fix(tuner): re-validate config on the resume paths, not just start()

resume() and validate_profile() loaded config_json via TunerConfig.from_json
(which rejects wrong types only) but never called config.validate(), so a
corrupted or hand-edited DB row with a well-typed but out-of-range value (e.g.
coarse_step=0) revived on the resume path the non-convergent-search class that
start() already rejects. No unsafe CO write results -- every SMU write is
range-checked -- but the tune could spin instead of failing closed. Both paths
now validate and refuse, mirroring start().

Regression tests (TestResumePathsValidateConfig) are ablation-verified: they go
red when the guard is removed.

Eval: gate-green

Author: Daaboulex

src/tuner/engine.py

@@ -352,6 +352,15 @@ def resume(self, session_id: int) -> None:
         if self._smu is not None:
             self._config.clamp_max_offset(self._smu.commands.co_range)
 
+        # Fail closed on a corrupted/hand-edited config_json: from_json only
+        # rejects wrong TYPES, so a well-typed but out-of-range value (e.g.
+        # coarse_step=0, which makes the search non-convergent) survives it.
+        # start() rejects those; resume must too, or the bug returns on this path.
+        errors = self._config.validate()
+        if errors:
+            self.log_message.emit(f"Invalid tuner config: {'; '.join(errors)}")
+            return
+
         self._core_states = tp.load_core_states(self._db, session_id)
 
         # Rebuild the proven-safe envelope from the CO journal: a value the machine
@@ -531,6 +540,11 @@ def validate_profile(self, session_id: int) -> None:
             self._config = TunerConfig.from_json(session.config_json)
             if self._smu is not None:
                 self._config.clamp_max_offset(self._smu.commands.co_range)
+            # Fail closed on a corrupted config_json, exactly as resume()/start().
+            errors = self._config.validate()
+            if errors:
+                self.log_message.emit(f"Invalid tuner config: {'; '.join(errors)}")
+                return
 
         # Reset confirmed cores to "confirming" for re-validation
         self._core_states = tp.load_core_states(self._db, session_id)

tests/test_tuner_faults.py

@@ -1112,3 +1112,55 @@ def test_validation_terminates_and_settles_safely(self, data):
                 )
         finally:
             db.close()
+
+
+class TestResumePathsValidateConfig:
+    """resume() and validate_profile() re-validate the loaded config_json and fail
+    closed, not only start(). from_json rejects wrong TYPES but passes a well-typed
+    out-of-range value (e.g. coarse_step=0, a non-convergent search), so a corrupted
+    or hand-edited DB row would otherwise revive on resume the exact 'looped forever'
+    class start() rejects. A resident CO is never unsafe here (every SMU write is
+    range-checked), but the tune must refuse rather than spin."""
+
+    def test_resume_fails_closed_on_out_of_range_config(self, db, topo, smu, mock_backend):
+        sid = tp.create_session(db, TunerConfig(cores_to_test=[0], coarse_step=0), "", "")
+        eng = make_engine(db, topo, smu, mock_backend)
+        logs: list[str] = []
+        eng.log_message.connect(logs.append)
+        with patch.object(eng, "_run_next") as run_next:
+            eng.resume(sid)
+        assert run_next.call_count == 0, "resume proceeded on an invalid config"
+        assert any("Invalid tuner config" in m for m in logs)
+
+    def test_validate_profile_fails_closed_on_out_of_range_config(
+        self, db, topo, smu, mock_backend
+    ):
+        sid = tp.create_session(db, TunerConfig(cores_to_test=[0], coarse_step=0), "", "")
+        # A CONFIRMED core so validate_profile clears its empty-profile guard and
+        # reaches the config load/validate.
+        tp.save_core_state(db, sid, CoreState(
+            core_id=0, phase=TunerPhase.CONFIRMED,
+            current_offset=-10, best_offset=-10, baseline_offset=0,
+        ))
+        eng = make_engine(db, topo, smu, mock_backend)
+        logs: list[str] = []
+        eng.log_message.connect(logs.append)
+        with patch.object(eng, "_run_next") as run_next:
+            eng.validate_profile(sid)
+        assert run_next.call_count == 0, "validate_profile proceeded on an invalid config"
+        assert any("Invalid tuner config" in m for m in logs)
+
+    def test_resume_still_proceeds_on_a_valid_config(self, db, topo, smu, mock_backend):
+        """The guard is not over-eager: a valid config_json resumes normally."""
+        sid = tp.create_session(db, TunerConfig(cores_to_test=[0]), "", "")
+        tp.save_core_state(db, sid, CoreState(
+            core_id=0, phase=TunerPhase.FINE_SEARCH,
+            current_offset=-10, best_offset=-8, baseline_offset=0, in_test=False,
+        ))
+        eng = make_engine(db, topo, smu, mock_backend)
+        logs: list[str] = []
+        eng.log_message.connect(logs.append)
+        with patch.object(eng, "_run_next") as run_next:
+            eng.resume(sid)
+        assert run_next.called, "resume bailed on a valid config"
+        assert not any("Invalid tuner config" in m for m in logs)