create-egregore 0.21.0-runtime-mvp.9 → 0.21.0-runtime-mvp.11

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.9
+// egregore-launcher-version: 0.21.0-runtime-mvp.11
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.9";
+const VERSION = "0.21.0-runtime-mvp.11";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -4046,7 +4046,7 @@ async function browser(args = {}) {
             }
             if (chunk === "s" && proposal && proposal.token) {
               S.settingsAction = "tele-share";
-              S.settingsInput = `Send ${proposal.events} event(s) to ${proposal.target} now? Local events are retained. [y/N]`;
+              S.settingsInput = `Send ${proposal.events} event(s) now? Local events are retained. [y/N]`;
               render(); return;
             }
             if (key.name === "escape" || key.name === "left") {

package/lib/claude-runtime.js

@@ -76,6 +76,24 @@ function copyFile(src, dest) {
   try { fs.chmodSync(dest, fs.statSync(src).mode & 0o777); } catch {}
 }
 
+// The generated settings adapter may replace a stale template settings.json —
+// one carrying nothing the adapter lacks — but an org's customized settings
+// (extra hook events or permission allows, e.g. PreCompact/Stop) are
+// authoritative and are never adopted, even when clean and tracked.
+function settingsSafeToAdopt(destFile, srcFile) {
+  try {
+    const local = JSON.parse(fs.readFileSync(destFile, "utf8"));
+    const bundle = JSON.parse(fs.readFileSync(srcFile, "utf8"));
+    const bundleHooks = bundle.hooks || {};
+    const extraHooks = Object.keys(local.hooks || {}).filter((k) => !(k in bundleHooks));
+    const bundleAllow = new Set(bundle.permissions?.allow || []);
+    const extraAllow = (local.permissions?.allow || []).filter((entry) => !bundleAllow.has(entry));
+    return extraHooks.length === 0 && extraAllow.length === 0;
+  } catch {
+    return false;
+  }
+}
+
 // One-time ownership migration for pre-bundle Claude installs. A clean,
 // tracked path is part of the cloned framework template and may be adopted by
 // the package. Dirty/untracked paths are user work and remain untouched.
@@ -153,7 +171,11 @@ function installClaudeRuntime(egregoreDir) {
       summary.skipped += 1; record();
     } else if (previousHash && currentHash === previousHash) {
       copyFile(src, dest); summary.updated += 1; record();
-    } else if (!previousHash && isCleanTrackedFrameworkFile(egregoreDir, rel)) {
+    } else if (
+      !previousHash
+      && (rel.replaceAll("\\", "/") !== ".claude/settings.json" || settingsSafeToAdopt(dest, src))
+      && isCleanTrackedFrameworkFile(egregoreDir, rel)
+    ) {
       copyFile(src, dest); summary.updated += 1; record();
     } else {
       summary.conflicted += 1; summary.conflicts.push(rel);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.9",
+  "version": "0.21.0-runtime-mvp.11",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/bin/lib/git-sync.sh

@@ -24,6 +24,10 @@ FRAMEWORK_UPDATED_FILES=""
 HEALTH_RETRIEVAL="skip"
 SYNC_RECEIPT=""
 
+# Settings drift healer + unshared-settings reporting (see the lib header).
+# shellcheck source=bin/lib/settings-drift.sh
+source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -324,8 +328,14 @@ setup_develop() {
       return 1
     fi
   else
-    # Already on it — fetch couldn't update a checked-out branch, so pull
+    # Already on it — fetch couldn't update a checked-out branch, so pull.
+    # Launcher/installer settings drift blocks this merge and the refusal
+    # is otherwise silent; heal it first, re-apply the launcher's intent
+    # after (bin/lib/settings-drift.sh).
+    settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
+    settings_drift_reapply
+    settings_drift_report
   fi
 
   # Never report the intended branch as the actual branch. A checkout can fail

package/runtime/claude/bin/lib/greeting.sh

@@ -95,6 +95,14 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
+# --- Unshared org-settings drift (launcher writes not yet shared) ---
+if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
+  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
+fi
+if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
+  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
+fi
+
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"
 

package/runtime/claude/bin/lib/settings-drift.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# settings-drift.sh — heal launcher/installer settings drift around the
+# base-branch fast-forward, and surface unshared org-settings changes.
+#
+# Two org-config surfaces accumulate legitimate local modifications outside
+# any session: .claude/settings.json (the installer's generated public-safe
+# adapter can replace the org's richer committed file) and egregore.json
+# (launcher settings verbs: posture, workflow, people removals). Local
+# modifications to files a fast-forward also changes make git refuse the
+# merge — and that refusal used to be silently swallowed, leaving the
+# checkout behind with no explanation.
+#
+# Contract (sourced; caller provides $BASE_BRANCH and runs from the repo
+# root):
+#   settings_drift_heal      — before the ff-merge. Restores settings.json
+#                              only when the local copy is a reduced
+#                              generated adapter (its hook events and
+#                              permission allows are a subset of the
+#                              committed file's). Snapshots egregore.json
+#                              and returns it to HEAD so the merge can run.
+#   settings_drift_reapply   — after the ff-merge. Re-applies the snapshot's
+#                              changed settings-owned keys on top of the
+#                              incoming egregore.json.
+#   settings_drift_report    — sets UNSHARED_SETTINGS_KEYS to the
+#                              settings-owned keys where the working file
+#                              differs from HEAD, for the greeting.
+#
+# Anything dirty beyond these two files is user work and is never touched.
+
+_SETTINGS_OWNED_KEYS='["boundary","base_branch","people_removed","features","repos","admins","people"]'
+_SETTINGS_DRIFT_SNAPSHOT=""
+_SETTINGS_DRIFT_BASE=""
+# Read by bin/lib/greeting.sh after git-sync completes.
+export SETTINGS_ADAPTER_RESTORED="false"
+export UNSHARED_SETTINGS_KEYS=""
+
+# The generated adapter only ever removes relative to the org file: fewer
+# hook events, fewer permission allows. A local settings.json that carries
+# anything the committed file lacks is user work and stays untouched.
+_settings_is_reduced_adapter() {
+  local tmp_head
+  tmp_head=$(mktemp) || return 1
+  if ! git show "HEAD:.claude/settings.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 1
+  fi
+  jq -es '
+    .[0] as $local | .[1] as $head |
+    ($local != $head) and
+    ((($local.hooks // {}) | keys) - (($head.hooks // {}) | keys) | length == 0) and
+    ((($local.permissions.allow // []) - ($head.permissions.allow // [])) | length == 0)
+  ' .claude/settings.json "$tmp_head" >/dev/null 2>&1
+  local verdict=$?
+  rm -f "$tmp_head"
+  return "$verdict"
+}
+
+settings_drift_heal() {
+  git rev-parse -q --verify "origin/$BASE_BRANCH" >/dev/null 2>&1 || return 0
+  [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-parse "origin/$BASE_BRANCH" 2>/dev/null)" ] && return 0
+
+  if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
+    if _settings_is_reduced_adapter; then
+      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+    fi
+  fi
+
+  if ! git diff --quiet -- egregore.json 2>/dev/null; then
+    _SETTINGS_DRIFT_SNAPSHOT=$(cat egregore.json 2>/dev/null || true)
+    _SETTINGS_DRIFT_BASE=$(git show "HEAD:egregore.json" 2>/dev/null || true)
+    if [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] && [ -n "$_SETTINGS_DRIFT_BASE" ] \
+      && printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" | jq -e . >/dev/null 2>&1; then
+      git checkout -- egregore.json 2>/dev/null || _SETTINGS_DRIFT_SNAPSHOT=""
+    else
+      _SETTINGS_DRIFT_SNAPSHOT=""
+    fi
+  fi
+}
+
+settings_drift_reapply() {
+  [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] || return 0
+  local tmp_local tmp_base merged
+  tmp_local=$(mktemp) && tmp_base=$(mktemp) || return 0
+  printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" > "$tmp_local"
+  printf '%s' "$_SETTINGS_DRIFT_BASE" > "$tmp_base"
+  merged=$(jq -s --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $incoming | .[1] as $local | .[2] as $base |
+    reduce $keys[] as $k ($incoming;
+      if ($local[$k] // null) != ($base[$k] // null) then
+        if ($local | has($k)) then .[$k] = $local[$k] else del(.[$k]) end
+      else . end)
+  ' egregore.json "$tmp_local" "$tmp_base" 2>/dev/null || true)
+  rm -f "$tmp_local" "$tmp_base"
+  if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+    printf '%s\n' "$merged" > egregore.json
+  fi
+  _SETTINGS_DRIFT_SNAPSHOT=""
+  _SETTINGS_DRIFT_BASE=""
+}
+
+settings_drift_report() {
+  UNSHARED_SETTINGS_KEYS=""
+  git diff --quiet -- egregore.json 2>/dev/null && return 0
+  local tmp_head
+  tmp_head=$(mktemp) || return 0
+  if ! git show "HEAD:egregore.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 0
+  fi
+  UNSHARED_SETTINGS_KEYS=$(jq -rs --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $local | .[1] as $head |
+    [$keys[] | select(($local[.] // null) != ($head[.] // null))] | join(", ")
+  ' egregore.json "$tmp_head" 2>/dev/null || true)
+  rm -f "$tmp_head"
+  export UNSHARED_SETTINGS_KEYS
+}

package/runtime/claude/bin/search.sh

@@ -235,6 +235,21 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
+  # Content-free query telemetry: mode, duration, result count. Never the
+  # query text. This is what makes Runtime/QMD retrieval visible in the
+  # telemetry event list instead of only legacy graph_query rows.
+  local _tele_count _tele_ms
+  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
+  if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
+        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+  else
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+  fi
+
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
     local packet

package/runtime/claude/bin/settings.sh

@@ -146,7 +146,7 @@ cmd_workflow() {
           || _die "cannot switch workflow: origin/main does not exist or could not be reached" 1
         _save '.base_branch = "main"'
       fi
-      echo "Git workflow: SIMPLE — pull requests now target main"
+      echo "Git workflow: SIMPLE — pull requests now target main · /save shares it with the org"
       ;;
     staged)
       if [ "$base" != "develop" ]; then
@@ -160,7 +160,7 @@ cmd_workflow() {
       elif ! jq -e 'has("base_branch")' "$CONFIG" >/dev/null 2>&1; then
         _save '.base_branch = "develop"'
       fi
-      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main"
+      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh workflow status|simple|staged" 1 ;;
   esac
@@ -468,7 +468,7 @@ cmd_posture() {
       if [ "$action" != "$current" ]; then
         _save '.boundary = ((.boundary // {}) + {posture: $p})' --arg p "$action"
       fi
-      echo "Boundary posture: $action"
+      echo "Boundary posture: $action · applies to new sessions · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh posture status|strict|standard|open" 1 ;;
   esac

package/runtime/claude/bin/telemetry.sh

@@ -27,6 +27,10 @@ fi
 BUFFER_FILE="$BUFFER_DIR/telemetry.jsonl"
 LOCK_DIR="$BUFFER_DIR/telemetry.lock"
 SHARE_CONSENT_FILE="$BUFFER_DIR/telemetry-share-consent.json"
+# Exact dataset pinned at proposal time. The confirm step sends this snapshot,
+# so events emitted between proposal and confirm (attendant, other sessions)
+# can never invalidate — or silently join — a disclosed share.
+SHARE_STAGED_FILE="$BUFFER_DIR/telemetry.share-staged.jsonl"
 STATE_FILE="${EGREGORE_STATE_FILE:-$SCRIPT_DIR/.egregore-state.json}"
 CONFIG="${EGREGORE_CONFIG_FILE:-$SCRIPT_DIR/egregore.json}"
 ENV_FILE="${EGREGORE_ENV_FILE:-$SCRIPT_DIR/.env}"
@@ -230,7 +234,8 @@ _validate_metrics() {
 }
 
 _validate_buffer() {
-  [ -s "$BUFFER_FILE" ] || return 0
+  local target="${1:-$BUFFER_FILE}"
+  [ -s "$target" ] || return 0
   jq -e --arg schema "$SCHEMA_VERSION" --argjson allowed "$ALLOWED_METRICS_JSON" '
     def safe_id:
       type == "string" and length > 0 and length <= 256 and
@@ -264,7 +269,7 @@ _validate_buffer() {
       (.data | safe_metrics) and (.ts | type == "string") and
       (.type | safe_id) and (.sid | safe_id) and (.org | safe_id) and (.user | safe_id)
     end
-  ' "$BUFFER_FILE" >/dev/null 2>&1
+  ' "$target" >/dev/null 2>&1
 }
 
 cmd_emit() {
@@ -422,7 +427,7 @@ cmd_clear() {
     echo "Could not acquire the telemetry lock; nothing was cleared." >&2
     return 1
   fi
-  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE"
+  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
   _unlock
   echo "Local telemetry buffer cleared."
 }
@@ -525,31 +530,35 @@ cmd_share() {
     https://*|http://127.0.0.1*|http://localhost*|http://\[::1\]*) ;;
     *) echo "Share endpoint must use https (or loopback http)." >&2; return 2 ;;
   esac
-  if ! _validate_buffer; then
+  # Proposal validates the live buffer it is about to stage; confirm validates
+  # the staged snapshot it is about to send — never the moving buffer.
+  if [ -z "$confirmation" ] && ! _validate_buffer; then
     echo "Share blocked: the local buffer contains an invalid or content-bearing event." >&2
     return 2
   fi
-
-  local count=0 size=0 dataset_sha256=""
-  if [ -s "$BUFFER_FILE" ]; then
-    count=$(grep -c '^{' "$BUFFER_FILE" 2>/dev/null || true)
-    size=$(wc -c < "$BUFFER_FILE" 2>/dev/null | tr -d ' ')
-    dataset_sha256=$(_sha256_file "$BUFFER_FILE")
-  else
-    local empty_file="$BUFFER_DIR/telemetry.empty.$$"
-    mkdir -p "$BUFFER_DIR"
-    : > "$empty_file"
-    dataset_sha256=$(_sha256_file "$empty_file")
-    rm -f "$empty_file"
+  if [ -n "$confirmation" ] && ! _validate_buffer "$SHARE_STAGED_FILE"; then
+    echo "Share blocked: the staged dataset contains an invalid or content-bearing event." >&2
+    return 2
   fi
 
+  local count=0 size=0 dataset_sha256=""
   if [ -z "$confirmation" ]; then
-    local fields="none"
+    mkdir -p "$BUFFER_DIR"
     if [ -s "$BUFFER_FILE" ]; then
+      cp "$BUFFER_FILE" "$SHARE_STAGED_FILE"
+    else
+      : > "$SHARE_STAGED_FILE"
+    fi
+    chmod 600 "$SHARE_STAGED_FILE"
+    count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+    size=$(wc -c < "$SHARE_STAGED_FILE" 2>/dev/null | tr -d ' ')
+    dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
+    local fields="none"
+    if [ -s "$SHARE_STAGED_FILE" ]; then
       fields=$(jq -rs '
         [.[].metrics // .[].data // {} | keys[]] | unique |
         if length == 0 then "none" else map("metrics." + .) | join(", ") end
-      ' "$BUFFER_FILE" 2>/dev/null || echo "unable to inspect")
+      ' "$SHARE_STAGED_FILE" 2>/dev/null || echo "unable to inspect")
     fi
     local token token_sha256 expires_at
     token=$(_random_token)
@@ -600,10 +609,14 @@ cmd_share() {
     return 0
   fi
 
-  if [ ! -f "$SHARE_CONSENT_FILE" ]; then
+  if [ ! -f "$SHARE_CONSENT_FILE" ] || [ ! -f "$SHARE_STAGED_FILE" ]; then
     echo "Share blocked: run share without --confirm to inspect and prepare this dataset first." >&2
     return 2
   fi
+  # The staged snapshot is the disclosed dataset: exactly what the proposal
+  # named is what ships, and later buffer growth cannot invalidate it.
+  count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+  dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
   local expected_target expected_dataset expected_token expires_at actual_token
   expected_target=$(jq -r '.target // empty' "$SHARE_CONSENT_FILE")
   expected_dataset=$(jq -r '.dataset_sha256 // empty' "$SHARE_CONSENT_FILE")
@@ -611,7 +624,7 @@ cmd_share() {
   expires_at=$(jq -r '.expires_at // 0' "$SHARE_CONSENT_FILE")
   actual_token=$(_sha256_text "$confirmation")
   if [ "$(date +%s)" -gt "$expires_at" ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Share blocked: confirmation expired; prepare a new share." >&2
     return 2
   fi
@@ -621,7 +634,7 @@ cmd_share() {
   fi
 
   local share_file="$BUFFER_DIR/telemetry.share.$$"
-  if [ -s "$BUFFER_FILE" ]; then
+  if [ -s "$SHARE_STAGED_FILE" ]; then
     jq -c --arg schema "$SCHEMA_VERSION" '
       if .schema_version == $schema then
         {ts:.occurred_at,type:.event_type,sid:.session_id,org:.org_id,user:.actor_id,
@@ -629,7 +642,7 @@ cmd_share() {
            artifact_ids:.artifact_ids,task_id:.task_id,org_revision:.org_revision,
            index_spec_version:.index_spec_version,shared:true})}
       else . end
-    ' "$BUFFER_FILE" > "$share_file"
+    ' "$SHARE_STAGED_FILE" > "$share_file"
   else
     : > "$share_file"
   fi
@@ -646,7 +659,7 @@ cmd_share() {
   http_code=$(curl "${curl_args[@]}" 2>/dev/null || echo "000")
   rm -f "$share_file"
   if [ "$http_code" -ge 200 ] 2>/dev/null && [ "$http_code" -lt 300 ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Shared $count telemetry events with $endpoint. Local events were retained."
   else
     echo "Share failed (HTTP $http_code). Nothing was removed locally." >&2

package/runtime/claude/egregore_runtime/issue_cli.py

@@ -61,7 +61,7 @@ def _snapshot(runtime, actor, service, permission: Permission = Permission.READ)
 
 
 def _resolve(runtime, actor, service, reference: str) -> IssueSnapshot:
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     return service.resolve(rows, reference)
 
 
@@ -72,7 +72,7 @@ def _write_result(issue: IssueSnapshot, receipt) -> int:
 
 def _list(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     selected = rows if args.status == "all" else tuple(
         row for row in rows if row.status == args.status
     )
@@ -89,7 +89,7 @@ def _show(args):
 
 def _search(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     terms = tuple(part for part in args.term.casefold().split() if part)
 
     def matches(row: IssueSnapshot) -> bool:

package/runtime/claude/manifest.json

@@ -184,6 +184,7 @@
     "bin/lib/metrics.sh",
     "bin/lib/noncode.sh",
     "bin/lib/permissions.sh",
+    "bin/lib/settings-drift.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
     "bin/node-run.sh",

package/runtime/codex/bin/lib/git-sync.sh

@@ -24,6 +24,10 @@ FRAMEWORK_UPDATED_FILES=""
 HEALTH_RETRIEVAL="skip"
 SYNC_RECEIPT=""
 
+# Settings drift healer + unshared-settings reporting (see the lib header).
+# shellcheck source=bin/lib/settings-drift.sh
+source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -324,8 +328,14 @@ setup_develop() {
       return 1
     fi
   else
-    # Already on it — fetch couldn't update a checked-out branch, so pull
+    # Already on it — fetch couldn't update a checked-out branch, so pull.
+    # Launcher/installer settings drift blocks this merge and the refusal
+    # is otherwise silent; heal it first, re-apply the launcher's intent
+    # after (bin/lib/settings-drift.sh).
+    settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
+    settings_drift_reapply
+    settings_drift_report
   fi
 
   # Never report the intended branch as the actual branch. A checkout can fail

package/runtime/codex/bin/lib/greeting.sh

@@ -95,6 +95,14 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
+# --- Unshared org-settings drift (launcher writes not yet shared) ---
+if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
+  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
+fi
+if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
+  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
+fi
+
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"
 

package/runtime/codex/bin/lib/settings-drift.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# settings-drift.sh — heal launcher/installer settings drift around the
+# base-branch fast-forward, and surface unshared org-settings changes.
+#
+# Two org-config surfaces accumulate legitimate local modifications outside
+# any session: .claude/settings.json (the installer's generated public-safe
+# adapter can replace the org's richer committed file) and egregore.json
+# (launcher settings verbs: posture, workflow, people removals). Local
+# modifications to files a fast-forward also changes make git refuse the
+# merge — and that refusal used to be silently swallowed, leaving the
+# checkout behind with no explanation.
+#
+# Contract (sourced; caller provides $BASE_BRANCH and runs from the repo
+# root):
+#   settings_drift_heal      — before the ff-merge. Restores settings.json
+#                              only when the local copy is a reduced
+#                              generated adapter (its hook events and
+#                              permission allows are a subset of the
+#                              committed file's). Snapshots egregore.json
+#                              and returns it to HEAD so the merge can run.
+#   settings_drift_reapply   — after the ff-merge. Re-applies the snapshot's
+#                              changed settings-owned keys on top of the
+#                              incoming egregore.json.
+#   settings_drift_report    — sets UNSHARED_SETTINGS_KEYS to the
+#                              settings-owned keys where the working file
+#                              differs from HEAD, for the greeting.
+#
+# Anything dirty beyond these two files is user work and is never touched.
+
+_SETTINGS_OWNED_KEYS='["boundary","base_branch","people_removed","features","repos","admins","people"]'
+_SETTINGS_DRIFT_SNAPSHOT=""
+_SETTINGS_DRIFT_BASE=""
+# Read by bin/lib/greeting.sh after git-sync completes.
+export SETTINGS_ADAPTER_RESTORED="false"
+export UNSHARED_SETTINGS_KEYS=""
+
+# The generated adapter only ever removes relative to the org file: fewer
+# hook events, fewer permission allows. A local settings.json that carries
+# anything the committed file lacks is user work and stays untouched.
+_settings_is_reduced_adapter() {
+  local tmp_head
+  tmp_head=$(mktemp) || return 1
+  if ! git show "HEAD:.claude/settings.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 1
+  fi
+  jq -es '
+    .[0] as $local | .[1] as $head |
+    ($local != $head) and
+    ((($local.hooks // {}) | keys) - (($head.hooks // {}) | keys) | length == 0) and
+    ((($local.permissions.allow // []) - ($head.permissions.allow // [])) | length == 0)
+  ' .claude/settings.json "$tmp_head" >/dev/null 2>&1
+  local verdict=$?
+  rm -f "$tmp_head"
+  return "$verdict"
+}
+
+settings_drift_heal() {
+  git rev-parse -q --verify "origin/$BASE_BRANCH" >/dev/null 2>&1 || return 0
+  [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-parse "origin/$BASE_BRANCH" 2>/dev/null)" ] && return 0
+
+  if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
+    if _settings_is_reduced_adapter; then
+      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+    fi
+  fi
+
+  if ! git diff --quiet -- egregore.json 2>/dev/null; then
+    _SETTINGS_DRIFT_SNAPSHOT=$(cat egregore.json 2>/dev/null || true)
+    _SETTINGS_DRIFT_BASE=$(git show "HEAD:egregore.json" 2>/dev/null || true)
+    if [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] && [ -n "$_SETTINGS_DRIFT_BASE" ] \
+      && printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" | jq -e . >/dev/null 2>&1; then
+      git checkout -- egregore.json 2>/dev/null || _SETTINGS_DRIFT_SNAPSHOT=""
+    else
+      _SETTINGS_DRIFT_SNAPSHOT=""
+    fi
+  fi
+}
+
+settings_drift_reapply() {
+  [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] || return 0
+  local tmp_local tmp_base merged
+  tmp_local=$(mktemp) && tmp_base=$(mktemp) || return 0
+  printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" > "$tmp_local"
+  printf '%s' "$_SETTINGS_DRIFT_BASE" > "$tmp_base"
+  merged=$(jq -s --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $incoming | .[1] as $local | .[2] as $base |
+    reduce $keys[] as $k ($incoming;
+      if ($local[$k] // null) != ($base[$k] // null) then
+        if ($local | has($k)) then .[$k] = $local[$k] else del(.[$k]) end
+      else . end)
+  ' egregore.json "$tmp_local" "$tmp_base" 2>/dev/null || true)
+  rm -f "$tmp_local" "$tmp_base"
+  if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+    printf '%s\n' "$merged" > egregore.json
+  fi
+  _SETTINGS_DRIFT_SNAPSHOT=""
+  _SETTINGS_DRIFT_BASE=""
+}
+
+settings_drift_report() {
+  UNSHARED_SETTINGS_KEYS=""
+  git diff --quiet -- egregore.json 2>/dev/null && return 0
+  local tmp_head
+  tmp_head=$(mktemp) || return 0
+  if ! git show "HEAD:egregore.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 0
+  fi
+  UNSHARED_SETTINGS_KEYS=$(jq -rs --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $local | .[1] as $head |
+    [$keys[] | select(($local[.] // null) != ($head[.] // null))] | join(", ")
+  ' egregore.json "$tmp_head" 2>/dev/null || true)
+  rm -f "$tmp_head"
+  export UNSHARED_SETTINGS_KEYS
+}

package/runtime/codex/bin/search.sh

@@ -235,6 +235,21 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
+  # Content-free query telemetry: mode, duration, result count. Never the
+  # query text. This is what makes Runtime/QMD retrieval visible in the
+  # telemetry event list instead of only legacy graph_query rows.
+  local _tele_count _tele_ms
+  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
+  if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
+        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+  else
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+  fi
+
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
     local packet