[Maneek21]

The operator docs still described routine upgrades and expired Runtime sessions as requiring human re-enrollment. They now explain the connect-once behavior shipped October 20–22 (Host 125–136, Email 18–28), using the current Host136/schema131 and Email28 compatibility set.

• Add an owner guide for per-installation compatible update trust, exact approval carry-forward and review boundaries, turning trust off, until-revoked defaults, scoped own-account service recovery and one-second durable catch-up.
• Update connection/renewal contracts, Troubleshooting and structured errors; refresh active setup and compatibility entry points while marking the October 15 decision as historical.
• State the remaining Knowledge race (observed 10–61 s recovery), missing health API fields and item links, dated background permission limit, sequential authority budget risk, and deferred contracts/Wiki and Knowledge/Calendar work.

Sources: supplied reliability analysis, connect-once final report, Email28 zero-human-step report, UI review and mailbox-generation investigation; merged Host #399–#410 and Email #12–#22. The Email28 initial unknown read is preserved as an uncertain operation followed by an independent recovery read.

Validation: pnpm docs:check passed (public links/examples, six operation-script tests and vendor-pilot module validation); final Markdown diff/whitespace and documentation-only file checks passed. All 16 changed files are Markdown. No code, release metadata, artifacts or demo changes.

🤖 Generated with Claude Code