From 043b49fd537ee4cd9b414411ffc8280d35ac3d63 Mon Sep 17 00:00:00 2001
From: yacosta738 <33158051+yacosta738@users.noreply.github.com>
Date: Tue, 15 Sep 2026 00:32:47 +0000
Subject: [PATCH 1/4] docs(architecture): synchronize C4 models and ADR
 discovery ledger with 100% codebase evidence

---
 docs/README.md                                |  2 +-
 docs/architecture/README.md                   |  4 ++--
 .../adr-discovery/candidate-decisions.md      |  4 +++-
 .../adr-discovery/documentation-drift.md      |  4 +++-
 .../documentation-synchronization-plan.md     |  6 +++--
 .../adr-discovery/evidence-ledger.md          | 22 +++++++++++++++++++
 docs/architecture/c4/01-system-context.md     |  4 ++--
 docs/architecture/c4/02-container.md          | 12 +++++-----
 docs/architecture/c4/03-component.md          |  4 ++--
 docs/architecture/c4/04-code.md               |  4 ++--
 docs/architecture/c4/README.md                |  4 ++--
 docs/architecture/c4/SUMMARY.md               |  4 ++--
 docs/architecture/iam-platform.md             |  4 ++--
 docs/architecture/login-flow.md               |  4 ++--
 docs/architecture/media-library-cas-dedup.md  |  2 +-
 docs/architecture/shared/dependencies.md      |  4 ++--
 docs/compliance/agpl-source-offer.md          |  4 ++--
 docs/compliance/contributor-copyright-map.md  |  4 ++--
 docs/compliance/underage-account-procedure.md |  2 +-
 docs/getting-started.md                       |  2 +-
 docs/gradle-build-system.md                   |  2 +-
 docs/observability-contracts.md               |  2 +-
 docs/observability-usage.md                   |  2 +-
 docs/production-secrets.md                    |  2 +-
 docs/publishing-failure-modes.md              |  2 +-
 docs/release-verification.md                  |  2 +-
 docs/retention-framework-operations.md        |  4 ++--
 docs/retention-framework-quick-reference.md   |  4 ++--
 docs/runbooks/production-rollback.md          |  2 +-
 docs/technical-debt-remediation.md            |  2 +-
 30 files changed, 76 insertions(+), 48 deletions(-)

diff --git a/docs/README.md b/docs/README.md
index bd87bab64..4e2ccbae4 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,6 +1,6 @@
 # Profile Tailors Documentation
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 ## 📖 Table of Contents
 
diff --git a/docs/architecture/README.md b/docs/architecture/README.md
index 293e1807a..f42034f26 100644
--- a/docs/architecture/README.md
+++ b/docs/architecture/README.md
@@ -1,6 +1,6 @@
 # Profile Tailors — Architecture Documentation
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 This directory contains the architecture documentation for Profile Tailors, a social media
 management platform.
@@ -183,4 +183,4 @@ architecture at different levels of abstraction.
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/adr-discovery/candidate-decisions.md b/docs/architecture/adr-discovery/candidate-decisions.md
index 156b7ea28..ac7a0e094 100644
--- a/docs/architecture/adr-discovery/candidate-decisions.md
+++ b/docs/architecture/adr-discovery/candidate-decisions.md
@@ -14,7 +14,9 @@
 | CANDIDATE-010 | **Shared Kernel Strategy**          | Implemented   | High              | Yes                      | None                                  | Create ADR      |
 | CANDIDATE-011 | **Docker Swarm Deployment**         | Implemented   | High              | Yes                      | C4 referenced Kubernetes/Cloud Run    | Documented      |
 | CANDIDATE-012 | **In-Process Reactor Event Bus**    | Implemented   | High              | Yes                      | C4 referenced RabbitMQ/Kafka          | Documented      |
-| CANDIDATE-013 | **17 Backend Bounded Contexts**     | Implemented   | High              | Yes                      | C4 missing 11 contexts                | Documented      |
+| CANDIDATE-013 | **19 Backend Bounded Contexts**     | Implemented   | High              | Yes                      | C4 previously listed 17 or missing 11 | Documented      |
+| CANDIDATE-014 | **In-Monolith Task Scheduling**     | Implemented   | High              | Yes                      | C4 referenced separate Scheduler Svc  | Documented      |
+| CANDIDATE-015 | **Stateless Auth / Optional Redis** | Implemented   | High              | Yes                      | C4 referenced Redis session cache     | Documented      |
 
 ## Decision Groups
 
diff --git a/docs/architecture/adr-discovery/documentation-drift.md b/docs/architecture/adr-discovery/documentation-drift.md
index f87b3a990..2bdef737e 100644
--- a/docs/architecture/adr-discovery/documentation-drift.md
+++ b/docs/architecture/adr-discovery/documentation-drift.md
@@ -9,4 +9,6 @@
 | `server/smp/src/test/.../ModularityVerificationTest.kt` | Modulith enforces boundaries                       | Test is disabled due to violation: `authorization -> audit :: application` | CANDIDATE-001     | Resolve violation or update ADR to acknowledge permitted exceptions.           |
 | `docs/architecture/c4/02-container.md`                  | Container deployment via Kubernetes / Cloud Run    | Production deployment via Docker Swarm                                     | CANDIDATE-011     | ✅ Resolved (2026-08-14) — Updated deployment details to Docker Swarm.         |
 | `docs/architecture/c4/02-container.md`                  | Async messaging via RabbitMQ / Kafka               | Internal event publishing via Reactor Channels (`ReactorChannelEventPublisher`)| CANDIDATE-012 | ✅ Resolved (2026-08-14) — Updated messaging model to in-process channels.     |
-| `docs/architecture/c4/03-component.md`                  | Context list missing 11 bounded contexts           | 17 contexts in `server/smp` (Hashtags, Ideas, Privacy, Media, MCP, etc.)    | CANDIDATE-013     | ✅ Resolved (2026-08-14) — Documented all 17 bounded contexts.                 |
+| `docs/architecture/c4/03-component.md`                  | Context list missing bounded contexts              | 19 contexts in `server/smp` (Hashtags, Ideas, Privacy, Media, MCP, etc.)    | CANDIDATE-013     | ✅ Resolved (2026-09-14) — Documented all 19 bounded contexts.                 |
+| `docs/architecture/c4/02-container.md`                  | Scheduler Service / Analytics Service as separate  | In-monolith scheduling (`PublishingWorker`) and analytics context           | CANDIDATE-014     | ✅ Resolved (2026-09-14) — Clarified in-monolith context execution.            |
+| `docs/architecture/c4/02-container.md`                  | Redis for session data (TTL 15 min)                | Session auth is stateless signed JWT in HttpOnly cookie; Redis is rate-limit| CANDIDATE-015     | ✅ Resolved (2026-09-14) — Clarified stateless JWT cookie auth.                |
diff --git a/docs/architecture/adr-discovery/documentation-synchronization-plan.md b/docs/architecture/adr-discovery/documentation-synchronization-plan.md
index ffad96ecc..186cc81fa 100644
--- a/docs/architecture/adr-discovery/documentation-synchronization-plan.md
+++ b/docs/architecture/adr-discovery/documentation-synchronization-plan.md
@@ -12,8 +12,10 @@ the canonical architectural state.
 | `docs/architecture/c4/04-code.md`      | Identifier Strategy     | Update description to mention prefixed-UUIDs (`varchar(64)`).  | ADR-0005           | ✅ Applied (2026-08-14) |
 | `docs/architecture/README.md`          | Architecture Principles | Link to ADR-0001 (Modular Monolith) and ADR-0002 (Hexagonal).  | ADR-0001, ADR-0002 | ✅ Applied (2026-08-14) |
 | `docs/architecture/c4/02-container.md` | Deployment & Messaging  | Remove Kubernetes/Cloud Run & RabbitMQ/Kafka in favor of Swarm & Reactor channels. | CANDIDATE-011, CANDIDATE-012 | ✅ Applied (2026-08-14) |
-| `docs/architecture/c4/03-component.md` | Bounded Contexts        | Document all 19 bounded contexts in `server/smp/`.             | CANDIDATE-013      | ✅ Applied (2026-08-14) |
-| `docs/architecture/shared/dependencies.md`| Shared Kernel Modules| Document all 10 registered Gradle modules under `shared/`.     | ADR-0010           | ✅ Applied (2026-08-14) |
+| `docs/architecture/c4/03-component.md` | Bounded Contexts        | Document all 19 bounded contexts in `server/smp/`.             | CANDIDATE-013      | ✅ Applied (2026-09-14) |
+| `docs/architecture/c4/02-container.md` | In-Monolith Execution   | Clarify task scheduling and analytics run inside monolith.    | CANDIDATE-014      | ✅ Applied (2026-09-14) |
+| `docs/architecture/c4/02-container.md` | Auth Caching Clarification| Specify stateless JWT cookie auth vs optional rate-limit cache. | CANDIDATE-015      | ✅ Applied (2026-09-14) |
+| `docs/architecture/shared/dependencies.md`| Shared Kernel Modules| Document all 11 registered Gradle modules under `shared/`.     | ADR-0010           | ✅ Applied (2026-09-14) |
 | `.agents/AGENTS.md`                    | Backend Architecture    | Explicitly mention the custom `@Service` marker rule.          | ADR-0002           | ✅ Applied (2026-08-14) |
 
 ## Process
diff --git a/docs/architecture/adr-discovery/evidence-ledger.md b/docs/architecture/adr-discovery/evidence-ledger.md
index 234207cd5..6c3f2f09f 100644
--- a/docs/architecture/adr-discovery/evidence-ledger.md
+++ b/docs/architecture/adr-discovery/evidence-ledger.md
@@ -81,6 +81,28 @@ Yes.
 - **Verification Result**: VERIFIED (count corrected from 17 to 19). Config is infrastructure/cross-cutting configuration, not a separate bounded context in the DDD sense, but is organized as a module. Observability is retained among the contexts.
 - **Drift Action**: Updated C4 Component & Code documents to include all 19 contexts and corrected CANDIDATE-013 synchronization records.
 
+---
+
+## Finding: Task Scheduling & Analytics Execution Model
+
+- **Claim**: Task scheduling and analytics execute in-process within the `server:smp` modular monolith, rather than via separate external Scheduler or Analytics container services.
+- **Evidence**:
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/publishing/infrastructure/scheduling/PublishingWorker.kt:912`: In-process publishing scheduling via Spring `TaskScheduler`.
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/analytics/`: Analytics context module inside `server:smp`.
+- **Verification Result**: VERIFIED.
+- **Drift Action**: Updated C4 Container model to remove separate container claims for Scheduler Service and Analytics Service.
+
+---
+
+## Finding: Stateless Auth & Rate Limit Caching
+
+- **Claim**: Session management relies on stateless signed JWTs in HttpOnly cookies, while Redis/Caffeine is used solely for rate limiting in `shared:shield:ratelimit`, not for central session storage.
+- **Evidence**:
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/security/JwtPrincipalAuthenticationConverter.kt`: Stateless JWT authentication.
+  - `shared/shield/ratelimit/src/main/kotlin/com/profiletailors/shield/ratelimit/`: Bucket4j rate limiting with Caffeine/Redis store options.
+- **Verification Result**: VERIFIED.
+- **Drift Action**: Corrected C4 Container caching section to clarify stateless JWT cookies vs optional rate-limit caching.
+
 ### Open questions
 
 - What is the remediation plan for the current Modulith violation?
diff --git a/docs/architecture/c4/01-system-context.md b/docs/architecture/c4/01-system-context.md
index d93da775a..34c747e5d 100644
--- a/docs/architecture/c4/01-system-context.md
+++ b/docs/architecture/c4/01-system-context.md
@@ -1,6 +1,6 @@
 # Level 1: System Context Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 ## Overview
 
@@ -190,4 +190,4 @@ Profile Tailors enables teams to:
 - Team collaboration enhancements
 - Media asset management improvements
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/c4/02-container.md b/docs/architecture/c4/02-container.md
index f92726bc1..8be4a88f5 100644
--- a/docs/architecture/c4/02-container.md
+++ b/docs/architecture/c4/02-container.md
@@ -1,6 +1,6 @@
 # Level 2: Container Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 ## Overview
 
@@ -288,9 +288,8 @@ graph TB
 
 ### Horizontal Scaling
 
-- API Application: Stateless, can scale horizontally
-- Scheduler Service: Partitioned by workspace or time slot
-- Analytics Service: Partitioned by platform or metric type
+- API Application: Stateless, can scale horizontally; in-process workers (`PublishingWorker`) handle scheduled tasks within the modular monolith
+- Analytics Context: In-monolith analytics processing and metric aggregation
 
 ### Database Scaling
 
@@ -300,7 +299,8 @@ graph TB
 
 ### Caching Strategy
 
-- Redis for session data (TTL: 15 min)
+- Local Caffeine or optional Redis store for Bucket4j rate limiting (`shared:shield:ratelimit`)
+- Session management is stateless via signed HttpOnly JWT cookies
 - API response cache (TTL: 1-5 min)
 - OAuth token cache (TTL: token expiry - 5 min)
 
@@ -326,4 +326,4 @@ graph TB
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/c4/03-component.md b/docs/architecture/c4/03-component.md
index 50d587f7c..e2ea763cf 100644
--- a/docs/architecture/c4/03-component.md
+++ b/docs/architecture/c4/03-component.md
@@ -1,6 +1,6 @@
 # Level 3: Component Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 ## Overview
 
@@ -891,4 +891,4 @@ framework features, it belongs in `shared/spring-boot-common` instead.
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/c4/04-code.md b/docs/architecture/c4/04-code.md
index b691de155..1f579618b 100644
--- a/docs/architecture/c4/04-code.md
+++ b/docs/architecture/c4/04-code.md
@@ -1,6 +1,6 @@
 # Level 4: Code Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 ## Overview
 
@@ -164,4 +164,4 @@ com.profiletailors.smp
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/c4/README.md b/docs/architecture/c4/README.md
index 098df3d47..f35330030 100644
--- a/docs/architecture/c4/README.md
+++ b/docs/architecture/c4/README.md
@@ -1,6 +1,6 @@
 # Profile Tailors — C4 Architecture Models
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 This directory contains the C4 architecture models for Profile Tailors, a social media management
 platform.
@@ -55,4 +55,4 @@ Diagrams are written in:
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/c4/SUMMARY.md b/docs/architecture/c4/SUMMARY.md
index 6116680ae..aef24e993 100644
--- a/docs/architecture/c4/SUMMARY.md
+++ b/docs/architecture/c4/SUMMARY.md
@@ -5,7 +5,7 @@ status: 🔄 In Progress
 
 # Profile Tailors — C4 Architecture Summary
 
-**Last updated: 2026-09-12
+**Last updated: 2026-09-14
 
 ## Executive Summary
 
@@ -279,4 +279,4 @@ Managed & Local Storage
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/iam-platform.md b/docs/architecture/iam-platform.md
index 1db1e6a30..ad66c6ea7 100644
--- a/docs/architecture/iam-platform.md
+++ b/docs/architecture/iam-platform.md
@@ -1,6 +1,6 @@
 # IAM Platform Architecture
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 ## Overview
 
@@ -322,4 +322,4 @@ These capabilities are part of the durable platform model but explicitly deferre
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/login-flow.md b/docs/architecture/login-flow.md
index 57077b544..3852819f3 100644
--- a/docs/architecture/login-flow.md
+++ b/docs/architecture/login-flow.md
@@ -1,6 +1,6 @@
 # Login Flow Architecture & Sequence Diagrams
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 - **Status**: Active / Implemented
 - **Bounded Contexts**: `com.profiletailors.smp.identity`, `com.profiletailors.smp.credentials`
@@ -212,4 +212,4 @@ graph TD
 - **Stateless Verification**: API requests evaluate JWT access tokens statelessly without DB roundtrips on protected endpoints.
 - **Session Rotation**: Every refresh invocation revokes the prior refresh token and issues a new one, mitigating token replay attacks.
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14
diff --git a/docs/architecture/media-library-cas-dedup.md b/docs/architecture/media-library-cas-dedup.md
index 54defcaf4..b6a5befbe 100644
--- a/docs/architecture/media-library-cas-dedup.md
+++ b/docs/architecture/media-library-cas-dedup.md
@@ -1,7 +1,7 @@
 # Media Library — Content-Addressed Storage (CAS) Deduplication
 
 > **Status:** Implemented internal storage architecture
-> ****Last Updated:** 2026-09-12
+> **Last Updated:** 2026-09-14
 
 ## Overview
 
diff --git a/docs/architecture/shared/dependencies.md b/docs/architecture/shared/dependencies.md
index 866dfb598..45fc95ffc 100644
--- a/docs/architecture/shared/dependencies.md
+++ b/docs/architecture/shared/dependencies.md
@@ -1,9 +1,9 @@
 # Shared Module Dependencies
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 > Quick-reference dependency graph for the `shared/` Gradle modules in the Profile Tailors monorepo.
-> Last updated: 2026-09-12
+> Last updated: 2026-09-14
 
 ## Overview
 
diff --git a/docs/compliance/agpl-source-offer.md b/docs/compliance/agpl-source-offer.md
index c4909714b..103fc3d61 100644
--- a/docs/compliance/agpl-source-offer.md
+++ b/docs/compliance/agpl-source-offer.md
@@ -1,10 +1,10 @@
 # AGPL-3.0 Source-Offer Runbook
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 > **Classification:** Internal — Legal and Compliance
 > **Status:** Active
-> **Last updated: 2026-09-12
+> **Last updated: 2026-09-14
 
 ## Overview
 
diff --git a/docs/compliance/contributor-copyright-map.md b/docs/compliance/contributor-copyright-map.md
index d352c3756..2dc8e64e1 100644
--- a/docs/compliance/contributor-copyright-map.md
+++ b/docs/compliance/contributor-copyright-map.md
@@ -1,10 +1,10 @@
 # Contributor and Copyright Map
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 > **Classification:** Internal — Legal and Compliance
 > **Status:** Active
-> **Last updated: 2026-09-12
+> **Last updated: 2026-09-14
 
 ## Overview
 
diff --git a/docs/compliance/underage-account-procedure.md b/docs/compliance/underage-account-procedure.md
index 3025e9fb1..2d83df858 100644
--- a/docs/compliance/underage-account-procedure.md
+++ b/docs/compliance/underage-account-procedure.md
@@ -2,7 +2,7 @@
 
 > **Document ID:** COMP-007
 > **Version:** v1.0.0
-> ****Last Updated:** 2026-09-12
+> **Last Updated:** 2026-09-14
 > **Owner:** Legal & Compliance Team
 > **Review Cadence:** Annual
 
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 3edd215c9..dd0309fae 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,6 +1,6 @@
 # Getting Started — Local Development Environment
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** Active
 
 ## Overview
diff --git a/docs/gradle-build-system.md b/docs/gradle-build-system.md
index 9c583a185..26598fdff 100644
--- a/docs/gradle-build-system.md
+++ b/docs/gradle-build-system.md
@@ -1,6 +1,6 @@
 # Gradle Build System & Conventions
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** ✅ Implemented
 
 ---
diff --git a/docs/observability-contracts.md b/docs/observability-contracts.md
index 1d801b8e4..8af7051e9 100644
--- a/docs/observability-contracts.md
+++ b/docs/observability-contracts.md
@@ -1,6 +1,6 @@
 # Observability Contracts & SLA Matrix
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** Active
 **Scope:** System-wide Service Level Agreements (SLAs), Service Level Objectives (SLOs), Service Level Indicators (SLIs), and Observability Standards
 **Audience:** Platform Engineers, Backend Engineers, Operations, SRE
diff --git a/docs/observability-usage.md b/docs/observability-usage.md
index 1dac1351a..087902984 100644
--- a/docs/observability-usage.md
+++ b/docs/observability-usage.md
@@ -1,6 +1,6 @@
 # Shared Observability Usage Standard
 
-****Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-14
 **Status:** Active documentation standard  
 **Scope:** Kotlin shared modules and the SMP backend  
 **Audience:** Backend engineers, platform engineers, operations, SRE, and reviewers
diff --git a/docs/production-secrets.md b/docs/production-secrets.md
index 5b83f9653..b5e06c613 100644
--- a/docs/production-secrets.md
+++ b/docs/production-secrets.md
@@ -1,6 +1,6 @@
 # Production Secrets Reference
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** Active
 
 ## Overview
diff --git a/docs/publishing-failure-modes.md b/docs/publishing-failure-modes.md
index d53ad5a56..24795c873 100644
--- a/docs/publishing-failure-modes.md
+++ b/docs/publishing-failure-modes.md
@@ -1,6 +1,6 @@
 # Publishing Failure Modes
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** Active
 
 ## Overview
diff --git a/docs/release-verification.md b/docs/release-verification.md
index 32f7de974..720525d8f 100644
--- a/docs/release-verification.md
+++ b/docs/release-verification.md
@@ -1,6 +1,6 @@
 # Release Verification
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** Active
 
 ## Overview
diff --git a/docs/retention-framework-operations.md b/docs/retention-framework-operations.md
index da159809b..c17bef6cd 100644
--- a/docs/retention-framework-operations.md
+++ b/docs/retention-framework-operations.md
@@ -1,10 +1,10 @@
 # Data Retention Operations Guide (Current State)
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 > **Classification:** Internal — Operations and Compliance
 > **Status:** Current-state operations guide — the retention governance API is planned, not implemented
-> **Last updated: 2026-09-12
+> **Last updated: 2026-09-14
 >
 > **IMPORTANT:** Earlier drafts of this guide described a retention rule/purge/hold HTTP API
 > (`/api/governance/retention/*`) and a `V100__retention_governance.xml` migration. Neither
diff --git a/docs/retention-framework-quick-reference.md b/docs/retention-framework-quick-reference.md
index 32ace2e4a..efb798687 100644
--- a/docs/retention-framework-quick-reference.md
+++ b/docs/retention-framework-quick-reference.md
@@ -1,6 +1,6 @@
 # Data Retention — Quick Reference (Current State)
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 
 > **For:** On-call operators, compliance officers
 > **Updated:** 2026-08-02
@@ -55,6 +55,6 @@
 
 ---
 
-**Last updated: 2026-09-12
+**Last updated: 2026-09-14
 **Version:** 2.0 (corrected — v1.0 described a not-yet-implemented framework)
 **For questions:** [retention-and-erasure-control-plan.md](compliance/retention-and-erasure-control-plan.md)
diff --git a/docs/runbooks/production-rollback.md b/docs/runbooks/production-rollback.md
index a74780f3a..0f810948f 100644
--- a/docs/runbooks/production-rollback.md
+++ b/docs/runbooks/production-rollback.md
@@ -1,6 +1,6 @@
 # Production Rollback Runbook
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** Active
 **Scope:** Production Docker Swarm, Docker Compose, Database, and Worker Rollback
 **Audience:** Release Manager, On-Call Operator, SRE
diff --git a/docs/technical-debt-remediation.md b/docs/technical-debt-remediation.md
index 4e2ca40b2..30a4a278b 100644
--- a/docs/technical-debt-remediation.md
+++ b/docs/technical-debt-remediation.md
@@ -1,6 +1,6 @@
 # Technical Debt Remediation and Java 25
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-14
 **Status:** In progress; not a completion report
 
 ## Overview

From 765397723da3a0614fccafc1e3901f7ab5c56f1c Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 04:42:12 +0000
Subject: [PATCH 2/4] docs(architecture): clarify auth flow and bounded context
 count

---
 docs/architecture/README.md                   | 10 +++----
 .../adr-discovery/candidate-decisions.md      |  4 +--
 .../adr-discovery/documentation-drift.md      |  4 +--
 .../documentation-synchronization-plan.md     |  4 +--
 .../adr-discovery/evidence-ledger.md          | 27 ++++++++++---------
 docs/architecture/c4/02-container.md          | 15 +++++------
 docs/architecture/c4/03-component.md          |  4 +--
 docs/architecture/c4/04-code.md               |  4 +--
 docs/architecture/c4/README.md                |  4 ++-
 docs/architecture/c4/SUMMARY.md               | 10 +++----
 docs/compliance/agpl-source-offer.md          |  2 +-
 docs/compliance/contributor-copyright-map.md  |  2 +-
 docs/retention-framework-operations.md        |  2 +-
 docs/retention-framework-quick-reference.md   |  2 +-
 14 files changed, 49 insertions(+), 45 deletions(-)

diff --git a/docs/architecture/README.md b/docs/architecture/README.md
index f42034f26..04108aeec 100644
--- a/docs/architecture/README.md
+++ b/docs/architecture/README.md
@@ -46,8 +46,8 @@ architecture at different levels of abstraction.
 ┌─────────────────────────────────────────────────────────────┐
 │ Level 3: Component (API Application)                        │
 │ ┌─────────────────────────────────────────────────────┐   │
-│ │  19 Bounded Contexts: Identity, Authorization,      │   │
-│ │  Tenancy, Credentials, Publishing, Governance, etc. │   │
+│ │  18 Bounded Contexts + Config: Identity,            │   │
+│ │  Authorization, Tenancy, Publishing, etc.           │   │
 │ └─────────────────────────────────────────────────────┘   │
 └─────────────────────────────────────────────────────────────┘
                         ↓
@@ -72,9 +72,9 @@ architecture at different levels of abstraction.
 
 ### 2. Domain-Driven Design (DDD)
 
-- **Bounded Contexts**: 19 modular bounded contexts in `server/smp` (Analytics, Audit, Authorization,
-  Config, Credentials, Governance, Hashtags, Ideas, Identity, Lead Capture, MCP, Media,
-  Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy)
+- **Bounded Contexts**: 18 bounded contexts plus the Config module in `server/smp` (19 modules total):
+  Analytics, Audit, Authorization, Credentials, Governance, Hashtags, Ideas, Identity, Lead Capture,
+  MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy
 - **Shared Kernel**: Multiple module layers — see [full dependency graph](shared/dependencies.md)
   for all `api` and `implementation` relationships
 - **Foundation**: [`shared:common`](../../shared/common/) and [`shared:lead-capture:common`](../../shared/lead-capture/common/) — framework-agnostic domain
diff --git a/docs/architecture/adr-discovery/candidate-decisions.md b/docs/architecture/adr-discovery/candidate-decisions.md
index ac7a0e094..bdf916e49 100644
--- a/docs/architecture/adr-discovery/candidate-decisions.md
+++ b/docs/architecture/adr-discovery/candidate-decisions.md
@@ -10,11 +10,11 @@
 | CANDIDATE-006 | **Resource Creation via POST**      | Implemented   | High              | Likely (REST convention) | Documentation drift (target PUT)      | Create ADR      |
 | CANDIDATE-007 | **Astro & Vue Frontend Split**      | Implemented   | High              | Yes                      | Documentation drift (mentions React)  | Create ADR      |
 | CANDIDATE-008 | **Application-Level Multi-tenancy** | Implemented   | High              | Yes                      | None (RLS not used)                   | Create ADR      |
-| CANDIDATE-009 | **JWT + HttpOnly Cookie Auth**      | Implemented   | High              | Yes                      | None                                  | Create ADR      |
+| CANDIDATE-009 | **Bearer JWT + HttpOnly Refresh Cookie** | Implemented   | High              | Yes                      | None                                  | Create ADR      |
 | CANDIDATE-010 | **Shared Kernel Strategy**          | Implemented   | High              | Yes                      | None                                  | Create ADR      |
 | CANDIDATE-011 | **Docker Swarm Deployment**         | Implemented   | High              | Yes                      | C4 referenced Kubernetes/Cloud Run    | Documented      |
 | CANDIDATE-012 | **In-Process Reactor Event Bus**    | Implemented   | High              | Yes                      | C4 referenced RabbitMQ/Kafka          | Documented      |
-| CANDIDATE-013 | **19 Backend Bounded Contexts**     | Implemented   | High              | Yes                      | C4 previously listed 17 or missing 11 | Documented      |
+| CANDIDATE-013 | **18 Bounded Contexts + Config Module** | Implemented   | High              | Yes                      | C4 previously listed 17 or missing 11 | Documented      |
 | CANDIDATE-014 | **In-Monolith Task Scheduling**     | Implemented   | High              | Yes                      | C4 referenced separate Scheduler Svc  | Documented      |
 | CANDIDATE-015 | **Stateless Auth / Optional Redis** | Implemented   | High              | Yes                      | C4 referenced Redis session cache     | Documented      |
 
diff --git a/docs/architecture/adr-discovery/documentation-drift.md b/docs/architecture/adr-discovery/documentation-drift.md
index 2bdef737e..b470bb94c 100644
--- a/docs/architecture/adr-discovery/documentation-drift.md
+++ b/docs/architecture/adr-discovery/documentation-drift.md
@@ -9,6 +9,6 @@
 | `server/smp/src/test/.../ModularityVerificationTest.kt` | Modulith enforces boundaries                       | Test is disabled due to violation: `authorization -> audit :: application` | CANDIDATE-001     | Resolve violation or update ADR to acknowledge permitted exceptions.           |
 | `docs/architecture/c4/02-container.md`                  | Container deployment via Kubernetes / Cloud Run    | Production deployment via Docker Swarm                                     | CANDIDATE-011     | ✅ Resolved (2026-08-14) — Updated deployment details to Docker Swarm.         |
 | `docs/architecture/c4/02-container.md`                  | Async messaging via RabbitMQ / Kafka               | Internal event publishing via Reactor Channels (`ReactorChannelEventPublisher`)| CANDIDATE-012 | ✅ Resolved (2026-08-14) — Updated messaging model to in-process channels.     |
-| `docs/architecture/c4/03-component.md`                  | Context list missing bounded contexts              | 19 contexts in `server/smp` (Hashtags, Ideas, Privacy, Media, MCP, etc.)    | CANDIDATE-013     | ✅ Resolved (2026-09-14) — Documented all 19 bounded contexts.                 |
+| `docs/architecture/c4/03-component.md`                  | Context list missing bounded contexts              | 18 bounded contexts plus the Config module in `server/smp` (19 modules total) | CANDIDATE-013   | ✅ Resolved (2026-09-14) — Documented all 18 bounded contexts plus Config.     |
 | `docs/architecture/c4/02-container.md`                  | Scheduler Service / Analytics Service as separate  | In-monolith scheduling (`PublishingWorker`) and analytics context           | CANDIDATE-014     | ✅ Resolved (2026-09-14) — Clarified in-monolith context execution.            |
-| `docs/architecture/c4/02-container.md`                  | Redis for session data (TTL 15 min)                | Session auth is stateless signed JWT in HttpOnly cookie; Redis is rate-limit| CANDIDATE-015     | ✅ Resolved (2026-09-14) — Clarified stateless JWT cookie auth.                |
+| `docs/architecture/c4/02-container.md`                  | Redis for session data (TTL 15 min)                | Access JWT is sent as a Bearer token; only the refresh token is in the HttpOnly cookie | CANDIDATE-015 | ✅ Resolved (2026-09-14) — Clarified stateless access-token validation and refresh-cookie storage. |
diff --git a/docs/architecture/adr-discovery/documentation-synchronization-plan.md b/docs/architecture/adr-discovery/documentation-synchronization-plan.md
index 186cc81fa..7edcd8773 100644
--- a/docs/architecture/adr-discovery/documentation-synchronization-plan.md
+++ b/docs/architecture/adr-discovery/documentation-synchronization-plan.md
@@ -12,9 +12,9 @@ the canonical architectural state.
 | `docs/architecture/c4/04-code.md`      | Identifier Strategy     | Update description to mention prefixed-UUIDs (`varchar(64)`).  | ADR-0005           | ✅ Applied (2026-08-14) |
 | `docs/architecture/README.md`          | Architecture Principles | Link to ADR-0001 (Modular Monolith) and ADR-0002 (Hexagonal).  | ADR-0001, ADR-0002 | ✅ Applied (2026-08-14) |
 | `docs/architecture/c4/02-container.md` | Deployment & Messaging  | Remove Kubernetes/Cloud Run & RabbitMQ/Kafka in favor of Swarm & Reactor channels. | CANDIDATE-011, CANDIDATE-012 | ✅ Applied (2026-08-14) |
-| `docs/architecture/c4/03-component.md` | Bounded Contexts        | Document all 19 bounded contexts in `server/smp/`.             | CANDIDATE-013      | ✅ Applied (2026-09-14) |
+| `docs/architecture/c4/03-component.md` | Bounded Contexts        | Document all 18 bounded contexts plus the Config module in `server/smp/` (19 modules total). | CANDIDATE-013 | ✅ Applied (2026-09-14) |
 | `docs/architecture/c4/02-container.md` | In-Monolith Execution   | Clarify task scheduling and analytics run inside monolith.    | CANDIDATE-014      | ✅ Applied (2026-09-14) |
-| `docs/architecture/c4/02-container.md` | Auth Caching Clarification| Specify stateless JWT cookie auth vs optional rate-limit cache. | CANDIDATE-015      | ✅ Applied (2026-09-14) |
+| `docs/architecture/c4/02-container.md` | Auth Caching Clarification| Specify Bearer access-token auth, an HttpOnly refresh-token cookie, and optional rate-limit caching. | CANDIDATE-015 | ✅ Applied (2026-09-14) |
 | `docs/architecture/shared/dependencies.md`| Shared Kernel Modules| Document all 11 registered Gradle modules under `shared/`.     | ADR-0010           | ✅ Applied (2026-09-14) |
 | `.agents/AGENTS.md`                    | Backend Architecture    | Explicitly mention the custom `@Service` marker rule.          | ADR-0002           | ✅ Applied (2026-08-14) |
 
diff --git a/docs/architecture/adr-discovery/evidence-ledger.md b/docs/architecture/adr-discovery/evidence-ledger.md
index 6c3f2f09f..3ad6f1988 100644
--- a/docs/architecture/adr-discovery/evidence-ledger.md
+++ b/docs/architecture/adr-discovery/evidence-ledger.md
@@ -73,13 +73,13 @@ Yes.
 
 ---
 
-## Finding: 19 Backend Bounded Contexts
+## Finding: 18 Backend Bounded Contexts plus Config
 
-- **Claim**: Backend `server:smp` comprises 19 bounded contexts following hexagonal architecture.
+- **Claim**: Backend `server:smp` comprises 18 bounded contexts following hexagonal architecture plus the cross-cutting Config module (19 modules total).
 - **Evidence**:
   - `server/smp/src/main/kotlin/com/profiletailors/smp/`: Directory structure containing `analytics`, `audit`, `authorization`, `config`, `credentials`, `governance`, `hashtags`, `ideas`, `identity`, `leadcapture`, `mcp`, `media`, `notifications`, `observability`, `platform`, `platformadmin`, `privacy`, `publishing`, `tenancy`.
-- **Verification Result**: VERIFIED (count corrected from 17 to 19). Config is infrastructure/cross-cutting configuration, not a separate bounded context in the DDD sense, but is organized as a module. Observability is retained among the contexts.
-- **Drift Action**: Updated C4 Component & Code documents to include all 19 contexts and corrected CANDIDATE-013 synchronization records.
+- **Verification Result**: VERIFIED (count corrected from 17 to 18 bounded contexts plus Config). Config is infrastructure/cross-cutting configuration, not a separate bounded context in the DDD sense, but is organized as a module. Observability is retained among the contexts.
+- **Drift Action**: Updated C4 Component & Code documents to include all 18 bounded contexts plus the Config module and corrected CANDIDATE-013 synchronization records.
 
 ---
 
@@ -94,14 +94,16 @@ Yes.
 
 ---
 
-## Finding: Stateless Auth & Rate Limit Caching
+## Finding: Stateless Access-Token Auth & Rate Limit Caching
 
-- **Claim**: Session management relies on stateless signed JWTs in HttpOnly cookies, while Redis/Caffeine is used solely for rate limiting in `shared:shield:ratelimit`, not for central session storage.
+- **Claim**: The SPA keeps the short-lived JWT access token in memory and sends it in the `Authorization: Bearer` header. The refresh token alone is stored in an HttpOnly cookie. Caffeine/Redis caching is reserved for rate limiting in `shared:shield:ratelimit`, not central session storage.
 - **Evidence**:
-  - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/security/JwtPrincipalAuthenticationConverter.kt`: Stateless JWT authentication.
+  - `apps/web/app/src/modules/auth/infrastructure/auth.store.ts` and `auth-api.ts`: Keep the access token in memory and add it to the `Authorization: Bearer` header.
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/http/LocalAuthController.kt`: Returns the access token in `AuthTokens` and stores only `result.refreshToken` in the HttpOnly cookie.
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/security/JwtPrincipalAuthenticationConverter.kt`: Stateless access-token validation.
   - `shared/shield/ratelimit/src/main/kotlin/com/profiletailors/shield/ratelimit/`: Bucket4j rate limiting with Caffeine/Redis store options.
 - **Verification Result**: VERIFIED.
-- **Drift Action**: Corrected C4 Container caching section to clarify stateless JWT cookies vs optional rate-limit caching.
+- **Drift Action**: Corrected the C4 Container caching section to distinguish Bearer access-token authentication, the HttpOnly refresh-token cookie, and optional rate-limit caching.
 
 ### Open questions
 
@@ -425,7 +427,7 @@ Yes.
 
 ---
 
-## Finding: Authentication Flow (JWT + HttpOnly Cookie)
+## Finding: Authentication Flow (Bearer JWT + HttpOnly Refresh Cookie)
 
 ### Observed implementation
 
@@ -434,9 +436,10 @@ cookie. Access token lives only in memory on the frontend.
 
 ### Evidence
 
-- `LocalAuthHandlers.kt`: `issueAuthSession` creates tokens.
-- `auth-api.ts`: `requestRaw` includes `credentials: 'include'`.
-- `auth.ts` (Vue store): "Access token lives ONLY in memory".
+- `LocalAuthHandlers.kt`: `issueAuthSession` creates the access and refresh tokens.
+- `LocalAuthController.kt`: returns `AuthTokens` and stores only `result.refreshToken` in the HttpOnly cookie.
+- `auth-api.ts`: `requestRaw` sends the in-memory access token in the `Authorization: Bearer` header and includes the refresh cookie via `credentials: 'include'`.
+- `auth.store.ts` (Vue store): "Access token lives ONLY in memory".
 
 ### Documented intention
 
diff --git a/docs/architecture/c4/02-container.md b/docs/architecture/c4/02-container.md
index 8be4a88f5..67ae5d050 100644
--- a/docs/architecture/c4/02-container.md
+++ b/docs/architecture/c4/02-container.md
@@ -30,7 +30,7 @@ System_Boundary(profile_tailors, "Profile Tailors") {
     
     Container(spa, "Web Application", "Vue 3, TypeScript", "Single-page application for content management, scheduling, and analytics")
     
-    Container(api, "API Application", "Spring Boot 4, Kotlin, WebFlux", "Reactive REST API with 19 bounded contexts including Identity, Tenancy, Publishing, Media, Privacy, etc.")
+    Container(api, "API Application", "Spring Boot 4, Kotlin, WebFlux", "Reactive REST API with 18 bounded contexts plus the Config module (19 modules total), including Identity, Tenancy, Publishing, Media, and Privacy.")
     
     ContainerDb(db, "Database", "PostgreSQL 18", "Stores user data, workspaces, posts, schedules, credentials, and audit logs. R2DBC for reactive access.")
     
@@ -131,10 +131,11 @@ graph TB
 - **Composition**: Shared modules (`shared:common`, `shared:bus`, `shared:spring-boot-common`,
   `shared:security`, `shared:presentation`, `shared:storage`, `shared:shield:ratelimit`,
   `shared:lead-capture:*`) and `server:smp` (application assembly).
-- **Bounded Contexts**: Analytics, Audit, Authorization, Config, Credentials, Governance, Hashtags,
+- **Bounded Contexts**: Analytics, Audit, Authorization, Credentials, Governance, Hashtags,
   Ideas, Identity, Leadcapture, MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy,
   Publishing, Tenancy.
-- **Key Features**: Reactive programming with Kotlin coroutines, native JWT/cookie authentication,
+- **Cross-Cutting Module**: Config.
+- **Key Features**: Reactive programming with Kotlin coroutines, Bearer JWT access-token authentication with an HttpOnly refresh-token cookie,
   non-blocking R2DBC access, internal in-process event publishing via Reactor (`ChannelEventPublisher`),
   Spring Modulith modular monolith.
 
@@ -153,8 +154,8 @@ graph TB
 
 - **Technology**: Caffeine local in-memory cache, optional Redis via `shared:shield:ratelimit`
 - **Deployment**: Embedded JVM in-memory / optional container
-- **Purpose**: Rate limiting (Bucket4j) and ephemeral caching.
-- **Use Cases**: Rate limiting for public and waitlist endpoints (defaults to Caffeine). Session management relies on stateless signed JWT cookies rather than central session cache storage.
+- **Purpose**: Rate-limit state storage for Bucket4j.
+- **Use Cases**: Rate limiting for public and waitlist endpoints (defaults to Caffeine). The JWT access token is validated statelessly from the `Authorization: Bearer` header, while only the refresh token is stored in an HttpOnly cookie.
 
 #### Event Bus (In-Process Event Dispatch)
 
@@ -300,9 +301,7 @@ graph TB
 ### Caching Strategy
 
 - Local Caffeine or optional Redis store for Bucket4j rate limiting (`shared:shield:ratelimit`)
-- Session management is stateless via signed HttpOnly JWT cookies
-- API response cache (TTL: 1-5 min)
-- OAuth token cache (TTL: token expiry - 5 min)
+- The SPA keeps the short-lived JWT access token in memory and sends it in the `Authorization: Bearer` header; only the refresh token is stored in an HttpOnly cookie
 
 ---
 
diff --git a/docs/architecture/c4/03-component.md b/docs/architecture/c4/03-component.md
index e2ea763cf..381d26fdc 100644
--- a/docs/architecture/c4/03-component.md
+++ b/docs/architecture/c4/03-component.md
@@ -867,12 +867,12 @@ framework features, it belongs in `shared/spring-boot-common` instead.
 
 ## Current Implementation Status
 
-**Implemented Contexts** (19 total):
+**Implemented Modules** (18 bounded contexts plus Config; 19 total):
 
 - ✅ Analytics Context (engagement metrics & reporting)
 - ✅ Audit Context (request outcomes, authorization decisions, mutations)
 - ✅ Authorization Context (RBAC, direct grants, workspace permissions)
-- ✅ Config Context (system & application configuration)
+- ✅ Config Module (system & application configuration)
 - ✅ Credentials Context (API keys, token validation, secret management)
 - ✅ Governance Context (audit logging, mutation tracking, compliance)
 - ✅ Hashtags Context (hashtag group management & tracking)
diff --git a/docs/architecture/c4/04-code.md b/docs/architecture/c4/04-code.md
index 1f579618b..95c6a18d7 100644
--- a/docs/architecture/c4/04-code.md
+++ b/docs/architecture/c4/04-code.md
@@ -130,12 +130,12 @@ com.profiletailors.smp
 
 ## Current Implementation Status
 
-**Implemented Bounded Contexts** (19 total):
+**Implemented Modules** (18 bounded contexts plus Config; 19 total):
 
 - ✅ Analytics Context (engagement metrics & reporting)
 - ✅ Audit Context (request outcomes, authorization decisions, mutations)
 - ✅ Authorization Context (permission checking, RBAC, direct grants)
-- ✅ Config Context (application & system configuration)
+- ✅ Config Module (application & system configuration)
 - ✅ Credentials Context (API key validation, secret management)
 - ✅ Governance Context (audit logging, compliance)
 - ✅ Hashtags Context (hashtag group management & tracking)
diff --git a/docs/architecture/c4/README.md b/docs/architecture/c4/README.md
index f35330030..92902c61b 100644
--- a/docs/architecture/c4/README.md
+++ b/docs/architecture/c4/README.md
@@ -51,7 +51,9 @@ Diagrams are written in:
 - Marketing site (Astro 7, bilingual static site)
 - Web Application Dashboard (Vue 3, Pinia, TypeScript)
 - Backend Modular Monolith (Spring Boot 4, Kotlin, WebFlux, R2DBC)
-- 19 Bounded Contexts: Analytics, Audit, Authorization, Config, Credentials, Governance, Hashtags, Ideas, Identity, Leadcapture, MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy
+- 18 bounded contexts plus the Config module (19 modules total): Analytics, Audit, Authorization,
+  Credentials, Governance, Hashtags, Ideas, Identity, Leadcapture, MCP, Media, Notifications,
+  Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy; plus Config
 
 ---
 
diff --git a/docs/architecture/c4/SUMMARY.md b/docs/architecture/c4/SUMMARY.md
index aef24e993..28b6fa79f 100644
--- a/docs/architecture/c4/SUMMARY.md
+++ b/docs/architecture/c4/SUMMARY.md
@@ -5,7 +5,7 @@ status: 🔄 In Progress
 
 # Profile Tailors — C4 Architecture Summary
 
-**Last updated: 2026-09-14
+**Last updated:** 2026-09-14
 
 ## Executive Summary
 
@@ -66,19 +66,19 @@ framework-agnostic domain primitives and shared infrastructure:
 
 ---
 
-## Bounded Contexts (19 Bounded Contexts)
+## Backend Modules (18 Bounded Contexts + Config)
 
-The backend `server:smp` comprises 19 modular bounded contexts:
+The backend `server:smp` comprises 18 bounded contexts plus the cross-cutting Config module (19 modules total):
 
 1. **Analytics Context**: Engagement metrics collection, aggregation, and reporting.
 2. **Audit Context**: Request outcomes, authorization decision auditing, and mutation event capture.
 3. **Authorization Context**: RBAC, direct permission grants, workspace permissions, and entitlements.
-4. **Config Context**: Dynamic platform and system configuration.
+4. **Config Module**: Dynamic platform and system configuration.
 5. **Credentials Context**: API keys, OAuth tokens, and credential encryption (`PublishingCredentialsProperties`).
 6. **Governance Context**: Mutation audit logging, policy enforcement, and compliance tracking.
 7. **Hashtags Context**: Hashtag group management, aggregation, and performance tracking.
 8. **Ideas Context**: Content brainstorming and draft idea management.
-9. **Identity Context**: Native JWT and HttpOnly cookie authentication, principal management.
+9. **Identity Context**: Bearer JWT access-token and HttpOnly refresh-cookie authentication, principal management.
 10. **Lead Capture Context**: Public waitlist joins, lead capture storage, and consent collection.
 11. **MCP Context**: Model Context Protocol integration for platform AI tooling.
 12. **Media Context**: Media asset storage, Content-Addressable Storage (CAS) deduplication.
diff --git a/docs/compliance/agpl-source-offer.md b/docs/compliance/agpl-source-offer.md
index 103fc3d61..05536f900 100644
--- a/docs/compliance/agpl-source-offer.md
+++ b/docs/compliance/agpl-source-offer.md
@@ -4,7 +4,7 @@
 
 > **Classification:** Internal — Legal and Compliance
 > **Status:** Active
-> **Last updated: 2026-09-14
+> **Last updated:** 2026-09-14
 
 ## Overview
 
diff --git a/docs/compliance/contributor-copyright-map.md b/docs/compliance/contributor-copyright-map.md
index 2dc8e64e1..a5a705405 100644
--- a/docs/compliance/contributor-copyright-map.md
+++ b/docs/compliance/contributor-copyright-map.md
@@ -4,7 +4,7 @@
 
 > **Classification:** Internal — Legal and Compliance
 > **Status:** Active
-> **Last updated: 2026-09-14
+> **Last updated:** 2026-09-14
 
 ## Overview
 
diff --git a/docs/retention-framework-operations.md b/docs/retention-framework-operations.md
index c17bef6cd..0311a31bb 100644
--- a/docs/retention-framework-operations.md
+++ b/docs/retention-framework-operations.md
@@ -4,7 +4,7 @@
 
 > **Classification:** Internal — Operations and Compliance
 > **Status:** Current-state operations guide — the retention governance API is planned, not implemented
-> **Last updated: 2026-09-14
+> **Last updated:** 2026-09-14
 >
 > **IMPORTANT:** Earlier drafts of this guide described a retention rule/purge/hold HTTP API
 > (`/api/governance/retention/*`) and a `V100__retention_governance.xml` migration. Neither
diff --git a/docs/retention-framework-quick-reference.md b/docs/retention-framework-quick-reference.md
index efb798687..e1cf4f7aa 100644
--- a/docs/retention-framework-quick-reference.md
+++ b/docs/retention-framework-quick-reference.md
@@ -55,6 +55,6 @@
 
 ---
 
-**Last updated: 2026-09-14
+**Last updated:** 2026-09-14
 **Version:** 2.0 (corrected — v1.0 described a not-yet-implemented framework)
 **For questions:** [retention-and-erasure-control-plan.md](compliance/retention-and-erasure-control-plan.md)

From 010db4ef1803f03d9956bb804a9b274bfcf045ae Mon Sep 17 00:00:00 2001
From: yacosta738 <33158051+yacosta738@users.noreply.github.com>
Date: Tue, 15 Sep 2026 06:39:48 +0200
Subject: [PATCH 3/4] docs(architecture): update Last Updated date in
 publishing-failure-modes

---
 docs/publishing-failure-modes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/publishing-failure-modes.md b/docs/publishing-failure-modes.md
index 24795c873..b61706497 100644
--- a/docs/publishing-failure-modes.md
+++ b/docs/publishing-failure-modes.md
@@ -1,6 +1,6 @@
 # Publishing Failure Modes
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** Active
 
 ## Overview

From 9d042f90c702496c6003a757522a314fa49b9882 Mon Sep 17 00:00:00 2001
From: yacosta738 <33158051+yacosta738@users.noreply.github.com>
Date: Tue, 15 Sep 2026 07:07:28 +0200
Subject: [PATCH 4/4] docs(architecture): sync Last Updated headers with latest
 doc commits

---
 docs/README.md                                | 2 +-
 docs/architecture/README.md                   | 2 +-
 docs/architecture/c4/01-system-context.md     | 2 +-
 docs/architecture/c4/02-container.md          | 2 +-
 docs/architecture/c4/03-component.md          | 2 +-
 docs/architecture/c4/04-code.md               | 2 +-
 docs/architecture/c4/README.md                | 2 +-
 docs/architecture/c4/SUMMARY.md               | 2 +-
 docs/architecture/iam-platform.md             | 2 +-
 docs/architecture/login-flow.md               | 2 +-
 docs/architecture/media-library-cas-dedup.md  | 2 +-
 docs/architecture/shared/dependencies.md      | 2 +-
 docs/compliance/agpl-source-offer.md          | 2 +-
 docs/compliance/contributor-copyright-map.md  | 2 +-
 docs/compliance/underage-account-procedure.md | 2 +-
 docs/getting-started.md                       | 2 +-
 docs/gradle-build-system.md                   | 2 +-
 docs/observability-contracts.md               | 2 +-
 docs/observability-usage.md                   | 2 +-
 docs/production-secrets.md                    | 2 +-
 docs/release-verification.md                  | 2 +-
 docs/retention-framework-operations.md        | 2 +-
 docs/retention-framework-quick-reference.md   | 2 +-
 docs/runbooks/production-rollback.md          | 2 +-
 docs/technical-debt-remediation.md            | 2 +-
 25 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/docs/README.md b/docs/README.md
index 4e2ccbae4..d4a832748 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,6 +1,6 @@
 # Profile Tailors Documentation
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 ## 📖 Table of Contents
 
diff --git a/docs/architecture/README.md b/docs/architecture/README.md
index 04108aeec..06df22d2f 100644
--- a/docs/architecture/README.md
+++ b/docs/architecture/README.md
@@ -1,6 +1,6 @@
 # Profile Tailors — Architecture Documentation
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 This directory contains the architecture documentation for Profile Tailors, a social media
 management platform.
diff --git a/docs/architecture/c4/01-system-context.md b/docs/architecture/c4/01-system-context.md
index 34c747e5d..7725993de 100644
--- a/docs/architecture/c4/01-system-context.md
+++ b/docs/architecture/c4/01-system-context.md
@@ -1,6 +1,6 @@
 # Level 1: System Context Diagram
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 ## Overview
 
diff --git a/docs/architecture/c4/02-container.md b/docs/architecture/c4/02-container.md
index 67ae5d050..fa94fdc52 100644
--- a/docs/architecture/c4/02-container.md
+++ b/docs/architecture/c4/02-container.md
@@ -1,6 +1,6 @@
 # Level 2: Container Diagram
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 ## Overview
 
diff --git a/docs/architecture/c4/03-component.md b/docs/architecture/c4/03-component.md
index 381d26fdc..1b074c414 100644
--- a/docs/architecture/c4/03-component.md
+++ b/docs/architecture/c4/03-component.md
@@ -1,6 +1,6 @@
 # Level 3: Component Diagram
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 ## Overview
 
diff --git a/docs/architecture/c4/04-code.md b/docs/architecture/c4/04-code.md
index 95c6a18d7..6486e4810 100644
--- a/docs/architecture/c4/04-code.md
+++ b/docs/architecture/c4/04-code.md
@@ -1,6 +1,6 @@
 # Level 4: Code Diagram
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 ## Overview
 
diff --git a/docs/architecture/c4/README.md b/docs/architecture/c4/README.md
index 92902c61b..9dd4aa092 100644
--- a/docs/architecture/c4/README.md
+++ b/docs/architecture/c4/README.md
@@ -1,6 +1,6 @@
 # Profile Tailors — C4 Architecture Models
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 This directory contains the C4 architecture models for Profile Tailors, a social media management
 platform.
diff --git a/docs/architecture/c4/SUMMARY.md b/docs/architecture/c4/SUMMARY.md
index 28b6fa79f..2629a31dc 100644
--- a/docs/architecture/c4/SUMMARY.md
+++ b/docs/architecture/c4/SUMMARY.md
@@ -5,7 +5,7 @@ status: 🔄 In Progress
 
 # Profile Tailors — C4 Architecture Summary
 
-**Last updated:** 2026-09-14
+**Last updated:** 2026-09-15
 
 ## Executive Summary
 
diff --git a/docs/architecture/iam-platform.md b/docs/architecture/iam-platform.md
index ad66c6ea7..fb0a6dc0a 100644
--- a/docs/architecture/iam-platform.md
+++ b/docs/architecture/iam-platform.md
@@ -1,6 +1,6 @@
 # IAM Platform Architecture
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 ## Overview
 
diff --git a/docs/architecture/login-flow.md b/docs/architecture/login-flow.md
index 3852819f3..466987ee2 100644
--- a/docs/architecture/login-flow.md
+++ b/docs/architecture/login-flow.md
@@ -1,6 +1,6 @@
 # Login Flow Architecture & Sequence Diagrams
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 - **Status**: Active / Implemented
 - **Bounded Contexts**: `com.profiletailors.smp.identity`, `com.profiletailors.smp.credentials`
diff --git a/docs/architecture/media-library-cas-dedup.md b/docs/architecture/media-library-cas-dedup.md
index b6a5befbe..9aa59daaa 100644
--- a/docs/architecture/media-library-cas-dedup.md
+++ b/docs/architecture/media-library-cas-dedup.md
@@ -1,7 +1,7 @@
 # Media Library — Content-Addressed Storage (CAS) Deduplication
 
 > **Status:** Implemented internal storage architecture
-> **Last Updated:** 2026-09-14
+> **Last Updated:** 2026-09-15
 
 ## Overview
 
diff --git a/docs/architecture/shared/dependencies.md b/docs/architecture/shared/dependencies.md
index 45fc95ffc..9f55194c5 100644
--- a/docs/architecture/shared/dependencies.md
+++ b/docs/architecture/shared/dependencies.md
@@ -1,6 +1,6 @@
 # Shared Module Dependencies
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 > Quick-reference dependency graph for the `shared/` Gradle modules in the Profile Tailors monorepo.
 > Last updated: 2026-09-14
diff --git a/docs/compliance/agpl-source-offer.md b/docs/compliance/agpl-source-offer.md
index 05536f900..d88947213 100644
--- a/docs/compliance/agpl-source-offer.md
+++ b/docs/compliance/agpl-source-offer.md
@@ -1,6 +1,6 @@
 # AGPL-3.0 Source-Offer Runbook
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 > **Classification:** Internal — Legal and Compliance
 > **Status:** Active
diff --git a/docs/compliance/contributor-copyright-map.md b/docs/compliance/contributor-copyright-map.md
index a5a705405..f310973bd 100644
--- a/docs/compliance/contributor-copyright-map.md
+++ b/docs/compliance/contributor-copyright-map.md
@@ -1,6 +1,6 @@
 # Contributor and Copyright Map
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 > **Classification:** Internal — Legal and Compliance
 > **Status:** Active
diff --git a/docs/compliance/underage-account-procedure.md b/docs/compliance/underage-account-procedure.md
index 2d83df858..dc8108845 100644
--- a/docs/compliance/underage-account-procedure.md
+++ b/docs/compliance/underage-account-procedure.md
@@ -2,7 +2,7 @@
 
 > **Document ID:** COMP-007
 > **Version:** v1.0.0
-> **Last Updated:** 2026-09-14
+> **Last Updated:** 2026-09-15
 > **Owner:** Legal & Compliance Team
 > **Review Cadence:** Annual
 
diff --git a/docs/getting-started.md b/docs/getting-started.md
index dd0309fae..67847b40f 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,6 +1,6 @@
 # Getting Started — Local Development Environment
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** Active
 
 ## Overview
diff --git a/docs/gradle-build-system.md b/docs/gradle-build-system.md
index 26598fdff..9c5ccaae4 100644
--- a/docs/gradle-build-system.md
+++ b/docs/gradle-build-system.md
@@ -1,6 +1,6 @@
 # Gradle Build System & Conventions
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** ✅ Implemented
 
 ---
diff --git a/docs/observability-contracts.md b/docs/observability-contracts.md
index 8af7051e9..de7cbb2e7 100644
--- a/docs/observability-contracts.md
+++ b/docs/observability-contracts.md
@@ -1,6 +1,6 @@
 # Observability Contracts & SLA Matrix
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** Active
 **Scope:** System-wide Service Level Agreements (SLAs), Service Level Objectives (SLOs), Service Level Indicators (SLIs), and Observability Standards
 **Audience:** Platform Engineers, Backend Engineers, Operations, SRE
diff --git a/docs/observability-usage.md b/docs/observability-usage.md
index 087902984..53ca52d26 100644
--- a/docs/observability-usage.md
+++ b/docs/observability-usage.md
@@ -1,6 +1,6 @@
 # Shared Observability Usage Standard
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** Active documentation standard  
 **Scope:** Kotlin shared modules and the SMP backend  
 **Audience:** Backend engineers, platform engineers, operations, SRE, and reviewers
diff --git a/docs/production-secrets.md b/docs/production-secrets.md
index b5e06c613..b1b343fd5 100644
--- a/docs/production-secrets.md
+++ b/docs/production-secrets.md
@@ -1,6 +1,6 @@
 # Production Secrets Reference
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** Active
 
 ## Overview
diff --git a/docs/release-verification.md b/docs/release-verification.md
index 720525d8f..e37b618eb 100644
--- a/docs/release-verification.md
+++ b/docs/release-verification.md
@@ -1,6 +1,6 @@
 # Release Verification
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** Active
 
 ## Overview
diff --git a/docs/retention-framework-operations.md b/docs/retention-framework-operations.md
index 0311a31bb..376e5b4b4 100644
--- a/docs/retention-framework-operations.md
+++ b/docs/retention-framework-operations.md
@@ -1,6 +1,6 @@
 # Data Retention Operations Guide (Current State)
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 > **Classification:** Internal — Operations and Compliance
 > **Status:** Current-state operations guide — the retention governance API is planned, not implemented
diff --git a/docs/retention-framework-quick-reference.md b/docs/retention-framework-quick-reference.md
index e1cf4f7aa..2704cee53 100644
--- a/docs/retention-framework-quick-reference.md
+++ b/docs/retention-framework-quick-reference.md
@@ -1,6 +1,6 @@
 # Data Retention — Quick Reference (Current State)
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 
 > **For:** On-call operators, compliance officers
 > **Updated:** 2026-08-02
diff --git a/docs/runbooks/production-rollback.md b/docs/runbooks/production-rollback.md
index 0f810948f..cee3a634e 100644
--- a/docs/runbooks/production-rollback.md
+++ b/docs/runbooks/production-rollback.md
@@ -1,6 +1,6 @@
 # Production Rollback Runbook
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** Active
 **Scope:** Production Docker Swarm, Docker Compose, Database, and Worker Rollback
 **Audience:** Release Manager, On-Call Operator, SRE
diff --git a/docs/technical-debt-remediation.md b/docs/technical-debt-remediation.md
index 30a4a278b..f0af8b1bd 100644
--- a/docs/technical-debt-remediation.md
+++ b/docs/technical-debt-remediation.md
@@ -1,6 +1,6 @@
 # Technical Debt Remediation and Java 25
 
-**Last Updated:** 2026-09-14
+**Last Updated:** 2026-09-15
 **Status:** In progress; not a completion report
 
 ## Overview