the-daily-epub/docs/plans/briefs/web-dashboard/handoff-step5.md

Step 5 handoff — settings

Landed

• src/web/dashboard/settings.rs: a schema derived by walking serialized default and live Config values, including optional/env-only fields, exact field kinds and enum choices, derived environment names, source tracking, README/example-backed help text, stable group order, and dotted-path anchors.
• /dashboard/settings: reload-on-mtime with a visible load-error banner and last-good config retention; secret presence-only rendering, environment locks, typed inputs, defaults/reset controls, and weight normalization notes.
• Typed toml_edit saves that preserve comments/order, collect field errors, write multiline string arrays, create missing tables, validate through Config::load in <path>.tmp.<pid>, preserve permissions, rename atomically, swap the live config, and record one attributed config_changes row per key.
• Provider add/remove flows through the same validated writer, including name and kind validation, role-reference refusal, placeholder defaults, audit history, and redaction of a hand-written provider api_key from history.
• /dashboard/settings/history, newest first at 100 rows per page.
• A step 5 CSS block and reset helper in app.js; /etc/daily-epub added to the server unit's ReadWritePaths.
• Sixteen settings tests covering every schema and writer case listed in §17, including router-level rendering and POST behavior through oneshot.

Deviations and notes

• Shipped providers cannot be removed, even when unreferenced. They are members of Config::default(), so deleting their TOML table would immediately restore the built-in entry and falsely report success. They can be edited or left unreferenced; custom providers can be removed normally.
• FieldKind::Enum owns Vec<String> rather than the plan sketch's static slice because llm.bulk and llm.editor must include provider names derived at runtime. The rendered behavior and validation table are unchanged.
• Restart notices also cover server.public_url, server.session_days, server.login_attempts, and server.login_window_minutes, in addition to the plan sketch's database_path and server.bind, because those values are captured when the server/session/throttle layers are built.
• An absent key whose effective value is already the submitted default remains absent. This reconciles “only changed fields” with the no-JavaScript form posting every editable field; resetting an explicit non-default file value still writes the default explicitly.
• Step 6 should call WebState::reload_if_changed before starting each job, as §4.2 requires. Step 5 supplies the shared helper; this branch's jobs module is intentionally still the parallel-step stub.
• The shared brief's sandbox list omits three pre-existing OpenAI fake-server tests that bind through the same curate::llm::tests::serve helper as its four named Anthropic tests. The step 1 handoff records those three additional sandbox failures; they are not settings regressions.

Verification

• cargo fmt: pass.
• cargo clippy --all-targets -- -D warnings: pass.
• Focused cargo test web::dashboard::settings -- --nocapture: 16 passed, 0 failed.
• Unfiltered cargo test: 379 library tests passed before the harness reported the expected loopback-bind failures (the 10 named library tests plus the three OpenAI tests noted above); no settings test failed.
• cargo test with all pre-existing loopback listener tests excluded: 411 passed, 0 failed, 15 filtered out (379 library, 7 binary-unit, and 25 integration tests passed; 13 library listener tests and both m7_server tests were filtered).