Stop a config reload from undoing a change the user just made by hand

Reloading rebuilds the theme and general settings from the config file.
That is right for a file edit, but it also wiped every live `srd set` - and
the titlebar right-click menu's "Customize" rows are built entirely out of
live `srd set`s. Changing a button style from that menu and then saving
init.lua for any unrelated reason silently reverted it.

Survivable while reloads only happened on Mod4+Ctrl+r. The reload-on-write
support added in the previous commit makes a reload happen on every save,
which turns a rare surprise into a reliable one. A control that silently
reverts is worse than no control, so this is a defect rather than a
documented quirk. The AGS peer session reached the same conclusion from the
other side while deciding whether to build Settings controls against these
values, and would have had to label them session-only.

Every setting changed live is recorded on the WindowManager as key -> raw
JSON text, and replayed after each reload through the very same handle_set
that applied it, so a replayed setting cannot behave differently from a real
one. Recorded only on success, so a rejected value is never replayed, and
only for real client calls, so the replay cannot rewrite what it is reading.
Last write wins per key. Raw JSON text because core has no serde dependency
and no reason to gain one for this; the platform crate parses it back.

Verified live in a nested compositor: set button_side left and button_mode
fixed, saved an unrelated config edit, both survived, and the log reported
re-applying two live settings. Three tests cover the round trip, the
rejected-value case and the one-entry-per-key case.

A live value is still a session override rather than a persisted setting.
That distinction is now written down in DEFAULTS.md instead of being a trap.

515 tests pass, clippy clean.

2 files changed, 37 insertions, 14 deletions

diff --git a/docs/DEFAULTS.md b/docs/DEFAULTS.md
index a130434..3497410 100644
--- a/docs/DEFAULTS.md
+++ b/docs/DEFAULTS.md
@@ -867,10 +867,17 @@ checks the config directory's `.lua` modification times once a second and
 reloads when one changes. Set it to `false` for a config that does expensive
 work at load time. `Mod4+Ctrl+r` still reloads on demand in either case.
 
-Two limits to know. A reload does not re-register key *grabs* with the
+**A hand-made change is not undone by a reload.** A reload rebuilds the
+theme and general settings from the config file, which is right for a file
+edit but would also wipe every live `srd set` - and the titlebar
+right-click menu's "Customize" rows are all live `srd set`s. Every setting
+changed live is recorded and re-applied after each reload, so changing a
+button style from that menu and then saving `init.lua` for an unrelated
+reason keeps the change. A live value stays until it is changed again or the
+session ends; it is a session override, not a persisted setting, so write it
+into the config to keep it across restarts.
+
+One limit to know: a reload does not re-register key *grabs* with the
 backend, so a brand new key combination needs a restart before the
-compositor sees that key at all; an existing combination picks up its new
-action immediately. And a reload rebuilds the theme from the config file, so
-it discards live `srd set` theme changes - including titlebar settings
-changed through the right-click menu. That is the correct precedence, but
-with reload-on-write it now happens every time the config is saved.
+compositor sees that key at all. An existing combination picks up its new
+action immediately.
diff --git a/docs/TODO.md b/docs/TODO.md
index 49f7312..d24f9b8 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -104,14 +104,30 @@ investigations in one day started from a screenshot that was quietly lying --
 draw (border strips and the desktop icon grid), and `winit/render.rs` carries
 a pointer to it at the place a new tier gets added.
 
-**One interaction worth knowing.** A config reload rebuilds `ThemeConfig` from
-the config file, so it discards live `srd set` theme changes - correct
-precedence, and pre-existing, but auto-reload makes it happen on every save
-rather than only when the reload key is pressed. A titlebar customised live
-through the right-click menu reverts the next time `init.lua` is saved.
-
-Full workspace build/test/clippy clean: 512 tests (262 core / 160 wayland /
-43 platform / 34 config / 13 ctl), 0 failed, 0 clippy warnings.
+**A follow-on defect, found and fixed rather than documented away.** A config
+reload rebuilds `ThemeConfig` from the config file, so it discarded every
+live `srd set` - and the titlebar right-click menu's "Customize" rows are
+built entirely out of live `srd set`s. That was survivable while reloads only
+happened on `Mod4+Ctrl+r`; reload-on-write turned a rare surprise into a
+reliable one, and a control that silently reverts is worse than no control.
+Flagged independently by the AGS peer session while deciding whether to build
+Settings controls against these values, which is the same conclusion from the
+other side.
+
+Every setting changed live is now recorded (`WindowManager::live_settings`,
+key -> raw JSON text) and replayed after each reload through the very same
+`handle_set` that applied it, so a replayed setting cannot behave differently
+from a real one. Recorded only on success, so a rejected value is never
+replayed; last write wins per key. Verified live: set `button_side left` and
+`button_mode fixed`, saved an unrelated config edit, both survived and the
+log reported "re-applied 2 live setting(s) after the reload".
+
+A live value is still a session override rather than a persisted setting --
+it lasts until changed again or the session ends. That distinction is now
+documented in `DEFAULTS.md` instead of being a trap.
+
+Full workspace build/test/clippy clean: 515 tests (262 core / 160 wayland /
+46 platform / 34 config / 13 ctl), 0 failed, 0 clippy warnings.
 
 ## Nemo's right-click menu: confirmed working, and two real bugs found doing it (2026-08-28)