feat: price med-arb by phase, attest the conflicts undertaking, and answer the first real spam

Pouya's rulings of 2026-09-03 (the last two D20 findings) and 2026-09-04 (the
spam observation and four mitigations), in one change set.

D20 finding 10 — med-arb is billed BY PHASE, each phase at the rates already
published, so /fees/'s "Every figure is on this page" is true as written rather
than narrowed. FEES.medArb is the single source; docs/07 §Med-arb carries the
rule INTERIM against R5, and R5 now carries it back, because a derived price
moves silently when a rate moves.

D20 finding 13 — conduct undertaking (g), attested 2026-09-03, published as his
wording verbatim on /legal/privacy/ and /contact/. The clause that raised the
finding promised to DISCLOSE a conflicts check's outcome, which the attestation
does not cover; it is struck. D20 now partitions 17 fixed / 2 refuted / 1 owed.

Spam, 2026-09-04 — recorded in docs/05 §Observed abuse with the date and
signature. A second honeypot (a decoy checkbox, own class, `hidden`, a label
that tells a human not to tick it) and scoring that LABELS and never rejects:
nothing is dropped, nothing new is stored, and only the operator notification
changes. Q65 opens the WAF cost call.

The timing floor could not be built: there is no timing check and never has
been. docs/05 carries it struck, and every mechanism that would give a real
per-visitor clock breaks zero-JS, handler-and-form-only, or D1. Q66.

configure.mjs gains section 5 — a custom origin request policy forwarding
CloudFront-Viewer-Address on /api/*. Written, dry-run against the live
distribution, NOT applied. It reads the handler's own header reads and refuses
to run if the whitelist omits one.

And reading the live account to do it found four AGENTS.md §7 rows saying the
intake backend was undeployed, two days after it went live — corrected against
get-function-configuration, get-routes, get-stage, get-policy and the deployed
zip, which was downloaded and read.

Review: adversarial-reviewer only (claims-auditor is D20's cutover pass and has
run). Round 1 five lenses, 56 findings, 7 blocking, 4 refuted by an independent
refuter; round 2 four lenses, 36 findings, 33 of them defects in round 1's own
repairs. Stopped at two per D19.

Gates, exit status read for each: check 0 · build 0 (23 pages) · check:claims 0
· check:intake 0 · og:proof 0 · lint 0 · spam-score.test 39/39 with 6/6 mutations
killed · router.test 30/30 · minifier grep 1 (clean) · lighthouse 0, no category
below 95 · configure.mjs dry run 0, nothing written.

Nothing deployed and nothing applied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

scripts/check-intake.mjs

@@ -23,10 +23,15 @@
  * Both files are read directly — Node strips the types out of the `.ts` — so
  * this script holds no third copy of the list.
  */
-import { INTAKE_FIELDS, HONEYPOT_FIELD } from '../src/data/intake.ts';
+import {
+  INTAKE_FIELDS,
+  HONEYPOT_FIELD,
+  DECOY_CHECKBOX_FIELD,
+} from '../src/data/intake.ts';
 import {
   FIELDS as SERVER_FIELDS,
   HONEYPOT,
+  DECOY_CHECKBOX,
 } from '../backend/intake/fields.mjs';
 
 /**
@@ -81,6 +86,63 @@ if (serverNames.includes(HONEYPOT_FIELD)) {
   );
 }
 
+/* THE SECOND HONEYPOT GETS THE SAME THREE CHECKS, and it needs a fourth.
+   Added 2026-09-04 with the decoy checkbox. Every failure mode below is silent
+   in production: a mismatched name disables the trap, a name inside `FIELDS`
+   turns it into ordinary validation, and two traps sharing one name is one
+   trap with a comment claiming there are two. */
+if (DECOY_CHECKBOX !== DECOY_CHECKBOX_FIELD) {
+  problems.push(
+    `decoy checkbox name differs: form "${DECOY_CHECKBOX_FIELD}", handler ` +
+      `"${DECOY_CHECKBOX}". The form renders one name and the handler checks ` +
+      'another, so the trap is disabled and nothing fails.',
+  );
+}
+if (serverNames.includes(DECOY_CHECKBOX_FIELD)) {
+  problems.push(
+    `the decoy checkbox "${DECOY_CHECKBOX_FIELD}" is in the handler's FIELDS ` +
+      'table; it must be checked separately, or ticking it would fail ' +
+      'validation instead of sending the bot to the success page.',
+  );
+}
+if (clientNames.includes(DECOY_CHECKBOX_FIELD)) {
+  problems.push(
+    `the decoy checkbox "${DECOY_CHECKBOX_FIELD}" is in the form's ` +
+      'INTAKE_FIELDS table; it would render as a real, visible field.',
+  );
+}
+/* `consent` is submitted by the form and read by the handler, and it is in
+   NEITHER field table — so the two checks above cannot see a collision with it.
+   A honeypot named `consent` would discard every valid submission behind the
+   success page, which is the worst failure this file can fail to catch. */
+for (const [what, name] of [
+  ['honeypot', HONEYPOT_FIELD],
+  ['decoy checkbox', DECOY_CHECKBOX_FIELD],
+]) {
+  if (name === 'consent') {
+    problems.push(
+      `the ${what} is named "consent", which the form submits and the handler ` +
+        'requires — every valid submission would be discarded behind the ' +
+        'success page.',
+    );
+  }
+}
+if (DECOY_CHECKBOX_FIELD === HONEYPOT_FIELD) {
+  problems.push(
+    'the two honeypots share the name ' +
+      `"${HONEYPOT_FIELD}" — that is one trap, not two, and the second ` +
+      'mechanism (a checkbox that must arrive absent) would not exist.',
+  );
+}
+/* And the first honeypot must not appear on the form's own table either — the
+   mirror of the check above it, which existed only for the handler's side. */
+if (clientNames.includes(HONEYPOT_FIELD)) {
+  problems.push(
+    `the honeypot "${HONEYPOT_FIELD}" is in the form's INTAKE_FIELDS table; ` +
+      'it would render as a real, visible field.',
+  );
+}
+
 for (const clientField of INTAKE_FIELDS) {
   const serverField = server.find((f) => f.name === clientField.name);
   if (!serverField) continue;
@@ -128,7 +190,9 @@ for (const clientField of INTAKE_FIELDS) {
 
 console.log(
   `check:intake — ${clientNames.length} form fields, ${serverNames.length} ` +
-    'handler fields, compared on name, label, requiredness, cap and option set.',
+    'handler fields, compared on name, label, requiredness, cap and option ' +
+    `set; 2 honeypots ("${HONEYPOT_FIELD}", "${DECOY_CHECKBOX_FIELD}") ` +
+    'compared on name and checked out of both tables.',
 );
 if (problems.length > 0) {
   console.error(`\nINTAKE TABLE MISMATCH — ${problems.length}:`);