Remove over-comments, dead code, and duplicate logic

docs/.vitepress/theme/FileTree.vue

@@ -365,7 +365,6 @@ const TreeNode = defineComponent({
   color: var(--vp-c-brand-1);
 }
 
-/* Adapter tabs */
 /* Adapter tabs */
 .adapter-tabs {
   display: flex;

docs/guide/ai.md

@@ -41,7 +41,7 @@ export const POST = defineHandler(async (c) => {
 });
 ```
 
-AI methods return promises. Await them to receive the result, or return the promise directly from a handler. Usage limits reject with [`UsageLimit`](#usage-limits); Void route handlers and Pages actions automatically send a structured HTTP 429 when it is left uncaught.
+AI methods return promises. Await them to receive the result, or return the promise directly from a handler. See [Usage Limits](#usage-limits) for limit errors.
 
 You can use any model available through Cloudflare's AI binding, including Workers AI models such as `@cf/meta/llama-3.3-70b-instruct-fp8-fast` and Cloudflare Gateway models such as `google/gemini-2.5-flash` or `openai/gpt-4.1-mini`. The input object must match the selected Cloudflare model's schema. Models that return binary data, such as generated images, are returned as a `Blob` from `ai.run()`.
 

docs/guide/auth.md

@@ -92,7 +92,7 @@ Email/password is enabled by default. To add social providers:
 }
 ```
 
-Use `auth.providers` when you want to enable social providers explicitly. Provider credentials come from `AUTH_<PROVIDER>_CLIENT_ID` and `AUTH_<PROVIDER>_CLIENT_SECRET`.
+Provider credentials come from `AUTH_<PROVIDER>_CLIENT_ID` and `AUTH_<PROVIDER>_CLIENT_SECRET`.
 
 See the full provider list in the [config reference](../reference/config.md#auth).
 

docs/guide/database/postgresql.md

@@ -59,7 +59,7 @@ export const users = pgTable('users', {
 });
 ```
 
-`void gen model` generates PostgreSQL-appropriate code when the dialect is set to `postgresql`.
+`void gen model` generates PostgreSQL-appropriate code when `database` is set to `"pg"`.
 
 ## Migrations
 
@@ -88,4 +88,4 @@ To update a linked Void project's connection, for example after moving the datab
 void db set-url
 ```
 
-This prompts for the new connection string and updates the Hyperdrive configuration. The change takes effect on the next deploy.
+This prompts for the new connection string and updates the Hyperdrive configuration.

docs/guide/edge/rewrites.md

@@ -109,15 +109,13 @@ The file can include [3xx redirects](./redirects) too. Rules in `void.config.ts`
 
 ## Client navigation
 
-Rewrites run on the server. In Pages mode, a client-side `<Link to="/docs">` navigation may fetch loader data for `/docs` rather than the rewritten route `/en/docs`.
+Rewrites run on the server. In Pages mode, a client-side `<Link href="/docs">` navigation may fetch loader data for `/docs` rather than the rewritten route `/en/docs`.
 
 Use `<a href="/docs">` to make a full server request when the destination has a different loader. Use a redirect if the URL should change.
 
 ## ISR cache keys with rewrites
 
-Static rewrites cache the destination separately for each original pathname. Query parameters vary the cache only when included in `routing.revalidateQueryAllowlist`. Middleware rewrites don't create a separate cache variant.
-
-Purge the destination with `revalidate({ paths: ['/en/docs/foo'] })` to clear direct and rewritten requests. Purging only `/docs/foo` does not clear that entry. See [Revalidation](./revalidation).
+Purge the destination path, such as `/en/docs/foo`, to clear rewritten cache entries. See [Cache keys and rewrites](./revalidation#cache-keys-and-rewrites).
 
 ## Debugging with `X-Void-Routing`
 

docs/guide/email/sending.md

@@ -59,8 +59,6 @@ Cloudflare emails the recipient with a verification link. Once they click it and
 void email destinations
 ```
 
-The project owner’s email is added automatically, but still needs verification as described in [Setup](#setup).
-
 ::: warning When this is the right fit
 The shared sender suits team alerts, project notifications, and replies to inbound mail.
 

docs/guide/env-vars.md

@@ -39,8 +39,12 @@ STRIPE_KEY=sk_test_example
 VITE_API_ORIGIN=http://localhost:5173
 ```
 
+An unquoted value ends at `#`, which starts a comment. Quote a value that contains `#`, such as `DATABASE_URL="postgres://user:p#ss@localhost/my-app"`.
+
 Keep `.env` out of Git. Other dotenv files, including `.env.local`, `.env.production`, `.env.example`, and Wrangler’s `.dev.vars*`, are not supported.
 
+Names starting with `__VOID_` are reserved for Void. Void stops with an error if `.env` or `env.ts` defines one.
+
 Run the local check at any time:
 
 ```sh

docs/guide/jobs.md

@@ -70,8 +70,6 @@ curl -X POST http://localhost:5173/__void/scheduled \
   -d '{"cron":"0 * * * *","scheduledTime":'"$(date +%s000)"'}'
 ```
 
-If you set `__VOID_PROXY_TOKEN` in `.env`, that explicit token takes precedence and the printed curl command uses `x-void-internal: <your-token>` instead.
-
 The endpoint works in native Void apps and supported frameworks. Framework jobs run in the adapter's development runtime and use the bindings it provides.
 
 ## Deployment behavior

docs/guide/pages-routing/markdown.md

@@ -401,7 +401,7 @@ Code blocks include a copy button.
 
 ### Line Numbers
 
-Enable per code block with `:line-numbers` or disable with `:no-line-numbers`:
+Enable per code block with `:line-numbers`:
 
 ````md
 ```ts :line-numbers
@@ -412,14 +412,6 @@ const b = 2;
 
 Start from a specific number with `:line-numbers=5`.
 
-### Snippet Imports
-
-Import code from external files:
-
-```md
-<<< ./path/to/file.ts
-```
-
 ### Emoji
 
 Shortcodes convert to unicode: `:tada:` becomes :tada:, `:rocket:` becomes :rocket:.
@@ -455,16 +447,16 @@ Headings include permalink anchors. Use `[[toc]]` for a table of contents. Image
 ```ts
 voidMarkdown({
   shiki: {
-    themes: { light: 'github-light', dark: 'github-dark' }, // Shiki themes
-    langs: ['sql', 'graphql'], // additional languages
+    themes: { light: 'github-light', dark: 'github-dark' },
   },
 });
 ```
 
-| Option         | Type                             | Default                                          | Description                  |
-| -------------- | -------------------------------- | ------------------------------------------------ | ---------------------------- |
-| `shiki.themes` | `{ light: string; dark: string}` | `{ light: "github-light", dark: "github-dark" }` | Shiki color themes           |
-| `shiki.langs`  | `string[]`                       | Common web languages                             | Additional languages to load |
+| Option         | Type                             | Default                                          | Description        |
+| -------------- | -------------------------------- | ------------------------------------------------ | ------------------ |
+| `shiki.themes` | `{ light: string; dark: string}` | `{ light: "github-light", dark: "github-dark" }` | Shiki color themes |
+
+Code block languages load on demand from Shiki's bundled languages.
 
 ## Building a Sidebar
 

docs/guide/platform/administration/access.md

@@ -30,15 +30,7 @@ the company sign-in before Void login. Interactive Access authentication uses a
 locally installed `cloudflared` and saves its short-lived credential in your
 system keychain for that platform origin. You do not need to copy browser cookies.
 
-For CI, use a [project deploy token](/guide/platform/installation/first-deployment) alongside your Access credentials. An Access service token does not authorize a Void deployment.
-
-Store Access credentials in origin-keyed `VOID_ACCESS_CREDENTIALS`. A deploy
-that uses prerendering or remote bindings needs entries for both the exact API
-and proxy HTTPS origins, even when both entries contain the same admitted
-service-token pair. `VOID_ACCESS_ORIGIN` selects only one recipient and therefore
-cannot cover both calls. Keep the JSON value in your secret manager, not in
-application configuration. See [CI deployment setup](/guide/platform/installation/first-deployment)
-for the required shape.
+For CI, use a [project deploy token](/guide/platform/installation/first-deployment) alongside your Access credentials in origin-keyed `VOID_ACCESS_CREDENTIALS`. An Access service token does not authorize a Void deployment. See [CI deployment setup](/guide/platform/installation/first-deployment) for the required origins and shape.
 
 ## Choosing a Platform
 

docs/guide/platform/administration/operations.md

@@ -66,18 +66,9 @@ The dashboard’s **System Status** page refreshes health checks every 30 second
 
 Use `void platform upgrade`, `repair`, `disable`, and `enable` to maintain your platform. See [platform maintenance](/guide/platform/installation/maintenance#resume-repair-recover-and-upgrade).
 
-Upgrades and rollbacks run through the CLI; watching their progress is optional.
-During maintenance, navigating the admin UI automatically redirects to
-`/admin/status`. You can also open that page directly on the API origin. It
-refreshes automatically and shows saved progress and the API's traffic state
-while the API and authentication database remain reachable. If a status refresh
-fails, the last confirmed snapshot is marked as stale. Normal administrator
-changes stay paused during maintenance.
-If the CLI reports an error or a waiting state, follow its recovery instructions
-to resume the operation. See
-[Follow upgrade and rollback progress](/guide/platform/installation/maintenance#follow-upgrade-and-rollback-progress).
-
-For disaster recovery, keep a matching PostgreSQL backup, provider data backups, installation identity and complete project-encryption keyring, and immutable runtime artifacts. Keep traffic disabled while restoring data, run `discover` to reconstruct verified local metadata, and review `repair --plan` before recreating missing installer-owned infrastructure. Neither command restores backed-up data. See [Prepare for disaster recovery](/guide/platform/installation/maintenance#prepare-for-disaster-recovery) for the full sequence.
+During an upgrade or rollback, the admin UI shows progress at `/admin/status`. See [Follow upgrade and rollback progress](/guide/platform/installation/maintenance#follow-upgrade-and-rollback-progress).
+
+For backups and restores, see [Prepare for disaster recovery](/guide/platform/installation/maintenance#prepare-for-disaster-recovery).
 
 ## Using Scripts
 

docs/guide/platform/development/local.md

@@ -36,7 +36,7 @@ Use the Node.js version recorded in `.node-version`.
 
 The `@voidcloud/*` names identify workspace implementation packages. Their `private: true` flags prevent publishing those packages to npm. Deployable core Workers are bundled into the public `@void/platform` package.
 
-The core installer creates the API, dispatch, proxy, and tail Workers. The dashboard and managed GitHub build services are available in the source tree but are not included in that installation. Adding an optional service requires its infrastructure, bindings, authentication, and capability configuration together.
+The core installer creates the API, dispatch, proxy, tail, and email gateway Workers. The dashboard and managed GitHub build services are available in the source tree but are not included in that installation. Adding an optional service requires its infrastructure, bindings, authentication, and capability configuration together.
 
 ## Running the API Locally
 

docs/guide/platform/development/runtime.md

@@ -25,7 +25,7 @@ void-dev platform install \
   --plan
 ```
 
-Before applying the plan, complete the [installation guides](/guide/self-hosted-platform). Run the command without `--plan` to install. For testing before your domain is ready, replace `--application-domain` and `--zone` with `--workers-dev`; PostgreSQL and the runtime/GitHub/R2 credentials are still needed. Use `void-dev` in place of `void` and keep `--runtime packages/platform/dist/runtime` on install and resume commands. For an interrupted installation, keep that runtime build available until it completes.
+Before applying the plan, complete the [installation guides](/guide/self-hosted-platform). Run the command without `--plan` to install. For testing before your domain is ready, replace `--application-domain` and `--zone` with `--workers-dev`; PostgreSQL and the runtime, login-provider, and R2 credentials are still needed. Use `void-dev` in place of `void` and keep `--runtime packages/platform/dist/runtime` on install and resume commands. For an interrupted installation, keep that runtime build available until it completes.
 
 Later, run `void-dev platform domain set example.app`. Domain setup uses the existing installed runtime and needs no `--runtime`, rebuild, or app redeploy. It keeps the platform API URL and original workers.dev app URLs available.
 

docs/guide/platform/development/schema-ci.md

@@ -20,7 +20,7 @@ Review the generated SQL and migration journal before committing them. Released
 
 `@void/platform` contains installation manifests, resource naming, discovery contracts, Worker configuration, and deployable bundles under the `./installer` export. Platform source lives in `platform/packages/`.
 
-Runtime artifacts include migration SQL, its journal, and a rollback compatibility manifest. Drizzle authoring snapshots remain in the source tree. Migrations are forward-only; compatibility edges in `platform/packages/api/drizzle/compatibility.json` must be tested against the earlier runtime before publication. The build verifies schema lineage and hashes the journal and SQL files.
+Runtime artifacts include migration SQL, its journal, and a rollback compatibility manifest. Drizzle authoring snapshots remain in the source tree.
 
 ## CI in a Fork
 

docs/guide/platform/installation/domains.md

@@ -91,7 +91,7 @@ New platform resources use deterministic `void-<installation-name>-<role>` names
 | Workers                                   | 5, plus one per app using workers.dev | API/control plane, proxy, tail ingestion, dispatch, email gateway, and test-origin forwarders |
 | KV namespaces                             |                                     3 | Routing, ISR cache, and static asset storage                                                  |
 | R2 buckets                                |                                     1 | Static and deployment assets                                                                  |
-| Queues                                    |                                     2 | Usage events and cron firing                                                                  |
+| Queues                                    |                                     3 | Usage events, cron firing, and deployments                                                    |
 | Workers for Platforms dispatch namespaces |                                     1 | User application Workers                                                                      |
 | Hyperdrive configurations                 |                                     1 | External platform PostgreSQL                                                                  |
 | AI Gateways                               |                                     1 | Installation-isolated AI routing and metering                                                 |

docs/guide/platform/installation/first-deployment.md

@@ -83,7 +83,7 @@ void platform signup allow github teammate
 
 Void shows the proposed access change and asks you to confirm it. Once approved, `teammate` can connect to the platform's API URL and sign in with GitHub.
 
-To see who can join, run `void platform signup show`. You can also allow an email address or a domain such as `*@example.com`. For an OIDC user without verified email, use `void platform signup allow identity <connection-id> <subject>`; the subject match is exact and the provider's domain or group restrictions still apply. Remove that grant with `void platform signup disallow identity <connection-id> <subject>`. `void platform signup open` permits public signup; `void platform signup restrict` requires an allowlist match again.
+To allow email addresses, domains, or OIDC identities, or to open signup, see [Giving People Access](/guide/platform/administration/access#giving-people-access).
 
 Your administrator session lasts for one hour. Use it to inspect users, projects, logs, and platform health. The [Platform Administration guide](/guide/platform-administration) walks through those workflows, previews, and automation. You can also open `<API origin>/admin/login` to use the browser admin UI.
 

docs/guide/project-collaboration.md

@@ -66,8 +66,8 @@ An invitation is bound to the registered account. Forwarding its ID does not let
 These three commands use the active platform connection selected by
 `void connect`, even inside a directory linked to another project or deployed
 directly to Cloudflare. `VOID_API_URL` takes precedence when set. If you use
-`VOID_TOKEN`, set `VOID_API_URL` to the matching platform; a token without that
-URL selects Void Cloud. Each command shows the platform it contacts.
+`VOID_TOKEN`, also set `VOID_API_URL` to the matching platform. Each command
+shows the platform it contacts.
 
 Accepting an invitation grants access without linking your current directory.
 Open the invited application's directory and run `void project link` if it is

docs/guide/queues.md

@@ -137,6 +137,4 @@ curl -X POST http://localhost:5173/__void/queue \
   -d '{"queue":"my-queue","messages":[{"id":"1","timestamp":'"$(date +%s000)"',"body":{"hello":"world"},"attempts":1}]}'
 ```
 
-If you set `__VOID_PROXY_TOKEN` in `.env`, that explicit token takes precedence and the printed curl command uses `x-void-internal: <your-token>` instead.
-
 In supported meta-frameworks, use `/__void/queue` to test a consumer manually. It runs inside the framework adapter's development runtime with that adapter's bindings. Sending to a queue binding doesn't automatically invoke the consumer in this mode.

docs/guide/remote-dev.md

@@ -49,16 +49,16 @@ AI requests use your platform’s account and allowance in both local and remote
 When the dev server starts with remote mode active, it prints:
 
 ```
-⚡ Remote bindings active (my-project.apps.example.com)
-   DB      → remote D1
-   KV      → remote KV
-   STORAGE → remote R2
+[void] Remote bindings active
+         DB      → remote D1
+         KV      → remote KV
+         STORAGE → remote R2
 ```
 
 ## Limitations
 
 - **Network latency:** each binding call makes a network request, so responses may be slower than local development.
 - **R2 multipart uploads:** `createMultipartUpload()` and `resumeMultipartUpload()` are not supported in remote mode.
-- **R2 conditional writes:** `put(..., { onlyIf })` requires a current Void platform and an active deployment with the native remote-binding handler. Update the platform and redeploy the project if this operation is unavailable. Failed preconditions return `null`.
+- **R2 conditional writes:** `put(..., { onlyIf })` requires an updated platform and project deployment. Failed preconditions return `null`.
 - **D1 dump:** `db.dump()` is not supported in remote mode.
 - **D1 batches:** `db.batch()` requires an updated platform and project deployment.

docs/guide/sandboxes.md

@@ -97,7 +97,7 @@ Files, running processes, and listening servers last only as long as the contain
 
 ## Configuration
 
-The default environment provides Node.js 24 on Debian Trixie. Managed platform deploys use Cloudflare's managed Node.js image.
+The default environment provides Node.js 26 on Debian Trixie. Managed platform deploys use Cloudflare's managed Node.js image.
 
 Use `void.config.ts` when you need a custom image or container size:
 
@@ -118,7 +118,7 @@ See the [configuration reference](../reference/config.md#sandbox) for binding na
 Custom images must include the helper matching Void's installed Sandbox SDK version. The SDK image supplies this binary, but is not a runnable environment itself:
 
 ```dockerfile
-FROM node:24.21.0-trixie-slim
+FROM node:26.10.0-trixie-slim
 COPY --from=docker.io/cloudflare/sandbox:1.0.0 /usr/local/bin/sandbox-shim /usr/local/bin/sandbox-shim
 WORKDIR /workspace
 CMD ["sleep", "infinity"]

docs/guide/sse.md

@@ -168,6 +168,4 @@ export const GET = defineHandler(async (c) => {
 });
 ```
 
-Native `EventSource` can send cookies with `withCredentials: true`. For non-cookie auth, generate a short-lived signed URL and validate it in the route handler.
-
 For shared topics and subscriptions, use [Live Event Streams](./live.md). For two-way communication, use [WebSockets](./websockets.md).

docs/integrations/nodejs-bun-deno.md

@@ -111,6 +111,7 @@ The following imports are **not available** with a non-CF target and produce a c
 | `void/storage` | R2 (blob storage)        |
 | `void/auth`    | Void-managed Better Auth |
 | `void/ai`      | Workers AI               |
+| `void/sandbox` | Cloudflare Sandboxes     |
 | `void/env`     | Typed environment schema |
 
 If you need a database or storage, use an external provider and connect via standard Node.js libraries.