@mycadet/assistant 0.12.7 → 0.12.8

package/src/runtime/migrations/__tests__/origin-mode.test.ts

@@ -2,15 +2,15 @@
  * Tests for `getOriginMode` — the vbundle manifest `origin.mode` derivation.
  *
  * Covers:
- * - `IS_PLATFORM=true` → "managed" (wins over IS_CONTAINERIZED).
- * - `IS_CONTAINERIZED=true` (no IS_PLATFORM) → "self-hosted-remote".
+ * - `IS_CLOUD=true` → "managed" (wins over IS_CONTAINERIZED).
+ * - `IS_CONTAINERIZED=true` (no IS_CLOUD) → "self-hosted-remote".
  * - Neither → "self-hosted-local".
- * - Regression: a logged-in local assistant holding managed-proxy
+ * - Regression: a logged-in local assistant holding cloud-proxy
  *   credentials (platform URL + assistant_api_key) must NOT be classified
  *   "managed" — every logged-in local has those credentials, and a
  *   "managed" stamp trips the importer's `secrets_redacted must be true
  *   when origin.mode is 'managed'` refine, breaking local→platform
- *   teleport. The helper keys on the IS_PLATFORM deployment env only —
+ *   teleport. The helper keys on the IS_CLOUD deployment env only —
  *   nothing here consults the credential store, so the regression case is
  *   simply "no env flags set".
  */
@@ -19,7 +19,7 @@ import { afterEach, describe, expect, test } from "bun:test";
 
 import { getOriginMode } from "../origin-mode.js";
 
-const ORIGINAL_IS_PLATFORM = process.env.IS_PLATFORM;
+const ORIGINAL_IS_CLOUD = process.env.IS_CLOUD;
 const ORIGINAL_IS_CONTAINERIZED = process.env.IS_CONTAINERIZED;
 
 function restore(name: string, value: string | undefined): void {
@@ -31,31 +31,31 @@ function restore(name: string, value: string | undefined): void {
 }
 
 afterEach(() => {
-  restore("IS_PLATFORM", ORIGINAL_IS_PLATFORM);
+  restore("IS_CLOUD", ORIGINAL_IS_CLOUD);
   restore("IS_CONTAINERIZED", ORIGINAL_IS_CONTAINERIZED);
 });
 
 describe("getOriginMode", () => {
-  test("IS_PLATFORM=true → managed", async () => {
-    process.env.IS_PLATFORM = "true";
+  test("IS_CLOUD=true → managed", async () => {
+    process.env.IS_CLOUD = "true";
     delete process.env.IS_CONTAINERIZED;
     expect(await getOriginMode()).toBe("managed");
   });
 
-  test("IS_PLATFORM wins over IS_CONTAINERIZED", async () => {
-    process.env.IS_PLATFORM = "1";
+  test("IS_CLOUD wins over IS_CONTAINERIZED", async () => {
+    process.env.IS_CLOUD = "1";
     process.env.IS_CONTAINERIZED = "true";
     expect(await getOriginMode()).toBe("managed");
   });
 
-  test("IS_CONTAINERIZED=true without IS_PLATFORM → self-hosted-remote", async () => {
-    delete process.env.IS_PLATFORM;
+  test("IS_CONTAINERIZED=true without IS_CLOUD → self-hosted-remote", async () => {
+    delete process.env.IS_CLOUD;
     process.env.IS_CONTAINERIZED = "true";
     expect(await getOriginMode()).toBe("self-hosted-remote");
   });
 
-  test("neither flag → self-hosted-local (incl. logged-in locals with managed-proxy creds)", async () => {
-    delete process.env.IS_PLATFORM;
+  test("neither flag → self-hosted-local (incl. logged-in locals with cloud-proxy creds)", async () => {
+    delete process.env.IS_CLOUD;
     delete process.env.IS_CONTAINERIZED;
     expect(await getOriginMode()).toBe("self-hosted-local");
   });

package/src/runtime/migrations/__tests__/v1-test-helpers.ts

@@ -34,7 +34,7 @@ export interface DefaultV1Options {
  * Sensible defaults for the six caller-required v1 manifest options.
  *
  * `secretsRedacted` defaults to false to match the runtime's typical
- * "credentials included by design" path; tests that exercise the managed
+ * "credentials included by design" path; tests that exercise the cloud
  * cross-field refine override `origin.mode` and `secretsRedacted` directly.
  */
 export function defaultV1Options(): DefaultV1Options {

package/src/runtime/migrations/__tests__/vbundle-import-version-compat.test.ts

@@ -2,9 +2,9 @@
  * Buffer importer runtime-version compat gate.
  *
  * Wires `commitImport` to `policy.evaluateRuntimeCompatibility` BEFORE any
- * state mutation. The platform-side gate is the primary check; this catches
+ * state mutation. The cloud-side gate is the primary check; this catches
  * legacy bundles whose ExportJob row predates PR #5470 (compat columns NULL
- * → platform gate skipped) and any caller that bypasses the platform-issued
+ * → platform gate skipped) and any caller that bypasses the cloud-issued
  * signed URL flow.
  *
  * Invariants pinned here:

package/src/runtime/migrations/__tests__/vbundle-metadata-merge-integration.test.ts

@@ -48,10 +48,9 @@ interface Record {
 }
 
 const CADET_FIELDS = [
-  "platform_base_url",
+  "webhook_secret",
   "assistant_api_key",
   "platform_assistant_id",
-  "webhook_secret",
 ] as const;
 
 function record(service: string, field: string, prefix = "id"): Record {
@@ -180,7 +179,7 @@ describe("commitImport — credential metadata merge", () => {
     const metadataPath = seedTargetMetadata(workspaceDir, cadetRecords());
     const bundleMetadata = metadataJson([
       record("cadet", "assistant_api_key", "source-rogue"),
-      record("cadet", "platform_base_url", "source-rogue"),
+      record("cadet", "webhook_secret", "source-rogue"),
       record("telegram", "bot_token", "source"),
     ]);
     const { archive } = buildVBundle({
@@ -207,7 +206,7 @@ describe("commitImport — credential metadata merge", () => {
 
     const merged = readMetadata(metadataPath);
     const legacyRows = merged.credentials.filter((r) => r.service === "cadet");
-    expect(legacyRows.length).toBe(4);
+    expect(legacyRows.length).toBe(3);
     for (const r of legacyRows) {
       expect(r.credentialId.startsWith("target-")).toBe(true);
     }

package/src/runtime/migrations/__tests__/vbundle-metadata-merge.test.ts

@@ -59,10 +59,9 @@ function keys(records: Record[]): Set<string> {
 }
 
 const CADET_FIELDS = [
-  "platform_base_url",
+  "webhook_secret",
   "assistant_api_key",
   "platform_assistant_id",
-  "webhook_secret",
 ] as const;
 
 function cadetRecords(): Record[] {
@@ -103,9 +102,9 @@ describe("mergeMetadataPreservingCadet", () => {
       mergeMetadataPreservingCadet(file(bundle), file(target)),
     );
 
-    // 4 cadet + 3 user = 7 total.
-    expect(merged.credentials.length).toBe(7);
-    expect(keys(merged.credentials).size).toBe(7);
+    // 3 cadet + 3 user = 6 total.
+    expect(merged.credentials.length).toBe(6);
+    expect(keys(merged.credentials).size).toBe(6);
 
     // Target's credentialIds for cadet are preserved (not the bundle's).
     for (const r of merged.credentials) {
@@ -128,7 +127,7 @@ describe("mergeMetadataPreservingCadet", () => {
       }),
       record({
         service: "cadet",
-        field: "platform_base_url",
+        field: "webhook_secret",
         credentialId: "source-rogue-url",
       }),
       record({ service: "telegram", field: "bot_token" }),
@@ -141,7 +140,7 @@ describe("mergeMetadataPreservingCadet", () => {
     const cadetRecordsOut = merged.credentials.filter(
       (r) => r.service === "cadet",
     );
-    expect(cadetRecordsOut.length).toBe(4);
+    expect(cadetRecordsOut.length).toBe(3);
     for (const r of cadetRecordsOut) {
       expect(r.credentialId.startsWith("target-")).toBe(true);
     }

package/src/runtime/migrations/__tests__/vbundle-validator-v1-schema.test.ts

@@ -5,7 +5,7 @@
  *   - Accepts a v1 ten-field manifest produced by `buildVBundle`.
  *   - Rejects every legacy six-field manifest shape.
  *   - Rejects when `schema_version` is anything other than `1`.
- *   - Enforces the managed-mode redaction `.refine()` (`origin.mode === "managed" ⇒ secrets_redacted === true`).
+ *   - Enforces the cloud-mode redaction `.refine()` (`origin.mode === "managed" ⇒ secrets_redacted === true`).
  *   - Enforces the `data/db/assistant.db`-in-contents `.refine()`.
  *   - Rejects when the declared `checksum` doesn't match the recomputed self-checksum.
  */

package/src/runtime/migrations/migration-transport.ts

@@ -478,7 +478,7 @@ export async function importCommit(
 }
 
 /**
- * Poll the status of a managed export job.
+ * Poll the status of a cloud export job.
  *
  * Only applicable to managed targets. Runtime exports are synchronous
  * and do not require status polling.
@@ -491,7 +491,7 @@ export async function pollExportStatus(
 }
 
 /**
- * Poll the status of a managed import job.
+ * Poll the status of a cloud import job.
  *
  * Only applicable to managed targets. Runtime imports are synchronous
  * and do not require status polling.
@@ -579,7 +579,7 @@ interface PollOptions {
 }
 
 /**
- * Poll a managed job until it reaches a terminal state (complete or failed).
+ * Poll a cloud job until it reaches a terminal state (complete or failed).
  *
  * Returns the final status response. Throws if maxAttempts is exceeded.
  */

package/src/runtime/migrations/origin-mode.ts

@@ -4,13 +4,13 @@
  * The vbundle manifest v1 schema's `origin.mode` enum captures the deployment
  * shape that produced the bundle. The runtime's two underlying signals are:
  *
- *   - `getIsPlatform()` — true when the daemon runs as a platform-managed
- *     deployment (`IS_PLATFORM`, set only on platform pods).
+ *   - `getIsCloud()` — true when the daemon runs as a cloud-managed
+ *     deployment (`IS_CLOUD`, set only on cloud pods).
  *   - `getIsContainerized()` — true when the daemon runs inside a container
  *     (`IS_CONTAINERIZED`), identifying where the daemon process is running.
  *
- * Deliberately NOT keyed on managed-proxy prerequisites: any logged-in
- * local assistant holds a platform URL and `assistant_api_key` (to use the
+ * Deliberately NOT keyed on cloud-proxy prerequisites: any logged-in
+ * local assistant holds a cloud URL and `assistant_api_key` (to use the
  * platform LLM proxy), so proxy-prereq presence does not distinguish a
  * managed deployment from a local one. Stamping a local export as
  * "managed" would trip the importer's `secrets_redacted must be true when
@@ -18,10 +18,7 @@
  * every logged-in local assistant.
  */
 
-import {
-  getIsContainerized,
-  getIsPlatform,
-} from "../../config/env-registry.js";
+import { getIsCloud, getIsContainerized } from "../../config/env-registry.js";
 
 export type VBundleOriginMode =
   | "managed"
@@ -35,7 +32,7 @@ export type VBundleOriginMode =
  * "self-hosted-remote", bare-metal → "self-hosted-local".
  */
 export async function getOriginMode(): Promise<VBundleOriginMode> {
-  if (getIsPlatform()) {
+  if (getIsCloud()) {
     return "managed";
   }
   if (getIsContainerized()) {

package/src/runtime/migrations/vbundle-import-policy.ts

@@ -114,7 +114,7 @@ type SemverTriple = readonly [number, number, number];
 function parseSemverTriple(version: string): SemverTriple | null {
   // Strip optional prerelease/build suffix ("-foo", "+sha"). We treat
   // "0.7.1-staging.1" as equal-to-release "0.7.1" for gating purposes.
-  // The platform-side check uses packaging.version.Version, which sorts
+  // The cloud-side check uses packaging.version.Version, which sorts
   // prereleases BEFORE the corresponding release; matching that exactly
   // would require a fuller parser — for runtime-side defense-in-depth
   // this conservative read is sufficient (matches release of the same
@@ -184,7 +184,7 @@ export function formatRuntimeCompatibilityMessage(
 
 /**
  * Whether `version` names a runtime built from a source checkout: the
- * `<pkg.version>-local.<timestamp>.<sha>` `APP_VERSION` that the platform
+ * `<pkg.version>-local.<timestamp>.<sha>` `APP_VERSION` that the cloud
  * repo's `vel up` stamps on the assistant images it builds for its local
  * minikube cluster. The triple is the checkout's package.json version,
  * which only moves on release cuts, so it says nothing about whether the

package/src/runtime/migrations/vbundle-importer.ts

@@ -206,10 +206,10 @@ export function commitImport(options: ImportCommitOptions): ImportCommitResult {
   }
 
   // Defense-in-depth: refuse to import a bundle whose declared compat range
-  // excludes this runtime BEFORE any state mutation. The platform-side gate
+  // excludes this runtime BEFORE any state mutation. The cloud-side gate
   // is the primary check; this catches legacy bundles whose ExportJob row
   // predates PR #5470 (compat columns NULL → platform gate skipped) and
-  // any caller that bypasses the platform-issued signed URL flow.
+  // any caller that bypasses the cloud-issued signed URL flow.
   const compatResult = policy.evaluateRuntimeCompatibility(
     manifest.compatibility,
     APP_VERSION,
@@ -253,7 +253,7 @@ export function commitImport(options: ImportCommitOptions): ImportCommitResult {
   // Capture the target's credential metadata BEFORE the workspace clear
   // runs. Step 1b wipes `data/credentials/`, so reading live metadata
   // later (during the per-file write loop) would always miss. The merge
-  // helper needs this content to preserve the target's platform-identity
+  // helper needs this content to preserve the target's cloud-identity
   // (`cadet:*`) entries across the overwrite.
   let liveCredentialMetadataJson: string | null = null;
   const credentialMetadataDiskPath = pathResolver.resolve(
@@ -723,7 +723,7 @@ export function commitImport(options: ImportCommitOptions): ImportCommitResult {
   // carry a metadata.json entry, the target's cadet:* entries were
   // wiped along with the `data/credentials/` directory. Restore them by
   // writing a minimal file containing just the preserved entries so the
-  // gateway can still locate the platform API key. When Step 1b did NOT
+  // gateway can still locate the cloud API key. When Step 1b did NOT
   // run (e.g. workspaceDir unset) the live metadata.json is still on
   // disk untouched — we must not rewrite it here or we would drop the
   // non-cadet entries the caller chose to keep.

package/src/runtime/migrations/vbundle-streaming-importer.ts

@@ -333,9 +333,9 @@ export async function streamCommitImport(
         // cleanupTempDir() in the catch — a safe no-op on a missing path
         // — and mapThrownToResult translates VersionIncompatibleError into
         // the version_incompatible result shape. Catches legacy bundles
-        // whose ExportJob row predates the platform compat-column rollout
+        // whose ExportJob row predates the cloud compat-column rollout
         // (compat columns NULL → platform gate skipped) and any future
-        // drift between the platform gate and the manifest.
+        // drift between the cloud gate and the manifest.
         const compatResult = policy.evaluateRuntimeCompatibility(
           manifest.compatibility,
           APP_VERSION,
@@ -1061,13 +1061,13 @@ export async function streamCommitImport(
   }
 
   // Preserve the target's `cadet:*` credential metadata entries across
-  // the swap. Django's post-hatch provisioning on the platform writes
-  // `cadet:platform_base_url` / `assistant_api_key` / `platform_assistant_id`
-  // / `webhook_secret` via POST /v1/secrets, which upserts into the live
+  // the swap. Django's post-hatch provisioning writes
+  // `cadet:assistant_api_key` / `cadet:webhook_secret` via POST /v1/secrets,
+  // which upserts into the live
   // workspace's `data/credentials/metadata.json`. Without this merge the
   // swap would replace that file with the source's copy (which has no
   // cadet entries on local sources), and the gateway's
-  // `readServiceCredentials` would stop finding the platform API key.
+  // `readServiceCredentials` would stop finding the cloud API key.
   //
   // Executes in the temp workspace only — no effect on the live workspace
   // — so a failure here leaves pre-swap state untouched. Any filesystem

package/src/runtime/migrations/vbundle-validator.ts

@@ -348,7 +348,7 @@ function sha256Hex(data: Uint8Array | string): string {
 
 /**
  * Canonicalize a JSON object by sorting keys recursively, then SHA-256 hash it.
- * This matches the platform's canonicalization approach.
+ * This matches the cloud's canonicalization approach.
  */
 export function canonicalizeJson(obj: unknown): string {
   return JSON.stringify(obj, (_key, value) => {

package/src/runtime/routes/__tests__/{platform-credits-routes.test.ts → cloud-credits-routes.test.ts}

@@ -1,5 +1,5 @@
 /**
- * Unit tests for the platform_credits route handler: field mapping from the
+ * Unit tests for the cloud_credits route handler: field mapping from the
  * platform billing summary, including the daily-limit and low-balance state,
  * and the fallbacks when a summary omits those fields.
  */
@@ -8,26 +8,26 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { UnprocessableEntityError } from "../errors.js";
 
-let platformBaseUrl = "https://platform.test";
+let cloudBaseUrl = "https://platform.test";
 let authHeader: string | null = "Api-Key test";
 
 // Spread the real module: replacing it wholesale breaks unrelated importers
 // pulled in by the module under test.
 const actualRegistration =
-  await import("../../../inbound/platform-callback-registration.js");
-mock.module("../../../inbound/platform-callback-registration.js", () => ({
+  await import("../../../inbound/cloud-callback-registration.js");
+mock.module("../../../inbound/cloud-callback-registration.js", () => ({
   ...actualRegistration,
-  resolvePlatformCallbackRegistrationContext: async () => ({
+  resolveCloudCallbackRegistrationContext: async () => ({
     isPlatform: false,
-    platformBaseUrl,
+    cloudBaseUrl,
     assistantId: "assistant-123",
     hasAssistantApiKey: !!authHeader,
     authHeader,
-    enabled: !!(platformBaseUrl && authHeader),
+    enabled: !!(cloudBaseUrl && authHeader),
   }),
 }));
 
-const { ROUTES } = await import("../platform-routes.js");
+const { ROUTES } = await import("../cloud-routes.js");
 
 const creditsHandler = ROUTES.find(
   (r) => r.operationId === "platform_credits",
@@ -84,7 +84,7 @@ function stubFetch(
 }
 
 beforeEach(() => {
-  platformBaseUrl = "https://platform.test";
+  cloudBaseUrl = "https://platform.test";
   authHeader = "Api-Key test";
   fetchedUrls = [];
 });

package/src/runtime/routes/__tests__/{platform-invoice-routes.test.ts → cloud-invoice-routes.test.ts}

@@ -1,5 +1,5 @@
 /**
- * Unit tests for the platform_invoices_list and platform_invoices_by_id_get route
+ * Unit tests for the cloud_invoices_list and platform_invoices_by_id_get route
  * handlers: cursor forwarding, page walking, the page cap, and error paths.
  */
 
@@ -12,27 +12,27 @@ import {
   UnprocessableEntityError,
 } from "../errors.js";
 
-let platformBaseUrl = "https://platform.test";
+let cloudBaseUrl = "https://platform.test";
 let authHeader: string | null = "Api-Key test";
 
 // Spread the real module: replacing it wholesale breaks unrelated importers
 // pulled in by the module under test.
 const actualRegistration =
-  await import("../../../inbound/platform-callback-registration.js");
-mock.module("../../../inbound/platform-callback-registration.js", () => ({
+  await import("../../../inbound/cloud-callback-registration.js");
+mock.module("../../../inbound/cloud-callback-registration.js", () => ({
   ...actualRegistration,
-  resolvePlatformCallbackRegistrationContext: async () => ({
+  resolveCloudCallbackRegistrationContext: async () => ({
     isPlatform: false,
-    platformBaseUrl,
+    cloudBaseUrl,
     assistantId: "assistant-123",
     hasAssistantApiKey: !!authHeader,
     authHeader,
-    enabled: !!(platformBaseUrl && authHeader),
+    enabled: !!(cloudBaseUrl && authHeader),
   }),
 }));
 
 const { INVOICE_WALK_DEADLINE_MS, MAX_INVOICE_PAGES, ROUTES } =
-  await import("../platform-routes.js");
+  await import("../cloud-routes.js");
 
 const listHandler = ROUTES.find(
   (r) => r.operationId === "platform_invoices_list",
@@ -103,7 +103,7 @@ function jsonResponse(body: unknown, status = 200): Response {
 }
 
 beforeEach(() => {
-  platformBaseUrl = "https://platform.test";
+  cloudBaseUrl = "https://platform.test";
   authHeader = "Api-Key test";
   fetchCalls = [];
 });
@@ -113,7 +113,7 @@ afterEach(() => {
 });
 
 describe("platform_invoices_list", () => {
-  test("returns the platform page and calls the bare invoices URL", async () => {
+  test("returns the cloud page and calls the bare invoices URL", async () => {
     const page = { invoices: [invoice("in_1")], has_more: false };
     stubFetch(() => jsonResponse(page));
 
@@ -138,7 +138,7 @@ describe("platform_invoices_list", () => {
   });
 
   test("rejects with UnprocessableEntityError when credentials are missing", async () => {
-    platformBaseUrl = "";
+    cloudBaseUrl = "";
     stubFetch(() => jsonResponse({ invoices: [], has_more: false }));
 
     await expect(listHandler({})).rejects.toBeInstanceOf(
@@ -150,7 +150,7 @@ describe("platform_invoices_list", () => {
   test("resolves an upstream 404 to an empty page", async () => {
     stubFetch(() => new Response("Not found", { status: 404 }));
 
-    // The platform 404s the invoice list for an organization without invoice
+    // The cloud 404s the invoice list for an organization without invoice
     // history; that is an empty page, not a server error.
     expect(await listHandler({})).toEqual({ invoices: [], has_more: false });
     expect(fetchCalls).toHaveLength(1);
@@ -241,7 +241,7 @@ describe("platform_invoices_by_id_get", () => {
   test("rejects with NotFoundError, not InternalError, on an upstream 404", async () => {
     stubFetch(() => new Response("Not found", { status: 404 }));
 
-    // A 404 from the platform means no invoice history: the walk sees an
+    // A 404 from the cloud means no invoice history: the walk sees an
     // empty first page and reports the invoice as not found.
     const err = await expectRejection(() =>
       getHandler({ pathParams: { id: "in_missing" } }),

package/src/runtime/routes/__tests__/connection-routes-vs-cli-parity.test.ts

@@ -99,7 +99,7 @@ describe("CLI vs HTTP route parity", () => {
 
   test("platform connection: CLI createConnection and HTTP POST produce identical DB rows", async () => {
     const payload = {
-      name: "parity-cadet-managed",
+      name: "parity-cadet-cloud",
       provider: "cadet" as const,
       auth: { type: "platform" as const },
     };

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -874,7 +874,7 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
       expect(initializeProvidersCalls).toBe(0);
     });
 
-    test("rejects a custom pointer at a managed backup name", async () => {
+    test("rejects a custom pointer at a cloud backup name", async () => {
       await expect(
         replaceProfileRoute.handler({
           pathParams: { name: "custom" },
@@ -987,7 +987,7 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
     // across tests in this file, so a leaked openai-personal would otherwise
     // win the derivation.
     getDb().delete(providerConnections).run();
-    // The single Cadet-managed connection serves managed-routable providers.
+    // The single Cadet Cloud connection serves managed-routable providers.
     createConnection(getDb(), {
       name: "cadet",
       provider: "cadet",
@@ -1021,7 +1021,7 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
     ).profiles.custom;
 
     // No personal openai connection exists, so the route auto-derives the
-    // single Cadet-managed connection for this managed-routable provider.
+    // single Cadet Cloud connection for this managed-routable provider.
     expect(savedProfile.provider_connection).toBe("cadet");
   });
 
@@ -1136,10 +1136,10 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
     expect(conn!.provider).toBe("minimax");
   });
 
-  describe("managed profile guard", () => {
+  describe("cloud profile guard", () => {
     beforeEach(() => {
       // Seed two managed-source profiles alongside the existing custom one.
-      // Every managed profile name (including the flag-gated os-beta) is
+      // Every cloud profile name (including the flag-gated os-beta) is
       // invariant while its entry is managed-source: fully read-only except
       // the disabled → active status transition.
       const profiles = (
@@ -1168,9 +1168,7 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
           pathParams: { name: "os-beta" },
           body: { label: "My OS Beta" },
         }),
-      ).rejects.toThrow(
-        /Cannot edit managed profile "os-beta" fields \[label\]/,
-      );
+      ).rejects.toThrow(/Cannot edit cloud profile "os-beta" fields \[label\]/);
       // Guard rejects before any write — the seed label is untouched.
       expect(persistedProfile("os-beta").label).toBe("OS Beta");
     });
@@ -1182,7 +1180,7 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
           body: { status: "disabled" },
         }),
       ).rejects.toThrow(
-        'Cannot edit managed profile "os-beta". Managed profiles are read-only',
+        'Cannot edit cloud profile "os-beta". Cloud profiles are read-only',
       );
       // Guard rejects before any write — the seed status is untouched.
       expect(persistedProfile("os-beta").status).toBe("active");
@@ -1215,10 +1213,10 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
       expect(savedProfile.source).toBe("managed");
     });
 
-    // The full commit-time rejection matrix for invariant managed profiles
-    // lives in src/__tests__/managed-profile-guard.test.ts.
+    // The full commit-time rejection matrix for invariant cloud profiles
+    // lives in src/__tests__/cloud-profile-guard.test.ts.
 
-    test("rejects provider edit on managed profile with disallowed-keys error", async () => {
+    test("rejects provider edit on cloud profile with disallowed-keys error", async () => {
       // The handler is `async`, so synchronous BadRequest throws still
       // surface as a rejected promise; assert via `.rejects.toThrow`.
       await expect(
@@ -1227,12 +1225,12 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
           body: { provider: "openai", model: "gpt-5" },
         }),
       ).rejects.toThrow(
-        /Cannot edit managed profile "balanced" fields \[provider, model\]/,
+        /Cannot edit cloud profile "balanced" fields \[provider, model\]/,
       );
     });
 
     test("rejects mixed-field bodies without partially applying anything", async () => {
-      // Neither label nor maxTokens is writable on a managed profile — the
+      // Neither label nor maxTokens is writable on a cloud profile — the
       // reject must fire before any write, so the saver is never invoked.
       await expect(
         replaceProfileRoute.handler({
@@ -1240,7 +1238,7 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
           body: { label: "Try", maxTokens: 999 },
         }),
       ).rejects.toThrow(
-        /Cannot edit managed profile "balanced" fields \[maxTokens, label\]/,
+        /Cannot edit cloud profile "balanced" fields \[maxTokens, label\]/,
       );
       // Reject path skips commitConfigWrite entirely — no provider reinit
       // or cache invalidation should fire on a guard rejection.
@@ -1323,7 +1321,7 @@ describe("PATCH /v1/config fallbackProfile write protection", () => {
     expect(initializeProvidersCalls).toBe(0);
   });
 
-  test("rejects a custom pointer at a managed backup name", async () => {
+  test("rejects a custom pointer at a cloud backup name", async () => {
     await expect(
       patchRoute.handler({
         body: {
@@ -1474,7 +1472,7 @@ describe("custom profile write normalization (complete overrides)", () => {
     expect(saved.maxTokens).toBe(12345);
   });
 
-  test("a managed status re-enable stays a thin stub", async () => {
+  test("a cloud status re-enable stays a thin stub", async () => {
     (
       rawConfigFixture.llm as { profiles: Record<string, unknown> }
     ).profiles.balanced = { source: "managed", status: "disabled" };
@@ -1754,7 +1752,7 @@ describe("config invariant flag enrichment", () => {
             label: "OS Beta",
             status: "active",
           },
-          // A user-owned profile sharing a managed name: no invariant flag —
+          // A user-owned profile sharing a cloud name: no invariant flag —
           // the stamp is gated on `source: "managed"` to match the guard.
           "cost-optimized": {
             source: "user",
@@ -2208,16 +2206,19 @@ describe("persisted chat settings", () => {
     });
   });
 
-  test("sparse GET exposes effective defaults without materializing unrelated fields", async () => {
+  test("sparse GET returns the fully materialized typed config with effective chat settings", async () => {
     rawConfigFixture = {};
     seedRawConfig();
     invalidateConfigCache();
     const result = await getRoute.handler({});
     expect(result).toMatchObject({
-      conversations: { autoArchive: { enabled: false, afterDays: 7 } },
+      conversations: {
+        autoArchive: { enabled: false, afterDays: 7 },
+        skipAutoRetitling: false,
+      },
       notifications: { newMessageEnabled: true },
     });
-    expect(result).not.toHaveProperty("conversations.skipAutoRetitling");
+    // Materialization is wire-only: nothing is written back to disk.
     expect(loadRawConfig()).not.toHaveProperty("conversations");
     expect(loadRawConfig()).not.toHaveProperty("notifications");
   });
@@ -2237,9 +2238,9 @@ describe("persisted chat settings", () => {
       expect(result).toMatchObject({
         conversations: {
           skipAutoRetitling: true,
-          autoArchive: { enabled: true, afterDays: 30, futureOption: "keep" },
+          autoArchive: { enabled: true, afterDays: 30 },
         },
-        notifications: { newMessageEnabled: false, futureOption: "keep" },
+        notifications: { newMessageEnabled: false },
         maxStepsPerSession: 75,
       });
       expect(loadRawConfig()).toEqual({
@@ -2280,9 +2281,9 @@ describe("persisted chat settings", () => {
     expect(result).toMatchObject({
       conversations: {
         skipAutoRetitling: true,
-        autoArchive: { enabled: false, afterDays: 7, futureOption: "keep" },
+        autoArchive: { enabled: false, afterDays: 7 },
       },
-      notifications: { newMessageEnabled: true, futureOption: "keep" },
+      notifications: { newMessageEnabled: true },
     });
     expect(loadRawConfig()).toMatchObject({
       conversations: { autoArchive: { futureOption: "keep" } },