feat: rule Q62 by stating the truth; strike the /med-arb/ gloss; re-stamp R18

Pouya's four rulings of 2026-09-01, applied 2026-09-02.

Q62 — RULED "state the truth", not "remove the access". /legal/privacy/
now says two people can read the intake table, names their role, and adds
the two stronger facts the false sentence had crowded out: the handler
role holds PutItem only, and adr-sml-deploy is implicitDeny on all seven
read and write actions. Wording is subject to Pouya's read-through —
Q63(a), with a TODO(pouya) beside the copy.

The ruling named one sentence; a vocabulary sweep found the falsehood in
three places, and the audit then found two more. Five paragraphs now
answer "who can see it" and change together.

The tripwire stays permanently, per ruling, and grew from two
alternatives to five. Every alternative is one string that reached dist/.
Proven both ways against the pre-correction page rebuilt from bd282aa:
exit 1 with 5 matches at dist/legal/privacy/index.html:54,67,67,68,72;
exit 0 on the corrected page, self-test 12 patterns / 36 approved
strings.

/med-arb/ — the gloss is struck with no replacement, per ruling. The
strike left "the section above" pointing at the ADRIC rule set and "the
agreement" with no antecedent; both fixed. The bare designations line
sitting under ADRIC's quoted competence requirement is also struck, which
goes beyond the ruling and is flagged for Pouya.

R18 — re-stamped, two-tier: (a)(c)(d) re-verified against a source,
(b)(e)(f)(g) held on a cadence judgement. All seven hold, no shipped
sentence changed. R18's trigger had NO cutover checklist item and had
stamped five extracts of seven; both fixed. Candidate limb (h) flagged.

R10 — fired and unsatisfied; left open on instruction.

The evidence behind the new privacy sentence was weaker than the
sentence. Re-measured: 33 of 33 roles simulated (23 of 26 carried inline
policies nobody had read; the two CDK lookup roles can read the table),
four trust policies, the CloudFormation escalation path for all five
users, 0 federated providers, root recorded. Every read path terminates
at the same two people.

Two review rounds, 36 findings. 35 fixed, 1 declined. Five of round 2's
were defects in round 1's own fixes; stopped at two per D19.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/reference/ontario-construction-act.md

@@ -13,6 +13,31 @@ cite it. Do not paraphrase a fact into a page that is not stated here.
 > date and effective date below is as at the retrieval date and nothing more.
 > Re-check before cutover, and before any republish that turns on one of them.
 
+> ### R18 re-check — cutover pass, 2026-09-01
+>
+> ⚠️ **THIS FILE CARRIES THE STANDING RE-CHECK INSTRUCTION ABOVE AND WAS
+> NOT ONE OF R18's SEVEN LIMBS, AND IT WENT UNSTAMPED IN THE FIRST PASS.**
+> Five of seven extracts were stamped and two were not, so a reader could
+> not tell whether this one was considered and found non-volatile or simply
+> missed. Found by `adversarial-reviewer`, 2026-09-02 — the same
+> control-fires-over-part-of-its-scope defect as R18 having no checklist
+> item, one notch smaller. **Nothing here was re-retrieved.**
+>
+> - **No R18 limb, but ONE CANDIDATE LIMB, and it is flagged rather than
+>   silently adopted.** `/practice/construction/` publishes: *"Ontario Power
+>   Generation … applied in March 2026 for a licence to operate it."* That is a
+>   **pending application**, so it moves the way limb (a) moves. It is not
+>   false today — the application was made, and a completed past act stays
+>   true — which is why this is a note and not a blocker. But a reader takes it
+>   as current status, and unlike limb (a) the sentence is **not time-anchored**
+>   ("when this page was written"). **For Pouya at the next re-check: adopt it
+>   as R18 limb (h), or time-anchor the sentence and drop it.**
+> - The rest is stable: Part II.1 in force since 2019-10-01, and ODACC's own
+>   statement that it is the Authorized Nominating Authority. The ODACC 2025
+>   Annual Report is cited for institutional facts rather than for figures, so
+>   it does not carry limb (d)'s exposure `[verified 2026-09-02 — swept
+>   `dist/practice/construction/index.html`]`.
+
 **Topic as researched:** Ontario construction dispute resolution — the statutory machinery (Construction Act, R.S.O. 1990, c. C.30); plus verification of the OPG Darlington New Nuclear Project and Bruce Power's Bruce C Project
 
 ---