Depends on #28394.

Audit changes to seven operational agent settings through a typed
`chat_operational_settings` resource. Each handler serializes baseline
capture and mutation with a per-setting advisory lock, keeps both
operations in one transaction, and records field-specific diffs.

Effective no-op requests now skip both the database upsert and the
success audit, including absent rows whose effective value is already
the default. The change also retains the allowlisted raw `site_configs`
query, updates generated audit and API surfaces, adds failure and
concurrency coverage, and reuses the existing AuditPage resource-filter
story pattern.

Relates to CODAGT-720.

…n area to release/2.37 (#28673)

Batch backport of @tracyjohnsonux's PRs that merged into `main` after
the `release/2.37` branch point (`c275327f`, #28369) and were not yet on
the release branch.

Commits are `git cherry-pick -x` of the original squash commits in
`main` merge order. Ten are verbatim; the last two carry manual conflict
resolutions, documented below. `pnpm run lint:types` and the affected
Storybook suites (311 tests) pass on the branch.

## Included (12)

| PR | Commit on main | Notes |
|---|---|---|
| #28427 fix(site/src): delete DateTimeRangeFilter and unify on the
picker's time range type | `607a1d06` | verbatim |
| #28481 fix(site/src/pages/AIBridgePage): move AI Sessions docs link
inline into subtitle | `0452ff7e` | verbatim |
| #28477 fix(site/src/pages/AIBridgePage): align token badges with
neighboring badge sizing | `e98e2b9b` | verbatim |
| #28561 fix(site): use robot icon for subagent toggle in chat kebab
menu | `94f312df` | verbatim |
| #28557 fix: use medium badges and shorter shared key label on agent
API keys page | `c07bde80` | verbatim |
| #28560 fix(site/src/pages/AgentsPage): use outlined empty state and
kebab menu for personal skills | `74e5a680` | verbatim |
| #28559 fix(site/src/pages/AgentsPage): add organization filter to
compaction settings | `2eee703e` | verbatim |
| #28527 fix(site/src): use md badges for provisioner tags and network
call pills | `f31b7597` | verbatim |
| #28613 fix(site/src): use default combobox dropdown surface |
`2eb9e4fb` | verbatim |
| #28478 fix(site): match sessions date/time picker icon to search field
icon | `769decbe` | verbatim |
| #28612 fix(site/src): move deployment docs links inline as View docs
text links | `046a532a` | resolved |
| #28564 fix(site/src): reposition org pickers in AI settings models and
MCP pages | `78c65ea5` | resolved, ported |

## Conflict resolutions

- **#28612**: conflicted with #28664 (the backport of #28660) in
`SecuritySettingsPageView.{tsx,stories.tsx}` because the backports
landed in reverse `main` order. Resolved by taking `main`'s content;
since only #28612 and #28660 touched those files on either side, the
resolved files are byte-identical to `main`.
- **#28564**: written on top of #28593 (MCP server sharing), which is
not release material. 24 of 29 files applied verbatim; the 5 conflicting
files were ported by hand against pre-#28593 code: `organizationPicker`
prop threading and the edit-requires-dirty submit gate without the
`canShareServer` context, the form header rebuilt as `main`'s version
minus the share button, and story assertions ported (the #28593 share
stories do not exist on this branch).
`ModelFormProviderConfig.stories.tsx` takes `main`'s version,
deliberately folding in the stories-only decorator fix from #28462
because `release/2.37` already has #27960 and those stories were broken
without the provider wrap. Validated with the full MCPServersPage +
ModelsPage Storybook suites (140/140, matching the original PR) and the
`mcpServerFormLogic` unit tests.

## Excluded

- #28492 (built-in emoji avatar inset): reverted on `main` by #28533, so
it is not backported.
- #28558 (show disabled state on AI provider rows): handled individually
in #28662; blocked only on the #28624 backport (see analysis there).

<details>
<summary>Decision log</summary>

- Branch point of `release/2.37` from `main`:
`c275327fb724dea6c4428263d948e13815041b3e` (2026-08-24, #28369),
computed via `git merge-base`.
- 15 of the author's merged PRs landed on `main` after that point; none
had been backported yet (verified by ancestry, patch-id equivalence, and
`(#NNNN)` references in `release/2.37` history since the branch point).
- Cherry-picks were applied oldest-first in `main` topological order;
conflicting picks were initially skipped, then #28612 and #28564 were
resolved on the same base and appended (no file overlap with the
verbatim picks except `docs/ai-coder/agents/models.md`, which merges
cleanly).
- #28492 was initially included, then rebased out after confirming it
was reverted on `main` by #28533 (`bef6b4c30b`).
- The bot's individual cherry-pick PRs were closed as superseded:
#28661, #28663, #28665, #28667, #28668, #28669, #28671, and after
consolidation #28670 and #28666.
- Validation: `pnpm install`, `pnpm run lint:types` (tsc), Biome on
changed files, `mcpServerFormLogic` unit tests, and the AISettingsPage +
SecuritySettingsPage Storybook suites (311 tests) pass after each
change.

</details>

> Created by Coder Agents on behalf of @tracyjohnsonux.

---------

Co-authored-by: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>