test(setup): add patch-missing ablation controls across all layouts

Adds a `patch_missing` ablation (new `patchset: none` — no `.socket/`
fixture committed) to the single, workspace and monorepo scenario sets,
complementing the existing setup-not-run controls. Together they are the
controls that confirm `setup` is correct: each is identical to the
corresponding `*_with_setup` case except for the single removed factor
(the setup step, or the committed patch), and each must run UNPATCHED.

So every "it applies" case is now flanked by both ablations, e.g. for
single npm:
  baseline_with_setup  -> applied   (patch + setup)
  no_setup_control     -> unpatched (setup ablated)
  patch_missing        -> unpatched (patch ablated)

`run-case.sh` skips the fixture entirely for `patchset: none` (so the
hook's apply finds no manifest and no-ops — distinct from `empty`, where
the manifest exists but lists zero patches). No orchestrator/Rust changes
needed; the scenarios are data-driven and picked up automatically.

Matrix grows to 114 cases. Verified in Docker (3.3.0): all 22
patch_missing cases pass (run unpatched) — single 16/16, workspace 5/5,
monorepo 1/1; with_setup cases still apply; 0 regressions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

tests/setup_matrix/README.md

@@ -37,11 +37,18 @@ wrappers).
   hatch · cargo · bundler · go · mvn · composer · dotnet · deno.
 - **Scenarios (single-project):**
   - `baseline_with_setup` — setup + install ⇒ patch applied *(ideal)*.
-  - `no_setup_control` — install only ⇒ NOT applied *(the hook is the cause)*.
-  - `empty_patchset` — empty manifest ⇒ NOT applied.
+  - `no_setup_control` — **ablation (setup not run)**: install only ⇒ NOT applied *(the hook is the cause)*.
+  - `patch_missing` — **ablation (patch missing)**: setup runs and the hook fires, but no `.socket/` patch set is committed ⇒ runs UNPATCHED *(the committed patch is the cause)*.
+  - `empty_patchset` — manifest present but with zero patches ⇒ NOT applied.
   - `wrong_target_patchset` — manifest targets a different package ⇒ NOT applied.
   - `alt_content_patchset` — a second patch set ⇒ its marker applied *(content tracks the manifest)*.
 
+  The two **ablations** are the controls that confirm `setup` is correct:
+  each is identical to `baseline_with_setup` except for the single removed
+  factor (the setup step, or the committed patch), and each must run
+  unpatched. The workspace and monorepo layouts carry the same pair
+  (`*_no_setup`, `*_patch_missing`).
+
 ## Layouts
 
 The driver's `SM_LAYOUT` selects the project shape (each layout has its
@@ -57,15 +64,15 @@ own `*_targets` / `*_scenarios` sections in `matrix.json`):
   dependency hoists / lands in the pnpm store and is patched once) and
   **pip** (nested `requirements.txt` files) + **uv** (uv workspace, one
   shared `.venv`) as Python gaps. Scenarios: `workspace_with_setup`,
-  `workspace_no_setup`.
+  `workspace_no_setup`, `workspace_patch_missing`.
 - **`monorepo`** — a **polyglot all-ecosystem repo**: an npm workspace
   alongside python/rust/go/php/ruby/nuget/deno manifests. Confirms `setup`
   works in a mixed environment — it must configure the npm hooks and
   **not choke** on the foreign manifests; a root `npm install` then
   patches the npm slice. Runs in the npm image (the only one with the npm
   toolchain), so the foreign manifests are present to test setup's
   robustness, not installed. Scenarios: `monorepo_with_setup`,
-  `monorepo_no_setup`.
+  `monorepo_no_setup`, `monorepo_patch_missing`.
 
 > Real-world wiring note surfaced by the workspace layout: the install
 > hook's `apply` must run with the package manager's per-script cwd (root

tests/setup_matrix/matrix.json

@@ -55,6 +55,13 @@
       "patchset": "alt",
       "expect_applied": true,
       "description": "Different patch set: a second fixture whose blob carries the ALT marker. Proves the applied bytes track the active manifest (alt marker present, primary marker absent)."
+    },
+    {
+      "id": "patch_missing",
+      "run_setup": true,
+      "patchset": "none",
+      "expect_applied": false,
+      "description": "Ablation: setup runs and the install hook fires, but NO patch set is committed (no .socket/). The install must run UNPATCHED — proving the committed patch is what changes the code, not setup/install alone."
     }
   ],
 
@@ -189,7 +196,14 @@
       "run_setup": false,
       "patchset": "primary",
       "expect_applied": false,
-      "description": "Negative control: workspace install without setup must NOT apply."
+      "description": "Ablation (setup not run): workspace install without setup must NOT apply — the hook is the cause."
+    },
+    {
+      "id": "workspace_patch_missing",
+      "run_setup": true,
+      "patchset": "none",
+      "expect_applied": false,
+      "description": "Ablation (patch missing): workspace setup + install with NO committed patch set must run unpatched across the workspace."
     }
   ],
   "workspace_targets": [
@@ -246,7 +260,14 @@
       "run_setup": false,
       "patchset": "primary",
       "expect_applied": false,
-      "description": "Negative control: polyglot monorepo install without setup must NOT apply."
+      "description": "Ablation (setup not run): polyglot monorepo install without setup must NOT apply."
+    },
+    {
+      "id": "monorepo_patch_missing",
+      "run_setup": true,
+      "patchset": "none",
+      "expect_applied": false,
+      "description": "Ablation (patch missing): polyglot monorepo setup + install with NO committed patch set must run unpatched."
     }
   ],
   "monorepo_targets": [

tests/setup_matrix/run-case.sh

@@ -153,6 +153,14 @@ EOF
 }
 
 build_fixture() {
+  # Ablation: no patch set committed at all (no .socket/). Even with a
+  # working install hook, apply finds no manifest and no-ops, so the
+  # install must run unpatched. Distinct from `empty` (manifest present
+  # but with zero patches).
+  if [ "$SM_PATCHSET" = none ]; then
+    note "no patch fixture committed (ablation: patch missing)"
+    return
+  fi
   mkdir -p .socket/blobs
   case "$SM_PATCHSET" in
     empty)