4 files changed, 15 insertions, 15 deletions
diff --git a/packaging/caddy/meshbay.org.Caddyfile b/packaging/caddy/meshbay.org.Caddyfile
index c161202..7eaa336 100644
--- a/packaging/caddy/meshbay.org.Caddyfile
+++ b/packaging/caddy/meshbay.org.Caddyfile
@@ -11,10 +11,10 @@
 #   /sw.js         the service worker MUST stay at the root or its scope stops
 #                  covering the pages it intercepts downloads for. A 404 here
 #                  silently breaks streamed downloads on Firefox and Safari.
-#   /a/<hash>/*    the versioned module graph. The old snippet in
-#                  devel-phases-next.md proxied `/style.css` and `/*.js`, which
-#                  matches neither this prefix nor /locales/*.js — it predates
-#                  asset versioning and would 404 the entire bundle.
+#   /a/<hash>/*    the versioned module graph. The old snippet proxied
+#                  `/style.css` and `/*.js`, which matches neither this prefix
+#                  nor /locales/*.js — it predates asset versioning and would
+#                  404 the entire bundle.
 #   /style.css     old bookmarks, still served unversioned by the hub.
 #
 # Deployment: the site is NOT pushed by the hub deploy procedure. Sync it
diff --git a/packaging/conf/hub.toml.example b/packaging/conf/hub.toml.example
index b5f3830..5407436 100644
--- a/packaging/conf/hub.toml.example
+++ b/packaging/conf/hub.toml.example
@@ -51,7 +51,7 @@ access_token_ttl  = 14400      # 4 h
 # reCAPTCHA v2 on registration and password reset, so no mail is ever sent
 # before a human has been seen. Absent, or either key empty, disables it
 # entirely — which is right for development and for a hub nobody can reach.
-# See docs/captcha.md.
+# See docs/MESHBAY_DESIGN.md §7.7.
 site_key   = ""
 secret_key = ""
 
@@ -80,7 +80,7 @@ allowed_hosts = []
 # page or somebody else's Electron application look identical from here. The
 # captcha still has to be solved per token; what is given up is the origin
 # restriction for those clients. Leave it off unless you ship the desktop
-# client. See docs/captcha.md §6.
+# client. See docs/MESHBAY_DESIGN.md §7.7.
 allow_unattributed_host = false
 
 
diff --git a/packaging/systemd/meshbay-node-user.service b/packaging/systemd/meshbay-node-user.service
index feb415b..0c60671 100644
--- a/packaging/systemd/meshbay-node-user.service
+++ b/packaging/systemd/meshbay-node-user.service
@@ -27,11 +27,11 @@ Type=simple
 # the node authenticates to the hub with an Ed25519 signature (NS7).
 # MESHBAY_TMDB_DEFAULT_TOKEN (Videos app, optional) also lives here — never
 # in source. Absent means TMDB lookups are inert until the operator sets one
-# here or configures a custom token in Settings (docs/mediacenter.md §5.5).
+# here or configures a custom token in Settings (docs/MESHBAY_DESIGN.md §9.7).
 # MESHBAY_MUSICBRAINZ_CONTACT_DEFAULT (Music app, optional) lives here too,
 # same reasoning — not a credential (MusicBrainz needs none), but still
 # never a literal value in source: it's a personal contact address sent
-# as-is in every request's User-Agent (docs/musicbay.md §3.2). Absent means
+# as-is in every request's User-Agent (docs/MESHBAY_DESIGN.md §9.8). Absent means
 # MusicBrainz lookups are inert until the operator sets one here or
 # configures a contact in Settings.
 EnvironmentFile=-%h/.config/meshbay/node.env
diff --git a/packaging/systemd/meshbay-node.service b/packaging/systemd/meshbay-node.service
index ad4dc40..aa720b5 100644
--- a/packaging/systemd/meshbay-node.service
+++ b/packaging/systemd/meshbay-node.service
@@ -15,13 +15,13 @@ WorkingDirectory=%h
 # Secrets: MESHBAY_PASSWORD (hub login), MESHBAY_UNLOCK_KEY (keystore),
 # MESHBAY_TMDB_DEFAULT_TOKEN (Videos app — optional, no literal default
 # ships in source; absent means TMDB lookups are inert until the operator
-# sets one here or configures a custom token in Settings, docs/mediacenter.md §5.5).
-# MESHBAY_MUSICBRAINZ_CONTACT_DEFAULT (Music app — optional, no literal
-# default ships in source either; not a credential, but still never a
-# literal value in git — it's a personal contact address sent as-is in
-# every MusicBrainz request's User-Agent, docs/musicbay.md §3.2). Absent
-# means MusicBrainz lookups are inert until the operator sets one here or
-# configures a contact in Settings.
+# sets one here or configures a custom token in Settings,
+# docs/MESHBAY_DESIGN.md §9.7). MESHBAY_MUSICBRAINZ_CONTACT_DEFAULT (Music app
+# — optional, no literal default ships in source either; not a credential, but
+# still never a literal value in git — it's a personal contact address sent
+# as-is in every MusicBrainz request's User-Agent, docs/MESHBAY_DESIGN.md
+# §9.8). Absent means MusicBrainz lookups are inert until the operator sets one
+# here or configures a contact in Settings.
 EnvironmentFile=-%h/.config/meshbay/node.env
 
 ExecStart=/opt/meshbay-common/venv/bin/meshbay-node --config %h/.config/meshbay/node.toml