M48: harden demo operations and offsite recovery

docs/17-runbook.md

@@ -56,10 +56,19 @@ unique `GRAFANA_ADMIN_PASSWORD` before first start. Provisioning includes the Mo
 overview dashboard and alerts for API/database outage, 5xx rate, p95 latency, real outbox
 backlog and real outbox failures. Synthetic retry scenarios never trigger outbox alerts.
 
+The hourly `live-canary.yml` workflow independently checks HTTPS readiness, the TLS
+certificate horizon and the non-destructive Chromium/Firefox production journey. Configure
+the optional `LIVE_CANARY_HEARTBEAT_URL` repository secret to make missed scheduled jobs
+visible in an external dead-man monitor. A successful app release does not restart the
+database, backup or monitoring services; use `deploy/unraid/refresh-infrastructure.sh`
+deliberately when those definitions change.
+
 Never execute `pytest` inside the deployed API container: the acceptance fixtures reset
 their database deliberately. `make test` uses `compose.test.yaml`, a fixed
 `mobilityops-test` Compose project and its own disposable PostgreSQL volume, and removes
 that project on success or failure. The Gitea workflow uses the same isolation boundary.
+CI also runs `scripts/run-readonly-load-smoke.py` against persisted list/dashboard routes;
+the gate requires zero HTTP errors and a p95 below 1.5 seconds at its bounded concurrency.
 
 ## Operational mode (non-demo login)
 
@@ -242,3 +251,7 @@ Publish the scheduled quality-scan workflow the same way:
   independently-authenticated API surface;
 - failed demo experiment: Operations Manager reset (`POST /api/v1/demo/reset`) restores
   the deterministic seed, including all named S1–S6 demo scenarios.
+- loss of the Unraid host: recover the latest OneDrive dump only after its downloaded
+  checksum and `pg_restore --list` pass; use the guarded restore command above. OneDrive
+  synchronization health requires both a daily verified round trip and a weekly real
+  restore drill. OAuth setup is documented in `deploy/unraid/README.md`.