@sealant/mend 0.36.0-next.665 → 0.36.0-next.684

package/man/mend-accounts.1

@@ -1,4 +1,4 @@
-.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-accounts \- your connected accounts on the platform
 .SH SYNOPSIS

package/man/mend-adopt.1

@@ -1,4 +1,4 @@
-.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-adopt \- adopt a repository into the store
 .SH SYNOPSIS

package/man/mend-attach.1

@@ -1,4 +1,4 @@
-.TH MEND-ATTACH 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-ATTACH 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-attach \- reattach this terminal to a running session
 .SH SYNOPSIS

package/man/mend-codex.1

@@ -1,4 +1,4 @@
-.TH MEND-CODEX 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-CODEX 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-codex \- launch codex, claude, opencode or pi in a recorded worktree
 .SH SYNOPSIS

package/man/mend-completions.1

@@ -1,4 +1,4 @@
-.TH MEND-COMPLETIONS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-COMPLETIONS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-completions \- print the TAB\-completion hook
 .SH SYNOPSIS

package/man/mend-connect-pi.1

@@ -1,4 +1,4 @@
-.TH MEND-CONNECT-PI 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-CONNECT-PI 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-connect\-pi \- send your pi setup to every pi session of yours
 .SH SYNOPSIS

package/man/mend-connect.1

@@ -1,4 +1,4 @@
-.TH MEND-CONNECT 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-CONNECT 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-connect \- send this machine's provider credential to the platform
 .SH SYNOPSIS

package/man/mend-continue.1

@@ -1,4 +1,4 @@
-.TH MEND-CONTINUE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-CONTINUE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-continue \- resume a session with its pending review follow\-up
 .SH SYNOPSIS

package/man/mend-doctor.1

@@ -1,4 +1,4 @@
-.TH MEND-DOCTOR 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-DOCTOR 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-doctor \- check this machine's setup, or bundle it for a bug report
 .SH SYNOPSIS

package/man/mend-dotfiles-repo.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES-REPO 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-DOTFILES-REPO 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-dotfiles\-repo \- set or clear the repository the server clones at launch
 .SH SYNOPSIS

package/man/mend-dotfiles-sync.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES-SYNC 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-DOTFILES-SYNC 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-dotfiles\-sync \- capture config files from this machine into your store
 .SH SYNOPSIS

package/man/mend-dotfiles.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-DOTFILES 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-dotfiles \- your dotfiles on the server: repo and synced files
 .SH SYNOPSIS

package/man/mend-env-cluster.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-CLUSTER 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-ENV-CLUSTER 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-env\-cluster \- bind Kubernetes secrets and configmaps to the workspaces
 .SH SYNOPSIS

package/man/mend-env-load.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-LOAD 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-ENV-LOAD 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-env\-load \- load a .env into the project
 .SH SYNOPSIS

package/man/mend-env-show.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-SHOW 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-ENV-SHOW 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-env\-show \- what the project store holds: names only, never values
 .SH SYNOPSIS

package/man/mend-folder-create.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-CREATE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-FOLDER-CREATE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-folder\-create \- create an organization folder
 .SH SYNOPSIS

package/man/mend-folder-list.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-LIST 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-FOLDER-LIST 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-folder\-list \- list your organization's folders
 .SH SYNOPSIS

package/man/mend-folder-push.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-PUSH 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-FOLDER-PUSH 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-folder\-push \- upload a local directory into a folder
 .SH SYNOPSIS

package/man/mend-folder-rm.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-RM 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-FOLDER-RM 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-folder\-rm \- remove an organization folder
 .SH SYNOPSIS

package/man/mend-git-author.1

@@ -1,4 +1,4 @@
-.TH MEND-GIT-AUTHOR 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-GIT-AUTHOR 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-git\-author \- the name and email your workspaces commit as
 .SH SYNOPSIS

package/man/mend-help.1

@@ -1,4 +1,4 @@
-.TH MEND-HELP 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-HELP 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-help \- this index, or one command's page
 .SH SYNOPSIS

package/man/mend-invite.1

@@ -1,4 +1,4 @@
-.TH MEND-INVITE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-INVITE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-invite \- print a one\-time link that adds someone to your organization
 .SH SYNOPSIS

package/man/mend-keys-init.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-INIT 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-KEYS-INIT 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-keys\-init \- create your Mend key (ed25519) on the server
 .SH SYNOPSIS

package/man/mend-keys-mode.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-MODE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-KEYS-MODE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-keys\-mode \- how your remotes are reached: mend\-key or bridge
 .SH SYNOPSIS

package/man/mend-keys-share.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-SHARE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-KEYS-SHARE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-keys\-share \- relay this machine's ssh\-agent to the server
 .SH SYNOPSIS

package/man/mend-keys-show.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-SHOW 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-KEYS-SHOW 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-keys\-show \- print your Mend public key
 .SH SYNOPSIS

package/man/mend-land.1

@@ -1,4 +1,4 @@
-.TH MEND-LAND 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-LAND 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-land \- push a session's change to origin and open its pull request
 .SH SYNOPSIS

package/man/mend-login.1

@@ -1,4 +1,4 @@
-.TH MEND-LOGIN 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-LOGIN 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-login \- sign this terminal in through the browser
 .SH SYNOPSIS

package/man/mend-logout.1

@@ -1,4 +1,4 @@
-.TH MEND-LOGOUT 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-LOGOUT 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-logout \- revoke this terminal's device token and forget it
 .SH SYNOPSIS

package/man/mend-logs.1

@@ -1,14 +1,18 @@
-.TH MEND-LOGS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-LOGS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-logs \- print a session's recorded terminal output
 .SH SYNOPSIS
 .B mend logs [session] [\-\-follow] [\-\-from <sequence>] [\-\-process <id>]
 .br
+.B mend logs [session] \-\-service <name\-or\-id> [\-\-follow] [\-\-from <sequence>]
+.br
 .SH DESCRIPTION
 .PP
 Prints what the session's command (or agent) wrote to its terminal, as the record holds it, on stdout. Settled sessions count: the record outlives the process and the workspace. \-\-follow keeps printing until the process ends. The record is printed as it is, nothing taken out: anyone who can read the project can read it, so what a command printed, a password included, reaches them too. A signal stops it and puts the terminal back, exiting 128 + its number: 130 for SIGINT (Ctrl+C), 129 for SIGHUP, 143 for SIGTERM.
 .PP
-<session> is the session id, a prefix of it, or the worktree's name. With none, the one live session is taken. \-\-process reads another process of the session, a shell or a Service attempt, by a prefix of its id.
+<session> is the session id, a prefix of it, or the worktree's name. With none, the one live session is taken. \-\-process reads another process of the session, a shell or a Service attempt, by a prefix of its id; a Service's id or name there reads the Service's current attempt.
+.PP
+\-\-service reads a Service's current attempt, by the Service's id, its name or a prefix of its id, the ids mend service list prints. A full id names its Service before any name does. A name two Services carry is refused, with both ids listed; name one by its id, or name the session. A Service with no attempt (an adopted port, which Mend runs no process for) has nothing recorded, and mend logs says so and exits 1.
 .SH OPTIONS
 .TP
 .B \-\-follow, \-f
@@ -19,8 +23,15 @@ start at a record sequence. Default: 0
 .TP
 .B \-\-process <id>
 another process of the session, by a prefix of its id
+.TP
+.B \-\-service <name\-or\-id>
+a Service's current attempt
 .SH EXAMPLES
 .PP
 .B mend logs 3f2a \-\-follow
+.PP
+.B mend logs \-\-service web \-\-follow
+.br
+the Service web's output, live
 .SH SEE ALSO
 mend(1), mend\-run(1), mend\-wait(1), mend\-service\-logs(1)

package/man/mend-man.1

@@ -1,4 +1,4 @@
-.TH MEND-MAN 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-MAN 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-man \- one command's page, or the whole manual, in man
 .SH SYNOPSIS

package/man/mend-members.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMBERS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-MEMBERS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-members \- who belongs to your organization, and their roles
 .SH SYNOPSIS

package/man/mend-memory-import.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY-IMPORT 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-MEMORY-IMPORT 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-memory\-import \- bring this machine's claude and codex memory for the repository
 .SH SYNOPSIS

package/man/mend-memory-rm.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY-RM 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-MEMORY-RM 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-memory\-rm \- remove one memory file
 .SH SYNOPSIS

package/man/mend-memory-show.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY-SHOW 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-MEMORY-SHOW 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-memory\-show \- print one memory file
 .SH SYNOPSIS

package/man/mend-memory.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-MEMORY 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-memory \- what the agents remember about a project, for you
 .SH SYNOPSIS

package/man/mend-models.1

@@ -1,4 +1,4 @@
-.TH MEND-MODELS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-MODELS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-models \- the models each harness offers, as the server lists them
 .SH SYNOPSIS

package/man/mend-operator-exposure.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-EXPOSURE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-EXPOSURE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-exposure \- how this instance is exposed, as declared and as observed
 .SH SYNOPSIS

package/man/mend-operator-gate.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-GATE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-GATE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-gate \- what MEND_TENANCY=multi still needs on this instance
 .SH SYNOPSIS

package/man/mend-operator-grant-owner.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-GRANT-OWNER 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-GRANT-OWNER 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-grant\-owner \- make an existing member an owner
 .SH SYNOPSIS

package/man/mend-operator-org-create.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-CREATE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-ORG-CREATE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-org\-create \- create an organization (multi tenancy only)
 .SH SYNOPSIS

package/man/mend-operator-org-invite-owner.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-INVITE-OWNER 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-ORG-INVITE-OWNER 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-org\-invite\-owner \- print a one\-time owner invitation for an organization
 .SH SYNOPSIS

package/man/mend-operator-org-list.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-LIST 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-ORG-LIST 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-org\-list \- list organizations with their member and owner counts
 .SH SYNOPSIS

package/man/mend-operator-org-rename.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-RENAME 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-ORG-RENAME 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-org\-rename \- rename an organization
 .SH SYNOPSIS

package/man/mend-operator-reset-link.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-RESET-LINK 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-OPERATOR-RESET-LINK 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-operator\-reset\-link \- print a one\-time password reset link for an account
 .SH SYNOPSIS

package/man/mend-pair.1

@@ -1,4 +1,4 @@
-.TH MEND-PAIR 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-PAIR 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-pair \- pair a phone or a second machine
 .SH SYNOPSIS

package/man/mend-projects.1

@@ -1,4 +1,4 @@
-.TH MEND-PROJECTS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-PROJECTS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-projects \- adopted projects and their live sessions
 .SH SYNOPSIS

package/man/mend-pull.1

@@ -1,4 +1,4 @@
-.TH MEND-PULL 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-PULL 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-pull \- fetch a session's change into this clone as mend/<name>
 .SH SYNOPSIS

package/man/mend-refresh.1

@@ -1,4 +1,4 @@
-.TH MEND-REFRESH 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-REFRESH 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-refresh \- fetch origin's branches into the store
 .SH SYNOPSIS

package/man/mend-rejoin.1

@@ -1,4 +1,4 @@
-.TH MEND-REJOIN 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-REJOIN 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-rejoin \- attach if live, otherwise resume
 .SH SYNOPSIS

package/man/mend-resume.1

@@ -1,4 +1,4 @@
-.TH MEND-RESUME 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-RESUME 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-resume \- rejoin a settled session with its state restored
 .SH SYNOPSIS

package/man/mend-run.1

@@ -1,4 +1,4 @@
-.TH MEND-RUN 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-RUN 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-run \- run any command as a session
 .SH SYNOPSIS
@@ -12,7 +12,7 @@ The command's output is printed as the record has it, and mend run exits with th
 .PP
 Output this terminal could not be given in full (a read the server refused, a reader that went away) fails mend run with exit 1 even when the command succeeded, and the command's own code is said on stderr: a script never takes cut output for the whole of it.
 .PP
-The platform takes at most 64 words, none empty and none starting or ending with whitespace (a script that starts with a newline, for example). Such a command is refused before anything is created; trim the word and run it again.
+The platform takes at most 64 words and 1 MiB, at most 131,071 bytes a word, a program with no leading or trailing whitespace, and no NUL byte. An argument may be empty, start with a newline or span lines. A command it would refuse is refused before anything is created.
 .PP
 With \-\-detach, mend run returns once the command runs. With \-\-json, stdout carries one JSON object in place of the output: the session id, the process id, the worktree, the branch, and the process's status and exit code as last observed, which is how it ended without \-\-detach (and with it, when the command ended first).
 .PP

package/man/mend-secrets-add.1

@@ -1,4 +1,4 @@
-.TH MEND-SECRETS-ADD 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SECRETS-ADD 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-secrets\-add \- keep a file as a secret file, or replace one
 .SH SYNOPSIS

package/man/mend-secrets-rm.1

@@ -1,4 +1,4 @@
-.TH MEND-SECRETS-RM 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SECRETS-RM 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-secrets\-rm \- remove a secret file
 .SH SYNOPSIS

package/man/mend-secrets.1

@@ -1,4 +1,4 @@
-.TH MEND-SECRETS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SECRETS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-secrets \- your secret files: written into every session you launch
 .SH SYNOPSIS

package/man/mend-server-logs.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-LOGS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER-LOGS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-server\-logs \- print a bounded tail of the installation's container logs
 .SH SYNOPSIS

package/man/mend-server-restart.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-RESTART 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER-RESTART 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-server\-restart \- restart Mend using the same generation and pin
 .SH SYNOPSIS

package/man/mend-server-setup.1

@@ -1,8 +1,8 @@
-.TH MEND-SERVER-SETUP 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER-SETUP 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-server\-setup \- install or repair the local Mend server
 .SH SYNOPSIS
-.B mend server setup [\-\-context <name>] [\-\-version <version|latest>] [\-\-bind <ip>] [\-\-ssh\-bind <ip>] [\-\-url <origin>] [\-\-origin <origin>...] [\-\-port <n>] [\-\-ssh\-port <n>] [\-\-edge <host> | \-\-no\-edge] [\-\-exposure <loopback|private|public>] [\-\-tenancy <single|multi>] [\-\-declare <item>...] [\-\-docker\-socket <path>] [\-\-assets\-dir <dir>] [\-\-offline]
+.B mend server setup [\-\-context <name>] [\-\-version <version|latest>] [\-\-bind <ip>] [\-\-ssh\-bind <ip>] [\-\-url <origin>] [\-\-origin <origin>...] [\-\-port <n>] [\-\-ssh\-port <n>] [\-\-edge <host> | \-\-no\-edge] [\-\-exposure <loopback|private|public>] [\-\-tenancy <single|multi>] [\-\-declare <item>...] [\-\-npm\-mirror | \-\-no\-npm\-mirror] [\-\-npm\-mirror\-max\-size <size>] [\-\-docker\-mirror | \-\-no\-docker\-mirror] [\-\-docker\-mirror\-max\-size <size>] [\-\-docker\-hub\-username <name> \-\-docker\-hub\-token\-stdin \-\-docker\-hub\-public\-only | \-\-no\-docker\-hub\-login] [\-\-docker\-socket <path>] [\-\-assets\-dir <dir>] [\-\-offline]
 .br
 .SH DESCRIPTION
 .PP
@@ -14,6 +14,8 @@ The default listens only on localhost at http://localhost:3105. Non\-local acces
 .PP
 \-\-exposure declares how the instance is reached, and \-\-tenancy whether one organization or many use it. Both are written into the generation and kept across reruns and upgrades. public needs the edge and an existing first account. With multi, or with public, the multi mode gate's settings follow: MEND_SOURCE_POLICY=tenant and MEND_CAPTURE_REQUIRE_SIZES=true, and public sets MEND_URL_BEARERS=refuse. The server still decides whether it starts, and mend server status shows what it reports.
 .PP
+Two mirrors run beside Mend unless turned off: an npm mirror (nginx caching npmjs.org, capped at 10g by default, least recently used out) and a Docker mirror (a pull\-through cache of Docker Hub, capped at 20g by default: over the cap its cache is cleared). Both leave 5g free on their disk: below that, nginx evicts and the Docker mirror pauses, and sessions pull from Docker Hub directly. Neither publishes a host port. Sessions install npm packages and pull Docker Hub images through them; a project's own npm settings win, and a mirror that is down sends sessions upstream instead. Both are kept across reruns and upgrades, and an upgrade adds them to an install from before them. The Docker mirror pulls anonymously unless given a Docker Hub login: \-\-docker\-hub\-username with the access token piped on standard input, kept in server.env only. The mirror has no login of its own, so every session that reaches it can pull whatever that token can read: setup takes a login only with \-\-docker\-hub\-public\-only, your statement that the token's access permission is Public Repo Read\-only. Mend cannot check a token's scope.
+.PP
 Docker Desktop on Linux and macOS, and OrbStack on macOS, expose client\-side proxy sockets. Containers use the daemon\-side /var/run/docker.sock. \-\-docker\-socket overrides detection and is retained on reruns.
 .PP
 Setup holds an exclusive process lock through startup and health checks. A busy lock reports its owner and manual recovery steps. Never remove a live lock. Private configuration uses immutable generations and an atomic active pointer; failed attempts retain credentials and never delete Docker volumes.
@@ -58,6 +60,30 @@ declare single or multi; kept across reruns and upgrades. multi also sets the mu
 .B \-\-declare <item>
 state a gate item you verified from outside: core\-private, edge\-tls or workspace\-ssh; repeat for more, none clears. Kept across reruns. public with \-\-ssh\-bind beyond loopback needs workspace\-ssh
 .TP
+.B \-\-npm\-mirror, \-\-no\-npm\-mirror
+run or stop the npm mirror; kept across reruns and upgrades. Default: on
+.TP
+.B \-\-npm\-mirror\-max\-size <size>
+the npm mirror's disk cap, such as 20g or 1536m, at least 1g. Default: 10g
+.TP
+.B \-\-docker\-mirror, \-\-no\-docker\-mirror
+run or stop the Docker Hub mirror; kept across reruns and upgrades. Default: on
+.TP
+.B \-\-docker\-mirror\-max\-size <size>
+the Docker mirror's cap, such as 40g; over it the cache is cleared and fills again. Default: 20g
+.TP
+.B \-\-docker\-hub\-username <name>
+the Docker mirror pulls as this Docker Hub account; needs \-\-docker\-hub\-token\-stdin
+.TP
+.B \-\-docker\-hub\-token\-stdin
+read that account's access token from standard input; kept in server.env, never in argv or a session
+.TP
+.B \-\-docker\-hub\-public\-only
+required with a login: you state the token is scoped Public Repo Read\-only, since every session can pull what it can read
+.TP
+.B \-\-no\-docker\-hub\-login
+the Docker mirror pulls anonymously again
+.TP
 .B \-\-assets\-dir <dir>
 copy compose.v2.yaml and postgres\-init.sh from a release directory; fresh setup requires \-\-version
 .TP
@@ -91,5 +117,9 @@ a TLS edge for mend.example.com; its DNS points at this machine and 80 and 443 r
 .B mend server setup \-\-exposure public \-\-tenancy multi
 .br
 on an install with an edge and a first account: declare public, many organizations
+.PP
+.B printf %s "$DOCKER_HUB_TOKEN" | mend server setup \-\-docker\-hub\-username mendbot \-\-docker\-hub\-token\-stdin \-\-docker\-hub\-public\-only
+.br
+the Docker mirror pulls from Docker Hub as mendbot, with a Public Repo Read\-only token
 .SH SEE ALSO
 mend(1), mend\-server(1), mend\-server\-status(1), mend\-login(1), mend\-doctor(1), mend\-operator\-exposure(1)

package/man/mend-server-start.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-START 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER-START 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-server\-start \- start the selected server generation
 .SH SYNOPSIS

package/man/mend-server-status.1

@@ -1,6 +1,6 @@
-.TH MEND-SERVER-STATUS 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER-STATUS 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
-mend\-server\-status \- show the pin, generation, containers, edge and posture
+mend\-server\-status \- show the pin, generation, containers, edge, mirrors and posture
 .SH SYNOPSIS
 .B mend server status
 .br
@@ -8,6 +8,8 @@ mend\-server\-status \- show the pin, generation, containers, edge and posture
 .PP
 Reads the existing installation without changing its files. A running Mend must answer health with the exact pinned version. A stopped server makes no health claim. Never installs a server implicitly.
 .PP
+Each mirror the install runs follows, as observed: whether its container runs, what its cache holds, and its traffic. For the npm mirror, the tarball requests in its log for the last 24 hours and how many the cache served; for the Docker mirror, layer and manifest requests since it started and how many the cache served.
+.PP
 Then the posture, declared beside observed. Declared is what this install's configuration says: the edge host, MEND_EXPOSURE and MEND_TENANCY, a default named as one. Observed is what was seen: whether the edge's container runs and whether Caddy's data holds a certificate for the host, and what the running server reports in its health, the exposure it runs with and how many public exposure gate items are open, the tenancy and which multi mode gate items are open. When this machine is signed in to the install as the operator, every item of both gates follows with its detail, as mend operator gate and mend operator exposure print them. None of it is a verdict: the report says what was declared and what was observed.
 .SH SEE ALSO
 mend(1), mend\-server\-logs(1), mend\-server\-start(1), mend\-operator\-gate(1), mend\-operator\-exposure(1)

package/man/mend-server-stop.1

@@ -1,6 +1,6 @@
-.TH MEND-SERVER-STOP 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER-STOP 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
-mend\-server\-stop \- stop Mend, Postgres, Garage and the edge without deleting data
+mend\-server\-stop \- stop the server's containers without deleting data
 .SH SYNOPSIS
 .B mend server stop
 .br

package/man/mend-server-upgrade.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-UPGRADE 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER-UPGRADE 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-server\-upgrade \- upgrade to an explicit version with a database backup
 .SH SYNOPSIS

package/man/mend-server.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVER 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-server \- install and manage this machine's Mend server
 .SH SYNOPSIS

package/man/mend-service-add.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-ADD 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVICE-ADD 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-service\-add \- adopt a port something in the workspace already listens on
 .SH SYNOPSIS

package/man/mend-service-connect.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-CONNECT 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVICE-CONNECT 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-service\-connect \- bring live Services to this machine's loopback
 .SH SYNOPSIS

package/man/mend-service-init.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-INIT 1 "" "mend 0.36.0\-next.665" "mend manual"
+.TH MEND-SERVICE-INIT 1 "" "mend 0.36.0\-next.684" "mend manual"
 .SH NAME
 mend\-service\-init \- scaffold mend.toml from package.json and compose ports
 .SH SYNOPSIS