Refresh the docs against what N-11 actually shipped - #110

What and why

First staleness check on user-docs/, three days after it was written and immediately after N-11 phase 2, #100 and #102 landed. Two pages had already drifted — both making claims about things that changed underneath them.

This is the maintenance pass the docs conventions were built to make cheap. It found real drift on the first run.

What was stale

The architecture page said the quick-create link carries four parameters. It carries five — N-11 phase 2 added TopsInstallId, and the parent subscription now only forwards messages carrying that value, quarantining the rest. That is a materially better story for the security reviewers this page is written for, so it now describes the filter and the quarantine queue rather than just correcting a count.

SECURITY.md listed three known issues, two of them now closed. #100 shipped and #102's template is deleted. A vulnerability policy telling researchers not to report things that are already fixed is worse than useless — it discourages reporting a regression. #101 stays, reworded to describe what is now in place rather than what was open when it was written. #109 takes the freed slot, with an honest note that the SQS:ReceiveMessage grant is dead permission rather than exposure.

What was verified and did not need changing

Checked rather than assumed, against the current tree:

How it was tested

Documentation only; no application code touched.

• Relative-link check across user-docs/ and SECURITY.md — all resolve.
• Every numeric claim in the four pages re-extracted from the CloudFormation template and the rulesets, not carried over from the previous version.
• Confirmed no remaining references to templates/iam.role.audit.account.cfn.yaml or templates/sync.sh, both deleted by Delete the audit CFN template that defaults to the vendor's AWS account #107.

Quality gate

• Acceptance criteria are met — the drift is corrected and the rest verified
• Solves the user problem simply — two edits, no restructuring
• Follows the practices in docs/practices/
• Tests written and passing — none. Documentation only
• Documentation updated — this PR is the update
• No obvious performance issues — n/a
• Ready for production — the pages are accurate against develop as of this commit

Practices check

• Security — no secrets. The SECURITY.md change makes the known-issues list accurate, which matters more than it reads

Out of scope

• Enabling GitHub private vulnerability reporting and creating security@teemops.com. SECURITY.md still names two channels that do not answer yet — that is a repo settings change and a mail change, both yours.
• Trimming the child IAM template to the permissions actually used. Still unfiled; the role grants write across eight services on behalf of features that do not exist.
• The remaining 30 pages in the content map.

🤖 Generated with Claude Code