datlechin · Oct 13, 2026 · Oct 13, 2026
diff --git a/connections/connection-form.mdx b/connections/connection-form.mdx
@@ -17,7 +17,7 @@ The editor's sidebar lists the same four sections whatever the driver. Only Netw
 | **Options** | Timeouts, driver options, startup SQL, Safe Mode, external and AI access, iCloud |
 | **Appearance** | Icon, color, tags, group |
 
-The bar along the bottom carries **Test Connection**, **Cancel** and **Save**, plus **Save & Connect** on a new connection and **Delete** on a saved one. When **Save** is dimmed, the reason sits to its left, prefixed with the tab that holds the empty field.
+The bar along the bottom carries **Test Connection**, **Cancel** and **Save**, plus **Save & Connect** on a new connection and **Delete** on a saved one. The space to their left holds the reason **Save** is dimmed, prefixed with the tab that holds the empty field, or the warning the last test brought back from the server.
 
 ## General
 

diff --git a/connections/index.mdx b/connections/index.mdx
@@ -20,7 +20,7 @@ Press `Cmd+N` anywhere in the app to open the connection form. **New Connection
     Host, port, and credentials live on **General**. Everything else sits on **Network**, **Options** and **Appearance**; see [Connection form](/connections/connection-form).
   </Step>
   <Step title="Click Test Connection">
-    On success the button becomes a green checkmark and reads **Connected**. On failure a **Connection Test Failed** sheet carries the driver's own message, and for errors the driver recognizes a diagnostic sheet appears instead, with suggested fixes and **Copy Diagnostic Info**.
+    On success the button becomes a green checkmark and reads **Connected**. When the server accepts the login with a warning, such as a password about to expire, the checkmark is a yellow triangle and the warning sits to the left of the buttons. On failure a **Connection Test Failed** sheet carries the driver's own message, and for errors the driver recognizes a diagnostic sheet appears instead, with suggested fixes and **Copy Diagnostic Info**.
   </Step>
   <Step title="Click Save & Connect">
     The connection is saved and the window opens on it. **Save** alone keeps it without connecting.

diff --git a/databases/oracle.mdx b/databases/oracle.mdx
@@ -169,24 +169,42 @@ The SSL mode offers no certificate rows there, so **Verify Identity** checks the
 
 ## Troubleshooting
 
-**PROCEDURE … was created with compilation errors**: the unit is stored but does not compile. Each line after the first gives the line and column in the unit's source and the `PLS-` error there. Fix the source and run the `CREATE OR REPLACE` again.
+### ORA-28002: the password will expire within … days
 
-**Connection refused**: check the listener is up with `lsnrctl status`, that port 1521 is open, and, on Docker, that the container is running (`docker start oracle-xe`).
+The login worked, and the password is in its grace period. Oracle AI Database 26ai sends `ORA-28098: Profile limits PASSWORD_LIFE_TIME and PASSWORD_GRACE_TIME are not unlimited, password will expire within … days.` instead. The message stays in a yellow banner above the editor until you dismiss it, and comes back on every connect. Change the password with `ALTER USER name IDENTIFIED BY "new password"`, or ask the DBA to, before the grace period ends: after that the login fails with ORA-28001.
 
-**Invalid service name**: the listener does not answer for that name. List what it does answer for with `lsnrctl services`.
+### PROCEDURE … was created with compilation errors
 
-**Unsupported Password Verifier**: the account's verifier is one the driver cannot use, usually a new one such as 23ai. Read `password_versions` for that user and file an issue with the verifier flag the dialog shows.
+The unit is stored but does not compile. Each line after the first gives the line and column in the unit's source and the `PLS-` error there. Fix the source and run the `CREATE OR REPLACE` again.
 
-**Server Version Not Supported**: the server is 10g or earlier. Nothing on this side helps; the database has to be 11.1 or later.
+### Connection refused
 
-**Login Handshake Timed Out**: TCP connected but the login never finished, so the attempt stops when
-the connection's **Connect timeout** expires. An empty field under **Options** uses 30 seconds. The
-dialog names the step the server stopped answering at. If that step is network encryption, set
-**Network Encryption** to Rejected and connect again. Otherwise confirm the host and port reach the
-listener, and look for a firewall, VPN, or proxy that stalls traffic once the TCP handshake is done.
+Check the listener is up with `lsnrctl status`, that port 1521 is open, and, on Docker, that the container is running (`docker start oracle-xe`).
 
-**Connection Dropped During Handshake**: the server closed the connection mid-login, and the dialog names the phase it stopped at (`advancedNegotiation`, `dataTypeNegotiation`, `authentication`). Look for a firewall, VPN, or proxy that resets traffic, and confirm the host and port reach the listener itself.
+### Invalid service name
 
-**Native Network Encryption Not Completed**: the server requires an encryption or checksum algorithm the driver does not offer. Ask the DBA which ones are set and file an issue with the reason the dialog shows. TLS is the alternative: set an SSL mode instead.
+The listener does not answer for that name. List what it does answer for with `lsnrctl services`.
 
-**Native Network Encryption Required**: the server requires the negotiation but did not offer it on this connection. Ask the DBA to enable it for this client, or set an SSL mode and use TLS instead.
+### Unsupported Password Verifier
+
+The account's verifier is one the driver cannot use, usually a new one such as 23ai. Read `password_versions` for that user and file an issue with the verifier flag the dialog shows.
+
+### Server Version Not Supported
+
+The server is 10g or earlier. Nothing on this side helps; the database has to be 11.1 or later.
+
+### Login Handshake Timed Out
+
+TCP connected but the login never finished, so the attempt stops when the connection's **Connect timeout** expires. An empty field under **Options** uses 30 seconds. The dialog names the step the server stopped answering at. If that step is network encryption, set **Network Encryption** to Rejected and connect again. Otherwise confirm the host and port reach the listener, and look for a firewall, VPN, or proxy that stalls traffic once the TCP handshake is done.
+
+### Connection Dropped During Handshake
+
+The server closed the connection mid-login, and the dialog names the phase it stopped at (`advancedNegotiation`, `dataTypeNegotiation`, `authentication`). Look for a firewall, VPN, or proxy that resets traffic, and confirm the host and port reach the listener itself.
+
+### Native Network Encryption Not Completed
+
+The server requires an encryption or checksum algorithm the driver does not offer. Ask the DBA which ones are set and file an issue with the reason the dialog shows. TLS is the alternative: set an SSL mode instead.
+
+### Native Network Encryption Required
+
+The server requires the negotiation but did not offer it on this connection. Ask the DBA to enable it for this client, or set an SSL mode and use TLS instead.
diff --git a/development/plugin-development.mdx b/development/plugin-development.mdx
@@ -13,7 +13,7 @@ A plugin is a macOS loadable bundle target with `WRAPPER_EXTENSION = tableplugin
 
 | Key | Type | Required | Purpose |
 |-----|------|----------|---------|
-| `TableProPluginKitVersion` | integer | Yes | The PluginKit ABI the plugin was built against. Current value: 37 |
+| `TableProPluginKitVersion` | integer | Yes | The PluginKit ABI the plugin was built against. Current value: 38 |
 | `TableProProvidesDatabaseTypeIds` | array of strings | Recommended | Database type IDs the plugin serves, which is what makes lazy loading possible |
 | `CFBundleShortVersionString` | string | Yes | Plugin version, read by registry update checks |
 | `TableProMinAppVersion` | string | No | The loader rejects the plugin on an older app |

diff --git a/development/plugin-registry.mdx b/development/plugin-registry.mdx
@@ -66,13 +66,13 @@ The app filters `binaries` to the running architecture, keeps those whose `plugi
   "binaries": [
     {
       "architecture": "arm64",
-      "pluginKitVersion": 37,
+      "pluginKitVersion": 38,
       "downloadURL": "https://github.com/TableProApp/TablePro/releases/download/plugin-oracle-v1.0.26/OracleDriver-arm64.zip",
       "sha256": "<sha256>"
     },
     {
       "architecture": "x86_64",
-      "pluginKitVersion": 37,
+      "pluginKitVersion": 38,
       "downloadURL": "https://github.com/TableProApp/TablePro/releases/download/plugin-oracle-v1.0.26/OracleDriver-x86_64.zip",
       "sha256": "<sha256>"
     }