pllan 2026.3.47 → 2026.3.49

package/docs/nb/logging.md

@@ -69,7 +69,7 @@ pllan doctor
 ### Control UI (web)
 
 The Control UI’s **Logs** tab tails the same file using `logs.tail`.
-See [/web/control-ui](/web/control-ui) for how to open it.
+See [/web/control-ui](/nb/web/control-ui) for how to open it.
 
 ### Channel-only logs
 
@@ -219,7 +219,7 @@ Notes:
 
 - Flag logs go to the standard log file (same as `logging.file`).
 - Output is still redacted according to `logging.redactSensitive`.
-- Full guide: [/diagnostics/flags](/diagnostics/flags).
+- Full guide: [/diagnostics/flags](/nb/diagnostics/flags).
 
 ### Export to OpenTelemetry
 

package/docs/nb/network.md

@@ -14,17 +14,17 @@ devices across localhost, LAN, and tailnet.
 
 ## Core model
 
-- [Gateway architecture](/concepts/architecture)
-- [Gateway protocol](/gateway/protocol)
-- [Gateway runbook](/gateway)
-- [Web surfaces + bind modes](/web)
+- [Gateway architecture](/nb/concepts/architecture)
+- [Gateway protocol](/nb/gateway/protocol)
+- [Gateway runbook](/nb/gateway)
+- [Web surfaces + bind modes](/nb/web)
 
 ## Pairing + identity
 
-- [Pairing overview (DM + nodes)](/channels/pairing)
-- [Gateway-owned node pairing](/gateway/pairing)
-- [Devices CLI (pairing + token rotation)](/cli/devices)
-- [Pairing CLI (DM approvals)](/cli/pairing)
+- [Pairing overview (DM + nodes)](/nb/channels/pairing)
+- [Gateway-owned node pairing](/nb/gateway/pairing)
+- [Devices CLI (pairing + token rotation)](/nb/cli/devices)
+- [Pairing CLI (DM approvals)](/nb/cli/pairing)
 
 Local trust:
 
@@ -34,21 +34,21 @@ Local trust:
 
 ## Discovery + transports
 
-- [Discovery & transports](/gateway/discovery)
-- [Bonjour / mDNS](/gateway/bonjour)
-- [Remote access (SSH)](/gateway/remote)
-- [Tailscale](/gateway/tailscale)
+- [Discovery & transports](/nb/gateway/discovery)
+- [Bonjour / mDNS](/nb/gateway/bonjour)
+- [Remote access (SSH)](/nb/gateway/remote)
+- [Tailscale](/nb/gateway/tailscale)
 
 ## Nodes + transports
 
-- [Nodes overview](/nodes)
-- [Bridge protocol (legacy nodes)](/gateway/bridge-protocol)
-- [Node runbook: iOS](/platforms/ios)
-- [Node runbook: Android](/platforms/android)
+- [Nodes overview](/nb/nodes)
+- [Bridge protocol (legacy nodes)](/nb/gateway/bridge-protocol)
+- [Node runbook: iOS](/nb/platforms/ios)
+- [Node runbook: Android](/nb/platforms/android)
 
 ## Security
 
-- [Security overview](/gateway/security)
-- [Gateway config reference](/gateway/configuration)
-- [Troubleshooting](/gateway/troubleshooting)
-- [Doctor](/gateway/doctor)
+- [Security overview](/nb/gateway/security)
+- [Gateway config reference](/nb/gateway/configuration)
+- [Troubleshooting](/nb/gateway/troubleshooting)
+- [Doctor](/nb/gateway/doctor)

package/docs/nb/nodes/audio.md

@@ -130,8 +130,8 @@ Note: Binary detection is best-effort across macOS/Linux/Windows; ensure the CLI
 
 - Provider auth follows the standard model auth order (auth profiles, env vars, `models.providers.*.apiKey`).
 - Deepgram picks up `DEEPGRAM_API_KEY` when `provider: "deepgram"` is used.
-- Deepgram setup details: [Deepgram (audio transcription)](/providers/deepgram).
-- Mistral setup details: [Mistral](/providers/mistral).
+- Deepgram setup details: [Deepgram (audio transcription)](/nb/providers/deepgram).
+- Mistral setup details: [Mistral](/nb/providers/mistral).
 - Audio providers can override `baseUrl`, `headers`, and `providerOptions` via `tools.media.audio`.
 - Default size cap is 20MB (`tools.media.audio.maxBytes`). Oversize audio is skipped for that model and the next entry is tried.
 - Tiny/empty audio files below 1024 bytes are skipped before provider/CLI transcription.

package/docs/nb/nodes/index.md

@@ -9,9 +9,9 @@ title: "Nodes"
 
 # Nodes
 
-A **node** is a companion device (macOS/iOS/Android/headless) that connects to the Gateway **WebSocket** (same port as operators) with `role: "node"` and exposes a command surface (e.g. `canvas.*`, `camera.*`, `device.*`, `notifications.*`, `system.*`) via `node.invoke`. Protocol details: [Gateway protocol](/gateway/protocol).
+A **node** is a companion device (macOS/iOS/Android/headless) that connects to the Gateway **WebSocket** (same port as operators) with `role: "node"` and exposes a command surface (e.g. `canvas.*`, `camera.*`, `device.*`, `notifications.*`, `system.*`) via `node.invoke`. Protocol details: [Gateway protocol](/nb/gateway/protocol).
 
-Legacy transport: [Bridge protocol](/gateway/bridge-protocol) (TCP JSONL; deprecated/removed for current nodes).
+Legacy transport: [Bridge protocol](/nb/gateway/bridge-protocol) (TCP JSONL; deprecated/removed for current nodes).
 
 macOS can also run in **node mode**: the menubar app connects to the Gateway’s WS server and exposes its local canvas/camera commands as a node (so `pllan nodes …` works against this Mac).
 
@@ -19,7 +19,7 @@ Notes:
 
 - Nodes are **peripherals**, not gateways. They don’t run the gateway service.
 - Telegram/WhatsApp/etc. messages land on the **gateway**, not on nodes.
-- Troubleshooting runbook: [/nodes/troubleshooting](/nodes/troubleshooting)
+- Troubleshooting runbook: [/nodes/troubleshooting](/nb/nodes/troubleshooting)
 
 ## Pairing + status
 
@@ -159,9 +159,9 @@ node allowlist/approvals).
 
 Related:
 
-- [Node host CLI](/cli/node)
-- [Exec tool](/tools/exec)
-- [Exec approvals](/tools/exec-approvals)
+- [Node host CLI](/nb/cli/node)
+- [Exec tool](/nb/tools/exec)
+- [Exec approvals](/nb/tools/exec-approvals)
 
 ## Invoking commands
 
@@ -381,7 +381,7 @@ Notes:
 - Pairing is still required (the Gateway will show a device pairing prompt).
 - The node host stores its node id, token, display name, and gateway connection info in `~/.pllan/node.json`.
 - Exec approvals are enforced locally via `~/.pllan/exec-approvals.json`
-  (see [Exec approvals](/tools/exec-approvals)).
+  (see [Exec approvals](/nb/tools/exec-approvals)).
 - On macOS, the headless node host executes `system.run` locally by default. Set
   `PLLAN_NODE_EXEC_HOST=app` to route `system.run` through the companion app exec host; add
   `PLLAN_NODE_EXEC_FALLBACK=0` to require the app host and fail closed if it is unavailable.

package/docs/nb/nodes/media-understanding.md

@@ -390,5 +390,5 @@ This shows per‑capability outcomes and the chosen provider/model when applicab
 
 ## Related docs
 
-- [Configuration](/gateway/configuration)
-- [Image & Media Support](/nodes/images)
+- [Configuration](/nb/gateway/configuration)
+- [Image & Media Support](/nb/nodes/images)

package/docs/nb/nodes/troubleshooting.md

@@ -107,8 +107,8 @@ If still stuck:
 
 Related:
 
-- [/nodes/index](/nodes/index)
-- [/nodes/camera](/nodes/camera)
-- [/nodes/location-command](/nodes/location-command)
-- [/tools/exec-approvals](/tools/exec-approvals)
-- [/gateway/pairing](/gateway/pairing)
+- [/nodes/index](/nb/nodes/index)
+- [/nodes/camera](/nb/nodes/camera)
+- [/nodes/location-command](/nb/nodes/location-command)
+- [/tools/exec-approvals](/nb/tools/exec-approvals)
+- [/gateway/pairing](/nb/gateway/pairing)

package/docs/nb/perplexity.md

@@ -91,7 +91,7 @@ That field also accepts SecretRef objects.
 
 **Via environment:** set `PERPLEXITY_API_KEY` or `OPENROUTER_API_KEY`
 in the Gateway process environment. For a gateway install, put it in
-`~/.pllan/.env` (or your service environment). See [Env vars](/help/faq#how-does-pllan-load-environment-variables).
+`~/.pllan/.env` (or your service environment). See [Env vars](/nb/help/faq#how-does-pllan-load-environment-variables).
 
 If `provider: "perplexity"` is configured and the Perplexity key SecretRef is unresolved with no env fallback, startup/reload fails fast.
 
@@ -170,5 +170,5 @@ await web_search({
 - OpenRouter or explicit `plugins.entries.perplexity.config.webSearch.baseUrl` / `model` switches Perplexity back to Sonar chat completions for compatibility
 - Results are cached for 15 minutes by default (configurable via `cacheTtlMinutes`)
 
-See [Web tools](/tools/web) for the full web_search configuration.
+See [Web tools](/nb/tools/web) for the full web_search configuration.
 See [Perplexity Search API docs](https://docs.perplexity.ai/docs/search/quickstart) for more details.

package/docs/nb/pi-dev.md

@@ -76,5 +76,5 @@ If you only want to reset sessions, delete `agents/<agentId>/sessions/` and `age
 
 ## References
 
-- [Testing](/help/testing)
-- [Getting Started](/start/getting-started)
+- [Testing](/nb/help/testing)
+- [Getting Started](/nb/start/getting-started)

package/docs/nb/pi.md

@@ -564,4 +564,4 @@ Live/opt-in:
 
 - `src/agents/pi-embedded-runner-extraparams.live.test.ts` (enable `PLLAN_LIVE_TEST=1`)
 
-For current run commands, see [Pi Development Workflow](/pi-dev).
+For current run commands, see [Pi Development Workflow](/nb/pi-dev).

package/docs/nb/platforms/android.md

@@ -15,13 +15,13 @@ title: "Android App"
 
 - Role: companion node app (Android does not host the Gateway).
 - Gateway required: yes (run it on macOS, Linux, or Windows via WSL2).
-- Install: [Getting Started](/start/getting-started) + [Pairing](/channels/pairing).
-- Gateway: [Runbook](/gateway) + [Configuration](/gateway/configuration).
-  - Protocols: [Gateway protocol](/gateway/protocol) (nodes + control plane).
+- Install: [Getting Started](/nb/start/getting-started) + [Pairing](/nb/channels/pairing).
+- Gateway: [Runbook](/nb/gateway) + [Configuration](/nb/gateway/configuration).
+  - Protocols: [Gateway protocol](/nb/gateway/protocol) (nodes + control plane).
 
 ## System control
 
-System control (launchd/systemd) lives on the Gateway host. See [Gateway](/gateway).
+System control (launchd/systemd) lives on the Gateway host. See [Gateway](/nb/gateway).
 
 ## Connection Runbook
 
@@ -61,7 +61,7 @@ From the gateway machine:
 dns-sd -B _pllan-gw._tcp local.
 ```
 
-More debugging notes: [Bonjour](/gateway/bonjour).
+More debugging notes: [Bonjour](/nb/gateway/bonjour).
 
 #### Tailnet (Vienna ⇄ London) discovery via unicast DNS-SD
 
@@ -70,7 +70,7 @@ Android NSD/mDNS discovery won’t cross networks. If your Android node and the
 1. Set up a DNS-SD zone (example `pllan.internal.`) on the gateway host and publish `_pllan-gw._tcp` records.
 2. Configure Tailscale split DNS for your chosen domain pointing at that DNS server.
 
-Details and example CoreDNS config: [Bonjour](/gateway/bonjour).
+Details and example CoreDNS config: [Bonjour](/nb/gateway/bonjour).
 
 ### 3) Connect from Android
 
@@ -96,7 +96,7 @@ pllan devices approve <requestId>
 pllan devices reject <requestId>
 ```
 
-Pairing details: [Pairing](/channels/pairing).
+Pairing details: [Pairing](/nb/channels/pairing).
 
 ### 5) Verify the node is connected
 
@@ -151,7 +151,7 @@ Camera commands (foreground only; permission-gated):
 - `camera.snap` (jpg)
 - `camera.clip` (mp4)
 
-See [Camera node](/nodes/camera) for parameters and CLI helpers.
+See [Camera node](/nb/nodes/camera) for parameters and CLI helpers.
 
 ### 8) Voice + expanded Android command surface
 

package/docs/nb/platforms/digitalocean.md

@@ -12,7 +12,7 @@ title: "DigitalOcean"
 
 Run a persistent Pllan Gateway on DigitalOcean for **$6/month** (or $4/mo with reserved pricing).
 
-If you want a $0/month option and don’t mind ARM + provider-specific setup, see the [Oracle Cloud guide](/platforms/oracle).
+If you want a $0/month option and don’t mind ARM + provider-specific setup, see the [Oracle Cloud guide](/nb/platforms/oracle).
 
 ## Cost Comparison (2026)
 
@@ -27,8 +27,8 @@ If you want a $0/month option and don’t mind ARM + provider-specific setup, se
 **Picking a provider:**
 
 - DigitalOcean: simplest UX + predictable setup (this guide)
-- Hetzner: good price/perf (see [Hetzner guide](/install/hetzner))
-- Oracle Cloud: can be $0/month, but is more finicky and ARM-only (see [Oracle guide](/platforms/oracle))
+- Hetzner: good price/perf (see [Hetzner guide](/nb/install/hetzner))
+- Oracle Cloud: can be $0/month, but is more finicky and ARM-only (see [Oracle guide](/nb/platforms/oracle))
 
 ---
 
@@ -160,7 +160,7 @@ pllan channels login whatsapp
 # Scan QR code
 ```
 
-See [Channels](/channels) for other providers.
+See [Channels](/nb/channels) for other providers.
 
 ---
 
@@ -225,7 +225,7 @@ Oracle Cloud offers **Always Free** ARM instances that are significantly more po
 - Signup can be finicky (retry if it fails)
 - ARM architecture — most things work, but some binaries need ARM builds
 
-For the full setup guide, see [Oracle Cloud](/platforms/oracle). For signup tips and troubleshooting the enrollment process, see this [community guide](https://gist.github.com/rssnyder/51e3cfedd730e7dd5f4a816143b25dbd).
+For the full setup guide, see [Oracle Cloud](/nb/platforms/oracle). For signup tips and troubleshooting the enrollment process, see this [community guide](https://gist.github.com/rssnyder/51e3cfedd730e7dd5f4a816143b25dbd).
 
 ---
 
@@ -260,7 +260,7 @@ free -h
 
 ## See Also
 
-- [Hetzner guide](/install/hetzner) — cheaper, more powerful
-- [Docker install](/install/docker) — containerized setup
-- [Tailscale](/gateway/tailscale) — secure remote access
-- [Configuration](/gateway/configuration) — full config reference
+- [Hetzner guide](/nb/install/hetzner) — cheaper, more powerful
+- [Docker install](/nb/install/docker) — containerized setup
+- [Tailscale](/nb/gateway/tailscale) — secure remote access
+- [Configuration](/nb/gateway/configuration) — full config reference

package/docs/nb/platforms/index.md

@@ -17,26 +17,26 @@ Native companion apps for Windows are also planned; the Gateway is recommended v
 
 ## Choose your OS
 
-- macOS: [macOS](/platforms/macos)
-- iOS: [iOS](/platforms/ios)
-- Android: [Android](/platforms/android)
-- Windows: [Windows](/platforms/windows)
-- Linux: [Linux](/platforms/linux)
+- macOS: [macOS](/nb/platforms/macos)
+- iOS: [iOS](/nb/platforms/ios)
+- Android: [Android](/nb/platforms/android)
+- Windows: [Windows](/nb/platforms/windows)
+- Linux: [Linux](/nb/platforms/linux)
 
 ## VPS & hosting
 
-- VPS hub: [VPS hosting](/vps)
-- Fly.io: [Fly.io](/install/fly)
-- Hetzner (Docker): [Hetzner](/install/hetzner)
-- GCP (Compute Engine): [GCP](/install/gcp)
-- Azure (Linux VM): [Azure](/install/azure)
-- exe.dev (VM + HTTPS proxy): [exe.dev](/install/exe-dev)
+- VPS hub: [VPS hosting](/nb/vps)
+- Fly.io: [Fly.io](/nb/install/fly)
+- Hetzner (Docker): [Hetzner](/nb/install/hetzner)
+- GCP (Compute Engine): [GCP](/nb/install/gcp)
+- Azure (Linux VM): [Azure](/nb/install/azure)
+- exe.dev (VM + HTTPS proxy): [exe.dev](/nb/install/exe-dev)
 
 ## Common links
 
-- Install guide: [Getting Started](/start/getting-started)
-- Gateway runbook: [Gateway](/gateway)
-- Gateway configuration: [Configuration](/gateway/configuration)
+- Install guide: [Getting Started](/nb/start/getting-started)
+- Gateway runbook: [Gateway](/nb/gateway)
+- Gateway configuration: [Configuration](/nb/gateway/configuration)
 - Service status: `pllan gateway status`
 
 ## Gateway service install (CLI)

package/docs/nb/platforms/ios.md

@@ -170,7 +170,7 @@ The Gateway advertises `_pllan-gw._tcp` on `local.`. The iOS app lists these aut
 ### Tailnet (cross-network)
 
 If mDNS is blocked, use a unicast DNS-SD zone (choose a domain; example: `pllan.internal.`) and Tailscale split DNS.
-See [Bonjour](/gateway/bonjour) for the CoreDNS example.
+See [Bonjour](/nb/gateway/bonjour) for the CoreDNS example.
 
 ### Manual host/port
 
@@ -209,12 +209,12 @@ pllan nodes invoke --node "iOS Node" --command canvas.snapshot --params '{"maxWi
 ## Common errors
 
 - `NODE_BACKGROUND_UNAVAILABLE`: bring the iOS app to the foreground (canvas/camera/screen commands require it).
-- `A2UI_HOST_NOT_CONFIGURED`: the Gateway did not advertise a canvas host URL; check `canvasHost` in [Gateway configuration](/gateway/configuration).
+- `A2UI_HOST_NOT_CONFIGURED`: the Gateway did not advertise a canvas host URL; check `canvasHost` in [Gateway configuration](/nb/gateway/configuration).
 - Pairing prompt never appears: run `pllan devices list` and approve manually.
 - Reconnect fails after reinstall: the Keychain pairing token was cleared; re-pair the node.
 
 ## Related docs
 
-- [Pairing](/channels/pairing)
-- [Discovery](/gateway/discovery)
-- [Bonjour](/gateway/bonjour)
+- [Pairing](/nb/channels/pairing)
+- [Discovery](/nb/gateway/discovery)
+- [Bonjour](/nb/gateway/bonjour)

package/docs/nb/platforms/linux.md

@@ -21,18 +21,18 @@ Native Linux companion apps are planned. Contributions are welcome if you want t
 4. From your laptop: `ssh -N -L 18789:127.0.0.1:18789 <user>@<host>`
 5. Open `http://127.0.0.1:18789/` and paste your token
 
-Full Linux server guide: [Linux Server](/vps). Step-by-step VPS example: [exe.dev](/install/exe-dev)
+Full Linux server guide: [Linux Server](/nb/vps). Step-by-step VPS example: [exe.dev](/nb/install/exe-dev)
 
 ## Install
 
-- [Getting Started](/start/getting-started)
-- [Install & updates](/install/updating)
-- Optional flows: [Bun (experimental)](/install/bun), [Nix](/install/nix), [Docker](/install/docker)
+- [Getting Started](/nb/start/getting-started)
+- [Install & updates](/nb/install/updating)
+- Optional flows: [Bun (experimental)](/nb/install/bun), [Nix](/nb/install/nix), [Docker](/nb/install/docker)
 
 ## Gateway
 
-- [Gateway runbook](/gateway)
-- [Configuration](/gateway/configuration)
+- [Gateway runbook](/nb/gateway)
+- [Configuration](/nb/gateway/configuration)
 
 ## Gateway service install (CLI)
 
@@ -66,7 +66,7 @@ pllan doctor
 
 Pllan installs a systemd **user** service by default. Use a **system**
 service for shared or always-on servers. The full unit example and guidance
-live in the [Gateway runbook](/gateway).
+live in the [Gateway runbook](/nb/gateway).
 
 Minimal setup:
 

package/docs/nb/platforms/mac/health.md

@@ -31,4 +31,4 @@ How to see whether the linked channel is healthy from the menu bar app.
 
 ## When in doubt
 
-- You can still use the CLI flow in [Gateway health](/gateway/health) (`pllan status`, `pllan status --deep`, `pllan health --json`) and tail `/tmp/pllan/pllan-*.log` for `web-heartbeat` / `web-reconnect`.
+- You can still use the CLI flow in [Gateway health](/nb/gateway/health) (`pllan status`, `pllan status --deep`, `pllan health --json`) and tail `/tmp/pllan/pllan-*.log` for `web-heartbeat` / `web-reconnect`.

package/docs/nb/platforms/mac/remote.md

@@ -58,7 +58,7 @@ Remote mode supports two transports:
 - Prefer loopback binds on the remote host and connect via SSH or Tailscale.
 - SSH tunneling uses strict host-key checking; trust the host key first so it exists in `~/.ssh/known_hosts`.
 - If you bind the Gateway to a non-loopback interface, require token/password auth.
-- See [Security](/gateway/security) and [Tailscale](/gateway/tailscale).
+- See [Security](/nb/gateway/security) and [Tailscale](/nb/gateway/tailscale).
 
 ## WhatsApp login flow (remote)
 

package/docs/nb/platforms/mac/signing.md

@@ -11,7 +11,7 @@ This app is usually built from [`scripts/package-mac-app.sh`](https://github.com
 
 - sets a stable debug bundle identifier: `ai.pllan.mac.debug`
 - writes the Info.plist with that bundle id (override via `BUNDLE_ID=...`)
-- calls [`scripts/codesign-mac-app.sh`](https://github.com/pllan/pllan/blob/main/scripts/codesign-mac-app.sh) to sign the main binary and app bundle so macOS treats each rebuild as the same signed bundle and keeps TCC permissions (notifications, accessibility, screen recording, mic, speech). For stable permissions, use a real signing identity; ad-hoc is opt-in and fragile (see [macOS permissions](/platforms/mac/permissions)).
+- calls [`scripts/codesign-mac-app.sh`](https://github.com/pllan/pllan/blob/main/scripts/codesign-mac-app.sh) to sign the main binary and app bundle so macOS treats each rebuild as the same signed bundle and keeps TCC permissions (notifications, accessibility, screen recording, mic, speech). For stable permissions, use a real signing identity; ad-hoc is opt-in and fragile (see [macOS permissions](/nb/platforms/mac/permissions)).
 - uses `CODESIGN_TIMESTAMP=auto` by default; it enables trusted timestamps for Developer ID signatures. Set `CODESIGN_TIMESTAMP=off` to skip timestamping (offline debug builds).
 - inject build metadata into Info.plist: `PllanBuildTimestamp` (UTC) and `PllanGitCommit` (short hash) so the About pane can show build, git, and debug/release channel.
 - **Packaging defaults to Node 24**: the script runs TS builds and the Control UI build. Node 22 LTS, currently `22.16+`, remains supported for compatibility.
@@ -31,7 +31,7 @@ DISABLE_LIBRARY_VALIDATION=1 scripts/package-mac-app.sh   # dev-only Sparkle Tea
 
 ### Ad-hoc Signing Note
 
-When signing with `SIGN_IDENTITY="-"` (ad-hoc), the script automatically disables the **Hardened Runtime** (`--options runtime`). This is necessary to prevent crashes when the app attempts to load embedded frameworks (like Sparkle) that do not share the same Team ID. Ad-hoc signatures also break TCC permission persistence; see [macOS permissions](/platforms/mac/permissions) for recovery steps.
+When signing with `SIGN_IDENTITY="-"` (ad-hoc), the script automatically disables the **Hardened Runtime** (`--options runtime`). This is necessary to prevent crashes when the app attempts to load embedded frameworks (like Sparkle) that do not share the same Team ID. Ad-hoc signatures also break TCC permission persistence; see [macOS permissions](/nb/platforms/mac/permissions) for recovery steps.
 
 ## Build metadata for About
 

package/docs/nb/platforms/mac/xpc.md

@@ -42,7 +42,7 @@ Agent -> Gateway -> Node Service (WS)
 - UI automation uses a separate UNIX socket named `bridge.sock` and the PeekabooBridge JSON protocol.
 - Host preference order (client-side): Peekaboo.app → Claude.app → Pllan.app → local execution.
 - Security: bridge hosts require an allowed TeamID; DEBUG-only same-UID escape hatch is guarded by `PEEKABOO_ALLOW_UNSIGNED_SOCKET_CLIENTS=1` (Peekaboo convention).
-- See: [PeekabooBridge usage](/platforms/mac/peekaboo) for details.
+- See: [PeekabooBridge usage](/nb/platforms/mac/peekaboo) for details.
 
 ## Operational flows
 

package/docs/nb/platforms/macos.md

@@ -213,14 +213,14 @@ components can talk to a remote Gateway as if it were on localhost.
   ExitOnForwardFailure + keepalive options.
 - **IP reporting:** the SSH tunnel uses loopback, so the gateway will see the node
   IP as `127.0.0.1`. Use **Direct (ws/wss)** transport if you want the real client
-  IP to appear (see [macOS remote access](/platforms/mac/remote)).
+  IP to appear (see [macOS remote access](/nb/platforms/mac/remote)).
 
-For setup steps, see [macOS remote access](/platforms/mac/remote). For protocol
-details, see [Gateway protocol](/gateway/protocol).
+For setup steps, see [macOS remote access](/nb/platforms/mac/remote). For protocol
+details, see [Gateway protocol](/nb/gateway/protocol).
 
 ## Related docs
 
-- [Gateway runbook](/gateway)
-- [Gateway (macOS)](/platforms/mac/bundled-gateway)
-- [macOS permissions](/platforms/mac/permissions)
-- [Canvas](/platforms/mac/canvas)
+- [Gateway runbook](/nb/gateway)
+- [Gateway (macOS)](/nb/platforms/mac/bundled-gateway)
+- [macOS permissions](/nb/platforms/mac/permissions)
+- [Canvas](/nb/platforms/mac/canvas)

package/docs/nb/platforms/oracle.md

@@ -296,8 +296,8 @@ tar -czvf pllan-backup.tar.gz ~/.pllan ~/.pllan/workspace
 
 ## See Also
 
-- [Gateway remote access](/gateway/remote) — other remote access patterns
-- [Tailscale integration](/gateway/tailscale) — full Tailscale docs
-- [Gateway configuration](/gateway/configuration) — all config options
-- [DigitalOcean guide](/platforms/digitalocean) — if you want paid + easier signup
-- [Hetzner guide](/install/hetzner) — Docker-based alternative
+- [Gateway remote access](/nb/gateway/remote) — other remote access patterns
+- [Tailscale integration](/nb/gateway/tailscale) — full Tailscale docs
+- [Gateway configuration](/nb/gateway/configuration) — all config options
+- [DigitalOcean guide](/nb/platforms/digitalocean) — if you want paid + easier signup
+- [Hetzner guide](/nb/install/hetzner) — Docker-based alternative

package/docs/nb/platforms/raspberry-pi.md

@@ -178,7 +178,7 @@ Then open the printed Dashboard URL in your local browser.
 If the UI asks for auth, paste the token from `gateway.auth.token`
 (or `PLLAN_GATEWAY_TOKEN`) into Control UI settings.
 
-For always-on remote access, see [Tailscale](/gateway/tailscale).
+For always-on remote access, see [Tailscale](/nb/gateway/tailscale).
 
 ---
 
@@ -405,8 +405,8 @@ echo 'wireless-power off' | sudo tee -a /etc/network/interfaces
 
 ## See Also
 
-- [Linux guide](/platforms/linux) — general Linux setup
-- [DigitalOcean guide](/platforms/digitalocean) — cloud alternative
-- [Hetzner guide](/install/hetzner) — Docker setup
-- [Tailscale](/gateway/tailscale) — remote access
-- [Nodes](/nodes) — pair your laptop/phone with the Pi gateway
+- [Linux guide](/nb/platforms/linux) — general Linux setup
+- [DigitalOcean guide](/nb/platforms/digitalocean) — cloud alternative
+- [Hetzner guide](/nb/install/hetzner) — Docker setup
+- [Tailscale](/nb/gateway/tailscale) — remote access
+- [Nodes](/nb/nodes) — pair your laptop/phone with the Pi gateway

package/docs/nb/platforms/windows.md

@@ -18,8 +18,8 @@ Native Windows companion apps are planned.
 
 ## WSL2 (recommended)
 
-- [Getting Started](/start/getting-started) (use inside WSL)
-- [Install & updates](/install/updating)
+- [Getting Started](/nb/start/getting-started) (use inside WSL)
+- [Install & updates](/nb/install/updating)
 - Official WSL2 guide (Microsoft): [https://learn.microsoft.com/windows/wsl/install](https://learn.microsoft.com/windows/wsl/install)
 
 ## Native Windows status
@@ -62,8 +62,8 @@ If Scheduled Task creation is blocked, the fallback service mode still auto-star
 
 ## Gateway
 
-- [Gateway runbook](/gateway)
-- [Configuration](/gateway/configuration)
+- [Gateway runbook](/nb/gateway)
+- [Configuration](/nb/gateway/configuration)
 
 ## Gateway service install (CLI)
 
@@ -233,7 +233,7 @@ pnpm build
 pllan onboard
 ```
 
-Full guide: [Getting Started](/start/getting-started)
+Full guide: [Getting Started](/nb/start/getting-started)
 
 ## Windows companion app
 

package/docs/nb/plugins/architecture.md

@@ -11,7 +11,7 @@ title: "Plugin Architecture"
 # Plugin Architecture
 
 This page covers the internal architecture of the Pllan plugin system. For
-user-facing setup, discovery, and configuration, see [Plugins](/tools/plugin).
+user-facing setup, discovery, and configuration, see [Plugins](/nb/tools/plugin).
 
 ## Public capability model
 
@@ -70,7 +70,7 @@ registration behavior (not just static metadata):
   capabilities
 
 Use `pllan plugins inspect <id>` to see a plugin's shape and capability
-breakdown. See [CLI reference](/cli/plugins#inspect) for details.
+breakdown. See [CLI reference](/nb/cli/plugins#inspect) for details.
 
 ### Legacy hooks
 
@@ -352,7 +352,7 @@ sequence again: define the core capability first, then let vendor plugins
 register implementations against it.
 
 Need a concrete rollout checklist? See
-[Capability Cookbook](/tools/capability-cookbook).
+[Capability Cookbook](/nb/tools/capability-cookbook).
 
 ## Contracts and enforcement
 
@@ -1286,7 +1286,7 @@ Recommended sequence:
    Add tests so ownership and registration shape stay explicit over time.
 
 This is how Pllan stays opinionated without becoming hardcoded to one
-provider's worldview. See the [Capability Cookbook](/tools/capability-cookbook)
+provider's worldview. See the [Capability Cookbook](/nb/tools/capability-cookbook)
 for a concrete file checklist and worked example.
 
 ### Capability checklist

package/docs/nb/plugins/building-extensions.md

@@ -159,7 +159,7 @@ Create `pllan.plugin.json` in your extension root:
 }
 ```
 
-See [Plugin manifest](/plugins/manifest) for the full schema.
+See [Plugin manifest](/nb/plugins/manifest) for the full schema.
 
 ## Step 6: Test with contract tests
 

package/docs/nb/plugins/bundles.md

@@ -24,9 +24,9 @@ Verbose output and `pllan plugins inspect <id>` also show the subtype
 
 Related:
 
-- Plugin system overview: [Plugins](/tools/plugin)
-- CLI install/list flows: [plugins](/cli/plugins)
-- Native manifest schema: [Plugin manifest](/plugins/manifest)
+- Plugin system overview: [Plugins](/nb/tools/plugin)
+- CLI install/list flows: [plugins](/nb/cli/plugins)
+- Native manifest schema: [Plugin manifest](/nb/plugins/manifest)
 
 ## What a bundle is
 

package/docs/nb/plugins/manifest.md

@@ -10,7 +10,7 @@ title: "Plugin Manifest"
 
 This page is for the **native Pllan plugin manifest** only.
 
-For compatible bundle layouts, see [Plugin bundles](/plugins/bundles).
+For compatible bundle layouts, see [Plugin bundles](/nb/plugins/bundles).
 
 Compatible bundle formats use different manifest files:
 
@@ -31,9 +31,9 @@ Every native Pllan plugin **must** ship a `pllan.plugin.json` file in the
 **without executing plugin code**. Missing or invalid manifests are treated as
 plugin errors and block config validation.
 
-See the full plugin system guide: [Plugins](/tools/plugin).
+See the full plugin system guide: [Plugins](/nb/tools/plugin).
 For the native capability model and current external-compatibility guidance:
-[Capability model](/plugins/architecture#public-capability-model).
+[Capability model](/nb/plugins/architecture#public-capability-model).
 
 ## Required fields
 
@@ -121,7 +121,7 @@ Example:
 - If plugin config exists but the plugin is **disabled**, the config is kept and
   a **warning** is surfaced in Doctor + logs.
 
-See [Configuration reference](/configuration) for the full `plugins.*` schema.
+See [Configuration reference](/nb/configuration) for the full `plugins.*` schema.
 
 ## Notes
 
@@ -135,7 +135,7 @@ See [Configuration reference](/configuration) for the full `plugins.*` schema.
   `--auth-choice` resolution, preferred-provider mapping, and simple onboarding
   CLI flag registration before provider runtime loads. For runtime wizard
   metadata that requires provider code, see
-  [Provider runtime hooks](/plugins/architecture#provider-runtime-hooks).
+  [Provider runtime hooks](/nb/plugins/architecture#provider-runtime-hooks).
 - Exclusive plugin kinds are selected through `plugins.slots.*`.
   - `kind: "memory"` is selected by `plugins.slots.memory`.
   - `kind: "context-engine"` is selected by `plugins.slots.contextEngine`