@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/config/call-site-defaults.ts

@@ -45,9 +45,16 @@ export const CALL_SITE_DEFAULTS: Record<LLMCallSite, CallSiteDefaultConfig> = {
     profile: "cost-optimized",
     contextWindow: { maxInputTokens: 1000000 },
   },
+  // Forced-tool selection over a numbered candidate pool: the model picks ids,
+  // it does not reason its way to an answer. `effort` has to be named here
+  // because a call-site tweak only overrides the fields it lists, so leaving it
+  // off inherits `balanced`'s `effort: "high"` (see default-profile-catalog).
+  // Low effort matches `recall`, the sibling site doing the same kind of
+  // bounded judgment, and keeps retrieval latency low on escalated voice turns.
   memoryV3SelectL2: {
     profile: "balanced",
     temperature: 0,
+    effort: "low",
     thinking: { enabled: false, streamThinking: false },
   },
   recall: {
@@ -121,22 +128,21 @@ export const CALL_SITE_DEFAULTS: Record<LLMCallSite, CallSiteDefaultConfig> = {
     effort: "low",
     thinking: { enabled: false },
   },
-  // Endpoint decisions gate live-voice turn-end latency, and `cost-optimized`'s
-  // upstream cannot fit any usable decision budget (~1s+ per forced tool call).
+  // Progress narration only helps when it arrives before the next real output.
   // `latency-optimized` is the latency-class profile (see
   // default-profile-catalog.ts): managed installs get the pinned latency model,
   // BYOK installs resolve their own provider's latency model through the intent
   // table rather than a model id they may hold no credential for. The profile
   // is user-facing ("Speed"), so a user edit to it moves this call site too.
-  voiceFrontDecision: {
+  voiceProgressNarration: {
     profile: "latency-optimized",
     effort: "low",
     thinking: { enabled: false },
   },
   // The front-door leg fronts EVERY unified live-voice turn and its leading
   // tokens ARE the endpointing/triage verdict, so both TTFT variance and
-  // judgment quality gate the whole call. Same latency class as the endpoint
-  // decider: live drives showed the cost-optimized upstream with multi-second
+  // judgment quality gate the whole call. Live drives showed the
+  // cost-optimized upstream with multi-second
   // cross-session TTFT tails and over-escalation of small talk under open-task
   // context pressure.
   voiceFrontDoor: {

package/src/config/default-profile-catalog.ts

@@ -4,8 +4,10 @@ import {
   isModelInCatalog,
 } from "../providers/model-catalog.js";
 import { resolveModelIntent } from "../providers/model-intents.js";
+import { isCodexSubscriptionModel } from "../providers/openai/codex-models.js";
 import type { ModelIntent } from "../providers/types.js";
 import { getManagedUpstream } from "../providers/vellum-model-routing.js";
+import { getBalancedModelExperimentArm } from "./balanced-model-experiment.js";
 import {
   DEFAULT_PROFILE_KEYS,
   DEFAULT_PROFILE_PROVIDERS,
@@ -31,7 +33,8 @@ import {
  * structured as an intent × provider matrix: each default profile is an
  * intent, and each provider that can serve default profiles has a concrete
  * implementation of that intent (model, token budget, effort, thinking).
- * The `vellum` column is the platform-managed implementation; the other
+ * The `vellum` column is the platform-managed implementation and the
+ * `chatgpt` column is the ChatGPT-subscription implementation; the other
  * columns are the BYOK implementations resolved through `llm.defaultProvider`
  * on off-platform installs.
  *
@@ -96,7 +99,7 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
     },
   },
   "cost-optimized": {
-    model: "accounts/fireworks/models/deepseek-v4-flash",
+    model: "accounts/fireworks/models/deepseek-v4-flash-0731",
     provider: "vellum",
     source: "managed",
     label: "Cost",
@@ -147,6 +150,108 @@ const VELLUM_PROFILE_IMPLS: ProfileImpls = {
   },
 };
 
+/**
+ * Arm to managed model pin for the `experiment-balanced-model-2026-08-06` A/B
+ * test (`balanced-model-experiment.ts` owns the flag read). An arm repoints
+ * the model of the managed (`vellum`) implementation of `balanced` and nothing
+ * else: effort, thinking, token budget, label and description all stay on the
+ * shipped body, and the `chatgpt` and BYOK columns are untouched because those
+ * installs run the provider their user chose and sit outside the experiment.
+ *
+ * `control` is absent by design. It, an arm this build does not know, and an
+ * unset flag all resolve to the shipped body, so no LaunchDarkly value can
+ * strand an install on a model that is not pinned here. A `Map` rather than an
+ * object literal keeps that true for every string LaunchDarkly can send: the
+ * arm is remote input, and an object lookup would resolve `constructor` or
+ * `toString` to an inherited `Object.prototype` member instead of missing.
+ *
+ * `glm-5p2` is text-only: Balanced does not pass `doesSupportVision` on that
+ * arm, so image input routes through the image-fallback captioning plugin.
+ */
+const BALANCED_EXPERIMENT_MODELS = new Map<string, string>([
+  ["terra", "gpt-5.6-terra"],
+  ["glm-5p2", "accounts/fireworks/models/glm-5p2"],
+]);
+
+/**
+ * The managed (`vellum`) implementation of a default profile, carrying the
+ * balanced-model experiment arm. Resolved per call rather than materialized
+ * once: the gateway pushes flag changes to a running daemon, so the arm can
+ * move under a live process.
+ */
+function managedProfileImpl(key: DefaultProfileKey): DefaultProfileTemplate {
+  const impl = VELLUM_PROFILE_IMPLS[key];
+  if (key !== "balanced") {
+    return impl;
+  }
+  const arm = getBalancedModelExperimentArm();
+  const model = arm == null ? undefined : BALANCED_EXPERIMENT_MODELS.get(arm);
+  return model == null ? impl : { ...impl, model };
+}
+
+/**
+ * The `chatgpt` column: ChatGPT-subscription implementations, stamped
+ * `provider: "chatgpt"` so dispatch routes through the canonical
+ * `chatgpt-subscription` row via `resolveRoutingIdentity` with no pinned
+ * connection. Models are pinned (never intents): the intent tables are
+ * keyed by concrete dispatch providers, and the Codex endpoint serves only
+ * `CODEX_SUBSCRIPTION_MODEL_IDS`. Cost and Speed are identical
+ * implementations here: the subscription serves no tier cheaper or faster
+ * than luna, and both profiles advertise reasoning off.
+ */
+const CHATGPT_PROFILE_IMPLS: ProfileImpls = {
+  balanced: {
+    model: "gpt-5.6-luna",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Balanced",
+    description: "Good balance of quality, cost, and speed",
+    // Matches the vellum column's Balanced (same model): the Codex path
+    // sends no max_output_tokens, so this only sizes internal budgeting.
+    maxTokens: 32000,
+    effort: "high",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "quality-optimized": {
+    model: "gpt-5.6-sol",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Quality",
+    description: "Best results with the most capable model",
+    maxTokens: 32000,
+    effort: "high",
+    thinking: { enabled: true, streamThinking: true },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "cost-optimized": {
+    model: "gpt-5.6-luna",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Cost",
+    description: "Cheapest responses, for high-volume work",
+    maxTokens: 8192,
+    effort: "none",
+    thinking: { enabled: false, streamThinking: false },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+  "latency-optimized": {
+    model: "gpt-5.6-luna",
+    provider: "chatgpt",
+    source: "managed",
+    label: "Speed",
+    description: "Fastest responses, with reasoning turned off",
+    maxTokens: 8192,
+    // Explicit reasoning opt-out, matching the other columns: this profile
+    // advertises reasoning as off, and OpenAI-compat APIs default reasoning
+    // to "medium" when the field is omitted, so the opt-out has to be stated
+    // rather than implied.
+    effort: "none",
+    thinking: { enabled: false, streamThinking: false },
+    contextWindow: { maxInputTokens: DEFAULT_CONTEXT_WINDOW_MAX_INPUT_TOKENS },
+  },
+};
+
 /**
  * The BYOK implementation of each default profile intent, shared by every
  * non-vellum provider. The concrete model resolves per provider from the
@@ -219,7 +324,9 @@ export const PROFILE_IMPLS: Record<
         provider,
         provider === "vellum"
           ? VELLUM_PROFILE_IMPLS[key]
-          : { ...BYOK_PROFILE_IMPLS[key], provider },
+          : provider === "chatgpt"
+            ? CHATGPT_PROFILE_IMPLS[key]
+            : { ...BYOK_PROFILE_IMPLS[key], provider },
       ]),
     ) as Record<DefaultProfileProvider, DefaultProfileTemplate>,
   ]),
@@ -302,9 +409,9 @@ export const OS_BETA_PROFILE_TEMPLATE: DefaultProfileTemplate = {
 /**
  * Profiles whose body is code-owned outright: no workspace overlay, and no
  * user-owned shadow. The shadow rule below lets a user replace a default they
- * can select, but `latency-optimized` fronts every live-voice turn through
- * `voiceFrontDecision`/`voiceFrontDoor`, where a model outside the latency
- * envelope is audible dead air rather than a slow reply. A same-named
+ * can select, but `latency-optimized` serves `voiceFrontDoor` and
+ * `voiceProgressNarration`, where a model outside the latency envelope is
+ * audible dead air rather than a slow reply. A same-named
  * workspace entry stays on disk and stays listed; it just never governs what
  * this name resolves to.
  */
@@ -372,21 +479,23 @@ for (const key of DEFAULT_PROFILE_KEYS) {
         `PROFILE_IMPLS[${key}][${provider}] must set exactly one of \`intent\` or \`model\`.`,
       );
     }
-    if (impl.provider === "vellum" && impl.model == null) {
+    if (ROUTING_IDENTITY_PROVIDERS.has(impl.provider) && impl.model == null) {
       throw new Error(
-        `PROFILE_IMPLS[${key}][${provider}] must pin a \`model\`: the vellum ` +
-          `column has no intent table, and the model selects the upstream.`,
+        `PROFILE_IMPLS[${key}][${provider}] must pin a \`model\`: routing ` +
+          `identities have no intent table, and the model selects the route.`,
       );
     }
     if (impl.model != null) {
       const routable =
         impl.provider === "vellum"
           ? getManagedUpstream(impl.model) !== null
-          : isModelInCatalog(impl.provider, impl.model);
+          : impl.provider === "chatgpt"
+            ? isCodexSubscriptionModel(impl.model)
+            : isModelInCatalog(impl.provider, impl.model);
       if (!routable) {
         throw new Error(
           `PROFILE_IMPLS[${key}][${provider}] references model "${impl.model}" ` +
-            `which is not ${impl.provider === "vellum" ? "served by any managed upstream" : `in PROVIDER_CATALOG for provider "${impl.provider}"`}. ` +
+            `which is not ${impl.provider === "vellum" ? "served by any managed upstream" : impl.provider === "chatgpt" ? "in CODEX_SUBSCRIPTION_MODEL_IDS" : `in PROVIDER_CATALOG for provider "${impl.provider}"`}. ` +
             `Update model-catalog.ts or default-profile-catalog.ts.`,
         );
       }
@@ -394,6 +503,19 @@ for (const key of DEFAULT_PROFILE_KEYS) {
   }
 }
 
+// The experiment arms substitute into the managed column at request time, so
+// they need the same routability guarantee as the pins validated above: a
+// LaunchDarkly arm must never select a model no managed upstream serves.
+for (const [arm, model] of BALANCED_EXPERIMENT_MODELS) {
+  if (getManagedUpstream(model) === null) {
+    throw new Error(
+      `BALANCED_EXPERIMENT_MODELS["${arm}"] references model "${model}" which ` +
+        `is not served by any managed upstream. ` +
+        `Update model-catalog.ts or default-profile-catalog.ts.`,
+    );
+  }
+}
+
 // Provider choices without a named column materialize from the shared BYOK
 // templates; verify each one's resolved model lands in the catalog.
 for (const provider of DEFAULT_PROVIDER_CHOICES) {
@@ -432,6 +554,14 @@ function buildDefaultProfileEntries(): Record<string, ProfileEntry> {
  * The materialized code-default bodies keyed by profile name — the
  * code-owned content a managed-source workspace entry resolves to. These are
  * the `vellum` column (the managed implementations).
+ *
+ * Materialized once at module load, so this is the shipped catalog: the
+ * balanced-model experiment arm is applied by the provider-aware resolvers
+ * (`resolveDefaultProfileForProvider`, `getEffectiveProfilesForProvider`),
+ * which are what every runtime and client-facing reader of a default profile's
+ * content goes through. The name-only readers that serve from this record
+ * (`getEffectiveProfile`, `getEffectiveProfiles`) consume a profile's
+ * existence and status, never its model.
  */
 export const CODE_DEFAULT_PROFILE_ENTRIES: Readonly<
   Record<string, ProfileEntry>
@@ -517,7 +647,9 @@ function resolveAgainstBody(
  * Non-obvious rules:
  *
  * - The `vellum` column stamps `provider: "vellum"` with no connection —
- *   dispatch derives the upstream from the model per-request.
+ *   dispatch derives the upstream from the model per-request. The `chatgpt`
+ *   column likewise stamps its routing identity with no connection;
+ *   dispatch resolves the canonical subscription row per-request.
  * - A default provider without a named matrix column materializes from the
  *   shared `BYOK_PROFILE_IMPLS` templates, with `resolveModelIntent`
  *   falling back to the provider's catalog `defaultModel`.
@@ -543,17 +675,48 @@ export function isDefaultProfileKey(name: string): name is DefaultProfileKey {
   return (DEFAULT_PROFILE_KEYS as readonly string[]).includes(name);
 }
 
+/**
+ * The implementation of default profile `key` on `provider`: the named matrix
+ * column when the provider has one, the shared BYOK template otherwise. The
+ * managed column carries the balanced-model experiment arm, which is why the
+ * lookup runs through here rather than reading `PROFILE_IMPLS` directly.
+ */
+function defaultProfileImplForProvider(
+  key: DefaultProfileKey,
+  provider: NonNullable<ProfileEntry["provider"]>,
+): DefaultProfileTemplate {
+  if (!isDefaultProfileProvider(provider)) {
+    return { ...BYOK_PROFILE_IMPLS[key], provider };
+  }
+  if (provider === "vellum") {
+    return managedProfileImpl(key);
+  }
+  return PROFILE_IMPLS[key][provider];
+}
+
+/**
+ * The code-owned body a default profile name resolves to under the given
+ * default provider. This is the single choke point where a default profile key
+ * becomes a concrete body, so every consumer (the runtime resolver through
+ * `resolveDefaultProfileForProvider`, the client-facing listing through
+ * `getEffectiveProfilesForProvider`) reports the same model the request runs
+ * on, experiment arm included.
+ */
 function defaultProfileBodyForProvider(
   name: string,
   defaultProvider: DefaultProviderConfig | null,
 ): ProfileEntry | undefined {
-  if (defaultProvider == null || !isDefaultProfileKey(name)) {
+  if (!isDefaultProfileKey(name)) {
     return CODE_DEFAULT_PROFILE_ENTRIES[name];
   }
+  if (defaultProvider == null) {
+    // The frozen `CODE_DEFAULT_PROFILE_ENTRIES` body, re-materialized so an
+    // install that predates `llm.defaultProvider` still sees the arm.
+    const managed = managedProfileImpl(name);
+    return materializeProfile(managed, managed.provider);
+  }
   const { provider } = defaultProvider;
-  const impl = isDefaultProfileProvider(provider)
-    ? PROFILE_IMPLS[name][provider]
-    : { ...BYOK_PROFILE_IMPLS[name], provider };
+  const impl = defaultProfileImplForProvider(name, provider);
   return clampMaxTokensToModelCap({
     ...materializeProfile(
       impl,

package/src/config/default-profile-names.ts

@@ -38,7 +38,9 @@ export const OS_BETA_PROFILE_KEY = "os-beta";
 /**
  * The named columns of the intent × provider matrix. `vellum` is the
  * platform-managed column (routed through the single `vellum` connection to
- * an underlying provider per profile); the rest are BYOK columns whose
+ * an underlying provider per profile) and `chatgpt` is the
+ * ChatGPT-subscription column (routed through the `chatgpt-subscription`
+ * connection to the Codex endpoint); the rest are BYOK columns whose
  * models resolve per provider via `resolveModelIntent`. The full set of
  * providers that can back `llm.defaultProvider` is wider, see
  * `DEFAULT_PROVIDER_CHOICES` in `schemas/llm.ts`.
@@ -53,6 +55,7 @@ export const DEFAULT_PROFILE_PROVIDERS = [
   "gemini",
   "fireworks",
   "openrouter",
+  "chatgpt",
   "vellum",
 ] as const;
 export type DefaultProfileProvider = (typeof DEFAULT_PROFILE_PROVIDERS)[number];

package/src/config/default-provider-resolution.ts

@@ -6,6 +6,7 @@
  * conveniences (`getDefaultProvider()` without an argument,
  * `setDefaultProvider`) live in `default-provider.ts`.
  */
+import { CHATGPT_SUBSCRIPTION_CONNECTION_NAME } from "../providers/inference/auth.js";
 import { VELLUM_MANAGED_CONNECTION_NAME } from "../providers/vellum-model-routing.js";
 import type { DefaultProviderConfig } from "./schemas/llm.js";
 import type { AssistantConfig } from "./types.js";
@@ -29,5 +30,8 @@ export function resolveDefaultConnectionName(
   if (dp.provider === "vellum") {
     return VELLUM_MANAGED_CONNECTION_NAME;
   }
+  if (dp.provider === "chatgpt") {
+    return CHATGPT_SUBSCRIPTION_CONNECTION_NAME;
+  }
   return `${dp.provider}-personal`;
 }

package/src/config/feature-flag-registry.json

@@ -36,15 +36,6 @@
       "defaultEnabled": "control",
       "values": ["control", "variant-a", "personal-page"]
     },
-    {
-      "id": "experiment-billing-cta-2026-07-23",
-      "scope": "client",
-      "key": "experiment-billing-cta-2026-07-23",
-      "label": "Experiment: Billing CTA 2026-07-23",
-      "description": "Credit paywall CTA experiment. control = single Add Credits CTA for everyone (opens Add Credits modal). upgrade-cta = FREE users (plan_id base) get a single Upgrade CTA (View Plans takeover) instead; PAID users still get Add Credits.",
-      "defaultEnabled": "control",
-      "values": ["control", "upgrade-cta"]
-    },
     {
       "id": "local-docker-enabled",
       "scope": "client",
@@ -247,10 +238,10 @@
     },
     {
       "id": "web-remote-ingress",
-      "scope": "assistant",
+      "scope": "client",
       "key": "web-remote-ingress",
       "label": "Web Remote Ingress",
-      "description": "Serve the web client over a public tunnel and enable browser pairing for self-hosted assistants.",
+      "description": "Show the pair-a-device card in web settings. Visibility only; pairing itself is always available.",
       "defaultEnabled": false
     },
     {
@@ -371,7 +362,16 @@
       "key": "plugin-schedules",
       "label": "Plugin Schedules",
       "description": "Plugins declare recurring schedules as files that register and run automatically",
-      "defaultEnabled": false
+      "defaultEnabled": true
+    },
+    {
+      "id": "experiment-balanced-model-2026-08-06",
+      "scope": "assistant",
+      "key": "experiment-balanced-model-2026-08-06",
+      "label": "Experiment: Balanced Profile Model",
+      "description": "Multivariate experiment on the model the managed Balanced inference profile resolves to. control = gpt-5.6-luna (the shipped pin); terra = gpt-5.6-terra; glm-5p2 = accounts/fireworks/models/glm-5p2. Only the managed (vellum) implementation moves: ChatGPT-subscription and BYOK installs run the provider the user chose and are outside the experiment. Rollout and targeting are managed in the LaunchDarkly dashboard; any value that is not an arm name resolves to control.",
+      "defaultEnabled": "control",
+      "values": ["control", "terra", "glm-5p2"]
     }
   ]
 }

package/src/config/llm-context-resolution.ts

@@ -1,3 +1,4 @@
+import { resolveEntryProviderKind } from "../providers/connection-resolution.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
 import {
   getCatalogProviderForModel,
@@ -54,11 +55,18 @@ export function resolveEffectiveContextWindow({
     forceOverrideProfile,
     selectionSeed,
   });
-  // Routing identities are not catalog providers; the model's catalog owner
-  // carries its context-window limits.
+  // Routing identities dispatch built-in catalog models, so the model's
+  // catalog owner carries their limits. An entry-name provider resolves
+  // through its row's kind instead: a custom-endpoint kind has no catalog
+  // models, so its models keep the conservative default even when a model
+  // id collides with a built-in one (the custom endpoint's "gpt-5.5" is not
+  // OpenAI's). Labels with no row fall back to the model's catalog owner.
   const catalogProviderId = ROUTING_IDENTITY_PROVIDERS.has(resolved.provider)
     ? getCatalogProviderForModel(resolved.model)
-    : resolved.provider;
+    : PROVIDER_CATALOG.some((p) => p.id === resolved.provider)
+      ? resolved.provider
+      : (resolveEntryProviderKind(resolved.provider, resolved.model) ??
+        getCatalogProviderForModel(resolved.model));
   const catalogModel = PROVIDER_CATALOG.find(
     (provider) => provider.id === catalogProviderId,
   )?.models.find((model) => model.id === resolved.model);

package/src/config/llm-resolver.ts

@@ -76,6 +76,15 @@ import {
  */
 export interface ResolveCallSiteOpts {
   overrideProfile?: string;
+  /**
+   * Whether a profile's provider value can actually dispatch: a known
+   * vendor, or a connection entry row. Selection is pure and DB-blind, so
+   * dispatch-side callers supply this (see `dispatchProviderResolvable` in
+   * `connection-resolution.ts`); a profile failing it is unusable and
+   * selection falls through to the next rung, keeping model and transport
+   * coherent. When absent, every provider is assumed resolvable.
+   */
+  isResolvableProvider?: (provider: string) => boolean;
   /**
    * Float `overrideProfile` above the call-site layers for non-main-agent call
    * sites. Retained for API compatibility; under single-winner selection the
@@ -112,7 +121,11 @@ export interface ResolveCallSiteOpts {
   }) => void;
 }
 
-export type ResolutionFallbackReason = "missing" | "disabled" | "incomplete";
+export type ResolutionFallbackReason =
+  | "missing"
+  | "disabled"
+  | "incomplete"
+  | "unresolvable";
 
 export interface ResolvedCallSiteConfig {
   config: z.infer<typeof LLMConfigBase>;
@@ -313,6 +326,20 @@ function usableEntry(
     report(name, "incomplete");
     return undefined;
   }
+  // A provider the caller cannot resolve (not a known vendor, not an entry
+  // row) makes the profile unusable, and selection falls through to the
+  // next rung the same way an incomplete profile does: the fallback keeps
+  // model and transport coherent, where a dispatch-time fallback would pair
+  // this profile's model with the default transport. Selection is DB-blind,
+  // so the predicate is supplied by dispatch-side callers; when absent,
+  // every provider is assumed resolvable.
+  if (
+    opts.isResolvableProvider != null &&
+    !opts.isResolvableProvider(entry.provider)
+  ) {
+    report(name, "unresolvable");
+    return undefined;
+  }
   return { name, entry };
 }
 

package/src/config/profile-materialization.ts

@@ -1,9 +1,12 @@
+import { getDb } from "../persistence/db-connection.js";
 import { ROUTING_IDENTITY_PROVIDERS } from "../providers/inference/auth.js";
+import { getConnection } from "../providers/inference/connections.js";
 import {
   getCatalogProviderForModel,
   isModelInCatalog,
 } from "../providers/model-catalog.js";
 import {
+  getManagedUpstream,
   MANAGED_ROUTABLE_PROVIDERS,
   VELLUM_MANAGED_CONNECTION_NAME,
 } from "../providers/vellum-model-routing.js";
@@ -97,35 +100,80 @@ export function completeCustomProfile(
     }
   }
 
-  // A provider-specific connection baked onto a different provider would pin
-  // a mismatch (dispatch auto-resolves an absent connection by provider
-  // instead). The Vellum managed connection must survive a provider change —
-  // dispatch routes it via `expectedProvider` — but only onto providers it
-  // can actually route; a non-managed-routable provider (openrouter, ollama)
-  // would hit the mismatch path instead of auto-resolution.
-  // Routing-identity providers resolve their connection per-request from
-  // the provider value; a stamped provider_connection would be dead weight
-  // at best and a misroute at worst.
+  // Completion never stamps a `provider_connection`; an inherited binding
+  // would only re-introduce the collapsed field on disk. The default's
+  // explicit binding is instead inherited IN the provider value, the
+  // entries-model representation: the vellum binding becomes the routing
+  // identity (only when it can serve the model, or the read-path schema
+  // would strip the profile), and a same-vendor binding becomes the entry
+  // name, so a completed profile keeps signing with the credential the
+  // workspace default names rather than whatever auto-resolution finds
+  // first.
   if (
     completed.provider !== undefined &&
-    ROUTING_IDENTITY_PROVIDERS.has(completed.provider)
+    !ROUTING_IDENTITY_PROVIDERS.has(completed.provider) &&
+    profile.provider_connection === undefined &&
+    dflt.provider_connection !== undefined
   ) {
-    return structuredClone(completed);
+    if (dflt.provider_connection === VELLUM_MANAGED_CONNECTION_NAME) {
+      // Only managed-servable pairs inherit the managed binding; anything
+      // else inherits nothing and lets dispatch auto-resolve by vendor,
+      // matching the pre-entries inheritance contract.
+      if (
+        MANAGED_ROUTABLE_PROVIDERS.has(completed.provider) &&
+        completed.model !== undefined &&
+        getManagedUpstream(completed.model) !== null
+      ) {
+        completed.provider = "vellum";
+      }
+    } else if (completed.provider === dflt.provider) {
+      // Folding to the entry name is only safe against a verified row; a
+      // dangling or kind-disagreeing binding stays in the legacy field,
+      // where the collapse migration's recovery can judge it.
+      if (bindingRowKind(dflt.provider_connection) === completed.provider) {
+        completed.provider = dflt.provider_connection;
+      } else {
+        completed.provider_connection = dflt.provider_connection;
+      }
+    }
   }
+  return structuredClone(completed);
+}
 
-  const vellumRoutable =
-    dflt.provider_connection === VELLUM_MANAGED_CONNECTION_NAME &&
-    completed.provider !== undefined &&
-    MANAGED_ROUTABLE_PROVIDERS.has(completed.provider);
-  if (
-    profile.provider_connection === undefined &&
-    dflt.provider_connection !== undefined &&
-    (completed.provider === dflt.provider || vellumRoutable)
-  ) {
-    completed.provider_connection = dflt.provider_connection;
+/**
+ * `{...raw, ...completed}` recursively: completed (schema-known) values win,
+ * raw keys the schema stripped survive at every depth. Used by boot
+ * materialization and the config write path so both preserve unknown keys
+ * the same way after `safeParse`.
+ */
+export function mergePreservingUnknownKeys(
+  raw: Record<string, unknown>,
+  completed: Record<string, unknown>,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...raw, ...completed };
+  for (const [key, value] of Object.entries(completed)) {
+    const rawValue = raw[key];
+    if (isRecord(value) && isRecord(rawValue)) {
+      out[key] = mergePreservingUnknownKeys(rawValue, value);
+    }
   }
+  return out;
+}
 
-  return structuredClone(completed);
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * The provider kind stored on a connection row, or null when the row is
+ * missing or the DB is unavailable (both mean "unverifiable" to callers).
+ */
+function bindingRowKind(name: string): string | null {
+  try {
+    return getConnection(getDb(), name)?.provider ?? null;
+  } catch {
+    return null;
+  }
 }
 
 type PlainObject = Record<string, unknown>;