[Staphylococcus]

Summary

Declared behavior settings now resolve through one validated generated-data overlay and are read-only across GUI, CLI and alternate config writers. Declaring an idle timeout of 300 overrides a saved 600 without replacing it; removing the declaration restores the saved preference and normal editing.

Scope

• This PR addresses one concern only.
• I split unrelated fixes, refactors, cleanup, or formatting into separate PRs.
• I read CONTRIBUTING.md and the relevant docs linked there.
• I discussed design-sensitive changes first, or this is a small obvious bug fix.

The versioned JSON binding beside the selected canonical config supports the eight existing screen/system/update behavior keys. It accepts generic or Nix presentation attribution, follows complete generation replacements, and rejects malformed, unavailable or unsafe sources. The application reads data and does not evaluate Nix. Config selectors retain their existing protections; credentials remain user-owned.

Shared mutation/publication guards re-read current declarations, preserve the existing locks and ownership checks, and reject stale edits before publication or service activation. GUI, CLI, startup, monitor and lifecycle readers use the declared values without copying them into mutable preferences.

The required bundle smoke gate also includes the supported-distro matrix, so Fedora/Arch failures cannot produce a green aggregate check.

User-Visible Behavior

Managed Settings rows remain visible with declared values and source information, disabled editors/reset actions, and the conditional page-top notice specified in #255. Busy/ready transitions and late worker completions cannot unlock them. Unmanaged keys remain editable; declaration removal restores ordinary resolution. CLI set/unset return actionable refusal for managed keys.

Monitor startup resolves the same effective idle-blanking policy as GUI/CLI even when the saved preference is the opposite. In-flight reads keep their own request identity, so an older save completion cannot discard a newer declaration snapshot. Queued edits wait for that read and remain serialized; a newly submitted edit still supersedes an older read.

The binding/schema, validation, precedence, removal and publisher-lock/reload contract are documented in the configuration guide. Final NixOS/Home Manager modules and native rebuild/activation/rollback qualification remain #253.

Validation

• Current head: 125c178586426058a26e5a79ab22c757ccaf088f. All 24 checks in full CI passed, including privileged ownership tests, Fedora/Arch packaged GUI and upgrades, Debian/RPM lifecycle and update paths, release-bundle smoke and the aggregate gate.
• Local checks passed: the full cargo test --locked -p lg-buddy suite, including 1,612 library tests (one existing physical-device test ignored), all 43 runtime-entrypoint tests and 155 Cucumber scenarios/1,988 steps; all 13 GTK tests; declaration/legacy CLI compatibility probes; and workspace/all-targets/all-features Clippy with warnings denied.
• Both behavioral regressions failed before the fixes. The monitor regression observes GNOME activity subscriptions and the mock TV's screen state with declared enabled/saved disabled and the reverse; it checks retained config/credentials. First-run missing-config coverage also verifies that the passive setup endpoint remains available with native interfaces present.
• UI regression coverage delivers read/save completions in both orders, with and without a queued unrelated edit, asserting declared value/source, disabled editor/reset, notice attribution and ordered persistence. Additional cases cover failed mutation completion and newer edits superseding older reads. These assert state and side effects, not incidental wording.
• Nix flake evaluation for both supported systems and the x86_64 sandboxed package/installed-launch check passed. Real-store update ownership and declaration generation-replacement probes passed outside the builder. The unchanged required smoke gate includes Fedora/Arch.

Native aarch64, physical-TV execution and public-module rebuild/rollback are not claimed. No host activation was performed. The original subagent reviewer verified this exact head against the unchanged base, independently ran five focused regression tests, and confirmed both findings are resolved with no actionable remaining issue in the fixes. Merge remains pending.

Related Issue

Fixes #255. Relates to #253.