@sealant/mend 0.36.0-next.684 → 0.36.0-next.721

package/man/mend-accounts.1

@@ -1,4 +1,4 @@
-.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-accounts \- your connected accounts on the platform
 .SH SYNOPSIS

package/man/mend-adopt.1

@@ -1,4 +1,4 @@
-.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-adopt \- adopt a repository into the store
 .SH SYNOPSIS

package/man/mend-attach.1

@@ -1,4 +1,4 @@
-.TH MEND-ATTACH 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ATTACH 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-attach \- reattach this terminal to a running session
 .SH SYNOPSIS

package/man/mend-codex.1

@@ -1,4 +1,4 @@
-.TH MEND-CODEX 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CODEX 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-codex \- launch codex, claude, opencode or pi in a recorded worktree
 .SH SYNOPSIS

package/man/mend-completions.1

@@ -1,4 +1,4 @@
-.TH MEND-COMPLETIONS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-COMPLETIONS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-completions \- print the TAB\-completion hook
 .SH SYNOPSIS

package/man/mend-connect-pi.1

@@ -1,4 +1,4 @@
-.TH MEND-CONNECT-PI 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CONNECT-PI 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-connect\-pi \- send your pi setup to every pi session of yours
 .SH SYNOPSIS

package/man/mend-connect.1

@@ -1,4 +1,4 @@
-.TH MEND-CONNECT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CONNECT 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-connect \- send this machine's provider credential to the platform
 .SH SYNOPSIS

package/man/mend-continue.1

@@ -1,4 +1,4 @@
-.TH MEND-CONTINUE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CONTINUE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-continue \- resume a session with its pending review follow\-up
 .SH SYNOPSIS

package/man/mend-doctor.1

@@ -1,4 +1,4 @@
-.TH MEND-DOCTOR 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOCTOR 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-doctor \- check this machine's setup, or bundle it for a bug report
 .SH SYNOPSIS

package/man/mend-dotfiles-repo.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES-REPO 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOTFILES-REPO 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-dotfiles\-repo \- set or clear the repository the server clones at launch
 .SH SYNOPSIS

package/man/mend-dotfiles-sync.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES-SYNC 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOTFILES-SYNC 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-dotfiles\-sync \- capture config files from this machine into your store
 .SH SYNOPSIS

package/man/mend-dotfiles.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOTFILES 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-dotfiles \- your dotfiles on the server: repo and synced files
 .SH SYNOPSIS

package/man/mend-env-cluster.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-CLUSTER 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ENV-CLUSTER 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-env\-cluster \- bind Kubernetes secrets and configmaps to the workspaces
 .SH SYNOPSIS

package/man/mend-env-load.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-LOAD 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ENV-LOAD 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-env\-load \- load a .env into the project
 .SH SYNOPSIS

package/man/mend-env-show.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-SHOW 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ENV-SHOW 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-env\-show \- what the project store holds: names only, never values
 .SH SYNOPSIS

package/man/mend-folder-create.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-CREATE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-FOLDER-CREATE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-folder\-create \- create an organization folder
 .SH SYNOPSIS

package/man/mend-folder-list.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-LIST 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-FOLDER-LIST 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-folder\-list \- list your organization's folders
 .SH SYNOPSIS

package/man/mend-folder-push.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-PUSH 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-FOLDER-PUSH 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-folder\-push \- upload a local directory into a folder
 .SH SYNOPSIS

package/man/mend-folder-rm.1

@@ -1,4 +1,4 @@
-.TH MEND-FOLDER-RM 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-FOLDER-RM 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-folder\-rm \- remove an organization folder
 .SH SYNOPSIS

package/man/mend-git-author.1

@@ -1,4 +1,4 @@
-.TH MEND-GIT-AUTHOR 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-GIT-AUTHOR 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-git\-author \- the name and email your workspaces commit as
 .SH SYNOPSIS

package/man/mend-help.1

@@ -1,4 +1,4 @@
-.TH MEND-HELP 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-HELP 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-help \- this index, or one command's page
 .SH SYNOPSIS

package/man/mend-invite.1

@@ -1,4 +1,4 @@
-.TH MEND-INVITE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-INVITE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-invite \- print a one\-time link that adds someone to your organization
 .SH SYNOPSIS

package/man/mend-keys-init.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-INIT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-KEYS-INIT 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-keys\-init \- create your Mend key (ed25519) on the server
 .SH SYNOPSIS

package/man/mend-keys-mode.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-MODE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-KEYS-MODE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-keys\-mode \- how your remotes are reached: mend\-key or bridge
 .SH SYNOPSIS

package/man/mend-keys-share.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-SHARE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-KEYS-SHARE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-keys\-share \- relay this machine's ssh\-agent to the server
 .SH SYNOPSIS

package/man/mend-keys-show.1

@@ -1,4 +1,4 @@
-.TH MEND-KEYS-SHOW 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-KEYS-SHOW 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-keys\-show \- print your Mend public key
 .SH SYNOPSIS

package/man/mend-land.1

@@ -1,4 +1,4 @@
-.TH MEND-LAND 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-LAND 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-land \- push a session's change to origin and open its pull request
 .SH SYNOPSIS

package/man/mend-login.1

@@ -1,4 +1,4 @@
-.TH MEND-LOGIN 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-LOGIN 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-login \- sign this terminal in through the browser
 .SH SYNOPSIS

package/man/mend-logout.1

@@ -1,4 +1,4 @@
-.TH MEND-LOGOUT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-LOGOUT 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-logout \- revoke this terminal's device token and forget it
 .SH SYNOPSIS

package/man/mend-logs.1

@@ -1,4 +1,4 @@
-.TH MEND-LOGS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-LOGS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-logs \- print a session's recorded terminal output
 .SH SYNOPSIS

package/man/mend-man.1

@@ -1,4 +1,4 @@
-.TH MEND-MAN 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-MAN 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-man \- one command's page, or the whole manual, in man
 .SH SYNOPSIS

package/man/mend-members.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMBERS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-MEMBERS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-members \- who belongs to your organization, and their roles
 .SH SYNOPSIS

package/man/mend-memory-import.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY-IMPORT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-MEMORY-IMPORT 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-memory\-import \- bring this machine's claude and codex memory for the repository
 .SH SYNOPSIS

package/man/mend-memory-rm.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY-RM 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-MEMORY-RM 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-memory\-rm \- remove one memory file
 .SH SYNOPSIS

package/man/mend-memory-show.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY-SHOW 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-MEMORY-SHOW 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-memory\-show \- print one memory file
 .SH SYNOPSIS

package/man/mend-memory.1

@@ -1,4 +1,4 @@
-.TH MEND-MEMORY 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-MEMORY 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-memory \- what the agents remember about a project, for you
 .SH SYNOPSIS

package/man/mend-models.1

@@ -1,4 +1,4 @@
-.TH MEND-MODELS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-MODELS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-models \- the models each harness offers, as the server lists them
 .SH SYNOPSIS

package/man/mend-operator-exposure.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-EXPOSURE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-EXPOSURE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-exposure \- how this instance is exposed, as declared and as observed
 .SH SYNOPSIS
@@ -6,6 +6,6 @@ mend\-operator\-exposure \- how this instance is exposed, as declared and as obs
 .br
 .SH DESCRIPTION
 .PP
-Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item that blocks a start is open: every item the server can observe, and workspace\-ssh until you declare it. Items it cannot observe say what would verify them; once you have verified core\-private, edge\-tls or workspace\-ssh (SSH published apart from the web port) from outside, name it in MEND_EXPOSURE_DECLARED, or with mend server setup \-\-declare. The report is what was observed; it is not a statement that the instance is fit to expose.
+Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item that blocks a start is open: every item the server can observe, and workspace\-ssh until you declare it. Items it cannot observe say what would verify them; once you have verified core\-private, edge\-tls, workspace\-ssh (SSH published apart from the web port) or (while it is enabled) t3code\-gateway from outside, name it in MEND_EXPOSURE_DECLARED, or with mend server setup \-\-declare. The report is what was observed; it is not a statement that the instance is fit to expose.
 .SH SEE ALSO
 mend(1), mend\-operator\-gate(1), mend\-doctor(1)

package/man/mend-operator-gate.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-GATE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-GATE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-gate \- what MEND_TENANCY=multi still needs on this instance
 .SH SYNOPSIS

package/man/mend-operator-grant-owner.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-GRANT-OWNER 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-GRANT-OWNER 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-grant\-owner \- make an existing member an owner
 .SH SYNOPSIS

package/man/mend-operator-org-create.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-CREATE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-ORG-CREATE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-org\-create \- create an organization (multi tenancy only)
 .SH SYNOPSIS

package/man/mend-operator-org-invite-owner.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-INVITE-OWNER 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-ORG-INVITE-OWNER 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-org\-invite\-owner \- print a one\-time owner invitation for an organization
 .SH SYNOPSIS

package/man/mend-operator-org-list.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-LIST 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-ORG-LIST 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-org\-list \- list organizations with their member and owner counts
 .SH SYNOPSIS

package/man/mend-operator-org-rename.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-ORG-RENAME 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-ORG-RENAME 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-org\-rename \- rename an organization
 .SH SYNOPSIS

package/man/mend-operator-reset-link.1

@@ -1,4 +1,4 @@
-.TH MEND-OPERATOR-RESET-LINK 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-OPERATOR-RESET-LINK 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-operator\-reset\-link \- print a one\-time password reset link for an account
 .SH SYNOPSIS

package/man/mend-pair.1

@@ -1,4 +1,4 @@
-.TH MEND-PAIR 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-PAIR 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-pair \- pair a phone or a second machine
 .SH SYNOPSIS

package/man/mend-projects.1

@@ -1,4 +1,4 @@
-.TH MEND-PROJECTS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-PROJECTS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-projects \- adopted projects and their live sessions
 .SH SYNOPSIS

package/man/mend-pull.1

@@ -1,4 +1,4 @@
-.TH MEND-PULL 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-PULL 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-pull \- fetch a session's change into this clone as mend/<name>
 .SH SYNOPSIS

package/man/mend-refresh.1

@@ -1,4 +1,4 @@
-.TH MEND-REFRESH 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-REFRESH 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-refresh \- fetch origin's branches into the store
 .SH SYNOPSIS

package/man/mend-rejoin.1

@@ -1,4 +1,4 @@
-.TH MEND-REJOIN 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-REJOIN 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-rejoin \- attach if live, otherwise resume
 .SH SYNOPSIS

package/man/mend-resume.1

@@ -1,4 +1,4 @@
-.TH MEND-RESUME 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-RESUME 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-resume \- rejoin a settled session with its state restored
 .SH SYNOPSIS

package/man/mend-run.1

@@ -1,4 +1,4 @@
-.TH MEND-RUN 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-RUN 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-run \- run any command as a session
 .SH SYNOPSIS

package/man/mend-secrets-add.1

@@ -1,4 +1,4 @@
-.TH MEND-SECRETS-ADD 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SECRETS-ADD 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-secrets\-add \- keep a file as a secret file, or replace one
 .SH SYNOPSIS

package/man/mend-secrets-rm.1

@@ -1,4 +1,4 @@
-.TH MEND-SECRETS-RM 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SECRETS-RM 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-secrets\-rm \- remove a secret file
 .SH SYNOPSIS

package/man/mend-secrets.1

@@ -1,4 +1,4 @@
-.TH MEND-SECRETS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SECRETS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-secrets \- your secret files: written into every session you launch
 .SH SYNOPSIS

package/man/mend-server-logs.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-LOGS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER-LOGS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-server\-logs \- print a bounded tail of the installation's container logs
 .SH SYNOPSIS

package/man/mend-server-restart.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-RESTART 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER-RESTART 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-server\-restart \- restart Mend using the same generation and pin
 .SH SYNOPSIS

package/man/mend-server-setup.1

@@ -1,17 +1,25 @@
-.TH MEND-SERVER-SETUP 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER-SETUP 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
-mend\-server\-setup \- install or repair the local Mend server
+mend\-server\-setup \- install or change the local Mend server, guided
 .SH SYNOPSIS
-.B mend server setup [\-\-context <name>] [\-\-version <version|latest>] [\-\-bind <ip>] [\-\-ssh\-bind <ip>] [\-\-url <origin>] [\-\-origin <origin>...] [\-\-port <n>] [\-\-ssh\-port <n>] [\-\-edge <host> | \-\-no\-edge] [\-\-exposure <loopback|private|public>] [\-\-tenancy <single|multi>] [\-\-declare <item>...] [\-\-npm\-mirror | \-\-no\-npm\-mirror] [\-\-npm\-mirror\-max\-size <size>] [\-\-docker\-mirror | \-\-no\-docker\-mirror] [\-\-docker\-mirror\-max\-size <size>] [\-\-docker\-hub\-username <name> \-\-docker\-hub\-token\-stdin \-\-docker\-hub\-public\-only | \-\-no\-docker\-hub\-login] [\-\-docker\-socket <path>] [\-\-assets\-dir <dir>] [\-\-offline]
+.B mend server setup
+.br
+.B mend server setup [\-\-yes] [\-\-context <name>] [\-\-version <version|latest>] [\-\-bind <ip>] [\-\-ssh\-bind <ip>] [\-\-url <origin>] [\-\-origin <origin>...] [\-\-port <n>] [\-\-ssh\-port <n>] [\-\-edge <host> | \-\-no\-edge] [\-\-exposure <loopback|private|public>] [\-\-tenancy <single|multi>] [\-\-declare <item>...] [\-\-undeclare <item>...] [\-\-t3\-gateway [\-\-t3\-gateway\-port <n>] | \-\-no\-t3\-gateway] [\-\-npm\-mirror | \-\-no\-npm\-mirror] [\-\-npm\-mirror\-max\-size <size>] [\-\-docker\-mirror | \-\-no\-docker\-mirror] [\-\-docker\-mirror\-max\-size <size>] [\-\-docker\-hub\-username <name> \-\-docker\-hub\-token\-stdin \-\-docker\-hub\-public\-only | \-\-no\-docker\-hub\-login] [\-\-docker\-socket <path>] [\-\-assets\-dir <dir>] [\-\-offline]
 .br
 .SH DESCRIPTION
 .PP
+On a terminal with no flags, setup asks its questions in plain words, one at a time: how people reach this Mend (just this machine, your private network or Tailscale, or the public internet with HTTPS), whether VS Code Remote\-SSH reaches it from other machines, the T3 Code gateway, the mirrors, and one organization or several. It looks before it asks and says what it observed: Tailscale's name and address and what Tailscale Serve forwards, where your domain resolves, and whether ports 80 and 443 are taken. It never asks for an address to bind: that follows from the answers. On an existing install it shows what is saved and lets you keep it, change one thing, or go through every question. It ends with what changes, in words, and the same command with flags; nothing applies until you say yes.
+.PP
+Flags are for scripts and CI, and teach what the questions do. Each changes only what it names; everything else is kept from the saved install, so mend server setup \-\-t3\-gateway turns the gateway on and nothing more. When there is an install, a run with flags says what it changes. With no terminal and no flags, a fresh install is refused rather than guessed: \-\-yes takes the defaults.
+.PP
 Checks a local Unix\-socket Docker context and the Compose plugin, downloads the compose and Postgres initialization assets for one Mend release, preserves existing data and secrets, and starts the server. Re\-running repairs the same pinned version. A changed \-\-version is refused; use mend server upgrade. Updating this CLI never updates an existing server pin.
 .PP
 The default listens only on localhost at http://localhost:3105. Non\-local access requires both \-\-bind and \-\-url. Every extra browser origin must be named with \-\-origin; setup never guesses from the request Host header or network interfaces.
 .PP
 \-\-edge <host> runs a TLS edge in front of Mend: Caddy on ports 80 and 443 of every interface, which obtains and renews a certificate for the host and proxies to Mend's web tier. Mend's own port stays on loopback and the browser origin is https://<host>. The edge's compose overlay and Caddyfile are written into the generation beside compose.yaml, so start, restart and upgrade run them every time. \-\-no\-edge takes it away again, and the edge's container with it. A fresh install cannot start with the edge: until the first account exists, registration is open to whoever reaches the origin first, so set up on localhost, create the account, then add the edge.
 .PP
+\-\-t3\-gateway turns on the t3code gateway (docs/adr/0012): t3code's desktop, mobile and web clients add it as an environment, pair with a code from mend pair, and see this Mend's projects and sessions. It runs in the Mend container, confined to a root and a uid of its own, on a listener of its own published on 127.0.0.1 only (port 3120, or \-\-t3\-gateway\-port): reaching it from another machine is an exposure you put in front of it and declare. Setup refuses it on a Mend image that has no gateway, and says whether it answered. It is kept across reruns and upgrades; \-\-no\-t3\-gateway turns it off, and its state stays in its own volume, mend\-t3\-gateway. Off, nothing of it runs.
+.PP
 \-\-exposure declares how the instance is reached, and \-\-tenancy whether one organization or many use it. Both are written into the generation and kept across reruns and upgrades. public needs the edge and an existing first account. With multi, or with public, the multi mode gate's settings follow: MEND_SOURCE_POLICY=tenant and MEND_CAPTURE_REQUIRE_SIZES=true, and public sets MEND_URL_BEARERS=refuse. The server still decides whether it starts, and mend server status shows what it reports.
 .PP
 Two mirrors run beside Mend unless turned off: an npm mirror (nginx caching npmjs.org, capped at 10g by default, least recently used out) and a Docker mirror (a pull\-through cache of Docker Hub, capped at 20g by default: over the cap its cache is cleared). Both leave 5g free on their disk: below that, nginx evicts and the Docker mirror pauses, and sessions pull from Docker Hub directly. Neither publishes a host port. Sessions install npm packages and pull Docker Hub images through them; a project's own npm settings win, and a mirror that is down sends sessions upstream instead. Both are kept across reruns and upgrades, and an upgrade adds them to an install from before them. The Docker mirror pulls anonymously unless given a Docker Hub login: \-\-docker\-hub\-username with the access token piped on standard input, kept in server.env only. The mirror has no login of its own, so every session that reaches it can pull whatever that token can read: setup takes a login only with \-\-docker\-hub\-public\-only, your statement that the token's access permission is Public Repo Read\-only. Mend cannot check a token's scope.
@@ -21,6 +29,9 @@ Docker Desktop on Linux and macOS, and OrbStack on macOS, expose client\-side pr
 Setup holds an exclusive process lock through startup and health checks. A busy lock reports its owner and manual recovery steps. Never remove a live lock. Private configuration uses immutable generations and an atomic active pointer; failed attempts retain credentials and never delete Docker volumes.
 .SH OPTIONS
 .TP
+.B \-\-yes
+no questions: a fresh install takes the defaults (this machine only, http://localhost:3105), an existing one keeps what is saved
+.TP
 .B \-\-context <name>
 local Docker context to persist; the global context is unchanged
 .TP
@@ -37,7 +48,7 @@ where workspace SSH is published, when not on \-\-bind; with \-\-edge, Remote\-S
 advertised browser URL, required with a non\-loopback bind
 .TP
 .B \-\-origin <origin>
-additional exact browser origin; repeat for more than one
+additional exact browser origin; repeat for more than one. The list given replaces the saved one; none clears it
 .TP
 .B \-\-port <n>
 external web port. Default: 3105
@@ -51,6 +62,15 @@ run the Caddy TLS edge for this DNS name on 80 and 443; the origin becomes https
 .B \-\-no\-edge
 take a saved edge away; the origin returns to http://localhost
 .TP
+.B \-\-t3\-gateway
+run the t3code gateway, published on 127.0.0.1:3120 only; kept across reruns and upgrades
+.TP
+.B \-\-t3\-gateway\-port <n>
+the gateway's port on 127.0.0.1; implies \-\-t3\-gateway
+.TP
+.B \-\-no\-t3\-gateway
+turn the t3code gateway off; its state stays
+.TP
 .B \-\-exposure <v>
 declare loopback, private or public; kept across reruns and upgrades. public needs \-\-edge and an existing first account
 .TP
@@ -58,7 +78,10 @@ declare loopback, private or public; kept across reruns and upgrades. public nee
 declare single or multi; kept across reruns and upgrades. multi also sets the multi mode gate's variables
 .TP
 .B \-\-declare <item>
-state a gate item you verified from outside: core\-private, edge\-tls or workspace\-ssh; repeat for more, none clears. Kept across reruns. public with \-\-ssh\-bind beyond loopback needs workspace\-ssh
+state a gate item you verified from outside: core\-private, edge\-tls, workspace\-ssh or t3code\-gateway. Adds to what is saved; repeat for more, none clears. public with \-\-ssh\-bind beyond loopback needs workspace\-ssh
+.TP
+.B \-\-undeclare <item>
+take one statement back; the others stay. Repeat for more
 .TP
 .B \-\-npm\-mirror, \-\-no\-npm\-mirror
 run or stop the npm mirror; kept across reruns and upgrades. Default: on
@@ -96,7 +119,15 @@ daemon\-side socket mount override for diagnostics
 .PP
 .B mend server setup
 .br
-localhost, using the current local Docker context
+on a terminal: the questions, then what changes and the same command with flags
+.PP
+.B mend server setup \-\-t3\-gateway
+.br
+on an existing install: turn the T3 Code gateway on, and keep everything else
+.PP
+.B mend server setup \-\-yes
+.br
+no questions: localhost on a fresh install, using the current local Docker context
 .PP
 .B mend server setup \-\-context orbstack \-\-bind 0.0.0.0 \-\-url http://100.70.80.90:3105
 .br

package/man/mend-server-start.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-START 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER-START 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-server\-start \- start the selected server generation
 .SH SYNOPSIS

package/man/mend-server-status.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-STATUS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER-STATUS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-server\-status \- show the pin, generation, containers, edge, mirrors and posture
 .SH SYNOPSIS

package/man/mend-server-stop.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-STOP 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER-STOP 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-server\-stop \- stop the server's containers without deleting data
 .SH SYNOPSIS

package/man/mend-server-upgrade.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER-UPGRADE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER-UPGRADE 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-server\-upgrade \- upgrade to an explicit version with a database backup
 .SH SYNOPSIS

package/man/mend-server.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVER 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVER 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-server \- install and manage this machine's Mend server
 .SH SYNOPSIS

package/man/mend-service-add.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-ADD 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVICE-ADD 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-service\-add \- adopt a port something in the workspace already listens on
 .SH SYNOPSIS

package/man/mend-service-connect.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-CONNECT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVICE-CONNECT 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-service\-connect \- bring live Services to this machine's loopback
 .SH SYNOPSIS

package/man/mend-service-init.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-INIT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVICE-INIT 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-service\-init \- scaffold mend.toml from package.json and compose ports
 .SH SYNOPSIS

package/man/mend-service-list.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-LIST 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVICE-LIST 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-service\-list \- every live service and its observed state
 .SH SYNOPSIS

package/man/mend-service-logs.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-LOGS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVICE-LOGS 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-service\-logs \- follow a supervised service's output
 .SH SYNOPSIS

package/man/mend-service-restart.1

@@ -1,4 +1,4 @@
-.TH MEND-SERVICE-RESTART 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-SERVICE-RESTART 1 "" "mend 0.36.0\-next.721" "mend manual"
 .SH NAME
 mend\-service\-restart \- re\-run a service's recorded command, same URL
 .SH SYNOPSIS