Merge remote-tracking branch 'origin/master' into worktree/web-multimodal-image-input

# Conflicts:
#	docs/architecture.i18n.yaml
#	docs/architecture.md
#	docs/architecture.zh.md
#	docs/cordis-catalog/events.md
#	docs/cordis-catalog/services.md
#	docs/core-data-structures/core.i18n.yaml
#	docs/core-data-structures/llm-streaming.i18n.yaml
#	docs/event-producer-consumer.md
#	docs/module-graph.md
#	examples/acp-agent/tests/snapshots/cordis-inspect-jsdoc/session.jsonl
#	packages/client/connection/README.i18n.yaml
#	packages/client/connection/README.md
#	packages/client/connection/README.zh.md
#	packages/client/connection/src/client/fixture.ts
#	packages/client/runtime/README.i18n.yaml
#	packages/client/runtime/README.md
#	packages/client/runtime/README.zh.md
#	packages/client/ui-conversation/README.i18n.yaml
#	packages/client/ui-conversation/src/client/chat/AssistantMarkdown.tsx
#	packages/client/ui-conversation/src/client/chat/ChatView.tsx
#	packages/host/apiproxy/README.i18n.yaml
#	packages/host/apiproxy/src/api-proxy.ts
#	packages/llm/llm-deepseek/tests/adapter.spec.ts
#	packages/llm/llm-pi-ai/README.i18n.yaml
#	packages/llm/llm-pi-ai/src/index.ts
#	packages/llm/llm/README.i18n.yaml
#	packages/llm/llm/README.md
#	packages/llm/llm/README.zh.md
#	packages/llm/llm/src/index.ts
#	packages/llm/llm/src/types.ts

apps/cli/config/base.cordis.yml

@@ -67,9 +67,10 @@
 
 # Credential store: the live process environment over `$DSH_HOME/.env`
 # (owner-only file, hot-reloaded). Adapters resolve their key references
-# through it at each request, so no key is inlined in this file — and nothing
-# hoists that document into the process environment, which would make every
-# stored key read as an unrotatable ambient override.
+# through it at each request, so no key is inlined in this file. The web
+# Models page's key inputs write it through `credentials.set`; nothing hoists
+# the document into the process environment, which would make every stored key
+# read as an unrotatable ambient override.
 - id: credentials
   name: '@deepseek-ai/dsh-credentials-local'
 
@@ -77,8 +78,9 @@
 # models in the picker) until a `llm-pi-ai:` settings section supplies provider
 # profiles — then those routes register live, keys resolving per request
 # through their apiKeyEnv references, and drop again when the section empties.
-# Which adapters exist is composition; which providers run is the user's
-# settings document.
+# Supplying those profiles is exactly what the web Models page does. Which
+# adapters exist is composition; which providers run is the user's settings
+# document.
 - id: llm-pi-ai
   name: '@deepseek-ai/dsh-llm-pi-ai'
 
@@ -95,6 +97,38 @@
   config:
     path: !!js launcherSessionQueryPath ?? './.sessions/session-query.db'
 
+# Session telemetry, on for every dsh surface: mirrors every session-log
+# event (assistant/chunk projected to first-of-step) plus ops markers onto
+# OTLP/HTTP log records, streaming on the batch processor's cadence
+# (10s/batch here) — not at exit; a crash loses at most the last unexported
+# interval. No telemetry/record redaction rule is mounted yet, so exports
+# are the raw captured copy; the deployment stance, env seams, and
+# follow-ups are pinned in the web-telemetry-default-mount Agent Note.
+# DSH_TELEMETRY_OTLP_URL overrides the production endpoint, and a non-empty
+# DSH_TELEMETRY_DISABLED — any value, including '0'/'false' — opts the
+# process out (the launchers patch the row disabled; config cannot disable
+# a row). The exporter/processor values bound the shutdown drain to ~1s
+# against an unreachable collector: exporter.timeoutMillis is both the
+# per-attempt socket timeout and the retry deadline (1s effectively
+# disables the SDK's 5-try backoff), maxExportBatchSize == maxQueueSize
+# (both explicit) makes the drain a single batch, and exportTimeoutMillis
+# is the processor's own cap on that one export cycle — the second bound
+# when the exporter's clock alone does not fire. Every surface's exit path
+# drains it: web/headless dispose on SIGINT/SIGTERM, and the TUI's normal
+# exit and /resume handoff both dispose the root.
+- id: telemetry-otel
+  name: '@deepseek-ai/dsh-session-telemetry-otel'
+  config:
+    exporter:
+      url: !!js process.env.DSH_TELEMETRY_OTLP_URL ?? 'https://harness-telemetry.deepseeksvc.com/v1/logs'
+      compression: gzip
+      timeoutMillis: 1000
+    processor:
+      scheduledDelayMillis: 10000
+      maxQueueSize: 2048
+      maxExportBatchSize: 2048
+      exportTimeoutMillis: 1500
+
 - id: subprocess
   name: '@deepseek-ai/dsh-subprocess-local'
 

apps/cli/config/tui.cordis.yml

@@ -22,7 +22,7 @@
   config:
     agents:
       - id: main
-        provider: deepseek
+        provider: deepseek-official
         model: deepseek-v4-pro
         cwd: !!js process.cwd()
 
@@ -36,8 +36,8 @@
       Verify your work by running the code or tests. Keep answers brief and
       factual.
 
-# Shipped default: full thinking at max effort on every request (wire-only
-# defaults; they never enter the request header).
+# Shipped default: full thinking at max effort on every request. Exact-model
+# resolution materializes request defaults before the request header is logged.
 - id: llm-deepseek
   config:
     apiKey: !!js process.env.DEEPSEEK_API_KEY

apps/cli/config/web.cordis.yml

@@ -123,7 +123,7 @@
     - id: api-gateway
       name: '@deepseek-ai/dsh-host-apiproxy'
       config:
-        provider: deepseek
+        provider: deepseek-official
         model: deepseek-v4-flash
 
     # ── layer 2: transport/service ──────────────────────────────────────────────