Prompt-override orphan trap: delete clears the switch, writes heal orphans

Contract-fix interlude (2026-09-26), two bugs from UI's prompts-overhaul
(6edc220):

(a) ORPHAN-400 TRAP: an ON switch whose override file dies orphaned the
record; every agent-section write then 400'd (ON-must-have-file) while
the disabled toggle couldn't reach the OFF escape hatch — a user stuck
unable to write settings. Verified live on 3004 before the fix.
Two-layer fix:
- DELETE /api/settings/prompts/[...segment] now clears the record's
  switch in the same operation (switch-first order: a crash between the
  two leaves the valid off+file state, never an orphan). Response gains
  switchCleared (additive). Overrules the 2026-09-19 switch-survives-
  delete note — the delete route and the record agree by construction.
- PUT /api/settings/[section] agent writes HEAL an orphaned ON to OFF
  (key dropped) inside the write — never a 400 (defense in depth: disk
  wipes outside the app can still orphan). A valid ON with its file
  stays valid; the invariant: a user can never get stuck unable to
  write settings, and the record never contradicts file reality for
  long. Heal logs at info.

(b) TEST WIPES REAL DATA: tests/prompt-overrides.test.ts wiped
data/prompts/ (REAL user override files) in after() and its empty-list
case — every npm test killed actual overrides and orphaned their ON
switches (feeding trap a). Isolated via the established LH_DATA_DIR
seam (mkdtemp + env set before the first config.ts-loading import; all
app-module imports dynamic). after() now snapshots the REAL repo
data/prompts before/after and fails the suite if it changed; the seam is
pinned (writes land under the temp dir).

Pins: delete-clears-switch (incl. idempotent no-op), the exact repro
(disk-level wipe → mirror-the-orphan + tool toggle → 200, healed key,
rest of the write landed), vanished-fragment ON heals, valid ON stays.
Live: the 400-forever write now lands 200, heal info-logged, record
clean.

Gates: 967/967 (+5), typecheck, lint, build green.

app/api/settings/prompts/[...segment]/route.ts

@@ -7,16 +7,31 @@
  *          — derived from src/agent/prompts at runtime): overriding a
  *          segment that doesn't compose is a typo or a vanished fragment,
  *          a 400, never a silent orphan.
- *   DELETE → removes the override file (idempotent). Switches are NOT
- *          touched — an on-switch with no file composes the source
- *          default (inert by design), so the user's switch state survives
- *          a delete/re-write cycle.
+ *   DELETE → removes the override file (idempotent) AND clears the
+ *          record's switch for that segment in the same operation
+ *          (contract fix, interlude 2026-09-26 — overrules the 2026-09-19
+ *          "switch survives a delete/re-write cycle" note). The old
+ *          behavior orphaned the on-switch: the write validation then
+ *          400'd every agent-section write while the UI's disabled toggle
+ *          couldn't reach the OFF escape hatch — a user stuck unable to
+ *          write settings. Delete clears the switch so the route and the
+ *          record agree BY CONSTRUCTION; the write path additionally heals
+ *          any orphan that still arises (disk-level wipes outside the
+ *          app's control) — see [section]/route.ts. Order here: clear the
+ *          switch first, then unlink — a crash between the two leaves
+ *          "off + file", a valid state, never an orphan.
  *
  * The ON/OFF switch itself lives in the record's agent.prompts map
  * (PUT /api/settings/agent) — file presence alone is never the override.
  */
 
-import { allSegmentPaths, isValidSegmentPath, promptOverrides } from "@/src/server";
+import {
+	allSegmentPaths,
+	isValidSegmentPath,
+	promptOverrides,
+	readSettingsRecord,
+	writeSettingsRecord,
+} from "@/src/server";
 
 export const dynamic = "force-dynamic";
 
@@ -49,6 +64,17 @@ export async function DELETE(_request: Request, ctx: { params: Promise<{ segment
 	const { segment } = await ctx.params;
 	const path = segmentPathFrom(segment);
 	if (!path) return Response.json({ error: "invalid segment path" }, { status: 400 });
+	// Clear the record's switch FIRST (crash between the two leaves "off +
+	// file" — valid — never an orphaned ON), then unlink the file.
+	const record = readSettingsRecord();
+	const hadSwitch = record?.agent?.prompts?.[path] === true;
+	if (record && record.agent?.prompts?.[path] !== undefined) {
+		const prompts = { ...record.agent.prompts };
+		delete prompts[path];
+		writeSettingsRecord({ ...record, agent: { ...record.agent, prompts } });
+	}
 	promptOverrides.deleteOverride(path);
-	return Response.json({ path, deleted: true });
+	// switchCleared tells the caller their on-switch went off WITH the file
+	// (additive; the GET view derives the same truth from record+file).
+	return Response.json({ path, deleted: true, switchCleared: hadSwitch });
 }