From bbd0337e916dfb6ebac60d9fc7f0b1477699f808 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek@invisiblethingslab.com>
Date: Thu, 28 Dec 2023 11:44:25 +0100
Subject: [PATCH] manual fixes

Manual fixes after the conversion tool.
---
 developer/building/development-workflow.rst   |    2 +-
 .../general/documentation-style-guide.rst     |    2 +-
 developer/general/gsoc.rst                    |    4 +-
 developer/general/gsod.rst                    |    2 +-
 .../general/how-to-edit-the-documentation.rst |    4 +-
 developer/releases/3_0/release-notes.rst      |    6 -
 developer/services/admin-api.rst              |   50 +-
 developer/services/dom0-secure-updates.rst    |    4 +-
 developer/services/qrexec-internals.rst       |    4 +-
 developer/services/qrexec.rst                 |    1 -
 developer/system/gui.rst                      | 1616 +++--------------
 index.rst                                     |    6 +-
 introduction/getting-started.rst              |    2 +-
 introduction/intro.rst                        |    8 +-
 introduction/issue-tracking.rst               |   17 +-
 introduction/video-tours.rst                  |    6 +-
 project-security/verifying-signatures.rst     |    2 +-
 user/advanced-topics/resize-disk-image.rst    |    2 +-
 .../download-mirrors.rst                      |    2 +-
 .../how-to-back-up-restore-and-migrate.rst    |   32 +-
 .../how-to-guides/how-to-install-software.rst |   15 +-
 user/how-to-guides/how-to-use-pci-devices.rst |    2 +-
 user/security-in-qubes/firewall.rst           |  117 +-
 user/templates/templates.rst                  |   25 +-
 user/templates/windows/migrate-to-4-1.rst     |   16 +-
 .../windows/qubes-windows-tools-4-0.rst       |   54 +-
 26 files changed, 388 insertions(+), 1613 deletions(-)

diff --git a/developer/building/development-workflow.rst b/developer/building/development-workflow.rst
index c8d9eccc..329420db 100644
--- a/developer/building/development-workflow.rst
+++ b/developer/building/development-workflow.rst
@@ -179,7 +179,7 @@ RPMs will appear in qubes-src/linux-kernel/pkgs/fc20/x86_64:
 
 
 Useful :doc:`QubesBuilder </developer/building/qubes-builder>` commands
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 
 1. ``make check`` - will check if all the code was committed into
diff --git a/developer/general/documentation-style-guide.rst b/developer/general/documentation-style-guide.rst
index 4672f127..6a4d0298 100644
--- a/developer/general/documentation-style-guide.rst
+++ b/developer/general/documentation-style-guide.rst
@@ -208,7 +208,7 @@ the source less readable and more difficult to work with for
 localization and automation purposes. Here are examples of several types
 of alerts and their recommended icons:
 
-.. code:: bash
+.. code::
 
       <div class="alert alert-success" role="alert">
         <i class="fa fa-check-circle"></i>
diff --git a/developer/general/gsoc.rst b/developer/general/gsoc.rst
index 28f0244d..7a959826 100644
--- a/developer/general/gsoc.rst
+++ b/developer/general/gsoc.rst
@@ -92,7 +92,7 @@ and therefore one of the most important things to do well.
 
 Below is the application template:
 
-.. code:: bash
+.. code:: markdown
 
       # Introduction
       
@@ -136,7 +136,7 @@ incomplete. If you are interested in submitting a proposal based on
 these ideas, you should contact the :ref:`qubes-devel mailing list <introduction/support:qubes-devel>` and associated GitHub issue to learn
 more about the idea.
 
-.. code:: bash
+.. code:: markdown
 
       ### Adding a Proposal
       
diff --git a/developer/general/gsod.rst b/developer/general/gsod.rst
index bd1d1fa9..a607933f 100644
--- a/developer/general/gsod.rst
+++ b/developer/general/gsod.rst
@@ -224,7 +224,7 @@ satisfy the following criteria:
 
 - The videos are suitable for embedding in appropriate places in the
   Qubes documentation. (E.g., a video on how to update Qubes OS should
-  be appropriate for appearing on the :doc:`:doc:`how to update </user/how-to-guides/how-to-update>`` page.)
+  be appropriate for appearing on the :doc:`how to update </user/how-to-guides/how-to-update>` page.)
 
 - Where possible, the videos should strive to be version-independent.
   (For example, a video explaining the template system should still be
diff --git a/developer/general/how-to-edit-the-documentation.rst b/developer/general/how-to-edit-the-documentation.rst
index b37f6468..992b33a5 100644
--- a/developer/general/how-to-edit-the-documentation.rst
+++ b/developer/general/how-to-edit-the-documentation.rst
@@ -3,7 +3,7 @@ How to edit the documentation
 =============================
 
 
-*Also see the* :doc:`documentation style guide </developer/general/documentation-style-guide>` *.*
+*Also see the* :doc:`documentation style guide </developer/general/documentation-style-guide>`.
 
 Qubes OS documentation pages are stored as plain text Markdown files in
 the `qubes-doc <https://github.com/QubesOS/qubes-doc>`__ repository. By
@@ -186,7 +186,7 @@ function the way they should when the website is rendered. They are not
 further analyzed in an attempt to determine whether they are malicious.
 
 Once a pull request passes review, the reviewer should add a signed
-comment stating, “Passed review as of ``<LATEST_COMMIT>``” (or similar).
+comment stating, “Passed review as of ``<LATEST_COMMIT>`` ” (or similar).
 The documentation maintainer then verifies that the pull request is
 mechanically sound (no merge conflicts, broken links, ANSI escapes,
 etc.). If so, the documentation maintainer then merges the pull request,
diff --git a/developer/releases/3_0/release-notes.rst b/developer/releases/3_0/release-notes.rst
index f0f03820..52bb0282 100644
--- a/developer/releases/3_0/release-notes.rst
+++ b/developer/releases/3_0/release-notes.rst
@@ -3,12 +3,6 @@ Qubes R3.0 release notes
 ========================
 
 
-Qubes R3.0 Release Notes
-------------------------
-
-
-
-
 This Qubes OS release is dedicated to the memory of Caspar Bowden.
 
 New features since 2.0
diff --git a/developer/services/admin-api.rst b/developer/services/admin-api.rst
index c107bf0a..ae38120a 100644
--- a/developer/services/admin-api.rst
+++ b/developer/services/admin-api.rst
@@ -776,27 +776,35 @@ Policy admin API
 There is also an API to view and update :doc:`Qubes RPC policy files </developer/services/qrexec>` in dom0. All of the following calls have dom0 as
 destination:
 
-+------------------+----------+------------------+------------------+
-| call             | argument | inside           | return           |
-+==================+==========+==================+==================+
-| ``policy.List``  | -        | -                | ``<name1>        |
-| ``polic          |          |                  | \n<name2>\n...`` |
-| y.include.List`` |          |                  |                  |
-+------------------+----------+------------------+------------------+
-| ``policy.Get``   | name     | -                | ``<tok           |
-| ``poli           |          |                  | en>\n<content>`` |
-| cy.include.Get`` |          |                  |                  |
-+------------------+----------+------------------+------------------+
-| ``               | name     | ``<tok           | -                |
-| policy.Replace`` |          | en>\n<content>`` |                  |
-| ``policy.i       |          |                  |                  |
-| nclude.Replace`` |          |                  |                  |
-+------------------+----------+------------------+------------------+
-| `                | name     | ``<token>``      | -                |
-| `policy.Remove`` |          |                  |                  |
-| ``policy.        |          |                  |                  |
-| include.Remove`` |          |                  |                  |
-+------------------+----------+------------------+------------------+
+.. list-table:: i
+   :widths: 15 8 8 15
+   :align: left
+   :header-rows: 1
+
+   * - call
+     - argument
+     - inside
+     - return
+   * - | ``policy.List``
+       | ``policy.include.List``
+     - `-`
+     - `-`
+     - | ``<name1>\n<name2>...``
+   * - | ``policy.Get``
+       | ``policy.include.Get``
+     - name
+     - `-`
+     - | ``<token>\n<content>``
+   * - | ``policy.Get``
+       | ``policy.include.Get``
+     - name
+     - | ``<token>\n<content>``
+     - `-`
+   * - | ``policy.Remove``
+       | ``policy.include.Remove``
+     - name
+     - ``<token>``
+     - `-`
 
 The ``policy.*`` calls refer to main policy files
 (``/etc/qubes/policy.d/``), and the ``policy.include.*`` calls refer to
diff --git a/developer/services/dom0-secure-updates.rst b/developer/services/dom0-secure-updates.rst
index 7aec12d1..c5c6f72b 100644
--- a/developer/services/dom0-secure-updates.rst
+++ b/developer/services/dom0-secure-updates.rst
@@ -61,10 +61,10 @@ qubes-dom0-update). Note that we assume that this script might get
 compromised and fetch maliciously compromised downloads – this is not a
 problem as Dom0 verifies digital signatures on updates later. The
 downloaded rpm files are placed in a
- ``/var/lib/qubes/dom0-updates``  directory on UpdateVM
+``/var/lib/qubes/dom0-updates``  directory on UpdateVM
 filesystem (again, they might get compromised while being kept there,
 still this isn’t a problem). This directory is passed to yum using the
- ``–installroot=``  option.
+``–installroot=``  option.
 
 Once updates are downloaded, the update script that runs in UpdateVM
 requests an RPM service
diff --git a/developer/services/qrexec-internals.rst b/developer/services/qrexec-internals.rst
index 1813ee1e..e5097a77 100644
--- a/developer/services/qrexec-internals.rst
+++ b/developer/services/qrexec-internals.rst
@@ -14,7 +14,7 @@ Components residing in the same domain (``qrexec-client-vm`` to
 ``qrexec-agent``, ``qrexec-client`` to ``qrexec-daemon``) use local
 sockets as the underlying transport medium. Components in separate
 domains (``qrexec-daemon`` to ``qrexec-agent``, data channel between
-``qrexec-agent``s) use vchan links. Because of `vchan limitation <https://github.com/qubesos/qubes-issues/issues/951>`__, it
+``qrexec-agent``) use vchan links. Because of `vchan limitation <https://github.com/qubesos/qubes-issues/issues/951>`__, it
 is not possible to establish qrexec connection back to the source
 domain.
 
@@ -185,7 +185,7 @@ dom0: request execution of ``cmd`` in domX
   with ``qrexec-agent`` later.)
   ``qrexec-client`` translates that request into a ``MSG_EXEC_CMDLINE``
   message sent to ``qrexec-daemon``, with ``connect_domain`` set to 0
-  (connect to **dom0**) and `connect_port also set to 0 (allocate a
+  (connect to **dom0**) and ``connect_port`` also set to 0 (allocate a
   port).
 
 - **dom0**: ``qrexec-daemon`` allocates a free port (in this case 513),
diff --git a/developer/services/qrexec.rst b/developer/services/qrexec.rst
index 47d46a2e..1e8a5a8c 100644
--- a/developer/services/qrexec.rst
+++ b/developer/services/qrexec.rst
@@ -367,7 +367,6 @@ particular service argument.
 
 See `below <#rpc-service-with-argument-file-reader>`__ for an example of
 an RPC service using an argument.
-      <!-- TODO document "Yes to All" authorization if it is reintroduced -->
 
 Qubes RPC examples
 ------------------
diff --git a/developer/system/gui.rst b/developer/system/gui.rst
index e7b4f729..882e0ed9 100644
--- a/developer/system/gui.rst
+++ b/developer/system/gui.rst
@@ -213,785 +213,125 @@ Each message starts with the following header:
 
 This header is followed by message-specific data:
 
-.. raw:: html
-
-   <table class="table">
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <th>
-
-Message name
-
-.. raw:: html
-
-   </th>
-
-.. raw:: html
-
-   <th>
-
-Structure after header
-
-.. raw:: html
-
-   </th>
-
-.. raw:: html
-
-   <th>
-
-Action
-
-.. raw:: html
-
-   </th>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CLIPBOARD_DATA
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-amorphic blob (in protocol before 1.2, length determined by the “window”
-field, in 1.2 and later - by untrusted_len in the header)
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Store the received clipboard content (not parsed in any way)
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CREATE
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_create {
-     uint32_t x;
-     uint32_t y;
-     uint32_t width;
-     uint32_t height;
-     uint32_t parent;
-     uint32_t override_redirect;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Create a window with given parameters
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_DESTROY
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-None
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Destroy a window
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_MAP
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_map_info {
-     uint32_t transient_for;
-     uint32_t override_redirect;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Map a window with given parameters
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_UNMAP
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-None
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Unmap a window
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CONFIGURE
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_configure {
-     uint32_t x;
-     uint32_t y;
-     uint32_t width;
-     uint32_t height;
-     uint32_t override_redirect;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Change window position/size/type
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_MFNDUMP
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct shm_cmd {
-     uint32_t shmid;
-     uint32_t width;
-     uint32_t height;
-     uint32_t bpp;
-     uint32_t off;
-     uint32_t num_mfn;
-     uint32_t domid;
-     uint32_t mfns[0];
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Retrieve the array of mfns that constitute the composition buffer of a
-remote window.
-
-The “num_mfn” 32bit integers follow the shm_cmd structure; “off” is the
-offset of the composite buffer start in the first frame; “shmid” and
-“domid” parameters are just placeholders (to be filled by
-``qubes-guid``), so that we can use the same structure when talking to
-``shmoverride.so``.
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_SHMIMAGE
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_shmimage {
-        uint32_t x;
-        uint32_t y;
-        uint32_t width;
-        uint32_t height;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Repaint the given window fragment
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_WMNAME
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_wmname {
-     char data[128];
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Set the window name. Only printable characters are allowed, and by
-default non-ASCII characters are not allowed.
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_DOCK
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-None
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Dock the window in the tray
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_WINDOW_HINTS
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_window_hints {
-        uint32_t flags;
-        uint32_t min_width;
-        uint32_t min_height;
-        uint32_t max_width;
-        uint32_t max_height;
-        uint32_t width_inc;
-        uint32_t height_inc;
-        uint32_t base_width;
-        uint32_t base_height;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Size hints for window manager
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_WINDOW_FLAGS
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_window_flags {
-        uint32_t flags_set;
-        uint32_t flags_unset;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Change window state request; fields contains bitmask which flags request
-to be set and which unset
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CURSOR
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_cursor {
-        uint32_t cursor;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Update cursor pointer for a window. Supported cursor IDs are default
-cursor (0) and X Font cursors (with 0x100 bit set).
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_WMCLASS
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_wmclass {
-       char res_class[64];
-       char res_name[64];
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Set the WM_CLASS property of a window.
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_WINDOW_DUMP
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_window_dump_hdr {
-       uint32_t type;
-       uint32_t width;
-       uint32_t height;
-       uint32_t bpp;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Header for shared memory dump command of type hdr.type. Currently only
-
-.. raw:: html
-
-   <pre>WINDOW_DUMP_TYPE_GRANT_REFS</pre>
-
-(0) is supported.
-
-    .. raw:: html
-
-       </td>
-
-    .. raw:: html
-
-       </tr>
-
-    .. raw:: html
-
-       <tr>
-
-    .. raw:: html
-
-       <td>
-
-    WINDOW_DUMP_TYPE_GRANT_REFS
-
-    .. raw:: html
-
-       </td>
-
-    .. raw:: html
-
-       <td>
-
-    .. raw:: html
-
-       <pre>
-       struct msg_window_dump_grant_refs {
-           uint32_t refs[0];
-       };
-       </pre>
-
-    .. raw:: html
-
-       </td>
-
-    .. raw:: html
-
-       <td>
-
-    Grant references that should be mapped into the compositing buffer.
-
-    .. raw:: html
-
-       </td>
-
-    .. raw:: html
-
-       </tr>
-
-    .. raw:: html
-
-       </tr>
-
-    .. raw:: html
-
-       </table>
+.. list-table:: i
+   :widths: 8 20 40
+   :align: left
+   :header-rows: 1
+
+   * - Message name
+     - Structure after header
+     - Action
+   * - ``MSG_CLIPBOARD_DATA``
+     - amorphic blob (in protocol before 1.2, length determined by the “window” field, in 1.2 and later - by untrusted_len in the header)
+     - Store the received clipboard content (not parsed in any way)
+   * - ``MSG_CREATE``
+     - | struct msg_create {
+       |   uint32_t x;
+       |   uint32_t y;
+       |   uint32_t width;
+       |   uint32_t height;
+       |   uint32_t parent;
+       |   uint32_t override_redirect;
+       | };
+     - Create a window with given parameters
+   * - ``MSG_DESTROY``
+     - None
+     - Destroy a window
+   * - ``MSG_MAP``
+     - | struct msg_map_info {
+       |   uint32_t transient_for;
+       |   uint32_t override_redirect;
+       | };
+     - Map a window with given parameters
+   * - ``MSG_UNMAP``
+     - None
+     - Unmap a window
+   * - ``MSG_CONFIGURE``
+     - | struct msg_configure {
+       |   uint32_t x;
+       |   uint32_t y;
+       |   uint32_t width;
+       |   uint32_t height;
+       |   uint32_t override_redirect;
+       | };
+     - Change window position/size/type
+   * - ``MSG_MFNDUMP``
+     - | struct shm_cmd {
+       |   uint32_t shmid;
+       |   uint32_t width;
+       |   uint32_t height;
+       |   uint32_t bpp;
+       |   uint32_t off;
+       |   uint32_t num_mfn;
+       |   uint32_t domid;
+       |   uint32_t mfns[0];
+       | };
+     - Retrieve the array of mfns that constitute the composition buffer of a remote window.
+
+       The “num_mfn” 32bit integers follow the shm_cmd structure; “off” is the
+       offset of the composite buffer start in the first frame; “shmid” and
+       “domid” parameters are just placeholders (to be filled by
+       ``qubes-guid``), so that we can use the same structure when talking to
+       ``shmoverride.so``.
+   * - ``MSG_SHMIMAGE``
+     - | struct msg_shmimage {
+       |      uint32_t x;
+       |      uint32_t y;
+       |      uint32_t width;
+       |      uint32_t height;
+       | };
+     - Repaint the given window fragment
+   * - ``MSG_WMNAME``
+     - | struct msg_wmname {
+       |   char data[128];
+       | };
+     - Set the window name. Only printable characters are allowed, and by default non-ASCII characters are not allowed.
+   * - ``MSG_DOCK``
+     - None
+     - Dock the window in the tray
+   * - ``MSG_WINDOW_HINTS``
+     - | struct msg_window_hints {
+       |      uint32_t flags;
+       |      uint32_t min_width;
+       |      uint32_t min_height;
+       |      uint32_t max_width;
+       |      uint32_t max_height;
+       |      uint32_t width_inc;
+       |      uint32_t height_inc;
+       |      uint32_t base_width;
+       |      uint32_t base_height;
+       | };
+     - Size hints for window manager
+   * - ``MSG_WINDOW_FLAGS``
+     - | struct msg_window_flags {
+       |      uint32_t flags_set;
+       |      uint32_t flags_unset;
+       | };
+     - Change window state request; fields contains bitmask which flags request to be set and which unset
+   * - ``MSG_CURSOR``
+     - | struct msg_cursor {
+       |     uint32_t cursor;
+       | };
+     - Update cursor pointer for a window. Supported cursor IDs are default cursor (0) and X Font cursors (with 0x100 bit set).
+   * - ``MSG_WMCLASS``
+     - | struct msg_wmclass {
+       |     char res_class[64];
+       |     char res_name[64];
+       | };
+     - Set the WM_CLASS property of a window.
+   * - ``MSG_WINDOW_DUMP``
+     - | struct msg_window_dump_hdr {
+       |     uint32_t type;
+       |     uint32_t width;
+       |     uint32_t height;
+       |     uint32_t bpp;
+       | };
+     - Header for shared memory dump command of type hdr.type. Currently only ``WINDOW_DUMP_TYPE_GRANT_REFS`` (0) is supported.
+   * - ``WINDOW_DUMP_TYPE_GRANT_REFS``
+     - | struct msg_window_dump_grant_refs {
+       |     uint32_t refs[0];
+       | };
+     - Grant references that should be mapped into the compositing buffer.
 
 GuiVM -> AppVM messages
 -----------------------
@@ -1009,636 +349,94 @@ Each message starts with the following header
 
 The header is followed by message-specific data:
 
-.. raw:: html
-
-   <table class="table">
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <th>
-
-Message name
-
-.. raw:: html
-
-   </th>
-
-.. raw:: html
-
-   <th>
-
-Structure after header
-
-.. raw:: html
-
-   </th>
-
-.. raw:: html
-
-   <th>
-
-Action
-
-.. raw:: html
-
-   </th>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_KEYPRESS
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_keypress {
-     uint32_t type;
-     uint32_t x;
-     uint32_t y;
-     uint32_t state;
-     uint32_t keycode;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Tell
-
-.. raw:: html
-
-   <pre>qubes_drv</pre>
-
-driver to generate a keypress
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_BUTTON
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_button {
-     uint32_t type;
-     uint32_t x;
-     uint32_t y;
-     uint32_t state;
-     uint32_t button;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Tell
-
-.. raw:: html
-
-   <pre>qubes_drv</pre>
-
-driver to generate mouseclick
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_MOTION
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_motion {
-     uint32_t x;
-     uint32_t y;
-     uint32_t state;
-     uint32_t is_hint;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Tell
-
-.. raw:: html
-
-   <pre>qubes_drv</pre>
-
-driver to generate motion event
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CONFIGURE
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_configure {
-     uint32_t x;
-     uint32_t y;
-     uint32_t width;
-     uint32_t height;
-     uint32_t override_redirect;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Change window position/size/type
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_MAP
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_map_info {
-     uint32_t transient_for;
-     uint32_t override_redirect;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Map a window with given parameters
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CLOSE
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-None
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-send wmDeleteMessage to the window
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CROSSING
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_crossing {
-     uint32_t type;
-     uint32_t x;
-     uint32_t y;
-     uint32_t state;
-     uint32_t mode;
-     uint32_t detail;
-     uint32_t focus;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Notify window about enter/leave event
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_FOCUS
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_focus {
-     uint32_t type;
-     uint32_t mode;
-     uint32_t detail;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Raise a window, XSetInputFocus
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CLIPBOARD_REQ
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-None
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Retrieve the local clipboard, pass contents to gui-daemon
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_CLIPBOARD_DATA
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-amorphic blob
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Insert the received data into local clipboard
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_EXECUTE
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Obsolete
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Obsolete, unused
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_KEYMAP_NOTIFY
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-unsigned char remote_keys[32];
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Synchronize the keyboard state (key pressed/released) with dom0
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   <tr>
-
-.. raw:: html
-
-   <td>
-
-MSG_WINDOW_FLAGS
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-.. raw:: html
-
-   <pre>
-   struct msg_window_flags {
-     uint32_t flags_set;
-     uint32_t flags_unset;
-   };
-   </pre>
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   <td>
-
-Window state change confirmation
-
-.. raw:: html
-
-   </td>
-
-.. raw:: html
-
-   </tr>
-
-.. raw:: html
-
-   </table>
+.. list-table:: i
+   :widths: 8 20 40
+   :align: left
+   :header-rows: 1
+   
+   * - Message name
+     - Structure after header
+     - Action
+   * - ``MSG_KEYPRESS``
+     - | struct msg_keypress {
+       |   uint32_t type;
+       |   uint32_t x;
+       |   uint32_t y;
+       |   uint32_t state;
+       |   uint32_t keycode;
+       | };
+     - Tell ``qubes_drv`` driver to generate a keypress
+   * - ``MSG_BUTTON``
+     - | struct msg_button {
+       |   uint32_t type;
+       |   uint32_t x;
+       |   uint32_t y;
+       |   uint32_t state;
+       |   uint32_t button;
+       | };
+     - Tell ``qubes_drv``> driver to generate mouseclick
+   * - ``MSG_MOTION``
+     - | struct msg_motion {
+       |   uint32_t x;
+       |   uint32_t y;
+       |   uint32_t state;
+       |   uint32_t is_hint;
+       | };
+     - Tell ``qubes_drv`` driver to generate motion event
+   * - ``MSG_CONFIGURE``
+     - | struct msg_configure {
+       |   uint32_t x;
+       |   uint32_t y;
+       |   uint32_t width;
+       |   uint32_t height;
+       |   uint32_t override_redirect;
+       | };
+     - Change window position/size/type
+   * - ``MSG_MAP``
+     - | struct msg_map_info {
+       |   uint32_t transient_for;
+       |   uint32_t override_redirect;
+       | };
+     - Map a window with given parameters
+   * - ``MSG_CLOSE``
+     - None
+     - send wmDeleteMessage to the window
+   * - ``MSG_CROSSING``
+     - | struct msg_crossing {
+       |   uint32_t type;
+       |   uint32_t x;
+       |   uint32_t y;
+       |   uint32_t state;
+       |   uint32_t mode;
+       |   uint32_t detail;
+       |   uint32_t focus;
+       | };
+     - Notify window about enter/leave event
+   * - ``MSG_FOCUS``
+     - | struct msg_focus {
+       |   uint32_t type;
+       |   uint32_t mode;
+       |   uint32_t detail;
+       | };
+     - Raise a window, XSetInputFocus
+   * - ``MSG_CLIPBOARD_REQ``
+     - None
+     - Retrieve the local clipboard, pass contents to gui-daemon
+   * - ``MSG_CLIPBOARD_DATA``
+     - amorphic blob
+     - Insert the received data into local clipboard
+   * - ``MSG_EXECUTE``
+     - Obsolete
+     - Obsolete, unused
+   * - ``MSG_KEYMAP_NOTIFY``
+     - unsigned char remote_keys[32];
+     - Synchronize the keyboard state (key pressed/released) with dom0
+   * - ``MSG_WINDOW_FLAGS``
+     - | struct msg_window_flags {
+       |   uint32_t flags_set;
+       |   uint32_t flags_unset;
+       | };
+     - Window state change confirmation
 
 ``KEYPRESS``, ``BUTTON``, ``MOTION``, ``FOCUS`` messages pass
 information extracted from dom0 XEvent; see appropriate event
diff --git a/index.rst b/index.rst
index cae0c9db..381521da 100644
--- a/index.rst
+++ b/index.rst
@@ -358,11 +358,11 @@ System
 
    Security-critical code </developer/system/security-critical-code>
 
-   Qubes core admin </developer/system/qubes-core-admin>
+   Qubes core admin <https://dev.qubes-os.org/projects/core-admin/>
 
-   Qubes core admin client </developer/system/qubes-core-admin-client>
+   Qubes core admin client <https://dev.qubes-os.org/projects/core-admin-client/>
 
-   Qubes core stack </developer/system/qubes-core-stack>
+   Qubes core stack <https://www.qubes-os.org/news/2017/10/03/core3/>
 
    GUI virtualization </developer/system/gui>
 
diff --git a/introduction/getting-started.rst b/introduction/getting-started.rst
index 3aa955c4..e3f4b63f 100644
--- a/introduction/getting-started.rst
+++ b/introduction/getting-started.rst
@@ -165,7 +165,7 @@ Opening a terminal emulator in dom0 can be done in several ways:
 
 - Go to the App Menu and select **Terminal Emulator** at the top.
 
-- Press ``Alt``+ ``F3`` and search for ``xfce terminal``.
+- Press ``Alt+F3`` and search for ``xfce terminal``.
 
 - Right-click on the desktop and select **Open Terminal Here**.
 
diff --git a/introduction/intro.rst b/introduction/intro.rst
index 04d9da5d..7d1956d7 100644
--- a/introduction/intro.rst
+++ b/introduction/intro.rst
@@ -3,7 +3,7 @@ Introduction
 ============
 
 What is Qubes OS?
-----------------
+-----------------
 
 Qubes OS is a free and open-source, security-oriented operating system for
 single-user desktop computing. Qubes OS `leverages Xen-based virtualization <https://wiki.xen.org/wiki/Xen_Project_Software_Overview>`__ to allow for the creation and management of isolated compartments called :ref:`qubes <user/reference/glossary:qube>`.
@@ -54,7 +54,7 @@ Features
 
 - **Split GPG** Utilize :doc:`Split GPG </user/security-in-qubes/split-gpg>` to keep your private keys safe.
 
-- **U2F proxy** Operate :doc:`Qubes U2F proxy </user/security-in-qubes/u2f-proxy>` to use your two-factor authentication devices without exposing your web browser to the full USB stack.
+- **U2F/CTAP proxy** Operate :doc:`Qubes U2F/CTAP proxy </user/security-in-qubes/ctap-proxy>` to use your two-factor authentication devices without exposing your web browser to the full USB stack.
 
 - **Open-source** Users are free to use, copy, and modify Qubes OS and :doc:`are encouraged to do so! </introduction/contributing>`
 
@@ -63,7 +63,7 @@ Features
 
 
 Why Qubes OS?
-------------
+-------------
 
 
 Physical isolation is a given safeguard that the digital world lacks
@@ -123,7 +123,7 @@ fact, Qubes has `distinct advantages over physical air gaps <https://invisibleth
 
 
 Made to support vulnerable users and power users alike
------------------------------------------------------
+------------------------------------------------------
 
 
 Qubes provides practical, usable security to vulnerable and
diff --git a/introduction/issue-tracking.rst b/introduction/issue-tracking.rst
index a988c949..0e1b46a1 100644
--- a/introduction/issue-tracking.rst
+++ b/introduction/issue-tracking.rst
@@ -248,10 +248,13 @@ Search tips
   `Xen <https://github.com/QubesOS/qubes-issues/issues?q=is%3Aopen+is%3Aissue+label%3A%22C%3A+Xen%22>`__,
   etc.).
 
-- Search by closure reason:
-  ```reason:completed`` <https://github.com/QubesOS/qubes-issues/issues?q=reason%3Acompleted>`__
-  and
-  ```reason:"not planned"`` <https://github.com/QubesOS/qubes-issues/issues?q=reason%3A%22not+planned%22>`__.
+- Search by closure reason: |reason completed|_ and |reason notplanned|_.
+
+.. |reason completed| replace:: ``reason:completed``
+.. _reason completed: https://github.com/QubesOS/qubes-issues/issues?q=reason%3Acompleted
+
+.. |reason notplanned| replace:: ``reason:"not planned"``
+.. _reason notplanned: https://github.com/QubesOS/qubes-issues/issues?q=reason%3A%22not+planned%22
 
 - `Search by project <https://github.com/QubesOS/qubes-issues/projects>`__.
 
@@ -446,8 +449,10 @@ Resolution
 ^^^^^^^^^^
 
 
-In GitHub, an issue can be :title-reference:`closed as either ``completed`` or
-``not planned`` <https://github.blog/changelog/2022-03-10-the-new-github-issues-march-10th-update/#%F0%9F%95%B5%F0%9F%8F%BD%E2%99%80%EF%B8%8F-issue-closed-reasons>`__.
+In GitHub, an issue can be :title-reference:`closed as either ``completed`` or |notplanned|_.
+
+.. |notplanned| replace:: ``not planned``
+.. _notplanned: https://github.blog/changelog/2022-03-10-the-new-github-issues-march-10th-update/#%F0%9F%95%B5%F0%9F%8F%BD%E2%99%80%EF%B8%8F-issue-closed-reasons
 
 Being closed as ``completed`` means that the issue has been fixed (in
 the case of bugs) or done (in the case of enhancements and tasks). More
diff --git a/introduction/video-tours.rst b/introduction/video-tours.rst
index 13a98fd0..3710bcc0 100644
--- a/introduction/video-tours.rst
+++ b/introduction/video-tours.rst
@@ -18,6 +18,7 @@ September 9-11, 2022 in Berlin, Germany.
              :height: 315
              :width: 560
              :align: left
+
 ----
 
 
@@ -25,6 +26,7 @@ September 9-11, 2022 in Berlin, Germany.
              :height: 315
              :width: 560
              :align: left
+
 ----
 
 
@@ -59,10 +61,6 @@ Explaining Computers presents "Qubes OS: Security Oriented Operating System"
 ----------------------------------------------------------------------------
 
 
-
-----
-
-
 .. youtube:: hWDvS_Mp6gc
              :height: 315
              :width: 560
diff --git a/project-security/verifying-signatures.rst b/project-security/verifying-signatures.rst
index 4e9de929..b2161afa 100644
--- a/project-security/verifying-signatures.rst
+++ b/project-security/verifying-signatures.rst
@@ -984,7 +984,7 @@ signature file has been modified. Try downloading it again or from a
 different source.
 
 Do I have to verify both the `detached PGP signature file <#how-to-verify-detached-pgp-signatures-on-qubes-isos>`__ and the `cryptographic hash values <#how-to-verify-the-cryptographic-hash-values-of-qubes-isos>`__?
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 
 No, either method is sufficient by itself, but you can do both if you
diff --git a/user/advanced-topics/resize-disk-image.rst b/user/advanced-topics/resize-disk-image.rst
index 695e43c6..77e645ca 100644
--- a/user/advanced-topics/resize-disk-image.rst
+++ b/user/advanced-topics/resize-disk-image.rst
@@ -156,5 +156,5 @@ to reduce the private storage of qube1 to 1GiB: Open a terminal in dom0:
 
 
 
-If you have a SSD see :doc:`here <https://forum.qubes-os.org/t/19054>` for information on using
+If you have a SSD see `here <https://forum.qubes-os.org/t/19054>`__ for information on using
 fstrim.
diff --git a/user/downloading-installing-upgrading/download-mirrors.rst b/user/downloading-installing-upgrading/download-mirrors.rst
index 72d74a41..fbead72e 100644
--- a/user/downloading-installing-upgrading/download-mirrors.rst
+++ b/user/downloading-installing-upgrading/download-mirrors.rst
@@ -11,7 +11,7 @@ List of Download Mirrors
 
 
 The full list of known Qubes download mirrors is available
-`here <https://www.qubes-os.org/downloads/#mirrors>__.
+`here <https://www.qubes-os.org/downloads/#mirrors>`__.
 
 Instructions for Mirror Operators
 ---------------------------------
diff --git a/user/how-to-guides/how-to-back-up-restore-and-migrate.rst b/user/how-to-guides/how-to-back-up-restore-and-migrate.rst
index b8d28564..1a4e2784 100644
--- a/user/how-to-guides/how-to-back-up-restore-and-migrate.rst
+++ b/user/how-to-guides/how-to-back-up-restore-and-migrate.rst
@@ -223,26 +223,26 @@ Here are some things to consider when selecting a passphrase for your
 backups:
 
 - If you plan to store the backup for a long time or on third-party
-servers, you should make sure to use a very long, high-entropy
-passphrase. (Depending on the decryption passphrase you use for your
-system drive, this may necessitate selecting a stronger passphrase.
-If your system drive decryption passphrase is already sufficiently
-strong, it may not.)
+  servers, you should make sure to use a very long, high-entropy
+  passphrase. (Depending on the decryption passphrase you use for your
+  system drive, this may necessitate selecting a stronger passphrase.
+  If your system drive decryption passphrase is already sufficiently
+  strong, it may not.)
 
 - An adversary who has access to your backups may try to substitute one
-backup for another. For example, when you attempt to retrieve a
-recent backup, the adversary may instead give you a very old backup
-containing a compromised VM. If you’re concerned about this type of
-attack, you may wish to use a different passphrase for each backup,
-e.g., by appending a number or date to the passphrase.
+  backup for another. For example, when you attempt to retrieve a
+  recent backup, the adversary may instead give you a very old backup
+  containing a compromised VM. If you’re concerned about this type of
+  attack, you may wish to use a different passphrase for each backup,
+  e.g., by appending a number or date to the passphrase.
 
 - If you’re forced to enter your system drive decryption passphrase in
-plain view of others (where it can be shoulder-surfed), then you may
-want to use a different passphrase for your backups (even if your
-system drive decryption passphrase is already maximally strong). On
-the other hand, if you’re careful to avoid shoulder-surfing and/or
-have a passphrase that’s difficult to detect via shoulder-surfing,
-then this may not be a problem for you.
+  plain view of others (where it can be shoulder-surfed), then you may
+  want to use a different passphrase for your backups (even if your
+  system drive decryption passphrase is already maximally strong). On
+  the other hand, if you’re careful to avoid shoulder-surfing and/or
+  have a passphrase that’s difficult to detect via shoulder-surfing,
+  then this may not be a problem for you.
 
 
 
diff --git a/user/how-to-guides/how-to-install-software.rst b/user/how-to-guides/how-to-install-software.rst
index 7e85f720..358e34b4 100644
--- a/user/how-to-guides/how-to-install-software.rst
+++ b/user/how-to-guides/how-to-install-software.rst
@@ -62,15 +62,10 @@ Installing software from default repositories
    troubleshooting.)
 
 
-
-
-
 .. figure:: /attachment/doc/r4.1-dom0-appmenu-select.png
-   :alt: `The Applications tab in Qube
-   Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
+   :alt: `The Applications tab in Qube Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
 
-   `The Applications tab in Qube
-   Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
+   `The Applications tab in Qube Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
 
 Installing software from other sources
 --------------------------------------
@@ -134,11 +129,9 @@ running as a template in Qubes OS.
 
 
 .. figure:: /attachment/doc/r4.1-dom0-appmenu-select.png
-   :alt: `The Applications tab in Qube
-   Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
+   :alt: `The Applications tab in Qube Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
 
-   `The Applications tab in Qube
-   Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
+   `The Applications tab in Qube Settings </attachment/doc/r4.1-dom0-appmenu-select.png>`__
 
 Troubleshooting
 ---------------
diff --git a/user/how-to-guides/how-to-use-pci-devices.rst b/user/how-to-guides/how-to-use-pci-devices.rst
index 400c7c19..8396f8dc 100644
--- a/user/how-to-guides/how-to-use-pci-devices.rst
+++ b/user/how-to-guides/how-to-use-pci-devices.rst
@@ -59,7 +59,7 @@ attach PCI-devices to a qube.
 1. To reach the settings of any qube either
 
    - Press Alt+F3 to open the application finder, type in the VM name,
-     select the “|appmenu|[VM-name]: Qube Settings” menu entry and
+     select the “\|appmenu\|[VM-name]: Qube Settings” menu entry and
      press enter or click “Launch”!
 
    - Select the VM in Qube Manager and click the settings-button or
diff --git a/user/security-in-qubes/firewall.rst b/user/security-in-qubes/firewall.rst
index 267e5d4c..94806b27 100644
--- a/user/security-in-qubes/firewall.rst
+++ b/user/security-in-qubes/firewall.rst
@@ -459,13 +459,13 @@ each destination qube to ease rules management:
 
 .. code:: bash
 
-      nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
+   nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
 
+.. note:: the name ``custom-dnat-qubeDST`` is arbitrary
 
+.. note::
 
-   Note: the name ``custom-dnat-qubeDST`` is arbitrary
-
-   Note: while we use a DNAT chain for a single qube, it’s totally
+   while we use a DNAT chain for a single qube, it’s totally
    possible to have a single DNAT chain for multiple qubes
 
 Second step, code a natting firewall rule to route traffic on the
@@ -473,25 +473,23 @@ outside interface for the service to the sys-firewall VM
 
 .. code:: bash
 
-      nft add rule qubes custom-dnat-qubeDEST iif == "ens6" ip saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter dnat 10.137.1.z
-
-
+   nft add rule qubes custom-dnat-qubeDEST iif == "ens6" ip saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter dnat 10.137.1.z
 
 Third step, code the appropriate new filtering firewall rule to allow
 new connections for the service
 
 .. code:: bash
 
-      nft add rule qubes custom-forward iif == "ens6" ip saddr 192.168.x.y/24 ip daddr 10.137.1.z tcp dport 443 ct state new,established,related counter accept
+   nft add rule qubes custom-forward iif == "ens6" ip saddr 192.168.x.y/24 ip daddr 10.137.1.z tcp dport 443 ct state new,established,related counter accept
 
 
 
-   Note: If you do not wish to limit the IP addresses connecting to the
+.. note:: If you do not wish to limit the IP addresses connecting to the
    service, remove ``ip saddr 192.168.x.y/24`` from the rules
 
-   If you want to expose the service on multiple interfaces, repeat the
-   steps 2 and 3 described above, for each interface. Alternatively, you
-   can leave out the interface completely.
+If you want to expose the service on multiple interfaces, repeat the
+steps 2 and 3 described above, for each interface. Alternatively, you
+can leave out the interface completely.
 
 Verify the rules on sys-net firewall correctly match the packets you
 want by looking at its counters, check for the counter lines in the
@@ -499,7 +497,7 @@ chains ``custom-forward`` and ``custom-dnat-qubeDEST``:
 
 .. code:: bash
 
-      nft list table ip qubes
+   nft list table ip qubes
 
 
 
@@ -508,14 +506,14 @@ in the dnat rule:
 
 .. code:: bash
 
-      chain custom-forward {
-        iif "ens6" ip saddr 192.168.x.y/24 ip daddr 10.137.1.z tcp dport 443 ct state new,established,related counter packets 7 bytes 448 accept
-      }
-      
-      chain custom-dnat-qubeDEST {
-        type nat hook prerouting priority filter + 1; policy accept;
-        iif "ens6" ip saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter packets 3 bytes 192 dnat to 10.138.33.59
-      }
+   chain custom-forward {
+     iif "ens6" ip saddr 192.168.x.y/24 ip daddr 10.137.1.z tcp dport 443 ct state new,established,related counter packets 7 bytes 448 accept
+   }
+
+   chain custom-dnat-qubeDEST {
+     type nat hook prerouting priority filter + 1; policy accept;
+     iif "ens6" ip saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter packets 3 bytes 192 dnat to 10.138.33.59
+   }
 
 
 
@@ -524,7 +522,7 @@ service from an external device using the following command:
 
 .. code:: bash
 
-      telnet 192.168.x.n 443
+   telnet 192.168.x.n 443
 
 
 
@@ -534,8 +532,8 @@ so they get set on sys-net start-up:
 
 .. code:: bash
 
-      [user@sys-net user]$ sudo -i
-      [root@sys-net user]# nano /rw/config/qubes-firewall-user-script
+   [user@sys-net user]$ sudo -i
+   [root@sys-net user]# nano /rw/config/qubes-firewall-user-script
 
 
 
@@ -543,17 +541,17 @@ Content of ``/rw/config/qubes-firewall-user-script`` in ``sys-net``:
 
 .. code:: bash
 
-      #!/bin/sh
-      
-      # create the dnat chain for qubeDEST if it doesn't already exist
-      if nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
-      then
-        # create the dnat rule
-        nft add rule qubes custom-dnat-qubeDEST iif == "ens6" saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter dnat 10.137.1.z
-      
-        # allow forwarded traffic
-        nft add rule qubes custom-forward iif == "ens6" ip saddr 192.168.x.y/24 ip daddr 10.137.1.z tcp dport 443 ct state new,established,related counter accept
-      fi
+   #!/bin/sh
+
+   # create the dnat chain for qubeDEST if it doesn't already exist
+   if nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
+   then
+     # create the dnat rule
+     nft add rule qubes custom-dnat-qubeDEST iif == "ens6" saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter dnat 10.137.1.z
+
+     # allow forwarded traffic
+     nft add rule qubes custom-forward iif == "ens6" ip saddr 192.168.x.y/24 ip daddr 10.137.1.z tcp dport 443 ct state new,established,related counter accept
+   fi
 
 
 
@@ -569,7 +567,7 @@ routing rules:
 
 .. code:: bash
 
-      nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
+   nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
 
 
 
@@ -578,7 +576,7 @@ outside interface for the service to the destination qube
 
 .. code:: bash
 
-      nft add rule qubes custom-dnat-qubeDEST iif == "eth0" ip saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter dnat 10.137.0.xx
+   nft add rule qubes custom-dnat-qubeDEST iif == "eth0" ip saddr 192.168.x.y/24 tcp dport 443 ct state new,established,related counter dnat 10.137.0.xx
 
 
 
@@ -587,11 +585,11 @@ new connections for the service
 
 .. code:: bash
 
-      nft add rule qubes custom-forward iif == "eth0" ip saddr 192.168.x.y/24 ip daddr 10.137.0.xx tcp dport 443 ct state new,established,related counter accept
+   nft add rule qubes custom-forward iif == "eth0" ip saddr 192.168.x.y/24 ip daddr 10.137.0.xx tcp dport 443 ct state new,established,related counter accept
 
 
 
-   Note: If you do not wish to limit the IP addresses connecting to the
+.. note:: If you do not wish to limit the IP addresses connecting to the
    service, remove ``ip saddr 192.168.x.y/24`` from the rules
 
 Once you have confirmed that the counters increase, store these commands
@@ -599,9 +597,8 @@ in the script ``/rw/config/qubes-firewall-user-script``
 
 .. code:: bash
 
-      [user@sys-net user]$ sudo -i
-      [root@sys-net user]# nano /rw/config/qubes-firewall-user-script
-
+   [user@sys-net user]$ sudo -i
+   [root@sys-net user]# nano /rw/config/qubes-firewall-user-script
 
 
 Content of ``/rw/config/qubes-firewall-user-script`` in
@@ -609,17 +606,17 @@ Content of ``/rw/config/qubes-firewall-user-script`` in
 
 .. code:: bash
 
-      #!/bin/sh
-      
-      # create the dnat chain for qubeDEST if it doesn't already exist
-      if nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
-      then
-        # create the dnat rule
-        nft add rule qubes custom-dnat-qubeDEST iif == "eth0" tcp dport 443 ct state new,established,related counter dnat 10.137.0.xx
-      
-        # allow forwarded traffic
-        nft add rule qubes custom-forward iif == "eth0" ip saddr 192.168.x.y/24 ip daddr 10.137.0.xx tcp dport 443 ct state new,established,related counter accept
-      fi
+   #!/bin/sh
+
+   # create the dnat chain for qubeDEST if it doesn't already exist
+   if nft add chain qubes custom-dnat-qubeDEST '{ type nat hook prerouting priority filter +1 ; policy accept; }'
+   then
+     # create the dnat rule
+     nft add rule qubes custom-dnat-qubeDEST iif == "eth0" tcp dport 443 ct state new,established,related counter dnat 10.137.0.xx
+
+     # allow forwarded traffic
+     nft add rule qubes custom-forward iif == "eth0" ip saddr 192.168.x.y/24 ip daddr 10.137.0.xx tcp dport 443 ct state new,established,related counter accept
+   fi
 
 
 
@@ -638,7 +635,7 @@ The according rule to allow the traffic is:
 
 .. code:: bash
 
-      nft add rule qubes custom-input tcp dport 443 ip daddr 10.137.0.xx ct state new,established,related counter accept
+   nft add rule qubes custom-input tcp dport 443 ip daddr 10.137.0.xx ct state new,established,related counter accept
 
 
 
@@ -647,8 +644,8 @@ To make it persistent, you need to add this command in the script
 
 .. code:: bash
 
-      [user@qubeDEST user]$ sudo -i
-      [root@qubeDEST user]# echo 'nft add rule qubes custom-input tcp dport 443 ip daddr 10.137.0.xx ct state new,established,related counter accept' >> /rw/config/rc.local
+   [user@qubeDEST user]$ sudo -i
+   [root@qubeDEST user]# echo 'nft add rule qubes custom-input tcp dport 443 ip daddr 10.137.0.xx ct state new,established,related counter accept' >> /rw/config/rc.local
 
 
 
@@ -686,7 +683,7 @@ run this command:
 
 .. code:: bash
 
-      tcpdump -i eth0 -nn dst port 443 and src net 192.168.x.y/24
+   tcpdump -i eth0 -nn dst port 443 and src net 192.168.x.y/24
 
 
 
@@ -709,7 +706,7 @@ You can dump the ruleset in two files using the following command:
 
 .. code:: bash
 
-      nft list ruleset | tee nft_backup | tee nft_new_ruleset
+   nft list ruleset | tee nft_backup | tee nft_new_ruleset
 
 
 
@@ -720,6 +717,4 @@ You can revert to the original ruleset with the following commands:
 
 .. code:: bash
 
-      nft flush ruleset && nft -f nft_backup
-
-
+   nft flush ruleset && nft -f nft_backup
diff --git a/user/templates/templates.rst b/user/templates/templates.rst
index 07f21142..7fcc1966 100644
--- a/user/templates/templates.rst
+++ b/user/templates/templates.rst
@@ -147,11 +147,10 @@ available templates. To install a template, use:
 
 
 You can also use ``qvm-template`` to upgrade or reinstall templates.
-| Repo definitions are stored in ``/etc/qubes/repo-templates`` and
-  associated keys in ``/etc/qubes/repo-templates/keys``.
+| Repo definitions are stored in ``/etc/qubes/repo-templates`` and associated keys in ``/etc/qubes/repo-templates/keys``.
 | There are additional repos for testing releases and community
-  templates. To temporarily enable any of these repos, use the
-  ``--enablerepo=<repo-name>`` option. E.g. :
+| templates. To temporarily enable any of these repos, use the
+| ``--enablerepo=<repo-name>`` option. E.g. :
 
 
 .. code:: bash
@@ -388,22 +387,22 @@ changes in the parent template.
    :header-rows: 1
 
    * - Qube Type
-     - Inheritance1
-     - Persistence2
-   * - t emplate
+     - Inheritance [#f1]_
+     - Persistence [#f2]_
+   * - template
      - N/A (templates cannot be based on templates)
      - everything
-   * - app qube3
+   * - app qube [#f3]_
      - /etc/skel to /home; /usr/local.orig to /usr/local
      - /rw (includes /home, /usr/local, and bind-dirs)
-   * - dispo sable
+   * - disposable
      - /rw (includes /home, /usr/local, and bind-dirs)
      - nothing
    
 
-| 1Upon creation
-| 2Following shutdown
-| 3Includes :ref:`disposable templates <user/reference/glossary:disposable template>`
+.. [#f1] Upon creation
+.. [#f2] Following shutdown
+.. [#f3] Includes :ref:`disposable templates <user/reference/glossary:disposable template>`
 
 
 Trusting your templates
@@ -527,7 +526,7 @@ Important Notes
 
 - ``qvm-trim-template`` is no longer necessary or available in Qubes
   4.0 and higher. All qubes are created in a thin pool and trimming is
-  handled automatically. No user action is required. See :doc:`Disk Trim <https://forum.qubes-os.org/t/19054>` for more information.
+  handled automatically. No user action is required. See `Disk Trim <https://forum.qubes-os.org/t/19054>`__ for more information.
 
 - RPM-installed templates are “system managed” and therefore cannot be
   backed up using Qubes’ built-in backup function. In order to ensure
diff --git a/user/templates/windows/migrate-to-4-1.rst b/user/templates/windows/migrate-to-4-1.rst
index 3c5c8d3f..d5b59925 100644
--- a/user/templates/windows/migrate-to-4-1.rst
+++ b/user/templates/windows/migrate-to-4-1.rst
@@ -120,13 +120,11 @@ BOOT DEVICE, which can be repaired as described above.
 
 After successful uninstallation of the PV disk drivers, the disks will
 appear as QEMU ATA disks.
-:warning: 
+
+.. warning::
+
    **Caution:** This change may lead Windows to declare that the
-
-SYSTEM MESSAGE  for: /home/user/qubes-doc-rst2/user/templates/windows/migrate-to-4-1.rst:100: (WARNING/2) Field list ends without a blank line; unexpected unindent.
-Field list ends without a blank line; unexpected unindent.
-
-hardware has changed and that in consequence, the activation is no
-longer valid, possibly complaining that the use of the software is no
-longer lawful. It should be possible to reactivate the software if a
-valid product key is provided.
+   hardware has changed and that in consequence, the activation is no
+   longer valid, possibly complaining that the use of the software is no
+   longer lawful. It should be possible to reactivate the software if a
+   valid product key is provided.
diff --git a/user/templates/windows/qubes-windows-tools-4-0.rst b/user/templates/windows/qubes-windows-tools-4-0.rst
index 82150d79..fe929a9b 100644
--- a/user/templates/windows/qubes-windows-tools-4-0.rst
+++ b/user/templates/windows/qubes-windows-tools-4-0.rst
@@ -697,7 +697,7 @@ automatically, try to start Windows in safe mode (see above) and 1)
 disable automatic restart on BSOD (Control Panel - System - Advanced
 system settings - Advanced - Startup and recovery), 2) check the system
 event log for BSOD events. If you can, send the ``memory.dmp`` dump file
-from ``c:\Windows``. Xen logs (/var/log/xen/console/guest-*) are also
+from ``c:\Windows``. Xen logs (``/var/log/xen/console/guest-*``) are also
 useful as they contain pvdrivers diagnostic output.
 
 If a specific component is malfunctioning, you can increase its log
@@ -710,44 +710,32 @@ Below is a list of components:
       :header-rows: 1
 
       * - qrexec-agent
-        - Responsible for most communication with Qubes (dom0
-      * - and other domains), secure clipboard, file copying, qrexec services.
+        - Responsible for most communication with Qubes (dom0 and other domains), secure clipboard, file copying, qrexec services.
       * - qrexec-wrapper
-        - Helper executable that’s responsible for launching
-      * - qrexec services, handling their I/O and vchan communication.
+        - Helper executable that’s responsible for launching qrexec services, handling their I/O and vchan communication.
       * - qrexec-client-vm
         - Used for communications by the qrexec protocol.
       * - qga
         - Gui agent.
-        -  
-        - QgaWatchdog
-        - Service that monitors session/desktop
-      * - changes (logon/logoff/locking/UAC…) and simulates SAS sequence
-      * - (ctrl-alt-del).
-        -  
-        - qubesdb-daemon
-        - Service for accessing Qubes
-      * - configuration database.
-        -  
-        - network-setup
-        - Service that sets up network
-      * - parameters according to VM’s configuration.
-        -  
-        - prepare-volume
-        - Utility
-      * - that initializes and formats the disk backed by private.img file.
-      * - It’s registered to run on next system boot during QWT setup, if that
-      * - feature is selected (it can’t run during the setup because Xen block
-      * - device drivers are not yet active). It in turn registers move-profiles
-      * - (see below) to run at early boot.
-        -  
-        - relocate-dir
+      * - QgaWatchdog
+        - Service that monitors session/desktop changes (logon/logoff/locking/UAC…) and simulates SAS sequence (ctrl-alt-del).
+      * - qubesdb-daemon
+        - Service for accessing Qubes configuration database.
+      * - network-setup
+        - Service that sets up network parameters according to VM’s configuration.
+      * - prepare-volume
+        - Utility that initializes and formats the disk backed by private.img file.
+          It’s registered to run on next system boot during QWT setup, if that
+          feature is selected (it can’t run during the setup because Xen block
+          device drivers are not yet active). It in turn registers move-profiles
+          (see below) to run at early boot.
+      * - relocate-dir
         - Utility that moves
-      * - user profiles directory to the private disk. It’s registered as an early
-      * - boot native executable (similar to chkdsk) so it can run before any
-      * - profile files are opened by some other process. Its log is in a fixed
-      * - location: c:\move-profiles.log (it can’t use our common logger
-      * - library so none of the log settings apply).
+          user profiles directory to the private disk. It’s registered as an early
+          boot native executable (similar to chkdsk) so it can run before any
+          profile files are opened by some other process. Its log is in a fixed
+          location: c:\move-profiles.log (it can’t use our common logger
+          library so none of the log settings apply).
       
 
 Updates