create-egregore 0.21.0-runtime-mvp.10 → 0.21.0-runtime-mvp.11

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.10
+// egregore-launcher-version: 0.21.0-runtime-mvp.11
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.10";
+const VERSION = "0.21.0-runtime-mvp.11";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/lib/claude-runtime.js

@@ -76,6 +76,24 @@ function copyFile(src, dest) {
   try { fs.chmodSync(dest, fs.statSync(src).mode & 0o777); } catch {}
 }
 
+// The generated settings adapter may replace a stale template settings.json —
+// one carrying nothing the adapter lacks — but an org's customized settings
+// (extra hook events or permission allows, e.g. PreCompact/Stop) are
+// authoritative and are never adopted, even when clean and tracked.
+function settingsSafeToAdopt(destFile, srcFile) {
+  try {
+    const local = JSON.parse(fs.readFileSync(destFile, "utf8"));
+    const bundle = JSON.parse(fs.readFileSync(srcFile, "utf8"));
+    const bundleHooks = bundle.hooks || {};
+    const extraHooks = Object.keys(local.hooks || {}).filter((k) => !(k in bundleHooks));
+    const bundleAllow = new Set(bundle.permissions?.allow || []);
+    const extraAllow = (local.permissions?.allow || []).filter((entry) => !bundleAllow.has(entry));
+    return extraHooks.length === 0 && extraAllow.length === 0;
+  } catch {
+    return false;
+  }
+}
+
 // One-time ownership migration for pre-bundle Claude installs. A clean,
 // tracked path is part of the cloned framework template and may be adopted by
 // the package. Dirty/untracked paths are user work and remain untouched.
@@ -153,7 +171,11 @@ function installClaudeRuntime(egregoreDir) {
       summary.skipped += 1; record();
     } else if (previousHash && currentHash === previousHash) {
       copyFile(src, dest); summary.updated += 1; record();
-    } else if (!previousHash && isCleanTrackedFrameworkFile(egregoreDir, rel)) {
+    } else if (
+      !previousHash
+      && (rel.replaceAll("\\", "/") !== ".claude/settings.json" || settingsSafeToAdopt(dest, src))
+      && isCleanTrackedFrameworkFile(egregoreDir, rel)
+    ) {
       copyFile(src, dest); summary.updated += 1; record();
     } else {
       summary.conflicted += 1; summary.conflicts.push(rel);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.10",
+  "version": "0.21.0-runtime-mvp.11",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/bin/lib/git-sync.sh

@@ -24,6 +24,10 @@ FRAMEWORK_UPDATED_FILES=""
 HEALTH_RETRIEVAL="skip"
 SYNC_RECEIPT=""
 
+# Settings drift healer + unshared-settings reporting (see the lib header).
+# shellcheck source=bin/lib/settings-drift.sh
+source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -324,8 +328,14 @@ setup_develop() {
       return 1
     fi
   else
-    # Already on it — fetch couldn't update a checked-out branch, so pull
+    # Already on it — fetch couldn't update a checked-out branch, so pull.
+    # Launcher/installer settings drift blocks this merge and the refusal
+    # is otherwise silent; heal it first, re-apply the launcher's intent
+    # after (bin/lib/settings-drift.sh).
+    settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
+    settings_drift_reapply
+    settings_drift_report
   fi
 
   # Never report the intended branch as the actual branch. A checkout can fail

package/runtime/claude/bin/lib/greeting.sh

@@ -95,6 +95,14 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
+# --- Unshared org-settings drift (launcher writes not yet shared) ---
+if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
+  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
+fi
+if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
+  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
+fi
+
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"
 

package/runtime/claude/bin/lib/settings-drift.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# settings-drift.sh — heal launcher/installer settings drift around the
+# base-branch fast-forward, and surface unshared org-settings changes.
+#
+# Two org-config surfaces accumulate legitimate local modifications outside
+# any session: .claude/settings.json (the installer's generated public-safe
+# adapter can replace the org's richer committed file) and egregore.json
+# (launcher settings verbs: posture, workflow, people removals). Local
+# modifications to files a fast-forward also changes make git refuse the
+# merge — and that refusal used to be silently swallowed, leaving the
+# checkout behind with no explanation.
+#
+# Contract (sourced; caller provides $BASE_BRANCH and runs from the repo
+# root):
+#   settings_drift_heal      — before the ff-merge. Restores settings.json
+#                              only when the local copy is a reduced
+#                              generated adapter (its hook events and
+#                              permission allows are a subset of the
+#                              committed file's). Snapshots egregore.json
+#                              and returns it to HEAD so the merge can run.
+#   settings_drift_reapply   — after the ff-merge. Re-applies the snapshot's
+#                              changed settings-owned keys on top of the
+#                              incoming egregore.json.
+#   settings_drift_report    — sets UNSHARED_SETTINGS_KEYS to the
+#                              settings-owned keys where the working file
+#                              differs from HEAD, for the greeting.
+#
+# Anything dirty beyond these two files is user work and is never touched.
+
+_SETTINGS_OWNED_KEYS='["boundary","base_branch","people_removed","features","repos","admins","people"]'
+_SETTINGS_DRIFT_SNAPSHOT=""
+_SETTINGS_DRIFT_BASE=""
+# Read by bin/lib/greeting.sh after git-sync completes.
+export SETTINGS_ADAPTER_RESTORED="false"
+export UNSHARED_SETTINGS_KEYS=""
+
+# The generated adapter only ever removes relative to the org file: fewer
+# hook events, fewer permission allows. A local settings.json that carries
+# anything the committed file lacks is user work and stays untouched.
+_settings_is_reduced_adapter() {
+  local tmp_head
+  tmp_head=$(mktemp) || return 1
+  if ! git show "HEAD:.claude/settings.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 1
+  fi
+  jq -es '
+    .[0] as $local | .[1] as $head |
+    ($local != $head) and
+    ((($local.hooks // {}) | keys) - (($head.hooks // {}) | keys) | length == 0) and
+    ((($local.permissions.allow // []) - ($head.permissions.allow // [])) | length == 0)
+  ' .claude/settings.json "$tmp_head" >/dev/null 2>&1
+  local verdict=$?
+  rm -f "$tmp_head"
+  return "$verdict"
+}
+
+settings_drift_heal() {
+  git rev-parse -q --verify "origin/$BASE_BRANCH" >/dev/null 2>&1 || return 0
+  [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-parse "origin/$BASE_BRANCH" 2>/dev/null)" ] && return 0
+
+  if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
+    if _settings_is_reduced_adapter; then
+      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+    fi
+  fi
+
+  if ! git diff --quiet -- egregore.json 2>/dev/null; then
+    _SETTINGS_DRIFT_SNAPSHOT=$(cat egregore.json 2>/dev/null || true)
+    _SETTINGS_DRIFT_BASE=$(git show "HEAD:egregore.json" 2>/dev/null || true)
+    if [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] && [ -n "$_SETTINGS_DRIFT_BASE" ] \
+      && printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" | jq -e . >/dev/null 2>&1; then
+      git checkout -- egregore.json 2>/dev/null || _SETTINGS_DRIFT_SNAPSHOT=""
+    else
+      _SETTINGS_DRIFT_SNAPSHOT=""
+    fi
+  fi
+}
+
+settings_drift_reapply() {
+  [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] || return 0
+  local tmp_local tmp_base merged
+  tmp_local=$(mktemp) && tmp_base=$(mktemp) || return 0
+  printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" > "$tmp_local"
+  printf '%s' "$_SETTINGS_DRIFT_BASE" > "$tmp_base"
+  merged=$(jq -s --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $incoming | .[1] as $local | .[2] as $base |
+    reduce $keys[] as $k ($incoming;
+      if ($local[$k] // null) != ($base[$k] // null) then
+        if ($local | has($k)) then .[$k] = $local[$k] else del(.[$k]) end
+      else . end)
+  ' egregore.json "$tmp_local" "$tmp_base" 2>/dev/null || true)
+  rm -f "$tmp_local" "$tmp_base"
+  if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+    printf '%s\n' "$merged" > egregore.json
+  fi
+  _SETTINGS_DRIFT_SNAPSHOT=""
+  _SETTINGS_DRIFT_BASE=""
+}
+
+settings_drift_report() {
+  UNSHARED_SETTINGS_KEYS=""
+  git diff --quiet -- egregore.json 2>/dev/null && return 0
+  local tmp_head
+  tmp_head=$(mktemp) || return 0
+  if ! git show "HEAD:egregore.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 0
+  fi
+  UNSHARED_SETTINGS_KEYS=$(jq -rs --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $local | .[1] as $head |
+    [$keys[] | select(($local[.] // null) != ($head[.] // null))] | join(", ")
+  ' egregore.json "$tmp_head" 2>/dev/null || true)
+  rm -f "$tmp_head"
+  export UNSHARED_SETTINGS_KEYS
+}

package/runtime/claude/egregore_runtime/issue_cli.py

@@ -61,7 +61,7 @@ def _snapshot(runtime, actor, service, permission: Permission = Permission.READ)
 
 
 def _resolve(runtime, actor, service, reference: str) -> IssueSnapshot:
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     return service.resolve(rows, reference)
 
 
@@ -72,7 +72,7 @@ def _write_result(issue: IssueSnapshot, receipt) -> int:
 
 def _list(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     selected = rows if args.status == "all" else tuple(
         row for row in rows if row.status == args.status
     )
@@ -89,7 +89,7 @@ def _show(args):
 
 def _search(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     terms = tuple(part for part in args.term.casefold().split() if part)
 
     def matches(row: IssueSnapshot) -> bool:

package/runtime/claude/manifest.json

@@ -184,6 +184,7 @@
     "bin/lib/metrics.sh",
     "bin/lib/noncode.sh",
     "bin/lib/permissions.sh",
+    "bin/lib/settings-drift.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
     "bin/node-run.sh",

package/runtime/codex/bin/lib/git-sync.sh

@@ -24,6 +24,10 @@ FRAMEWORK_UPDATED_FILES=""
 HEALTH_RETRIEVAL="skip"
 SYNC_RECEIPT=""
 
+# Settings drift healer + unshared-settings reporting (see the lib header).
+# shellcheck source=bin/lib/settings-drift.sh
+source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -324,8 +328,14 @@ setup_develop() {
       return 1
     fi
   else
-    # Already on it — fetch couldn't update a checked-out branch, so pull
+    # Already on it — fetch couldn't update a checked-out branch, so pull.
+    # Launcher/installer settings drift blocks this merge and the refusal
+    # is otherwise silent; heal it first, re-apply the launcher's intent
+    # after (bin/lib/settings-drift.sh).
+    settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
+    settings_drift_reapply
+    settings_drift_report
   fi
 
   # Never report the intended branch as the actual branch. A checkout can fail

package/runtime/codex/bin/lib/greeting.sh

@@ -95,6 +95,14 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
+# --- Unshared org-settings drift (launcher writes not yet shared) ---
+if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
+  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
+fi
+if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
+  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
+fi
+
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"
 

package/runtime/codex/bin/lib/settings-drift.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# settings-drift.sh — heal launcher/installer settings drift around the
+# base-branch fast-forward, and surface unshared org-settings changes.
+#
+# Two org-config surfaces accumulate legitimate local modifications outside
+# any session: .claude/settings.json (the installer's generated public-safe
+# adapter can replace the org's richer committed file) and egregore.json
+# (launcher settings verbs: posture, workflow, people removals). Local
+# modifications to files a fast-forward also changes make git refuse the
+# merge — and that refusal used to be silently swallowed, leaving the
+# checkout behind with no explanation.
+#
+# Contract (sourced; caller provides $BASE_BRANCH and runs from the repo
+# root):
+#   settings_drift_heal      — before the ff-merge. Restores settings.json
+#                              only when the local copy is a reduced
+#                              generated adapter (its hook events and
+#                              permission allows are a subset of the
+#                              committed file's). Snapshots egregore.json
+#                              and returns it to HEAD so the merge can run.
+#   settings_drift_reapply   — after the ff-merge. Re-applies the snapshot's
+#                              changed settings-owned keys on top of the
+#                              incoming egregore.json.
+#   settings_drift_report    — sets UNSHARED_SETTINGS_KEYS to the
+#                              settings-owned keys where the working file
+#                              differs from HEAD, for the greeting.
+#
+# Anything dirty beyond these two files is user work and is never touched.
+
+_SETTINGS_OWNED_KEYS='["boundary","base_branch","people_removed","features","repos","admins","people"]'
+_SETTINGS_DRIFT_SNAPSHOT=""
+_SETTINGS_DRIFT_BASE=""
+# Read by bin/lib/greeting.sh after git-sync completes.
+export SETTINGS_ADAPTER_RESTORED="false"
+export UNSHARED_SETTINGS_KEYS=""
+
+# The generated adapter only ever removes relative to the org file: fewer
+# hook events, fewer permission allows. A local settings.json that carries
+# anything the committed file lacks is user work and stays untouched.
+_settings_is_reduced_adapter() {
+  local tmp_head
+  tmp_head=$(mktemp) || return 1
+  if ! git show "HEAD:.claude/settings.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 1
+  fi
+  jq -es '
+    .[0] as $local | .[1] as $head |
+    ($local != $head) and
+    ((($local.hooks // {}) | keys) - (($head.hooks // {}) | keys) | length == 0) and
+    ((($local.permissions.allow // []) - ($head.permissions.allow // [])) | length == 0)
+  ' .claude/settings.json "$tmp_head" >/dev/null 2>&1
+  local verdict=$?
+  rm -f "$tmp_head"
+  return "$verdict"
+}
+
+settings_drift_heal() {
+  git rev-parse -q --verify "origin/$BASE_BRANCH" >/dev/null 2>&1 || return 0
+  [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-parse "origin/$BASE_BRANCH" 2>/dev/null)" ] && return 0
+
+  if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
+    if _settings_is_reduced_adapter; then
+      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+    fi
+  fi
+
+  if ! git diff --quiet -- egregore.json 2>/dev/null; then
+    _SETTINGS_DRIFT_SNAPSHOT=$(cat egregore.json 2>/dev/null || true)
+    _SETTINGS_DRIFT_BASE=$(git show "HEAD:egregore.json" 2>/dev/null || true)
+    if [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] && [ -n "$_SETTINGS_DRIFT_BASE" ] \
+      && printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" | jq -e . >/dev/null 2>&1; then
+      git checkout -- egregore.json 2>/dev/null || _SETTINGS_DRIFT_SNAPSHOT=""
+    else
+      _SETTINGS_DRIFT_SNAPSHOT=""
+    fi
+  fi
+}
+
+settings_drift_reapply() {
+  [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] || return 0
+  local tmp_local tmp_base merged
+  tmp_local=$(mktemp) && tmp_base=$(mktemp) || return 0
+  printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" > "$tmp_local"
+  printf '%s' "$_SETTINGS_DRIFT_BASE" > "$tmp_base"
+  merged=$(jq -s --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $incoming | .[1] as $local | .[2] as $base |
+    reduce $keys[] as $k ($incoming;
+      if ($local[$k] // null) != ($base[$k] // null) then
+        if ($local | has($k)) then .[$k] = $local[$k] else del(.[$k]) end
+      else . end)
+  ' egregore.json "$tmp_local" "$tmp_base" 2>/dev/null || true)
+  rm -f "$tmp_local" "$tmp_base"
+  if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+    printf '%s\n' "$merged" > egregore.json
+  fi
+  _SETTINGS_DRIFT_SNAPSHOT=""
+  _SETTINGS_DRIFT_BASE=""
+}
+
+settings_drift_report() {
+  UNSHARED_SETTINGS_KEYS=""
+  git diff --quiet -- egregore.json 2>/dev/null && return 0
+  local tmp_head
+  tmp_head=$(mktemp) || return 0
+  if ! git show "HEAD:egregore.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 0
+  fi
+  UNSHARED_SETTINGS_KEYS=$(jq -rs --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $local | .[1] as $head |
+    [$keys[] | select(($local[.] // null) != ($head[.] // null))] | join(", ")
+  ' egregore.json "$tmp_head" 2>/dev/null || true)
+  rm -f "$tmp_head"
+  export UNSHARED_SETTINGS_KEYS
+}

package/runtime/codex/egregore_runtime/issue_cli.py

@@ -61,7 +61,7 @@ def _snapshot(runtime, actor, service, permission: Permission = Permission.READ)
 
 
 def _resolve(runtime, actor, service, reference: str) -> IssueSnapshot:
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     return service.resolve(rows, reference)
 
 
@@ -72,7 +72,7 @@ def _write_result(issue: IssueSnapshot, receipt) -> int:
 
 def _list(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     selected = rows if args.status == "all" else tuple(
         row for row in rows if row.status == args.status
     )
@@ -89,7 +89,7 @@ def _show(args):
 
 def _search(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     terms = tuple(part for part in args.term.casefold().split() if part)
 
     def matches(row: IssueSnapshot) -> bool:

package/runtime/codex/manifest.json

@@ -171,6 +171,7 @@
     "bin/lib/metrics.sh",
     "bin/lib/noncode.sh",
     "bin/lib/permissions.sh",
+    "bin/lib/settings-drift.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
     "bin/node-run.sh",

package/runtime/pi/bin/lib/git-sync.sh

@@ -24,6 +24,10 @@ FRAMEWORK_UPDATED_FILES=""
 HEALTH_RETRIEVAL="skip"
 SYNC_RECEIPT=""
 
+# Settings drift healer + unshared-settings reporting (see the lib header).
+# shellcheck source=bin/lib/settings-drift.sh
+source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -324,8 +328,14 @@ setup_develop() {
       return 1
     fi
   else
-    # Already on it — fetch couldn't update a checked-out branch, so pull
+    # Already on it — fetch couldn't update a checked-out branch, so pull.
+    # Launcher/installer settings drift blocks this merge and the refusal
+    # is otherwise silent; heal it first, re-apply the launcher's intent
+    # after (bin/lib/settings-drift.sh).
+    settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
+    settings_drift_reapply
+    settings_drift_report
   fi
 
   # Never report the intended branch as the actual branch. A checkout can fail

package/runtime/pi/bin/lib/greeting.sh

@@ -95,6 +95,14 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
+# --- Unshared org-settings drift (launcher writes not yet shared) ---
+if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
+  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
+fi
+if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
+  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
+fi
+
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"
 

package/runtime/pi/bin/lib/settings-drift.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# settings-drift.sh — heal launcher/installer settings drift around the
+# base-branch fast-forward, and surface unshared org-settings changes.
+#
+# Two org-config surfaces accumulate legitimate local modifications outside
+# any session: .claude/settings.json (the installer's generated public-safe
+# adapter can replace the org's richer committed file) and egregore.json
+# (launcher settings verbs: posture, workflow, people removals). Local
+# modifications to files a fast-forward also changes make git refuse the
+# merge — and that refusal used to be silently swallowed, leaving the
+# checkout behind with no explanation.
+#
+# Contract (sourced; caller provides $BASE_BRANCH and runs from the repo
+# root):
+#   settings_drift_heal      — before the ff-merge. Restores settings.json
+#                              only when the local copy is a reduced
+#                              generated adapter (its hook events and
+#                              permission allows are a subset of the
+#                              committed file's). Snapshots egregore.json
+#                              and returns it to HEAD so the merge can run.
+#   settings_drift_reapply   — after the ff-merge. Re-applies the snapshot's
+#                              changed settings-owned keys on top of the
+#                              incoming egregore.json.
+#   settings_drift_report    — sets UNSHARED_SETTINGS_KEYS to the
+#                              settings-owned keys where the working file
+#                              differs from HEAD, for the greeting.
+#
+# Anything dirty beyond these two files is user work and is never touched.
+
+_SETTINGS_OWNED_KEYS='["boundary","base_branch","people_removed","features","repos","admins","people"]'
+_SETTINGS_DRIFT_SNAPSHOT=""
+_SETTINGS_DRIFT_BASE=""
+# Read by bin/lib/greeting.sh after git-sync completes.
+export SETTINGS_ADAPTER_RESTORED="false"
+export UNSHARED_SETTINGS_KEYS=""
+
+# The generated adapter only ever removes relative to the org file: fewer
+# hook events, fewer permission allows. A local settings.json that carries
+# anything the committed file lacks is user work and stays untouched.
+_settings_is_reduced_adapter() {
+  local tmp_head
+  tmp_head=$(mktemp) || return 1
+  if ! git show "HEAD:.claude/settings.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 1
+  fi
+  jq -es '
+    .[0] as $local | .[1] as $head |
+    ($local != $head) and
+    ((($local.hooks // {}) | keys) - (($head.hooks // {}) | keys) | length == 0) and
+    ((($local.permissions.allow // []) - ($head.permissions.allow // [])) | length == 0)
+  ' .claude/settings.json "$tmp_head" >/dev/null 2>&1
+  local verdict=$?
+  rm -f "$tmp_head"
+  return "$verdict"
+}
+
+settings_drift_heal() {
+  git rev-parse -q --verify "origin/$BASE_BRANCH" >/dev/null 2>&1 || return 0
+  [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-parse "origin/$BASE_BRANCH" 2>/dev/null)" ] && return 0
+
+  if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
+    if _settings_is_reduced_adapter; then
+      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+    fi
+  fi
+
+  if ! git diff --quiet -- egregore.json 2>/dev/null; then
+    _SETTINGS_DRIFT_SNAPSHOT=$(cat egregore.json 2>/dev/null || true)
+    _SETTINGS_DRIFT_BASE=$(git show "HEAD:egregore.json" 2>/dev/null || true)
+    if [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] && [ -n "$_SETTINGS_DRIFT_BASE" ] \
+      && printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" | jq -e . >/dev/null 2>&1; then
+      git checkout -- egregore.json 2>/dev/null || _SETTINGS_DRIFT_SNAPSHOT=""
+    else
+      _SETTINGS_DRIFT_SNAPSHOT=""
+    fi
+  fi
+}
+
+settings_drift_reapply() {
+  [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] || return 0
+  local tmp_local tmp_base merged
+  tmp_local=$(mktemp) && tmp_base=$(mktemp) || return 0
+  printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" > "$tmp_local"
+  printf '%s' "$_SETTINGS_DRIFT_BASE" > "$tmp_base"
+  merged=$(jq -s --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $incoming | .[1] as $local | .[2] as $base |
+    reduce $keys[] as $k ($incoming;
+      if ($local[$k] // null) != ($base[$k] // null) then
+        if ($local | has($k)) then .[$k] = $local[$k] else del(.[$k]) end
+      else . end)
+  ' egregore.json "$tmp_local" "$tmp_base" 2>/dev/null || true)
+  rm -f "$tmp_local" "$tmp_base"
+  if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+    printf '%s\n' "$merged" > egregore.json
+  fi
+  _SETTINGS_DRIFT_SNAPSHOT=""
+  _SETTINGS_DRIFT_BASE=""
+}
+
+settings_drift_report() {
+  UNSHARED_SETTINGS_KEYS=""
+  git diff --quiet -- egregore.json 2>/dev/null && return 0
+  local tmp_head
+  tmp_head=$(mktemp) || return 0
+  if ! git show "HEAD:egregore.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 0
+  fi
+  UNSHARED_SETTINGS_KEYS=$(jq -rs --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $local | .[1] as $head |
+    [$keys[] | select(($local[.] // null) != ($head[.] // null))] | join(", ")
+  ' egregore.json "$tmp_head" 2>/dev/null || true)
+  rm -f "$tmp_head"
+  export UNSHARED_SETTINGS_KEYS
+}

package/runtime/pi/egregore_runtime/issue_cli.py

@@ -61,7 +61,7 @@ def _snapshot(runtime, actor, service, permission: Permission = Permission.READ)
 
 
 def _resolve(runtime, actor, service, reference: str) -> IssueSnapshot:
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     return service.resolve(rows, reference)
 
 
@@ -72,7 +72,7 @@ def _write_result(issue: IssueSnapshot, receipt) -> int:
 
 def _list(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     selected = rows if args.status == "all" else tuple(
         row for row in rows if row.status == args.status
     )
@@ -89,7 +89,7 @@ def _show(args):
 
 def _search(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     terms = tuple(part for part in args.term.casefold().split() if part)
 
     def matches(row: IssueSnapshot) -> bool:

package/runtime/pi/manifest.json

@@ -174,6 +174,7 @@
     "bin/lib/metrics.sh",
     "bin/lib/noncode.sh",
     "bin/lib/permissions.sh",
+    "bin/lib/settings-drift.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
     "bin/node-run.sh",

package/runtime/prime/bin/lib/git-sync.sh

@@ -24,6 +24,10 @@ FRAMEWORK_UPDATED_FILES=""
 HEALTH_RETRIEVAL="skip"
 SYNC_RECEIPT=""
 
+# Settings drift healer + unshared-settings reporting (see the lib header).
+# shellcheck source=bin/lib/settings-drift.sh
+source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -324,8 +328,14 @@ setup_develop() {
       return 1
     fi
   else
-    # Already on it — fetch couldn't update a checked-out branch, so pull
+    # Already on it — fetch couldn't update a checked-out branch, so pull.
+    # Launcher/installer settings drift blocks this merge and the refusal
+    # is otherwise silent; heal it first, re-apply the launcher's intent
+    # after (bin/lib/settings-drift.sh).
+    settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
+    settings_drift_reapply
+    settings_drift_report
   fi
 
   # Never report the intended branch as the actual branch. A checkout can fail

package/runtime/prime/bin/lib/greeting.sh

@@ -95,6 +95,14 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
+# --- Unshared org-settings drift (launcher writes not yet shared) ---
+if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
+  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
+fi
+if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
+  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
+fi
+
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"
 

package/runtime/prime/bin/lib/settings-drift.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# settings-drift.sh — heal launcher/installer settings drift around the
+# base-branch fast-forward, and surface unshared org-settings changes.
+#
+# Two org-config surfaces accumulate legitimate local modifications outside
+# any session: .claude/settings.json (the installer's generated public-safe
+# adapter can replace the org's richer committed file) and egregore.json
+# (launcher settings verbs: posture, workflow, people removals). Local
+# modifications to files a fast-forward also changes make git refuse the
+# merge — and that refusal used to be silently swallowed, leaving the
+# checkout behind with no explanation.
+#
+# Contract (sourced; caller provides $BASE_BRANCH and runs from the repo
+# root):
+#   settings_drift_heal      — before the ff-merge. Restores settings.json
+#                              only when the local copy is a reduced
+#                              generated adapter (its hook events and
+#                              permission allows are a subset of the
+#                              committed file's). Snapshots egregore.json
+#                              and returns it to HEAD so the merge can run.
+#   settings_drift_reapply   — after the ff-merge. Re-applies the snapshot's
+#                              changed settings-owned keys on top of the
+#                              incoming egregore.json.
+#   settings_drift_report    — sets UNSHARED_SETTINGS_KEYS to the
+#                              settings-owned keys where the working file
+#                              differs from HEAD, for the greeting.
+#
+# Anything dirty beyond these two files is user work and is never touched.
+
+_SETTINGS_OWNED_KEYS='["boundary","base_branch","people_removed","features","repos","admins","people"]'
+_SETTINGS_DRIFT_SNAPSHOT=""
+_SETTINGS_DRIFT_BASE=""
+# Read by bin/lib/greeting.sh after git-sync completes.
+export SETTINGS_ADAPTER_RESTORED="false"
+export UNSHARED_SETTINGS_KEYS=""
+
+# The generated adapter only ever removes relative to the org file: fewer
+# hook events, fewer permission allows. A local settings.json that carries
+# anything the committed file lacks is user work and stays untouched.
+_settings_is_reduced_adapter() {
+  local tmp_head
+  tmp_head=$(mktemp) || return 1
+  if ! git show "HEAD:.claude/settings.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 1
+  fi
+  jq -es '
+    .[0] as $local | .[1] as $head |
+    ($local != $head) and
+    ((($local.hooks // {}) | keys) - (($head.hooks // {}) | keys) | length == 0) and
+    ((($local.permissions.allow // []) - ($head.permissions.allow // [])) | length == 0)
+  ' .claude/settings.json "$tmp_head" >/dev/null 2>&1
+  local verdict=$?
+  rm -f "$tmp_head"
+  return "$verdict"
+}
+
+settings_drift_heal() {
+  git rev-parse -q --verify "origin/$BASE_BRANCH" >/dev/null 2>&1 || return 0
+  [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-parse "origin/$BASE_BRANCH" 2>/dev/null)" ] && return 0
+
+  if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
+    if _settings_is_reduced_adapter; then
+      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+    fi
+  fi
+
+  if ! git diff --quiet -- egregore.json 2>/dev/null; then
+    _SETTINGS_DRIFT_SNAPSHOT=$(cat egregore.json 2>/dev/null || true)
+    _SETTINGS_DRIFT_BASE=$(git show "HEAD:egregore.json" 2>/dev/null || true)
+    if [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] && [ -n "$_SETTINGS_DRIFT_BASE" ] \
+      && printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" | jq -e . >/dev/null 2>&1; then
+      git checkout -- egregore.json 2>/dev/null || _SETTINGS_DRIFT_SNAPSHOT=""
+    else
+      _SETTINGS_DRIFT_SNAPSHOT=""
+    fi
+  fi
+}
+
+settings_drift_reapply() {
+  [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] || return 0
+  local tmp_local tmp_base merged
+  tmp_local=$(mktemp) && tmp_base=$(mktemp) || return 0
+  printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" > "$tmp_local"
+  printf '%s' "$_SETTINGS_DRIFT_BASE" > "$tmp_base"
+  merged=$(jq -s --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $incoming | .[1] as $local | .[2] as $base |
+    reduce $keys[] as $k ($incoming;
+      if ($local[$k] // null) != ($base[$k] // null) then
+        if ($local | has($k)) then .[$k] = $local[$k] else del(.[$k]) end
+      else . end)
+  ' egregore.json "$tmp_local" "$tmp_base" 2>/dev/null || true)
+  rm -f "$tmp_local" "$tmp_base"
+  if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+    printf '%s\n' "$merged" > egregore.json
+  fi
+  _SETTINGS_DRIFT_SNAPSHOT=""
+  _SETTINGS_DRIFT_BASE=""
+}
+
+settings_drift_report() {
+  UNSHARED_SETTINGS_KEYS=""
+  git diff --quiet -- egregore.json 2>/dev/null && return 0
+  local tmp_head
+  tmp_head=$(mktemp) || return 0
+  if ! git show "HEAD:egregore.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 0
+  fi
+  UNSHARED_SETTINGS_KEYS=$(jq -rs --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $local | .[1] as $head |
+    [$keys[] | select(($local[.] // null) != ($head[.] // null))] | join(", ")
+  ' egregore.json "$tmp_head" 2>/dev/null || true)
+  rm -f "$tmp_head"
+  export UNSHARED_SETTINGS_KEYS
+}

package/runtime/prime/egregore_runtime/issue_cli.py

@@ -61,7 +61,7 @@ def _snapshot(runtime, actor, service, permission: Permission = Permission.READ)
 
 
 def _resolve(runtime, actor, service, reference: str) -> IssueSnapshot:
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     return service.resolve(rows, reference)
 
 
@@ -72,7 +72,7 @@ def _write_result(issue: IssueSnapshot, receipt) -> int:
 
 def _list(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     selected = rows if args.status == "all" else tuple(
         row for row in rows if row.status == args.status
     )
@@ -89,7 +89,7 @@ def _show(args):
 
 def _search(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     terms = tuple(part for part in args.term.casefold().split() if part)
 
     def matches(row: IssueSnapshot) -> bool:

package/runtime/prime/manifest.json

@@ -177,6 +177,7 @@
     "bin/lib/metrics.sh",
     "bin/lib/noncode.sh",
     "bin/lib/permissions.sh",
+    "bin/lib/settings-drift.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
     "bin/node-run.sh",