Docs: list every change that withholds a stored secret

src/content/docs/docs/create-a-widget/manifest.md

@@ -125,7 +125,7 @@ A widget with no light design declares it, and keeps its dark card and dark inte
 | `default` | The value used when none is saved. |
 | `hint` | Short help under the field. On a `group`, it shows at the bottom of the section. |
 | `optional` | When `true`, the field is not required to save. A required `secret` counts as missing only when nothing is stored. |
-| `cosmetic` | When `true`, changing the field keeps a stored `secret`. Use it only on a field that cannot change the server a secret is sent to, the account it is paired with, or a path on a user-entered server. Links, labels, colours and units qualify. A repeated key needs it on every declaration. The keys a cosmetic picker `carries` count as cosmetic too. |
+| `cosmetic` | When `true`, changing the field keeps a stored `secret`. Use it only on a field that cannot change the server a secret is sent to, the user name sent with it, or a path on a user-entered server. Links, labels, colours and units qualify, and so does a value sent to a fixed vendor host, such as a profile ID or a user to look up. A repeated key needs it on every declaration. The keys a cosmetic picker `carries` count as cosmetic too. |
 | `transient` | When `true`, the field is sent to an `optionsFrom` fetch but not saved. Use it for a search box. Top-level fields only. |
 | `carries` | For a `select` with `optionsFrom`: extra config keys this picker writes, from the chosen option's `set` block. |
 | `showIf` | Shows the field only when a sibling matches: `{ "field": "provider", "equals": "adguard" }`, or `{ "field": "provider", "in": ["adguard", "pihole"] }`. Anything else is rejected. |

src/content/docs/docs/security.md

@@ -40,7 +40,7 @@ The first page load after install or upgrade sets the list. A host name is trust
 
 Stored secrets are stripped from the config before it reaches the browser. A populated field reports as set without returning its value, in config responses and in exports alike.
 
-A secret is restored only for the request it was stored for. If a save changes where the credential would be sent, by editing a badge URL, its non-secret headers, or a widget field that decides where it goes, the stored value is not restored and Stackyard names what must be re-entered. Matching on an item's id alone would let an imported config point an existing credential somewhere new. Turning **Allow self-signed certificate** on or off for an app, and changing the port map (`settings.server.portMap`), count as such a change.
+A secret is restored only for the request it was stored for. If a save changes where the credential would be sent, by editing a badge URL, its non-secret headers, or a widget field that decides where it goes, the stored value is not restored and Stackyard names what must be re-entered. Matching on an item's id alone would let an imported config point an existing credential somewhere new. These count as such a change too: turning **Allow self-signed certificate** on or off for an app, turning `settings.server.skipTlsVerify` on or off for widgets, changing a widget's type, and changing or removing the port map (`settings.server.portMap`).
 
 Secrets are stored in plain text in `apps.json` on the data volume. Protect that volume with filesystem permissions and backups.
 

src/content/docs/docs/troubleshooting.md

@@ -99,7 +99,7 @@ Check that the service is reachable and the credential is still valid.
 
 ### A credential stopped working after an edit
 
-Changing where or how a credential would be sent clears the stored value. Editing a badge URL, its non-secret headers, or a widget field that decides where the credential goes all count. Display settings such as units, colours and links do not. So do turning **Allow self-signed certificate** on or off for an app, and changing the port map (`settings.server.portMap`) in the config. Unticking **Secret** on a header row clears it on the next save.
+Changing where or how a credential would be sent clears the stored value. Editing a badge URL, its non-secret headers, or a widget field that decides where the credential goes all count. Display settings such as units, colours and links do not. These count too: turning **Allow self-signed certificate** on or off for an app, and in the config, turning `settings.server.skipTlsVerify` on or off or changing or removing the port map (`settings.server.portMap`). Unticking **Secret** on a header row clears it on the next save.
 
 Stackyard names the items to re-enter. Enter the credential again and save.