feat: production run — Q61 ramp, /404/, CloudFront router, cutover runbook

Five items of Pouya's production run, 2026-09-01.

Q61 — scroll-padding-top becomes a max() ramp on `10lh - 83px`, with the
plain calc() first as the fallback for engines without `lh`. Hidden focus
stops under minimumFontSize=32: 290 of 1,455 -> 0, control build still
290. Default settings byte-identical (0 differences over 352 page-widths x
17 fields). The 12 residual cells at minimumFontSize=16/20 are pre-existing
and unchanged-or-better; reported, not widened, per instruction.

Intake backend + CloudFront — docs/09-cutover-runbook.md is the
copy-paste sequence for admin execution: every command followed by its
verification and expected output, rollback per part, and Part 10 is Q60's
TTL test. infra/cloudfront/router.js is the trailing-slash function
(30-case suite; 8 fail against the pre-review version, incl. a
protocol-relative open redirect). infra/cloudfront/configure.mjs is
dry-run-by-default and idempotent. scripts/intake-env.mjs emits the six
Lambda env vars from src/data/site.ts.

Four launch blockers found by reading the running system:
  - handler.mjs wrote pk/sk; the live table's key is submissionId with no
    sort key, so every submission would have failed validation silently
  - the Lambda invoke permission is scoped to the old route path
  - 22 of 23 pages 403 without the router function
  - there was no 404 page; src/pages/404.astro adds it

Claims audit (D20 cutover pass) — five gloss over-reaches corrected on
/practice/energy/, /practice/insurance/ (x2), /practice/technology/ and
/med-arb/. Three findings left open for Pouya: Q62, the /med-arb/ gloss,
and Q60.

Q62 — one frozen-tripwire pattern added under the freeze's own breach
exception, with a probe and four negative fixtures. check:claims exits 1
until the false /legal/privacy/ sentence is corrected, so both deploy
paths are blocked by a mechanism rather than by memory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/01-architecture.md

@@ -49,15 +49,15 @@ decision, not an aesthetic one.
 /legal/terms/                    Terms of use
 ```
 
-Nineteen fixed URLs plus one per article — **and three more added at build steps
-8 and 9, all three `noindex` and all three excluded from the sitemap in
-`astro.config.mjs`.** They are utilities rather than pages in the IA above, which
-is why they are listed here rather than in it:
+Nineteen fixed URLs plus one per article — **and four more, all `noindex` and all
+excluded from the sitemap in `astro.config.mjs`.** They are utilities rather than
+pages in the IA above, which is why they are listed here rather than in it:
 
 ```
 /contact/received/               The intake form's success landing page
 /contact/could-not-send/         Its failure landing page
 /bio/                            Source of the one-page PDF (R16)
+/404/                            Emitted as dist/404.html — see below
 ```
 
 The two `/contact/` pages exist because the site ships **zero JavaScript**, so
@@ -66,9 +66,32 @@ the form is a plain POST and the handler answers `303 See Other` to a real URL
 with an appointment proposal is a *rendering of a reviewed page* rather than a
 document outside this project's review apparatus.
 
-**So: 22 built pages plus one per published article.** `npm run lighthouse`
-enumerates them from `dist/` rather than from this list, which is why this count
-being stale could never make the gate miss a page.
+⚠️ **`/404/` IS THE ONE ROUTE THAT BREAKS THIS DOCUMENT'S OWN URL RULES, AND IT
+HAS TO.** The rules above are lower-case, hyphenated, trailing slash, no file
+extensions. Astro emits `src/pages/404.astro` as **`dist/404.html`** — a file at
+the root, outside `build.format: 'directory'` — because that is the object name a
+CDN custom error response can point at. `SEO.astro` still sees the path as
+`/404/`, which is why its `OG_CARDS` key is `/404/` while the URL a tool fetches
+is `/404.html`. Added 2026-09-01; `docs/04` had asked for the page since before
+build step 1 and it did not exist.
+
+**So: 23 built pages plus one per published article.**
+
+⚠️ **AND THIS SENTENCE USED TO END WITH A REASSURANCE THAT WAS DISPROVEN THE DAY
+THE 404 PAGE WAS ADDED.** It read: *"`npm run lighthouse` enumerates them from
+`dist/` rather than from this list, which is why this count being stale could never
+make the gate miss a page."* Both `scripts/lighthouse.mjs` and
+`scripts/og-proof.mjs` enumerated **`index.html` under `dist/`**, not every page —
+so both missed `/404/`, and `og:proof` reported it backwards, as an orphaned card
+rather than an unchecked page. The count being stale was not the failure mode; the
+**definition of "a page"** was. Both now take any `.html` at the root as well, and
+`check:claims` always did, which is why the new page's copy was inside the claim
+register from its first build.
+
+**The rule that replaces the reassurance:** a route that does not live at
+`<dir>/index.html` is invisible to anything that looks for `index.html`. If a
+future page is emitted outside the directory convention, grep the three scripts
+for `index.html` before trusting any of them.
 
 ### URL rules