aledbf · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
diff --git a/src/content/docs/aws/overview.mdx b/src/content/docs/aws/overview.mdx
@@ -17,8 +17,8 @@ module, [spin-terraform-aws](https://github.com/spin-stack/spin-terraform-aws):
 
 ```hcl
 module "spin" {
-  source       = "github.com/spin-stack/spin-terraform-aws?ref=v20261025.01"
-  spin_version = "v20261025.01"
+  source       = "github.com/spin-stack/spin-terraform-aws?ref=v20261027.01"
+  spin_version = "v20261026.02"
   domain       = "spin.example.com"
 }
 ```

diff --git a/src/content/docs/aws/prerequisites.md b/src/content/docs/aws/prerequisites.md
@@ -26,24 +26,14 @@ zone in Route 53, and you point the domain's nameservers at it. The installation
 |---|---|
 | `app.<domain>` | The dashboard and the API |
 | `tunnel.app.<domain>` | The relay runners connect to |
+| `term.<domain>` | The browser terminal: an SSH client for a workspace, in the browser, that signs in with a passkey |
+| `agents.<domain>` | The agent's client the browser terminal opens a workspace's agent in |
+| `id.<domain>` | The identity issuer: what a system outside Spinbox verifies a workspace's identity token, or a commit it signed, with |
 | `*.ws.<domain>` | Workspaces' ports |
 
 Workspaces are under a name of their own so that a workspace is never a subdomain of the
 dashboard: nothing a workspace serves can set a cookie the dashboard reads.
 
-### Optional modules
-
-Two modules of spin-terraform-aws are not part of an installation unless you add them beside
-it. Each serves one more name, on its own CloudFront origin, and takes a provider in `us-east-1`
-for its certificate:
-
-| Name | Module | What |
-|---|---|---|
-| `term.<domain>` | [`modules/terminal`](/reference/terraform/terminal/) | The browser terminal: an SSH client for a workspace, in the browser, that signs in with a passkey |
-| `id.<domain>` | [`modules/identity-issuer`](/reference/terraform/identity-issuer/) | The identity issuer: the documents a system outside Spinbox verifies a workspace's identity token with |
-
-Each module's page says what it takes, and its README what it needs and how to add it.
-
 ## Room for runners
 
 Each runner is a large spot machine, of one of the types
@@ -83,4 +73,4 @@ your own instead, name them with [`image_ids`](/reference/terraform/root/#image_
 ## Pick a release
 
 Releases are named by date: `v<YYYYMMDD>.<N>`, the Nth release of that day. This site documents
-`v20261025.01`. See [github.com/spin-stack/spin/releases](https://github.com/spin-stack/spin/releases).
+`v20261026.02`. See [github.com/spin-stack/spin/releases](https://github.com/spin-stack/spin/releases).
diff --git a/src/content/docs/aws/setup.md b/src/content/docs/aws/setup.md
@@ -35,7 +35,7 @@ $(tofu -chdir=../../bootstrap output -raw init)
 That runs `tofu init` against the state bucket. Then write `terraform.tfvars`:
 
 ```hcl
-spin_version = "v20261025.01"
+spin_version = "v20261026.02"
 domain       = "spin.example.com"
 # name   = "spin"        # a prefix for every resource; one installation per name
 # region = "us-west-2"   # the region bootstrap was applied in

diff --git a/src/content/docs/quickstart.md b/src/content/docs/quickstart.md
@@ -25,7 +25,7 @@ spin version
 The Linux build is also in the release's public package:
 
 ```bash
-oras pull ghcr.io/spin-stack/spin-release:v20261025.01-spin-linux-amd64
+oras pull ghcr.io/spin-stack/spin-release:v20261026.02-spin-linux-amd64
 ```
 
 ## 2. Sign in

diff --git a/src/content/docs/reference/release.md b/src/content/docs/reference/release.md
@@ -9,21 +9,21 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin-terraform-aws:images.json. Edit the source, not this file. -->
 
-An installation runs Spinbox `v20261025.01`, the newest release spin-terraform-aws's `images.json` has images of. It is made of:
+An installation runs Spinbox `v20261026.02`, the newest release spin-terraform-aws's `images.json` has images of. It is made of:
 
 | Part | Release | Read from |
 |---|---|---|
-| spin: the control plane, the runner, the proxy and the CLI | `v20261025.01` | spin-terraform-aws's `images.json` |
-| spin-machine: QEMU, the guest kernel, the firmware and the base image a workspace boots, as one artefact | [`v20261014.01`](https://github.com/spin-stack/spin-machine/releases/tag/v20261014.01) | spin's `versions.yaml` at `v20261025.01` |
-| The OpenTofu module, spin-terraform-aws | [`v20261025.01`](https://github.com/spin-stack/spin-terraform-aws/releases/tag/v20261025.01) | its newest release tag |
+| spin: the control plane, the runner, the proxy and the CLI | `v20261026.02` | spin-terraform-aws's `images.json` |
+| spin-machine: QEMU, the guest kernel, the firmware and the base image a workspace boots, as one artefact | [`v20261023.01`](https://github.com/spin-stack/spin-machine/releases/tag/v20261023.01) | spin's `versions.yaml` at `v20261026.02` |
+| The OpenTofu module, spin-terraform-aws | [`v20261027.01`](https://github.com/spin-stack/spin-terraform-aws/releases/tag/v20261027.01) | its newest release tag |
 
-The versions of QEMU and the guest kernel in spin-machine `v20261014.01` are its own [`versions.yaml`](https://github.com/spin-stack/spin-machine/blob/v20261014.01/versions.yaml) at that tag. The host's kernel is the Spin OS image's: none of the sources this site is generated from records its version.
+The versions of QEMU and the guest kernel in spin-machine `v20261023.01` are its own [`versions.yaml`](https://github.com/spin-stack/spin-machine/blob/v20261023.01/versions.yaml) at that tag. The host's kernel is the Spin OS image's: none of the sources this site is generated from records its version.
 
 ## Spin OS images
 
 Each machine boots the image of its role, in a region that has all three ([Spin OS images](/reference/terraform/images/)):
 
 | Region | Control plane | Proxy | Runner |
 |---|---|---|---|
-| `us-east-1` | `ami-00cb2d0feffe89588` | `ami-0ac882e2869f704f9` | `ami-090fbe7203af7a8bd` |
-| `us-west-2` | `ami-0ae9395569c631c81` | `ami-02b2c9c828e4db70d` | `ami-06f1c0680dcd7ea96` |
+| `us-east-1` | `ami-0774cba716732d76f` | `ami-0d23fd135c2b1569a` | `ami-04dfd5df7d3bbaf5a` |
+| `us-west-2` | `ami-0c0458b4218567425` | `ami-08808879d20e484cc` | `ami-0a2410b4fdd3f37e2` |
diff --git a/src/content/docs/reference/terraform/bootstrap.md b/src/content/docs/reference/terraform/bootstrap.md
@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin-terraform-aws:bootstrap/variables.tf. Edit the source, not this file. -->
 
-Source: `github.com/spin-stack/spin-terraform-aws//bootstrap?ref=v20261025.01`. Generated from its variables and outputs.
+Source: `github.com/spin-stack/spin-terraform-aws//bootstrap?ref=v20261027.01`. Generated from its variables and outputs.
 
 ## Variables
 
@@ -18,8 +18,11 @@ Source: `github.com/spin-stack/spin-terraform-aws//bootstrap?ref=v20261025.01`.
 | [`cost_allocation_tags`](#cost_allocation_tags) | `bool` | `false` |
 | [`github_repositories`](#github_repositories) | `map(string)` | `{}` |
 | [`region`](#region) | `string` | `"us-west-2"` |
+| [`tags`](#tags) | `map(string)` | `{}` |
 | [`image_publishers`](#image_publishers) | `map(string)` | `{}` |
 | [`publish_regions`](#publish_regions) | `list(string)` | `[]` |
+| [`public_images`](#public_images) | `bool` | `false` |
+| [`public_image_quota`](#public_image_quota) | `number` | `15` |
 
 ### cost_allocation_tags
 
@@ -42,6 +45,13 @@ The region the installations are in.
 - Type: `string`
 - Default: `"us-west-2"`
 
+### tags
+
+Tags on everything bootstrap creates: what the bill is read by.
+
+- Type: `map(string)`
+- Default: `{}`
+
 ### image_publishers
 
 Repositories that publish Spin OS from GitHub Actions, as owner/name => the prefix of their OIDC subject (github.tf): each gets a publish role.
@@ -56,6 +66,20 @@ The regions a publish role writes snapshots and registers images in; none is thi
 - Type: `list(string)`
 - Default: `[]`
 
+### public_images
+
+Whether the publish roles make their images public: unblocks public images and raises the quota in each publish region.
+
+- Type: `bool`
+- Default: `false`
+
+### public_image_quota
+
+Public AMIs a region, when public_images: three a release, for the releases spin-stack/ami keeps public.
+
+- Type: `number`
+- Default: `15`
+
 ## Outputs
 
 | Output | What it is |

diff --git a/src/content/docs/reference/terraform/controlplane.md b/src/content/docs/reference/terraform/controlplane.md
@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin-terraform-aws:modules/controlplane/variables.tf. Edit the source, not this file. -->
 
-Source: `github.com/spin-stack/spin-terraform-aws//modules/controlplane?ref=v20261025.01`. Generated from its variables and outputs.
+Source: `github.com/spin-stack/spin-terraform-aws//modules/controlplane?ref=v20261027.01`. Generated from its variables and outputs.
 
 ## Variables
 
@@ -23,7 +23,7 @@ Source: `github.com/spin-stack/spin-terraform-aws//modules/controlplane?ref=v202
 | [`internal_zone`](#internal_zone) | `string` | `"spin.internal"` |
 | [`acme_email`](#acme_email) | `string` | `""` |
 | [`vpc_cidr`](#vpc_cidr) | `string` | `"10.42.0.0/16"` |
-| [`availability_zones`](#availability_zones) | `number` | `3` |
+| [`availability_zones`](#availability_zones) | `number` | `8` |
 | [`instance_type`](#instance_type) | `string` | `"t8i.medium"` |
 | [`root_volume_gb`](#root_volume_gb) | `number` | `40` |
 | [`admin_email`](#admin_email) | `string` | `""` |
@@ -104,10 +104,10 @@ The VPC's range, a /16. One /20 public subnet per availability zone is carved fr
 
 ### availability_zones
 
-How many zones to make subnets in. The control plane, the proxy and the runners may each be started in any of them, which is what gives a group somewhere to go when a zone runs out.
+How many zones to make subnets in, at most: a region with fewer gets one in each. The control plane, the proxy and the runners may each be started in any of them, which is what gives a group somewhere to go when a zone runs out - and a zone left out is spot pools a runner is never drawn from. A subnet is its zone's by index, so raising this adds subnets and moves none.
 
 - Type: `number`
-- Default: `3`
+- Default: `8`
 
 ### instance_type
 
@@ -280,14 +280,13 @@ The builds of each role's image - control-plane, runner and proxy - oldest first
 | `standard_vcpus` | The on-demand standard vCPUs the control plane's and the proxy's machines take at most: two of each while an update replaces one. The runners module counts them against the quota on-demand runners share. |
 | `name_servers` | The domain's public zone's nameservers, which its registrar points at. |
 | `domain` | The base domain; the runners' relay is tunnel.app.&lt;domain>, dialled at relay_dial. |
-| `public_zone_id` | The domain's public zone, where modules/identity-issuer puts id.&lt;domain>. |
+| `public_zone_id` | The domain's public zone, where the installation's names are. |
 | `identity_key_arn` | The KMS key the installation's identity key is sealed under, which only an attested runner opens. |
-| `identity_documents` | The commands that write the identity issuer's documents - discovery, key set, allowed signers and SPIFFE bundle - for modules/identity-issuer to publish: the identity key as the control plane keeps it in its bucket (its public half is all that is read) and the X.509 CA the first host to sign an SVID made beside it, then the documents from them. Run them with credentials that may read both, and commit what they write. |
 | `internal_zone_id` | The private zone the components reach each other by, cp.&lt;internal_zone> and proxy.&lt;internal_zone>. |
 | `relay_dial` | Where a runner dials the relay, host:port: the proxy inside the VPC, by the name the proxy of the moment points at itself. |
 | `collector` | Where every process of the installation pushes its telemetry, host:port. Where the collector sends it is set in the dashboard. |
 | `boundary_arn` | The permissions boundary every role of the installation carries; the runners module puts it on the runners' role. |
-| `proxy_ip` | The proxy's elastic IP, where app.&lt;domain>, tunnel.app.&lt;domain> and \*.ws.&lt;domain> point: the one address of the installation the internet reaches. |
+| `proxy_ip` | The proxy's elastic IP, where every name of the installation's domain points: the one address of the installation the internet reaches. |
 | `proxy_group` | The proxy's group of one. Its machine, for `aws ssm start-session --target` (it has no SSH): aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names &lt;this> --query 'AutoScalingGroups[0].Instances[0].InstanceId'. |
 | `bucket` | The volumes' bucket: every workspace's disk, versioned under Object Lock, reached only through the VPC's endpoint. |
 | `database_bucket` | The database's archive: the base backups and WAL the control plane ships as it writes, and restores from when its machine is replaced. Its role alone reaches it. |

diff --git a/src/content/docs/reference/terraform/identity-issuer.md b/src/content/docs/reference/terraform/identity-issuer.md
diff --git a/src/content/docs/reference/terraform/images.md b/src/content/docs/reference/terraform/images.md
@@ -4,14 +4,14 @@ description: "The Spin OS images the module boots for the release this site docu
 source: "spin-terraform-aws:images.json"
 editUrl: false
 sidebar:
-  order: 7
+  order: 5
 ---
 
 <!-- Generated by tools/refgen from spin-terraform-aws:images.json. Edit the source, not this file. -->
 
-Every machine of an installation boots Spin OS, built for one release of spin. The module reads the image of each machine from its `images.json`, by `spin_version` and region, so an installation of `v20261025.01` can be made in a region listed here and nowhere else. To boot images of your own, name them with `image_ids` and their measurements with `image_measurements` ([the module's variables](/reference/terraform/root/#image_ids)).
+Every machine of an installation boots Spin OS, built for one release of spin. The module reads the image of each machine from its `images.json`, by `spin_version` and region, so an installation of `v20261026.02` can be made in a region listed here and nowhere else. To boot images of your own, name them with `image_ids` and their measurements with `image_measurements` ([the module's variables](/reference/terraform/root/#image_ids)).
 
 | Region | Control plane | Proxy | Runner |
 |---|---|---|---|
-| `us-east-1` | `ami-00cb2d0feffe89588` | `ami-0ac882e2869f704f9` | `ami-090fbe7203af7a8bd` |
-| `us-west-2` | `ami-0ae9395569c631c81` | `ami-02b2c9c828e4db70d` | `ami-06f1c0680dcd7ea96` |
+| `us-east-1` | `ami-0774cba716732d76f` | `ami-0d23fd135c2b1569a` | `ami-04dfd5df7d3bbaf5a` |
+| `us-west-2` | `ami-0c0458b4218567425` | `ami-08808879d20e484cc` | `ami-0a2410b4fdd3f37e2` |
diff --git a/src/content/docs/reference/terraform/root.md b/src/content/docs/reference/terraform/root.md
@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin-terraform-aws:variables.tf. Edit the source, not this file. -->
 
-Source: `github.com/spin-stack/spin-terraform-aws?ref=v20261025.01`. Generated from its variables and outputs.
+Source: `github.com/spin-stack/spin-terraform-aws?ref=v20261027.01`. Generated from its variables and outputs.
 
 ## Variables
 
@@ -33,6 +33,7 @@ Source: `github.com/spin-stack/spin-terraform-aws?ref=v20261025.01`. Generated f
 | [`quiet_hours`](#quiet_hours) | `string` | the module's own |
 | [`time_zone`](#time_zone) | `string` | the module's own |
 | [`runner_instance_types`](#runner_instance_types) | `list(string)` | the module's own |
+| [`runner_vcpus`](#runner_vcpus) | `object({ min = number, max = number })` | the module's own |
 | [`runner_spot`](#runner_spot) | `bool` | the module's own |
 | [`runner_data_volume_gb`](#runner_data_volume_gb) | `number` | the module's own |
 | [`runner_root_volume_gb`](#runner_root_volume_gb) | `number` | the module's own |
@@ -165,11 +166,18 @@ The IANA zone quiet_hours are in; modules/controlplane's default is UTC.
 
 ### runner_instance_types
 
-What the runners' group may start, most preferred first, one CPU generation; see modules/runners.
+The types the runners' group may start, as names or patterns (c8id.\*), one CPU generation; see modules/runners.
 
 - Type: `list(string)`
 - Default: `null` (the module's own default)
 
+### runner_vcpus
+
+How many vCPUs a runner may have, { min, max }; modules/runners' default is 32 to 48.
+
+- Type: `object({ min = number, max = number })`
+- Default: `null` (the module's own default)
+
 ### runner_spot
 
 Every runner a spot instance; modules/runners' default is true.
@@ -248,7 +256,7 @@ Tags on everything both modules create.
 | `dashboard` | The installation's dashboard. |
 | `first_sign_in` | The setup page, the first administrator, and the command that reads their one-time password: an SSM SecureString this apply wrote without it ever being in the state. |
 | `name_servers` | The domain's zone's nameservers: what its registrar, or its parent's zone, points at. |
-| `proxy_ip` | The proxy's elastic IP, where app.&lt;domain>, tunnel.app.&lt;domain> and \*.ws.&lt;domain> point: the one address of the installation the internet reaches. |
+| `proxy_ip` | The proxy's elastic IP, where every name of the installation's domain points: the one address of the installation the internet reaches. |
 | `controlplane_group` | The control plane's group of one; its machine is reached with `aws ssm start-session --target &lt;instance>`. |
 | `update_status` | After an apply that changed a machine: how its replacement went. Successful, InProgress, or RollbackSuccessful with the reason - after which the old machine serves again, at once or, for a control plane that had handed its database over, once its watch has restored it from the archive. |
 | `update_abort` | After an apply whose new machine will not come up: the command that stops waiting for it - rolls the refresh back and abandons the launch the hook still holds - so the next apply can change the group. One command per group. |