diff --git a/AGENTS.md b/AGENTS.md
index 9b3b673..a0ff5c2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -75,11 +75,15 @@ real-phone/WireGuard bring-up, which is operational rather than code.
   generated into a constant. So the server must have started once on that
   machine first — the build stops with that instruction otherwise — and an
   APK built in this VM only works against a server in this VM.
-- Run the server for development with `--bind 127.0.0.1` (wg0 doesn't exist
-  on this machine yet; the default fails closed). First run prints the
-  enrollment QR/URI with the token — capture it from the log.
+- Run the server for development with `--bind 127.0.0.1`. Without it the
+  server binds wg0, which exists here but is unreachable from the emulator
+  (it dials 10.0.2.2). First run prints the enrollment QR/URI with the
+  token — capture it from the log.
 - Prefer exercising the server directly over going through the UI:
-  `curl --cacert certs/ca.pem -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions`.
+  `curl --cacert ~/.config/ai-app/certs/ca.pem -H "Authorization: Bearer …" https://127.0.0.1:8443/sessions`.
+  The CA is wherever `--certs` put it — by default under
+  `$XDG_CONFIG_HOME` (`~/.config` when that is unset), never in the
+  checkout, so a relative `certs/ca.pem` finds nothing.
   The emulator app reaches it at `https://10.0.2.2:8443`; enroll it with
   `adb shell "am start -a android.intent.action.VIEW -d 'aiapp://enroll?host=10.0.2.2&port=8443&token=…'"`
   (quote so the device shell doesn't eat the `&`s).
diff --git a/server/src/auth.rs b/server/src/auth.rs
index 011ad0c..5474363 100644
--- a/server/src/auth.rs
+++ b/server/src/auth.rs
@@ -9,8 +9,9 @@
 //! defense in depth rather than the sole gate.
 //!
 //! Nothing in this module -- and nothing anywhere else -- may log the
-//! Authorization header or the token; `token_is_never_logged` below holds a
-//! tripwire against a logging change silently starting to.
+//! Authorization header or the token; the test below holds a tripwire
+//! against a logging change silently starting to. It is one test covering
+//! both gating and logging on purpose -- see the note in it.
 
 use std::net::SocketAddr;
 use std::sync::Arc;
diff --git a/server/src/config.rs b/server/src/config.rs
index 2f22362..b1090e9 100644
--- a/server/src/config.rs
+++ b/server/src/config.rs
@@ -7,7 +7,7 @@
 //! funnels through `SessionManager` (the registry pattern), so in-memory
 //! and on-disk state can't come apart.
 //!
-//! The file is RON, in the shape the [`format`] module describes -- the
+//! The file is RON, in the shape the [`mod@format`] module describes -- the
 //! same format, and the same two house rules, as the sibling dev-updater
 //! project's config, because both are written and read by hand.
 //!
@@ -30,9 +30,10 @@ use crate::private;
 ///
 /// **No outer parentheses.** A file *is* the body of the struct, so nothing
 /// in it is indented for the sake of a wrapper. RON has no implicit
-/// top-level struct (`de/mod.rs` requires the `(`), so [`parse`] adds it
-/// and [`render`] takes it back off. The opening paren is not followed by a
-/// newline, so a parse error's line number still points at the real line.
+/// top-level struct (`de/mod.rs` requires the `(`), so [`format::parse`]
+/// adds it and [`format::render`] takes it back off. The opening paren is
+/// not followed by a newline, so a parse error's line number still points
+/// at the real line.
 ///
 /// **`Some` is implicit.** Enabled on the deserializer rather than by a
 /// `#![enable(implicit_some)]` header the file would have to carry, and