fix(mcp): stop server-access save mutating the live in-memory ACL profile

BuildAllowedServerList wrote McpServersMode=Allowlist and AllowedMcpServers back
onto the live ToolAudienceProfile object returned by ResolveProfile — the same
object IsServerAllowed/IsToolGranted/GetEffectiveMode read for access decisions.
A save interrupted by an exception after that mutation but before the file write
would leave the in-memory ACL coerced to allowlist mode.

Fold the helper into SaveServerAccess, which now accumulates each audience's
allow-list in a local working dictionary (seeded once from the original profile so
multiple changes to the same audience still build on each other) and writes the
mode and list straight to the serialization dictionary. The live profile is never
mutated.

Author: Aaronontheweb

openspec/changes/harden-config-tui-io-and-failloud/tasks.md

@@ -36,7 +36,7 @@ Cited file:line numbers are from the review doc and may drift as fixes land. -->
 - [x] 3.3 `SlackStepViewModel.BuildChannelAudiences` (review:299) — do not write an unresolved channel name as an ACL key; omit/flag it (or block) so it grants nothing. Test: unresolved channel → no inert name key in `ChannelAudiences`. — `ResolveChannelAudienceKey` (which returned the channel NAME when `LastChannelResolution` was null or the name was unresolved) is now `TryResolveChannelAudienceKey`: it yields a key only for the DM row (`"dm"`) or a resolved canonical channel ID, and `BuildChannelAudiences` omits any entry it can't resolve — so a dead, name-keyed ACL entry the Slack runtime can never match is never written. The health-check phase already warns about unresolved channels. New `ContributeConfig_OmitsUnresolvedChannelNameFromAudiences_KeepsResolvedById`.
 - [x] 3.4 `ChannelsConfigViewModel.ApplyAddChannelAsync` (review:582) — replace `Single()` with a safe predicate so a resolved id of `"dm"` with DMs enabled does not throw. Test: add a `"dm"`-resolving channel → no exception. — The row-focus lookup that positioned `_channelRowIndex` used `Single(row.Id == channelId)`; a resolved id of exactly `"dm"` with DMs enabled collided with the DM row (also `Id="dm"`) → `InvalidOperationException` crashing the add flow. Now `FirstOrDefault` over `!IsDirectMessage && !IsAction && Id==channelId` (matches only real channel rows), guarded against not-found. New `Add_channel_resolving_to_dm_with_dms_enabled_does_not_throw`.
 - [x] 3.5 `TelemetryAlertingConfigViewModel` (review:289) — add an explicit gesture to clear a webhook auth header (blank-preserve still keeps it). Test: clear gesture removes the header; blank keeps it. — `SaveWebhookForm` now treats a single `-` in the auth field as an explicit clear (`target.Headers = null`); blank still preserves the stored header. The edit-form placeholder now reads `(stored header preserved — enter - to clear)` so the gesture is discoverable. New `Editing_a_webhook_clears_the_auth_header_with_the_dash_gesture`; the existing blank-preserve test still passes.
-- [ ] 3.6 `McpToolPermissionsViewModel.BuildAllowedServerList` (review:533) — operate on a copy, not the live in-memory profile object. Test: building the list does not mutate the source profile.
+- [x] 3.6 `McpToolPermissionsViewModel.BuildAllowedServerList` (review:533) — operate on a copy, not the live in-memory profile object. Test: building the list does not mutate the source profile. — `BuildAllowedServerList` mutated `profile.McpServersMode`/`AllowedMcpServers` on the live `Profiles.Public/Team/Personal` objects that back runtime ACL queries; folded it into `SaveServerAccess`, which now accumulates each audience's allow-list in a local working dict (seeded once from the original profile so multi-change-per-audience still accumulates correctly) and writes mode/list straight to the serialization dict — the in-memory ACL profile is never touched. New `Save_DoesNotMutateTheLiveInMemoryProfile` (live profile stays `All` after a save that converts the persisted config to `Allowlist`); existing All→Allowlist + allowlist-preserve tests still pass.
 
 ## 4. Verification & close
 

src/Netclaw.Cli.Tests/Mcp/McpToolPermissionsViewModelTests.cs

@@ -327,6 +327,41 @@ public void Save_DisablingServerFromAllProfileConvertsToAllowlist()
         Assert.False(reloaded.IsServerAllowedForSelectedAudience());
     }
 
+    [Fact]
+    public void Save_DoesNotMutateTheLiveInMemoryProfile()
+    {
+        File.WriteAllText(_paths.NetclawConfigPath,
+            """
+            {
+              "configVersion": 1,
+              "McpServers": { "github": { "Transport": "stdio" } },
+              "Tools": {
+                "AudienceProfiles": {
+                  "Personal": { "McpServersMode": "All" }
+                }
+              }
+            }
+            """);
+
+        var vm = CreateVm();
+        vm.Servers.Add(("notion", "running", 1));
+        vm.InitializeForTests(new McpServerName("notion"), new[] { "create-pages" });
+        vm.SetSelectedAudienceForTests(TrustAudience.Personal);
+        Assert.Equal(ToolProfileMode.All, vm.Profiles.Personal.McpServersMode);
+
+        vm.ToggleServerAccess(); // disable notion -> pending All->Allowlist conversion
+        Assert.True(vm.Save());
+
+        // The save writes the Allowlist conversion to disk, but must NOT coerce the live in-memory
+        // profile that backs runtime ACL queries (IsServerAllowed, etc.). The prior code mutated it
+        // mid-save, so a mid-save exception would leave the ACL in a post-save allowlist state.
+        Assert.Equal(ToolProfileMode.All, vm.Profiles.Personal.McpServersMode);
+        Assert.Empty(vm.Profiles.Personal.AllowedMcpServers);
+
+        using var doc = JsonDocument.Parse(File.ReadAllText(_paths.NetclawConfigPath));
+        Assert.Equal("Allowlist", GetAudienceProfile(doc, "Personal").GetProperty("McpServersMode").GetString());
+    }
+
     private static void CycleServerDefault(McpToolPermissionsViewModel vm, bool reverse)
     {
         if (reverse)

src/Netclaw.Cli/Mcp/McpToolPermissionsViewModel.cs

@@ -509,37 +509,36 @@ public bool Save()
     private void SaveServerAccess(Dictionary<string, object> config, Dictionary<string, object> profilesSection)
     {
         var knownServers = GetKnownMcpServers(config);
+
+        // Accumulate per-audience working lists WITHOUT mutating the live in-memory profile objects
+        // (Profiles.Public/Team/Personal back the runtime ACL queries — IsServerAllowed, etc. — so
+        // coercing them here would leave the ACL in a post-save state if Save throws before the file
+        // write). Seed each audience's working list from its ORIGINAL profile the first time it is
+        // touched; later changes for the same audience build on the working list rather than re-reading
+        // a profile that an earlier iteration would have coerced.
+        var workingLists = new Dictionary<string, List<string>>(StringComparer.Ordinal);
         foreach (var ((audienceName, serverName), allowed) in _pendingServerAccess)
         {
             var audienceSection = ConfigFileHelper.GetOrCreateSection(profilesSection, audienceName);
-            var profile = ResolveProfile(AudienceFromName(audienceName));
-            var serverList = BuildAllowedServerList(profile, knownServers, serverName, allowed);
+            if (!workingLists.TryGetValue(audienceName, out var serverList))
+            {
+                var profile = ResolveProfile(AudienceFromName(audienceName));
+                serverList = profile.McpServersMode == ToolProfileMode.All
+                    ? knownServers.ToList()
+                    : profile.AllowedMcpServers.ToList();
+                workingLists[audienceName] = serverList;
+            }
 
-            audienceSection["McpServersMode"] = profile.McpServersMode.ToString();
+            if (allowed)
+                AddServer(serverList, serverName);
+            else
+                serverList.RemoveAll(s => s.Equals(serverName, StringComparison.OrdinalIgnoreCase));
+
+            audienceSection["McpServersMode"] = ToolProfileMode.Allowlist.ToString();
             audienceSection["AllowedMcpServers"] = serverList;
         }
     }
 
-    private List<string> BuildAllowedServerList(
-        ToolAudienceProfile profile,
-        IReadOnlyList<string> knownServers,
-        string serverName,
-        bool allowed)
-    {
-        var serverList = profile.McpServersMode == ToolProfileMode.All
-            ? knownServers.ToList()
-            : profile.AllowedMcpServers.ToList();
-
-        profile.McpServersMode = ToolProfileMode.Allowlist;
-        if (allowed)
-            AddServer(serverList, serverName);
-        else
-            serverList.RemoveAll(s => s.Equals(serverName, StringComparison.OrdinalIgnoreCase));
-
-        profile.AllowedMcpServers = serverList;
-        return serverList;
-    }
-
     private IReadOnlyList<string> GetKnownMcpServers(Dictionary<string, object> config)
     {
         var names = new List<string>();