feat: apply six rulings; close Q22/Q44/Q45/Q46(b)/Q47; revert Q47's two graph fields

Pouya's rulings: Q44 (memberships current — ship the group), Q45 (PDF bio
deferred to step 9), Q46(a) (three offerings pass all gates), Q46(b) (§11
ratified as the source for definitional expansions, conditional on committing
the source), Q47 (set jobTitle and worksFor), the legal-advice formulation
ratified without change, and Q22 closed on his own execution evidence.

Q46(b): docs/reference/adrio-designations.md commits all five ADRIO expansions
with reproducible sha256 (four fetches each; both review agents independently
reproduced every digest). It immediately caught the error Pouya raised in the
same message — §11 had said "Chartered Mediator-Arbitrator" since the file was
created, ADRIO's term is "Chartered Med-Arbitrator", and the wrong form was in
dist/about/index.html. Four prior review passes read that string and checked
only whether it was sourced, not whether it was right.

Q47 REVERTED after both review agents struck it independently. jobTitle shipped
for one pass as "Mediator and Commercial Arbitrator" — the string claims-auditor
had removed from this same node's description the previous day, since §4 has no
row for a completed arbitration. The implementation flagged the wrong defect: it
argued about scoping and missed that the whole string was already struck. worksFor
was reverted because ProfessionalService.provider is this Person, so
provider -> Person -> worksFor asserts a same-entity claim transitively. Now
jobTitle: 'Mediator', no worksFor. Q49 asks for the two §4 rows.

Q44: memberships render with NO currency warranty (his condition), and R10 is
re-armed with an event trigger rather than a date since he declined renewal-date
tracking. Q22: §7 goes to PROVISIONED; R17 carries the first rotation date,
2026-11-26. New CLAUDE.md convention, his: never suppress stderr in a
verification script — suppression turns "it failed" into "it found nothing".

Two review rounds resolved 48 findings; the majority of the second round were
defects in the first round's fixes, including a re-widening of §4's renewal
period inside the comment that corrects that widening, a cited guard in
schema.ts that does not exist, and a struck §9 row describing a reverted state.
Three findings were one lift from a public page: docs/03's /for-parties/
directive breached D13 twice, docs/01 told an implementer an unpublishable strip
could ship, and docs/07 priced three ungated offerings with no gate note.

Also commits docs/reference/adrio-extract/ — the extraction script and its five
outputs, since the digests covered raw HTML and said nothing about the text the
term counts were run against. The equivalent gap for Q22's IAM verification is
NOT closed and is Q52.

Verified: astro check 0/0/0, eslint + prettier clean, build 2 pages, 0 .js
emitted, minifier guard silent, animation-timeline intact, no currency-warranty
phrasing in dist, JSON-LD correct on both pages.
NOT run: Lighthouse (tool unavailable until step 7, R11); HTML validator.

Opens Q48-Q53. Live reminders: R1, R10, R11, R13, R14, R15, R16, R17.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e

README.md

@@ -59,11 +59,13 @@ both.
 `.gitea/workflows/deploy.yml` is the CI pipeline — **Gitea Actions**, not GitHub
 Actions. **It has never run**, for two reasons that are not oversights:
 
-- The scoped IAM user does not exist. `aws iam get-user --user-name
-  adr-sml-deploy` returns `NoSuchEntity` (`AGENTS.md` Q22).
 - Actions are not enabled and no runner is registered. The Gitea instance is
   jointly administered, so both need its second administrator (Q23).
 
+*(It previously listed a second reason — that the scoped IAM user did not exist.
+**It exists**: `adr-sml-deploy`, created 2026-08-26, Q22 closed 2026-08-28. See
+`AGENTS.md` §7 for the inventory and the least-privilege verification.)*
+
 Its **first** step is a guard: the run aborts, naming what is missing, if any
 required variable or either AWS secret is empty. Only emptiness is tested and no
 value is echoed.
@@ -75,11 +77,14 @@ Gitea falls back to that directory when `.gitea/workflows` is absent, so a
 workflow file left there with a `push` trigger would be only conditionally
 inert. As an `.example` under `docs/` it cannot be picked up at all.
 
-**The pipeline is designed around a long-lived AWS credential, and it does not
-exist yet.** Gitea is not an AWS OIDC provider, so there is no role to assume:
-deploys are *to* authenticate as a scoped IAM user, `adr-sml-deploy`, with its
-access key in the repository's Gitea Actions secrets. `aws iam get-user`
-confirms that user has not been created (Q22). In the meantime the local script
+**The pipeline is designed around a long-lived AWS credential, and that
+credential now exists.** Gitea is not an AWS OIDC provider, so there is no role
+to assume: deploys authenticate as a scoped IAM user, `adr-sml-deploy`, with its
+access key in the repository's Gitea Actions secrets. **The user was created
+2026-08-26 and verified least-privilege by execution — `AGENTS.md` §7, Q22 closed
+2026-08-28.** Its access key has **never been used** (`LastUsed` null), because
+deploys still run locally. *(This paragraph asserted the user "has not been
+created" until 2026-08-28.)* In the meantime the local script
 **refuses to run as `user/pouya`**, the broadly-permissioned personal user —
 see `AGENTS.md` §10. Two things are meant to bound the risk, and neither is in
 place yet:
@@ -93,11 +98,14 @@ place yet:
   narrowness is what keeps a compromised runner away from it, and it is
   load-bearing rather than hygiene. See `AGENTS.md` §10. If a deploy step needs
   a permission the policy lacks, question the step; do not widen the policy.
-- **The key must be rotated quarterly, and nobody owns that yet.** Create a
-  second access key, update the Gitea secrets, confirm a deploy succeeds, then
-  delete the old one — rotation that leaves the old key active is not
-  rotation. OIDC would have removed the obligation entirely; it is
-  unavailable, so this is a standing calendar task still waiting on an owner.
+- **The key must be rotated quarterly. It now has an owner and a date: first
+  rotation due 2026-11-26** (key created 2026-08-26) — `AGENTS.md` §12 **R17**.
+  Create a second access key, update the Gitea secrets, confirm a deploy
+  succeeds, **then** delete the old one — rotation that leaves the old key active
+  is not rotation, and deleting before verifying leaves no way to authenticate
+  the fix. OIDC would have removed the obligation entirely; it is unavailable, so
+  this is a standing calendar task. *(It read "nobody owns that yet" until
+  2026-08-28; R17 is the owner, and the date is the whole point of the row.)*
 
 Full procedure, IAM policy, runner setup, and cutover checklist:
 `docs/06-deployment.md`.