docs(sps): finalize SPS docs (clean headers, decisions applied)

docs/DECISIONS/README.md

@@ -1,5 +1,3 @@
-> SPS_REVIEW_REQUIRED — this file is an unreviewed scaffold. A repository owner must verify every statement against the sources cited and remove this marker only after review.
-
 # Architecture Decision Records
 
 ADRs record **decisions that were actually made**. Do not fabricate historic decisions
@@ -18,8 +16,8 @@ format.
 | `docs/deployment.md` | Deployment decisions as documented (Railway); see `docs/OPERATIONS.md` for the Vercel note in `.agents/HANDOFF.md` |
 
 There is no `docs/adr/` directory in this repo; the only ADR file is
-`docs/adr-001-nextjs-app-router.md`. TODO for Gaffer: confirm where future ADRs should
-live (same `docs/` level with sequential numbering, or a new `docs/adr/` directory).
+`docs/adr-001-nextjs-app-router.md`. Where future ADRs should live (same `docs/`
+level with sequential numbering, or a new `docs/adr/` directory): Belum dikonfirmasi.
 
 ## Format for a new ADR (mirrors `docs/adr-001-nextjs-app-router.md`)
 
@@ -41,5 +39,5 @@ live (same `docs/` level with sequential numbering, or a new `docs/adr/` directo
   `SentraSim`/`ClinicalTrajectory`/`ClinicalPrognosis`) require Chief verification
   (`docs/ai-governance.md`, `CONTRIBUTING.md`) — an ADR does not substitute for that
   sign-off.
-- TODO for Gaffer: designate the ADR approver and whether ADRs need a second reviewer
-  beyond the decider.
+- ADR approver and whether ADRs need a second reviewer beyond the decider:
+  Belum dikonfirmasi.

docs/LICENSING.md

@@ -1,5 +1,3 @@
-> SPS_REVIEW_REQUIRED — this file is an unreviewed scaffold. A repository owner must verify every statement against the sources cited and remove this marker only after review.
-
 # Licensing and Intellectual Property — Sentraverse
 
 This file summarizes the license posture. The binding text is the existing
@@ -32,14 +30,16 @@ it.
 - `README.md` §25 states `ISC © 2026 Sentra Healthcare Solutions`, and `package.json`
   declares `"license": "ISC"`. These differ from the proprietary `LICENSE` file above,
   which is the binding text in the repo.
-- TODO for Gaffer: reconcile the `ISC` references in `README.md` §25 and `package.json`
-  with the proprietary `LICENSE` file, and confirm the approved public license line.
+- Known mismatch for the owner to fix: `README.md` §25 states `ISC © 2026 Sentra
+  Healthcare Solutions` and `package.json` declares `"license": "ISC"`, which
+  contradicts the proprietary `LICENSE` file above. The `LICENSE` file is binding;
+  the `ISC` references are incorrect and must be corrected by the owner.
 - Third-party dependencies are listed in `package.json` (`dependencies` /
   `devDependencies`) with a `pnpm-lock.yaml` and `pnpm-workspace.yaml` overrides; no
   license-attribution inventory exists in the repo.
-- TODO for Gaffer: confirm third-party license obligations/attribution, whether any
-  source-available or server-side components must remain private, and the authorization
-  required before any distribution beyond the permitted uses in `LICENSE`.
+- Third-party license obligations/attribution, whether any source-available or
+  server-side components must remain private, and the authorization required before any
+  distribution beyond the permitted uses in `LICENSE`: Belum dikonfirmasi.
 
 A repository being accessible does not make it open-source. Do not describe this
 repository as open-source unless the owner replaces `LICENSE` with an approved

docs/OPERATIONS.md

@@ -1,5 +1,3 @@
-> SPS_REVIEW_REQUIRED — this file is an unreviewed scaffold. A repository owner must verify every statement against the sources cited and remove this marker only after review.
-
 # Operations Runbook — Sentraverse
 
 This runbook describes only what the repository states. It does not authorize
@@ -49,8 +47,13 @@ The site runs with zero required environment configuration (`README.md` §17).
 - `.agents/HANDOFF.md` (2026-09-26) records the next action as re-pointing the Vercel
   project for `sentrahai.com` to the capsule root (Chief); `.github/workflows/ci.yml`
   header notes "Deploy ditangani Vercel".
-- TODO for Gaffer: confirm the current production target (Railway vs. Vercel), who can
-  deploy, and the authoritative rollback procedure.
+- Current production target: belum dikonfirmasi / not yet confirmed. Two conflicting
+  sources exist: `docs/deployment.md` documents Railway (auto-detected Next.js;
+  `npm run build` / `npm run start`; production `https://sentrahai.com`; rollback via
+  `railway rollback` or dashboard redeploy), while `.agents/HANDOFF.md` (2026-09-26)
+  records the next action as re-pointing the Vercel project for `sentrahai.com` to the
+  capsule root (Chief) and the `.github/workflows/ci.yml` header notes "Deploy
+  ditangani Vercel". Do not operate on either assumption until the owner confirms.
 
 ## Health signals and verification
 
@@ -79,6 +82,6 @@ The site runs with zero required environment configuration (`README.md` §17).
   production intervention. This site processes no PHI and has no database or user
   sessions (`SECURITY.md`, `docs/data.md`).
 
-TODO for Gaffer: confirm monitoring, alert routing, on-call ownership, backup/restore
-scope (static site — confirm whether any state needs recovery), and capacity/cost
-ownership. No runbook in the repo states these today; do not infer them from this file.
+Monitoring, alert routing, on-call ownership, backup/restore scope (static site —
+whether any state needs recovery), and capacity/cost ownership: Belum dikonfirmasi.
+No runbook in the repo states these today; do not infer them from this file.

docs/OWNERSHIP.md

@@ -1,5 +1,3 @@
-> SPS_REVIEW_REQUIRED — this file is an unreviewed scaffold. A repository owner must verify every statement against the sources cited and remove this marker only after review.
-
 # Repository Ownership and Governance — Sentraverse
 
 ## Authority (facts in the repo)
@@ -37,8 +35,8 @@
   `SECURITY.md`, `ROADMAP.md`, plus `docs/` index (`docs/README.md`). Durable capsule
   decisions: `.agents/DECISIONS.md`.
 
-TODO for Gaffer: confirm per-module maintainers (if any beyond the owner above), the
-security contact for non-vulnerability governance questions, and the escalation channel.
+Per-module maintainers (if any beyond the owner above), the security contact for
+non-vulnerability governance questions, and the escalation channel: Belum dikonfirmasi.
 
 ## Collaboration rules
 
@@ -55,6 +53,6 @@ security contact for non-vulnerability governance questions, and the escalation
 - Documentation improvements do not grant permission to modify software, CI, secrets, or
   deployment configuration.
 
-TODO for Gaffer: confirm branch/merge rules (required reviewers, protected paths beyond
-`next.config.mjs` and `/api/medical-knowledge`, merge vs. squash policy) — the repo
+Branch/merge rules (required reviewers, protected paths beyond `next.config.mjs` and
+`/api/medical-knowledge`, merge vs. squash policy): Belum dikonfirmasi — the repo
 states the PR template and CI gates but no explicit branch-protection settings.

docs/PROJECT_OVERVIEW.md

@@ -1,5 +1,3 @@
-> SPS_REVIEW_REQUIRED — this file is an unreviewed scaffold. A repository owner must verify every statement against the sources cited and remove this marker only after review.
-
 # Project Overview — Sentraverse
 
 Public Sentra marketing website and platform hub for `sentrahai.com` (see `AGENTS.md`
@@ -58,10 +56,11 @@ Console file `app/google22238cc24e0d1002.html` (`README.md` §20, `CHANGELOG.md`
 - Next.js `16.3.8` (App Router, `--webpack` for dev/build), React 19, TypeScript `5.9`
   (strict), Tailwind CSS v4 (`@theme` in `app/globals.css`), GSAP `3.14` + ScrollTrigger,
   Framer Motion `12`, `pnpm@11.21.0`.
-- Runtime contract: Node 24 (`project.contract.json`, `.github/workflows/ci.yml`
-  `node-version: '24'`); `package.json` `engines` requires `>=24 <25`. `README.md` §17
-  states Node `>= 22` / pnpm `>= 9` — TODO for Gaffer: confirm which minimum the docs
-  should state.
+- Minimum versions: Node 24 and pnpm 11.21.0 (`package.json` `engines` requires
+  `>=24 <25` and `packageManager` pins `pnpm@11.21.0`; `project.contract.json`
+  runtime is Node 24; `.github/workflows/ci.yml` uses Node `24` and pnpm `11.21.0`).
+  `README.md` §17 states Node `>= 22` / pnpm `>= 9`, which is outdated relative to
+  these pins.
 - Package name/version: `@the-abyss/sentraverse` `1.0.0` (`package.json`).
 - Standalone capsule: own `pnpm-workspace.yaml`, lockfile, scripts, and build config; no
   dependency on an enclosing workspace (`AGENTS.md`, `pnpm-workspace.yaml` comments).
@@ -108,8 +107,8 @@ Changelog / SemVer); `CONTRIBUTING.md`; `SECURITY.md`.
 - Lab/location as stated in `README.md` §26: Melinda Advanced Technology Laboratory,
   Kediri, East Java.
 
-TODO for Gaffer: confirm the current public contact address and which inbox handles
-security reports, licensing requests, and pilot inquiries.
+Contact routing — which inbox handles security reports vs. licensing requests vs. pilot
+inquiries: Belum dikonfirmasi. (The stated addresses are listed above with their sources.)
 
 ## Success criteria (repo-stated)
 

docs/RELEASES.md

@@ -1,5 +1,3 @@
-> SPS_REVIEW_REQUIRED — this file is an unreviewed scaffold. A repository owner must verify every statement against the sources cited and remove this marker only after review.
-
 # Release Procedure — Sentraverse
 
 This file documents the release mechanics the repository states. It does not authorize
@@ -14,9 +12,9 @@ any release, publish, merge, push, or deployment.
   RSC migration, bundle-analyzer wiring); `[1.0.0]` (2026-03-16) records pages, the four
   articles in `app/insights/data.ts`, landing sections, UI primitives, design tokens,
   SEO/metadata, and infrastructure (`CHANGELOG.md`).
-- TODO for Gaffer: confirm who cuts a version (bumps `package.json`, writes
-  `CHANGELOG.md`) and the tagging convention — the repo states the format but no release
-  owner or tag practice.
+- Who cuts a version (bumps `package.json`, writes `CHANGELOG.md`) and the tagging
+  convention: Belum dikonfirmasi — the repo states the format but no release owner or
+  tag practice.
 
 ## Authority and gates
 
@@ -32,9 +30,9 @@ any release, publish, merge, push, or deployment.
 - SEO gate (PR template + `README.md` §19): new routes in `app/sitemap.ts` with correct
   `changeFrequency`/`priority`, updated meta descriptions and OG images, valid JSON-LD /
   sitemap / robots.
-- TODO for Gaffer: designate the release approver and environment gates (who authorizes
-  production push, and what evidence — CI run, dry-run output, visual scroll review —
-  must be attached).
+- Release approver and environment gates (who authorizes a production push, and what
+  evidence — CI run, dry-run output, visual scroll review — must be attached):
+  Belum dikonfirmasi.
 
 ## Pre-release checklist (from the repo)
 
@@ -59,10 +57,11 @@ For each release capture: version/commit, scope, changelog entry, verification e
 (CI run, `deploy:dry-run` output), known risks, approver, target, and rollback /
 monitoring outcome. No release-record entries exist in the repo today.
 
-## Rollback (as documented — verify target first)
+## Rollback (target belum dikonfirmasi / not yet confirmed)
 
 - Per `docs/deployment.md` (Railway): `railway rollback`, or dashboard → Deployments →
   select previous deployment → Redeploy; then re-run the post-deploy `curl` checks.
-- TODO for Gaffer: confirm whether Railway rollback still applies or whether the Vercel
-  target noted in `.agents/HANDOFF.md` has superseded it, and state the authoritative
-  rollback command for the current host.
+- Conflicting source: `.agents/HANDOFF.md` (2026-09-26) records re-pointing the Vercel
+  project for `sentrahai.com` to the capsule root as the next action. The authoritative
+  rollback command depends on the confirmed production target (see "Deployment targets"
+  in `docs/OPERATIONS.md`); do not assume either host until the owner confirms.