A-08 — Wider Ops Runbook: Help Desk, School Zones, Housing Queues, Complaints, Compliance (administrator)

Scope: Steady-state operations runbook for the wider scenario set — wire checks, help-desk queues, school-zone schedules, housing queue hygiene, complaint-mode handling, compliance calendar, and per-family rollback drills — for city and estate administrators who run these playbooks day to day. Status: as of 2026-11-09 Blueprint sources: Community-life fragment family guide; facilities fragment family guide; housing fragment family guide; public-property and property-compliance fragment family guides; administrator deployment and compliance-ops guides and environmental-ops guide in docs/platform-map/jijibora/; playbook registry in docs/platform-map/jijibora/.

What this means for you

You run the wider set as subscriptions, clocks and queues — not as code changes: each family is enabled or paused by one declared setting, every threshold lives in lookup values you can inspect, and every action leaves a receipt you can audit. When in doubt you refuse the action rather than inventing a substitute, and you keep the audit trail even while a zone or a ladder is temporarily paused (source: administrator compliance-ops companion — fail closed on doubt; source: facilities dossier, "Guardrails" — fail closed everywhere, never fill a gap with a plausible substitute).

Details

The wider families share one operating spine. Runtime evaluation lives in the orchestration and protocol-translation engines, not in stored data; the durable anchor records before any hand-off; and a family lands in practice mode before production mode, where a pack cannot declare itself live (source: environmental-ops companion, "Subscribing ops" and "Reflex enabling gates" — Soft before Live, pack cannot self-declare live).

1. Wire-check ladder — inbox, consumer, allowlist, handler, receipt (per playbook)

Walk every playbook in this order and do not skip a rung; diagnose only with the family quiesced, never while it is firing (source: environmental-ops companion, "If the reflex hurts" — kill switch first, then ordered checks).

1. Inbox (durable anchor). Check pending depth is zero in steady state. A depth that never falls means the relay is faulty — diagnose on a temporary instance, verify with the consumer-alive check, and expect depth to return to zero (source: environmental-ops companion, "Capacity probe steps" — steady-state expectation zero; source: administrator deployment companion — relay runbook).
2. Consumer (receipt health). Confirm one receipt per event: published means delivered, guard-refused means failed and recorded, max retries means dead-letter with an audit row. A transition that reports success but writes no delivery row is a fault (source: environmental-ops companion, "Capacity probe steps" — one receipt per event, refusals recorded, never re-emitted).
3. Allowlist (ceiling). Confirm the subject family is allowlisted and no child request widens the parent promise. A ceiling-denied response is a refusal to be honoured, not a negotiation (source: environmental-ops companion, "If the reflex hurts" — allowlist rung; child cannot widen parent).
4. Handler (terminal owner). Confirm only the terminal stage may command. A non-terminal stage attempting a command must refuse; the terminal handler owns tickets, notifications, and proof receipts (source: environmental-ops companion, "Subscribing ops" — actuation only from terminal).
5. Receipt. Require the terminal receipt — fired notice with causation inherited, occupancy or queue receipt, itinerary verdict, or approval record — before declaring the playbook enabled (source: community-life dossier, "Wiring" — one standard fired notice out with causation inherited).

Run all checks per family (help desk, ladder, school zone, traffic pattern, boards, tenancy, rounds, inspections, housing queue, relief, zoning, encroachment, register, disclosure), not as one catch-all feed (source: environmental-ops companion, "Subscribing ops" — subscribe each family under its own subject family).

2. Help-desk queue operations — service clocks, reopening bands, role separation

Service clocks. Each desk category (maintenance, security, pest, cleaning, other) carries a service timing that is declared as a lookup value and enforced by a timer — the intake is acknowledged, then urged, then escalated, then sent to the ward office, exactly as the declared ladder says (source: community-life dossier, "Wiring" — ladder timings from lookup values only). Confirm the timer fires on the same schedule as the plates in the lookup; never hardcode a clock from memory. UNKNOWN: numeric service timings per category are UNKNOWN in the fragments until bound (source: community-life dossier, "Guardrails" — timings are lookup values). Grader capacity. Classification is only a proposal until a human grader confirms within the service window; the grader queue depth is your capacity signal — not message volume (source: community-life dossier, "Guardrails" — manual confirm within service window required). If the grader queue breaches, pause intake upgrades rather than lowering the confirmation bar. Role separation discipline. Enforce that the intake agent never closes their own intake and that close-out needs a triage note; a resolver cannot approve their own close (source: community-life dossier, "Guardrails" — intake agent cannot also close; source: reflex dossier, "Guardrails" — resolver cannot approve own close). Rotate graders so that the same human does not intake and close the same ticket; audit the separation on every close-out sample. Reopening bands. A closed ticket reopens only through a declared reopen path that re-enters the ladder with a fresh evidence note — never by editing history. The fragments assert terminal-only close; the reopening band widths (how long after close a reopen is staff-handled versus re-intaked) are UNKNOWN and must be declared before go-live (source: community-life dossier, "Guardrails" — terminal-only actuation; specific reopen bands UNKNOWN).

3. School-zone schedules — windows as policy values

Windows as values. Treat every school-zone window as a declared policy value bound to the school calendar plus geographic slots; the reflex proposes guard rosters and raises advisories only inside the window (source: community-life dossier, "Wiring" — school calendar window plus geographic slots to advisory). Window times, corridor extents and roster compositions are UNKNOWN until declared (source: community-life dossier, "Guardrails" — window and corridor values UNKNOWN). How a window change reaches the reflex. Change the lookup value declaratively — never by editing stored data and never by editing code — then let the next evaluation read it; confirm the next advisory receipt carries the new window (source: environmental-ops companion, "Reflex enabling gates" — change settings declaratively; source: community-life dossier, "Wiring" — lookup references resolve at runtime from the lookup store). Temporary disabling with the trail kept. To pause a zone for an assembly or holiday: set the family enabled switch false, let the durable anchor drain to zero, observe that no new advisories fire, and record the pause in the audit narrative. Do not delete history or purge pending rows — purge of receipts is refused (source: environmental-ops companion, "Reflex enabling gates" — disable without purge; source: environmental-ops companion, "If the reflex hurts" — never purge history to look clean). Re-enable by setting the switch true and confirming a fresh receipt. The literal operator control to flip the switch is UNKNOWN in the read set — confirm the console key with the platform owner before go-live (source: environmental-ops companion, "Reflex enabling gates" — literal control UNKNOWN).

4. Housing queue hygiene — rounds discipline, ordering and published rationals

Rounds hygiene. Dress the queue like rounds: each queue evaluation is a visit prompt with a dated record; deleted or vanished applicants are never silently dropped — a lapsed item reschedules through the same guard (source: housing dossier, "Wiring" — proposal-only terminal with human confirmation; source: public-property dossier, "Guardrails" — missed round reschedules, never silently dropped). Ordering and rationals. Ordering reads only declared bands and evidence references; publish the band keys and evidence refs that produced each rank, and never publish individual enumeration (source: housing dossier, "Guardrails" — eligibility by band key plus evidence reference; individual enumeration forbidden). If a dwelling reference resolves zero or multiple times, refuse the row rather than reassigning it (source: housing dossier, "Guardrails" — spaces resolve or refuse). Panel hygiene. Allocation panels observe separation and quorum; an allocation attempted by reflex alone must refuse (source: housing dossier, "Guardrails" — no allocation by reflex without human confirmation). Keep offer proposals as proposals until the panel confirms; do not let a proposal act as an allocation in any downstream message. Relief operations. Relief placements attach evidence before proposal and sit inside the parent SOS ceiling; any scope, duration or count widening the ceiling refuses by default (source: housing dossier, "Wiring" — evidence attached first; child inherits ceiling). Shelter inventories and capacities are UNKNOWN until bound (source: housing dossier, "Review state" — inventories UNKNOWN).

5. Complaint-mode operation — multi-witness evidence sealing and dignity rules

Multi-witness evidence sealing. Complaint evidence seals by reference only and attaches before a case advances; a weight without a resolvable evidence ref refuses (source: housing dossier, "Guardrails" — evidence-based only, evidence attaches first; source: property-compliance dossier, "Guardrails" — due process before review). For multi-witness cases, seal each witness reference independently so one witness withdrawing does not invalidate the others — whether witnesses are combined by a declared quorum rule is UNKNOWN until bound (source: property-compliance dossier, "Wiring" — disputed review needs quorum; quorum text UNKNOWN). Dignity rules. Public digests and pattern notices carry scrubbed fields only; sealed content never enters a match or a public notice, and personal data never enters a public tier (source: public-property dossier, "Guardrails" — scrubbed fields only in public tiers; sealed content never in the match; source: housing dossier, "Guardrails" — no personal data in public tiers). In complaint-mode digests, do not name the accused person, and do not name households in housing tiers; use band and reference language only (source: housing dossier, "Guardrails" — no individual enumeration; source: public-property dossier, "Guardrails" — no private data in public subjects). A context event carrying personal data is refused rather than sanitised-and-proceeded (source: housing dossier, "Guardrails"). Pattern discipline. Three or more same-corridor reports open a pattern case; a single report never escalates a person. Keep the case about the systemic failure, not the resident (source: public-property dossier, "Wiring" — pattern case raises a sourcing requirement; source: community-life dossier, "Guardrails" — pattern case only when signals quantified).

6. Compliance calendar — certificate expiry watches and re-inspection cadences

Certificate expiry. Watch certificates as dated values: an expired certificate is a lapsed prompt, not a silent pass. Because expiry watch thresholds and certificate formats are UNKNOWN in the fragments, declare both as lookup values and refuse any packet whose certificate ref does not resolve (source: facilities dossier, "Review state" — certificate formats UNKNOWN; source: facilities dossier, "Guardrails" — no sign-off, no certificate; packet exports receipts only). Re-inspection cadences. Run inspections on declared cadences read as lookup values; never hardcode a cadence. Certificates require expert sign-off plus all inspection receipts, and the signing expert must differ from the inspecting worker (source: facilities dossier, "Guardrails" — no self-approval; source: property-compliance dossier, "Guardrails" — no self-certification). Due-process calendar. For encroachment notices, serve and record both neighbour and owner notices before any review opens; notice contents, service method and period are UNKNOWN until bound (source: property-compliance dossier, "Guardrails" — due process before review; notice values UNKNOWN). Diary them as dated obligations, not as discretionary nudges. Register services. Keep the lease and occupancy registers append-only; a use change appends history and never rewrites it. Arrears behaviours are explicitly out of scope — any arrears consequence needs a separately governed disposition (source: property-compliance dossier, "Guardrails" — arrears behaviour out of scope).

7. Rollback drill per family — pause ladder and kill-switch owners

Drill this per family — help desk, ladder, school zone, traffic pattern, boards, tenancy, rounds, inspections, housing queue, relief, zoning, encroachment, register, disclosure — before go-live and quarterly thereafter. Each drill: set the enabled switch false, drain to depth zero, confirm no new fires, record the pause, re-enable, confirm one fresh receipt (source: environmental-ops companion, "Reflex enabling gates" — disable sequence; source: environmental-ops companion, "If the reflex hurts" — kill switch first).

Kill-switch owners above are roles (rotations), not named individuals — member names are UNKNOWN and resolved at runtime (source: community-life dossier, "Guardrails" — escalations to named rotations, members UNKNOWN). Escalation thresholds like time-to-broadcast are UNKNOWN in the read set; only the pattern of value plus dual control plus expiry plus audit is evidenced for emergency overrides (source: environmental-ops companion, "SOS and escalation business rules").

Open items / gaps

• Literal runtime keys and consoles for the enabled switch, service clocks, window values and pause controls are UNKNOWN — verify with the platform owner before go-live (source: environmental-ops companion, "Reflex enabling gates" and "Open items"; source: environmental-ops companion, "Recurring orders clock").
• All wider families remain Soft drafts — practice mode only until seeded and live-verified; a Soft apply never reports as live (source: community-life dossier, "Review status"; source: facilities dossier, "Review state"; source: housing dossier, "Review state").
• Numeric alert thresholds on depth, lag and rule health are UNKNOWN; steady state expects zero pending depth, and sustained non-zero depth triggers the relay runbook (source: environmental-ops companion, "Capacity probe steps").
• Provisional stream and event names in the facilities, housing and property-compliance families are pending registration; canonical subject keys bind at wiring time (source: facilities dossier, "Purpose"; source: housing dossier, "Purpose").