@vellumai/assistant 0.10.3 → 0.10.4-dev.202607010119.ad15dbb

package/src/config/schemas/llm.ts

@@ -76,10 +76,7 @@ export const LLMCallSiteEnum = z.enum([
   "styleAnalyzer",
   "inviteInstructionGenerator",
   "skillCategoryInference",
-  "meetConsentMonitor",
-  "meetChatOpportunity",
   "inference",
-  "advisor",
   "vision",
   "trustRuleSuggestion",
   "homeGreeting",
@@ -442,13 +439,6 @@ export const ProfileEntry = LLMConfigFragment.extend({
    * #30362 even though the schema didn't accept it until now.
    */
   status: ProfileStatusSchema.nullable().optional(),
-  /**
-   * Whether the advisor is active while this profile is the chat profile.
-   * Absent/null means enabled (default on); only an explicit `false` disables
-   * it. `.nullable()` matches `status`/`label` so the PUT route's "send null
-   * to clear" sentinel resets it back to the default-on state.
-   */
-  advisorEnabled: z.boolean().nullable().optional(),
   /**
    * When present, this profile is a "mix": it carries no model config and
    * instead references a weighted list of standard profiles. The resolver
@@ -492,10 +482,9 @@ export const LLMSchema = z
     // schema level, so `LLMSchema.parse({})` yields an empty map.
     callSites: z.partialRecord(LLMCallSiteEnum, LLMCallSiteConfig).default({}),
     activeProfile: z.string().min(1).optional(),
-    // The profile the advisor consults (chosen under Models & Services). It is
-    // excluded from the chat-profile pickers so it can't be selected as the
-    // assistant's chat model. Absent falls back to the `advisor` call-site
-    // default (`quality-optimized`).
+    // The profile the advisor role consults when spawned as a subagent (chosen
+    // under Models & Services). It is excluded from the chat-profile pickers so
+    // it can't be selected as the assistant's chat model.
     advisorProfile: z.string().min(1).optional(),
     // TTL bounds for inference profile sessions. `defaultTtlSeconds` is read by
     // the CLI to apply when `--ttl` is omitted; the daemon handler itself only

package/src/config/schemas/memory-lifecycle.ts

@@ -84,7 +84,7 @@ export const MemoryWorkerConfigSchema = z
       .boolean({ error: "memory.worker.enabled must be a boolean" })
       .default(false)
       .describe(
-        "Whether the memory jobs worker runs as a separate OS process spawned at assistant startup (the `assistant memory worker` implementation) instead of on the assistant's main event loop. Only affects startup; shutdown stops whichever worker is actually running.",
+        "Whether the memory jobs worker runs as a separate OS process instead of the assistant's synchronous in-process runner. The assistant's worker supervisor re-reads this flag on every poll: while it is set, the in-process runner stands down (the out-of-process worker, spawned at startup when set, owns the queue); while it is unset, the in-process runner drains the queue. `assistant memory worker start`/`stop` flip the flag (and spawn/stop the worker process) to switch modes at runtime without a restart.",
       ),
   })
   .describe("Memory jobs worker process configuration");
@@ -190,6 +190,15 @@ export const MemoryMaintenanceConfigSchema = z
       .describe(
         "Database maintenance is deferred unless at least this many milliseconds have elapsed since the last user message, so maintenance's write locks never collide with an active user (0 disables the quiet-period gate)",
       ),
+    skillPruneDays: z
+      .number({ error: "memory.maintenance.skillPruneDays must be a number" })
+      .int("memory.maintenance.skillPruneDays must be an integer")
+      .min(1, "memory.maintenance.skillPruneDays must be at least 1")
+      .nullable()
+      .default(null)
+      .describe(
+        'Usage-based prune threshold for assistant-authored skills, in days. `null` (the default) = never prune — the maintain stage runs observe-only and deletes nothing (it still reports stale skills for observability). Set a positive integer to enable deletion of assistant-authored skills unused (lastUsedAt, else installedAt) for at least that many days. Shipped default-off so skill accumulation can be observed before deletion is enabled. Only `author:"assistant"` skills are ever eligible; user-authored and untagged skills are always protected.',
+      ),
   })
   .describe(
     "Database maintenance (PRAGMA optimize / WAL checkpoint) scheduling",

package/src/config/schemas/memory-v2.ts

@@ -190,7 +190,7 @@ export const MemoryV2ConfigSchema = z
       .positive(
         "memory.v2.consolidation_interval_hours must be a positive integer",
       )
-      .default(4)
+      .default(8)
       .describe(
         "Hours between scheduled consolidation runs that synthesize buffered memories into concept pages",
       ),

package/src/config/schemas/memory-v3.ts

@@ -48,10 +48,10 @@ export const MemoryV3HotSetSchema = z
     k: z
       .number({ error: "memory.v3.hotSet.k must be a number" })
       .int("memory.v3.hotSet.k must be an integer")
-      .positive("memory.v3.hotSet.k must be a positive integer")
+      .nonnegative("memory.v3.hotSet.k must be a non-negative integer")
       .default(40)
       .describe(
-        "Number of top frecency-scored pages included in the hot-set lane.",
+        "Number of top frecency-scored pages included in the hot-set lane. 0 disables the lane.",
       ),
     halfLifeDays: z
       .number({ error: "memory.v3.hotSet.halfLifeDays must be a number" })
@@ -214,10 +214,53 @@ export const MemoryV3PruneSchema = z
   })
   .describe("Memory v3 prune-valve (resident card footprint) bounds.");
 
+/**
+ * Entity-lane tuning: the heading-anchored named-entity match. A distinctive
+ * token the message shares with a `## ` section heading surfaces that section,
+ * so a named entity (person, place, project, product, bot) the additive needle
+ * buries under a long message's bulk theme is retrieved on the exact-name
+ * signal instead.
+ */
+export const MemoryV3EntitySchema = z
+  .object({
+    enabled: z
+      .boolean({ error: "memory.v3.entity.enabled must be a boolean" })
+      .default(true)
+      .describe(
+        "Whether the entity lane runs: surface the section whose `## ` heading names a distinctive entity the message mentions. Recall-additive and ~free when the message names no catalogued entity.",
+      ),
+    idfFloor: z
+      .number({ error: "memory.v3.entity.idfFloor must be a number" })
+      .nonnegative("memory.v3.entity.idfFloor must be a non-negative number")
+      .default(4)
+      .describe(
+        'Minimum corpus IDF for a `## ` heading token to become an entity key. Excludes hub tokens (e.g. "vellum") common enough that an exact match cannot disambiguate; those pages ride the core/hot lanes instead.',
+      ),
+    cap: z
+      .number({ error: "memory.v3.entity.cap must be a number" })
+      .int("memory.v3.entity.cap must be an integer")
+      .positive("memory.v3.entity.cap must be a positive integer")
+      .default(8)
+      .describe(
+        "Hard cap on the number of distinct entity-heading articles surfaced per turn.",
+      ),
+  })
+  .describe(
+    "Memory v3 entity-lane (heading-anchored named-entity match) tuning.",
+  );
+
 // NOTE: a retired `workingSet` sub-config (maxPages/evictWindow for the old
 // per-turn carry set) used to live here. Existing user config files may still
 // contain the key; zod default unknown-key stripping accepts and ignores it,
 // so legacy configs keep parsing. Do not make this object `.strict()`.
+//
+// The retrieval tuning defaults across these sub-schemas (hotSet.k, freshSet.k,
+// learnedEdges.cap, edge.{seedCount,perSeed,cap}) and the top-level needleK /
+// denseK / replyQueryK / selectorEnabled are the FULL (established-corpus)
+// profile. Sparse-corpus assistants run the lean new-user profile
+// (`resolveV3Tuning` / `MEMORY_V3_NEW_USER_TUNING` in the v3 plugin's
+// `tuning-profile.ts`) until they cross `MEMORY_V3_FULL_PROFILE_MIN_PAGES` real
+// concept pages, at which point these configured values take effect.
 export const MemoryV3ConfigSchema = z
   .object({
     live: z
@@ -238,18 +281,18 @@ export const MemoryV3ConfigSchema = z
     needleK: z
       .number({ error: "memory.v3.needleK must be a number" })
       .int("memory.v3.needleK must be an integer")
-      .positive("memory.v3.needleK must be a positive integer")
+      .nonnegative("memory.v3.needleK must be a non-negative integer")
       .default(100)
       .describe(
-        "Number of section-grain BM25 needle articles folded into the candidate pool each turn.",
+        "Number of section-grain BM25 needle articles folded into the candidate pool each turn. 0 disables the needle lane.",
       ),
     denseK: z
       .number({ error: "memory.v3.denseK must be a number" })
       .int("memory.v3.denseK must be an integer")
-      .positive("memory.v3.denseK must be a positive integer")
+      .nonnegative("memory.v3.denseK must be a non-negative integer")
       .default(100)
       .describe(
-        "Number of dense-lane articles folded into the candidate pool each turn.",
+        "Number of dense-lane articles folded into the candidate pool each turn after embedding the turn query. 0 disables dense retrieval for both current-message and reply-query passes.",
       ),
     replyQueryK: z
       .number({ error: "memory.v3.replyQueryK must be a number" })
@@ -259,6 +302,12 @@ export const MemoryV3ConfigSchema = z
       .describe(
         "Per-lane article budget for the reply-query finder pass: needle and dense each re-run over the assistant's previous message as separate queries (never concatenated with the user's message). 0 disables the pass. Deliberately small next to needleK/denseK — the pass adds the assistant-side retrieval signal, not a second full sweep.",
       ),
+    selectorEnabled: z
+      .boolean({ error: "memory.v3.selectorEnabled must be a boolean" })
+      .default(true)
+      .describe(
+        "Whether to run the memory-v3 selector LLM callsite over the candidate pool. When false, every pooled candidate is passed through to injection directly; an empty pool produces no memory block.",
+      ),
     selectorPromptPath: z
       .string({ error: "memory.v3.selectorPromptPath must be a string" })
       .nullable()
@@ -267,6 +316,7 @@ export const MemoryV3ConfigSchema = z
         "Optional path to a file whose contents replace the bundled per-turn selector system prompt (the instructions that tell the selector which candidate pages to keep). Absolute paths are used as-is, a leading `~/` is expanded to the home directory, otherwise the path is resolved under the workspace root. The selector prompt takes no placeholders — the candidate pool is supplied separately as the user message — so the file is used verbatim. If the file is missing, unreadable, empty, or over 1 MiB, the bundled prompt is used and a warning is logged.",
       ),
     edge: MemoryV3EdgeSchema.default(MemoryV3EdgeSchema.parse({})),
+    entity: MemoryV3EntitySchema.default(MemoryV3EntitySchema.parse({})),
   })
   .describe("Memory v3 — section-grain lane retrieval");
 

package/src/config/schemas/migrations.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+
+export const MigrationsWorkerConfigSchema = z
+  .object({
+    enabled: z
+      .boolean({ error: "migrations.worker.enabled must be a boolean" })
+      .default(false)
+      .describe(
+        "Enable the async migration worker. While false, migrations that are too expensive to run inside the synchronous startup migration runner skip their work and pass, deferring until the async runner is in place.",
+      ),
+  })
+  .describe("Async migration worker configuration");
+
+export const MigrationsConfigSchema = z
+  .object({
+    worker: MigrationsWorkerConfigSchema.default(
+      MigrationsWorkerConfigSchema.parse({}),
+    ),
+  })
+  .describe("Workspace/database migration configuration");
+
+export type MigrationsWorkerConfig = z.infer<
+  typeof MigrationsWorkerConfigSchema
+>;
+export type MigrationsConfig = z.infer<typeof MigrationsConfigSchema>;

package/src/config/schemas/services.ts

@@ -115,42 +115,6 @@ const HubspotOAuthServiceSchema = BaseServiceSchema.extend({
   mode: ServiceModeSchema.default("your-own"),
 });
 
-/**
- * `services.meet.host.*` — daemon-side knobs for the externalized meet-join
- * skill process. Kept narrow: only the values the daemon reads before the
- * meet-host child is spawned live here. Skill-internal configuration
- * (avatar renderer, consent copy, proactive-chat keywords, etc.) lives in
- * `skills/meet-join/config-schema.ts` and is sourced from the separate
- * `<workspace>/config/meet.json` file the skill owns.
- */
-const MeetHostConfigSchema = z
-  .object({
-    idle_timeout_ms: z
-      .number({
-        error: "services.meet.host.idle_timeout_ms must be a number",
-      })
-      .int()
-      .nonnegative()
-      .optional()
-      .describe(
-        "Idle window in milliseconds after the last active meet session closes before the meet-host child is shut down. Defaults to 5 minutes when unset.",
-      ),
-  })
-  .describe("Daemon-side configuration for the external meet-join skill host");
-
-/**
- * Daemon-side `services.meet` block. Intentionally distinct from the
- * skill-internal `MeetServiceSchema` in `skills/meet-join/config-schema.ts`,
- * which validates the bot-facing `<workspace>/config/meet.json` file. This
- * schema only describes the keys the assistant itself reads from its global
- * `config.json` before the meet-host child process is spawned.
- */
-const MeetDaemonServiceSchema = z
-  .object({
-    host: MeetHostConfigSchema.default(MeetHostConfigSchema.parse({})),
-  })
-  .describe("meet-join skill daemon-side configuration");
-
 export const ServicesSchema = z.object({
   inference: InferenceServiceSchema.default(InferenceServiceSchema.parse({})),
   "image-generation": ImageGenerationServiceSchema.default(
@@ -196,7 +160,6 @@ export const ServicesSchema = z.object({
   "hubspot-oauth": HubspotOAuthServiceSchema.default(
     HubspotOAuthServiceSchema.parse({}),
   ),
-  meet: MeetDaemonServiceSchema.default(MeetDaemonServiceSchema.parse({})),
 });
 export type Services = z.infer<typeof ServicesSchema>;
 

package/src/config/seed-inference-profiles.ts

@@ -1,4 +1,4 @@
-import type { DrizzleDb } from "../memory/db-connection.js";
+import type { DrizzleDb } from "../persistence/db-connection.js";
 import {
   createConnection,
   getConnection,
@@ -42,51 +42,36 @@ type ManagedProfileTemplate = Omit<
  * (`preserveProfileNames`) take precedence when present.
  */
 const MANAGED_PROFILE_TEMPLATES: Record<string, ManagedProfileTemplate> = {
-  // Served by MiniMax M3 on Together AI via managed platform inference: a strong
-  // open model at a lower price point than the managed Anthropic route.
-  balanced: {
-    intent: "balanced",
-    provider: "together",
-    connectionName: "together-managed",
-    source: "managed",
-    label: "Balanced",
-    description: "Good balance of quality, cost, and speed",
-    maxTokens: 32000,
-    effort: "medium",
-    thinking: { enabled: true, streamThinking: true },
-    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
-    topP: 0.95,
-  },
   // Served by GLM 5.2 on Fireworks via managed platform inference: a leading
-  // open model. `model` is pinned explicitly rather than resolved via the
-  // `quality-optimized` intent (which still maps to Anthropic Opus for the
-  // `frontier` profile below).
-  "quality-optimized": {
+  // open model at a balanced price point. `model` is pinned explicitly rather
+  // than resolved via the `balanced` intent (which still maps to MiniMax M3 on
+  // Together for `custom-balanced` and OS beta).
+  balanced: {
     model: "accounts/fireworks/models/glm-5p2",
     provider: "fireworks",
     connectionName: "fireworks-managed",
     source: "managed",
-    label: "Quality",
-    description: "High-quality results with a leading open model (GLM 5.2)",
+    label: "Balanced",
+    description: "Good balance of quality, cost, and speed",
     maxTokens: 32000,
     effort: "high",
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
   },
-  frontier: {
+  // Served by Anthropic Opus via managed platform inference — the most capable
+  // managed profile. The `quality-optimized` intent resolves to Opus for the
+  // `anthropic` provider.
+  "quality-optimized": {
     intent: "quality-optimized",
     provider: "anthropic",
     connectionName: "anthropic-managed",
     source: "managed",
-    label: "Frontier",
-    description: "Best results with the most capable model",
+    label: "Quality",
+    description: "High-quality results with the most capable model",
     maxTokens: 32000,
     effort: "high",
     thinking: { enabled: true, streamThinking: true },
     contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
-    // This is the advisor's own (strongest) profile: when it's also the chat
-    // profile there's nothing stronger to consult, so the advisor defaults off.
-    advisorEnabled: false,
   },
   // Served by DeepSeek V4 Flash on Fireworks via managed platform inference: a
   // fast, low-cost open model. `model` is pinned explicitly rather than
@@ -191,15 +176,6 @@ export const MANAGED_PROFILE_NAMES = new Set([
   OS_BETA_PROFILE_KEY,
 ]);
 
-// Managed names introduced after profile-ownership metadata existed, so any
-// pre-existing same-named entry must have been user-created. The seed loop
-// protects these from being clobbered: a user may already own a profile under
-// such a name (the settings UI saves custom profiles without a `source`), so an
-// entry that isn't explicitly `source: "managed"` is treated as theirs. The
-// original canonical names (`balanced`/`quality-optimized`/`cost-optimized`)
-// predate ownership metadata — migration 052 seeded them source-less — so they
-// are NOT listed here and always reseed, even when source is absent.
-const NEWLY_RESERVED_MANAGED_NAMES = new Set(["frontier"]);
 const MIX_MIN_ARMS = 2;
 
 export type SeedInferenceProfilesOptions = {
@@ -224,11 +200,9 @@ export type SeedInferenceProfilesOptions = {
  *    `cost-optimized`): reconciled from the code templates on every boot —
  *    on-platform and off-platform alike — so Vellum can push model/config
  *    updates to customers in a release without a workspace migration. The
- *    templates own all profile content; `label`, `status`, `advisorEnabled`,
- *    and `topP` are user overrides that survive reseeds. Of those, only
- *    `label`, `status`, and `topP` are editable through the managed PUT route
- *    allowlist; `advisorEnabled` is edited via the generic config path but is
- *    still preserved here so it survives reboots.
+ *    templates own all profile content; `label`, `status`, and `topP` are user
+ *    overrides that survive reseeds and are editable through the managed PUT
+ *    route allowlist.
  *    Platform overlays (`preserveProfileNames`) take precedence for the boot
  *    they are supplied.
  *
@@ -283,14 +257,11 @@ export function seedInferenceProfiles(
   //    as usual.
   //
   //    A whitelist of user-editable fields survives the reconcile: `label`
-  //    (display rename), `status` (active/disabled toggle), `advisorEnabled`
-  //    (per-profile advisor toggle), and `topP` (sampling override) — the only
-  //    fields a user may override. The managed PUT route
-  //    `/v1/config/llm/profiles/:name` lets users patch `label`, `status`, and
-  //    `topP` on managed profiles without duplicating (its editable allowlist,
-  //    `MANAGED_PROFILE_EDITABLE_KEYS`, deliberately excludes `advisorEnabled`,
-  //    which is set through the generic config path). We honor every one of
-  //    these overrides across reseeds or they'd silently revert on every boot.
+  //    (display rename), `status` (active/disabled toggle), and `topP`
+  //    (sampling override) — the only fields a user may override. The managed
+  //    PUT route `/v1/config/llm/profiles/:name` lets users patch these on
+  //    managed profiles without duplicating. We honor every one of these
+  //    overrides across reseeds or they'd silently revert on every boot.
   //    Carry by key-presence rather than truthiness so an explicit `null` (user
   //    cleared the field) survives too.
   //
@@ -318,21 +289,6 @@ export function seedInferenceProfiles(
     if (preservedProfileNames.has(name)) continue;
 
     const previous = readObject(profiles[name]);
-    // Never clobber a custom profile that happens to share a *newly reserved*
-    // managed name (e.g. `frontier`): reseeding would change its provider/model
-    // and mark it managed. Treat anything not explicitly `source: "managed"` as
-    // the user's, since the settings UI saves custom profiles without a `source`
-    // and the source backfill below skips managed names. The original canonical
-    // names are excluded from this guard — they may be source-less *managed*
-    // entries from migration 052, so they must keep reseeding to receive
-    // template updates (see NEWLY_RESERVED_MANAGED_NAMES).
-    if (
-      NEWLY_RESERVED_MANAGED_NAMES.has(name) &&
-      previous &&
-      previous.source !== "managed"
-    ) {
-      continue;
-    }
     const effectiveTemplate: ManagedProfileTemplate = isByokMode
       ? { ...template, label: `${template.label} (Managed)` }
       : template;
@@ -362,12 +318,6 @@ export function seedInferenceProfiles(
             : previous.label;
       }
       if ("status" in previous) next.status = previous.status;
-      // The per-profile advisor toggle is a user override — preserve it across
-      // reseeds so a user's choice survives reboots (the template value only
-      // seeds the initial default, e.g. off for quality-optimized).
-      if ("advisorEnabled" in previous) {
-        next.advisorEnabled = previous.advisorEnabled;
-      }
       // `topP` is user-editable on managed profiles (see the managed-profile
       // editable allowlist on the PUT route) — preserve a user override across
       // reseeds, including an explicit `null` clear, or it would silently revert
@@ -440,19 +390,32 @@ export function seedInferenceProfiles(
     }
   }
 
-  // Advisor profile: default to the strongest managed profile when unset, so
-  // the advisor consults `frontier` (Anthropic Opus) out of the box, falling
-  // back to `quality-optimized` if `frontier` is unavailable. The `frontier`
-  // arm requires managed ownership: the seed loop above leaves a user-owned
-  // profile named `frontier` in place, and pointing the advisor at that would
-  // consult an arbitrary user model. Guarded on existence so it never names a
-  // missing profile (superRefine rejects that); off-platform/BYOK installs can
-  // repoint it at one of their own profiles.
-  if (readString(llm.advisorProfile) === undefined) {
-    if (readObject(profiles["frontier"])?.source === "managed") {
-      llm.advisorProfile = "frontier";
-    } else if (readObject(profiles["quality-optimized"]) !== null) {
-      llm.advisorProfile = "quality-optimized";
+  // Advisor profile: BYOK hatches default to the strongest personal profile
+  // backed by the entered provider key. Managed-profile hatches and registered
+  // platform installs default to the strongest active managed profile.
+  const requestedAdvisorProfile = readString(llm.advisorProfile);
+  const requestedAdvisorEntry =
+    requestedAdvisorProfile !== undefined
+      ? readObject(profiles[requestedAdvisorProfile])
+      : null;
+  const requestedAdvisorIsDisabledManaged =
+    requestedAdvisorEntry?.source === "managed" &&
+    requestedAdvisorEntry.status === "disabled";
+  const preferPersonalAdvisor =
+    userConnectionName !== undefined &&
+    hatchSelectedManagedConnection === undefined;
+  if (
+    requestedAdvisorProfile === undefined ||
+    requestedAdvisorIsDisabledManaged
+  ) {
+    const defaultAdvisorProfile = selectDefaultAdvisorProfile(
+      profiles,
+      preferPersonalAdvisor,
+    );
+    if (defaultAdvisorProfile) {
+      llm.advisorProfile = defaultAdvisorProfile;
+    } else if (requestedAdvisorIsDisabledManaged) {
+      delete llm.advisorProfile;
     }
   }
 
@@ -592,6 +555,47 @@ function readString(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
+function selectDefaultAdvisorProfile(
+  profiles: Record<string, Record<string, unknown>>,
+  preferPersonalProfile: boolean,
+): string | undefined {
+  const personal = firstActiveProfile(profiles, [
+    "custom-quality-optimized",
+    "custom-balanced",
+    "custom-cost-optimized",
+  ]);
+  const managed = firstActiveManagedProfile(profiles, [
+    "quality-optimized",
+    "balanced",
+    "cost-optimized",
+  ]);
+  return preferPersonalProfile ? (personal ?? managed) : (managed ?? personal);
+}
+
+function firstActiveProfile(
+  profiles: Record<string, Record<string, unknown>>,
+  names: string[],
+): string | undefined {
+  for (const name of names) {
+    const profile = readObject(profiles[name]);
+    if (profile && profile.status !== "disabled") return name;
+  }
+  return undefined;
+}
+
+function firstActiveManagedProfile(
+  profiles: Record<string, Record<string, unknown>>,
+  names: string[],
+): string | undefined {
+  for (const name of names) {
+    const profile = readObject(profiles[name]);
+    if (profile?.source === "managed" && profile.status !== "disabled") {
+      return name;
+    }
+  }
+  return undefined;
+}
+
 function getHatchSelectedManagedConnection(
   llm: Record<string, unknown>,
   profiles: Record<string, Record<string, unknown>>,

package/src/config/sync-gated-profiles.ts

@@ -117,9 +117,6 @@ function enableProfile(
     // Preserve user-owned overrides across reconciles.
     if ("label" in previous) next.label = previous.label;
     if ("status" in previous) next.status = previous.status;
-    if ("advisorEnabled" in previous) {
-      next.advisorEnabled = previous.advisorEnabled;
-    }
     if ("topP" in previous) next.topP = previous.topP;
   }
 
@@ -192,23 +189,12 @@ function disableProfile(
     typeof llm.advisorProfile === "string" &&
     removed.has(llm.advisorProfile)
   ) {
-    // Repoint the advisor at the managed Frontier profile (the strongest).
-    // `frontier` is seeded unconditionally every boot, so target it even if it
-    // has not been materialized yet this startup — this reconcile can run before
-    // the seeder in the boot sequence, and the later seeder won't rewrite an
-    // already-set `advisorProfile`. The exception is a user-owned profile named
-    // `frontier`: that is not ours to route to, so fall back to the
-    // always-managed Quality profile, then clear the pointer as a last resort.
-    const frontierEntry = readObject(profiles["frontier"]);
-    const frontierIsUserOwned =
-      frontierEntry !== null && frontierEntry.source !== "managed";
-    if (!frontierIsUserOwned) {
-      llm.advisorProfile = "frontier";
-    } else if (readObject(profiles["quality-optimized"]) !== null) {
-      llm.advisorProfile = "quality-optimized";
-    } else {
-      delete llm.advisorProfile;
-    }
+    // Repoint the advisor at the managed Quality profile (the strongest).
+    // `quality-optimized` is a canonical name seeded unconditionally every boot,
+    // so target it even if it has not been materialized yet this startup — this
+    // reconcile can run before the seeder in the boot sequence, and the later
+    // seeder won't rewrite an already-set `advisorProfile`.
+    llm.advisorProfile = "quality-optimized";
   }
 
   // Clear any call-site `profile` reference to a removed profile; other override

package/src/contacts/__tests__/contacts-write-revoke-relay.test.ts

@@ -40,14 +40,13 @@ mock.module("../../ipc/gateway-client.js", () => ({
 }));
 
 
-// Local-mirror primitive.
+// Local resolver primitive — resolves the native contact/channel by id; the
+// gateway owns the ACL downgrade, so it takes no reason and mutates nothing.
 const revokeMemberResult: ContactWriteResult = {
   contact: { id: "c1" } as ContactWriteResult["contact"],
-  channel: { id: "ch1", status: "revoked" } as ContactWriteResult["channel"],
+  channel: { id: "ch1" } as ContactWriteResult["channel"],
 };
-const revokeMemberMock = mock((_memberId: string, _reason?: string) =>
-  revokeMemberResult,
-);
+const revokeMemberMock = mock((_memberId: string) => revokeMemberResult);
 const actualContactsWrite = await import("../contacts-write.js");
 mock.module("../contacts-write.js", () => ({
   ...actualContactsWrite,
@@ -75,7 +74,7 @@ describe("revokeMemberChannel gateway-first relay", () => {
       },
     ]);
     expect(revokeMemberMock).toHaveBeenCalledTimes(1);
-    expect(revokeMemberMock).toHaveBeenCalledWith("ch1", "removed");
+    expect(revokeMemberMock).toHaveBeenCalledWith("ch1");
     expect(result).toBe(revokeMemberResult);
   });
 
@@ -83,8 +82,8 @@ describe("revokeMemberChannel gateway-first relay", () => {
     await revokeMemberChannel("c1:ch1");
 
     expect(ipcCalls[0]?.params?.contactChannelId).toBe("ch1");
-    // The local mirror still receives the original composite id it accepts.
-    expect(revokeMemberMock).toHaveBeenCalledWith("c1:ch1", undefined);
+    // The local resolver still receives the original composite id it accepts.
+    expect(revokeMemberMock).toHaveBeenCalledWith("c1:ch1");
   });
 
   test("always relays — never skips based on local mirror status", async () => {