDF bio discharges
    R16; /bio/ is its source, so the circulated artefact stays inside the
    review apparatus.

10  /legal/privacy/ and /legal/terms/, written to the backend as built. Three
    of the policy's statements are derived and cannot drift.

Also: /about/'s inverse credentials band (approved at step 6); Q59 closed;
R15 and R16 discharged; and a fix to shipped copy — /practice/energy/ asserted
the absence of a regulation the source extract says must not be asserted.

Review: adversarial-reviewer, two rounds (D20/D19). Round 1 returned 16
findings including two blocking — an invisible ghost button on /fees/ at
1.00:1 that Lighthouse scored 100, and a privacy policy that named one data
processor when there are two. All 16 acted on.

Lighthouse, 22 pages, mobile: performance 99-100, accessibility 100,
best practices 100, SEO 100 on every indexable page, CLS 0.000.

AGENTS.md entry (ah) has the detail, including four of my own verification
commands that were wrong and what each of them nearly caused.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/01-architecture.md

@@ -49,7 +49,26 @@ decision, not an aesthetic one.
 /legal/terms/                    Terms of use
 ```
 
-Nineteen fixed URLs plus one per article.
+Nineteen fixed URLs plus one per article — **and three more added at build steps
+8 and 9, all three `noindex` and all three excluded from the sitemap in
+`astro.config.mjs`.** They are utilities rather than pages in the IA above, which
+is why they are listed here rather than in it:
+
+```
+/contact/received/               The intake form's success landing page
+/contact/could-not-send/         Its failure landing page
+/bio/                            Source of the one-page PDF (R16)
+```
+
+The two `/contact/` pages exist because the site ships **zero JavaScript**, so
+the form is a plain POST and the handler answers `303 See Other` to a real URL —
+`docs/05` §Build step 8 has the reasoning. `/bio/` exists so the PDF circulated
+with an appointment proposal is a *rendering of a reviewed page* rather than a
+document outside this project's review apparatus.
+
+**So: 22 built pages plus one per published article.** `npm run lighthouse`
+enumerates them from `dist/` rather than from this list, which is why this count
+being stale could never make the gate miss a page.
 
 ### URL rules
 
@@ -191,8 +210,30 @@ to an appointment. This page carries the verifiable record.
 7. `Person` JSON-LD. Downloadable one-page PDF bio — brief §VIII lists this as
    an asset for circulation with appointment proposals.
 
-> **The PDF bio ships at BUILD STEP 9, alongside `/fees/` — deferred by Pouya
-> 2026-08-28 (Q45), tracked as `AGENTS.md` §12 **R16**.** His reasoning: it is a
+> ✅ **SHIPPED AT BUILD STEP 9, 2026-08-31. R16 / Q45 DISCHARGED.**
+> `public/pouya-lajevardi-bio.pdf` exists, is committed, and this page links it
+> between the biography and the credentials.
+>
+> **The two decisions R16 left open are both taken, and the second makes the
+> first safe.** *(a)* Neither "generated at build" nor "authored once": the bio
+> is a **page**, `src/pages/bio.astro`, so every line is reviewed by the same
+> apparatus as every other page — and `npm run bio:pdf` renders the PDF from the
+> built page through the Chrome that Lighthouse already requires, so it adds no
+> dependency. It is **not** part of `astro build`, because CI has no Chrome.
+> *(b)* It carries **nothing the site does not** — every line renders from
+> `CREDENTIALS`, `ROLE`, `BOUTIQUE`, `PRACTICE_AREAS`, `FEES` and `CONTACT`. No
+> matter list (which R16 correctly said would collide with §4 Forbidden), no
+> referees, no figure that is not on `/fees/`.
+>
+> ⚠️ **`npm run bio:pdf` asserts ONE PAGE and writes nothing if the count is
+> wrong.** And reading the rendered PDF caught a breach the source review had
+> not: its opening clause scoped **mediation** commercial, which Q56 leaves
+> unscoped deliberately. Nothing in the build regenerates the PDF — `docs/06`'s
+> cutover checklist carries the re-render.
+
+> *Original deferral note, kept because its reasoning is why this is R16 rather
+> than a to-do.* **The PDF bio ships at BUILD STEP 9, alongside `/fees/` —
+> deferred by Pouya 2026-08-28 (Q45), tracked as `AGENTS.md` §12 **R16**.** His reasoning: it is a
 > derived artefact, so building it before `/about/` and `/fees/` are final means
 > building it twice, and an appointment proposal needs the fee card as much as
 > the bio. The two decisions below are **not** settled by the deferral and travel
@@ -620,8 +661,24 @@ Dependency-ordered, so nothing is blocked mid-stream:
 4. `/mediation/`, `/arbitration/`, `/med-arb/`
 5. `/practice/` and the six area pages
 6. `/process/`, `/for-parties/`
-7. `/insights/` plumbing, then the drafted articles
-8. `/contact/` and the intake backend
-9. `/fees/` — last, though no longer blocked: D14 confirmed the card
-10. `/legal/*` — written to match the backend as actually built
-11. Audit and cutover (`06-deployment.md`)
+7. ✅ `/insights/` plumbing, then the drafted articles — **built 2026-08-31.**
+   Step 7a returned Lighthouse (`AGENTS.md` §7, R11); 7b built the OG card
+   generator (R15) and the Insights routes; 7c drafted the five launch articles.
+   **The section is not live and cannot be**: D9 and `src/content.config.ts`
+   between them mean an article publishes only when Pouya sets both flags, and
+   `SiteHeader` keeps Insights out of the nav until two are live
+8. ✅ `/contact/` — **the page is built; the pipe behind it is not.** The handler
+   is written (`backend/intake/`) and undeployed, and the CloudFront `/api/*`
+   behaviour it posts to does not exist yet. Both are cutover items, and `docs/05`
+   §Build step 8 records three deliberate deviations from that spec
+9. ✅ `/fees/` — **built 2026-08-31 on Q59's ruling**, which settled where the
+   overtime hour starts (the session cap) and supplied the reservation point that
+   answers the rate card's arithmetic anomaly. The PDF bio shipped with it (R16)
+10. ✅ `/legal/privacy/` and `/legal/terms/` — **built 2026-08-31, written to the
+    backend as actually built.** Three of the privacy policy's statements are
+    DERIVED — the collected-data list from `INTAKE_FIELDS`, the retention period
+    from the handler's own figure, the analytics paragraph from
+    `ANALYTICS.installed` — so they cannot drift from the implementation
+11. Audit and cutover (`06-deployment.md`) — **not started. Nothing is deployed.**
+    `claims-auditor`'s single pass over the whole finished site (D20) is a blocking
+    item there and has not run