diff --git a/.orly/audits/spec-template.sh b/.orly/audits/spec-template.sh
index aee0e1e..59bb435 100755
--- a/.orly/audits/spec-template.sh
+++ b/.orly/audits/spec-template.sh
@@ -1,35 +1,17 @@
 #!/usr/bin/env bash
-# spec-template.sh — enforce docs/TEMPLATE.md across every spec under
-# docs/v*/{pending,active,done}/. Two check families:
-#
-#   1. PROHIBITED patterns (negative space) — TEMPLATE.md "Prohibited" section:
-#      time/effort estimates, effort/complexity columns, %-complete, owners, dates.
-#      Always BLOCK.
-#   2. REQUIRED-PRESENT + NO-PLACEHOLDER (positive space) — the determinism
-#      sections the agent-facing template mandates (PR Intent, Applicable Gates,
-#      Prior-Art, Metrics, Decomposition, tiered Test Spec, Product Clarity,
-#      Discovery, …) must EXIST and carry content: no known unfilled slots and
-#      no surviving "tpl:" guidance comments (template fill grammar). A spec
-#      that omits them forces the executing agent to guess intent. This is the
-#      half that makes a spec "built for the agent".
-#   2b. DECLARED-COMMAND PARITY — a pending/active spec's Acceptance Rubric
-#      must quote the repository's declared conform + applicable verify.* commands
-#      (.orly/orly.json) verbatim: the rubric and `orly gate` grade one
-#      boundary. Staged/file scope only; done/ specs stay historical.
-#
-# Dispatch façade: dispatch/write_spec.md (SPEC TEMPLATE GATE)
-# Fires in: make lint (after audit-logging, before audit-error-codes).
+# spec-template.sh — select specs and snapshot staged content for the shared
+# validator in spec-template.ts. The native orly spec.gate criterion calls the
+# same validator directly; this entry point serves script callers.
+# Dispatch façade: dispatch/write_spec.md (SPEC TEMPLATE GATE).
 #
 # Modes:
 #   --staged         diff-scope: only specs in `git diff --cached`
 #   --all            (default) pending+active specs only — current/in-flight work
 #   --include-done   adds done/ specs to the scan (one-time sweep tool)
 #
-# Family 2 runs in --staged and --file scope — the spec being authored/edited right
-# now, which is exactly the agent's own output. The bulk scans (--all /
-# --include-done) run Family 1 only, so they behave identically over the whole
-# corpus and never break an existing spec. No legacy carve-out, no heuristics:
-# author a spec → full template required; scan the tree → prohibited-only.
+# Staged/file checks require complete sections, references, test mappings and
+# declared commands. Bulk scans check prohibited patterns only. Bun is required
+# for both scopes; bulk checks do not require repository command configuration.
 #
 # Done specs are excluded by default: historical artifacts, not work product.
 # Exits 0 clean, 1 on any blocking finding.
@@ -44,7 +26,6 @@ cd "$ROOT"
 FAIL=0
 fail() { printf "FAIL: %s\n" "$*" >&2; FAIL=1; }
 ok()   { printf "OK:   %s\n" "$*"; }
-note() { printf "NOTE: %s\n" "$*"; }
 
 # Discover spec files in scope.
 case "$MODE" in
@@ -62,8 +43,7 @@ case "$MODE" in
     while IFS= read -r s; do SPECS+=("$s"); done < <(find docs/v[0-9]* -type f -name '*.md' 2>/dev/null | grep -E '/(pending|active|done)/' || true)
     ;;
   --file|file)
-    # Single named spec, both families — the lifecycle engine's spec.gate
-    # criterion calls this so the engine and pre-commit share one enforcer.
+    # Single named spec, using the same checks as the native criterion.
     [[ -n "${2:-}" ]] || { printf "usage: %s --file <spec path>\n" "$0" >&2; exit 64; }
     [[ -f "$2" ]] || { printf "FAIL: spec not found: %s\n" "$2" >&2; exit 1; }
     SPECS=("$2")
@@ -79,70 +59,6 @@ if [[ ${#SPECS[@]} -eq 0 ]]; then
   exit 0
 fi
 
-# ---------------------------------------------------------------------------
-# Family 1 — Prohibited patterns from docs/TEMPLATE.md "Prohibited" section.
-# Each pattern: <severity>:<one-line description>:<regex> — the regex comes
-# LAST because it may contain colons (e.g. the [:|] label-row class); read(1)
-# assigns the remainder of the line to the final field, so the regex survives
-# intact. Descriptions must stay colon-free.
-# Severity: BLOCK = exit 1; INFO = stdout note only. Patterns use ERE (egrep -E)
-# only — no PCRE constructs like (?:...), which grep -E rejects.
-#
-# DESIGN NOTE — patterns are deliberately structural, not prose-level.
-# Bare regex like `\b\d+\s*days?\b` false-positives on legitimate prose
-# ("Day 50", "≥7 days uptime", "within 3 days of install"). Instead we
-# match where time/effort estimates LIVE structurally:
-#   - Section headings: `## Estimated effort`, `## Effort`, `## Sizing`
-#   - Label rows:       `**Effort:** medium`, `**Owner:** alice`
-#   - Tilde-bulleted:   `- ~2 h survey`, `* ~5 days OAuth setup`
-#                       (the `~` prefix is Indy's idiom for effort estimates;
-#                       legitimate prose doesn't use it)
-# This catches the actual drift class without churning real content.
-# ---------------------------------------------------------------------------
-PATTERNS=(
-  'BLOCK:Estimated effort section heading:^#+ .*Estimated [Ee]ffort'
-  'BLOCK:Effort/Complexity/Sizing section heading:^#+ .*\b(Effort|Complexity|Sizing|Cost)\b\s*$'
-  'BLOCK:Scale estimate section heading:^#+ .*\bScale\b.*estimate'
-  'BLOCK:Tilde-bulleted hour estimate (e.g. "- ~2 h"):^[-*]\s*~\s*[0-9]+\s*h\b'
-  'BLOCK:Tilde-bulleted time estimate:^[-*]\s*~\s*[0-9]+\s*(hours?|days?|min(utes?)?)\b'
-  'BLOCK:Effort/Estimate label row:^\s*\*\*\s*(Effort|Estimate|Sizing|Complexity|Cost)\s*(:\s*\*\*|\*\*\s*[:|])'
-  'BLOCK:Owner label row:^\s*\*\*\s*Owner\s*(:\s*\*\*|\*\*\s*[:|])'
-  'BLOCK:Assigned-to label row:^\s*\*\*\s*Assigned to\s*(:\s*\*\*|\*\*\s*[:|])'
-  'BLOCK:Date-bound deadline label:^\s*\*\*\s*(Due|Deadline)\s*(:\s*\*\*|\*\*\s*[:|])\s*[0-9]'
-  'BLOCK:Percentage-complete metric:^[-*\|]?\s*\*?\*?\s*[0-9]+\s*%\s*complete'
-  'BLOCK:Hour-range estimate in effort context:\b(effort|estimate|takes?|spend)\b[^.]{0,40}\b[0-9]+\s*[-–]\s*[0-9]+\s*h\b'
-  'BLOCK:Effort/complexity rating:\b(low|medium|high|small|large)\s*[/|-]\s*(effort|complexity)\b'
-)
-
-# Carve-outs — lines that look prohibited but are legitimate. Skip any match.
-SAFE_LINES_RE='^\*\*Date:\*\*|^\s*```|<!--|^\s*//|"[0-9]+\s*(h|hour|day|min)"'
-
-scan_spec() {
-  local spec="$1" content_file="$2"
-  local hits=0
-  local pattern desc severity line content
-  while IFS=: read -r severity desc pattern; do
-    while IFS= read -r match; do
-      [[ -z "$match" ]] && continue
-      if grep -qE "$SAFE_LINES_RE" <<<"$match"; then
-        continue
-      fi
-      line="${match%%:*}"
-      content="${match#*:}"
-      content="${content%$'\r'}"
-      if [[ "$severity" = "BLOCK" ]]; then
-        fail "$spec:$line — $desc"
-        printf "        > %s\n" "$content" >&2
-      else
-        note "$spec:$line — $desc"
-      fi
-      hits=$((hits + 1))
-    done < <(grep -nE "$pattern" "$content_file" 2>/dev/null || true)
-  done < <(printf '%s\n' "${PATTERNS[@]}")
-  if [[ $hits -eq 0 ]]; then ok "$spec — no prohibited patterns"; fi
-  return 0
-}
-
 # Staged checks grade the index, including files removed only from the worktree.
 CONTENT_DIR="$(mktemp -d)"
 trap 'rm -rf "$CONTENT_DIR"' EXIT
@@ -158,16 +74,11 @@ for spec in "${SPECS[@]}"; do
       ;;
   esac
   [[ -f "$content_file" ]] || { fail "$spec — cannot read spec"; continue; }
-  scan_spec "$spec" "$content_file"
-  case "$MODE" in
-    --staged|staged|--file|file)
-      if ! command -v bun >/dev/null 2>&1; then
-        fail "$spec — Bun is required for spec readiness checks"
-      elif ! bun "$SCRIPT_DIR/spec-template.ts" "$spec" "$content_file" "$MODE"; then
-        FAIL=1
-      fi
-      ;;
-  esac
+  if ! command -v bun >/dev/null 2>&1; then
+    fail "$spec — Bun is required for spec checks"
+  elif ! bun "$SCRIPT_DIR/spec-template.ts" "$spec" "$content_file" "$MODE"; then
+    FAIL=1
+  fi
 done
 
 if [[ $FAIL -ne 0 ]]; then
diff --git a/.orly/audits/spec-template.ts b/.orly/audits/spec-template.ts
index bdde92b..66d8279 100644
--- a/.orly/audits/spec-template.ts
+++ b/.orly/audits/spec-template.ts
@@ -1,4 +1,4 @@
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join, normalize, resolve } from "node:path";
 
 type MarkdownElement = { type?: unknown; props: { children?: MarkdownNode[] } };
@@ -23,7 +23,24 @@ const REQUIRED = [
 ];
 const RESIDUE = /<!--\s*tpl:|\{\{fill:|\{unresolved_[^}]+\}|path\/to\/file\.ext|path\/to\/spec_or_doc\.md|test_<short_name>|\{one-line reason\}|\{Slice title\}|\{smallest verifiable behaviour\}|\{one-line behavioural claim\}/;
 const STAGED_MODES = new Set(["--staged", "staged"]);
+const BULK_MODES = new Set(["--all", "all", "--include-done", "include-done"]);
 const EXPECTED_COLUMN = "Expected";
+const TEXT_ENCODING = "utf8";
+const SAFE_PROHIBITION_LINE = /<!--|"[0-9]+\s*(h|hour|day|min)"/;
+const PROHIBITED: Array<[RegExp, string]> = [
+  [/^#+ .*Estimated [Ee]ffort/, "Estimated effort section heading"],
+  [/^#+ .*\b(Effort|Complexity|Sizing|Cost)\b\s*$/, "Effort/Complexity/Sizing section heading"],
+  [/^#+ .*\bScale\b.*estimate/, "Scale estimate section heading"],
+  [/^[-*]\s*~\s*[0-9]+\s*h\b/, 'Tilde-bulleted hour estimate (e.g. "- ~2 h")'],
+  [/^[-*]\s*~\s*[0-9]+\s*(hours?|days?|min(utes?)?)\b/, "Tilde-bulleted time estimate"],
+  [/^\s*\*\*\s*(Effort|Estimate|Sizing|Complexity|Cost)\s*(:\s*\*\*|\*\*\s*[:|])/, "Effort/Estimate label row"],
+  [/^\s*\*\*\s*Owner\s*(:\s*\*\*|\*\*\s*[:|])/, "Owner label row"],
+  [/^\s*\*\*\s*Assigned to\s*(:\s*\*\*|\*\*\s*[:|])/, "Assigned-to label row"],
+  [/^\s*\*\*\s*(Due|Deadline)\s*(:\s*\*\*|\*\*\s*[:|])\s*[0-9]/, "Date-bound deadline label"],
+  [/^[-*|]?\s*\*?\*?\s*[0-9]+\s*%\s*complete/, "Percentage-complete metric"],
+  [/\b(effort|estimate|takes?|spend)\b[^.]{0,40}\b[0-9]+\s*[-–]\s*[0-9]+\s*h\b/, "Hour-range estimate in effort context"],
+  [/\b(low|medium|high|small|large)\s*[/|-]\s*(effort|complexity)\b/, "Effort/complexity rating"],
+];
 
 function sectionsOf(text: string): Section[] {
   const sections: Section[] = [];
@@ -111,8 +128,9 @@ function git(argv: string[], root: string): { ok: boolean; text: string } {
   return { ok: result.exitCode === 0, text: result.stdout.toString() };
 }
 
-async function commands(staged: boolean, root: string): Promise<Commands> {
-  const text = staged ? git(["show", `:${CONFIG_PATH}`], root) : { ok: true, text: await Bun.file(join(root, CONFIG_PATH)).text() };
+// Gate criteria are synchronous; standalone audits share the same command reader.
+export function readSpecCommands(staged: boolean, root: string): Commands {
+  const text = staged ? git(["show", `:${CONFIG_PATH}`], root) : { ok: true, text: readFileSync(join(root, CONFIG_PATH), TEXT_ENCODING) };
   if (!text.ok) throw new Error(`cannot read ${CONFIG_PATH} from the index`);
   const config: unknown = JSON.parse(text.text);
   if (!object(config) || !object(config.commands)) throw new Error(`${CONFIG_PATH} needs declared commands`);
@@ -154,9 +172,22 @@ function rubricCommands(sections: Section[], declared: Commands): string[] {
   return errors;
 }
 
+export function validateSpecProhibitions(text: string): string[] {
+  const errors: string[] = [];
+  const lines = text.split("\n");
+  for (const [pattern, description] of PROHIBITED) {
+    for (const [index, line] of lines.entries()) {
+      if (pattern.test(line) && !SAFE_PROHIBITION_LINE.test(line)) {
+        errors.push(`line ${index + 1} — ${description}\n        > ${line.replace(/\r$/, EMPTY)}`);
+      }
+    }
+  }
+  return errors;
+}
+
 export function validateSpec(text: string, declared: Commands, exists: (path: string) => boolean): string[] {
   const sections = sectionsOf(text);
-  const errors: string[] = [];
+  const errors = validateSpecProhibitions(text);
   const count = text.trimEnd().split(/\r?\n/).length;
   if (count > SPEC_LINE_LIMIT) errors.push(`spec has ${count} lines; cap ${SPEC_LINE_LIMIT}`);
   for (const heading of REQUIRED) {
@@ -170,9 +201,11 @@ export function validateSpec(text: string, declared: Commands, exists: (path: st
 export async function auditSpec(args: string[], root: string): Promise<string[]> {
   const [spec, path, mode] = args;
   if (!spec || !path || !mode) throw new Error("expected spec path, content path, and audit mode");
+  const text = await Bun.file(resolve(root, path)).text();
+  if (BULK_MODES.has(mode)) return validateSpecProhibitions(text);
   const staged = STAGED_MODES.has(mode);
   const exists = (reference: string) => staged ? git(["cat-file", "-e", `:${reference}`], root).ok : existsSync(join(root, reference));
-  return validateSpec(await Bun.file(resolve(root, path)).text(), await commands(staged, root), exists);
+  return validateSpec(text, readSpecCommands(staged, root), exists);
 }
 
 if (import.meta.main) {
@@ -184,7 +217,7 @@ if (import.meta.main) {
     }
     if (errors.length) process.exitCode = 1;
     // logging: report structural checks without claiming semantic readiness.
-    else console.log(`OK: ${Bun.argv[2]} — sections, references, test mappings, and declared commands checked`);
+    else console.log(`OK: ${Bun.argv[2]} — ${BULK_MODES.has(Bun.argv[4] ?? EMPTY) ? "no prohibited patterns" : "sections, references, test mappings, and declared commands checked"}`);
   } catch (error) {
     // logging: unavailable audit inputs must fail, never silently skip checks.
     console.error(`FAIL: spec readiness check — ${error instanceof Error ? error.message : String(error)}`);
diff --git a/.orly/dispatch/write_spec.md b/.orly/dispatch/write_spec.md
index e41a4cc..6bf60ce 100644
--- a/.orly/dispatch/write_spec.md
+++ b/.orly/dispatch/write_spec.md
@@ -20,9 +20,12 @@ and who may decide it. A required human sign-off remains a human dependency.
 
 ## Mechanical checks
 
-`.orly/audits/spec-template.sh` is the entry point; its Bun helper
-`.orly/audits/spec-template.ts` reads headings, lists, and tables from the runtime's
-parsed Markdown tree. Code examples and quoted headings cannot supply sections.
+`orly gate pr` calls the native validator in `.orly/audits/spec-template.ts` through
+`spec.gate`. The validator reads headings, lists, and tables from Bun's parsed
+Markdown tree. Code examples and quoted headings cannot supply sections.
+
+`.orly/audits/spec-template.sh` selects files and snapshots staged content before
+calling the same validator.
 
 - Prohibited authoring estimates, ownership labels, and completion percentages.
 - Required sections with content, known placeholder residue, and the spec length cap.
@@ -38,9 +41,11 @@ parsed Markdown tree. Code examples and quoted headings cannot supply sections.
 ## Scope
 
 `--staged` reads spec contents, configuration, and local references from the Git
-index. `--file <path>` checks the working copy. Missing runtime or configuration
-fails these readiness checks. Bulk `--all` and `--include-done` scans retain
-prohibited-pattern checks only; they do not retrofit historical documents.
+index. `--file <path>` checks the working copy. All script modes require Bun;
+staged and file checks also require repository configuration.
+
+Bulk `--all` and `--include-done` scans retain prohibited-pattern checks only;
+they do not retrofit historical documents.
 
 ## Author review
 
@@ -90,4 +95,5 @@ Incident-derived rules the deterministic half can't check — apply while writin
 
 - `.orly/docs/TEMPLATE.md` — canonical Prohibited section + required sections.
 - `orly-spec-new` skill — creates specs from the template; inserts the banner.
-- `.orly/audits/spec-template.sh` — structural and prohibited-section checks; `orly gate pr` invokes it through `spec.gate`.
+- `.orly/audits/spec-template.ts` — native structural and prohibited-section validator, called directly by `spec.gate`.
+- `.orly/audits/spec-template.sh` — file selection and staged snapshots for script callers of the same validator.
diff --git a/.orly/orly.json b/.orly/orly.json
index 726bc73..ae118be 100644
--- a/.orly/orly.json
+++ b/.orly/orly.json
@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "orly_version": "0.15.0",
+  "orly_version": "0.17.0",
   "packs": [],
   "commands": {
     "conform": [
@@ -112,8 +112,8 @@
     ".orly/audits/msid-ui.sh": "sha256:50fa3a6dd3edb5e1e75722509259c753858687213e8aba6fc4159ba84185401f",
     ".orly/audits/rule-ledger-lib.sh": "sha256:168182658aa0d53bf08bbd571f81e04d538fc5b9b0c6d0006e57c6974c083164",
     ".orly/audits/scope.sh": "sha256:83725913f561729377f4b913495823e749ed64de5aeb9eda8fa1b35e01ef707b",
-    ".orly/audits/spec-template.sh": "sha256:ea2aa79fd39c632e88be4d5b9f755beabfdd844c2c3fa882a0d13f9822daae29",
-    ".orly/audits/spec-template.ts": "sha256:fcfc1534a8d33586835b456cf0d27284ffb3441fa00abe75848c2db6a05af247",
+    ".orly/audits/spec-template.sh": "sha256:403046b83d8be1fa8279940f39a6aae2b23336e9a33d53d2af8b227406fffd2f",
+    ".orly/audits/spec-template.ts": "sha256:ef10e170d86731d40cab6a9466b9ce26b9b20f6974b122e6defd870af40749e1",
     ".orly/audits/ufs-strings.awk": "sha256:a6ef0f62d627f3c09f64c9d8b6e33ea6b25d85ccf2585cfddb2f3500be1a80c0",
     ".orly/audits/ufs.sh": "sha256:18b93033a91ea5ef2d7f453fc1f893201245e17a6932f67a8227c4ebb707e19e",
     ".orly/dispatch/lib.sh": "sha256:63b5e2b8e962808ce41523f122e34a75d316e58bf4026c3aafab54c28e73ea97",
@@ -128,7 +128,7 @@
     ".orly/dispatch/write_mdx.md": "sha256:70ce22667e2ca60e1bf623d5ba0ca1a9bcc0586faf018d44328ddfeaa2cd4306",
     ".orly/dispatch/write_pr_description.md": "sha256:2e1a91b09e98faa0971968092b53be8d087c617fc1b9afb267b2deeccc5372e0",
     ".orly/dispatch/write_python.md": "sha256:2b6fd567a12ccb92f19f29669cc9b1a2254127b49501a057b155991adde54988",
-    ".orly/dispatch/write_spec.md": "sha256:ffc8f991965faed799f8ce83ff4052a3de18defafdfe0d112ab2ebf176804ee4",
+    ".orly/dispatch/write_spec.md": "sha256:a1b89dcf110985b949ec8277f7a79241fedab4da2744ac727019f53c1a152bfb",
     ".orly/dispatch/write_ts_adhere_bun.md": "sha256:466784d3161014c6dc735a6e55831a83dad66883db15027cc0543f62a9dd7f11",
     ".orly/dispatch/write_ts_adhere_bun.sh": "sha256:3244892292500a18f5a053c9f1e954ef0ff51cb79b7ae83883aa3350289d1fa2",
     ".orly/docs/CHANGELOG_VOICE.md": "sha256:c523f2a1002aff6583ad6570fb93acc322229e7421f6c889685084a47fe00195",
diff --git a/billing/budgets.mdx b/billing/budgets.mdx
index 88d6db3..61b1278 100644
--- a/billing/budgets.mdx
+++ b/billing/budgets.mdx
@@ -3,8 +3,8 @@ title: Fleet budgets
 description: Daily and monthly spending limits for one fleet.
 type: explanation
 audience: user
-verified: 2026-10-19
-product_version: 0.62.1
+verified: 2026-10-23
+product_version: 0.65.0
 executable: false
 ---
 
@@ -27,7 +27,7 @@ Each limit is a decimal string of whole nanodollars. One dollar is `"1000000000"
 
 ## Why it exists
 
-Every workspace under one tenant shares the same credit balance. A fleet budget stops one fleet from draining that shared balance.
+Every workspace in one account shares the same credit balance. A fleet budget stops one fleet from draining that shared balance.
 
 The dashboard header shows what is left of that balance on every page, as a **Credits** chip beside the workspace switcher. It appears on screens at least 640px wide. Select the chip to open **Settings → Billing**, which holds the live figure and the charge history.
 
@@ -53,6 +53,10 @@ If billing cannot answer, work continues and can exceed that bound. The full cha
 
 ### How charges are counted
 
+In **Settings → Billing**, **Model** shows its published display name when available. **Usage** separates input and output counts.
+
+**Occurred** shows relative time; hover to see the exact timestamp. Unavailable usage stays marked as unavailable.
+
 `agentsfleet` charges each provider request on its own line. A fleet run or setup chat also adds one run-time line for each stretch of time it ran. The charge history at `GET /v1/tenants/me/billing/charges` returns one row per line.
 
 Each request is priced at the rate in effect when it was made, and at the tier its whole prompt falls in. Cached reads, cache writes, and output each use their own rate.
diff --git a/bun.lock b/bun.lock
index 9d89e34..d23cf31 100644
--- a/bun.lock
+++ b/bun.lock
@@ -5,14 +5,14 @@
     "": {
       "name": "@agentsfleet/docs",
       "devDependencies": {
-        "@agentsfleet/orly": "0.15.0",
+        "@agentsfleet/orly": "0.17.0",
         "markdown-link-check": "3.15.0",
         "mint": "4.2.1065",
       },
     },
   },
   "packages": {
-    "@agentsfleet/orly": ["@agentsfleet/orly@0.15.0", "", { "dependencies": { "@babel/parser": "7.29.9", "@babel/types": "7.29.8", "zod": "4.6.5" }, "bin": { "orly": "bin/orly" } }, "sha512-YaKF5GibH6/xSNKksf4oPpO1vi+85qmrSIveDTODnHwymWIKMQuXgIPuu7OniPhjD/duWJRU9TfbSib5mV+BRA=="],
+    "@agentsfleet/orly": ["@agentsfleet/orly@0.17.0", "", { "dependencies": { "@babel/parser": "7.29.9", "@babel/types": "7.29.8", "zod": "4.6.5" }, "bin": { "orly": "bin/orly" } }, "sha512-+4+JHrFDBWzV1cxp01sa+78wl1ZJMvKVwxwu7TG8s+JacYLVFJnJR/SMT9DgZoaLxBC4czLlbvLDrOw6UFOXLQ=="],
 
     "@alcalzone/ansi-tokenize": ["@alcalzone/ansi-tokenize@0.2.5", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-3NX/MpTdroi0aKz134A6RC2Gb2iXVECN4QaAXnvCIxxIm3C3AVB1mkUe8NaaiyvOpDfsrqWhYtj+Q6a62RrTsw=="],
 
diff --git a/changelog.mdx b/changelog.mdx
index cf3343f..f525447 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -7,6 +7,18 @@ description: "Stay up to date with the latest agentsfleet product updates, new f
   agentsfleet is in **stealth-mode testing** and pre-production. APIs and agent behavior may change between releases without long deprecation windows. Email [agentsfleet@agentmail.to](mailto:agentsfleet@agentmail.to) if you want a hand calibrating an agent or to join as a design partner.
 </Tip>
 
+<Update label="Oct 23, 2026" tags={["Bug fixes"]}>
+  ## Keep fleet setup edits and recover failed replies
+
+  Setup chat preserves manual edits when a newer proposal arrives. Review a conflict before updating instructions or saving.
+
+  - **Recovery** — failed replies keep partial text and offer **Try again** when available.
+  - **Navigation** — saved fleets use their chosen names. Private drafts appear under **New fleet → Unfinished setups**.
+  - **Controls** — **Stop** and **Kill** share the fleet header menu and require confirmation.
+  - **Billing** — model display names, readable usage, and relative timestamps clarify each charge.
+  - **Settings** — compact secret tables and shared navigation styles match the dashboard.
+</Update>
+
 <Update label="Oct 23, 2026" tags={["Bug fixes"]}>
   ## Edit fleet setup beside the conversation
 
diff --git a/fleets/approvals.mdx b/fleets/approvals.mdx
index b18c5a2..1e5c9bb 100644
--- a/fleets/approvals.mdx
+++ b/fleets/approvals.mdx
@@ -4,7 +4,7 @@ description: Review requested access, approve or deny it, and revoke standing gr
 type: how-to
 audience: user
 verified: 2026-10-23
-product_version: 0.64.0
+product_version: 0.65.0
 executable: false
 ---
 
@@ -123,7 +123,8 @@ Then run `agentsfleet grant delete <GRANT_ID> --fleet <FLEET_ID>`.
 To change which repositories a fleet may reach, or to drop it to read-only,
 change `repositories` or `repository_access` in a private improvement chat.
 Choose **Edit setup** in the fleet header, then ask for the change.
-Review the updated setup through **… → Edit instructions**, then choose **Save changes** beside the chat.
+
+Open **Edit instructions manually** below the setup conversation to review the change. Choose **Save changes** in the setup footer.
 
 The next service credential uses the updated repository access. The grant stays
 approved, and the fleet keeps running.
diff --git a/fleets/authoring.mdx b/fleets/authoring.mdx
index 9b5bf6d..080adb1 100644
--- a/fleets/authoring.mdx
+++ b/fleets/authoring.mdx
@@ -4,7 +4,7 @@ description: Describe a fleet in a private chat, check its setup, and save it.
 type: how-to
 audience: user
 verified: 2026-10-23
-product_version: 0.64.0
+product_version: 0.65.0
 executable: false
 ---
 
@@ -35,15 +35,18 @@ Each chat message is charged to the workspace owner's balance. A message the bal
 
 1. Open **New fleet** in the workspace sidebar.
 2. Check the selected model, then describe the task. New chats select an available authoring model by default. Each reply can change the draft setup.
-3. Open the chat's **… → Edit instructions**. Check the instructions and **Review and run options**. Keep chatting until the proposal matches your task.
-4. Choose **Save fleet** beside the chat title. For an immediate first run, enter a message under **Optional first run** in the editor and choose **Save and run now**.
+3. Choose **… → Edit instructions** beside the chat title to review the proposed instructions. Keep chatting until the proposal matches your task.
+4. Choose **Save fleet** beside the chat title. For an immediate first run, open **Edit instructions → Review and run options**. Enter **Optional first run**, then choose **Save and run now**.
 5. Saving opens the fleet conversation. Its sections are **Chat**, **Activity**, and **Memory**.
 
 The proposed setup creates no fleet and requests no run. **Save fleet** checks the current setup, then saves it. It requests no first run, but configured automatic triggers can start work once setup is ready.
 
-**Edit instructions** opens a panel beside the chat, or across the screen on a phone. Your unsent chat message stays in place.
+For a saved fleet, **Edit instructions manually** expands the editor below setup chat. Folding the editor keeps your unsaved text.
 
-Choose **Update instructions** to apply manual edits to the draft, then **Save fleet** or **Save changes** beside the chat. **Cancel editing** discards unsubmitted edits.
+Choose **Update instructions** to apply manual edits to the draft. Then choose **Save fleet** or **Save changes**. Unsaved manual edits block those save actions.
+
+An untouched editor follows changes from setup chat. If chat changes the setup during manual editing, your text remains available and a conflict blocks updates.
+Choose **Discard manual changes and load latest** to replace that local text with the current proposal.
 
 The setup chat shows a compact saved-version summary. Setup and first-run warnings remain visible when setup needs attention.
 
@@ -51,13 +54,19 @@ Keep unfinished setup steps and schedule registration warnings in view. Use the
 
 To change a saved fleet, choose **Edit setup** in its header. A private chat opens beside the fleet conversation, based on its saved setup revision. On a phone, the editor fills the page.
 
-Describe the change, review it through **Edit instructions**, then choose **Save changes** beside the chat.
+Describe the change, review it through **Edit instructions manually**, then choose **Save changes** in the setup footer.
+Your unsent message in the fleet conversation stays in place.
+
 New work uses the updated instructions; work already running keeps its current version.
 
 ### Recover a stopped or failed reply
 
 **Queued…** means your message is waiting to start. **Working…** means a reply has started.
 
+A failed reply keeps any partial text and shows its failure message. Choose **Try again** when available to retry the original request.
+
+Open **View details** for diagnostics. A retry can incur another model charge.
+
 If the provider outcome is uncertain, choose **Stop authoring**, then send a new message.
 Earlier usage stays under review, and its reserved balance can limit new work until accounting finishes.
 
@@ -70,7 +79,9 @@ Stopping setup chat leaves saved fleets running.
 
 ### Find, rename, and delete setup chats
 
-The sidebar lists fleets and your unsaved setup chats under **Recent**. Select a fleet to return to its conversation.
+The sidebar lists saved fleets under **Fleets**. Select a fleet to return to its conversation.
+
+Open **New fleet → Unfinished setups** to resume a private unsaved chat. Only the person who started the chat can see it.
 
 A new chat is titled with the first line of your first message, cut to 100 characters. A chat started from a Definition or a Library revision takes the first line of its description. A chat with neither reads **New fleet**.
 
@@ -80,7 +91,7 @@ You cannot rename a chat while a reply or Save is running, while earlier usage i
 
 To delete a chat, choose its delete action and confirm **Delete chat**. The private conversation is removed. Saved fleets keep running, and published Library revisions stay available.
 
-Hover or focus a setup-chat row to read its full title and status. The editor identifies the saved fleet revision on which your changes are based.
+Hover or focus an unfinished setup row to read its full title and status. The editor identifies the saved revision beneath your changes.
 
 ### In the terminal
 
@@ -232,7 +243,7 @@ A Definition holds at most 8 triggers. One webhook allows 1 through 16 event nam
   Deleting a setup chat removes its private messages for good. Saved fleets keep running, and published Library revisions stay.
 </Warning>
 
-Delete a chat from the sidebar, with `/delete` in the terminal chat, or with `agentsfleet chat delete <DRAFT_ID>`.
+Delete a chat from **Unfinished setups**, with `/delete` in the terminal chat, or with `agentsfleet chat delete <DRAFT_ID>`.
 
 Saving a fleet, or saving changes to one, closes its chat. `agentsfleet` keeps a closed chat and its messages for 30 days, then deletes them. The chat's `expires_at` field shows when.
 
diff --git a/fleets/connectors.mdx b/fleets/connectors.mdx
index d509dab..eb9ff86 100644
--- a/fleets/connectors.mdx
+++ b/fleets/connectors.mdx
@@ -3,8 +3,8 @@ title: Connect a provider
 description: Connect a workspace to GitHub, Slack, Zoho Desk, Jira, or Linear.
 type: how-to
 audience: user
-verified: 2026-10-19
-product_version: 0.62.1
+verified: 2026-10-23
+product_version: 0.65.0
 executable: false
 ---
 
@@ -20,9 +20,15 @@ You must own the account that holds the workspace.
 You also need permission to connect the provider account.
 Supported providers are GitHub, Slack, Zoho Desk, Jira, and Linear.
 
+**Connect apps** lists the providers offered by the platform. Opening this page creates no connection.
+
+**Connected** means the workspace holds saved connection data. Provider calls can still fail if that access expires or is revoked.
+
+If a provider needs platform setup, choose **Request access** to register your interest. This does not connect the provider.
+
 ## Steps
 
-1. Open **Settings → Integrations** in the dashboard.
+1. Open the account menu and choose **Connect apps** in the dashboard.
 
 2. Choose a provider and click **Connect**.
 
@@ -63,7 +69,7 @@ One GitHub App installation can belong to only one workspace. Another workspace
 
 ## Remove or undo
 
-Disconnect the connector from the Integrations page. `agentsfleet` removes the saved connection and stops routing that provider's events to the workspace. Deleting the connector's secret, such as `github`, does the same.
+Disconnect the connector from **Connect apps**. `agentsfleet` removes the saved connection and stops routing that provider's events to the workspace. Deleting the connector's secret, such as `github`, does the same.
 
 Revoke the application from the provider's account settings. The next connector call fails and the dashboard asks for reconnection.
 
diff --git a/fleets/overview.mdx b/fleets/overview.mdx
index f9c4efe..55d7837 100644
--- a/fleets/overview.mdx
+++ b/fleets/overview.mdx
@@ -4,7 +4,7 @@ description: Understand what a fleet owns and how its lifecycle works.
 type: explanation
 audience: user
 verified: 2026-10-23
-product_version: 0.64.0
+product_version: 0.65.0
 executable: false
 ---
 
@@ -73,7 +73,7 @@ Each unsent message keeps its own **Resend** and **Dismiss** until you choose on
 
 An expired session shows **Sign in** beside **Resend**, so you can sign in and then resend. Resending the same message is safe; changing the text makes it a new message. A message can be at most 8,192 bytes.
 
-The fleet API's `webhook_urls` lists each provider webhook address. Open **Edit setup → … → Edit instructions** to review declared triggers and their filters.
+The fleet API's `webhook_urls` lists each provider webhook address. Choose **Edit setup**, then **Edit instructions manually** below the conversation to review declared triggers and their filters.
 
 Each schedule's `description` states its timing and time zone, such as `At 9:00 AM (Asia/Kolkata)`. Its `run_state` and nullable `next_run_at` describe whether it will run:
 
diff --git a/fleets/running.mdx b/fleets/running.mdx
index 51ca34a..4c09735 100644
--- a/fleets/running.mdx
+++ b/fleets/running.mdx
@@ -3,8 +3,8 @@ title: Run and control a fleet
 description: Inspect, message, stop, resume, kill, and delete a fleet.
 type: how-to
 audience: user
-verified: 2026-10-19
-product_version: 0.62.1
+verified: 2026-10-23
+product_version: 0.65.0
 executable: false
 ---
 
@@ -12,6 +12,8 @@ executable: false
 
 These commands show fleet activity and change lifecycle state. Every command uses the active workspace.
 
+The dashboard uses your chosen fleet name in **Your fleets** and the conversation header. Open a card to return to that fleet.
+
 ## Before you begin
 
 Install a fleet. Copy its identifier from `agentsfleet list`.
@@ -65,7 +67,7 @@ Install a fleet. Copy its identifier from `agentsfleet list`.
    If you scroll back, a turn someone else sends does not move you. Click
    **Jump to latest** to follow it.
 
-4. Stop new work while keeping the fleet resumable.
+4. Stop new work while keeping the fleet resumable. In the dashboard, open the fleet header’s **… → Stop** and confirm.
 
    ```bash
    agentsfleet stop <FLEET_ID>
@@ -121,9 +123,12 @@ A run with no reply may be waiting for approval. Run `agentsfleet approvals list
 
 A message with no answer after 30 seconds reads **Couldn't confirm this message was sent.** Click **Resend**. It carries the same `operation_id`, so the fleet runs the message once.
 
-If a run fails while replying, open its event details in the dashboard and
-click **Copy diagnostic**. The copy includes the event identifier and the
-recorded failure cause. The chat keeps the failure message short.
+A failed reply keeps any partial text in the conversation. Choose **Try again** when available to send the original request again.
+A retry creates another run and can incur another charge.
+
+Before retrying a request that changes an outside service, check whether the action already completed. A new run can repeat completed actions.
+
+Open **View details** for diagnostics. Event details also offer **Copy diagnostic**, which includes the event identifier and recorded failure cause.
 
 A lifecycle command sends a write again only when the connection was refused, the name did not resolve, or the server declined it. A reset after sending or a timeout surfaces the error instead, because the server may have processed the write. Check `agentsfleet doctor`, then run the command again.
 
@@ -150,6 +155,8 @@ and tool updates may remain missing.
 
 Stopping is reversible with `resume`. Killing is permanent but keeps the fleet records until deletion.
 
+In the dashboard, choose **… → Kill** from the fleet header. Confirm the permanent action in the dialog.
+
 Deleting removes all fleet records and cannot be undone. The client has no dry-run option for either command.
 
 ```bash
diff --git a/fleets/secrets.mdx b/fleets/secrets.mdx
index 627b443..4e7d08d 100644
--- a/fleets/secrets.mdx
+++ b/fleets/secrets.mdx
@@ -3,8 +3,8 @@ title: Manage secrets
 description: Store, replace, inspect, and delete workspace secrets.
 type: how-to
 audience: user
-verified: 2026-10-19
-product_version: 0.62.1
+verified: 2026-10-23
+product_version: 0.65.0
 executable: false
 ---
 
@@ -82,6 +82,11 @@ Use `agentsfleet secret create` for a new name.
 
 ## Verify it works
 
+In setup chat, ask to use the `api_token` field from the `stripe` secret for requests to `api.stripe.com`.
+
+Share the secret name and field, and keep the value out of chat.
+Review the requested tools and access before saving.
+
 Save a fleet that declares the secret name. If a required secret is missing,
 the fleet stays `installing`, and the readiness check names the secret to create.
 
diff --git a/fleets/slack.mdx b/fleets/slack.mdx
index 0681e12..fdc7663 100644
--- a/fleets/slack.mdx
+++ b/fleets/slack.mdx
@@ -4,7 +4,7 @@ description: Attach a fleet to a Slack channel so it answers when someone mentio
 type: how-to
 audience: user
 verified: 2026-10-23
-product_version: 0.64.0
+product_version: 0.65.0
 executable: false
 ---
 
@@ -16,7 +16,7 @@ Slack sometimes delivers one mention twice. The second delivery starts no second
 
 ## Before you begin
 
-Connect Slack to your workspace at **Settings → Integrations**. See [Connect a provider](/fleets/connectors) for the full procedure.
+Open the account menu and choose **Connect apps**. Connect Slack to the active workspace. See [Connect a provider](/fleets/connectors) for the full procedure.
 
 Invite the `agentsfleet` Slack app to the channel. The app receives mentions only in channels it belongs to.
 
@@ -53,7 +53,7 @@ Find the channel identifier (ID) in Slack. Open the channel's details and copy *
    ✓ Fleet <NAME>: active
    ```
 
-   In the dashboard, review the setup through **… → Edit instructions**, then choose **Save fleet** beside the chat.
+   In the dashboard, review the setup through **… → Edit instructions** beside the chat title. Choose **Save fleet** in the header.
 
 3. Mention the app in the channel and ask your question.
 
@@ -135,7 +135,7 @@ A fleet you save under that name with the channel fleet's exact runtime settings
 
 A mention from a bot, an edited message, or the app's own reply starts no run.
 
-A mention from a Slack workspace that is not connected to an `agentsfleet` workspace starts no run. Connect Slack again from **Settings → Integrations**.
+A mention from a Slack workspace that is not connected to an `agentsfleet` workspace starts no run. Connect Slack again from **Connect apps** in the account menu.
 
 ## Remove or undo
 
@@ -143,7 +143,7 @@ To detach a fleet from the channel, remove its `mention` trigger and apply the c
 
 1. Open the fleet in the dashboard and choose **Edit setup** in its header.
 2. Ask the chat to remove the Slack mention trigger.
-3. Open **… → Edit instructions** and check that the trigger is gone. Choose **Save changes** beside the chat.
+3. Open **Edit instructions manually** below the setup conversation and check that the trigger is gone. Choose **Save changes** in the setup footer.
 
 In the terminal, start the same chat with `agentsfleet chat --fleet <FLEET_ID> --setup-revision <SETUP_REVISION> --model <MODEL_REF>`. `<SETUP_REVISION>` is the `setup_revision` field that `agentsfleet --json fleet show <FLEET_ID>` prints. Ask for the change, then run `/review` and `/apply`.
 
diff --git a/fleets/webhooks.mdx b/fleets/webhooks.mdx
index b55a59b..2bea139 100644
--- a/fleets/webhooks.mdx
+++ b/fleets/webhooks.mdx
@@ -4,7 +4,7 @@ description: Send signed provider events to a fleet.
 type: how-to
 audience: user
 verified: 2026-10-23
-product_version: 0.64.0
+product_version: 0.65.0
 executable: false
 ---
 
@@ -93,8 +93,7 @@ grant can be approved.
 
 1. Connect the provider once per workspace.
 
-   Open **Settings → Integrations**, choose GitHub, and approve the access
-   GitHub requests. The workspace owns the connection.
+   Open the account menu and choose **Connect apps**. Choose GitHub and approve the access it requests. The workspace owns the connection.
 
 2. Save a fleet whose webhook trigger names your repositories.
 
diff --git a/package.json b/package.json
index 2715a9f..9da38f1 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "check-links": "markdown-link-check"
   },
   "devDependencies": {
-    "@agentsfleet/orly": "0.15.0",
+    "@agentsfleet/orly": "0.17.0",
     "markdown-link-check": "3.15.0",
     "mint": "4.2.1065"
   }