diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85422c97..5eda0ddf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -36,8 +36,16 @@ jobs:
       - name: 'Install dependencies'
         run: bun install --frozen-lockfile
 
+      - name: 'Check content (MDX that could run code)'
+        run: bun run check:content
+
+      - name: 'Test the content check'
+        run: bun run test:content
+
       - name: 'Typecheck'
         run: bun run typecheck
 
+      # prebuild runs check:content again (Netlify builds run it there);
+      # postbuild runs check:paths on out/.
       - name: 'Build'
         run: bun run build
diff --git a/.github/workflows/preview-build.yml b/.github/workflows/preview-build.yml
new file mode 100644
index 00000000..344aaecb
--- /dev/null
+++ b/.github/workflows/preview-build.yml
@@ -0,0 +1,81 @@
+# Publishes this branch's built /docs as static files for the Hub's preview deployment
+# (hub-preview.pelican.dev), so the preview shows the whole one-site pelican.dev: the Hub's
+# pages and these docs under /docs.
+#
+# The branch preview/docs-under-docs holds exactly what goes in the Hub's public/docs/:
+# out/docs/*, plus out/_next/ as _next/ (pages load /docs/_next/... because of assetPrefix,
+# while the export writes those files to out/_next/), plus BUILD.json naming the commit.
+# The Hub installs it on the preview host (App\Services\Site\DocsPreviewService); the last
+# step asks the preview to check for the new build right away.
+name: 'Preview build'
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'feat/docs-under-docs'
+
+concurrency:
+  group: preview-build
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: 'Build and publish /docs for the Hub preview'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v7
+
+      - name: 'Setup Bun'
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
+      - name: 'Setup Node'
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+
+      - name: 'Cache Bun packages'
+        uses: actions/cache@v6
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
+      - name: 'Install dependencies'
+        run: bun install --frozen-lockfile
+
+      # prebuild checks the content, postbuild checks every file lands where it should.
+      - name: 'Build'
+        run: bun run build
+
+      - name: 'Assemble the /docs folder'
+        run: |
+          rm -rf preview
+          mkdir preview
+          cp -R out/docs/. preview/
+          cp -R out/_next preview/_next
+          test -f preview/index.html
+          test -d preview/_next/static
+          printf '{"sha":"%s","branch":"%s","built_at":"%s"}\n' \
+            "$GITHUB_SHA" "$GITHUB_REF_NAME" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > preview/BUILD.json
+
+      - name: 'Publish to preview/docs-under-docs'
+        working-directory: preview
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git init -q -b preview
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add -A
+          git commit -q -m "Docs preview build of ${GITHUB_SHA::10} (${GITHUB_REF_NAME})"
+          git push -q -f "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:refs/heads/preview/docs-under-docs
+
+      # Not fatal: the preview also checks on its own every 10 minutes and on the first visit.
+      - name: 'Ask the Hub preview to install it'
+        run: curl -fsS --max-time 60 https://hub-preview.pelican.dev/docs/_refresh || echo "The preview will pick it up on its next check."
diff --git a/README.md b/README.md
index 3a03b8e3..4f8df9b0 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # Pelican Docs
 
-The website and documentation at [pelican.dev](https://pelican.dev), covering [Pelican Panel](https://github.com/pelican/panel) and [Wings](https://github.com/pelican/wings).
+The source for the documentation at [pelican.dev/docs](https://pelican.dev/docs), covering [Pelican Panel](https://github.com/pelican/panel) and [Wings](https://github.com/pelican/wings).
+
 Built with [Next.js](https://nextjs.org) and [Fumadocs](https://fumadocs.dev) and served by Netlify as a static site.
 
 ## Running it locally
@@ -23,6 +24,9 @@ bun run build   # the production site, written to out/
 | `app/(home)/page.tsx` | The homepage. |
 | `public/` | Files served as they are, including the `update-panel.sh` and `migrate-*.sh` scripts. |
 | `netlify.toml` | Build settings and redirects such as `/discord`. |
+| `ui/` | Design tokens (`tokens.css`) and site nav (`nav.json`) shared with the Hub; published at `/docs/ui/v1/`. |
+| `router/` | `dev-server.mjs`: pelican.dev as one site locally (docs from `out/`, the rest from the Hub). See its README. |
+| `scripts/check-*.mjs` | `check-content` (parses every page as MDX and fails on anything that could run code: `import`/`export`, `{expressions}`, components outside `mdx-components.tsx`, handlers, unsafe URLs; runs before the build, tested by `bun run test:content`) and `check-paths` (everything under `/docs/`, runs after it). |
 
 ## Writing a page
 
diff --git a/app/(landing)/home.css b/app/(landing)/home.css
index a9661aef..4c5d3db7 100644
--- a/app/(landing)/home.css
+++ b/app/(landing)/home.css
@@ -8,37 +8,8 @@
  * ====================================================================== */
 
 .pl {
-  --ink: #04121c;
-  --sky: #38bdf8;
-  --sky-deep: #0b79ad;
-  --white: #ffffff;
-  --paper: #f3f7f9;
-  --text: #1f3644;
-  --on-ink-soft: #b9ccd6;
-  --line-on-ink: #2e4756;
-  --line: 3px solid var(--ink);
-  --pad: clamp(16px, 4cqi, 64px);
-  --section: clamp(72px, 9cqi, 120px);
-  --font-display: var(--pl-font-display), 'Helvetica Neue', sans-serif;
-  --font-text: var(--pl-font-text), 'Helvetica Neue', system-ui, sans-serif;
-  --font-code: var(--font-jetbrains), ui-monospace, Menlo, monospace;
-  --btn-shadow: var(--ink);
-  /* Theme roles. --ink and --white flip in dark mode (see "Dark theme" at the
-     end); these stay put or carry the role the light values had. */
-  --navy: #04121c; /* always navy: text on sky, chrome that is dark in both themes */
-  --snow: #ffffff; /* always white: text on navy */
-  --shadow: var(--ink); /* hard offset shadow on cards */
-  --muted: #33505f;
-  --faint: #8aa3b0;
-  --rule: #d5e3ea;
-  --rule-soft: #e3edf2;
-  --rule-ink: rgba(4, 18, 28, 0.12);
-  --chip: #e3edf2;
-  --hover: #e8f6fd;
-  --hover-strong: #cdeefd;
-  --on-sky-soft: #0b2a3b;
-  --kbd-bg: rgba(255, 255, 255, 0.5);
-
+  /* The colours, fonts and sizes (--ink, --sky, --line, --pad, ...) are in
+     ui/tokens.css, loaded on every page by app/global.css. */
   container: page / inline-size;
   flex: 1;
   display: flex;
@@ -4556,27 +4527,7 @@ html:has(.pl-ed[open]) {
  * keep their light values and only the bands around them change.
  * ====================================================================== */
 .dark .pl {
-  --ground: #04121c;
-  --deep: #071926;
-  --code: #000b12;
-  --ink: #ffffff;
-  --white: #0a1e2b;
-  --card: #0a1e2b; /* the surface, also inside .on-ink where --white is white again */
-  --paper: #071926;
-  --text: #d4e3ea;
-  --muted: #b9ccd6;
-  --faint: #7f99a6;
-  --rule: #2e4756;
-  --rule-soft: #1f3a4a;
-  --rule-ink: rgba(185, 204, 214, 0.18);
-  --chip: #14304a;
-  --hover: #0f2c3d;
-  --hover-strong: #123a52;
-  --on-sky-soft: #b9ccd6;
-  --kbd-bg: rgba(255, 255, 255, 0.1);
-  --sky-deep: #38bdf8;
-  --shadow: var(--sky);
-  --btn-shadow: var(--sky);
+  /* The dark tokens are in ui/tokens.css. */
   background: var(--ground);
 }
 
@@ -4585,13 +4536,7 @@ html:has(.pl-ed[open]) {
   color: var(--navy);
 }
 
-/* Navy sections were already dark: give them back their light values. */
-.dark .pl .on-ink {
-  --ink: #04121c;
-  --white: #ffffff;
-  --line: 3px solid var(--line-on-ink);
-  --btn-shadow: var(--snow);
-}
+/* Navy (.on-ink) sections get their light values back in ui/tokens.css. */
 
 /* ---- Full-width bands: navy grounds with slate edges, no bright blocks ---- */
 .dark .pl :is(.pl-features, .pl-activity, .pl-sup-faq) {
diff --git a/app/md/[...slug]/route.ts b/app/docs/md/[...slug]/route.ts
similarity index 84%
rename from app/md/[...slug]/route.ts
rename to app/docs/md/[...slug]/route.ts
index 9aaf3c3b..1899cff5 100644
--- a/app/md/[...slug]/route.ts
+++ b/app/docs/md/[...slug]/route.ts
@@ -1,7 +1,7 @@
 import { notFound } from 'next/navigation';
 import { markdownParams, pageFromMarkdownSlug, pageMarkdown } from '@/lib/llms';
 
-// One docs page as Markdown. Builds to out/md/<page>.md; netlify.toml serves
+// One docs page as Markdown. Builds to out/docs/md/<page>.md; netlify.toml serves
 // it at /docs/<page>.md (the docs page route owns everything under /docs).
 export const dynamic = 'force-static';
 export const dynamicParams = false;
@@ -10,7 +10,7 @@ export function generateStaticParams() {
   return markdownParams();
 }
 
-export async function GET(_request: Request, { params }: RouteContext<'/md/[...slug]'>) {
+export async function GET(_request: Request, { params }: RouteContext<'/docs/md/[...slug]'>) {
   const { slug } = await params;
   const page = pageFromMarkdownSlug(slug);
   if (!page) notFound();
diff --git a/app/og/docs/[...slug]/route.tsx b/app/docs/og/[...slug]/route.tsx
similarity index 96%
rename from app/og/docs/[...slug]/route.tsx
rename to app/docs/og/[...slug]/route.tsx
index ee7a51aa..14165e55 100644
--- a/app/og/docs/[...slug]/route.tsx
+++ b/app/docs/og/[...slug]/route.tsx
@@ -7,7 +7,7 @@ import { checkedMotif } from '@/lib/og-motifs';
 import { source } from '@/lib/source';
 
 // Share images for the docs, written into out/ at build time:
-// /og/docs/image.png for /docs/ and /og/docs/<slug>/image.png for every other page.
+// /docs/og/image.png for /docs/ and /docs/og/<slug>/image.png for every other page.
 // The last segment is the file name, so a catch-all can stay the last part of the route.
 export const dynamic = 'force-static';
 export const dynamicParams = false;
@@ -32,7 +32,7 @@ function placeOf(url: string): { section: DocsSection; trail: string[] } {
   return section ? { section, trail } : { section: 'Project', trail: [] };
 }
 
-export async function GET(_req: Request, { params }: RouteContext<'/og/docs/[...slug]'>) {
+export async function GET(_req: Request, { params }: RouteContext<'/docs/og/[...slug]'>) {
   const { slug } = await params;
   if (slug.at(-1) !== FILE) notFound();
   const page = source.getPage(slug.slice(0, -1));
diff --git a/app/api/search/route.ts b/app/docs/search.json/route.ts
similarity index 57%
rename from app/api/search/route.ts
rename to app/docs/search.json/route.ts
index c1d933fb..b89a81e3 100644
--- a/app/api/search/route.ts
+++ b/app/docs/search.json/route.ts
@@ -1,7 +1,7 @@
 import { createFromSource } from 'fumadocs-core/search/server';
 import { source } from '@/lib/source';
 
-// Built once at build time into a static file; the search box downloads it
-// and searches in the browser, so the site needs no server.
+// Built once at build time into out/docs/search.json; the search box (app/layout.tsx)
+// downloads it and searches in the browser, so the site needs no server.
 export const revalidate = false;
 export const { staticGET: GET } = createFromSource(source, { language: 'english' });
diff --git a/app/docs/sitemap.ts b/app/docs/sitemap.ts
new file mode 100644
index 00000000..f90d8fff
--- /dev/null
+++ b/app/docs/sitemap.ts
@@ -0,0 +1,17 @@
+import type { MetadataRoute } from 'next';
+import { absoluteUrl } from '@/lib/og';
+import { source } from '@/lib/source';
+
+// Written once into out/docs/sitemap.xml by the static export. The Hub's
+// /sitemap.xml index links here.
+export const dynamic = 'force-static';
+
+/** Every docs page, with its git last-modified date. */
+export default function sitemap(): MetadataRoute.Sitemap {
+  return source.getPages().map((page) => ({
+    url: absoluteUrl(page.url),
+    lastModified: page.data.lastModified,
+    changeFrequency: 'weekly',
+    priority: page.slugs.length === 0 ? 0.9 : 0.7,
+  }));
+}
diff --git a/app/docs/ui/v1/nav.json/route.ts b/app/docs/ui/v1/nav.json/route.ts
new file mode 100644
index 00000000..182bd93c
--- /dev/null
+++ b/app/docs/ui/v1/nav.json/route.ts
@@ -0,0 +1,11 @@
+import { siteNav } from '@/lib/nav';
+
+// /docs/ui/v1/nav.json: ui/nav.json (the site header, footer and call to action),
+// for the Hub to copy. v1 is the shape of the file.
+export const dynamic = 'force-static';
+
+export function GET() {
+  return new Response(`${JSON.stringify(siteNav, null, 2)}\n`, {
+    headers: { 'Content-Type': 'application/json; charset=utf-8' },
+  });
+}
diff --git a/app/docs/ui/v1/tokens.css/route.ts b/app/docs/ui/v1/tokens.css/route.ts
new file mode 100644
index 00000000..4927bb80
--- /dev/null
+++ b/app/docs/ui/v1/tokens.css/route.ts
@@ -0,0 +1,11 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+// /docs/ui/v1/tokens.css: ui/tokens.css as it is, for the Hub to copy.
+// v1 is the shape of the file; bump the folder when a change would break a copy.
+export const dynamic = 'force-static';
+
+export async function GET() {
+  const css = await readFile(join(process.cwd(), 'ui/tokens.css'), 'utf8');
+  return new Response(css, { headers: { 'Content-Type': 'text/css; charset=utf-8' } });
+}
diff --git a/app/global.css b/app/global.css
index 963f2753..14a377f7 100644
--- a/app/global.css
+++ b/app/global.css
@@ -1,6 +1,8 @@
 @import 'tailwindcss';
 @import 'fumadocs-ui/css/neutral.css';
 @import 'fumadocs-ui/css/preset.css';
+/* The V12 tokens shared with the Hub (published at /docs/ui/v1/tokens.css). */
+@import '../ui/tokens.css';
 
 /* =========================================================================
  * Site-wide theme, in the V12 "B v3" style: navy #04121C, sky #38BDF8,
@@ -16,16 +18,8 @@
   --font-mono: var(--font-jetbrains), ui-monospace, SFMono-Regular, Menlo, monospace;
 }
 
+/* Fumadocs' colours; the --pl-* brand colours come from ui/tokens.css. */
 :root {
-  --pl-ink: #04121c;
-  --pl-sky: #38bdf8;
-  --pl-sky-deep: #0b79ad;
-  --pl-white: #ffffff;
-  --pl-paper: #f3f7f9;
-  /* the thick edge and hard shadow used on cards, code and callouts */
-  --pl-edge: var(--pl-ink);
-  --pl-shadow: var(--pl-ink);
-
   --color-fd-background: #f3f7f9;
   --color-fd-foreground: #04121c;
   --color-fd-muted: #e3edf2;
@@ -51,9 +45,6 @@
 }
 
 .dark {
-  --pl-edge: #2e4756;
-  --pl-shadow: #38bdf8;
-
   --color-fd-background: #04121c;
   --color-fd-foreground: #f3f7f9;
   --color-fd-muted: #0a1f2e;
diff --git a/app/layout.tsx b/app/layout.tsx
index 8ff22cbd..7fc358e0 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -24,7 +24,7 @@ export const metadata: Metadata = {
   description:
     'Pelican is a free, open-source panel for running game servers and applications in isolated Docker containers.',
   applicationName: SITE_NAME,
-  icons: { icon: '/img/favicon.ico', apple: '/img/logo.png' },
+  icons: { icon: '/docs/img/favicon.ico', apple: '/docs/img/logo.png' },
   // Fallbacks only: each page sets its own canonical, Open Graph and Twitter card
   // through pageMetadata() in lib/og.ts.
   openGraph: {
@@ -41,10 +41,11 @@ export default function RootLayout({ children }: LayoutProps<'/'>) {
     <html lang="en" className={`${display.variable} ${text.variable} ${mono.variable}`} suppressHydrationWarning>
       <body className="flex min-h-screen flex-col">
         <RootProvider
-          // Follows the reader's system setting; the switch in the docs bar overrides it.
-          theme={{ defaultTheme: 'system' }}
-          // The search index is a static file built with the site (app/api/search).
-          search={{ options: { type: 'static' } }}
+          // Dark until the reader picks a theme with the switch in the docs bar (the Hub does the same).
+          theme={{ defaultTheme: 'dark' }}
+          // The search index is a static file built with the site (app/docs/search.json),
+          // under /docs/ like everything else the docs load.
+          search={{ options: { type: 'static', api: '/docs/search.json' } }}
         >
           {children}
           <ExternalLinkGuard />
diff --git a/app/robots.ts b/app/robots.ts
index 88e272d9..56de5be1 100644
--- a/app/robots.ts
+++ b/app/robots.ts
@@ -2,6 +2,7 @@ import type { MetadataRoute } from 'next';
 import { IS_PRODUCTION, SITE_URL } from '@/lib/og';
 
 // Written once into out/robots.txt by the static export.
+// INTERIM: after the switch the Hub serves /robots.txt (and should list /docs/sitemap.xml).
 export const dynamic = 'force-static';
 
 /** Everything is open, AI crawlers included: the owner wants the docs discoverable. */
@@ -9,6 +10,6 @@ export default function robots(): MetadataRoute.Robots {
   return {
     // Deploy previews are closed to crawlers; production is open to everyone.
     rules: IS_PRODUCTION ? { userAgent: '*', allow: '/' } : { userAgent: '*', disallow: '/' },
-    sitemap: `${SITE_URL}/sitemap.xml`,
+    sitemap: [`${SITE_URL}/sitemap.xml`, `${SITE_URL}/docs/sitemap.xml`],
   };
 }
diff --git a/app/sitemap.ts b/app/sitemap.ts
index b66ef176..addda019 100644
--- a/app/sitemap.ts
+++ b/app/sitemap.ts
@@ -1,13 +1,16 @@
 import type { MetadataRoute } from 'next';
 import { absoluteUrl } from '@/lib/og';
-import { pagesSource, source } from '@/lib/source';
+import { pagesSource } from '@/lib/source';
 
 // Written once into out/sitemap.xml by the static export.
+// INTERIM: the landing pages only (remove after the switch, with them). The docs
+// have their own /docs/sitemap.xml (app/docs/sitemap.ts); robots.txt lists both,
+// and the Hub will serve /sitemap.xml as an index that points at the docs one.
 export const dynamic = 'force-static';
 
-/** Every landing page and every docs page, with the docs' git last-modified dates. */
+/** The landing pages (/, /eggs, /support, /faq). */
 export default function sitemap(): MetadataRoute.Sitemap {
-  const landing: MetadataRoute.Sitemap = [
+  return [
     { url: absoluteUrl('/'), changeFrequency: 'weekly', priority: 1 },
     { url: absoluteUrl('/eggs/'), changeFrequency: 'daily', priority: 0.8 },
     { url: absoluteUrl('/support/'), changeFrequency: 'monthly', priority: 0.6 },
@@ -18,13 +21,4 @@ export default function sitemap(): MetadataRoute.Sitemap {
       priority: 0.6,
     })),
   ];
-
-  const docs: MetadataRoute.Sitemap = source.getPages().map((page) => ({
-    url: absoluteUrl(page.url),
-    lastModified: page.data.lastModified,
-    changeFrequency: 'weekly',
-    priority: page.slugs.length === 0 ? 0.9 : 0.7,
-  }));
-
-  return [...landing, ...docs];
 }
diff --git a/bun.lock b/bun.lock
index 20a62523..db96648c 100644
--- a/bun.lock
+++ b/bun.lock
@@ -24,6 +24,9 @@
         "@types/node": "26.6.6",
         "@types/react": "19.3.0",
         "@types/react-dom": "19.3.0",
+        "mdast-util-from-markdown": "2.1.0",
+        "mdast-util-mdx": "3.0.0",
+        "micromark-extension-mdxjs": "3.0.0",
         "postcss": "8.5.28",
         "sharp": "0.35.5",
         "tailwindcss": "4.3.3",
@@ -32,6 +35,11 @@
       },
     },
   },
+  "trustedDependencies": [
+    "@tailwindcss/oxide",
+    "sharp",
+    "esbuild",
+  ],
   "packages": {
     "@alloc/quick-lru": ["@alloc/quick-lru@5.3.0", "", {}, "sha512-U4+70Pc5ZS9osnCBCE5Jha/ciHM+Yp+CNMNC/7HvYbNRk1Ldd+f7qO65W5qfhu/TCv+/ozljlXXe9Nj8419DMA=="],
 
diff --git a/components/docs/docs-top-bar.tsx b/components/docs/docs-top-bar.tsx
index b8de1759..79c16064 100644
--- a/components/docs/docs-top-bar.tsx
+++ b/components/docs/docs-top-bar.tsx
@@ -4,6 +4,7 @@ import { FullSearchTrigger } from 'fumadocs-ui/layouts/shared/slots/search-trigg
 import { ThemeSwitch } from 'fumadocs-ui/layouts/shared/slots/theme-switch';
 import { links } from '@/lib/links';
 import { project } from '@/lib/home-data';
+import { navOutsideDocs, siteNav } from '@/lib/nav';
 
 /**
  * The B v3 top bar for the docs (desktop and tablet). On phones Fumadocs'
@@ -12,26 +13,28 @@ import { project } from '@/lib/home-data';
 export function DocsTopBar() {
   return (
     <header className="dt-bar">
-      <Link href="/" className="dt-bar__brand" aria-label="Pelican home">
+      {/* Plain links: / and the paths in the site nav are the Hub's pages, not this app's. */}
+      <a href="/" className="dt-bar__brand" aria-label="Pelican home">
         {/* eslint-disable-next-line @next/next/no-img-element */}
-        <img src="/img/logo.png" alt="" width={34} height={34} />
+        <img src="/docs/img/logo.png" alt="" width={34} height={34} />
         <span>Pelican</span>
         <span className="dt-bar__section">Docs</span>
-      </Link>
+      </a>
       <FullSearchTrigger className="dt-bar__search" />
       <nav className="dt-bar__links" aria-label="Site">
-        <a href={`${links.hub}/plugins`}>Plugins</a>
-        <Link href="/eggs/">Eggs</Link>
-        <a href={links.discord}>Community</a>
-        <Link href="/support/">Sponsor</Link>
+        {navOutsideDocs.map((item) => (
+          <a key={item.href} href={item.href}>
+            {item.label}
+          </a>
+        ))}
       </nav>
       <div className="dt-bar__actions">
         <ThemeSwitch className="dt-bar__theme" />
         <a href={links.github} className="dt-btn" aria-label={`Pelican on GitHub, ${project.stars} stars`}>
           <Star size={15} strokeWidth={2.5} aria-hidden /> {(project.stars / 1000).toFixed(1)}k
         </a>
-        <Link href={links.install} className="dt-btn dt-btn--ink">
-          Get started
+        <Link href={siteNav.cta.href} className="dt-btn dt-btn--ink">
+          {siteNav.cta.label}
         </Link>
       </div>
     </header>
diff --git a/components/home/feature-panel.tsx b/components/home/feature-panel.tsx
index ee96f2d2..6d20e1d9 100644
--- a/components/home/feature-panel.tsx
+++ b/components/home/feature-panel.tsx
@@ -63,7 +63,7 @@ export function FeaturePanel() {
       <div className="pl-panel" data-ui id="pl-panel-view" role="tabpanel" aria-label={`Drawing of the ${tab} page`}>
         <div className="pl-panel__top">
           {/* eslint-disable-next-line @next/next/no-img-element */}
-          <img src="/img/logo.png" alt="" width={24} height={24} />
+          <img src="/docs/img/logo.png" alt="" width={24} height={24} />
           <span className="pl-panel__brand">Pelican</span>
           <span className="pl-panel__crumb">/ Servers / Minecraft SMP</span>
           <span className="pl-panel__search">
diff --git a/components/home/sections.tsx b/components/home/sections.tsx
index 60dccacd..922b8bcc 100644
--- a/components/home/sections.tsx
+++ b/components/home/sections.tsx
@@ -195,7 +195,7 @@ export function FeaturesSection() {
           <div className="pl-fleet__map">
             <div className="pl-fleet__panel">
               {/* eslint-disable-next-line @next/next/no-img-element */}
-              <img src="/img/logo.png" alt="" width={44} height={44} />
+              <img src="/docs/img/logo.png" alt="" width={44} height={44} />
               <span>
                 <strong>Panel</strong> Web UI + API
               </span>
@@ -480,7 +480,7 @@ export function SiteFooterNav() {
           <div>
             <Link href="/" className="pl-nav__brand">
               {/* eslint-disable-next-line @next/next/no-img-element */}
-              <img src="/img/logo.png" alt="" width={40} height={40} />
+              <img src="/docs/img/logo.png" alt="" width={40} height={40} />
               <span className="d">Pelican</span>
             </Link>
             <p className="pl-footer__tag">A free, open-source game server panel, built by its community.</p>
diff --git a/components/home/site-header.tsx b/components/home/site-header.tsx
index 163bd068..99516c0c 100644
--- a/components/home/site-header.tsx
+++ b/components/home/site-header.tsx
@@ -22,7 +22,7 @@ export function SiteHeader() {
       <header className="pl-nav">
         <Link href="/" className="pl-nav__brand" aria-label="Pelican home">
           {/* eslint-disable-next-line @next/next/no-img-element */}
-          <img src="/img/logo.png" alt="" width={44} height={44} />
+          <img src="/docs/img/logo.png" alt="" width={44} height={44} />
           <span className="d">Pelican</span>
         </Link>
         <nav className="pl-nav__links" aria-label="Main">
diff --git a/lib/layout.shared.tsx b/lib/layout.shared.tsx
index d6abb42d..12f81930 100644
--- a/lib/layout.shared.tsx
+++ b/lib/layout.shared.tsx
@@ -1,6 +1,7 @@
 import type { BaseLayoutProps } from 'fumadocs-ui/layouts/shared';
 import { DiscordIcon } from '@/components/icons';
 import { links } from '@/lib/links';
+import { navOutsideDocs } from '@/lib/nav';
 
 /**
  * Options for the docs layout. On desktop the B v3 top bar (DocsTopBar) carries
@@ -12,7 +13,7 @@ export function docsOptions(): BaseLayoutProps {
       title: (
         <span className="dt-navtitle">
           {/* eslint-disable-next-line @next/next/no-img-element */}
-          <img src="/img/logo.png" alt="" width={28} height={28} />
+          <img src="/docs/img/logo.png" alt="" width={28} height={28} />
           Pelican <span>Docs</span>
         </span>
       ),
@@ -20,10 +21,12 @@ export function docsOptions(): BaseLayoutProps {
     },
     githubUrl: links.github,
     links: [
+      // The Hub's pages (ui/nav.json). Fumadocs' `external` would open a new tab; without it a
+      // click tries client-side navigation, gets no payload from the Hub and loads the page normally.
       { text: 'Home', url: '/', on: 'menu' },
-      { text: 'Eggs', url: links.eggs, on: 'menu' },
-      { text: 'Plugins', url: `${links.hub}/plugins`, on: 'menu' },
-      { text: 'Sponsor', url: '/support/', on: 'menu' },
+      ...navOutsideDocs
+        .filter((item) => item.href.startsWith('/'))
+        .map((item) => ({ text: item.label, url: item.href, on: 'menu' as const })),
       {
         type: 'icon',
         label: 'Discord',
diff --git a/lib/llms.ts b/lib/llms.ts
index 810521f3..df616825 100644
--- a/lib/llms.ts
+++ b/lib/llms.ts
@@ -8,8 +8,9 @@ import { source } from '@/lib/source';
  *
  *   /llms.txt             an index of every docs page, linking the .md files
  *   /llms-full.txt        every docs page in one file, in sidebar order
- *   /docs/<page>.md       one page; built to out/md/<page>.md and served at
- *                         /docs/<page>.md by a rewrite in netlify.toml
+ *   /docs/<page>.md       one page; built to out/docs/md/<page>.md (app/docs/md)
+ *                         and served at /docs/<page>.md by a rewrite in
+ *                         netlify.toml (and router/dev-server.mjs locally)
  *
  * The Markdown comes from Fumadocs (`includeProcessedMarkdown` in
  * source.config.ts), with <Admonition>, <Tabs> and friends left as
@@ -25,7 +26,7 @@ export function markdownPath(page: DocsPage): string {
   return page.slugs.length === 0 ? '/docs/index.md' : `${page.url}.md`;
 }
 
-/** Route params for app/md/[...slug]: the page's slugs, with .md on the last one. */
+/** Route params for app/docs/md/[...slug]: the page's slugs, with .md on the last one. */
 export function markdownParams(): { slug: string[] }[] {
   return source.getPages().map((page) => ({ slug: markdownPath(page).replace(/^\/docs\//, '').split('/') }));
 }
diff --git a/lib/nav.ts b/lib/nav.ts
new file mode 100644
index 00000000..4c7cc491
--- /dev/null
+++ b/lib/nav.ts
@@ -0,0 +1,20 @@
+import nav from '@/ui/nav.json';
+
+/**
+ * The pelican.dev navigation shared with the Hub (ui/nav.json, published at
+ * /docs/ui/v1/nav.json). Paths like /plugins and /sponsor are the Hub's; while
+ * Netlify still serves the whole domain, netlify.toml redirects them.
+ */
+export interface NavLink {
+  label: string;
+  href: string;
+}
+
+export const siteNav: {
+  items: NavLink[];
+  footer: { title: string; items: NavLink[] }[];
+  cta: NavLink;
+} = nav;
+
+/** The site nav without "Docs": the docs bar is already in the docs. */
+export const navOutsideDocs = siteNav.items.filter((item) => !item.href.startsWith('/docs'));
diff --git a/lib/og-image.tsx b/lib/og-image.tsx
index ec747ed4..538bde16 100644
--- a/lib/og-image.tsx
+++ b/lib/og-image.tsx
@@ -171,7 +171,7 @@ function loadAssets(): Promise<Assets> {
       font('InstrumentSans-SemiBold.ttf'),
       font('InstrumentSans-Bold.ttf'),
       font('JetBrainsMono-Medium.ttf'),
-      readFile(join(ROOT, 'public/img/logo.png')),
+      readFile(join(ROOT, 'public/docs/img/logo.png')),
     ]);
     return {
       fonts: [
diff --git a/lib/og.ts b/lib/og.ts
index 171f2b1b..41d991ed 100644
--- a/lib/og.ts
+++ b/lib/og.ts
@@ -18,17 +18,18 @@ export const ASSET_URL = (!IS_PRODUCTION && process.env.DEPLOY_PRIME_URL) || SIT
 export const OG_SIZE = { width: 1200, height: 630 } as const;
 
 /**
- * Social card (Open Graph) image paths. The routes under app/og build exactly these
- * 1200×630 PNGs at build time, so keep both sides in step.
+ * Social card (Open Graph) image paths. The routes under app/og (site pages) and
+ * app/docs/og (docs pages) build exactly these 1200×630 PNGs at build time, so keep
+ * both sides in step.
  */
 export const ogImage = {
   home: '/og/home.png',
   eggs: '/og/eggs.png',
   support: '/og/support.png',
   faq: '/og/faq.png',
-  /** `/og/docs/image.png` for /docs/, `/og/docs/<slug segments>/image.png` for the rest. */
+  /** `/docs/og/image.png` for /docs/, `/docs/og/<slug segments>/image.png` for the rest (app/docs/og). */
   docs(slugs: string[] = []): string {
-    return slugs.length === 0 ? '/og/docs/image.png' : `/og/docs/${slugs.join('/')}/image.png`;
+    return slugs.length === 0 ? '/docs/og/image.png' : `/docs/og/${slugs.join('/')}/image.png`;
   },
 } as const;
 
@@ -108,7 +109,7 @@ export function organizationJsonLd() {
     '@id': ORG_ID,
     name: SITE_NAME,
     url: `${SITE_URL}/`,
-    logo: `${SITE_URL}/img/logo.png`,
+    logo: `${SITE_URL}/docs/img/logo.png`,
     sameAs: ['https://github.com/pelican', links.discord],
   };
 }
@@ -181,7 +182,7 @@ export function techArticleJsonLd(page: {
     ...(page.section ? { articleSection: page.section } : {}),
     ...(page.lastModified ? { dateModified: page.lastModified.toISOString() } : {}),
     isPartOf: { '@type': 'WebSite', name: SITE_NAME, url: `${SITE_URL}/` },
-    publisher: { '@type': 'Organization', name: SITE_NAME, url: `${SITE_URL}/`, logo: `${SITE_URL}/img/logo.png` },
+    publisher: { '@type': 'Organization', name: SITE_NAME, url: `${SITE_URL}/`, logo: `${SITE_URL}/docs/img/logo.png` },
   };
 }
 
diff --git a/netlify.toml b/netlify.toml
index ceb97208..54358972 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -11,6 +11,71 @@
   # runtime isn't needed; serve out/ as plain files.
   NETLIFY_NEXT_PLUGIN_SKIP = "true"
 
+# ---- pelican.dev/docs next to the Hub ------------------------------------
+# After the switch a Cloudflare route sends only /docs/*, /llms.txt,
+# /llms-full.txt and the three install scripts here; the Hub serves the rest.
+# So everything the docs load is under /docs/ (see scripts/check-paths.mjs).
+
+# The JS, CSS and fonts. next.config.mjs sets assetPrefix '/docs', so pages ask
+# for /docs/_next/...; the static export still writes them to out/_next/.
+[[redirects]]
+  from = "/docs/_next/*"
+  to = "/_next/:splat"
+  status = 200
+  force = true
+
+# Old locations of files that moved under /docs/ (other sites may link them).
+[[redirects]]
+  from = "/img/logo.png"
+  to = "/docs/img/logo.png"
+  status = 301
+  force = true
+
+[[redirects]]
+  from = "/img/favicon.ico"
+  to = "/docs/img/favicon.ico"
+  status = 301
+  force = true
+
+[[redirects]]
+  from = "/og/docs/*"
+  to = "/docs/og/:splat"
+  status = 301
+  force = true
+
+[[redirects]]
+  from = "/md/*"
+  to = "/docs/:splat"
+  status = 301
+  force = true
+
+[[redirects]]
+  from = "/api/search"
+  to = "/docs/search.json"
+  status = 301
+  force = true
+
+# INTERIM (remove after the switch, when the Hub owns these paths): the docs
+# nav uses the Hub's paths from ui/nav.json; while Netlify serves the whole
+# domain, send them where they live today. /eggs already resolves to /eggs/.
+[[redirects]]
+  from = "/plugins"
+  to = "https://hub.pelican.dev/plugins"
+  status = 302
+  force = true
+
+[[redirects]]
+  from = "/plugins/*"
+  to = "https://hub.pelican.dev/plugins/:splat"
+  status = 302
+  force = true
+
+[[redirects]]
+  from = "/sponsor"
+  to = "/support/"
+  status = 302
+  force = true
+
 # ---- Short links (were client-side redirects on Docusaurus) --------------
 [[redirects]]
   from = "/discord"
@@ -75,12 +140,13 @@
   force = true
 
 # ---- Markdown for AI tools (lib/llms.ts) ---------------------------------
-# /docs/panel/update.md is built to out/md/panel/update.md (the docs page route
-# owns every path under /docs). Not forced, so it only applies when no file
-# exists: the HTML pages under /docs are served as before. Keep it last.
+# /docs/panel/update.md is built to out/docs/md/panel/update.md (app/docs/md;
+# the docs page route owns the other paths under /docs). Not forced, so it only
+# applies when no file exists: the HTML pages under /docs are served as before.
+# Keep it last.
 [[redirects]]
   from = "/docs/*"
-  to = "/md/:splat"
+  to = "/docs/md/:splat"
   status = 200
 
 [[headers]]
@@ -98,6 +164,12 @@
   [headers.values]
     Content-Type = "text/plain; charset=utf-8"
 
+# The design tokens and nav the Hub copies (ui/); readable from any origin.
+[[headers]]
+  for = "/docs/ui/*"
+  [headers.values]
+    Access-Control-Allow-Origin = "*"
+
 # The install scripts are fetched with curl; make sure they come back as text.
 [[headers]]
   for = "/*.sh"
diff --git a/next.config.mjs b/next.config.mjs
index 18da8525..db9a3911 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -9,6 +9,12 @@ const config = {
   output: 'export',
   // pelican.dev has always used /docs/panel/getting-started/ with the slash.
   trailingSlash: true,
+  // pelican.dev serves only /docs/* (plus /llms*.txt and the install scripts) from
+  // this build; every other path belongs to the Hub. So the JS, CSS and fonts load
+  // from /docs/_next/... With `output: 'export'` the files are still written to
+  // out/_next/, and netlify.toml rewrites /docs/_next/* to them.
+  // (basePath would move the interim landing pages under /docs too.)
+  assetPrefix: '/docs',
   images: { unoptimized: true },
 };
 
diff --git a/package.json b/package.json
index 64f5961d..add391c6 100644
--- a/package.json
+++ b/package.json
@@ -6,9 +6,14 @@
   "scripts": {
     "dev": "next dev",
     "sync:eggs": "node scripts/sync-eggs.mjs",
-    "prebuild": "node scripts/sync-eggs.mjs --if-online",
+    "prebuild": "node scripts/check-content.mjs && node scripts/sync-eggs.mjs --if-online",
     "build": "next build",
+    "postbuild": "node scripts/check-paths.mjs",
+    "check:paths": "node scripts/check-paths.mjs",
+    "check:content": "node scripts/check-content.mjs",
+    "test:content": "node --test scripts/check-content.test.mjs",
     "start": "bunx serve out",
+    "preview:site": "node router/dev-server.mjs",
     "typecheck": "fumadocs-mdx && next typegen && tsc --noEmit",
     "postinstall": "fumadocs-mdx"
   },
@@ -32,6 +37,9 @@
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
+    "mdast-util-from-markdown": "2.1.0",
+    "mdast-util-mdx": "3.0.0",
+    "micromark-extension-mdxjs": "3.0.0",
     "postcss": "8.5.28",
     "sharp": "0.35.5",
     "tailwindcss": "4.3.3",
diff --git a/public/img/favicon.ico b/public/docs/img/favicon.ico
similarity index 100%
rename from public/img/favicon.ico
rename to public/docs/img/favicon.ico
diff --git a/public/img/logo.png b/public/docs/img/logo.png
similarity index 100%
rename from public/img/logo.png
rename to public/docs/img/logo.png
diff --git a/router/README.md b/router/README.md
new file mode 100644
index 00000000..e28093c5
--- /dev/null
+++ b/router/README.md
@@ -0,0 +1,84 @@
+# router/
+
+pelican.dev is two apps on one domain: the **Pelican Hub** (Laravel) serves
+almost every path, and this repo's static build (Netlify) serves the docs.
+In production a Cloudflare Worker on `pelican.dev/*` picks the origin per
+request. `dev-server.mjs` makes the same split on your machine, so you can see
+pelican.dev as one site before the Worker exists.
+
+```sh
+bun run build                  # writes out/
+node router/dev-server.mjs     # http://127.0.0.1:8020/ (or: bun run preview:site)
+```
+
+Env: `PORT` (default `8020`), `HUB` (default `http://127.0.0.1:8010`), `OUT`
+(default `out`). Node 22, no dependencies. Every request is logged as
+`status docs|hub|edge METHOD url`.
+
+## The paths this build serves
+
+Matched on the decoded, normalised path (`/docs/%2e%2e/x` is `/x`):
+
+| Path | From |
+| --- | --- |
+| `/docs` and `/docs/*` | `out/docs/` (pages, `search.json`, `sitemap.xml`, `md/`, `og/`, `img/`, `ui/v1/`) |
+| `/docs/_next/*` | `out/_next/*` (assetPrefix `/docs`; the export still writes to `out/_next/`) |
+| `/docs/<page>.md` | `out/docs/md/<page>.md`, only when no file matched first |
+| `/llms.txt`, `/llms-full.txt` | `out/` |
+| `/update-panel.sh`, `/migrate-panel.sh`, `/migrate-wings.sh` | `out/` (the docs tell people to `curl` them) |
+
+Everything else goes to the Hub. `scripts/check-paths.mjs` keeps the build in
+step with this list: it fails when a file lands outside `out/docs/` that isn't
+one of the five root files, Netlify's own, or on its INTERIM list.
+
+Inside the docs paths it behaves like Netlify (`netlify.toml`): `GET`/`HEAD`
+only, a directory without its trailing slash gets a 301, a missing file gets
+`out/404.html` with status 404. It does not apply the other redirects in
+`netlify.toml` (old docs paths, short links).
+
+## What the router does on each side
+
+- **Docs paths** are served from `out/`. `Cookie` and `Authorization` are
+  removed first: the docs are static and must never see a Hub session.
+- **Everything else** is proxied to the Hub with its method, headers and body.
+  `Location` headers pointing at the Hub's own address are made relative, so
+  redirects stay on the one site.
+- **Next.js payload requests outside the docs** (`RSC: 1` header or `?_rsc=`)
+  are answered with 404 by the router itself. The docs' client router prefetches
+  them for links to `/`, `/plugins`, `/eggs`, `/sponsor`; the Hub has none, and
+  on click Next.js falls back to a normal page load. This keeps a Laravel boot
+  off every docs page view.
+
+## Mapping to the Cloudflare Worker
+
+The Worker is the same three branches, with Netlify instead of `out/`:
+
+```js
+const ROOT_FILES = new Set(['/llms.txt', '/llms-full.txt', '/update-panel.sh', '/migrate-panel.sh', '/migrate-wings.sh']);
+const isDocs = (p) => p === '/docs' || p.startsWith('/docs/') || ROOT_FILES.has(p);
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url); // WHATWG URL: already normalised
+    if (isDocs(url.pathname)) {
+      const headers = new Headers(request.headers);
+      headers.delete('cookie');
+      headers.delete('authorization');
+      // Netlify does the /docs/_next and .md rewrites itself (netlify.toml).
+      return fetch(new URL(url.pathname + url.search, env.DOCS_ORIGIN), { method: request.method, headers });
+    }
+    if (request.headers.get('rsc') === '1' || url.searchParams.has('_rsc')) {
+      return new Response('Not a docs page\n', { status: 404 });
+    }
+    return fetch(new Request(new URL(url.pathname + url.search, env.HUB_ORIGIN), request));
+  },
+};
+```
+
+- `DOCS_ORIGIN` is the Netlify production site (e.g. `https://pelican-docs.netlify.app`);
+  PR previews keep their own Netlify URLs and don't go through the Worker.
+- Set `X-Forwarded-Host: pelican.dev` towards the Hub (and trust the Worker in
+  Laravel's TrustProxies) so it builds `https://pelican.dev/...` URLs.
+- Strip any `Set-Cookie` from Netlify responses on the way back.
+- Keep this file, `dev-server.mjs` and `scripts/check-paths.mjs` in step when the
+  list changes.
diff --git a/router/dev-server.mjs b/router/dev-server.mjs
new file mode 100644
index 00000000..584b0f22
--- /dev/null
+++ b/router/dev-server.mjs
@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+/**
+ * pelican.dev as one site, locally: the docs build (out/) for /docs/* and the
+ * five root files, the Hub for everything else. The same split the Cloudflare
+ * route makes in production (router/README.md). Node only, no dependencies.
+ *
+ *   bun run build && node router/dev-server.mjs
+ *   open http://127.0.0.1:8020/
+ *
+ * Env: PORT (8020), HUB (http://127.0.0.1:8010), OUT (out, relative to the repo).
+ */
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import http from 'node:http';
+import { extname, join, normalize, posix, resolve, sep } from 'node:path';
+import { pipeline } from 'node:stream';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(fileURLToPath(new URL('..', import.meta.url)));
+const OUT = resolve(repo, process.env.OUT ?? 'out');
+const PORT = Number(process.env.PORT ?? 8020);
+const HUB = new URL(process.env.HUB ?? 'http://127.0.0.1:8010');
+
+/** The paths this build serves on pelican.dev; keep in step with router/README.md and scripts/check-paths.mjs. */
+const ROOT_FILES = ['/llms.txt', '/llms-full.txt', '/update-panel.sh', '/migrate-panel.sh', '/migrate-wings.sh'];
+const isDocsPath = (path) => path === '/docs' || path.startsWith('/docs/') || ROOT_FILES.includes(path);
+
+const TYPES = {
+  '.html': 'text/html; charset=utf-8',
+  '.txt': 'text/plain; charset=utf-8',
+  '.md': 'text/markdown; charset=utf-8',
+  '.sh': 'text/x-shellscript; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.xml': 'application/xml; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.webp': 'image/webp',
+  '.ico': 'image/x-icon',
+  '.woff2': 'font/woff2',
+};
+
+/** A file under out/ for a URL path, or undefined. Never leaves out/. */
+async function fileFor(path) {
+  const full = normalize(join(OUT, path));
+  if (full !== OUT && !full.startsWith(OUT + sep)) return undefined;
+  try {
+    const info = await stat(full);
+    if (info.isFile()) return { full, size: info.size };
+    if (info.isDirectory()) return { dir: true };
+  } catch {}
+  return undefined;
+}
+
+/**
+ * The Netlify mapping (netlify.toml), in the same order:
+ * 1. /docs/_next/*  -> out/_next/*        (assetPrefix; forced)
+ * 2. the file itself, or <dir>/index.html (a directory without the slash gets a 301, like Netlify)
+ * 3. /docs/*        -> out/docs/md/*      (the .md copies; only when nothing else matched)
+ */
+async function resolveDocs(path) {
+  if (path.startsWith('/docs/_next/')) {
+    const file = await fileFor(path.slice('/docs'.length));
+    return file?.full ? { file } : undefined;
+  }
+  const file = await fileFor(path);
+  if (file?.full) return { file };
+  if (file?.dir) {
+    if (!path.endsWith('/')) return { redirect: `${path}/` };
+    const index = await fileFor(`${path}index.html`);
+    if (index?.full) return { file: index };
+  }
+  if (path.startsWith('/docs/')) {
+    const md = await fileFor(`/docs/md/${path.slice('/docs/'.length)}`);
+    if (md?.full) return { file: md };
+  }
+  return undefined;
+}
+
+function sendFile(res, method, status, { full, size }) {
+  res.writeHead(status, {
+    'Content-Type': TYPES[extname(full)] ?? 'application/octet-stream',
+    'Content-Length': size,
+    'Cache-Control': 'no-cache',
+    'X-Served-By': 'docs (out/)',
+  });
+  if (method === 'HEAD') return res.end();
+  // pipeline, not pipe: a file that fails to open after stat() ends this response instead
+  // of crashing the router with an unhandled stream error.
+  pipeline(createReadStream(full), res, () => {});
+}
+
+async function serveDocs(req, res, path) {
+  // The docs are a static build and never see the Hub's session: like the
+  // Worker will before it forwards to Netlify, drop Cookie and Authorization.
+  delete req.headers.cookie;
+  delete req.headers.authorization;
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    res.writeHead(405, { Allow: 'GET, HEAD', 'Content-Type': 'text/plain' });
+    return res.end('Method Not Allowed\n');
+  }
+  const hit = await resolveDocs(path);
+  if (hit?.redirect) {
+    const query = req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '';
+    res.writeHead(301, { Location: hit.redirect + query });
+    return res.end();
+  }
+  if (hit?.file) return sendFile(res, req.method, 200, hit.file);
+  // Netlify answers every missing path with out/404.html.
+  const notFound = await fileFor('/404.html');
+  if (notFound?.full) return sendFile(res, req.method, 404, notFound);
+  res.writeHead(404, { 'Content-Type': 'text/plain' });
+  res.end('Not Found\n');
+}
+
+/**
+ * Next.js navigation payloads (`RSC: 1` header or `?_rsc=`) for paths outside
+ * the docs: the docs' client router prefetches them for links to the Hub (/,
+ * /plugins, ...). The Hub has none, so answer here instead of booting Laravel;
+ * on click Next.js then loads the page normally.
+ */
+const isNextPayload = (req) => req.headers.rsc === '1' || /[?&]_rsc=/.test(req.url ?? '');
+
+function proxyToHub(req, res) {
+  if (isNextPayload(req)) {
+    res.setHeader('X-Served-By', 'router');
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    return res.end('Not a docs page\n');
+  }
+  const headers = {
+    ...req.headers,
+    'x-forwarded-for': req.socket.remoteAddress ?? '',
+    'x-forwarded-host': req.headers.host ?? '',
+    'x-forwarded-proto': 'http',
+  };
+  const upstream = http.request(
+    { protocol: HUB.protocol, hostname: HUB.hostname, port: HUB.port, method: req.method, path: req.url, headers },
+    (hubRes) => {
+      const out = { ...hubRes.headers, 'x-served-by': 'hub' };
+      // Keep redirects on this origin when the Hub answers with its own address.
+      if (typeof out.location === 'string' && out.location.startsWith(HUB.origin)) {
+        out.location = out.location.slice(HUB.origin.length) || '/';
+      }
+      res.writeHead(hubRes.statusCode ?? 502, out);
+      // pipeline, not pipe: if the Hub cuts its response short, the browser's response is
+      // closed too instead of hanging (and a browser that leaves stops the Hub's).
+      pipeline(hubRes, res, () => {});
+    },
+  );
+  upstream.on('error', (error) => {
+    if (res.headersSent) return res.destroy(error);
+    res.writeHead(502, { 'Content-Type': 'text/plain' });
+    res.end(`The Hub at ${HUB.origin} did not answer: ${error.message}\n`);
+  });
+  pipeline(req, upstream, () => {});
+}
+
+const server = http.createServer(async (req, res) => {
+  let path;
+  try {
+    // Decoded and with ./.. resolved, so /docs/%2e%2e/x can't reach out/ outside docs/.
+    path = posix.normalize(decodeURIComponent(new URL(req.url ?? '/', 'http://x').pathname));
+  } catch {
+    res.writeHead(400);
+    return res.end();
+  }
+  const docs = isDocsPath(path);
+  res.on('finish', () => console.log(`${res.statusCode} ${res.getHeader('x-served-by') === 'router' ? 'edge' : docs ? 'docs' : 'hub '} ${req.method} ${req.url}`));
+  try {
+    if (docs) await serveDocs(req, res, path);
+    else proxyToHub(req, res);
+  } catch (error) {
+    console.error(error);
+    if (!res.headersSent) res.writeHead(500);
+    res.end();
+  }
+});
+
+server.listen(PORT, '127.0.0.1', () => {
+  console.log(`pelican.dev (local): http://127.0.0.1:${PORT}/`);
+  console.log(`  /docs/*, ${ROOT_FILES.join(', ')} -> ${OUT}`);
+  console.log(`  everything else -> ${HUB.origin}`);
+});
diff --git a/scripts/check-content.mjs b/scripts/check-content.mjs
new file mode 100644
index 00000000..d26e81ed
--- /dev/null
+++ b/scripts/check-content.mjs
@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+/**
+ * Fails if a page in content/ could run code. The docs take pull requests from anyone, and
+ * MDX compiles every page into JavaScript that runs during the build and in readers'
+ * browsers, so anything a page puts into JavaScript is code: `import`/`export`, `{...}`
+ * expressions (`{(() => { while (true) {} })()}` would hang the build), JSX attribute
+ * values in braces, spread props, event handlers and `javascript:` URLs.
+ *
+ * So each page is parsed as MDX, the syntax the site compiles, and checked against an
+ * allowlist rather than searched for bad words:
+ *   - no `import` or `export`;
+ *   - no `{expression}`, except a comment (`{/* ... *\/}`);
+ *   - only the components mdx-components.tsx gives pages, and a short list of HTML tags;
+ *   - attributes are plain: no spread, no `on*` handlers, no `dangerouslySetInnerHTML`,
+ *     no `javascript:`, `vbscript:` or `data:` URLs, and a `{value}` may only be literal
+ *     data (strings, numbers, booleans, null, and arrays or objects of those), as in
+ *     <SetupPanel fields={['domain', 'php']} />;
+ *   - Markdown links and images don't use those URL schemes either.
+ * Code blocks and `inline code` are text to the parser, so a snippet like
+ * `export CF_Token=...` is fine.
+ *
+ *   node scripts/check-content.mjs [dir]     (default: content)
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import { mdxFromMarkdown } from 'mdast-util-mdx';
+import { mdxjs } from 'micromark-extension-mdxjs';
+
+const root = process.argv[2] ?? 'content';
+
+/** The components mdx-components.tsx gives pages (its own and Fumadocs' defaults). */
+const COMPONENTS = new Set(['Admonition', 'Tabs', 'TabItem', 'Link', 'Mermaid', 'SetupPanel', 'Card', 'Cards', 'Callout']);
+
+/** HTML a page may write as tags. Markdown covers the rest. */
+const HTML = new Set([
+  'details', 'summary', 'br', 'kbd', 'sub', 'sup', 'abbr', 'mark', 'small', 'span', 'div', 'p',
+  'a', 'img', 'code', 'pre', 'strong', 'em', 'ul', 'ol', 'li',
+  'table', 'thead', 'tbody', 'tr', 'th', 'td',
+]);
+
+const UNSAFE_URL = /^(javascript|vbscript|data):/;
+
+function walk(dir) {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(dir, entry.name);
+    return entry.isDirectory() ? walk(path) : [path];
+  });
+}
+
+/** Blank out YAML frontmatter, keeping its lines so positions still match the file. */
+function withoutFrontmatter(source) {
+  const match = source.match(/^---\r?\n[\s\S]*?\r?\n---(?=\r?\n|$)/);
+  return match ? match[0].replace(/[^\n]/g, '') + source.slice(match[0].length) : source;
+}
+
+/** Browsers ignore whitespace and control characters inside a scheme (`java\tscript:`). */
+function isUnsafeUrl(value) {
+  return UNSAFE_URL.test(value.replace(/[\u0000- ]/g, '').toLowerCase());
+}
+
+/** True when an estree expression is plain data: no calls, functions, names or operators. */
+function isLiteralData(node) {
+  switch (node?.type) {
+    case 'Literal':
+      return true;
+    case 'TemplateLiteral':
+      return node.expressions.length === 0;
+    case 'UnaryExpression':
+      return (node.operator === '-' || node.operator === '+') && node.argument.type === 'Literal' && typeof node.argument.value === 'number';
+    case 'ArrayExpression':
+      return node.elements.every((element) => element === null || isLiteralData(element));
+    case 'ObjectExpression':
+      return node.properties.every(
+        (property) => property.type === 'Property' && property.kind === 'init' && !property.computed && !property.method && !property.shorthand && isLiteralData(property.value),
+      );
+    default:
+      return false;
+  }
+}
+
+/** Every string in literal data, nested ones included, so `{'javascript:...'}` is checked like a quoted value. */
+function literalStrings(node) {
+  switch (node?.type) {
+    case 'Literal':
+      return typeof node.value === 'string' ? [node.value] : [];
+    case 'TemplateLiteral':
+      return node.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
+    case 'ArrayExpression':
+      return node.elements.flatMap(literalStrings);
+    case 'ObjectExpression':
+      return node.properties.flatMap((property) => literalStrings(property.value));
+    default:
+      return [];
+  }
+}
+
+/** The single expression in an attribute value's `{...}`, or null if there isn't exactly one. */
+function attributeExpression(value) {
+  const body = value.data?.estree?.body;
+  return body?.length === 1 && body[0].type === 'ExpressionStatement' ? body[0].expression : null;
+}
+
+function checkNode(node, report) {
+  switch (node.type) {
+    case 'mdxjsEsm':
+      report(node, `${node.value.trim().split(/\s/)[0]} statement: ${node.value.trim().split('\n')[0]}`);
+      return;
+    case 'mdxFlowExpression':
+    case 'mdxTextExpression':
+      // A comment ({/* ... */}) compiles to nothing; anything else is code.
+      if (node.data?.estree?.body.length !== 0) report(node, `{expression}: {${node.value.trim().slice(0, 60)}}`);
+      return;
+    case 'mdxJsxFlowElement':
+    case 'mdxJsxTextElement':
+      checkElement(node, report);
+      return;
+    case 'link':
+    case 'image':
+    case 'definition':
+      if (isUnsafeUrl(node.url)) report(node, `unsafe URL: ${node.url.slice(0, 60)}`);
+      return;
+  }
+}
+
+function checkElement(node, report) {
+  const name = node.name;
+  if (name !== null && !COMPONENTS.has(name) && !HTML.has(name)) {
+    report(node, `<${name}> is not a component pages can use (see COMPONENTS and HTML in this script)`);
+  }
+
+  for (const attribute of node.attributes) {
+    if (attribute.type !== 'mdxJsxAttribute') {
+      report(node, `<${name}> has a spread attribute {${attribute.value.trim().slice(0, 40)}}`);
+      continue;
+    }
+
+    const where = `<${name} ${attribute.name}>`;
+    if (/^on/i.test(attribute.name) || attribute.name === 'dangerouslySetInnerHTML') {
+      report(node, `${where}: event handlers and dangerouslySetInnerHTML are not allowed`);
+      continue;
+    }
+
+    const value = attribute.value;
+    if (typeof value === 'string') {
+      if (isUnsafeUrl(value)) report(node, `${where}: unsafe URL ${value.slice(0, 60)}`);
+    } else if (value !== null && value !== undefined) {
+      const expression = attributeExpression(value);
+      if (!isLiteralData(expression)) {
+        report(node, `${where}: {${value.value.trim().slice(0, 60)}} is code; only literal data is allowed`);
+      } else {
+        const unsafe = literalStrings(expression).find(isUnsafeUrl);
+        if (unsafe !== undefined) report(node, `${where}: unsafe URL ${unsafe.slice(0, 60)}`);
+      }
+    }
+  }
+}
+
+function checkFile(file, problems) {
+  const where = (node) => `${relative(process.cwd(), file)}:${node?.position?.start.line ?? '?'}`;
+
+  let tree;
+  try {
+    tree = fromMarkdown(withoutFrontmatter(readFileSync(file, 'utf8')), {
+      extensions: [mdxjs()],
+      mdastExtensions: [mdxFromMarkdown()],
+    });
+  } catch (error) {
+    const line = error.line ?? error.place?.line ?? error.place?.start?.line ?? '?';
+    problems.push(`${relative(process.cwd(), file)}:${line}  not valid MDX: ${error.reason ?? error.message}`);
+    return;
+  }
+
+  const report = (node, message) => problems.push(`${where(node)}  ${message}`);
+  const visit = (node) => {
+    checkNode(node, report);
+    for (const child of node.children ?? []) visit(child);
+  };
+  visit(tree);
+}
+
+const problems = [];
+const files = walk(root).filter((file) => /\.mdx?$/.test(file));
+for (const file of files) checkFile(file, problems);
+
+if (problems.length) {
+  console.error(`check-content: ${problems.length} problem(s) in ${root}/ (MDX that would run code):`);
+  for (const problem of problems) console.error(`  ${problem}`);
+  console.error('\nUse the components from mdx-components.tsx with plain attributes; code samples go in ``` blocks.');
+  process.exit(1);
+}
+
+console.log(`check-content: ${files.length} pages in ${root}/, no code: no import/export, {expressions}, handlers or unsafe URLs. ok`);
diff --git a/scripts/check-content.test.mjs b/scripts/check-content.test.mjs
new file mode 100644
index 00000000..99175e5b
--- /dev/null
+++ b/scripts/check-content.test.mjs
@@ -0,0 +1,80 @@
+// node --test scripts/check-content.test.mjs  (bun run test:content)
+// Runs check-content.mjs on one-page folders: pages that could run code must fail, the
+// MDX the docs really use must pass.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const script = new URL('./check-content.mjs', import.meta.url).pathname;
+
+function check(page) {
+  const dir = mkdtempSync(join(tmpdir(), 'check-content-'));
+  writeFileSync(join(dir, 'page.mdx'), `---\ntitle: Test\n---\n\n${page}\n`);
+  const result = spawnSync(process.execPath, [script, dir], { encoding: 'utf8' });
+  return { ok: result.status === 0, output: result.stdout + result.stderr };
+}
+
+const blocked = {
+  'an expression that would hang the build': '{(() => { while (true) {} })()}',
+  'an inline expression': 'Hello {process.exit(1)} world',
+  'an import': "import x from 'node:fs'",
+  'an export': 'export const a = 1',
+  'a script tag': '<script>alert(1)</script>',
+  'a component pages are not given': '<Evil />',
+  'code in an attribute': '<Admonition title={fetch("https://example.com")}>x</Admonition>',
+  'a function in an attribute': '<SetupPanel fields={() => []} />',
+  'a spread attribute': '<Tabs {...props}>x</Tabs>',
+  'an event handler': '<div onClick="alert(1)">x</div>',
+  'a lowercase event handler': '<img src="/a.png" onerror="alert(1)" />',
+  'dangerouslySetInnerHTML': '<div dangerouslySetInnerHTML={{ __html: "x" }} />',
+  'a javascript: link in JSX': '<a href="javascript:alert(1)">x</a>',
+  'a javascript: link with a tab in the scheme': '<Link to="java\tscript:alert(1)">x</Link>',
+  'a javascript: link in braces': "<a href={'javascript:alert(1)'}>x</a>",
+  'a data: link in a template literal': '<Link to={`data:text/html,x`}>x</Link>',
+  'a javascript: URL nested in literal data': "<Card title=\"x\" data={{ links: [{ href: 'JavaScript:alert(1)' }] }} />",
+  'a javascript: Markdown link': '[x](javascript:alert(1))',
+  'a data: Markdown image': '![x](data:text/html;base64,PHNjcmlwdD4=)',
+  'MDX that does not parse': '<Admonition>',
+};
+
+for (const [name, page] of Object.entries(blocked)) {
+  test(`fails on ${name}`, () => {
+    const { ok, output } = check(page);
+    assert.equal(ok, false, output);
+    assert.match(output, /problem/);
+  });
+}
+
+const allowed = {
+  'the components the docs use': [
+    '<Admonition type="warning" title="Back up first">',
+    '  Text',
+    '</Admonition>',
+    '',
+    '<Tabs groupId="webserver" queryString>',
+    '  <TabItem value="nginx" label="NGINX" default>NGINX</TabItem>',
+    '</Tabs>',
+    '',
+    '<details>',
+    '  <summary>More</summary>',
+    '  Hidden',
+    '</details>',
+  ].join('\n'),
+  'literal data in an attribute': "<SetupPanel fields={['domain', 'webserver', 'ssl', 'php', 'path']} />",
+  'nested literal data': '<Card title="x" data={{ size: -1, tags: ["a", `b`], on: true, none: null }} />',
+  'a comment': '{/* a note for editors */}',
+  // @mdx-js/mdx 3 compiles an indented import/export as a paragraph of text, not code.
+  'an indented export, which MDX reads as text': '  export const a = 1',
+  'code that only looks like code': '```sh\nexport CF_Token=abc\n```\n\nRun `import x` or `<script>` in a shell.',
+  'ordinary links': '[Docs](https://pelican.dev/docs) and [a page](./wings/update) and <Link to="/docs">x</Link>',
+};
+
+for (const [name, page] of Object.entries(allowed)) {
+  test(`passes ${name}`, () => {
+    const { ok, output } = check(page);
+    assert.equal(ok, true, output);
+  });
+}
diff --git a/scripts/check-paths.mjs b/scripts/check-paths.mjs
new file mode 100644
index 00000000..ae1f1de6
--- /dev/null
+++ b/scripts/check-paths.mjs
@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+/**
+ * After `next build`: every file in out/ must be under out/docs/, unless it is
+ * listed below. pelican.dev will send only /docs/* and the five root files to
+ * this build (a Cloudflare route; see router/README.md); the Hub serves every
+ * other path. A file outside out/docs/ that isn't listed would be unreachable
+ * on pelican.dev, or would mean a docs page depends on a path the Hub owns.
+ *
+ * It also reads every docs page (every .html file under out/docs/) and fails if one loads
+ * something (script, stylesheet, font, icon, image, share image) from outside
+ * /docs/: after the switch those paths are the Hub's.
+ *
+ *   node scripts/check-paths.mjs [outDir]     (default: out)
+ */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+
+/** Served at the site root by this build, also after the switch. */
+const ROOT_FILES = ['llms.txt', 'llms-full.txt', 'update-panel.sh', 'migrate-panel.sh', 'migrate-wings.sh'];
+
+/** Netlify's own files: it reads them, it doesn't serve them as pages. */
+const NETLIFY = [
+  '_redirects',
+  '_headers',
+  // Netlify serves out/404.html for every missing path, /docs/* included.
+  '404.html',
+];
+
+/**
+ * Prefix-matched paths that are reachable under /docs/ by a rewrite.
+ * _next/: the JS, CSS and fonts. Pages load them from /docs/_next/ (assetPrefix
+ * in next.config.mjs); netlify.toml and router/dev-server.mjs map that to out/_next/.
+ */
+const MAPPED = ['_next/'];
+
+/**
+ * INTERIM: the landing pages (/, /eggs/, /support/, /faq/) and what only they
+ * use. Each entry: remove after the switch, together with the pages.
+ */
+const INTERIM = [
+  'index.html', // remove after the switch: the homepage
+  'index.txt', // remove after the switch: the homepage's navigation payload
+  '__next.', // remove after the switch: the homepage's navigation payloads (__next.*.txt)
+  'eggs/', // remove after the switch: /eggs/
+  'support/', // remove after the switch: /support/
+  'faq/', // remove after the switch: /faq/
+  'data/', // remove after the switch: egg details the /eggs/ page loads
+  'img/', // remove after the switch: images on the landing pages (eggs, games, plugins, sponsors)
+  'og/', // remove after the switch: share images of the landing pages
+  'sitemap.xml', // remove after the switch: the landing pages' sitemap (the Hub serves /sitemap.xml)
+  'robots.txt', // remove after the switch: the Hub serves /robots.txt
+  '404/', // remove after the switch: Next's copy of the 404 page (Netlify uses 404.html)
+  '_not-found/', // remove after the switch: the 404 page's navigation payloads
+];
+
+const outDir = process.argv[2] ?? 'out';
+
+function walk(dir) {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(dir, entry.name);
+    return entry.isDirectory() ? walk(path) : [path];
+  });
+}
+
+try {
+  statSync(outDir);
+} catch {
+  console.error(`check-paths: ${outDir}/ not found. Run the build first.`);
+  process.exit(1);
+}
+
+const files = walk(outDir).map((file) => relative(outDir, file).split(sep).join('/'));
+const counts = { docs: 0, root: 0, netlify: 0, mapped: 0, interim: 0 };
+const interimHits = new Map();
+const stray = [];
+
+const matches = (file, entry) => (entry.endsWith('/') || entry.endsWith('.') ? file.startsWith(entry) : file === entry);
+
+for (const file of files) {
+  if (file.startsWith('docs/')) counts.docs++;
+  else if (ROOT_FILES.includes(file)) counts.root++;
+  else if (NETLIFY.includes(file)) counts.netlify++;
+  else if (MAPPED.some((entry) => file.startsWith(entry))) counts.mapped++;
+  else {
+    const entry = INTERIM.find((e) => matches(file, e));
+    if (entry) {
+      counts.interim++;
+      interimHits.set(entry, (interimHits.get(entry) ?? 0) + 1);
+    } else stray.push(file);
+  }
+}
+
+const missing = ROOT_FILES.filter((file) => !files.includes(file));
+
+// What docs pages load: <script src>, <link href> (stylesheets, preloads, icons;
+// not canonical/alternate, which are links), <img src> and share-image <meta>.
+// Links (<a href>) may point anywhere.
+const TAGS = /<(script|link|img|meta)\b[^>]*>/g;
+const badRefs = new Set();
+for (const file of files.filter((f) => f.startsWith('docs/') && f.endsWith('.html'))) {
+  const html = readFileSync(join(outDir, file), 'utf8');
+  for (const [tag, name] of html.matchAll(TAGS)) {
+    let url;
+    if (name === 'link') url = /rel="(canonical|alternate)"/.test(tag) ? undefined : /\shref="([^"]+)"/.exec(tag)?.[1];
+    else if (name === 'meta') url = /(og:image|twitter:image)"/.test(tag) ? /\scontent="([^"]+)"/.exec(tag)?.[1] : undefined;
+    else url = /\ssrc="([^"]+)"/.exec(tag)?.[1];
+    if (!url) continue;
+    const path = url.replace(/^https:\/\/pelican\.dev(?=\/)/, '');
+    if (!path.startsWith('/') || path.startsWith('//')) continue; // other sites
+    if (path.startsWith('/docs/') || ROOT_FILES.includes(path.slice(1))) continue;
+    badRefs.add(`${path}  (first seen in ${file})`);
+  }
+}
+
+console.log(`check-paths: ${files.length} files in ${outDir}/`);
+console.log(`  under docs/          ${counts.docs}`);
+console.log(`  root files           ${counts.root} (${ROOT_FILES.join(', ')})`);
+console.log(`  _next/ (/docs/_next) ${counts.mapped}`);
+console.log(`  Netlify              ${counts.netlify}`);
+console.log(`  INTERIM              ${counts.interim} (remove after the switch)`);
+for (const [entry, n] of interimHits) console.log(`    ${entry.padEnd(14)} ${n}`);
+
+let failed = false;
+if (missing.length) {
+  failed = true;
+  console.error(`\nMissing root files: ${missing.join(', ')}`);
+}
+if (stray.length) {
+  failed = true;
+  console.error(`\n${stray.length} file(s) outside docs/ that pelican.dev would not route to this build:`);
+  for (const file of stray.slice(0, 50)) console.error(`  ${file}`);
+  if (stray.length > 50) console.error(`  … and ${stray.length - 50} more`);
+  console.error('\nMove them under /docs/, or add them to a list in scripts/check-paths.mjs with a reason.');
+}
+
+if (badRefs.size) {
+  failed = true;
+  console.error(`\nDocs pages load ${badRefs.size} path(s) outside /docs/ (the Hub's after the switch):`);
+  for (const ref of [...badRefs].slice(0, 50)) console.error(`  ${ref}`);
+}
+
+if (failed) process.exit(1);
+console.log('\ncheck-paths: ok');
diff --git a/ui/nav.json b/ui/nav.json
new file mode 100644
index 00000000..093f65fa
--- /dev/null
+++ b/ui/nav.json
@@ -0,0 +1,39 @@
+{
+  "items": [
+    { "label": "Docs", "href": "/docs/" },
+    { "label": "Plugins", "href": "/plugins" },
+    { "label": "Eggs", "href": "/eggs" },
+    { "label": "Community", "href": "https://discord.gg/pelican-panel" },
+    { "label": "Sponsor", "href": "/sponsor" }
+  ],
+  "footer": [
+    {
+      "title": "Product",
+      "items": [
+        { "label": "Documentation", "href": "/docs/" },
+        { "label": "Install guide", "href": "/docs/panel/getting-started/" },
+        { "label": "Live demo", "href": "https://demo.pelican.dev" },
+        { "label": "Plugin Hub", "href": "/plugins" }
+      ]
+    },
+    {
+      "title": "Community",
+      "items": [
+        { "label": "Discord", "href": "https://discord.gg/pelican-panel" },
+        { "label": "GitHub", "href": "https://github.com/pelican/panel" },
+        { "label": "Contributors", "href": "/docs/contributors/" },
+        { "label": "Translate", "href": "/docs/guides/translating/" }
+      ]
+    },
+    {
+      "title": "Project",
+      "items": [
+        { "label": "FAQ", "href": "/faq/" },
+        { "label": "Sponsor", "href": "/sponsor" },
+        { "label": "Versioning", "href": "/docs/versioning/" },
+        { "label": "Comparison", "href": "/docs/comparison/" }
+      ]
+    }
+  ],
+  "cta": { "label": "Get started", "href": "/docs/panel/getting-started/" }
+}
diff --git a/ui/tokens.css b/ui/tokens.css
new file mode 100644
index 00000000..01418fb8
--- /dev/null
+++ b/ui/tokens.css
@@ -0,0 +1,117 @@
+/* =========================================================================
+ * pelican.dev design tokens, V12 "B v3" (light) and "V3 · Night" (dark).
+ *
+ * The one source for the colours, font stacks and sizes the site uses. This
+ * repo imports it (app/global.css, which loads on every page), and the build
+ * publishes it at /docs/ui/v1/tokens.css for the Hub to copy, so both halves of
+ * pelican.dev draw with the same values. Plain CSS (no Tailwind at-rules), so
+ * it works anywhere.
+ *
+ * Only custom properties live here; the rules that use them stay in
+ * app/(landing)/home.css (the `.pl` pages) and app/global.css (the docs).
+ *
+ * Dark mode: next-themes puts `dark` on <html> before the first paint (system
+ * setting by default; the switch in either nav overrides it and stores the
+ * choice in localStorage "theme", shared by the docs and the Hub).
+ * ====================================================================== */
+
+/* ---- Fonts ---------------------------------------------------------------
+ * Bricolage Grotesque (display, 800), Instrument Sans (text), JetBrains Mono
+ * (code). In this repo next/font sets these three variables on <html> with its
+ * own hashed family names; these are the fallbacks for anyone self-hosting the
+ * faces under their real names. :where() keeps them at zero specificity, so
+ * next/font's class always wins.
+ * ------------------------------------------------------------------------- */
+:where(:root) {
+  --pl-font-display: 'Bricolage Grotesque', 'Bricolage Grotesque Fallback';
+  --pl-font-text: 'Instrument Sans', 'Instrument Sans Fallback';
+  --font-jetbrains: 'JetBrains Mono', 'JetBrains Mono Fallback';
+}
+
+/* ---- Page-wide brand colours (the docs chrome reads these) --------------- */
+:root {
+  --pl-ink: #04121c;
+  --pl-sky: #38bdf8;
+  --pl-sky-deep: #0b79ad;
+  --pl-white: #ffffff;
+  --pl-paper: #f3f7f9;
+  /* the thick edge and hard shadow used on cards, code and callouts */
+  --pl-edge: var(--pl-ink);
+  --pl-shadow: var(--pl-ink);
+}
+
+.dark {
+  --pl-edge: #2e4756;
+  --pl-shadow: #38bdf8;
+}
+
+/* ---- The `.pl` design (homepage, site pages, the Hub's pages) ------------
+ * `.pl` is the wrapper around a V12 page.
+ * ------------------------------------------------------------------------- */
+.pl {
+  --ink: #04121c;
+  --sky: #38bdf8;
+  --sky-deep: #0b79ad;
+  --white: #ffffff;
+  --paper: #f3f7f9;
+  --text: #1f3644;
+  --on-ink-soft: #b9ccd6;
+  --line-on-ink: #2e4756;
+  --line: 3px solid var(--ink);
+  --pad: clamp(16px, 4cqi, 64px);
+  --section: clamp(72px, 9cqi, 120px);
+  --font-display: var(--pl-font-display), 'Helvetica Neue', sans-serif;
+  --font-text: var(--pl-font-text), 'Helvetica Neue', system-ui, sans-serif;
+  --font-code: var(--font-jetbrains), ui-monospace, Menlo, monospace;
+  --btn-shadow: var(--ink);
+  /* Theme roles. --ink and --white flip in dark mode (below); these stay put or
+     carry the role the light values had. */
+  --navy: #04121c; /* always navy: text on sky, chrome that is dark in both themes */
+  --snow: #ffffff; /* always white: text on navy */
+  --shadow: var(--ink); /* hard offset shadow on cards */
+  --muted: #33505f;
+  --faint: #8aa3b0;
+  --rule: #d5e3ea;
+  --rule-soft: #e3edf2;
+  --rule-ink: rgba(4, 18, 28, 0.12);
+  --chip: #e3edf2;
+  --hover: #e8f6fd;
+  --hover-strong: #cdeefd;
+  --on-sky-soft: #0b2a3b;
+  --kbd-bg: rgba(255, 255, 255, 0.5);
+}
+
+/* In the dark, --ink and --white swap roles: --ink is the foreground (text, the
+   3px borders) and --white the card surface. Shadows turn sky; sky bands become
+   navy grounds; navy (.on-ink) sections keep their light values. */
+.dark .pl {
+  --ground: #04121c;
+  --deep: #071926;
+  --code: #000b12;
+  --ink: #ffffff;
+  --white: #0a1e2b;
+  --card: #0a1e2b; /* the surface, also inside .on-ink where --white is white again */
+  --paper: #071926;
+  --text: #d4e3ea;
+  --muted: #b9ccd6;
+  --faint: #7f99a6;
+  --rule: #2e4756;
+  --rule-soft: #1f3a4a;
+  --rule-ink: rgba(185, 204, 214, 0.18);
+  --chip: #14304a;
+  --hover: #0f2c3d;
+  --hover-strong: #123a52;
+  --on-sky-soft: #b9ccd6;
+  --kbd-bg: rgba(255, 255, 255, 0.1);
+  --sky-deep: #38bdf8;
+  --shadow: var(--sky);
+  --btn-shadow: var(--sky);
+}
+
+/* Navy sections were already dark: give them back their light values. */
+.dark .pl .on-ink {
+  --ink: #04121c;
+  --white: #ffffff;
+  --line: 3px solid var(--line-on-ink);
+  --btn-shadow: var(--snow);
+}