Scope and merge status

This is the single review vehicle for the complete config-surface reduction program. PR #111584 has been folded into this branch. Do not merge this PR without maintainer approval.

Product decisions requested

1. surfaces.*.silentReply versus agents.defaults.silentReply: choose delivery-surface ownership or agent-behavior ownership.
2. Keep ui.prefs.* server-synced, or move it client-side once.
3. Keep strict JSON plus annotation fields, or adopt JSON5/JSONC and retire config comment fields.
4. Keep Talk and TTS provider trees separate, or fold talk.providers into tts.providers while Talk retains session/VAD settings.
5. Sequence the two mega-hookifies: CLI backend DSL to registerCliBackend, and model compat.* flags to provider/catalog hooks.

What this consolidates

Product consolidations

• Unified media-model ownership, root memory/search ownership, root TTS defaults, and agent typing policy.
• Removed or fixed-defaulted undocumented and duplicate product switches through Doctor-owned migration.
• Converted config-only agents.list arrays to keyed agents.entries while preserving runtime agent IDs and bindings.

Fresh-eyes layout

• Normalized names and nesting for PDF limits, exec timeouts, browser SSRF policy, sandbox browser settings, environment vars, MCP settings, attachments, audit, node policy, heartbeat visibility, generation models, and other layout inconsistencies.
• Removed presentation/timing micro-knobs where one product default is sufficient.
• Kept active safety, policy, deployment, and scoped override surfaces when readers proved them load-bearing.

Environment cleanup folded from #111584

• Isolated test/build/dev-only environment reads from shipped runtime paths.
• Collapsed name-of-variable indirection and duplicate aliases.
• Documented the supported operator allowlist.
• Added the shrink-only production environment ratchet: 529/529.

Tier-eval tranche 6a

• Retired verified aliases and dead/inert fields, moved machine state into shared SQLite, made redaction fail-closed, consolidated security posture, removed heartbeat presentation knobs, simplified memory/QMD internals, moved WhatsApp web enablement under its channel, and copied response prefixes into explicit channel owners while retaining the implicit/custom fallback.
• Doctor performs canonical-wins migration, state import, conflict-safe merging, and idempotent stripping under one bounded compatibility record: doctor-tier-eval-tranche, through 2026-09-18.
• Added regression coverage for exec-policy inheritance, Signal endpoint inheritance/IPv6, idle-reset semantics, bundled-plugin discovery state, hook-install state merging, proxy opt-out, response-prefix fallbacks, TTS preference ownership, and config-write fixtures.

Tier-eval tranche 6b

• TTS persona prompt leaves now belong to speech-provider code through prepareSynthesis; Doctor strips old prompt blocks and docs point users to provider-specific config or a custom speech provider.
• Compaction summary/identifier and memory-flush prompt strings now belong to compaction providers through summarize() and prompt hooks through before_prompt_build.
• postCompactionSections was kept because it owns a dedicated AGENTS.md extraction/injection pipeline and exceeded the small-hookify seam.
• Hook mapping templates/model/thinking were kept because Doctor cannot synthesize transform-module code for existing mappings without breaking them.
• Group-entry systemPrompt was kept because it is the primary documented persona surface across channel plugins; removing it would delete supported group personas, not a redundant echo.

Kept because reader evidence contradicted the retirement claim

• humanDelay.*: active runtime reader.
• meta.lastTouchedVersion and the migration marker: required file-scoped downgrade/migration compatibility; only lastTouchedAt moved to SQLite.
• Wizard last-run/local-model/security acknowledgement fields: retained for atomic setup.
• Discord/Telegram scoped threadBindings: documented runtime-read account/channel overrides.
• messages.responsePrefix: retained for implicit and custom channels; explicit supported channels receive copied canonical values.
• Per-media transport values: Doctor cannot safely infer capabilities/provider ownership or globalize media-only credentials.
• Legacy exec security/ask: representable policies move to mode; malformed, partial, ask=always, and full+on-miss policies remain for explicit repair.
• proxy.enabled: retained as the advanced explicit-off escape hatch when an environment URL is present.
• Per-agent tts.prefsPath: retained because agents can own distinct preference stores; only the global path moved to machine state.
• memory.search.experimental.sessionMemory and store.vector.enabled: retained because root/agent inheritance can invert behavior if stripped.

Rejected with reasons

• Kept skipBootstrap, broadcast, plugins.deny, global loop-detection enablement, account names, health-monitor enablement, and strict-JSON annotation fields: each has an active setup, policy, recovery, or usability contract.
• Kept Teams delegated-auth scopes after reader tracing.
• Kept one Control UI insecure-LAN compatibility path only where the runtime trust boundary requires it; overlapping disable paths were removed.
• Rejected a speech super-parent and wholesale root-to-agent re-homes: those cross lifecycle and infrastructure ownership boundaries.

Follow-ups

• Mega-hookify the CLI backend adapter DSL through registerCliBackend.
• Move model compat.* flags to provider/model-catalog hooks.
• Extract Talk, QMD, and sandbox ownership behind plugin-capable seams.
• Revisit postCompactionSections only with a designed replacement for its file extraction/injection behavior.
• Migrate hook mapping templates/model/thinking only with an explicit transform-module generator or compatible authoring workflow.

Compatibility

• Runtime consumes current canonical config; shipped legacy shapes normalize through openclaw doctor --fix.
• Canonical values win conflicts.
• Retired paths have dead-key coverage and bounded Doctor compatibility through 2026-09-18.
• State migrations are SQLite-first and idempotent; no schema-version bump was introduced.

Whole-program surface metrics

Verification

• Focused Doctor, config-write, state migration, proxy, Signal, WhatsApp, Feishu, memory, policy, TTS, compaction, provider, and plugin-planning suites passed.
• config:docs:gen and config:docs:check: clean; final counts 2351/3627/3556.
• Environment ratchet: 530/530.
• tsgo:all and check:test-types: clean.
• Changed TypeScript ESLint: clean.
• Knip production/full-tree/script dead-code lanes: zero entries.
• Plugin SDK surface: clean at 313 entrypoints, 7,389 exports, 2,880 public callable exports, and zero forbidden subpaths.
• Full repository format check and git diff --check: clean.
• Fresh autoreview returned no accepted/actionable findings for the final 6a bundle, both implemented 6b commits, and every closeout repair. A final whole-branch invocation was blocked before model execution by the helper's sensitive-filename guard on the tracked credential-surface matrix; no raw credential data was sent or exposed.

Checklist

• Phase-5 environment commits folded with structure preserved.
• Approved 6a tranche implemented with evidence-mismatch retention.
• Small 6b hookifies implemented or explicitly skipped at their seam boundary.
• Generated baselines and ratchets updated.
• Full requested gate set clean.
• Branch pushed for maintainer review.
• Maintainer decisions above are resolved.
• Merge is authorized. Do not merge as part of this task.