Stage 4: services + MCP-server codemod (A/B/D-prod/E sub-classes ~50-70 sites)

Context

Stage 4 of Epic #12101 — the consumer-side codemod for the four non-getter anti-pattern sub-classes from Discussion #12100's ledger (A / B / D-prod / E). Migrates ai/services/** + ai/mcp/** consumers onto the canonical Proxy-routed aiConfig.X.Y read and the operator's no-hidden-default contract. Stage 3 (#12105, the delegation-getter sub-class C) is merged.

API note: there is no aiConfig.set(path, value) method (Discussion #12100 hypothesized "Option F's .set()"); only setData + the createConfigProxy set-trap exist. So D-prod writes migrate to aiConfig.X = v (the proxy set-trap routes to setData), not a .set() call.

Contract Ledger

• Source of authority: AiConfig (Tier-1 realm root Neo.ai.Config) + its parent chain.
• Consumers/tests: the affected services' specs (DatabaseService, GraphService, SessionService, ConceptDiscovery, GapInference, ProviderReadiness, the KB DocumentService/QueryService/SearchService/VectorService + Source classes) + Orchestrator-adjacent.

E treatment (per-site verified, not blanket)

Each ?? <literal> is checked against the owning config leaf:

• Redundant (literal == template default — e.g. guideGapWeightThreshold ?? 0.8 ↔ leaf(0.8, …), minSourceLength ?? 200, prScanLimit ?? 20): remove the fallback; the config already provides the value.
• Code-only default (the literal is the real default, not in config — candidate: the 9 KB Source ?? '<path>' defaults): add the default to the config template (the SSOT), then remove the fallback.
• ?? null (e.g. Orchestrator swarmHeartbeat?.targetSource ?? null): excluded — null-normalization, not a default value.
• Tenant defaults (?? 'neo-shared' / ?? 'neo' in DocumentService/QueryService/SearchService): verified against the fail-closed tenant-isolation resolution — removed only if the resolution provably always yields the tenant (no security regression).

Acceptance Criteria

• AC-Stage4-A: drop .data at the ~12 read sites — aiConfig.data.X → aiConfig.X.
• AC-Stage4-B: ProviderReadinessHelper default-params read the Proxy (aiConfig), not .data.
• AC-Stage4-D: the ~8 bootstrap debug mutations go through the proxy set-trap (aiConfig.debug = true).
• AC-Stage4-E: each ?? <literal> hidden-default removed only after verifying the config provides the default (added to the template where it lived only in code); ?? null excluded; tenant sites guarded against isolation regression.
• AC-Stage4-tests: affected service specs green; no tenant-isolation regression.

Out of Scope

• D-test — the 33 test aiConfig.X = Y mutations (a separate test-ergonomics migration).
• Stage 5 (#12107 — Env consumer-export retraction) / Stage 6 (#12108 — delete legacy applyEnv).

Related

• Parent Epic: #12101 (Stage 4). Source: Discussion #12100 (sub-classes A/B/D-prod/E; §"Stage 3 codemod-sweep prep"). Sibling: #12105 (Stage 3, merged).