Note

Low Risk
Refactor is localized to desktop persistence error typing and layer wiring; persistence and encryption behavior are preserved and covered by expanded tests.

Overview
Refactors four desktop Effect services (DesktopAppSettings, DesktopClientSettings, DesktopSavedEnvironments, DesktopConnectionCatalogStore) so failures are typed, stage-specific errors instead of generic read/write wrappers around platform or schema causes.

Error model: Data.TaggedError becomes Schema.TaggedErrorClass with structured fields—operation, path / catalogPath / registryPath, optional environmentId or field—and stable user-facing message strings that do not echo raw underlying errors. JSON envelope failures are split from filesystem reads (*DocumentDecodeError vs *ReadError); encrypted payload/base64 issues use dedicated decode errors. Secret-related messages are built so invalid blob content (e.g. %%%) is not leaked.

Service shape: Standalone *Shape interfaces are removed; contracts live on each Context.Service tag. Layers are built via exported make + Layer.effect(..., make); tests and mocks use Service["Service"] where needed.

Behavior: Persistence, encryption, legacy migration, and settings semantics are unchanged; tests are expanded to assert error class, operation, paths, and message content for read/write/decode/migration paths.

^{Reviewed by Cursor Bugbot for commit 037db6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refactor desktop settings services to use structured, tagged error classes

• Replaces generic error classes in DesktopAppSettings, DesktopClientSettings, DesktopSavedEnvironments, and DesktopConnectionCatalogStore with Schema.TaggedErrorClass variants that include structured fields: operation, path/registryPath/catalogPath, and cause.
• Each write path now maps individual failure stages (e.g. encode-document, create-directory, write-temporary-file, replace-settings-file) to distinct operation literals on the error, providing stable messages that don't echo underlying error content.
• Read paths now distinguish between filesystem read failures and JSON decode failures using separate error classes (e.g. DesktopSavedEnvironmentsReadError vs DesktopSavedEnvironmentsDocumentDecodeError).
• Secret decode errors include environment ID, registry/catalog path, and field name while avoiding leaking sensitive content.
• Service construction is refactored from inline layer logic into a make factory function; method signatures and success-path behavior are unchanged.

^{Macroscope summarized 037db6d.}