Context

PR #2191 wholesale-restored src/commands/doctor-config-flow.ts from pre-v2026.3.1. This discarded ~620 lines of new upstream diagnostic and repair features. ALL dependency modules exist in the fork.

Audit report: hq/engineering/notes/post-remediation-audit-b3b4.md

Findings (v2026.3.1/v2026.3.2)

1. noteOpencodeProviderOverrides implementation

Currently a dead no-op stub. Upstream added a real implementation that detects when the user has OpenCode Zen provider overrides masking built-in routing/costs. The models.providers config field exists in RemoteClaw.

2. collectMissingDefaultAccountBindingWarnings

New diagnostic: warns when channels have accounts configured but no default account and no binding coverage. Pure channel-layer diagnostic — directly relevant to RemoteClaw middleware.

3. Exec safe-bin profile scaffolding (6 functions)

normalizeConfiguredSafeBins, collectExecSafeBinScopes, scanExecSafeBinCoverage, scanExecSafeBinTrustedDirHints, maybeRepairExecSafeBinProfiles. All dependency modules exist: exec-command-resolution.ts, exec-safe-bin-runtime-policy.ts, exec-safe-bin-trust.ts.

4. "Legacy" → "Compatibility" terminology

Upstream renamed "Legacy config keys" to "Compatibility config keys" and "Legacy migration" to "Compatibility migration". Intentional wording change.

5. formatConfigIssueLines usage (v2026.3.2)

Refactors inline .map() config issue formatting to use shared formatConfigIssueLines() utility from a dedicated module.

6. Supporting imports

normalizeChatChannelId, readChannelAllowFromStore, DEFAULT_ACCOUNT_ID, normalizeAccountId, isRecord — all from modules that exist in the fork.

Dependencies

• ../pairing/pairing-store.js — readChannelAllowFromStore (exists)
• ../channels/registry.js — normalizeChatChannelId (exists)
• ../routing/session-key.js — DEFAULT_ACCOUNT_ID, normalizeAccountId (exists)
• ../exec-safe-bin-*.js — all 3 modules (exist)
• ../utils.js — isRecord (exists)

Exit Criterion

All 6 feature groups re-applied. Doctor --repair mode exercises the new repair functions. Doctor diagnostic mode exercises the new validation functions.