Eliminate B3 defensive reads of the AiConfig SSOT in production source

Sub of Epic #12456 (AiConfig-SSOT antipattern cleanup). Authority = ADR 0019 (#12457, merged). Identified by the Diamond-1 fan-out census (Epic #12456 comment IC_kwDODSospM8AAAABEz8AaQ).

Context

The cleanup's largest read-side class: the fan-out found 62 live B3 instances across 30 production source files (V-B-A'd on dev). Per ADR 0019 §3, the Provider SSOT guarantees the resolved tree — defending a read with ?. or substituting a hidden-default || masks fail-loud and (for ||) violates the operator's no-hidden-default-fallbacks contract.

The Problem

Two variants of one root (defending against a SSOT-guaranteed subtree):

• aiConfig.X?.Y optional-chain (incl. the 11 KB Source classes' uniform sourcePaths?. pattern).
• || <leaf-default-literal> / || {} hidden-default substitution.

Several || {} in kb-gc/kb-reconciliation/kb-alerting explicitly guard a stale gitignored config.mjs — that is a deploy/bootstrapWorktree concern, NOT a code-side fallback (resolve at the deploy layer, do not defend the read).

The Architectural Reality

Fix per ADR 0019 §5: read the resolved leaf at the use site, let it fail loud; fold any legitimate literal default INTO the leaf declaration (leaf(default, env, type)). File-clusters (one PR per cluster):

• KB Source classes — 11 files (uniform sourcePaths?.)
• daemons/orchestrator — ~20 instances / 5 files (mostly Orchestrator.mjs)
• services/memory-core — 8 / 5
• KB ingestion + vector — 8 / 2
• graph + ingestion — 7 / 3
• scripts/maintenance — 5 / 2
• gitlab-workflow — 2 / 1
• examples — 1 / 1

The Fix

Per cluster: aiConfig.X?.Y → AiConfig.X.Y (read resolved); aiConfig.X || literal → fold literal into the leaf default + read AiConfig.X. Route the || {} stale-config.mjs guards to bootstrapWorktree/deploy, not a code-side defense. Each PR cites ADR 0019.

Decision Record impact

aligned-with ADR 0019 (AiConfig reactive Provider SSOT).

Acceptance Criteria

• All 62 B3 instances across the 30 files removed (resolved-leaf reads; literal defaults folded into leaf declarations).
• || {} stale-config.mjs guards resolved at the deploy/bootstrapWorktree layer, not by code-side defense.
• Each cluster PR cites ADR 0019 and passes the sub-#2 SSOT lint (once landed) with zero B3 hits.
• (post-merge) no new B3 instance merges un-flagged.

Out of Scope

• B3 inside test specs (5 instances) — coupled to the B4 isolation rewrite (#12435), remediated there.
• The lint itself (sub #2 = #12451).
• Other antipattern classes (A1/B4/C3 — their own subs).

Related

Parent: Epic #12456. Authority: ADR 0019 (#12457). Census: #12456 comment IC_kwDODSospM8AAAABEz8AaQ. Sibling subs: #12435 (B4), #12438 (A1), #11976 (C3), #12451 (lint + A4/C2/A3).

Origin Session ID: 966c46fb-ad36-4e4c-88d6-899c4d18ed91

Retrieval Hint: query_raw_memories("AiConfig SSOT B3 defensive read cleanup production source")