diff --git a/docs/administration/spinifex-admin-cli/README.md b/docs/administration/spinifex-admin-cli/README.md
index f4619ddf0..175720f94 100644
--- a/docs/administration/spinifex-admin-cli/README.md
+++ b/docs/administration/spinifex-admin-cli/README.md
@@ -35,13 +35,25 @@ All services in the Spinifex platform are managed through this single binary.
 
 ## Account Management
 
+Create a new isolated account with an admin user and AdministratorAccess policy:
+
 ```bash
 spx admin account create --name myteam
 export AWS_PROFILE=spinifex-myteam
 ```
 
+List all accounts:
+
+```bash
+spx admin account list
+```
+
+
+
 ## Node Management
 
+List nodes in the cluster:
+
 ```bash
 spx get nodes
 ```
@@ -59,6 +71,8 @@ node3   Ready     127.0.0.3       ap-southeast-2   ap-southeast-2a  2m       0
 spx top nodes
 ```
 
+Prints per-node CPU/memory usage and cluster-wide instance type availability.
+
 ## Image Management
 
 ```bash
@@ -66,8 +80,13 @@ spx admin images list
 spx admin images import --name debian-12-arm64
 ```
 
+Catalog imports verify the image against the catalog-declared SHA-256/SHA-512 digest before extraction. Use `--file` to import operator-supplied media (verification skipped — operator is responsible for integrity), or `--force` to re-download after a checksum mismatch.
+
+
 ## Cluster Shutdown
 
+Coordinated, phased shutdown of the entire cluster (API/UI → VMs → viperblock → predastore → NATS/daemon):
+
 ```bash
 spx admin cluster shutdown
 ```
@@ -86,11 +105,12 @@ If you get permission errors during operations, ensure you're running with appro
 
 ### Services Fail to Start
 
-Check the daemon logs for specific errors:
+Check the daemon logs for specific errors via `systemctl`/`journalctl`:
 
 ```bash
-ls ~/spinifex/logs/
-cat ~/spinifex/logs/spinifex.log
+systemctl status 'spinifex-*'
+journalctl -u spinifex-daemon -f
+journalctl -u 'spinifex-*' -f
 ```
 
 Common causes include port conflicts, missing OVN configuration, or untrusted CA certificates.
diff --git a/docs/compute/launching-instances/README.md b/docs/compute/launching-instances/README.md
index 4c71b00c7..9a33ed948 100644
--- a/docs/compute/launching-instances/README.md
+++ b/docs/compute/launching-instances/README.md
@@ -149,7 +149,7 @@ For production SSH via public IPs, see [Setting Up Your Cluster](/docs/setting-u
 Check QEMU logs for the instance and verify the AMI architecture matches your host:
 
 ```bash
-cat ~/spinifex/logs/spinifex.log
+journalctl -u spinifex-daemon -f
 aws ec2 describe-images --image-ids $SPINIFEX_AMI
 ```
 
diff --git a/docs/compute/vpc-networking/README.md b/docs/compute/vpc-networking/README.md
index a6315076f..2b6b8791a 100644
--- a/docs/compute/vpc-networking/README.md
+++ b/docs/compute/vpc-networking/README.md
@@ -1014,13 +1014,13 @@ sudo tcpdump -i {nic} -n "host {public_ip}"
 
 ```bash
 # vpcd log (reconcile, NAT, topology operations)
-cat ~/spinifex/logs/vpcd.log
+journalctl -u spinifex-vpcd -f
 
 # ovn-controller log (port binding, commit failures)
 sudo cat /var/log/ovn/ovn-controller.log | tail -50
 
 # Daemon log (instance launch, network setup)
-cat ~/spinifex/logs/spinifex.log
+journalctl -u spinifex-daemon -f
 ```
 
 ### VPC Creation Fails
@@ -1029,7 +1029,7 @@ Check OVN services and vpcd daemon:
 
 ```bash
 sudo systemctl is-active ovn-controller
-cat ~/spinifex/logs/vpcd.log
+journalctl -u spinifex-vpcd -f
 ```
 
 ### Instances Cannot Reach Each Other
@@ -1218,7 +1218,7 @@ sudo ovs-vsctl get Open_vSwitch . external-ids:system-id
 # What SB registered
 sudo ovn-sbctl list Chassis | grep name
 # What vpcd expects
-grep node ~/spinifex/config/spinifex.toml | head -1
+grep node /etc/spinifex/spinifex.toml | head -1
 ```
 
 **Fix:** `reset-dev-env.sh` passes `--chassis-id=chassis-node1` to
diff --git a/docs/getting-started/setting-up-your-cluster/README.md b/docs/getting-started/setting-up-your-cluster/README.md
index 777f42379..d8d4840da 100644
--- a/docs/getting-started/setting-up-your-cluster/README.md
+++ b/docs/getting-started/setting-up-your-cluster/README.md
@@ -345,7 +345,7 @@ export AWS_PROFILE=spinifex-myteam
 ### Instance Stuck in Pending
 
 ```bash
-cat ~/spinifex/logs/spinifex.log
+journalctl -u spinifex-daemon -f
 aws ec2 describe-images
 ```
 
diff --git a/docs/getting-started/update/README.md b/docs/getting-started/update/README.md
index 44646e9ee..f40597daa 100644
--- a/docs/getting-started/update/README.md
+++ b/docs/getting-started/update/README.md
@@ -1,7 +1,7 @@
 ---
 title: "Updating Spinifex"
 description: "Upgrade an existing Spinifex installation to the latest release."
-category: "Getting Started"
+category: "Administration"
 tags:
   - update
   - upgrade
diff --git a/docs/security/flaw-remediation-policy/README.md b/docs/security/flaw-remediation-policy/README.md
index 0df38ec9f..0ee68cc35 100644
--- a/docs/security/flaw-remediation-policy/README.md
+++ b/docs/security/flaw-remediation-policy/README.md
@@ -129,7 +129,7 @@ Operators own remediation for layers Spinifex does not ship:
 | Host OS + kernel | Track distribution advisories (Debian DSA, Ubuntu USN) at matching cadence. |
 | OVN / OVS | Patched via the operator's package channel alongside the OS. |
 | QEMU / KVM / libvirt | As above — hypervisor CVEs affect tenant isolation. |
-| Host AV / EDR agent | See [Malware Protection §2](/docs/security/malware-protection). |
+| Host AV / EDR agent | See [Malware Protection §2](/docs/security/malware-protection#2-update-requirements-sil1-3144). |
 
 Operators should subscribe to the `mulgadc/spinifex` release feed (Watch → Custom → Releases + Security Advisories) so Critical/High advisories arrive via GitHub's notification channel rather than polling.