[acamarata]

Fixes the open debt rows D-0614, D-0830 and D-0863. One commit per fix.

D-0830: config trust dns skipped headless reported ok:true

runDNSSetup now sets dataResult{OK: false} in the headless-skip branch when the v1.5 envelope is on, as trust.go does. It still returns nil, because start_config.go relies on skip-and-continue. Test: TestDNSSetupHeadlessSkipEnvelope runs the child binary with NSELF_HEADLESS=1 and expects exit 0 and ok:false. It fails on the old code and passes now.

D-0863: disabled builtin family broke every --json command

nself remove admin unmounted admin but left its canon entries, data types and v1.5-only envelope paths, so buildRegistry failed with E400 (29 problems on this base). Reproduced with the built binary. buildRegistry now mounts disabled builtin families for the duration of the build only (mountDisabledBuiltinFamilies, undone after). The runtime tree is unchanged, so nself admin still exits E407. The generators and help --json no longer depend on the developer's plugin directory. Test: TestDisabledBuiltinFamilyKeepsJSONSurface runs remove admin, then version --json expects one envelope, then admin --json expects E407. It fails on the old code and passes now.

D-0614: five Codex post-merge items (all still present on main, all fixed)

1. Start AI gate ignores the project .env opt-out. autoInstallAIIfNeeded now takes the project dir and resolves AI_AUTO_INSTALL from the process env first (so --frozen and CI still win), then the project env cascade, before config.Load runs. Test: TestAutoInstallAIIfNeededProjectEnv.
2. Ops arch preflight used a different key and compose set than the deploy. The probe key chain is now the server's key ref, then remote.DefaultKeyPath() (the chain the deploy uses). The ops preflight checks only the compose file the ops push ships (DeployViaSsh copies one file), not the project's plugin fragments. Tests: TestArchProbeKeyMatchesDeployKey, TestOpsPreflight_ChecksOnlyShippedCompose.
3. doctor VECTOR-SEARCH trusted the desired inference flag. false from config now counts only when the running Hasura container confirms it (docker inspect, new database.HasuraContainerEnvValue). If the container still infers, has no flag, or cannot be inspected, the audit runs as inferred (fail closed). Test: TestVectorSearchChecksLive covers the confirmed case and the three unconfirmed cases (docker is stubbed).
4. Machine Exposure ignored flag-level JSON overrides. New cmdregistry.EffectiveJSON(cmd, set) (none over legacy over envelope). Exposure refuses a command whose set flags move json away from envelope. A flag cannot make a non-envelope command exposed. Test: TestExposureRefusesFlagJSONOverride.
5. Installed-plugin JSON intent lost on proxy start failure. Installed mounts parse no flags, so --json was never recorded and a missing plugin binary failed as plain text. guardedPre now records the invocation from the forwarded args (output.JSONRequestedFromArgs) for installed mounts, so report emits the error envelope. Nothing is refused there; the plugin owns its output. Test: TestMountProxyFailureKeepsJSONIntent.

Checks run

• go build ./...: ok
• go vet on cmd, controlplane, doctor, invoke, cmdregistry, database: clean
• gofmt -l cmd internal: clean
• go test ./cmd/... ./internal/controlplane/... ./internal/doctor/... ./internal/invoke/... ./internal/cmdregistry/... ./internal/database/... ./internal/plugin/... -count=1: all ok, no failures
• Fail-before-fix was checked by reverting the fix file for the D-0830, D-0863, ops compose-set, Exposure and installed-plugin tests; each failed on the old code. The AI gate and arch key tests exercise new signatures/helpers, so they do not compile against the old code; the VECTOR-SEARCH change was not reverted and re-run.
• golangci-lint is not installed on this worker, so it was not run.

🤖 Generated with Claude Code

[acamarata]

Fixed the review finding (bf978b9): buildMachineRegistry now mounts disabled builtin families for the build, as buildRegistry does (D-0863), so NSELF_V15=1 nself mcp starts after remove admin. Added TestDisabledBuiltinFamilyKeepsMachineRegistry. It fails on the previous head with the unresolved admin entries and passes now. The Machine|MCP|Registry|Invoke|Disabled tests in cmd/commands, gofmt and vet are clean. I didn't run the full module or lint, and I didn't re-check the five tests you said fail against the baseline.

[acamarata]

Rebased onto origin/main and fixed the two ratchet failures that remained (no ratchet loosened): TestDockerFunnel (internal/database/hasura_container_env.go shelled out to docker inspect; it now reads the env through docker.InspectContainer) and TestFileSizeBudgetNotExceeded (cmd/commands/invocation.go was 317 lines; guardedPre and the installed-command entry moved to invocation_installed.go, 290 lines). Both ratchet tests failed on the rebased head and pass now; repoqa, database, doctor and cmd/commands pass. TestSoftCancelSendsTerm in internal/docker failed once under full-suite load and passes alone; it is a timing flake, untouched.

[acamarata]

Rebased again onto current origin/main (39b7e8a), force-pushed as 57503c1. go build, go vet and go test ./... all pass locally, including the ratchets (nginx call sites, docker funnel allowlist, 300-line budget, panic baseline). No ratchet loosened, no source change needed beyond the rebase. The 'zsh: no matches found ... log*.log' line in the gate output is a glob failure on the gate host, not a Go test result. Once on the old head I saw internal/docker TestSoftCancelSendsTerm fail under full-suite load (200ms bound plus a shell trap); it passes alone and 40x under CPU load, this PR does not touch that package, so I left it as a known timing flake.