diff --git a/README.md b/README.md
index 33c6d13..711f7cc 100644
--- a/README.md
+++ b/README.md
@@ -4,8 +4,6 @@
   Lightweight DAG workflow engine for orchestrating code in Docker containers. Delegates container execution to <a href="https://github.com/enixCode/light-run">light-run</a>.
 </p>
 
-# IF SOMEBODY CAN REBUILD FROM ZERO DO IT THIS IS JUST AN POC
-
 <p align="center">
   <a href="https://enixcode.github.io/light-process/">Documentation</a> -
   <a href="#quick-start">Quick Start</a> -
diff --git a/website/content/docs/cli.mdx b/website/content/docs/cli.mdx
index 9c76c67..9260773 100644
--- a/website/content/docs/cli.mdx
+++ b/website/content/docs/cli.mdx
@@ -70,26 +70,29 @@ light serve [dir] [--port 3000]
 | Flag | Description | Default |
 |---|---|---|
 | `--port <number>` | Port to listen on | `3000` |
+| `--runner-port <number>` | Port for the auto-spawned light-run (ignored when `LIGHT_RUN_URL` is set) | `3001` |
+| `--install` | Auto-install `@enixcode/light-run` if missing (only in all-in-one mode) | off |
 
 **Environment:**
 
 | Variable | Description |
 |---|---|
 | `LP_API_KEY` | Enable Bearer token authentication on protected routes. If unset, all routes are public. |
-| `LIGHT_RUN_URL` | URL of the light-run service (required). |
+| `LIGHT_RUN_URL` | URL of the light-run service. If unset, a local light-run is auto-spawned (all-in-one mode). |
 | `LIGHT_RUN_TOKEN` | Bearer token for light-run (optional). |
 
 **Endpoints:**
 
-| Method | Path | Description |
-|---|---|---|
-| GET | `/health` | Health check (public) |
-| GET | `/api/workflows` | List workflows |
-| GET | `/api/workflows/:id` | Workflow detail (add `?full=true` for full JSON) |
-| POST | `/api/workflows` | Add workflow at runtime (add `?persist=true` to save) |
-| PUT | `/api/workflows/:id` | Replace a workflow (add `?persist=true` to save) |
-| DELETE | `/api/workflows/:id` | Remove workflow (add `?persist=true` to delete file) |
-| POST | `/api/workflows/:id/run` | Execute the workflow with the JSON body as input |
+| Method | Path | Description | Auth |
+|---|---|---|---|
+| GET | `/health` | Health check | public |
+| GET | `/api/meta` | Server version and metadata | public |
+| GET | `/api/workflows` | List workflows | Bearer (when `LP_API_KEY` set) |
+| GET | `/api/workflows/:id` | Workflow detail (add `?full=true` for full JSON) | Bearer (when `LP_API_KEY` set) |
+| POST | `/api/workflows` | Add workflow at runtime (add `?persist=true` to save) | Bearer (when `LP_API_KEY` set) |
+| PUT | `/api/workflows/:id` | Replace a workflow (add `?persist=true` to save) | Bearer (when `LP_API_KEY` set) |
+| DELETE | `/api/workflows/:id` | Remove workflow (add `?persist=true` to delete file) | Bearer (when `LP_API_KEY` set) |
+| POST | `/api/workflows/:id/run` | Execute the workflow with the JSON body as input | Bearer (when `LP_API_KEY` set) |
 
 **Examples:**
 
@@ -101,7 +104,7 @@ light serve
 light serve --port 8080
 
 # Serve a specific directory
-light serve ./my-workflows --verbose
+light serve ./my-workflows
 
 # Enable Bearer token authentication
 LP_API_KEY=my-secret-key light serve
@@ -148,14 +151,13 @@ Validate a workflow without running it.
 light check <file|dir> [--fix]
 ```
 
-**Checks performed:**
+**Checks performed (folder mode):**
 1. `workflow.json` exists and parses
-2. Node folders exist
-3. `.node.json` files exist
-4. Workflow loads (valid structure)
-5. All nodes have images
-6. All nodes have entrypoints or files
-7. Entry nodes exist
+2. `workflow.json` structure (name + nodes array)
+3. Workflow loads (valid graph)
+4. Nodes valid - reports count, or per-node failures (missing image, no entrypoint/files)
+5. Links valid - reports count, or per-link failures
+6. Entry nodes - reports count, or failure if none found
 
 **`--fix`** auto-removes dead node references from `workflow.json`.
 
@@ -221,7 +223,7 @@ light remote <bind|set-key|list|use|forget|ping|ls|run|delete|rm> [...]
 
 | Subcommand | Description |
 |---|---|
-| `bind <url> --key <key> [--name <name>]` | Register a remote (first becomes default) |
+| `bind <url> [--key <key>] [--name <name>]` | Register a remote (first becomes default) |
 | `set-key <key> [--name <name>]` | Rotate the API key for an existing remote |
 | `list` | Show all registered remotes |
 | `use <name>` | Set the default remote |
@@ -430,6 +432,19 @@ light node register <dir>
 
 Use this when you initialized a node outside a workflow folder and moved it in afterwards.
 
+### light node dev
+
+Generate a `.devcontainer/devcontainer.json` for the node and open it in VS Code.
+
+```bash
+light node dev <dir> [--force] [--env-file <path>]
+```
+
+| Flag | Description |
+|---|---|
+| `--force` | Regenerate even if `devcontainer.json` already exists |
+| `--env-file <path>` | Explicit `.env` file (auto-detected by walking up if omitted) |
+
 ### light node helpers
 
 Regenerate `lp.d.ts` from the node's input/output schema. Provides TypeScript type definitions for `lp.js` so editors show autocomplete for `input` fields and `send()` arguments.
diff --git a/website/content/docs/docker.mdx b/website/content/docs/docker.mdx
index 193a0f8..b11f40c 100644
--- a/website/content/docs/docker.mdx
+++ b/website/content/docs/docker.mdx
@@ -8,9 +8,15 @@ light-process no longer talks to Docker directly. Every node runs inside a conta
 
 ## Configuration
 
+light-process runs in one of two modes:
+
+- **All-in-one (default):** leave `LIGHT_RUN_URL` unset. `light run` / `light serve` start a local light-run for you on a free port - nothing to export.
+- **Explicit runner:** point at a light-run you started yourself (a remote or shared instance).
+
 ```bash
-export LIGHT_RUN_URL=http://localhost:3001     # required
-export LIGHT_RUN_TOKEN=your-bearer-token       # optional, if light-run requires auth
+# Explicit runner only - skip this entirely in all-in-one mode:
+export LIGHT_RUN_URL=http://localhost:3001     # required ONLY in this mode
+export LIGHT_RUN_TOKEN=your-bearer-token       # optional, if that light-run needs auth
 ```
 
 Or programmatically via the SDK:
@@ -77,4 +83,4 @@ const result = await wf.execute(input, {
 light doctor
 ```
 
-Verifies `LIGHT_RUN_URL` is set and `GET /health` on the light-run instance responds.
+In all-in-one mode it confirms the light-run binary is installed (so `light serve` can spawn it). When `LIGHT_RUN_URL` is set, it pings that instance's `GET /health` instead.
diff --git a/website/content/docs/getting-started.mdx b/website/content/docs/getting-started.mdx
index 2846252..1312a60 100644
--- a/website/content/docs/getting-started.mdx
+++ b/website/content/docs/getting-started.mdx
@@ -196,7 +196,7 @@ light link example --from hello --to transform --when '{"status": "ok"}'
 light init --node ./analyze --lang python
 ```
 
-Creates `analyze/` with `.node.json`, `main.py`, and `lp.py` using `python:3.12-alpine`.
+Creates `analyze/` with `.node.json`, `main.py`, `lp.js`, `lp.py`, and `input.json` using `python:3.12-alpine`.
 
 ## Next steps
 
diff --git a/website/content/docs/sdk.mdx b/website/content/docs/sdk.mdx
index 9cf0e7f..f0ca1ee 100644
--- a/website/content/docs/sdk.mdx
+++ b/website/content/docs/sdk.mdx
@@ -140,7 +140,7 @@ const result = await wf.execute(input, {
   },
 
   onStatusChange: (status) => {
-    console.log(`Current: ${status.currentNodeName}`);
+    console.log(`Current: ${status.currentNodeName ?? '(none)'}`);
     console.log(`Done: ${status.completedNodes.length}`);
   },
 });
@@ -221,7 +221,7 @@ await app.listen();
 await app.close();
 ```
 
-When `apiKey` is provided, every write route (POST/PUT/DELETE) and every `/api/*` route requires `Authorization: Bearer <key>`. Leave it undefined to run without auth. `/health` is always public.
+When `apiKey` is provided, every write route (POST/PUT/DELETE) and every `/api/*` route (except `/api/meta`) requires `Authorization: Bearer <key>`. Leave it undefined to run without auth. `/health` and `/api/meta` are always public.
 
 ## Error types