Say what the include layer exports and what it reads from conf

Plugin/unraid/include/ai_rpc.php

@@ -64,6 +64,15 @@
 //   vv_ai_route()  action → route for this node
 //   vv_ai_rpc()    forward one action to the owner, return its response body
 //
+// CONFIGURATION
+//   host*.conf
+//     <HOST>_SSH_KEY   private key this node authenticates to the owner with. Absent or not a
+//                      file means no remote route exists, and vv_ai_route() says so rather than
+//                      attempting a hop that cannot succeed.
+//     <OWNER>          the owner's hostname, looked up by the id vv_ai_owner_host() returns —
+//                      resolved to an address through vv_resolve_tailscale_ip(), never used as
+//                      a hostname directly, because MagicDNS does not resolve across the tailnets.
+//
 // DEPENDS ON
 //   include/config.php  vv_ai_owner_host(), vv_ai_is_owner(), vv_resolve_tailscale_ip()
 //   Tools/ai_rpc.php    the far side — reached at the WebGUI symlink path

Plugin/unraid/include/ai_web.php

@@ -43,6 +43,31 @@
 //
 //   Redacted before it is logged, like every other question in this subsystem.
 //
+// EXPORTS
+//   Settings   vv_ai_web_enabled(), vv_ai_web_provider(), vv_ai_web_results_max(),
+//              vv_ai_web_timeout(), vv_ai_web_searx_url(), vv_ai_web_degoog_url(),
+//              vv_ai_web_api_key(), vv_ai_web_ready()
+//              — every one reads conf; none of them reaches the network.
+//   Providers  vv_ai_web_degoog(), vv_ai_web_searxng(), vv_ai_web_brave(), vv_ai_web_tavily()
+//              — one per backend, each returning the same normalised shape.
+//   Transport  vv_ai_web_http(), vv_ai_web_normalise()
+//   Entry      vv_ai_web_search(), vv_ai_web_context()
+//              — what the rest of the subsystem calls. Everything above is reachable but only
+//              these two are meant to be: search() picks the provider, context() formats for
+//              the prompt.
+//
+// CONFIGURATION
+//   master.conf
+//     AI_WEB_SEARCH_ENABLED    master switch; anything but "true" disables the whole subsystem
+//     AI_WEB_SEARCH_PROVIDER   which backend vv_ai_web_search() dispatches to
+//     AI_WEB_SEARCH_RESULTS    result cap handed to the provider
+//     AI_WEB_SEARCH_TIMEOUT    per-request timeout, in seconds
+//
+//   host*.conf — per host, because the endpoint and the key are this machine's
+//     <HOST>_SEARXNG_URL         self-hosted SearXNG base URL
+//     <HOST>_DEGOOG_URL          self-hosted degoogle/Whoogle base URL
+//     <HOST>_WEB_SEARCH_API_KEY  Brave or Tavily key, whichever provider is selected
+//
 // DEPENDS ON
 //   include/ai.php   vv_ai_redact(), vv_conf_vars()
 // ═══════════════════════════════════════════════════════════════════════════════════════════════

Plugin/unraid/include/monitor.php

@@ -1,8 +1,4 @@
 <?php
-require_once __DIR__ . '/common.php';
-require_once __DIR__ . '/fallback.php';    // vv_fb_proc(), vv_fb_dryrun_state() — daemon liveness
-require_once __DIR__ . '/partnership.php';   // vv_pt_peer_match() — tailnet name vs conf hostname
-
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
 // PURPOSE
 //   Monitor-page roll-ups that are not raw system metrics: partner reachability, fallback
@@ -57,6 +53,10 @@ require_once __DIR__ . '/partnership.php';   // vv_pt_peer_match() — tailnet n
 //   DATA_DIR    container_restart_history.db
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
 
+require_once __DIR__ . '/common.php';
+require_once __DIR__ . '/fallback.php';    // vv_fb_proc(), vv_fb_dryrun_state() — daemon liveness
+require_once __DIR__ . '/partnership.php';   // vv_pt_peer_match() — tailnet name vs conf hostname
+
 function vv_partner_state(): array {
     $vars     = vv_conf_vars();
     $myHostId = strtoupper(vv_detect_host());

Plugin/unraid/include/monitor_board.php

@@ -44,6 +44,17 @@
 //   The declaration and the markup are cross-checked at runtime. vv_mon_board_js() ships the
 //   declared ids to the page, which compares them against the cards actually present and flags
 //   either direction — a card in the markup nobody declared, or a declaration with no card.
+//
+// EXPORTS
+//   Declaration  vv_mon_board(), vv_mon_board_cards(), vv_mon_board_total()
+//                — the one array every other function here reads. Change the layout by editing
+//                that declaration, never by editing what follows.
+//   Geometry     vv_mon_rung_min(), vv_mon_rung_rows(), vv_mon_rung_rowdiv(),
+//                vv_mon_absent_class()
+//                — derive the column ladder and each card's span from the declaration.
+//   Emitters     vv_mon_board_css(), vv_mon_absorb_css(), vv_mon_board_js()
+//   Validation   vv_mon_board_check()
+//                — the only one that reports rather than renders; see OPERATIONAL SAFEGUARDS.
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
 
 // The narrowest a card may be drawn. Every breakpoint is a function of this number — see

Plugin/unraid/include/node_chat.php

@@ -52,6 +52,16 @@
 //   vv_nc_send()            store + deliver to the channel's other members
 //   vv_nc_delete_local()    forget one message on this machine
 //   vv_nc_flush_spool()     retry undelivered
+//
+// CONFIGURATION
+//   host*.conf
+//     <HOST>_SSH_KEY   private key used to reach the channel's other members. Missing or not a
+//                      file means delivery is skipped and the message is spooled — stored here
+//                      and retried later, never reported as failed.
+//     <HOST>           each member's hostname, looked up by the id in the channel definition.
+//
+//   The store's own paths are defines, not conf: VV_NC_DIR under DATA_DIR/db, its .spool
+//   subdirectory, and VV_NC_KEEP — the per-channel message retention, fixed at 300.
 // ═══════════════════════════════════════════════════════════════════════════════════════════════
 require_once __DIR__ . '/config.php';