feat: D19 bounds the review loop; apply nine rulings; close Q46(a) and Q48–Q53

D19 into §3 and swept to all six destinations Pouya named: both agent briefs
(scope + severity filter), /build Phases 2–4 (non-gating questions, scope, stop
signal, two-round cap), /wrap, and CLAUDE.md (comments record decisions, not
history). Sweep verified by command, not recalled.

Rulings applied:
  Q46(a) PUBLISHABLE — three §4 Offerings rows flipped; gate 1 records
         [Pouya's stated basis], never [verified]. Step 5 unblocked.
  Q48    closed, not site-relevant.
  Q49    one §4 row, "Mediator"; read as declining Q49(b), so worksFor stays out.
  Q50    DEVIATES — ships as name + slogan, not the concatenation. Flagged.
  Q51    OBA sections stay; the regulator/voluntary distinction recorded.
  Q52    docs/reference/deploy-credential-verification.md — 18 read-only AWS
         calls, re-run rather than transcribed, access key ID redacted.
  Q53    memberOf emitted on /about/'s Person node.

Two review rounds. The headline finding was this session's own: the Q53 sweep
was asserted and never run, leaving six in-scope records saying memberOf was
withheld — including §12 R10, which is read aloud every session. Round 2 then
found that round 1's simplification had put memberOf on / as well; the per-page
opt-in is restored, because Pouya's ruling turns on /about/'s visible HTML.

Also fixed: MEMBERSHIP_ORGS had orphaned BOUTIQUE's D16 JSDoc; /'s title now
derives from the constants; §7's deploy row stated and retracted three facts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e

.claude/agents/claims-auditor.md

@@ -13,6 +13,38 @@ The site this replaces contained a fictitious founder, invented matter values
 and a testimonial attributed to a person who does not exist. Your existence is
 the control that stops that recurring.
 
+## Scope — D19, and it is a hard boundary
+
+**In scope:**
+
+- `dist/` and `src/` — what a visitor actually receives
+- the specs that direct copy: `docs/01-architecture.md`,
+  `docs/03-content-spec.md`, `docs/04-seo-spec.md`, `docs/07-fees.md`
+- `AGENTS.md` **§3, §4, §7, §9, §12** — the operative sections
+
+**Out of scope:**
+
+- the `AGENTS.md` **Change Log**
+- the agent briefs in `.claude/agents/`, including this one
+- `AGENTS.md` prose outside the five sections named above
+- the **historical accuracy of code comments** — whether a comment's account of
+  how the code got here is still true
+
+A false statement in a Change Log entry gets corrected when someone notices it.
+It does not get a review pass, because **no visitor reads it.** Pouya's ruling,
+2026-08-28 (D19), on the session where most of a second review round's findings
+were defects in the first round's own fixes: *"they are defects in the record
+about the record, and that is infinite regress."*
+
+**What this does not narrow, and read this carefully.** Your subject is **claims
+about Pouya, his credentials, his experience and his practice** — and one of
+those in a code comment is in scope wherever it could reach a page or mislead an
+implementer into writing one. `src/data/site.ts` and `src/data/schema.ts` carry
+the register's wording in comments *precisely because the wording is the
+compliance*; audit those exactly as you would copy. What is out of scope is a
+comment's account of **how the code got here** — which version said what, which
+review found it.
+
 ## Method
 
 1. Read `AGENTS.md` §4 in full — the Verified table, the Forbidden table, and
@@ -105,6 +137,17 @@ machine-readable misrepresentation is still a misrepresentation.
 A table: **claim quoted verbatim · location · verdict (VERIFIED / NOT IN
 REGISTER / FORBIDDEN) · the register line it matches, or what to do instead.**
 
+### Severity filter — D19
+
+Report **FORBIDDEN** and **NOT IN REGISTER** findings in full — those are the
+job, and none of them is optional. Below that line, raise a wording preference
+only if acting on it would change what ships. Pouya's ruling, 2026-08-28: *"a
+review that reports twenty things to make twenty small edits has spent more than
+it saved."*
+
+This does not soften the rule above it. **A claim not in the Verified table does
+not ship**, at any count.
+
 Then a single line: **PASS** — every assertion traced — or **FAIL**, with the
 count of untraceable claims.