feat: rule Q63 in three limbs; take the human headcount off /legal/privacy/; close R10; ratify /med-arb/

Pouya's rulings, 2026-09-02.

Q63(a) — wording approved with two trims: the editorial closing sentence is
struck, and the mailbox clause is rewritten per (b).

Q63(b) — info@smlcompany.ca is a delegated mailbox read by Pouya and by
administrative staff. The page said "anyone who can reach that mailbox"; it now
says who. The answer reached four sentences, not the one the ruling named, in
three sections: "my mailbox" had been written as a personal one throughout.

Q63(c) — the account root credential is held by Pouya, has no programmatic key
and carries MFA. The page now states the first two.

And the answer to (c) took the human headcount off the page. His attestation:
"two people is an exaggeration... a handful is accurate — the simulation counts
identities, not humans, and the two are not the same claim." The enumeration was
exhaustive and the inference off it was not: two IAM identities is a LOWER BOUND
on people and was published as an exact count. The page now attributes read
access to "the account's administrators — me, and the small number of people who
administer it with me", and the false inference is corrected at its source in
docs/reference/intake-table-access-verification.md as well as on the page.

R10 — CLOSED on a fresh one-line confirmation, not on the 2026-08-28 stamp.
ADRIC, ADRIO, the three OBA sections and the CTF all current. Re-stamped on all
four stamp-bearing sites; the row stays live, because its trigger is an event.

/med-arb/ — ratified as shipped, no credential line restored. His note for the
record: med-arb is a service he provides, not a designation.

The tripwire is unchanged and proven both ways: exit 0 on the revised page,
exit 1 with 5 matches on the pre-correction bytes rebuilt from bd282aa.

A sentence added to back the correction had no command behind it. "The table
carries no policy of its own granting access to anyone" was published with
nothing in the repo establishing it — a DynamoDB resource policy is invisible to
describe-table, and every simulation on file asks what a principal may do.
Measured rather than deleted: get-resource-policy returns PolicyNotFoundException,
and describe-organization returns AWSOrganizationsNotInUseException, which is
what makes the Identity Center zero conclusive rather than merely local. Both
recorded as commands 7 and 8; R21 gains claim (v) and two falsifiers.

Q64 OPENED, with a TODO(pouya) and an unticked cutover item: "I hold it" is true
whether or not a second person holds it, and reads as sole custody one paragraph
below "the small number of people who administer it with me". The request to
strike the possessive now is declined with a reason — he dictated the clause —
and the page cannot ship while the TODO stands.

Two review rounds, 22 findings, 21 resolved, 1 declined. Nine of round 2's twelve
were defects in round 1's own repairs. Stopped at two per D19.

Gates, exit status read: check 0 · build 0 (23 pages) · check:claims 0 ·
og:proof 0 · check:intake 0 · lint 0 · router.test 0 (30/30) · lighthouse 0,
worst of 23 99/100/100/100, /legal/privacy/ 100/100/100.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/05-backend-spec.md

@@ -446,7 +446,7 @@ Plausible or Fathom, cookieless, no consent banner.
 - [ ] **TTL set and verified by test record.** ⚠️ **THIS ONE BACKS A PUBLISHED PROMISE.** `/legal/privacy/` states that records are deleted automatically after 24 months, and it asserts the **mechanism**, not only the period. The handler writes the `ttl` attribute — epoch seconds, 24 months, confirmed against this spec `[verified 2026-08-31]` — and **writing the attribute is not the mechanism**: TTL must also be enabled on the table, which is a table setting the code cannot see. **`AGENTS.md` §7 holds that status and its stamp; this line does not restate it** — it restated it once, went stale within the day, and had to be pulled back (§12 R19). **The test record is what closes this item, not the status:** `ENABLED` proves the setting, a record written with a near-future `ttl` and observed to vanish proves the behaviour. Tracked as §9 Q60
 - [x] **PITR enabled** — `ENABLED`, 35-day window `[verified 2026-09-01 — describe-continuous-backups]`
 - [ ] KMS customer-managed key. **Not on the table: encryption at rest is with the AWS-owned key** `[verified 2026-09-01 — describe-table returns no SSEDescription]`. **Not claimed on `/legal/privacy/`** — the page says "encrypted at rest", which is unconditionally true of every DynamoDB table and does not mention a customer-managed key, so nothing published depends on it. An improvement, not a blocker
-- [x] ✅ **Table access matches what `/legal/privacy/` says about it — 2026-09-02.** **The access is unchanged; the page now states it.** Pouya ruled *state the truth* rather than *remove the access* (§9 Q62), so the page publishes two administrators of a shared account, and adds the two stronger facts the false sentence had crowded out: the handler role holds `PutItem` **only**, and `adr-sml-deploy` is `implicitDeny` on all seven read **and** write actions. Evidence and commands: `docs/reference/intake-table-access-verification.md`, whose enumeration was **extended on 2026-09-02** — the original screened roles by `list-attached-role-policies` alone, missing that 23 of 26 non-service-linked roles carry inline policies and that the two CDK `lookup` roles can read the table. Four roles can, not two; all four terminate at the same two people. ⚠️ **THIS LINE SAID "IT DOES NOT" FOR A DAY AFTER THE PAGE WAS CORRECTED, AND IT IS A DEFINITION-OF-DONE LIST SOMEONE FOLLOWS AT CUTOVER** — the Q62 sweep was run over `src/` only, so it could not reach a spec. `adversarial-reviewer`, round 1. The sweep across `docs/` is in the Change Log entry
+- [x] ✅ **Table access matches what `/legal/privacy/` says about it — 2026-09-02.** **The access is unchanged; the page now states it.** Pouya ruled *state the truth* rather than *remove the access* (§9 Q62), so the page attributes read access to **the account's administrators of a shared account, with no human headcount** — the count came off later the same day under §9 Q63, because a simulation counts identities and the page was reading them as people — and adds the two stronger facts the false sentence had crowded out: the handler role holds `PutItem` **only**, and `adr-sml-deploy` is `implicitDeny` on all seven read **and** write actions. Evidence and commands: `docs/reference/intake-table-access-verification.md`, whose enumeration was **extended on 2026-09-02** — the original screened roles by `list-attached-role-policies` alone, missing that 23 of 26 non-service-linked roles carry inline policies and that the two CDK `lookup` roles can read the table. Four roles can, not two; every one of them is reachable only by those administrators. ⚠️ **Do not restate that as a count of PEOPLE** — this line said *"all four terminate at the same two people"* until 2026-09-02, which is the inference §9 Q63 struck. ⚠️ **THIS LINE SAID "IT DOES NOT" FOR A DAY AFTER THE PAGE WAS CORRECTED, AND IT IS A DEFINITION-OF-DONE LIST SOMEONE FOLLOWS AT CUTOVER** — the Q62 sweep was run over `src/` only, so it could not reach a spec. `adversarial-reviewer`, round 1. The sweep across `docs/` is in the Change Log entry
 - [ ] Both emails send; SPF/DKIM/DMARC aligned; inbox-tested, not spam-tested
 - [ ] **CloudWatch alarms on Lambda `Errors` and API Gateway `5xx`** — replacing the DLQ item, which is struck: a DLQ on a **synchronously** invoked function never receives anything, so the alarm on its depth would have been permanently green. See §Notification. The handler writes to DynamoDB **before** sending mail, so the protection this item was pointing at is in the code rather than in a queue
 - [x] **Form usable by keyboard only.** Errors are announced by the browser's own validation, which with no script is the only thing that can announce them inline — `role="alert"` needs a live region and something to write into it