feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist

Step 5 ships /practice/ and the six practice-area pages (construction,
technology, energy, insurance, shareholder, cross-border) from one route, and
adds the mechanical §4 gate Pouya ruled for.

check:claims — §4 Forbidden becomes a build error
  scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying
  the incident that put it there. It strips <style> and non-JSON-LD <script>
  first (a bare sweep for "leading" returned 26 hits, 25 of them
  var(--leading-body)), self-tests every pattern against fixtures before
  sweeping, and refuses a missing, empty or stale dist/. Wired into /build
  Phase 5 and both deploy paths.

Q54 — six conduct undertakings publish, and §4 gains a third class
  Conduct undertakings sit apart from credentials and offerings: the gate is
  that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a
  softening is one visible diff. (e) and (f) replace the third-person sentences
  already on /arbitration/ rather than joining them.

Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's
deletion. R11 holds typescript at its current major, with the peer-range
reason recorded.

Three facts corrected, two of them already shipped
  - The LAT gloss said mediation "before filing and continuing after filing";
    the Tribunal names mediation for "Before you apply" only and its second
    sentence is about negotiation. An ellipsis in docs/01 had deleted it.
  - "Connection allocation" is not an Ontario term.
  - "The 2026 privacy statute" does not exist — Bill C-27 died without royal
    assent. Struck from docs/03 rather than corrected in place.

ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya,
2026-08-30): the source establishes what the firm publishes, not that an
outside neutral can be appointed under its rules.

claims-auditor gains a second lens — for every quoted source, whether the
sentence beneath stays inside what the quotation establishes. Four shipped
defects had that shape and none of them is greppable.

CLAUDE.md gains a convention: never truncate the output of a check you intend
to believe. `npm run check | tail -3` returns warnings, hints and a blank line
and drops the errors line; it was reported as passing four times while
astro check was exiting 1 with 10 type errors.

Gates, exit status read directly, not through a pipe:
  npm run check        exit=0
  npm run lint         exit=0
  npm run build        exit=0
  npm run check:claims exit=0

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

.claude/agents/claims-auditor.md

@@ -54,6 +54,9 @@ review found it.
    role, an institution, a language, a number, a date, a location, a capability,
    a comparison.
 3. For each one, find its line in the Verified table.
+4. **Then run the second lens below over every quoted or cited source** —
+   claims about the world are audited against `docs/reference/`, not §4, and
+   they are the ones that have shipped wrong most often.
 
 ## The rule
 
@@ -61,6 +64,60 @@ review found it.
 no "defensible", no "everyone says this". Report it and require it be removed or
 replaced with something verified.
 
+## The second lens — does the gloss stay inside the quote?
+
+**This is a separate pass over a separate class of claim, and you must run it.**
+Everything above audits claims **about Pouya** against §4. This lens audits
+claims **about the world** — a statute, a tribunal's process, a regulator's
+name, a bill's status — against the `docs/reference/` extract they are sourced
+to. §4 cannot help you here; the extract is the register.
+
+**The failure shape, which is now four-for-four on this project: a correct
+verbatim quotation with an overreaching sentence beneath it.** The quotation
+passes audit because it is accurate. The gloss fails because it asserts more
+than the quotation establishes — and it is the gloss that ships as the page's
+own voice, so it is the half a reader relies on.
+
+**So for every quoted or cited source in the material under review:**
+
+1. Read the quotation.
+2. Read the sentence beneath it — the page's own words.
+3. Ask **what a reader would take the second to mean**, and then whether the
+   first actually establishes that. Not "is it consistent with", not "is it
+   plausible given" — **does the quoted text establish it.**
+4. Where it does not, the finding is on the gloss, not the quote. Say which
+   words of the quotation would have to be different for the gloss to hold.
+
+**Four specific ways it has gone wrong here, so you know the shapes:**
+
+- **A subject swapped between sentences.** The LAT extract quoted the Tribunal
+  correctly; the gloss said it *"points parties at private mediation, before
+  filing and continuing after filing."* The Tribunal's first sentence names
+  mediation for *"Before you apply"* only; its second is about **negotiation**,
+  and said so twice. Shipped on three pages. An ellipsis in `docs/01` had
+  deleted the second *"negotiation"*.
+- **A term the source never uses.** *"Connection allocation"* is not an Ontario
+  term — the IESO pages contain zero occurrences of *"allocation"*. Shipped on
+  three pages. **A term of art that appears nowhere in the extract is a term
+  somebody wrote from recall.**
+- **A status assumed to have held.** *"The 2026 privacy statute"* does not
+  exist; Bill C-27 died without royal assent. It came from a brief's
+  *"replacement privacy legislation in 2026"*, which was a forecast read as an
+  event. **A bill is not an Act until something says it received assent.**
+- **A class asserted from one instance.** ADR Chambers' self-amendment clause
+  is quoted from its *arbitration* rules; the page wrote *"amends them"* of all
+  three rule sets. You caught that one. The related over-read — that publishing
+  rules establishes an outside neutral can be **appointed** under them — is why
+  the firm is no longer named on any page (2026-08-30).
+
+**None of this is greppable, which is why it is yours.** `npm run check:claims`
+catches a fixed set of forbidden strings in `dist/`; it cannot compare a
+sentence against a source. If a page states a fact about the world and you
+cannot find the extract that establishes it, that is a finding — an unsourced
+world-fact is the same defect as an unregistered claim about Pouya, and R14
+says a claim nobody can check against a committed artefact is unverifiable by
+construction rather than merely unverified.
+
 ## Specific things to catch
 
 **Licensure (D13).** The site asserts the JD and nothing further. Flag: "lawyer",

.claude/commands/build.md

@@ -109,8 +109,17 @@ two**, so a later reader does not read the cap as laxness.
 ```bash
 npm run check
 npm run build
+npm run check:claims
 ```
 
+`check:claims` greps the built pages for the §4 Forbidden set — Pouya's ruling,
+2026-08-29. **Every pattern it catches is a finding neither review agent has to
+spend a pass on**, which is D19 served directly. It self-tests its own patterns
+before it sweeps and refuses to run against an empty or stale `dist/`, so a pass
+is a pass on the bytes that would ship. **A match is not yet a finding** — read
+the context it prints. If a pattern is genuinely wrong, change it deliberately
+with a Change Log entry; do not delete one to make a build pass.
+
 Then, as applicable to what changed:
 
 - Serve `dist/` and confirm the page **renders its full content with JavaScript