diff --git a/okf/apis/api-surface.md b/okf/apis/api-surface.md
index 47a68bd..b52b4b4 100644
--- a/okf/apis/api-surface.md
+++ b/okf/apis/api-surface.md
@@ -34,7 +34,7 @@ endpoint docs: <https://app.peoplepowerco.com/cloud/apidocs/cloud.html>.
 server dropped those endpoints in API spec v65. Escalations (spec v65,
 `/cloud/json/escalations`) live on `Locations` alongside narratives.
 
-App APIs migrated from legacy `/espapi/cloud/json/` to `/cloud/json/` on
+[App APIs](bundle://developer-knowledge/apis/cloud-api.md) migrated from legacy `/espapi/cloud/json/` to `/cloud/json/` on
 2026-07-07 — the espapi route cannot validate EdDSA JWT API keys
 ("[2] JWK not found"). See
 [authentication](/apis/authentication-and-signature-login.md).
@@ -49,7 +49,7 @@ adapter: it fetches the websocket URL via REST, then provides an async client
 `AdminDevices`, `AdminLocations`, `AdminTags`, `Narratives`,
 `Billing`, `Firmware`, `Reports`.
 
-A few admin APIs (narratives, tags, groups) still use legacy
+A few [admin APIs](bundle://developer-knowledge/apis/admin-api.md) (narratives, tags, groups) still use legacy
 `/espapi/admin/json/...` paths — the same JWK failure class may surface there
 with JWT keys.
 
diff --git a/okf/log.md b/okf/log.md
index 0561fa1..a273f3f 100644
--- a/okf/log.md
+++ b/okf/log.md
@@ -1,5 +1,11 @@
 # Log
 
+## 2026-10-06
+### Graph gardening
+
+* Linked “App APIs” and “admin APIs” in [API Surface](/apis/api-surface.md) to the developer-knowledge Cloud API and Admin API concepts.
+* Link changes only; no claims or trust fields changed.
+
 ## 2026-10-05
 
 * **Update**: Server API spec v63 → v65. Removed the `Weather` (app) and `Challenges` (admin) API classes and their factory entries, user codes methods on `UserAccounts`, and bot `Analytic.get_challenge_participants`; added escalations (`get/create/update_escalation`) on `Locations`. Updated the api-surface concept.