diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1552716..cc08dd1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -135,12 +135,12 @@ two confirmed bugs).
   the `.form-grid` cards above. Removes the visual rhythm break at the
   2-col → full-width transition. The popup surface is unchanged.
 - **Documentation refreshed for v0.5.0 (doc audit, 14 findings).**
-  `ARCHITECTURE.md` now describes four codebases (the
+  `DESIGN.md` now describes four codebases (the
   `relicario-server` pre-receive hook crate is no longer invisible);
   `CLAUDE.md` project tree and roadmap reflect current state;
   `docs/SECURITY.md` names the server crate and its `verify-commit` /
   `generate-hook` subcommands and notes the without-the-hook-it's-
-  advisory caveat; `docs/ARCHITECTURE.md` shows `settings.enc` as a
+  advisory caveat; `docs/CRYPTO.md` shows `settings.enc` as a
   parallel artifact in the vault-creation flow; the foundational
   design spec gains a "historical" status banner pointing readers at
   the current docs.
diff --git a/CLAUDE.md b/CLAUDE.md
index 3d93eda..2923563 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -99,7 +99,7 @@ After completing any dev iteration, update `STATUS.md` to reflect what shipped a
 
 ## Roadmap & status
 
-Current in-flight work: `STATUS.md`. Full roadmap with release targets: `ROADMAP.md`. Wire format reference: `FORMATS.md`.
+Current in-flight work: `STATUS.md`. Full roadmap with release targets: `ROADMAP.md`. Wire format reference: `docs/FORMATS.md`.
 
 ## Living docs — update discipline
 
diff --git a/ROADMAP.md b/ROADMAP.md
index a802018..4092b83 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -57,5 +57,5 @@ These are specced and either in progress or immediately queued:
 ## Non-goals (explicitly deferred or cancelled)
 
 - **Reference-image rotation** — changing the image factor without re-embedding. Back-burner, not cancelled.
-- **Per-entry subkeys** — no real-world benefit at family-vault scale; see design rationale in `docs/ARCHITECTURE.md`.
+- **Per-entry subkeys** — no real-world benefit at family-vault scale; see design rationale in `docs/CRYPTO.md`.
 - **libgit2 / gitoxide** — shell-out to `git` is intentional; see `crates/relicario-cli/ARCHITECTURE.md`.
diff --git a/docs/FORMATS.md b/docs/FORMATS.md
index 74c851b..e35a63c 100644
--- a/docs/FORMATS.md
+++ b/docs/FORMATS.md
@@ -19,7 +19,7 @@ Every encrypted file — `manifest.enc`, `settings.enc`, `items/<id>.enc`, `atta
 - `VERSION_BYTE = 0x02` (`crypto.rs:59`). Any blob starting with `0x01` is rejected with `UnsupportedFormatVersion { found: 0x01, expected: 0x02 }`.
 - Minimum valid blob length: 41 bytes (1 + 24 + 0 + 16).
 - Nonces are always fresh from `OsRng` — no caller-supplied nonces.
-- Full diagram: `docs/ARCHITECTURE.md` § "Encrypted File Format".
+- Full diagram: `docs/CRYPTO.md` § "Encrypted File Format".
 
 ## `.relicario/params.json`