pllan 2026.3.47 → 2026.3.49

package/docs/sv/gateway/network-model.md

@@ -12,11 +12,11 @@ process that owns channel connections and the WebSocket control plane.
 
 ## Core rules
 
-- One Gateway per host is recommended. It is the only process allowed to own the WhatsApp Web session. For rescue bots or strict isolation, run multiple gateways with isolated profiles and ports. See [Multiple gateways](/gateway/multiple-gateways).
+- One Gateway per host is recommended. It is the only process allowed to own the WhatsApp Web session. For rescue bots or strict isolation, run multiple gateways with isolated profiles and ports. See [Multiple gateways](/sv/gateway/multiple-gateways).
 - Loopback first: the Gateway WS defaults to `ws://127.0.0.1:18789`. The wizard generates a gateway token by default, even for loopback. For tailnet access, run `pllan gateway --bind tailnet --token ...` because tokens are required for non-loopback binds.
 - Nodes connect to the Gateway WS over LAN, tailnet, or SSH as needed. The legacy TCP bridge is deprecated.
 - Canvas host is served by the Gateway HTTP server on the **same port** as the Gateway (default `18789`):
   - `/__pllan__/canvas/`
   - `/__pllan__/a2ui/`
-    When `gateway.auth` is configured and the Gateway binds beyond loopback, these routes are protected by Gateway auth. Node clients use node-scoped capability URLs tied to their active WS session. See [Gateway configuration](/gateway/configuration) (`canvasHost`, `gateway`).
-- Remote use is typically SSH tunnel or tailnet VPN. See [Remote access](/gateway/remote) and [Discovery](/gateway/discovery).
+    When `gateway.auth` is configured and the Gateway binds beyond loopback, these routes are protected by Gateway auth. Node clients use node-scoped capability URLs tied to their active WS session. See [Gateway configuration](/sv/gateway/configuration) (`canvasHost`, `gateway`).
+- Remote use is typically SSH tunnel or tailnet VPN. See [Remote access](/sv/gateway/remote) and [Discovery](/sv/gateway/discovery).

package/docs/sv/gateway/openai-http-api.md

@@ -39,7 +39,7 @@ Treat this endpoint as a **full operator-access** surface for the gateway instan
 - If the target agent policy allows sensitive tools, this endpoint can use them.
 - Keep this endpoint on loopback/tailnet/private ingress only; do not expose it directly to the public internet.
 
-See [Security](/gateway/security) and [Remote access](/gateway/remote).
+See [Security](/sv/gateway/security) and [Remote access](/sv/gateway/remote).
 
 ## Choosing an agent
 

package/docs/sv/gateway/openresponses-http-api.md

@@ -20,7 +20,7 @@ Under the hood, requests are executed as a normal Gateway agent run (same codepa
 
 ## Authentication, security, and routing
 
-Operational behavior matches [OpenAI Chat Completions](/gateway/openai-http-api):
+Operational behavior matches [OpenAI Chat Completions](/sv/gateway/openai-http-api):
 
 - use `Authorization: Bearer <token>` with the normal Gateway auth config
 - treat the endpoint as full operator access for the gateway instance
@@ -224,7 +224,7 @@ Security note:
 - URL allowlists are enforced before fetch and on redirect hops.
 - Allowlisting a hostname does not bypass private/internal IP blocking.
 - For internet-exposed gateways, apply network egress controls in addition to app-level guards.
-  See [Security](/gateway/security).
+  See [Security](/sv/gateway/security).
 
 ## Streaming (SSE)
 

package/docs/sv/gateway/openshell.md

@@ -14,7 +14,7 @@ containers locally, Pllan delegates sandbox lifecycle to the `openshell` CLI,
 which provisions remote environments with SSH-based command execution.
 
 The OpenShell plugin reuses the same core SSH transport and remote filesystem
-bridge as the generic [SSH backend](/gateway/sandboxing#ssh-backend). It adds
+bridge as the generic [SSH backend](/sv/gateway/sandboxing#ssh-backend). It adds
 OpenShell-specific lifecycle (`sandbox create/get/delete`, `sandbox ssh-config`)
 and an optional `mirror` workspace mode.
 
@@ -147,7 +147,7 @@ All OpenShell config lives under `plugins.entries.openshell.config`:
 
 Sandbox-level settings (`mode`, `scope`, `workspaceAccess`) are configured under
 `agents.defaults.sandbox` as with any backend. See
-[Sandboxing](/gateway/sandboxing) for the full matrix.
+[Sandboxing](/sv/gateway/sandboxing) for the full matrix.
 
 ## Examples
 
@@ -301,7 +301,7 @@ pllan sandbox recreate --all
 
 ## See also
 
-- [Sandboxing](/gateway/sandboxing) -- modes, scopes, and backend comparison
-- [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging blocked tools
-- [Multi-Agent Sandbox and Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides
-- [Sandbox CLI](/cli/sandbox) -- `pllan sandbox` commands
+- [Sandboxing](/sv/gateway/sandboxing) -- modes, scopes, and backend comparison
+- [Sandbox vs Tool Policy vs Elevated](/sv/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging blocked tools
+- [Multi-Agent Sandbox and Tools](/sv/tools/multi-agent-sandbox-tools) -- per-agent overrides
+- [Sandbox CLI](/sv/cli/sandbox) -- `pllan sandbox` commands

package/docs/sv/gateway/remote.md

@@ -28,7 +28,7 @@ Run the Gateway on a persistent host and reach it via **Tailscale** or SSH.
 
 - **Best UX:** keep `gateway.bind: "loopback"` and use **Tailscale Serve** for the Control UI.
 - **Fallback:** keep loopback + SSH tunnel from any machine that needs access.
-- **Examples:** [exe.dev](/install/exe-dev) (easy VM) or [Hetzner](/install/hetzner) (production VPS).
+- **Examples:** [exe.dev](/sv/install/exe-dev) (easy VM) or [Hetzner](/sv/install/hetzner) (production VPS).
 
 This is ideal when your laptop sleeps often but you want the agent always-on.
 
@@ -39,7 +39,7 @@ The laptop does **not** run the agent. It connects remotely:
 - Use the macOS app’s **Remote over SSH** mode (Settings → General → “Pllan runs”).
 - The app opens and manages the tunnel, so WebChat + health checks “just work.”
 
-Runbook: [macOS remote access](/platforms/mac/remote).
+Runbook: [macOS remote access](/sv/platforms/mac/remote).
 
 ### 3) Laptop runs the Gateway, remote access from other machines
 
@@ -48,7 +48,7 @@ Keep the Gateway local but expose it safely:
 - SSH tunnel to the laptop from other machines, or
 - Tailscale Serve the Control UI and keep the Gateway loopback-only.
 
-Guide: [Tailscale](/gateway/tailscale) and [Web overview](/web).
+Guide: [Tailscale](/sv/gateway/tailscale) and [Web overview](/sv/web).
 
 ## Command flow (what runs where)
 
@@ -63,7 +63,7 @@ Flow example (Telegram → node):
 
 Notes:
 
-- **Nodes do not run the gateway service.** Only one gateway should run per host unless you intentionally run isolated profiles (see [Multiple gateways](/gateway/multiple-gateways)).
+- **Nodes do not run the gateway service.** Only one gateway should run per host unless you intentionally run isolated profiles (see [Multiple gateways](/sv/gateway/multiple-gateways)).
 - macOS app “node mode” is just a node client over the Gateway WebSocket.
 
 ## SSH tunnel (CLI + tools)
@@ -130,7 +130,7 @@ WebChat no longer uses a separate HTTP port. The SwiftUI chat UI connects direct
 
 The macOS menu bar app can drive the same setup end-to-end (remote status checks, WebChat, and Voice Wake forwarding).
 
-Runbook: [macOS remote access](/platforms/mac/remote).
+Runbook: [macOS remote access](/sv/platforms/mac/remote).
 
 ## Security rules (remote/VPN)
 
@@ -150,4 +150,4 @@ Short version: **keep the Gateway loopback-only** unless you’re sure you need
   trusted. Set it to `false` if you want tokens/passwords everywhere.
 - Treat browser control like operator access: tailnet-only + deliberate node pairing.
 
-Deep dive: [Security](/gateway/security).
+Deep dive: [Security](/sv/gateway/security).

package/docs/sv/gateway/sandbox-vs-tool-policy-vs-elevated.md

@@ -39,7 +39,7 @@ Sandboxing is controlled by `agents.defaults.sandbox.mode`:
 - `"non-main"`: only non-main sessions are sandboxed (common “surprise” for groups/channels).
 - `"all"`: everything is sandboxed.
 
-See [Sandboxing](/gateway/sandboxing) for the full matrix (scope, workspace mounts, images).
+See [Sandboxing](/sv/gateway/sandboxing) for the full matrix (scope, workspace mounts, images).
 
 ### Bind mounts (security quick check)
 
@@ -110,7 +110,7 @@ Gates:
 - Enablement: `tools.elevated.enabled` (and optionally `agents.list[].tools.elevated.enabled`)
 - Sender allowlists: `tools.elevated.allowFrom.<provider>` (and optionally `agents.list[].tools.elevated.allowFrom.<provider>`)
 
-See [Elevated Mode](/tools/elevated).
+See [Elevated Mode](/sv/tools/elevated).
 
 ## Common "sandbox jail" fixes
 
@@ -129,6 +129,6 @@ In `"non-main"` mode, group/channel keys are _not_ main. Use the main session ke
 
 ## See also
 
-- [Sandboxing](/gateway/sandboxing) -- full sandbox reference (modes, scopes, backends, images)
-- [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides and precedence
-- [Elevated Mode](/tools/elevated)
+- [Sandboxing](/sv/gateway/sandboxing) -- full sandbox reference (modes, scopes, backends, images)
+- [Multi-Agent Sandbox & Tools](/sv/tools/multi-agent-sandbox-tools) -- per-agent overrides and precedence
+- [Elevated Mode](/sv/tools/elevated)

package/docs/sv/gateway/sandboxing.md

@@ -34,7 +34,7 @@ Not sandboxed:
 - The Gateway process itself.
 - Any tool explicitly allowed to run on the host (e.g. `tools.elevated`).
   - **Elevated exec runs on the host and bypasses sandboxing.**
-  - If sandboxing is off, `tools.elevated` does not change execution (already on host). See [Elevated Mode](/tools/elevated).
+  - If sandboxing is off, `tools.elevated` does not change execution (already on host). See [Elevated Mode](/sv/tools/elevated).
 
 ## Modes
 
@@ -137,7 +137,7 @@ Important consequences:
 Use `backend: "openshell"` when you want Pllan to sandbox tools in an
 OpenShell-managed remote environment. For the full setup guide, configuration
 reference, and workspace mode comparison, see the dedicated
-[OpenShell page](/gateway/openshell).
+[OpenShell page](/sv/gateway/openshell).
 
 OpenShell reuses the same core SSH transport and remote filesystem bridge as the
 generic SSH backend, and adds OpenShell-specific lifecycle
@@ -320,7 +320,7 @@ Security notes:
 - Pllan blocks dangerous bind sources (for example: `docker.sock`, `/etc`, `/proc`, `/sys`, `/dev`, and parent mounts that would expose them).
 - Sensitive mounts (secrets, SSH keys, service credentials) should be `:ro` unless absolutely required.
 - Combine with `workspaceAccess: "ro"` if you only need read access to the workspace; bind modes stay independent.
-- See [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) for how binds interact with tool policy and elevated exec.
+- See [Sandbox vs Tool Policy vs Elevated](/sv/gateway/sandbox-vs-tool-policy-vs-elevated) for how binds interact with tool policy and elevated exec.
 
 ## Images + setup
 
@@ -397,12 +397,12 @@ Security defaults:
 - Break-glass override: `agents.defaults.sandbox.docker.dangerouslyAllowContainerNamespaceJoin: true`.
 
 Docker installs and the containerized gateway live here:
-[Docker](/install/docker)
+[Docker](/sv/install/docker)
 
 For Docker gateway deployments, `scripts/docker/setup.sh` can bootstrap sandbox config.
 Set `PLLAN_SANDBOX=1` (or `true`/`yes`/`on`) to enable that path. You can
 override socket location with `PLLAN_DOCKER_SOCKET`. Full setup and env
-reference: [Docker](/install/docker#enable-agent-sandbox-for-docker-gateway-opt-in).
+reference: [Docker](/sv/install/docker#enable-agent-sandbox-for-docker-gateway-opt-in).
 
 ## setupCommand (one-time container setup)
 
@@ -430,19 +430,19 @@ globally or per-agent, sandboxing doesn’t bring it back.
 
 `tools.elevated` is an explicit escape hatch that runs `exec` on the host.
 `/exec` directives only apply for authorized senders and persist per session; to hard-disable
-`exec`, use tool policy deny (see [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated)).
+`exec`, use tool policy deny (see [Sandbox vs Tool Policy vs Elevated](/sv/gateway/sandbox-vs-tool-policy-vs-elevated)).
 
 Debugging:
 
 - Use `pllan sandbox explain` to inspect effective sandbox mode, tool policy, and fix-it config keys.
-- See [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) for the “why is this blocked?” mental model.
+- See [Sandbox vs Tool Policy vs Elevated](/sv/gateway/sandbox-vs-tool-policy-vs-elevated) for the “why is this blocked?” mental model.
   Keep it locked down.
 
 ## Multi-agent overrides
 
 Each agent can override sandbox + tools:
 `agents.list[].sandbox` and `agents.list[].tools` (plus `agents.list[].tools.sandbox.tools` for sandbox tool policy).
-See [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) for precedence.
+See [Multi-Agent Sandbox & Tools](/sv/tools/multi-agent-sandbox-tools) for precedence.
 
 ## Minimal enable example
 
@@ -462,8 +462,8 @@ See [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) for preceden
 
 ## Related docs
 
-- [OpenShell](/gateway/openshell) -- managed sandbox backend setup, workspace modes, and config reference
-- [Sandbox Configuration](/gateway/configuration-reference#agents-defaults-sandbox)
-- [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging "why is this blocked?"
-- [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides and precedence
-- [Security](/gateway/security)
+- [OpenShell](/sv/gateway/openshell) -- managed sandbox backend setup, workspace modes, and config reference
+- [Sandbox Configuration](/sv/gateway/configuration-reference#agents-defaults-sandbox)
+- [Sandbox vs Tool Policy vs Elevated](/sv/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging "why is this blocked?"
+- [Multi-Agent Sandbox & Tools](/sv/tools/multi-agent-sandbox-tools) -- per-agent overrides and precedence
+- [Security](/sv/gateway/security)

package/docs/sv/gateway/secrets-plan-contract.md

@@ -44,7 +44,7 @@ If a target does not match these rules, apply fails before mutating configuratio
 
 Plan targets are accepted for supported credential paths in:
 
-- [SecretRef Credential Surface](/reference/secretref-credential-surface)
+- [SecretRef Credential Surface](/sv/reference/secretref-credential-surface)
 
 ## Target type behavior
 
@@ -110,7 +110,7 @@ If apply fails with an invalid target path message, regenerate the plan with `pl
 
 ## Related docs
 
-- [Secrets Management](/gateway/secrets)
-- [CLI `secrets`](/cli/secrets)
-- [SecretRef Credential Surface](/reference/secretref-credential-surface)
-- [Configuration Reference](/gateway/configuration-reference)
+- [Secrets Management](/sv/gateway/secrets)
+- [CLI `secrets`](/sv/cli/secrets)
+- [SecretRef Credential Surface](/sv/reference/secretref-credential-surface)
+- [Configuration Reference](/sv/gateway/configuration-reference)

package/docs/sv/gateway/secrets.md

@@ -321,7 +321,7 @@ Runtime behavior:
 
 Canonical supported and unsupported credentials are listed in:
 
-- [SecretRef Credential Surface](/reference/secretref-credential-surface)
+- [SecretRef Credential Surface](/sv/reference/secretref-credential-surface)
 
 Runtime-minted or rotating credentials and OAuth refresh material are intentionally excluded from read-only SecretRef resolution.
 
@@ -469,7 +469,7 @@ Exec note:
 
 For strict target/path contract details and exact rejection rules, see:
 
-- [Secrets Apply Plan Contract](/gateway/secrets-plan-contract)
+- [Secrets Apply Plan Contract](/sv/gateway/secrets-plan-contract)
 
 ## One-way safety policy
 
@@ -495,9 +495,9 @@ Some SecretInput unions are easier to configure in raw editor mode than in form
 
 ## Related docs
 
-- CLI commands: [secrets](/cli/secrets)
-- Plan contract details: [Secrets Apply Plan Contract](/gateway/secrets-plan-contract)
-- Credential surface: [SecretRef Credential Surface](/reference/secretref-credential-surface)
-- Auth setup: [Authentication](/gateway/authentication)
-- Security posture: [Security](/gateway/security)
-- Environment precedence: [Environment Variables](/help/environment)
+- CLI commands: [secrets](/sv/cli/secrets)
+- Plan contract details: [Secrets Apply Plan Contract](/sv/gateway/secrets-plan-contract)
+- Credential surface: [SecretRef Credential Surface](/sv/reference/secretref-credential-surface)
+- Auth setup: [Authentication](/sv/gateway/authentication)
+- Security posture: [Security](/sv/gateway/security)
+- Environment precedence: [Environment Variables](/sv/help/environment)

package/docs/sv/gateway/security/index.md

@@ -21,7 +21,7 @@ Pllans säkerhetsvägledning förutsätter en **personlig assistent**-distributi
 
 ## Snabbkontroll: `pllan security audit`
 
-Se även: [Formell verifiering (säkerhetsmodeller)](/security/formal-verification)
+Se även: [Formell verifiering (säkerhetsmodeller)](/sv/security/formal-verification)
 
 Kör detta regelbundet (särskilt efter konfigurationsändringar eller exponering av nätverksgränssnitt):
 
@@ -54,6 +54,6 @@ Standard DM-policyer:
 
 ## Relaterad dokumentation
 
-- [Parkoppling](/channels/pairing)
-- [Gateway-konfiguration](/gateway/configuration)
-- [Formell verifiering](/security/formal-verification)
+- [Parkoppling](/sv/channels/pairing)
+- [Gateway-konfiguration](/sv/gateway/configuration)
+- [Formell verifiering](/sv/security/formal-verification)

package/docs/sv/gateway/troubleshooting.md

@@ -9,7 +9,7 @@ title: "Troubleshooting"
 # Gateway troubleshooting
 
 This page is the deep runbook.
-Start at [/help/troubleshooting](/help/troubleshooting) if you want the fast triage flow first.
+Start at [/help/troubleshooting](/sv/help/troubleshooting) if you want the fast triage flow first.
 
 ## Command ladder
 
@@ -54,9 +54,9 @@ Fix options:
 
 Related:
 
-- [/providers/anthropic](/providers/anthropic)
-- [/reference/token-use](/reference/token-use)
-- [/help/faq#why-am-i-seeing-http-429-ratelimiterror-from-anthropic](/help/faq#why-am-i-seeing-http-429-ratelimiterror-from-anthropic)
+- [/providers/anthropic](/sv/providers/anthropic)
+- [/reference/token-use](/sv/reference/token-use)
+- [/help/faq#why-am-i-seeing-http-429-ratelimiterror-from-anthropic](/sv/help/faq#why-am-i-seeing-http-429-ratelimiterror-from-anthropic)
 
 ## No replies
 
@@ -84,9 +84,9 @@ Common signatures:
 
 Related:
 
-- [/channels/troubleshooting](/channels/troubleshooting)
-- [/channels/pairing](/channels/pairing)
-- [/channels/groups](/channels/groups)
+- [/channels/troubleshooting](/sv/channels/troubleshooting)
+- [/channels/pairing](/sv/channels/pairing)
+- [/channels/groups](/sv/channels/groups)
 
 ## Dashboard control ui connectivity
 
@@ -124,8 +124,8 @@ Use `error.details.code` from the failed `connect` response to pick the next act
 | Detail code                  | Meaning                                                  | Recommended action                                                                                                                                                   |
 | ---------------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `AUTH_TOKEN_MISSING`         | Client did not send a required shared token.             | Paste/set token in the client and retry. For dashboard paths: `pllan config get gateway.auth.token` then paste into Control UI settings.                          |
-| `AUTH_TOKEN_MISMATCH`        | Shared token did not match gateway auth token.           | If `canRetryWithDeviceToken=true`, allow one trusted retry. If still failing, run the [token drift recovery checklist](/cli/devices#token-drift-recovery-checklist). |
-| `AUTH_DEVICE_TOKEN_MISMATCH` | Cached per-device token is stale or revoked.             | Rotate/re-approve device token using [devices CLI](/cli/devices), then reconnect.                                                                                    |
+| `AUTH_TOKEN_MISMATCH`        | Shared token did not match gateway auth token.           | If `canRetryWithDeviceToken=true`, allow one trusted retry. If still failing, run the [token drift recovery checklist](/sv/cli/devices#token-drift-recovery-checklist). |
+| `AUTH_DEVICE_TOKEN_MISMATCH` | Cached per-device token is stale or revoked.             | Rotate/re-approve device token using [devices CLI](/sv/cli/devices), then reconnect.                                                                                    |
 | `PAIRING_REQUIRED`           | Device identity is known but not approved for this role. | Approve pending request: `pllan devices list` then `pllan devices approve <requestId>`.                                                                        |
 
 Device auth v2 migration check:
@@ -144,10 +144,10 @@ If logs show nonce/signature errors, update the connecting client and verify it:
 
 Related:
 
-- [/web/control-ui](/web/control-ui)
-- [/gateway/authentication](/gateway/authentication)
-- [/gateway/remote](/gateway/remote)
-- [/cli/devices](/cli/devices)
+- [/web/control-ui](/sv/web/control-ui)
+- [/gateway/authentication](/sv/gateway/authentication)
+- [/gateway/remote](/sv/gateway/remote)
+- [/cli/devices](/sv/cli/devices)
 
 ## Gateway service not running
 
@@ -175,9 +175,9 @@ Common signatures:
 
 Related:
 
-- [/gateway/background-process](/gateway/background-process)
-- [/gateway/configuration](/gateway/configuration)
-- [/gateway/doctor](/gateway/doctor)
+- [/gateway/background-process](/sv/gateway/background-process)
+- [/gateway/configuration](/sv/gateway/configuration)
+- [/gateway/doctor](/sv/gateway/doctor)
 
 ## Channel connected messages not flowing
 
@@ -205,10 +205,10 @@ Common signatures:
 
 Related:
 
-- [/channels/troubleshooting](/channels/troubleshooting)
-- [/channels/whatsapp](/channels/whatsapp)
-- [/channels/telegram](/channels/telegram)
-- [/channels/discord](/channels/discord)
+- [/channels/troubleshooting](/sv/channels/troubleshooting)
+- [/channels/whatsapp](/sv/channels/whatsapp)
+- [/channels/telegram](/sv/channels/telegram)
+- [/channels/discord](/sv/channels/discord)
 
 ## Cron and heartbeat delivery
 
@@ -238,9 +238,9 @@ Common signatures:
 
 Related:
 
-- [/automation/troubleshooting](/automation/troubleshooting)
-- [/automation/cron-jobs](/automation/cron-jobs)
-- [/gateway/heartbeat](/gateway/heartbeat)
+- [/automation/troubleshooting](/sv/automation/troubleshooting)
+- [/automation/cron-jobs](/sv/automation/cron-jobs)
+- [/gateway/heartbeat](/sv/gateway/heartbeat)
 
 ## Node paired tool fails
 
@@ -269,9 +269,9 @@ Common signatures:
 
 Related:
 
-- [/nodes/troubleshooting](/nodes/troubleshooting)
-- [/nodes/index](/nodes/index)
-- [/tools/exec-approvals](/tools/exec-approvals)
+- [/nodes/troubleshooting](/sv/nodes/troubleshooting)
+- [/nodes/index](/sv/nodes/index)
+- [/tools/exec-approvals](/sv/tools/exec-approvals)
 
 ## Browser tool fails
 
@@ -300,8 +300,8 @@ Common signatures:
 
 Related:
 
-- [/tools/browser-linux-troubleshooting](/tools/browser-linux-troubleshooting)
-- [/tools/browser](/tools/browser)
+- [/tools/browser-linux-troubleshooting](/sv/tools/browser-linux-troubleshooting)
+- [/tools/browser](/sv/tools/browser)
 
 ## If you upgraded and something suddenly broke
 
@@ -373,6 +373,6 @@ pllan gateway restart
 
 Related:
 
-- [/gateway/pairing](/gateway/pairing)
-- [/gateway/authentication](/gateway/authentication)
-- [/gateway/background-process](/gateway/background-process)
+- [/gateway/pairing](/sv/gateway/pairing)
+- [/gateway/authentication](/sv/gateway/authentication)
+- [/gateway/background-process](/sv/gateway/background-process)

package/docs/sv/gateway/trusted-proxy-auth.md

@@ -324,7 +324,7 @@ If you're moving from token auth to trusted-proxy:
 
 ## Related
 
-- [Security](/gateway/security) — full security guide
-- [Configuration](/gateway/configuration) — config reference
-- [Remote Access](/gateway/remote) — other remote access patterns
-- [Tailscale](/gateway/tailscale) — simpler alternative for tailnet-only access
+- [Security](/sv/gateway/security) — full security guide
+- [Configuration](/sv/gateway/configuration) — config reference
+- [Remote Access](/sv/gateway/remote) — other remote access patterns
+- [Tailscale](/sv/gateway/tailscale) — simpler alternative for tailnet-only access

package/docs/sv/help/environment.md

@@ -90,7 +90,7 @@ You can reference env vars directly in config string values using `${VAR_NAME}`
 }
 ```
 
-See [Configuration: Env var substitution](/gateway/configuration-reference#env-var-substitution) for full details.
+See [Configuration: Env var substitution](/sv/gateway/configuration-reference#env-var-substitution) for full details.
 
 ## Secret refs vs `${ENV}` strings
 
@@ -99,7 +99,7 @@ Pllan supports two env-driven patterns:
 - `${VAR}` string substitution in config values.
 - SecretRef objects (`{ source: "env", provider: "default", id: "VAR" }`) for fields that support secrets references.
 
-Both resolve from process env at activation time. SecretRef details are documented in [Secrets Management](/gateway/secrets).
+Both resolve from process env at activation time. SecretRef details are documented in [Secrets Management](/sv/gateway/secrets).
 
 ## Path-related env vars
 
@@ -135,6 +135,6 @@ When set, `PLLAN_HOME` replaces the system home directory (`$HOME` / `os.homedir
 
 ## Related
 
-- [Gateway configuration](/gateway/configuration)
-- [FAQ: env vars and .env loading](/help/faq#env-vars-and-env-loading)
-- [Models overview](/concepts/models)
+- [Gateway configuration](/sv/gateway/configuration)
+- [FAQ: env vars and .env loading](/sv/help/faq#env-vars-and-env-loading)
+- [Models overview](/sv/concepts/models)