feat: apply six rulings; close Q22/Q44/Q45/Q46(b)/Q47; revert Q47's two graph fields

Pouya's rulings: Q44 (memberships current — ship the group), Q45 (PDF bio
deferred to step 9), Q46(a) (three offerings pass all gates), Q46(b) (§11
ratified as the source for definitional expansions, conditional on committing
the source), Q47 (set jobTitle and worksFor), the legal-advice formulation
ratified without change, and Q22 closed on his own execution evidence.

Q46(b): docs/reference/adrio-designations.md commits all five ADRIO expansions
with reproducible sha256 (four fetches each; both review agents independently
reproduced every digest). It immediately caught the error Pouya raised in the
same message — §11 had said "Chartered Mediator-Arbitrator" since the file was
created, ADRIO's term is "Chartered Med-Arbitrator", and the wrong form was in
dist/about/index.html. Four prior review passes read that string and checked
only whether it was sourced, not whether it was right.

Q47 REVERTED after both review agents struck it independently. jobTitle shipped
for one pass as "Mediator and Commercial Arbitrator" — the string claims-auditor
had removed from this same node's description the previous day, since §4 has no
row for a completed arbitration. The implementation flagged the wrong defect: it
argued about scoping and missed that the whole string was already struck. worksFor
was reverted because ProfessionalService.provider is this Person, so
provider -> Person -> worksFor asserts a same-entity claim transitively. Now
jobTitle: 'Mediator', no worksFor. Q49 asks for the two §4 rows.

Q44: memberships render with NO currency warranty (his condition), and R10 is
re-armed with an event trigger rather than a date since he declined renewal-date
tracking. Q22: §7 goes to PROVISIONED; R17 carries the first rotation date,
2026-11-26. New CLAUDE.md convention, his: never suppress stderr in a
verification script — suppression turns "it failed" into "it found nothing".

Two review rounds resolved 48 findings; the majority of the second round were
defects in the first round's fixes, including a re-widening of §4's renewal
period inside the comment that corrects that widening, a cited guard in
schema.ts that does not exist, and a struck §9 row describing a reverted state.
Three findings were one lift from a public page: docs/03's /for-parties/
directive breached D13 twice, docs/01 told an implementer an unpublishable strip
could ship, and docs/07 priced three ungated offerings with no gate note.

Also commits docs/reference/adrio-extract/ — the extraction script and its five
outputs, since the digests covered raw HTML and said nothing about the text the
term counts were run against. The equivalent gap for Q22's IAM verification is
NOT closed and is Q52.

Verified: astro check 0/0/0, eslint + prettier clean, build 2 pages, 0 .js
emitted, minifier guard silent, animation-timeline intact, no currency-warranty
phrasing in dist, JSON-LD correct on both pages.
NOT run: Lighthouse (tool unavailable until step 7, R11); HTML validator.

Opens Q48-Q53. Live reminders: R1, R10, R11, R13, R14, R15, R16, R17.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e

docs/06-deployment.md

@@ -34,13 +34,27 @@ cache headers, and the same invalidation as the workflow — at this scale the
 pipeline changes only **how a deploy is triggered**, not what it does. Treat the
 script and the workflow as one artefact in two places: change one, change both.
 
-Two things block the workflow, and neither is a fact to look up:
+One thing blocks the workflow, and it is not a fact to look up:
 
-- **`adr-sml-deploy` does not exist** — `aws iam get-user` returns
-  `NoSuchEntity` (§7, Q22). Create it from *Create the user* below.
 - **Actions are not enabled and no runner is registered** (Q23). The Gitea
   instance is jointly administered, so both need its second administrator.
 
+> ✅ **`adr-sml-deploy` EXISTS — created 2026-08-26, Q22 closed 2026-08-28.**
+> **DO NOT CREATE IT.** This bullet said *"`adr-sml-deploy` does not exist —
+> `aws iam get-user` returns `NoSuchEntity`… Create it from Create the user
+> below"* until 2026-08-28, and an operator following it would have created a
+> **second** IAM user, or hand-provisioned one with a different scope from the
+> `adr-sml-deploy-minimal` policy §7 now records. §7 carries the inventory and
+> the eight `simulate-principal-policy` results.
+>
+> *Found by `adversarial-reviewer`: the Q22 flip to PROVISIONED was swept in
+> `AGENTS.md` and nowhere else, and the Change Log entry's sweep block covered
+> the copy corrections only. Same shape as the SES-DKIM inversion — the stale
+> copy instructed an action against a High-risk credential.*
+>
+> *Create the user* below is retained as the **record of how it was
+> provisioned**, not as an instruction. Read it that way.
+
 The script **refuses to run as `user/pouya`** — the broadly-permissioned
 personal user that has been authenticating to this account. See §10.
 
@@ -329,18 +343,47 @@ Then invalidate `/*`.
 
 **Content and compliance**
 - [ ] Every claim traced to `AGENTS.md` §4 Verified
-- [ ] **Memberships re-confirmed with Pouya, then published** — `AGENTS.md` §12
-      **R10** and **Q44**. ADRIC, ADRIO, the three OBA sections and the Canadian
-      Tax Foundation are `[verified 2026-08-26]`. **§4 records yearly renewal for
-      the OBA sections and the CTF only** — it says nothing about ADRIC's or
-      ADRIO's period, and an earlier version of this line asserted "all renew
-      yearly", which §4 does not support. **`/about/` currently publishes NO
-      memberships group**: R10 is a prohibition and the re-confirmation was not
-      obtained, so the group is withheld behind a `TODO(pouya)`. OCNI already
-      lapsed quietly and §4 records it as "not current, do not publish" — that is
-      the failure mode, and a stamp is not a renewal receipt. Re-confirm,
-      re-stamp §4 and `CREDENTIALS.memberships`, restore the group to
-      `CREDENTIAL_GROUPS`, and add `memberOf` to the Person JSON-LD
+- [ ] **Memberships RE-CONFIRMED AGAIN, on the day of cutover** — `AGENTS.md`
+      §12 **R10**, which is now an **event trigger and cutover is one of its two
+      events.** Q44 closed 2026-08-28 and the group is published on `/about/`
+      (ADRIC, ADRIO, the three OBA sections, the CTF, `[verified 2026-08-28 —
+      Pouya]`), so this item is no longer "publish them" — it is **"ask him
+      again, then re-stamp §4 with the cutover date."**
+      **Pouya declined renewal-date tracking**, which is exactly why this sits on
+      the checklist: there is no date on which anyone would otherwise re-check.
+      OCNI lapsed quietly and §4 records it as "not current, do not publish" —
+      found roughly a year late. A stamp is not a renewal receipt.
+      **Do NOT add a currency sentence to the page while you are here** — his
+      ruling is *"list the memberships; promise nothing about their future
+      state"*, and the struck sentence stays struck.
+      **Do NOT add `memberOf` to the Person JSON-LD** unless Pouya has said to.
+      It is withheld deliberately and on narrower grounds than the visible page:
+      the reason is recorded in `src/data/schema.ts` and **it is an open
+      judgement, not a settled one — `AGENTS.md` Q53.** Do not restate the
+      reasoning here; a third copy is how the first two went stale.
+      **§4 records yearly renewal for the OBA sections and the CTF only** — it
+      says nothing about ADRIC's or ADRIO's period, and an earlier version of
+      this line asserted "all renew yearly", which §4 does not support.
+- [ ] **`AGENTS.md` Q51 answered before cutover** — does listing the **OBA
+      sections** on `/about/` carry the licensure implication that excludes the
+      LSO? §4 excludes the Law Society precisely because *"listing the Law Society
+      among memberships implies licensure"*, and Forbidden bars *any phrasing that
+      **implies** entitlement to practise law*. The OBA sections **went live on
+      `/about/` on 2026-08-28** and Q51 was raised the same day, **after** Pouya's
+      Q44 ruling authorised the group — so the ruling did not consider it.
+      `adversarial-reviewer` rates it moderate-low confidence as a defect and
+      **high confidence that the question is unasked**: `grep -n OBA AGENTS.md`
+      returns rows on renewal, scope and stamping and nothing on implication, and
+      OBA membership eligibility is not established anywhere in this repo. It sits
+      beside **R1** — same subject, same page, and not settleable internally. If
+      the answer is yes, the fix is the LSO fix: exclude deliberately, and record
+      that it was excluded rather than omitted.
+      *(This item did not exist until 2026-08-28. Q48, which governs nothing
+      currently on the site, had a checklist item while Q51, which governs live
+      public copy, had none.)*
+      **Also re-check `AGENTS.md` Q48** before re-stamping: if `Q.Med` retention
+      turns out to depend on ADRIO membership currency, this item covers the
+      site's central credential and not just a list
 - [ ] No `TODO(pouya)` remains in any shipped page
 - [ ] No matter counts, rates, dollar figures, or testimonials anywhere
 - [ ] Q.Arb described as **commenced August 2026** everywhere it appears — §4's