Manage routine operations through Ansible

hosts/synapse.chans.xyz.md

@@ -90,11 +90,16 @@ Path: `/etc/matrix-bootstrap/` (root:root, 0700) — individual files per secret
 
 Inventory group: `matrix_production` (but NOT in `managed` which expects Docker Compose).
 
-Playbooks in `ansible/playbooks/matrix-*.yml`.
+Routine status: `cd ansible && ansible-playbook playbooks/health-report.yml --limit matrix`.
+Use `matrix-preflight.yml` before a Matrix/K3s change, and use the gated
+`matrix-stack.yml` to apply a reviewed ESS chart version. Playbooks are in
+`ansible/playbooks/matrix-*.yml`; direct SSH is reserved for focused K3s
+diagnosis and imperative recovery work.
 
 ## Known limitations
 
 - MatrixRTC / Element Call / LiveKit / Coturn not deployed (`mrtc.chans.xyz` reserved only)
-- SMTP email not yet configured (requires manual bootstrap + Helm upgrade)
+- SMTP email not yet configured (requires manual secret bootstrap followed by a
+  reviewed Ansible stack deployment)
 - No off-site Restic backup
 - Single-node K3s (no HA for control plane)