feat: apply six rulings; close Q22/Q44/Q45/Q46(b)/Q47; revert Q47's two graph fields

Pouya's rulings: Q44 (memberships current — ship the group), Q45 (PDF bio
deferred to step 9), Q46(a) (three offerings pass all gates), Q46(b) (§11
ratified as the source for definitional expansions, conditional on committing
the source), Q47 (set jobTitle and worksFor), the legal-advice formulation
ratified without change, and Q22 closed on his own execution evidence.

Q46(b): docs/reference/adrio-designations.md commits all five ADRIO expansions
with reproducible sha256 (four fetches each; both review agents independently
reproduced every digest). It immediately caught the error Pouya raised in the
same message — §11 had said "Chartered Mediator-Arbitrator" since the file was
created, ADRIO's term is "Chartered Med-Arbitrator", and the wrong form was in
dist/about/index.html. Four prior review passes read that string and checked
only whether it was sourced, not whether it was right.

Q47 REVERTED after both review agents struck it independently. jobTitle shipped
for one pass as "Mediator and Commercial Arbitrator" — the string claims-auditor
had removed from this same node's description the previous day, since §4 has no
row for a completed arbitration. The implementation flagged the wrong defect: it
argued about scoping and missed that the whole string was already struck. worksFor
was reverted because ProfessionalService.provider is this Person, so
provider -> Person -> worksFor asserts a same-entity claim transitively. Now
jobTitle: 'Mediator', no worksFor. Q49 asks for the two §4 rows.

Q44: memberships render with NO currency warranty (his condition), and R10 is
re-armed with an event trigger rather than a date since he declined renewal-date
tracking. Q22: §7 goes to PROVISIONED; R17 carries the first rotation date,
2026-11-26. New CLAUDE.md convention, his: never suppress stderr in a
verification script — suppression turns "it failed" into "it found nothing".

Two review rounds resolved 48 findings; the majority of the second round were
defects in the first round's fixes, including a re-widening of §4's renewal
period inside the comment that corrects that widening, a cited guard in
schema.ts that does not exist, and a struck §9 row describing a reverted state.
Three findings were one lift from a public page: docs/03's /for-parties/
directive breached D13 twice, docs/01 told an implementer an unpublishable strip
could ship, and docs/07 priced three ungated offerings with no gate note.

Also commits docs/reference/adrio-extract/ — the extraction script and its five
outputs, since the digests covered raw HTML and said nothing about the text the
term counts were run against. The equivalent gap for Q22's IAM verification is
NOT closed and is Q52.

Verified: astro check 0/0/0, eslint + prettier clean, build 2 pages, 0 .js
emitted, minifier guard silent, animation-timeline intact, no currency-warranty
phrasing in dist, JSON-LD correct on both pages.
NOT run: Lighthouse (tool unavailable until step 7, R11); HTML validator.

Opens Q48-Q53. Live reminders: R1, R10, R11, R13, R14, R15, R16, R17.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e

CLAUDE.md

@@ -176,6 +176,32 @@ from a command that found nothing. Same family as *a sweep is a command, not a
 claim*: the claim must rest on output you actually read, from a command that
 actually ran.
 
+**And never suppress stderr in a verification script.** *Pouya's convention,
+2026-08-28, from verifying the deploy credential (`AGENTS.md` Q22).* This is the
+rule above from the other direction, and it is the more dangerous direction:
+**`2>/dev/null` converts "it failed" into "it found nothing", and those are
+opposite results.** His first pass at eight `simulate-principal-policy` checks
+returned empty for all eight; the suppression was hiding an `InvalidInput` error,
+and the empty output was then explained with a guess — *"probably lacks the
+permission"* — which is the answer the check was supposed to produce, arrived at
+without the check running. The actual cause was a **zsh parameter-expansion bug**:
+`$ACCT:user/` parses `:u` as a history modifier and yields `327082975128ser/`.
+Braces fixed it.
+
+So: no `2>/dev/null` in anything whose output you intend to believe, read the
+exit status, and when a result is empty **remove the suppression and look before
+proposing a cause.** A guessed explanation for an empty result is worse than no
+result, because it closes the question.
+
+*Corroborated the same day, twice, in the same session and both in zsh:*
+`grep -rn $EX 'Mediator-Arbitrator'` printed an option error and no matches —
+which reads as clean — because zsh does not word-split unquoted variables; and a
+digest-comparison loop using `set -- $pair` printed **`DIFFER` on all five rows**,
+which reads as "the source changed under me", because the loop body received one
+argument and the comparison never ran. Prefer `git grep`, quote or array-expand
+anything you pass as flags, and re-check any result whose shape is "uniformly
+bad".
+
 **A parent cannot style a child component's root element.** Astro does not pass
 a parent's scope attribute down, so `<Button class="header-cta" />` compiles the
 parent's rule to `.header-cta[data-astro-cid-<parent>]` while the rendered `<a>`