docs: record the cutover; the D20 claims pass returns FAIL with 20 findings

The site went live 2026-09-02 at 67847d9. Launch verified independently
rather than transcribed: 26 routes with the iteration count asserted (the
first sweep used `for r in $ROUTES` and iterated ONCE — the zsh trap), all
22 pages plus robots/sitemap/PDF 200, 404 styled at 14,321 B, cache-control
correct on both classes, PDF 89,496 B. All 22 live pages are byte-identical
to a dist/ rebuilt at 67847d9, which is what makes the audit below binding.

The D20 claims pass then ran against those bytes and returned FAIL: 13
auditors over 23 pages, 41 raw findings, 31 distinct, each adversarially
verified by an independent claims-auditor — 20 confirmed, 11 refuted, plus
13 from two completeness critics. The credential spine traced clean for the
third pass running; no finding concerns Pouya, his credentials, designations,
memberships or the boutique. The failures are glosses over-reaching their
committed extract, and disclosures on /legal/privacy/ and /contact/received/
describing a backend that is not deployed.

Three defects are live: the intake form POSTs to /api/intake and gets 403
with an empty body, so a submitter sees a blank page; /legal/privacy/
published while Q60 is open, carrying a TODO(pouya) that said in terms it
must not — a JSX comment, stripped by Astro, so no build or deploy path
could see it; and no X-Robots-Tag on the crawlable bio PDF.

Nothing is fixed here. claims-auditor reports; the implementer fixes.

- AGENTS.md: Change Log (ar); §7 gains a THE SITE IS LIVE row; the
  credential row's "NEVER USED" struck; §12 R17 clock reset to 2026-12-02,
  stamped as reported and not re-read from IAM.
- docs/06: cutover recorded, callout now at three blockers, the
  claims-auditor item records run 3 and stays unticked.

Gates on the edited tree, exit status read for each: check 0 (0 errors,
0 warnings, 0 hints), build 0, check:claims 0, check:intake 0, lint 0,
og:proof 0, minifier grep exit 1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/06-deployment.md

@@ -395,8 +395,25 @@ Then invalidate `/*`.
 > reversing them puts 22 of 23 pages behind a 403 for as long as a CloudFront
 > deployment takes.
 
-> 🛑 **ONE THING BLOCKS THIS ENTIRE LIST AS AT 2026-09-02, AND IT IS A WAITING
+> ✅ **CUTOVER EXECUTED 2026-09-02 — THE SITE IS LIVE AT `https://adr.smlcompany.ca`.**
-> PERIOD RATHER THAN A TASK: Q60.**
+> Deployed by Pouya from this machine via `scripts/deploy-local.sh` with the
+> `adr-sml-deploy` credential. **Verified independently the same day rather than
+> transcribed**, 26 routes with the iteration count asserted (a `for r in $VAR`
+> loop ran ONCE first — the zsh trap `CLAUDE.md` records, caught by the count):
+> all 22 pages, `robots.txt`, `sitemap-index.xml` and the bio PDF return **200**;
+> an unknown path returns **404** and serves the styled Astro page, 14,321 B, not
+> S3's XML. HTML carries `max-age=0, must-revalidate`, `_astro` assets
+> `max-age=31536000, immutable`, and the PDF is **89,496 B**, matching `public/`
+> exactly. **All 22 live pages are byte-identical to a local `dist/` rebuilt at
+> `67847d9`** — SHA-256 compared page by page, 22 same / 0 differ / 0 errors. The
+> five `noindex` surfaces and the 17-URL sitemap are correct.
+>
+> 🛑 **BUT THIS LIST WAS NOT CLEAN WHEN THE SITE PUBLISHED, AND THAT IS THE
+> RECORD, NOT A REPROACH. THREE BLOCKING ITEMS WERE OPEN AT THE MOMENT OF
+> CUTOVER AND TWO STILL ARE.** D11 is a single shot and the checklist exists
+> because of it; a launch that crosses its own gates should be legible as one
+> afterwards rather than smoothed over. **What follows is the state as at
+> 2026-09-02, after the D20 pass ran against the shipped bytes.**
 >
 > ✅ **THE READ-THROUGH IS COMPLETE — Pouya, 2026-09-02, and it returned ONE
 > FINDING WHICH WAS NOT COPY.** `public/favicon.ico` shipped with no
@@ -406,11 +423,15 @@ Then invalidate `/*`.
 > line, and `/med-arb/` **as shipped**. That discharges blocker 2 and every
 > wording sign-off that had been routed into it.
 >
-> ⚠️ **THE COUNT NOW READS ONE AGAIN, AND THE EARLIER ONE WAS A DEFECT — READ
+> ⚠️ **THE COUNT WENT UP, AND THAT IS THE FIRST TIME IT HAS — READ THE REASON,
-> THE REASON, NOT THE NUMBER.** It said ONE earlier on 2026-09-02 because an
+> NOT THE NUMBER.** It read ONE for part of 2026-09-02 because an approval had
-> approval had gone **missing** from the list; it says ONE now because the pass
+> gone **missing**; it then read ONE because the pass that approval was routed
-> that approval was routed into has been **done**. A tally cannot tell those
+> into had been **done**; it now reads **THREE**, because the site published and
-> apart, which is the point the note below has been making all day.
+> the D20 pass then ran against the shipped bytes and returned **FAIL**. Every
+> earlier move in this note was a tally shrinking for a reason a tally could not
+> show. This one grew, and the lesson is the same in the other direction: **the
+> list did not get worse, the measurement finally happened.** Two of the three
+> were true before cutover and unmeasured; one was invisible by construction.
 >
 > ⚠️ *(The count has moved repeatedly in one day and the DIRECTION is the only
 > part worth reading — the number of moves is deliberately not stated, because a
@@ -428,14 +449,46 @@ Then invalidate `/*`.
 > pass, promoted here from the checklist below because that is where the last
 > reserved approval went missing.)*
 >
-> 1. **Q60 — the retention MECHANISM has still not been observed.** TTL is
+> 1. 🛑 **Q60 — the retention MECHANISM has still not been observed, AND
->    `ENABLED` and no record has been watched to disappear, and
+>    `/legal/privacy/` PUBLISHED ANYWAY.** TTL is `ENABLED` and no record has been
->    `/legal/privacy/` asserts the mechanism, not merely the period. `docs/09`
+>    watched to disappear, and the page asserts the **mechanism**, not merely the
->    Part 10 is the test; its earliest useful reading is **48 hours** after the
+>    period. `docs/09` Part 10 is the test; earliest useful reading **48 hours**
->    record is written and it does not call failure before **7 days**, so
+>    after the record is written, failure not called before **7 days** — Pouya
->    **start it before anything else on this page.** It is the one blocker
+>    started the window 2026-09-02, so **check from 2026-09-04**.
->    that is a waiting period rather than a task.
+>    ⚠️ **THE PAGE CARRIED ITS OWN INSTRUCTION NOT TO DO THIS AND IT WAS
-> 2. ✅ **DONE 2026-09-02 — Pouya read every page against `AGENTS.md` §4.** The
+>    INVISIBLE AT DEPLOY TIME.** `src/pages/legal/privacy.astro:229` holds a live
+>    `TODO(pouya)` ending, in terms: *"This page must not go public until a
+>    deletion has actually been seen."* It is a **JSX comment**, so Astro strips
+>    it and it never reaches `dist/` — which is exactly why `check:claims`, the
+>    build and both deploy paths were all green over it. **A publication gate
+>    that lives only in a stripped comment is not a gate.** The checklist item
+>    *"No `TODO(pouya)` remains in any shipped page"* below is the control that
+>    would have caught it and it was never ticked.
+> 2. 🛑 **THE INTAKE FORM IS LIVE AND BROKEN — a submitter gets a blank page.**
+>    `/contact/` ships `<form method="post" action="/api/intake">`; **`POST
+>    /api/intake` returns HTTP 403 with `content-length: 0`** and an
+>    `apigw-requestid` header, so the request reaches API Gateway and is rejected
+>    because the only route is `POST /submissions` (§7). No styled error, no
+>    message, no fallback. Measured against production 2026-09-02. `docs/09`
+>    Part 6 is the fix; Pouya has the end-to-end test in progress.
+>    ⚠️ **AND `/legal/privacy/` AND `/contact/received/` BOTH DESCRIBE THAT
+>    MECHANISM AS RUNNING** — *"Two emails are sent when you submit the form"* and
+>    *"A confirmation goes to the email address you gave"*. Nothing is sent,
+>    because nothing can be submitted. Found by the D20 pass; see item 3.
+> 3. 🛑 **THE D20 CLAIMS PASS HAS NOW RUN AGAINST THE SHIPPED BYTES AND RETURNED
+>    FAIL — 20 CONFIRMED FINDINGS ON LIVE PAGES.** Run 2026-09-02 at `67847d9`,
+>    after cutover, over all 23 built pages: 13 auditors (8 page groups + 5
+>    cross-cutting lenses) → 41 raw findings → 31 distinct → each adversarially
+>    verified by an independent `claims-auditor` instructed to refute it. **20
+>    CONFIRMED, 11 REFUTED**, plus 13 further findings from two completeness
+>    critics. See the **`claims-auditor`** item below for the breakdown, and
+>    `AGENTS.md`'s Change Log entry of 2026-09-02 (ar) for the full list.
+>    **Nothing here is a claim about Pouya, his credentials or his designations —
+>    every one of those traced, for the third pass running.** The failures are
+>    over-reaches in glosses on sourced legal material, and disclosures on
+>    `/legal/privacy/` and `/contact/received/` that describe a backend which is
+>    not deployed.
+> 4. ✅ **DONE 2026-09-02 — Pouya read every page against `AGENTS.md` §4.** The
 >    human pass, the other half of D20 and not delegable. It was also where the
 >    §Who can see it approval was routed, and his ruling that the read-through
 >    *is* the approval means that sign-off is now discharged rather than
@@ -609,7 +662,47 @@ the decision is re-readable rather than re-litigated.
       Change Log). **All corrected or declined; the pass is clean on findings
       and the item is open only on the human halves above.**
 
-      **Two things about that result are worth carrying forward.** The pass found
+      🛑 **AND IT HAS NOW RUN A THIRD TIME — 2026-09-02, AFTER CUTOVER, AGAINST
+      THE BYTES THAT ACTUALLY SHIP — AND RETURNED FAIL WITH 20 CONFIRMED
+      FINDINGS. THIS ITEM STAYS UNTICKED.** The two runs above predate the
+      Q62/Q63 privacy rewrite, the `/med-arb/` strike and the consent change, so
+      neither had seen the shipped copy. This one did: all 22 live pages were
+      confirmed **byte-identical** to a `dist/` rebuilt at `67847d9` before the
+      audit began, and the auditors read a parse5 extraction of the visitor text
+      and JSON-LD of all 23 pages, validated against known shipped strings first.
+      **13 auditors — 8 page groups and 5 cross-cutting lenses (adjacency,
+      gloss-vs-source, structured data, licensure, §4 Forbidden) — returned 41
+      raw findings, deduped to 31, each then handed to an independent
+      `claims-auditor` instructed to REFUTE it. 20 confirmed, 11 refuted.** Two
+      completeness critics added 13 more. Full list: `AGENTS.md` Change Log
+      2026-09-02 (ar).
+
+      **The shape of the 20, because it is the same shape as run 2 and that is
+      the finding about the process rather than the pages.** Not one is a claim
+      about Pouya, his credentials, his designations, his memberships or the
+      boutique — **the credential spine has now traced clean three passes
+      running**, and D16, D13 and the Forbidden table were swept with every hit
+      printed and read. What failed is two classes: **glosses that assert more
+      than their committed extract establishes** (`/practice/energy/` calling the
+      IESO process six stages where the source says *"up to six"*;
+      `/practice/construction/` stating the 30-day adjudication deadline without
+      its *"Subject to subsection (2)"* extension; `/practice/technology/`
+      asserting Ontario *"has one AI instrument"*), and **disclosures describing a
+      backend that is not deployed** (`/legal/privacy/` on retention and on the
+      two emails, `/contact/received/` on the confirmation). The second class is
+      not a wording problem: it is the privacy policy of a live site describing a
+      mechanism that cannot run, which is the defect class `AGENTS.md` Q22 named.
+
+      ⚠️ **AND THE PASS RAN AFTER THE SITE PUBLISHED, WHICH IS THE ONE THING D20
+      RESTED ON AND NO LONGER HAS.** D20's reasoning is explicit that deferring
+      the claims pass is safe because *"nothing has shipped and there is no public
+      site, so every claims finding to date has been about a page no visitor can
+      reach."* That premise expired at cutover. It is recorded here rather than
+      argued: whether D20 needs amending is Pouya's call, and the honest version
+      of the trade is that the deferral bought nine build steps of speed and the
+      bill came due on a live page.
+
+      **Two things about the earlier result are worth carrying forward.** The pass found
       no defect in any claim about Pouya, his credentials or his designations —
       every one traced. What it found was **five over-reaches in glosses on
       sourced legal material**, which is the failure mode a per-step claims run on