/**
 * The YAML keys of every machine-visibility config key — the ones that live in
 * the owning box's own `devices/<machine>/agents.yaml` and cannot be read or
 * set for a peer. A fleet default may still live under
 * `fleet.defaults.config` (the shared default layer); the peer restriction
 * is about targeting another device, not about fleet policy.
 *
 * This is a ZERO-DEPENDENCY leaf on purpose. The authority is `CONFIG_KEYS` in
 * `lib/device-config.ts`, but that module imports `devices/config-migration.ts`,
 * so the migration cannot import it back without a cycle. Same shape as the
 * `agent-cli-commands` leaf: duplicated here, pinned equal to the registry by a
 * test (`device-config.test.ts`), so the two cannot drift silently.
 */
export const MACHINE_LOCAL_YAML_KEYS = new Set([
    'defaultBrowserProfile', // browser.profile
    'browserRemoteControl', // browser.remote-control — a consent flag; syncing it is a leak
    'schedulerEnabled', // scheduler.enabled
    'daemonEnabled', // daemon.enabled
    'tmuxEnabled', // tmux.enabled — whether an interactive run is tmux-wrapped on THIS box
    'browserTaskIdleMinutes', // browser.task-idle-minutes — only THIS box's reaper reads it
]);
