@@ -45,6 +45,8 @@ _Notes on upcoming releases will be added here_
 `git`, `hg`, and `svn` blocks match their libvcs options classes. Loading
 rejects unknown fields, invalid values, and blocks for a different VCS before
 sync starts. Errors identify the file, workspace, repository, and field.
+Overridden legacy values are validated too. Integer fields accept integral
+numbers such as `2.0`; metadata accepts JSON-compatible values.
 
 ```yaml
 ~/code/:
 
@@ -62,8 +62,12 @@ After:
 `shallow: true` becomes `git.depth: 1`. `git_options`, `hg_options`, and
 `svn_options` become `git`, `hg`, and `svn`. `pin_reason` and
 `allow_overwrite` move from `options` to the entry level alongside `pin`.
-Existing canonical values take precedence. Unknown legacy `options` keys
-produce an error before the file is written.
+Existing canonical values take precedence. Every supplied setting is
+validated before precedence applies, including overridden values. Unknown
+legacy `options` keys produce an error before the file is written. Remove
+invalid values instead of relying on another field to hide them. Both `url`
+and `repo` must be valid strings when present; `url` still takes precedence.
+Metadata must contain JSON-compatible values with string keys.
 
 `add` and `discover` write the canonical layout. `import` and `fmt` migrate
 entries they rewrite; entries pinned for that command stay unchanged. Use
@@ -75,9 +79,12 @@ belongs in `metadata`, not in a libvcs constructor argument. Sync constructs
 the matching immutable libvcs options object from `git`, `hg`, or `svn`.
 
 To omit historical file contents without truncating commit history, add
-`git.filter: blob:none`. The value can also be a native filter string, a
-kind-tagged mapping, or a nonempty list of filters. Filter and depth changes
-only affect a new clone; they do not reconfigure an existing checkout.
+`git.filter: blob:none`. The value can also be an atomic native filter
+string, a kind-tagged mapping, or a nonempty list of filters. Express combined
+filters as `{kind: combine, filters: [blob:none, "tree:3"]}` or nested lists;
+`vcspull migrate --write` converts native `combine:` strings to that form.
+Filter and depth changes only affect a new clone; they do not reconfigure an
+existing checkout.
 
 ## vcspull 1.62.0 (2026-05-31)
 
 
@@ -138,6 +138,9 @@ See {ref}`cli-worktree` for full command documentation.
 Repository entries use one backend block matching their URL: `git`, `hg`,
 or `svn`. Unknown keys, wrong-backend blocks, and malformed values fail when
 loading, with the file, workspace, repository, and field in the error.
+Supplied legacy values must be valid even when a canonical field overrides
+them. Numeric integer fields accept `2.0` as `2`; booleans and fractional
+values fail. Metadata contains JSON-compatible values with string keys.
 
 | Block | Options |
 | --- | --- |
@@ -171,7 +174,20 @@ needed by the current working tree.
           depth: 3
 ```
 
-Filters accept native strings, kind-tagged mappings, or nonempty lists.
+Filters accept atomic native strings, kind-tagged mappings, or nonempty lists.
+Use a mapping or nested list for a combined filter, without percent encoding:
+
+```yaml
+git:
+  filter:
+    kind: combine
+    filters:
+      - blob:none
+      - tree:3
+```
+
+Native `combine:` strings are rejected in configuration; `vcspull migrate`
+converts them to this structured form. Combinations may nest up to 32 levels.
 `auto` requires a Git version that supports it and cannot be combined with
 other filters or forwarded to submodule initialization. libvcs validates
 filter syntax before running Git. The remote must enable partial-clone
 
@@ -1061,6 +1061,15 @@ def _run_import(
                     if isinstance(existing_raw, dict)
                     else {}
                 )
+                updated["repo"] = incoming_url
+                updated.pop("url", None)
+                if import_source:
+                    # None is not safe: setdefault returns existing None
+                    # instead of replacing it, causing TypeError.
+                    if not isinstance(updated.get("metadata"), dict):
+                        updated["metadata"] = {}
+                    metadata = updated.setdefault("metadata", {})
+                    metadata["imported_from"] = import_source
                 try:
                     _, updated = migrate_repo_entry(updated)
                 except (TypeError, ValueError) as error:
@@ -1072,15 +1081,6 @@ def _run_import(
                         error,
                     )
                     return 1
-                updated["repo"] = incoming_url
-                updated.pop("url", None)
-                if import_source:
-                    # None is not safe: setdefault returns existing None
-                    # instead of replacing it, causing TypeError.
-                    if not isinstance(updated.get("metadata"), dict):
-                        updated["metadata"] = {}
-                    metadata = updated.setdefault("metadata", {})
-                    metadata["imported_from"] = import_source
                 raw_config[repo_workspace_label][repo.name] = updated
             else:
                 log.info("[DRY-RUN] Would update URL: %s", repo.name)
@@ -1097,6 +1097,12 @@ def _run_import(
                     )
                     if needs_tag:
                         if not dry_run:
+                            live = copy.deepcopy(live)
+                            if not isinstance(existing_meta, dict):
+                                live["metadata"] = {}
+                            live.setdefault("metadata", {})["imported_from"] = (
+                                import_source
+                            )
                             try:
                                 _, live = migrate_repo_entry(live)
                             except (TypeError, ValueError) as error:
@@ -1109,11 +1115,6 @@ def _run_import(
                                 )
                                 return 1
                             raw_config[repo_workspace_label][repo.name] = live
-                            if not isinstance(existing_meta, dict):
-                                live["metadata"] = {}
-                            live.setdefault("metadata", {})["imported_from"] = (
-                                import_source
-                            )
                         provenance_tagged_count += 1
                 elif isinstance(live, str):
                     if not dry_run:
 
@@ -14,10 +14,13 @@
 import typing as t
 from collections.abc import Callable
 
+from libvcs.cmd.git_filter import Combine, parse_filter
 from libvcs.sync.git import GitRemote
 
 from vcspull.validator import (
     is_valid_config,
+    validate_legacy_options,
+    validate_metadata,
     validate_repo_entry,
     validate_working_copy,
 )
@@ -29,7 +32,7 @@
     config_format_from_path,
 )
 from .types import ConfigDict, RawConfigDict, WorktreeConfigDict
-from .util import get_config_dir, update_dict
+from .util import get_config_dir
 
 log = logging.getLogger(__name__)
 
@@ -269,22 +272,22 @@ def extract_repos(
             if isinstance(repo_data, str):
                 conf["url"] = repo_data
             else:
-                conf = update_dict(conf, repo_data)
-
-            if "repo" in conf:
-                if "url" not in conf:
-                    conf["url"] = conf.pop("repo")
-                else:
-                    conf.pop("repo", None)
+                conf = copy.deepcopy(repo_data)
 
             location = f"{directory!r} -> {repo!r}"
             try:
-                _, conf = migrate_repo_entry(conf)
+                _, conf = migrate_repo_entry(conf, normalize_filters=False)
             except (TypeError, ValueError) as error:
                 msg = f"{location}.{error}"
                 raise exc.VCSPullException(msg) from error
             validate_repo_entry(conf, location=location)
 
+            if "repo" in conf:
+                if "url" not in conf:
+                    conf["url"] = conf.pop("repo")
+                else:
+                    conf.pop("repo", None)
+
             if "name" not in conf:
                 conf["name"] = repo
 
@@ -969,9 +972,8 @@ def resolve_clone_depth(
 
     1. ``explicit_depth`` (from ``--depth N``) → ``(False, explicit_depth)``.
     2. ``explicit_shallow`` (from ``--shallow``) → ``(True, None)``.
-    3. Auto-detected depth (hybrid): a depth-1 checkout records ``shallow:
-       true`` (the common case), depth > 1 records ``depth: N``, and a full
-       checkout records neither.
+    3. Auto-detected depth: shallow checkouts record ``git.depth: N``;
+       full checkouts omit the depth setting.
 
     Parameters
     ----------
@@ -1079,7 +1081,47 @@ def build_repo_entry(
 LEGACY_REPO_OPTION_KEYS = ("rev", "shallow", "depth")
 
 
-def migrate_repo_entry(entry: t.Any) -> tuple[bool, t.Any]:
+def _migrate_filter_config(value: t.Any, *, depth: int = 0) -> t.Any:
+    """Express native combinations without nested percent encoding.
+
+    >>> _migrate_filter_config("combine:blob:none+tree:1")
+    {'kind': 'combine', 'filters': ['blob:none', 'tree:1']}
+    """
+    if depth > 33:
+        msg = "filter nesting exceeds 32 levels"
+        raise ValueError(msg)
+    if isinstance(value, str) and value.startswith("combine:"):
+        value = parse_filter(value)
+    if isinstance(value, Combine):
+        return {
+            "kind": "combine",
+            "filters": [
+                _migrate_filter_config(child, depth=depth + 1)
+                if isinstance(child, Combine)
+                else child.to_spec()
+                for child in value.filters
+            ],
+        }
+    if isinstance(value, list):
+        return [_migrate_filter_config(child, depth=depth + 1) for child in value]
+    if (
+        isinstance(value, dict)
+        and value.get("kind") == "combine"
+        and isinstance(value.get("filters"), list)
+    ):
+        return {
+            **value,
+            "filters": [
+                _migrate_filter_config(child, depth=depth + 1)
+                for child in value["filters"]
+            ],
+        }
+    return value
+
+
+def migrate_repo_entry(
+    entry: t.Any, *, normalize_filters: bool = True
+) -> tuple[bool, t.Any]:
     """Separate checkout targets, backend settings, and entry policy.
 
     Canonical values win over legacy values. Within the legacy layout,
@@ -1090,6 +1132,9 @@ def migrate_repo_entry(entry: t.Any) -> tuple[bool, t.Any]:
     ----------
     entry : Any
         A raw repository entry (string shorthand or mapping).
+    normalize_filters : bool
+        Rewrite native combined filters for serialization. Loading disables
+        this conversion so unsupported syntax fails at its source.
 
     Returns
     -------
@@ -1121,17 +1166,31 @@ def migrate_repo_entry(entry: t.Any) -> tuple[bool, t.Any]:
     if not isinstance(entry, dict):
         return False, entry
 
+    if "metadata" in entry:
+        try:
+            validate_metadata(entry["metadata"])
+        except exc.VCSPullException as error:
+            raise ValueError(str(error)) from error
+
     legacy_keys = (
         *LEGACY_REPO_OPTION_KEYS,
         "options",
         "git_options",
         "hg_options",
         "svn_options",
     )
-    if not any(key in entry for key in legacy_keys):
-        return False, entry
-
     new_entry = copy.deepcopy(entry)
+    if normalize_filters:
+        for key in ("git", "git_options"):
+            options = new_entry.get(key)
+            if isinstance(options, dict) and "filter" in options:
+                options["filter"] = _migrate_filter_config(options["filter"])
+    if not any(key in new_entry for key in legacy_keys):
+        return new_entry != entry, new_entry
+    try:
+        validate_legacy_options(new_entry)
+    except exc.VCSPullException as error:
+        raise ValueError(str(error)) from error
     options = new_entry.pop("options", {})
     if not isinstance(options, dict):
         msg = "options: expected a mapping"