S3 Vectors: help text for weed-vector, weed-vector-cli and weed-worker (#12486)

vector: the engine's, CLI's and worker's help say what they do now

weed-vector's --masters and --filer-group said "reads through" and
--security-toml named only gRPC TLS, though the engine keeps tables on the
filers and volume servers and takes https.client, the read JWT key and the
SSE-S3 keys from it too; weed-vector-cli called itself a "query spike";
weed-worker's --filer-signing-key spoke of write credentials the
namespace no longer vends.


Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

seaweed-vector/crates/core/src/main.rs

@@ -12,7 +12,10 @@ use weed_vector_core::table::VectorTable;
 /// namespace that says where a table is, and the masters whose filers hold
 /// it.
 #[derive(Parser, Debug)]
-#[command(name = "weed-vector", about = "SeaweedFS vector query spike")]
+#[command(
+    name = "weed-vector",
+    about = "Describe, query and index S3 Vectors tables"
+)]
 struct Args {
     /// Lance namespace the tables live in.
     #[arg(

seaweed-vector/crates/server/src/main.rs

@@ -19,7 +19,8 @@ struct Args {
     #[arg(long, env = "WEED_VECTOR_LISTEN", default_value = "127.0.0.1:8090")]
     listen: String,
     /// Comma-separated master addresses. The engine registers with them, so
-    /// the gateway finds it, and asks them for the filers it reads through.
+    /// the gateway finds it, and asks them for the filers it keeps tables
+    /// through.
     #[arg(long, alias = "master", env = "WEED_VECTOR_MASTERS")]
     masters: String,
     /// Encrypt every chunk written for the volume servers, as `weed s3
@@ -30,7 +31,7 @@ struct Args {
         env = "WEED_VECTOR_ENCRYPT_VOLUME_DATA"
     )]
     encrypt_volume_data: bool,
-    /// The filer group whose filers the engine reads through.
+    /// The filer group whose filers the engine keeps tables through.
     #[arg(
         long,
         alias = "filer.group",
@@ -45,10 +46,11 @@ struct Args {
     /// tenth of the index's partitions, at least 8; more under a filter.
     #[arg(long, env = "WEED_VECTOR_NPROBES")]
     nprobes: Option<std::num::NonZeroUsize>,
-    /// The cluster's security.toml, for gRPC TLS: this server's identity is
-    /// [grpc.vector], the masters are dialed with [grpc.client]. By default
-    /// the file weed processes find in -config_dir, ., ~/.seaweedfs and
-    /// /etc/seaweedfs.
+    /// The cluster's security.toml: [grpc.vector] for this server,
+    /// [grpc.client] for the masters and filers, https.client for volume
+    /// servers under HTTPS, jwt.signing.read.key for signed volume reads,
+    /// s3.sse.kek or s3.sse.key for SSE-S3 buckets. By default the file weed
+    /// processes find in -config_dir, ., ~/.seaweedfs and /etc/seaweedfs.
     #[arg(long, env = "WEED_VECTOR_SECURITY_TOML")]
     security_toml: Option<PathBuf>,
     /// The directory weed's -config_dir names, searched for security.toml

seaweed-worker/crates/lance/src/main.rs

@@ -78,11 +78,11 @@ struct Args {
     #[arg(long)]
     tls_server_name: Option<String>,
 
-    /// Shared secret for the admin control stream, `jwt.filer_signing.key`.
-    /// Required by admins that authenticate the worker stream with a signing
-    /// key. The Lance namespace takes it too: only a holder gets write
-    /// credentials to vector indexes. When not given, read from where the Go
-    /// worker reads it: WEED_JWT_FILER_SIGNING_KEY, then security.toml.
+    /// The cluster's `jwt.filer_signing.key`. The Lance namespace knows the
+    /// worker by a token derived from it, and admins that authenticate the
+    /// worker stream with a signing key require it. When not given, read from
+    /// where the Go worker reads it: WEED_JWT_FILER_SIGNING_KEY, then
+    /// security.toml.
     #[arg(long, env = "WEED_FILER_SIGNING_KEY")]
     filer_signing_key: Option<String>,