docs(worker): Gate F runbook for docling shadow extraction (packet B4)

docs/README.md

@@ -50,7 +50,7 @@ npm run docs:check-links
 - [launch-operator-runbook.md](launch-operator-runbook.md) — launch/operational duties and SLO probes
 - [reindex-runbook.md](reindex-runbook.md) — safe reindex and ingestion recovery
 - [retrieval-quality-runbook.md](retrieval-quality-runbook.md) — RAG/retrieval eval gates and tuning
-- [worker-deploy-runbook.md](worker-deploy-runbook.md) — worker build contract, run recipe, secrets
+- [worker-deploy-runbook.md](worker-deploy-runbook.md) — worker build contract, run recipe, secrets, docling shadow extraction (B4)
 - [disaster-recovery-runbook.md](disaster-recovery-runbook.md) — backup/restore and recovery drills
 - [auth-connection-cap-runbook.md](auth-connection-cap-runbook.md) — Supabase auth connection cap (operator)
 - [staging-setup.md](staging-setup.md) — staging environment bootstrap

docs/branch-review-records/4ec2291165da59a78cf8fa25a7d04e7cca8c1c312a7b08bca06a23b7273ff0b3.record.md

@@ -0,0 +1 @@
+| 2026-08-20 | claude/docling-shadow-extraction-runbook-942862 | 0ec44604547f4adb3de0cd8fdb96982e2e4f67a1 | packet B4 docling shadow extraction Gate F operator runbook (docs only) | runbook-added;values-verified-from-code-and-gate-b-record;cost-cap-stated-2pct-and-5pct;rollback-triggers-named;fixtures-v2-caveat-explicit;three-unverifiable-values-flagged-and-queued-P3 | verify:pr-local:11-gates-pass-0-fail;docs:check-links:2054-refs;docs:check-index:54-roots;docs:check-scripts:524-refs;docs:check-inventory:current;check:outstanding-issues:403-rows;check:ledger-write-discipline:pass;check:branch-review-ledger:pass;prettier:clean |

docs/branch-review-records/cf5f4bc2b34ec20df29958026b121de2abc549bfd79f6a2f662c38f1c69f6171.record.md

@@ -0,0 +1 @@
+| 2026-08-20 | claude/docling-shadow-extraction-runbook-942862 | 47deb7c42e398c39c2337b5e1cd6a5529afc9e40 | packet B4 docling shadow extraction Gate F operator runbook (docs only) — post-review pass | two-codex-P2-findings-verified-against-code-and-fixed;search-delay-claim-was-wrong-status-set-at-commit;cohort-widening-needs-reindex-stated;two-coderabbit-nits-on-queued-request-fixed;coderabbit-ledger-entry-finding-rejected-invented-scope | check:outstanding-issues:pass;prettier:clean;code-verified:commit_document_index_generation-sets-status-before-shadow |

docs/outstanding-issues-inbox/219680d3-050e-40d4-bd95-f511420ac3cb.json

@@ -0,0 +1,14 @@
+{
+ "version": 2,
+ "id": "219680d3-050e-40d4-bd95-f511420ac3cb",
+ "createdOn": "2026-08-20",
+ "action": "add",
+ "payload": {
+ "pri": "P3",
+ "type": "task",
+ "summary": "Close the four operator unknowns the B4 shadow-extraction runbook could not answer from the repository: Railway variable-change behaviour, the shadow-record read path, the timeout rollback threshold, and the worker memory limit/peak",
+ "detail": "docs/worker-deploy-runbook.md section 3 (added 2026-08-20) is the Gate F runbook for packet B4 docling shadow extraction. Three values in it could not be verified from the repository and are flagged as such in the text. (1) ROLLBACK TIME TO EFFECT: the one-step rollback is WORKER_DOCUMENT_EXTRACTOR_MODE=legacy on the Railway worker service, but whether Railway restarts or fully rebuilds the service on a variable change is not recorded anywhere in this repo, so the runbook can only bound the worker-side cost (SIGTERM batch drain plus at most one 120 s docling window). One dashboard observation settles it; record the answer in section 3.7. (2) NO READ PATH: no npm script reads, exports, or clears documents.metadata.shadow_extraction, so the first-24-hours watch in section 3.6 is a hand-run SQL query in the Supabase editor. A small read-only aggregation script (outcome counts, wall_ms and peak_rss_bytes percentiles, delta ratios) would make the watch repeatable and reviewable instead of ad hoc. (3) TIMEOUT ROLLBACK THRESHOLD: section 3.7 trigger 5 proposes rolling back when more than 10 percent of cohort runs time out. That number is a proposed operating rule, not a measured value, and needs owner ratification or replacement once real-corpus wall_ms data exists. Also unverified: the memory headroom precondition in section 3.2 asks the operator to confirm the Railway worker memory limit and observed peak, neither of which is in-repo. Stop: no code, worker, or provider change is implied by this row; it is documentation completion plus one small offline read-only script.",
+ "source": "docs/worker-deploy-runbook.md section 3 (Gate F runbook PR, 2026-08-21); PR #2170 squash 5437c309f",
+ "issueUlid": "01M0G2J7891VFSYF1ZZPN5H78Z"
+ }
+}