Merge branch 'worktree-llm-dynamic-config' into worktree-llm-web-config

# Conflicts:
#	apps/cli/cordis.yml
#	apps/cli/package.json
#	apps/cli/tests/tui-keyless-smoke.e2e.ts
#	apps/web/tests/details-session-lifecycle.e2e.ts
#	apps/web/tests/snapshots/code-mode-round/ui.expected.md
#	apps/web/tests/snapshots/cordis-tool-round/ui.expected.md
#	apps/web/tests/snapshots/fresh-round-trip/ui.expected.md
#	apps/web/tests/snapshots/lifecycle-chrome/hero.expected.md
#	apps/web/tests/snapshots/lifecycle-chrome/reloaded.expected.md
#	apps/web/tests/snapshots/live-interactions/cancel.expected.md
#	apps/web/tests/snapshots/live-interactions/error-auth.expected.md
#	apps/web/tests/snapshots/live-interactions/retry.expected.md
#	apps/web/tests/snapshots/message-actions/ui.expected.md
#	apps/web/tests/snapshots/question-composer/answered.expected.md
#	apps/web/tests/snapshots/seeded-history/ui.expected.md
#	apps/web/tests/snapshots/steering/mid-steer.expected.md
#	apps/web/tests/snapshots/steering/settled.expected.md
#	docs/cordis-catalog/events.md
#	docs/cordis-catalog/services.md
#	docs/event-producer-consumer.md
#	docs/user/guide/config.i18n.yaml
#	docs/user/guide/config.md
#	docs/user/guide/config.zh.md
#	docs/user/guide/index.i18n.yaml
#	docs/user/guide/index.md
#	docs/user/guide/index.zh.md
#	examples/acp-agent/tests/snapshots/subagent-fork/session.1.jsonl
#	examples/acp-agent/tests/snapshots/subagent-mixed/session.2.jsonl
#	examples/cordis-agent/cordis.yml
#	examples/cordis-agent/tests/cordis-tools.e2e.ts
#	examples/headless-agent/tests/semantic-checkpoint-snapshots/tool-outcome-unknown/session.expected.jsonl
#	examples/headless-agent/tests/subagent-inheritance-snapshots/parent-override/parent.expected.jsonl
#	examples/tui-agent/code-mode.cordis.yml
#	examples/tui-agent/cordis.yml
#	packages/examples/tui-demo/README.md
#	packages/examples/tui-demo/README.zh.md
#	packages/host/apiproxy/README.i18n.yaml
#	packages/pty/tool-bash-persistent/README.i18n.yaml
#	packages/ui/tui/tests/snapshots/status-diagnostics-narrow.expected.txt
#	packages/ui/tui/tests/snapshots/status-diagnostics.expected.txt
#	pnpm-lock.yaml
#	scripts/snapshots/python-sdk-single-exe/advanced/result.json
#	scripts/snapshots/python-sdk-single-exe/advanced/session.1.jsonl
#	scripts/snapshots/python-sdk-single-exe/advanced/session.2.jsonl
#	scripts/snapshots/python-sdk-single-exe/advanced/session.jsonl

apps/web/tests/scaffold.ts

@@ -1,6 +1,6 @@
 // Shared scaffold for the keyless browser e2e lane (Agent Note:
 // .agents/notes/implemented/testing/2026-07-24-web-gui-browser-e2e-lane.md).
-// Boots the REAL web composition — the shipped apps/cli/cordis.yml through
+// Boots the REAL web composition — the shipped base plus web overlay through
 // the vendored Loader (the same include boot AppCLIEntry drives), patched the
 // snapshot way — so a real chromium exercises the real HTTP/SSE wire, the
 // api-gateway, agent loop, tools, and persistence. Modes ride $DSH_SNAPSHOT:
@@ -9,7 +9,7 @@
 // from live session memory), refresh (keyless replay that rewrites goldens).
 //
 // Composition divergences from `dsh web`, all deliberate, all via include
-// patches over the SAME tree (never a second yml): temp persistenceRoot;
+// patches after the shipped surface overlay: temp persistenceRoot;
 // workspace-context disabled (recorded fixtures must not embed this repo's
 // AGENTS.md); session-title-llm disabled (its fire-and-forget title call
 // would race the loop for the session's replay cursor); webserver pinned to
@@ -28,7 +28,7 @@ import { Context } from 'cordis'
 import Loader from '@cordisjs/plugin-loader'
 import Include, { type PatchOptions } from '@cordisjs/plugin-include'
 import { scrubRequestHeaders } from '@deepseek-ai/dsh-acp-snapshot'
-import { assertEntriesLoaded } from '@deepseek-ai/dsh-app-boot'
+import { assertEntriesLoaded, loadOverlayPatches } from '@deepseek-ai/dsh-app-boot'
 import type { ReplayHandle } from '@deepseek-ai/dsh-llm-replay'
 import { installLlmReplay, parseSessionLog } from '@deepseek-ai/dsh-llm-replay'
 import SessionStore, {
@@ -60,8 +60,9 @@ export function webSnapshotMode(): WebSnapshotMode {
   throw new Error(`DSH_SNAPSHOT must be replay, record, or refresh; got ${JSON.stringify(value)}`)
 }
 
-/** The shipped composition under test: apps/cli's config tree. */
-const CONFIG_PATH = join(REPO_ROOT, 'apps/cli/cordis.yml')
+/** The shipped composition under test: apps/cli's shared base and web overlay. */
+const CONFIG_PATH = join(REPO_ROOT, 'apps/cli/config/base.cordis.yml')
+const WEB_OVERLAY_PATH = join(REPO_ROOT, 'apps/cli/config/web.cordis.yml')
 
 // Replay publishes the provider catalog the gateway routes to (providers
 // mode, never catch-all: with llm-deepseek disabled no adapter exists, so a
@@ -169,7 +170,9 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise<We
   // The include patch set — the same mechanism AppCLIEntry and the ACP
   // snapshot overlay use, applied over the SAME shipped tree (a patch id that
   // stops matching a row fails the boot sweep loudly instead of drifting).
+  const surfacePatches = loadOverlayPatches('web e2e scaffold', WEB_OVERLAY_PATH)
   const patches: PatchOptions[] = [
+    ...surfacePatches,
     { id: 'session-persistence-jsonl', config: { root: persistenceRoot } },
     // storage-json's './.storages' yml default is cwd-relative and resolves
     // per write; the scaffold restores the original cwd after boot, so the