[barbatdev]

Linked Issue

Refs #324

Umbrella: #401

PR Type

• type:feature Feature
• type:bug Bug fix
• type:docs Documentation
• type:refactor Refactoring
• type:chore Maintenance
• type:breaking-change Breaking change

Summary

Refuse an existing unusable default profile source instead of silently selecting the placeholder route. Preserve placeholder behavior only when the source is absent.

Changes

This is slice 3/8, 122 authored changed lines. Code, focused tests and applicable operating documentation stay together. Exact reviewed source commit: eb6e516952d1dbf701ce77120d178644f46aa37a. Delivery head 349958bd2d0bdc66924ed3db6f9618880d65c667 has the identical complete source tree.

Focused Tests

Each cumulative prepared slice passed go test ./internal/cli ./internal/qapi ./internal/qaroute ./internal/installobserve -count=1, go vet ./... and whitespace checks. Final candidate additionally passed go test ./... -count=1, go vet ./..., go test -race ./... and all 15 repository Python policy tests on a byte-verified canonical clean snapshot. Independent source-agreement, typed-admission and final security verification passed with no severe blockers; final verification observed 19 named tests plus four package suites/vet.

Native assessment of this exact slice: medium native tier, reviewDue=false (under_budget); no new native review started. Security-affecting slices retained explicit high-risk escalation and independent verification rather than treating assessment as proof. Parser's separately requested native review completed approved and acknowledged.

Runtime Harness

Disposable public CLI fixtures, no real provider calls. Rejections pin no launch/write effects, route identity and safe profile tokens. macOS /tmp is a symlink and intentionally refused: canonical snapshot cwd passed unchanged guards. No credentials changed.

Rollback

Revert this slice. Revert any dependent later slice first; no stored-data migration.

Chain Dependencies / Out of Scope

Sequential verified-main strategy: merged #403 -> [current slice 3/8] -> remaining slices. This PR targets main only after its predecessor lands, so its diff contains only this work unit. Do not close the umbrella from this intermediate slice.

Known acceptance limit: #329's literal transient/persistent causal distinction is NOT established by stage reporting and remains open. Defensive untyped branches, a currently unreachable non_nan_route mapping and a brittle wording assertion were disclosed as nonblocking verifier advisories, not silently fixed. Provider transport #345 and lifecycle #373 are out of scope.

Checklist

• Linked issue is open and status:approved.
• Exactly one matching type:* label is applied.
• Focused tests and runtime harness evidence are recorded.
• Rollback and out-of-scope boundaries are documented.