docs: align internal docs to enterprise standards

Add canonical operations/security/access/feature docs and fix path integrity to improve onboarding and incident readiness.

docs/features/selective-collection-sync.md

@@ -0,0 +1,69 @@
+# Feature: Selective Collection Sync
+
+## Purpose and Business Outcome
+
+Allow teams to replicate only selected collections so bandwidth and operational overhead stay aligned to business-critical data.
+
+## Scope and Non-Goals
+
+Scope:
+
+- Register collections for replication using `WatchCollection()`.
+- Replicate changes for registered collections across peers.
+
+Non-goals:
+
+- Automatic replication of all database collections.
+- Schema migration management.
+
+## User and System Workflows
+
+1. Developer registers target collections in the document store.
+2. Local writes trigger CDC events.
+3. Oplog entries propagate through peer sync.
+4. Remote peers apply updates for matching collections.
+
+## Interfaces, APIs, and Events Involved
+
+- `WatchCollection(collectionName, collection, keySelector)`
+- CDC trigger pipeline
+- Oplog append and apply operations
+
+## Permissions and Data Handling
+
+- Access to source collections is controlled by host application permissions.
+- Only approved collections should be registered for sync in sensitive environments.
+
+## Dependencies and Failure Modes
+
+Dependencies:
+
+- Correct collection registration
+- Stable peer connectivity
+- Persistence availability
+
+Failure modes:
+
+- Missed replication due to unregistered collection
+- Delayed propagation during network partition
+
+## Monitoring, Alerts, and Troubleshooting Pointers
+
+- Monitor replication lag and peer confirmation metrics.
+- Use [Runbook](../runbook.md) and [Troubleshooting](../troubleshooting.md) for incident response.
+
+## Rollout and Change Considerations
+
+- Introduce new synced collections behind staged rollout.
+- Validate downstream consumer compatibility before production enablement.
+
+## Validation and Testability Guidance
+
+- Add integration tests verifying only registered collections replicate.
+- Smoke test by writing to registered and non-registered collections and confirming expected behavior.
+- Validate no unexpected collection appears in remote peers after deployment.
+
+## Related Security Controls
+
+- [Security](../security.md)
+- [Access and Permissions](../access.md)