fix(cli): plugin doctor validates the registry against itself, so registry drift reports healthy while the durable layer never loads

[rickylabs]

Summary

netscript plugin doctor validates the generated plugin registry against itself, so a registry
that is stale relative to the source tree passes green. A saga or job authored after the last
generate plugins is absent from the registry, is never loaded at runtime, and doctor still reports
healthy and "every declared saga is registered".

Registry drift is not a hypothetical failure mode: in Wave 7 run 2 it silently removed the product's
entire durable layer, and doctor reported healthy throughout.

Evidence

Wave 7 run 2 (Gemini 3.7 Flash, NetScript 0.0.6, product rickylabs/w7-workflow-builder-gemini
@ 00a0add), independently verified by the run's evaluator, who reproduced the behaviour and
reverted its change afterwards:

• netscript generate plugins ran once at 05:30:46.
• The saga definition and the worker job were written at 05:33 and 05:34 — after it.
• generate plugins was never re-run. Both definitions are absent from the generated registries.
• Consequently, at runtime: saga_instances, saga_runtime_state, saga_execution_history,
  job_definitions, trigger_definitions and trigger_events are all 0 rows across 18 runs.
• netscript plugin doctor nevertheless reported healthy, including an explicit "every declared
  saga is registered" style assurance.

The check is self-referential: it enumerates what the registry declares and confirms the registry
declares it. Nothing compares the registry against the source tree that was supposed to produce it.

Why this matters more than an ordinary doctor bug

doctor is the command an agent or a developer runs to find out whether the durable layer is wired.
It is the designated escape hatch from exactly this class of mistake, and here it actively confirms
the broken state. Wave 7's two runs both shipped a durable layer that never executed; run 1 through
the saga-publisher fallback (#1365) and run 2 through registry drift. In both cases every available
green signal agreed the system was fine.

Target contract

• plugin doctor compares the generated registry against the source tree, not against itself:
  every saga/job/trigger/stream definition discoverable in the workspace must appear in the registry.
• A definition present in source and absent from the registry is a failure, naming the file and
  the command that would fix it (netscript generate plugins).
• The reverse — a registry entry with no backing source — is also reported.
• The check states what it actually verified, so "healthy" cannot be read as a stronger claim than
  the evidence supports.
• Regression coverage: author a saga after generate plugins, do not regenerate, and assert doctor
  goes red. This test must fail against today's implementation.

Boundaries

Distinct from #1366 (declareHealthChecks returning only the API resource) and from the closed #1574
(package-backed plugin version truthfulness). Related to #1365 in consequence — both let a
never-executing durable layer report success — but the mechanism is different and neither fix
addresses the other.

Provenance

Wave 7 run 2 evaluator pack:
agent-posts/wave-7/runs/workflow-builder-gemini-3.7-flash-0.0.6/. Filed 2026-08-17.