Update tenant settings

settings is merged, so a switch left out is left alone. Takes effect on the next request — except throttleLimit, which each replica caches for up to a minute.

episodicAlerts gates episode recording and the notification feed. synchronousMode makes ingest return before evaluating. throttleLimit overrides THROTTLE_LIMIT for this tenant; 0 exempts it.

informationalCodes, historyCategories and feedCodes (lists of strings, none by default): the codes the tenant's triggers consume and never judge (no no-verdict, and the * trigger skips them), the reading categories stored and never judged, and the codes the notification feed lists by default (none: every code). A new tenant is given the default pack's lists, and a tenant that states no historyCategories keeps the default pack's.

ruleSet is deprecated and ignored: readings are judged by the triggers in the rule settings, the tenant's (orgSettings) and each patient's own (/api/patient/{id}/settings).

orgSettings is the tenant's rule settings, which replace /api/settings/org: what the triggers judge by, the triggers themselves included. It is merged key by key: a key sent replaces the stored one whole, null removes it, and a key left out is kept. Its first write is given the default pack when it sends no triggers. Audited as UPDATE_ORG_SETTINGS. A band it changes ends the episodes judged under the old one, and a code it switches off (its band "NO_THRESHOLD", or out of bed enabled: false) has its active alerts resolved and its open episodes closed THRESHOLD_CHANGED at the save, for every patient judged by the tenant's settings (an acknowledged out-of-bed absence, whose episode the ack closed, has its still-active alert resolved); a band deleted closes nothing. A tenant whose only org settings are one project's, with no patient stamped with another project, has them made the tenant's first, so the write reaches the patients they served.

resolvedAt (ISO 8601) is when the caller resolved orgSettings: it lands only over a write resolved earlier, or stored without one, and is otherwise refused 409 STALE_SETTINGS with nothing written. With ifAbsent=true each key of orgSettings is written only where the stored settings lack it, so a default seeded at enrolment cannot overwrite a concurrent save.

Through ovok

• Who can call it: Manager apps, and users whose access policy grants the capabilities.
• Capabilities, all required: signals_config:update, signals_silence:update. Project admins have every capability; client applications get no admin bypass.
• Only orgSettings, resolvedAt and settings.episodicAlerts are written through ovok. Turning episodicAlerts off stops Signals recording episodes, which empties episode feeds.
• It can reach any patient of your project without naming one, so it is for callers that reach every patient: project admins, manager or submitter apps, and anyone whose Patient access has no criteria.