diff --git a/mps/design/poolawl.txt b/mps/design/poolawl.txt
index cd2625d3c67..ebad6106ee1 100644
--- a/mps/design/poolawl.txt
+++ b/mps/design/poolawl.txt
@@ -246,7 +246,7 @@ segment sizes are rounded up to the arena grain size.
 
 _`.fun.awlsegcreate.where`: The segment is allocated using a
 generation preference, using the generation number stored in the
-``AWLStruct`` (the ``gen`` field), see `.poolstruct.gen`_ above.
+``AWLStruct`` (the ``gen`` field), see `.poolstruct`_ above.
 
 ``Res awlSegInit(Seg seg, Pool pool, Addr base, Size size, ArgList args)``
 
diff --git a/mps/design/protix.txt b/mps/design/protix.txt
index 88a764f66a8..529b43990a2 100644
--- a/mps/design/protix.txt
+++ b/mps/design/protix.txt
@@ -88,12 +88,9 @@ okay), the protection is set to ``PROT_READ|PROT_WRITE|PROT_EXEC``.
 .. _design.mps.prot.if.set: prot#.if.set
 
 _`.fun.set.assume.mprotect`: We assume that the call to ``mprotect()``
-always succeeds.
-
-_`.fun.set.assume.mprotect`: This is because we should always call the
-function with valid arguments (aligned, references to mapped pages,
-and with an access that is compatible with the access of the
-underlying object).
+always succeeds.  We should always call the function with valid
+arguments (aligned, references to mapped pages, and with an access
+that is compatible with the access of the underlying object).
 
 _`.fun.sync`: ``ProtSync()`` does nothing in this implementation as
 ``ProtSet()`` sets the protection without any delay.
diff --git a/mps/design/protocol.txt b/mps/design/protocol.txt
index 8d285fd9e19..93ac13efd0d 100644
--- a/mps/design/protocol.txt
+++ b/mps/design/protocol.txt
@@ -569,7 +569,7 @@ following:
   A function called by ``SomeClassGet()``. All the class
   initialization code is actually in this function.
 
-_`.impl.subclass`: The subclass test `.if.subclass`_ is implemented
+_`.impl.subclass`: The subclass test `.if.is-subclass`_ is implemented
 using an array of superclasses [Cohen_1991]_ giving a fast
 constant-time test.  (RB_ tried an approach using prime factors
 [Gibbs_2004]_ but found that they overflowed in 32-bits too easily to
diff --git a/mps/design/shield.txt b/mps/design/shield.txt
index 489bec6743d..248b72c4346 100644
--- a/mps/design/shield.txt
+++ b/mps/design/shield.txt
@@ -257,7 +257,7 @@ _`.proof.sync`: As the depth of a segment cannot be negative
   |   ⇒ all segments are synced (by `.inv.unsynced.depth`_)
 
 _`.proof.access`: If the mutator is running then all segments must be
-synced (`.inv.unsynced.suspend`_). Which means that the hardware
+synced (`.inv.unsynced.suspended`_). Which means that the hardware
 protection (protection mode) must reflect the software protection
 (shield mode). Hence all shielded memory will be hardware protected
 while the mutator is running. This ensures `.prop.mutator.access`_.
diff --git a/mps/procedure/release-build.rst b/mps/procedure/release-build.rst
index eff46a92999..233789e71a5 100644
--- a/mps/procedure/release-build.rst
+++ b/mps/procedure/release-build.rst
@@ -280,7 +280,7 @@ B. Document History
 .. _NB: mailto:nb@ravenbrook.com
 .. _RHSK: mailto:rhsk@ravenbrook.com
 .. _GDR: mailto:gdr@ravenbrook.com
-.. _PNJ  mailto:pnj@ravenbrook.com
+.. _PNJ: mailto:pnj@ravenbrook.com
 
 C. Copyright and License
 ------------------------