okengine 0.11.2 → 0.12.0

package/site/content/docs/elements/ai.mdx

@@ -81,14 +81,14 @@ export const triage = smart.prompt("ticket-triage", {
 
 ### Prompt options
 
-| Option       | Type                  | Meaning                                                        |
-| ------------ | --------------------- | -------------------------------------------------------------- |
-| `in` / `out` | zod / Standard Schema | Input and output contracts — responses validated against `out` |
-| `version`    | number                | Artifact version — diffs and regressions tracked per version   |
-| `evals`      | string                | Path to a `.jsonl` eval set, regression-gated via `oke eval`   |
-| `budget`     | object                | `maxCostPerCall` / `maxCostPerRun` — cost, not time            |
-| `via`        | `string[]`            | Ordered recovery chain of logical model names for this prompt  |
-| `timeout`    | `string \| number`    | Deadline — clock duration (`"30s"`) or milliseconds            |
+| Option       | Type                  | Meaning                                                                                |
+| ------------ | --------------------- | -------------------------------------------------------------------------------------- |
+| `in` / `out` | zod / Standard Schema | Input and output contracts — responses validated against `out`                         |
+| `version`    | number                | Artifact version — diffs and regressions tracked per version. Pins use `name@version`. |
+| `evals`      | string                | Path to a `.jsonl` eval set, regression-gated via `oke eval`                           |
+| `budget`     | object                | `maxCostPerCall` / `maxCostPerRun` — cost, not time                                    |
+| `via`        | `string[]`            | Ordered recovery chain of logical model names for this prompt                          |
+| `timeout`    | `string \| number`    | Deadline — clock duration (`"30s"`) or milliseconds                                    |
 
 ## Recovery chain + per-command timeout
 
@@ -196,9 +196,9 @@ oke ai setup --provider llama-cpp --yes
 oke ai setup --provider ollama --yes
 ```
 
-Writes `drivers.ai`, commented AI overrides in `.env.local` (so they do not
-shadow `docker/.env.docker`), and AI models into `src/core.ts`. Uncomment
-`.env.local` lines only for a host-managed AI endpoint.
+Writes `drivers.ai`, commented AI overrides in `.env.local` (so `oke
+dev --docker` can write the live compose URL), and AI models into
+`src/core.ts`. Uncomment `.env.local` only for a host-managed endpoint.
 
 **Recommended** defaults to llama.cpp (lightest local footprint). Customize
 offers llama.cpp · Ollama · vLLM · SGLang · cloud providers.
@@ -233,7 +233,7 @@ export default defineConfig({
     ai: { dev: "openai-compatible", test: "mock", prod: "anthropic" },
   },
   images: {
-    ai: "ghcr.io/ggml-org/llama.cpp:server-b10290", // ≥ b8146; never :latest
+    ai: "ghcr.io/ggml-org/llama.cpp:server-b10450", // ≥ b8146; never :latest
   },
 });
 ```
@@ -252,7 +252,7 @@ export const smart = ai.model("smart", {
 ### Ollama (fully supported alternative)
 
 Native `ollama` driver — `complete`, `stream`, `embed` without an OpenAI shim.
-Pin `ollama/ollama:0.32.6` or newer (≥ **0.17.1**). See
+Pin `ollama/ollama:0.32.13` or newer (≥ **0.17.1**). See
 [Ollama recipe](/docs/recipes/ollama).
 
 ### OpenAI-compatible endpoints (one driver)
@@ -291,17 +291,27 @@ The one you declared. There is no fallback or guess — if `prod` has no AI driv
 </Accordion>
 <Accordion title="oke boot: ollama driver needs OKE_AI_URL">
 
-Docker mode expects `OKE_AI_URL` from `docker/.env.docker` (written when `images.ai` is pinned). Keep `OKE_AI_*` in `.env.local` commented — an active `OKE_AI_URL` there wins and shadows the compose URL. Locally, the Ollama default is `http://127.0.0.1:11434`. If asks fail with `OllamaUnavailableError`, confirm the server answers at that URL and that the model is listed under `GET /api/tags` (boot pulls via `POST /api/pull` against the container — do not rely on a host `ollama pull`, which may talk to a different install). Prefer `oke ai setup` to wire driver, commented env overrides, and AI models in `src/core.ts` in one pass.
+Docker mode writes `OKE_AI_URL` into `.env.local` when `images.ai` is pinned. Leave leftover `OKE_AI_*` pins commented if you want `oke dev` to refresh that URL. Locally, the Ollama default is `http://127.0.0.1:11434`. If asks fail with `OllamaUnavailableError`, confirm the server answers at that URL and that the model is listed under `GET /api/tags` (boot pulls via `POST /api/pull` against the container — do not rely on a host `ollama pull`, which may talk to a different install). Prefer `oke ai setup` to wire driver, commented env overrides, and AI models in `src/core.ts` in one pass.
 
 </Accordion>
 <Accordion title="A prompt edit made answers worse — how do I catch that pre-merge?">
 
 Attach `evals: "./evals/<name>.jsonl"` to the prompt and run `oke eval` in CI. The suite replays the eval cases and fails on regressions, per prompt version.
 
+</Accordion>
+<Accordion title="Call API returns Unavailable ai: unknown prompt">
+
+Capability pins and Call API pass `name@version`. `fx.ask` resolves the bare
+prompt id. A pin that does not match `prompt.version` throws
+`ai: unknown prompt "name@version"`.
+
 </Accordion>
 <Accordion title="An agent looped and burned budget">
 
-Bound it at declaration: `maxSteps` caps iterations, `budget.maxCostPerRun` caps spend. The Console's AI view shows cost per run so you can tune both against real numbers.
+Bound it at declaration: `maxSteps` caps iterations, `budget.maxCostPerRun` caps spend.
+
+`fx.ask` stamps `promptVersion` on the run. Cost is recorded only when the
+driver reports `usage.cost` — tokens land on the ask journal either way.
 
 </Accordion>
 </Accordions>

package/site/content/docs/elements/channel.mdx

@@ -207,7 +207,7 @@ drivers: {
   },
 },
 images: {
-  channel: { email: "axllent/mailpit:v1.22.3" },
+  channel: { email: "axllent/mailpit:v1.30.7" },
 },
 ```
 
@@ -303,7 +303,7 @@ raw webhook JSON.
 </Accordion>
 <Accordion title="How do I know which driver finally delivered?">
 
-The receipt keeps every attempt in order with its outcome. A send that succeeded on a later driver reports status `fallback` — you can see the full chain in Console → Channels.
+The receipt keeps every attempt in order with its outcome. A send that succeeded on a later driver reports status `fallback` — you can see the full chain in Console → Flows (Traces).
 
 </Accordion>
 <Accordion title="How do I verify Web Push against a real browser?">

package/site/content/docs/elements/clock.mdx

@@ -118,6 +118,7 @@ reclaimed after its lease expires and continues at the next unfinished step.
 | Guarantee          | What it means                                                                                      |
 | ------------------ | -------------------------------------------------------------------------------------------------- |
 | Leader election    | Instances that share one CronStore fire a given tick once (lease TTL, default 30s)                 |
+| Process identity   | Boot mints one `instanceId` (`inst-<uuid>`) for Clock, Journal, and the fleet registry             |
 | Catch-up `"one"`   | Health counts every missed slot; the runtime still fires **once** when overdue — not once per miss |
 | Reconciled at boot | Named clocks land in `oke_crons`; the scheduler reads the Store, not the source                    |
 | DST detection      | Ambiguous local times get a Console warning — schedules are not rewritten or blocked               |
@@ -156,7 +157,11 @@ drivers: {
 
 ## Operating schedules from the Console
 
-The Console (`:6533` → Clock) lists every named clock with health — drift, overdue, missed runs + catch-up `"one"`, and which replica holds the leader lease.
+The Console (`:6533` → `/flows`) lists clock-triggered flows in the cron / every bands.
+
+Named clocks still carry health — drift, overdue, missed runs + catch-up `"one"`, and the lease holder.
+
+`/observability` adds an Instances chip from `GET /console/instances` (alive ⇔ presence TTL not expired). A cron lease holder is not a fleet census.
 
 From there you can **pause** any cron, **wake early** a sleeping durable run, or **edit the schedule** when `overridable: true`. Edit on a locked clock throws `ScheduleNotOverridableError` (`clock "…" is not overridable`).
 
@@ -188,6 +193,11 @@ Emit it from inside a flow with `fx.clock.sleep(label, duration)` before the wor
 They are not sharing one CronStore. In-memory leases are per process. Point every replica at the same
 `postgres` CronStore (`DATABASE_URL`), or use `file` on a shared volume for single-host multi-process.
 
+</Accordion>
+<Accordion title="Observability says no fleet">
+
+The registry is off in `test` and when there is no shared SQL URL. `dev`/`prod` write `oke_instances` on the same Postgres as Clock. Unbound is empty — not `0 alive`.
+
 </Accordion>
 </Accordions>
 

package/site/content/docs/elements/flow.mdx

@@ -71,15 +71,16 @@ curl -X POST localhost:6530/orders -d '{"sku":"SKU-1","qty":2}' -H 'content-type
 
 ## Anatomy of a Flow
 
-| Part         | Role                                                                       |
-| ------------ | -------------------------------------------------------------------------- |
-| trigger      | What starts the flow — `http`, a signal, `every`, a row change             |
-| `in`         | Input contract — validated before `do` runs; bad input is a 422            |
-| `out`        | Output contract — the return value is checked against it                   |
-| `errors`     | Typed failures — **returned** with `fx.fail`, never thrown                 |
-| `retry`      | Optional whole-`do` backoff on thrown errors (same journal)                |
-| `do`         | The work — every read, write, emit, and call goes through `fx`             |
-| `compensate` | Durable only — optional hook after auto per-step `{ undo }` (same journal) |
+| Part         | Role                                                                              |
+| ------------ | --------------------------------------------------------------------------------- |
+| trigger      | What starts the flow — `http`, a signal, `every`, a row change                    |
+| `in`         | Input contract — validated before `do` runs; bad input is a 422                   |
+| `out`        | Output contract — the return value is checked against it                          |
+| `errors`     | Typed failures — **returned** with `fx.fail`, never thrown                        |
+| `retry`      | Optional whole-`do` backoff on thrown errors (same journal)                       |
+| `cache`      | Optional — `false` opts out; `"30s"` adds a TTL. Read-only flows cache by default |
+| `do`         | The work — every read, write, emit, and call goes through `fx`                    |
+| `compensate` | Durable only — optional hook after auto per-step `{ undo }` (same journal)        |
 
 Failures are values, not exceptions:
 
@@ -97,12 +98,24 @@ Every response follows one envelope — success `{ data, error: null }`, failure
 `{ data: null, error: { code, data, message? } }` — clients switch on `error.code`.
 Built-in codes attach a localized `message` ([Errors](/docs/reference/errors)); custom codes stay message-less unless registered or `{ message }` is passed.
 
+<Callout title="List pages">
+  Prefer `out` as the item array and `return fx.json.withQuery(rows, input)` so the pager is
+  top-level `meta`. Do not put `{ data, meta }` on `out`. See
+  [Store](/docs/elements/store#handwritten-http-lists).
+</Callout>
+
 ## The five triggers
 
 <FlowTriggers />
 
 ### http — a request arrives
 
+`http.get` · `http.post` · `http.put` · `http.patch` · `http.delete` · `http.head` · `http.options` · `http.query`. QUERY (RFC 10008) is a safe, idempotent read with a JSON body.
+
+`Content-Type: application/json` is required — missing → **400** `InvalidQuery`, anything else → **415** `UnsupportedMediaType` with `Accept-Query: "application/json"`. Invalid JSON is **400** (no sniffing). Responses advertise `Accept-Query`. okengine does not assign `Location` / `Content-Location` result URIs.
+
+A browser `GET` (`Accept` prefers `text/html`) paints the `{ data, error }` envelope in traces chrome — status, latency, and cache, Routes rail (static GET links), copy, line numbers, Pretty / Raw, Console on **6533**. `curl`, `Accept: application/json`, and `?format=json` stay JSON.
+
 ```typescript
 export const findOrder = on(
   http.get("/orders/:id").gate(member), // gates evaluate before do runs
@@ -204,6 +217,24 @@ Everything a flow may touch, on one object:
   cache invalidation, least-privilege tokens, and durable replay.
 </Callout>
 
+## Cache — automatic for reads
+
+Read-only flows cache automatically from those inferred `reads`. A write to the same
+resource invalidates the entry. You do not declare `effects` or set `cache: "30s"`
+unless you want a TTL or to opt out.
+
+| On the flow      | What happens                            |
+| ---------------- | --------------------------------------- |
+| omitted / `true` | Tier-1 cache when the flow only `reads` |
+| `cache: "30s"`   | Same, plus a TTL                        |
+| `cache: false`   | Skip cache (live SQL every time)        |
+
+Mutations, `fx.ask`, and `durable: true` stay uncached. Console Traces shows **hit** /
+**miss** on cached reads, and **not applicable** only when the flow never used the cache.
+
+A hit records the cache lookup on the waterfall (`computed:…` reads), not a replay of
+the original store reads.
+
 ## Durability — flows that survive the process
 
 <FlowDurable />
@@ -255,12 +286,9 @@ export const chargeOrder = flow("payments.chargeOrder", {
 });
 ```
 
-The runtime journals undos as `undo:<name>` under status `compensating`, then commits
-`failed`. Orphan reclaim resumes that phase without re-entering forward work.
-`flow.compensate` remains an optional hook after auto undos for cross-cutting cleanup.
-`JournalSuspend` (sleep) is park, not failure — undo does not run.
-Use `fx.using` for same-attempt cleanup; `{ undo }` for durable external effects — not both
-for the same release.
+The runtime journals undos as `undo:<name>` under `compensating`, then commits `failed`.
+Orphan reclaim resumes that phase; `flow.compensate` is optional after auto undos.
+`JournalSuspend` is park (no undo). Prefer `fx.using` or `{ undo }` — not both for one release.
 
 ## Composition is just calls
 
@@ -306,10 +334,32 @@ Only after terminal failure for that journal attempt — not on sleep, not mid-r
 
 Make it a plain flow with no trigger and `fx.call` it. You keep contracts, the Manifest entry, and tracing; a bare function would hide the work from the effect graph.
 
+</Accordion>
+<Accordion title="The browser shows a code block instead of JSON">
+
+That is the HTML view for a navigated `GET` when `Accept` prefers `text/html`. Send `Accept: application/json`, add `?format=json`, or use `curl` — the envelope is unchanged. `?raw=1` is the compact view of the same page.
+
+</Accordion>
+<Accordion title="GET on a POST-only path">
+
+The router returns **405 Method Not Allowed** with `Allow` listing every method bound to that path. A path that no flow owns is still 404. When QUERY is allowed, the 405 also carries `Accept-Query: "application/json"`.
+
+</Accordion>
+<Accordion title="QUERY without Content-Type">
+
+RFC 10008 forbids sniffing. Send `Content-Type: application/json` and a JSON body. Missing header → `InvalidQuery` **400**; `text/plain` (or any non-JSON type) → `UnsupportedMediaType` **415**.
+
 </Accordion>
 <Accordion title="What happens if a cron flow throws?">
 
-Only that run fails — the schedule keeps firing and the process does not exit. The failed run lands in Console → Runs with its trace.
+Only that run fails — the schedule keeps firing and the process does not exit. The failed run lands in Console → Flows (Traces) with its trace.
+
+</Accordion>
+<Accordion title="Console shows Cache not applicable on a GET">
+
+The flow is not a read-only cache candidate — it writes, asks a model, is durable, or set
+`cache: false`. Leave `cache` omitted. The first identical GET is a **miss**; the second is
+a **hit**. A matching write turns the next read into a miss.
 
 </Accordion>
 </Accordions>

package/site/content/docs/elements/gate.mdx

@@ -10,7 +10,7 @@ burned its minute quota? Attach gates to the HTTP trigger — the pipeline check
 store write, emit, or channel send runs.
 
 <Callout title="The one rule">
-  Every HTTP trigger declares posture: attach a real gate, or attach `gate.public`. Omitting both
+  Every HTTP trigger declares posture: attach a real gate, or attach `.gate.public`. Omitting both
   fails boot. Denial is a typed error value — never a thrown exception mid-`do`.
 </Callout>
 
@@ -65,15 +65,17 @@ import { on, flow, http, gate } from "okengine";
 import { member, canBook, fair } from "../../gates";
 
 export const health = on(
-  http.get("/health").gate(gate.public),
+  http.get("/health").gate.public,
   flow("health.check", {
     out: HealthOut,
     do: () => ({ ok: true as const }),
   }),
 );
 
+export const write = gate.all(member, canBook, fair);
+
 export const shorten = on(
-  http.post("/links").gate(member, canBook, fair),
+  http.post("/links").gate(write),
   flow("links.shorten", {
     in: NewLink,
     out: LinkCode,
@@ -85,7 +87,9 @@ export const shorten = on(
 );
 ```
 
-Do **not** put `gate.public` in `gate.policies` — attach it on the trigger only.
+A single gate stays `.gate(member)`. Reuse two or more with `gate.all` — `.gate(write)`
+flattens. `http.resource(path, ops).gate(...)` stamps every verb. Do **not** put
+`gate.public` in `gate.policies` — attach it on the trigger only.
 
 </Step>
 
@@ -108,15 +112,15 @@ A denied request never reaches `do`. It returns one of three typed failures:
 
 <GatePipeline />
 
-`.gate(member, canBook, fair)` evaluates left to right — first denial wins
-(`Unauthorized` · `Forbidden` · `RateLimited`); later gates are skipped. `do`
-runs only when every gate passed.
+`.gate(member, canBook, fair)` and `.gate(write)` (from `gate.all`) evaluate left
+to right — first denial wins (`Unauthorized` · `Forbidden` · `RateLimited`); later
+gates are skipped. `do` runs only when every gate passed.
 
 ## `oke({ gate })` bag
 
 | Option          | Type                    | Default  | Meaning                                                         |
 | --------------- | ----------------------- | -------- | --------------------------------------------------------------- |
-| `policies`      | `GateDecl[]`            | `[]`     | Named policy / rate decls for the Gate runtime                  |
+| `policies`      | `GateDecl[]`            | `[]`     | Policy / rate decls — `gate.all` handles flatten to members     |
 | `auth`          | `GateAuthOptions`       | —        | Builtin hybrid sessions + `/auth/*` Flows (see below)           |
 | `rateLimit`     | `{ enabled?: boolean }` | see note | When auth is on, defaults `true` — stricter rates on auth paths |
 | `unguardedHttp` | `"deny"` \| `"allow"`   | `"deny"` | `"allow"` skips posture audit **only** when `env === "test"`    |
@@ -127,13 +131,17 @@ runs only when every gate passed.
 | ------------------------------------- | ------------------------------------------- | ---------------------------------- |
 | `gate.policy(name, check \| options)` | Is this principal allowed? (ABAC)           | auth / operator / request metadata |
 | `gate.scope(name)`                    | Does `auth.scopes` contain this exact name? | `auth.scopes`                      |
-| `gate.public`                         | Intentionally unauthenticated surface       | always allows                      |
+| `gate.public` / `.gate.public`        | Intentionally unauthenticated surface       | always allows                      |
 | `gate.rate(options)`                  | Is there budget left for this subject?      | an atomic counter on the kv driver |
+| `gate.all(...members)`                | Reuse this chain on many triggers           | flattens; each member is evaluated |
 
 Pass `{ check, description }` on `gate.policy` when you want a human title in the Console (falls
 back to the policy name). The name `"public"` is reserved — use `gate.public`, not
 `gate.policy("public", …)`.
 
+`gate.all()` with no members throws. Nested `all` handles flatten.
+`oke({ gate: { policies: [write] } })` registers the members.
+
 ### Policy context
 
 | Field      | Contents                                                 |
@@ -170,11 +178,11 @@ driver in tests. Boot opens a dedicated `oke:gates` namespace on **`drivers.stor
 
 ## Auth posture at boot
 
-Every HTTP trigger must carry a gate or `gate.public`. Omitting both fails boot with
+Every HTTP trigger must carry a gate or `.gate.public`. Omitting both fails boot with
 `GateBootError` — message starts with `gate boot failed —` and lists every gap.
 
 ```typescript
-on(http.get("/health").gate(gate.public), flow("health.check", {/* … */}));
+on(http.get("/health").gate.public, flow("health.check", {/* … */}));
 on(http.post("/bookings").gate(member, canBook), flow("bookings.create", {/* … */}));
 ```
 
@@ -183,7 +191,7 @@ on(http.post("/bookings").gate(member, canBook), flow("bookings.create", {/* …
 posture but does **not** authenticate.
 
 `gate: { unguardedHttp: "allow" }` skips the audit **only** when `env === "test"`.
-In `dev` / `prod` migrate with per-trigger `gate.public`.
+In `dev` / `prod` migrate with per-trigger `.gate.public`.
 
 ## Built-in auth (`gate.auth`)
 
@@ -215,24 +223,24 @@ export const app = oke({
 | `POST /auth/revoke`        | when `gate.auth` is set                |
 | `GET /auth/me`             | Bearer session (`auth.session` policy) |
 
-| Auth option                                 | Default   | Meaning                                                                        |
-| ------------------------------------------- | --------- | ------------------------------------------------------------------------------ |
-| `secret`                                    | minted\*  | HMAC for access tokens (\*`prod` requires you set it)                          |
-| `basePath`                                  | `"/auth"` | HTTP prefix for auth Flows                                                     |
-| `http`                                      | `true`    | `false` = secret/tables only (no `/auth/*` Bindings)                           |
-| `audience`                                  | `oke-app` | Audience stamped on access tokens                                              |
-| `emailAndPassword.enabled`                  | `false`   | Sign-up / sign-in email Flows                                                  |
-| `emailAndPassword.requireEmailVerification` | `false`   | Block sign-in until email is verified                                          |
-| `passwordPolicy`                            | secure\*  | `\*` minLength 12, letter + number; sign-up → `AuthFailed` / `password_policy` |
-| `breachCheck`                               | unset     | `(password) => Promise<boolean>` — `true` rejects as `password_breached`       |
-| `session.freshAgeMs`                        | 24h       | Window for step-up `auth.fresh` policy                                         |
-| `session.accessTtlMs` / `refreshTtlMs`      | 14m / 30d | Access / refresh lifetimes                                                     |
-| `session.idleTtlMs`                         | unset     | Opt-in: reject refresh when idle too long                                      |
-| `session.absoluteTtlMs`                     | unset     | Opt-in: hard cap from session creation                                         |
-| `session.singleSessionPerUser`              | `false`   | Opt-in: issuing a session revokes other families for that user                 |
-| `cookies.enabled`                           | `false`   | Opt-in HttpOnly cookie mirror (Bearer stays default)                           |
-| `secondaryStorage.enabled`                  | `false`   | Hot auth data in `store.kv` when configured                                    |
-| `user` / `session` / …                      | defaults  | `modelName` / `fields` / `additionalFields`                                    |
+| Auth option                                 | Default   | Meaning                                                                                                                    |
+| ------------------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `secret`                                    | minted\*  | HMAC for access tokens (\*`prod` requires you set it)                                                                      |
+| `basePath`                                  | `"/auth"` | HTTP prefix for auth Flows                                                                                                 |
+| `http`                                      | `true`    | `false` = secret/tables only (no `/auth/*` Bindings)                                                                       |
+| `audience`                                  | `oke-app` | Audience stamped on access tokens                                                                                          |
+| `emailAndPassword.enabled`                  | `false`   | Sign-up / sign-in email Flows                                                                                              |
+| `emailAndPassword.requireEmailVerification` | `false`   | Block sign-in until email is verified                                                                                      |
+| `passwordPolicy`                            | secure\*  | `\*` minLength 8, letter + number + upper + lower + special (`requireSpecial`); sign-up → `AuthFailed` / `password_policy` |
+| `breachCheck`                               | unset     | `(password) => Promise<boolean>` — `true` rejects as `password_breached`                                                   |
+| `session.freshAgeMs`                        | 24h       | Window for step-up `auth.fresh` policy                                                                                     |
+| `session.accessTtlMs` / `refreshTtlMs`      | 14m / 30d | Access / refresh lifetimes                                                                                                 |
+| `session.idleTtlMs`                         | unset     | Opt-in: reject refresh when idle too long                                                                                  |
+| `session.absoluteTtlMs`                     | unset     | Opt-in: hard cap from session creation                                                                                     |
+| `session.singleSessionPerUser`              | `false`   | Opt-in: issuing a session revokes other families for that user                                                             |
+| `cookies.enabled`                           | `false`   | Opt-in HttpOnly cookie mirror (Bearer stays default)                                                                       |
+| `secondaryStorage.enabled`                  | `false`   | Hot auth data in `store.kv` when configured                                                                                |
+| `user` / `session` / …                      | defaults  | `modelName` / `fields` / `additionalFields`                                                                                |
 
 HIBP via `createHibpBreachCheck` from `okengine/auth` (k-anonymity range API; requires
 `userAgent`; `onError` defaults to `"reject"` — fail closed while the check is enabled):
@@ -248,10 +256,9 @@ gate: {
 }
 ```
 
-Customize tables, then run `oke schema generate` (writes `.oke/schema/oke.ts`;
-supports `--check` in CI). Extra sign-in
-shapes: [Plugins](/docs/plugins) (username, magic link, OTP, TOTP, passkeys). Call auth from
-[createClient](/docs/reference/client) — one client, helpers in `okengine/client/auth`.
+Customize tables, then `oke schema generate` (`.oke/schema/oke.ts`; `--check` in CI). Extra
+sign-in shapes: [Plugins](/docs/plugins). Call auth from
+[createClient](/docs/reference/client) — helpers in `okengine/client/auth`.
 
 ## Identity and decisions
 
@@ -259,8 +266,8 @@ Gates decide on principals that already exist. `gate.auth` issues hybrid session
 `fx.auth` (Console: `fx.operator`). Audit across `fx.call` uses read-only `fx.principal`
 (see [fx](/docs/reference/fx)).
 
-Pass **and** deny land on the run's `gates` dimension. Console (`:6533` → Gates) shows the
-chain. Rate `overridable` is a catalog flag only — Clock schedules are what the Console can
+Pass **and** deny land on the run's `gates` dimension. Console (`:6533` → `/flows`) shows the
+chain on the flow contract. Rate `overridable` is a catalog flag only — Clock schedules are what the Console can
 edit live today.
 
 ## Troubleshooting
@@ -268,7 +275,7 @@ edit live today.
 <Accordions>
 <Accordion title="Boot: gate boot failed — N HTTP trigger(s) missing auth posture">
 
-Empty `.gate(...)` chain. Attach a policy/rate gate, or `.gate(gate.public)`. First `fetch`
+Empty `.gate(...)` chain. Attach a policy/rate gate, or `.gate.public`. First `fetch`
 auto-boots — do not rely on `gate.unguardedHttp: "allow"` outside `env: "test"`.
 
 </Accordion>
@@ -291,8 +298,9 @@ Set `gate.auth.secret` (or provide it before boot). Non-prod may mint a developm
 </Accordion>
 <Accordion title="Sign-up returns AuthFailed password_policy">
 
-Default policy requires length ≥ 12 plus a letter and a number. Short passwords like `"123"`
-are rejected — not accepted silently. Tighten or loosen via `gate.auth.passwordPolicy`.
+Default policy: length ≥ 8 plus upper, lower, number, and special (`"123"` is rejected).
+Tighten via `gate.auth.passwordPolicy`. Console claim uses min length 12 with the same
+character classes.
 
 </Accordion>
 <Accordion title="Which keyBy should I use?">

package/site/content/docs/elements/signal.mdx

@@ -182,7 +182,7 @@ const unsub = await bus.live("order-status", (payload) => {
 
 `once` signals retry automatically. Every attempt keeps a **typed failure reason**, and the full attempt history survives into the DLQ — so when a message lands there you see _why_ each attempt failed, not just that it did.
 
-The **Console** (`:6533` → Signals) shows the topology (which flows emit and consume each signal), per-subscriber delivery stats, and the DLQ contents with replay / discard controls — no separate broker UI to run.
+The **Console** (`:6533` → `/overview`) shows emit and consume on the graph, and delivery attempts in Traces — no separate broker UI to run.
 
 <Callout title="Orphan emits and schema fail loudly">
   Zero subscribers throws **OKE1042** unless `optional: true`. A payload that fails the signal's
@@ -268,7 +268,7 @@ The payload failed the signal's Standard Schema at emit time — nothing was sta
 </Accordion>
 <Accordion title="A message keeps retrying and then disappears">
 
-When `attempts > retries` the message moves to the DLQ (if `deadLetter: true`) — it is not lost. Open Console → Signals, inspect the typed failure reasons, fix the consumer, then replay.
+When `attempts > retries` the message moves to the DLQ (if `deadLetter: true`) — it is not lost. Open Console → Flows, inspect the typed failure on the trace, fix the consumer, then replay.
 
 </Accordion>
 <Accordion title="once vs broadcast vs live — how do I choose?">