Flows and dashboards are created by POST under an issued or superuser-pinned id; PUT only updates; deleted flows leave a tombstone with their key; the controller stores by id and runs by key, hooks live under /hooks/<flow id>; a key with state or queued work behind it is refused until cleared

docs/reference/node-types.md

@@ -61,7 +61,9 @@ unwrapped only if it contains the port's name as a key.
 
 The ports pick the direction: outputs only make a **listener**, inputs a
 **sender**. A listener is a **webhook**: the engine mounts a route at
-`/hooks/{flow}/{url}/{secret}` while the flow runs. A sender requests `url`
+`/hooks/{flow id}/{url}/{secret}` while the flow runs. The flow's id is in the
+URL rather than its key, so the URL stays the same when the key changes, and
+for a flow made before ids existed it reads as the key. A sender requests `url`
 and publishes a JSON object response on its outputs, one key per output port.
 Keys no port declares are dropped, and a response that is not an object
 publishes nothing.
@@ -93,7 +95,8 @@ one), while a reverse proxy in front of the engine logs the path as it sees it.
 
 The URL picks the role: `ws://…` or `wss://…` connects to a server and
 reconnects when it drops; a path such as `/ticker` is served at
-`/hooks/{flow}/{url}/{secret}` while the flow runs. The ports pick the
+`/hooks/{flow id}/{url}/{secret}` while the flow runs, under the flow's id like
+a webhook. The ports pick the
 direction: outputs only make a **listener**, inputs a **sender**. A served
 sender sends to every connected client.