docs(website): sync dev docs from 3495c8e92a

fern/.docs-snapshots.yml

@@ -1,8 +1,8 @@
 snapshots:
   dev:
-    source-ref: f01a664029888ac32b007acb7e1f8ff823ba85bc
-    source-sha: f01a664029888ac32b007acb7e1f8ff823ba85bc
-    version: 0.1.4.dev21
+    source-ref: 3495c8e92af8947046f4f938f929bfb7057eb455
+    source-sha: 3495c8e92af8947046f4f938f929bfb7057eb455
+    version: 0.1.4.dev26
   latest:
     source-ref: e1f3c82caa3ed3b65de22889ae7ef32a774878ef
     source-sha: e1f3c82caa3ed3b65de22889ae7ef32a774878ef

fern/pages-dev/how-it-works/policies/schema.mdx

@@ -77,9 +77,10 @@ fails to enforce the policy's rules:
 | `best_effort` | The sandbox runs without the filesystem rules and logs a high-severity finding. |
 | `hard_requirement` | The sandbox fails to start. |
 
-In either mode, a sandbox requires a kernel with Landlock ABI v3 or later. The
-sandbox log's `Landlock ruleset built` event reports how many paths were applied
-and skipped.
+In either mode, a sandbox requires a kernel with Landlock ABI v3 or later. On an
+older kernel, startup fails with an error that names the required and detected
+ABI. The sandbox log's `Landlock ruleset built` event reports how many paths
+were applied and skipped.
 
 ## Process
 

fern/pages-dev/kubernetes/ingress.mdx

@@ -265,6 +265,8 @@ If the release uses `workload.kind=deployment`, this upgrade replaces the Deploy
 
 Sandbox SSH uses the gateway endpoint registered with the CLI. No separate Helm SSH host or port values are required.
 
+When a Gateway terminates TLS, register its externally reachable `https://` endpoint with the CLI. OpenShell uses that registered endpoint for `sandbox connect`, `sandbox exec`, and port forwarding, even when the gateway pod reports an internal plaintext endpoint.
+
 ## Next Steps
 
 Return to [Setup](/kubernetes/setup) to complete the installation.

fern/pages-dev/kubernetes/setup.mdx

@@ -228,6 +228,18 @@ openshell status
 
 </Steps>
 
+## Upgrade OpenShell
+
+To upgrade, rerun `helm upgrade --install` with the new `--version` and the values you installed with. Running sandboxes keep their supervisor and sandbox runtime images until they stop. When a stopped sandbox starts, it takes both images from the upgraded gateway and keeps its workload image and workspace.
+
+If you override images, set `supervisor.image` and `sandboxRuntime.image` to the same release, or set only `global.image.tag`. An incompatible pair fails when a sandbox starts, and the supervisor log shows the cause while the start is in progress:
+
+```shell
+kubectl -n openshell logs -l openshell.ai/sandbox-id=<sandbox-id>,openshell.ai/component=supervisor
+```
+
+After you correct the images, recover a sandbox whose start timed out as described in [Sandbox Lifecycle](/how-it-works/sandboxes/overview#sandbox-lifecycle).
+
 ## Configure Chart Values
 
 The Helm chart renders `gatewayConfig` into the mounted `gateway.toml`