docs(user-docs): detailed review against dev — browser admin claim, first-run overlay, platform keys, canvas lifecycle, abilities 2.0

[trinity-ability]

Summary

A detailed review of every page under docs/user-docs/ against the code on dev, following this morning's full sync (#2746). Everything that merged after that sync is now documented, and the audit also caught claims that had drifted earlier. 78 pages updated, 61 verified unchanged; FAQ 431 → 470 questions, index regenerated from headings.

Landed since the morning sync, now documented

• Browser admin claim + first-run overlay (feat(onboarding): browser admin claim, one first-run overlay, credentials without a terminal (trinity-enterprise#580, #581, #582) #2715) — a 1-Click / installer boot no longer generates a password; the first visitor claims the admin at /setup (ADMIN_PASSWORD_SOURCE=browser). The dashboard card ladder is replaced by one first-run sequence with its re-run entry under Settings → General. Setup, quick start, overview, roles, the UI tour, all seven deploy guides, telemetry and the FAQ rewritten around it. Every "restart the backend to re-read .env" instruction corrected to a container recreate.
• Platform keys from the browser (feat(onboarding): browser admin claim, one first-run overlay, credentials without a terminal (trinity-enterprise#580, #581, #582) #2715) — Claude, GitHub, Resend and Gemini keys set and validated in Settings, env vars as the fallback; reflected across credentials, subscriptions, voice, VoIP, image generation and avatars (+ bundled default avatars, fix(avatars): bundle a default avatar with each first-run template (#2693) #2776).
• Canvas lifecycle (feat(canvas): delete, pin, search and a stated bound for the canvas pile (ent#553) #2619, feat(canvas): share a canvas at a link, and download it as a PDF (ent#554) #2623, feat(canvas): the open canvas is shared context for the turn (ent#555) #2628, fix(canvas): the canvas header renders two facts instead of a staleness verdict (#2734) #2779) — delete / Manage / pin / search / the per-agent cap, share links with two scopes, PDF, the open canvas as turn context, the two-fact header. The canvas page now carries the full REST + MCP surface; the Workspace page describes the rail side; the shared-canvas route is in the API reference.
• Skills library legacy adoption (fix(skills): match the legacy library URL by repo, not by raw string (#2763) #2764, fix(skills): the legacy-adoption refusal files one row per refused URL, not one per sync (#2744) #2777) — repo-identity matching and the one-row-per-URL alert, with the cancel-not-acknowledge rule on the Operating Room page.
• Voice (fix(workspace): the audio bridge owns the live-call lease, arms it at connect and always releases it (#2700) #2775, feat(voice): a long task runs in the background and the agent says it once (abilityai/trinity-enterprise#551, #576) #2735) — background tasks on a call, the mute hotkey, the leave-mid-call prompt; the orphaned-call 409 note removed.
• Abilities marketplace 2.0 (abilities f84bbce, today) — the eight retired domain wizards removed everywhere; plugin versions, skill counts, /trinity:* skill changes and the TRINITY_PLATFORM_PLUGINS=0 opt-out.

Corrections found by the audit

• Permissions tab direction was documented backwards (it controls who this agent may call).
• subscribe_to_event third argument is target_message; initialize_github_sync takes repo_owner/repo_name, not repo_url.
• Image generation endpoint is /api/images/generate; health check is /health.
• /api/internal/decrypt-and-inject and the process-trigger routes no longer exist; the startup credential auto-import was documented as working (see follow-ups).
• Slack / Nevermined / Telegram / WhatsApp setup steps and Settings labels now match the UI; GitHub token locations corrected; MCP key panel labels and revoke-vs-delete.
• New sections: per-public-link Connect Slack, the Workspace Speak replies aloud toggle, webhook rate limits, the missing git-sync and canvas routes, Failed execution stat card, High Ctx mobile label, no "tag clouds" / "Require verified email" toggle / "Operations → Restart All" (none exist).

Not in this PR

• No whats-new/v0.9.5.md — the release is still at RC; /release writes docs/releases/0.9.5.md at cut time, and the screenshot request follows then.

Follow-ups for code owners (not docs)

• docker/base-image/startup.sh still POSTs to /api/internal/decrypt-and-inject, which no router serves — every such boot logs "Could not auto-import credentials".
• Operations has no per-item Cancel, yet cancelling is now the intended action for the legacy skills-library alert (fix(skills): the legacy-adoption refusal files one row per refused URL, not one per sync (#2744) #2777).
• src/mcp-server/src/tools/rooms.ts create_room descriptions say 60 messages / 24 h; the service defaults are 200 / 168 h.
• trinity-ops-public scripts/tunnel.sh port defaults disagree with its own .env.example.
• abilities README.md and marketplace.json lag the plugins on disk.

Verification

• find docs/user-docs -name '*.md' | wc -l → 139; 78 modified (+790 / −456)
• Relative-link check across the tree → 0 broken; FAQ index anchors → 0 bad
• Issue-number / codename grep → 0 hits outside dev-announcements/ and whats-new/ archives; FAQ grep → 0
• Public-safety greps (sshpass|tailnet|ts.net|ssh -i …@, private IPs, instances/*/) → 0 hits tree-wide
• enterprise-docs-guard.yml pattern run locally over docs/user-docs/ → 0 hits
• UI labels taken from the .vue files, endpoints from router decorators, MCP tool signatures from the .ts modules

Journey Impact

Journey Impact: none: documentation only under docs/user-docs/ — no runtime code, no API or UI behaviour changes, no promise in tests/journeys/catalog.yaml touched.

🤖 Generated with Claude Code

[vybe]

merge-train: batch validated on train/20260915-1011 (#2808) — full suite green across all five members together.