docs(web-research): the search egress re-read from the live boxes

Two pages described Dankclaw's search stack from memory, and one of them invented a port.

`searxng-tuning.md` claimed "`:8081` (UI) / `:8082` (JSON API)". Re-probed 2026-10-21: JSON is
served on **8081** (`/search?q=…&format=json` returns results) and **8082 is not SearXNG at
all** — it publishes container port 8085, which is Marreta's nginx, moved off 8080 because
SearXNG owns that port inside the shared namespace. Four containers print the same port list in
`podman ps` because they share gluetun's namespace, which is exactly the detail that gets
mistaken for "the JSON API is on another port". The policy-drift flag now carries today's
reading: `/config` still reports 262 engines and zero disabled, unchanged since 2026-10-19, so
the tuned engine policy is still not live — still an operator decision, still not silently
re-applied.

`vpn-routing.md` gave a mullvad-shaped gluetun example and no fleet shape at all, while the
bundle's own work log says the manual-WireGuard law lives "on concept pages". It lives here now,
read from the running container: `VPN_SERVICE_PROVIDER=custom` + `VPN_TYPE=wireguard` + the
single-peer `WIREGUARD_*` names (`protonvpn` and the plural `WIREGUARD_PEERS_*` family are both
wrong for this image), `FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT=on` — whose name
is the warning that disabling it leaks egress while every check keeps passing — and
`tun0` present. The mullvad block stays as the generic illustration, now labelled as one.

Refs #64

omp-docs/agentic-web-research/searxng-tuning.md

@@ -8,7 +8,7 @@ tags:
   - privacy
   - configuration
   - unverified
-verified: 2026-10-19
+verified: 2026-10-21
 timestamp: 2026-08-11
 resource: https://docs.searxng.org
 ---
@@ -23,25 +23,27 @@ Compose (or Podman Quadlet) with a Valkey container.
 
 This page lists the settings that matter for speed, privacy, and useful results.
 
-> **Fleet instance:** the harness `web/searxng` provider calls the instance at
-> `192.168.0.143:8081` (UI) / `:8082` (JSON API) on dankclaw. The pi-era
-> [Pi Web Access](../pi/packages/pi-web-access.md) called the same host.
+> **Fleet instance:** the harness `web/searxng` provider calls
+> `192.168.0.143:8081` on dankclaw — HTML **and** JSON on that one port
+> (`/search?q=…&format=json`, re-probed 2026-10-21). Port **8082 is not a second SearXNG
+> API**: it publishes container port 8085, which is Marreta's nginx (moved off 8080 because
+> SearXNG owns it in that namespace). Both ports show up against four container names because
+> `searxng`, `searxng-valkey`, `gluetun` and the `marreta` pair share one network namespace.
+> The pi-era [Pi Web Access](../pi/packages/pi-web-access.md) called the same host.
 
-## Live instance (probed 2026-10-19)
+## Live instance (probed 2026-10-21)
 
 User Quadlet stack on dankclaw: `searxng.container`
 (`ghcr.io/searxng/searxng:latest`) + `searxng-valkey.container`
-(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the
-containers share its network namespace, which is why `podman ps` shows :8081/
-:8082 on several names) + `marreta`/`marreta_browser`. `limiter.toml`: enabled,
-`pass_searxng_org: true`.
+(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the other containers
+join its network namespace, hence the shared port list) + `marreta`/`marreta_browser`.
+`limiter.toml`: enabled, `pass_searxng_org: true`.
 
-**Policy drift flag:** this page's tuned engine policy (google and bing
-disabled; DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on
-2026-08-16) is NOT live: `/config` on 2026-10-19 reports all 262 engines
-enabled, google and bing included. Either the settings override was lost in
-the 2026-10 stack reinstatement or the policy was deliberately dropped.
-Confirm with Frank before re-applying.
+**Policy drift flag:** this page's tuned engine policy (google and bing disabled;
+DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on 2026-08-16) is NOT live.
+`/config` re-read 2026-10-21: 262 engines, **zero disabled**, google and bing included —
+unchanged since 2026-10-19. Either the override was lost in the 2026-10 stack reinstatement or
+the policy was deliberately dropped. Confirm with Frank before re-applying.
 
 
 ## Plan the Deployment