Say consumer tokens are off for every account

help/troubleshoot.md

@@ -45,7 +45,7 @@ This is safe. The peer id and the enrollment credential live in `$HOME/optimum-g
 
 **A stream-only gateway stays `degraded` with `cl_peers` failing.** It was started with the **My consensus client** command. On **1b**, choose **A feed for my consumers** and run that command. [Stream-only](/signal/connect-your-gateway#stream-only).
 
-**No Stream consumers tab, or Signal says the account “cannot mint yet”.** Optimum has consumer tokens switched off. The gateway still runs healthy without a consumer. Ask [support](/help/support). [Block stream](/operate/block-stream).
+**No Stream consumers tab.** Consumer tokens are switched off for every account. The gateway still runs healthy without a consumer, and there is no token to mint. Nothing on one organization turns the tab on. [Block stream](/operate/block-stream).
 
 **`curl` to port `48123` is refused from another machine.** Telemetry is published on the gateway host's loopback only. Run it on that host.
 

operate/block-stream.md

@@ -7,7 +7,7 @@ description: The consumer feed, and where its reference lives.
 
 A stream-only gateway serves blocks to your consumers. It is the path for an account that does not run validators. See [Choose a path](/start/choose-a-path).
 
-On the gateway host the feed is `ws://127.0.0.1:9600` and gRPC `127.0.0.1:9601`. Mint a consumer token under **Gateways & keys** → **Stream consumers**. The tab is hidden while Optimum has consumer tokens switched off. Signal then says reading the feed needs a consumer token, “which this account cannot mint yet”. Ask [support](/help/support).
+On the gateway host the feed is `ws://127.0.0.1:9600` and gRPC `127.0.0.1:9601`. A consumer token is minted under **Gateways & keys** → **Stream consumers** once Optimum switches consumer tokens on. That switch covers every account. While it is off, the tab is hidden, the gateway runs healthy without a consumer, and there is no token to mint. Nothing on one organization turns it on.
 
 Protocol, authentication, and client usage: [Consumer block stream](https://getoptimum.github.io/optimum-gateway/versions/latest/block-stream).
 

signal/network.md

@@ -15,7 +15,7 @@ Console publishes three ports. The full host requirements, including outbound ac
 
 `/health` from any machine other than the gateway host is refused. That is the bind, not a failed gateway.
 
-Stream-only also publishes the consumer feed to loopback on the gateway host: WebSocket `9600` and gRPC `9601`. Inside the container those listeners bind `0.0.0.0` so the published ports can reach them. They are not published on the host’s other interfaces. A consumer token is required; `stream_require_auth` defaults on.
+Stream-only also publishes the consumer feed to loopback on the gateway host: WebSocket `9600` and gRPC `9601`. Inside the container those listeners bind `0.0.0.0` so the published ports can reach them. They are not published on the host’s other interfaces. Reading the feed needs a consumer token once Optimum switches consumer tokens on; `stream_require_auth` defaults on. While that switch is off, the gateway runs healthy without a consumer and there is no token to mint.
 
 Outbound, the gateway needs to reach Console’s auth and bootstrap endpoints (`auth.getoptimum.io` and `bootstrap.getoptimum.io` on the production command) and the mesh peers. Use the gateway network page for the firewall list rather than opening ports this page does not name.
 

signal/what-signal-does.md

@@ -15,7 +15,7 @@ That switch covers every account. It is not a fault in yours, and no URL gets ar
 
 Enrollment keys stay available either way. With Signal on, the tab is under **Gateways & keys**. With Signal off, the sidebar item is **Manage Gateways**, and **Enrollment keys** is a tab on it.
 
-Once a gateway is enrolled, Signal opens on a home. The line under the heading is **Your validators receive blocks sooner, which improves attestation performance. A gateway you run joins Optimum's mesh, which often carries a block before public gossip reaches you.** The banner says **Signal is active** when a gateway was seen recently, and it counts gateways online and indices assigned. Under it, four cards: **Blocks received earlier**, **Attestation accuracy**, **Gateways online** (seen in the last ten minutes), and **Indices assigned**. **Set up another gateway** starts the connect steps. **Gateways & keys** is where you mint enrollment keys and consumer tokens.
+Once a gateway is enrolled, Signal opens on a home. The line under the heading is **Your validators receive blocks sooner, which improves attestation performance. A gateway you run joins Optimum's mesh, which often carries a block before public gossip reaches you.** The banner says **Signal is active** when a gateway was seen recently, and it counts gateways online and indices assigned. Under it, four cards: **Blocks received earlier**, **Attestation accuracy**, **Gateways online** (seen in the last ten minutes), and **Indices assigned**. **Set up another gateway** starts the connect steps. **Gateways & keys** is where you mint enrollment keys. The **Stream consumers** tab appears there once Optimum switches consumer tokens on for every account. While that switch is off, the tab is hidden and there is no token to mint.
 
 ![Signal home. Signal is active, with the four cards, Set up another gateway, and Gateways & keys.](/console/03-signal-home.png)
 

start/choose-a-path.md

@@ -21,4 +21,4 @@ This is a supported account. The gateway takes blocks from the mesh and serves t
 
 Signal starts this account on the stream-only command. On **1b**, **Where does this gateway send data?** is set to **A feed for my consumers**, and that is the command to copy. **My consensus client** is the beacon-node command. Starting a stream-only gateway with that one leaves `/health` failing the consensus-client checks. See the [stream-only command](/signal/connect-your-gateway#stream-only).
 
-The container is started with `OPT_STREAM_ENABLE` and `OPT_STREAM_ONLY`. The libp2p port is not published. The feed, once healthy, is on the gateway host at `ws://127.0.0.1:9600` and gRPC `127.0.0.1:9601`. Both want a consumer token, minted under **Gateways & keys** → **Stream consumers**. That tab is hidden while Optimum has consumer tokens switched off. See [Block stream](/operate/block-stream).
+The container is started with `OPT_STREAM_ENABLE` and `OPT_STREAM_ONLY`. The libp2p port is not published. The feed, once healthy, is on the gateway host at `ws://127.0.0.1:9600` and gRPC `127.0.0.1:9601`. Both want a consumer token once Optimum switches consumer tokens on. Until then the **Stream consumers** tab is hidden for every account, the gateway runs healthy without a consumer, and there is no token to mint. See [Block stream](/operate/block-stream).