diff --git a/Plugin/unraid/Tools/ui_map_build.php b/Plugin/unraid/Tools/ui_map_build.php
index e98b845..b76adf4 100644
--- a/Plugin/unraid/Tools/ui_map_build.php
+++ b/Plugin/unraid/Tools/ui_map_build.php
@@ -68,10 +68,16 @@ foreach (VV_SCRIPT_CONF_SECTIONS as $script => $subs) {
 
 // ── Route 2: pages that show sections by subject ─────────────────────────────────────────────
 foreach (VV_UI_SECTION_SURFACES as $surface) {
-    $re = '/\b' . preg_quote((string) $surface['match'], '/') . '\b/i';
+    // "*" is the catch-all, matched the same way api/confform.php matches it. preg_quote would
+    // turn it into \* and quietly match nothing, which is how the map went on reporting a third
+    // of the conf as unreachable after the page that reaches it had shipped.
+    $all = ((string) $surface['match'] === '*');
+    $re  = $all ? '' : '/\b' . preg_quote((string) $surface['match'], '/') . '\b/i';
     foreach ($sections as $k => $g) {
-        if (!preg_match($re, (string) $g['subsection'])) continue;
-        $routes[$k][] = $surface['route'] . " → *{$g['subsection']}*";
+        $name = (string) $g['subsection'];
+        if (isset(VV_UI_SECTION_EXCLUDE[$name])) continue;
+        if (!$all && !preg_match($re, $name)) continue;
+        $routes[$k][] = $surface['route'] . " → *{$name}*";
     }
 }
 
@@ -194,12 +200,31 @@ foreach ($sections as $k => $g) {
     }
 }
 
-if ($unreachable) {
+// Two different kinds of "no route", and conflating them was unhelpful. One is a gap; the other
+// is a decision, and the decision has a reason worth repeating to whoever asks.
+$excluded = array_filter($unreachable, fn($g) => isset(VV_UI_SECTION_EXCLUDE[$g['subsection']]));
+$gaps     = array_filter($unreachable, fn($g) => !isset(VV_UI_SECTION_EXCLUDE[$g['subsection']]));
+
+if ($excluded) {
+    $md .= "\n---\n\n## Settings deliberately kept out of the UI\n\n";
+    $md .= "These have no control on purpose. They hold the machine's identity and the roots\n"
+         . "everything else is derived from, and a text box beside a Save button is the wrong\n"
+         . "shape for a value that decides whether the server recognises itself on next boot.\n\n"
+         . "If one is asked about, give the reason and say it is edited in the conf file directly.\n"
+         . "Do not describe a route — there is none, and that is the point.\n\n";
+    foreach ($excluded as $g) {
+        $keys = implode(', ', array_map(fn($f) => '`' . $f['key'] . '`', $g['fields']));
+        $md  .= '- **' . $g['subsection'] . '** (`' . $g['file'] . "`) — $keys  \n"
+              . '  ' . VV_UI_SECTION_EXCLUDE[$g['subsection']] . "\n";
+    }
+}
+
+if ($gaps) {
     $md .= "\n---\n\n## Settings with no route through the UI\n\n";
-    $md .= "These sections are not rendered by any page, so they can only be changed by editing\n"
-         . "the conf file. If one of these is asked about, say so plainly rather than inventing a\n"
-         . "route — mapping it into the Scheduler is a code change, not a setting.\n\n";
-    foreach ($unreachable as $g) {
+    $md .= "Not a decision, just not built yet: no page renders these, so they can only be changed\n"
+         . "by editing the conf file. If one of these is asked about, say so plainly rather than\n"
+         . "inventing a route.\n\n";
+    foreach ($gaps as $g) {
         $keys = implode(', ', array_map(fn($f) => '`' . $f['key'] . '`', $g['fields']));
         $md  .= '- **' . $g['subsection'] . '** (`' . $g['file'] . "`) — $keys\n";
     }
diff --git a/Plugin/unraid/api/confform.php b/Plugin/unraid/api/confform.php
index 7987e38..1843b60 100644
--- a/Plugin/unraid/api/confform.php
+++ b/Plugin/unraid/api/confform.php
@@ -105,11 +105,19 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         //
         // preg_quote first: the needle arrives from a query string, so it is matched as a literal
         // with boundaries around it rather than as a pattern a caller could widen to everything.
-        $re  = '/\b' . preg_quote($match, '/') . '\b/i';
+        // "*" is every section this host has. Deliberately not the same as an empty needle, which
+        // would match everything by accident rather than on purpose.
+        $all = ($match === '*');
+        $re  = $all ? '' : '/\b' . preg_quote($match, '/') . '\b/i';
         $out = [];
         foreach (vv_get_conf_files() as $f) {
             foreach (vv_conf_all_groups($f) as $g) {
-                if (preg_match($re, (string) ($g['subsection'] ?? ''))) $out[] = $g;
+                $name = (string) ($g['subsection'] ?? '');
+                // Excluded everywhere, not only from the catch-all. A section kept out of forms
+                // because a text box is the wrong control for it does not become the right
+                // control because a different page asked.
+                if (isset(VV_UI_SECTION_EXCLUDE[$name])) continue;
+                if ($all || preg_match($re, $name)) $out[] = $g;
             }
         }
         echo json_encode(['ok' => true, 'groups' => $out]);
diff --git a/Plugin/unraid/include/confform.php b/Plugin/unraid/include/confform.php
index bdb1990..f4adfa2 100644
--- a/Plugin/unraid/include/confform.php
+++ b/Plugin/unraid/include/confform.php
@@ -107,6 +107,14 @@ const VV_UI_SECTION_SURFACES = [
         'tab'   => 'AI',
         'route' => 'AI tab → Settings → Configuration',
     ],
+    // Everything that is not structurally excluded. The catch-all exists so no ordinary setting
+    // is reachable only by editing a file — a settings page whose answer to a third of the conf
+    // is "open it over SSH" is not a settings page.
+    [
+        'match' => '*',
+        'tab'   => 'Settings',
+        'route' => 'Settings tab → All settings',
+    ],
     [
         'match' => 'partnership',
         'tab'   => 'Partnership',
@@ -116,6 +124,30 @@ const VV_UI_SECTION_SURFACES = [
     ],
 ];
 
+// Sections deliberately kept out of every settings surface, and why. Not a security boundary —
+// vv_conf_edit() still guards the write and the raw editor can still reach them. This is about
+// what belongs in a form: these hold the machine's identity and the roots everything else is
+// derived from, and a text box next to a Save button is the wrong shape for a value that decides
+// whether the server recognises itself on next boot.
+//
+// The reason travels with the exclusion because the UI map prints it. "No route" invites someone
+// to add one; "no route, because changing this moves the entire data tree" does not.
+const VV_UI_SECTION_EXCLUDE = [
+    'HOST IDENTITIES' =>
+        'HOST1 and HOST2 are what detect_hosts() matches the local hostname against. Editing one '
+        . 'here would change which machine this believes it is.',
+    'SHARED HOST CONFIGURATION' =>
+        'DATA_DIR is the single on-disk root — move it and the whole tree follows, including the '
+        . 'state the running scripts are holding open.',
+    'Cache Roots' =>
+        'The tmpfs half. These must never point at flash, and nothing in a form conveys that.',
+    'State Files' =>
+        'Paths to live state databases, derived from STATE_DIR. Repointing one orphans the state '
+        . 'a watchdog is mid-way through writing.',
+    'GIT / REPO' =>
+        'Where the plugin updates itself from. Wrong here means the next pull is the last one.',
+];
+
 // Pages that edit named keys rather than whole sections — a purpose-built control for one
 // setting, not a form over a conf section. Only the route is declared: the keys themselves are
 // read out of the page source by Tools/ui_map_build.php, so a control added or removed changes
diff --git a/Plugin/unraid/pages/readme/ui-map.md b/Plugin/unraid/pages/readme/ui-map.md
index aea5354..bfeae97 100644
--- a/Plugin/unraid/pages/readme/ui-map.md
+++ b/Plugin/unraid/pages/readme/ui-map.md
@@ -28,7 +28,10 @@ those settings genuinely have no control, and saying so is the right answer.
 
 ## Arr Recovery Toggles
 
-Route: Scheduler tab → **Arrs Failed Stalled Recovery** → Config → *Arr Recovery Toggles*
+Reachable from:
+
+- Scheduler tab → **Arrs Failed Stalled Recovery** → Config → *Arr Recovery Toggles*
+- Settings tab → All settings → *Arr Recovery Toggles*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -38,9 +41,23 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 | `HOST1_SONARR_RECOVERY` | a switch | in this section | — |
 | `HOST1_RADARR_RECOVERY` | a switch | in this section | — |
 
+## Authelia
+
+Route: Settings tab → All settings → *Authelia*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_AUTHELIA_CONFIG` | a text box | in this section | — |
+| `HOST1_AUTHELIA_CONTAINER` | a text box | in this section | — |
+
 ## Backup Verify
 
-Route: Scheduler tab → **Backup Verify** → Config → *Backup Verify*
+Reachable from:
+
+- Scheduler tab → **Backup Verify** → Config → *Backup Verify*
+- Settings tab → All settings → *Backup Verify*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -54,6 +71,7 @@ Reachable from:
 
 - Scheduler tab → **Cert Monitor** → Config → *Certificate Monitor*
 - Scheduler tab → **Weekly Health Digest** → Config → *Certificate Monitor*
+- Settings tab → All settings → *Certificate Monitor*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -63,7 +81,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Corruption Scan
 
-Route: Scheduler tab → **Arr Corruption Scan** → Config → *Corruption Scan*
+Reachable from:
+
+- Scheduler tab → **Arr Corruption Scan** → Config → *Corruption Scan*
+- Settings tab → All settings → *Corruption Scan*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -75,7 +96,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Critical Sync Shares
 
-Route: Scheduler tab → **Critical Sync Maintenance** → Config → *Critical Sync Shares*
+Reachable from:
+
+- Scheduler tab → **Critical Sync Maintenance** → Config → *Critical Sync Shares*
+- Settings tab → All settings → *Critical Sync Shares*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -85,7 +109,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## DDNS
 
-Route: Scheduler tab → **Fallback** → Config → *DDNS*
+Reachable from:
+
+- Scheduler tab → **Fallback** → Config → *DDNS*
+- Settings tab → All settings → *DDNS*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -95,7 +122,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Daily Sync Shares
 
-Route: Scheduler tab → **Daily Sync Maintenance** → Config → *Daily Sync Shares*
+Reachable from:
+
+- Scheduler tab → **Daily Sync Maintenance** → Config → *Daily Sync Shares*
+- Settings tab → All settings → *Daily Sync Shares*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -105,7 +135,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Docker Daily Restart
 
-Route: Scheduler tab → **Docker Daily Restart** → Config → *Docker Daily Restart*
+Reachable from:
+
+- Scheduler tab → **Docker Daily Restart** → Config → *Docker Daily Restart*
+- Settings tab → All settings → *Docker Daily Restart*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -115,7 +148,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Docker Network Connect
 
-Route: Scheduler tab → **Docker Network Connect** → Config → *Docker Network Connect*
+Reachable from:
+
+- Scheduler tab → **Docker Network Connect** → Config → *Docker Network Connect*
+- Settings tab → All settings → *Docker Network Connect*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -126,7 +162,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Docker Watchdog
 
-Route: Scheduler tab → **Docker Watchdog** → Config → *Docker Watchdog*
+Reachable from:
+
+- Scheduler tab → **Docker Watchdog** → Config → *Docker Watchdog*
+- Settings tab → All settings → *Docker Watchdog*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -142,7 +181,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Docker Weekly Restart
 
-Route: Scheduler tab → **Docker Weekly Restart** → Config → *Docker Weekly Restart*
+Reachable from:
+
+- Scheduler tab → **Docker Weekly Restart** → Config → *Docker Weekly Restart*
+- Settings tab → All settings → *Docker Weekly Restart*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -156,6 +198,7 @@ Reachable from:
 
 - Scheduler tab → **Downloaders Reset** → Config → *Downloaders*
 - Scheduler tab → **Resource Watchdog** → Config → *Downloaders*
+- Settings tab → All settings → *Downloaders*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -183,6 +226,7 @@ Reachable from:
 - Scheduler tab → **Emby To Radarr Sync** → Config → *Emby*
 - Scheduler tab → **Emby To Sonarr Sync** → Config → *Emby*
 - Scheduler tab → **Emby Database Repair** → Config → *Emby*
+- Settings tab → All settings → *Emby*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -192,9 +236,48 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 | `HOST1_EMBY_URL` | a text box | in this section | — |
 | `HOST1_EMBY_API_KEY` | a masked box with a **Show** button | in this section | — |
 
+## Fallback Tiers — What HOST1 Wants Covered When Down
+
+Route: Settings tab → All settings → *Fallback Tiers — What HOST1 Wants Covered When Down*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `FALLBACK_HOST1_TIER1` | a list, one entry per line | in this section | Containers the partner starts for HOST1 when HOST1 goes down. Tier 1 is always immediate. Higher tiers activate after HOST1_TIER*_DELAY minutes. |
+| `FALLBACK_HOST1_TIER2` | a list, one entry per line | in this section | — |
+| `FALLBACK_HOST1_TIER3` | a list, one entry per line | in this section | — |
+| `FALLBACK_HOST1_TIER4` | a list, one entry per line | in this section | — |
+
+## Gitea
+
+Route: Settings tab → All settings → *Gitea*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_GITEA_API_TOKEN` | a masked box with a **Show** button | in this section | Personal access token for gitea_ssh_setup.sh. Create in Gitea: Settings → Applications → Generate Token → scope: write:user |
+
+## Identity
+
+Route: Settings tab → All settings → *Identity*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_SSH_KEY` | a masked box with a **Show** button | in this section | HOST1 host1ame lives in master.conf (not a credential — safe for all servers). SSH key used for all server-to-server operations — rsync, failover, conf sync. Convention: /root/.ssh/<host1ame-lowercase-no-unraid-prefix>_rsync_automation Must be in /root/.ssh/ and authorised in the partner's /root/.ssh/authorized_keys. Run Partnership/ssh_setup.sh to generate the key and copy it to the partner. |
+| `HOST1_STORAGE_PATH` | a text box | in this section | — |
+| `HOST1_OWNER` | a text box | in this section | — |
+| `HOST1_OWNER_EMAIL` | a text box | in this section | — |
+
 ## Intermediate Sync Shares
 
-Route: Scheduler tab → **Intermediate Sync Maintenance** → Config → *Intermediate Sync Shares*
+Reachable from:
+
+- Scheduler tab → **Intermediate Sync Maintenance** → Config → *Intermediate Sync Shares*
+- Settings tab → All settings → *Intermediate Sync Shares*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -204,7 +287,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Internet Loss
 
-Route: Scheduler tab → **Fallback** → Config → *Internet Loss*
+Reachable from:
+
+- Scheduler tab → **Fallback** → Config → *Internet Loss*
+- Settings tab → All settings → *Internet Loss*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -212,6 +298,18 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 |---|---|---|---|
 | `FALLBACK_HOST1_STOP_ON_NO_NET` | a list, one entry per line | in this section | Containers stopped immediately when internet is lost. |
 
+## Jellyfin
+
+Route: Settings tab → All settings → *Jellyfin*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_JELLYFIN_CONTAINER` | a text box | in this section | — |
+| `HOST1_JELLYFIN_URL` | a text box | in this section | — |
+| `HOST1_JELLYFIN_API_KEY` | a masked box with a **Show** button | in this section | — |
+
 ## Lidarr
 
 Reachable from:
@@ -222,6 +320,7 @@ Reachable from:
 - Scheduler tab → **Lidarr Duplicate Artist Cleanup** → Config → *Lidarr*
 - Scheduler tab → **Playback Aware Lidarr Discovery** → Config → *Lidarr*
 - Scheduler tab → **Emby To Lidarr Sync** → Config → *Lidarr*
+- Settings tab → All settings → *Lidarr*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -236,7 +335,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Media Cleaner
 
-Route: Scheduler tab → **Media Cleaner** → Config → *Media Cleaner*
+Reachable from:
+
+- Scheduler tab → **Media Cleaner** → Config → *Media Cleaner*
+- Settings tab → All settings → *Media Cleaner*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -252,6 +354,7 @@ Reachable from:
 - Scheduler tab → **Media Shares Permissions** → Config → *Media Permissions*
 - Scheduler tab → **Bulk Permissions Repair** → Config → *Media Permissions*
 - Scheduler tab → **Trailer Folder Migration** → Config → *Media Permissions*
+- Settings tab → All settings → *Media Permissions*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -259,9 +362,22 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 |---|---|---|---|
 | `HOST1_MEDIA_PERMISSION_SHARES` | a list, one entry per line | in this section | — |
 
+## Monthly Sync Shares
+
+Route: Settings tab → All settings → *Monthly Sync Shares*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_MONTHLY_SYNC_SHARES` | a list, one entry per line | in this section | Shares synced by monthly_maintenance.sh. Add here when ready. |
+
 ## Network Watchdog
 
-Route: Scheduler tab → **Network Watchdog** → Config → *Network Watchdog*
+Reachable from:
+
+- Scheduler tab → **Network Watchdog** → Config → *Network Watchdog*
+- Settings tab → All settings → *Network Watchdog*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -271,9 +387,21 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 | `HOST1_NETWORK_WATCHDOG_DDNS_CONTAINER` | a text box | in this section | — |
 | `HOST1_NETWORK_WATCHDOG_NPM_URL` | a text box | in this section | — |
 
+## NginxProxyManager
+
+Route: Settings tab → All settings → *NginxProxyManager*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_NPM_URL` | a text box | in this section | Admin API runs on 7818 (not 81 — 81 is the partnership WebUI port). |
+| `HOST1_NPM_USER` | a text box | in this section | NPM admin email |
+| `HOST1_NPM_PASS` | a masked box with a **Show** button | in this section | NPM admin password |
+
 ## Notifications
 
-No single page shows this section. Individual settings below carry their own route.
+Route: Settings tab → All settings → *Notifications*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -287,6 +415,7 @@ Reachable from:
 
 - Scheduler tab → **Ai Index** → Config → *Ollama*
 - Scheduler tab → **Ai Query** → Config → *Ollama*
+- Settings tab → All settings → *Ollama*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -298,7 +427,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## PARTNERSHIP
 
-Route: Partnership tab → Array Settings → *PARTNERSHIP*
+Reachable from:
+
+- Settings tab → All settings → *PARTNERSHIP*
+- Partnership tab → Array Settings → *PARTNERSHIP*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -317,6 +449,37 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 | `HOST1_PARTNERSHIP_EMBY_ADMIN_USER` | a text box | in this section | this server's desired Emby username |
 | `HOST1_PARTNERSHIP_EMBY_ADMIN_PASS` | a masked box with a **Show** button | in this section | this server's desired Emby password |
 
+## PCIe AER Quiet
+
+Route: Settings tab → All settings → *PCIe AER Quiet*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_PCIE_QUIET_DEVICES` | a list, one entry per line | in this section | Only devices bound to vfio-pci or to no driver at all are eligible. Anything with a live driver is refused, so a mistyped address cannot pull an HBA or NIC out from under a running system. Devices claimed by a running VM are refused too. Gated by PCIE_QUIET_ENABLED in master.conf. Empty list = no-op. |
+
+## Personal Shares
+
+Route: Settings tab → All settings → *Personal Shares*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_PERSONAL_SHARES` | a list, one entry per line | in this section | Private encrypted shares synced for offsite backup, independent of media shares. |
+
+## RESOURCE MANAGER
+
+Route: Settings tab → All settings → *RESOURCE MANAGER*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_RW_PAUSE_CONTAINERS` | a list, one entry per line | in this section | — |
+| `HOST1_RW_STOP_CONTAINERS` | a list, one entry per line | in this section | — |
+
 ## Radarr
 
 Reachable from:
@@ -326,6 +489,7 @@ Reachable from:
 - Scheduler tab → **Playback Aware Radarr Discovery** → Config → *Radarr*
 - Scheduler tab → **Radarr Tmdb Removed** → Config → *Radarr*
 - Scheduler tab → **Emby To Radarr Sync** → Config → *Radarr*
+- Settings tab → All settings → *Radarr*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -342,9 +506,26 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 | `HOST1_RADARR_DOWNLOAD_CONTAINER_DIR` | a text box | in this section | — |
 | `HOST1_RADARR_PATH_MAP` | a list, one entry per line | in this section | — |
 
+## Rsync Writeback
+
+Route: Settings tab → All settings → *Rsync Writeback*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_TIER1_WRITEBACK_DELAY` | a number box | in this section | skip Emby writeback if outage under 1hr |
+| `FALLBACK_HOST1_WRITEBACK_TIER1` | a list, one entry per line | in this section | — |
+| `FALLBACK_HOST1_WRITEBACK_TIER2` | a list, one entry per line | in this section | — |
+| `FALLBACK_HOST1_WRITEBACK_TIER3` | a list, one entry per line | in this section | — |
+| `FALLBACK_HOST1_WRITEBACK_TIER4` | a list, one entry per line | in this section | — |
+
 ## SMART Health
 
-Route: Scheduler tab → **Smart Health** → Config → *SMART Health*
+Reachable from:
+
+- Scheduler tab → **Smart Health** → Config → *SMART Health*
+- Settings tab → All settings → *SMART Health*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -354,7 +535,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## SYSTEM WATCHDOG
 
-Route: Scheduler tab → **Watchdog Orchestrator** → Config → *SYSTEM WATCHDOG*
+Reachable from:
+
+- Scheduler tab → **Watchdog Orchestrator** → Config → *SYSTEM WATCHDOG*
+- Settings tab → All settings → *SYSTEM WATCHDOG*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -389,6 +573,7 @@ Reachable from:
 - Scheduler tab → **Playback Aware Sonarr Discovery** → Config → *Sonarr*
 - Scheduler tab → **Sonarr Tvdb Removed** → Config → *Sonarr*
 - Scheduler tab → **Emby To Sonarr Sync** → Config → *Sonarr*
+- Settings tab → All settings → *Sonarr*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -406,7 +591,7 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## Storage mode
 
-No single page shows this section. Individual settings below carry their own route.
+Route: Settings tab → All settings → *Storage mode*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -414,9 +599,61 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 |---|---|---|---|
 | `HOST1_STORAGE_MODE_INTERNAL` | a switch | Settings tab | Controls where Varaverk stores scripts, conf, and state files. true = internal NVMe/SSD — /boot/config/plugins/varaverk (write-safe, git-direct) false = USB flash boot — /mnt/user/appdata/Varaverk (preserves flash lifetime) Auto-detected from boot device transport on first setup. To change: Settings → Storage → Migrate. |
 
+## TRANSCODES
+
+Route: Settings tab → All settings → *TRANSCODES*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_RAMDISK_SIZE` | a text box | in this section | — |
+| `HOST1_RAMDISK_WARN_GB` | a text box | in this section | flip to SSD when ramdisk usage reaches this |
+| `HOST1_RAMDISK_LOW_GB` | a number box | in this section | flip back to ramdisk when usage drops to this |
+| `HOST1_TRANSCODE_SSD` | a text box | in this section | — |
+| `HOST1_TRANSCODE_SERVERS` | a list, one entry per line | in this section | — |
+
+## Tier Delays — HOST1 Outage Timers
+
+Route: Settings tab → All settings → *Tier Delays — HOST1 Outage Timers*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_TIER2_DELAY` | a number box | in this section | 4 hours — NextCloud, Immich |
+| `HOST1_TIER3_DELAY` | a number box | in this section | 12 hours — secondary services |
+| `HOST1_TIER4_DELAY` | a number box | in this section | 24 hours — arrs + downloaders |
+
+## Unraid API
+
+Route: Settings tab → All settings → *Unraid API*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_UNRAID_API_KEY` | a masked box with a **Show** button | in this section | Used by the Varaverk plugin to query this server's Unraid GraphQL API. Generate in Unraid: Settings → Management Access → API Keys → + New Key |
+
+## Web search
+
+Route: Settings tab → All settings → *Web search*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_DEGOOG_URL` | a text box | in this section | e.g. http://localhost:4444 — self-hosted, no key, /api/search |
+| `HOST1_SEARXNG_URL` | a text box | in this section | e.g. http://localhost:8888 — needs format: [json] in its settings.yml |
+| `HOST1_WEB_SEARCH_API_KEY` | a masked box with a **Show** button | in this section | brave or tavily; unused when the provider is searxng |
+| `HOST1_OLLAMA_EMBED_MODEL` | a text box | in this section | embeddings — the generation model cannot embed |
+
 ## Weekly Sync Shares
 
-Route: Scheduler tab → **Weekly Sync Maintenance** → Config → *Weekly Sync Shares*
+Reachable from:
+
+- Scheduler tab → **Weekly Sync Maintenance** → Config → *Weekly Sync Shares*
+- Settings tab → All settings → *Weekly Sync Shares*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -426,7 +663,10 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 
 ## ZFS Report
 
-Route: Scheduler tab → **Zfs Memory Snapshot** → Config → *ZFS Report*
+Reachable from:
+
+- Scheduler tab → **Zfs Memory Snapshot** → Config → *ZFS Report*
+- Settings tab → All settings → *ZFS Report*
 
 Saved into `host1.conf`, which does not need to be opened by hand.
 
@@ -434,9 +674,24 @@ Saved into `host1.conf`, which does not need to be opened by hand.
 |---|---|---|---|
 | `HOST1_ZFS_REPORT_IGNORE_POOLS` | a list, one entry per line | in this section | — |
 
+## lldap
+
+Route: Settings tab → All settings → *lldap*
+
+Saved into `host1.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `HOST1_LLDAP_URL` | a text box | in this section | — |
+| `HOST1_LLDAP_USER` | a text box | in this section | lldap admin username |
+| `HOST1_LLDAP_PASS` | a masked box with a **Show** button | in this section | lldap admin password |
+
 ## AI Chat Caution
 
-Route: AI tab → Settings → Configuration → *AI Chat Caution*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Chat Caution*
+- Settings tab → All settings → *AI Chat Caution*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -446,7 +701,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## AI Conf Write Access
 
-Route: AI tab → Settings → Configuration → *AI Conf Write Access*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Conf Write Access*
+- Settings tab → All settings → *AI Conf Write Access*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -461,6 +719,7 @@ Reachable from:
 
 - Scheduler tab → **Ai Token Sync** → Config → *AI Feature Toggles*
 - AI tab → Settings → Configuration → *AI Feature Toggles*
+- Settings tab → All settings → *AI Feature Toggles*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -474,7 +733,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## AI Learned Memory
 
-Route: AI tab → Settings → Configuration → *AI Learned Memory*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Learned Memory*
+- Settings tab → All settings → *AI Learned Memory*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -491,6 +753,7 @@ Reachable from:
 - Scheduler tab → **Ai Query** → Config → *AI Master Switch*
 - Scheduler tab → **Ai Repair Sweep** → Config → *AI Master Switch*
 - AI tab → Settings → Configuration → *AI Master Switch*
+- Settings tab → All settings → *AI Master Switch*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -504,7 +767,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## AI Memory
 
-Route: AI tab → Settings → Configuration → *AI Memory*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Memory*
+- Settings tab → All settings → *AI Memory*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -524,6 +790,7 @@ Reachable from:
 
 - Scheduler tab → **Ai Repair Sweep** → Config → *AI Repair*
 - AI tab → Settings → Configuration → *AI Repair*
+- Settings tab → All settings → *AI Repair*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -538,6 +805,7 @@ Reachable from:
 
 - Scheduler tab → **Ai Repair Sweep** → Config → *AI Repair Findings*
 - AI tab → Settings → Configuration → *AI Repair Findings*
+- Settings tab → All settings → *AI Repair Findings*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -549,7 +817,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## AI Repair: what it reads
 
-Route: AI tab → Settings → Configuration → *AI Repair: what it reads*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Repair: what it reads*
+- Settings tab → All settings → *AI Repair: what it reads*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -567,6 +838,7 @@ Reachable from:
 - Scheduler tab → **Ai Index** → Config → *AI Retrieval Index*
 - Scheduler tab → **Ai Query** → Config → *AI Retrieval Index*
 - AI tab → Settings → Configuration → *AI Retrieval Index*
+- Settings tab → All settings → *AI Retrieval Index*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -580,7 +852,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## AI Stored Conversations
 
-Route: AI tab → Settings → Configuration → *AI Stored Conversations*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Stored Conversations*
+- Settings tab → All settings → *AI Stored Conversations*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -590,7 +865,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## AI Token Accounting
 
-Route: AI tab → Settings → Configuration → *AI Token Accounting*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Token Accounting*
+- Settings tab → All settings → *AI Token Accounting*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -602,7 +880,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## AI Web Search
 
-Route: AI tab → Settings → Configuration → *AI Web Search*
+Reachable from:
+
+- AI tab → Settings → Configuration → *AI Web Search*
+- Settings tab → All settings → *AI Web Search*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -613,6 +894,18 @@ Saved into `master.conf`, which does not need to be opened by hand.
 | `AI_WEB_SEARCH_RESULTS` | a number box | in this section | — |
 | `AI_WEB_SEARCH_TIMEOUT` | a number box | in this section | — |
 
+## Abort Toggles
+
+Route: Settings tab → All settings → *Abort Toggles*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `SYS_WATCHDOG_ABORT_ON_ZFS_UNHEALTHY` | a switch | in this section | rebooting with bad pool risks data loss |
+| `SYS_WATCHDOG_ABORT_ON_PARITY` | a switch | in this section | aborting parity better than crashing mid-check |
+| `SYS_WATCHDOG_ABORT_ON_MOVER` | a switch | in this section | aborting move better than crashing mid-move |
+
 ## Arr Cleanup
 
 Reachable from:
@@ -620,6 +913,7 @@ Reachable from:
 - Scheduler tab → **Radarr Cleanup** → Config → *Arr Cleanup*
 - Scheduler tab → **Lidarr Cleanup** → Config → *Arr Cleanup*
 - Scheduler tab → **Sonarr Cleanup** → Config → *Arr Cleanup*
+- Settings tab → All settings → *Arr Cleanup*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -706,6 +1000,7 @@ Reachable from:
 
 - Scheduler tab → **Radarr Classification Scan** → Config → *Arr Content Classification (radarr/sonarr_classification_scan.sh)*
 - Scheduler tab → **Sonarr Classification Scan** → Config → *Arr Content Classification (radarr/sonarr_classification_scan.sh)*
+- Settings tab → All settings → *Arr Content Classification (radarr/sonarr_classification_scan.sh)*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -719,7 +1014,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Arr Failed/Stalled Recovery
 
-Route: Scheduler tab → **Arrs Failed Stalled Recovery** → Config → *Arr Failed/Stalled Recovery*
+Reachable from:
+
+- Scheduler tab → **Arrs Failed Stalled Recovery** → Config → *Arr Failed/Stalled Recovery*
+- Settings tab → All settings → *Arr Failed/Stalled Recovery*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -732,7 +1030,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Arr Full Library Rescan
 
-Route: Scheduler tab → **Arr Full Rescan** → Config → *Arr Full Library Rescan*
+Reachable from:
+
+- Scheduler tab → **Arr Full Rescan** → Config → *Arr Full Library Rescan*
+- Settings tab → All settings → *Arr Full Library Rescan*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -740,9 +1041,29 @@ Saved into `master.conf`, which does not need to be opened by hand.
 |---|---|---|---|
 | `ARR_FULL_RESCAN_TIMEOUT` | a number box, in seconds | in this section | seconds per arr — a full-library walk, not a single release |
 
+## Arr Sync
+
+Route: Settings tab → All settings → *Arr Sync*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `ARR_SYNC_ENABLED` | a switch | in this section | arr_sync.sh syncs Lidarr/Sonarr/Radarr libraries across all nodes bidirectionally. Runs before rsync — all nodes agree on tracked library before files are transferred. Remote API keys are read live from each node's config.xml via SSH — never stored here. |
+| `ARR_SYNC_BLOCKLIST` | a text box | in this section | — |
+| `ARR_SYNC_CONNECT_TIMEOUT` | a number box, in seconds | in this section | seconds — SSH connect timeout per node |
+| `ARR_SYNC_API_TIMEOUT` | a number box, in seconds | in this section | seconds — curl timeout for library fetches |
+| `DOCKER_APPDATA_BASE` | a text box | in this section | set by platform adapter; override in host*.conf if needed |
+| `ARR_SYNC_LIDARR_PORT` | a number box | in this section | — |
+| `ARR_SYNC_SONARR_PORT` | a number box | in this section | — |
+| `ARR_SYNC_RADARR_PORT` | a number box | in this section | — |
+
 ## Array Start
 
-Route: Scheduler tab → **Array Started** → Config → *Array Start*
+Reachable from:
+
+- Scheduler tab → **Array Started** → Config → *Array Start*
+- Settings tab → All settings → *Array Start*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -752,7 +1073,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Array Stop
 
-Route: Scheduler tab → **Array Stopping** → Config → *Array Stop*
+Reachable from:
+
+- Scheduler tab → **Array Stopping** → Config → *Array Stop*
+- Settings tab → All settings → *Array Stop*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -762,7 +1086,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Backup Verify
 
-Route: Scheduler tab → **Backup Verify** → Config → *Backup Verify*
+Reachable from:
+
+- Scheduler tab → **Backup Verify** → Config → *Backup Verify*
+- Settings tab → All settings → *Backup Verify*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -773,7 +1100,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Bandwidth Monitor
 
-Route: Scheduler tab → **Bandwidth Monitor** → Config → *Bandwidth Monitor*
+Reachable from:
+
+- Scheduler tab → **Bandwidth Monitor** → Config → *Bandwidth Monitor*
+- Settings tab → All settings → *Bandwidth Monitor*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -792,6 +1122,7 @@ Reachable from:
 
 - Scheduler tab → **Cert Monitor** → Config → *Certificate Monitor*
 - Scheduler tab → **Weekly Health Digest** → Config → *Certificate Monitor*
+- Settings tab → All settings → *Certificate Monitor*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -803,7 +1134,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Clear Logs
 
-Route: Scheduler tab → **Clear Logs** → Config → *Clear Logs*
+Reachable from:
+
+- Scheduler tab → **Clear Logs** → Config → *Clear Logs*
+- Settings tab → All settings → *Clear Logs*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -813,9 +1147,42 @@ Saved into `master.conf`, which does not need to be opened by hand.
 | `LOG_MIN_SIZE_MB` | a number box | in this section | skip system log if under this size (already small) |
 | `LOG_DOCKER_MAX_MB` | a number box | in this section | clear Docker container log only if over this size (MB) |
 
+## Conf Backups
+
+Route: Settings tab → All settings → *Conf Backups*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `CONF_BACKUP_RETAIN` | a number box | in this section | Every write through the plugin copies the conf aside first, to CONF_BACKUP_DIR with an ISO-8601 stamp. The confs are gitignored, so that directory is the whole recovery path — there is no history to revert to. A backup that cannot be taken cancels the write. Oldest are pruned past this count, per conf file. |
+
+## Conf Sync
+
+Route: Settings tab → All settings → *Conf Sync*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `CONF_SYNC_ENABLED` | a switch | in this section | HOST2 rebuild in progress — re-enable when HOST2 is back online |
+
+## Critical Containers
+
+Route: Settings tab → All settings → *Critical Containers*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `RW_CRITICAL_CONTAINERS` | a list, one entry per line | in this section | Never paused or stopped regardless of pressure level. Keep DNS, auth, media serving, and live TV always running. |
+
 ## Critical Sync Maintenance
 
-Route: Scheduler tab → **Critical Sync Maintenance** → Config → *Critical Sync Maintenance*
+Reachable from:
+
+- Scheduler tab → **Critical Sync Maintenance** → Config → *Critical Sync Maintenance*
+- Settings tab → All settings → *Critical Sync Maintenance*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -825,7 +1192,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Daily Sync Maintenance
 
-Route: Scheduler tab → **Daily Sync Maintenance** → Config → *Daily Sync Maintenance*
+Reachable from:
+
+- Scheduler tab → **Daily Sync Maintenance** → Config → *Daily Sync Maintenance*
+- Settings tab → All settings → *Daily Sync Maintenance*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -836,7 +1206,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Docker Watchdog
 
-Route: Scheduler tab → **Docker Watchdog** → Config → *Docker Watchdog*
+Reachable from:
+
+- Scheduler tab → **Docker Watchdog** → Config → *Docker Watchdog*
+- Settings tab → All settings → *Docker Watchdog*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -876,7 +1249,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Download Orphan Cleaner (arr_download_orphan_cleaner.sh)
 
-Route: Scheduler tab → **Arr Download Orphan Cleaner** → Config → *Download Orphan Cleaner (arr_download_orphan_cleaner.sh)*
+Reachable from:
+
+- Scheduler tab → **Arr Download Orphan Cleaner** → Config → *Download Orphan Cleaner (arr_download_orphan_cleaner.sh)*
+- Settings tab → All settings → *Download Orphan Cleaner (arr_download_orphan_cleaner.sh)*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -887,9 +1263,22 @@ Saved into `master.conf`, which does not need to be opened by hand.
 | `DOWNLOAD_ORPHAN_MIN_VIDEO_MB` | a number box | in this section | no video file above this = junk (par2 debris, samples, dead archives) |
 | `DOWNLOAD_ORPHAN_MAX_DELETE_GB` | a number box | in this section | abort delete pass over this — a partial queue fetch would classify |
 
+## Download Webhook
+
+Route: Settings tab → All settings → *Download Webhook*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `DOWNLOAD_WEBHOOK_ENABLED` | a switch | in this section | Immediate push to remote nodes on every Sonarr/Radarr/Lidarr Download event. Prevents remotes from searching for content that is already on disk locally. |
+
 ## Downloaders Reset
 
-Route: Scheduler tab → **Downloaders Reset** → Config → *Downloaders Reset*
+Reachable from:
+
+- Scheduler tab → **Downloaders Reset** → Config → *Downloaders Reset*
+- Settings tab → All settings → *Downloaders Reset*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -901,7 +1290,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Emby Session Report
 
-Route: Scheduler tab → **Emby Session Report** → Config → *Emby Session Report*
+Reachable from:
+
+- Scheduler tab → **Emby Session Report** → Config → *Emby Session Report*
+- Settings tab → All settings → *Emby Session Report*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -912,22 +1304,25 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## FALLBACK
 
-No single page shows this section. Individual settings below carry their own route.
+Route: Settings tab → All settings → *FALLBACK*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
 | Setting | Control | Where | What it does |
 |---|---|---|---|
-| `EXTERNAL_IP` | a text box | — | — |
+| `EXTERNAL_IP` | a text box | in this section | — |
 | `FALLBACK_CHECK_INTERVAL` | a number box, in seconds | Fallback tab | seconds between fallback state checks |
 | `FALLBACK_HANDBACK_STRIKES` | a number box, in consecutive | Fallback tab | consecutive healthy checks before initiating handback (3×30s = 90s) |
-| `FALLBACK_STATE_FILE` | a text box | — | — |
+| `FALLBACK_STATE_FILE` | a text box | in this section | — |
 | `FALLBACK_ENABLED` | a switch | Fallback tab | HOST2 back online |
 | `FALLBACK_PARTNERSHIP_SUSPEND_AFTER` | a number box, in minutes | Fallback tab | minutes without active partnership before suspending |
 
 ## Failover Test
 
-Route: Scheduler tab → **Fallback Test** → Config → *Failover Test*
+Reachable from:
+
+- Scheduler tab → **Fallback Test** → Config → *Failover Test*
+- Settings tab → All settings → *Failover Test*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -938,7 +1333,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Health Digest
 
-Route: Scheduler tab → **Weekly Health Digest** → Config → *Health Digest*
+Reachable from:
+
+- Scheduler tab → **Weekly Health Digest** → Config → *Health Digest*
+- Settings tab → All settings → *Health Digest*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -953,7 +1351,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Intermediate Sync Maintenance
 
-Route: Scheduler tab → **Intermediate Sync Maintenance** → Config → *Intermediate Sync Maintenance*
+Reachable from:
+
+- Scheduler tab → **Intermediate Sync Maintenance** → Config → *Intermediate Sync Maintenance*
+- Settings tab → All settings → *Intermediate Sync Maintenance*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -963,7 +1364,7 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## LOGGING
 
-No single page shows this section. Individual settings below carry their own route.
+Route: Settings tab → All settings → *LOGGING*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -973,7 +1374,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Media Cleaner
 
-Route: Scheduler tab → **Media Cleaner** → Config → *Media Cleaner*
+Reachable from:
+
+- Scheduler tab → **Media Cleaner** → Config → *Media Cleaner*
+- Settings tab → All settings → *Media Cleaner*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -989,6 +1393,7 @@ Reachable from:
 - Scheduler tab → **Media Shares Permissions** → Config → *Media Permissions*
 - Scheduler tab → **Bulk Permissions Repair** → Config → *Media Permissions*
 - Scheduler tab → **Trailer Folder Migration** → Config → *Media Permissions*
+- Settings tab → All settings → *Media Permissions*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1000,7 +1405,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Monthly Maintenance
 
-Route: Scheduler tab → **Monthly Maintenance** → Config → *Monthly Maintenance*
+Reachable from:
+
+- Scheduler tab → **Monthly Maintenance** → Config → *Monthly Maintenance*
+- Settings tab → All settings → *Monthly Maintenance*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1013,7 +1421,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Mover
 
-Route: Scheduler tab → **Mover Stop** → Config → *Mover*
+Reachable from:
+
+- Scheduler tab → **Mover Stop** → Config → *Mover*
+- Settings tab → All settings → *Mover*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1023,19 +1434,22 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## NOTIFICATIONS
 
-No single page shows this section. Individual settings below carry their own route.
+Route: Settings tab → All settings → *NOTIFICATIONS*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
 | Setting | Control | Where | What it does |
 |---|---|---|---|
 | `NOTIFY_UNRAID` | a switch | Settings tab | unRAID native notification system — integrates with the bell icon in the WebGUI. normal = job completed successfully / warning = something failed or needs attention |
-| `WEBHOOK_PORT` | a number box | — | Upgrade webhook — standalone PHP listener that receives OnUpgrade events from Sonarr/Radarr/Lidarr and immediately pushes the upgraded file to all mesh nodes. Bypasses Unraid nginx auth — the secret in the URL is the only gate. Run Tools/webhook_setup.sh once to register the connection in each arr. WEBHOOK_PORT 0 disables the listener. |
-| `WEBHOOK_SECRET` | a masked box with a **Show** button | — | auto-generated on first start if empty |
+| `WEBHOOK_PORT` | a number box | in this section | Upgrade webhook — standalone PHP listener that receives OnUpgrade events from Sonarr/Radarr/Lidarr and immediately pushes the upgraded file to all mesh nodes. Bypasses Unraid nginx auth — the secret in the URL is the only gate. Run Tools/webhook_setup.sh once to register the connection in each arr. WEBHOOK_PORT 0 disables the listener. |
+| `WEBHOOK_SECRET` | a masked box with a **Show** button | in this section | auto-generated on first start if empty |
 
 ## Network Watchdog
 
-Route: Scheduler tab → **Network Watchdog** → Config → *Network Watchdog*
+Reachable from:
+
+- Scheduler tab → **Network Watchdog** → Config → *Network Watchdog*
+- Settings tab → All settings → *Network Watchdog*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1051,7 +1465,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## OOM Bypass Settings
 
-Route: Scheduler tab → **Stability Watchdog** → Config → *OOM Bypass Settings*
+Reachable from:
+
+- Scheduler tab → **Stability Watchdog** → Config → *OOM Bypass Settings*
+- Settings tab → All settings → *OOM Bypass Settings*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1061,7 +1478,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## PARTNERSHIP
 
-Route: Partnership tab → Array Settings → *PARTNERSHIP*
+Reachable from:
+
+- Settings tab → All settings → *PARTNERSHIP*
+- Partnership tab → Array Settings → *PARTNERSHIP*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1087,9 +1507,33 @@ Saved into `master.conf`, which does not need to be opened by hand.
 | `PARTNERSHIP_FOLDERVIEW3` | a switch | in this section | create/remove FolderView3 folder on onboard/offboard |
 | `PARTNERSHIP_FOLDERVIEW3_URL` | a text box | in this section | CA plugin URL — leave empty to skip auto-install |
 
+## PCIe AER Quiet
+
+Route: Settings tab → All settings → *PCIe AER Quiet*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `PCIE_QUIET_ENABLED` | a switch | in this section | Devices are listed per host in host*.conf as HOST*_PCIE_QUIET_DEVICES. Off by default — turn on only after filling in that list for this host. |
+
+## PER-HOST CONTAINER LISTS
+
+Route: Settings tab → All settings → *PER-HOST CONTAINER LISTS*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `RW_ENABLED` | a switch | in this section | — |
+| `RW_STATE_FILE` | a text box | in this section | — |
+
 ## PHP-FPM
 
-Route: Scheduler tab → **Php Fpm Max Children** → Config → *PHP-FPM*
+Reachable from:
+
+- Scheduler tab → **Php Fpm Max Children** → Config → *PHP-FPM*
+- Settings tab → All settings → *PHP-FPM*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1100,7 +1544,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Play State Sync
 
-Route: Scheduler tab → **Play State Sync** → Config → *Play State Sync*
+Reachable from:
+
+- Scheduler tab → **Play State Sync** → Config → *Play State Sync*
+- Settings tab → All settings → *Play State Sync*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1119,6 +1566,7 @@ Reachable from:
 
 - Scheduler tab → **Play State Sync** → Config → *Play State Sync — Handback*
 - Scheduler tab → **Fallback** → Config → *Play State Sync — Handback*
+- Settings tab → All settings → *Play State Sync — Handback*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1129,7 +1577,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Pressure Thresholds
 
-Route: Scheduler tab → **Resource Watchdog** → Config → *Pressure Thresholds*
+Reachable from:
+
+- Scheduler tab → **Resource Watchdog** → Config → *Pressure Thresholds*
+- Settings tab → All settings → *Pressure Thresholds*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1145,7 +1596,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## RAM Reboot Threshold
 
-Route: Scheduler tab → **Stability Watchdog** → Config → *RAM Reboot Threshold*
+Reachable from:
+
+- Scheduler tab → **Stability Watchdog** → Config → *RAM Reboot Threshold*
+- Settings tab → All settings → *RAM Reboot Threshold*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1155,7 +1609,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Reboot
 
-Route: Scheduler tab → **Server Reboot** → Config → *Reboot*
+Reachable from:
+
+- Scheduler tab → **Server Reboot** → Config → *Reboot*
+- Settings tab → All settings → *Reboot*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1164,9 +1621,32 @@ Saved into `master.conf`, which does not need to be opened by hand.
 | `REBOOT_SLEEP` | a number box, in seconds | in this section | Seconds of warning broadcast to logged-in users before server_reboot.sh reboots. Gives users time to save work — 300s = 5 minutes. |
 | `REBOOT_VM_WAIT` | a number box, in seconds | in this section | Seconds to wait for graceful VM shutdown (ACPI signal via virsh) before libvirt stops it anyway — reboot takes priority. |
 
+## Remote Docker Daemon
+
+Route: Settings tab → All settings → *Remote Docker Daemon*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `REMOTE_DOCKER_STRIKE_LIMIT` | a number box, in consecutive | in this section | consecutive failures before critical notify |
+
+## Remote Health Checks
+
+Route: Settings tab → All settings → *Remote Health Checks*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `ROOTFS_WARN` | a number box | in this section | Pre-flight — aborts if remote rootfs (/) usage is at or above this percentage. When remote array is down, rsync writes land on rootfs and fill it rapidly. |
+
 ## Rsync Defaults
 
-Route: Scheduler tab → **Rsync** → Config → *Rsync Defaults*
+Reachable from:
+
+- Scheduler tab → **Rsync** → Config → *Rsync Defaults*
+- Settings tab → All settings → *Rsync Defaults*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1185,7 +1665,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Rsync Enable/Disable
 
-Route: Scheduler tab → **Rsync** → Config → *Rsync Enable/Disable*
+Reachable from:
+
+- Scheduler tab → **Rsync** → Config → *Rsync Enable/Disable*
+- Settings tab → All settings → *Rsync Enable/Disable*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1201,7 +1684,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Rsync Merge Auto-Promote
 
-Route: Scheduler tab → **Rsync** → Config → *Rsync Merge Auto-Promote*
+Reachable from:
+
+- Scheduler tab → **Rsync** → Config → *Rsync Merge Auto-Promote*
+- Settings tab → All settings → *Rsync Merge Auto-Promote*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1211,7 +1697,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Rsync Profile System
 
-Route: Scheduler tab → **Rsync** → Config → *Rsync Profile System*
+Reachable from:
+
+- Scheduler tab → **Rsync** → Config → *Rsync Profile System*
+- Settings tab → All settings → *Rsync Profile System*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1228,7 +1717,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## SABnzbd Throttle
 
-Route: Scheduler tab → **Resource Watchdog** → Config → *SABnzbd Throttle*
+Reachable from:
+
+- Scheduler tab → **Resource Watchdog** → Config → *SABnzbd Throttle*
+- Settings tab → All settings → *SABnzbd Throttle*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1240,7 +1732,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## SMART Health
 
-Route: Scheduler tab → **Smart Health** → Config → *SMART Health*
+Reachable from:
+
+- Scheduler tab → **Smart Health** → Config → *SMART Health*
+- Settings tab → All settings → *SMART Health*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1251,7 +1746,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Strike and Reboot Loop Settings
 
-Route: Scheduler tab → **Stability Watchdog** → Config → *Strike and Reboot Loop Settings*
+Reachable from:
+
+- Scheduler tab → **Stability Watchdog** → Config → *Strike and Reboot Loop Settings*
+- Settings tab → All settings → *Strike and Reboot Loop Settings*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1263,7 +1761,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Sunday Morning Coffee Report
 
-Route: Scheduler tab → **Sunday Morning Coffee Report** → Config → *Sunday Morning Coffee Report*
+Reachable from:
+
+- Scheduler tab → **Sunday Morning Coffee Report** → Config → *Sunday Morning Coffee Report*
+- Settings tab → All settings → *Sunday Morning Coffee Report*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1273,7 +1774,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Syslog Filter
 
-Route: Scheduler tab → **Docker Syslog Filter** → Config → *Syslog Filter*
+Reachable from:
+
+- Scheduler tab → **Docker Syslog Filter** → Config → *Syslog Filter*
+- Settings tab → All settings → *Syslog Filter*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1283,7 +1787,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## System Tuning Monitor
 
-Route: Scheduler tab → **System Tuning Monitor** → Config → *System Tuning Monitor*
+Reachable from:
+
+- Scheduler tab → **System Tuning Monitor** → Config → *System Tuning Monitor*
+- Settings tab → All settings → *System Tuning Monitor*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1296,7 +1803,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## System Watchdog
 
-Route: Scheduler tab → **Watchdog Orchestrator** → Config → *System Watchdog*
+Reachable from:
+
+- Scheduler tab → **Watchdog Orchestrator** → Config → *System Watchdog*
+- Settings tab → All settings → *System Watchdog*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1304,9 +1814,35 @@ Saved into `master.conf`, which does not need to be opened by hand.
 |---|---|---|---|
 | `SYSTEM_WATCHDOG_SCRIPTS` | a list, one entry per line | in this section | system_watchdog.sh runs SYSTEM_WATCHDOG_SCRIPTS sequentially each cycle. Called by watchdog_orchestrator.sh — not scheduled directly. |
 
+## Thresholds
+
+Route: Settings tab → All settings → *Thresholds*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `SYS_WATCHDOG_ROOTFS_PCT` | a number box | in this section | standard strike threshold |
+| `SYS_WATCHDOG_ROOTFS_CRITICAL_PCT` | a number box | in this section | bypass strikes — truly full, writes failing |
+| `SYS_WATCHDOG_LOG_PCT` | a number box | in this section | /var/log usage — log spam indicates something broken |
+| `SYS_WATCHDOG_TMP_PCT` | a number box | in this section | warn + attempt clear |
+| `SYS_WATCHDOG_TMP_CRITICAL_PCT` | a number box | in this section | bypass strikes if clear failed |
+| `SYS_WATCHDOG_ARC_PINNED_PCT` | a number box | in this section | ZFS ARC pinned percentage — ARC not releasing after reclaim = memory stuck |
+| `SYS_WATCHDOG_ARC_RELEASE_PCT` | a number box | in this section | — |
+| `SYS_WATCHDOG_LOAD_MULTIPLIER` | a number box | in this section | Load average multiplier — threshold = MULTIPLIER × CPU core count MULTIPLIER=3 on 16-core = load of 48 before triggering |
+| `SYS_WATCHDOG_ZOMBIE_LIMIT` | a number box | in this section | Zombie process count — large numbers = serious process management failure |
+| `SYS_WATCHDOG_CPU_TEMP_MAX` | a number box | in this section | CPU temperature — sustained high temp causes throttling or kernel panic |
+| `SYS_WATCHDOG_FD_CRITICAL_PCT` | a number box | in this section | bypass strikes — critical tier |
+| `SYS_WATCHDOG_RUNAWAY_CPU_PCT` | a number box | in this section | % single process must sustain |
+| `SYS_WATCHDOG_RUNAWAY_STRIKES` | a number box, in consecutive | in this section | consecutive cycles before warning |
+| `SYS_WATCHDOG_MDSTAT_ERROR_LIMIT` | a number box | in this section | new errors in one cycle before acting |
+
 ## Transcode Management
 
-Route: Scheduler tab → **Transcode Management** → Config → *Transcode Management*
+Reachable from:
+
+- Scheduler tab → **Transcode Management** → Config → *Transcode Management*
+- Settings tab → All settings → *Transcode Management*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1320,6 +1856,7 @@ Reachable from:
 
 - Scheduler tab → **Transcode Management** → Config → *Transcode Manager*
 - Scheduler tab → **Transcode Manager** → Config → *Transcode Manager*
+- Settings tab → All settings → *Transcode Manager*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1339,9 +1876,22 @@ Saved into `master.conf`, which does not need to be opened by hand.
 | `TRANSCODE_LOG_RETENTION` | a number box, in days | in this section | days before old entries purged |
 | `TRANSCODE_CHECK_EMBY` | a switch | in this section | — |
 
+## Version Parity
+
+Route: Settings tab → All settings → *Version Parity*
+
+Saved into `master.conf`, which does not need to be opened by hand.
+
+| Setting | Control | Where | What it does |
+|---|---|---|---|
+| `UNRAID_VERSION_MISMATCH_ACTION` | a dropdown (warn, abort) | in this section | Controls behaviour when local and remote unRAID versions differ. Major version mismatch always aborts regardless of this setting. "warn" — log warning and continue (safe for minor/patch differences) "abort" — refuse to continue (strict — ensures both sides always match) |
+
 ## Watchdog Orchestrator
 
-Route: Scheduler tab → **Watchdog Orchestrator** → Config → *Watchdog Orchestrator*
+Reachable from:
+
+- Scheduler tab → **Watchdog Orchestrator** → Config → *Watchdog Orchestrator*
+- Settings tab → All settings → *Watchdog Orchestrator*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1351,7 +1901,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## WebGUI Watchdog
 
-Route: Scheduler tab → **Webgui Watchdog** → Config → *WebGUI Watchdog*
+Reachable from:
+
+- Scheduler tab → **Webgui Watchdog** → Config → *WebGUI Watchdog*
+- Settings tab → All settings → *WebGUI Watchdog*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1365,7 +1918,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## Weekly Sync Maintenance
 
-Route: Scheduler tab → **Weekly Sync Maintenance** → Config → *Weekly Sync Maintenance*
+Reachable from:
+
+- Scheduler tab → **Weekly Sync Maintenance** → Config → *Weekly Sync Maintenance*
+- Settings tab → All settings → *Weekly Sync Maintenance*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1382,7 +1938,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## ZFS Memory Snapshot
 
-Route: Scheduler tab → **Zfs Memory Snapshot** → Config → *ZFS Memory Snapshot*
+Reachable from:
+
+- Scheduler tab → **Zfs Memory Snapshot** → Config → *ZFS Memory Snapshot*
+- Settings tab → All settings → *ZFS Memory Snapshot*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1396,7 +1955,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## inotify Tuning
 
-Route: Scheduler tab → **Inotify Tuning** → Config → *inotify Tuning*
+Reachable from:
+
+- Scheduler tab → **Inotify Tuning** → Config → *inotify Tuning*
+- Settings tab → All settings → *inotify Tuning*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1408,7 +1970,10 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ## qBittorrent Throttle
 
-Route: Scheduler tab → **Resource Watchdog** → Config → *qBittorrent Throttle*
+Reachable from:
+
+- Scheduler tab → **Resource Watchdog** → Config → *qBittorrent Throttle*
+- Settings tab → All settings → *qBittorrent Throttle*
 
 Saved into `master.conf`, which does not need to be opened by hand.
 
@@ -1420,42 +1985,22 @@ Saved into `master.conf`, which does not need to be opened by hand.
 
 ---
 
-## Settings with no route through the UI
+## Settings deliberately kept out of the UI
 
-These sections are not rendered by any page, so they can only be changed by editing
-the conf file. If one of these is asked about, say so plainly rather than inventing a
-route — mapping it into the Scheduler is a code change, not a setting.
+These have no control on purpose. They hold the machine's identity and the roots
+everything else is derived from, and a text box beside a Save button is the wrong
+shape for a value that decides whether the server recognises itself on next boot.
 
-- **Authelia** (`host1.conf`) — `HOST1_AUTHELIA_CONFIG`, `HOST1_AUTHELIA_CONTAINER`
-- **Fallback Tiers — What HOST1 Wants Covered When Down** (`host1.conf`) — `FALLBACK_HOST1_TIER1`, `FALLBACK_HOST1_TIER2`, `FALLBACK_HOST1_TIER3`, `FALLBACK_HOST1_TIER4`
-- **Gitea** (`host1.conf`) — `HOST1_GITEA_API_TOKEN`
-- **Identity** (`host1.conf`) — `HOST1_SSH_KEY`, `HOST1_STORAGE_PATH`, `HOST1_OWNER`, `HOST1_OWNER_EMAIL`
-- **Jellyfin** (`host1.conf`) — `HOST1_JELLYFIN_CONTAINER`, `HOST1_JELLYFIN_URL`, `HOST1_JELLYFIN_API_KEY`
-- **Monthly Sync Shares** (`host1.conf`) — `HOST1_MONTHLY_SYNC_SHARES`
-- **NginxProxyManager** (`host1.conf`) — `HOST1_NPM_URL`, `HOST1_NPM_USER`, `HOST1_NPM_PASS`
-- **PCIe AER Quiet** (`host1.conf`) — `HOST1_PCIE_QUIET_DEVICES`
-- **Personal Shares** (`host1.conf`) — `HOST1_PERSONAL_SHARES`
-- **RESOURCE MANAGER** (`host1.conf`) — `HOST1_RW_PAUSE_CONTAINERS`, `HOST1_RW_STOP_CONTAINERS`
-- **Rsync Writeback** (`host1.conf`) — `HOST1_TIER1_WRITEBACK_DELAY`, `FALLBACK_HOST1_WRITEBACK_TIER1`, `FALLBACK_HOST1_WRITEBACK_TIER2`, `FALLBACK_HOST1_WRITEBACK_TIER3`, `FALLBACK_HOST1_WRITEBACK_TIER4`
-- **TRANSCODES** (`host1.conf`) — `HOST1_RAMDISK_SIZE`, `HOST1_RAMDISK_WARN_GB`, `HOST1_RAMDISK_LOW_GB`, `HOST1_TRANSCODE_SSD`, `HOST1_TRANSCODE_SERVERS`
-- **Tier Delays — HOST1 Outage Timers** (`host1.conf`) — `HOST1_TIER2_DELAY`, `HOST1_TIER3_DELAY`, `HOST1_TIER4_DELAY`
-- **Unraid API** (`host1.conf`) — `HOST1_UNRAID_API_KEY`
-- **Web search** (`host1.conf`) — `HOST1_DEGOOG_URL`, `HOST1_SEARXNG_URL`, `HOST1_WEB_SEARCH_API_KEY`, `HOST1_OLLAMA_EMBED_MODEL`
-- **lldap** (`host1.conf`) — `HOST1_LLDAP_URL`, `HOST1_LLDAP_USER`, `HOST1_LLDAP_PASS`
-- **Abort Toggles** (`master.conf`) — `SYS_WATCHDOG_ABORT_ON_ZFS_UNHEALTHY`, `SYS_WATCHDOG_ABORT_ON_PARITY`, `SYS_WATCHDOG_ABORT_ON_MOVER`
-- **Arr Sync** (`master.conf`) — `ARR_SYNC_ENABLED`, `ARR_SYNC_BLOCKLIST`, `ARR_SYNC_CONNECT_TIMEOUT`, `ARR_SYNC_API_TIMEOUT`, `DOCKER_APPDATA_BASE`, `ARR_SYNC_LIDARR_PORT`, `ARR_SYNC_SONARR_PORT`, `ARR_SYNC_RADARR_PORT`
-- **Cache Roots** (`master.conf`) — `VV_CACHE_ROOT`, `VV_CACHE_DIR`, `CONF_RAM_CACHE_DIR`, `ARR_CACHE_DIR`, `AI_TOKEN_CACHE_DIR`, `AI_JOB_DIR`, `DOCKER_JOB_DIR`
-- **Conf Backups** (`master.conf`) — `CONF_BACKUP_RETAIN`
-- **Conf Sync** (`master.conf`) — `CONF_SYNC_ENABLED`
-- **Critical Containers** (`master.conf`) — `RW_CRITICAL_CONTAINERS`
-- **Download Webhook** (`master.conf`) — `DOWNLOAD_WEBHOOK_ENABLED`
-- **GIT / REPO** (`master.conf`) — `GITEA_CONTAINER`, `GITEA_REPO_PATH`, `GITEA_DOMAIN`, `TARGET_DIR`, `GITEA_SSH_KEY`, `SSH_PORT`, `GITEA_HTTP_PORT`
-- **HOST IDENTITIES** (`master.conf`) — `HOST1`, `HOST2`
-- **PCIe AER Quiet** (`master.conf`) — `PCIE_QUIET_ENABLED`
-- **PER-HOST CONTAINER LISTS** (`master.conf`) — `RW_ENABLED`, `RW_STATE_FILE`
-- **Remote Docker Daemon** (`master.conf`) — `REMOTE_DOCKER_STRIKE_LIMIT`
-- **Remote Health Checks** (`master.conf`) — `ROOTFS_WARN`
-- **SHARED HOST CONFIGURATION** (`master.conf`) — `DATA_DIR`, `DB_DIR`, `STATE_DIR`, `AI_DATA_DIR`, `CACHE_BACKUP_DIR`, `LOG_ARCHIVE_DIR`, `BACKUP_DIR`, `CONF_BACKUP_DIR`, `PERSISTENT_CONF_CACHE`, `ARR_CACHE_BACKUP_DIR`
-- **State Files** (`master.conf`) — `SYS_WATCHDOG_STATE_FILE`, `DOCKER_WATCHDOG_FAILED_FILE`, `DOCKER_WATCHDOG_INTENTIONAL_FILE`, `SYS_WATCHDOG_REBOOT_LOG`, `SYS_WATCHDOG_OOM_FILE`
-- **Thresholds** (`master.conf`) — `SYS_WATCHDOG_ROOTFS_PCT`, `SYS_WATCHDOG_ROOTFS_CRITICAL_PCT`, `SYS_WATCHDOG_LOG_PCT`, `SYS_WATCHDOG_TMP_PCT`, `SYS_WATCHDOG_TMP_CRITICAL_PCT`, `SYS_WATCHDOG_ARC_PINNED_PCT`, `SYS_WATCHDOG_ARC_RELEASE_PCT`, `SYS_WATCHDOG_LOAD_MULTIPLIER`, `SYS_WATCHDOG_ZOMBIE_LIMIT`, `SYS_WATCHDOG_CPU_TEMP_MAX`, `SYS_WATCHDOG_FD_CRITICAL_PCT`, `SYS_WATCHDOG_RUNAWAY_CPU_PCT`, `SYS_WATCHDOG_RUNAWAY_STRIKES`, `SYS_WATCHDOG_MDSTAT_ERROR_LIMIT`
-- **Version Parity** (`master.conf`) — `UNRAID_VERSION_MISMATCH_ACTION`
+If one is asked about, give the reason and say it is edited in the conf file directly.
+Do not describe a route — there is none, and that is the point.
+
+- **Cache Roots** (`master.conf`) — `VV_CACHE_ROOT`, `VV_CACHE_DIR`, `CONF_RAM_CACHE_DIR`, `ARR_CACHE_DIR`, `AI_TOKEN_CACHE_DIR`, `AI_JOB_DIR`, `DOCKER_JOB_DIR`  
+  The tmpfs half. These must never point at flash, and nothing in a form conveys that.
+- **GIT / REPO** (`master.conf`) — `GITEA_CONTAINER`, `GITEA_REPO_PATH`, `GITEA_DOMAIN`, `TARGET_DIR`, `GITEA_SSH_KEY`, `SSH_PORT`, `GITEA_HTTP_PORT`  
+  Where the plugin updates itself from. Wrong here means the next pull is the last one.
+- **HOST IDENTITIES** (`master.conf`) — `HOST1`, `HOST2`  
+  HOST1 and HOST2 are what detect_hosts() matches the local hostname against. Editing one here would change which machine this believes it is.
+- **SHARED HOST CONFIGURATION** (`master.conf`) — `DATA_DIR`, `DB_DIR`, `STATE_DIR`, `AI_DATA_DIR`, `CACHE_BACKUP_DIR`, `LOG_ARCHIVE_DIR`, `BACKUP_DIR`, `CONF_BACKUP_DIR`, `PERSISTENT_CONF_CACHE`, `ARR_CACHE_BACKUP_DIR`  
+  DATA_DIR is the single on-disk root — move it and the whole tree follows, including the state the running scripts are holding open.
+- **State Files** (`master.conf`) — `SYS_WATCHDOG_STATE_FILE`, `DOCKER_WATCHDOG_FAILED_FILE`, `DOCKER_WATCHDOG_INTENTIONAL_FILE`, `SYS_WATCHDOG_REBOOT_LOG`, `SYS_WATCHDOG_OOM_FILE`  
+  Paths to live state databases, derived from STATE_DIR. Repointing one orphans the state a watchdog is mid-way through writing.
diff --git a/Plugin/unraid/pages/settings.php b/Plugin/unraid/pages/settings.php
index 385bec1..fa38a7c 100644
--- a/Plugin/unraid/pages/settings.php
+++ b/Plugin/unraid/pages/settings.php
@@ -49,6 +49,10 @@ $_discordHook   = $_vars[$_discordKey] ?? '';
 $_aiHost    = vv_is_ai_host();
 $_aiEnabled = strtolower(trim($_vars['AI_ENABLED'] ?? 'false')) === 'true';
 
+// The shared settings renderer, for the All-settings card at the foot of the page.
+require_once dirname(__DIR__) . '/include/confui.php';
+vv_conf_ui_assets();
+
 ?>
 <style>
 .vv-set-card   { background:#161616;border:1px solid #2a2a2a;border-radius:6px;padding:14px 16px;margin-bottom:14px; }
@@ -83,6 +87,20 @@ $_aiEnabled = strtolower(trim($_vars['AI_ENABLED'] ?? 'false')) === 'true';
                    font-size:12px;padding:5px 8px;outline:none;width:100%;box-sizing:border-box;
                    font-family:monospace; }
 .vv-set-inp:focus{ border-color:#444; }
+/* The All-settings header. A row rather than a heading because it carries the disclosure, the
+   filter and the save together — the filter is only meaningful while the card is open, and the
+   save only while something is dirty, so both appear with what they act on. */
+.vv-cf-all-h { display:flex;align-items:center;gap:10px;cursor:pointer;user-select:none;
+               flex-wrap:wrap; }
+.vv-cf-all-c { color:#333;font-size:9px;transition:transform .12s; }
+.vv-cf-all-h.open .vv-cf-all-c { transform:rotate(90deg); }
+.vv-cf-all-f { max-width:260px;cursor:text; }
+/* Scrolls itself rather than growing the page past the viewport — 124 sections is far taller
+   than a screen, and the Save button belongs where it can still be reached. */
+#vv-cf-all { max-height:60vh;overflow-y:auto;margin-top:10px;padding-right:4px; }
+/* Hidden by the filter. display:none rather than removal, so the controls keep their state and
+   a field edited before filtering is still dirty and still saved. */
+.vv-cf-group.vv-filtered { display:none; }
 </style>
 
 <div style="max-width:740px;margin:0 auto;">
@@ -220,6 +238,31 @@ $_aiEnabled = strtolower(trim($_vars['AI_ENABLED'] ?? 'false')) === 'true';
     <pre class="vv-set-out" id="vv-api-out"></pre>
   </div>
 
+  <!-- Everything else the conf holds. The cards above are purpose-built for the few settings that
+       needed a workflow — a migration, a renewal, a webhook test. This is the rest: a third of the
+       configuration had no control anywhere, so the answer to "where do I change X" was "open a
+       file over SSH", which is not an answer a settings page should give.
+
+       Collapsed and loaded on first open. 124 sections is real work to assemble and the card is
+       shut almost every time the page is drawn.
+
+       Five sections are deliberately absent — the machine's identity and the roots everything
+       derives from. See VV_UI_SECTION_EXCLUDE for which, and why each one. -->
+  <div class="vv-set-card">
+    <div class="vv-cf-all-h" id="vv-cf-all-t">
+      <span class="vv-cf-all-c">▶</span>
+      <span class="vv-set-hdr" style="margin-bottom:0;">All settings</span>
+      <input type="text" class="vv-set-inp vv-cf-all-f" id="vv-cf-all-filter"
+             placeholder="filter by name or setting…" style="display:none">
+      <span class="vv-set-sum" id="vv-cf-all-sum" style="margin-left:auto"></span>
+      <button class="vv-set-btn primary" id="vv-cf-all-save" type="button"
+              style="display:none" disabled>Save</button>
+    </div>
+    <div id="vv-cf-all-body" style="display:none">
+      <div id="vv-cf-all"><p class="vv-cf-empty">opens when you do</p></div>
+    </div>
+  </div>
+
 </div>
 
 <script>
@@ -486,4 +529,112 @@ function vvApiRenew() {
 
 // Auto-check on load
 vvApiCheck();
+
+// ── All settings ─────────────────────────────────────────────────────────────
+// Every conf section that is not structurally excluded, drawn by the same renderer the AI tab
+// and the Scheduler use and written through the same guarded path. Nothing about which sections
+// exist or what control each field gets is decided here — it is read from the conf.
+const VV_CF_ALL_API = '/plugins/varaverk/api/confform.php';
+let _vvCfAllLoaded = false;
+
+function vvCfAllToggle() {
+  const head = document.getElementById('vv-cf-all-t');
+  const body = document.getElementById('vv-cf-all-body');
+  const open = body.style.display === 'none';
+  body.style.display = open ? '' : 'none';
+  head.classList.toggle('open', open);
+  document.getElementById('vv-cf-all-filter').style.display = open ? '' : 'none';
+  document.getElementById('vv-cf-all-save').style.display   = open ? '' : 'none';
+  // First open only. Reloading on every toggle would discard edits in progress the moment
+  // someone collapsed the card to look at something else.
+  if (open) vvCfAllLoad();
+}
+
+function vvCfAllLoad() {
+  if (_vvCfAllLoaded) return;
+  _vvCfAllLoaded = true;
+  fetch(VV_CF_ALL_API + '?sections=*')
+    .then(r => r.json())
+    .then(d => {
+      if (!d.ok) throw new Error(d.error || 'could not be read');
+      VvConfUI.render('vv-cf-all', d.groups || []);
+      VvConfUI.wire('vv-cf-all', vvCfAllDirty);
+      vvCfAllDirty();
+    })
+    .catch(e => {
+      // Retryable: the flag goes back, so closing and reopening tries again rather than
+      // leaving a permanent error where the settings should be.
+      _vvCfAllLoaded = false;
+      document.getElementById('vv-cf-all').innerHTML =
+        '<p class="vv-cf-empty">could not be read: ' + String(e.message || e) + '</p>';
+    });
+}
+
+function vvCfAllDirty() {
+  const n   = VvConfUI.dirtyCount('vv-cf-all');
+  const btn = document.getElementById('vv-cf-all-save');
+  const sum = document.getElementById('vv-cf-all-sum');
+  btn.disabled = (n === 0);
+  sum.textContent = n ? (n + ' unsaved') : '';
+  sum.style.color = n ? '#ffb74d' : '#444';
+}
+
+// Hides whole sections, never individual fields — a setting means little without the header that
+// says what it belongs to. Matches the section name and the key names inside it, because people
+// look for both. display:none rather than removal, so a field edited before filtering is still
+// dirty and still saved: a filter that silently drops pending edits would be a data-loss bug
+// wearing a search box.
+function vvCfAllFilter() {
+  const q = document.getElementById('vv-cf-all-filter').value.trim().toLowerCase();
+  document.querySelectorAll('#vv-cf-all .vv-cf-group').forEach(g => {
+    g.classList.toggle('vv-filtered', q !== '' && !g.textContent.toLowerCase().includes(q));
+  });
+}
+
+function vvCfAllSave() {
+  const changes = VvConfUI.collect('vv-cf-all');
+  if (!changes.length) return;
+  const btn = document.getElementById('vv-cf-all-save');
+  const sum = document.getElementById('vv-cf-all-sum');
+  btn.disabled = true;
+  sum.textContent = 'saving…';
+  sum.style.color = '#444';
+
+  // URLSearchParams, not FormData — a multipart POST to this plugin's endpoints hangs with no
+  // status ever returned.
+  fetch(VV_CF_ALL_API, { method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8' },
+    body: new URLSearchParams({ changes: JSON.stringify(changes) }) })
+    .then(r => r.text())
+    .then(t => {
+      let d;
+      try { d = JSON.parse(t); }
+      catch (_) {
+        throw new Error(t.trim() ? 'unparseable response'
+                                 : 'empty response — rejected before the endpoint ran');
+      }
+      if (!d.ok) throw new Error(d.error || 'save failed');
+      // Rebased rather than refetched: the values on screen are now the values on disk, and a
+      // reload would repaint every control including the one just edited.
+      VvConfUI.commit('vv-cf-all');
+      vvCfAllDirty();
+      sum.textContent = 'saved ' + changes.length + ' change' + (changes.length > 1 ? 's' : '');
+      sum.style.color = '#4caf50';
+    })
+    .catch(e => {
+      // Left dirty on purpose. A refused write changed nothing, and clearing the marks would
+      // say it had.
+      sum.textContent = String(e.message || e);
+      sum.style.color = '#ef5350';
+      vvCfAllDirty();
+    });
+}
+
+document.getElementById('vv-cf-all-t').addEventListener('click', e => {
+  // The filter and the save live in the header; clicking either must not collapse the card.
+  if (e.target.closest('#vv-cf-all-filter, #vv-cf-all-save')) return;
+  vvCfAllToggle();
+});
+document.getElementById('vv-cf-all-filter').addEventListener('input', vvCfAllFilter);
+document.getElementById('vv-cf-all-save').addEventListener('click', vvCfAllSave);
 </script>