docs: prod FernDesk IA refactor (no public staging)

changelog.mdx

@@ -14,7 +14,7 @@ Dated notes on what the products ship. Each entry names a change the app or the
 <Update label="8 September 2026" description="Cortex CLI 0.1.10 · /goal on main">
 - **`/goal`** — persisted long-horizon objectives with `goal.json` on the session, an 8-turn budget, evidence-based completion, and a composer chip — merged to the CLI main branch in [CortexLM/cli #54](https://github.com/CortexLM/cli/pull/54). It ships with the next tagged release; `cortex upgrade` will pick it up. See [Goals](/cli/goal).
 - **One approval path** — the permission prompt is the locked inline numbered picker (run once · always allow in this project · edit command · decline), merged in [#53](https://github.com/CortexLM/cli/pull/53). See [Modes and permissions](/cli/modes-and-permissions).
-- The Designer runtime pack — headless renders of every TUI state at 120×40 — is what the [CLI pages](/cli) now show. The README demo on a green macOS desktop is regenerated from the same chrome.
+- The CLI runtime pack — headless renders of every TUI state at 120×40 — is what the [CLI pages](/cli) now show. The README demo on a green macOS desktop is regenerated from the same chrome.
 - Release: [v0.1.10 on GitHub](https://github.com/CortexLM/cli/releases/tag/v0.1.10). Update with `cortex upgrade`.
 </Update>
 

cli/index.mdx

@@ -58,24 +58,6 @@ cortex
   <Card title="Quickstart" icon="rocket" href="/cli/quickstart">
     First session, `AGENTS.md`, choosing autonomy.
   </Card>
-  <Card title="The TUI" icon="terminal" href="/cli/tui">
-    Timeline rows, the composer, status line, queueing follow-ups, interrupting.
-  </Card>
-  <Card title="Slash commands" icon="slash" href="/cli/slash-commands">
-    Everything after `/` — model, mode, permissions, plan, goal, sessions, MCP, diagnostics.
-  </Card>
-  <Card title="Modes and permissions" icon="shield-check" href="/cli/modes-and-permissions">
-    Agent / Plan / Ask, Spec, approvals, sandbox, the `permission` table, effort.
-  </Card>
-  <Card title="Goals" icon="target" href="/cli/goal">
-    `/goal` — a persisted long-horizon objective that survives compaction and resume.
-  </Card>
-  <Card title="Sessions" icon="history" href="/cli/sessions">
-    Resume, rewind, fork, export, import, share, lock, clean up.
-  </Card>
-  <Card title="Keyboard shortcuts" icon="keyboard" href="/cli/keyboard">
-    Every binding, grouped by where it applies — plus the Ctrl+X overlay.
-  </Card>
   <Card title="Headless runs" icon="workflow" href="/cli/headless">
     `cortex exec` and `cortex run` in scripts, GitHub Actions, GitLab CI.
   </Card>
@@ -85,11 +67,22 @@ cortex
   <Card title="Extend" icon="puzzle" href="/cli/extend">
     MCP servers, skills, agents and subagents, hooks, plugins, themes.
   </Card>
-  <Card title="Troubleshooting" icon="life-buoy" href="/cli/troubleshooting">
-    Outage copy, hosts that refuse, the agent that will not edit, MCP, quotas.
-  </Card>
 </CardGroup>
 
+## In the terminal
+
+The rest of the CLI reference lives in the sidebar under this tab:
+
+| Page | What it covers |
+| --- | --- |
+| [The TUI](/cli/tui) | Timeline rows, the composer, status line, queueing follow-ups, interrupting |
+| [Slash commands](/cli/slash-commands) | Everything after `/` — model, mode, permissions, plan, goal, sessions, MCP, diagnostics |
+| [Modes and permissions](/cli/modes-and-permissions) | Agent / Plan / Ask, Spec, approvals, sandbox, the `permission` table, effort |
+| [Goals](/cli/goal) | `/goal` — a persisted long-horizon objective that survives compaction and resume |
+| [Sessions](/cli/sessions) | Resume, rewind, fork, export, import, share, lock, clean up |
+| [Keyboard shortcuts](/cli/keyboard) | Every binding, grouped by where it applies — plus the Ctrl+X overlay |
+| [CLI troubleshooting](/cli/troubleshooting) | Outage copy, hosts that refuse, the agent that will not edit, MCP, quotas |
+
 ## Conventions on these pages
 
 - Commands are written `cortex …`. The installed binary is `Cortex`; the installer adds `cortex` and `agent` symlinks, and both spellings work on case-insensitive filesystems.

getting-started/quickstart.mdx

@@ -39,15 +39,6 @@ Cortex is one account across four products: **Chat**, **Code**, **Bot**, and **D
   <Step title="Sign in when you want more">
     Choose **Sign in to save your work** in the sidebar footer. A signed-in account keeps chats, projects, Library files, plans, and Bot routines across devices, and unlocks Code and Bot. See [Accounts](/getting-started/accounts).
   </Step>
-  <Step title="Pick your next surface">
-    | Surface | First useful thing | Guide |
-    | --- | --- | --- |
-    | **Chat** | Create a project with standing instructions | [Chat quickstart](/chat/quickstart) |
-    | **Code** | Connect GitHub and start a Cloud session on a repository | [Code quickstart](/code/quickstart) |
-    | **Bot** | Create a bot and open its computer | [Bot quickstart](/bot/quickstart) |
-    | **CLI** | Install, sign in, run `cortex` in a project | [CLI quickstart](/cli/quickstart) |
-    | **Design** | Host a canvas from Chat or Code, then open it on desktop | [Design](/design) |
-  </Step>
 </Steps>
 
 ## Install the desktop app or the CLI

getting-started/settings.mdx

@@ -59,17 +59,18 @@ Model availability depends on your plan. During peak hours new chats may fall ba
 
 ## Data & privacy
 
-| Control | Default | Notes |
+Where each control lives. What each one stores, and what it means, is on
+[Security and privacy](/security/overview).
+
+| Control | Where | Notes |
 | --- | --- | --- |
-| **Save chat history** | On | Conversations are kept in your account so you can pick them up on any device. *Coming soon* as a toggle. |
-| **Improve the model** | Off | When on, a sample of your conversations may be reviewed to train future models. Your chats are never used without this setting. *Coming soon.* |
-| **Necessary cookies** | Always on | Session, language, and this preference. Cortex cannot work without them. |
-| **Optional analytics** | Off | Stays off until you allow it. Nothing in the current build loads an optional tracker. |
-| **Memory** | — | Review or delete individual memories. See [Memory](/chat/memory). |
-| **Two-factor authentication** | — | A signed-in account uses an authenticator app to confirm export and deletion. |
-| **Your data** | — | **Export my data** and **Delete all data**. Deletion takes effect within 30 days. |
-
-See [Security](/security/overview) for what Cortex stores and where code runs.
+| **Save chat history** | Data & privacy | On by default. *Coming soon* as a toggle. |
+| **Improve the model** | Data & privacy | Off by default. Your chats are never used without this setting. *Coming soon.* |
+| **Necessary cookies** | Data & privacy | Session, language, and this preference. Cortex cannot work without them. |
+| **Optional analytics** | Data & privacy | Stays off until you allow it. Nothing in the current build loads an optional tracker. |
+| **Memory** | Data & privacy | Review or delete individual memories. See [Memory](/chat/memory). |
+| **Two-factor authentication** | Data & privacy | An authenticator app confirms export and deletion. |
+| **Export my data / Delete all data** | Data & privacy | Deletion takes effect within 30 days. |
 
 ## Plan & billing
 

images/cli/README.md

@@ -9,7 +9,7 @@ exactly one page; no two files share a sha256.
 `docs/media/intro.gif` — the README demo: the signed lock TUI composited onto a
 photographed macOS desktop. Generated, not a live recording. Used on `cli/index`.
 
-## `runtime/` — Designer cli pack
+## `runtime/` — CLI runtime pack
 
 Headless `MockTerminal` renders of the live session chrome, vendored byte-for-byte
 from CortexLM/cli tip `4d41ef362481ec816ac395e0e64fe6a54327de14`

scripts/check-docs-site.mjs

@@ -201,6 +201,35 @@ function assertNavPagesExist(parsed) {
   }
 }
 
+/**
+ * An MDX page no navigation entry reaches is dead weight: it still gets
+ * indexed, and still shows up in search — but no reader can navigate to it.
+ * This is how the old tree accumulated a second hub for every product
+ * (`chat/overview` beside `chat/index`) and pages whose only inbound links
+ * were from other orphans.
+ *
+ * The home page is reachable from the navbar's `/` link, which `pushNavSlug`
+ * drops as a non-slug, so it is exempted by name.
+ */
+function assertNoOrphanPages(docsJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(docsJson);
+  } catch {
+    return; // already reported as invalid JSON
+  }
+  const nav = new Set(navPages(parsed));
+  for (const file of walk(ROOT)) {
+    if (!file.endsWith('.mdx')) continue;
+    const slug = relative(ROOT, file).replace(/\.mdx$/, '');
+    if (slug === 'index') continue;
+    if (nav.has(slug) || nav.has(slug.replace(/\/index$/, ''))) continue;
+    fail(
+      `${slug}.mdx is not reachable from docs.json navigation (orphaned page)`,
+    );
+  }
+}
+
 const AUTH_INTERNALS = [
   { pattern: /\/auth\//, label: '/auth/' },
   { pattern: /\/oauth\//, label: '/oauth/' },
@@ -210,6 +239,46 @@ const AUTH_INTERNALS = [
   { pattern: /client_secret/i, label: 'client secret' },
 ];
 
+/**
+ * Staging must never reach the public site again.
+ *
+ * `docs.cortex.foundation` is the public Mintlify site, and it once publicly
+ * served `/staging/*` pages plus a Staging collection. Deleting those files is
+ * not enough: a re-added `staging/…` page, a nav entry, or a redirect into one
+ * would put pre-prod copy back on the public domain. This holds the line
+ * mechanically, the same way the auth-internal check does.
+ */
+function assertNoStagingNav(docsJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(docsJson);
+  } catch {
+    return; // already reported as invalid JSON
+  }
+  const seen = new Set();
+  for (const slug of navPages(parsed)) {
+    if (!/(^|\/)staging(\/|$)/i.test(slug) || seen.has(slug)) continue;
+    seen.add(slug);
+    fail(`docs.json navigation must not publish a staging page (${slug})`);
+  }
+  const redirectSources = Array.isArray(parsed.redirects) ? parsed.redirects : [];
+  for (const rule of redirectSources) {
+    if (typeof rule?.destination === 'string' && /(^|\/)staging(\/|$)/i.test(rule.destination)) {
+      fail(`docs.json redirect ${rule.source} points at a staging page`);
+    }
+  }
+}
+
+function assertNoStagingContent(rel, text) {
+  if (!rel.endsWith('.mdx')) return;
+  if (/\/staging(\/|$)/.test(text)) {
+    fail(`${rel} links to a staging path (public docs have no staging mirror)`);
+  }
+  if (/\bstaging\b/i.test(text) && !/no staging|not staging|retired/i.test(text)) {
+    fail(`${rel} tells readers about staging (public docs are production only)`);
+  }
+}
+
 function assertNoAuthInternals(rel, text) {
   if (!rel.endsWith('.mdx')) return;
   for (const { pattern, label } of AUTH_INTERNALS) {
@@ -310,6 +379,37 @@ for (const extra of pageCodes) {
   }
 }
 
+/**
+ * The catalog table in `problems/index.mdx` is hand-maintained while the pages
+ * beside it are generated in lockstep with the backend. That is the same decay
+ * this file exists to catch: a new code lands as a page, the catalog keeps
+ * listing the old set, and the index — the page a reader actually lands on —
+ * silently stops being complete.
+ */
+function assertCatalogCoversPages() {
+  const rel = 'problems/index.mdx';
+  if (!existsSync(join(ROOT, rel))) {
+    fail(`${rel} is missing (problem catalog index)`);
+    return;
+  }
+  const catalog = read(rel);
+  const listed = new Set(
+    [...catalog.matchAll(/\]\(\/problems\/([a-z_]+)\)/g)].map((m) => m[1]),
+  );
+  for (const code of pageCodes) {
+    if (!listed.has(code)) {
+      fail(`${rel} does not link \`${code}\`; every problem page belongs in the catalog`);
+    }
+  }
+  for (const code of listed) {
+    if (!pageCodes.has(code)) {
+      fail(`${rel} links \`${code}\`, which has no page at problems/${code}.mdx`);
+    }
+  }
+}
+
+assertCatalogCoversPages();
+
 if (!existsSync(join(docsRoot, 'docs.json'))) {
   fail('docs.json is missing (Mintlify site config)');
 } else {
@@ -321,6 +421,8 @@ if (!existsSync(join(docsRoot, 'docs.json'))) {
     fail('docs.json still names docs.cortex.sh');
   }
   assertDocsChrome(docsJson);
+  assertNoStagingNav(docsJson);
+  assertNoOrphanPages(docsJson);
 }
 
 for (const rel of FORBIDDEN_AUTH_PAGES) {
@@ -363,6 +465,7 @@ for (const file of docsFiles) {
     );
   }
   assertNoAuthInternals(rel, text);
+  assertNoStagingContent(rel, text);
   if (BACKEND === null) continue;
   for (const path of documentedV1Paths(text)) {
     const norm = normalizePath(path);