Make v2 legacy redirects merge-safe

IA.md

@@ -310,7 +310,7 @@ Two notes:
 - [x] `/integrations/drizzle` — overview and generated `@cipherstash/stack-drizzle` API reference
 - [x] `/integrations/prisma` — Prisma ORM 8 RC, EQL v3, Prisma Postgres, Prisma Compute, and generated API reference
 - [ ] `/integrations/aws/rds-aurora` — Proxy path
-- [ ] `/integrations/aws/dynamodb`
+- [x] `/integrations/aws/dynamodb` — Stack 1.0 helper, equality lookups, and legacy reads
 - [ ] `/integrations/clerk`
 - [ ] `/integrations/auth0` — end-to-end example (Clerk parity)
 - [ ] `/integrations/okta` — end-to-end example (Clerk parity)
@@ -349,13 +349,11 @@ and the old `/compare/*` paths redirect there (`v2-redirects.mjs`).
 - [ ] `/guides/development/schema-design` — which encrypted type/variant per column (CIP-3327)
 - [ ] `/guides/development/testing-and-ci` (port deploy/testing)
 - [ ] `/guides/development/team-onboarding` (port)
-- [ ] `/guides/migration/encrypt-existing-data` — the backfill guide, runnable (CIP-3329)
+- [x] `/guides/migration` — the backfill guide, runnable (CIP-3329)
 - [ ] ⛔ `/guides/migration/upgrading-from-eql-v2` — REQUIRED; mechanics pending product answer (CIP-3329)
 - [ ] `/guides/migration/adopting-incrementally` (CIP-3329)
 - [ ] `/guides/migration/key-rotation-operations`
-- [ ] `/guides/deployment/going-to-production` (port)
-- [ ] `/guides/deployment/serverless-and-bundling` (merge bundling + sst)
-- [ ] `/guides/deployment/proxy-deployment` (merge proxy Docker + aws-ecs)
+- [x] `/guides/deployment` — production rollout, bundling, CI, onboarding, and Proxy deployment consolidated into one page
 - [ ] `/guides/troubleshooting` index — symptom-based router
 - [ ] `/guides/troubleshooting/query-performance` — seq-scan diagnosis, typed-operand gotcha
 - [ ] `/guides/troubleshooting/runtime-errors`
@@ -367,14 +365,14 @@ and the old `/compare/*` paths redirect there (`v2-redirects.mjs`).
 - [x] Section scaffold 🚧
 - [x] `/security/cryptography` — ONE reconciled ZeroKMS mechanism story (kills the 3 conflicting accounts)
 - [ ] `/security/zerokms`
-- [ ] `/security/cts` — auth layer architecture (CIP-3330)
+- [x] `/security/cts` — auth layer architecture (hidden from nav until the section is expanded)
 - [ ] `/security/stack-sdk`
 - [ ] `/security/proxy`
 - [ ] `/security/threat-scenarios`
 - [ ] ⛔ `/security/availability-and-continuity` — DR (port) + SLA + exit story; pending SLA answer
-- [ ] ⛔ `/security/audit-logging` — pending retention answer
+- [x] `/security/audit-logging` — Proxy event mechanics; retention/export remains deployment-specific and the nav stays hidden
 - [ ] ⛔ `/security/key-ownership` — BYOK/self-hosted; pending product answer
-- [ ] `/security/compliance` index — framework mapping (port, good)
+- [x] `/security/compliance` index — capability/responsibility mapping (nav remains hidden)
 - [ ] `/security/compliance/hipaa` — BAA scope, §164.312 mapping (CIP-3332)
 - [ ] `/security/compliance/soc2` — verify Type II report exists
 - [ ] `/security/compliance/gdpr`
@@ -384,7 +382,7 @@ and the old `/compare/*` paths redirect there (`v2-redirects.mjs`).
 - [x] Section scaffold 🚧
 - [ ] `/solutions/protecting-pii` (new)
 - [ ] `/solutions/healthcare-hipaa` (new; pairs with compliance/hipaa)
-- [ ] `/solutions/ai-and-rag` (port use-cases/ai-rag)
+- [x] `/solutions/ai-and-rag` — source protection, retrieval flow, and isolation boundaries
 - [ ] `/solutions/data-residency` (port)
 - [ ] `/solutions/provable-access` (port)
 
@@ -419,8 +417,8 @@ and the old `/compare/*` paths redirect there (`v2-redirects.mjs`).
 - **Auth (CIP-3330):**
 - [ ] `/reference/auth/lock-contexts`
 - [ ] `/reference/auth/cts-tokens`
-- [ ] `/reference/auth/oidc-configuration`
-- [ ] `/reference/auth/access-keys` (+ clients)
+- [x] `/reference/auth/oidc-configuration`
+- [x] `/reference/auth/access-keys` + `/reference/auth/clients`
 - **CLI / Proxy / Workspace:**
 - [ ] `/reference/cli/*` (port 9 pages)
 - [ ] `/reference/proxy/*` (configuration, message-flow, multitenant, errors)

content/docs/concepts/key-management.mdx

@@ -161,7 +161,7 @@ The design deliberately keeps the durable pieces small and separated:
 | ZeroKMS | Authority keys and access-control state |
 | Nowhere | Plaintext data keys |
 
-Your encrypted data stays in your database. ZeroKMS handles key material, not application data. This separation also shapes recovery: restoring ZeroKMS restores the ability to reproduce keys; it does not require CipherStash to restore or move your encrypted database. See [Disaster recovery](/stack/cipherstash/kms/disaster-recovery).
+Your encrypted data stays in your database. ZeroKMS handles key material, not application data. This separation also shapes recovery: restoring ZeroKMS restores the ability to reproduce keys; it does not require CipherStash to restore or move your encrypted database. Multi-region application patterns are covered in [Data residency](/solutions/data-residency#multi-region-with-regional-key-isolation).
 
 ## ZeroKMS and searchable encryption
 

content/docs/get-started/choose-your-stack.mdx

@@ -33,7 +33,7 @@ EQL installs into any Postgres you can connect to. It needs no extension, no sup
 | Neon, RDS, Aurora, Cloud SQL | Yes | `stash eql install` detects a non-superuser role and adapts. |
 | Self-hosted Postgres | Yes | Full operator-class support, so the ORE ordering mechanism is available. |
 | Postgres behind PgBouncer | Yes | Transaction pooling is fine. Proxy has its own pooling. |
-| DynamoDB | Yes, without EQL | [DynamoDB integration](/stack/cipherstash/encryption/dynamodb). Encrypted attributes and HMAC key lookups; no EQL, because there's no Postgres. |
+| DynamoDB | Yes, without EQL | [DynamoDB integration](/integrations/aws/dynamodb). Encrypted attributes and HMAC key lookups; no EQL, because there's no Postgres. |
 | MySQL, MongoDB, others | Not yet | The SDK still encrypts values for you, but nothing is queryable server-side. |
 
 <Callout type="info">

content/docs/get-started/what-is-cipherstash.mdx

@@ -62,7 +62,7 @@ flowchart TB
 
 You rarely need all of them at once. The Stack SDK plus EQL is the common case. Proxy is the alternative to the SDK, not an addition to it.
 
-Note that **EQL is only for Postgres**. The SDK also encrypts values that never touch a database, and non-Postgres stores like [DynamoDB](/stack/cipherstash/encryption/dynamodb), with no EQL involved.
+Note that **EQL is only for Postgres**. The SDK also encrypts values that never touch a database, and non-Postgres stores like [DynamoDB](/integrations/aws/dynamodb), with no EQL involved.
 
 ## Choosing what each column reveals
 
@@ -99,7 +99,7 @@ Encryption in use is usually assumed to be slow. It is, if you do it with fully
 | vs fully homomorphic encryption | [410,000x faster](https://github.com/cipherstash/tfhe-ore-bench) on the per-row primitives a database actually executes. |
 | vs AWS KMS | Up to 14x the throughput, because ZeroKMS derives keys in bulk rather than one call per value. |
 
-The FHE comparison is an open benchmark harness you can run yourself. See [CipherStash vs FHE](/stack/reference/comparisons/fhe) for the methodology, and for the workloads where FHE is genuinely the right tool.
+The FHE comparison is an open benchmark harness you can run yourself. See [CipherStash vs FHE](/concepts/compare/fhe) for the methodology, and for the workloads where FHE is genuinely the right tool.
 
 ## What it protects against
 

content/docs/guides/deployment/index.mdx → content/docs/guides/deployment.mdx

@@ -1,6 +1,5 @@
 ---
 title: Deployment
-navTitle: Overview
 description: "Deploy CipherStash changes safely across environments, with explicit credential, migration, rollout, monitoring, and rollback gates."
 type: guide
 components: [encryption, eql, cli]
@@ -9,7 +8,7 @@ audience: [developer]
 
 CipherStash deployments coordinate application code, database schema, and credentials. Treat each independently deployable stage as a release with its own verification and rollback gate.
 
-For the detailed dual-write, backfill, and cutover procedure for populated columns, follow [Encrypt existing data](/guides/migration/encrypt-existing-data). This page covers the production rollout around that migration.
+For the detailed dual-write, backfill, and cutover procedure for populated columns, follow [Data migration](/guides/migration). This page covers the production rollout around that migration.
 
 ## Before the first deployment
 
@@ -96,3 +95,90 @@ Test the correctness of returned values, not only request success rates. An inco
 Prefer application rollbacks while both plaintext and encrypted columns are being maintained. Before plaintext removal, a read cutover can be reversed without changing data: point reads back to the original columns and leave dual-writes running.
 
 After plaintext is dropped, rollback becomes a data-recovery operation. Avoid reaching that stage until operational evidence shows the encrypted path is stable and every supported application version has moved forward.
+
+## Serverless and bundled applications
+
+`@cipherstash/stack` must remain a runtime dependency when a build tool creates
+a server bundle. Configure the bundler to leave the package external, then make
+sure the deployment artifact installs it for the target platform.
+
+For Next.js, use `serverExternalPackages`:
+
+```typescript filename="next.config.ts"
+const nextConfig = {
+  serverExternalPackages: ["@cipherstash/stack"],
+}
+
+export default nextConfig
+```
+
+For esbuild, pass `--external:@cipherstash/stack`; for webpack, declare it as a
+CommonJS external. An SST function needs both the esbuild exclusion and a
+runtime install:
+
+```typescript filename="sst.config.ts"
+{
+  nodejs: {
+    esbuild: { external: ["@cipherstash/stack"] },
+    install: ["@cipherstash/stack"],
+  },
+}
+```
+
+Build and start the artifact in a Linux container before release when local
+development uses macOS or Windows. This catches a lockfile or deployment bundle
+that omitted the target platform's runtime package.
+
+## Testing and CI
+
+Use a separate workspace and database for integration tests. Supply the test
+workspace's four `CS_*` credentials only to the CI job, install the same EQL
+release used by production, and test:
+
+- encryption followed by decryption returns the original typed value;
+- every required equality, range, ordering, token, or JSON query returns the
+  expected records;
+- a client without the required keyset grant cannot decrypt the data;
+- schema migrations and application code work in both rolling-deployment
+  orders.
+
+Mocks are useful for business logic that merely passes encrypted values
+through, but they do not test ciphertext compatibility, key access, query
+terms, or EQL behavior. Keep at least one real end-to-end test for every
+encrypted query capability used in production.
+
+## Team onboarding
+
+Invite each developer to the organization and workspace, then have them run:
+
+```bash
+npx stash init
+```
+
+Each device receives its own developer identity and client key. Do not share
+production credentials with developers or copy one developer's local profile
+into CI. Remove a departing developer from the workspace and revoke their
+device client keys without changing application credentials.
+
+See [workspace members](/reference/workspace/members) and
+[client keys](/reference/auth/clients) for the complete access model.
+
+## Deploying Proxy
+
+Run CipherStash Proxy as a container in the same private network as PostgreSQL.
+Supply database credentials and CipherStash application credentials from the
+platform's secret manager, expose the PostgreSQL listener only to application
+clients, and expose health or metrics endpoints only to the monitoring plane.
+
+For ECS, Kubernetes, or another orchestrator, keep these concerns separate:
+
+1. Pull the published Proxy image from the approved registry.
+2. Grant the task or pod permission to read only its deployment secrets.
+3. Configure security groups or network policies for application → Proxy and
+   Proxy → database traffic.
+4. Roll out at least two instances where connection availability requires it.
+5. Verify a plaintext write, encrypted database value, encrypted query, and
+   decrypted read through the deployed endpoint.
+
+Use the [Proxy configuration reference](/reference/proxy/configuration) for
+environment variables, TOML settings, ports, logging, and metrics.

content/docs/guides/index.mdx

@@ -1,10 +1,11 @@
 ---
 title: Guides
-navTitle: Overview
-description: "Task-oriented guides: development workflow, data migration, deployment, and troubleshooting."
+description: "Deployment and data migration guidance for CipherStash."
 type: guide
 ---
 
-This section is being built as part of the docs V2 overhaul ([CIP-3307](https://linear.app/cipherstash/issue/CIP-3307)). Track progress in [IA.md](https://github.com/cipherstash/docs/blob/v2/IA.md).
-
-Until it lands, current documentation lives in the [existing docs](/stack).
+{/*
+  Fumadocs requires an index document when generating a metadata-backed folder.
+  meta.json excludes this file from the page tree, and Next redirects its route
+  to Deployment.
+*/}

content/docs/guides/meta.json

@@ -1,5 +1,5 @@
 {
   "title": "Guides",
   "icon": "Wrench",
-  "pages": ["index", "..."]
+  "pages": ["!index", "deployment", "migration", "..."]
 }

content/docs/guides/migration/encrypt-existing-data.mdx → content/docs/guides/migration.mdx

@@ -1,5 +1,6 @@
 ---
-title: Encrypt existing data
+title: Data migration
+navTitle: Data migration
 description: "Move populated plaintext columns to searchable encryption with dual-writes, a resumable backfill, and a reversible read cutover."
 type: guide
 components: [encryption, eql, cli]

content/docs/index.mdx

@@ -24,10 +24,10 @@ agent, a curious insider: they all see ciphertext with no key.
 <Cards>
   <Card title="Integrations" href="/integrations" description="Platforms, ORMs, frameworks, auth providers, and runtimes." />
   <Card title="Searchable encryption" href="/concepts/searchable-encryption" description="How encrypted queries work and what each query capability enables." />
-  <Card title="Guides" href="/guides" description="Development workflow, data migration, deployment, and troubleshooting." />
+  <Card title="Guides" href="/guides/deployment" description="Deployment and data migration guidance for CipherStash." />
   <Card title="Architecture & security" href="/security" description="Trust model, components, availability, audit, and compliance, for security review." />
   <Card title="Solutions" href="/solutions" description="PII protection, HIPAA, AI/RAG, data residency, and provable access." />
-  <Card title="Reference" href="/reference" description="EQL, the Stack SDK, Auth, the CLI, and Proxy: precise API documentation." />
+  <Card title="Reference" href="/reference/eql" description="EQL, the Stack SDK, Auth, the CLI, and Proxy: precise API documentation." />
 </Cards>
 
 ## AI-ready documentation