diff --git a/README.md b/README.md
index fbfe43ad..7146e1a5 100644
--- a/README.md
+++ b/README.md
@@ -3,8 +3,8 @@
 This repo produces the **clean code baseline** of the www.archline.hu docroot
 (Cadline, Joomla 3.8.11, host `tanis.cadline.hu`) — the post-compromise, malware-free,
 faithful reproduction of the live server's source files. The baseline is the **input**
-to the `illusion/hids` verifier (imrcli per-vhost `vanilla_ref`); the verification
-itself lives there, not here.
+to the operator's HIDS baseline-diff verifier (per-vhost known-good reference); the
+verification itself runs there, not here.
 
 ## Model: constituents + a generator script (not a checked-out tree)
 
@@ -39,6 +39,5 @@ installer junk); it is not a target.
 
 ## References
 
-- Audit + baseline method: `cadline/infra` — `docs/audit/archline-hu-2026/`
-- Per-vhost baseline tracking: cadline/infra#47 · Incident: cadline/infra#17
-- Verifier (consumer): `illusion/hids` (imrcli)
+- The archline.hu 2026 security audit and incident analysis (operator-held).
+- The baseline is consumed by the operator's per-vhost HIDS baseline-diff verifier.
diff --git a/RUNBOOK.md b/RUNBOOK.md
index 48e24890..e927bc4c 100644
--- a/RUNBOOK.md
+++ b/RUNBOOK.md
@@ -2,8 +2,8 @@
 
 This repo stores the **constituents** of the clean code baseline, not the deployed
 tree. [`build-baseline.sh`](build-baseline.sh) deterministically "deploys" them into
-`out/` — the code docroot that `illusion/hids` (imrcli `vanilla_ref`) diffs the live
-server against. The deployed layout differs from the repo layout, so the build maps
+`out/` — the code docroot that the operator's HIDS baseline-diff verifier compares the
+live server against. The deployed layout differs from the repo layout, so the build maps
 each constituent to its Joomla-installed location.
 
 ## Goal
@@ -34,8 +34,8 @@ delta (`cadline.patch`), so `git diff` documents exactly our change vs upstream.
 ./build-baseline.sh            # → out/  (the deployed code baseline)
 ```
 
-Verification (residual→0, malware/data buckets) lives in **`illusion/hids`** (imrcli),
-which consumes `out/` as the per-vhost `vanilla_ref`. This repo only produces the input.
+Verification (residual→0, malware/data buckets) lives in the operator's HIDS verifier,
+which consumes `out/` as the per-vhost known-good reference. This repo only produces the input.
 
 **Current build result (verified against the live RO mirror):** `out/` = 23,578 clean
 code files. Byte-matches live for all legit code; differs only on the 4 known-infected
diff --git a/build-baseline.sh b/build-baseline.sh
index 7077df9c..74cc2f1c 100755
--- a/build-baseline.sh
+++ b/build-baseline.sh
@@ -2,8 +2,8 @@
 #
 # build-baseline.sh — reproducibly assemble the www.archline.hu clean CODE baseline.
 #
-# Output (out/) = the deployed docroot (code only), which the illusion/hids
-# baseline-diff (imrcli vanilla_ref) verifies the live server against.
+# Output (out/) = the deployed docroot (code only), which the operator's HIDS
+# baseline-diff verifies the live server against.
 #
 # The repo stores the baseline CONSTITUENTS, not the deployed tree; this script
 # performs the deterministic "deployment" (Joomla manifest-mapping for packaged
diff --git a/malware-iocs.md b/malware-iocs.md
index eb5bd039..1af3dd5e 100644
--- a/malware-iocs.md
+++ b/malware-iocs.md
@@ -1,6 +1,6 @@
 # Malware / planted IOC set — www.archline.hu
 
-Authoritative source: `cadline/infra` incidens-doksi (#17), §7/13/14/16 (human-tracked).
+Authoritative source: the archline.hu incident analysis (operator-held), §7/13/14/16.
 These items are **excluded from the baseline** so the HIDS baseline-diff flags them
 on the live server. Machine-readable path list: [`malware-iocs.paths`](malware-iocs.paths).