fix(console): stop wizard saves from deleting custom tiers

[devlikebear]

Summary

Review follow-up to #935 (#931). Two bugs the config narrowing made reachable, plus the DESIGN.md contradictions it left behind. The removed editors are not restored — that scope narrowing is the point of #931.

Wizard saves silently delete custom tiers

buildConfigPayload merges llm_providers with what is already on disk, and its own comment explains why: "the backend's alias-keyed PATCH replaces the on-disk alias set with what the patch sends — so we must include every existing alias here". The identical reasoning applies to llm_tiers, which was instead rebuilt from requiredTiers (heavy/standard/light) alone and returned wholesale.

internal/config/schema.go:70 documents llm_tiers as "heavy/standard/light (or custom tiers)". So a user with a vision tier who clicks Edit in wizard on llm_tiers and changes one model loses that tier at save, and any role bound to it breaks at the next restart.

The limitation pre-dated #935, but #935 deleted the safe local tier editor and routed Config.svelte into this path (Config.svelte:391), which is what opened it to normal users.

Inspect rendered uncommitted edits as server state

shouldShowFieldActions is viewMode === 'quick', so Save/Discard are hidden outside Quick Start — but getDisplayValue preferred dirtyFields regardless of mode. A pane whose banner reads "Read-only inspection", and which DESIGN.md describes as showing "what the server actually loaded", displayed an unsaved value with no way to commit it. Toggle something in Quick Start, switch to Inspect to confirm, see the new value, restart — the edit is gone.

DESIGN.md contradicted itself and the code

• Line 283 listed the 13 Quick Start gates — including embodiment_providers_json — as staying interactive; line 296, in the same section, made that field read-only. The code implements 296. CLAUDE.md makes DESIGN.md the design source of truth, so the next contributor would have assumed an interactive embodiment card exists.
• Line 284 promised masked entry for 7 credential fields "wherever surfaced". Only memory_embed_api_key and tools_web_search_api_key still have inputs; api_auth_token, api_user_token, api_admin_token, tools_web_search_perplexity_api_key and work_scheduler_a2a_bearer_token have zero occurrences in src/. Now stated plainly, including the consequence that token rotation requires filesystem access to the host — a console-only operator cannot rotate them.

Dead code: documented, not deleted

Deleting the modal editors left configStructured.ts's seven draft builders and their constant tables with no component consumer (Config.svelte imports only four display helpers), kept green by their own unit test; saveConfig and getProviders likewise have zero call sites. I did not delete them: #931 is still open and DESIGN.md:296 already names a possible embodiment-preset follow-up that would reuse exactly this code. Instead DESIGN.md now carries the inventory, so it reads as deferred rather than forgotten — and as the delete list if that follow-up is declined.

Not changed

The removed capability itself — embodiment provider editing, YAML save, provider-alias deletion, per-provider live model lists. Those are #931's intent, not defects.

Test plan

• npm run check — 529 files, 0 errors, 0 warnings (this also establishes that refactor(console): narrow console surface to chat and observability #935 type-checks, which its review could not verify)
• npm test — 303/303 (note: test:ci is a curated slice that excludes onboarding.test.ts, so the new test only runs under the full suite)
• New tier test verified red against the old code
• go test ./internal/tarsserver/

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud