Remediate the 2026-09-03 feature-test findings

shopdb/core/api/settings.py

@@ -811,6 +811,34 @@ def update_setting(key: str):
     if _is_secret(key) and value == SECRET_MASK:
         return success_response(_serialize_setting(setting), message='Setting unchanged')
 
+    # The declared valuetype is a promise about what every reader will get, and
+    # nothing checked it: "A6-not-a-number" was stored verbatim on an integer
+    # key and every consumer then read 0, because Setting.get_typed_value
+    # swallows the ValueError. The setting looked set, the behaviour was the
+    # default, and nothing said so.
+    valuetype = (setting.valuetype or 'string').lower()
+    if value is not None and not isinstance(value, bool):
+        text = str(value).strip()
+        if valuetype == 'integer' and text:
+            try:
+                int(text)
+            except ValueError:
+                return error_response(
+                    ErrorCodes.VALIDATION_ERROR,
+                    '%s is a whole-number setting (got %r)' % (key, value))
+        elif valuetype == 'float' and text:
+            try:
+                float(text)
+            except ValueError:
+                return error_response(
+                    ErrorCodes.VALIDATION_ERROR,
+                    '%s is a number setting (got %r)' % (key, value))
+        elif valuetype == 'boolean' and text:
+            if text.lower() not in ('true', 'false', '1', '0', 'yes', 'no'):
+                return error_response(
+                    ErrorCodes.VALIDATION_ERROR,
+                    '%s is a true/false setting (got %r)' % (key, value))
+
     # Convert value to string for storage
     if isinstance(value, bool):
         setting.value = 'true' if value else 'false'
@@ -1460,14 +1488,13 @@ def build_default_settings():
                            'Incoming Webhook), adaptivecard (Teams Workflow), '
                            'or json (generic {title,text})'
         },
-        # Audit log settings
-        {
-            'key': 'audit_retention_days',
-            'value': '90',
-            'valuetype': 'integer',
-            'category': 'audit',
-            'description': 'Number of days to retain audit logs (0 = keep forever)'
-        },
+        # Audit log retention lives at 'audit_retentiondays' (category site),
+        # defined above and read by shopdb/core/services/auditretention.py. A
+        # second key 'audit_retention_days' was seeded here with a different
+        # default and a different category, and the Audit & Logging page wrote
+        # to THAT one - so the page saved a value, read it back, and nothing
+        # ever consulted it. Removed rather than aliased: two keys for one
+        # setting is how this happened.
         # Authentication settings
         {
             'key': 'saml_enabled',