deepseek-harness/docs/core-data-structures/settings.i18n.yaml

# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
#   pnpm run verify-translation-pairing --write docs/core-data-structures/settings.md
settings.md: 1cabfae5d8dc72a9cd79341d250ee79820693872
settings.zh.md: d63a1384646fa38199e7d65e9f0504f0440597be
fix(settings): harden seam and provider per review findings Confirmed and fixed, each with a regression test that failed first: - Concurrent update() lost patches (merge over one stale snapshot): per-namespace serialized write queues; a failed write cannot poison the queue for later writers. - Fixed-name .tmp write followed planted symlinks and kept stale modes: random-suffix sibling, exclusive-create (wx), 0600, cleanup on failure, then rename. - A throwing settings/updated listener escaped commit and permanently wedged the provider reload chain (rejected refreshTask): commit now contains listener failures (INVARIANT-coded errors still propagate), async watcher rejections are adopted and contained (watch callbacks are officially void \| Promise<void>), and the provider chains refreshes on a settled tail with an error log. - No way to remove a user override: scope/service replace(section) sets the user section wholesale; replace({}) re-inherits base and schema defaults. - The three-primitive provider contract did not hold (base never called load()): the base Service.init loads and publishes once; settings-local delegates via yield* super[Service.init](). - Dispose did not quiesce: teardown flags closed, closes the watcher, then awaits queued/in-flight reloads; closed is re-checked across await points. - Invariant now checks the authoritative relation with the seam's own deepEqualJson: emitted next must equal settings.get(ns), and next/prev must differ structurally (cosmokit dependency dropped). - New docs/core-data-structures/settings.{md,zh.md} with type-equiv blocks + manifest entries; catalog types moved from exemptions to LINK_MAP; website page registered. Both packages stay at per-file 100% coverage. 2026-07-28 18:18:34 +08:00			`# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each`
			`# side as of the last confirmed-consistent state. Both languages carry equal authority;`
			`# after editing either side, bring the other along and re-record with:`
			`# pnpm run verify-translation-pairing --write docs/core-data-structures/settings.md`
feat(settings): detect stale writers with a revision, and announce raw changes The remaining P1 from the #939 review, plus the P2 it shares a mechanism with. Nothing carried a version, so two tabs editing one namespace silently overwrote each other — reproduced as tab B's `reasoning` lost to tab A's older draft. The seam's per-namespace write queue orders writes; it cannot tell a fresh writer from one replaying a snapshot a predecessor superseded. Each namespace now carries a monotonic `revision` over its RAW section. A write may send `expectedRevision`, checked at the FRONT of the queue (not at call time, which would race the very predecessor it guards against); a mismatch rejects with `SettingsConflictError` → `settings-conflict` on the wire, carrying both revisions. The editor captures the revision it opened at and, on conflict, asks the user to reopen rather than replaying its snapshot. The same counter fixes the missing broadcast. `settings/updated` is gated on the resolved value — correct for consumers, wrong for configuration surfaces: storing an override equal to the composition base leaves the resolved value alone while changing what the document says (the field is now overridden, not inherited) and moving every open editor's revision. `settings/document-updated (ns, revision)` fires on any raw-section change, in-process or external, and `host/settings-changed` now rides it. That event also closes the stale model picker: editing a provider's `models` changes no route, so `llm/adapters-updated` never fired and an open picker kept serving the old catalog. A change to an exposed provider namespace now emits `host/models-changed` too — that namespace holds the catalog. Docs: both sides of the five touched README pairs, a type-equiv block for `SettingsPathOp`, and an Agent Note recording what the plane exposes and who may overwrite what. The deferred wire-redaction gaps (secrets behind union/intersection/transform, `.default(...)` in the served envelope, schema text in rejection messages, `new Function` rehydration, pi-ai's `headers`) are recorded as TODO(settings-wire-redaction) and in Known Limitations rather than half-fixed. 2026-07-30 19:24:21 +08:00			`settings.md: 1cabfae5d8dc72a9cd79341d250ee79820693872`
			`settings.zh.md: d63a1384646fa38199e7d65e9f0504f0440597be`