Part of #2724 (gateway-suite remediation — docs accuracy). One slice of a multi-part tracker — this PR intentionally leaves #2724 open for the remaining parts.

Reconciles the gateway docs to the fork's actual RPC surface and local SecretRef resolution. Every changed line was verified against the live fork code (BASE_METHODS, GATEWAY_EVENTS, the real handlers, and the resolver modules) — not a mechanical find-replace.

(a) Local SecretRef resolution — docs/cli/qr.md, docs/gateway/secrets.md

The fork resolves SecretRefs locally and in-process via src/secrets/resolve.ts (env/file/exec) and src/gateway/resolve-configured-secret-input-string.ts. The gateway secrets.resolve snapshot RPC was dropped in #2728 (it had no handler) — there is no RPC path anymore.

• secrets.md § Command-path resolution: rewritten to describe local, in-process resolution; removed the "gateway snapshot RPC", the "read from the active snapshot / gateway-unavailable fallback" framing, and the Gateway RPC method used by these command paths: secrets.resolve line. The strict (fail-fast) vs read-only (degrade) distinction is kept — both verified: qr --remote fails fast (resolveRequiredConfiguredSecretRefInputString throws); the configured but unavailable in this command path degrade diagnostics are real (commands/channels/status.ts, commands/status-all/channels.ts, commands/doctor-config-flow.ts, gateway/credentials.ts).
• qr.md: line 44 rewritten to local resolution (qr resolves all refs in-process via qr-cli.ts + pairing/setup-code.ts, running exec providers locally; no gateway client); removed the obsolete secrets.resolve gateway-version-skew note.

#2728's own commit body explicitly deferred this as follow-up gap (A): "secrets.md/qr.md command-path SecretRef-resolution docs still name secrets.resolve as the gateway snapshot RPC, but the fork resolves locally."

(b) RPC method families — docs/gateway/protocol.md

Removed the methods #2720 dropped from BASE_METHODS (confirmed absent from BASE_METHODS and with no handler in coreGatewayHandlers):

Methods-vs-events distinction preserved: the plugin.approval.requested / plugin.approval.resolved events are in GATEWAY_EVENTS (server-methods-list.ts:139-140) and remain documented under "Common event families".

Verified ambiguous families (the handlers do not confirm them → corrected):

• sessions.usage / sessions.usage.timeseries / sessions.usage.logs: not in BASE_METHODS, no handler anywhere repo-wide — only an orphan classification in method-scopes.ts:76-78. Removed.
• exec.approval.get / exec.approval.list: not in BASE_METHODS, not in method-scopes, no handler. Removed from the exec-approval line (kept exec.approval.request / resolve + waitDecision, all in BASE_METHODS).

Also dropped the now-empty "Node helper methods" subsection (it only documented skills.bins) and the stray models token in the "## Scope" capability list.

Note: this fork's BASE_METHODS deliberately still advertises some declared-but-unhandled methods (e.g. sessions.create/send/abort, exec.approval.request) while the execution engine is mid-gutting. Those are the advertised surface and are intentionally left documented — out of scope here.

Verification

• astro build of the docs site passes (319 pages, exit 0).
• rebrand-gate passes (no openclaw leakage introduced).
• oxfmt 0.38.0 --check: all three files correctly formatted.

Out-of-scope findings (flagged, NOT changed — surgical 3-file scope)

These reference removed methods but live outside the three named files; flagging for a future #2724 pass (or confirm if they should be folded in):

• docs/web/control-ui.md:113 — lists models.list as a manual debug RPC call.
• docs/tools/exec-approvals.md:261 — describes skills.bins over the Gateway RPC.
• docs/gateway/bridge-protocol.md:52 — lists skills.bins in the scoped gateway RPC set.
• docs/gateway/secrets.md § Activation triggers (~lines 387, 396) — reference bare secrets.reload (also not in BASE_METHODS); likely the CLI remoteclaw secrets reload command rather than the gutted RPC.

🤖 Generated with Claude Code