feat: rule Q62 by stating the truth; strike the /med-arb/ gloss; re-stamp R18

Pouya's four rulings of 2026-09-01, applied 2026-09-02.

Q62 — RULED "state the truth", not "remove the access". /legal/privacy/
now says two people can read the intake table, names their role, and adds
the two stronger facts the false sentence had crowded out: the handler
role holds PutItem only, and adr-sml-deploy is implicitDeny on all seven
read and write actions. Wording is subject to Pouya's read-through —
Q63(a), with a TODO(pouya) beside the copy.

The ruling named one sentence; a vocabulary sweep found the falsehood in
three places, and the audit then found two more. Five paragraphs now
answer "who can see it" and change together.

The tripwire stays permanently, per ruling, and grew from two
alternatives to five. Every alternative is one string that reached dist/.
Proven both ways against the pre-correction page rebuilt from bd282aa:
exit 1 with 5 matches at dist/legal/privacy/index.html:54,67,67,68,72;
exit 0 on the corrected page, self-test 12 patterns / 36 approved
strings.

/med-arb/ — the gloss is struck with no replacement, per ruling. The
strike left "the section above" pointing at the ADRIC rule set and "the
agreement" with no antecedent; both fixed. The bare designations line
sitting under ADRIC's quoted competence requirement is also struck, which
goes beyond the ruling and is flagged for Pouya.

R18 — re-stamped, two-tier: (a)(c)(d) re-verified against a source,
(b)(e)(f)(g) held on a cadence judgement. All seven hold, no shipped
sentence changed. R18's trigger had NO cutover checklist item and had
stamped five extracts of seven; both fixed. Candidate limb (h) flagged.

R10 — fired and unsatisfied; left open on instruction.

The evidence behind the new privacy sentence was weaker than the
sentence. Re-measured: 33 of 33 roles simulated (23 of 26 carried inline
policies nobody had read; the two CDK lookup roles can read the table),
four trust policies, the CloudFormation escalation path for all five
users, 0 federated providers, root recorded. Every read path terminates
at the same two people.

Two review rounds, 36 findings. 35 fixed, 1 declined. Five of round 2's
were defects in round 1's own fixes; stopped at two per D19.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/01-architecture.md

@@ -386,11 +386,27 @@ the C.Med-Arb endpoint" until 2026-08-29; C.Med-Arb is off the site.)*
    Q.Arb, which is what med-arb requires. The page says he conducts med-arb and
    stops."* The section is **rewritten, not edited** — it earned its credibility
    from an incomplete credential and now says what med-arb demands of one
-   neutral and that he holds both designations.
+   neutral. ⚠️ **AND IT NO LONGER RESTATES THE DESIGNATIONS EITHER —
+   2026-09-02, `claims-auditor` D20 pass, finding F.** §Why this practice held a
+   bare `DESIGNATIONS_HELD_LINE` sentence sitting directly beneath §Rules'
+   quotation of ADRIC requiring *"a high level of practitioner competence"*, so
+   the designations read as meeting a bar ADRIC answers with the Chartered
+   Med-Arb — struck from this site entirely. The section now makes **no
+   credential claim at all**; `/about/` publishes them and the JSON-LD carries
+   them. Do not reinstate one here.
 5. **The ADRIC Med-Arb Rules**, which this spec did not mention and which exist:
-   a published rule set, presented to ADRIC's membership at its 2019 annual conference, drafted for domestic
-   commercial disputes and designed to work with its Mediation and Arbitration
-   Rules. Sourced: `docs/reference/adric-rules.md` Finding 2. Quote ADRIC's own
+   ~~a published rule set, presented to ADRIC's membership~~ — **CORRECTED
+   2026-09-02, `claims-auditor` D20 pass, finding 6.** The source says a
+   **discussion draft** was presented, not the rules; `adric-rules.md` Finding 2
+   records no adoption and no effective date, in deliberate contrast to the
+   Arbitration Rules ("effective March 1, 2025") and the Mediation Rules ("the
+   existing rules remain in effect"). The page was corrected on 2026-09-01 and
+   **this line still instructed the struck form for a day** — the Q.Arb lesson
+   exactly: page fixed, spec still telling the next implementer to write the
+   false version. Write it as **presented to the membership as a discussion
+   draft at ADRIC's 2019 annual conference** — drafted for domestic commercial
+   disputes and designed to work with its Mediation and Arbitration Rules.
+   Sourced: `docs/reference/adric-rules.md` Finding 2. Quote ADRIC's own
    framing rather than paraphrasing it, and **keep its superlatives inside the
    quotation marks** — Finding 5 lists the two not to lift.