andrewleesteele · Sep 28, 2026 · Sep 28, 2026 · Sep 28, 2026 · Sep 28, 2026 · Sep 28, 2026
diff --git a/auth/fill-from-vault.mdx b/auth/fill-from-vault.mdx
@@ -1,5 +1,5 @@
 ---
-title: "Overview"
+title: "Fill from Vault"
 description: "Collect end-user credentials and inject them into browser forms while controlling the login workflow"
 ---
 

diff --git a/auth/managed-auth.mdx b/auth/managed-auth.mdx
@@ -1,5 +1,5 @@
 ---
-title: "Overview"
+title: "Managed Auth"
 description: "Handle website login, reuse session state, and recover eligible connections automatically"
 ---
 

diff --git a/browsers/browser-loop.mdx b/browsers/browser-loop.mdx
@@ -0,0 +1,87 @@
+---
+title: "Browser Loop"
+description: "A framework-neutral browser tool catalog for your agent, executed against a Kernel browser"
+---
+
+Browser Loop gives your agent browser tools. You pick the tools, it supplies the declarations each model provider accepts, executes every action against a [Kernel browser](/introduction/create), and returns plain objects your existing agent loop can use.
+
+It's open source ([`kernel/browser-loop`](https://github.com/kernel/browser-loop), MIT) and published as [`@onkernel/browser-loop`](https://www.npmjs.com/package/@onkernel/browser-loop).
+
+Reach for it when you're building an agent and don't want to write the translation layer between "the model asked to click at (420, 280)" and an actual browser action. If you're driving the browser yourself from a script, use [Playwright execution](/browsers/playwright-execution) or [computer controls](/browsers/computer-controls) directly.
+
+## What it handles
+
+Frontier models expose browser and computer control differently: native computer-use declarations, predefined browser action sets, ordinary function tools, different coordinate systems, different screenshot and result contracts. Every one of them still expects you to run a real browser, translate each action into an SDK call, and capture the right feedback so the model can verify the action landed.
+
+Browser Loop does that and stops there. It doesn't supply an agent class, a session format, or a UI — your framework already has those.
+
+- **Framework-neutral tool catalog.** Tool identities (`kloop.*.v1`) and model-facing names are byte-identical across bindings, so transcripts and evals stay comparable.
+- **Kernel-browser execution.** Canonical actions run through Kernel's computer API or a raw-CDP executor against a session with your [profile](/browsers/profiles) and [proxy](/proxies/overview).
+- **Per-model compatibility.** Provider transforms compose only the declarations and request fields the tools you selected require.
+- **A pi binding and extension**, with Eve and AI SDK bindings next.
+
+## Install
+
+```bash
+npm install @onkernel/browser-loop
+```
+
+## Build an agent
+
+`attach()` binds a browser once; `compile()` turns a (model, tools) pair into plain agent objects.
+
+```typescript
+import Kernel from '@onkernel/sdk';
+import { Agent } from '@earendil-works/pi-agent-core';
+import { loop } from '@onkernel/browser-loop';
+import { attach } from '@onkernel/browser-loop/pi';
+
+const client = new Kernel();
+const browser = await client.browsers.create({ stealth: true });
+const kb = attach({ client, browser });
+
+const { model, agentTools, models } = kb.compile({
+  model: 'anthropic:claude-opus-5',
+  tools: [...loop.toolsets.browser(), loop.tools.browser.act()],
+});
+
+const agent = new Agent({
+  streamFn: (selected, context, options) => models.streamSimple(selected, context, options),
+  initialState: { model, tools: [...agentTools], systemPrompt: 'Use the supplied browser tools.' },
+});
+
+try {
+  await agent.prompt('Open example.com and report the heading.');
+} finally {
+  await kb.dispose();
+  await client.browsers.deleteByID(browser.session_id);
+}
+```
+
+The compiled `model` and `agentTools` have to reach the agent together: selecting a provider-native browser or computer surface can change the transport the model needs, and that's derived from the tools you chose.
+
+## Check which tools a model accepts
+
+Not every model accepts every tool, and two providers' native surfaces can't coexist. Ask instead of guessing — and rebuild the menu after each change rather than caching a per-tool verdict:
+
+```typescript
+import { loopToolMenu } from '@onkernel/browser-loop';
+import { getLoopModel } from '@onkernel/browser-loop/pi';
+
+for (const entry of loopToolMenu(getLoopModel('openai:gpt-5.6-sol'))) {
+  console.log(entry.label, entry.available ? 'ok' : `unavailable: ${entry.unavailableReason}`);
+}
+```
+
+## Try it from a terminal first
+
+The pi extension contributes the same tools to a pi session, so you can find out which tools and which model actually work for your use case before deploying anything. Same catalog, same tool identities, same model knowledge as the SDK path:
+
+```bash
+pi install npm:@onkernel/browser-loop
+pi -p --browser-tools browser,browser-act "open example.com and report the heading"
+```
+
+<Card title="Repository and architecture docs" href="https://github.com/kernel/browser-loop" horizontal>
+  Harness variant, swapping tools on a running session, and tool contexts.
+</Card>
diff --git a/browsers/concurrency-and-limits.mdx b/browsers/concurrency-and-limits.mdx
@@ -0,0 +1,61 @@
+---
+title: "Concurrency and Limits"
+description: "How many browsers you can run, how fast you can create them, and what each one gets"
+---
+
+Three separate limits shape a scaled workload, and they're easy to confuse. Concurrency caps how many browsers exist at once. The create rate caps how fast you can ask for new ones. Per-browser resources cap what one browser can do.
+
+## Concurrency
+
+One org-wide limit covers every browser you're running, whether created on demand with `browsers.create()` or reserved in a [browser pool](/browsers/pools). The full limit is available to either API in any mix.
+
+| Plan | Concurrent browsers |
+| --- | --- |
+| Developer | 5 |
+| Hobbyist | 10 |
+| Start-Up | 150 |
+| Enterprise | Custom |
+
+Two things count against it that people don't expect:
+
+- **Reserved pool capacity counts whether or not it's acquired.** A pool sized to 40 browsers uses 40 of your limit for as long as it exists.
+- **Browsers in [standby](/browsers/standby) count.** Standby stops usage charges, not the concurrency slot. Delete the browser to release it.
+
+Set per-project caps if you're splitting one org limit across teams or environments — see [project concurrency limits](/info/projects#concurrency-limits).
+
+## Create rate
+
+Browser creation is rate limited separately from concurrency. The create rate caps how fast you can create browsers, not how many you may run.
+
+{/* TODO: add the per-plan browser-create rate table once the numbers are confirmed. */}
+
+Acquiring from a [browser pool](/browsers/pools) isn't subject to the create rate — the pool's browsers already exist. If your traffic arrives in bursts, that's the reason to use a pool even when your concurrency headroom is fine.
+
+### What happens at the limit
+
+Exceeding the create rate returns `429 Too Many Requests` with a `Retry-After` header, and rate-limited responses carry `X-RateLimit-Limit` and `X-RateLimit-Remaining`.
+
+All Kernel SDKs retry a `429` up to 2 times, honoring `Retry-After`. If retries are exhausted, the SDK raises a typed `RateLimitError` carrying the response headers, so you can apply your own backoff. Queue on your side rather than tightening the retry loop: a `429` means the org is over budget for the minute, so retrying faster doesn't help.
+
+If you're hitting the ceiling in normal operation, [contact us](https://calendly.com/d/d3tn-5kp-5yt) — the limit is raisable.
+
+## Per-browser resources
+
+| Resource | Headful | Headless |
+| --- | --- | --- |
+| Default memory | 8 GB | 1 GB |
+
+Memory is the practical ceiling on how many tabs and how heavy a page one browser handles. A [headless](/browsers/headless) browser at 1 GB is sized for short-lived, single-page, high-concurrency automation; open a dozen heavy tabs in one and Chromium starts killing renderers. If your workload needs many concurrent pages, spread it across more browsers rather than more tabs in one. [Browser pools](/browsers/pools) accept a `memory` setting when a workload needs more than the default.
+
+[GPU acceleration](/browsers/gpu-acceleration) is a separate browser type with its own [usage rate](/info/pricing#usage-rates), available on Start-Up and Enterprise.
+
+## Other limits worth knowing
+
+| Limit | Where |
+| --- | --- |
+| Browser `timeout_seconds` (default 60, max 259200 / 72h) | [Termination](/browsers/termination) |
+| Pool `timeout_seconds` (default 600) and fill rate | [Browser pools](/browsers/pools) |
+| App invocation concurrency, per plan and per app | [Pricing](/info/pricing#concurrency-limits) |
+| Managed auth health check interval, per plan | [Connection lifecycle](/auth/connection-lifecycle) |
+| Replay retention, extensions, projects, per plan | [Pricing](/info/pricing#managed-infrastructure) |
+| Monthly spend | [Spending caps](/info/spending-caps) |
diff --git a/browsers/curl.mdx b/browsers/curl.mdx
@@ -1,5 +1,6 @@
 ---
 title: "Curl"
+sidebarTitle: "Browser Curl"
 description: "Send HTTP requests through Kernel browsers"
 ---
 

diff --git a/browsers/payments.mdx b/browsers/payments.mdx
@@ -1,5 +1,6 @@
 ---
 title: "Payments"
+sidebarTitle: "Overview"
 description: "Let browser agents complete purchases without handling raw payment details"
 ---
 

diff --git a/cookbooks.mdx b/cookbooks.mdx
@@ -1,5 +1,6 @@
 ---
 title: "cookbooks"
+sidebarTitle: "Cookbooks"
 description: "end-to-end recipes to teach agents to use the internet"
 mode: "wide"
 ---
@@ -13,6 +14,10 @@ import { CookbookSearch } from '/snippets/cookbook-search.jsx';
 ## Common patterns
 
 <Columns className="responsive-columns" cols={3}>
+  <Card title="Playwright & Computer Use" img="/images/cookbooks/playwright.png" href="/browsers/playwright-computer-use-fallback">
+    <div className="cookbook-tag">common patterns</div>
+    Using Playwright with computer use fallback.
+  </Card>
   <Card title="Human-in-the-loop Credentials" img="/images/cookbooks/hitl-creds.png" href="/browsers/use-vault-credentials-in-browser-agent">
     <div className="cookbook-tag">common patterns</div>
     Collect credentials from a human, then let your agent fill the form.
@@ -21,10 +26,6 @@ import { CookbookSearch } from '/snippets/cookbook-search.jsx';
     <div className="cookbook-tag">common patterns</div>
     Enable Payments in a Browser Agent.
   </Card>
-  <Card title="Playwright & Computer Use" img="/images/cookbooks/playwright.png" href="/browsers/playwright-computer-use-fallback">
-    <div className="cookbook-tag">common patterns</div>
-    Using Playwright with computer use fallback.
-  </Card>
   <Card title="Pausing for Captcha Solves" img="/images/cookbooks/captcha-solving.png" href="/browsers/telemetry/pausing-for-captcha-solves">
     <div className="cookbook-tag">common patterns</div>
     Hold an agent while Kernel's captcha solver works, and tell it what actually happened.