Operational runbooks — versioned workflow admin (internal-only)

These are the operational runbooks. The operator executes the VERSIONED steps — never improvises. An outdated runbook version is flagged (FM-3): do not execute a stale procedure. A destructive move (Refund / Withdrawal / Brazil-Toggle) requires a dual-confirm + reason (the friction trail). This is the MINIMAL surface — the Customer 360 and the DSAR are F11.5, the HITL inbox is F11.3, and the full admin console is F12.

The 4 operational runbooks

• Runbook refund (runbook.v1) [DESTRUCTIVE — dual-confirm + reason required] — internal-only; versioned steps.
  Versioned steps — execute in order (never improvise) — DESTRUCTIVE: dual-confirm + reason required

  1. Classify the refund (read-only).
  2. Apply the Discovery Trail (friction-by-design).
  3. Dual-confirm the refund (a destructive financial move).
  4. Record the reason key (the friction trail).

  Start runbook
• Runbook chart_manual_upload (runbook.v1) — internal-only; versioned steps.
  Versioned steps — execute in order (never improvise)

  1. Receive the manual chart the engine could not resolve.
  2. Validate against the HD Chart Schema (F2).

  Start runbook