docs: settings-key escrow and restore runbook (tmi#1009), startup connect retries (tmi#972) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K9bcYHu4vBU8iTAt55n1GU
docs: Redis noeviction, rotation-failure alarm, rotator reconnect (tmi#1016, #1018, #1019) Secret-Rotation: Redis runs maxmemory 384mb noeviction (640Mi limit); revoke and client-credential delete fail closed with 503. New tmi-secret-rotation-failing alarm alongside tmi-secret-rotation-stale. A Redis restart mid-rotation no longer fails the run except before the swap. Replace allkeys-lru advice on five other pages with noeviction (an evicting policy can drop token revocations) and remove a Common-Issues command that deleted every Redis key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EZaffxdUjvovYXDXXoAcRB
docs: remove Tilt, document .local/k3s.json and --api-cidr, add Secret-Rotation runbook - tmi#995: Tilt inner loop removed; dev-restart is the loop. - tmi#998: CLUSTER=k3s needs .local/k3s.json; deploy-aws.sh needs --api-cidr or .local/aws-deploy.json; make lint runs ruff F on scripts/. - tmi#965 PR 1: new Secret-Rotation page (staged recovery marked untested), linked from Security-Operations and the sidebar; Configuration-Reference re-synced from tmi main 5e567aeb (rotator vars, secrets.file_dir). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XTXhR3iM4aV9mjVbNJ4a7V