diff --git a/CLAUDE.md b/CLAUDE.md
index 46882adbe..fee48ba3c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -78,8 +78,8 @@ just react-fmt    # Format UI with Prettier
   `viper.SetDefault()` in `cmd/root.go`
 - **`pkg/sdk/`** - Go SDK for programmatic REST API access (`client/` client
   library). See @docs/docs/sidebar/sdk/guidelines.md for SDK development rules
-- Shared `nats-client` and `nats-server` are sibling repos linked via `replace`
-  in `go.mod`
+- Shared `nats-client` and `nats-server` are sibling repos, consumed as pinned
+  module versions in `go.mod` (no `replace` directive)
 
 ## UI Architecture (Quick Reference)
 
@@ -769,8 +769,8 @@ the same principles as the orchestrator examples:
 - `cmd/client_node_{domain}_{operation}.go` — one subcommand per endpoint (e.g.,
   `client_node_sysctl_get.go`)
 - All commands support `--json` for raw output
-- Use `printKV` for inline key-value output and `printStyledTable` for multi-row
-  tabular data (both in `cmd/ui.go`)
+- Use `cli.PrintKV` for inline key-value output and `cli.PrintCompactTable` for
+  multi-row tabular data (both in `internal/cli/ui.go`)
 - Use flags (e.g., `--job-id`, `--audit-id`) instead of positional args for
   resource IDs
 - Handle **all** API response codes in the `switch resp.StatusCode()` block:
diff --git a/docs/docs/sidebar/architecture/system-architecture.md b/docs/docs/sidebar/architecture/system-architecture.md
index 5051ee7cd..a6dded0fb 100644
--- a/docs/docs/sidebar/architecture/system-architecture.md
+++ b/docs/docs/sidebar/architecture/system-architecture.md
@@ -21,7 +21,7 @@ The system is organized into six layers, top to bottom:
 | **Job Client**             | `internal/job/client/`                  | Business logic for job CRUD and status                                                   |
 | **NATS JetStream**         | (external)                              | KV `job-queue`, Stream `JOBS`, KV `job-responses`, KV `agent-registry`                   |
 | **Agent / Provider Layer** | `internal/agent/`, `internal/provider/` | Consumes jobs, executes providers, evaluates conditions, drain lifecycle, heartbeat      |
-| **Notifications**          | `internal/notify/`                      | Watches registry KV for condition transitions; dispatches events via pluggable notifiers |
+| **Notifications**          | `internal/controller/notify/`           | Watches registry KV for condition transitions; dispatches events via pluggable notifiers |
 
 ```mermaid
 graph TD
diff --git a/docs/docs/sidebar/intro.md b/docs/docs/sidebar/intro.md
index 59498a049..69284d703 100644
--- a/docs/docs/sidebar/intro.md
+++ b/docs/docs/sidebar/intro.md
@@ -95,13 +95,13 @@ osapi client health
 
 ## Explore the Docs
 
-- [Features](sidebar/features/node-management.md) — what OSAPI can manage and
-  how each feature works
-- [Architecture](sidebar/architecture/architecture.md) — how the three processes
-  (NATS, API server, agent) fit together
-- [Configuration](sidebar/usage/configuration.md) — full `osapi.yaml` reference
-- [API](category/api) — OpenAPI documentation for all endpoints
-- [CLI Usage](sidebar/usage/usage.mdx) — command reference with examples
+- [Features](features/node-management.md) — what OSAPI can manage and how each
+  feature works
+- [Architecture](architecture/architecture.md) — how the three processes (NATS,
+  API server, agent) fit together
+- [Configuration](usage/configuration.md) — full `osapi.yaml` reference
+- [API](/category/api) — OpenAPI documentation for all endpoints
+- [CLI Usage](usage/usage.mdx) — command reference with examples
 
 ## Alternatives
 
diff --git a/docs/docs/sidebar/usage/configuration.md b/docs/docs/sidebar/usage/configuration.md
index 0aae2282d..71c41c013 100644
--- a/docs/docs/sidebar/usage/configuration.md
+++ b/docs/docs/sidebar/usage/configuration.md
@@ -121,15 +121,17 @@ Environment variables take precedence over file values.
 
 ## Required Fields
 
-Two fields carry a `required` validation tag and must be set before the server
-or client will start:
-
-| Key                                       | Purpose                            |
-| ----------------------------------------- | ---------------------------------- |
-| `controller.api.security.signing_key`     | HS256 key for signing JWTs         |
-| `controller.client.security.bearer_token` | JWT sent with client requests      |
-| `controller.metrics.enabled`              | `OSAPI_CONTROLLER_METRICS_ENABLED` |
-| `controller.metrics.port`                 | `OSAPI_CONTROLLER_METRICS_PORT`    |
+Seven fields carry a `required` validation tag. Five of them
+(`nats.stream.name`, `nats.stream.subjects`, `nats.kv.bucket`,
+`nats.kv.response_bucket`, and `nats.registry.bucket`) are given defaults via
+`viper.SetDefault()`, so they satisfy validation without appearing in your
+config file. Two have no default and must be set before the server or client
+will start:
+
+| Key                                       | Purpose                       |
+| ----------------------------------------- | ----------------------------- |
+| `controller.api.security.signing_key`     | HS256 key for signing JWTs    |
+| `controller.client.security.bearer_token` | JWT sent with client requests |
 
 Generate a signing key with `openssl rand -hex 32`. Generate a bearer token with
 `osapi token generate`.