diff --git a/src/guide/preserves.md b/src/guide/preserves.md
index 5fe7457..47c34bd 100644
--- a/src/guide/preserves.md
+++ b/src/guide/preserves.md
@@ -118,8 +118,8 @@ as it travels over a Unix pipe connecting a program to the root dataspace:
 
 The `user-settings-command` structure includes the `assert` command itself, plus an embedded
 capability reference, `#![0 123]`, which encodes a transport-specific reference to an object.
-
-> TODO: Link to documentation for `sturdy.prs`.
+(See the [Syndicate Protocol](../protocol.md#capabilities-on-the-wire) for an concrete example
+of this.)
 
 The syntax of values under `#!` differs depending on the medium carrying the message.
 For example, point-to-point transports need to be able to refer to "my references" (`#![0 `*n*`]`) and "your
@@ -132,8 +132,9 @@ that unforgeably denotes, in a local context, some complex data structure on the
 a trust boundary.
 
 When capability-bearing Preserves values are read off a transport, the capabilities are
-automatically rewritten into references to in-memory proxy objects. The reverse process of
-rewriting capability references happens when an in-memory value is serialized for transmission.
+[automatically rewritten](../protocol.md#inbound-rewriting) into references to in-memory proxy
+objects. The [reverse process](../protocol.md#outbound-rewriting) of rewriting capability
+references happens when an in-memory value is serialized for transmission.
 
 ## Schemas
 
diff --git a/src/protocol.md b/src/protocol.md
index 0592bc2..87e1c81 100644
--- a/src/protocol.md
+++ b/src/protocol.md
@@ -487,7 +487,7 @@ the reference using *messages*. A relay receiving a message bearing a transient
 terminate the session with an error. A relay about to send such a message SHOULD preemptively
 refuse to do so.
 
-### Rewriting embedded references upon receipt
+### <span id="inbound-rewriting"></span>Rewriting embedded references upon receipt
 
 When processing a `Value` *v* in a received `Assert` or `Message` event, embedded references in
 *v* are decoded from their [on-the-wire `WireRef` form](#capabilities-on-the-wire) to in-memory
@@ -518,7 +518,7 @@ The value is recursively traversed. As the relay comes across each embedded `Wir
   - In each case, the `WireSymbol` associated with the OID has its reference count incremented
     (if an `Assert` is being processed).
 
-### Rewriting embedded references for transmission
+### <span id="outbound-rewriting"></span>Rewriting embedded references for transmission
 
 When transmitting a `Value` *v* in an `Assert` or `Message` event, embedded references in *v*
 are encoded from their in-memory ref-pointer form to [on-the-wire `WireRef`