Four rulings from Pouya, 2026-08-30, and their sweep.
D20 — the review protocol. Per build step the review is `adversarial-reviewer`
alone. `claims-auditor` no longer runs per step; it runs ONCE, at cutover, over
the whole finished site, as a blocking item near the top of docs/06's checklist.
`check:claims` is unchanged and still runs on every build and both deploy paths.
The reasoning is recorded in full in AGENTS.md D20, as a calibration and not an
erosion: nothing has shipped, so every claims finding so far has been about a
page no visitor can reach, and one pass over twenty finished pages catches more
than nine passes over drafts because it sees the site as a reader does. The
/med-arb/ ADRIC gloss is the proof — no individual claim was false, the defect
was adjacency, and adjacency does not exist until the pages sit next to each
other. The code reviewer stays per step because what it catches compounds.
What this costs is recorded honestly beside it, not summarised away.
D17 and D19 amended to match. D19's two-round cap governs the per-step code
review only; the single cutover claims pass runs until its findings are
resolved, because there is no second pass behind it.
Q56 — mediation is NOT scoped commercial. Thirteen shipped strings corrected
across five files: page titles, meta descriptions, hero ledes, section ledes,
the `Service` node's name and description, and `ProfessionalService`'s. §4's
mediation row stays unscoped, and the reason now sits beside both rows so the
asymmetry reads as designed: arbitration is scoped commercial because of a
LEGAL GATE (Q39 — family arbitration in Ontario requires prescribed training);
mediation has no such gate. `adversarial-reviewer` then found three surfaces
the sweep had missed, the worst on /practice/ — "These describe the process the
parties are choosing between, in commercial matters" scoped mediation with the
two words never appearing in the same element, so no proximity grep reached it.
Q55 — CLOSED WITHOUT BEING RESOLVED, and the difference is the ruling. The
Q.Arb stamp is split: `[verified]` on the status, `[Pouya's stated basis]` on
the date. The 2026-08-26 record is marked UNRECONCILED, permanently and on
purpose. The date is not published and nothing depends on it.
check:claims — FROZEN. Round 2 found five defects in round 1's own fixes to
that script, two of which made it worse than before the pattern existed. A
pattern is added only after a real breach reaches dist/, never speculatively,
and each addition ships with a probe plus a negative fixture. No refactors, no
coverage improvements. It is a tripwire, not a program.
Two conventions into CLAUDE.md: sweep the VOCABULARY, not only the subject
(`git grep 'Q.Arb'` is line-anchored and could not find ten lines entirely
about Q.Arb that never name it); and agent definitions load at session start,
so an edit to .claude/agents/*.md does not reach the session that made it.
Verified: check 0 errors, lint 0, build 0 (12 pages), check:claims 0.
Lighthouse not run — tool unavailable until build step 7.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
The re-audit of the deploy-guard change surfaced defects well outside the
diff, including one that would have broken production mail.
docs/05-backend-spec.md had the two SES DKIM sets exactly inverted, labelling
the three records that resolve as "orphans" and the three NXDOMAIN records as
"Live. Never delete". Entry (j) corrected this in AGENTS.md §7 and the
correction never reached docs/05. Since SES has no custom MAIL FROM, DKIM is
the only thing satisfying DMARC, so acting on that table would have silently
broken intake mail authentication.
Also in this change:
- .gitea/workflows/deploy.yml gains a guard as steps[0] that fails the run,
naming the variable, if AWS_REGION, S3_BUCKET or CLOUDFRONT_DISTRIBUTION_ID
is empty — how a Gitea too old for the vars context manifests. Verified
fail-closed under bash -e, sh -e and bash -euo pipefail.
- AGENTS.md Current Truth: SPF and DMARC recorded as present (Q20), the
matching §10 High risk row retired, three duplicate Q rows removed.
- docs/reference/AWS-Hosting-Guide.md tracked and given a do-not-execute
banner; it was an executable procedure for the architecture D1/D3 replace.
- Copy decks: "a working litigator" and "an active litigation practice"
replaced with the register's own wording; LegalService JSON-LD replaced with
ProfessionalService; tribunal-secretary offers removed per D14; nine stale
question blockers swept.
- astro.config.mjs: prefetchAll disabled — it injected JS into every page
against the zero-JS convention with no decision recorded.
- src/data/site.ts: unregistered response-time commitment nulled (Q27);
OBA section names downgraded to [assumed] (Q28).
- s3:AbortMultipartUpload reasoning corrected to measure ./dist, not the repo.
Opens Q27, Q28, Q29. AGENTS.md entry (q) records the full resolution,
including the findings declined and why.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF
