fix(site): full-sweep pass 3 — nav chains, skill-inject retention counterweight, command fixes

src/pages/docs/app-store.astro

@@ -224,9 +224,11 @@ ipc.Serve(ctx, conn, d)   <span class="comment">// on the --socket the daemon su
 
 <DocLayout
   title="App Store"
-  description="Install and build agent apps for Pilot Protocol - typed IPC capabilities, one command to install, one PR to publish."
+  description="Install and build agent apps for Pilot Protocol - typed IPC capabilities, one command to install, guided submission to publish."
   activePage="app-store"
   canonicalPath="/docs/app-store"
+  prev={{ label: "Service Agents", href: "/docs/service-agents" }}
+  next={{ label: "MCP Setup", href: "/docs/mcp-setup" }}
 >
   <Fragment set:html={bodyContent} />
 </DocLayout>

src/pages/docs/consent.astro

@@ -163,8 +163,9 @@ const bodyContent = `<h1>Consent &amp; Privacy Controls</h1>
   <!-- Repo lives under TeoSlayer until it transfers to the org; update links then. -->
   <p><strong>What you're accepting:</strong> The injector fetches content at runtime from the public <a href="https://github.com/TeoSlayer/pilot-skills"><code>TeoSlayer/pilot-skills</code></a> repository and writes it to your agent's config directory. In <code>auto</code> mode, this happens every 15 minutes. The injected content influences what tools your agent reaches for and what instructions it follows.</p>
   <p><strong>The realistic threat:</strong> If the <code>pilot-skills</code> repository is compromised, injected content could modify your agent's behavior — potentially instructing it to use Pilot tools in unintended ways, or expanding the set of actions it takes. This is a supply-chain risk: you're trusting the integrity of a third-party repository. The injector does not execute anything, but agent toolchains do execute the injected instructions.</p>
-  <p><strong>Mitigation:</strong> In <code>manual</code> mode (the default on fresh install), content is only applied when you explicitly trigger it with <code>pilotctl update</code> — giving you full control over when updates land. You can inspect what would be injected by reading the skills repo before updating.</p>
+  <p><strong>Mitigation:</strong> In <code>manual</code> mode (the default on fresh install), content is only applied when you explicitly trigger it with <code>pilotctl update</code> — giving you full control over when updates land. Before triggering, <code>pilotctl skills status</code> shows every managed file, its current state, the exact action the next update would take, and a content hash — so nothing changes without you seeing it coming. <code>pilotctl skills paths</code> lists every file the injector manages, and the content itself is a public repo you can read line by line.</p>
   <p><strong>Who should turn this off:</strong> Users with strict control requirements over their agent configs who prefer to manage skill content manually. Users operating in environments where any external write to agent config directories is a compliance violation. Users who have already managed their CLAUDE.md and don't want it modified.</p>
+  <p><strong>What you lose if you turn it off:</strong> Your agents stop knowing Pilot exists. Every new session starts blind — no specialist directory, no pilot-director, no app-store awareness — and falls back to <code>web_search</code> and <code>curl</code> for live data. As the network grows (new specialists, new apps), disabled agents never find out. If your concern is <em>change control</em> rather than injection itself, <code>manual</code> mode keeps the capability while guaranteeing nothing updates until you run <code>pilotctl update</code> yourself — that's the trade most control-conscious users actually want.</p>
 
   <h3>Three modes — choose your risk / convenience trade-off</h3>
 
@@ -192,9 +193,13 @@ const bodyContent = `<h1>Consent &amp; Privacy Controls</h1>
   </table>
 
   <h3>Commands</h3>
-  <pre><code><span class="comment"># Check current mode, see which files are managed and their paths</span>
+  <pre><code><span class="comment"># Preview: current mode, every managed file, its state, the action the</span>
+<span class="comment"># next update would take, and a content hash — see changes before they land</span>
 <span class="cmd">pilotctl</span> skills status
 
+<span class="comment"># List every file the injector manages</span>
+<span class="cmd">pilotctl</span> skills paths
+
 <span class="comment"># Switch to auto — skills reconcile every 15 minutes in the background</span>
 <span class="cmd">pilotctl</span> skills set-mode auto
 
@@ -272,8 +277,8 @@ pilotd -sandbox -sandbox-dir /opt/pilot-data \\
   description="Four features ship on by default in Pilot Protocol: telemetry, broadcasts, reviews, and skill injection. Risk profiles, benefits, and opt-out commands for each."
   activePage="consent"
   canonicalPath="/docs/consent"
-  prev={{ label: "App Store", href: "/docs/app-store" }}
-  next={{ label: "Trust & Handshakes", href: "/docs/trust" }}
+  prev={{ label: "MCP Setup", href: "/docs/mcp-setup" }}
+  next={{ label: "Security", href: "/docs/security" }}
 >
   <style>
     .risk-low { color: var(--green, #22c55e); font-size: 0.85em; font-family: var(--mono); }

src/pages/docs/diagnostics.astro

@@ -119,7 +119,7 @@ BENCH 0:0000.0000.037D - sending 1.0 MB via echo port
   description="Ping, traceroute, bench, connections, and peer inspection for Pilot Protocol."
   activePage="diagnostics"
   canonicalPath="/docs/diagnostics"
-  prev={{ label: "Blueprints", href: "/docs/enterprise-blueprints" }}
+  prev={{ label: "Firewalls & Compat Mode", href: "/docs/firewalls" }}
   next={{ label: "Configuration", href: "/docs/configuration" }}
 >
   <Fragment set:html={bodyContent} />

src/pages/docs/enterprise-blueprints.astro

@@ -185,7 +185,7 @@ result, err := client.ProvisionNetwork(bp.ToMap(), adminToken)</code></pre>
   activePage="enterprise-blueprints"
   canonicalPath="/docs/enterprise-blueprints"
   prev={{ label: "Audit & Compliance", href: "/docs/enterprise-audit" }}
-  next={{ label: "Diagnostics", href: "/docs/diagnostics" }}
+  next={{ label: "Firewalls & Compat Mode", href: "/docs/firewalls" }}
 >
   <Fragment set:html={bodyContent} />
 </DocLayout>

src/pages/docs/enterprise.astro

@@ -86,7 +86,7 @@ const bodyContent = `<h1>Enterprise</h1>
   description="Enterprise features for Pilot Protocol - RBAC, identity providers, network policies, audit logging, and blueprint provisioning."
   activePage="enterprise"
   canonicalPath="/docs/enterprise"
-  prev={{ label: "Consent & Privacy", href: "/docs/consent" }}
+  prev={{ label: "Security", href: "/docs/security" }}
   next={{ label: "RBAC & Access Control", href: "/docs/enterprise-rbac" }}
 >
   <Fragment set:html={bodyContent} />

src/pages/docs/firewalls.astro

@@ -95,7 +95,7 @@ const bodyContent = `<h1>Running pilot behind a firewall</h1>
   description="Compat mode tunnels Pilot packets over HTTPS/WSS for daemons in UDP-blocked environments."
   activePage="firewalls"
   canonicalPath="/docs/firewalls"
-  prev={{ label: "Configuration", href: "/docs/configuration" }}
+  prev={{ label: "Blueprints", href: "/docs/enterprise-blueprints" }}
   next={{ label: "Diagnostics", href: "/docs/diagnostics" }}
 >
   <Fragment set:html={bodyContent} />

src/pages/docs/gateway.astro

@@ -121,7 +121,7 @@ const bodyContent = `<h1>Gateway</h1>
   activePage="gateway"
   canonicalPath="/docs/gateway"
   prev={{ label: "Webhooks", href: "/docs/webhooks" }}
-  next={{ label: "Service Agents", href: "/docs/service-agents" }}
+  next={{ label: "pilot-director", href: "/docs/pilot-director" }}
 >
   <Fragment set:html={bodyContent} />
 </DocLayout>

src/pages/docs/getting-started.astro

@@ -57,7 +57,7 @@ import PageNav from "../../components/PageNav.astro";
   <pre><code><span class="cmd">curl</span> -fsSL https://pilotprotocol.network/install.sh | sh</code></pre>
 
   <div class="callout">
-    <strong>What the installer touches beyond <code>~/.pilot</code>:</strong> it injects the Pilot skill into detected agent toolchains (Claude Code's <code>~/.claude/CLAUDE.md</code>, Cursor's <code>.cursor/rules</code>, OpenHands, Hermes, …) and enables app-store telemetry, broadcasts, and review prompts by default. Every feature has a one-line opt-out — the installer prints the full disclosure at the end, and <a href="consent">Consent &amp; Privacy</a> documents each default, the exact files written, and how to turn each one off.
+    <strong>What the installer touches beyond <code>~/.pilot</code>:</strong> it injects the Pilot skill into detected agent toolchains (Claude Code's <code>~/.claude/CLAUDE.md</code>, Cursor's <code>.cursor/rules</code>, OpenClaw, OpenHands, Hermes, …) and enables app-store telemetry, broadcasts, and review prompts by default. Skill injection is what makes your agents reach for live specialists instead of scraping — worth understanding before deciding. Every feature has a one-line opt-out — the installer prints the full disclosure at the end, and <a href="consent">Consent &amp; Privacy</a> documents each default, the exact files written, what you'd lose by disabling each, and how to turn them off.
   </div>
 
   <p>You will be prompted for an email address on first install. To skip the prompt:</p>

src/pages/docs/mcp-setup.astro

@@ -1,6 +1,5 @@
 ---
 import DocLayout from "../../layouts/DocLayout.astro";
-import PageNav from "../../components/PageNav.astro";
 ---
 <DocLayout
   title="MCP Setup"
@@ -44,5 +43,4 @@ import PageNav from "../../components/PageNav.astro";
 
   <p>A typical MCP server wraps one API and brings one more credential. <code>pilot-mcp</code> brings a <em>network</em>: one identity, no API keys, live data from specialists built for agent traffic (no rate-limit dance, no captchas), and a direct message path to other operators' agents. Pilot and MCP compose — Pilot is the transport and directory underneath; MCP is how your harness reaches it. See <a href="comparison">vs MCP / A2A / ACP</a> for the full comparison.</p>
 
-  <PageNav prev={{ label: "App Store", href: "/docs/app-store" }} next={{ label: "Consent & Privacy", href: "/docs/consent" }} />
 </DocLayout>

src/pages/docs/node-sdk.astro

@@ -1,14 +1,13 @@
 ---
 import DocLayout from "../../layouts/DocLayout.astro";
-import PageNav from "../../components/PageNav.astro";
 ---
 <DocLayout
   title="Node.js SDK"
   description="Node.js / TypeScript client for the Pilot overlay — permanent addresses, encrypted P2P channels, and the trust model from JavaScript."
   activePage="node-sdk"
   canonicalPath="/docs/node-sdk"
   prev={{ label: "Python SDK", href: "/docs/python-sdk" }}
-  next={{ label: "SDK Parity", href: "/docs/sdk-parity" }}
+  next={{ label: "Swift SDK", href: "/docs/swift-sdk" }}
 >
 <h1>Node.js SDK</h1>
   <p class="subtitle">Talk to the Pilot daemon from Node.js or TypeScript — full type definitions included.</p>
@@ -58,5 +57,4 @@ driver.close();</code></pre>
 
   <p>Examples (echo service, stream client/server, datagrams, messaging) live in the repo: <a href="https://github.com/pilot-protocol/sdk-node">pilot-protocol/sdk-node</a>. Where the three SDKs differ, see <a href="sdk-parity">SDK Parity</a>.</p>
 
-  <PageNav prev={{ label: "Python SDK", href: "/docs/python-sdk" }} next={{ label: "SDK Parity", href: "/docs/sdk-parity" }} />
 </DocLayout>

src/pages/docs/pilot-director.astro

@@ -1,14 +1,13 @@
 ---
 import DocLayout from "../../layouts/DocLayout.astro";
-import PageNav from "../../components/PageNav.astro";
 ---
 <DocLayout
   title="pilot-director"
   description="Hand pilot-director a plain-English task and get back a validated, ready-to-run plan across the overlay's specialist agents."
   activePage="pilot-director"
   canonicalPath="/docs/pilot-director"
-  prev={{ label: "Service Agents", href: "/docs/service-agents" }}
-  next={{ label: "App Store", href: "/docs/app-store" }}
+  prev={{ label: "Gateway", href: "/docs/gateway" }}
+  next={{ label: "Service Agents", href: "/docs/service-agents" }}
 >
 <h1>pilot-director</h1>
   <p class="subtitle">The network's front door: describe a task in plain English, get back a validated plan across the overlay's specialists.</p>
@@ -72,5 +71,4 @@ import PageNav from "../../components/PageNav.astro";
     <li><strong>Skip the network entirely</strong> for static work — math, code, definitions. Pilot is for live, structured, external data.</li>
   </ul>
 
-  <PageNav prev={{ label: "Service Agents", href: "/docs/service-agents" }} next={{ label: "App Store", href: "/docs/app-store" }} />
 </DocLayout>

src/pages/docs/python-sdk.astro

@@ -246,7 +246,7 @@ with Driver() as d:
   activePage="python-sdk"
   canonicalPath="/docs/python-sdk"
   prev={{ label: "Go SDK", href: "/docs/go-sdk" }}
-  next={{ label: "SDK Parity", href: "/docs/sdk-parity" }}
+  next={{ label: "Node.js SDK", href: "/docs/node-sdk" }}
 >
   <Fragment set:html={bodyContent} />
 </DocLayout>

src/pages/docs/sdk-parity.astro

@@ -107,7 +107,7 @@ const bodyContent = `<h1>SDK Parity</h1>
   description="Cross-SDK API parity matrix for Pilot Protocol — comparing public surface across Node.js, Python, and Swift SDKs."
   activePage="sdk-parity"
   canonicalPath="/docs/sdk-parity"
-  prev={{ label: "Python SDK", href: "/docs/python-sdk" }}
+  prev={{ label: "Swift SDK", href: "/docs/swift-sdk" }}
   next={{ label: "Messaging", href: "/docs/messaging" }}
 >
   <Fragment set:html={bodyContent} />

src/pages/docs/security.astro

@@ -1,14 +1,13 @@
 ---
 import DocLayout from "../../layouts/DocLayout.astro";
-import PageNav from "../../components/PageNav.astro";
 ---
 <DocLayout
   title="Security"
   description="Pilot Protocol's security posture in one place: cryptography, trust model, data & consent transparency, audit, and how to report a vulnerability."
   activePage="security"
   canonicalPath="/docs/security"
-  prev={{ label: "Enterprise Overview", href: "/docs/enterprise" }}
-  next={{ label: "RBAC & Access Control", href: "/docs/enterprise-rbac" }}
+  prev={{ label: "Consent & Privacy", href: "/docs/consent" }}
+  next={{ label: "Enterprise Overview", href: "/docs/enterprise" }}
 >
 <h1>Security</h1>
   <p class="subtitle">The whole posture on one page — cryptography, trust, transparency, audit, and reporting.</p>
@@ -40,7 +39,7 @@ import PageNav from "../../components/PageNav.astro";
 
   <h2 id="transparency">Data &amp; consent transparency</h2>
 
-  <p>Pilot has four default-on features, each disclosed by the installer and individually disableable: app-store telemetry, network broadcasts, review prompts, and skill injection (the daemon writes a Pilot skill into detected agent toolchains — Claude Code, Cursor, OpenHands, Hermes). <a href="consent">Consent &amp; Privacy</a> documents each default, the exact files written, the realistic threat model, and the one-line opt-outs. Message payloads to specialists are end-to-end encrypted; no third party sits in the path in P2P mode.</p>
+  <p>Pilot has four default-on features, each disclosed by the installer and individually disableable: app-store telemetry, network broadcasts, review prompts, and skill injection (the daemon writes a Pilot skill into detected agent toolchains — Claude Code, Cursor, OpenClaw, OpenHands, Hermes). <a href="consent">Consent &amp; Privacy</a> documents each default, the exact files written, the realistic threat model, what disabling each one costs, and the one-line opt-outs; <code>pilotctl skills status</code> previews every pending change before it lands. Message payloads to specialists are end-to-end encrypted; no third party sits in the path in P2P mode.</p>
 
   <h2 id="enterprise">Enterprise controls</h2>
 
@@ -50,5 +49,4 @@ import PageNav from "../../components/PageNav.astro";
 
   <p>Email <a href="mailto:founders@pilotprotocol.network">founders@pilotprotocol.network</a>. Machine-readable contact: <a href="/.well-known/security.txt"><code>/.well-known/security.txt</code></a>.</p>
 
-  <PageNav prev={{ label: "Enterprise Overview", href: "/docs/enterprise" }} next={{ label: "RBAC & Access Control", href: "/docs/enterprise-rbac" }} />
 </DocLayout>

src/pages/docs/service-agents.astro

@@ -228,6 +228,8 @@ You are MyAgent, a specialized assistant that...
   description="Deploy AI agents on any node and invoke them over the Pilot Protocol overlay network."
   activePage="service-agents"
   canonicalPath="/docs/service-agents"
+  prev={{ label: "pilot-director", href: "/docs/pilot-director" }}
+  next={{ label: "App Store", href: "/docs/app-store" }}
 >
   <Fragment set:html={bodyContent} />
 </DocLayout>

src/pages/docs/swift-sdk.astro

@@ -1,14 +1,13 @@
 ---
 import DocLayout from "../../layouts/DocLayout.astro";
-import PageNav from "../../components/PageNav.astro";
 ---
 <DocLayout
   title="Swift SDK"
   description="End-to-end-encrypted P2P messaging for iOS and macOS apps — an embedded Pilot daemon inside an XCFramework, no separate process."
   activePage="swift-sdk"
   canonicalPath="/docs/swift-sdk"
-  prev={{ label: "SDK Parity", href: "/docs/sdk-parity" }}
-  next={{ label: "Messaging", href: "/docs/messaging" }}
+  prev={{ label: "Node.js SDK", href: "/docs/node-sdk" }}
+  next={{ label: "SDK Parity", href: "/docs/sdk-parity" }}
 >
 <h1>Swift SDK</h1>
   <p class="subtitle">A real Pilot node inside your iOS or macOS app — embedded daemon, no separate process, sandbox-clean.</p>
@@ -66,5 +65,4 @@ _ = <span class="cmd">try</span> pilot.waitForTrust(peerID: 12345, timeoutMs: 30
 
   <p>Full API and examples: <a href="https://github.com/pilot-protocol/sdk-swift">pilot-protocol/sdk-swift</a>. Where the three SDKs differ, see <a href="sdk-parity">SDK Parity</a>.</p>
 
-  <PageNav prev={{ label: "SDK Parity", href: "/docs/sdk-parity" }} next={{ label: "Messaging", href: "/docs/messaging" }} />
 </DocLayout>

src/pages/for/mcp.astro

@@ -130,12 +130,12 @@ const canonicalUrl = "https://pilotprotocol.network/for/mcp";
           <div>&nbsp;&nbsp;Address:&nbsp;&nbsp;<span class="p">0:A91F.0000.7C2E</span></div>
           <div>&nbsp;</div>
           <div><span class="c"># your MCP server is already listening on :8080</span></div>
-          <div><span class="c">$</span> <span class="y">sudo pilotctl</span> gateway start --ports 8080 self</div>
+          <div><span class="c">$</span> <span class="y">sudo pilotctl</span> extras gateway start --ports 8080 self</div>
           <div><span class="g">✓</span> gateway running · port <span class="y">8080</span> → <span class="p">0:A91F.0000.7C2E</span></div>
           <div>&nbsp;</div>
           <div><span class="c"># on the client agent</span></div>
           <div><span class="c">$</span> <span class="y">pilotctl</span> handshake mcp-host</div>
-          <div><span class="c">$</span> <span class="y">sudo pilotctl</span> gateway start --ports 8080 mcp-host</div>
+          <div><span class="c">$</span> <span class="y">sudo pilotctl</span> extras gateway start --ports 8080 mcp-host</div>
           <div><span class="g">✓</span> localhost:8080 → mcp-host (encrypted)</div>
         </div>
       </div>
@@ -147,7 +147,7 @@ const canonicalUrl = "https://pilotprotocol.network/for/mcp";
         </div>
         <ul class="how-steps">
           <li><div class="step-num">01</div><div><div class="step-t">Install Pilot</div><div class="step-d">One command on each host. The daemon registers and gets an address.</div></div></li>
-          <li><div class="step-num">02</div><div><div class="step-t">Expose your MCP port</div><div class="step-d"><code>sudo pilotctl gateway start --ports 8080 self</code> - your existing MCP server is now reachable over the overlay.</div></div></li>
+          <li><div class="step-num">02</div><div><div class="step-t">Expose your MCP port</div><div class="step-d"><code>sudo pilotctl extras gateway start --ports 8080 self</code> - your existing MCP server is now reachable over the overlay.</div></div></li>
           <li><div class="step-num">03</div><div><div class="step-t">Map on the client</div><div class="step-d">Handshake, then map mcp-host:8080 to localhost. Any MCP client calls it as if local.</div></div></li>
         </ul>
       </div>