@@ -38,7 +38,7 @@ Resource presets now follow a cloud-style `<series>.<size>` taxonomy with **40 p
 
 Each series ships eight sizes (`nano` → `4xlarge`). The seven legacy flat names (`nano` … `2xlarge`) are kept as deprecated aliases that map 1:1 by CPU and memory, so `helm template ... --set resourcesPreset=small` still renders `1 CPU / 512Mi` exactly as before. **Migration 39** walks every `HelmRelease.spec.values` and every app CR under `apps.cozystack.io/v1alpha1` and rewrites legacy values to their instance-type equivalents (`small → t1.small`, `medium → c1.small`, etc); the migration is idempotent and dry-runnable via `MIGRATION_DRY_RUN=1`. The `cozystack-api` emits deprecation warnings on every `Create`/`Update` against an app CR that still carries a legacy value, naming the JSON path and the 1:1 replacement.
 
-Operators see no behavioural change on upgrade — defaults preserve resources exactly. New deployments get the richer taxonomy and can select an explicit CPU/memory ratio per workload. See [Resource Presets](https://cozystack.io/docs/operations/resource-presets/) for the full size matrix ([**@lexfrei**](https://github.com/lexfrei) and [**@matthieu-robin**](https://github.com/matthieu-robin) in #2607).
+Operators see no behavioural change on upgrade — defaults preserve resources exactly. New deployments get the richer taxonomy and can select an explicit CPU/memory ratio per workload. See [Resource Presets](https://cozystack.io/docs/v1.4/guides/resource-management/) for the full size matrix ([**@lexfrei**](https://github.com/lexfrei) and [**@matthieu-robin**](https://github.com/matthieu-robin) in #2607).
 
 ### Declarative Backup Strategies for Managed Apps
 
@@ -50,7 +50,7 @@ Credentials are referenced by Kubernetes Secret name (never inline) and RBAC is
 
 The new `hami` system package integrates [HAMi](https://github.com/Project-HAMi/HAMi) v2.8.1 (CNCF Sandbox) for **fractional GPU sharing in tenant clusters**. HAMi exposes per-tenant `nvidia.com/gpu`, `nvidia.com/gpumem`, and `nvidia.com/gpucores` resources so multiple pods can share a single physical GPU with explicit memory and compute slicing; the device plugin, scheduler extender, mutating webhook, and RuntimeClass are bundled. The integration auto-disables the GPU Operator's native device plugin to avoid conflict, and HAMi is exposed as an opt-in toggle (`hami.enabled`) on the tenant Kubernetes addon with a hard dependency on the GPU Operator.
 
-The release notes call out an important compatibility caveat: HAMi-core relies on a private glibc symbol (`_dl_sym`) removed in glibc 2.34, so compute isolation only works on container images that ship glibc < 2.34 (Ubuntu 22.04+, current PyTorch/TensorFlow official images do not). Alpine/musl is unsupported. Memory enforcement works on all images. See the package README and the [HAMi documentation](https://cozystack.io/docs/operations/kubernetes/hami/) for the supported image matrix ([**@Arsolitt**](https://github.com/Arsolitt) in #2484).
+The release notes call out an important compatibility caveat: HAMi-core relies on a private glibc symbol (`_dl_sym`) removed in glibc 2.34, so compute isolation only works on container images that ship glibc < 2.34 (Ubuntu 22.04+, current PyTorch/TensorFlow official images do not). Alpine/musl is unsupported. Memory enforcement works on all images. See the package README and the [HAMi documentation](https://cozystack.io/docs/v1.4/kubernetes/gpu-sharing/) for the supported image matrix ([**@Arsolitt**](https://github.com/Arsolitt) in #2484).
 
 ### Ouroboros: One-Switch PROXY-Protocol + Hairpin-NAT Fix
 
@@ -78,9 +78,9 @@ Most operators can take v1.4.0 with no manual action — Cozystack stays on the
 
 * **KubeVirt VMs running before the upgrade need a cold restart.** With #2502, KubeVirt jumps v1.6.3 → v1.8.2 which crosses the upstream QEMU bump (1.6.x → 1.7.x+). Live-migration of VMs that were running before the upgrade fails permanently with `qemu-kvm: error while loading state for instance ... virtio-net` / `operation failed: job 'migration in' failed: Operation not permitted` — this is upstream [kubevirt/kubevirt#16386](https://github.com/kubevirt/kubevirt/issues/16386). Switching `workloadUpdateMethods` from `[LiveMigrate, Evict]` to `[Evict]` does not help (the eviction webhook re-routes through live-migrate). **Action required:** after the platform upgrade, cold-restart pre-existing VMs (`virtctl stop` / `virtctl start`, or set `runStrategy: RerunOnFailure` and delete the VMI) so they relaunch on the new virt-launcher. New VMs created after the upgrade are unaffected.
 
-* **Resource presets gain new names; legacy names keep working.** With #2426 / Migration 39, presets follow a `<series>.<size>` taxonomy (`t1`/`c1`/`s1`/`u1`/`m1` × `nano`–`4xlarge`). The seven legacy flat names (`nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`) **remain accepted as deprecated aliases** with the exact pre-rename CPU/memory by 1:1 mapping — no behavioural change for existing deployments. Stored values are rewritten on upgrade. You will see deprecation warnings on `Create`/`Update` against app CRs that still carry a legacy preset; migrate at your own pace before they are removed in a future release.
+* **Resource presets gain new names; legacy names keep working.** With #2607 / Migration 39, presets follow a `<series>.<size>` taxonomy (`t1`/`c1`/`s1`/`u1`/`m1` × `nano`–`4xlarge`). The seven legacy flat names (`nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`) **remain accepted as deprecated aliases** with the exact pre-rename CPU/memory by 1:1 mapping — no behavioural change for existing deployments. Stored values are rewritten on upgrade. You will see deprecation warnings on `Create`/`Update` against app CRs that still carry a legacy preset; migrate at your own pace before they are removed in a future release.
 
-* **PostgreSQL parameters are now type-checked.** With #2475, `postgresql.parameters` becomes a typed `map[string]string` with a case-insensitive denylist for parameters that would allow arbitrary code execution: `archive_command`, `restore_command`, `ssl_passphrase_command`, `dynamic_library_path`, and any `*_preload_libraries`. Common settings like `max_connections`, `shared_buffers`, `work_mem`, etc. are unaffected. If you relied on any of the denylisted parameters, the deployment will fail to render with a clear error and you must remove them.
+* **PostgreSQL parameters are now type-checked.** With #2466, `postgresql.parameters` becomes a typed `map[string]string` with a case-insensitive denylist for parameters that would allow arbitrary code execution: `archive_command`, `restore_command`, `ssl_passphrase_command`, `dynamic_library_path`, and any `*_preload_libraries`. Common settings like `max_connections`, `shared_buffers`, `work_mem`, etc. are unaffected. If you relied on any of the denylisted parameters, the deployment will fail to render with a clear error and you must remove them.
 
 * **cert-manager pods now run as UID 65532.** Upstream cert-manager v1.20 changes the default container UID/GID from `1000/0` to `65532`. If you have custom PodSecurityPolicies, restrictive imagePullSecrets, or filesystem-mounted certs whose ownership is pinned to the old UID, update them. Operators who have not customised cert-manager security context need no action.