feat: D19 bounds the review loop; apply nine rulings; close Q46(a) and Q48–Q53

D19 into §3 and swept to all six destinations Pouya named: both agent briefs
(scope + severity filter), /build Phases 2–4 (non-gating questions, scope, stop
signal, two-round cap), /wrap, and CLAUDE.md (comments record decisions, not
history). Sweep verified by command, not recalled.

Rulings applied:
  Q46(a) PUBLISHABLE — three §4 Offerings rows flipped; gate 1 records
         [Pouya's stated basis], never [verified]. Step 5 unblocked.
  Q48    closed, not site-relevant.
  Q49    one §4 row, "Mediator"; read as declining Q49(b), so worksFor stays out.
  Q50    DEVIATES — ships as name + slogan, not the concatenation. Flagged.
  Q51    OBA sections stay; the regulator/voluntary distinction recorded.
  Q52    docs/reference/deploy-credential-verification.md — 18 read-only AWS
         calls, re-run rather than transcribed, access key ID redacted.
  Q53    memberOf emitted on /about/'s Person node.

Two review rounds. The headline finding was this session's own: the Q53 sweep
was asserted and never run, leaving six in-scope records saying memberOf was
withheld — including §12 R10, which is read aloud every session. Round 2 then
found that round 1's simplification had put memberOf on / as well; the per-page
opt-in is restored, because Pouya's ruling turns on /about/'s visible HTML.

Also fixed: MEMBERSHIP_ORGS had orphaned BOUTIQUE's D16 JSDoc; /'s title now
derives from the constants; §7's deploy row stated and retracted three facts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e

CLAUDE.md

@@ -313,6 +313,22 @@ sweep; instances survived all three, and one of them was inside
 `.claude/agents/claims-auditor.md` — the definition of the agent whose job is to
 catch exactly that. Recall is not evidence.
 
+**Comments record decisions, not history — D19.** *"X because D13"* stays.
+*"This was Y, then flagged, then became X"* belongs in the `AGENTS.md` Change
+Log, which is where a reader looks for how something got here. **A comment
+longer than the code it explains must justify itself. Trim on sight.**
+
+Pouya's ruling, 2026-08-28, on his own measurement: **342 lines added to `src/`
+in one session for 8 functional lines**, and four of that session's review
+findings were stale statements living inside those comments. A comment that
+narrates its own revision history becomes a second record to keep true, and then
+a source of defects about the record rather than about the site.
+
+This does **not** license deleting a comment that carries a live constraint. The
+parent-scope trap, the `animation-timeline` minifier defect and the `as`-prop
+hazard above are load-bearing and stay. The test is whether a future reader needs
+it **to avoid breaking something** — not whether it is interesting.
+
 **Commits.** Conventional Commits (`feat:`, `fix:`, `docs:`, `chore:`, `refactor:`).
 One logical change per commit. Never commit secrets, `.env` files, or AWS
 credentials. Gitea is not an AWS OIDC provider, so the deploy key is designed as