Consolidate settings and durable turn admission

[Open-Squilla]

Scope

Frontend/backend separation left duplicate request interfaces, configuration write orchestration in Gateway handlers, and separate Web/Channel reservation lifecycles. This PR makes the existing contracts accurately represent required alternatives, gives AppSettings ownership of configuration policy and commit ordering, and uses one durable reservation/activation implementation for both interactive entry points.

Four main commits:

1. Restore generated Params fidelity, observe actual backend Params without changing dispatch behavior, remove five ineffective request validators, and keep an accurate data-only route feedback result in its domain module.
2. Reuse narrow request capabilities and existing WorkspaceCatalog contract types; retain response validation, projection, timeout, cancellation, and error differences.
3. Move candidate construction, configuration policy, persistence/live ordering, and reload coordination into AppSettings. Delete the old overlapping Gateway write bodies and combined-write bypass.
4. Share reserve/freeze/commit/activate/compensation. If Goal compensation returns no result or raises, atomically fail only the exact accepted, unactivated, still-queued task. Preserve existing terminal records and accepted identity when storage outcome is unknown; activated tasks remain driver-owned.

Non-goals: protocol replacement, database migration, domain-wide contract aggregation, a general ContractClient, or unifying CLI/Cron/Heartbeat ingress.

Maintenance accounting

At base 846bbc6b4 and head d6a75c34aa, authored production code decreases by 313 physical lines; generators, scripts, and architecture enforcement increase by 91, for a net reduction of 222. Tests (+766), schema (-5), and generated output (+231 lines, -63,298 bytes) are accounted for separately. The complete PR has 4,041 additions and 3,271 deletions, a net increase of 770 lines. This is not a claim of large whole-repository code reduction. Moves and formatting are not claimed as architectural benefits.

The principal benefit is deletion of duplicate business ownership: three overlapping settings write commit bodies become one, and two shared reservation lifecycles become one. Necessary entry-specific gates, collect behavior, input preparation, and delivery remain. No download, memory, or performance improvement is inferred from line counts.

Route feedback uses a small explicit domain result with required accepted and nullable optional reason/recorded. Its Adapter returns the validated response without a type assertion. The architecture gate uses its existing generated-contract fence, with no field-specific public alias exemption or syntax recognizer. A type check compares the domain result with the wire fields in the Adapter test. Shared request capabilities and their input/output isolation remain.

The final simplification commit removes 126 lines in total: 76 authored implementation lines and 50 test lines. Thirteen cases specific to the removed public-facade exception are retired; the general import/re-export fence and response/nullability checks remain covered.

Branch

Base branch: main

Target exception: N/A

The four main commits remain available in PR history for review. The protected main branch uses a squash merge queue; the final main commit will represent the complete PR.

Issue

Linked issue: None

Reason: scoped follow-up maintenance of the frontend/backend separation and its durable acceptance boundary.

Release Note

Release note: Correct generated request types with required alternatives and preserve accepted task identity and actual terminal state when activation compensation fails. Existing v4 fields and persisted layouts remain compatible.

Tests

Latest-head validation for d6a75c34aa:

• Full frontend suite: 5,500 tests across 432 files passed.
• WebUI architecture guards, production-validator policy (210 roles), and vue-tsc: passed.
• Formal WebUI build, theme/runtime bundle checks, artifact verification and package staging: passed (397 artifact files).
• Contract tooling: 14 tests passed.
• Targeted architecture/route-feedback preflight: 136 tests passed. The prior implementation passed its original 149-test preflight; the new no-exemption regression failed against that implementation and passes with this change.
• GitNexus staged-change analysis plus complete file-diff review confirmed the intended frontend scope. Static hunk mapping has gaps for removed aliases/test files and can report adjacent unchanged functions, so it was supplemented by source comparison and the complete frontend checks.

The final commit changes only frontend domain types, architecture enforcement and their tests. Python implementation, contract schemas/generators, and Desktop implementation are unchanged from 6a0e521b9. Previously recorded evidence on those sources includes:

• Linux complete offline acceptance: 25,936 passed, 184 existing skips across four complete partitions of 1,482 files, with zero duplicate JUnit IDs and zero exit codes for all phases.
• Ordinary macOS acceptance preflight: 568 passed, 9 skipped, including real Seatbelt/network probes, configuration transactions and durable ingress faults. Ruff, package mypy (1,549 files), and wheel build passed.
• macOS Desktop Workbench and the complete offline document journey passed. An earlier annotation timeout did not recur in the baseline control, subsequent preflight or full rerun; its cause remains unestablished.
• Configuration and admission checks include secret/provenance and old-config compatibility, once-persist/commit ordering, replay/collect/cancellation, ownership races, storage uncertainty and conditional terminal transitions. New compensation cases reproduced 15 failures on the original implementation and passed after the fix. Consolidating shared Web/Channel scenarios retained all 18 scenarios and passed all 147 tests in the affected files.
• Complete contract tests: 388 passed, 1 existing fixture skip, with real Python/TypeScript/Ajv integration. Complete cross-platform determinism remains part of required CI.

Latest-head CI is pending. The preceding run had failures in Windows recovery-migration and Desktop profiles, and had not completed Windows contract determinism when this revision was pushed; it is not counted as green acceptance. Local passing checks do not replace the required current-head CI.

The default test path remains offline, deterministic, credential-free and safe for forks. Response validation, transport capability isolation, lifecycle failure coverage, timeouts and skip policies are retained. Deleted cases exercise only the retired public-facade policy.

Maintainer Live Check

Maintainer live check: no

Surface: N/A — validation uses synthetic, offline provider and channel fixtures.

Safety

Existing public v4 contracts, secret/environment provenance, sparse configuration persistence, old-config compatibility, read-only/safe-write rules, and reload ordering are retained. No database migration is required. Durable task compensation uses an exact task/session conditional update and never compensates a driver-owned task. The final frontend simplification is platform-neutral and changes no runtime wire fields or persisted state. The existing domain export remains available; the removed facade was introduced only on this unmerged branch. Native process/filesystem/network changes in the broader PR require platform CI in addition to macOS evidence; single-platform results do not establish cross-platform acceptance.

No secrets, user runtime data, private prompts, research notes, implementation plans, or machine-specific artifacts are included.

Third-Party Origin

Third-party origin: none

No third-party implementation, fixture, documentation text, or dependency is added.

Documentation Changes

No project documentation changed.