docs: producer & media ingest, ops changes, library updates (October 2026)

- engineering-guide §10: media attachments, alt-text delivery, producer,
  audio-less silence bed, chunked ingest, upload caps
- admin-guide §10: oCIS retired from the payload path, storage_key (041),
  publishing media resolver + dedupe origins, produce-worker, api restart
  rate-limit note; §6.3 marked legacy
- user-guide §9: 2 GiB Library uploads, compose attachments + alt text,
  producer, chunked large-video uploads

docs/admin-guide.md

@@ -128,6 +128,7 @@ Operational notes:
 - Every switch is idempotent (`Idempotency-Key`) and lands in the audit chain as `director.<operation>` — incident review replays commands from the audit log.
 
 ## 6.3 Files SSO (Hub as the OIDC issuer for oCIS)
+> **Retired (October 2026):** oCIS is out of the payload path and the in-app Drive view is gone — see §10.1. This section remains only as reference for the legacy `files.occupymedia.cc` host.
 `files.occupymedia.cc` signs in through the Hub: the issuer is `https://api.occupymedia.cc/oidc`, client id `web`, PKCE only, auto-consent for that first-party client. Phase 2 (migration 034) makes sessions revocable and adds rotating refresh tokens bound to the Hub session — Hub logout reaches Drive within one access-token TTL (≤1 h). Operational notes:
 
 - `OIDC_KEY_DIR` must be a persistent volume (the API generates and seals its ES256 keyset there on first boot; losing it logs every Drive session out).
@@ -172,7 +173,29 @@ The governance sim is re-runnable (all fixtures prefixed `e2e-gov-`) and writes
 | MinIO image pull denied | registry degradation | retry later or point `S3_ENDPOINT` at any S3 |
 | Streams columns empty in UI | mock-registry data (API not wired yet) | expected pre-WP3-integration |
 
-## 10. Upgrading
+## 10. Operations changes (October 2026)
+
+### 10.1 oCIS retired from the payload path
+- **All media** — Files tab, video, submissions, media posts, produced files — now stores in the **R2 bucket** (`S3_*` env, `S3_KEK` envelope encryption). oCIS holds no payloads.
+- `files.occupymedia.cc` / the **Drive tab** is gone from the web UI.
+- `192.168.13.210` is no longer in the serving path and may be decommissioned.
+
+### 10.2 Payload pointer (migration 041)
+- `chat_media_archive.storage_key` is the **authoritative** payload pointer.
+- `ocis_resource_id` remains only as a legacy column — do not build against it.
+
+### 10.3 Publishing media
+- The scheduler resolves media at dispatch (**PublishingMediaResolver**: RLS workspace lookup + R2 download + SPENC1 open).
+- `MASTODON_PUBLISH_DEDUPE_ORIGINS=https://social.occupymedia.cc` **must stay set**. Media posts are two provider mutations (media upload + status create) and the dispatch gate refuses the second without a verified dedupe origin.
+
+### 10.4 Produce worker
+- Runs as a **separate container** (`produce-worker`) and needs **ffmpeg + a font** — `DejaVuSans-Bold` at `/usr/share/fonts/truetype/dejavu/`.
+- `MEDIA_DEBUG_STDERR=1` routes ffmpeg stderr to `/tmp/ffmpeg-debug.log` for debugging.
+
+### 10.5 Known ops note
+- Restarting the api container repeatedly can trip the homeserver login rate limit (`M_LIMIT_EXCEEDED`) and crash bootstrap — wait **~2–3 min** between api restarts.
+
+## 11. Upgrading
 
 1. Back up DB + confirm KEK backups (§4.3).
 2. `git pull && pnpm install`.