# Changelog 0.12

## v0.12.0 — 2026-08-16

### ✨ Added

#### Console — Chrome

- `motion` (Motion for React) reserved for near-future ui-next animations; import via `motion/react`.

#### Console — Observability

- `fx.ask` stamps driver-reported input / output tokens onto WideEvent, Parquet, and Console run rows. Observability AI rail shows window totals when present — never a 0-token placeholder.

- Console **Runs SQL** (`POST /console/runs/query`, Observability SQL tab) — read-only DuckDB over `.oke/runs`. Statement guard rejects DDL/DML/external access; isolated session sets `enable_external_access=false`; 5s timeout; 1000-row cap. Files driver skips re-copy when partition keys are unchanged. PII mask is column-key only (`RunsQueryPiiProjectionGap`).

- Fleet registry (`oke_instances`) — each process heartbeats every 5s (30s TTL) on the existing 1s scheduler. `GET /console/instances` joins Clock and Journal leases by the unified boot `instanceId`. Observability shows `N alive` (unbound is empty, not 0).

- Console **Observability** (`/observability`) — health strip (Vault seal/KEK, Store drift, Clock overdue/lease, Signal queue lag, window P95 / error rate), top errors from the persisted runs buffer (opens Trace detail), and a Bklit composed chart (request volume, error count, dual-axis P95). AI cost stays empty until `fx.ask` writes run telemetry. Instances chip reads `GET /console/instances` (alive ⇔ TTL).

- `oke dev` live Traces bridge: host-app WideEvents POST to Console `POST /console/runs/ingest` (secret-gated). Console appends into its own runs store → existing `feedRun` / `projectRun` PII mask for `GET /console/runs` and `/console/live`. Prod stays opt-in (`oke({ runs })`); the bridge env is set only by `oke dev`.

- ui-next trace detail Sheet (shadcn, side=left): row click keeps graph highlight and opens a real breakdown — summary counts from EffectKind + logs, proportional waterfall bars from EffectEntry timestamps/durations (EDGE_STROKE colors), expandable event list, and REQUEST with Manifest method/path plus Shiki-highlighted `WideEvent.input`. No RESPONSE section (WideEvent has no output field today). `GET /console/runs` / live projection now include masked `input`.

- Console **Kbd** key caps on the command palette, sidebar tooltips, Query run/save, Store grid find/undo/redo, and shortcut sheets. `⌘1`…`⌘5` hop Overview / Flows / Store / Monitoring / Vault; `⌘,` opens Settings; `⌘E` logs out. Caps show ⌘ on Mac and Ctrl on Windows.

- Console explorer pages (Overview, Flows, Store, Observability, Vault) share a start-panel collapse / expand control on the inspector header.

#### Console — Store

- Call API **PII** matches Store Query: handler responses mask classified fields by default. Toggle includes audited cleartext (`revealPii`).

- Console Files is a folder browser, not a key table. Slash-separated keys become folders with breadcrumbs, list/grid views, and an inspector that previews text and images. Operators can upload (including drag-and-drop), download, and delete. Browse returns `sizeBytes`; `POST /console/store/object` reads one object; `POST /console/store/edit` `put`s `patch.body` (`utf8` / `base64`).

- Console Files uploads mint a URL-safe object key (`safeFileObjectKey` from `okengine/store`) and keep the original name plus MIME / size in `.oke/catalog.json`. When the Manifest has a `file_objects` SQL table, Console upserts that row too. Non-ASCII keys on `/edit` are rewritten; the old key is deleted. `fx.store(files).put` is unchanged.

- Console Store explorer facet bands (SQL / KV / Files / Index) have a show/hide control on each band and an eye menu in the search bar. Hidden bands leave the tree; restore them from the menu. The pick persists in localStorage. Selecting a resource in a hidden facet shows that band again.

- Console Store table rows show live RLS: emerald `ShieldEnergy` when enabled, muted `ShieldOff` when disabled (`pg_class.relrowsecurity`).

- Console Store catalog create sheets expose **Advanced** Postgres knobs: Indexes (`CONCURRENTLY`, `INCLUDE`, `NULLS NOT DISTINCT`, `WITH`), Functions (`SECURITY DEFINER`, `STRICT`, `PARALLEL`, `LEAKPROOF`, `SET search_path`, `COST` / `ROWS`), Triggers (`CONSTRAINT`, `UPDATE OF`, transition tables, `TRUNCATE`, function args), and Extensions (`SCHEMA`, `VERSION`, `CASCADE` — `pg_catalog` refused).

- Console Store **Create policy** Advanced pairs RLS with Gate **policy** and **scope** (`gate.public`, `gate.policy`, `gate.scope`) — not the Access Module:Action / role catalog. Read / Write / Both stays the default. Picks stay on Gate — `TO public` stays on the SQL.

- Console Store **SQL** and **KV** facet bands open a query console (code icon on the band). SQL runs DML and DDL through `POST /console/store/sql` (`allowWrite` on writes, including `CREATE` / `GRANT` / `EXPLAIN ANALYZE`). The workbench has query tabs, session history, a Manifest schema rail (tables + columns), run current / selection (`⌘Enter`), run all (`⌘⇧Enter`, sequential, stops on the first error), EXPLAIN / EXPLAIN ANALYZE, gutter play marks, Prettify, a No LIMIT hint, elapsed time, and table / JSON / raw results with CSV copy. A multi-statement script opens a result tab per statement. The SQL editor completes Manifest tables, columns, and keywords as you type (context-aware after FROM / SELECT / WHERE, plus CREATE / ALTER / DROP / EXPLAIN); KV completes `list` / `get` / `set` / `delete` / `ttl` and namespaces. Schema collapses to a right-edge strip; results collapse to the status bar (Run expands them again). KV namespaces expand to inferred value fields (same rail as SQL columns). Double-click a tab to rename; Save keeps named queries in localStorage (History → Saved). Tabs persist across sessions. KV `set(key, value, ttl?)` writes through `POST /console/store/edit` (same script Pending Changes emits). `delete` and `ttl` match the `fx.store` handle (`ttlMs`); word and call forms work for every command. `oke_console` stays refused for raw SQL.

- Console SQL query console toolbar can **include PII**. Default stays masked; turning PII on sends `revealPii: true` on `POST /console/store/sql` and re-runs the last read (writes stay untouched). Results meta shows `PII masked` or `PII visible`.

- Console KV query console has the same **Prettify** control as SQL. It rewrites `list` / `get` / `set` / `delete` / `ttl` to call form and indents `set` JSON.

- Console SQL query console can **view data as a Gate** — three cards (Operator, Public, As). Operator bypasses RLS. Public and As set `oke.gate` on postgres / pglite. As picks a user (via their matching policy) or a Manifest policy gate. Policies read `current_setting('oke.gate', true)`. Memory SQL accepts the pick but does not apply session GUCs.

- Console Store SQL band **Schema** opens a visualizer of Manifest tables, columns, and relations — declared `.references()` plus inferred `*_id` columns (search, auto layout, copy as SQL, smart Colorize, PK / FK / unique icons, cardinality icons for many-to-one / one-to-one / many-to-many / self; click a related table to dim the rest).

- Console Store SQL table browse can **insert a row** from the grid toolbar (Insert data). Empty fields stay NULL; `id` defaults to a UUID. Omit `id` on `POST /console/store/edit` to INSERT (`patch.id` required).

- Console Store **Indexes** catalog can **Create index** — the same form-and-preview sheet as RLS Policies (templates, table / columns / method, plus a free highlighted SQL editor), then `CREATE INDEX` through `POST /console/store/sql` (`allowWrite`). Refuses anything that is not `CREATE INDEX`.

- Console Store **Functions** catalog can **New function** — the same form-and-preview sheet as RLS Policies / Triggers (templates, name / args / returns / language, plus a free highlighted SQL editor), then `CREATE FUNCTION` through `POST /console/store/sql` (`allowWrite`). Refuses anything that is not `CREATE FUNCTION`.

- Console Store SQL folders add **Triggers** under each SQL store. Browse uses live `pg_trigger` when the engine has it; otherwise an empty list. **New trigger** uses the same form-and-preview sheet as RLS Policies (templates, table / timing / events, plus a free highlighted SQL editor), then runs `CREATE TRIGGER` through `POST /console/store/sql` (`allowWrite`).

- Console Store tree adds **Expand all / Collapse all** next to search, on each facet band (scoped to that facet's folders), and on each store folder. Facet bands start open; store folders and SQL Tables start collapsed. Selecting a resource re-opens its facet, not the folder. Search still expands matching folders.

- Console Store can list the **`oke_console` auth schema** beside app SQL (`oke_operators`, sessions, roles, API keys, identities) when `OKE_CONSOLE_AUTH_STORE=1`. Hidden by default. Browse is read-only; credential hashes stay masked until audited reveal. Edit / delete / raw SQL are refused so operator-plane rows never join `public`.

- Console Store SQL folders add **Indexes**, **Functions**, and **Extensions** under each SQL store (app `db` and `oke_console`). Browse uses live `pg_*` when the engine has it; otherwise Manifest primary-key / unique indexes. Extensions list built-in contrib packs with an enable / disable toggle (`CREATE` / `DROP EXTENSION`). A Library sheet searches and adds external packs (TimescaleDB, PostGIS, pg_cron, DuckDB, plv8, FDWs, …) by name, alias, or category. Memory keeps the catalog in-process. The SQL editor does not complete these as tables.

- Console Store SQL folders add **RLS Policies** (`__policies`). Browse lists `pg_policies`. Create policy reviews `CREATE POLICY` (and optional `ENABLE ROW LEVEL SECURITY`) before it runs. **Templates** opens a flush rail beside the form (SELECT / INSERT / UPDATE / DELETE / ALL, owner, `oke.gate`, joins, restrictive extra check). `oke_console` stays read-only.

- Console Store Extensions can **upgrade** to the newest packaged version (`ALTER EXTENSION … UPDATE`). The name chip shows the current version and an Upgrade action (pgvector `0.8.0` → `0.8.6`). Names link to the project page or Postgres docs.

- Console Store replica-lag chip follows the newest touching run from the live runs buffer (same `/console/live` merge as Traces) and uses the Traces duration cool→hot palette (emerald → yellow → rose). Falls back to the store-list snapshot when the buffer has no lag.

- Console Store **PII chip** toggles masking for every classified column on the current browse page. Off (amber) sends audited `revealPii: true` on `QUERY /console/store/query`; on (sky) remasks. Switching tables remasks.

- Console Store browse **Import / Export** in the grid toolbar. Export downloads the current page (or checked rows) as CSV or JSON. Import parses CSV/TSV/JSON, matches rows by `id`/`key` already on the page, and stages writable cells as uncommitted changes (PII `[redacted]` values are skipped). Does not insert new rows — there is still no `/console/store/add` endpoint.

- Console Store JSON cells (KV `value`, Index `meta`, and JSON strings) show a trailing **Open as table** icon. It opens a sheet with a flattened field table plus a full-height JSON editor. On writable KV/SQL cells, table fields and JSON source both edit in place and stage the reconstructed object as an uncommitted change.

- Console Store KV browse adds **TTL** and **size** columns. TTL is remaining time from the driver (`PTTL` on redis; intended TTL on memory) and is editable in the grid (`30m`, `1h`, or empty to clear). Size is the UTF-8 JSON byte length of the value, and updates as you stage edits. **Add key** upserts via `POST /console/store/edit` (no `/console/store/add` endpoint). Value-only edits now preserve remaining TTL instead of wiping it.

- **Console ui-next Store page (v1)** — read-first browse at `/store`: facet tree, schema, masked SQL row browser with audited reveal, KV/files/index browsers with honest “not PII-classified / no SQL-grade masking” copy, and reverse readers/writers linking to Units/Flows (no edit/delete/SQL console).

- **Console ui-next Store page (v2)** — browse is now a virtualized data grid (TanStack Table + Virtual, Base UI chrome) with column sort, find-in-page (honest “increase Limit to search more rows” copy), and safe mutations:

- Edit (SQL/KV) runs dry-run preview → typed `EDIT` + reason in production; PII-masked cells require audited reveal before edit and the client strips any `[redacted]` placeholder from the patch.

- Delete (all four facets) requires typed `DELETE` + reason in production.

- Server `applyEdit` rejects a patch value equal to `[redacted]` on a classified PII column so the mask can never overwrite real data.

- No SQL Insert UI (no `/console/store/add` endpoint); KV “add” is edit/set.

- No server-side column WHERE filters yet — v1 find/sort are client-side on the fetched page only.

- Console Store SQL band **Performance** view — slow queries, cache hit rate, and live lock blocking from `pg_stat_statements` / `pg_locks` (`QUERY /console/store/sql/stats` and `/locks`). Structured `PgStatStatementsNotPreloaded` / `Unsupported` / `NotCreated` instead of a generic 500. Index Advisor is opt-in: Enable when `pg_available_extensions` lists `index_advisor`, otherwise a CTA to pin `oke-postgres-advisor:18-alpine`. Suggest copies `CREATE INDEX` DDL and does not create indexes.

- Local `postgres` / `pgvector` recipes preload `pg_stat_statements` at postmaster start. Timescale keeps `timescaledb` first (`timescaledb,pg_stat_statements`). `supabase/postgres` and Yugabyte commands are unchanged. Opt-in `oke-postgres-advisor:18-alpine` emits `Dockerfile.postgres-advisor` (hypopg + index_advisor). Default `postgres:18-alpine` is unchanged.

- ui-next seed now fills all four Store facets with real data (previously schema-only): SQL `bookings` 5 rows / `shipments` 3 rows (with a PII `email` column), KV `holds` 4 keys, Files `uploads` 3 objects (one non-ASCII key for warnings), Index `docs` 4 vectors. Seeded via `seedUiNextStoreData` in both the Vite dev plugin and the Playwright fixture.

- `fx.store(index).list(limit?)` returns stored documents (id + meta, no embeddings) on every index driver. Console Index browse uses it so an empty search lists the catalog.

- Store query performance: preload vs `CREATE EXTENSION` vs unsupported on Postgres / Timescale / Supabase Docker / Neon / Supabase / Yugabyte / Cockroach pages. Index Advisor opt-in image documented on the Postgres recipe.

- Store KV **Performance** (`QUERY /console/store/kv/stats`) — Redis-wire `INFO` / `COMMANDSTATS` / `SLOWLOG` / `LATENCY` on the KV band. `memory` returns `KvStatsUnsupported`. INFO is instance-wide (`StoreKvStatsServerWideGap`). SLOWLOG args collapse until reveal (`StoreKvStatsSlowlogArgsGap`). No `MONITOR`, no invented hot-keys.

#### Console — Vault

- Console Vault **Add** (`+`) creates a secret or config from the operator plane as well as from `vault.secret` / `vault.config` in source. Metadata lands in `.oke/vault-contracts.json`; the value uses the same write path as Set. A review dialog (name + fingerprint) pauses before the write — same as set / rotate. Rows show a `console` chip until the name is declared in the Manifest.

- Console Vault is a security instrument, not a filter-and-empty-state. Deep search (`is:unset`, `is:blast`, `from:.env.local`, `reader:`, `fp:`) ANDs over name, fingerprint, readers, and winner. Posture chips and a scan board surface unset, blast, shared, dormant, and overdue contracts. Resolution is a lock-path. Security (verify chain, rotate master, fingerprint export, CLI copy) lives in one sheet. Values stay write-only.

- Console **Vault** page (`/vault`): fingerprints-only list + backend status, set / rotate via typed confirm, and master rotation through `POST /console/vault/rotate-master` (one batch, `remaining` honest, `ROTATE_MASTER` + reason). Any operator in the same process may continue; overlapping batches return `VaultRotateBusy`. Generated master key is shown once and never logged. Audit verify is `GET /console/vault/audit/verify` (`ok`, `brokenAt`, `reason`, `row`). Backup stays on the CLI. The Console never accepts a master key in the HTTP body.

#### Console — Flows & traces

- Boot wires `drivers.runs` (`files` in `dev`/`prod` at `.oke/runs`, `memory` in `test`). `oke replay` and host recording share that root. create-oke templates install `@duckdb/node-api`. `runs.keep` deletes old Parquet partitions (`7d` in `dev`, `30d` in `prod`). Console `listRuns` unions live ingest with disk so Traces survive a Console restart.

- ui-next Flows split-view is bidirectionally interactive: clicking a flow node filters the Traces list (`flow = X` advanced clause), clicking a signal node filters to runs whose flow emits or consumes that signal, and clicking the canvas clears the filter (removable chip in the filter row).

- ui-next Trace detail sheet supports sticky effect focus — click a waterfall bar, overview segment, or event row to pin emphasis (click again to release).

- ui-next Replay is now visible: a Motion playhead sweeps the waterfall while bars grow as it crosses them, the hero duration counts up in sync, and the Flow graph pulses along the causal chain. All motion respects reduced-motion settings.

- ui-next Traces pane parity: contextual `formatDuration` (μs / ms / s), status row tint + trigger icons (HTTP / Signal / Clock), persistent selected accent, hover Replay + Copy run ID, and All/Errors + duration-threshold filters over the scoped runs list. `POST /console/traces/replay` now re-invokes through `runReplay` (same path as `oke replay --request-id`), not a log-only stub.

- ui-next trace detail Sheet surfaces the **Gate** element: summary chip from `run.gates`, plus a Gates section with Manifest kind/description (e.g. `member` · policy · Signed-in member on `support.triage`).

- ui-next Request section is a protocol frame: method-colored rail, Body with Fields/Raw toggle (typed key·value rows + per-field copy), byte size, and line-numbered Raw JSON.

- WideEvent / Console runs project optional **`output`** (flow return value), PII-masked like `input`. ui-next trace sheet shows an Output protocol frame; seeded skyport runs include realistic outputs (failures omit them).

- ui-next Traces duration filter uses shadcn Base UI `Select` with cool→hot colored dots on each threshold (Any / >10ms…>5s), matching row duration tones.

- ui-next Traces **Advanced** filtering: progressive-disclosure dimension query (`flow = X AND cache = miss AND duration > 1s`) with presets, chips, and expression editor — same language as Runs (§9.11), client-side on the scoped list.

- ui-next eight-element HugeIcons vocabulary (`ELEMENT_ICONS`) aligned with site Lucide; Traces trigger icons and Flow graph nodes share Flow / Signal / Store / Clock / Gate / Vault / Channel / AI glyphs.

- `bun run dev:console-next:seeded` (`OKE_CONSOLE_NEXT_SEEDED=1`) boots the same Console kernel + skyport Manifest + seeded WideEvent chain as the Playwright ui-next fixture, so opening http://127.0.0.1:6537 shows a real Flows graph and Traces (click → highlight). Terminal prints URL, claim code, and a one-line seed summary.

#### Console — Units & Call API

- `dev:console-next:seed` Units tree is a full work-management HTTP surface: CRUD on tasks, comments, projects, documents, attachments, spaces, tags, goals, members, views, and forms, plus custom routes (archive, assign, complete, follow, QUERY search, PUT drafts, HEAD health). Call API binds every HTTP flow.

- ui-next Units ↔ Flows connector: `/flows?flow=<id>` seeds the graph/Traces filter and fitView; Units contract header has **Open in graph**. Recent activity strip shows real buffered call count / error rate for the selected flow (honest empty when the Console runs buffer has nothing in-window). Units subscribes to `useRuns` + `/console/live` like Flows.

- ui-next Units **Platform failure modes**: derived only from this flow's Gates

- request schema with HTTP-encoding truth (`Unauthorized` 401 · `Forbidden` 403 · `RateLimited` 429 · `ValidationError` 422) — not OKE#### codes and not Call API chrome's default-400 quirk. Declared Flow errors stay a separate tier.

- Console `POST /console/flows/invoke` executes the target flow on a bound host via invoke-as (assumed identity scopes) — no more stub `echo` / `inv_*` responses. Fail-closed when the host adapter is unbound. Optional `pathParams`; response includes `status` / `failure` / `runId` when the host provides them. Kernel `execute` accepts `trustedInvoke` for console-trusted principal injection outside `env: "test"`.

- ui-next **Units** page (`/units`): Manifest flows grouped by unit, contract panel (request/response schema rows, typed errors, gates, effects), and session-authenticated Call API wired to real invoke-as.

#### Console — Auth & shell

- Console claim **Generate** mints a first-operator password that meets Console policy (12+ upper, lower, number, special) and copies it to the clipboard.

- `oke console claim-code` prints the first-admin claim mirrored to `.oke/claim-code` (mode 0600) on Console boot while setup is open; cleared after a successful claim. Same code still prints once to the boot log.

- `bun run dev:console-next` boots an ephemeral Console kernel on :6533 beside Vite and prints the claim code in the same terminal (also mirrored to `.oke/claim-code`). Uses `bunx --bun vite` so the Console graph runs under Bun (not Node).

- ui-next operator login when setup is closed: Email + Password (TanStack Form + Zod + shadcn Field) posts to real `POST /console/session/login`, stores `oke_console_at` on success, and surfaces `AuthFailed` / `AuthRateLimited` errors. Same ConsoleChrome shell as claim. Gate extended in `test:console:setup-ui-next`.

- ui-next authenticated shell (Phase 3): TanStack Router (`/` pre-auth, `/overview` · `/flows` · `/store` guarded shell). Claim and login success navigate to `/overview`. Sidebar-07 layout collapsed by default, OKE logo header, Overview/Flows/Store nav with honest Empty placeholders. Unauthenticated shell visits redirect to `/`. Gate: `test:console:setup-ui-next`.

- Parallel Console SPA scaffold at `src/console/ui-next/` (React + Vite + shadcn/Base UI + TanStack Form/Query + HugeIcons) with a real first-admin claim page wired to `/console/setup/status` and `/console/setup/claim`. Existing `src/console/ui/` is unchanged; cutover is not yet. Gate: `bun run test:console:setup-ui-next`.

- ui-next shell chrome: OKE wordmark + light/dark/system theme toggle (official shadcn Vite ThemeProvider, `oke-console-theme` storage, no next-themes).

- Console sidebar **Fast** opens a ⌘K command palette (navigate, theme, settings, logout). **Settings** is a dialog with operator identity and the theme toggle. **Logout** posts `/console/session/logout` and returns to sign-in.

#### Runtime

- `http.resource(path, ops)` chains `.gate(...)` and `.live()` like `http.get`. Gates apply to every verb; live marks list and get.

- `gate.all(...members)` reuses a gate chain. `.gate(write)` flattens the handle (and plain arrays) left to right. The compiler expands `.gate(write)` and `.gate(...WRITE)` onto `flow.gates`.

- `.gate.public` is the unauthenticated sentinel — same as `.gate(gate.public)`, without importing `gate`.

- Handwritten HTTP lists prefer the Stripe envelope (`out` is the item array, `fx.json.withQuery(rows, input)`). Extra keys auto-eq except path `id`. `fx.json.with(page)` stays for an already-built pager. Any other declared `out` is still valid.

- Official managed vault providers now include Azure Key Vault, GCP Secret Manager, Doppler, and 1Password Connect alongside AWS Secrets Manager. Set `drivers.vault` to `"managed"` and `OKE_VAULT_PROVIDER` to the id. Cloud SDKs stay optional peers; Doppler and 1Password use `fetch`.

- `http.query()` — RFC 10008 safe, idempotent HTTP trigger that still carries a JSON body. `Content-Type: application/json` is required (missing → 400 `InvalidQuery`; other types → 415 `UnsupportedMediaType`). Invalid JSON is 400 with no sniffing. QUERY responses and 405s that allow QUERY advertise `Accept-Query: "application/json"`. CORS default methods include QUERY; CSRF treats QUERY as safe (like GET). The client always sends a JSON body on QUERY (`{}` when only path params remain).

- Browser `GET` (`Accept` prefers `text/html`) paints the JSON envelope in traces chrome — flush h-10 strips, hairline /60, status + handler latency

- cache (hit / miss / none), a right-rail Routes tree (static GET links; POST and `:param` listed), line numbers, copy, Pretty / Raw (compact stays on the same page). `curl`, `Accept: application/json`, `?format=json`, and `/_/` · `/_oke/` stay JSON.

- Console operator reads `store/query`, `gates/simulate`, `gates/powers`, `access/effective`, and `channels/preview` now bind QUERY. `store/preview` stays POST (audited dry-run).

#### Dev, Keel & create-oke

- create-oke `standard` / `advanced` ship a Vite 8 `web/` SPA. Vite owns `index.html` and proxies `/notes` · `/health` · `/_oke` to the app. `bun run web` after `oke dev`.

- Keel lists speak PostgREST v16 read grammar: `col=eq|neq|gt|gte|lt|lte|like|ilike|in|is|match|imatch`, `not.`, `like(any).{…}`, nested `or=` / `and=` / `not.and`, `order=col.desc.nullslast`, `select=id,alias:col`. `store.resource` now accepts `not.`, `is.not_null`, quoted `in.()`, and nested `or`/`and` groups.

- `bun run dev:keel:reset` tears down the keel Compose stack (`oke docker clean --yes`) and deletes `.oke/`, `.env.local`, and generated Docker extras so the next `dev:keel` is a first boot.

- `defineSeed({ name, description })` labels this app's seed (template or example). `oke dev` asks `Seed keel (Featured Harbor GA story + volume + vault stubs)?` and `.oke/state.json` stores that id — a different name re-prompts. Not a global seeded flag.

- `examples/keel` is a work-management OKE app (not a create-oke template) for `oke dev` against Compose — Postgres, PgDog, Redis, RustFS, Mailpit, Meilisearch, and llama.cpp. Featured Harbor GA task chain, stub GitHub/Slack ingest, `bun run dev:keel`, then `oke db seed`.

- Keel pins `images.pgdog` so Compose puts PgDog in front of Postgres. `DATABASE_URL` is the pooler (`:6432`); `OKE_STORE_SQL_URL` stays the direct host.

- `create-oke` asks **Add a reverse proxy…?** (Caddy / Traefik / nginx / No) and persists `proxy` in `~/.oke/create-defaults.json`. Flags: `--proxy <id>` / `--no-proxy`.

- nginx image recipe (`nginx:1.27-alpine`) — generated `nginx.conf` reverse proxy on :80; companion docs under Recipes → nginx.

- `playwright.ui-next.config.ts` always records trace + screenshot + video; after `bun run test:console:setup-ui-next`, `bun run test:console:setup-ui-next:report` opens the HTML timeline report.

- `oke-images` skill (`.agents/skills/oke-images/`) — probe registries and bump Compose pins in catalog, recipes, templates, Keel, and docs without inventing tags.

#### Docs

- Docs site machine surfaces for agents: spec-compliant `/llms.txt` (absolute links, curated sections, Optional rest), `/llms.json`, `/llms-full.txt` with teaching-figure fallbacks, `/llms/agents` (the AGENTS.md contract), `/robots.txt` (allow-all including named AI crawlers), and `/sitemap.xml`. Per-page markdown is `/llms.mdx/docs/⟨slug⟩`; `/content.md` and `.md` still resolve. HTML docs pages advertise `rel="alternate"` `type="text/markdown"`.

### 💥 Breaking Changes

- Global password policy defaults are now minLength **8** with uppercase, lowercase, number, and special character required (`DEFAULT_PASSWORD_POLICY.requireSpecial`). Previous defaults were minLength 12 with letter + number only. Override via `gate.auth.passwordPolicy` / `createOperator({ passwordPolicy })`. The special-character option is named `requireSpecial` (failure reason `requireSpecial`); do not use `requireSymbol` on password policies.

- Stack env is project `.env.local` only. Vault resolution is driver → `process.env` → `.env.local` → (optional) `dev-fallback`. `oke docker` merges stack keys into `.env.local`; compose `env_file` is `../.env.local`. `COMPOSE_ENV_REL` is `.env.local`. The `.env.docker` file and resolution source are gone.

- Console routes are now `/overview` (graph + Traces), `/flows` (explorer), `/store`, and `/vault`. Unknown paths (including `/units`) are 404 — no legacy rewrite. Dev scripts are `dev:console` / `:seed` / `:fresh` (the `-next` suffix is gone).

### ♻️ Changed

#### Console — Chrome

- Explorer folder rows (`db`, Tables, unit folders) use the same `text-xs` as leaf rows — the group token had no size and read larger.

- Signal uses Hugeicons `InternetAntenna03` everywhere (Units bands, live flags, traces, graph) — was the slashed `Radio01`.

- Console tab chrome uses the O mark favicon, title **okengine Console**, and an operator description meta (was a generic icon and "oke Console"). Module routes prefix the page name (`Overview · okengine Console`).

- Console data tables drop the muted header fill and use the same hairline / hover as explorers: Store browse, query results, files list, JSON inspect, and Vault fingerprints. Store browse restyles the row checkbox at the table, not the shared control.

- Console sidebar: the graph/traces page is **Overview** (`/overview`); the Manifest catalog is **Flows** (`/flows`). `/units` redirects to `/flows`. Sign-in lands on Overview. Legacy `?next=/units` rewrites to `/flows`. The Flows explorer search placeholder is **Search flows…** (was units).

- Schema type badges use one hue per type (string teal, integer blue); rose stays on risk pills.

- Console sheets share one flat language: full-bleed fields (no boxed inputs), text toggles instead of chips, and a flush Cancel | action footer. Create policy, index, function, trigger, insert, KV add, edit, confirm, pending changes, and the extension library all use it.

- Console theme toggle is strip tokens (ink when active, icon-only when idle) — no sliding pill, no muted chip. Same control in Settings.

- ui-next theme tokens match SACP web zinc (tuned dark card/muted + chart/sidebar).

#### Console — Observability

- Observability SQL Run is a stretch strip token; the PII gap note is hairline text. KPI labels use tracking 0.08em and `/60` hairlines. Error rows open the local Trace sheet instead of navigating to Overview. Leftover `monitoring-*` slots are `observability-*`.

- Console explorers share the Overview traces language: flush rows, bare tinted icons, tabular counts, and a full-height selection rail. Flows, Store, Vault, and Observability lists plus detail headers drop boxed wells. Advanced on Flows is an icon control like Traces.

- Console inspector identity (Vault / Store / Units) matches the Observability Query / Metrics header: one h-8 strip. Title, kind, and env / copy sit on one centered baseline; risk, PII, Set, and Rotate stay full-height strip tokens. Vault posture and Units activity use the same stretch bar.

- Console explorer tokens encode traces chrome: stretch toolbars, `EXPLORER_STRIP_*` bars, flat icon buttons (no bordered wells). Search, filters, Query, Call, Vault, and Monitoring strips use those tokens — selected ink only.

- Console Monitoring Metrics / SQL tabs and the Query header are flush strips (no pill tabs, no blur header). Sidebar module icons are flush in the rail — hover fill, no chip. The brand cell and explorer search / identity / command headers share h-10 — between the old 32px strip and a full 48px rail square.

- Console sidebar order is Overview / Flows / Store / Monitoring / Vault. Monitoring uses the chart-analysis mark.

- Console Monitoring is now **Observability**. Canonical route is `/observability`; `/monitoring` keeps a search-preserving redirect (bookmarks and `?next=`). Sidebar, command palette, and digit `4` point at the new path.

#### Console — Store

- Store KV uses Hugeicons `Braces` on the band (same `{ }` mark as site Store docs). Leaves use a job glyph — drafts, reminders, view prefs, webhooks — instead of the same key on every row.

- Store Index / KV leaves skip the folder wrap when a store has one child with the same name (`comments` → `comments`). Files already did this for a single bucket.

- Console Store Query PII uses the view / view-off glyph. Gate keeps the shield so the two toolbar controls no longer share an icon. The query command strip matches Call API: full-height, square tokens (Gate / PII / Schema / Run). Gate As picker drops the User/Policy tray and rounded rows for flush list chrome.

- Console Gate picker (Store Query and Call API) is a flush strip: Operator / Public / As keep the access diagrams; Operator and Public show a one-line hint; As still opens the user/policy list.

- Console Query results toolbar matches the command strip: h-8 flush tokens, hairline /60, no boxed icon wells.

- Console index browse Search / topK lives on the grid toolbar (one strip — no second search row). Sidebar nav idle icons sit at 40% ink; the active module is a solid accent chip.

- `fx.store(index).driverId` is the configured driver before first I/O (was a gated function, so seed treated Meilisearch as memory and wrote one vector blob). Keel `dev` pins `meilisearch`. Index browse promotes title / identifier columns.

- Console Index browse is a search box, not a vector probe. Type a phrase to rank documents by id and stored meta (Meilisearch uses full-text `q`). Paste `1, 0, 0` to run an ANN probe. Opening the index lists documents immediately.

- Console Overview graph is a radial hub, not a spaghetti of every flow × effect. OKE sits at the center; the eight elements orbit it; each element's kinds sit on a middle ring (Store SQL/KV/Files/Index, Gate policy/scope/rate/flag, Channel email/SMS/WA/Push, and the rest); units sit on the outer ring with live heat from Traces. Hover a unit to light the elements it touches. Click a unit or flow for a 1-hop neighborhood; click an element disc to fan its resources. Map breadcrumb returns to the hub. Opening Overview runs the orchestra: random notes from the traces ledger land as new rows and light that request's path on the hub (paused while a run or neighborhood is open).

- Console Files treats the **bucket** as the inspectable unit. A singleton `store.files(name, { buckets: [name] })` is one tree leaf (no `attachments → attachments`). The list payload may include `driverId` (`memory` / `fs` / `s3`) so the tree and header can show where bytes live. Click a file to open a right-side sheet (same chrome as SQL / KV row detail) so the folder list stays full width. The sheet previews images, PDF, video, audio, and text (pretty JSON, CSV table). The toolbar is path + find + view + upload + delete + refresh.

- Console Files upload shows the original name (Unicode OK) and a generated ASCII key. The browser lists and searches by original name. Existing non-ASCII objects keep the `non_ascii_key` warning until they are re-uploaded.

- Console Store **Create policy** is easier to scan: table and behavior share a row, `FOR` is a compact command strip, Gate / Rows are chaptered, and the SQL preview stays pinned above Create. `USING` and `WITH CHECK` appear only for the commands Postgres accepts.

- Console Store **Create index**, **New function**, and **New trigger** match that layout: compact template chips, paired fields, chaptered Options, and a pinned editable SQL dock above Create. Choice rows (Language, Method, Timing, FOR) keep the label on the same line as the chips so they do not read as empty field headers.

- Console Store SQL catalog folders use `sql:db/indexes` (and `functions` / `triggers` / `extensions` / `policies`) instead of the `__indexes` reserved prefix. Query still accepts the old `__` names.

- Console Store **Extension library** Install reviews required extensions and the `CREATE EXTENSION` SQL (requires first) before enabling a pack.

- Console Store **Extension library** is a marketplace sheet: featured Timescale / Cron / PostGIS cards, search + category select, and an installed badge — not a flat list.

- ui-next Store browse adopts a single toolbar + row-detail Sheet layout (SACP-style chrome): Refresh, find-in-results, sort indicator, Writers/Readers popover, tenant, page size, and row count on one row; column headers carry PK/type glyphs from the Manifest; double-click a row for Fields/JSON detail with the existing audited Reveal, edit, and typed-confirm Delete. No Insert / Export / pagination arrows — those have no real backend endpoints. Seed bookings gain an Arabic `note` so mixed RTL/LTR cells render without breaking column alignment.

- ui-next Store resource pane is now an edge-to-edge explorer workbench: compact identity chrome (status chips on the right, PII copy on the chip tooltip), a command strip with growing find, a spreadsheet grid (PK / PII / numeric headers, cell focus ring, compact audited reveal), and an IDE-style status bar. Instructional banners are gone.

- ui-next Store grid is now the beUI editable Table: inline cell edit (commit on blur/Enter), row-handle delete (typed confirm, no Insert), selection, sort, resize, and reorder. PII-masked cells still use audited Reveal; JSON/RTL/numeric cells keep their formatters. Find, undo/redo, column visibility, and the status bar stay on the command strip.

- ui-next Store grid stages edits locally: dirty cells fill brown with tan text; a selected range is navy with a 2px primary outline on the head cell. Changes opens a Pending Changes sheet (Visual diffs + SQL, Clear All / Commit All, ⌘S). Click selects a cell, click again or type to edit, drag to multi-select (paste/type fills). The row-detail Sheet is gone from browse — edits stay in the grid until Commit All.

- Console Store Query / KV performance headers use the shared identity strip: one baseline for title, ref, and actions. The Index Advisor pin note lives in the limitation banner, not the h-10 chrome.

- Console Store Schema find is the explorer search field (flush, no magnifying-glass overlay). Table count stays tabular and unclipped.

- Console Store SQL / KV Query identity uses the shared header strip: one baseline for title, ref, and statement hint. Store / tenant pickers are flush tokens, not pills.

#### Console — Vault

- Console Vault list rows are two lines: description + risk on the first, env name and readers on the second. Healthy rows drop the trailing set/config word. Band hints live on the section title.

- Console Vault detail is one path: identity, a next-action banner with the verb (Set / Rotate) when something is wrong, a posture strip (from / read / readers / blast), then the lock path as a first-hit-wins spine. Pick a layer to copy its fill command in the row. Fingerprints and readers stay flush lists. Shared and in-flight runs sit on the posture strip / blast banner — no Advanced dump. One Set or Rotate on the page, not two.

- Console Vault set / rotate drop the typed `SET` / `ROTATE` phrase. Pick a reason chip (`scheduled`, `leak`, `provider`, …) or **other** and type a note. Submit opens a review dialog (name, fingerprint, reason) — Cancel aborts; Confirm is the write. Add uses the same dialog. Rotate-master still types `ROTATE_MASTER`.

- The `env` vault driver lock-path matches vault/managed: driver → `process.env` → `.env.local` → (optional) `dev-fallback`. Console writes still persist to `.env.local`.

- Console Vault lock-path paints the winning layer emerald (same hit tone as the docs figure). Winner / last-read / readers / blast briefing rows carry icons. The first lock-path step is always `driver`; its chip shows `built-in`, `managed · aws`, or `simulate` (env driver) on the same line.

- Console Vault lock-path `simulate` / driver-kind chip uses emerald ink on the won wash (not muted-foreground) so contrast holds in dark mode.

- Console Vault list bands (Secrets / Config) collapse like Store and Units. Row wells use posture color and icon (overdue clock, blast alert, config source) instead of one gray key.

- Console Vault lists declared contracts only — undeclared `process.env` keys no longer appear as secrets. Seeded keel vault is five secrets plus four public config values (origin, API, docs, workspace) with winners across driver / process.env / .env.local. Overdue chips say `overdue`; hover explains the rotate window (`Last read older than rotate 90d — never-read counts`). Secrets that must not rotate declare `rotate: "never"` (omit is the same); Console shows `no rotate`.

#### Console — Flows & traces

- Overview orchestra (random minted traces) runs only in `dev:console:seed`. Live `oke dev` Traces stay operation-based — Clock, HTTP, Call API — not cloned ledger notes.

- Console lookback and facet tokens are flat text (15m / 1h / 24h / 7d, Vault posture, Flows filters) — no muted segment well. Selected lookback fills the strip (`bg-muted/70`). Filter tokens hover-fill the strip (Traces All / Errors / duration, Call dock, schema toolbar, sheet tabs).

- Console overview Store spoke shows only SQL / KV / Cache / Files / Index. Named KV namespaces (`drafts`, `reminders`, `view-prefs`, `webhooks`) fan when Store is focused.

- Console Traces list row no longer shows Replay — that action lives on the trace detail sheet.

- Console Traces list row shows cache status before duration: flash for hit, slashed flash for miss, muted unavailable for not applicable (`run.cache`). The detail sheet repeats the same mark next to the trigger kind.

- Console Traces filters drop the pill well: All / Errors are flat text toggles and duration is a borderless select. Advanced visualizes applied clauses (`trigger  =  signal`) instead of a raw query dump; presets toggle those clauses. `SelectTrigger` now accepts `flat`.

- ui-next Traces filter chrome: title, Advanced (icon + count), and live status share one header; All/Errors + duration sit on a single non-wrapping row with the duration select filling leftover width — no more wrap that stranded Advanced on a second line.

- ui-next Flow graph visual craft: per-kind HugeIcons + accents (Flow/Store/Signal/AI), color-coded bezier edges for reads/writes/emits/calls, `@dagrejs/dagre` LR layout, selection glow + desaturated dim, tighter unit-group bounds, and a pannable MiniMap.

- `oke dev` request lines append the WideEvent / run id after the timestamp so a Console `GET /console/vault` line can be pasted into Traces or `oke replay --request-id`.

- Console Trace / Flows Gates heading matches Waterfall: title and count sit together on the strip, not justify-between.

#### Console — Units & Call API

- Console Units tree lists HTTP flows by method: GET, POST, QUERY, PATCH/PUT, DELETE (then name). Was alphabetical, so `delete` sat above `get`.

- Call API Response status uses the same traces cache glyph as the Traces list (`CacheGlyph`: sky flash / amber flash-off / muted unavailable) beside `200`, then duration. Reveal-PII invokes skip auto-cache and do not invent a hit.

- Console sidebar hops restore the last Flows / Units / Store / Vault URL (selected trace, flow, resource, contract) instead of wiping the module back to its empty landing.

- Seeded Console Call API runs against the same Store as browse. `issues.list` returns rows, `issues.create` inserts, `attachments.delete` returns the deleted object. A leftover `:id` path token is `NotFound`, not a fake 200. Path fields prefill keel seed ids.

- Seeded Console list Call API takes query + pagination: `q`, `teamKey`, `limit`, `offset`, `cursor`, `orderBy`, `order`. The response includes `items`, `count`, `total`, `limit`, `offset`, and `nextCursor`.

- Console Call API Response has an expand control that opens the full JSON in a wide sheet (copy included) so long list payloads are readable.

- Console Call API body fields sit on a container grid that drops from five columns to one as the dock narrows.

- Console Traces toolbar uses the same explorer search as Units / Store / Vault (`Search traces…`) instead of a title. The query matches flow, unit, trigger, cache, error, and run id.

- Units explorer bands and folders start collapsed (search still expands matches).

- Console Units inspector is a vertical workbench: contract briefing above, Call API docked below (always visible). Request/Response sit side by side; identity, Fields/Raw, Reset, and Call live on the dock toolbar — no more scrolling past a long contract to invoke.

- Console Flows contract no longer lists derived Platform failure modes (401/403/422/429 from gates + schema). Declared Flow errors stay. Gates remain in their own section.

- Console Flows, Units, Store, and Vault share one explorer language: 28/72 split, h-8 search toolbar, tinted band headers, sky selection rail, sticky identity header, and the same Empty pane. Vault search and posture chips live in the left explorer (not a page-wide bar).

- ui-next Units tree: trigger bands (HTTP, Signal, …) are bordered, clearly separated sections with chevron + tinted kind-icon headers; unit folders also show chevrons and nest flows under a guide line — both levels collapse/expand (auto-reopen when the selection is inside). Trigger glyphs are now distinct per kind (API / radio / calendar / timer / store / function) with matching icon wells in Traces.

- ui-next Units Call API is trigger-aware: HTTP keeps method/path + body; call-only keeps `flow.in` with a bypasses-caller note and Manifest callers from `effects.calls`; cron/every prefer lease-gated `/console/clock/run-now` when a Manifest clock soft-joins, otherwise honest empty-input invoke fallback; signal keeps handler invoke with copy that it does not test bus delivery physics.

- `fx.ask` stamps `RunTelemetry.promptVersion` and adds cost only when the driver supplies `usage.cost` greater than zero. Token counts persist on the ask journal. `oke dev` attaches the host AI runtime so Call API asks reach `GET /console/ai`. Child-process HTTP asks still have a separate journal (no ingest bridge).

- Console Call API Response (and Body / Path params chapters) use the shared explorer strip: 0.08em heading, ink status, flush JSON rail — no padded well or status chip.

- Console Call API expanded Response sheet header is the same strip: stretch copy / close, hairline before close, no absolute icon-sm well or pr-12 dodge.

#### Console — Auth & shell

- Sign-in prefills `dev@oke.dev` only on standalone `dev:console` / `:seed`. `oke dev` and production leave email and password empty.

- Console Sign in / Create admin expanding-arrow tile uses primary ink, not sky.

- Console Sign in / first-admin claim is a docked lock: wordmark sits on the plate, calibration ticks on the corners, two-column instrument fields, page-ink tile on the key. The submit key sits below the plate, not inside it.

- Console claim / sign-in lock column is `max-w-md` (was `max-w-sm`) so the first-admin plate has room for the password meter and generate control.

- Setup / sign-in is a gate, not an inspector: OKE wordmark in open air, LED eyebrow + display title, underline ledger fields, ink key. The page foot stays traces (brand, theme tokens, version) — no boxed tray, no pill theme well.

- Console claim / sign-in drops the nested muted tray. The form is a lock ledger (uppercase labels, underline fields, display title); setup state stays an LED eyebrow, not a strip chip.

- Console Sign in / Create admin is a sharp expanding-arrow key (primary bar inverted per theme, sky tile, near-black dotted trail) — beUI motion, Console rail color, no lime pill.

- `dev:console-next` / `:seed` boot a fixed operator (`dev@oke.dev` / `Okengine123!`) so restarts skip claim; login form prefills in Vite serve. `dev:console-next:fresh` / `:fresh:seed` keep first-admin claim open. Renamed `dev:console-next:seeded` → `:seed`.

- Console first-operator claim keeps a stricter minLength **12** with the same character classes (`CONSOLE_PASSWORD_POLICY`), shared by the claim flow, ui-next meter/Zod, and setup docs.

- ui-next password strength bar uses a red → amber → lime → emerald ladder (theme primary washed out mid-progress in dark mode).

- ui-next authenticated sidebar stays always icon-collapsed on desktop (no expand / rail / header trigger); mobile sheet trigger unchanged.

- Console sidebar footer drops the operator avatar. Icon actions are Fast (command palette), Settings, and Logout.

- ui-next authenticated shell drops the inset top header (page title breadcrumb); content uses the full inset area.

- Console is the ui-next SPA. `oke dev` / `oke start` serve `src/console/ui-next/dist/`. Initial-load budget is 700 kB gzip (no legacy `panel-*` split).

- Access, Manifest Diff, Plugins, and standalone Runs are not in this Console yet — named backlog, not silently dropped. Backend projections remain.

- `oke dev` Notices and 4xx/5xx request follow-ups use the Claim house block: a colored `◇  Notice` / `◇  401` chip on its own row, then the body — yellow for warnings, red for 5xx. No dim `↳` line.

#### Runtime

- The `files` runs driver no longer uses a deleted tmpdir: default root is `.oke/runs`, `all()` reads every Parquet file (not just this process's catalog), and the memory driver opens DuckDB only when `query()` runs.

- `fx.json.with` accepts a `{ data, meta }` page (`fx.json.with(page)`) as well as the two-arg form. Flow `out` stays the item array — do not put the page object on `out`.

- List `meta.next` / `meta.prev` are the next request (`{ cursor }`), not flags. The typed client walks with `page.next()` or `for await (const page of api.notes.list({ limit: 20 }))` — no `.pages()`, no `if (mode)`, no `hasNext`. `meta.next` / `meta.prev` are typed `{ cursor }` bags for TanStack `pageParam`. Offset and keyset tokens share `?cursor=`. `hasNext` / `nextCursor` / `hasNextPage` / `ClientCall.pages` are gone (unreleased).

#### Dev, Keel & create-oke

- Keel Files is one `keel` bucket (was `attachments`). Seed lays out workspace folders — attachments, documents, avatars, projects, exports, forms — so Console browse matches the app.

- Keel and Console seed now declare four `store.index` facets — tasks, documents, comments, and projects — and fill each from featured + volume rows (was tasks only).

- Keel `oke db seed` (dev) initializes the built-in vault and writes the keel stubs plus minted stack URLs (Postgres / Redis / S3 / Meilisearch / Mailpit / AI) so `/vault` looks like production. `.env.local` keeps `OKE_VAULT_MASTER_KEY` and `PORT` — other apps still leave Vault empty.

- `examples/keel` now picks Signal delivery per job: comments, projects, forms, and goals emit `once` + `broadcast` + `live` (notify / search / late-subscriber feed). Tasks add `task-changed` broadcast; `task-assigned` is `live` optional.

- Keel Compose now starts llama.cpp so all eight elements are live. `drivers.ai` is `openai-compatible` in dev/prod (`mock` in test); the hero shows `openai-compatible · granite3.3:2b` instead of `—`.

- `examples/keel` and Console ui-next seed are work management (spaces, goals, projects, sections, tasks, forms, views) with first-class `project_manager` / `developer` roles — not a Linear issue tracker. Featured walkable id is `ENG-12`. Seed volume is ~500 tasks across SQL, KV, files, and index.

- Keel scheduled flows drop the repeated unit from the name: `drafts.expire`, `overdue.watch`, `recurring.spawn`, `goals.rollup`, `digest.daily` (was `drafts.expire-drafts`, …).

- Keel list responses put the item array in `data` and pagination in `meta` (Stripe envelope). `out` is `z.array(Item)`, not `{ items, count }`. create-oke Notes `notes.list` uses the same envelope. Store / Flow docs teach it as the preferred handwritten list, not a requirement.

- `examples/keel` flow `in` / `out` schemas now come from `drizzle-zod` (`createSelectSchema` / insert / update on generated tables) instead of hand-copied `z.object` column lists.

- S3 files (`RustFS` / MinIO) create the configured bucket on first open when `S3_ENDPOINT` is set, so `oke db seed` and uploads no longer fail with `The specified bucket does not exist`.

- `examples/keel` `oke db seed` now writes the same lived-in Linear story as Console ui-next seed — featured ENG-184 chain plus ~500 generated issues, comments, labels, drafts, attachments, and search index documents.

- ui-next seeded mode (`dev:console-next:seed`) is a Linear-shaped **keel** workspace: github.ingest → issues.create → notify.onIssue, `CycleClosed` failure, live `issues.list`, cycle rollover, Triage Intelligence, and draft TTL — all eight elements plus CDC, ~14 SQL tables (teams through customer_requests), KV drafts, file attachments, and issue search. Eight featured rows + 72 ops (~80 traces). Store browse defaults to 500 rows so the 500+ `issues` backlog (plus comments, labels, drafts, attachments) fills the grid. `sql:db` also lists the app Gate auth + `oke schema generate` system tables (`oke_identities`, sessions, roles, crons, vault stubs) — distinct from the Console `oke_console` operator folder.

- Default Compose image pins: RustFS `1.0.0-rc.2`, Mailpit `v1.30.7`, PgDog `v0.1.53`, Meilisearch `v1.53`, llama.cpp `server-b10450`, Ollama `0.32.13`, vLLM `v0.27.1`, SGLang `v0.5.17-runtime`, Traefik `v3.7`, nginx `1.31-alpine`. Floating tags (`postgres:18-alpine`, `redis:8-alpine`, `caddy:2-alpine`) stay.

#### Docs

- `/llms.txt` is a curated llmstxt.org index instead of the raw Fumadocs nav dump. Onboard AI copies `/llms.txt` plus `/llms/agents` on the current origin. The documented Vault curl no longer 404s.

- Landing CollapseDiagram shows the zoo and okengine rings side by side on one shared step (no tab switch).

- AI docs: `fx.ask` resolves capability pins `name@version` against the declared prompt; a mismatched pin is `ai: unknown prompt`.

### 🔥 Removed

- `store.resource({ unit })` — unit comes from `flow("notes.list")` and `.adopt({ notes })`, not a resource option.

- Legacy `src/console/ui/` Console SPA (15 `panel-*` chunks, Vite `:6534`).

- Console Traces duration-threshold select (Any / >10ms…>5s). Status (All / Errors) and Advanced (`duration > 100ms`) remain.

### 🐛 Fixed

#### Console — Chrome

- Console shortcut caps use ⌘ on Mac and Ctrl on Windows. Detection reads Client Hints / userAgent, not only `navigator.platform`.

- Sidebar Logout hover is destructive ink + wash. Tooltip and palette show `⌘E` / `Ctrl+E`.

- Console icon-rail selection is readable: idle icons sit at 30% ink, the active chip uses a stronger `--sidebar-accent`, and hover no longer clears the selected fill.

- Console Flow and Store schema MiniMaps were blank: graph nodes only set `style.width` / `style.height`, and xyflow MiniMap skips user nodes without top-level `width` / `height`.

#### Console — Observability

- Console `GET /console/runs` no longer nests each list response back into the runs store (`console.runs.list` output elided on record; prior list polls filtered from the projection). Live/poll fallbacks were doubling payload size every tick and OOMing the ui-next kernel (~GB RSS).

#### Console — Store

- Console index browse keeps focus while typing. Search no longer sits inside a tooltip trigger, the grid stays mounted across keystrokes, and the query waits 280ms of quiet.

- Console Store browse no longer shows classified emails in cleartext. `ownerEmail` / `owner_email` (and the same JS/SQL spelling split) mask as `[redacted]` unless the operator enables Include PII.

- Store Query editors paint SQL and KV with their own token colors (keywords / commands, strings, keys, numbers, comments) instead of a single gray overlay. KV is no longer highlighted as bash.

- Console Store KV browse on a dedicated namespace (`store.kv("drafts")`) lists root keys (`ENG-184`) instead of looking for `drafts:*`. Extract stamps `namespaces` so Overview Store resources include KV.

- Console Units Call no longer paints a thrown host error as `200` + `response: null`. A 500 envelope or `OkeError` (including OKE1006 undeclared secret) shows as a failure. Extract now binds `vault.config` so `fx.vault.get(publicAppUrl)` declares `PUBLIC_APP_URL`, and list flows can return the seeded rows Store SQL already shows.

- Console Units Call **Invoke as** uses the same Operator / Public / As Gate cards as Store Query. Operator bypasses the flow's gate chain; Public is anonymous; As picks a user or policy.

- Console Store schema graph infers camelCase FKs (`teamId`, `issueId`, `parentId`) the same as `*_id`, so keel tables draw relation edges instead of a single unlinked column.

- Console SQL query editor applies Shiki token colors with inline theme ink (`github-light` / `github-dark`) so `SELECT` / `FROM` are not a flat grey overlay.

- Console Units Call identity picker uses the same card menu as Store Query Gate (name, email, scopes) instead of a plain select.

- `oke dev` Console Call API and Store SQL now use the live host app (compose Postgres / Redis), not the empty Manifest memory sandbox. Invoke-as no longer returns `InvokeDenied: host invoke not configured`.

- Console SQL query console **Gate** menu no longer crashes on open (`MenuGroupContext` — label now sits inside `DropdownMenuGroup`).

- Console Store RLS policy rows are editable in the grid (`ALTER POLICY` for roles / USING / WITH CHECK). Creating a policy with RLS on now flips the table shield to emerald.

- Console Store explorer shows the RLS shield only on SQL tables (`pg_class.relrowsecurity`). KV, files, and index children no longer get a muted "RLS disabled" badge.

- Console Store SQL console no longer fails default `SELECT * … LIMIT 50;` on the memory driver — trailing semicolons are stripped before parse.

- Console Store Pending Changes **KV tab** shows `set(key, value, ttl?)` instead of a fake SQL `UPDATE`. Visual diff is unchanged. SQL tables still get the SQL tab.

- Console Store KV namespaces now have unique effect refs (`kv:drafts` vs `kv:triage-snooze`). Selecting one no longer highlights both, and browse lists only that namespace's keys.

- ui-next Store cell edit no longer draws a focus ring; pending brown fill covers the whole cell. Escape or clicking empty space clears the cell range.

- Console `storeEdit` / `storeDelete` SQL DML through `sql.raw` now uses `exec` (the memory driver has no generic UPDATE/DELETE on `query`), so ui-next Commit All actually writes rows instead of returning `InternalError`.

- Console Manifest StoreRuntime now derives SQL `classify` maps from `tables.*.columns` PII/sensitive tags (and `table.column` keys on `store.classifications`), so browse masking matches list `piiColumns` without a hand-registered classify map. Store query/edit/delete/sql paths also bind the panel-lazy runtime (previously only list did).

- Console Store browse of a Meilisearch index no longer fails with InternalError after the index already exists. Open is idempotent (GET then create; `index_already_exists` / HTTP 409 is success). Browse errors show the driver message, not a bare code.

#### Console — Vault

- Console Vault **Set** on Simulated env no longer returns `VaultNotFound`. The panel boots with gaps so the first write can land in `.env.local`.

- Console Vault lock-path no longer shows `simulate` under `oke dev` when `drivers.vault.dev` is `"vault"`. The Console was not given `oke.config`, so it fell back to the env driver. `oke dev` now passes the loaded config; `serveConsole` loads `oke.config.ts` from cwd when it is omitted.

#### Console — Flows & traces

- Tier-1 cache hits record the real `computed:…` lookup on the effect ledger. Trace Waterfall shows that cache read instead of "No effects recorded". Miss runs still show the store reads that actually ran.

- Console Trace request / response body fills leftover sheet height. Raw JSON is no longer capped at 14rem with empty space below. The sheet is `max-w-2xl` (was `max-w-xl`) so the payload has more room.

- Console Traces / Runs no longer 500 after a failed login sits next to a successful run. All-null `error_code` Parquet batches were JSON; `Unauthorized` was VARCHAR — DuckDB refused the union.

- Console Overview no longer paints Cache as a fifth Store type. Store kinds are `sql` · `kv` · `files` · `index`. Cache is a KV namespace (and HTTP read cache), not a facet.

- Console Overview element discs are name-only: no `N live` caption and no live-heat pulse. Center edge handles stay invisible. Hubs are 56px and show the two-letter lattice symbol (`Fl` · `Sg` · `St` · `Ck` · `Gt` · `Vt` · `Ch` · `Ai`). Hover still names the element.

- Console Traces Advanced clause and preset labels use stronger ink so they stay readable on the dark pane (no muted-on-muted greys).

- Console Traces list always shows relative time in the right column. Failed runs keep the rail / dot; hover still carries the error code.

- Console Flows graph keeps node cards (ships) above effect ribbons. Parent-group edges no longer inherit a child z-index that paints lines over store / signal / AI targets.

- `/flows` renders the graph + Traces page and `/units` renders the explorer — the path names now match the pages.

- HTTP API-key Bearer now authenticates through `onAuth`. WideEvent `principal` is the key id and `dimensions.api_key` is stamped. Session JWTs stay `claims.sub` with no key dimension. Forged / revoked / expired keys are 401.

#### Console — Units & Call API

- Call API Fields / Raw no longer draws a second hairline under the dock toolbar (the toggle sat in its own strip).

- `fx.ask` now converts Zod / shorthand `out` to JSON Schema (validate + `response_format`). Mock fills that shape instead of `{ ok, echo }`, so Call API `documents.summarize` returns a summary instead of generic Unavailable. Docker openai-compatible fails loud without `OKE_AI_URL`. Concurrent `/console/ai` no longer 500s on a duplicate DuckDB `runs` view.

- Call API Response no longer flashes cleartext then remasks, or drops the 200 chip on a PII toggle. Hide PII remasks in place; reveal refetches. The JSON viewer never paints a stale highlight.

- Call API **PII** now opens the host store session with cleartext when Include PII is on, and skips auto-cache so a prior masked list is not reused. Classified columns the handler reads (`ownerEmail`) were already `[redacted]` at the driver.

- `bun run dev:keel:reset` writes a fresh `.env.local` from `.env.example` (PUBLIC_APP_URL and the other vault / app defaults). The next `dev:keel` regenerates stack passwords. Keel now passes KV / index stores, vault configs, and clocks into `oke()` so Call API and KV Query resolve after a wipe.

- Overview Store spoke always shows **Cache** (engine `fx.cache` — not a Call API / trace) and fans declared KV namespaces (`drafts`, `triage-snooze`, `webhooks`) so keel does not hide them behind a Store click.

- Call API **PII** now renders on the toolbar. The panel imported `runs-pii` from a path Vite could not resolve, so `:6533` kept the last bundle without the control.

- Tables with a `name` column (teams, labels, cycles, …) no longer fail Call API with OKE1001 `sql:db`. The kernel now reads `tableName` so the capability matches extracted `sql:<table>`.

- Console Traces now lists Call API invokes (`issues.list` and other host flows). The in-process attach used by `oke dev` posts WideEvents to the same ingest bridge as the app child, so they sit next to clock ticks like `drafts.expire`.

- Console Units Call Response shows the handler output JSON on success. Invoke-as also unwraps `fx.json` and HTTP `{ data }` envelopes when `execute` left `output` empty.

- Console Units Call path-param fields show the route token as a placeholder (`:id`) and stamp the path on the Path params chapter.

- Traces no longer show `0μs` for a handler that finished in the same millisecond. Duration uses `performance.now()` when the app clock did not tick. Call API shows that handler time (same clock as Traces) and labels the browser round-trip as `rtt`.

#### Console — Auth & shell

- Command palette search mark is `size-3.5`, same as explorer row icons — it no longer fills the 40px strip.

- `oke dev` keeps the first-admin claim code on the live board (paste URL + `oke console claim-code`). The code is TTY-only — never returned from `GET /console/setup/status`. After surfaces bind, the TTY reprints one Ready board (elements, Docker, claim, notices, Backend / Console / MCP) so mid-boot db-push lines and health ticks cannot tear the claim box. The `bun --hot` child no longer clears the screen on schema reload. The pane drops after the first operator.

- Console setup chrome footer no longer draws hairline rules against the theme toggle. Brand sits left, theme center, version right.

- Console Sign in after an expired session returns to the module you were on (`/store`, `/units`, `/flows` plus search) instead of always opening Flows. `?next=` only accepts those three paths.

- First-admin claim/login no longer 500 with `ReadableStream has already been used` when a stale `oke_console_at` cookie (or Bearer) is present — public-flow `onRequest` skips re-wrapping a body already consumed by `parseValidate`.

- Console fields stay transparent when the browser autofills. `html` uses Tailwind `scheme-light` / `scheme-dark`; autofill ink follows `--foreground` with no UA wash.

- First-admin claim no longer flashes Sign in before Overview. Setup closes the instant the operator exists; the gate keeps the Created plate and uses the new session instead of swapping to login.

#### Runtime

- `fx.ask` with a versioned prompt handle (`document-summary@1`) resolves the bare prompt id. Call API `documents.summarize` no longer returns Unavailable `ai: unknown prompt`.

- After `oke keel reset`, Console Call API no longer mocks `fx.ask` when `OKE_AI_URL` is set. Traces also show `fail(code, { message })` on the run (Unavailable was a code with no reason).

- Clock `every` jobs no longer re-enter on the 1s scheduler tick. The slot (`lastRunAt`) is claimed before the handler, stacked ticks are skipped, and a named clock covers its interval so keel does not register both `watch-overdue` and `15m`.

- OKE1005 no longer fires when a flow asks a prompt by name and the Manifest stamped `effects.asks` as `name@version` (compiler pin). `documents.summarize` → `document-summary` matches `document-summary@1`. Distinct pins still deny.

- Console Gates list no longer 500s on apps that use `gate.public`. Reconstructing the Manifest used `gate.policy("public")`, which is reserved.

- Boot mints one `instanceId` (`inst-<uuid>`) for Clock, Journal, and the fleet registry. They no longer mint independently with different prefixes.

- Read-only flows cache automatically from inferred or ledgered `reads` — no `cache: "30s"` and no `fx.cache`. The first GET is a miss; the next identical GET is a hit. `cache: false` opts out; a duration string adds a TTL. Writes invalidate matching keys.

- `GET /_oke/client.json` wraps the runtime route map as `{ routes }` so `oke dev` can regenerate `oke-client.d.ts`. Chrome `GET /json/version` probes are silent on Backend as well as MCP.

- Clock traces like `drafts.expire` no longer fail with a bare `OkeError` and no message. `fx.store(kv).delete(key)` now extracts `kv:<namespace>` (not `kv:key`), `ttlMs` is a read, and thrown `OkeError`s record as `OKE1002` plus the cause.

- `store.schema.table` with a `name` column no longer throws `Unable to resolve table name from value` on insert, select, or Drizzle emit.

- Wrong-method hits on a registered path return **405** with `Allow` listing bound methods (was a generic 404). CORS preflight still answers first. Raw Console ingest 405s now include `Allow: POST`.

- Password policy special-character rule is canonical as `requireSpecial` on both `DEFAULT_PASSWORD_POLICY` and `CONSOLE_PASSWORD_POLICY`, with regression tests that a password missing only a special is rejected and that ui-next’s 5 checklist criteria match server validation.

- Kernel edge and Store-only `oke()` no longer statically import PostgREST `listPage`, i18n catalogs, `http.resource`, or auto-cache. Those load through computed `import.meta.require` when the feature actually runs, so unused graphs stay under budget.

#### Dev, Keel & create-oke

- Keel `oke db seed` no longer fails vault boot on empty `OKE_CONSOLE_SECRET` / `MEILI_MASTER_KEY` / `OPENAI_API_KEY`. Those contracts (and the other stack configs) now have `dev` fallbacks so the app can boot before seed writes the store. Compose `OKE_STORE_INDEX_KEY` still maps to `MEILI_MASTER_KEY`.

- `oke db seed` no longer crashes tallying Meilisearch `upsert` (`undefined is not an object (evaluating 'result.status')`). Index upserts return void; only SQL `{ status }` is counted.

- Keel reset no longer pins `OKE_AI_URL=http://127.0.0.1:8080/v1`. `oke dev` writes the published llama.cpp port (`:23xxx`).

- `oke dev` / `bun run dev:keel` hot-reloads Console UI from source. Vite attaches on an okengine checkout so `ui-next` edits no longer need `bun run build`.

- `oke dev` under Compose no longer refuses keel CRUD with OKE1008. `bindCrud` stamps `sql:<table>` on each verb; extract expands the same. Authors do not declare `effects` at the call site.

- A fresh `oke dev` hero now shows the effective driver map (signal Redis, clock Postgres, files S3, channel SMTP) even when `oke.config.ts` only pins overrides. `dev:keel:reset` SIGTERMs leftover listeners on `:6530` / `:6533` / `:6535`. Chrome inspector probes on MCP (`GET /`, `/json/version`) no longer paint as 404s.

- Keel `oke db seed` no longer inserts sections before projects (`sections_project_id` FK). Essential seed is spaces / members / tags; sections land with projects in the volume step.

- `oke dev` no longer crashes when an app binds `http.query` (RFC 10008). Bun.serve native `routes` reject QUERY; those verbs stay on the fetch fallback. An invalid route table retries fetch-only — Bun's HTML-bundling example is not printed.

- `bun run dev:keel` no longer dies with OKE1008 on `cycles.list`. Extract expands `bindNamedTableCrud` into unit-prefixed CRUD flows so effects are inferred, not hand-declared.

- `create-oke` **reuse previous settings** no longer re-asks locales / PgDog / proxy — saved answers from `~/.oke/create-defaults.json` apply directly (CLI flags still override).

- ui-next `tsconfig` no longer typechecks the Vite Console kernel plugin (SPA stays DOM-only); root `tsconfig` covers `vite.config.ts` + the kernel plugin.

- Typecheck for `tests/console/setup-ui-next.spec.ts` via a DOM-scoped `tests/console/tsconfig.ui-next.json` (root stays ESNext-only for kernel/server tests).

- `bun run build` no longer warns that Console chunks exceed 500 kB. Highlighting loads five grammars through the JS engine (no Oniguruma WASM / unused C++ bundle), and Overview / Flows / Store / Vault are lazy route chunks.

- `oke dev` no longer writes a label-only Compose `app` service when Traefik is pinned. That stub had no image or build, so `docker compose up` failed with `service "app" has neither an image nor a build context`. Laptop `oke dev` stays infra-only; Traefik labels still apply when `oke docker` includes `app`.

- `oke dev` no longer attaches Console Vite HMR to the create-oke `file:` stage (`~/.oke/create-oke/okengine`). That copy has `ui-next` source but is not the monorepo, so the browser requested `/src/features/flows/flows-page.tsx` and failed. Scaffolded apps serve `ui-next/dist` like a published install. Vite attach stays on for the okengine checkout (`workspaces` in package.json).

- create-oke templates and the local okengine stage list `@duckdb/node-api` in `trustedDependencies` so Bun runs its native postinstall. Console run history falls back to in-process events when DuckDB is missing instead of crashing the kernel.

- `oke db push` `missing_hints` now prints the unresolved statements instead of only the status line.

#### Docs

- Docs Signal and AI figures no longer ask Motion to interpolate `oklch` / `lab` theme tokens (`stroke` / `fill` stay attributes; Motion animates opacity and position only).

- Docs `GET /sw.js` is no longer a 404. A leftover service worker on localhost:3000 was still asking for the script; the site now serves an unregistering worker and drops the registration.

### 🔒 Security

#### Console — Store

- Console Store hides `oke_console` (operators, sessions, credential hashes) unless `OKE_CONSOLE_AUTH_STORE=1`. Query is refused when the flag is off.

- Console security gate **5c**: default `QUERY /console/store/query` on a table with PII-classified columns never returns unmasked values; `POST /console/store/reveal` returns cleartext and leaves an audited `console.store.reveal` Runs log (operatorId, ref, child, id, column) — same suite class as gate **5b** host-ingest masking.

- Console security gate **5e**: default `POST /console/store/sql` masks classified columns; `revealPii: true` returns cleartext and writes an audited `console.store.sql.reveal` log (operatorId, ref).

- `POST /console/store/sql` `asGate` must be `public` or a declared policy Gate (rate gates refused). The pick is audited as `console.store.sql.asGate` (operatorId, ref, gate).

- Store SQL performance query text is a named limitation `StoreSqlStatsQueryTextGap` — engine-native fingerprints, not Store browse masking. Live `pg_stat_activity.query` is collapsed until `revealPii: true`, which writes `console.store.sql.stats.reveal`. Documented in security.md §10.4.

- Store KV SLOWLOG args (keys and values) stay collapsed until `revealPii: true`, which writes `console.store.kv.stats.reveal` (operator, ref). Named limitation `StoreKvStatsSlowlogArgsGap`.

#### Console — Flows & traces

- Host → Console runs ingest never returns WideEvent bodies; operator reads stay on the masked `projectRun` path (adversarial PII gate covered).

#### Console — Units & Call API

- Console invoke-as adversarial coverage: assumed identity A never executes with identity B's scopes; host gates enforce the assumed principal.

#### Console — Auth & shell

- Console login `?next=` is allow-listed to `/overview`, `/flows`, `/store`, `/vault`, and `/observability` (plus their search). `/monitoring` rewrites to `/observability`. Other values (including `/units`) are dropped so an expired session cannot be an open redirect.

#### Runtime

- Host HTTP API-key authentication stamps `principal` as the bare key id (and `dimensions.api_key`) so Access per-key matching is real when a request is key-authenticated.