- Never fold over an unreadable settings.json: the fold and its write run
  only when the file decoded, so a malformed file stays for the user to
  repair instead of being replaced with defaults.
- A canonical projectSettingsOverrides entry wins over a legacy map for the
  same project in one patch, so omitting a key to clear it sticks.
- A project defaultModelSelection on a disabled provider falls back to the
  environment, like the text generation model already did.
- Agent access without orchestration withholds only the capability some
  project overrides; a device-only override no longer revokes browser access.
- Server stop resolves continueThreadsAfterServerUpdate per session project,
  so a project override marks its running turns for continuation.
- The settlement key encodes an absent threshold differently from null, so
  switching a project from inherit to never sweeps immediately.