settings: the four per-feature files .wikitool-remotes/-telemetry/-upload/-tasks.json move into the three tiers and disappear; new command config migrate; 10.0.0-beta.1 (#208)

Files changed:
- .gitignore
- AGENTS.md
- CHANGES.md
- INSTALL.md
- VERSION
- docs/explanation/knowledge-and-commitment.md
- docs/explanation/telemetry-and-evaluation.md
- docs/explanation/why-gates-are-code.md
- docs/how-to/run-the-weekly-review.md
- docs/how-to/set-up-the-mcp-server.md
- docs/how-to/trace-and-score-sessions.md
- docs/how-to/troubleshoot.md
- docs/reference/commands/README.md
- docs/reference/commands/configuration.md
- docs/reference/commands/finding-and-checking.md
- docs/reference/commands/git.md
- docs/reference/commands/instance-health.md
- docs/reference/commands/pages.md
- docs/reference/commands/raw-material-and-uploads.md
- docs/reference/configuration.md
- docs/reference/exit-codes.md
- instructions/dev/doc-pull-through.md
- instructions/dev/tracker-testing.md
- instructions/gates.md
- instructions/ingest-queue.md
- instructions/mcp-read-server.md
- instructions/migrate-corpus.md
- instructions/migrations/10.0.0-settings-tiers.md
- instructions/setup-instance.md
- raw/CONTRACT.md
- reports/CONTRACT.md
- tools/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/_util.py
- tools/chemenu/commands/config_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/export_cmd.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/new_page.py
- tools/chemenu/commands/review_cmd.py
- tools/chemenu/commands/task_cmd.py
- tools/chemenu/commands/upload_cmd.py
- tools/chemenu/config.py
- tools/chemenu/config_shapes.py
- tools/chemenu/legacy_settings.py
- tools/chemenu/mcp/__main__.py
- tools/chemenu/mcp/server.py
- tools/chemenu/reference_doc.py
- tools/chemenu/review.py
- tools/chemenu/settings.py
- tools/chemenu/tasks/__init__.py
- tools/chemenu/tasks/caldav.py
- tools/chemenu/tasks/config.py
- tools/chemenu/tasks/superproductivity.py
- tools/chemenu/telemetry/policy.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/record_sp_fixtures.py
- tools/chemenu/tests/test_bugreport.py
- tools/chemenu/tests/test_caldav.py
- tools/chemenu/tests/test_config_shapes.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_git_publish.py
- tools/chemenu/tests/test_legacy_settings.py
- tools/chemenu/tests/test_mcp_server.py
- tools/chemenu/tests/test_new_page.py
- tools/chemenu/tests/test_review.py
- tools/chemenu/tests/test_settings.py
- tools/chemenu/tests/test_sp_recorded.py
- tools/chemenu/tests/test_superproductivity.py
- tools/chemenu/tests/test_task_cmd.py
- tools/chemenu/tests/test_tasks_config.py
- tools/chemenu/tests/test_telemetry_policy.py
- tools/chemenu/tests/test_tracker_live.py
- tools/chemenu/tests/test_upload.py
- tools/chemenu/tests/tracker_live.py
- tools/chemenu/upload.py

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

instructions/dev/tracker-testing.md

@@ -36,15 +36,15 @@ plain `pytest` run unless you set it.
 |---|---|---|
 | `CHEMENU_LIVE_SP_BINARY` | The packaged Super Productivity (`.deb` layout). The suite starts its own headless copy on a fresh profile, seeded from `fixtures/sp/seed-backup.json`, and stops it again. | The suite |
 | `CHEMENU_LIVE_CALDAV_URL`, `_USER`, `_PASSWORD` (optional `_VERSION` for the report line) | A CalDAV collection. In CI it is a throwaway Radicale started by `.gitea/scripts/start-radicale.sh`. | The suite - it may create the marker calendar |
-| `CHEMENU_LIVE_PROFILE=<name>` | A tracker of your own, described by `.wikitool-tasks.d/<name>.json` in the checkout, used exactly as configured. | You - the suite never creates anything but items |
+| `CHEMENU_LIVE_PROFILE=<name>` | A tracker of your own, described by a profile `.wikitool-tasks.d/<name>.json` in the checkout, used exactly as configured. | You - the suite never creates anything but items |
 
 `CHEMENU_LIVE_REQUIRE=sp,caldav,profile` (any subset) turns "no such tracker configured" into
 a failure instead of a skip. CI sets it; without it a workflow that lost its server would go
 green by skipping, which is the outcome the suite exists to rule out.
 
-The commands under test read their configuration from `.wikitool-tasks.json`, or from the file
-`WIKITOOL_TASKS_CONFIG` names when that variable is set. The live suite sets the variable per
-test, so it never touches the checkout's own `.wikitool-tasks.json`; you can use the same
+The commands under test read the `tasks`, `superproductivity` and `caldav` sections of the
+settings, or those of the profile `WIKITOOL_TASKS_CONFIG` names when that variable is set. The
+live suite sets the variable per test, so it never touches the checkout's own settings; you can use the same
 variable to run `task` and `review` by hand against a second tracker.
 
 ## What the suite writes, and what it never does
@@ -72,19 +72,23 @@ that fails against theirs. The steps differ per tracker only in the profile and
 
 1. **Create the marker project in that tracker**, by hand, named exactly `Chemenu Live-Test`.
    Nothing else in the tracker is touched, but this project's items are created and closed.
-2. **Write the profile** to `.wikitool-tasks.d/<name>.json` (gitignored - it holds
-   credentials). It is a normal `.wikitool-tasks.json` plus one optional key,
-   `live_test_version`, which is stripped before use and only names the tracker's version in
-   the report line. Paths are absolute.
+2. **Write the profile** to `.wikitool-tasks.d/<name>.json` (gitignored). It is in the format of
+   `.wikitool-local.json`, holds only the sections `tasks`, `superproductivity` and `caldav`, and
+   takes one optional key, `live_test_version`, which is stripped before use and only names the
+   tracker's version in the report line. Paths are absolute. **A secret in a profile is a
+   reference, never a value** - `{"ref": "<name>"}` - so the file holds no credential. Put the
+   value where the reference resolves: the environment variable `WIKITOOL_SECRET_<NAME>` (name in
+   capitals) for a run, or 1Password / the secrets file for a standing profile
+   ([configuration reference](../../docs/reference/configuration.md#profiles)). The user does
+   that; a value never goes through the chat or onto a command line.
 
    Super Productivity, API access (the app must be running with the Local REST API on):
 
    ```json
    {
      "schema": 1,
-     "provider": "superproductivity",
-     "thresholds": {"stalled_waiting_days": 14, "unpaged_project_weeks": 3, "someday_stale_months": 5},
-     "superproductivity": {"access": "api", "api_base_url": "http://127.0.0.1:3876", "api_token": "<token>"},
+     "tasks": {"provider": "superproductivity", "stalled_waiting_days": 14, "unpaged_project_weeks": 3, "someday_stale_months": 5},
+     "superproductivity": {"access": "api", "api_base_url": "http://127.0.0.1:3876", "api_token": {"ref": "live_sp_token"}},
      "live_test_version": "19.1.0"
    }
    ```
@@ -94,9 +98,8 @@ that fails against theirs. The steps differ per tracker only in the profile and
    ```json
    {
      "schema": 1,
-     "provider": "caldav",
-     "thresholds": {"stalled_waiting_days": 14, "unpaged_project_weeks": 3, "someday_stale_months": 5},
-     "caldav": {"url": "https://<server>/<user>/", "username": "<user>", "app_password": "<password>",
+     "tasks": {"provider": "caldav", "stalled_waiting_days": 14, "unpaged_project_weeks": 3, "someday_stale_months": 5},
+     "caldav": {"url": "https://<server>/<user>/", "username": "<user>", "app_password": {"ref": "live_caldav_password"},
                 "inbox_list": "Inbox", "someday_list": "Someday"},
      "live_test_version": "<server and version>"
    }