113 settings: what can be defaulted, what can be deleted, and what is a decision

There are 113 settings across 22 groups on /admin/config. Most are keys for third parties and are irreducible — an instance without a Twilio SID cannot send an SMS. The rest fall into four kinds, and only one of them is really a setting.

A setting is a decision we declined to make and handed to the operator. That is legitimate when the answer genuinely differs per instance (a domain, a key, a limit). It is not when one answer is simply better, and the flag exists because nobody went back to delete it.

---

1. Wrong, and misleading — fix first

The "Storage" group is mislabelled and it will cost somebody their backups.

Its description reads "The older S3 names, kept so a configured instance keeps working. Set the group above instead." That is false. The two key pairs are not old and new names for one thing — they are two different subsystems:

	read by
S3_ACCESS_KEY, S3_SECRET_KEY	internal/blob — blob storage
S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY	internal/backup — backups
S3_ENDPOINT, S3_BUCKET, S3_REGION	both

An operator who reads "set the group above instead" and skips these leaves backups unconfigured, silently. And the three shared keys are listed in both groups, so the page shows them twice.

Fix: one Object storage group with the shared three, and separate blob and backup credentials named for what they are. No behaviour change, no migration.

---

2. Can be defaulted, with a migration

MU_USE_SQLITE — the search index. Off by default, which means search reads a map end to end with strings.Contains, populated asynchronously through a queue. FTS5 sits behind the flag.

This is not a preference and should not be a setting. What blocks flipping it: turning it on starts an empty index. backend.go describes a migration in prose and no such function exists — nothing reads index.json into SQLite. Only service/mail rebuilds itself at boot today (Reindex, added in e02b4569).

Migration path, in order:

1. Give every indexing service a Reindex() that runs at boot — news, social, blog, archive, images, and internal/thread.
2. Or write the migration backend.go already claims exists: read index.json once into index_entries, guarded on the table being empty (the guard is already described there).
3. Then flip the default and delete the flag.

Safety: the flag switches only the search index, not the data store. The index is derived, so the worst case is a rebuild. Stale() and Superseded() in backend.go already know which files stop being written.

---

3. Can be deleted outright

• APP_URL — the same fact as MU_DOMAIN for every instance where something is not sitting in front on a different name. Read in three places (internal/origin, internal/x402, service/wallet). Derive it from MU_DOMAIN and keep the override undocumented, or drop it.
• SHUTDOWN_SECONDS — a deploy detail. Nobody browses a settings page to tune a graceful-shutdown window; it belongs in the systemd unit's documentation.
• MCP_REGISTRY_PROOF — not a setting but a one-time publishing step. It belongs on whatever page explains publishing to the registry, not in a list of dials.

---

4. A decision, not a default

AGENT_NATIVE / AGENT_NATIVE_STREAM already default to on. They are not prototype flags — they are escape hatches back to the hand-rolled plan/execute/synthesize pipeline, and that pipeline is most of agent/agent.go's 3,295 lines.

It is also not dead code. agent.go:225 falls through to it when the native path errors: "so a query never fails." So it is a safety net, and the cost of the net is that every agent bug has two possible code paths and the second one is the one nobody exercises or improves — all of this session's work went into the native path.

The question is not what to default. It is whether the fallback earns 3,000 lines. My read: the honest replacement is an error message. A query that fails loudly is better than one answered by a pipeline nobody has touched in months, and the fallback masks exactly the native-path failures worth knowing about.

Needs a decision before any code moves.

---

Not on this list

The keys. ANTHROPIC_API_KEY, the Twilio dozen, STRIPE_*, BRAVE_API_KEY and the rest are third-party credentials with no sane default, and there is nothing to fix about them beyond the grouping that already exists.

Done when

/admin/config has no group called Platform, no setting that is a decision we could have made, and no description that would cause somebody to skip configuring their backups.

Start at /admin/config and inspect how the Storage group and its shared keys are defined. Then read backend.go, the listed indexing services, and agent/agent.go around line 225 to map the migration and fallback decisions. Done means the configuration groups and descriptions are corrected, the search migration/default decision is implemented safely, and the unresolved agent fallback has an explicit decision.