Reviewed `d1b85d63`; no files changed.

1. **P1 — §3.1: The scanner role can read SSM parameters, violating D4.**  
   `AmazonSSMManagedInstanceCore` includes `ssm:GetParameter` and `ssm:GetParameters` on `*`. Attaching it alone does not deliver “no parameter grants.” The existing module documents this exact problem and supplies an explicit deny: [infra/modules/region-host/main.tf:418](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/infra/modules/region-host/main.tf:418). The [AWS policy document](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMManagedInstanceCore.html) confirms the permissions.  
   **Fix:** Explicitly deny all parameter-read actions on the scanner role while retaining Session Manager’s channel permissions.

2. **P1 — §3.2, steps 6–7: Masking the socket leaves clamd requiring a masked unit.**  
   Debian trixie’s [clamd/clamav-daemon.service.in:4](https://sources.debian.org/src/clamav/1.4.3%2Bdfsg-1/clamd/clamav-daemon.service.in/#L4) contains `Requires=clamav-daemon.socket`; its install section also names that socket. The proposed memory/restart drop-in does not remove this dependency. Starting the service after masking the socket therefore fails. Debian’s [packaging bug discussion](https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=1042377%3Bmsg%3D10) explicitly identifies removing the dependency as part of this workaround.  
   **Fix:** Specify a complete service override without the socket dependency and `Also=` entry. Stop the service and socket, mask the socket, reload systemd, then start clamd and verify both listeners.

3. **P1 — §3.2, steps 1–2: The foreground FreshClam invocation conflicts with the package-started daemon.**  
   Debian’s [debian/clamav-freshclam.postinst.in:333](https://sources.debian.org/src/clamav/1.4.3%2Bdfsg-1/debian/clamav-freshclam.postinst.in/#L333) starts `clamav-freshclam` during installation. The next prescribed step launches another instance using the same configuration and locked update log. That invocation can fail before initialization reaches the clamd configuration.  
   **Fix:** Suppress package service starts during installation, or explicitly stop FreshClam before its foreground run. Keep clamd and its socket stopped during configuration; restart the updater after database initialization succeeds.

4. **P2 — §3.2: Matching the size limits does not prevent incomplete scans being recorded as clean.**  
   `MaxScanSize` counts expanded archive content, and `MaxFileSize` also applies to contained files. A compressed object below 25 MiB can exceed either limit after extraction. With `AlertExceedsMax` defaulting to `no`, the proposed settings do not guarantee that this becomes a size-refusal response. See the [trixie configuration manual](https://manpages.debian.org/trixie/clamav-daemon/clamd.conf.5.en.html#AlertExceedsMax). The client maps an `OK` response to clean at [internal/clamd/clamd.go:273](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/internal/clamd/clamd.go:273), which is then signed and tagged at [internal/objstore/clamav.go:364](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/internal/objstore/clamav.go:364).  
   **Fix:** Define explicit handling for extraction-limit results and add an archive exceeding those limits to §7. `AlertExceedsMax yes` prevents silent success, but the current client classifies its `FOUND` response as infected; either document that policy or add a distinct skipped mapping.

5. **P2 — §§3.1–3.2: The only administration path lacks an installed SSM agent.**  
   `module.<host>.ami_id` returns the base Debian image, not the configured console host: [infra/modules/region-host/outputs.tf:26](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/infra/modules/region-host/outputs.tf:26). Debian images do not include SSM Agent by default, according to [AWS’s installation instructions](https://docs.aws.amazon.com/systems-manager/latest/userguide/agent-install-deb.html). The proposed script installs only ClamAV packages. With SSH closed, the promised SSM checks and recovery path will be unavailable.  
   **Fix:** Install and enable the arm64 SSM agent during bootstrap, and require successful Systems Manager registration before wiring the console.

**Verdict: reject.**