Fix data loss in global config writer (updateGlobalConfig)

[0101]

Problem

The Treemon global config file (%USERPROFILE%\.treemon\config.json) intermittently lost most of its keys. A user's editor / editorName settings and their collapsedRepos would silently revert, and the file would end up containing only lastViewedHashes. This is real data loss in the server's config write path.

Root cause

All global-config writers (writeCollapsedRepos, writeCanvasPaneOpen, writeCanvasPosition, writeLastViewedHashes) funnel through updateGlobalConfig in src/Server/WorktreeApi.fs. The old read-modify-write had three compounding problems:

1. No synchronization — every mutation called the writer with no lock. writeLastViewedHashes fires very frequently (every canvas-doc view).
2. Non-atomic write — File.WriteAllText could be observed mid-write by a concurrent reader, yielding a truncated/partial file.
3. Silent reset-to-empty on read failure — when the read/parse threw (e.g. because a concurrent writer left a partial file), the with _ -> JsonObject() branch discarded the entire existing config and wrote back only the single key currently being updated.

Together these turn a transient, recoverable race into permanent data loss — and explain why the file collapses down to just lastViewedHashes, the highest-frequency (usually last) writer.

Fix

Hardened the config write path in src/Server/WorktreeApi.fs:

• Serialize writes with a module-level globalConfigLock wrapping the whole read-modify-write (mirrors the configLock pattern in TreemonConfig.fs).
• Atomic write — serialize to a temp file in the same directory, then File.Move(tempPath, configPath, overwrite = true) (atomic on the same volume), mirroring SessionManager.fs and CanvasDocOwnership.fs. Readers can no longer observe a partial file.
• Back up instead of discard — on a genuine parse failure, log a clear error including the path, copy the unparseable file to a timestamped sibling (config.json.corrupt-<yyyyMMddHHmmss>), then start fresh. Existing data is never silently overwritten with a near-empty object.
• Data-oriented write contract — writers describe their change as (string * JsonNode) list instead of a JsonObject -> unit callback that mutates a passed-in object. The single root[key] <- value mutation is confined to one List.iter inside updateConfigAtPath, keeping the writers pure and honouring the repo rule against passing a collection in to be mutated.

The core read-modify-write is internal updateConfigAtPath (configPath) (updates) returning Result<unit, string>, so it can be unit-tested against a temp file. updateGlobalConfig is a thin wrapper that supplies the global path and preserves the existing per-writer failure logging. No change to the on-disk JSON format or keys for the valid-file case — unrelated keys are now always preserved.

Tests

Added src/Tests/ConfigWriterTests.fs (Category Fast + Unit), driving updateConfigAtPath against a temp file:

• Two sequential writes of different keys preserve both (the regression).
• An unparseable on-disk file is backed up to a config.json.corrupt-* sibling (original bytes intact) and the rewritten file is valid and contains the new key.
• A successful write leaves no .tmp file behind.

Results:

• dotnet build src/Tests/Tests.fsproj — succeeded, 0 warnings / 0 errors.
• dotnet test --filter "Category=Fast" — 872 passed, 0 failed (includes the 3 new tests).

[Copilot]

Pull request overview

This PR fixes intermittent data loss in the Treemon global config file (~/.treemon/config.json), where unrelated keys (e.g. editor/editorName, collapsedRepos) would silently revert and the file could collapse to just lastViewedHashes. The root cause was an unsynchronized, non-atomic read-modify-write in updateGlobalConfig that reset the config to an empty object whenever a concurrent writer left a partially-written file that failed to parse. The fix hardens the write path and adds unit coverage, fitting into the Server project's existing safe-persistence conventions.

Changes:

• Extract a reusable, testable internal updateConfigAtPath that serializes writes with a module-level lock, writes atomically via a same-directory temp file + File.Move(overwrite = true), and backs up an unparseable file to a timestamped config.json.corrupt-* sibling instead of discarding existing data.
• Reduce updateGlobalConfig to a thin wrapper that supplies the global path and preserves per-writer failure logging.
• Add ConfigWriterTests.fs (Fast/Unit) covering key preservation across sequential writes, corrupt-file backup/recovery, and no leftover temp file.

Show a summary per file

File	Description
src/Server/WorktreeApi.fs	Adds globalConfigLock, tryParseJsonObject, and updateConfigAtPath (locked + atomic + corrupt-file backup); rewrites updateGlobalConfig as a thin wrapper.
src/Tests/ConfigWriterTests.fs	New unit tests exercising updateConfigAtPath against a temp file for the regression, corrupt-backup, and temp-file-cleanup scenarios.
src/Tests/Tests.fsproj	Registers the new test file in compile order (after TestUtils.fs, so its helpers resolve).

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 0