[samuv]

Summary

Adds docs/acceptance/studio-settings.md (Bounded): the safe, capability-gated runtime-settings inventory (management stays deployment-managed), storage health, the eight-section settings workspace, and the restoration of chat's model picker over the live inventory.

Review focus

• The runtime-settings response is an allowlisted projection: build id, server implementation, provider display endpoint, inventory; never a credential or raw endpoint.
• Provider and routing configuration are capability-disabled in the UI with the daemon-managed reasons.

Checker: check-acceptance-plan.sh passes; task docs passes. Stacked delivery: nothing in this series merges until the whole stack is reviewed; the plan's approval-by-merge event is deferred to the end, as its Delivery line records.

Contract amendments

• AC3.3. The models section names each deployment-managed control with the BFF's reason, as it does now, instead of rendering disabled controls. Sign-out is in the about section, where the code puts it.
• Model picker. The plan now says the chat layer deferred it, not stubbed it, matching the chat plan.

Development stage

• Plan / Interface
• Implementation
• Combined
• Spike / Routine / Cleanup

Contract linkage

• Work classification: Bounded
• Classification rationale: adds the read-only runtime-settings and storage-health surface inside the boundary ADR 0351 fixed
• Decision record: None — the boundary and the published-SDK rule are ADR 0351's; this plan only fills in a feature contract that ADR anticipated
• Human waiver of spine: Yes — the directing human chose stacked (gh stack) delivery for the whole Studio series: nothing merges until every layer is reviewed, so the plan's approval-by-merge event is deferred to the end (recorded in each plan's Delivery line), and each implementation layer records the exact plan commit it built against.
• Acceptance plan: docs/acceptance/studio-settings.md
• Human decisions resolved and recorded: Yes
• Plan / Interface PR: this PR
• Approved commit baseline: absent until the stack root merges (stacking exception above)
• Combined/exemption rationale: N/A

Interface conformance

• Interface contract under review: GET /api/v1/settings/runtime (allowlisted, read-only) and GET /api/v1/storage/health; management stays deployment-managed. No gRPC, Go, CLI, or tool-schema change.

Issue relationship

Relates to #1750 (parent #1736; stack #1766). Non-closing: the step completes when both of its layers merge.

Type of change

• Behavioral/interface plan
• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation/process

Test plan

Baseline checks

• Acceptance-plan checker
• Linting (task lint)
• Offline test suite (task test)
• Offline demo (go run ./cmd/mecademo)
• Markdown changed: docs generation/link checks (task docs)

Plan layer: the acceptance-plan checker and task docs pass. The Studio gates (task studio:check, task ac-trace) run on the implementation layer above, since this layer adds no apps/ code.

User-facing change

None — a plan document and, for the bootstrap, ADR 0351.

Special notes for reviewers

Part of a fourteen-layer stack; review bottom-up. Nothing merges until the whole series is reviewed.