feat: production run — Q61 ramp, /404/, CloudFront router, cutover runbook

Five items of Pouya's production run, 2026-09-01.

Q61 — scroll-padding-top becomes a max() ramp on `10lh - 83px`, with the
plain calc() first as the fallback for engines without `lh`. Hidden focus
stops under minimumFontSize=32: 290 of 1,455 -> 0, control build still
290. Default settings byte-identical (0 differences over 352 page-widths x
17 fields). The 12 residual cells at minimumFontSize=16/20 are pre-existing
and unchanged-or-better; reported, not widened, per instruction.

Intake backend + CloudFront — docs/09-cutover-runbook.md is the
copy-paste sequence for admin execution: every command followed by its
verification and expected output, rollback per part, and Part 10 is Q60's
TTL test. infra/cloudfront/router.js is the trailing-slash function
(30-case suite; 8 fail against the pre-review version, incl. a
protocol-relative open redirect). infra/cloudfront/configure.mjs is
dry-run-by-default and idempotent. scripts/intake-env.mjs emits the six
Lambda env vars from src/data/site.ts.

Four launch blockers found by reading the running system:
  - handler.mjs wrote pk/sk; the live table's key is submissionId with no
    sort key, so every submission would have failed validation silently
  - the Lambda invoke permission is scoped to the old route path
  - 22 of 23 pages 403 without the router function
  - there was no 404 page; src/pages/404.astro adds it

Claims audit (D20 cutover pass) — five gloss over-reaches corrected on
/practice/energy/, /practice/insurance/ (x2), /practice/technology/ and
/med-arb/. Three findings left open for Pouya: Q62, the /med-arb/ gloss,
and Q60.

Q62 — one frozen-tripwire pattern added under the freeze's own breach
exception, with a probe and four negative fixtures. check:claims exits 1
until the false /legal/privacy/ sentence is corrected, so both deploy
paths are blocked by a mechanism rather than by memory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

.claude/agents/claims-auditor.md

@@ -178,9 +178,25 @@ years in ADR practice, or time-to-award statistic is forbidden outright. The
 approved stat set is `Q.Med` / `JD + ML` / `EN · FA`, plus `Q.Arb` in a fourth
 slot.
 
-**Q.Arb.** Commenced August 2026. Flag anything reading as held, imminent, or
-nearly complete. The Arbitration page must state plainly what is available now
-versus what follows designation.
+**Q.Arb — DO NOT HOLD ITS STATE HERE EITHER. Read §4's row at audit time.**
+This paragraph said *"Commenced August 2026. Flag anything reading as held,
+imminent, or nearly complete. The Arbitration page must state plainly what is
+available now versus what follows designation."* §4 recorded Q.Arb as **HELD** on
+2026-08-29, struck every stage form — `commenced`, `in progress`, `pathway`,
+`not yet` — struck the Forbidden row against *"held, imminent, nearly complete"*
+with it, and dissolved the paired-disclosure condition with an explicit
+instruction to leave no residue. **Applied literally, the struck text would have
+flagged correct copy and demanded the struck form**, and an imperative sentence
+about what a page "must state plainly" is the kind an agent obeys.
+
+Found by this agent in the D20 cutover pass, 2026-09-01, which read §4 instead —
+**the fifth stale claim found inside this file**, after the memberships list
+below, and the shape is identical every time: a fact copied here, corrected in
+§4, never swept. The rule that follows from five instances is the one the
+memberships paragraph already states, generalised: **this file holds the
+questions to ask, not the answers.** Any state that can change — a designation, a
+membership, a date, a rate — is read from §4 at audit time. If you find yourself
+about to write a value here, write the §4 pointer instead.
 
 **Memberships.** **Do not hold a list here. Read the memberships row in
 `AGENTS.md` §4 at audit time and use what it says.** This paragraph used to