Preserve explicit false values in config defaults

internal/config/config_test.go

@@ -76,6 +76,15 @@ sources:
 	if got := cfg.Investigation.BackgroundLookback.Duration; got != 0 {
 		t.Fatalf("unexpected background lookback default: got %s want 0", got)
 	}
+	if !cfg.Investigation.Enabled {
+		t.Fatalf("expected investigation to default to enabled")
+	}
+	if !cfg.Investigation.SpamhausEnabled {
+		t.Fatalf("expected spamhaus checks to default to enabled")
+	}
+	if !cfg.OPNsense.EnsureAlias {
+		t.Fatalf("expected ensure_alias to default to enabled")
+	}
 	profile := cfg.Profiles["main"]
 	if !profile.IsAllowedPostPath("/search") {
 		t.Fatalf("expected /search to be normalized as an allowed POST path")
@@ -107,3 +116,41 @@ sources:
 		t.Fatalf("expected invalid initial_position to be rejected")
 	}
 }
+
+func TestLoadPreservesExplicitFalseForTrueDefaults(t *testing.T) {
+	t.Parallel()
+
+	tempDir := t.TempDir()
+	configPath := filepath.Join(tempDir, "config.yaml")
+	payload := fmt.Sprintf(`investigation:
+  enabled: false
+  spamhaus_enabled: false
+opnsense:
+  enabled: false
+  ensure_alias: false
+profiles:
+  main:
+    auto_block: true
+sources:
+  - name: main
+    path: %s/access.json
+    profile: main
+`, tempDir)
+	if err := os.WriteFile(configPath, []byte(payload), 0o600); err != nil {
+		t.Fatalf("write config file: %v", err)
+	}
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("load config: %v", err)
+	}
+	if cfg.Investigation.Enabled {
+		t.Fatalf("expected investigation.enabled=false to be preserved")
+	}
+	if cfg.Investigation.SpamhausEnabled {
+		t.Fatalf("expected investigation.spamhaus_enabled=false to be preserved")
+	}
+	if cfg.OPNsense.EnsureAlias {
+		t.Fatalf("expected opnsense.ensure_alias=false to be preserved")
+	}
+}