feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist

Step 5 ships /practice/ and the six practice-area pages (construction,
technology, energy, insurance, shareholder, cross-border) from one route, and
adds the mechanical §4 gate Pouya ruled for.

check:claims — §4 Forbidden becomes a build error
  scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying
  the incident that put it there. It strips <style> and non-JSON-LD <script>
  first (a bare sweep for "leading" returned 26 hits, 25 of them
  var(--leading-body)), self-tests every pattern against fixtures before
  sweeping, and refuses a missing, empty or stale dist/. Wired into /build
  Phase 5 and both deploy paths.

Q54 — six conduct undertakings publish, and §4 gains a third class
  Conduct undertakings sit apart from credentials and offerings: the gate is
  that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a
  softening is one visible diff. (e) and (f) replace the third-person sentences
  already on /arbitration/ rather than joining them.

Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's
deletion. R11 holds typescript at its current major, with the peer-range
reason recorded.

Three facts corrected, two of them already shipped
  - The LAT gloss said mediation "before filing and continuing after filing";
    the Tribunal names mediation for "Before you apply" only and its second
    sentence is about negotiation. An ellipsis in docs/01 had deleted it.
  - "Connection allocation" is not an Ontario term.
  - "The 2026 privacy statute" does not exist — Bill C-27 died without royal
    assent. Struck from docs/03 rather than corrected in place.

ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya,
2026-08-30): the source establishes what the firm publishes, not that an
outside neutral can be appointed under its rules.

claims-auditor gains a second lens — for every quoted source, whether the
sentence beneath stays inside what the quotation establishes. Four shipped
defects had that shape and none of them is greppable.

CLAUDE.md gains a convention: never truncate the output of a check you intend
to believe. `npm run check | tail -3` returns warnings, hints and a blank line
and drops the errors line; it was reported as passing four times while
astro check was exiting 1 with 10 type errors.

Gates, exit status read directly, not through a pipe:
  npm run check        exit=0
  npm run lint         exit=0
  npm run build        exit=0
  npm run check:claims exit=0

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

CLAUDE.md

@@ -104,6 +104,7 @@ npm run dev        # local dev server
 npm run build      # static build to ./dist
 npm run preview    # serve ./dist locally
 npm run check      # astro check — type and template errors
+npm run check:claims  # §4 Forbidden, enforced on dist/ — run it after a build
 npm run lint       # eslint + prettier check
 npm run format     # prettier — rewrite files in place
 npm run deploy     # build + deploy from this machine (see docs/06)
@@ -193,6 +194,24 @@ exit status, and when a result is empty **remove the suppression and look before
 proposing a cause.** A guessed explanation for an empty result is worse than no
 result, because it closes the question.
 
+**And never TRUNCATE the output of a check you intend to believe.** *Added
+2026-08-29, from build step 5.* This is the stderr rule's twin and it is easier
+to commit, because the command runs and the pipe looks harmless. `npm run check`
+prints its verdict as three lines — `- N errors`, `- N warnings`, `- N hints` —
+followed by a blank line. **`npm run check 2>&1 | tail -3` therefore returns
+warnings, hints and the blank line, and silently drops the errors line.** It was
+run four times that way and reported as passing each time; `astro check` was
+exiting **1 with 10 type errors**, and both deploy paths run it before the build,
+so nothing could have shipped. `adversarial-reviewer` found it.
+
+The fix is not a bigger `tail`. **Read the exit status** — `cmd; echo "exit=$?"`
+or `cmd || echo FAILED` — because it is the one signal a pipe cannot silently
+reshape. `head`, `tail`, `grep -c` and `| grep -i error` all have the same
+failure mode: they turn a verdict you did not read into a verdict you assert.
+Same family as *a sweep is a command, not a claim*, and note the asymmetry that
+makes it dangerous — the truncation only ever hides the bad news, because the
+error line comes first.
+
 *Corroborated the same day, twice, in the same session and both in zsh:*
 `grep -rn $EX 'Mediator-Arbitrator'` printed an option error and no matches —
 which reads as clean — because zsh does not word-split unquoted variables; and a