bug: let explicit negative lifecycle flags override configuration

[codeforester]

Problem

An explicit --no-debug or --no-keep-temp cannot turn off a true configuration value. Runtime merging uses boolean OR and loses the distinction between an omitted flag and an explicitly supplied false. This can keep diagnostic/temp data against the caller's explicit request.

Verified evidence

Reviewed on 2026-09-17 at 2d67cd24e8d704386f2be7d3a41addc06fb81e17 (local checkout matched GitHub main). Reproduced in isolated macOS environments with Python 3.14.6. Framework default probe environment: Click 8.5.0 and Typer 0.27.2. Demo probes used released base-cli 0.4.3 unless noted.

Configured log_level: debug and keep_temp: true, with LifecycleOption("--debug/--no-debug") and LifecycleOption("--keep-temp/--no-keep-temp"). Invoked with both negative flags:

exit 0
get_lifecycle_values(): debug=False, keep_temp=False
Context: debug=True, keep_temp=True

The parser resolves the options correctly; _create_context() re-enables both through OR merging. README promises lifecycle command-line options take precedence over file configuration.

Sources:

• lib/python/base_cli/_app_core.py
• lib/python/base_cli/_lifecycle_install.py
• lib/python/base_cli/lifecycle_options.py
• README.md

Acceptance criteria

• Preserve parameter-source/presence information through the configuration merge so explicit false overrides configured true.
• Keep configuration fallback when a flag is genuinely omitted; specify precedence for envvar/default_map/callable defaults.
• Cover positive/negative and root/leaf overrides in native and attached commands.
• Assert effective Context values, user-facing debug behavior, run preserve metadata and actual temp cleanup, not only parsed LifecycleValues.

Related work

Related to configuration separation delivered in #264; distinct from the log-level filtering defect.

Project fields

• Status: Backlog
• Priority: P1
• Area: CLI
• Initiative: v1.0 Readiness
• Size: M
• Assignee: @codeforester
• Milestone: v1.0.0
• Target date: unscheduled