docs: describe Console config layer precedence (#58987)

Author: vimtor

services/www/src/docs/content/console/harnesses/index.mdx

@@ -96,4 +96,5 @@ registration, so you sign in from the browser instead of pasting a key.
 https://opencode.ai/console/mcp
 ```
 
-Each harness page shows how to add it.
+Each harness page shows how to add it. OpenCode adds the server automatically as `opencode_console` when your workspace
+enables it, and asks you to sign in from the browser the first time it uses it.

services/www/src/docs/content/console/index.mdx

@@ -30,7 +30,8 @@ member.
 
 ## Policies
 
-Providers and Tools rules from the Policies page apply to every OpenCode V2 client
+Providers and Tools rules from the Policies page apply to every OpenCode client
 connected to the workspace. They are delivered as [policy](/policies#console)
-statements with final authority over the member's own configuration and take effect
-within about a minute.
+statements that outrank the member's user and project configuration and take effect
+within about a minute. Managed preferences and the system configuration file still
+outrank the workspace; see [precedence](/policies#precedence).

services/www/src/docs/content/console/websearch.mdx

@@ -3,7 +3,7 @@ title: "Web Search"
 description: "Hosted web search for OpenCode through Console."
 ---
 
-Console provides hosted web search to connected OpenCode v2 users. A workspace owner or admin enables it once for the workspace, without giving members a separate search provider key.
+Console provides hosted web search to connected OpenCode users. A workspace owner or admin enables it once for the workspace, without giving members a separate search provider key.
 
 Each successful search costs **$0.01** and counts toward the workspace balance and member spending limits.
 
@@ -19,7 +19,7 @@ Each member then connects OpenCode to the workspace with `/connect`.
 /connect
 ```
 
-OpenCode loads **OpenCode Web Search** from the workspace's managed configuration. Members do not need to set `websearch.provider` or add a provider API key.
+The workspace configuration selects **OpenCode Web Search** as the default provider. Members do not need to set `websearch.provider` or add a provider API key. A member who sets their own `websearch.provider` keeps that choice instead.
 
 ## Search
 

services/www/src/docs/content/policies.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Policies"
-description: "Allow or deny OpenCode actions on named resources, with organization policy taking final authority."
+description: "Allow or deny OpenCode actions on named resources, with managed and organization policy outranking user and project configuration."
 ---
 
 Policies decide whether OpenCode may perform an action on a named resource. They are
@@ -190,10 +190,6 @@ configuration and the connected Console always outrank user and project files.
 | 5           | Direct `opencode.json(c)`; outer directories beat inner ones                                                   |
 | 6 (lowest)  | `.opencode/opencode.json(c)`; outer directories beat inner ones                                                |
 
-This order applies when the Console serves its workspace configuration in the current
-format. A Console that still serves the older format ranks first instead, above managed
-preferences and the system file; see [Console](#console).
-
 A repository cannot re-enable a provider you deny globally:
 
 ```jsonc title="~/.config/opencode/opencode.jsonc"
@@ -213,16 +209,12 @@ A repository cannot re-enable a provider you deny globally:
 ## Console
 
 A workspace on the [OpenCode Console](/console) compiles its Providers and Tools
-policies into statements and returns them with the workspace configuration. OpenCode
+policies into regular `policies` statements in the workspace configuration. OpenCode
 merges that configuration like a configuration file that ranks right below managed
 preferences and the system file, so an organization `deny` cannot be lifted by a
 repository or user `allow`, and an organization `allow` lifts a lower-authority `deny`.
 Managed preferences and the system file still override the workspace.
 
-A Console that serves the older format instead has its statements appended after every
-authored statement, so they have the final say, over managed preferences and the system
-file too.
-
 Denials from these statements name the workspace:
 
 ```text