Desktop settings have one native ABP authority

Status: accepted architecture, implementation staged. Contract version 0.1.0.

Desktop appearance and layout belong to a headless settingsd authority. Settings controls, Mix operators and agents submit validated batches through native ABP. Applications and compd/Quoin consume complete accepted snapshots through shared headless settings contracts and one theme adapter per UI layer. Closing a Settings page does not stop delivery. Other services retain their own hardware and operational settings; discovery does not create a distributed transaction.

The shared library has multiple external owners from its first commit: settingsd, applications and compd. The plain component names settings and settingsd describe their public contracts. Config remains independent of Bus; the UI toolkit layer remains independent of settings transport. No COSMIC implementation or GPL/MPL code is incorporated.

Settings behaviour has one shared implementation per concern: settings consumer ordering/recovery and render-domain comparison; one theme adapter projecting settings onto the UI toolkit; shared reusable controls and role/default builders; and one shared event-loop activation/invalidation path. Applications retain their service lifetime, content and deliberate overrides. Compd owns output geometry, work areas, Wayland configuration and presentation. Standard widgets inherit current defaults without copied app palettes, font captures or settings handlers. Extract repeated components during migrations; keep headless crates independent of renderers and the UI layer independent of Bus.

Each profile has one exclusive writer. Authored settings, revision and bounded operation receipts share a durable strict-data replacement. A no-op persists a receipt without changing semantic revision. The durable store incarnation fences restores; broker sequence is delivery order, not settings revision. Caller access remains open across the trusted mesh. Correct target/revision binding and canonical publisher ownership do not require the operator to own the session.

Native calls/events use existing ABP/noded, preserving frozen framing and identity constants. External toolkit D-Bus adapters are later compatibility boundaries inside the independent MixOS session. Retained broker snapshots are presentation/recovery aids, not a durable offline store. Recovery is driven by lifecycle/connection/loss events, without an idle settings polling loop.

Consumer application and frame presentation are separate evidence. Compositor geometry/input updates remain coherent while Wayland configure/ack/buffer changes complete asynchronously. No global same-vblank guarantee is made.

The authority/store and shared consumer primitives are implemented; consumers adopt them as they enter this tree. Full widget geometry/resources, panel reconfiguration, native frame/first-map acceptance, named profiles, previews, replication and compatibility remain in development. This decision establishes ownership; individual fixtures do not close full desktop acceptance. See the initial contract.