Docs: correct what today's changes made false, and add the system-level reference

[Sbussiso]

Two commits: an accuracy pass, then the document that didn't exist.

Accuracy — a day of infrastructure work left the docs describing a system that's gone

A confidently wrong doc costs more than a missing one, because nobody goes looking for a second source.

docs/SENTINEL_AGENT.md — rewritten, not patched. It was still titled after the archived SourceBox-Sentinel repo, described the agent as a separate Fly app with its own secrets and deploy token, told readers to pip install -r requirements.txt, documented an Ollama client that no longer exists, and warned against poll mode because it "defeats auto_stop_machines" — on a machine that is now deliberately always warm. It also contained a half-finished edit of mine sitting inside a code block. Preserved what was still true and good (reliability layers, multi-tenancy model, limitations); corrected the rest.

docs/legal/SUB_PROCESSORS.md — this one has consequences. The Ollama Cloud entry is still factually right about who processes data (verified against the running config: ollama_chat/qwen3.5:cloud), but it called the agent "a separate SourceBox-operated service" and predates the provider becoming a config value.

LiteLLM means one environment variable now decides who receives customer camera imagery. That's a sub-processor change under the DPA — 14 days' notice, not a config tweak. The warning is recorded both at the point of use and in the changelog, so someone editing LLM_MODEL meets it.

docs/runbooks/DISASTER_RECOVERY.md justified Sync having no dump job because it "runs two machines". It runs one now and scales to zero, so the stated reason is false. The conclusion survives on stronger grounds — sentinel_sync holds a mirror whose source of truth is the operator's local SQLite — and now says that instead.

docs/LAUNCH_HANDOFF.md told the operator to verify notifications.sourceboxsentry.com as the Resend sending domain. That's the pre-rename brand and is not verified; AGENTS.md already records that sentinel-command.com is. Following the old step at launch would have failed every send.

README.md linked the agent row to the archived repo. docs/README.md pointed at the old domain, never indexed SENTINEL_AGENT.md, and told readers no runbooks existed — in the same file that lists two.

The document that didn't exist

README.md covers this repo. AGENTS.md covers Command Center's internals. Nothing covered the level above both, so "what talks to what" lived only in the heads of the people who built it.

docs/ARCHITECTURE.md is that level — written from the running infrastructure, not from memory. It makes explicit several things that were previously folklore:

• the live video path touches no object storage, and the segment cache's 384 MiB ceiling is coupled to the machine's 1 GiB — raise one without the other and the OOM killer takes every org's streams
• two services scale to zero and two don't, for a measurable reason (Fly's proxy gives an auto-started machine ~8s to bind; License needs ~4s, the agent ~10s)
• isolation between the three databases is by role, not by cluster
• CI path filtering is asymmetric on purpose, and inverting it would hang every PR on a check that never reports
• the GITHUB_TOKEN deploy gap, which is why only this repo has an auto-merge workflow

All 37 relative links verified to resolve.

🤖 Generated with Claude Code