diff --git a/assets/orchestration-flow-list.png b/assets/orchestration-flow-list.png
index d209b54..91ef1d5 100644
Binary files a/assets/orchestration-flow-list.png and b/assets/orchestration-flow-list.png differ
diff --git a/assets/orchestration-flow-patterns.svg b/assets/orchestration-flow-patterns.svg
index 45d4333..e3046d5 100644
--- a/assets/orchestration-flow-patterns.svg
+++ b/assets/orchestration-flow-patterns.svg
@@ -1,4 +1,4 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/docs/orchestration.md b/docs/orchestration.md
index 6c928fc..7c71199 100644
--- a/docs/orchestration.md
+++ b/docs/orchestration.md
@@ -1,12 +1,12 @@
-
# 🔁 Orchestration
> [!NOTE]
-> Kestra runs every scheduled maintenance flow across the fleet — 14 flows covering OS updates, container updates, app updates, disk cleanup, fleet inventory, and KB self-maintenance. Most run straight through on their own schedule with nobody watching; exactly one is built around a check → pause → human approval → apply pattern instead, reserved specifically for the one category of change judged worth a checkpoint.
+> Kestra runs every scheduled maintenance flow across the fleet — 15 flows covering OS updates, container updates, app updates, disk cleanup, fleet inventory, KB self-maintenance, and public-doc drift checks. Most run straight through on their own schedule with nobody watching; exactly one is built around a check → pause → human approval → apply pattern instead, reserved specifically for the one category of change judged worth a checkpoint.
This is the real flow list, not a claimed count:
@@ -18,7 +18,7 @@ A blanket human-gate policy was the obvious simpler design, and it was rejected:
## Two Patterns, Not One
-
+
That's not just a diagram of the pattern — it's the actual flow's own topology in Kestra, `wait_for_approval` sitting right there as a real node between the pending-check and the apply step:
@@ -30,7 +30,8 @@ This is the real check, not an assumption — every flow's own definition, queri
```
$ for flow in os-update-vms os-update-pve os-update-pve-verify os-update-pbs \
- container-update disk-cleanup app-update homelab-inventory-sync; do
+ container-update disk-cleanup app-update homelab-inventory-sync \
+ public-docs-drift; do
echo "$flow: $(curl -s .../flows/homelab/$flow | grep -c 'core.flow.Pause')"
done
os-update-vms: 0
@@ -41,6 +42,7 @@ container-update: 0
disk-cleanup: 0
app-update: 1
homelab-inventory-sync: 0
+public-docs-drift: 0
```
## One Dedicated Identity, Not a Shared One
@@ -79,7 +81,7 @@ This is the actual KV Store, not a description of it — exactly two entries, no
## Trilium KB Self-maintenance
-Two flows keep this fleet's own internal knowledge base structure current — the *only* two things allowed to write to it, everything else (including this repo's own generation) only ever reads from it:
+Two flows keep this fleet's own internal knowledge base structure current. Those two, plus one more that only ever tags notes for review without altering their content, are the only things that write to the KB at all — everything else, including this repo's own generation, strictly reads from it:
| Flow | Trigger | What it does |
|---|---|---|