Settings ownership P41: owner recovery (E2992 minimum v8) #2994

Parent epic: #2992

This is the approved P02 delivery unit of the settings-owner plan.
Technical consensus is complete. Implementation awaits explicit user plan review and coordinator authorization; no branch or product change has started.

Situation and intended behavior

The epic centralizes settings operations for app and CLI/daemon while preserving source composition, authorization, failures and durability. This child implements only its approved phase below, after its dependencies have landed.

Replace SettingsState alias with Arc using the constructor prepared in P01. Its only authoritative AppSettings stays in the existing RwLock. Initially preserve legacy read/write forwarding methods as explicitly temporary adapters; new current_snapshot/apply/result/drain methods use the contracts below. Add typed physical-loader halves, lifecycle gate and ledger-aware locked saver. Do not activate long-lived ownership or CLI proxy yet. Keep pre-existing loader compatibility and legacy transaction coordination. Tests in settings.rs exercise the new owner directly with temporary directories. Add the stable owner sidecar constant and ignore membership in instance_artifacts, without renaming existing sidecars.

Only listed files may change. Preserve unrelated formatter debt and user data. Shared-file handoff is merged main, owned by the next authorized phase; never private scratch.
Main must compile/test using only landed code. Before P20 the new authority stays inactive with legacy transactional behavior; P20 removes staging and activates only the completely migrated set.
No intermediate cut publishes a second active memory authority or promises sole-writer memory freshness while legacy writers remain.

Approved identity and ownership

• Phase: P02
• Class: design-bearing
• Owner: ac-dev-rust-v5
• Depends on phase IDs: P01
• Files: 2
• Canonical phase: D:/0_repos/AgentsCommander_iac/.ac/plans/2992-settings-owner/P02-v5-owner-core.md
• Phase-SHA256: FB79D5D89154809738EC4084454203E497FB8DE7F4735B577F66362030A7949B
• Master: D:/0_repos/AgentsCommander_iac/.ac/plans/2992-settings-owner/plan-v5-settings-owner.md
• Plan-SHA256: C142BB7BF5EDC96C5E88AA70A5A217B54D37E41F2E0B04ABD4A4AD9D8A69B0A5
• Source reference: f6e5d08882ba9b208b56afe1fec44efb04925205

The canonical phase file is the sole cold-start implementation specification. This issue is tracking and a review summary, not permission to make new design choices. Child/branch/execution identity belongs in the separate coordinator mapping; no certified Markdown is edited.

Planned modified files

• D:/0_repos/AgentsCommander_iac/.ac/room-18-ac-dev-team-v5/repo-AgentsCommander/src-tauri/src/config/settings.rs
• D:/0_repos/AgentsCommander_iac/.ac/room-18-ac-dev-team-v5/repo-AgentsCommander/src-tauri/src/config/instance_artifacts.rs

No tracked source files are added or removed. The phase's explicit preserve sets, protected behavior and budgets remain binding; P01 alone has the approved constructor-only mechanical exception.

Acceptance and verification (future work)

All following cases are FUTURE, owner-executed tests using existing inline modules, tempdirs, saver fault seams, controlled clocks/barriers. Prefix new cases e2992_p02_ in each named module. No generic harness/dependency or runtime execution during planning. Execute focused commands only after the Cold start block has initialized R/EVIDENCE and captured the actual authorized phase base.

From R/src-tauri after authorization:

cargo +1.98.1 test --locked --lib --bins e2992_p02_ -- --list > "$EVIDENCE/focused-list.txt"
rg "e2992_p02_" "$EVIDENCE/focused-list.txt"
cargo +1.98.1 test --locked --lib --bins e2992_p02_ -- --nocapture

Every named case must appear in the list and execute; zero matches is failure, not PASS. Full applicable regression and integration guards below remain mandatory.

Preserve existing source/permission/error contracts. Failed, absent or timed-out evidence stops delivery and returns the exact discrepancy to architecture; no widening of the frozen file table.

Execute the phase's complete local verification, structural and exact-head CI gates from its canonical file only after authorization. Every dependency must be merged into main; one sequential phase/PR at a time. A phase PR closes only this child. The epic remains open through all phases and the requested final shipper build. No installation, release/version bump or other persistence-domain migration is authorized.