okengine 0.11.2 → 0.13.0

package/site/content/docs/recipes/llama-cpp.mdx

@@ -26,7 +26,7 @@ drivers: {
   ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
-  ai: "ghcr.io/ggml-org/llama.cpp:server-b10290", // never :latest
+  ai: "ghcr.io/ggml-org/llama.cpp:server-b10450", // never :latest
 },
 ```
 
@@ -39,15 +39,14 @@ for `granite3.3:2b`.
 <Step>
 ### Env written by the stack
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_AI_URL=http://127.0.0.1:8080/v1
 OKE_AI_MODEL=granite3.3:2b
 ```
 
 `OKE_AI_MODEL` is a Docker Hub `ai/<id>` model. The recipe writes
-`.oke/llama-entrypoint.py` (generated, gitignored — not app source), which
-Hub-pulls into the cache volume, then starts `llama-server -m <gguf> --alias <id>`
-(single-model).
+`.oke/llama-entrypoint.py` (generated, gitignored), Hub-pulls into the cache
+volume, then starts `llama-server -m <gguf> --alias <id>` (single-model).
 
 Never set `LLAMA_ARG_MODELS_PRESET` / `LLAMA_ARG_DOCKER_REPO` — those hang on
 b10290+. `oke dev` shows the model id and polls `/v1/models` until `ready`
@@ -127,7 +126,7 @@ First start Hub-pulls the curated `ai/` model into the named cache volume
 (see logs: `oke ai: ensuring…` / download %). Prefer `oke ai setup` tiers
 (Ultra Fast → `granite3.3:2b`) for smoke tests.
 
-Confirm `OKE_AI_MODEL` in `docker/.env.docker` (keep the `.env.local` hint commented so it does not shadow compose). Watch `oke
+Confirm `OKE_AI_MODEL` in `.env.local`. Watch `oke
 dev` until AI status is `ready`.
 
 If status stays `loading` on Compose that still uses `--models-preset`,

package/site/content/docs/recipes/mailpit.mdx

@@ -28,7 +28,7 @@ drivers: {
   },
 },
 images: {
-  channel: { email: "axllent/mailpit:v1.22.3" },
+  channel: { email: "axllent/mailpit:v1.30.7" },
 },
 ```
 
@@ -37,7 +37,7 @@ images: {
 <Step>
 ### Connect the smtp driver
 
-```bash title="docker/.env.docker (written by oke docker)"
+```bash title=".env.local (written by oke docker)"
 SMTP_URL=smtp://127.0.0.1:1025
 MAILPIT_UI_URL=http://127.0.0.1:8025
 ```
@@ -100,7 +100,7 @@ if SMTP still accepts mail.
 <Accordion title="oke boot: smtp driver needs SMTP_URL">
 
 The smtp binder refuses to start without `SMTP_URL` (or `OKE_CHANNEL_EMAIL_URL`). In
-under `oke dev` the error asks whether Compose wrote `docker/.env.docker`. Also rejects
+under `oke dev` the error asks whether Compose wrote `.env.local`. Also rejects
 non-`smtp://` schemes: `oke boot: SMTP_URL must use smtp://`.
 
 </Accordion>

package/site/content/docs/recipes/meilisearch.mdx

@@ -28,7 +28,7 @@ drivers: {
   },
 },
 images: {
-  store: { index: "getmeili/meilisearch:v1.14" },
+  store: { index: "getmeili/meilisearch:v1.53" },
 },
 ```
 
@@ -37,7 +37,7 @@ images: {
 <Step>
 ### Keys written by oke docker
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_STORE_INDEX_URL=http://127.0.0.1:7700
 OKE_STORE_INDEX_KEY=…          # also accepted as MEILI_MASTER_KEY
 ```
@@ -78,7 +78,7 @@ Writes wait on Meilisearch tasks before returning.
 **Backup means:** snapshot/restore that named volume (or Meilisearch dumps). Recreating
 the container **keeps** data if the volume remains; deleting the volume wipes every index.
 
-The master key is **not** inside the volume — it lives in `.env.docker` / secrets.
+The master key is **not** inside the volume — it lives in `.env.local` / secrets.
 Losing the key without a backup blocks admin API access even if data remains.
 
 ## Production note
@@ -104,7 +104,7 @@ not FTS. See [Store · Index](/docs/elements/store#index).
 <Accordion title="oke boot: meilisearch index needs OKE_STORE_INDEX_URL">
 
 No silent memory fallback. Re-run `oke dev` or export `OKE_STORE_INDEX_URL`.
-Docker-mode wording asks whether `docker/.env.docker` was written.
+Docker-mode wording asks whether `.env.local` was written.
 
 </Accordion>
 <Accordion title="meilisearch index: GET/POST … failed (403) — or master key errors">

package/site/content/docs/recipes/meta.json

@@ -16,6 +16,7 @@
     "---Proxy---",
     "caddy",
     "traefik",
+    "nginx",
     "---Services---",
     "pgdog",
     "rustfs",

package/site/content/docs/recipes/nginx.mdx

@@ -0,0 +1,117 @@
+---
+title: "nginx"
+description: "Static reverse proxy via a generated nginx.conf — HTTP on :80 when you bring your own TLS edge."
+icon: "Lock"
+source: "docs/spec/unified-theory.md"
+---
+
+nginx is the classic static reverse proxy — a generated `nginx.conf` forwards to
+`app:6530` on the compose network. Right choice when TLS already terminates elsewhere
+(Cloudflare, ALB, another edge) or you want a hand-edited config.
+
+<Callout title="The one rule">
+  Leave `images.proxy` unset until you need an edge in front of the app. Pin nginx for a static HTTP
+  proxy; prefer [Caddy](/docs/recipes/caddy) or [Traefik](/docs/recipes/traefik) when you want
+  automatic HTTPS in the same stack.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### Pin the proxy
+
+```typescript title="oke.config.ts"
+images: {
+  proxy: "nginx:1.31-alpine",
+},
+```
+
+`create-oke` offers **nginx** in **Add a reverse proxy…?** (or `--proxy nginx`).
+
+</Step>
+
+<Step>
+### Include the proxy layer
+
+```bash
+docker compose -f docker-compose.yml up -d
+```
+
+Generated `nginx.conf`: `upstream oke_app { server app:6530; }` with
+`proxy_pass http://oke_app` on `:80`. The app host port (`6530`) is unpublished —
+traffic enters through the proxy.
+
+</Step>
+
+<Step>
+### Put TLS in front (optional)
+
+Point Cloudflare / an ALB / another terminator at host `:80`, or switch the pin to
+Caddy / Traefik when you want ACME inside Compose.
+
+</Step>
+
+</Steps>
+
+## Required env
+
+| Variable                | Required?  | Meaning                                                                     |
+| ----------------------- | ---------- | --------------------------------------------------------------------------- |
+| `OKE_PROXY_HOST`        | Optional   | Documented for the proxy role; nginx listens on any `Host` (`_`)            |
+| `allowedHosts` (config) | Production | Must include the public hostname — see [Security](/docs/reference/security) |
+
+## Data and backup
+
+| Volume / bind | Path                                        | What it stores        |
+| ------------- | ------------------------------------------- | --------------------- |
+| Bind mount    | `./nginx.conf` → `/etc/nginx/nginx.conf:ro` | Generated site config |
+
+**Backup means:** the `nginx.conf` is regenerated by `oke docker`. Keep overrides in
+`compose.override.yml` or a replaced file if you customize routing.
+
+## Production note
+
+nginx here is **HTTP-only** on port 80 — no ACME, no Docker service discovery. For
+automatic HTTPS use [Caddy](/docs/recipes/caddy). For `--scale app=N` use
+[Traefik](/docs/recipes/traefik).
+
+**Consequence:** `OKE_PROXY_URL` is `http://…` for this recipe (Caddy / Traefik use
+`https://…`).
+
+## Troubleshooting
+
+<Accordions>
+<Accordion title="App still publishes 6530">
+
+You still have `6530:6530` on `app`. Confirm `images.proxy` is set and
+`oke docker` regenerated compose so the app host bind was omitted.
+
+</Accordion>
+<Accordion title="502 Bad Gateway from nginx">
+
+The upstream is `app:6530` on the `oke` network. Confirm the app service is healthy
+and shares that network. Override `nginx.conf` only after checking the generated
+upstream block.
+
+</Accordion>
+</Accordions>
+
+## Learn more
+
+- [Reverse proxy](/docs/deployment/reverse-proxy) — Caddy / Traefik / nginx choice
+- [Docker · Reverse proxy](/docs/deployment/docker#reverse-proxy) — compose layer order
+- [Security](/docs/reference/security) — `allowedHosts`
+
+## Next
+
+<Cards>
+  <Card title="Caddy" description="Automatic HTTPS alternative." href="/docs/recipes/caddy" />
+  <Card title="Traefik" description="Multi-replica alternative." href="/docs/recipes/traefik" />
+  <Card
+    title="PgDog"
+    description="Pool Postgres behind the same stack."
+    href="/docs/recipes/pgdog"
+  />
+</Cards>

package/site/content/docs/recipes/ollama.mdx

@@ -26,7 +26,7 @@ drivers: {
   ai: { dev: "ollama", test: "mock", prod: "ollama" }, // or set prod deliberately
 },
 images: {
-  ai: "ollama/ollama:0.32.6", // never :latest — floor 0.17.1 (CVE-2026-7482)
+  ai: "ollama/ollama:0.32.13", // never :latest — floor 0.17.1 (CVE-2026-7482)
 },
 ```
 
@@ -37,7 +37,7 @@ Or run `oke ai setup --provider ollama --yes`.
 <Step>
 ### Env written by the stack
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_AI_URL=http://127.0.0.1:11434
 OKE_AI_MODEL=qwen3.5:9b
 ```
@@ -114,7 +114,7 @@ PII egress rules treat `ollama` as local — see [AI · PII](/docs/elements/ai).
 <Accordions>
 <Accordion title="oke boot: ollama driver needs OKE_AI_URL">
 
-Docker mode expects `OKE_AI_URL` from `docker/.env.docker` when `images.ai` is pinned.
+Docker mode expects `OKE_AI_URL` from `.env.local` when `images.ai` is pinned.
 Locally the default is `http://127.0.0.1:11434`. Prefer `oke ai setup` to wire everything
 in one pass.
 

package/site/content/docs/recipes/pgdog.mdx

@@ -26,7 +26,7 @@ create-oke asks **Add PgDog connection pooling…?** (or pass `--pgdog`). Manual
 ```typescript title="oke.config.ts"
 images: {
   "store.sql": "postgres:18-alpine",
-  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.51",
+  pgdog: "ghcr.io/pgdogdev/pgdog:v0.1.53",
 },
 ```
 

package/site/content/docs/recipes/postgres.mdx

@@ -37,7 +37,7 @@ oke dev
 ```
 
 `oke docker` writes `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB` into
-`docker/.env.docker` as `${OKE_STORE_SQL_USER}` / `${OKE_STORE_SQL_PASSWORD}` /
+`.env.local` as `${OKE_STORE_SQL_USER}` / `${OKE_STORE_SQL_PASSWORD}` /
 `${OKE_STORE_SQL_DB}` refs — never literal secrets in compose YAML.
 
 </Step>
@@ -93,11 +93,37 @@ Scale out with [PgDog](/docs/recipes/pgdog) so `N × Bun.SQL pool` does not exha
 
 ## What the recipe configures
 
-| Field          | Value                                                |
-| -------------- | ---------------------------------------------------- |
-| Container port | `5432`                                               |
-| Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries |
-| Connection URL | `postgres://user:pass@host:5432/db`                  |
+| Field          | Value                                                     |
+| -------------- | --------------------------------------------------------- |
+| Container port | `5432`                                                    |
+| Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries      |
+| Connection URL | `postgres://user:pass@host:5432/db`                       |
+| Preload        | `postgres -c shared_preload_libraries=pg_stat_statements` |
+
+## Query performance
+
+<Callout title="Preload, then create">
+  `pg_stat_statements` must load at postmaster start. `CREATE EXTENSION` alone is not enough.
+  Recreate `store-sql` after a recipe change — the data volume can stay.
+</Callout>
+
+| Step    | What you do                                                       |
+| ------- | ----------------------------------------------------------------- |
+| Preload | Recipe already sets `shared_preload_libraries=pg_stat_statements` |
+| Create  | `CREATE EXTENSION IF NOT EXISTS pg_stat_statements`               |
+| Console | Store → SQL band → **Performance**                                |
+
+Default `postgres:18-alpine` does **not** ship `hypopg` / `index_advisor`. Pin the
+opt-in image when you want Suggest indexes:
+
+```typescript title="oke.config.ts"
+images: {
+  "store.sql": "oke-postgres-advisor:18-alpine",
+},
+```
+
+`oke docker` writes `Dockerfile.postgres-advisor` and a compose `build:`. Driver id
+stays `postgres`. Suggest copies `CREATE INDEX` DDL — it does not create indexes.
 
 ## Troubleshooting
 
@@ -105,16 +131,26 @@ Scale out with [PgDog](/docs/recipes/pgdog) so `N × Bun.SQL pool` does not exha
 <Accordion title="oke boot: postgres driver needs DATABASE_URL">
 
 The `postgres` driver fails boot when neither `DATABASE_URL` nor `OKE_STORE_SQL_URL` is
-set. Re-run `oke dev` so the stack writes `docker/.env.docker`, or export
+set. Re-run `oke dev` so the stack writes `.env.local`, or export
 `DATABASE_URL` yourself when pointing at a managed host.
 
+</Accordion>
+<Accordion title="PgStatStatementsNotPreloaded">
+
+The Console Performance view needs the library preloaded **and** the extension
+created. Recreate `store-sql` so the new `command` applies, then run
+`CREATE EXTENSION IF NOT EXISTS pg_stat_statements`.
+
+Existing clusters that started before this recipe change keep the old
+postmaster flags until recreate.
+
 </Accordion>
 <Accordion title="pg_isready fails / store-sql unhealthy">
 
 Wrong `POSTGRES_USER` or the container is still initializing. Check
 `docker compose … logs store-sql` for `database system is ready to accept connections`.
 
-Credential refs must resolve in `.env.docker` — empty `${OKE_STORE_SQL_PASSWORD}` leaves
+Credential refs must resolve in `.env.local` — empty `${OKE_STORE_SQL_PASSWORD}` leaves
 Postgres refusing auth.
 
 </Accordion>

package/site/content/docs/recipes/redis.mdx

@@ -32,7 +32,7 @@ images: {
 <Step>
 ### Required password
 
-```bash title="docker/.env.docker (written by oke docker)"
+```bash title=".env.local (written by oke docker)"
 OKE_STORE_KV_PASSWORD=…
 REDIS_URL=redis://:…@127.0.0.1:6379
 ```
@@ -66,12 +66,11 @@ The recipe runs:
 
 ## Data and backup
 
-The Redis recipe declares **no named volume**. Process memory is the source of truth;
-a container recreate loses keys unless you add persistence yourself
-(`compose.override.yml` + Redis AOF/RDB).
+The default `store.kv` recipe declares **no named volume**. Process memory is the source of truth;
+a container recreate loses those keys.
 
-**Backup means (default recipe):** treat KV as a cache — rebuild from SQL / files, or
-add an explicit volume + `SAVE`/`BGSAVE` policy before you rely on durability.
+Keys that must survive go on `{ durable: true }` — a JSONB table on your SQL database, not a
+second Redis. See [Store · Durable KV](/docs/elements/store#durable-kv).
 
 ## Production note
 
@@ -93,6 +92,11 @@ Multi-replica Gate rate counters and Signal need a **shared** Redis URL — an i
 | Healthcheck    | `redis-cli -a <password> ping`, every 5s, 10 retries |
 | Connection URL | `redis://:pass@host:6379`                            |
 
+<Callout title="Console Performance">
+  Store → KV band → **Performance** reads `INFO` / `SLOWLOG` on this instance. Those commands are
+  server-wide, not scoped to `oke:kv:{ns}:`. `memory` (tests) returns `KvStatsUnsupported`.
+</Callout>
+
 ## Troubleshooting
 
 <Accordions>
@@ -100,7 +104,7 @@ Multi-replica Gate rate counters and Signal need a **shared** Redis URL — an i
 
 Missing `REDIS_URL` fails boot loudly — never a silent fallback to `memory`. Re-run
 `oke dev` or export `REDIS_URL` when using a managed host. Under Compose the
-message asks whether `oke dev -d` wrote `docker/.env.docker`.
+message asks whether `oke dev -d` wrote `.env.local`.
 
 </Accordion>
 <Accordion title="NOAUTH Authentication required">

package/site/content/docs/recipes/rustfs.mdx

@@ -27,7 +27,7 @@ drivers: {
   },
 },
 images: {
-  store: { files: "rustfs/rustfs:1.0.0-beta.11" },
+  store: { files: "rustfs/rustfs:1.0.0-rc.2" },
 },
 ```
 
@@ -36,7 +36,7 @@ images: {
 <Step>
 ### Credentials and endpoint
 
-```bash title="docker/.env.docker (written by oke docker)"
+```bash title=".env.local (written by oke docker)"
 S3_ACCESS_KEY_ID=…
 S3_SECRET_ACCESS_KEY=…
 S3_BUCKET=oke
@@ -88,7 +88,7 @@ endpoint. Open `S3_CONSOLE_URL` for a browser console on port **9001**.
 **Backup means:** snapshot that named volume (or `aws s3 sync` against the API).
 Deleting the volume deletes every object.
 
-Credentials live in `.env.docker`, not in `/data` — rotate keys without wiping objects.
+Credentials live in `.env.local`, not in `/data` — rotate keys without wiping objects.
 Losing both volume and keys means full restore from backup only.
 
 ## Production note
@@ -122,7 +122,7 @@ for a managed bucket.
 <Accordion title="Access Denied / signature errors against :9000">
 
 `S3_ACCESS_KEY_ID` / `S3_SECRET_ACCESS_KEY` do not match `RUSTFS_*` inside the
-container, or `S3_ENDPOINT` points at the wrong host/port. Align `.env.docker` with the
+container, or `S3_ENDPOINT` points at the wrong host/port. Align `.env.local` with the
 running service; confirm health at `/health` before debugging client signatures.
 
 </Accordion>

package/site/content/docs/recipes/sglang.mdx

@@ -26,7 +26,7 @@ drivers: {
   ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
-  ai: "lmsysorg/sglang:v0.5.16-runtime", // never :latest
+  ai: "lmsysorg/sglang:v0.5.17-runtime", // never :latest
 },
 ```
 
@@ -37,7 +37,7 @@ Or `oke ai setup --provider sglang --yes`.
 <Step>
 ### Env + GPU
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_AI_URL=http://127.0.0.1:30000/v1
 OKE_AI_MODEL=Qwen/Qwen3-0.6B
 ```

package/site/content/docs/recipes/supabase-docker.mdx

@@ -98,10 +98,34 @@ cloud pausing does not apply to this Docker image — you own uptime.
 | Container port | `5432`                                               |
 | Healthcheck    | `pg_isready -U $POSTGRES_USER`, every 5s, 10 retries |
 | Connection URL | `postgres://user:pass@host:5432/db`                  |
+| Preload        | Image config — recipe does **not** set `command`     |
+
+## Query performance
+
+<Callout title="Do not overwrite command">
+  `supabase/postgres` already preloads `pg_stat_statements`. This recipe leaves `command` unset so
+  vendor startup stays intact.
+</Callout>
+
+| Step    | What you do                                                        |
+| ------- | ------------------------------------------------------------------ |
+| Preload | Image `postgresql.conf` (not an oke `command`)                     |
+| Create  | `CREATE EXTENSION IF NOT EXISTS pg_stat_statements`                |
+| Advisor | `CREATE EXTENSION IF NOT EXISTS index_advisor CASCADE` when listed |
+
+Console **Performance** then reads engine stats. Enable Index Advisor from the
+same view when `pg_available_extensions` lists it.
 
 ## Troubleshooting
 
 <Accordions>
+<Accordion title="PgStatStatementsNotPreloaded after a custom command">
+
+Do not replace the image entrypoint with a generic `postgres -c
+shared_preload_libraries=pg_stat_statements`. Restore the vendor command, create
+the extension, then open Store → **Performance**.
+
+</Accordion>
 <Accordion title='Extension "vector" is not available'>
 
 You pinned a plain `postgres:` image, not `supabase/postgres`, or the tag predates the

package/site/content/docs/recipes/timescale.mdx

@@ -86,16 +86,40 @@ Managed time-series hosts still use `DATABASE_URL` and
 
 ## What the recipe configures
 
-| Field          | Value                                   |
-| -------------- | --------------------------------------- |
-| Match          | `timescale` ahead of generic `postgres` |
-| Container port | `5432`                                  |
-| Healthcheck    | `pg_isready -U $POSTGRES_USER`          |
-| Connection URL | `postgres://user:pass@host:5432/db`     |
+| Field          | Value                                                  |
+| -------------- | ------------------------------------------------------ |
+| Match          | `timescale` ahead of generic `postgres`                |
+| Container port | `5432`                                                 |
+| Healthcheck    | `pg_isready -U $POSTGRES_USER`                         |
+| Connection URL | `postgres://user:pass@host:5432/db`                    |
+| Preload        | `timescaledb,pg_stat_statements` — Timescale **first** |
+
+## Query performance
+
+<Callout title="Keep timescaledb first">
+  Overwriting `command` with only `pg_stat_statements` breaks hypertables. This recipe preloads
+  `timescaledb,pg_stat_statements`. Then `CREATE EXTENSION pg_stat_statements`.
+</Callout>
+
+| Step    | What you do                                                           |
+| ------- | --------------------------------------------------------------------- |
+| Preload | Recipe sets `shared_preload_libraries=timescaledb,pg_stat_statements` |
+| Create  | `CREATE EXTENSION IF NOT EXISTS pg_stat_statements`                   |
+| Console | Store → SQL band → **Performance**                                    |
+
+Index Advisor is not in the Timescale image. Pin
+`oke-postgres-advisor:18-alpine` only if you drop Timescale — or enable
+`index_advisor` on an image that ships it.
 
 ## Troubleshooting
 
 <Accordions>
+<Accordion title="hypertables missing after a custom command">
+
+If you override compose `command`, keep `timescaledb` first in
+`shared_preload_libraries`. A `pg_stat_statements`-only preload unloads Timescale.
+
+</Accordion>
 <Accordion title='extension "timescaledb" is not available'>
 
 You pinned a plain `postgres:` image. Confirm the reference contains `timescale`,

package/site/content/docs/recipes/traefik.mdx

@@ -22,7 +22,7 @@ Traefik discovers `app` replicas from Docker labels instead of a static upstream
 
 ```typescript title="oke.config.ts"
 images: {
-  proxy: "traefik:v3.3",
+  proxy: "traefik:v3.7",
 },
 ```
 
@@ -31,7 +31,7 @@ images: {
 <Step>
 ### Hostname + ACME email
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_PROXY_HOST=app.example.com
 OKE_PROXY_ACME_EMAIL=admin@example.com
 ```
@@ -103,6 +103,13 @@ Usually `socket-proxy` is down, or `app` lacks Traefik labels. Confirm
 Logs showing Docker provider connection errors point at the socket-proxy, not Traefik
 config syntax.
 
+</Accordion>
+<Accordion title="oke dev: service app has neither an image nor a build context">
+
+`oke dev` starts infra only; the app stays on the host at `:6530`.
+Traefik labels apply when `app` is in Compose — use `oke docker` for that.
+Re-run `oke dev` after upgrading so compose drops the label-only `app`.
+
 </Accordion>
 <Accordion title="ACME email rejected / rate limited">
 
@@ -123,14 +130,10 @@ re-issuing repeatedly.
 
 <Cards>
   <Card title="Caddy" description="Single-instance alternative." href="/docs/recipes/caddy" />
+  <Card title="nginx" description="Static HTTP reverse proxy." href="/docs/recipes/nginx" />
   <Card
     title="PgDog"
     description="Pool Postgres behind the same stack."
     href="/docs/recipes/pgdog"
   />
-  <Card
-    title="Redis Cloud"
-    description="A managed backing store."
-    href="/docs/providers/redis-cloud"
-  />
 </Cards>

package/site/content/docs/recipes/valkey.mdx

@@ -61,9 +61,11 @@ Same knobs as Redis: `OKE_STORE_KV_MAXMEMORY`, `OKE_STORE_KV_MAXMEMORY_POLICY`.
 
 ## Data and backup
 
-No named volume in the recipe — same ephemeral default as [Redis](/docs/recipes/redis).
-**Backup means:** do not assume durability until you add a volume + persistence config;
-treat the default as a shared cache rebuilt from durable stores.
+The default `store.kv` recipe declares **no named volume** — same ephemeral default as
+[Redis](/docs/recipes/redis).
+
+Keys that must survive go on `{ durable: true }` — a JSONB table on your SQL database.
+See [Store · Durable KV](/docs/elements/store#durable-kv).
 
 ## Production note
 

package/site/content/docs/recipes/vllm.mdx

@@ -26,7 +26,7 @@ drivers: {
   ai: { dev: "openai-compatible", test: "mock", prod: "openai-compatible" },
 },
 images: {
-  ai: "vllm/vllm-openai:v0.26.0", // never :latest
+  ai: "vllm/vllm-openai:v0.27.1", // never :latest
 },
 ```
 
@@ -37,7 +37,7 @@ Or `oke ai setup --provider vllm --yes`.
 <Step>
 ### Env + GPU
 
-```bash title="docker/.env.docker"
+```bash title=".env.local"
 OKE_AI_URL=http://127.0.0.1:8000/v1
 OKE_AI_MODEL=Qwen/Qwen3-0.6B
 ```

package/site/content/docs/recipes/yugabytedb.mdx

@@ -89,6 +89,12 @@ tag; the image is large and cold-start is slower than Postgres.
 | Command        | `bin/yugabyted start --base_dir=… --background=false` |
 | Healthcheck    | `ysqlsh … SELECT 1` (90s `start_period`)              |
 | Connection URL | `postgres://user:pass@host:5432/db`                   |
+| Preload        | Vendor — recipe does **not** replace `yugabyted`      |
+
+## Query performance
+
+YSQL already preloads `pg_stat_statements`. Create the extension, then open Store →
+**Performance**. Do not add a Postgres `command` overlay.
 
 ## Troubleshooting
 
@@ -104,7 +110,7 @@ Receiver or remap that port in `compose.override.yml` if you need the UI.
 </Accordion>
 <Accordion title="password authentication failed">
 
-`YSQL_PASSWORD` must match `DATABASE_URL`. Regenerate `docker/.env.docker` with
+`YSQL_PASSWORD` must match `DATABASE_URL`. Regenerate `.env.local` with
 `oke dev`. Auth is off only when `YSQL_PASSWORD` is unset — this recipe
 always sets it.