fix: correct the audit pass's own errors, and six it missed

Four of these are defects I introduced in the audit commits by applying
suggested replacement text without verifying the replacement the way I verified
the finding:

- `postgresql.enabled: false` alone renders an empty `DATABASE_URL`;
  `externalDatabase.enabled: true` is required too. I dropped it.
- The external-database password check is skipped under `existingSecret` and
  External Secrets, so "the chart refuses to render" was false. Under ESO the
  mapping is what matters.
- `LOG_LEVEL` is an uppercase-only enum, so the `info` I told operators to set
  would fail validation.
- `add cache` writes `REDIS_URL`, which `realtime` reads too, so recreating
  only the app container leaves Socket.IO pointed at the old Redis.

Six the audits missed:

- `PII_URL` used `<release>-pii`, the same fullname bug already fixed for the
  realtime Service. A manual value is also ignored when `pii.enabled`.
- External Redis does not need `redis.enabled: false` — a non-empty
  `app.env.REDIS_URL` overrides the bundled URL and suppresses its Deployment.
- `sim-setup doctor` was recommended to Ollama-stack users, which it cannot
  detect.
- The CA-bundle snippet said "in either case" directly after explaining that an
  incomplete chain must be repaired server-side.
- `update` refuses only the `dev` mode; a source checkout on
  `docker-compose.local.yml` is a Compose install and does update.
- Doctor cannot tell whether migrations are current on a standalone install —
  the published package ships no migration journal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/data-retention.mdx

@@ -213,9 +213,11 @@ PII redaction runs against a standalone [Presidio](https://microsoft.github.io/p
 
 ```bash
 # The Presidio service exposing /analyze and /anonymize
-# Helm — setting pii.enabled wires this for you. Set it by hand only for an
-# external Presidio, substituting your release name and namespace.
-PII_URL=http://<release>-pii.<namespace>.svc.cluster.local:5001
+# Helm — setting pii.enabled wires this for you, and a manual value is then
+# ignored. Set it by hand only for an external Presidio with pii.enabled:
+# false. The bundled Service is <release>-sim-pii, or <release>-pii when the
+# release name already contains "sim".
+PII_URL=http://<service>.<namespace>.svc.cluster.local:5001
 # Docker Compose — no shipped file defines a PII service. Add one to the
 # same project, then use its service name.
 # PII_URL=http://pii:5001

apps/docs/content/docs/platform/enterprise/whitelabeling.mdx

@@ -117,8 +117,8 @@ NEXT_PUBLIC_BRAND_NAME=Acme
 NEXT_PUBLIC_BRAND_LOGO_URL=/branding/logo.png
 NEXT_PUBLIC_BRAND_WORDMARK_URL=/branding/wordmark.svg
 NEXT_PUBLIC_BRAND_FAVICON_URL=/branding/favicon.ico
-# Must be same-origin — the CSP's style-src allows only 'self' and Google
-# Fonts, so a stylesheet on another origin is blocked.
+# The CSP's style-src allows only 'self' and fonts.googleapis.com, and takes
+# no configured hosts — in practice this means same-origin.
 NEXT_PUBLIC_CUSTOM_CSS_URL=/branding/custom.css
 ```
 
@@ -173,4 +173,4 @@ branding:
     favicon.ico: "AAABAAEAEBAAAAEAIABoBAAA..."
 ```
 
-With the default `mountPath`, a file named `logo.png` is served at `/branding/logo.png` — the value to give `NEXT_PUBLIC_BRAND_LOGO_URL`. Outside Helm, host the logo, wordmark, and favicon anywhere the browser can reach and point those variables at absolute URLs. `NEXT_PUBLIC_CUSTOM_CSS_URL` is the exception — it must be same-origin, since the CSP's `style-src` takes no configured hosts.
+With the default `mountPath`, a file named `logo.png` is served at `/branding/logo.png` — the value to give `NEXT_PUBLIC_BRAND_LOGO_URL`. Outside Helm, host the logo, wordmark, and favicon anywhere the browser can reach and point those variables at absolute URLs. `NEXT_PUBLIC_CUSTOM_CSS_URL` is the exception — the CSP's `style-src` takes no configured hosts, so in practice it must be same-origin.

apps/docs/content/docs/platform/self-hosting/docker.mdx

@@ -182,7 +182,7 @@ docker compose -f "$COMPOSE_FILE" up -d --force-recreate simstudio
 | `sim-setup reset` | After a confirmation prompt, archive the env files and wipe managed data. A Compose install archives the `.env` beside its Compose file; a source checkout, a Kubernetes install, and an invocation with no install detected all archive `apps/sim/.env`, `apps/realtime/.env`, `packages/db/.env`, and the root `.env`. On Kubernetes it runs `helm uninstall`, which leaves the Postgres volumes behind — they come from a StatefulSet's `volumeClaimTemplates`, which Kubernetes never deletes. Delete those PVCs yourself to reset the data |
 | `sim-setup config` | Show configured capabilities and integrations |
 | `sim-setup doctor` | Check the setup. `--fix` repairs what it can, `--json` prints machine-readable output |
-| `sim-setup add <feature>` | Configure one capability: `email`, `storage`, `sandbox`, `jobs`, `cache`, `knowledge`, `knowledge-embeddings`, `chat`, `llm`, or `integration <slug>`. Writes to the `.env` beside your Compose file — recreate the app container to apply — or to `apps/sim/.env` on a source checkout. It refuses when no configuration is writable, when more than one is, and for Helm releases |
+| `sim-setup add <feature>` | Configure one capability: `email`, `storage`, `sandbox`, `jobs`, `cache`, `knowledge`, `knowledge-embeddings`, `chat`, `llm`, or `integration <slug>`. Writes to the `.env` beside your Compose file — recreate the containers that read the value to apply it, which for `cache` means `realtime` as well as `simstudio`, since both take `REDIS_URL` — or to `apps/sim/.env` on a source checkout, where `apps/realtime/.env` needs the same value. It refuses when no configuration is writable, when more than one is, and for Helm releases |
 | `sim-setup desktop` | Resolve the desktop installer for this deployment. `--url <url>` skips discovery, and is required when several detected configurations name different `NEXT_PUBLIC_APP_URL` origins. `--no-open` skips the "Download it now?" prompt — the link is printed either way |
 
 `--dir <path>` is accepted by every command, not just the wizard. On a standalone install it also scopes the lifecycle commands to that directory's install, which is how you disambiguate when more than one exists.

apps/docs/content/docs/platform/self-hosting/kubernetes.mdx

@@ -17,7 +17,7 @@ import { FAQ } from '@/components/ui/faq'
 - PV provisioner support (a default StorageClass supporting `ReadWriteOnce`)
 - An ingress controller, if `ingress.enabled=true`
 - `metrics-server`, if you enable autoscaling
-- **Redis** — bundled by the chart (`redis.enabled: true`). Only supply your own if you set `redis.enabled: false`; see [Redis](/platform/self-hosting/redis)
+- **Redis** — bundled by the chart (`redis.enabled: true`). To use your own, set `app.env.REDIS_URL`: a non-empty value overrides the bundled URL and suppresses its Deployment on its own. `redis.enabled: false` is the explicit opt-out. See [Redis](/platform/self-hosting/redis)
 
 ## Installation
 

apps/docs/content/docs/platform/self-hosting/scaling.mdx

@@ -78,7 +78,7 @@ Each app replica opens a pool. Total connections grow with replica count, and Po
 
 Budget it: `replicas × pool size + realtime + cronjobs + migrations + headroom` must stay under `max_connections`.
 
-For anything beyond a handful of replicas, put **PgBouncer** in transaction pooling mode in front of the database and point the chart at it with `externalDatabase.host` / `externalDatabase.port` and `postgresql.enabled: false`. Setting `app.env.DATABASE_URL` does nothing — the chart computes `DATABASE_URL` itself and inlines it on the container, where it overrides anything from the Secret. This is the single highest-leverage change for a large deployment — it decouples app replica count from database connection count.
+For anything beyond a handful of replicas, put **PgBouncer** in transaction pooling mode in front of the database and point the chart at it with `externalDatabase.enabled: true`, `externalDatabase.host`, and `externalDatabase.port`, alongside `postgresql.enabled: false`. Both halves are required — with `postgresql.enabled: false` and `externalDatabase.enabled` still false the chart renders an empty `DATABASE_URL`. Setting `app.env.DATABASE_URL` does nothing — the chart computes `DATABASE_URL` itself and inlines it on the container, where it overrides anything from the Secret. This is the single highest-leverage change for a large deployment — it decouples app replica count from database connection count.
 
 ### Read replicas
 
@@ -147,8 +147,10 @@ externalDatabase:
   port: 6432
   database: simstudio
   sslMode: require
-  # Required — supply it here, through externalDatabase.existingSecret, or
-  # through External Secrets, or the chart refuses to render.
+  # Required unless you use externalDatabase.existingSecret or External
+  # Secrets, either of which skips this check. Under External Secrets, map
+  # externalSecrets.remoteRefs.externalDatabase.password — an omitted mapping
+  # renders no Secret and the pod cannot start.
   password: "<password>"
 
 autoscaling:

apps/docs/content/docs/platform/self-hosting/troubleshooting.mdx

@@ -5,7 +5,7 @@ description: Common issues and solutions
 
 ## Start here: `sim-setup doctor`
 
-On a Docker Compose or source install, run the built-in checker first. It catches most failures without you having to guess which subsystem is broken. It reads env files, so it is not a Kubernetes tool — on Helm, skip to the checks below.
+On a production or local-development Compose install, or a source checkout, run the built-in checker first. It does not detect the Ollama stack. It catches most failures without you having to guess which subsystem is broken. It reads env files, so it is not a Kubernetes tool — on Helm, skip to the checks below.
 
 ```bash
 npx sim-setup doctor
@@ -127,7 +127,7 @@ Rule out expiry and clock drift first: the endpoint's certificate may genuinely
 
 That leaves two cases a bundle does address: the endpoint is signed by a private CA — a corporate TLS-inspecting proxy, or an internal service — or it serves an incomplete chain, omitting an intermediate. Adding the private root to `NODE_EXTRA_CA_CERTS` resolves the first. An incomplete chain is different: Node still fails with `UNABLE_TO_GET_ISSUER_CERT` because the missing intermediate has to be served by the endpoint, so repair the server's chain rather than expecting a bundle to cover it.
 
-In either case, the image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. Mount your CA bundle and point Node at it:
+For the private-CA case, the image already ships current CA certificates and runs as a non-root user, so installing packages inside it is not the fix. Mount your CA bundle and point Node at it — an incomplete chain is not fixed here, only on the server:
 
 ```yaml
 # docker-compose.prod.yml

apps/docs/content/docs/platform/self-hosting/upgrades.mdx

@@ -214,7 +214,7 @@ docker compose -f docker-compose.ollama.yml --profile "$PROFILE" up -d
   `sim-setup update` refuses two install kinds outright rather than doing something surprising:
 
   - **Kubernetes** — it does not upgrade Helm releases. Use `helm upgrade` after reading the chart and release notes.
-  - **Source / dev** — update the checkout with git, run `bun install`, and restart `bun run dev:full`.
+  - **Source / dev** — the `dev` mode that manages only Postgres and Redis. Update the checkout with git, run `bun install`, and restart `bun run dev:full`. A source checkout running `docker-compose.local.yml` is a Compose install and does update, by rebuilding.
 
   On a standalone `docker-compose.prod.yml` install it also refuses to overwrite its managed Compose file if you have edited it by hand, comparing the file against the hash it recorded in `.sim-setup.json`: preserve or remove your customizations first.
 </Callout>

apps/docs/content/docs/platform/self-hosting/verify.mdx

@@ -23,7 +23,7 @@ Run it from the directory holding your `.env` and Compose file, or from a source
 | **Schema** | **Required** keys are present, are not still the example placeholder, are valid URLs where they should be, and have a usable shape — `ENCRYPTION_KEY` is checked as exactly 64 hex characters, the rest as a minimum length. Optional secrets are not shape-checked, so a malformed `API_ENCRYPTION_KEY` passes here and fails later at encrypt time. `--fix` generates missing or placeholder secrets |
 | **Consistency** | The same key agrees across files — `BETTER_AUTH_SECRET` between the app and realtime, and `DATABASE_URL` between the app and `packages/db` (a mismatch there means migrations ran against a different database). `--fix` mirrors the `apps/sim/.env` value |
 | **Coherence** | Configuration that is individually valid but jointly wrong: a feature flag whose dependency is unset, a storage provider that is half-configured, and a server flag whose `NEXT_PUBLIC_` twin disagrees with it |
-| **Live** | Postgres is reachable, pgvector is available, migrations are applied and current, Redis answers, and the running services respond on their ports. Doctor reads env files, so on the production Compose layout — where those values live inside the containers rather than in `.env` — the Postgres, migration, and Redis probes are skipped and only the HTTP health checks run |
+| **Live** | Postgres is reachable, pgvector is available, migrations are applied — on a standalone `npx sim-setup` install the published package carries no migration journal, so it can confirm what has been applied but not that it is current — Redis answers, and the running services respond on their ports. Doctor reads env files, so on the production Compose layout — where those values live inside the containers rather than in `.env` — the Postgres, migration, and Redis probes are skipped and only the HTTP health checks run |
 
 <Callout type="warn">
   The check worth knowing about before you hit it: if `NEXT_PUBLIC_APP_URL` points at `sim.ai` or any subdomain of it, Sim treats the deployment as Sim's own hosted platform (`isHosted=true`) and disables self-host overrides. Doctor flags this. Use your own domain.
@@ -104,7 +104,7 @@ All six should be present on Compose: `simstudio`, `realtime`, `db`, `redis`, `c
 
 **Step 8 fails — knowledge base upload errors.** Knowledge bases need a hosted embedding provider — OpenAI, Azure OpenAI, or Gemini. There is no local embedding backend. If a key is set, check pgvector is installed on the database.
 
-**Step 9 fails — no email arrives.** With no provider configured the mailer no-ops: it records the recipient, subject, and sender at `info` and reports success, never the message body. Raise `LOG_LEVEL` to `info` to see that line — at the production default of `ERROR` nothing is logged at all.
+**Step 9 fails — no email arrives.** With no provider configured the mailer no-ops: it records the recipient, subject, and sender at `info` and reports success, never the message body. Raise `LOG_LEVEL` to `INFO` to see that line — the variable is uppercase-only, and at the production default of `ERROR` nothing is logged at all.
 
 **Step 11 fails — schedule never fires.** Read the scheduler's logs (`docker compose -f docker-compose.prod.yml logs cron`, or `kubectl get cronjobs -n simstudio`). A `401` there means the app and the scheduler disagree on `CRON_SECRET`.