diff --git a/.gitattributes b/.gitattributes
index 22c1e1e..8c151b6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -3,6 +3,7 @@
 # trees never ship in libreportal-<ver>.tar.gz.
 scripts/unused    export-ignore
 scripts/release   export-ignore
+site              export-ignore
 docs              export-ignore
 .claude           export-ignore
 .gitignore        export-ignore
diff --git a/docs/architecture/system-footprint.md b/docs/architecture/system-footprint.md
index 078bfeb..56f8b05 100644
--- a/docs/architecture/system-footprint.md
+++ b/docs/architecture/system-footprint.md
@@ -35,7 +35,8 @@ together in **`/usr/local/lib/libreportal/`**; everything else is named
 | `libreportal-socket` | root | docker-socket read perms (type switcher) |
 | `libreportal-svc` | root | generate/install the task-processor systemd unit |
 | `libreportal-bininstall` | root | install the restic/kopia backup-engine binaries |
-| `libreportal-appcfg` | root | rewrite AdGuard/CrowdSec/ownCloud config files |
+| `libreportal-appcfg` | root | rewrite AdGuard/CrowdSec-bouncer/ownCloud config files |
+| `libreportal-crowdsec` | root | install/manage the host-side CrowdSec agent + firewall bouncer |
 
 These are the scoped-sudoers trust boundary: root-owned in a root-owned dir, so the
 manager can `sudo` them but can't modify them. Each bakes the three roots + the
diff --git a/docs/guide/promise.md b/docs/guide/promise.md
index 843ad31..75dbaed 100644
--- a/docs/guide/promise.md
+++ b/docs/guide/promise.md
@@ -7,7 +7,7 @@ to you — in plain language, so you can hold us to it.
 
 You can **run, study, modify, share, and fully use 100% of LibrePortal —
 every feature — for free, forever.** The entire platform is licensed under
-the GNU AGPLv3 (see [LICENSE](LICENSE)). There are **no feature paywalls in
+the GNU AGPLv3 (see [LICENSE](../../LICENSE)). There are **no feature paywalls in
 the software, no crippled "community edition," and no telemetry** phoning
 home.