- `models.py`: `IdleConfig` and `NotifyConfig` could move into focused modules
  if either concern grows. Harness profiles and their idle factory already live
  in `harness_models.py`; keep the factory because its unique canonical keys and
  environment names are load-bearing (thermo F6).
- Config-framework audit (2026-10-13): 17 non-dictionary leaf fields on
  `MeridianConfig` lack catalog metadata. Migrate the existing TOML settings:
  `harness.<id>.allow_builtin_agents`, `harness.pi.model`, Pi extension fields (`load_all_pi_extensions`,
  `extra_extension_paths`, `background_tasks.enabled`, `spawn_watch.enabled`,
  `disable_managed_bash`), `primary.timeout`, `work.default_worktree`, and
  `work.worktree_base`. They validate through their models but
  `OPTION_CATALOG.resolve_key()` cannot find them, so generic config get/set/reset
  is incomplete and they have no env var. Pi extension keys are documented as
  TOML-only in `docs/configuration.md`. Declare `config_field()` metadata and
  retain intentional validation/visibility rules.
- `loader.py:resolve_pi_harness_profile` rereads three Pi env toggles after a
  launch config snapshot has been selected. `_truthy_env_value` also accepts
  arbitrary nonempty strings, unlike the shared boolean codec. Resolve these
  inputs when loading config and make captured launch snapshots authoritative.
  Check simultaneous load-all/managed-bash settings: the load-all branch returns
  early and skips the managed-bash overrides.
- Audit exclusions: `env` is intentionally a dynamic map; RuntimeOverrides is
  intentionally a separate per-spawn policy system. Startup selectors
  (`MERIDIAN_CONFIG`, `MERIDIAN_HOME`) and SMTP secret lookup should not be moved
  into ordinary persisted scalar settings merely to achieve catalog coverage.
