README: document membership sweep + rag refresh scheduled tasks

README.md

@@ -89,3 +89,22 @@ points. Remaining work before production:
       → `key/generate` returns `{key: "sk-..."}`; `key/list` returns `{keys: ["<token>", ...]}`
 - [ ] Add HMAC signature verification for the OC webhook (if OC supports it)
 - [ ] Wire the OIDC addon for admin access
+
+## Scheduled tasks (scheduler addon)
+
+Two jobs run inside the container via `CloudronManifest.json` → `addons.scheduler`:
+
+- **membership_sweep** (nightly 3am) — `sweep.sh` calls the portal's own
+  `/admin/sweep` (auth: `X-Admin-Token` = `WEBHOOK_TOKEN`) to reconcile members
+  against the live Open Collective list: provisions missed signups, deactivates
+  lapsed members, syncs Loomio + Matrix. Idempotent; a missed webhook
+  self-heals within 24 hours.
+- **rag_refresh** (nightly 3:30am) — `rag_refresh.py` pulls this repo's
+  sibling docs from the Gitea raw API (public, no credentials), uploads changed
+  files to Open WebUI (`OWUI_API_KEY`), attaches them to the shared knowledge
+  collection (`DOCS_KNOWLEDGE_ID`), reindexes, and re-grants the members group.
+  State persists in `/app/data/rag_refresh_state.json`.
+
+Verify after any manifest change: the deploy log must show
+`setupAddons: ... scheduler ...` listing both tasks, and each script must
+succeed when run manually inside the container.