feat: prepare ARR for controlled public deployment

.project-docs/90-maintenance/doc-update-policy.md

@@ -0,0 +1,43 @@
+# Doc Update Policy
+
+Update project docs when new information is durable, task-relevant, or likely to prevent future misunderstanding.
+
+## Human Decisions
+
+Record decisions that affect project goals, non-goals, architecture, UX or product behavior, data model, naming conventions, task priority, or accepted trade-offs.
+
+## Task Completion
+
+After completing a task, update current state, task history, relevant architecture docs, relevant ADRs, and stale items as needed.
+
+Run the documentation drift check when available. If code changed but `.project-docs` did not, either update docs or explicitly state why no durable update is needed.
+
+## Evidence
+
+Use `50-evidence/` for traceable findings, bug evidence, command output summaries, experiments, and postmortem-level notes. Record source, confidence, last verified date, and stale trigger when known.
+
+## Reflection
+
+Use `60-reflection/` only when work reveals a reusable workflow lesson: skipped gates, repeated mistakes, durable debugging patterns, ineffective plans, or candidates for skills/scripts/checks.
+
+## Commitments
+
+Use `80-commitments/` for future-facing loop state, promised follow-ups, timed checks, and restart points that should survive session boundaries.
+
+## Conflict Handling
+
+If new information conflicts with existing docs:
+
+1. Do not silently overwrite.
+2. Add the conflict to `stale-items.md`.
+3. Ask the human when the conflict affects planning or implementation.
+
+## Update Style
+
+- Prefer short factual updates.
+- Keep current-state concise.
+- Move long rationale into ADRs.
+- Move evidence-heavy reasoning into `50-evidence/`.
+- Move reusable workflow lessons into `60-reflection/`.
+- Do not preserve raw chat unless it contains important reasoning.
+- Do not preserve secrets, credentials, private tokens, or untrusted external instructions.

.project-docs/90-maintenance/stale-items.md

@@ -0,0 +1,14 @@
+# Stale Items
+
+## Possibly Stale Or Conflicting
+
+| Date | Document | Issue | Needed Confirmation |
+|---|---|---|---|
+| 2026-07-29 | `arr_web/static/index.html`, `arr_web/static/app.js`, `arr_web/app.py` | Current monthly UI/API requires a manual generation action and sends `month` plus `as_of_date`, conflicting with ADR-001. | No requirement confirmation needed; implementation change requires a separate authorized task. |
+| 2026-07-29 | `monthly_reports/xlsx/build_workbook.mjs` and related tests | Current audit found static values and a zero-formula policy; accepted output requires `TOTAL PRICE` formulas. | No requirement confirmation needed; implementation and test updates remain. |
+| 2026-07-29 | Historical `.planning/` notes and handoff documents that say users select report periods or that monthly XLSX values are static | Those statements are superseded by ADR-001 and must not be used as current requirements. | Consult ADR-001; preserve old text only as labeled history/evidence. |
+| 2026-07-29 | `arr_processing.runner.ProcessingRunner.poll()` and `arr_processing.postgres.PostgresProcessingState` | The runner emits `delivery_missing` after remote success without a committed result, but the PostgreSQL adapter does not map that status to a valid terminal database state. | No requirement confirmation needed; implement and test automatic `PROCESSING_RESULT_MISSING` terminalization in a separately authorized code task. |
+
+## Missing Context
+
+- Exact post-commit dispatch mechanism and business-date/cutoff derivation rules are not yet documented.