MergeSettings: root-level settings.user.json is silently ignored (user-overlay path footgun)

[dactylmedia]

Observed on v6.0.5.

Setup: the SessionStart maintenance hook merges settings via MergeSettings.ts --system <root>/settings.system.json --user <root>/LIFEOS/USER/CONFIG/settings.user.json --output <root>/settings.json.

Footgun: a settings.user.json placed at the CONFIG ROOT (~/.claude/settings.user.json) is never read by the merge. Because MergeSettings no-ops cleanly when its --user input is absent (the fresh-install guard), the merged settings.json silently stays pure system half with no warning. In our case an entire overlay (7 permission deny rules, 100 allow entries, 14 hook registrations) was inert for days: sessions ran with none of the user's deny rules or hooks, and nothing surfaced it. The root location is a natural-but-wrong guess since settings.system.json and the generated settings.json both live at the root.

Suggestions:

1. If <configRoot>/settings.user.json exists and differs from the canonical LIFEOS/USER/CONFIG/settings.user.json, print a loud warning at merge time (or refuse).
2. Document in ConfigSystem.md that plain arrays in the user overlay REPLACE system arrays, and that additive intent requires the {"__merge": "append", "values": [...]} annotation. A user hand-porting deny rules will otherwise either lose their rules (wrong path) or clobber the system's (right path, plain array).

[danielmiessler]

Both suggestions ported. MergeSettings now warns loudly when a root-level settings.user.json exists — and the check runs before the fresh-install no-op guard, since canonical-absent-plus-root-stray-present is exactly your case. ConfigSystem.md now documents that plain arrays REPLACE and that additive intent needs {"__merge": "append", "values": [...]}. Verified by planting a stray and watching the warning fire. Credited at the fix site; ships in the next release.