A node's worker label is worker, so a device is only a paired one

- NodeDef `device`/`device_policy` become `worker`/`worker_policy`, the
  issue `ignored_device` becomes `ignored_worker`, and the SDK's `@node`
  takes `worker=` and `worker_policy=`
- FlowStore._migrate renames the keys in published and draft documents
  once, bumping their version; a queued run's `needs` reads the old key
- placement passes the label as `label`, client regenerated
- docs: worker placement wording, MCP issuer without DOMAIN, device rows in
  the CLI data directory and the API table, device links in compose comments

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/code/agents.md

@@ -18,8 +18,8 @@ issuer of the client's tokens.
 
 The client registers, opens browser authorization, and receives an OAuth
 token after you approve access. The issuer and browser redirects use
-`DOMAIN`, `ENVIRONMENT`, and `FRONTEND_HOST`, so configure those for the
-addresses your client and browser can reach.
+`FRONTEND_HOST` and `ENVIRONMENT`, so configure those for the addresses your
+client and browser can reach.
 
 Manage registered clients under **Admin → Agents**. Revoking a client
 invalidates its access. MCP uses a separate signing key at

docs/code/api.md

@@ -195,6 +195,7 @@ on its own, so this is for reclaiming space sooner.
 | `POST` | `/devices/pair` | start device pairing, optionally with `{name, board, firmware}`; unauthenticated |
 | `GET` | `/devices/pair/{code}` | poll pairing with its `secret`; answers `device` (and `panel` for older firmware); unauthenticated |
 | `GET` | `/devices/pending` | devices waiting for a code, as they describe themselves |
+| `GET` | `/devices/pair/{code}/device` | what is waiting on a code, before it is approved |
 | `POST` | `/devices/{id}/pair` | adopt by `{code}`, or by `{request}` from the pending list for a request from your network |
 | `POST` | `/devices/{id}/unpair` | revoke the device credential |
 

docs/code/cli.md

@@ -340,7 +340,8 @@ The main files and directories are:
 |---|---|
 | `client.json` | Local API URL and token |
 | `fluksio.db` | SQLite database: accounts, runs, metrics and operations history |
-| `flows/` | Git repository of flows, node sources, dashboards and module requirements |
+| `flows/` | Git repository of flows, node sources, dashboards, devices (`_devices/`) and module requirements |
+| `devices.json` | Device credential nonces, outside the flow repository |
 | `artifacts/` | Files stored by content digest |
 | `user-venv/` | Managed node environment, when used |
 | `secrets.enc` | Encrypted credentials, outside the flow repository |

docs/code/nodes.md

@@ -324,10 +324,10 @@ waiting for that deadline.
 
 ## Running a node somewhere else
 
-Set a device label to select an attached worker:
+Set a worker label to select an attached worker:
 
 ```json
-{"id": "train", "device": "gpu", "device_policy": "require", "timeout": 7200}
+{"id": "train", "worker": "gpu", "worker_policy": "require", "timeout": 7200}
 ```
 
 `require` is the default and waits for a worker with that label. `prefer` uses

docs/code/workers.md

@@ -76,16 +76,16 @@ Set these fields on a node through `PUT /api/v1/flows/{name}`:
 ```json
 {
   "id": "train",
-  "device": "gpu",
-  "device_policy": "require",
+  "worker": "gpu",
+  "worker_policy": "require",
   "timeout": 7200
 }
 ```
 
 This is a node fragment; keep the node's other fields and the rest of the flow
-when updating it. `device` and `device_policy` are not in the node panel yet.
+when updating it. `worker` and `worker_policy` are not in the node panel yet.
 
-| `device_policy` | If no matching worker is attached |
+| `worker_policy` | If no matching worker is attached |
 |---|---|
 | `require` (default) | queues until a matching worker is available |
 | `prefer` | falls back to the engine |