docs: AGENTS.md + evidence-backed scaffold (state, trials, decisions, handoff)

- AGENTS.md operating rules incl. Gitea SSH port-2222 note + known_hosts incident
- CURRENT_STATE / TODO / CHANGELOG / TRIALS
- trials: endpoint-key pairing; config-merge safety matrix 14/14 (verify.sh + output)
- docs: DECISIONS (mcode 0.6.12 bundle facts, digest-pinned), FEATURE-MATRIX, PROJECT-HANDOFF
- handoffs: TEMPLATE + 2026-10-19 initial-install record

trials/config-merge-safety-2026-10-19/verify.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Trial: config-merge safety matrix for install.sh
+#
+# Re-runnable acceptance check for the ~/.minimax/config.yaml surgery:
+# fresh create, idempotency, backup-before-change, byte preservation,
+# duplicate-structure refusal, piped/embedded install, uninstall.
+#
+# Usage: bash verify.sh            (from anywhere; uses mktemp sandboxes)
+# Exit 0 when every check passes.
+set -u
+export LC_ALL=C
+REPO="$(cd "$(dirname "$0")/../.." && pwd)"
+pass=0; fail=0
+ok(){ if [ "$2" = "0" ]; then pass=$((pass+1)); printf 'PASS %s\n' "$1"; else fail=$((fail+1)); printf 'FAIL %s\n' "$1"; fi; }
+
+# S1 fresh install: creates tui block, 0600
+T1=$(mktemp -d); HOME=$T1 bash "$REPO/install.sh" >"$T1.log" 2>&1; ok "S1 fresh-install rc" $?
+grep -q created-tui "$T1.log"; ok "S1 created-tui message" $?
+[ "$(stat -c '%a' "$T1/.minimax/config.yaml" 2>/dev/null)" = 600 ]; ok "S1 new config mode 0600" $?
+ls "$T1"/.minimax/config.yaml.tmp.* >/dev/null 2>&1; [ $? -ne 0 ]; ok "S1 no tmp leftovers" $?
+
+# S2 idempotent rerun
+HOME=$T1 bash "$REPO/install.sh" >"$T1.b.log" 2>&1
+grep -q already-configured "$T1.b.log"; ok "S2 idempotent rerun" $?
+
+# S3 existing config: update in place, backup == pre-merge original
+T2=$(mktemp -d); mkdir -p "$T2/.minimax"
+printf 'logLevel: info\nprovider:\n  x:\n    apiKey: keepme\ntui:\n  statusLine:\n    - current-dir\n  customStatusLine:\n    command: /old/path\n    intervalSeconds: 30\n' > "$T2/.minimax/config.yaml"
+cp "$T2/.minimax/config.yaml" "$T2/orig.yaml"
+HOME=$T2 bash "$REPO/install.sh" >"$T2.log" 2>&1; ok "S3 update rc" $?
+cmp -s "$(ls -t "$T2"/.minimax/config.yaml.bak.* | head -1)" "$T2/orig.yaml"; ok "S3 backup equals pre-merge original" $?
+grep -q "apiKey: keepme" "$T2/.minimax/config.yaml" && grep -q "colorMode: ansi" "$T2/.minimax/config.yaml"; ok "S3 provider intact + keys updated" $?
+
+# S4 duplicate top-level tui blocks: refuse, file untouched
+T3=$(mktemp -d); mkdir -p "$T3/.minimax"
+printf 'a: 1\ntui:\n  statusLine:\n    - current-dir\nb: 2\ntui:\n  statusLine:\n    - model\nc: 3\n' > "$T3/.minimax/config.yaml"
+cp "$T3/.minimax/config.yaml" "$T3/orig.yaml"
+HOME=$T3 bash "$REPO/install.sh" >"$T3.log" 2>&1; [ $? -ne 0 ]; ok "S4 duplicate-tui refused" $?
+cmp -s "$T3/.minimax/config.yaml" "$T3/orig.yaml"; ok "S4 file untouched on refusal" $?
+grep -q merge-refused "$T3.log"; ok "S4 refusal reason reported" $?
+
+# S5 piped/embedded install (only install.sh present) -> embedded == zai-usage.sh
+T4=$(mktemp -d); cp "$REPO/install.sh" "$T4/"
+HOME=$T4 bash "$T4/install.sh" >"$T4.log" 2>&1
+cmp -s "$T4/.local/bin/mcode-zai-usage" "$REPO/zai-usage.sh"; ok "S5 embedded copy identical" $?
+
+# S6 uninstall: removes keys, keeps other items
+HOME=$T2 bash "$REPO/install.sh" --uninstall >"$T2.u.log" 2>&1; ok "S6 uninstall rc" $?
+! grep -q customStatusLine "$T2/.minimax/config.yaml" && ! grep -q custom-command "$T2/.minimax/config.yaml" && grep -q "current-dir" "$T2/.minimax/config.yaml"; ok "S6 keys removed, items kept" $?
+
+printf '== %s passed, %s failed ==\n' "$pass" "$fail"
+rm -rf "$T1" "$T2" "$T3" "$T4"
+[ "$fail" -eq 0 ]