docs: finish the removal sweeps for approvals and environment scaling #437

Two removals shipped as breaking changes in July–August 2026. In both cases the sweep missed a page, and both pages now state something that is no longer true.

1. Approvals are still listed as a built-in attestation type

understand_kosli/how_kosli_works.md:22:

Kosli provides built-in attestation types for common controls (Snyk, JUnit, SonarCloud, pull requests, approvals) and supports custom types with jq querying for compliance evaluation.

Approvals were removed on 28 July 2026, from both products, as breaking changes:

• changelog/index.mdx:444 (CLI v2.35.0) — "Approval commands removed — kosli assert approval, kosli get approval, kosli list approvals, kosli report approval, and kosli request approval are gone... Use attestations to record approval evidence instead."
• changelog/index.mdx:458 (Platform) — "Approval API removed — the deprecated approval endpoints under /api/v2/approvals/ no longer exist."

The authoritative list of attestation types is template-reference/flow_template.md:27 and :49 — generic, jira, junit, pull_request, snyk, sonar, decision, sbom, custom:<custom-type-name>. No approvals.

understand_kosli/controls.md:56 already handles this correctly: it maps "Deployment approvals" to "Attestation (generic or custom type)". how_kosli_works.md is the one page still contradicting it, and it sits in the Understand Kosli group that a new reader reads first — so the reader is told a type exists before they ever reach the page that says otherwise.

This exact line is already named as a known precedent in .claude/skills/doc-review/SKILL.md:74 — "an approvals-removal PR updated glossary.md and controls.md but left understand_kosli/how_kosli_works.md:22 still calling approvals a built-in attestation type" — so it has been seen in review and never fixed.

Every other approval mention on the site is fine: understand_kosli/risks.md, glossary.md, what_is_kosli.md, tutorials/working_with_controls.mdx and others describe approval as a control or as attached evidence, not as an attestation type.

2. Environment scaling is still described as a settable property

administration/managing_users/roles_in_kosli.md:146 warns that a snapshotter token can modify an existing environment's "description, scaling, policies, and included environments" by re-PUTting a full payload.

Scaling capture was retired on 19 August 2026 — changelog/index.mdx:224 (Platform): "capture of scale-only changes has been retired... the include_scaling environment setting is gone."

The rest of the site is already updated: helm/k8s_reporter/configuration.mdx:93 and helm/k8s_reporter/upgrading.mdx:14 both describe the value as deprecated and ignored, and the CLI reference carries the upstream deprecation notice. This one word is the only hand-authored leftover.

What a fix looks like

• understand_kosli/how_kosli_works.md:22 — drop approvals from the built-in list. Pull requests already cover the review case. If an approvals example is still wanted, point at understand_kosli/controls.md, where approvals map to a generic or custom attestation.
• administration/managing_users/roles_in_kosli.md:146 — drop scaling from the list of properties a re-PUT can change.

Evidence

Commands that found it:

grep -rni "approval" --include=*.md --include=*.mdx . | grep -v "^./changelog/" | grep -v "^./client_reference/kosli"
grep -rniE "include_scaling|include-scaling|exclude-scaling" --include=*.md --include=*.mdx . | grep -v "^./changelog/"

Found by the monthly doc-structure audit, step 4 (changelog coverage).

URL impact

No page files move and no headings are renamed. Prose edits only, so no config/redirects.json entry is needed.

Verification

• understand_kosli/how_kosli_works.md no longer presents approvals as an attestation type
• mint broken-links — no new broken links