okengine 0.11.1 → 0.12.0

package/site/content/docs/recipes/postgres.mdx

@@ -37,7 +37,7 @@ oke dev
 ```
 
 `oke docker` writes `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB` into
-`docker/.env.docker` as `${OKE_STORE_SQL_USER}` / `${OKE_STORE_SQL_PASSWORD}` /
+`.env.local` as `${OKE_STORE_SQL_USER}` / `${OKE_STORE_SQL_PASSWORD}` /
 `${OKE_STORE_SQL_DB}` refs — never literal secrets in compose YAML.
 
 </Step>
@@ -93,11 +93,37 @@ Scale out with [PgDog](/docs/recipes/pgdog) so `N × Bun.SQL pool` does not exha
 
 ## What the recipe configures
 
-| Field          | Value                                                |
-| -------------- | ---------------------------------------------------- |
-| Container port | `5432`                                               |
-| Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries |
-| Connection URL | `postgres://user:pass@host:5432/db`                  |
+| Field          | Value                                                     |
+| -------------- | --------------------------------------------------------- |
+| Container port | `5432`                                                    |
+| Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries      |
+| Connection URL | `postgres://user:pass@host:5432/db`                       |
+| Preload        | `postgres -c shared_preload_libraries=pg_stat_statements` |
+
+## Query performance
+
+<Callout title="Preload, then create">
+  `pg_stat_statements` must load at postmaster start. `CREATE EXTENSION` alone is not enough.
+  Recreate `store-sql` after a recipe change — the data volume can stay.
+</Callout>
+
+| Step    | What you do                                                       |
+| ------- | ----------------------------------------------------------------- |
+| Preload | Recipe already sets `shared_preload_libraries=pg_stat_statements` |
+| Create  | `CREATE EXTENSION IF NOT EXISTS pg_stat_statements`               |
+| Console | Store → SQL band → **Performance**                                |
+
+Default `postgres:18-alpine` does **not** ship `hypopg` / `index_advisor`. Pin the
+opt-in image when you want Suggest indexes:
+
+```typescript title="oke.config.ts"
+images: {
+  "store.sql": "oke-postgres-advisor:18-alpine",
+},
+```
+
+`oke docker` writes `Dockerfile.postgres-advisor` and a compose `build:`. Driver id
+stays `postgres`. Suggest copies `CREATE INDEX` DDL — it does not create indexes.
 
 ## Troubleshooting
 
@@ -105,16 +131,26 @@ Scale out with [PgDog](/docs/recipes/pgdog) so `N × Bun.SQL pool` does not exha
 <Accordion title="oke boot: postgres driver needs DATABASE_URL">
 
 The `postgres` driver fails boot when neither `DATABASE_URL` nor `OKE_STORE_SQL_URL` is
-set. Re-run `oke dev` so the stack writes `docker/.env.docker`, or export
+set. Re-run `oke dev` so the stack writes `.env.local`, or export
 `DATABASE_URL` yourself when pointing at a managed host.
 
+</Accordion>
+<Accordion title="PgStatStatementsNotPreloaded">
+
+The Console Performance view needs the library preloaded **and** the extension
+created. Recreate `store-sql` so the new `command` applies, then run
+`CREATE EXTENSION IF NOT EXISTS pg_stat_statements`.
+
+Existing clusters that started before this recipe change keep the old
+postmaster flags until recreate.
+
 </Accordion>
 <Accordion title="pg_isready fails / store-sql unhealthy">
 
 Wrong `POSTGRES_USER` or the container is still initializing. Check
 `docker compose … logs store-sql` for `database system is ready to accept connections`.
 
-Credential refs must resolve in `.env.docker` — empty `${OKE_STORE_SQL_PASSWORD}` leaves
+Credential refs must resolve in `.env.local` — empty `${OKE_STORE_SQL_PASSWORD}` leaves
 Postgres refusing auth.
 
 </Accordion>

package/site/content/docs/recipes/redis.mdx

@@ -32,7 +32,7 @@ images: {
 <Step>
 ### Required password
 
-```bash title="docker/.env.docker (written by oke docker)"
+```bash title=".env.local (written by oke docker)"
 OKE_STORE_KV_PASSWORD=…
 REDIS_URL=redis://:…@127.0.0.1:6379
 ```
@@ -93,6 +93,11 @@ Multi-replica Gate rate counters and Signal need a **shared** Redis URL — an i
 | Healthcheck    | `redis-cli -a <password> ping`, every 5s, 10 retries |
 | Connection URL | `redis://:pass@host:6379`                            |
 
+<Callout title="Console Performance">
+  Store → KV band → **Performance** reads `INFO` / `SLOWLOG` on this instance. Those commands are
+  server-wide, not scoped to `oke:kv:{ns}:`. `memory` (tests) returns `KvStatsUnsupported`.
+</Callout>
+
 ## Troubleshooting
 
 <Accordions>
@@ -100,7 +105,7 @@ Multi-replica Gate rate counters and Signal need a **shared** Redis URL — an i
 
 Missing `REDIS_URL` fails boot loudly — never a silent fallback to `memory`. Re-run
 `oke dev` or export `REDIS_URL` when using a managed host. Under Compose the
-message asks whether `oke dev -d` wrote `docker/.env.docker`.
+message asks whether `oke dev -d` wrote `.env.local`.
 
 </Accordion>
 <Accordion title="NOAUTH Authentication required">

package/site/content/docs/recipes/rustfs.mdx

@@ -27,7 +27,7 @@ drivers: {
   },
 },
 images: {
-  store: { files: "rustfs/rustfs:1.0.0-beta.11" },
+  store: { files: "rustfs/rustfs:1.0.0-rc.2" },
 },
 ```
 
@@ -36,7 +36,7 @@ images: {
 <Step>
 ### Credentials and endpoint
 
-```bash title="docker/.env.docker (written by oke docker)"
+```bash title=".env.local (written by oke docker)"
 S3_ACCESS_KEY_ID=…
 S3_SECRET_ACCESS_KEY=…
 S3_BUCKET=oke
@@ -88,7 +88,7 @@ endpoint. Open `S3_CONSOLE_URL` for a browser console on port **9001**.
 **Backup means:** snapshot that named volume (or `aws s3 sync` against the API).
 Deleting the volume deletes every object.
 
-Credentials live in `.env.docker`, not in `/data` — rotate keys without wiping objects.
+Credentials live in `.env.local`, not in `/data` — rotate keys without wiping objects.
 Losing both volume and keys means full restore from backup only.
 
 ## Production note
@@ -122,7 +122,7 @@ for a managed bucket.
 <Accordion title="Access Denied / signature errors against :9000">
 
 `S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY` do not match `RUSTFS_*` inside the
-container, or `S3_ENDPOINT` points at the wrong host/port. Align `.env.docker` with the
+container, or `S3_ENDPOINT` points at the wrong host/port. Align `.env.local` with the
 running service; confirm health at `/health` before debugging client signatures.
 
 </Accordion>

package/site/content/docs/recipes/sglang.mdx

@@ -26,7 +26,7 @@ drivers: {
   ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
-  ai: "lmsysorg/sglang:v0.5.16-runtime", // never :latest
+  ai: "lmsysorg/sglang:v0.5.17-runtime", // never :latest
 },
 ```
 
@@ -37,7 +37,7 @@ Or `oke ai setup --provider sglang --yes`.
 <Step>
 ### Env + GPU
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_AI_URL=http://127.0.0.1:30000/v1
 OKE_AI_MODEL=Qwen/Qwen3-0.6B
 ```

package/site/content/docs/recipes/supabase-docker.mdx

@@ -98,10 +98,34 @@ cloud pausing does not apply to this Docker image — you own uptime.
 | Container port | `5432`                                               |
 | Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries |
 | Connection URL | `postgres://user:pass@host:5432/db`                  |
+| Preload        | Image config — recipe does **not** set `command`     |
+
+## Query performance
+
+<Callout title="Do not overwrite command">
+  `supabase/postgres` already preloads `pg_stat_statements`. This recipe leaves `command` unset so
+  vendor startup stays intact.
+</Callout>
+
+| Step    | What you do                                                        |
+| ------- | ------------------------------------------------------------------ |
+| Preload | Image `postgresql.conf` (not an oke `command`)                     |
+| Create  | `CREATE EXTENSION IF NOT EXISTS pg_stat_statements`                |
+| Advisor | `CREATE EXTENSION IF NOT EXISTS index_advisor CASCADE` when listed |
+
+Console **Performance** then reads engine stats. Enable Index Advisor from the
+same view when `pg_available_extensions` lists it.
 
 ## Troubleshooting
 
 <Accordions>
+<Accordion title="PgStatStatementsNotPreloaded after a custom command">
+
+Do not replace the image entrypoint with a generic `postgres -c
+shared_preload_libraries=pg_stat_statements`. Restore the vendor command, create
+the extension, then open Store → **Performance**.
+
+</Accordion>
 <Accordion title='Extension "vector" is not available'>
 
 You pinned a plain `postgres:` image, not `supabase/postgres`, or the tag predates the

package/site/content/docs/recipes/timescale.mdx

@@ -86,16 +86,40 @@ Managed time-series hosts still use `DATABASE_URL` and
 
 ## What the recipe configures
 
-| Field          | Value                                   |
-| -------------- | --------------------------------------- |
-| Match          | `timescale` ahead of generic `postgres` |
-| Container port | `5432`                                  |
-| Healthcheck    | `pg_isready -U $POSTGRES_USER`          |
-| Connection URL | `postgres://user:pass@host:5432/db`     |
+| Field          | Value                                                  |
+| -------------- | ------------------------------------------------------ |
+| Match          | `timescale` ahead of generic `postgres`                |
+| Container port | `5432`                                                 |
+| Healthcheck    | `pg_isready -U $POSTGRES_USER`                         |
+| Connection URL | `postgres://user:pass@host:5432/db`                    |
+| Preload        | `timescaledb,pg_stat_statements` — Timescale **first** |
+
+## Query performance
+
+<Callout title="Keep timescaledb first">
+  Overwriting `command` with only `pg_stat_statements` breaks hypertables. This recipe preloads
+  `timescaledb,pg_stat_statements`. Then `CREATE EXTENSION pg_stat_statements`.
+</Callout>
+
+| Step    | What you do                                                           |
+| ------- | --------------------------------------------------------------------- |
+| Preload | Recipe sets `shared_preload_libraries=timescaledb,pg_stat_statements` |
+| Create  | `CREATE EXTENSION IF NOT EXISTS pg_stat_statements`                   |
+| Console | Store → SQL band → **Performance**                                    |
+
+Index Advisor is not in the Timescale image. Pin
+`oke-postgres-advisor:18-alpine` only if you drop Timescale — or enable
+`index_advisor` on an image that ships it.
 
 ## Troubleshooting
 
 <Accordions>
+<Accordion title="hypertables missing after a custom command">
+
+If you override compose `command`, keep `timescaledb` first in
+`shared_preload_libraries`. A `pg_stat_statements`-only preload unloads Timescale.
+
+</Accordion>
 <Accordion title='extension "timescaledb" is not available'>
 
 You pinned a plain `postgres:` image. Confirm the reference contains `timescale`,

package/site/content/docs/recipes/traefik.mdx

@@ -22,7 +22,7 @@ Traefik discovers `app` replicas from Docker labels instead of a static upstream
 
 ```typescript title="oke.config.ts"
 images: {
-  proxy: "traefik:v3.3",
+  proxy: "traefik:v3.7",
 },
 ```
 
@@ -31,7 +31,7 @@ images: {
 <Step>
 ### Hostname + ACME email
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_PROXY_HOST=app.example.com
 OKE_PROXY_ACME_EMAIL=admin@example.com
 ```
@@ -103,6 +103,13 @@ Usually `socket-proxy` is down, or `app` lacks Traefik labels. Confirm
 Logs showing Docker provider connection errors point at the socket-proxy, not Traefik
 config syntax.
 
+</Accordion>
+<Accordion title="oke dev: service app has neither an image nor a build context">
+
+`oke dev` starts infra only; the app stays on the host at `:6530`.
+Traefik labels apply when `app` is in Compose — use `oke docker` for that.
+Re-run `oke dev` after upgrading so compose drops the label-only `app`.
+
 </Accordion>
 <Accordion title="ACME email rejected / rate limited">
 
@@ -123,14 +130,10 @@ re-issuing repeatedly.
 
 <Cards>
   <Card title="Caddy" description="Single-instance alternative." href="/docs/recipes/caddy" />
+  <Card title="nginx" description="Static HTTP reverse proxy." href="/docs/recipes/nginx" />
   <Card
     title="PgDog"
     description="Pool Postgres behind the same stack."
     href="/docs/recipes/pgdog"
   />
-  <Card
-    title="Redis Cloud"
-    description="A managed backing store."
-    href="/docs/providers/redis-cloud"
-  />
 </Cards>

package/site/content/docs/recipes/vllm.mdx

@@ -26,7 +26,7 @@ drivers: {
   ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
-  ai: "vllm/vllm-openai:v0.26.0", // never :latest
+  ai: "vllm/vllm-openai:v0.27.1", // never :latest
 },
 ```
 
@@ -37,7 +37,7 @@ Or `oke ai setup --provider vllm --yes`.
 <Step>
 ### Env + GPU
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_AI_URL=http://127.0.0.1:8000/v1
 OKE_AI_MODEL=Qwen/Qwen3-0.6B
 ```

package/site/content/docs/recipes/yugabytedb.mdx

@@ -89,6 +89,12 @@ tag; the image is large and cold-start is slower than Postgres.
 | Command        | `bin/yugabyted start --base_dir=… --background=false` |
 | Healthcheck    | `ysqlsh … SELECT 1` (90s `start_period`)              |
 | Connection URL | `postgres://user:pass@host:5432/db`                   |
+| Preload        | Vendor — recipe does **not** replace `yugabyted`      |
+
+## Query performance
+
+YSQL already preloads `pg_stat_statements`. Create the extension, then open Store →
+**Performance**. Do not add a Postgres `command` overlay.
 
 ## Troubleshooting
 
@@ -104,7 +110,7 @@ Receiver or remap that port in `compose.override.yml` if you need the UI.
 </Accordion>
 <Accordion title="password authentication failed">
 
-`YSQL_PASSWORD` must match `DATABASE_URL`. Regenerate `docker/.env.docker` with
+`YSQL_PASSWORD` must match `DATABASE_URL`. Regenerate `.env.local` with
 `oke dev`. Auth is off only when `YSQL_PASSWORD` is unset — this recipe
 always sets it.
 

package/site/content/docs/reference/cli.md

@@ -18,6 +18,7 @@ oke --help                       # command list (also what bare `oke` prints whe
 oke dev                          # watch · hot reload · Console :6533 · app :6530 · MCP :6535 · docs MCP :6536
                                  #   → always Docker Compose under docker/ + host Bun
                                  #   → client types + domain schema push on save
+                                 #   → Console UI hot-reloads from source (okengine checkout; no bun run build)
 oke dev --no-db-push             #     opt out of auto oke db push on schema input save
 oke dev -d store.sql,signal      #     optional role filter (still Compose; requires Docker)
 oke test                         # bun test with PGLite posture (NODE_ENV=test, OKE_PGLITE_URL=memory://)
@@ -26,13 +27,28 @@ oke mode                         # removed — prints error; use oke dev (Compos
 
 oke start                        # runs exactly what production runs (this is the Docker CMD)
 oke doctor                       # verify secrets, ports, drivers, tenancy, schema drift
+oke console claim-code           # print setup claim code from .oke/claim-code (after Console boot)
+                                 #   → `bun run dev:console` boots kernel + Vite with a fixed
+                                 #     operator (`dev@oke.dev` / `Okengine123!`) — Sign in (prefilled)
+                                 #   → `bun run dev:console:seed` same + keel PM (all 8 elements) + ~80 traces
+                                 #     + 500+ tasks + full CRUD / custom HTTP (GET·POST·PUT·PATCH·DELETE·HEAD·QUERY)
+                                 #     + app Gate auth / oke_* system tables
+                                 #     (form/github→tasks.create→notify chain, work-management
+                                 #     SQL/KV/files/index; `oke_console` is Console operators);
+                                 #     click Traces row → highlight chain on the radial hub;
+                                 #     click a unit / element disc → 1-hop neighborhood + filter runs;
+                                 #     Replay → waterfall playhead + chain pulse on the graph)
+                                 #   → `bun run dev:console:fresh` / `:fresh:seed` — claim from scratch
+                                 #     (no fixed operator; claim code printed in the boot log)
+                                 #   → after `bun run test:console:setup`, open the HTML report:
+                                 #     `bun run test:console:setup:report` (trace + screenshots + video)
 oke stack                        # preview resolved images/tags/ports — writes nothing
 
 oke schema generate              # core + plugin stubs → .oke/schema/oke.ts (--check in CI)
 oke db push                      # domain schema.ts → live DB (dev; drizzle-kit)
 oke db generate                  # versioned SQL under drizzle/ (review)
 oke db migrate                   # apply migrations (explicit; never auto in prod)
-oke db seed                      # defineSeed (essential + env category); never at boot
+oke db seed                      # this app's defineSeed (name + essential + env); never at boot
 oke db seed --env prod --force   # CI: skip prod confirmation prompt
 oke db studio                    # drizzle-kit Studio (long-running)
 oke vault set STRIPE_KEY         # also: list · import .env · key rotate
@@ -59,7 +75,21 @@ oke upgrade                      # run codemods for a breaking change, print the
 
 `oke replay` loads a Runs WideEvent by id and re-enters the Flow with stored
 input. Defaults to dry-run when the ledger has `send` / `ask` (pass `--live`
-to override). Needs a build that persisted `WideEvent.input`.
+to override). Needs a build that persisted `WideEvent.input`. Console Traces
+Replay (`POST /console/traces/replay`) uses the same `runReplay` path.
+
+`oke dev` request lines print the WideEvent / run id after the timestamp.
+Paste it into Traces or `oke replay --request-id`.
+
+`oke dev` bridges host-app WideEvents into Console Traces: the CLI starts
+Console first, mints a loopback ingest secret, and sets `OKE_RUNS_INGEST_URL` /
+`OKE_RUNS_INGEST_SECRET` on the host child so every recorded run POSTs to
+`POST /console/runs/ingest`. Console appends into its own runs store (live
+`feedRun` → PII-masked `projectRun` for `GET /console/runs` and
+`/console/live`). `listRuns` also reads host Parquet at `.oke/runs`, so
+Traces survive a Console restart. Production recording stays opt-in —
+`oke start` does not enable the bridge; set `oke({ runs })` or
+`drivers.runs` explicitly. `oke replay` reads the same `.oke/runs` tree.
 
 In development, app, Console, MCP, and docs MCP prefer the canonical ports and move upward
 when occupied. Docker infrastructure uses stable per-project offsets in disjoint ranges for
@@ -85,7 +115,10 @@ prints immediately (wordmark + Starting + profile), then streams background work
 yellow pending/loading · red error · dim idle. Compose health keeps polling
 (`docker compose ps -a`); AI ● tracks model phase while the AI container is up.
 Boot does not wait for the model to become ready. A successful session writes
-`.oke/dev.json` (pid · ports · startedAt) and clears it on stop.
+`.oke/dev.json` (pid · ports · startedAt) and clears it on stop. Durable local
+markers live in `.oke/state.json` (`seededAt` + `seed` after the one-shot
+prompt for this app's `defineSeed({ name })`) — not in the session lock. Console session signing uses
+`.oke/console.secret` (or `OKE_CONSOLE_SECRET`); that is not a Vault secret.
 
 On a TTY, Ink keyboard controls stay active after boot (`useInput` — same
 shortcuts as before). Press `r` to clear the log pane and reprint the latest
@@ -122,7 +155,10 @@ On a TTY: pick **standard** or **advanced**, then recommended defaults or
 customize. Customize walks **Docker-first** facets once (including `store.index`
 with a `none` opt-out), then **AI setup**: Recommended (llama.cpp) · Customize ·
 Off. Writes user-global `~/.oke/create-defaults.json` (reuse only when `template`
-matches). Non-TTY / `--yes` / explicit `--template` never prompt.
+matches). Recommended / customize also ask locales, PgDog, and reverse proxy
+(Caddy / Traefik / nginx / No); **reuse** applies the saved answers without
+re-asking. Flags: `--locales`, `--pgdog` / `--no-pgdog`, `--proxy` /
+`--no-proxy`. Non-TTY / `--yes` / explicit `--template` never prompt.
 
 ### Additional commands
 
@@ -132,6 +168,7 @@ oke doctor --json                # -j  JSON on stdout; hints on stderr (agents /
 oke stack --json                 # -j
 oke images list                  # recipe · image · tag · digest · size (--json|-j)
 oke gates list                   # Module:Action catalogue (--json|-j)
+oke console claim-code           # first-admin claim from .oke/claim-code (--json|-j)
 oke ai setup --provider llama-cpp --yes  # default local AI
 oke ai setup --provider ollama --yes     # fully supported alternative
 # TTY: llama.cpp / Ollama → banner · tiers · manual; vLLM / SGLang / cloud → model
@@ -151,34 +188,34 @@ oke completion fish | source
 
 Long form is canonical in docs; short form is convenience only. Shared letters follow git’s pattern (different meanings on different subcommands — e.g. `-c` is `--check` on `schema generate`, `--config` on `stack` / `docker` / `images`).
 
-| Long                 | Short | Where                                          |
-| -------------------- | ----- | ---------------------------------------------- |
-| `--docker`           | `-d`  | `dev` (optional Compose **role filter**)       |
-| `--no-db-push`       |       | `dev`                                          |
-| `--prod`             | `-p`  | `docker`                                       |
-| `--yes`              | `-y`  | `docker clean`                                 |
-| `--all`              |       | `docker clean`                                 |
-| `--port`             | `-p`  | `start`                                        |
-| `--check`            | `-c`  | `schema generate`                              |
-| `--config`           | `-c`  | `stack`, `docker`, `images`, `db *` (drizzle)  |
-| `--apply`            | `-a`  | `upgrade`                                      |
-| `--at`               | `-a`  | `branch`                                       |
-| `--after`            | `-a`  | `doctor --diff`                                |
-| `--target`           | `-t`  | `build`                                        |
-| `--diff`             |       | `doctor`                                       |
-| `--json`             | `-j`  | `doctor`, `stack`, `images list`, `gates list` |
-| `--manifest`         | `-m`  | most Manifest readers                          |
-| `--entry`            | `-e`  | `dev`, `start`, `build`, `replay`              |
-| `--request-id`       | `-r`  | `replay`                                       |
-| `--dry-run`          |       | `replay`                                       |
-| `--live`             |       | `replay`                                       |
-| `--out` / `--outdir` | `-o`  | writers                                        |
-| `--subject`          | `-s`  | `privacy erase`                                |
-| `--before`           | `-b`  | `doctor --diff`                                |
-| `--base`             | `-B`  | `doctor --diff`                                |
-| `--env`              |       | `db *` (`dev` \| `test` \| `prod`)             |
-| `--force`            |       | `db seed`                                      |
-| `--local` / `-l`     |       | **removed** on `dev` (use `oke test`)          |
+| Long                 | Short | Where                                                                |
+| -------------------- | ----- | -------------------------------------------------------------------- |
+| `--docker`           | `-d`  | `dev` (optional Compose **role filter**)                             |
+| `--no-db-push`       |       | `dev`                                                                |
+| `--prod`             | `-p`  | `docker`                                                             |
+| `--yes`              | `-y`  | `docker clean`                                                       |
+| `--all`              |       | `docker clean`                                                       |
+| `--port`             | `-p`  | `start`                                                              |
+| `--check`            | `-c`  | `schema generate`                                                    |
+| `--config`           | `-c`  | `stack`, `docker`, `images`, `db *` (drizzle)                        |
+| `--apply`            | `-a`  | `upgrade`                                                            |
+| `--at`               | `-a`  | `branch`                                                             |
+| `--after`            | `-a`  | `doctor --diff`                                                      |
+| `--target`           | `-t`  | `build`                                                              |
+| `--diff`             |       | `doctor`                                                             |
+| `--json`             | `-j`  | `doctor`, `stack`, `images list`, `gates list`, `console claim-code` |
+| `--manifest`         | `-m`  | most Manifest readers                                                |
+| `--entry`            | `-e`  | `dev`, `start`, `build`, `replay`                                    |
+| `--request-id`       | `-r`  | `replay`                                                             |
+| `--dry-run`          |       | `replay`                                                             |
+| `--live`             |       | `replay`                                                             |
+| `--out` / `--outdir` | `-o`  | writers                                                              |
+| `--subject`          | `-s`  | `privacy erase`                                                      |
+| `--before`           | `-b`  | `doctor --diff`                                                      |
+| `--base`             | `-B`  | `doctor --diff`                                                      |
+| `--env`              |       | `db *` (`dev` \| `test` \| `prod`)                                   |
+| `--force`            |       | `db seed`                                                            |
+| `--local` / `-l`     |       | **removed** on `dev` (use `oke test`)                                |
 
 ### Exit codes
 

package/site/content/docs/reference/client.mdx

@@ -79,6 +79,9 @@ With the starter, that is `GET /health` on port **6530** when `$routes` are wire
 `oke dev` regenerates `oke-client.d.ts` from `GET /_oke/client.json`. A separate frontend repo
 runs `oke client add <url>` (default out: `oke-client.d.ts`).
 
+create-oke starters ship `web/`: Vite owns `index.html` and proxies `/notes` ·
+`/health` · `/_oke` to the app. Use `createClient("")` so the browser stays same-origin.
+
 ```bash
 oke client add http://localhost:6530
 oke client add https://api.example.com --out ./types/oke-client.d.ts
@@ -104,11 +107,11 @@ oke client add https://api.example.com --out ./types/oke-client.d.ts
 
 ## REST vs RPC
 
-| Situation                                          | Request                                                                                                  |
-| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
-| HTTP trigger with method + path on `$routes`       | That method and path (`:id` filled from input; leftover fields → query on GET/HEAD, JSON body otherwise) |
-| Adopted flow with no HTTP trigger                  | `POST {base}/_oke/{unit}/{flow}` with JSON body                                                          |
-| Incomplete proxy path (`api.notes()` with no flow) | Result error: `Incomplete path: api.notes(…)`                                                            |
+| Situation                                          | Request                                                                                                                                                        |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| HTTP trigger with method + path on `$routes`       | That method and path (`:id` filled from input; leftover fields → query on GET/HEAD, JSON body otherwise). QUERY always sends JSON (`{}` when only path params) |
+| Adopted flow with no HTTP trigger                  | `POST {base}/_oke/{unit}/{flow}` with JSON body                                                                                                                |
+| Incomplete proxy path (`api.notes()` with no flow) | Result error: `Incomplete path: api.notes(…)`                                                                                                                  |
 
 ```typescript
 // REST — createClient(app, url) saw method/path from on(http.get("/notes/:id"), …)
@@ -223,16 +226,32 @@ core today: cookie jars or plugin `.client()` decorations. Browser apps: also se
 Mount a resource, adopt the returned ops, then call the five Flows like any other:
 
 ```typescript
-const notesR = store.resource(db, notes, {/* in, out, list, unit: "notes" */});
-const mounted = on(http.resource("/notes", notesR.all()));
+const notesR = store.resource(db, notes, {/* in, out, list */});
+const mounted = on(http.resource("/notes", notesR.all()).gate.public.live());
 // .adopt({ notes: mounted }) →
-await api.notes.list({ limit: 20 }); // GET /notes?limit=20 — meta may carry nextCursor
+const page = await api.notes.list({ limit: 20 });
+const more = await page.next();
+for await (const page of api.notes.list({ limit: 20 })) page.data;
 await api.notes.get({ id }); // GET /notes/:id — NotFound when missing
 await api.notes.remove({ id }); // DELETE → 204, data undefined
 ```
 
-See [Store](/docs/elements/store) for the list query language and schemas. Auth posture for HTTP
-triggers is covered under [Gate](/docs/elements/gate).
+`meta.next` / `meta.prev` are `{ cursor }` bags — spread them, or use `page.next()`. TanStack
+`useInfiniteQuery` takes the bag, not the methods:
+
+```typescript
+useInfiniteQuery({
+  queryKey: ["notes", q],
+  queryFn: ({ pageParam }) => api.notes.list({ limit: 20, q, ...pageParam }),
+  initialPageParam: {} as { cursor?: string },
+  getNextPageParam: (last) => last.meta.next ?? undefined,
+  getPreviousPageParam: (last) => last.meta.prev ?? undefined,
+});
+```
+
+See [Store](/docs/elements/store) for the list query language and schemas. Handwritten lists use
+`fx.json.withQuery(rows, input)` for the same envelope. Auth posture for HTTP triggers is
+covered under [Gate](/docs/elements/gate).
 
 ### Signal and live queries
 
@@ -242,16 +261,16 @@ Flow that returns the current state.
 
 ## Exports
 
-| Export                                       | Kind      | Role                                              |
-| -------------------------------------------- | --------- | ------------------------------------------------- |
-| `createClient`                               | function  | Typed proxy `api.unit.flow(input?)`               |
-| `flattenRoutes`                              | function  | `$routes` → flat `unit.flow` REST table           |
-| `createTransport`                            | function  | Low-level HTTP transport (timeout / retry / auth) |
-| `isOk` / `isFail`                            | function  | Envelope predicates                               |
-| `isErrorCode` / `isTransportError`           | function  | Error narrowing                                   |
-| `Client`, `ClientOptions`, `ClientResult`, … | types     | Contracts and options                             |
-| `Register`                                   | interface | Module-augmentation slot for ambient App types    |
-| `AppOf`                                      | type      | Brand a bare route map as an App                  |
+| Export                                    | Kind      | Role                                               |
+| ----------------------------------------- | --------- | -------------------------------------------------- |
+| `createClient`                            | function  | Typed proxy `api.unit.flow(input?)`                |
+| `flattenRoutes`                           | function  | `$routes` → flat `unit.flow` REST table            |
+| `createTransport`                         | function  | Low-level HTTP transport (timeout / retry / auth)  |
+| `isOk` / `isFail`                         | function  | Envelope predicates                                |
+| `isErrorCode` / `isTransportError`        | function  | Error narrowing                                    |
+| `Client`, `ClientCall`, `ClientResult`, … | types     | Contracts, `page.next()` / `for await` of `list()` |
+| `Register`                                | interface | Module-augmentation slot for ambient App types     |
+| `AppOf`                                   | type      | Brand a bare route map as an App                   |
 
 Budget: the `./client` export stays under the measured client-runtime cap (hard gate in CI).