Prompt-override orphan trap: delete clears the switch, writes heal orphans

Contract-fix interlude (2026-09-26), two bugs from UI's prompts-overhaul
(6edc220):

(a) ORPHAN-400 TRAP: an ON switch whose override file dies orphaned the
record; every agent-section write then 400'd (ON-must-have-file) while
the disabled toggle couldn't reach the OFF escape hatch — a user stuck
unable to write settings. Verified live on 3004 before the fix.
Two-layer fix:
- DELETE /api/settings/prompts/[...segment] now clears the record's
  switch in the same operation (switch-first order: a crash between the
  two leaves the valid off+file state, never an orphan). Response gains
  switchCleared (additive). Overrules the 2026-09-19 switch-survives-
  delete note — the delete route and the record agree by construction.
- PUT /api/settings/[section] agent writes HEAL an orphaned ON to OFF
  (key dropped) inside the write — never a 400 (defense in depth: disk
  wipes outside the app can still orphan). A valid ON with its file
  stays valid; the invariant: a user can never get stuck unable to
  write settings, and the record never contradicts file reality for
  long. Heal logs at info.

(b) TEST WIPES REAL DATA: tests/prompt-overrides.test.ts wiped
data/prompts/ (REAL user override files) in after() and its empty-list
case — every npm test killed actual overrides and orphaned their ON
switches (feeding trap a). Isolated via the established LH_DATA_DIR
seam (mkdtemp + env set before the first config.ts-loading import; all
app-module imports dynamic). after() now snapshots the REAL repo
data/prompts before/after and fails the suite if it changed; the seam is
pinned (writes land under the temp dir).

Pins: delete-clears-switch (incl. idempotent no-op), the exact repro
(disk-level wipe → mirror-the-orphan + tool toggle → 200, healed key,
rest of the write landed), vanished-fragment ON heals, valid ON stays.
Live: the 400-forever write now lands 200, heal info-logged, record
clean.

Gates: 967/967 (+5), typecheck, lint, build green.

app/api/settings/[section]/route.ts

@@ -15,9 +15,14 @@
  *   level CLAMPS to the named model's nearest supported level and the
  *   clamped value is stored — model swaps just work, same as the
  *   defaults route. The agent section additionally validates prompt
- *   switches: an ON switch must reference a CURRENT source segment with an
- *   existing override file (an OFF switch may reference anything — users
- *   cleaning up orphans must not be blocked).
+ *   switches — under the orphan-heal contract (interlude 2026-09-26): an
+ *   ON switch with its override file present is valid as-is; an ON whose
+ *   file is gone (deleted outside the app, a disk wipe, or a record from
+ *   before the delete-clears-switch fix) is an ORPHAN and is healed to
+ *   OFF (the key drops) inside the same write — never a 400. Invariant:
+ *   a user can never get stuck unable to write settings, and switch
+ *   state never contradicts file reality for long (the delete route
+ *   clears the switch by construction; this is the backstop).
  *
  * The static siblings (defaults, prompts) take precedence over this
  * dynamic segment — Next resolves static routes first, so "prompts" never
@@ -58,6 +63,7 @@ export async function PUT(request: Request, ctx: { params: Promise<{ section: st
 	if (!parsed.ok) {
 		return Response.json({ error: parsed.error }, { status: 400 });
 	}
+	let agentHealed: AgentSettings | undefined;
 
 	// Section-specific cross-validation (against the catalog / the prompt
 	// store) — the parsers only see shapes.
@@ -77,19 +83,23 @@ export async function PUT(request: Request, ctx: { params: Promise<{ section: st
 		}
 	}
 	if (section === "agent") {
+		// Orphan-heal (contract fix, interlude 2026-09-26): an ON switch
+		// whose override file is gone (or whose segment left the source
+		// tree) is healed to OFF (key dropped) inside this write — never a
+		// 400. The old 400 trapped users: the record's own orphaned ON was
+		// mirrored back by every write while the disabled toggle couldn't
+		// reach the OFF escape hatch. An ON with a real file stays valid.
 		const agent = parsed.settings as AgentSettings;
 		const segments = new Set(allSegmentPaths());
+		const orphans: string[] = [];
 		for (const [path, on] of Object.entries(agent.prompts ?? {})) {
-			if (on && (!segments.has(path) || promptOverrides.readOverride(path) === null)) {
-				return Response.json(
-					{
-						error: `prompt switch for "${path}" cannot be on: ${
-							segments.has(path) ? "no override file exists" : "not a current source segment"
-						}`,
-					},
-					{ status: 400 },
-				);
-			}
+			if (on && (!segments.has(path) || promptOverrides.readOverride(path) === null)) orphans.push(path);
+		}
+		if (orphans.length > 0) {
+			const prompts = { ...(agent.prompts ?? {}) };
+			for (const path of orphans) delete prompts[path];
+			agentHealed = { ...agent, prompts };
+			console.info(`[settings] healed orphaned prompt switch(es) to off: ${orphans.join(", ")}`);
 		}
 	}
 
@@ -100,12 +110,17 @@ export async function PUT(request: Request, ctx: { params: Promise<{ section: st
 	// value is what lands in the record. The chat section's bare levels
 	// clamp against the record's resolved strong slot (the chain's
 	// fallback); the models section's slots each carry their own model.
+	// The agent section lands HEALED when orphaned prompt switches were
+	// found above (the healed copy) — after every write the record and
+	// file reality agree.
 	const sectionOut =
 		section === "chat"
 			? clampChatLevel(parsed.settings as ChatSettings, effectiveSettings().models.strong)
 			: section === "models"
 				? clampModelsLevels(parsed.settings as ModelsSettings)
-				: parsed.settings;
+				: section === "agent" && agentHealed
+					? agentHealed
+					: parsed.settings;
 
 	// Read-modify-write ONE section of the record; everything else rides
 	// along untouched (other sections, unknown keys — sanitize preserves).