docs: publish governance, governed boosts, receipts, OIDC phase 2, files SSO

Engineering guide: session/refresh/logout architecture, publish-governance
and amplify gating sections, file map to migrations 001-034. Admin guide:
governance administration, files-SSO operations, verification harnesses,
migration list + deploy order + 034 session note. User manual: calendar
receipt badges, boost gating, connections governance note (replaces the
stale 'stub' statuses). Design doc 2026-10-13: marked implemented with the
as-shipped phase 2. Wiki (EN/ES): Drive sign-in + boosts/approvals.
README: governance + Files SSO bullets.

docs/admin-guide.md

@@ -68,7 +68,7 @@ openssl rand -base64 32   # → SESSION_SECRET
 - `sp_app` — created by migration `003_app_role.sql`; `NOSUPERUSER`, grants on all tables/sequences. **All runtime connections.** `FORCE ROW LEVEL SECURITY` means even the table owner cannot silently bypass tenancy.
 
 ### 4.2 Migrations
-Ordered SQL files in `apps/api/migrations/` (001 tenants + RLS + audit chain · 002 RBAC seed · 003 sp_app role · 004 NULLIF policy fix · 005 epoch trigger fix · 006 publishing). Idempotent runner (`apps/api/src/db/migrate.ts`) tracks `schema_migrations`:
+Ordered SQL files in `apps/api/migrations/` — currently **001–034** (001 tenants + RLS + audit chain · 002 RBAC seed · 003 sp_app role · 004 NULLIF policy fix · 005 epoch trigger fix · 006 publishing · 019 publishing integration · 024 chatgov · 029 group files · 031 personal workspaces · 033 publish governance · 034 auth sessions + OIDC refresh tokens). Idempotent runner (`apps/api/src/db/migrate.ts`) tracks `schema_migrations`:
 
 ```bash
 cd apps/api && SUPER_DATABASE_URL='postgresql://tmbh:…@localhost:5433/tmbh' \
@@ -95,6 +95,43 @@ Truth model: raising a value **does not bypass the provider** — it declares wh
 
 37 permissions across 10 seeded roles (Owner, Admin, Publisher, Editor, Approver, Analyst, Moderator, VideoPublisher, StreamOperator, BroadcastOperator). Role changes bump the workspace `authz_epoch`; affected live sessions fail closed on their next request. Audit every membership change (hash-chained; `audit_verify_chain()` detects tampering).
 
+## 6.1 Publish governance (who signs off a post)
+
+Each social connection carries a publish-governance setting. Manage per connection (requires `chatgov.manage`):
+
+```bash
+curl -X PATCH https://api.occupymedia.cc/connections/$CONN/publish-governance \
+  -H "authorization: Bearer $TOKEN" -H 'content-type: application/json' \
+  -d '{"publishGovernance": "admin1"}'     # auto | admin1 | admin_majority | admin_consensus | null
+```
+
+| Mode | Who signs off the publish |
+|---|---|
+| `null` (unset) | manual: anyone with `publication.publish` |
+| `auto` | nobody — dispatch fires when the draft's approval lands |
+| `admin1` | one admin, via a publish poll |
+| `admin_majority` | majority of admins (snapshot at poll open) |
+| `admin_consensus` | every admin; one veto blocks at once |
+
+While held, the publish/boost route answers `202 awaiting_publish_approval` with the poll id; the poll closes after a day and rejects unanswered. Reconnecting an account keeps the setting. Changing the setting does not cancel an already-open poll. The Mastodon **boost** route runs behind the same gate.
+
+## 6.2 Files SSO (Hub as the OIDC issuer for oCIS)
+
+`files.occupymedia.cc` signs in through the Hub: the issuer is `https://api.occupymedia.cc/oidc`, client id `web`, PKCE only, auto-consent for that first-party client. Phase 2 (migration 034) makes sessions revocable and adds rotating refresh tokens bound to the Hub session — Hub logout reaches Drive within one access-token TTL (≤1 h). Operational notes:
+
+- `OIDC_KEY_DIR` must be a persistent volume (the API generates and seals its ES256 keyset there on first boot; losing it logs every Drive session out).
+- `FILES_OCID_USER` and `OIDC_RESERVED_USERNAMES` are never claimable as files accounts (`admin` is reserved by default).
+- Sign-in requires an **active membership** and a username usable as an account name; otherwise the consent endpoint fails closed.
+
+## 6.3 Verification harnesses
+
+```bash
+RADAR_EMAIL=… RADAR_PASSWORD=… node scripts/e2e/governance-sim.mjs   # S1–S9 governance scenarios, live
+node scripts/e2e/brand-palette-check.mjs                             # fails on blue-family pixels in embedded surfaces
+```
+
+The governance sim is re-runnable (all fixtures prefixed `e2e-gov-`) and writes a report to `/tmp/opencode/workers/GOV-SIM-REPORT.md` by default.
+
 ## 7. Monitoring & health
 
 - `GET /healthz` — liveness (no dependencies).
@@ -128,6 +165,8 @@ Truth model: raising a value **does not bypass the provider** — it declares wh
 
 1. Back up DB + confirm KEK backups (§4.3).
 2. `git pull && pnpm install`.
-3. Run migrations (§4.2) — additive by design; expand/contract policy documented per migration.
+3. Run migrations (§4.2) — additive by design; expand/contract policy documented per migration. **Order matters**: 033 must exist before the scheduler that queries its columns rolls, or the E3 pre-dispatch check fails open.
 4. Restart API, then scheduler.
 5. Watch `/readyz` and the audit chain verification.
+
+**Session note (migration 034+):** tokens issued before 034 carry no `sid`; they keep working until expiry but `reissue` refuses them — after upgrading, users re-login at their next epoch bump or within 12 h at the latest. Logout only revokes server-side for tokens issued after the upgrade.