refactor(settings): prepare owner recovery (refs #2994)

.github/workflows/pr-regression-gates.yml

@@ -1807,6 +1807,29 @@ jobs:
             exit 1
           }
 
+      # #2994 (E2992): the settings-owner tests in the lib crate. Windows already
+      # runs them through --lib --bins --tests; this leg lists the filter, refuses
+      # an empty list, then runs exactly that list serially.
+      - name: "cargo test (E2992 settings owner, focused)"
+        working-directory: src-tauri
+        shell: bash
+        timeout-minutes: 20
+        run: |
+          set -euo pipefail
+          FILTER=e2992_
+          cargo test --locked --lib "$FILTER" -- --list 2>&1 | tee test-e2992-list.log
+          COUNT="$(grep -cE ': test$' test-e2992-list.log || true)"
+          if [ "$COUNT" -eq 0 ]; then
+            echo "::error::the ${FILTER} filter lists no tests."
+            exit 1
+          fi
+          echo "listed ${COUNT} ${FILTER} tests"
+          cargo test --locked --lib "$FILTER" -- --test-threads=1 2>&1 | tee test-e2992.log
+          grep -qE "^test result: ok\. ${COUNT} passed; 0 failed" test-e2992.log || {
+            echo "::error::expected exactly ${COUNT} passing ${FILTER} tests."
+            exit 1
+          }
+
   rust-linux-release-parity:
     name: rust-linux-release-parity
     # #1842: the Linux PR gate runs ubuntu-latest (24.04) while the Linux
@@ -2775,6 +2798,29 @@ jobs:
             exit 1
           }
 
+      # #2994 (E2992): the settings-owner tests in the lib crate. Windows already
+      # runs them through --lib --bins --tests; this leg lists the filter, refuses
+      # an empty list, then runs exactly that list serially.
+      - name: "cargo test (E2992 settings owner, focused)"
+        working-directory: src-tauri
+        shell: bash
+        timeout-minutes: 20
+        run: |
+          set -euo pipefail
+          FILTER=e2992_
+          cargo test --locked --lib "$FILTER" -- --list 2>&1 | tee test-e2992-list.log
+          COUNT="$(grep -cE ': test$' test-e2992-list.log || true)"
+          if [ "$COUNT" -eq 0 ]; then
+            echo "::error::the ${FILTER} filter lists no tests."
+            exit 1
+          fi
+          echo "listed ${COUNT} ${FILTER} tests"
+          cargo test --locked --lib "$FILTER" -- --test-threads=1 2>&1 | tee test-e2992.log
+          grep -qE "^test result: ok\. ${COUNT} passed; 0 failed" test-e2992.log || {
+            echo "::error::expected exactly ${COUNT} passing ${FILTER} tests."
+            exit 1
+          }
+
   rust-fmt:
     name: rust-fmt
     # Skip branch-deletion push events while still requiring pull request validation.

src-tauri/src/config/instance_artifacts.rs

@@ -208,6 +208,13 @@ pub(crate) const SETTINGS_LOCK_FILE_NAME: &str = SETTINGS_LOCK_TARGET_NAME;
 /// leftover the naming migration deliberately never deletes stays ignored; the
 /// one row deliberately not composed by `layered_name!`.
 pub(crate) const SETTINGS_RETIRED_LOCK_NAME: &str = "settings.json.lock";
+/// #2994 - the settings owner's lifecycle lock: a stable sidecar, separate from
+/// the transactional `SETTINGS_LOCK_FILE_NAME`, retained for the owner's whole
+/// lifetime and never unlinked on close.
+pub(crate) const SETTINGS_OWNER_LOCK_FILE_NAME: &str = "settings.owner.no-git.lock";
+/// #2994 - the settings owner's endpoint metadata. Reserved here so the runtime
+/// artifact is ignored before any writer publishes it.
+pub(crate) const SETTINGS_OWNER_ENDPOINT_FILE_NAME: &str = "settings-owner.endpoint.no-git.json";
 /// Covers every settings migration backup instance. The concrete names are
 /// composed by their own migrations, so this glob is registry-owned and no
 /// writer imports it.
@@ -941,6 +948,12 @@ pub(crate) const INSTANCE_ARTIFACTS: &[InstanceArtifact] = &[
         disposition: Disposition::Ignore,
         comment: "# AgentsCommander: persisted session state",
     },
+    InstanceArtifact {
+        name: SETTINGS_OWNER_ENDPOINT_FILE_NAME,
+        kind: ArtifactKind::File,
+        disposition: Disposition::Ignore,
+        comment: "# AgentsCommander: settings owner endpoint metadata; machine-local runtime state",
+    },
     InstanceArtifact {
         name: SETTINGS_BACKUP_ROTATION_GLOB,
         kind: ArtifactKind::Glob,
@@ -983,6 +996,12 @@ pub(crate) const INSTANCE_ARTIFACTS: &[InstanceArtifact] = &[
         disposition: Disposition::Ignore,
         comment: "# AgentsCommander: retired pre-migration settings write lock; the naming migration never deletes it, so the leftover stays ignored",
     },
+    InstanceArtifact {
+        name: SETTINGS_OWNER_LOCK_FILE_NAME,
+        kind: ArtifactKind::File,
+        disposition: Disposition::Ignore,
+        comment: "# AgentsCommander: settings owner lifecycle lock; stable sidecar, never unlinked",
+    },
     InstanceArtifact {
         name: TELEGRAM_BRIDGE_LOG_FILE_NAME,
         kind: ArtifactKind::File,
@@ -1604,4 +1623,40 @@ mod tests {
         );
         assert_eq!(LOOP_STATE_TARGET_NAME, "loop.state.no-git.json");
     }
+
+    /// #2994 (P41) - the owner's lifecycle sidecar and endpoint metadata are Ignore
+    /// rows in sorted position, distinct from the transactional lock, and leave
+    /// every existing row in place.
+    #[test]
+    fn e2992_p41_owner_ignore() {
+        ignore_rows_are_unique_and_byte_sorted_by_name();
+        assert_eq!(SETTINGS_OWNER_LOCK_FILE_NAME, "settings.owner.no-git.lock");
+        assert_eq!(
+            SETTINGS_OWNER_ENDPOINT_FILE_NAME,
+            "settings-owner.endpoint.no-git.json"
+        );
+        assert_ne!(SETTINGS_OWNER_LOCK_FILE_NAME, SETTINGS_LOCK_FILE_NAME);
+        assert_ne!(SETTINGS_OWNER_LOCK_FILE_NAME, SETTINGS_RETIRED_LOCK_NAME);
+        for name in [
+            SETTINGS_OWNER_LOCK_FILE_NAME,
+            SETTINGS_OWNER_ENDPOINT_FILE_NAME,
+        ] {
+            let rows: Vec<&InstanceArtifact> = INSTANCE_ARTIFACTS
+                .iter()
+                .filter(|row| row.name == name)
+                .collect();
+            assert_eq!(rows.len(), 1, "{name} must have exactly one row");
+            assert_eq!(rows[0].kind, ArtifactKind::File);
+            assert_eq!(rows[0].disposition, Disposition::Ignore);
+        }
+        // Neighbouring rows survive unchanged: the transactional lock and the
+        // retired lock are still Ignore rows of their own.
+        for name in [
+            SETTINGS_LOCK_FILE_NAME,
+            SETTINGS_RETIRED_LOCK_NAME,
+            "sessions.json",
+        ] {
+            assert!(ignore_rows().iter().any(|row| row.name == name), "{name}");
+        }
+    }
 }