feat: production run — Q61 ramp, /404/, CloudFront router, cutover runbook

Five items of Pouya's production run, 2026-09-01.

Q61 — scroll-padding-top becomes a max() ramp on `10lh - 83px`, with the
plain calc() first as the fallback for engines without `lh`. Hidden focus
stops under minimumFontSize=32: 290 of 1,455 -> 0, control build still
290. Default settings byte-identical (0 differences over 352 page-widths x
17 fields). The 12 residual cells at minimumFontSize=16/20 are pre-existing
and unchanged-or-better; reported, not widened, per instruction.

Intake backend + CloudFront — docs/09-cutover-runbook.md is the
copy-paste sequence for admin execution: every command followed by its
verification and expected output, rollback per part, and Part 10 is Q60's
TTL test. infra/cloudfront/router.js is the trailing-slash function
(30-case suite; 8 fail against the pre-review version, incl. a
protocol-relative open redirect). infra/cloudfront/configure.mjs is
dry-run-by-default and idempotent. scripts/intake-env.mjs emits the six
Lambda env vars from src/data/site.ts.

Four launch blockers found by reading the running system:
  - handler.mjs wrote pk/sk; the live table's key is submissionId with no
    sort key, so every submission would have failed validation silently
  - the Lambda invoke permission is scoped to the old route path
  - 22 of 23 pages 403 without the router function
  - there was no 404 page; src/pages/404.astro adds it

Claims audit (D20 cutover pass) — five gloss over-reaches corrected on
/practice/energy/, /practice/insurance/ (x2), /practice/technology/ and
/med-arb/. Three findings left open for Pouya: Q62, the /med-arb/ gloss,
and Q60.

Q62 — one frozen-tripwire pattern added under the freeze's own breach
exception, with a probe and four negative fixtures. check:claims exits 1
until the false /legal/privacy/ sentence is corrected, so both deploy
paths are blocked by a mechanism rather than by memory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

.gitea/workflows/deploy.yml

@@ -195,7 +195,7 @@ jobs:
             --max-time 15 \
             -H "Origin: https://adr.smlcompany.ca" \
             -H 'Content-Type: application/x-www-form-urlencoded' \
-            --data 'deploy-route-probe=1' "$url" 2>/dev/null || true)
+            --data 'deploy-route-probe=1' "$url" || true)
           if [ "$rc" -ne 0 ]; then
             echo "WARNING: the POST to /api/intake did not complete (curl exit $rc)."
             echo "The site is deployed and the contact form is unverified."
@@ -205,9 +205,19 @@ jobs:
           else
             echo "WARNING: POST /api/intake returned $code, expected 303 to"
             echo "/contact/could-not-send/; redirect was '${location:-none}'."
-            echo "404 means the CloudFront /api/* behaviour is missing. 403 can"
-            echo "mean the same thing, or the handler refusing the Origin."
-            echo "See docs/06-deployment.md's cutover checklist."
+            # Kept in step with scripts/deploy-local.sh — the two are one
+            # artefact in two places. 404 is ambiguous between three causes and
+            # the distribution's 404 mapping hides API Gateway's own body.
+            echo "404: /api/* behaviour missing (docs/09 Part 3), OR the POST"
+            echo "/api/intake route missing (Part 6.2), OR the route exists and"
+            echo "the 404 mapping replaced the API's body. Separate them with"
+            echo "aws apigatewayv2 get-routes --api-id <id> --query"
+            echo "'Items[].RouteKey' — the --api-id is required; without it the"
+            echo "CLI exits 252 on ParamValidation."
+            echo "403: method rejected, or the handler refused the Origin —"
+            echo "check Managed-AllViewerExceptHostHeader is on the behaviour."
+            echo "500: the invoke permission for this route is missing (6.1)."
+            echo "See docs/09-cutover-runbook.md Part 7.1."
           fi
 
       - name: Summary