Why: Personal project rows and credentials could override system policy and split shared business configuration by actor.
Evidence: SELF receipts /tmp/project-settings-backend-full-20261014-973d52c1.json and /tmp/rdm-settings-backend-final-green-20261014-03.json preserve full commands, object snapshots and output. PostgreSQL and current-head CI remain NOT_RUN.
Impact: Add scope-aware APIs, a fail-closed optional project configuration authorizer, CAS updates and explicit atomic migration. Preserve legacy rows and private preferences; protected secrets and runtime model routes obey system ownership.
Refs: P1/P2/P8, docs/records/2026-10-14-rdm-settings-completion-contract.md
weichen
f965c5877f