feat: cut /legal/privacy/ §Who can see it to four plain statements; name SML Company Ltd on the consent; close Q64 moot

Two rulings from Pouya, 2026-09-02.

(1) The section stays generic — "it over-explains technical mechanics that
belong in the evidence file, not in front of an inquirer." Deleted: the
measurement paragraph, the root-credential sentence, the SSO/federated-login
enumeration, the resource-policy clause, the "company that runs a database"
aside, the deploy-credential sentence and the three-copies summary. All of it
stays true and stays measured in AGENTS.md §7 and the evidence file, which now
maps each shipped sentence to what it rests on.

(2) The consent string names the corporation: "I consent to SML Company Ltd
storing and using the information in this form…". docs/05 §Consent text moves
with it, proven byte-identical. Two new §4 rows carry the attestations the copy
rests on.

(3) The §Who can see it approval closes via the page read-through, which is now
blocker 2 in docs/06's callout rather than a checklist line.

Q64 closes MOOT — the paragraph it was about was deleted, so it gates nothing.
The underlying gap is unchanged: §7 records root as held by Pouya, not held only
by Pouya, and nothing about root custody may be published without asking again.

Two sentences were added back under review: the shared-account disclosure, to
§Where it is stored (a storage disclosure, never named in the ruling — without
it no page said the intake sits in a shared account), and one naming SML Company
Ltd in the policy, because a consent naming a company the linked policy never
mentions is an accountability gap.

adversarial-reviewer, two rounds, 14 findings, all resolved, none declined;
nine of round 2's ten were defects in round 1's own repairs. claims-auditor
correctly deferred to cutover per D20.

Gates, exit status read: check 0 · build 0 (23 pages) · check:claims 0
(12 patterns, 33 approved strings) · check:intake 0 · og:proof 0 · lint 0 ·
lighthouse 0, worst of 23 99/100/100/100. Tripwire proven both ways — exit 0 on
the revised page, exit 1 with 5 matches on the bd282aa bytes. Regex untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

src/data/intake.ts

@@ -172,9 +172,17 @@ export const INTAKE_FIELDS: readonly IntakeField[] = [
  * is the one the inquirer ticks; both ship on `/contact/`, which is deliberate:
  * `docs/01` requires the page to carry the notice, and `docs/05` requires the
  * checkbox to carry it too.
+ *
+ * ⚠️ **IT NAMES SML COMPANY LTD — Pouya's ruling, 2026-09-02 — AND THREE
+ * CONSTRAINTS RIDE ON THAT.** **Name only, no terminal period**, and never
+ * beside the licence-status row (`AGENTS.md` §4). **`docs/05` §Consent text is a
+ * byte-identical second copy with no `check:` script over it**, so it moves with
+ * this string. And **`/legal/privacy/` must keep naming the same party** — it
+ * does, under §Why it is collected; a consent naming a company the linked policy
+ * never mentions is an accountability gap, not a matter of voice.
  */
 export const CONSENT_TEXT =
-  'I consent to Pouya Lajevardi storing and using the information in this form ' +
+  'I consent to SML Company Ltd storing and using the information in this form ' +
   'to respond to my inquiry and to run a conflicts check. I understand that ' +
   'submitting this form does not create a retainer, does not appoint a neutral, ' +
   'and does not itself establish a mediator–party relationship.';