[rodboev]

Settings opens on Overview with feature status and setup actions. Seven categories group settings by task. Operations links to Overview. Contacts has one Sync now action. The daemon decides when it needs a full reconciliation.

Save changes covers ordinary settings, including Kata and task service keys, and says when a pending edit needs a restart. Leaving Settings or reloading with unsaved changes asks first. Provider keys, People lookups providers, contact accounts, and replacement inference keys still save at once with their own buttons.

settings-save-flow-dark.webm

View	Before	After
Overview, 1440x1000
Overview, 390x844
Server, 1440x1000
Server, 390x844
Search & AI, 1440x1000
Search & AI, 390x844
People lookups, 1440x1000
People lookups, 390x844
Tasks, 1440x1000
Tasks, 390x844
Contacts, 1440x1000
Contacts, 390x844
Contact sync, 1440x1000
Contact sync, 390x844
Sources, 1440x1000
Sources, 390x844
Advanced, 1440x1000
Advanced, 390x844
Feature setup, 1440x1000
Key dialog, 1440x1000
Build confirmation, 1440x1000	New in Overview
Build confirmation, 390x844	New in Overview
Contact test, 1440x1000
Contact test, 390x844
Pending contact roles, 1440x1000
Pending contact roles, 390x844
Index build with contact sync, 1440x1000	New in Overview
Index build with contact sync, 390x844	New in Overview
Named contact draft, 1440x1000
Named contact draft, 390x844
Contact account validation, 1440x1000
Contact account validation, 390x844
Leave warning, 1440x1000	New in Settings
Leave warning, 390x844	New in Settings
Restart notice before saving, 1440x1000	New in Settings
Stale message index, 1440x1000	New in Overview
Stale message index, 390x1000	New in Overview

Refs #1552, slice 2 (Settings categories)

• Next slice: feat(web): reduce the sidebar to four places with a status dot #1568

[roborev-ci]

roborev: Combined Review (aaee8da)

Verdict: Changes require fixes for 2 findings.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:424; web/src/lib/components/settings/SettingsWorkspace.svelte:432: Changing a provider endpoint to another origin while clearing its stored key leaves Save changes stuck. The endpoint write already deletes the credential, so the subsequent DELETE returns credential_not_found (404). The clear remains pending on every retry and blocks later account and inference-key saves.

  Fix: Reconcile pending credential clears after endpoint writes, settling clears whose credentials are already absent. Treat credential_not_found as a completed clear and add a regression test for the combined save.

• web/src/lib/components/settings/CardDAVAccountSettings.svelte:162: An unchanged Google contact account produces no draft, and the separate account-save button has been removed. Test performs nonpersistent discovery, while Save changes never submits the unchanged account, preventing users from refreshing saved discovery URLs through the documented Test-and-save workflow.

  Fix: Provide an explicit rediscovery action, or allow a successful connection test to stage an unchanged account for saving.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 10s | Total: 18m15s

[roborev-ci]

roborev: Combined Review (42933f6)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/components/settings/CardDAVAccountSettings.svelte:50: After staging a disable or clearing a schedule on a saved named contact connection, leaving Contacts and returning can lose those edits. Selecting the pending connection before /carddav/connections finishes initializes its persisted baseline from blank fallback values. When the summary arrives, reconcileSettings treats false/empty drafts as untouched, restores saved values, and can delete the draft entirely.

  Fix: Retain the saved baseline with each account draft, or wait for the named connection summary before initializing its form. Add coverage with a delayed connections response and a pending disable or schedule clear.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 8s | Total: 23m33s

[roborev-ci]

roborev: Combined Review (e5fb31b)

Verdict: No findings at or above medium severity.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 6s | Total: 18m7s

[roborev-ci]

roborev: Combined Review (8557c4d)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/components/settings/CardDAVAccountSettings.svelte:164: Successful connection tests only stage unchanged Google accounts. An unchanged Microsoft account with missing discovery, a missing credential binding, or unavailable runtime is therefore never submitted by Save changes, blocking account recovery.

  Fix: Stage unchanged Microsoft accounts after successful connection tests and cover the recovery paths.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 10s | Total: 15m40s

[roborev-ci]

roborev: Combined Review (92788d7)

Verdict: No findings at or above medium severity.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 6s | Total: 16m23s

[roborev-ci]

roborev: Combined Review (0cae3f6)

Verdict: Changes require fixes for 2 findings.

Medium

• web/src/lib/components/settings/SettingsWorkspace.test.ts:312: The test 'Overview shows a contacts sync action error' duplicates 'keeps a failed Overview action error on Overview' at line 143. Both reject the Contacts sync action and assert its alert; the earlier test also checks persistence across navigation.

  Fix: Delete 'Overview shows a contacts sync action error'.

• web/src/lib/operations/actions.test.ts:14: The test 'reports contacts sync conflict' duplicates the existing end-to-end test at web/tests/e2e/operations.spec.ts:24, which exercises the real controller with HTTP 409 and verifies the conflict alert. The new test adds only exact wording checks.

  Fix: Delete 'reports contacts sync conflict'; retain the distinct partial and failed result tests.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 11s | Total: 16m6s

[roborev-ci]

roborev: Combined Review (4ec5909)

Verdict: No findings at or above medium severity.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 10s | Total: 14m59s

[roborev-ci]

roborev: Combined Review (22043a0)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/settings/overview.test.ts:38: The initializing/available:true case uses a coverage response the daemon cannot produce: initializing responses set fullBuildAvailable=false, so searchCoverageActions cannot advertise build_index. SettingsWorkspace.test.ts:406 repeats this impossible combination in its concurrent-action journey.

  Fix: Delete the initializing/available:true table case; the next case already covers the Initializing chip. Preserve the concurrency journey using reachable responses, such as unavailable with build_index before completion, followed by ready without that action.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 10s | Total: 18m11s

[roborev-ci]

roborev: Combined Review (147abc4)

Verdict: Changes require fixes for 3 findings.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:119: After Back is held on a history entry without exploreIndex, clicking another workspace and then Stay leaves Settings displayed at the popped URL. The second leave request overwrites the original stay callback with undefined, losing holdPop's restoration callback. Subsequent navigation can overwrite the prior history entry.

  Fix: Retain and correctly settle the original history-restoration callback when replacing a pending leave request. Cover Back → workspace click → Stay and Discard.

• web/src/lib/settings/overview.test.ts:33: The incomplete coverage fixture advertises build_index, an impossible daemon response: usable non-stale generations set fullBuildAvailable=false, and incomplete coverage reporting preserves that flag.

  Fix: Set available=false for the incomplete case. Keep its Incomplete text and warning-tone assertions; unavailable and stale cases already cover advertised builds.

• web/src/lib/operations/actions.test.ts:8: The failed fixture combines aggregate status failed with a succeeded personal connection. CardDAVController.Sync reports partial whenever failures coexist with any success, making this response unreachable.

  Fix: Keep the successful personal connection only in the partial case. Make the failed case contain only failed connections while preserving failure-reporting and safe-name coverage.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 9s | Total: 17m59s

[roborev-ci]

roborev: Combined Review (15df179)

Verdict: Changes require fixes for 3 findings.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:119: After Back reaches an unindexed history entry, clicking another workspace replaces the pending leave request and loses its history-restoration callback. Choosing Stay leaves Settings displayed at the popped workspace URL, and subsequent navigation can overwrite that history entry.

  Fix: Preserve and settle the original restoration callback when replacing a pending leave request. Cover Back → workspace click → Stay and Discard.

• web/src/lib/settings/overview.test.ts:33: The incomplete coverage fixture advertises build_index, an unreachable daemon response: usable, non-stale generations set fullBuildAvailable=false, and incomplete coverage preserves that flag.

  Fix: Set available=false for the incomplete case while preserving its Incomplete text and warning-tone assertions. Use unavailable and stale cases to cover advertised builds.

• web/src/lib/operations/actions.test.ts:8: The failed aggregate sync fixture includes a succeeded connection. CardDAVController.Sync returns partial whenever failures coexist with success, making this fixture unreachable.

  Fix: Include the succeeded personal connection only in the partial case. Use only failed connections in the failed case while preserving failure-reporting and safe-name assertions.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 14s | Total: 14m28s

[roborev-ci]

roborev: Combined Review (92870e5)

Verdict: No findings at or above medium severity.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 7s | Total: 14m43s

[roborev-ci]

roborev: Combined Review (745724c)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/components/settings/SettingsWorkspace.test.ts:151: The restart-cue test treats log.sql_trace as a live setting, but the daemon always publishes restartRequired=true for it. The cue-absent assertions therefore depend on a response production cannot emit.

  Fix: Use a real live setting such as web.theme, retain that draft while navigating to Server, then toggle restart-required log.enabled to preserve the cue appearance/removal checks.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 8s | Total: 15m56s

[roborev-ci]

roborev: Combined Review (19f35c7)

Verdict: No findings at or above medium severity.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 8s | Total: 13m46s

[roborev-ci]

roborev: Combined Review (54f15c6)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:150: With dirty Settings, pressing Back to an unindexed history entry and then Forward before answering the leave prompt leaves pendingLeave intact. Clicking Discard and leave executes the old callback, displaying the previous workspace while the URL still points to Settings.

  Fix: Invalidate pending leave callbacks on every committed history navigation, including returns to the same category. Cover Back followed by Forward before answering the prompt.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 7s | Total: 16m27s

[roborev-ci]

roborev: Combined Review (4c5b927)

Verdict: No findings at or above medium severity.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 8s | Total: 12m59s

[roborev-ci]

roborev: Combined Review (fac6511)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/explore/state.svelte.ts:896: After indexed Back navigation is held for unsaved changes, clicking the global Settings tab again pushes another history entry without cancelling the held leave when the category is unchanged. “Discard and leave” then executes the old relative history.go(delta), potentially landing on the wrong entry and remaining in Settings after discarding edits.

  Fix: Cancel the held leave whenever another navigation commits, including navigation to the same Settings category. Add coverage for this indexed-history sequence.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 11s | Total: 17m9s

[roborev-ci]

roborev: Combined Review (d110519)

Verdict: No findings at or above medium severity.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 13s | Total: 15m47s

[roborev-ci]

roborev: Combined Review (ceef781)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/settings/people-inference-controller.svelte.ts:35: After another tab or a manual edit changes a People profile, a shared-settings conflict reload advances the ETag without refreshing the cached profile status. Returning to People lookups skips loading because status already exists. Confirming removal then sends the new ETag while displaying the old profile, allowing the updated policy and its stored key to be deleted without a conflict.

  Fix: Refresh the profile snapshot when advancing its configuration revision, and invalidate pending confirmations or checks when the corresponding profile changes.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 11s | Total: 19m32s

[roborev-ci]

roborev: Combined Review (3c294ec)

Verdict: Changes require fixes for 3 findings.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:399: Saving ordinary settings or an enrichment provider while People lookups remains open updates the shared configuration revision but leaves the People controller using its old ETag. Subsequent profile checks, creation, selection, or removal receive HTTP 412 and require a manual reload.

  Fix: Refresh the People profile snapshot and revision together after shared or provider configuration saves, invalidating checks and confirmations tied to the previous snapshot.

• web/src/lib/components/settings/SettingsWorkspace.svelte:169: A failed coverage refresh silently retains the previous status and actions. Overview can therefore show stale Message search status or continue offering a full index rebuild after the index has completed, even when operations status refreshes successfully.

  Fix: Preserve previous coverage while refreshing, but expose an error or unavailable state and suppress stale actions when the request fails.

• web/src/lib/explore/state.svelte.ts:645: Browser Back from dirty Settings opens the leave confirmation, but AppShell runs restoreHistoryFocus for both the held popstate and its restoring traversal. This moves focus from Stay to the navigation button and disrupts keyboard access to the confirmation.

  Fix: Coordinate history focus restoration with the leave guard so held and restoring traversals preserve focus on the confirmation.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 13s | Total: 18m21s

[roborev-ci]

roborev: Combined Review (77a85ac)

Verdict: Changes require fixes for 2 findings.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:354: After a shared-settings save returns HTTP 412, conflict recovery reloads general settings but leaves the mounted People controller with stale profiles and an old config ETag. Subsequent profile actions fail with another 412 and require a manual reload.

  Fix: Refresh the People profile snapshot and ETag after shared-settings conflict reloads, including provider conflict callbacks, and invalidate checks tied to the previous snapshot.

• web/src/lib/components/settings/SettingsWorkspace.svelte:404: Saving an enrichment provider while a People status read is pending requests inference.load(), but run() silently skips the refresh while busy. The pending response can then install an obsolete ETag, causing subsequent profile actions to fail with HTTP 412 despite the successful save.

  Fix: Queue a follow-up refresh when load() is requested while busy, or serialize provider saves with People requests.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 12s | Total: 17m58s

[roborev-ci]

roborev: Combined Review (e390f40)

Verdict: Changes require fixes for 2 findings.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:621: When an enrichment provider save or creation returns HTTP 412, conflict recovery reloads only general settings. The mounted People controller retains stale profiles and ETag, causing subsequent profile actions to fail with another 412 until manual reload.

  Fix: Refresh the People profile snapshot and ETag in both provider conflict callbacks, invalidating checks tied to the previous snapshot.

• web/src/lib/components/settings/SettingsWorkspace.svelte:404: If a provider save succeeds while a People status request is pending, inference.load() silently skips the refresh because run() returns while busy. The pending response can install an obsolete ETag, causing subsequent profile actions to fail with HTTP 412.

  Fix: Queue a follow-up refresh when load() is requested while busy, or serialize provider saves with People requests.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 14s | Total: 14m12s

[roborev-ci]

roborev: Combined Review (435a4f4)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:404: Saving or adding an enrichment provider while a People status request is pending can drop the refresh because inference.load() returns while busy. The older response can install stale profiles and a pre-save ETag, causing subsequent profile actions to fail with HTTP 412 until manually reloaded. Provider conflict callbacks can lose their refresh the same way.

  Fix: Queue a follow-up People status reload when busy, or serialize provider mutations with People requests. Add a regression test with a delayed status response spanning a provider save.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 9s | Total: 13m29s

[roborev-ci]

roborev: Combined Review (b01acb7)

Verdict: Changes require fixes for 1 finding.

Medium

• web/src/lib/components/settings/SettingsWorkspace.svelte:404: Saving or adding an enrichment provider while a People status request is pending drops the requested refresh because run() returns immediately when busy. The pending response can install a pre-save ETag, causing subsequent People actions to fail with HTTP 412 until manually reloaded. Provider conflict recovery has the same race.

  Fix: Queue a follow-up People status refresh after the pending request finishes, or serialize provider mutations with People requests. Add a regression test with a delayed People response spanning a provider save.

---

Reviewers: 2x codex, codex (security), codex (test-value) | Synthesis: codex, 7s | Total: 12m0s

[rodboev]

Risk accepted: People lookups can miss a refresh when a provider save lands while its profiles are still loading.

You'd have to save a provider in the few milliseconds while People lookups is loading from the local daemon. If that happens, the next profile action says the settings changed on disk and asks you to reload. Clicking Reload fixes it, and nothing is lost or written with old data. Preventing it means queuing or serializing requests, which adds new state for a window normal use doesn't hit.