fix(onboard): check the provider mapping on every profile path

The unmapped-backend check only guarded an explicit --profile, but the
installer and resume paths produce provenance that reaches the same
environment application. An unmapped backend arriving that way would set
the preset while leaving the provider unresolved — the silent fall-through
to the provider menu this change set fixes.

Check the profile the run actually settles on, after installer and resume
resolution, so all three paths converge on the same authoritative result.

Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>

Author: yanyunl1991

src/lib/onboard/command.test.ts

@@ -794,6 +794,44 @@ describe("onboard command options", () => {
     expect(env.NEMOCLAW_PROVIDER).toBeUndefined();
   });
 
+  it("rejects an unmapped backend on the resume path too (#9313)", () => {
+    // Explicit --profile, the installer path, and resume all converge on the
+    // same environment application, so the check lives at the end of the
+    // lifecycle rather than on the explicit path alone. Resume replays a
+    // recorded profile: a backend with no provider must be reported instead of
+    // resuming into the provider menu.
+    const catalog = loadServingCatalog();
+    // Retarget preset and recipe together; provenance requires them to agree.
+    const patchedCatalog = {
+      ...catalog,
+      presets: catalog.presets.map((preset) => ({
+        ...preset,
+        spec: { ...preset.spec, plan: { ...preset.spec.plan, backend: "future-backend" } },
+      })),
+      recipes: catalog.recipes.map((recipe) => ({
+        ...recipe,
+        spec: { ...recipe.spec, backend: "future-backend" },
+      })),
+    };
+    const recorded = servingProfileProvenance(
+      patchedCatalog as never,
+      catalog.presets[0]!.metadata.id,
+    );
+    const errors: string[] = [];
+
+    expect(() =>
+      resolve(
+        { resume: true },
+        {
+          loadServingCatalog: () => patchedCatalog as never,
+          loadSession: () => ({ servingProfileProvenance: recorded }) as never,
+          error: (message = "") => errors.push(message),
+        },
+      ),
+    ).toThrow("exit:1");
+    expect(errors.join("\n")).toContain("which onboarding cannot configure");
+  });
+
   it("maps each serving backend to the provider that can run it (#9313)", () => {
     // A backend with no provider returns null, which `resolveServingProfile`
     // reports instead of accepting the flag and then asking for a provider.

src/lib/onboard/command.ts

@@ -275,16 +275,7 @@ function resolveServingProfile(
     throw error;
   }
   validateServingProfileConflicts(selectedProfileId, deps);
-  const provenance = servingProfileProvenance(catalog, selectedProfileId);
-  if (!servingProfileProviderKey(provenance)) {
-    // Reporting this beats the old behaviour of accepting the flag and then
-    // asking which provider to use, which left the profile silently unapplied.
-    fail(
-      deps,
-      `  Serving profile '${selectedProfileId}' uses backend '${provenance.recipe.backend}', which onboarding cannot configure with --profile.`,
-    );
-  }
-  return provenance;
+  return servingProfileProvenance(catalog, selectedProfileId);
 }
 
 function resolveInstallerServingProfile(
@@ -323,8 +314,26 @@ function resolveServingProfileLifecycle(
     );
   }
   const requested = explicit ?? installerProfile;
-  if (!resume) return requested;
-  return resolveResumedServingProfile(requested, deps);
+  const settled = resume ? resolveResumedServingProfile(requested, deps) : requested;
+  // Check the profile the run will actually apply, not just an explicit
+  // --profile: the installer and resume paths reach the same environment
+  // application, and an unmapped backend there would set the preset while
+  // leaving the provider unresolved — the silent fall-through to the provider
+  // menu this fixes (#9313).
+  return assertServingProfileProviderSupported(settled, deps);
+}
+
+function assertServingProfileProviderSupported(
+  provenance: ServingProfileProvenance | null,
+  deps: ResolveOnboardOptionsDeps,
+): ServingProfileProvenance | null {
+  const unsupported = provenance !== null && servingProfileProviderKey(provenance) === null;
+  return unsupported
+    ? fail(
+        deps,
+        `  Serving profile '${provenance.preset.id}' uses backend '${provenance.recipe.backend}', which onboarding cannot configure.`,
+      )
+    : provenance;
 }
 
 function activeServingProfileId(provenance: ServingProfileProvenance | null): string | null {