@vellumai/assistant 0.10.12 → 0.11.0-staging.1

package/src/runtime/question-request-guardian-bridge.ts

@@ -0,0 +1,184 @@
+/**
+ * Bridge a guardian's parked `ask_question` prompt to a `guardian.question`
+ * notification.
+ *
+ * Mirrors `confirmation-request-guardian-bridge.ts` for the question kind:
+ * emits the notification signal (the broadcaster renders the options as card
+ * actions — see `resolveQuestionOptionsContext`) and records the resulting
+ * card deliveries so reply routing can address taps and reactions back to the
+ * request.
+ *
+ * Unlike the confirmation bridge — which escalates a NON-guardian's request TO
+ * the guardian — the caller (`question-guardian-request.ts`) has already
+ * established that the asking turn belongs to the guardian; this bridge only
+ * verifies the channel's guardian binding still matches so a rebind between
+ * ingress and prompt emission can't deliver the question card to the wrong
+ * recipient.
+ */
+
+import type { QuestionEntry } from "../api/events/question-request.js";
+import type { GuardianRequestWire } from "../channels/gateway-guardian-requests.js";
+import type { TrustContext } from "../daemon/trust-context-types.js";
+import { emitNotificationSignal } from "../notifications/emit-signal.js";
+import {
+  recordApprovalCardDelivery,
+  recordGuardianRequestDeliveries,
+} from "../notifications/guardian-delivery-recorder.js";
+import { buildVellumCardAffinity } from "../notifications/vellum-card-affinity.js";
+import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
+import { getLogger } from "../util/logger.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "./assistant-scope.js";
+import { getGuardianBinding } from "./channel-verification-service.js";
+
+const log = getLogger("question-request-guardian-bridge");
+
+export interface BridgeQuestionRequestParams {
+  /** The guardian request already persisted for this question. */
+  guardianRequest: GuardianRequestWire;
+  /** Trust context snapshot from the asking turn. */
+  trustContext: TrustContext;
+  /** Conversation the question was asked in. */
+  conversationId: string;
+  /** The (single) question entry being asked. */
+  question: QuestionEntry;
+  /** Logical assistant ID (defaults to 'self'). */
+  assistantId?: string;
+}
+
+export type BridgeQuestionRequestResult =
+  | { bridged: true; signalId: string }
+  | {
+      skipped: true;
+      reason: "no_guardian_binding" | "binding_identity_mismatch";
+    };
+
+/**
+ * Emit the `guardian.question` signal for a parked question and record the
+ * card deliveries. Fire-and-forget safe: emission errors are logged, never
+ * propagated.
+ */
+export async function bridgeQuestionRequestToGuardian(
+  params: BridgeQuestionRequestParams,
+): Promise<BridgeQuestionRequestResult> {
+  const {
+    guardianRequest,
+    trustContext,
+    conversationId,
+    question,
+    assistantId = DAEMON_INTERNAL_ASSISTANT_ID,
+  } = params;
+
+  const sourceChannel = trustContext.sourceChannel;
+  const binding = await getGuardianBinding(assistantId, sourceChannel);
+  if (!binding) {
+    log.debug(
+      { sourceChannel, conversationId },
+      "No guardian binding for question request bridge",
+    );
+    return { skipped: true, reason: "no_guardian_binding" };
+  }
+
+  // A guardian rebind between ingress and prompt emission would deliver the
+  // question card to the wrong recipient — mirror the confirmation bridge's
+  // canonicalized identity check.
+  const canonicalizedBindingGuardianId = canonicalizeInboundIdentity(
+    sourceChannel,
+    binding.guardianExternalUserId,
+  );
+  const canonicalizedRequestGuardianId = guardianRequest.guardianExternalUserId
+    ? canonicalizeInboundIdentity(
+        sourceChannel,
+        guardianRequest.guardianExternalUserId,
+      )
+    : null;
+  if (
+    canonicalizedRequestGuardianId &&
+    canonicalizedBindingGuardianId !== canonicalizedRequestGuardianId
+  ) {
+    log.warn(
+      {
+        sourceChannel,
+        requestId: guardianRequest.id,
+      },
+      "Guardian binding identity does not match the question request guardian — skipping notification to prevent misrouting",
+    );
+    return { skipped: true, reason: "binding_identity_mismatch" };
+  }
+
+  // The vellum delivery row is created up front in onConversationCreated so
+  // the in-app client sees it immediately; the post-resolve recorder reuses it.
+  let vellumDeliveryIdPromise: Promise<string | undefined> | undefined;
+
+  const signalPromise = emitNotificationSignal({
+    sourceEventName: "guardian.question",
+    sourceChannel,
+    sourceContextId: conversationId,
+    requiresConversation: true,
+    // Pin the in-app (vellum) card to the conversation the question was
+    // asked in, so the guardian answers it in context.
+    ...(buildVellumCardAffinity(conversationId) ?? {}),
+    attentionHints: {
+      requiresAction: true,
+      urgency: "high",
+      isAsyncBackground: false,
+      // MUST be false: visibleInSourceNow is a hard suppression pre-gate in
+      // emitNotificationSignal (source-active check) — it means "the user can
+      // already see this content in the source surface, skip notifying". A
+      // parked ask_question renders NOTHING in the source chat by itself; this
+      // card IS the prompt, so suppressing it would leave the turn hanging
+      // until the prompt timeout.
+      visibleInSourceNow: false,
+    },
+    contextPayload: {
+      requestKind: "pending_question",
+      requestId: guardianRequest.id,
+      requestCode:
+        guardianRequest.requestCode ??
+        guardianRequest.id.slice(0, 6).toUpperCase(),
+      sourceChannel,
+      requesterExternalUserId: trustContext.requesterExternalUserId,
+      requesterChatId: trustContext.requesterChatId ?? null,
+      questionText: question.question,
+      options: question.options.map((option) => ({
+        id: option.id,
+        label: option.label,
+      })),
+    },
+    dedupeKey: `ask-question-request:${guardianRequest.id}`,
+    onConversationCreated: (info) => {
+      vellumDeliveryIdPromise ??= recordApprovalCardDelivery({
+        requestId: guardianRequest.id,
+        channel: "vellum",
+        conversationId: info.conversationId,
+      }).then((delivery) => delivery?.id);
+      return vellumDeliveryIdPromise.then(() => undefined);
+    },
+  });
+
+  void signalPromise
+    .then(async (signalResult) => {
+      await recordGuardianRequestDeliveries({
+        requestId: guardianRequest.id,
+        deliveryResults: signalResult.deliveryResults,
+        vellumDeliveryId: await vellumDeliveryIdPromise,
+      });
+    })
+    .catch((err) => {
+      log.warn(
+        { err, requestId: guardianRequest.id },
+        "Failed to record channel deliveries for question bridge",
+      );
+    });
+
+  log.info(
+    {
+      sourceChannel,
+      requestId: guardianRequest.id,
+      requestCode: guardianRequest.requestCode,
+      optionCount: question.options.length,
+    },
+    "Guardian notified of pending question",
+  );
+
+  return { bridged: true, signalId: guardianRequest.id };
+}

package/src/runtime/question-resolution.ts

@@ -0,0 +1,153 @@
+/**
+ * Shared resolution core for pending `ask_question` interactions.
+ *
+ * A pending `question` interaction (registered by {@link QuestionPrompter}) can
+ * be resolved from two places:
+ *
+ *  - `POST /v1/question-response` — an app/web client submits the user's
+ *    batched selection (see `routes/question-routes.ts`).
+ *  - the guardian-request pipeline — a channel option tap, request-code reply,
+ *    or bare-text answer routes through the guardian reply router to the
+ *    `pending_question` resolver, which builds the submission (see
+ *    `approvals/guardian-request-resolvers.ts`).
+ *
+ * Both funnel through {@link resolvePendingQuestion} so the validate → consume
+ * → `rpcResolve` sequence has a single implementation. The helper is
+ * transport-agnostic: it returns a discriminated outcome rather than throwing
+ * route errors, so each caller maps the outcome to its own surface (HTTP status
+ * codes for the route; a resolver failure reason for the pipeline).
+ */
+
+import {
+  buildBatchEntries,
+  type QuestionBatchMetadata,
+  type QuestionBatchSubmission,
+  QuestionBatchValidationError,
+  type QuestionPromptResult,
+} from "../permissions/question-prompter.js";
+import * as pendingInteractions from "./pending-interactions.js";
+
+/**
+ * How to resolve a pending question: a batched submission (one entry per
+ * question) or a close (every question reported as `skipped`).
+ */
+export type QuestionResolutionInput =
+  | { kind: "submit"; submissions: QuestionBatchSubmission[] }
+  | { kind: "close" };
+
+/**
+ * Outcome of {@link resolvePendingQuestion}.
+ *
+ *  - `resolved` — the interaction was consumed and the prompter's caller
+ *    settled. `conversationId` is the owning conversation (absent for
+ *    conversation-less prompts).
+ *  - `not_found` — no pending `question` interaction matched the requestId
+ *    (already answered, timed out, superseded, or wrong kind). Callers treat
+ *    this as a stale request.
+ *  - `invalid` — the submission failed validation. The interaction is left
+ *    intact (timer still running) so the user can submit a correct batch.
+ */
+export type QuestionResolutionOutcome =
+  | {
+      status: "resolved";
+      result: QuestionPromptResult;
+      conversationId?: string;
+    }
+  | { status: "not_found" }
+  | { status: "invalid"; message: string };
+
+/**
+ * Resolve a pending `question` interaction with a batched submission or a
+ * close. Validation runs BEFORE the interaction is consumed, so an `invalid`
+ * outcome leaves the pending prompt (and its timer) intact for a retry.
+ */
+export function resolvePendingQuestion(
+  requestId: string,
+  input: QuestionResolutionInput,
+): QuestionResolutionOutcome {
+  const interaction = pendingInteractions.get(requestId);
+  if (!interaction || interaction.kind !== "question") {
+    return { status: "not_found" };
+  }
+
+  let result: QuestionPromptResult;
+  try {
+    if (input.kind === "close") {
+      const { orderedIds } = readBatchMetadata(interaction);
+      result = {
+        entries: orderedIds.map((id) => ({
+          questionId: id,
+          decision: "skipped" as const,
+        })),
+        overall: "closed",
+      };
+    } else {
+      result = buildCompletedResult(input.submissions, interaction);
+    }
+  } catch (err) {
+    if (err instanceof QuestionBatchValidationError) {
+      return { status: "invalid", message: err.message };
+    }
+    throw err;
+  }
+
+  // Validation passed — deregister now to clear the prompter timer, then hand
+  // the result to the prompter's caller via rpcResolve.
+  pendingInteractions.resolve(
+    requestId,
+    input.kind === "close" ? "cancelled" : "answered",
+  );
+
+  (
+    interaction.rpcResolve as
+      | ((value: QuestionPromptResult) => void)
+      | undefined
+  )?.(result);
+
+  return {
+    status: "resolved",
+    result,
+    conversationId: interaction.conversationId,
+  };
+}
+
+/**
+ * Build a `completed` QuestionPromptResult from a batched submission and the
+ * per-question metadata the prompter stashed on the interaction. Delegates the
+ * validation + ordering loop to {@link buildBatchEntries} so the prompter, the
+ * route, and the channel wizard share a single implementation.
+ */
+function buildCompletedResult(
+  submissions: QuestionBatchSubmission[],
+  interaction: ReturnType<typeof pendingInteractions.get>,
+): QuestionPromptResult {
+  const { orderedIds, optionsById } = readBatchMetadata(interaction);
+  if (orderedIds.length === 0) {
+    throw new QuestionBatchValidationError(
+      "No registered question ids for this batch",
+    );
+  }
+  const entries = buildBatchEntries(
+    orderedIds,
+    (qid, oid) => (optionsById[qid] ?? []).includes(oid),
+    new Set(Object.keys(optionsById)),
+    submissions,
+  );
+  return { entries, overall: "completed" };
+}
+
+/**
+ * Pull the prompter-stashed batch bookkeeping off a pending interaction.
+ * Returns empty defaults if the metadata is absent.
+ */
+export function readBatchMetadata(
+  interaction: ReturnType<typeof pendingInteractions.get>,
+): QuestionBatchMetadata {
+  const meta = interaction?.metadata as
+    | Partial<QuestionBatchMetadata>
+    | undefined;
+  return {
+    orderedIds: meta?.orderedIds ?? [],
+    optionsById: meta?.optionsById ?? {},
+  };
+}

package/src/runtime/routes/__tests__/bookmark-routes.test.ts

@@ -22,7 +22,9 @@ mock.module("../../assistant-event-hub.js", () => ({
     },
     subscribe: () => () => {},
   },
-  broadcastMessage: async () => {},
+  broadcastMessage: (message: unknown, conversationId?: string) => {
+    publishCalls.push({ message, conversationId });
+  },
 }));
 
 import { getDb } from "../../../persistence/db-connection.js";
@@ -47,7 +49,9 @@ await initializeDb();
 
 function findHandler(operationId: string): RouteDefinition["handler"] {
   const route = BOOKMARK_ROUTES.find((r) => r.operationId === operationId);
-  if (!route) throw new Error(`Route ${operationId} not found`);
+  if (!route) {
+    throw new Error(`Route ${operationId} not found`);
+  }
   return route.handler;
 }
 

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -71,7 +71,7 @@ import {
   type MemoryV2ConceptRowRecord,
   type MemoryV2ConfigSnapshot,
   recordMemoryV2ActivationLog,
-} from "../../../plugins/defaults/memory/memory-v2-activation-log-store.js";
+} from "../../../plugins/defaults/memory/v2/activation-log-store.js";
 import {
   createConnection,
   getConnection,

package/src/runtime/routes/acp-routes.ts

@@ -18,8 +18,8 @@ import {
   AcpSessionNotFoundError,
 } from "../../acp/session-manager.js";
 import type { AcpSessionState } from "../../acp/types.js";
+import type { AssistantEvent } from "../../api/index.js";
 import { getConfig } from "../../config/loader.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
 import { createGuardianRequestForConfirmation } from "../../permissions/confirmation-guardian-request.js";
 import type { UserDecision } from "../../permissions/types.js";
 import { getDb } from "../../persistence/db-connection.js";
@@ -159,7 +159,7 @@ function awaitRouteApproval(args: {
         settle(decision, decision === "allow" ? "approved" : "rejected"),
     });
 
-    const confirmationMsg: ServerMessage & {
+    const confirmationMsg: AssistantEvent & {
       type: "confirmation_request";
     } = {
       type: "confirmation_request",

package/src/runtime/routes/bookmark-routes.ts

@@ -20,33 +20,21 @@ import {
 } from "../../persistence/bookmark-crud.js";
 import { getMessageById } from "../../persistence/conversation-crud.js";
 import { getDb } from "../../persistence/db-connection.js";
-import { getLogger } from "../../util/logger.js";
-import { buildAssistantEvent } from "../assistant-event.js";
-import { assistantEventHub } from "../assistant-event-hub.js";
+import { broadcastMessage } from "../assistant-event-hub.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
-const log = getLogger("bookmark-routes");
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
 function publishBookmarkCreated(bookmark: BookmarkSummary): void {
-  assistantEventHub
-    .publish(buildAssistantEvent({ type: "bookmark.created", bookmark }))
-    .catch((err) => {
-      log.warn({ err }, "Failed to publish bookmark.created");
-    });
+  broadcastMessage({ type: "bookmark.created", bookmark });
 }
 
 function publishBookmarkDeleted(payload: { messageId: string }): void {
-  assistantEventHub
-    .publish(buildAssistantEvent({ type: "bookmark.deleted", ...payload }))
-    .catch((err) => {
-      log.warn({ err }, "Failed to publish bookmark.deleted");
-    });
+  broadcastMessage({ type: "bookmark.deleted", ...payload });
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/routes/canned-message-complete.ts

@@ -1,5 +1,5 @@
 import { createAssistantMessage } from "../../agent/message-types.js";
-import type { ServerMessage } from "../../daemon/message-protocol.js";
+import type { AssistantEvent } from "../../api/index.js";
 import {
   addMessage,
   recordConversationPersistedSeq,
@@ -28,7 +28,7 @@ import { publishConversationMessagesChanged } from "../sync/resource-sync-events
 // `state.assistantTurnId` directly, grep for `emitCannedMessageComplete` to
 // find every call site and inline-then-delete.
 export function emitCannedMessageComplete(
-  send: (msg: ServerMessage) => void,
+  send: (msg: AssistantEvent) => void,
   conversationId: string,
   persistedAssistantId: string,
 ): void {

package/src/runtime/routes/consolidation-routes.ts

@@ -29,7 +29,8 @@ import {
 } from "../../persistence/jobs-store.js";
 import { getUsageCostForConversationWindow } from "../../persistence/llm-usage-store.js";
 import { GRAPH_MAINTENANCE_CHECKPOINTS } from "../../plugins/defaults/memory/jobs-worker.js";
-import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/v3/substrate/constants.js";
+import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/substrate/constants.js";
+import { resolveSubstrateTuning } from "../../plugins/defaults/memory/substrate/tuning.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import {
@@ -46,7 +47,12 @@ function isConsolidationAvailable(): boolean {
 }
 
 function consolidationIntervalMs(): number {
-  return getConfig().memory.v2.consolidation_interval_hours * 60 * 60 * 1000;
+  return (
+    resolveSubstrateTuning(getConfig().memory).consolidation_interval_hours *
+    60 *
+    60 *
+    1000
+  );
 }
 
 function readLastRunAt(): number | null {

package/src/runtime/routes/conversation-list-routes.ts

@@ -10,6 +10,7 @@
 
 import { z } from "zod";
 
+import { CHANNEL_IDS } from "../../channels/types.js";
 import { channelBindingSchema } from "../../messaging/channel-binding-schema.js";
 import {
   type Confidence,
@@ -57,16 +58,7 @@ const log = getLogger("conversation-list-routes");
 // Response schemas
 // ---------------------------------------------------------------------------
 
-const channelIdSchema = z.enum([
-  "telegram",
-  "phone",
-  "vellum",
-  "whatsapp",
-  "slack",
-  "email",
-  "platform",
-  "a2a",
-]);
+const channelIdSchema = z.enum(CHANNEL_IDS);
 
 const assistantAttentionSchema = z.object({
   hasUnseenLatestAssistantMessage: z.boolean(),
@@ -453,15 +445,7 @@ export const ROUTES: RouteDefinition[] = [
           "Filter by origin channel. When provided, only conversations with this exact origin_channel value are returned. Omit to include all channels.",
         schema: {
           type: "string",
-          enum: [
-            "slack",
-            "telegram",
-            "whatsapp",
-            "email",
-            "a2a",
-            "vellum",
-            "phone",
-          ],
+          enum: [...CHANNEL_IDS],
         },
       },
     ],

package/src/runtime/routes/conversation-management-routes.ts

@@ -71,7 +71,6 @@ import { deleteSchedule } from "../../schedule/schedule-store.js";
 import { UserError } from "../../util/errors.js";
 import { safeParseRecord } from "../../util/json.js";
 import { getLogger } from "../../util/logger.js";
-import { silentlyWithLog } from "../../util/silently.js";
 import { broadcastMessage } from "../assistant-event-hub.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { resolveActorPrincipalIdForLocalGuardian } from "../local-actor-identity.js";
@@ -337,10 +336,7 @@ async function handleSummarizeConversation({ body = {} }: RouteHandlerArgs) {
         conversation.abortController = null;
       }
       conversation.setProcessing(false);
-      silentlyWithLog(
-        conversation.drainQueue(),
-        "summarize-command queue drain",
-      );
+      void conversation.kickDrainQueue("loop_complete", "summarize_command");
     }
   })();
 

package/src/runtime/routes/conversation-query-routes.ts

@@ -55,6 +55,10 @@ import {
 } from "../../config/schemas/llm.js";
 import { VALID_MEMORY_EMBEDDING_PROVIDERS } from "../../config/schemas/memory-storage.js";
 import { ServiceModeSchema } from "../../config/schemas/services.js";
+import {
+  describeShadowedConfigSet,
+  findSubstrateShadowing,
+} from "../../config/substrate-twin-shadowing.js";
 import { getConfigWatcher } from "../../daemon/config-watcher.js";
 import {
   getEmbeddingConfigInfo,
@@ -88,9 +92,9 @@ import { clearEmbeddingBackendCache } from "../../persistence/embeddings/embeddi
 import { getLlmRequestLogSource } from "../../persistence/llm-request-log-source.js";
 import { type LogRow } from "../../persistence/llm-request-log-store.js";
 import { getMemoryRecallLogByMessageIds } from "../../plugins/defaults/memory/memory-recall-log-store.js";
-import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/memory-v2-activation-log-store.js";
+import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/substrate/constants.js";
+import { getMemoryV2ActivationLogByMessageIds } from "../../plugins/defaults/memory/v2/activation-log-store.js";
 import { getMemoryV3SelectionForInspectorByMessageIds } from "../../plugins/defaults/memory/v3/selection-log-store.js";
-import { MEMORY_V2_CONSOLIDATION_SOURCE } from "../../plugins/defaults/memory/v3/substrate/constants.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../../providers/inference/auth.js";
 import { PROVIDERS_REQUIRING_BASE_URL_AND_MODELS } from "../../providers/inference/auth.js";
 import {
@@ -459,10 +463,10 @@ async function handleSetEmbeddingConfig({ body }: RouteHandlerArgs) {
  * response needs the same treatment so external clients (macOS, web, CLI)
  * see the effective value rather than `undefined` when the daemon hasn't
  * persisted an explicit choice yet. For example, on a freshly-hatched
- * platform-managed assistant, `services.image-generation.mode` may be absent
- * from disk (only `llm.profiles` was written by `seedInferenceProfiles`); the
- * fill pass ensures clients receive `"managed"` rather than falling back to
- * their own defaults.
+ * platform-managed assistant, `services.image-generation.provider` may be
+ * absent from disk (only `llm.profiles` was written by
+ * `seedInferenceProfiles`); the fill pass ensures clients receive `"vellum"`
+ * rather than falling back to their own defaults.
  *
  * Guards against `loadRawConfig()` handing us a value that is technically
  * valid JSON but not a plain object (e.g. literal `null`, a number, or an
@@ -703,7 +707,10 @@ const ConfigGetResponseSchema = z
           .passthrough()
           .optional(),
         "image-generation": z
-          .object({ mode: ServiceModeSchema.optional() })
+          .object({
+            provider: z.string().optional(),
+            model: z.string().optional(),
+          })
           .passthrough()
           .optional(),
         inference: z
@@ -807,7 +814,10 @@ const ConfigPatchRequestSchema = z
           .nullable()
           .optional(),
         "image-generation": z
-          .object({ mode: ServiceModeSchema.optional() })
+          .object({
+            provider: z.string().optional(),
+            model: z.string().optional(),
+          })
           .passthrough()
           .nullable()
           .optional(),
@@ -1449,6 +1459,28 @@ export async function commitConfigWrite(
   }
 }
 
+/**
+ * Web clients pair provider writes with a legacy `mode` key so their saves
+ * stay valid on daemons whose schemas still carry it. The provider-only
+ * services (web-search, image-generation) parse-strip that key, but the
+ * deep-merge would still persist it to raw config.json on every save —
+ * scrub it so the removed field cannot be resurrected on disk.
+ */
+function scrubRemovedServiceModes(raw: Record<string, unknown>): void {
+  const services = raw.services as
+    | Record<string, Record<string, unknown> | undefined>
+    | undefined;
+  if (!services) {
+    return;
+  }
+  for (const key of ["web-search", "image-generation"]) {
+    const entry = services[key];
+    if (entry && typeof entry === "object" && "mode" in entry) {
+      delete entry.mode;
+    }
+  }
+}
+
 async function handlePatchConfig({ body }: RouteHandlerArgs) {
   if (
     !body ||
@@ -1467,6 +1499,7 @@ async function handlePatchConfig({ body }: RouteHandlerArgs) {
   const patch = body as Record<string, unknown>;
   backfillNewCallSiteEntries(raw, patch);
   deepMergeOverwrite(raw, patch);
+  scrubRemovedServiceModes(raw);
 
   await commitConfigWrite(raw, "patch");
 
@@ -1568,6 +1601,17 @@ async function handleSetConfig({ body }: RouteHandlerArgs) {
   }
 
   await commitConfigWrite(raw, "set");
+  // A `memory.v2` substrate tunable whose `memory.substrate` twin is set does
+  // not mean what an unpaired write means: the substrate namespace wins in
+  // `resolveSubstrateTuning`, and for the three twins the v2 injection engine
+  // reads directly the two namespaces diverge instead. Report which case this
+  // is alongside the success so the caller can tell the operator.
+  const shadowing = findSubstrateShadowing(raw, path);
+  if (shadowing) {
+    const warning = describeShadowedConfigSet(shadowing, path);
+    log.warn({ path, substratePath: shadowing.substratePath }, warning);
+    return { ok: true, warning };
+  }
   return { ok: true };
 }