diff --git a/docs/man/rtlsdr.html b/docs/man/rtlsdr.html
new file mode 100644
index 0000000..a82133d
--- /dev/null
+++ b/docs/man/rtlsdr.html
@@ -0,0 +1,166 @@
+
+
+
+
+
+
rtlsdr(3)
+
+
+
+
+
NAME
+rtlsdr.lib - userspace RTL2832U and R820T2 radio driver
+
+SYNOPSIS
+
+#include <rtlsdr/rtlsdr.h>
+
+
+DESCRIPTION
+The library at
+ 0:/os/rtlsdr.lib
+drives supported Realtek RTL2832U USB receivers from userspace through the
+generic process-owned USB API. Supported USB product IDs are 0bda:2832 and
+0bda:2838. Samples are returned as interleaved unsigned 8-bit I/Q pairs.
+
+Applications load the library with libloader, resolve the
+ rtlsdr_*
+symbols declared in the header, enumerate devices, open one, configure it,
+start bulk reception, read samples, stop, and close it. Claims are exclusive
+and are released by the kernel if the process exits or the device disconnects.
+
+API
+ rtlsdr_count
+and
+ rtlsdr_get_device_info
+enumerate compatible unbound USB interfaces.
+ rtlsdr_open
+claims an interface and returns an opaque device pointer.
+ rtlsdr_set_center_freq,
+ rtlsdr_set_sample_rate,
+ rtlsdr_set_tuner_gain_mode,
+ rtlsdr_set_tuner_gain,
+ rtlsdr_set_freq_correction,
+ rtlsdr_set_agc_mode,
+and
+ rtlsdr_set_direct_sampling
+configure the receiver.
+ rtlsdr_start,
+ rtlsdr_read,
+and
+ rtlsdr_stop
+control non-blocking reception.
+
+NOTES
+Syscall numbers 140 through 148 are reserved former SDR slots and are not an
+API. Device-specific control and tuner programming live entirely in this
+library.
+
+
+
+
+
+
+
diff --git a/docs/man/sshd.html b/docs/man/sshd.html
new file mode 100644
index 0000000..86a6566
--- /dev/null
+++ b/docs/man/sshd.html
@@ -0,0 +1,191 @@
+
+
+
+
+
+
sshd(1)
+
+
+
+
+
NAME
+sshd - MontaukOS SSH-2 server
+
+SYNOPSIS
+ sshd
+
+DESCRIPTION
+ sshd
+accepts SSH-2 connections and gives each authenticated user a MontaukOS shell.
+
+It is normally launched automatically by
+ init (1)
+and does not require direct user interaction. Remote access is disabled by
+default; enable it from Settings > SSH Server, which sets
+ services.ssh.enabled
+in
+ 0:/config/init.toml .
+The change takes effect on the next boot.
+
+AUTHENTICATION
+Passwords are the only supported method, checked against the MontaukOS account
+database. A user must additionally be listed in the
+ [allow]
+table of
+ 0:/config/ssh.toml
+before a login is accepted; users absent from that table are refused. The
+Settings applet maintains this table.
+
+Failed passwords are delayed, and a connection is dropped after eight attempts.
+
+CONFIGURATION
+
+ 0:/config/ssh.toml
+Listening port
+ ( server.port ,
+default 22) and the per-user
+ [allow]
+table.
+
+ 0:/config/ssh_hostkey.toml
+The RSA host key, generated on first start. Note that the filesystem has no
+permission model, so this file is readable by any local process; keeping it
+separate from
+ ssh.toml
+limits exposure but is not access control.
+
+DIAGNOSTICS
+Messages go to the boot console only. They do not appear in
+ klog (1):
+ SYS_PRINT
+writes the kernel terminal rather than the kernel log ring, and is discarded
+entirely once the desktop suppresses console output. There is currently nowhere
+to read them from on a running desktop.
+
+PROTOCOL
+Key exchange is diffie-hellman-group14-sha256 with an rsa-sha2-256 host key;
+the transport uses aes128-ctr with hmac-sha2-256. Client-initiated rekeying is
+supported. Only one session channel per connection is served, and connections
+are handled one at a time.
+
+LIMITATIONS
+Public key authentication, port forwarding, X11 forwarding, SFTP and SCP are not
+implemented.
+
+ exec
+requests run the command by feeding it to an interactive shell, so the shell
+prompt and the echoed command line appear in the output. Scripts that parse
+remote command output should account for this.
+
+SEE ALSO
+ shell (1),
+ init (1)
+
+
+
+
+
+
+
diff --git a/docs/man/vol.html b/docs/man/vol.html
new file mode 100644
index 0000000..30dc087
--- /dev/null
+++ b/docs/man/vol.html
@@ -0,0 +1,157 @@
+
+
+
+
+
+
vol(1)
+
+
+
+
+
NAME
+ vol - list mounted volumes
+
+
+SYNOPSIS
+ vol
+
+
+DESCRIPTION
+ Prints information about volumes present on the system.
+
+ Drive numbers (column "Vol") represent volumes rather than physical disk devices.
+
+ The boot ramdisk, if present, reports "-" for its size, disk, and partition.
+
+
+OUTPUT
+ Vol Type Label Size Disk Part Partition
+ 0:/ ramdisk MontaukOS - - - -
+ 1:/ ext2 Montauk 118.4 GiB 0 0 Montauk
+ 2:/ FAT32 EFI 512.0 MiB 0 1 EFI System
+
+ Disks:
+ 0 NVMe Samsung SSD 990 PRO 1TB
+
+
+COLUMNS
+ Vol Drive number, as written in paths ("1:/file.txt").
+ Type Filesystem type (ext2, FAT32, ramdisk).
+ Label Filesystem volume label, or "-" if unset.
+ Size Partition size, binary prefixes.
+ Disk Block device index (see disk legend below the table).
+ Part Partition index on that disk.
+ Partition GPT partition name, or "-" if unset.
+
+
+SEE ALSO
+ disks(1), shell(1), syscalls(2)
+
+
+
+
+
+
+
diff --git a/docs/man/wifi.html b/docs/man/wifi.html
new file mode 100644
index 0000000..1a016c8
--- /dev/null
+++ b/docs/man/wifi.html
@@ -0,0 +1,230 @@
+
+
+
+
+
+
wifi(1)
+
+
+
+
+
NAME
+ wifi - scan for wireless networks and inspect the Wi-Fi adapter
+
+
+SYNOPSIS
+ wifi [scan [seconds]]
+ wifi info
+ wifi debug
+ wifi connect <ssid> [passphrase]
+ wifi status
+ wifi disconnect
+ wifi saved
+ wifi forget <ssid>
+
+
+DESCRIPTION
+ Drives the Intel Wi-Fi adapter. With no arguments, runs a five
+ second scan and lists the networks found, strongest signal first.
+
+ The driver supports Intel AX210-family devices whose RF type is
+ GF (marketed as AX211), which is what the bundled firmware image
+ covers. Other Intel wireless parts are left unclaimed.
+
+
+COMMANDS
+ scan [seconds]
+ Sweep every regulatory-permitted channel and report the
+ networks seen. The duration is clamped to 1-20 seconds and
+ defaults to 5.
+
+ info
+ Adapter status: MAC address, firmware version, supported
+ bands, usable channel count and whether a scan is running.
+
+ debug
+ Everything info prints, plus RX/error counters, a scan with
+ per-BSS detail (BSSID, channel, RSSI, security) and band and
+ security tallies. Use this when a scan finds nothing.
+
+ connect <ssid> [passphrase]
+ Joins a network from the last scan: open, or WPA2/WPA3-PSK
+ with CCMP or GCMP. Blocks until the link is up or the attempt
+ fails, and says which it was. A passphrase given here is
+ remembered in 0:/config/wifi.toml; given only an SSID, the
+ remembered one is used. Run dhcp(1) afterwards for an address.
+
+ status
+ The network currently joined, with signal and cipher.
+
+ disconnect
+ Leaves the network and tears the firmware contexts down.
+
+ saved
+ Lists the networks in 0:/config/wifi.toml and whether the
+ desktop rejoins them by itself at startup.
+
+ forget <ssid>
+ Removes a network from 0:/config/wifi.toml.
+
+
+OUTPUT
+ SSID SIGNAL RSSI CH BAND SECURITY
+ -------------------------------------------------------------------
+ homenet [####] -42 6 2.4GHz WPA2
+ homenet-5g [###.] -61 44 5GHz WPA3
+ guest [##..] -74 11 2.4GHz open
+
+
+FIRMWARE
+ The adapter needs firmware from the ramdisk:
+
+ 0:/os/firmware/intel/iwlwifi-so-a0-gf-a0-<api>.ucode
+ 0:/os/firmware/intel/iwlwifi-so-a0-gf-a0.pnvm
+
+ Loading happens shortly after boot, off the boot-critical path,
+ so "wifi info" may briefly report "detected (firmware not loaded
+ yet)". The PNVM file carries regulatory data; without it the
+ firmware falls back to conservative built-in limits.
+
+
+SAVED NETWORKS
+ 0:/config/wifi.toml holds the networks the system may rejoin
+ without being asked, as [network.<n>] tables of ssid and psk, and
+ a wifi.autoconnect flag. The desktop writes it when "Remember this
+ network" is ticked, and reads it after the automatic scan it runs
+ at startup. Passphrases are stored as typed; anyone who can read
+ 0:/config can read them.
+
+
+GRAPHICAL USE
+ The desktop panel carries a Wi-Fi icon whenever a supported
+ adapter is present, separate from the Ethernet one. Its menu lists
+ the networks in range, asks for a passphrase when one is needed,
+ and shows the address once the link is up. The Network app has the
+ same list under its Wi-Fi tab, along with Forget.
+
+
+DIAGNOSTICS
+ no supported Wi-Fi adapter found
+ No matching device, or its RF type is not GF.
+
+ radio disabled (RF-kill)
+ The hardware kill switch is off. No scanning is possible.
+
+ error
+ Firmware load or configuration failed; klog(1) has the
+ detail under the WiFi and WiFi-FW tags.
+
+
+SEE ALSO
+ ifconfig(1), klog(1), dhcp(1), syscalls(2)
+
+
+
+
+
+
+
diff --git a/downloads.html b/downloads.html
index c2e55c9..179f868 100644
--- a/downloads.html
+++ b/downloads.html
@@ -120,6 +120,7 @@