docs: say what the product does now, not what it did in August

[dspv]

An audit of the whole corpus — .ai/, README, CONTRIBUTING, docs/, and the site — against the code. Twenty-odd claims had gone false. These are the ones that would have cost someone something.

The privacy promise had quietly outgrown itself

Three documents said the release check is the single outbound call. The daemon can now also reach generativelanguage.googleapis.com (Gemini, on the user's own key) and api.telegram.org (the weekly report, to the user's own bot). Both are opt-in, both go to destinations the user chose, and both have an ADR — but the rule text never moved. Nothing is sent to Caprock, and that is the promise worth keeping; "one call" was the wording, not the principle. All three now name all three.

The premium page sold a shipped feature as unbuilt

The weekly report has worked since v0.42.1 and was sitting under a heading reading "Not written yet. Subscribing is what decides whether these get built" — so someone paying was told they were funding a promise that was already a product. Now "What premium unlocks". The same list advertised a webhook transport that does not exist (corrected) and a key-watching feature nobody has written (replaced with Gemini, which is real and appeared nowhere on the site).

The release runbook told you to verify a number that cannot appear

docs/RELEASING.md says to confirm caprock status reads hooks: 8/8. There are nine hooks since StopFailure. Following the runbook would have blocked a release on a check that must fail.

Gemini was missing from every user-facing list of agents

README, the site's works-with row, the site docs, 02-architecture.md, 04-ui.md, 14-build-status.md. Each described two agents. There are three, and they arrive three different ways — a shim and transcripts, a read-only SQLite database, and OpenTelemetry — which is the interesting part and was written down nowhere.

Two overturned ADRs had no forward pointer

• ADR-019 — a session ends after an hour of silence. Replaced by process liveness (ADR-028), on exactly the evidence its own "revisit if" asked for: 44 sessions paused over an hour and continued.
• ADR-023 — the Gemini key is never stored. Reversed by ADR-025; it lives in config.json at 0600, write-only over HTTP.

Both now say so at the top. ADR-005 ruled out licence keys in Phases 0–1 and its revisit condition has since been met; it says that too.

04-ui.md taught the wrong byte sequence

It documented the newline key as 5c 6e and explained at length why that value was correct. It is 1b 0d — ESC CR. 5c 6e was one of four wrong answers, and three of them survived because they were tested on an empty prompt, where a key that submits and a key that adds a line look identical. That is the part worth keeping, and it is what the section says now.

Also

• The manual release ledgers in 14-build-status.md and docs/RELEASING.md — one stopped at v0.10.0, eighty-four releases ago — are replaced by a pointer to CHANGELOG.md and git describe, which is what rule 9 asks for.
• tool_bytes and the gemini event source are in the contract's DDL (rule 8 — they should have landed with the migration).
• The daily cap, OpenCode's live SSE and its fixture tests are no longer described as unbuilt.
• The site's CLI reference lists report and license — without the latter a buyer cannot activate what they bought.
• The scripts inventory names the screenshot tooling it has had for weeks.

The site's own changes (works-with row, premium page, docs page, changelog synced to v0.48.0) are in caprock-web and need their own push.

https://claude.ai/code/session_01DR8fggA2LRHcjNWUsqtDcF