@mycadet/assistant 0.12.7 → 0.12.9

package/src/__tests__/{managed-profile-guard.test.ts → cloud-profile-guard.test.ts}

@@ -1,14 +1,14 @@
 /**
  * Tests the two layers protecting managed inference profiles:
  *
- * - Route-level managed guards: managed profiles can't be deleted via PATCH
+ * - Route-level managed guards: cloud profiles can't be deleted via PATCH
  *   and the PUT profile route accepts only a pure status re-enable body for
  *   them.
- * - The commitConfigWrite invariant guard: every managed profile name
+ * - The commitConfigWrite invariant guard: every cloud profile name
  *   ("quality-optimized", "balanced", "cost-optimized", "os-beta") is fully
  *   read-only across PATCH/SET/PUT while its on-disk entry is
  *   managed-source — the only writable transition is re-enabling a disabled
- *   profile. A user-owned (`source: "user"`) entry sharing a managed name is
+ *   profile. A user-owned (`source: "user"`) entry sharing a cloud name is
  *   not locked.
  *
  * Plus the wire-only profile keys (`invariant`, `supportsVision`) stamped on
@@ -105,7 +105,7 @@ mock.module("../providers/inference/connections.js", () => ({
   listConnections: () => [],
   createConnection: () => ({ ok: false, error: { code: "already_exists" } }),
   getConnection: () => null,
-  CADET_MANAGED_CONNECTION_NAME: "cadet",
+  CADET_CLOUD_CONNECTION_NAME: "cadet",
 }));
 
 import { ROUTES } from "../runtime/routes/conversation-query-routes.js";
@@ -145,7 +145,7 @@ function savedProfile(name: string): Record<string, unknown> {
 // PUT /v1/config/llm/profiles/:name — replace inference profile
 // ---------------------------------------------------------------------------
 
-describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
+describe("PUT /v1/config/llm/profiles/:name — cloud profile guard", () => {
   test("rejects provider/model edits to quality-optimized", async () => {
     await expect(
       replaceRoute.handler({
@@ -153,8 +153,8 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
         body: { provider: "openai", model: "gpt-4o" },
       }),
     ).rejects.toThrow(
-      'Cannot edit managed profile "quality-optimized" fields [provider, model]. ' +
-        "Managed profiles are read-only (a disabled profile can be re-enabled); " +
+      'Cannot edit cloud profile "quality-optimized" fields [provider, model]. ' +
+        "Cloud profiles are read-only (a disabled profile can be re-enabled); " +
         "duplicate to a custom profile to customize.",
     );
   });
@@ -219,7 +219,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
         pathParams: { name: "my-custom" },
         body: { provider: "cadet", model: "not-a-real-model" },
       }),
-    ).rejects.toThrow(/not served by the Cadet managed route/);
+    ).rejects.toThrow(/not served by the Cadet Cloud route/);
     expect(committedRaw()).toBeNull();
   });
 
@@ -234,14 +234,14 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
 
   // -------------------------------------------------------------------------
   // Null-as-clear sentinel: clients send `{ label: null }` or
-  // `{ status: null }` to clear a managed profile's overrides back to the
+  // `{ status: null }` to clear a cloud profile's overrides back to the
   // seed defaults. The Zod `ProfileEntry` schema accepts null for both
   // fields. Every managed name is invariant, so on managed-source entries
   // only the status clear is allowed (re-enable) — every other field is
   // frozen at commit time.
   // -------------------------------------------------------------------------
 
-  test("PUT { label: null } on a managed profile is rejected (label is frozen)", async () => {
+  test("PUT { label: null } on a cloud profile is rejected (label is frozen)", async () => {
     seedRawConfig({
       llm: {
         profiles: {
@@ -259,13 +259,13 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
         pathParams: { name: "balanced" },
         body: { label: null },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "balanced" fields [label]');
+    ).rejects.toThrow('Cannot edit cloud profile "balanced" fields [label]');
     expectNothingCommitted();
   });
 
   test("PUT on the code-owned latency profile is rejected, status re-enable included", async () => {
     // Fast fronts live voice, so it takes no writes at all: the re-enable
-    // escape hatch the other managed profiles keep would persist a stub that
+    // escape hatch the other cloud profiles keep would persist a stub that
     // never governs what the name resolves to.
     seedRawConfig({ llm: { profiles: {} } });
 
@@ -286,7 +286,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
     expectNothingCommitted();
   });
 
-  test("PUT on a managed backup profile is rejected as code-owned", async () => {
+  test("PUT on a cloud backup profile is rejected as code-owned", async () => {
     // Backups are code-owned too, and they carry no on-disk entry, so the
     // code-owned rejection has to win over the availability gate: reporting
     // "not currently available" would be wrong for a profile the picker
@@ -314,7 +314,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
     expectNothingCommitted();
   });
 
-  test("PUT { status: null } on managed profile clears status (back to active-by-absence)", async () => {
+  test("PUT { status: null } on cloud profile clears status (back to active-by-absence)", async () => {
     seedRawConfig({
       llm: {
         profiles: {
@@ -359,7 +359,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
         pathParams: { name: "os-beta" },
         body: { label: null, status: null },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "os-beta" fields [label]');
+    ).rejects.toThrow('Cannot edit cloud profile "os-beta" fields [label]');
     expectNothingCommitted();
   });
 
@@ -382,7 +382,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
         body: { status: "disabled" },
       }),
     ).rejects.toThrow(
-      'Cannot edit managed profile "os-beta". Managed profiles are read-only',
+      'Cannot edit cloud profile "os-beta". Cloud profiles are read-only',
     );
     expectNothingCommitted();
   });
@@ -404,7 +404,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
         pathParams: { name: "os-beta" },
         body: { topP: 0.9 },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "os-beta" fields [topP]');
+    ).rejects.toThrow('Cannot edit cloud profile "os-beta" fields [topP]');
     expectNothingCommitted();
   });
 
@@ -426,7 +426,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
         pathParams: { name: "os-beta" },
         body: { topP: null },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "os-beta" fields [topP]');
+    ).rejects.toThrow('Cannot edit cloud profile "os-beta" fields [topP]');
     expectNothingCommitted();
   });
 
@@ -455,7 +455,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
     expect(profile.model).toBe("zai-org/GLM-5.2");
   });
 
-  test("allows edits to a user-owned profile sharing a managed name (os-beta)", async () => {
+  test("allows edits to a user-owned profile sharing a cloud name (os-beta)", async () => {
     seedRawConfig({
       llm: {
         profiles: {
@@ -477,7 +477,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
     expect(profile.model).toBe("gpt-4o");
   });
 
-  test("rejects edits to a managed os-beta profile", async () => {
+  test("rejects edits to a cloud os-beta profile", async () => {
     seedRawConfig({
       llm: {
         profiles: {
@@ -513,7 +513,7 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
     expect(onDisk?.llm?.profiles?.["os-beta"]).toBeUndefined();
   });
 
-  test("PUT { label: '' } on managed profile still rejected by `.min(1)`", async () => {
+  test("PUT { label: '' } on cloud profile still rejected by `.min(1)`", async () => {
     // `.nullable()` only widens the type to accept null — empty strings
     // still fail the min-length check, which is correct: an empty string
     // would persist as a literal "" override, not the clear-to-seed
@@ -528,16 +528,16 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
 });
 
 // ---------------------------------------------------------------------------
-// PATCH /v1/config — managed profile deletion guard
+// PATCH /v1/config — cloud profile deletion guard
 // ---------------------------------------------------------------------------
 
-describe("PATCH /v1/config — managed profile deletion guard", () => {
+describe("PATCH /v1/config — cloud profile deletion guard", () => {
   test("rejects deletion of quality-optimized via null with descriptive message", async () => {
     await expect(
       patchRoute.handler({
         body: { llm: { profiles: { "quality-optimized": null } } },
       }),
-    ).rejects.toThrow('Cannot delete managed profile "quality-optimized".');
+    ).rejects.toThrow('Cannot delete cloud profile "quality-optimized".');
   });
 
   test("rejects deletion of balanced via null", async () => {
@@ -592,15 +592,15 @@ describe("PATCH /v1/config — managed profile deletion guard", () => {
     });
 
     expect(result).toHaveProperty("ingress");
-    expect(committedRaw()).toEqual({
-      ingress: {
-        publicBaseUrl: "https://manual.example.test",
-        publicBaseUrlManagedBy: "tunnel",
-      },
-    });
+    const committed = committedRaw() as Record<string, any>;
+    expect(committed.ingress.publicBaseUrl).toBe("https://manual.example.test");
+    expect(committed.ingress.publicBaseUrlManagedBy).toBe("tunnel");
+    expect("lastTunnel" in committed.ingress).toBe(false);
+    expect("pairingTunnel" in committed.ingress).toBe(false);
+    expect("assistantId" in committed.ingress).toBe(false);
   });
 
-  test("allows patches that modify a managed profile (non-null)", async () => {
+  test("allows patches that modify a cloud profile (non-null)", async () => {
     const result = await patchRoute.handler({
       body: {
         llm: {
@@ -611,7 +611,7 @@ describe("PATCH /v1/config — managed profile deletion guard", () => {
     expect(result).toHaveProperty("llm");
   });
 
-  test("allows deletion of a user-owned profile sharing a managed name (os-beta)", async () => {
+  test("allows deletion of a user-owned profile sharing a cloud name (os-beta)", async () => {
     seedRawConfig({
       llm: {
         profiles: {
@@ -629,7 +629,7 @@ describe("PATCH /v1/config — managed profile deletion guard", () => {
     expect(result).toHaveProperty("llm");
   });
 
-  test("rejects deletion of a managed os-beta profile", async () => {
+  test("rejects deletion of a cloud os-beta profile", async () => {
     seedRawConfig({
       llm: {
         profiles: {
@@ -645,7 +645,7 @@ describe("PATCH /v1/config — managed profile deletion guard", () => {
       patchRoute.handler({
         body: { llm: { profiles: { "os-beta": null } } },
       }),
-    ).rejects.toThrow('Cannot delete managed profile "os-beta".');
+    ).rejects.toThrow('Cannot delete cloud profile "os-beta".');
   });
 
   test("rejects nulling the entire profiles map", async () => {
@@ -658,23 +658,23 @@ describe("PATCH /v1/config — managed profile deletion guard", () => {
 });
 
 // ---------------------------------------------------------------------------
-// commitConfigWrite — managed-profile invariant guard
+// commitConfigWrite — cloud-profile invariant guard
 //
-// Every managed profile name (balanced, quality-optimized, cost-optimized,
+// Every cloud profile name (balanced, quality-optimized, cost-optimized,
 // os-beta) is read-only to every config-write route while its on-disk entry
 // is managed-source; the only writable transition is re-enabling a disabled
-// profile. A user-owned entry sharing a managed name is not locked. Enforced
+// profile. A user-owned entry sharing a cloud name is not locked. Enforced
 // by `assertInvariantProfilesPreserved` at the commitConfigWrite choke
 // point, so PATCH, SET, and PUT are all covered by the same checks.
 // ---------------------------------------------------------------------------
 
-describe("managed-profile invariant guard — rejected writes", () => {
+describe("cloud-profile invariant guard — rejected writes", () => {
   test("PATCH disabling balanced is rejected (active → disabled)", async () => {
     await expect(
       patchRoute.handler({
         body: { llm: { profiles: { balanced: { status: "disabled" } } } },
       }),
-    ).rejects.toThrow('Cannot disable managed profile "balanced".');
+    ).rejects.toThrow('Cannot disable cloud profile "balanced".');
     expectNothingCommitted();
   });
 
@@ -684,8 +684,8 @@ describe("managed-profile invariant guard — rejected writes", () => {
         body: { llm: { profiles: { balanced: { label: "X" } } } },
       }),
     ).rejects.toThrow(
-      'Cannot edit managed profile "balanced" fields [label]. ' +
-        "Managed profiles are read-only; duplicate to a custom profile to customize.",
+      'Cannot edit cloud profile "balanced" fields [label]. ' +
+        "Cloud profiles are read-only; duplicate to a custom profile to customize.",
     );
     expectNothingCommitted();
   });
@@ -697,7 +697,7 @@ describe("managed-profile invariant guard — rejected writes", () => {
       patchRoute.handler({
         body: { llm: { profiles: { balanced: { label: null } } } },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "balanced" fields [label]');
+    ).rejects.toThrow('Cannot edit cloud profile "balanced" fields [label]');
     expectNothingCommitted();
   });
 
@@ -706,7 +706,7 @@ describe("managed-profile invariant guard — rejected writes", () => {
       patchRoute.handler({
         body: { llm: { profiles: { balanced: { topP: 0.8 } } } },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "balanced" fields [topP]');
+    ).rejects.toThrow('Cannot edit cloud profile "balanced" fields [topP]');
     expectNothingCommitted();
   });
 
@@ -717,11 +717,11 @@ describe("managed-profile invariant guard — rejected writes", () => {
       patchRoute.handler({
         body: { llm: { profiles: { balanced: { topP: null } } } },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "balanced" fields [topP]');
+    ).rejects.toThrow('Cannot edit cloud profile "balanced" fields [topP]');
     expectNothingCommitted();
   });
 
-  test("PATCH disabling a managed-source os-beta is rejected (active → disabled)", async () => {
+  test("PATCH disabling a cloud-source os-beta is rejected (active → disabled)", async () => {
     (rawConfig as Record<string, any>).llm.profiles["os-beta"] = {
       provider: "together",
       model: "zai-org/GLM-5.2",
@@ -732,11 +732,11 @@ describe("managed-profile invariant guard — rejected writes", () => {
       patchRoute.handler({
         body: { llm: { profiles: { "os-beta": { status: "disabled" } } } },
       }),
-    ).rejects.toThrow('Cannot disable managed profile "os-beta".');
+    ).rejects.toThrow('Cannot disable cloud profile "os-beta".');
     expectNothingCommitted();
   });
 
-  test("SET llm.profiles.os-beta.label is rejected on a managed-source entry", async () => {
+  test("SET llm.profiles.os-beta.label is rejected on a cloud-source entry", async () => {
     (rawConfig as Record<string, any>).llm.profiles["os-beta"] = {
       provider: "together",
       model: "zai-org/GLM-5.2",
@@ -747,7 +747,7 @@ describe("managed-profile invariant guard — rejected writes", () => {
       setRoute.handler({
         body: { path: "llm.profiles.os-beta.label", value: "My OS Beta" },
       }),
-    ).rejects.toThrow('Cannot edit managed profile "os-beta" fields [label]');
+    ).rejects.toThrow('Cannot edit cloud profile "os-beta" fields [label]');
     expectNothingCommitted();
   });
 
@@ -756,7 +756,7 @@ describe("managed-profile invariant guard — rejected writes", () => {
       patchRoute.handler({
         body: { llm: { profiles: { balanced: "junk" } } },
       }),
-    ).rejects.toThrow('Cannot delete or replace managed profile "balanced".');
+    ).rejects.toThrow("expected object, received string");
     expectNothingCommitted();
   });
 
@@ -765,7 +765,7 @@ describe("managed-profile invariant guard — rejected writes", () => {
       patchRoute.handler({
         body: { llm: { profiles: { balanced: ["disabled"] } } },
       }),
-    ).rejects.toThrow('Cannot delete or replace managed profile "balanced".');
+    ).rejects.toThrow("expected object, received array");
     expectNothingCommitted();
   });
 
@@ -780,7 +780,7 @@ describe("managed-profile invariant guard — rejected writes", () => {
         body: { status: "disabled" },
       }),
     ).rejects.toThrow(
-      'Cannot edit managed profile "balanced". Managed profiles are read-only',
+      'Cannot edit cloud profile "balanced". Cloud profiles are read-only',
     );
     expectNothingCommitted();
   });
@@ -790,14 +790,14 @@ describe("managed-profile invariant guard — rejected writes", () => {
       setRoute.handler({
         body: { path: "llm.profiles.balanced.status", value: "disabled" },
       }),
-    ).rejects.toThrow('Cannot disable managed profile "balanced".');
+    ).rejects.toThrow('Cannot disable cloud profile "balanced".');
     expectNothingCommitted();
   });
 
   test("SET llm = {} is rejected (would drop all defaults)", async () => {
     await expect(
       setRoute.handler({ body: { path: "llm", value: {} } }),
-    ).rejects.toThrow(/Cannot delete or replace managed profile/);
+    ).rejects.toThrow(/Cannot delete or replace cloud profile/);
     expectNothingCommitted();
   });
 
@@ -806,10 +806,7 @@ describe("managed-profile invariant guard — rejected writes", () => {
       patchRoute.handler({
         body: { llm: { profiles: { balanced: { status: "weird" } } } },
       }),
-    ).rejects.toThrow(
-      'Cannot set status "weird" on managed profile "balanced". ' +
-        'Only re-enabling (status "active") is allowed.',
-    );
+    ).rejects.toThrow("llm.profiles.balanced.status: Invalid option");
     expectNothingCommitted();
   });
 
@@ -818,13 +815,13 @@ describe("managed-profile invariant guard — rejected writes", () => {
       setRoute.handler({
         body: { path: "llm.profiles.balanced.status", value: 123 },
       }),
-    ).rejects.toThrow('Cannot set status 123 on managed profile "balanced"');
+    ).rejects.toThrow("llm.profiles.balanced.status: Invalid option");
     expectNothingCommitted();
   });
 });
 
 describe("default-profile invariant guard — allowed writes", () => {
-  test("PATCH re-enables a disabled managed profile (BYOK re-enable)", async () => {
+  test("PATCH re-enables a disabled cloud profile (BYOK re-enable)", async () => {
     (rawConfig as Record<string, any>).llm.profiles.balanced.status =
       "disabled";
     seedRawConfig(rawConfig);
@@ -848,7 +845,7 @@ describe("default-profile invariant guard — allowed writes", () => {
     expect(savedProfile("balanced").status ?? null).toBeNull();
   });
 
-  test("PUT { status: 'active' } re-enables a disabled managed profile", async () => {
+  test("PUT { status: 'active' } re-enables a disabled cloud profile", async () => {
     (rawConfig as Record<string, any>).llm.profiles.balanced.status =
       "disabled";
     seedRawConfig(rawConfig);
@@ -861,7 +858,7 @@ describe("default-profile invariant guard — allowed writes", () => {
     expect(savedProfile("balanced").status).toBe("active");
   });
 
-  test("SET llm.profiles.balanced.status = 'active' re-enables a disabled managed profile", async () => {
+  test("SET llm.profiles.balanced.status = 'active' re-enables a disabled cloud profile", async () => {
     (rawConfig as Record<string, any>).llm.profiles.balanced.status =
       "disabled";
     seedRawConfig(rawConfig);
@@ -893,9 +890,9 @@ describe("default-profile invariant guard — allowed writes", () => {
   });
 
   test("PATCH deleting a user-sourced balanced entry is allowed (invariance is source-gated)", async () => {
-    // A `source: "user"` entry passes the managed-deletion guard AND the
+    // A `source: "user"` entry passes the cloud-deletion guard AND the
     // invariant guard — both key on the on-disk entry's managed source, so
-    // a user-owned profile sharing a managed name stays deletable.
+    // a user-owned profile sharing a cloud name stays deletable.
     (rawConfig as Record<string, any>).llm.profiles.balanced.source = "user";
     seedRawConfig(rawConfig);
     const result = await patchRoute.handler({
@@ -939,12 +936,12 @@ describe("default-profile invariant guard — allowed writes", () => {
 
   test("PATCH non-profile llm writes are unaffected", async () => {
     const result = await patchRoute.handler({
-      body: { llm: { activeProfile: "custom" } },
+      body: { llm: { activeProfile: "balanced" } },
     });
     expect(result).toHaveProperty("llm");
     expectOneCommitCycle();
     expect((committedRaw() as Record<string, any>).llm.activeProfile).toBe(
-      "custom",
+      "balanced",
     );
     // The invariant profiles are untouched by an unrelated llm write.
     expect(savedProfile("balanced")).toEqual(
@@ -1004,23 +1001,24 @@ describe("wire-only profile keys are stripped from writes", () => {
     expect(profile.model).toBe("claude-sonnet");
   });
 
-  test("SET of a wire-only leaf path is dropped without writing", async () => {
+  test("SET of a wire-only leaf path never persists the key", async () => {
     const result = await setRoute.handler({
       body: { path: "llm.profiles.balanced.supportsVision", value: true },
     });
     expect(result).toEqual({ ok: true });
-    expectNothingCommitted();
+    expectOneCommitCycle();
+    expect("supportsVision" in savedProfile("balanced")).toBe(false);
   });
 
   // -------------------------------------------------------------------------
   // Stale wire-only keys on disk: configs written before the write-side strip
-  // existed can carry `supportsVision` under a managed profile. The invariant
+  // existed can carry `supportsVision` under a cloud profile. The invariant
   // guard ignores wire-only keys on both sides, so a GET → write round-trip
   // (whose incoming copy is stripped) is not rejected for "removing" the
   // stale key — and a full-entry SET drops it from disk.
   // -------------------------------------------------------------------------
 
-  test("SET round-trip re-enabling a managed profile with stale on-disk supportsVision succeeds and drops the stale key", async () => {
+  test("SET round-trip re-enabling a cloud profile with stale on-disk supportsVision succeeds and drops the stale key", async () => {
     const balanced = (rawConfig as Record<string, any>).llm.profiles.balanced;
     balanced.supportsVision = true; // stale pre-strip persistence
     balanced.status = "disabled";
@@ -1186,7 +1184,7 @@ describe("code-owned default profiles — wire view and write normalization", ()
         },
       }),
     ).rejects.toThrow(
-      'Cannot edit managed profile "cost-optimized" fields [model].',
+      'Cannot edit cloud profile "cost-optimized" fields [model].',
     );
     expectNothingCommitted();
   });
@@ -1201,7 +1199,7 @@ describe("code-owned default profiles — wire view and write normalization", ()
           },
         },
       }),
-    ).rejects.toThrow('Cannot disable managed profile "balanced".');
+    ).rejects.toThrow('Cannot disable cloud profile "balanced".');
     expectNothingCommitted();
   });
 
@@ -1302,7 +1300,7 @@ describe("code-owned default profiles — BYO default provider wire view", () =>
 });
 
 describe("code-owned default profiles — leaf SET source stamping", () => {
-  test("a leaf SET creating a managed entry stamps the managed marker", async () => {
+  test("a leaf SET creating a cloud entry stamps the cloud marker", async () => {
     seedRawConfig({ llm: { profiles: {} } });
     const result = await setRoute.handler({
       body: { path: "llm.profiles.balanced.status", value: "active" },
@@ -1348,7 +1346,7 @@ describe("code-owned default profiles — leaf SET source stamping", () => {
 });
 
 describe("code-owned default profiles — echoes over stale on-disk bodies", () => {
-  // An overlay can persist a managed entry whose content differs from the
+  // An overlay can persist a cloud entry whose content differs from the
   // catalog; GET serves catalog content, so a client echo carries values
   // that match neither nothing — they match the wire view. The round-trip
   // must still be a no-op.
@@ -1425,7 +1423,11 @@ describe("PATCH /v1/config — provider-only services scrub legacy mode", () =>
       string,
       Record<string, Record<string, unknown>>
     >;
-    expect(raw.services["image-generation"]).toEqual({ provider: "cadet" });
-    expect(raw.services["web-search"]).toEqual({ provider: "cadet" });
+    // The section schemas are closed: the parse strips the legacy `mode`
+    // key and materializes the section's defaults around the user's values.
+    expect("mode" in raw.services["image-generation"]!).toBe(false);
+    expect(raw.services["image-generation"]!.provider).toBe("cadet");
+    expect("mode" in raw.services["web-search"]!).toBe(false);
+    expect(raw.services["web-search"]!.provider).toBe("cadet");
   });
 });