Updates

user-guide/README.md

@@ -18,7 +18,7 @@ For engineers (protocol, REST deep-dive, architecture), see [docs/](../docs/READ
 | [Metric Correlations](./metric-correlations.md) | Highlight → Find Correlations → filtered wall (full walkthrough) |
 | [Related metrics](./related-metrics.md) | Per-chart ⇢ related (taxonomy + Pearson) — different from Correlate |
 | [Alerts](./alerts.md) | Anomaly list, Show / Correlate actions |
-| [Logs](./logs.md) | System log search — anomalies, audit, optional journal |
+| [Logs](./logs.md) | System log stream — journal (default), anomalies, audit; Follow / search |
 | [Fleet](./fleet.md) | Multi-host roster, set active, reconnect, forget |
 | [Settings](./settings.md) | Theme, motion, spark depth, reconnect |
 | [Keyboard shortcuts](./keyboard.md) | Charts and shell shortcuts |
@@ -31,5 +31,5 @@ For engineers (protocol, REST deep-dive, architecture), see [docs/](../docs/READ
 1. [Connect](./connect.md) an agent  
 2. Skim [Overview](./overview-tab.md)  
 3. Open **Charts** — [Charts guide](./charts.md)  
-4. Investigate with [Metric Correlations](./metric-correlations.md) or [Related](./related-metrics.md)  
+4. Investigate with [Metric Correlations](./metric-correlations.md), [Logs](./logs.md), or [Related](./related-metrics.md)  
 5. Manage hosts in [Fleet](./fleet.md)