feat: price med-arb by phase, attest the conflicts undertaking, and answer the first real spam

Pouya's rulings of 2026-09-03 (the last two D20 findings) and 2026-09-04 (the
spam observation and four mitigations), in one change set.

D20 finding 10 — med-arb is billed BY PHASE, each phase at the rates already
published, so /fees/'s "Every figure is on this page" is true as written rather
than narrowed. FEES.medArb is the single source; docs/07 §Med-arb carries the
rule INTERIM against R5, and R5 now carries it back, because a derived price
moves silently when a rate moves.

D20 finding 13 — conduct undertaking (g), attested 2026-09-03, published as his
wording verbatim on /legal/privacy/ and /contact/. The clause that raised the
finding promised to DISCLOSE a conflicts check's outcome, which the attestation
does not cover; it is struck. D20 now partitions 17 fixed / 2 refuted / 1 owed.

Spam, 2026-09-04 — recorded in docs/05 §Observed abuse with the date and
signature. A second honeypot (a decoy checkbox, own class, `hidden`, a label
that tells a human not to tick it) and scoring that LABELS and never rejects:
nothing is dropped, nothing new is stored, and only the operator notification
changes. Q65 opens the WAF cost call.

The timing floor could not be built: there is no timing check and never has
been. docs/05 carries it struck, and every mechanism that would give a real
per-visitor clock breaks zero-JS, handler-and-form-only, or D1. Q66.

configure.mjs gains section 5 — a custom origin request policy forwarding
CloudFront-Viewer-Address on /api/*. Written, dry-run against the live
distribution, NOT applied. It reads the handler's own header reads and refuses
to run if the whitelist omits one.

And reading the live account to do it found four AGENTS.md §7 rows saying the
intake backend was undeployed, two days after it went live — corrected against
get-function-configuration, get-routes, get-stage, get-policy and the deployed
zip, which was downloaded and read.

Review: adversarial-reviewer only (claims-auditor is D20's cutover pass and has
run). Round 1 five lenses, 56 findings, 7 blocking, 4 refuted by an independent
refuter; round 2 four lenses, 36 findings, 33 of them defects in round 1's own
repairs. Stopped at two per D19.

Gates, exit status read for each: check 0 · build 0 (23 pages) · check:claims 0
· check:intake 0 · og:proof 0 · lint 0 · spam-score.test 39/39 with 6/6 mutations
killed · router.test 30/30 · minifier grep 1 (clean) · lighthouse 0, no category
below 95 · configure.mjs dry run 0, nothing written.

Nothing deployed and nothing applied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

src/pages/fees.astro

@@ -36,6 +36,17 @@
  * sentence ships **adjacent to the overtime row**, not in a footnote. Same
  * structural rule as `PROCESS_FRAMING` beside the five timings under Q43.
  *
+ * ✅ **MED-ARB IS PRICED HERE AS OF 2026-09-03, AND IT CARRIES NO FIGURE.**
+ * Pouya's ruling closing D20 finding 10: it is billed **by phase**, each phase
+ * at the rates already on this page. The finding was that the hero promises
+ * *"Every figure is on this page"* while §4 Offerings carries a Med-Arb row
+ * that `docs/07` priced nowhere — a promise wider than the card. It is closed by
+ * pricing the offering, not by narrowing the promise, so the hero sentence is
+ * unchanged and is now true as written. **Do not give the section a rate row:**
+ * a med-arb figure would be a fourth price for a process priced twice, and the
+ * first thing it would do is disagree with one of them. `FEES.medArb` holds the
+ * three sentences; `docs/07` §Med-arb holds the rule. INTERIM, reviewed at R5.
+ *
  * ⚠️ **NO TRIBUNAL-SECRETARY RATE AND NO SETTLEMENT COUNSEL.** Both are struck
  * rows in §4 Offerings — the first removed by Pouya from D14, the second by him
  * as his own error in `docs/01`. **A rate on a fee page is an offer**, which is
@@ -240,8 +251,35 @@ const ARBITRATION_ROWS = [
     </div>
   </section>
 
-  {/* ---- 4. Other services ---------------------------------------------- */}
+  {/* ---- 4. Med-arb ------------------------------------------------------ */}
   <section class="section section-alt reveal">
+    <div class="wrap">
+      <div class="section-head">
+        <SectionHeading
+          eyebrow="Med-arb"
+          level={2}
+          lede="One appointment, two processes. Each phase is charged at the rates for that process."
+        >
+          <span slot="heading">Billed by phase.</span>
+        </SectionHeading>
+      </div>
+      {
+        /* NO `<dl class="rates">` HERE, AND THE ABSENCE IS THE POINT — see the
+          header. Every other section on this page pairs an item with a figure;
+          this one has no figure of its own, and giving it a row would mean
+          inventing one. The three sentences come from `FEES.medArb` so the rule
+          lives beside the numbers it points at rather than in this template. */
+      }
+      <ul class="notes" role="list">
+        <li>{FEES.medArb.rule}</li>
+        <li>{FEES.medArb.noSeparateFee}</li>
+        <li>{FEES.medArb.termsApply}</li>
+      </ul>
+    </div>
+  </section>
+
+  {/* ---- 5. Other services ---------------------------------------------- */}
+  <section class="section reveal">
     <div class="wrap">
       <div class="section-head">
         <SectionHeading
@@ -304,8 +342,8 @@ const ARBITRATION_ROWS = [
     </div>
   </section>
 
-  {/* ---- 5. Cancellation ------------------------------------------------ */}
-  <section class="section reveal">
+  {/* ---- 6. Cancellation ------------------------------------------------ */}
+  <section class="section section-alt reveal">
     <div class="wrap">
       <div class="section-head">
         <SectionHeading
@@ -334,7 +372,7 @@ const ARBITRATION_ROWS = [
     </div>
   </section>
 
-  {/* ---- 6. Terms -------------------------------------------------------- */}
+  {/* ---- 7. Terms -------------------------------------------------------- */}
   <section class="section section-inverse reveal">
     <div class="wrap">
       <div class="section-head">