phase: 168_admin_settings_panel

**Phase 168 — Admin Settings panel — final verification: PASS**

1. **Implemented/verified:** `/settings.html` (admin-only) with the 75-field catalogue (`app/core/settings_catalog.py`), DB-over-env overrides in Postgres (`app_settings`, migration 0028 at head, `settings_overlay.py` resolver, `app/api/admin_settings.py` — 4 admin-only routes), live-apply on save with no restart + restart-required badges, Reset/Clear all, write-only secrets, `.env`-never-written, `BOR_SETTINGS_DB=0` kill switch.
2. **Phase E2E: 12/12** — run with `E2E_APP_PORT=8200` (ports 8123/8124 are held by an unrelated "undercooked" project; no process killed, no code change — the documented env override).
3. **Regression set: all 7 suites green in isolation** (theme tab, API tokens, configurable brand, global tuning, admin auth, cache busting, wide desktop column — 38 tests).
4. **Full suite: unit+integration exit 0 (4066 passed), app/ coverage 99%** (gate >90%); **ruff clean, pyright 0 errors / 0 warnings.**
5. **Log contract (rule 10) verified live:** per-turn + per-response byte-budget lines present; settings write lines carry key + action, **never the value**.
6. **Byte-budget audit: all endpoints under the 262,144 B budget**; settings catalogue 23,513 B (gzip 3,326).
7. **Defect fixed (one):** criterion 5 had no integration pin — added `test_bad_row_inserted_directly_never_bricks_boot` to `tests/integration/test_admin_settings_api.py` (malformed row inserted directly → fresh `create_app()` boots, row skipped with logged reason, rest of table applies, `/api/health` 200) — 12/12 green.
8. **Docs pass:** `README.md` and `AGENTS.md` reviewed in full — both consistent with the as-built feature (Settings page table, Settings section, Configuration-reference note, `.env.example` block); **no changes required**.
9. **Cleanup:** audit app killed (by PID); `app_settings` left empty (0 rows); all changes left in the working tree (no commit, per protocol).
10. **Completion criteria:** all 7 checkboxes verified green (criterion 7's commit is the harness's).
11. **Next pending phase:** `170_edit_bubble_sizing`.

app/config.py

@@ -905,4 +905,37 @@ class Settings(BaseSettings):
 
 @lru_cache
 def get_settings() -> Settings:
-    return Settings()
+    """Effective settings: env/.env with the admin's DB overrides layered
+    on top (phase 168, TODO L3: "The database value should override
+    the env var").
+
+    The DB half lives in :mod:`app.core.settings_overlay` — imported
+    LAZILY, on purpose: ``app.core.*`` imports ``app.config`` at module
+    scope (and ``app.db`` → ``app.config`` runs at import time), so a
+    module-scope import here would deadlock the import graph. The
+    ``@lru_cache`` is unchanged from pre-phase — every existing
+    ``get_settings.cache_clear()`` call site keeps working (they only
+    retune the environment, so skipping the reset hooks there is
+    correct), and :func:`invalidate_settings` is the save-side wrapper
+    that also runs the runtime reset hooks (phase 168, task 03).
+    """
+    from app.core.settings_overlay import resolve_settings
+
+    return resolve_settings()
+
+
+def invalidate_settings() -> None:
+    """Save-side settings refresh (phase 168, task 02/03).
+
+    Clears the ``get_settings`` cache (the next resolution re-reads the
+    DB overrides — no restart) and runs the registered runtime reset
+    hooks (task 03: the in-process singletons — the chat LLM client
+    and semaphore — rebuild from the fresh settings). The six existing
+    ``get_settings.cache_clear()`` test call sites stay the env-only
+    retune path: they re-resolve without running the hooks, which is
+    exactly what a test that only re-tunes the environment wants.
+    """
+    get_settings.cache_clear()
+    from app.core.settings_overlay import run_invalidators
+
+    run_invalidators()