[tang-vu]

Summary

Settings now keeps incomplete runtime work visible after saving or applying changes. A changed TOKEN_SPY_API_KEY or TOKEN_SPY_URL retains a manual stack restart requirement because Dashboard API and model-router capture those values at startup; recreating Token Spy alone does not update its clients. Changes belonging only to disabled services now report staged instead of none.

Fixes #7509.

Scope and overlap

The production change is six lines in settings.py. It changes apply-plan metadata; it preserves the existing service-recreation selection, credential sources, persisted values and refusal boundary. Existing Settings UI already displays the summary and retains manual work after Apply changes.

All-state searches covered settings, Token Spy key/restart, and settings.py. This includes the still-applicable staged-status outcome of closed #3802, whose closure retired its beta target. #2826 changes process environment reads and does not address persisted Settings changes. Closed #2517/#2518 concern other service keys. Open #3818's file inventory has no settings.py change. The rejected #7212 persisted-key fallback is not revived.

Validation

• Exact upstream main 0b44fa7edf351f2a3bcad88bca6db3aeebed2ee4: new Token Spy regressions fail eight cases; the staged-status regression fails one case, with three unchanged/active controls passing.
• Python 3.11 isolated Docker container, locked service dependencies plus the workflow's test requirements: 219 passed for test_settings_env.py, test_agent_monitor.py, test_usage.py.
• Linux Python 3.12 affected suites: 219 passed. One existing Starlette test-client deprecation warning.
• Actual settleSettingsApplyPlan JS consumer: both Token Spy connection keys remain visible as manual restart work after apply.
• Dependency-only Python 3.11/mypy 2.4.0 CI contract on the initial Token Spy candidate: 423 existing diagnostics, zero new against the 461 baseline. The final additional change is one boolean condition and four existing-fixture test cases; no new typed interfaces. No baseline was edited.
• Tests reside in the existing test_settings_env.py, executed by the dashboard API workflow's full pytest tests/ job. No new workflow wiring is needed.
• git diff --check passed. Independent review: root agent independently reviewed the final combined diff; no blocking findings..

Risk and release validation

This is a Settings control-plane metadata change. Host mutations and automatic service selection remain the same. Live credential rotation, installed restart/fleet verification and independent maintainer/human release approval are deferred; the authenticated save boundary and existing UI state reducer were exercised without changing the shared live QA runtime. Rollback is a normal revert and has no storage migration.

Attribution

Tang Vu and Codex collaborated: Tang Vu provided project direction, scope decisions and environment setup; Codex assisted with analysis, implementation, regression tests and review preparation. The listed commands were agent-executed. These receipts do not establish specific personal human verification or maintainer release approval.

Release Lane

• Stable hotfix targeting release/2.6.x
• Mainline change targeting main
• Next-minor work targeting the next feature/minor release
• Not sure; reviewer should help classify

Stable hotfix reason: n/a.

Changed Surface

• Docs only
• Tests only
• Dashboard UI
• Dashboard API / host agent
• Installer / bootstrap / lifecycle
• Docker Compose / service manifests
• Model routing / Hermes / capabilities
• Network exposure / auth / proxy
• Dependencies / runtime wiring

Risk And Validation

• Risk level: Medium for metadata; Settings control-plane release gates remain deferred below.
• Validation run:
  • git diff --check
  • Markdown/link sanity for docs
  • Focused tests listed above
  • Dashboard lint/test/build
  • Extension audit / compose validation
  • Release-grade fleet or scoped hardware validation
  • Stable-lane patch validation, if targeting release/2.6.x

Candidate: 4cfd1614b949625698359708587e77f987bf1a23, based on main 0b44fa7edf351f2a3bcad88bca6db3aeebed2ee4. The identity gate passes for its one author/committer commit. The final Python 3.11 tests used locked service dependencies and the workflow test requirements in an isolated Docker container; source matches this candidate.

Operational Change Check

• This is not an operational change.
• This is an operational change and validation is recorded above.
• This is an operational change and validation is intentionally deferred for: live credential rotation, installed restart/fleet verification and independent maintainer/human release approval. The narrower completed validation exercises the authenticated save boundary, all affected API suites and the existing UI apply-state reducer. Service selection and host mutation code are unchanged.

Notes For Reviewers

Revert has no storage migration. The change reports unfinished work accurately and does not claim that Token Spy key rotation is automatically complete. Please review the startup client contract and release gates before release.