Flow 1 · Settings editor · Frame (a) · /config

Settings editor — resolved, with provenance

The editor is a form over resolved entries, not over key/value pairs. Every row states where its value came from: set here, inherited from a named ancestor, or locked by a named ancestor. A build that renders only value produces a form that looks correct and misrepresents its own contents.

platform FuzeFront › portal Acme Portal › org Acme Corp › user You

namespace: notifications ETag v-8814

Delivery

3 settings

Digest frequency notifications.digest.frequency

How often batched notifications are delivered.

enum

Set here · org Acme Corp

allowedScopes: platform, portal, org, user

Batch notifications notifications.digest.enabled

Group notifications into a digest instead of sending each immediately.

boolean

Enabled Inherited from portal Acme Portal

SMS channel notifications.channel.sms

Send notifications over SMS in addition to email.

boolean

Disabled Locked by portal Acme Portal

🔒 portal Acme Portal locked this value. lockReason: "SMS is disabled tenant-wide pending carrier review."

Limits

2 settings

Retry backoff notifications.retry.backoff

Delay before retrying a failed delivery.

durationrequires restart

Set here · org Acme Corp

Max delivery attempts notifications.retry.maxAttempts

number

Default — never set anywhere

Credentials

1 setting

Provider API key notifications.provider.apiKey

secretsecret

•••••••••••••••• Replace

Set here · isSet: true, value never returned

2 unsaved changes

Contract. GET /v1/config?namespace=notifications&scopeType=org&scopeId=… → EffectiveConfig; each row is one EffectiveConfigEntry rendering source, locked, lockedBy, editable. Save is a single atomic PUT /v1/config carrying expectedVersion (the ETag above) — all operations succeed or none do; a settings page must never half-save.
Hidden keys are absent, not filtered. The editor has no client-side hidden filter and no code path that could render one — the API omits them. See frame (c).
The input is not the authorization boundary. A disabled control reflects editable: false; the server refuses the write regardless.