[itlezy]

Mixed settings PATCH requests now validate and replace all affected SQLite sections in one serialized transaction. Failed validation or a later SQL write leaves every section and the published runtime settings unchanged. Concurrent patches preserve omitted fields; an admitted update finishes publication even if its caller is cancelled, while cancellation before admission writes nothing.

The REST route preserves the existing typed settings surface and error envelopes. A committed update whose subsequent runtime refresh fails is classified separately as an internal error instead of implying that persistence was rejected. No TOML keys, settings DTOs or migration path are added.

Regressions cover transaction rollback across sections, independent connections, concurrent partial updates, cancellation on both sides of admission, request-body middleware admission, a real-router valid-request positive control followed by a later SQL-trigger failure, and restart persistence. Native managed metadata98, core479 unit plus package integrations, and REST143 unit plus3 contract integrations passed at the preserved pre-CI035 source68a98a1e. The two atomic-settings patches were restacked unchanged after AICH onto #314; normal hooks run on the final head. Fresh exact-head hosted gates remain required before merge. Artificial runtime-refresh error injection remains an accepted follow-up; typed error-classification coverage does not claim that runtime injection proof.

Fixes #299 (RUST-BUG-184). Stacked after #315 and #314; merge #314, then #315, then this PR. Its diff against main includes those prerequisite commits until the preceding PRs integrate. AICH schema67→68 retains the fresh-profile-only beta policy; old profiles remain separate for rollback and there is no migration.

Hosted Windows Clippy identified production items following the private error-classification test module. The follow-up only moves that unchanged test module to the end of its file, preserving production text and every assertion. Normal commit/push checks pass; fresh exact-head hosted qualification is required after that mechanical repair.

Parent-coordinated consolidation: #314 owns the CI graph and merged Builder selection. AICH trust #248 and atomic settings #299 are independently owned reliability work, with atomic settings explicitly stacked after AICH. They are being qualified in isolated registered checkouts in parallel using the exact #314 workflow candidate. Merge order is #314, then AICH, then atomic settings; each dependent branch will be refreshed against the actual preceding merge and applicable checks rerun before merge. The parent owns ref updates, conflict review and merges. File ownership and dependencies are recorded; no required CI/CodeQL gate is waived. This is the coordinated use of the parallel-approved policy, not an unrelated PR exception.

[itlezy]

The parent is also qualifying the existing profile-ownership lane (#247) in parallel. Its seven Rust commits own daemon/profile/metadata lease lifetimes and are separate from CI graph changes, AICH trust and atomic settings. Actual Windows packaged-daemon proof passed: all three offline writer commands specifically rejected the busy profile without settings/root/bootstrap mutation; clean shutdown released ownership, durable partial progress survived restart, and the 12 MiB transfer completed with the expected hash. Its current workflow base is the same #314 candidate; merge order remains #314, AICH #315, atomic settings #316, then parent-reviewed independent lanes. The parent will refresh exact branches and require applicable checks before each merge. No required status or author policy is waived; all affected human PRs carry the coordinated parallel-approved label.

[itlezy]

Parent-coordinated supersession: qualification runs for this head have been cancelled to prioritize #321, which removes unused Slint/fontconfig APT setup after repeated mirror-DNS failures before Cargo. Source commits and completed evidence are preserved. The parent will refresh this branch onto the actual merged prerequisite and rerun all applicable gates before integration. These deliberate cancellations do not establish a product regression or a passing qualification.