[aicayzer]

Summary

Aligns the docs with Marfa v0.0.19: syncs the generated reference, adds the Changelog entry for what the owner console, PATCH /config, the audit filters and file-free exports change for a person, and fixes the pages this release makes untrue.

Changes

• Sync the generated reference from marfa v0.0.19 (scripts/sync-from-marfa.sh): openapi.json, the contract index, the settings table, the release and its install commands.
• Changelog: add v0.0.19.
• Authenticate: replace the sentence that sent the owner to the older management page with a table of the console pages Home lists. Revoke access names the Connected apps page.
• Back up and restore: add exporting and restoring in a browser, and "Leave out the files" for files=false.
• Settings: add "Update the configuration" for PATCH /config and marfa config update, the General and All settings pages, and what makes a setting a secret.
• Audit log: add the kind and q filters and the Activity page.
• Housekeeping: the owner runs a job from the Health page, not from the Manage Marfa pages, which no longer exist.

Testing

• pnpm test (354 tests, including the content lint), pnpm build, pnpm build:status and pnpm types:check pass.
• Read the staleness report between the v0.0.18 and v0.0.19 syncs and each page it lists; searched content/ and src/ for /auth/owner/manage, /auth/owner/restore, "Manage" and "management" and found the two pages fixed here.
• Checked every new statement against marfa v0.0.19: the contract statements, openapi.json, COMMANDS.md and the server code for the pages.
• Not tested: the new examples against a running instance.

Notes for reviewers

• Review depth: fact-check against marfa v0.0.19, as the change is prose about behavior.
• marfa audit takes neither kind nor q, and marfa export has no option for files=false; the pages say so.

Checklist

• The title is a scoped Conventional Commit.
• New behavior has a test that was seen failing first, or no test was needed and the reason is above.
• Docs, comments and the contract still say what is true after this change.

[aicayzer]

Review: ready to merge

Summary. The pull request aligns the docs with Marfa v0.0.19, and every new statement was checked against the v0.0.19 contract, API description, CLI reference and server code; the faults found were over-broad wording, fixed in this branch.

First draft: 4/5. Two statements were untrue as written (a five-minute sign-in claimed for viewing pages, and a secret claimed hidden on "every page"), plus ambiguous or over-restated wording; none blocking, all fixed in 1db3637.

Checked.

• True: page addresses and what each console page does (General, Health, Connected apps, Browsers, Activity, All settings, Export and restore, Connectors) against the route and page code; the eight newly secret settings and the MARFA_AUTH_BASE_URL refusal; PATCH /config semantics, refusals and audit action; the kind and q audit filters; files=false; that marfa audit and marfa export take none of the new options.
• True: every contract anchor and guide anchor the new text links exists; no page in content/ or src/ still sends the owner to /auth/owner/manage or /auth/owner/restore or says an export always includes files; openapi.json is byte-identical to marfa's.
• Done: pnpm test (354 tests), pnpm build, pnpm build:status and pnpm types:check pass.

Found.

• Sign-in rule overstated. The Changelog said both new pages need a sign-in within five minutes; only disconnecting an app and signing out another browser do. Fixed in 1db3637. True
• Secrets hidden "on every page". The contract promises it for the All settings pages and Home; reworded. Fixed in 1db3637. True
• Old addresses "do not redirect". A signed-out browser is sent to sign in, as for any owner path; reworded to say nothing redirects to the new pages. Fixed in 1db3637. True
• Ambiguous and misplaced sentences. The General sentence sat inside the fields-table lead-in, the Activity sentence broke the lead-in to an example, and the Home table promised addresses it did not give. Fixed in 1db3637. True
• Contract rules restated. The files=false manifest rule and the PATCH /config refusal list were trimmed to a plain statement that links the rule. Fixed in 1db3637. True

Quick fixes. 7 applied by the reviewer.

---

Reviewed by withmarfa-reviewer on Sonnet. This review may contain mistakes.