docs: accuracy sweep against current code

[integry]

Stacked on #2654 (user-docs cleanup), with current main merged in (includes #2555).

What this is

An accuracy pass, not a style rewrite. About 1,300 checkable claims across the user docs were verified against the code. Claims covered commands and flags, env vars and defaults, precedence, paths, UI labels and navigation, routes, limits, platforms and behaviors. About 150 wrong claims were corrected with minimal edits. The pending PRs #2612, #2570, #2628 and #2502 were treated as shipped. Lines those PRs edit themselves were left alone to avoid conflicts; fixes for their own docs are listed below.

Highlights

• Broken example configs. The .env examples in setup-local.md and deployment.md put DB_FILENAME and the GIT_* paths under /app/..., which is outside every container mount. The database would not persist and agent worktrees would break. They now match the template, and clones and worktrees are documented under /tmp/git-processor.
• Private key on launcher installs. The docs said to mount the .pem into the launcher and set GH_PRIVATE_KEY_PATH. The app containers never see the launcher's mounts, so that doesn't work. Both the CLI and the launcher use HOST_GH_PRIVATE_KEY; see docker/launcher/orchestrator.mjs githubKeyArgs.
• Security and execution pages overstated isolation.
  • Implementation containers receive the installation GH_TOKEN/GITHUB_TOKEN.
  • OpenCode and Antigravity containers mount all of /tmp/git-processor read-write, which holds every repository's clone.
  • The optional firewall allowlists only api.anthropic.com for model traffic.
  • .env is mounted only into the service containers.
  • The pages now say what the code does.
• CLI reference.
  • propr ui/propr docs take on|off.
  • Added images pull, task followup and task import.
  • Corrected the task revert arguments, the plan create -b default and the per-command --json flag.
  • Added the missing settings keys.
• PR commands.
  • /merge is the only command that requires a processing label.
  • Documented how /switch, /use and /review handle unknown models, and how /fix list parsing works.
  • Corrected when /ultrafix waits for CI and its stop reasons.
  • Documented automatic failed-CI follow-up.
• Configuration reference.
  • Corrected defaults and precedence: GH_AUTH_MODE inference, OAuth vars required only for github login, PR_FOLLOWUP_TRIGGER_KEYWORDS and others.
  • Added user-relevant variables that are read but were undocumented.
• Desktop. Rewrote the menu/shortcut table from application-menu.ts; the documented "Go" menu with Cmd+1..7 didn't exist. The pairing flow now includes the provisional token → activate step and self-revoke.
• MCP.
  • Access tokens last 15 minutes, not 5.
  • The scope ceiling defaults to read, plan, review and applies only to Settings-managed enablement.
  • A changed encryption key disables MCP until connections are revoked.
  • Removed links to the private routing repo; the hosted gateway is marked not yet publicly available.
• Architecture.
  • DEFAULT_CLAUDE_MODEL replaces the nonexistent DEFAULT_MODEL_NAME.
  • Documented the daemon → worker job fan-out and the processGoal job.
  • CONTEXT_ANALYSIS_TIMEOUT_MS default is 60 minutes.
  • Restored the truncated ending of preview-storage-relay.md.

Suspected code issues found (not changed here)

• .env.example ships an active MCP_ENABLED=false, and propr init stack copies it. That blocks enabling MCP from Settings on fresh stacks.
• Follow-up trigger keywords saved in Settings, the API or MCP are never read by the trigger logic; only the env var is.
• Agent containers get the installation-wide token and a read-write mount of every clone.
• The firewall allowlist covers only Anthropic, so enabling it blocks the other agents.
• CODEX_MAX_TURNS is read but never applied.
• propr plan create hardcodes main as the base branch.
• /ultrafix pause=0 becomes 60s.
• /switch and /use with an unknown model give no feedback on the PR.
• The merge-marker scan lets the push proceed if the scan itself errors.
• In bundled Agent Tank mode, synthetic-pool caps read only a 90-second in-process cache that nothing refreshes. They also override the documented 5-minute SYNTHETIC_USAGE_FRESHNESS_MS.
• With CONFIG_REPO unset, the daemon and worker read processing labels and concurrency from env rather than saved settings (needs confirmation).

Pending PRs

#2612, #2628 and #2656 have since merged into the base. The review fixes for #2612's docs are applied here:

• listed the notifications resources, and allowed the token in the doc test
• retitled the optional-expectedHead step
• removed stale epic process text
• corrected the trigger-access rules: a whitelist is exclusive, a [bot] suffix is ignored, and empty keywords trigger on every comment

Still open:

• [Goal by GPT-6 Astra] Add Antigravity agent goal execution lifecycle support #2570: its goals.md should add --disable-slash-commands to the Antigravity capability requirements. Expect a goals.md conflict: keep this branch's structure and add the PR's Antigravity sessions, checkpoints and completion sections.
• [2500 by Claude Opus 5] Cache downsampled canvas preview images locally with 1-week expiration and Cache downsampled canvas preview images locally with 1-week expiration #2502: accurate as written.

Not verified

Claims about the ProPR Connect service side (seats, dashboard, storage quotas, token formats) were left unchanged; that code isn't in this repository. Third-party pricing and OS behavior were also left unchanged.

Verification

npm run build --prefix docs passes with broken-link errors enabled.

🤖 Generated with Claude Code