Safe mode starts with a configuration that does not load, and offers a one-click repair

[fylorn]

Why

Safe mode exists for a broken configuration, but twcore serve --safe loaded the configuration first and exited when it did not load, like a normal start. The desktop app saw core fail five times, switched to safe mode, saw it exit again and showed "Stopped" with no reason. Found when Lite 2026.10.2 met a config with client_probes.titling: passthrough (removed in 0.60.0).

What

• Stand-in: when serve --safe cannot load the configuration, it serves the control plane with a stand-in (tw_config::stand_in): the control key from the file, defaults for everything else. Status.config_rejected says which line is wrong from the start, so a UI that connects later can show it. A file too broken to find the control key in still exits (nobody could connect).
• ConfigManager::standing_in sets the rejection and clears seen, so saving the same broken text again does not look like a return to the version in service.
• One-click repair (tw_config::repair): a value outside its choices goes back to the default (its key is removed), an unknown field is removed; emptied parents go too (tw_yaml::remove_key), comments and layout stay. Offered only when the result loads (a half-fixed config is not offered). Shown values are masked like excerpts.
  • GET /config/repair → ConfigRepair { base_version, fixes: [ConfigFix] }
  • POST /config/repair (ConfigRepairRequest { base_version }) recomputes from the file on disk and writes through the normal write path (history, rollback, plugin guard); 409 when stale, 400 control.config_not_repairable when nothing is fixable.
• Message codes: serde's two commonest field errors get their own codes with arguments, config.unknown_variant { field, value, expected } and config.unknown_field { field, expected }, instead of English text inside config.unparsable. New control.config_not_repairable.
• CONTROL_API_VERSION 37.

Tests

• tw-config: stand-in, field-error codes, repair (single, several, list items, emptied sections, comments kept, half-fixed refused, masking, paths).
• tw-control/tests/safe_mode.rs: status from the start, plan → repair → swapped in, stale refused, unfixable refused, same broken text does not clear the rejection, a fixed file loads through reload_from_disk.
• End to end with the built binary: serve --safe on a broken config, twcore call /status, /config/repair GET and POST, file and history checked.
• cargo fmt --check, cargo clippy --workspace --all-targets -D warnings, cargo test --workspace pass locally.

🤖 Generated with Claude Code