docs: follow-ups to the re-landed Remember, custom gateway and owned-refresh changes

docs-site/src/content/docs/guides/custom-gateway.md

@@ -10,6 +10,10 @@ dashboard, name it `my-gateway`, select `openai-chat`, and enter the authorized
 form. Save it without putting the key in commands or shared examples. A saved provider is not yet
 proof that discovery or inference works.
 
+On a [Remote Link](/guides/remote-link/) Child, providers come from the Home: the Child's dashboard
+refuses provider changes and its requests are served by the Home's providers. Register and verify
+the gateway on the Home instead.
+
 Check the boundaries separately, using the configured local port if it differs from the default:
 
 ```sh

docs-site/src/content/docs/ko/guides/custom-gateway.md

@@ -9,6 +9,9 @@ description: 모델 목록 조회부터 제한된 응답 생성까지 사용자
 허가된 URL과 키를 입력하고 저장하세요. 키를 명령이나 공유 예시에 넣지 마세요. 저장 성공만으로 모델 목록 조회나
 추론 성공이 증명되지는 않습니다.
 
+[Remote Link](/ko/guides/remote-link/) Child에서는 provider를 Home에서 가져옵니다. Child 대시보드는 provider 변경을
+거부하고, 요청은 Home의 provider가 처리합니다. 게이트웨이 등록과 검증은 Home에서 하세요.
+
 각 단계를 따로 확인하세요. 기본 포트가 아니면 설정한 로컬 포트를 사용합니다.
 
 ```sh

docs-site/src/content/docs/reference/management-api.md

@@ -61,7 +61,7 @@ route-specific results rather than repeating this table.
 | --- | --- | --- |
 | 401 | `opencodex admin token required` | The admin token or GUI session is missing, invalid, expired, origin-mismatched, or missing CSRF evidence |
 | 403 | `cross-origin request blocked` | The request origin is outside the management allowlist |
-| 403 | `cross-origin request blocked` with `code: "remember_requires_direct_origin"` | `POST /api/session/remember` only: this dashboard address cannot hold a remembered device (for example a standalone dashboard behind a TLS-terminating proxy); sign in without Remember |
+| 403 | `code: "remember_requires_direct_origin"` | `POST /api/session/remember` only: this dashboard address cannot hold a remembered device (for example a standalone dashboard behind a TLS-terminating proxy); sign in without Remember. The `error` text is `cross-origin request blocked` when the origin check refuses the request, and `Remember requires a direct HTTPS dashboard (or loopback) and matching Origin` when the origin check allows the request but the route still refuses it, for example because the address is not a direct HTTPS or loopback dashboard or no matching `Origin` header was sent; match on `code` |
 | 404 | `not_found` | No management route matched the method and path |
 | 413 | `request body too large` | A POST, PUT, or PATCH body exceeds the 2 MiB management limit |
 | 503 | `management API unavailable` | Admin credential initialization or hardening is unavailable |

structure/clients/integrations.md

@@ -209,7 +209,7 @@ Visibility, selected-model and preset writes refresh already-owned catalog contr
 Command Code) after persisting the selection. Explicit sync also refreshes owned OpenCode, Kilo, Command Code and default-profile Hermes blocks. The shared catalog-refresh
 fan-out loads the filtered roster lazily once, leaves unowned clients alone, and reports each
 refusal independently. Existing coordinated writers retain all no-clobber and ownership checks. A background catalog auto-refresh that changes the served set calls `syncEnabledClientIntegrations` unattended from `src/server/background-lifecycle.ts`: it refreshes only an existing Grok fence, a Desktop gateway profile that is still selected and byte-identical to the last applied write (keeping its static, hybrid or discovery mode), and owned file and Aside blocks without a first apply; it skips Cline, includes Hermes (its managed `providers.opencodex` range is patched byte-wise and a hand-edited or never-connected block is never claimed), honours the hub and sibling gate, and the coordinated writer's synchronous `guard` refuses any write once the scheduler generation has stopped or the owner captured for that delivery has revoked fan-out admission or released its lease; a later delivery may select a surviving owner. Each write also requires the projection's configuration snapshot to remain current, ignoring only Desktop's applied fingerprint and timestamp; Grok rechecks its complete fence and refuses symlinked config or backup paths inside the synchronous injector, then revalidates admission and unchanged regular-file bytes in the no-follow writer's pre-rename hook without copying a backup.
-Implicit refresh operations use distinct flight keys: overlapping desired catalogs return busy rather than joining a write of a different catalog and reporting false success.
+Implicit refresh operations use distinct flight keys: overlapping desired catalogs return busy rather than joining a write of a different catalog and reporting false success. An implicit refresh of an owned file client whose home was removed afterwards is left alone: `refreshOwnedIntegration` in `src/integrations/owned-refresh.ts` returns `null` for the writer's `not_installed` refusal, exactly as for a never-connected client, so a model toggle or sync no longer reports "<client> is not installed" for a client the user uninstalled. The ownership record is kept, so a reinstall resumes refreshing, and explicit enable still refuses with `not_installed`. Aside keeps its per-profile report. `tests/clients/sync-client-integrations.test.ts` covers the left-alone and Aside-report cases; `tests/clients/integrations-writer.test.ts` covers the explicit-enable refusal.
 Hermes refresh is limited to the [default profile](hermes.md); named profiles expose stale status and require explicit Apply. A current contribution returns unchanged before `src/integrations/hermes-refresh.ts` checks actual preflight bytes against the ownership fingerprint. When a catalog update is pending, that check refuses even edits outside managed fragments until the change is explicitly applied. An unchanged refresh or Apply does not adopt a new baseline.
 On a sibling instance ([Codex home](../codex-home.md#codex-home)), including one identified from another home's managed client destination, `src/integrations/catalog-refresh.ts`
 and `syncEnabledClientIntegrations` in `src/server/management/config-routes.ts` refresh nothing: the