refactor(config): Route all config I/O through AppController

Eliminates 22 call sites that bypassed the AppController state owner
and read/wrote config.toml directly. AppController is now the single
source of truth for self.config; gui_2.py, commands.py, etc. go
through controller.save_config() / controller.load_config().

Production changes:
- src/models.py: rename load_config -> _load_config_from_disk,
  save_config -> _save_config_to_disk (private I/O primitives)
- src/app_controller.py: add public load_config()/save_config() methods
  that own the state. Update 3 internal call sites and 3 ConductorEngine
  call sites to pass max_workers from self.config
- src/multi_agent_conductor.py: ConductorEngine.__init__ now takes
  max_workers as a parameter (caller responsibility, not I/O primitive)
- src/external_editor.py: get_default_launcher() takes config as a
  parameter; gui_2.py:1311,4776 pass app.config
- src/gui_2.py: 17 sites of models.save_config(X.config) replaced with
  X.save_config() (delegates via __getattr__ to controller)
- src/commands.py: save_all() uses app.save_config()

Test changes (route through controller, not I/O primitive):
- tests/conftest.py: mock_app and app_instance fixtures now patch
  AppController.load_config/save_config instead of models I/O primitives
- 18 other test files: patches renamed from models._save_config_to_disk
  to AppController.save_config (and same for load_config)
- tests/test_app_controller_mcp.py: use SLOP_CONFIG env var instead of
  patching removed CONFIG_PATH module constant
- tests/test_parallel_execution.py: pass max_workers=2 explicitly to
  ConductorEngine (caller no longer reads config)
- tests/test_gui_paths.py: add save_config=MagicMock() to MockApp;
  assert on controller method, not I/O primitive
- tests/test_models_no_top_level_tomli_w.py: still calls private
  _save_config_to_disk directly (the only allowed exception; tests
  the lazy-load behavior of the primitive itself)

New files:
- scripts/audit_no_models_config_io.py: enforces the rule (--strict,
  --json modes; AST-based docstring detection to avoid false positives)
- conductor/code_styleguides/config_state_owner.md: documents the rule

Verification:
- 67 targeted tests pass
- scripts/audit_no_models_config_io.py --strict returns 0

This is the architectural cleanup that surfaced during the
audit_architectural_cheats_20260607 review. Closes the smoke-gun
CONFIG_PATH module constant (already done in 0c7ebf22) AND the
free-function models.load_config/save_config smell.

[conductor(checkpoint): config-iO-refactor-20260607]

tests/conftest.py

@@ -285,12 +285,12 @@ def mock_app() -> Generator[App, None, None]:
    Mock version of the App for simple unit tests that don't need a loop.
  """
  with (
-  patch('src.models.load_config', return_value={
+  patch('src.app_controller.AppController.load_config', return_value={
    'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'},
    'projects': {'paths': [], 'active': ''},
    'gui': {'show_windows': {}}
   }),
-  patch('src.models.save_config'),
+  patch('src.app_controller.AppController.save_config'),
   patch('src.gui_2.project_manager'),
   patch('src.gui_2.session_logger'),
   patch('src.gui_2.immapp.run'),
@@ -320,12 +320,12 @@ def app_instance() -> Generator[App, None, None]:
   [C: tests/test_gui2_events.py:test_app_subscribes_to_events]
  """
  with (
-  patch('src.models.load_config', return_value={
+  patch('src.app_controller.AppController.load_config', return_value={
    'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'},
    'projects': {'paths': [], 'active': ''},
    'gui': {'show_windows': {}}
   }),
-  patch('src.models.save_config'),
+  patch('src.app_controller.AppController.save_config'),
   patch('src.gui_2.project_manager'),
   patch('src.gui_2.session_logger'),
   patch('src.gui_2.immapp.run'),

tests/test_api_hook_extensions.py

@@ -33,7 +33,7 @@ def test_get_indicator_state_integration(live_gui: Any) -> None:
 
 def test_app_processes_new_actions() -> None:
  from src import gui_2
- with patch('src.models.load_config', return_value={}), \
+ with patch('src.app_controller.AppController.load_config', return_value={}), \
    patch('src.performance_monitor.PerformanceMonitor'), \
    patch('src.session_logger.open_session'), \
    patch('src.session_logger.reset_session'), \

tests/test_app_controller_mcp.py

@@ -49,7 +49,7 @@ def controller(tmp_path):
 def test_app_controller_mcp_loading(tmp_path, monkeypatch):
     # Mock CONFIG_PATH to point to our temp config
     config_file = tmp_path / "config.toml"
-    monkeypatch.setattr(models, "CONFIG_PATH", str(config_file))
+    monkeypatch.setenv("SLOP_CONFIG", str(config_file))
     
     mcp_global_file = tmp_path / "mcp_global.json"
     mcp_global_file.write_text(json.dumps({"mcpServers": {"global": {"command": "echo"}}}))
@@ -75,7 +75,7 @@ active = ""
 
 def test_app_controller_mcp_project_override(tmp_path, monkeypatch):
     config_file = tmp_path / "config.toml"
-    monkeypatch.setattr(models, "CONFIG_PATH", str(config_file))
+    monkeypatch.setenv("SLOP_CONFIG", str(config_file))
     
     project_file = tmp_path / "project.toml"
     mcp_project_file = tmp_path / "mcp_project.json"

tests/test_arch_boundary_phase2.py

@@ -44,7 +44,7 @@ class TestArchBoundaryPhase2(unittest.TestCase):
   from src.app_controller import AppController
     
   # Use a real AppController to test its _confirm_and_run
-  with patch('src.models.load_config', return_value={}), \
+  with patch('src.app_controller.AppController.load_config', return_value={}), \
    patch('src.performance_monitor.PerformanceMonitor'), \
    patch('src.session_logger.open_session'), \
    patch('src.session_logger.reset_session'), \
@@ -67,7 +67,7 @@ class TestArchBoundaryPhase2(unittest.TestCase):
   """When pre_tool_callback returns None (rejected), dispatch must NOT be called."""
   from src.app_controller import AppController
     
-  with patch('src.models.load_config', return_value={}), \
+  with patch('src.app_controller.AppController.load_config', return_value={}), \
    patch('src.performance_monitor.PerformanceMonitor'), \
    patch('src.session_logger.open_session'), \
    patch('src.session_logger.reset_session'), \

tests/test_auto_slices.py

@@ -6,7 +6,7 @@ from src import models
 @pytest.fixture
 def mock_app():
  with (
-  patch('src.models.load_config', return_value={
+  patch('src.app_controller.AppController.load_config', return_value={
    "ai": {"provider": "gemini", "model": "model-1"},
    "projects": {"paths": [], "active": ""},
    "gui": {"show_windows": {}}

tests/test_discussion_takes_gui.py

@@ -6,8 +6,8 @@ from src.gui_2 import App
 @pytest.fixture
 def app_instance():
  with (
-  patch('src.models.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}}),
-  patch('src.models.save_config'),
+  patch('src.app_controller.AppController.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}}),
+  patch('src.app_controller.AppController.save_config'),
   patch('src.gui_2.project_manager'),
   patch('src.gui_2.session_logger'),
   patch('src.gui_2.immapp.run'),

tests/test_gui_events_v2.py

@@ -6,7 +6,7 @@ from src.events import UserRequestEvent
 @pytest.fixture
 def mock_gui() -> App:
  with (
-  patch('src.models.load_config', return_value={
+  patch('src.app_controller.AppController.load_config', return_value={
     "ai": {"provider": "gemini", "model": "model-1"},
     "projects": {"paths": [], "active": ""},
     "gui": {"show_windows": {}}

tests/test_gui_paths.py

@@ -10,6 +10,7 @@ class MockApp:
   self.ui_scripts_dir = '/mock/scripts'
   self.config = {"paths": {}}
   self.ai_status = ""
+  self.save_config = MagicMock()
  
  def init_state(self):
   """
@@ -23,8 +24,7 @@ class MockApp:
 def test_save_paths():
  mock_app = MockApp()
  
- with patch('src.models.save_config') as mock_save, \
-      patch('shutil.copy') as mock_copy, \
+ with patch('shutil.copy') as mock_copy, \
       patch('src.paths.get_config_path') as mock_get_cfg, \
       patch('src.paths.reset_resolved') as mock_reset, \
       patch.object(MockApp, 'init_state') as mock_init:
@@ -37,7 +37,7 @@ def test_save_paths():
   
   # Verify config update
   assert 'conductor_dir' not in mock_app.config['paths']
-  mock_save.assert_called_once()
+  mock_app.save_config.assert_called_once()
   mock_copy.assert_called_once()
   assert 'applied' in mock_app.ai_status
   mock_reset.assert_called_once()

tests/test_gui_synthesis.py

@@ -6,8 +6,8 @@ from src.gui_2 import App
 @pytest.fixture
 def app_instance():
  with (
-  patch('src.models.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}}),
-  patch('src.models.save_config'),
+  patch('src.app_controller.AppController.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}}),
+  patch('src.app_controller.AppController.save_config'),
   patch('src.gui_2.project_manager'),
   patch('src.gui_2.session_logger'),
   patch('src.gui_2.immapp.run'),

tests/test_headless_service.py

@@ -11,7 +11,7 @@ from src.app_controller import AppController
 
 class TestHeadlessAPI(unittest.TestCase):
     def setUp(self) -> None:
-     with patch('src.models.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}, 'gui': {'show_windows': {}}}), \
+     with patch('src.app_controller.AppController.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}, 'gui': {'show_windows': {}}}), \
           patch('src.session_logger.open_session'), \
           patch('src.session_logger.reset_session'), \
           patch('src.ai_client.set_provider'), \

tests/test_hooks.py

@@ -11,7 +11,7 @@ def test_hooks_enabled_via_cli(monkeypatch: pytest.MonkeyPatch) -> None:
  from src.gui_2 import App
  from unittest.mock import patch
  monkeypatch.setattr("sys.argv", ["sloppy.py", "--enable-test-hooks"])
- with patch('src.models.load_config', return_value={}), \
+ with patch('src.app_controller.AppController.load_config', return_value={}), \
    patch('src.performance_monitor.PerformanceMonitor'), \
    patch('src.session_logger.open_session'), \
    patch('src.session_logger.reset_session'), \
@@ -23,7 +23,7 @@ def test_hooks_enabled_via_cli(monkeypatch: pytest.MonkeyPatch) -> None:
 def test_hooks_disabled_by_default() -> None:
  from src.gui_2 import App
  from unittest.mock import patch
- with patch('src.models.load_config', return_value={}), \
+ with patch('src.app_controller.AppController.load_config', return_value={}), \
    patch('src.performance_monitor.PerformanceMonitor'), \
    patch('src.session_logger.open_session'), \
    patch('src.session_logger.reset_session'), \

tests/test_layout_reorganization.py

@@ -45,7 +45,7 @@ def test_old_windows_removed_from_gui2(app_instance_simple: Any) -> None:
 def app_instance_simple() -> Any:
  from unittest.mock import patch
  from src.gui_2 import App
- with patch('src.models.load_config', return_value={'ai': {}, 'projects': {}, 'gui': {'show_windows': {}}}), \
+ with patch('src.app_controller.AppController.load_config', return_value={'ai': {}, 'projects': {}, 'gui': {'show_windows': {}}}), \
    patch('src.app_controller.AppController._init_ai_and_hooks'), \
    patch('src.app_controller.AppController._fetch_models'), \
    patch('src.app_controller.AppController._prune_old_logs'), \

tests/test_mma_dashboard_refresh.py

@@ -7,8 +7,8 @@ from src.gui_2 import App
 @pytest.fixture
 def app_instance() -> Any:
  with (
-  patch("src.models.load_config", return_value={"ai": {}, "projects": {}}),
-  patch("src.models.save_config"),
+  patch("src.app_controller.AppController.load_config", return_value={"ai": {}, "projects": {}}),
+  patch("src.app_controller.AppController.save_config"),
   patch("src.gui_2.project_manager"),
   patch("src.app_controller.project_manager") as mock_pm,
   patch("src.gui_2.session_logger"),

tests/test_models_no_top_level_tomli_w.py

@@ -46,7 +46,7 @@ def test_models_can_still_call_save_config_after_lazy_load() -> None:
   "theme": {"palette": "solarized_dark", "font_size": 16.0},
  }
  try:
-  src.models.save_config(config)
+  src.models._save_config_to_disk(config)
  except Exception as e:
   pytest.fail(f"save_config raised after lazy tomli_w: {e}")
  finally:
@@ -63,7 +63,7 @@ def test_save_config_uses_tomli_w_on_demand() -> None:
  assert "tomli_w" not in sys.modules
  # Call save_config - this should trigger the import
  try:
-  src.models.save_config({"test_key": "test_value"})
+  src.models._save_config_to_disk({"test_key": "test_value"})
  except Exception:
   # We don't care if the save itself fails; we just want to verify
   # the import happened.

tests/test_parallel_execution.py

@@ -71,20 +71,17 @@ from src.models import Track, Ticket
 from src.multi_agent_conductor import ConductorEngine
 
 @patch('src.multi_agent_conductor.run_worker_lifecycle')
-@patch('src.models.load_config')
-def test_conductor_engine_pool_integration(mock_load_config, mock_lifecycle):
- # Mock config to set max_workers=2
- mock_load_config.return_value = {"mma": {"max_workers": 2}}
- 
+def test_conductor_engine_pool_integration(mock_lifecycle):
  # Create 4 independent tickets
  tickets = [
   Ticket(id=f"t{i}", description=f"task {i}", status="todo")
   for i in range(4)
  ]
  track = Track(id="test_track", description="test", tickets=tickets)
- 
- # Set up engine with auto_queue
- engine = ConductorEngine(track, auto_queue=True)
+
+ # Set up engine with auto_queue and explicit max_workers=2.
+ # ConductorEngine no longer reads config itself; the caller passes max_workers.
+ engine = ConductorEngine(track, auto_queue=True, max_workers=2)
  sys.stderr.write(f"[TEST] engine.pool.max_workers = {engine.pool.max_workers}\n")
  assert engine.pool.max_workers == 2
  

tests/test_phase6_engine.py

@@ -47,7 +47,7 @@ def test_per_tier_model_persistence():
    patch("src.gui_2.project_manager.load_project", return_value={}), 
    patch("src.gui_2.project_manager.migrate_from_legacy_config", return_value={}), 
    patch("src.gui_2.project_manager.save_project"), 
-   patch("src.models.save_config"),
+   patch("src.app_controller.AppController.save_config"),
    patch("src.gui_2.theme.load_from_config"), 
    patch("src.gui_2.ai_client.set_provider"), 
    patch("src.gui_2.ai_client.list_models", return_value=["gpt-4", "claude-3"]), 

tests/test_process_pending_gui_tasks.py

@@ -7,8 +7,8 @@ from src.gui_2 import App
 @pytest.fixture
 def app_instance() -> Generator[App, None, None]:
  with (
-  patch('src.models.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}}),
-  patch('src.models.save_config'),
+  patch('src.app_controller.AppController.load_config', return_value={'ai': {'provider': 'gemini', 'model': 'gemini-2.5-flash-lite'}, 'projects': {}}),
+  patch('src.app_controller.AppController.save_config'),
   patch('src.gui_2.project_manager'),
   patch('src.gui_2.session_logger'),
   patch('src.gui_2.immapp.run'),

tests/test_rag_integration.py

@@ -31,7 +31,7 @@ def test_rag_integration(mock_project):
  # 1. Initializes a mock project and AppController.
  # We patch several components to avoid side effects during initialization.
  with patch('src.app_controller.AppController._fetch_models'), \
-      patch('src.models.load_config', return_value={}), \
+      patch('src.app_controller.AppController.load_config', return_value={}), \
       patch('src.paths.get_full_path_info', return_value={'logs_dir': {'path': mock_project}, 'scripts_dir': {'path': mock_project}}), \
       patch('src.theme_2.load_from_config'):
   app = AppController()

tests/test_symbol_parsing.py

@@ -8,7 +8,7 @@ from src import events
 @pytest.fixture
 def controller():
  with (
-  patch('src.models.load_config', return_value={
+  patch('src.app_controller.AppController.load_config', return_value={
    "ai": {"provider": "gemini", "model": "model-1"},
    "projects": {"paths": [], "active": ""},
    "gui": {"show_windows": {}}

tests/test_system_prompt_exposure.py

@@ -49,7 +49,7 @@ class TestSystemPromptExposure(unittest.TestCase):
   self.assertIn("You are a helpful coding assistant", combined)
   self.assertNotIn("Overridden Prompt", combined)
 
- @patch('src.models.load_config')
+ @patch('src.app_controller.AppController.load_config')
  @patch('src.paths.get_full_path_info')
  @patch('src.project_manager.load_project')
  @patch('src.ai_client.set_tool_preset')

tests/test_tiered_aggregation.py

@@ -31,7 +31,7 @@ def test_app_controller_do_generate_uses_persona_strategy(mock_build):
     with patch("pathlib.Path.write_text"):
      with patch.object(app, "_flush_to_project"):
       with patch.object(app, "_flush_to_config"):
-       with patch("src.models.save_config"):
+       with patch("src.app_controller.AppController.save_config"):
         full_md, path, file_items, stable_md, disc = app._do_generate()
     
  # Verify aggregate.run and build_markdown_no_history received aggregation_strategy="full"