@vellumai/assistant 0.7.1 → 0.7.3

package/src/__tests__/config-loader-backfill.test.ts

@@ -1,6 +1,7 @@
 import {
   existsSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   rmSync,
   writeFileSync,
@@ -63,12 +64,15 @@ afterAll(() => {
   mock.restore();
 });
 
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import {
-  deepMergeMissing,
   deepMergeOverwrite,
+  getConfig,
   invalidateConfigCache,
   loadConfig,
+  mergeDefaultWorkspaceConfig,
 } from "../config/loader.js";
+import { seedInferenceProfiles } from "../config/seed-inference-profiles.js";
 import { _setStorePath } from "../security/encrypted-store.js";
 
 // ---------------------------------------------------------------------------
@@ -79,73 +83,19 @@ function writeConfig(obj: unknown): void {
   writeFileSync(CONFIG_PATH, JSON.stringify(obj, null, 2) + "\n");
 }
 
-function readConfig(): Record<string, unknown> {
-  return JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
-}
-
-// ---------------------------------------------------------------------------
-// Tests: deepMergeMissing (unit)
-// ---------------------------------------------------------------------------
-
-describe("deepMergeMissing", () => {
-  test("adds missing top-level keys", () => {
-    const target: Record<string, unknown> = { a: 1 };
-    const defaults: Record<string, unknown> = { a: 99, b: 2 };
-    const changed = deepMergeMissing(target, defaults);
-    expect(changed).toBe(true);
-    expect(target).toEqual({ a: 1, b: 2 });
-  });
-
-  test("does not overwrite existing values", () => {
-    const target: Record<string, unknown> = { a: 1, b: "user" };
-    const defaults: Record<string, unknown> = { a: 99, b: "default" };
-    const changed = deepMergeMissing(target, defaults);
-    expect(changed).toBe(false);
-    expect(target).toEqual({ a: 1, b: "user" });
+function mergeDefaultConfigAndSeedInferenceProfiles(): void {
+  const defaultConfigMerge = mergeDefaultWorkspaceConfig();
+  seedInferenceProfiles({
+    preserveProfileNames: defaultConfigMerge.providedLlmProfileNames,
+    preserveActiveProfile: defaultConfigMerge.providedLlmActiveProfile,
   });
-
-  test("recursively fills nested objects", () => {
-    const target: Record<string, unknown> = {
-      nested: { existingKey: "keep" },
-    };
-    const defaults: Record<string, unknown> = {
-      nested: { existingKey: "default", newKey: 42 },
-    };
-    const changed = deepMergeMissing(target, defaults);
-    expect(changed).toBe(true);
-    expect(target).toEqual({
-      nested: { existingKey: "keep", newKey: 42 },
-    });
-  });
-
-  test("returns false when no changes needed", () => {
-    const target: Record<string, unknown> = { a: 1, b: { c: 3 } };
-    const defaults: Record<string, unknown> = { a: 99, b: { c: 100 } };
-    const changed = deepMergeMissing(target, defaults);
-    expect(changed).toBe(false);
-  });
-
-  test("does not merge arrays", () => {
-    const target: Record<string, unknown> = { items: [1, 2] };
-    const defaults: Record<string, unknown> = { items: [3, 4, 5] };
-    const changed = deepMergeMissing(target, defaults);
-    expect(changed).toBe(false);
-    expect(target).toEqual({ items: [1, 2] });
-  });
-
-  test("adds entire missing nested section", () => {
-    const target: Record<string, unknown> = {};
-    const defaults: Record<string, unknown> = {
-      slack: { deliverAuthBypass: false },
-    };
-    const changed = deepMergeMissing(target, defaults);
-    expect(changed).toBe(true);
-    expect(target).toEqual({ slack: { deliverAuthBypass: false } });
-  });
-});
+}
 
 // ---------------------------------------------------------------------------
 // Tests: deepMergeOverwrite (unit) — JSON-null-as-deletion semantics
+//
+// `deepMergeOverwrite` is used by `mergeDefaultWorkspaceConfig` and platform
+// override paths.
 // ---------------------------------------------------------------------------
 
 describe("deepMergeOverwrite", () => {
@@ -275,7 +225,11 @@ describe("deepMergeOverwrite", () => {
       heartbeat: { activeHoursStart: null, activeHoursEnd: null },
     });
     expect(target).toEqual({
-      heartbeat: { intervalMs: 6000, activeHoursStart: null, activeHoursEnd: null },
+      heartbeat: {
+        intervalMs: 6000,
+        activeHoursStart: null,
+        activeHoursEnd: null,
+      },
     });
   });
 
@@ -318,14 +272,21 @@ describe("deepMergeOverwrite", () => {
 });
 
 // ---------------------------------------------------------------------------
-// Tests: startup backfill integration
+// Tests: loadConfig() startup behavior
+//
+// Contract: disk = user intent, in-memory cache = effective values. loadConfig
+// must NOT silently materialize schema defaults into config.json on load.
+// The legitimate self-healing paths that DO rewrite the file (deprecated-key
+// strip, fresh-config seed, corrupt-JSON quarantine) are protected below.
 // ---------------------------------------------------------------------------
 
-describe("config loader backfill", () => {
+describe("loadConfig startup behavior", () => {
   beforeEach(() => {
     ensureTestDir();
     const resetPaths = [
       CONFIG_PATH,
+      join(WORKSPACE_DIR, "default-config.json"),
+      join(WORKSPACE_DIR, "hatch-overlay.json"),
       join(WORKSPACE_DIR, "keys.enc"),
       join(WORKSPACE_DIR, "data"),
       join(WORKSPACE_DIR, "data", "memory"),
@@ -335,129 +296,482 @@ describe("config loader backfill", () => {
         rmSync(path, { recursive: true, force: true });
       }
     }
+    // Also clear any leftover quarantine files from previous test runs.
+    if (existsSync(WORKSPACE_DIR)) {
+      for (const entry of readdirSync(WORKSPACE_DIR)) {
+        if (entry.startsWith("config.json.corrupt-")) {
+          rmSync(join(WORKSPACE_DIR, entry), { force: true });
+        }
+      }
+    }
+    const updatesPath = join(WORKSPACE_DIR, "UPDATES.md");
+    if (existsSync(updatesPath)) rmSync(updatesPath, { force: true });
     ensureTestDir();
     _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
     invalidateConfigCache();
   });
 
   afterEach(() => {
     _setStorePath(null);
+    delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
     invalidateConfigCache();
   });
 
-  test("backfills missing schema keys into existing config.json", () => {
-    // Write a minimal config that is missing many sections
-    writeConfig({ provider: "anthropic", model: "claude-opus-4-6" });
+  test("does not modify existing config.json on load", () => {
+    // Write a partial config and confirm the file's bytes are unchanged
+    // after loadConfig(). Schema defaults must apply in-memory only; disk
+    // is the user's source of truth.
+    writeConfig({ provider: "anthropic" });
+    const before = readFileSync(CONFIG_PATH);
 
     loadConfig();
 
-    // Re-read the file from disk — it should have been backfilled
-    const raw = readConfig();
-    // New fields from this PR should be present
-    expect(raw.telegram).toBeDefined();
-    expect((raw.telegram as Record<string, unknown>).apiBaseUrl).toBe(
-      "https://api.telegram.org",
-    );
-    expect((raw.telegram as Record<string, unknown>).deliverAuthBypass).toBe(
-      false,
-    );
-    expect((raw.telegram as Record<string, unknown>).timeoutMs).toBe(15_000);
-    expect((raw.telegram as Record<string, unknown>).maxRetries).toBe(3);
-    expect((raw.telegram as Record<string, unknown>).initialBackoffMs).toBe(
-      1_000,
-    );
+    const after = readFileSync(CONFIG_PATH);
+    expect(after.equals(before)).toBe(true);
+  });
 
-    expect(raw.whatsapp).toBeDefined();
-    expect((raw.whatsapp as Record<string, unknown>).deliverAuthBypass).toBe(
-      false,
-    );
-    expect((raw.whatsapp as Record<string, unknown>).timeoutMs).toBe(15_000);
-    expect((raw.whatsapp as Record<string, unknown>).maxRetries).toBe(3);
-    expect((raw.whatsapp as Record<string, unknown>).initialBackoffMs).toBe(
-      1_000,
-    );
+  test("getConfig().memory.v2.bm25_b returns schema default when absent on disk", () => {
+    // Consumer-side correctness: even though loadConfig no longer writes
+    // schema defaults back to disk, accessors still see them via the
+    // in-memory `cached: AssistantConfig` populated by `applyNestedDefaults`.
+    writeConfig({ provider: "anthropic" });
+
+    const config = getConfig();
+
+    expect(config.memory.v2.bm25_b).toBe(0.4);
+  });
+
+  test("reloads cached config when config.json is updated externally", () => {
+    // Models a CLI subprocess writing twilio.accountSid while the assistant
+    // process already has an effective config cached in memory.
+    writeConfig({ twilio: { accountSid: "AC_cached_before" } });
+    expect(loadConfig().twilio.accountSid).toBe("AC_cached_before");
 
-    expect(raw.slack).toBeDefined();
-    expect((raw.slack as Record<string, unknown>).deliverAuthBypass).toBe(
-      false,
+    writeConfig({
+      twilio: { accountSid: "AC_fresh_after_external_write" },
+    });
+
+    expect(loadConfig().twilio.accountSid).toBe(
+      "AC_fresh_after_external_write",
     );
   });
 
-  test("preserves existing user-defined values during backfill", () => {
+  test("still strips deprecated fields and rewrites", () => {
+    // `warnAndStripDeprecatedFields` is a legitimate self-healing path:
+    // it removes fields the schema no longer recognizes and persists the
+    // cleaned config so the deprecation warning fires only once.
     writeConfig({
-      services: {
-        inference: { provider: "openai", model: "gpt-4" },
-      },
-      telegram: { botUsername: "mybot", timeoutMs: 30_000 },
-      whatsapp: { phoneNumber: "+1234567890" },
+      provider: "anthropic",
+      rateLimit: { maxTokensPerSession: 100_000 },
     });
 
     loadConfig();
 
-    const raw = readConfig();
-    // User values preserved
-    const services = raw.services as Record<string, Record<string, unknown>>;
-    expect(services.inference.provider).toBe("openai");
-    expect(services.inference.model).toBe("gpt-4");
-    expect((raw.telegram as Record<string, unknown>).botUsername).toBe("mybot");
-    expect((raw.telegram as Record<string, unknown>).timeoutMs).toBe(30_000);
-    expect((raw.whatsapp as Record<string, unknown>).phoneNumber).toBe(
-      "+1234567890",
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.rateLimit?.maxTokensPerSession).toBeUndefined();
+    // Other rateLimit keys are not affected — only the deprecated entry is stripped
+    expect(raw.provider).toBe("anthropic");
+  });
+
+  test("strips memory.jobs.batchSize from existing user configs", () => {
+    // Pre-PR-#29364, the memory job worker read `memory.jobs.batchSize` to
+    // size its single claim batch. The per-lane scheduler no longer reads
+    // it, so the field is deprecated. Existing configs that have it
+    // written to disk should load cleanly with the field silently stripped.
+    writeConfig({
+      provider: "anthropic",
+      memory: { jobs: { batchSize: 25, workerConcurrency: 4 } },
+    });
+
+    loadConfig();
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.memory?.jobs?.batchSize).toBeUndefined();
+    // Sibling fields under memory.jobs are preserved
+    expect(raw.memory?.jobs?.workerConcurrency).toBe(4);
+  });
+
+  test("still writes a default config on first launch when file is absent", () => {
+    // Discoverability: when no config.json exists, write one populated with
+    // all schema defaults so users can see and edit available options.
+    expect(existsSync(CONFIG_PATH)).toBe(false);
+
+    loadConfig();
+
+    expect(existsSync(CONFIG_PATH)).toBe(true);
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    // Sanity: schema-defaulted nested fields are materialized
+    expect(raw.memory?.v2?.bm25_b).toBe(0.4);
+    expect(raw.dataDir).toBeUndefined();
+  });
+
+  test("hatch default overlay does not suppress first-load inference profiles", () => {
+    const overlayPath = join(WORKSPACE_DIR, "hatch-overlay.json");
+    writeFileSync(
+      overlayPath,
+      JSON.stringify(
+        {
+          llm: {
+            default: {
+              provider: "anthropic",
+              model: "claude-opus-4-7",
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
     );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
 
-    // Missing fields backfilled
-    expect((raw.telegram as Record<string, unknown>).apiBaseUrl).toBe(
-      "https://api.telegram.org",
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const config = loadConfig();
+
+    expect(config.llm.default.provider).toBe("anthropic");
+    expect(config.llm.default.model).toBe("claude-opus-4-7");
+    expect(config.llm.activeProfile).toBe("balanced");
+    expect(config.llm.profiles.balanced?.model).toBe("claude-sonnet-4-6");
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.default).toEqual({
+      provider: "anthropic",
+      model: "claude-opus-4-7",
+    });
+    expect(raw.llm.activeProfile).toBe("balanced");
+    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+  });
+
+  test("non-Anthropic hatch overlay seeds custom-* profiles and activates custom-balanced", () => {
+    const overlayPath = join(WORKSPACE_DIR, "hatch-overlay.json");
+    writeFileSync(
+      overlayPath,
+      JSON.stringify(
+        {
+          llm: {
+            default: {
+              provider: "openai",
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const config = loadConfig();
+    const mainAgentConfig = resolveCallSiteConfig("mainAgent", config.llm);
+
+    expect(config.llm.activeProfile).toBe("custom-balanced");
+    expect(config.llm.profiles["custom-balanced"]?.provider).toBe("openai");
+    expect(config.llm.profiles["custom-balanced"]?.model).toBe("gpt-5.4-mini");
+    expect(config.llm.profiles["custom-quality-optimized"]?.provider).toBe(
+      "openai",
     );
-    expect((raw.telegram as Record<string, unknown>).deliverAuthBypass).toBe(
-      false,
+    expect(config.llm.profiles["custom-cost-optimized"]?.provider).toBe(
+      "openai",
     );
-    expect((raw.whatsapp as Record<string, unknown>).deliverAuthBypass).toBe(
-      false,
+    expect(config.llm.profiles.balanced?.provider).toBe("anthropic");
+    expect(config.llm.profiles["quality-optimized"]?.provider).toBe(
+      "anthropic",
+    );
+    expect(config.llm.profiles["cost-optimized"]?.provider).toBe("anthropic");
+    expect(config.llm.default.provider).toBe("openai");
+    expect(config.llm.default.model).toBe("gpt-5.4-mini");
+    expect(mainAgentConfig.provider).toBe("openai");
+    expect(mainAgentConfig.model).toBe("gpt-5.4-mini");
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.activeProfile).toBe("custom-balanced");
+    expect(raw.llm.default.model).toBe(
+      raw.llm.profiles["custom-balanced"].model,
     );
   });
 
-  test("does not rewrite config.json when no effective change exists", () => {
-    // First load: creates config from scratch with all defaults
-    loadConfig();
-    invalidateConfigCache();
+  test("re-hatch from openai to anthropic resets stale custom-balanced active profile", () => {
+    // Pre-seed an OpenAI-style workspace: custom-balanced is active, default is
+    // openai. Simulates a workspace that previously hatched against OpenAI.
+    writeConfig({
+      llm: {
+        default: { provider: "openai", model: "gpt-5.4-mini" },
+        profiles: {
+          "custom-balanced": {
+            source: "managed",
+            provider: "openai",
+            model: "gpt-5.4-mini",
+          },
+        },
+        activeProfile: "custom-balanced",
+      },
+    });
 
-    // Read file and record its content
-    const contentBefore = readFileSync(CONFIG_PATH, "utf-8");
+    const overlayPath = join(WORKSPACE_DIR, "rehatch-anthropic.json");
+    writeFileSync(
+      overlayPath,
+      JSON.stringify({ llm: { default: { provider: "anthropic" } } }, null, 2) +
+        "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
 
-    // Second load: file already has all keys — no write expected
-    loadConfig();
+    mergeDefaultConfigAndSeedInferenceProfiles();
 
-    const contentAfter = readFileSync(CONFIG_PATH, "utf-8");
-    expect(contentAfter).toBe(contentBefore);
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.activeProfile).toBe("balanced");
+    expect(raw.llm.default.provider).toBe("anthropic");
+    expect(raw.llm.default.model).toBe("claude-sonnet-4-6");
   });
 
-  test("does not write dataDir during backfill", () => {
-    writeConfig({ provider: "anthropic" });
+  test("unknown overlay provider falls back to Anthropic seeding", () => {
+    const overlayPath = join(WORKSPACE_DIR, "hatch-overlay.json");
+    writeFileSync(
+      overlayPath,
+      JSON.stringify(
+        {
+          llm: {
+            default: {
+              provider: "unknownprov",
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.activeProfile).toBe("balanced");
+    expect(raw.llm.profiles.balanced.provider).toBe("anthropic");
+    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+    expect(raw.llm.profiles["custom-balanced"]).toBeUndefined();
+    expect(raw.llm.profiles["custom-quality-optimized"]).toBeUndefined();
+    expect(raw.llm.profiles["custom-cost-optimized"]).toBeUndefined();
+    // The unrecognized provider should be rewritten on disk so subsequent
+    // loads don't trip Zod's enum validation warning.
+    expect(raw.llm.default.provider).toBe("anthropic");
+  });
 
-    loadConfig();
+  test("preserves user-supplied non-catalog model on every restart (ollama custom model)", () => {
+    // Models the ollama case: catalog lists only `llama3.2` but the user has
+    // pulled `codellama`. The seeder must NOT silently overwrite their pick.
+    writeConfig({
+      llm: { default: { provider: "ollama", model: "codellama" } },
+    });
 
-    const raw = readConfig();
-    expect(raw.dataDir).toBeUndefined();
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    let raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.default.model).toBe("codellama");
+
+    // Re-run to confirm idempotency — the user's model survives every restart.
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.default.model).toBe("codellama");
   });
 
-  test("backfills new nested fields into existing sections", () => {
-    // Config with only the old telegram.botUsername field
+  test("syncs llm.default.model to active profile when missing or inconsistent, respects explicit user values", () => {
+    // 1. Missing on disk → write to active profile's model.
+    const overlayMissing = join(WORKSPACE_DIR, "overlay-missing.json");
+    writeFileSync(
+      overlayMissing,
+      JSON.stringify({ llm: { default: { provider: "openai" } } }, null, 2) +
+        "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayMissing;
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    let raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.default.model).toBe(
+      raw.llm.profiles["custom-balanced"].model,
+    );
+
+    // 2. Inconsistent (previous default model belongs to a different provider)
+    //    is overwritten on the next seed run.
+    rmSync(CONFIG_PATH);
     writeConfig({
-      telegram: { botUsername: "oldbot" },
+      llm: {
+        default: { provider: "openai", model: "claude-opus-4-7" },
+      },
     });
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayMissing;
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.default.model).toBe(
+      raw.llm.profiles["custom-balanced"].model,
+    );
+
+    // 3. Platform overlay supplies an explicit, internally-coherent
+    //    profile/active/default — the user's explicit choice is preserved.
+    rmSync(CONFIG_PATH);
+    const explicit = join(WORKSPACE_DIR, "overlay-explicit.json");
+    writeFileSync(
+      explicit,
+      JSON.stringify(
+        {
+          llm: {
+            default: { provider: "openai", model: "gpt-5.4" },
+            profiles: {
+              balanced: {
+                source: "managed",
+                provider: "openai",
+                model: "gpt-5.4",
+                label: "Platform Balanced",
+              },
+            },
+            activeProfile: "balanced",
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = explicit;
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.activeProfile).toBe("balanced");
+    expect(raw.llm.default.model).toBe("gpt-5.4");
+  });
+
+  test("platform-provided profile fragments are not polluted by managed seeds", () => {
+    writeConfig({
+      llm: {
+        default: {
+          provider: "anthropic",
+          model: "claude-opus-4-7",
+        },
+        profiles: {
+          balanced: {
+            source: "managed",
+            provider: "anthropic",
+            model: "claude-sonnet-4-6",
+            maxTokens: 16000,
+            effort: "high",
+            thinking: { enabled: true, streamThinking: true },
+          },
+        },
+        activeProfile: "balanced",
+      },
+    });
+
+    const overlayPath = join(WORKSPACE_DIR, "hatch-overlay.json");
+    writeFileSync(
+      overlayPath,
+      JSON.stringify(
+        {
+          llm: {
+            default: {
+              provider: "openai",
+              model: "gpt-5.4",
+            },
+            profiles: {
+              balanced: {
+                source: "managed",
+                provider: "openai",
+                model: "gpt-5.4",
+                label: "Platform Balanced",
+              },
+            },
+            activeProfile: "balanced",
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const config = loadConfig();
+    const mainAgentConfig = resolveCallSiteConfig("mainAgent", config.llm);
+
+    expect(config.llm.activeProfile).toBe("balanced");
+    expect(config.llm.profiles.balanced).toEqual({
+      source: "managed",
+      provider: "openai",
+      model: "gpt-5.4",
+      label: "Platform Balanced",
+    });
+    expect(mainAgentConfig.provider).toBe("openai");
+    expect(mainAgentConfig.model).toBe("gpt-5.4");
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.profiles.balanced).toEqual({
+      source: "managed",
+      provider: "openai",
+      model: "gpt-5.4",
+      label: "Platform Balanced",
+    });
+    expect(raw.llm.profiles.balanced.maxTokens).toBeUndefined();
+    expect(raw.llm.profiles.balanced.thinking).toBeUndefined();
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+
+    const afterRestart = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(afterRestart.llm.activeProfile).toBe("balanced");
+    expect(afterRestart.llm.profiles.balanced).toEqual({
+      source: "managed",
+      provider: "openai",
+      model: "gpt-5.4",
+      label: "Platform Balanced",
+    });
+  });
+
+  test("quarantines corrupt config before merging hatch overlay", () => {
+    writeFileSync(CONFIG_PATH, "{not valid json");
+
+    const overlayPath = join(WORKSPACE_DIR, "hatch-overlay.json");
+    writeFileSync(
+      overlayPath,
+      JSON.stringify(
+        {
+          llm: {
+            default: {
+              provider: "anthropic",
+              model: "claude-opus-4-7",
+            },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+
+    const quarantined = readdirSync(WORKSPACE_DIR).filter((n) =>
+      n.startsWith("config.json.corrupt-"),
+    );
+    expect(quarantined.length).toBeGreaterThan(0);
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.llm.default).toEqual({
+      provider: "anthropic",
+      model: "claude-opus-4-7",
+    });
+    expect(raw.llm.activeProfile).toBe("balanced");
+    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+  });
+
+  test("still quarantines corrupt JSON", () => {
+    // Corrupt-config quarantine is a recovery path: the broken file is
+    // renamed to `config.json.corrupt-<ts>.json` and the daemon proceeds
+    // with defaults. This must keep working.
+    writeFileSync(CONFIG_PATH, "{not valid json");
 
     loadConfig();
 
-    const raw = readConfig();
-    const telegram = raw.telegram as Record<string, unknown>;
-    // Old field preserved
-    expect(telegram.botUsername).toBe("oldbot");
-    // New fields backfilled
-    expect(telegram.apiBaseUrl).toBe("https://api.telegram.org");
-    expect(telegram.deliverAuthBypass).toBe(false);
-    expect(telegram.timeoutMs).toBe(15_000);
-    expect(telegram.maxRetries).toBe(3);
-    expect(telegram.initialBackoffMs).toBe(1_000);
+    // A new defaults-populated config.json is written in place
+    expect(existsSync(CONFIG_PATH)).toBe(true);
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.memory?.v2?.bm25_b).toBe(0.4);
+
+    // The corrupt original is preserved as a `*.corrupt-*.json` sibling
+    const quarantined = readdirSync(WORKSPACE_DIR).filter((n) =>
+      n.startsWith("config.json.corrupt-"),
+    );
+    expect(quarantined.length).toBeGreaterThan(0);
   });
 });