Load process settings once

[SaladDay]

Summary

AGENTS.md gives each setting one home, with no second reader or fallback. Before this change, Core read its process environment in about a dozen places, parsed some values twice, and built the public URLs four separate ways. This is T4 in the architecture audit, plus C4, C6, C7 and C9.

• One typed process config.
  • processconfig.Load() (Config, error) reads every Core variable once, and the history settings file is part of it.
  • main passes the fields down, and oac check-config is Load with its error reported.
  • The per-file readers are deleted: write audit, OAuth origins, credential cipher, managed nodes, runtime history, and the process-configuration re-reads.
  • The "optional, then required" admin-authenticator pair is deleted.
• One log parser. obs/log.LoadConfig is strict, and Core and Web share it. The lenient ConfigFromEnv is deleted.
• One public origin.
  • deployment.PublicOrigin is validated once and derives /v1, /api/v1, the daemon WebSocket and the installer base.
  • The four ad hoc URL builders, the reverse trim and the gateway revalidation are deleted.
• Periodic jobs.
  • coremetrics.Periodic{ID, Every, Run} owns the ticker, panic isolation and job reporting. The job IDs come from the registered jobs.
  • The bespoke cleanup loops and the duplicate StopJob are deleted.
• Dead settings deleted.
  • OAC_INSTALL_DIR, OAC_INSTALL_DIR_DEFAULT and OAC_RUNTIME_CLAUDE_SDK_WORKSPACE.
  • OAC_NATIVE_INSTALLER_DIR, now derived as $OAC_PROVIDER_ROOT/native-installers.
  • OAC_PROVIDER_STATE_ROOT, now the constant /state because nothing produced another value.
  • Web's OAC_WEB_ORIGIN. Web now reads OAC_PUBLIC_URL, each Web setting has one default, and the healthcheck uses the configured address.
• Docs.
  • docs/configuration.md names the setting categories once.
  • The anchor #process-settings-configjson is now #process-settings, and every link to it is updated, including AGENTS.md link targets (no wording change).
  • The history settings file is documented.
  • The credential-key path and the observability anchor are fixed.

Not in this change: making the installation ID and the credential key required. That is a separate change because the acceptance harnesses deliberately run Core without a credential key.

Behaviour

• oac check-config now validates the history settings file. Each of its errors is prefixed OAC_HISTORY_SETTINGS_FILE:.
• An invalid OAC_LOG_LEVEL (for example warning) is a startup error in both Core and Web. Before, it fell back silently.
• A panic in a periodic job is logged with the job ID and reported as a failed pass. The job continues at its next interval.
• core.write_audit_retention displays as 2160h.

Review

A fresh-context blind review found one should-fix (the retention display) and five nits (panic isolation, job ID in the prune log, a zero interval, the history error prefix, the missing-catalog test). All are fixed, and the sampler's "needs a Worker" rule is now structural rather than a comment.

Checks

• go build ./... and go vet for core, obs and web.
• go test for processconfig, obs/log, coremetrics, cmd/server, cmd/oac, api, nativeinstaller, runtimeobs, deployment, environmentconfig and services/web.
• oac-core check-config, valid and invalid cases.
• check-names.py, the markdown link check, deploy/compose/test_compose.py and the translation test.

Net: non-test code −149, tests −37, docs +22.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}