refactor(credentials,llm): remove speculative mutation and route lifecycle

apps/cli/config/base.cordis.yml

@@ -56,29 +56,20 @@
 - id: llm-retry
   name: '@deepseek-ai/dsh-llm-retry'
 
-# User-settings document (`$DSH_HOME/settings.yaml`, hot-reloaded): a
-# `llm-deepseek:` or `llm-pi-ai:` section there overrides the adapter entries
-# below without a restart, and is what the web Models page writes.
+# User-settings document (`$DSH_HOME/settings.yaml`, hot-reloaded): the
+# `llm-deepseek:` section overrides request-level adapter facts below without
+# a restart. Provider routes and retry policy remain composition-owned.
 - id: settings
   name: '@deepseek-ai/dsh-settings-local'
 
-# Credential store: the live process environment over `$DSH_HOME/.env`
-# (owner-only file, hot-reloaded). Adapters resolve their key references
-# through it at each request, so no key is inlined in this file — and nothing
-# hoists that document into the process environment, which would make every
-# stored key read as an unrotatable ambient override.
+# Credential reader: the live process environment over `$DSH_HOME/.env`.
+# Adapters resolve their key references on demand, so external rotations reach
+# the next request without a watcher, cache, or mutation API. Nothing hoists
+# that document into the process environment, where it would become an ambient
+# override.
 - id: credentials
   name: '@deepseek-ai/dsh-credentials-local'
 
-# The pi-ai multi-provider twin, mounted dormant: zero routes (and no extra
-# models in the picker) until a `llm-pi-ai:` settings section supplies provider
-# profiles — then those routes register live, keys resolving per request
-# through their apiKeyEnv references, and drop again when the section empties.
-# Which adapters exist is composition; which providers run is the user's
-# settings document.
-- id: llm-pi-ai
-  name: '@deepseek-ai/dsh-llm-pi-ai'
-
 - id: session-persistence-jsonl
   name: '@deepseek-ai/dsh-session-persistence-jsonl'
   config:
@@ -237,7 +228,7 @@
 
 # The native DeepSeek adapter. No key or endpoint is inlined: both resolve per
 # request from the `llm-deepseek:` settings section over this entry, with the
-# key coming from the credential store below. Thinking defaults are a surface
+# key coming from the credential reader below. Thinking defaults are a surface
 # choice.
 - id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'