docs: a Hosted app section, to install the app, use it, what it keeps and the plans

[robbeverhelst]

A sidebar group, Hosted app, after the guides, with four pages written in this repo. The action has no Markdown about the app, so they are authored .mdx under src/content/docs/hosted-app/, and their ids are HOSTED_APP in src/lib/pages.ts. src/lib/routes.ts knows them, so page() links to them are checked like every other link.

The pages and their header pictures

Page	Picture	Why
hosted-app/install: Install the app	first-run	no dashboard yet, before the onboarding pull request
hosted-app/using-the-app: Using the app	deploying-3	a tick going through the gate
hosted-app/what-the-app-keeps: What the app keeps and never keeps	in-sync	the calm quay: nothing moves on its own
hosted-app/plans: Plans and adopted repos	pending-5	five crates, Free's five adopted repos

Neighbours in sidebar order: Security (pending-1) → the four above → sluiceway.yaml (pending-2). No two neighbours share a picture.

• Install the app: installing, the permissions GitHub asks for, the onboarding pull request (what it holds and what its description lists, when there is none), the secrets step that stays the person's, the failed first scan explanations, and the recordWriters line and what it allows.
• Using the app: sign-in, the org view, a repo's Dashboard tab, ticking from the app with Undo, Rescan, Insights, the audit log, edit mode with its templates and the pull request Save opens, and Settings.
• What the app keeps and never keeps: stack-level facts, never resource names, paths, diffs, values or repo files, no token of a person, no cloud credential, never a deploy on its own, GitHub as the source of truth and the catch-up, and leaving the app.
• Plans and adopted repos: Free 5 / 30 days, Team 25 / 13 months, Team Plus 100 / 3 years, with prices linked on sluiceway.dev/pricing and not repeated. It also covers what counts, active and locked repos, choosing in Settings, history, Upgrade through Checkout, and changing or cancelling in Stripe's portal.

Nothing here comes from sluiceway/company: no strategy, competitor names, internal numbers, or app decision-record numbers (that repo is private). Everything is in the words of the app's CONTEXT.md.

Sentences that are not product sentences

These give a reason, point outside the product, or depend on something that isn't live yet. Each is worth a look before merging:

1. Plans: "The prices are on the pricing page." The live https://sluiceway.dev/pricing does not show the plans or their limits yet: it still says no hosted product is on sale. The landing repo has an app-and-pricing-live branch. The table follows the numbers given for this change, not the live page.
2. Plans: "To pay by invoice, write to hello@sluiceway.dev. An invoice plan is changed the same way." A contact line, from the app's invoice-plan decision.
3. Install the app, the callout "The list is the repo's reviewed word": the reason an app has to be named in sluiceway.yaml rather than allowed by a setting. It is rationale, and it paraphrases the action's own configuration docs.

Changed after review, in f9b923e: ticking and Rescan from the app are on in production, so the two sentences about a switch are gone. Install the app and Using the app each say instead, in one line, that ticking and Rescan from the app work in a repo whose sluiceway.yaml names sluiceway[bot] in recordWriters, and in any other repo they open the dashboard on GitHub. On What the app keeps, the line about a break-in is now a product fact: "The app keeps no token of yours, so it cannot act as you."

Added in 801b85b, from the app's second approver slice (#25): Plans says the required second approver is on Team and Team Plus. The customer adds Sluiceway as a custom deployment protection rule on a GitHub environment, which GitHub offers on Enterprise and on public repos only, and on Free the app approves such a job at once. The lead no longer says every feature is on every plan: a plan now also decides whether a second approver can hold a deploy.

Checks

• bun run check passes under the default /docs base: lint, tokens, pin, typecheck, build, 591 tests.
• bun run links passes: 30715 links on 144 pages all land, under both /docs and DOCS_SITE=https://docs.sluiceway.dev DOCS_BASE=/, with bun test passing under the second one too.
• Checked by eye at 1340 wide (light and dark) and 400 wide (dark), with no sideways scroll.
• The external links (github.com/apps/sluiceway, app.sluiceway.dev, sluiceway.dev/pricing) answered 200 today. The weekly lychee run covers them.
• Not related to this change: bun run release warns that the pin is at v0.42.2 and the action released v0.43.0.

Not merged.

🤖 Generated with Claude Code