feat: production run — Q61 ramp, /404/, CloudFront router, cutover runbook

Five items of Pouya's production run, 2026-09-01.

Q61 — scroll-padding-top becomes a max() ramp on `10lh - 83px`, with the
plain calc() first as the fallback for engines without `lh`. Hidden focus
stops under minimumFontSize=32: 290 of 1,455 -> 0, control build still
290. Default settings byte-identical (0 differences over 352 page-widths x
17 fields). The 12 residual cells at minimumFontSize=16/20 are pre-existing
and unchanged-or-better; reported, not widened, per instruction.

Intake backend + CloudFront — docs/09-cutover-runbook.md is the
copy-paste sequence for admin execution: every command followed by its
verification and expected output, rollback per part, and Part 10 is Q60's
TTL test. infra/cloudfront/router.js is the trailing-slash function
(30-case suite; 8 fail against the pre-review version, incl. a
protocol-relative open redirect). infra/cloudfront/configure.mjs is
dry-run-by-default and idempotent. scripts/intake-env.mjs emits the six
Lambda env vars from src/data/site.ts.

Four launch blockers found by reading the running system:
  - handler.mjs wrote pk/sk; the live table's key is submissionId with no
    sort key, so every submission would have failed validation silently
  - the Lambda invoke permission is scoped to the old route path
  - 22 of 23 pages 403 without the router function
  - there was no 404 page; src/pages/404.astro adds it

Claims audit (D20 cutover pass) — five gloss over-reaches corrected on
/practice/energy/, /practice/insurance/ (x2), /practice/technology/ and
/med-arb/. Three findings left open for Pouya: Q62, the /med-arb/ gloss,
and Q60.

Q62 — one frozen-tripwire pattern added under the freeze's own breach
exception, with a probe and four negative fixtures. check:claims exits 1
until the false /legal/privacy/ sentence is corrected, so both deploy
paths are blocked by a mechanism rather than by memory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

scripts/check-claims.mjs

@@ -257,6 +257,31 @@ const PATTERNS = [
       'reached a public page once.',
     re: /anyone (may|can) be appointed an arbitrator|nothing in law gates|no (licence|license|designation) is (required|needed) to (be appointed|arbitrate|act as an arbitrator)/gi,
   },
+  {
+    id: 'sole-administrator-q62',
+    rule: 'Q62 — /legal/privacy/ claims sole administrative access to the intake table, and that is FALSE.',
+    incident:
+      'The page shipped "nobody else has access to the table. There is no team, ' +
+      'no assistant and no external administrator." The AWS account has an ' +
+      '`admins` IAM group carrying AdministratorAccess with TWO members, and ' +
+      '`simulate-principal-policy` returns allowed for dynamodb:GetItem, Query ' +
+      'and Scan on the table for both ' +
+      '[verified 2026-09-01 — docs/reference/intake-table-access-verification.md]. ' +
+      'THE REACHED-DIST CONDITION IS WHY THIS PATTERN EXISTS AT ALL: the ' +
+      'sentence was in dist/legal/privacy/index.html, `build`, `check` and this ' +
+      'script all exited 0 over it, and the only thing between it and a live ' +
+      'privacy policy was a TODO(pouya) in a JSX comment — which Astro strips, ' +
+      'so `grep -rn "TODO(pouya)" dist/` returned nothing. The gate was human ' +
+      'memory. Found by `adversarial-reviewer`, 2026-09-01. ' +
+      'DELETE THIS PATTERN when Q62 is ruled: either the access is removed and ' +
+      'the sentence becomes true, or the sentence is rewritten. It is a tripwire ' +
+      'on one specific published falsehood, not a rule about a class.',
+    /* `\s+`, NOT LITERAL SPACES: `compressHTML` collapses whitespace between
+       tags and leaves it alone inside a text node, so the published bytes read
+       "nobody else has access to\n          the table". A literal-space version
+       runs, prints `ok`, and exits 0 with the breach in `dist/`. */
+    re: /nobody\s+else\s+has\s+access\s+to\s+the\s+table|there\s+is\s+no\s+team,\s+no\s+assistant\s+and\s+no\s+external\s+administrator/gi,
+  },
 ];
 
 /**
@@ -341,6 +366,11 @@ const FIXTURES = {
       'C.Med-Arbitrators',
       'C.Med-Arbitration',
     ],
+    'sole-administrator-q62': [
+      /* The two published clauses, verbatim from dist/legal/privacy/. */
+      'nobody else has access to the table',
+      'There is no team, no assistant and no external administrator.',
+    ],
     'struck-universal-q39': [
       'Anyone may be appointed an arbitrator in Ontario',
       'nothing in law gates the role',
@@ -348,6 +378,16 @@ const FIXTURES = {
   },
   /* Every one of these is real published or spec-approved copy on this site. */
   mustNotMatch: [
+    /* NEGATIVE FIXTURES FOR `sole-administrator-q62` — the approved copy nearest
+       to the two clauses it catches. The pattern is deliberately anchored on the
+       two published sentences rather than on the ideas in them, because the
+       replacement wording is not yet decided and a looser pattern would fire on
+       whatever Q62's ruling produces. These four are what "nearest" means: the
+       same page's true sentences about the same subject. */
+    'The table is reachable by the function that writes to it.',
+    'Two accounts hold administrative access to the AWS account, and the function that writes to the table cannot read it.',
+    'Nobody else has access to my mailbox.',
+    'There is no team. Every inquiry is read by me.',
     'I act as a neutral. I do not act for a party in a matter I take, and each party should have their own legal advice.',
     'I run a process, I do not run a case for anybody in it.',
     'I will not run a process whose shape nobody agreed to in advance.',