@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/plugins/defaults/memory/v3/orchestrate.ts

@@ -17,6 +17,14 @@
  *          associations the authored link graph does not record.
  *      Each lane only ever ADDS candidates, so the pool is recall-safe by
  *      construction.
+ *   1b. OPT-IN injection gate (`deps.gateConfig.enabled`, default off): once the
+ *      CURRENT-message finder lanes have run, `checkV3Gate` scores the needle +
+ *      dense hits against the tuned thresholds. A closed gate skips the
+ *      selectPool LLM call for the turn — returning empty selections (or, when
+ *      `bypassForCore` is set, selecting over the stable prefix only via the
+ *      same selector dispatch as the normal path, honoring `selectorEnabled`) —
+ *      so a low-signal turn pays no selector cost. The gate is pass-open: any
+ *      throw inside it logs a warning and falls through to normal selection.
  *   2. Build the candidate pool in CACHE ORDER: the stable prefix —
  *      `[...core (file order), ...hot (score order), ...fresh (recency order),
  *      ...always-candidate (skills pinned every turn)]`, all computed at lane
@@ -47,12 +55,19 @@
  */
 
 import type { AssistantConfig } from "../../../../config/schema.js";
-import { denseLane } from "./dense.js";
+import { recordWatchdogEvent } from "../../../../telemetry/watchdog-events-store.js";
+import { getLogger } from "../../../../util/logger.js";
+import { denseLaneScored } from "./dense.js";
 import type { EdgeGraph } from "./edge.js";
 import { edgeExpand } from "./edge.js";
 import type { EntityIndex } from "./entity-lane.js";
 import { entityLane } from "./entity-lane.js";
-import type { PoolCandidate, StableCandidate } from "./pool-select.js";
+import { checkV3Gate, type V3GateConfig, type V3GateResult } from "./gate.js";
+import type {
+  PoolCandidate,
+  SelectorPool,
+  StableCandidate,
+} from "./pool-select.js";
 import { selectAllPoolCandidates, selectPool } from "./pool-select.js";
 import type { SectionNeedle } from "./section-needle.js";
 import type {
@@ -64,6 +79,32 @@ import type {
   Slug,
 } from "./types.js";
 
+// Named to disambiguate from the unrelated `src/config/memory-v3-gate.ts`: this
+// logger names the per-turn INJECTION gate wired in below.
+const log = getLogger("memory-v3-injection-gate");
+
+/** `check_name` of the `watchdog` telemetry event recorded once per
+ *  injection-gate run. The platform's memory admin analytics count and filter
+ *  on this exact string — keep it stable. */
+export const MEMORY_V3_INJECTION_GATE_CHECK_NAME = "memory_v3_injection_gate";
+
+/** Record one injection-gate run to usage telemetry. `detail` keys are the
+ *  platform-side contract (snake_case, scores and reason codes only — never
+ *  conversation content). Never throws: the gate is pass-open by design, and a
+ *  telemetry failure must not cost the turn its memory either. */
+function recordGateRun(detail: Record<string, unknown>): void {
+  try {
+    recordWatchdogEvent({
+      checkName: MEMORY_V3_INJECTION_GATE_CHECK_NAME,
+      value: 1,
+      detail,
+    });
+  } catch {
+    // recordWatchdogEvent already no-ops on opt-out and a missing telemetry
+    // DB; anything past that is not worth failing the turn over.
+  }
+}
+
 /** Default number of BM25 needle articles to fold into the pool. */
 export const DEFAULT_NEEDLE_K = 12;
 /** Default number of dense-lane articles to fold into the pool. */
@@ -137,6 +178,10 @@ export interface OrchestrateDeps {
   /** Whether to run the selector LLM. False passes all pooled candidates
    *  straight through as selections, preserving pool-order slug dedup. */
   selectorEnabled?: boolean;
+  /** Per-turn injection gate config (`memory.v3.gate` tuning + the flag-derived
+   *  `enabled`, assembled in observeTurn). Omitted/disabled → the gate never
+   *  runs and every turn proceeds to selectPool as before. */
+  gateConfig?: V3GateConfig;
 }
 
 /** A finder-lane candidate: the slug, the descriptor that justified it, and
@@ -209,6 +254,35 @@ export async function orchestrate(
   );
   const stablePrefix = new Set<Slug>([...coreHotFresh, ...always]);
 
+  // The stable prefix as FULL CARDS, in cache order. Pre-rendered at lane init
+  // (`prefixCards`) so the rendered prefix is byte-identical across turns. A
+  // missing card is a lane-init bug and throws (silently degrading would violate
+  // the byte-stable-prefix contract). Built lazily so the gate's bypass path can
+  // reuse the exact same construction as the normal step-2 pool assembly.
+  const buildStable = (): StableCandidate[] =>
+    [...core, ...hot, ...fresh, ...always].map((slug) => {
+      const card = deps.prefixCards.get(slug);
+      if (card === undefined) {
+        // Lane init renders a card for every core/hot slug; a hole here means
+        // the lanes and the card map are out of sync. Throw rather than render
+        // a degraded card — the caller (observeTurn) logs and skips the turn,
+        // which is better than silently breaking the byte-stable prefix.
+        throw new Error(
+          `memory-v3: no pre-rendered card for stable-prefix slug "${slug}"`,
+        );
+      }
+      return { slug, card };
+    });
+
+  // Run the selector over a pool, or pass its candidates straight through when
+  // the selector LLM is disabled (`selectorEnabled: false`, the new-user
+  // profile). Shared by the normal step-3 selection and the gate's
+  // bypass-to-stable path so the two cannot diverge.
+  const runSelection = async (pool: SelectorPool): Promise<SelectedPage[]> =>
+    deps.selectorEnabled === false
+      ? selectAllPoolCandidates(pool)
+      : selectPool(pool, turn, deps.selectorPrompt);
+
   // Step 1: needle (sync BM25) and the enabled dense lane (async embed +
   // Qdrant) run in parallel. Both return distinct articles each tagged with
   // their best-scoring section index/ordinal. The reply-query pass re-runs the
@@ -223,18 +297,27 @@ export async function orchestrate(
     replyK > 0 ? (turn.previousAssistantMessage ?? "").trim() : "";
   const denseEnabled = denseK > 0;
   const [needled, densed, replyNeedled, replyDensed] = await Promise.all([
-    Promise.resolve(deps.needle.query(turn.currentMessage, needleK)),
+    Promise.resolve(deps.needle.queryScored(turn.currentMessage, needleK)),
     denseEnabled
-      ? denseLane(deps.denseConfig, turn.currentMessage, denseK)
+      ? denseLaneScored(deps.denseConfig, turn.currentMessage, denseK)
       : Promise.resolve([]),
     Promise.resolve(
-      replyQuery.length > 0 ? deps.needle.query(replyQuery, replyK) : [],
+      replyQuery.length > 0 ? deps.needle.queryScored(replyQuery, replyK) : [],
     ),
     replyQuery.length > 0 && denseEnabled
-      ? denseLane(deps.denseConfig, replyQuery, replyK)
+      ? denseLaneScored(deps.denseConfig, replyQuery, replyK)
       : Promise.resolve([]),
   ]);
 
+  // Dense hits restricted to pages still in the live section index. A deleted
+  // page's points can linger in Qdrant; the candidate pool already drops those
+  // (see the dense finder loop), so the gate must score the same live set —
+  // stale low-scored hits for deleted pages must neither fake dense availability
+  // nor drag the gate closed while the live lanes have candidates.
+  const liveDensed = densed.filter((hit) =>
+    deps.sectionIndex.byArticle.has(hit.article),
+  );
+
   // `matchedSections` records the matched `Section` (when one is known) for
   // every finder hit — INCLUDING hits on stable-prefix slugs — for downstream
   // injection/spotlight. `finder` accumulates one entry per distinct
@@ -337,6 +420,101 @@ export async function orchestrate(
     }
   }
 
+  // Step 1b''': opt-in injection gate. With the CURRENT-message finder lanes in
+  // hand (needle + dense — NOT reply/entity/edge, which only add recall), decide
+  // whether retrieval is confident enough to spend the selectPool LLM call this
+  // turn. Default-off via `?.enabled`; pass-open on any throw (a gate bug must
+  // never drop a turn's memory). A closed gate either hard-skips selection
+  // (empty selections) or, when `bypassForCore` is set, runs selectPool over the
+  // stable prefix only — never the finder tail.
+  //
+  // The gate is dense-gated: it only runs when the live dense lane produced hits
+  // (`liveDensed.length > 0`). In healthy operation dense returns top-k hits for
+  // any query, so zero live dense hits means dense is unavailable — denseK=0 (the
+  // new-user/small-corpus profile), a degraded embedding backend, a Qdrant error
+  // (`denseLaneScored` swallows these to `[]`), or only stale deleted-page points
+  // returned — NOT low relevance. checkV3Gate reads only finder scores and cannot
+  // tell those apart, so without live dense signal we pass open rather than
+  // suppress all memory (not even the core/hot/fresh prefix) on every
+  // lexically-weak turn.
+  if (deps.gateConfig?.enabled) {
+    if (liveDensed.length === 0) {
+      // No live dense hits (denseK=0 / degraded backend / Qdrant error swallowed
+      // to [] / only stale deleted-page points returned). That means dense is
+      // unavailable, not low relevance, so pass open — but record it so rollout
+      // telemetry sees these turns instead of silently skipping the gate.
+      log.info(
+        {
+          conversationId: turn.conversationId,
+          turnNumber: turn.turnNumber,
+          reason: "dense_unavailable",
+          pass: true,
+        },
+        "memory-v3 injection gate: dense lane unavailable, passing open",
+      );
+      recordGateRun({ pass: true, reason: "dense_unavailable" });
+    } else {
+      let gate: V3GateResult | null = null;
+      try {
+        gate = checkV3Gate({
+          needleHits: needled,
+          denseHits: liveDensed,
+          config: deps.gateConfig,
+        });
+      } catch (err) {
+        log.warn(
+          {
+            err: err instanceof Error ? err.message : String(err),
+            conversationId: turn.conversationId,
+          },
+          "memory-v3 injection gate threw; passing open (proceeding with selection)",
+        );
+        recordGateRun({ pass: true, reason: "gate_error" });
+      }
+      if (gate) {
+        log.info(
+          {
+            conversationId: turn.conversationId,
+            turnNumber: turn.turnNumber,
+            gate,
+          },
+          "memory-v3 injection gate decision",
+        );
+        recordGateRun({
+          pass: gate.pass,
+          reason: gate.reason,
+          top_dense_score: gate.topDenseScore,
+          top_norm_sparse_score: gate.topNormSparseScore,
+          checked_articles: gate.checkedArticles,
+        });
+        if (!gate.pass) {
+          // A closed gate produces no finder lane and no matched sections; only
+          // the `selections` differ between bypass (stable prefix) and hard-skip.
+          const closed = (selections: SelectedPage[]): OrchestrateResult => ({
+            selections,
+            matchedSections: new Map(),
+            lanes: { core, hot, fresh, finder: [] },
+          });
+          if (deps.gateConfig.bypassForCore) {
+            // Select over the stable prefix only. `runSelection` mirrors the
+            // normal path: with the selector off it passes the stable candidates
+            // straight through rather than forcing the selectPool LLM call —
+            // which a selector-disabled assistant has no provider for, so it
+            // throws MemoryV3RetrievalUnavailableError and escapes the gate on a
+            // benign low-signal turn. Reaching here means the assistant is
+            // explicitly configured with `selectorEnabled: false` AND
+            // `denseK > 0` (the dense-gated gate only runs with dense hits; the
+            // new-user profile sets `denseK: 0`, so the gate never runs for it).
+            return closed(
+              await runSelection({ stable: buildStable(), finder: [] }),
+            );
+          }
+          return closed([]);
+        }
+      }
+    }
+  }
+
   // Step 1c: edge expansion over the top needle+dense article seeds. `alive`
   // skips slugs already in the pool — finder-surfaced AND stable-prefix slugs
   // (an edge hit carries no matched section, so re-surfacing a core/hot page
@@ -408,21 +586,7 @@ export async function orchestrate(
   // its own snippet line so its CURRENT relevance stays visible; `selectPool`
   // dedupes selections by slug. Finder candidates with no match text fall
   // back to the page's lead-section snippet.
-  const stable: StableCandidate[] = [...core, ...hot, ...fresh, ...always].map(
-    (slug) => {
-      const card = deps.prefixCards.get(slug);
-      if (card === undefined) {
-        // Lane init renders a card for every core/hot slug; a hole here means
-        // the lanes and the card map are out of sync. Throw rather than render
-        // a degraded card — the caller (observeTurn) logs and skips the turn,
-        // which is better than silently breaking the byte-stable prefix.
-        throw new Error(
-          `memory-v3: no pre-rendered card for stable-prefix slug "${slug}"`,
-        );
-      }
-      return { slug, card };
-    },
-  );
+  const stable = buildStable();
   const finderTail: PoolCandidate[] = finder.map((c) => ({
     slug: c.slug,
     lane: c.lane,
@@ -437,10 +601,7 @@ export async function orchestrate(
   // contract. `selectorPrompt` is the (optionally overridden) instruction
   // scaffold; `undefined` falls through to the bundled default.
   const pool = { stable, finder: finderTail };
-  const selections =
-    deps.selectorEnabled === false
-      ? selectAllPoolCandidates(pool)
-      : await selectPool(pool, turn, deps.selectorPrompt);
+  const selections = await runSelection(pool);
 
   return {
     selections,

package/src/plugins/defaults/memory/v3/pool-select.test.ts

@@ -10,8 +10,8 @@
  *     empty pool → [].
  *
  * `mock.module` is process-global and leaks into sibling files in a directory
- * run, so the provider-send-message stub DELEGATES to the real implementation
- * (keeping the real `extractToolUse`) unless this test is actively running
+ * run, so the `@vellumai/plugin-api` stub DELEGATES to the real
+ * `getConfiguredProvider` unless this test is actively running
  * (`selectMockActive`) — mirrors `prune.test.ts` / `ever-injected-store.test.ts`.
  */
 
@@ -25,9 +25,7 @@ import type {
 
 import type { MemoryRoutingTurn, Slug } from "./types.js";
 
-const realProviderSend = {
-  ...(await import("../../../../providers/provider-send-message.js")),
-};
+const realPluginApi = await import("@vellumai/plugin-api");
 
 let selectMockActive = false;
 let sendMessageImpl: (() => Promise<ProviderResponse>) | null = null;
@@ -40,14 +38,14 @@ const mockProvider = {
   },
 } as unknown as Provider;
 
-mock.module("../../../../providers/provider-send-message.js", () => ({
-  ...realProviderSend,
+mock.module("@vellumai/plugin-api", () => ({
+  ...realPluginApi,
   getConfiguredProvider: (
-    ...args: Parameters<typeof realProviderSend.getConfiguredProvider>
+    ...args: Parameters<typeof realPluginApi.getConfiguredProvider>
   ) =>
     selectMockActive
       ? Promise.resolve(mockProvider)
-      : realProviderSend.getConfiguredProvider(...args),
+      : realPluginApi.getConfiguredProvider(...args),
 }));
 
 const { MemoryV3RetrievalUnavailableError, selectPool } =

package/src/plugins/defaults/memory/v3/pool-select.ts

@@ -51,19 +51,19 @@ import type {
   Message,
   ToolUseContent,
 } from "@vellumai/plugin-api";
+import { getConfiguredProvider } from "@vellumai/plugin-api";
 import { z } from "zod";
 
 import { classifyConversationError } from "../../../../daemon/conversation-error.js";
 import type { PendingConversationNotice } from "../../../../daemon/conversation-notices.js";
-import { cachedTextBlock } from "../../../../providers/cache-control.js";
-import {
-  extractToolUse,
-  getConfiguredProvider,
-} from "../../../../providers/provider-send-message.js";
-import type { ToolDefinition } from "../../../../providers/types.js";
 import { redactLogString } from "../../../../util/log-redact.js";
 import { getLogger } from "../../../../util/logger.js";
 import { truncate } from "../../../../util/truncate.js";
+import {
+  cachedTextBlock,
+  extractToolUse,
+  type ToolDefinition,
+} from "../llm-helpers.js";
 import { loadPromptOverride } from "../prompt-override.js";
 import { retryForResult } from "./llm-retry.js";
 import type { MemoryRoutingTurn, SelectedPage, Slug } from "./types.js";

package/src/plugins/defaults/memory/v3/prune.ts

@@ -60,9 +60,9 @@
 
 import type { ContentBlock, Message } from "@vellumai/plugin-api";
 
-import { getConfig } from "../../../../config/loader.js";
 import { getDb, getSqliteFrom } from "../../../../persistence/db-connection.js";
 import { getLogger } from "../../../../util/logger.js";
+import { getMemoryConfig } from "../config.js";
 import { unwrapMemoryBlock, wrapMemoryBlock } from "../memory-marker.js";
 import {
   INJECTED_CONCEPT_HEADER_REGEX,
@@ -393,7 +393,7 @@ export async function runPruneValve(
   options: PruneValveOptions,
 ): Promise<PrunePlan | null> {
   // Defensive read: test configs may omit the prune block entirely.
-  const pruneConfig = getConfig().memory?.v3?.prune;
+  const pruneConfig = getMemoryConfig()?.v3?.prune;
   if (!pruneConfig) return null;
 
   // Planning needs only the store (cheap); the persisted-metadata scan for

package/src/plugins/defaults/memory/v3/section-dense-store.ts

@@ -28,7 +28,6 @@ import type { AssistantConfig } from "../../../../config/types.js";
 import { deleteMemoryCheckpoint } from "../../../../persistence/checkpoints.js";
 import { getDb } from "../../../../persistence/db-connection.js";
 import {
-  embedWithBackend,
   geminiCacheExtras,
   getMemoryBackendStatus,
 } from "../../../../persistence/embeddings/embedding-backend.js";
@@ -37,8 +36,8 @@ import {
   writeEmbeddingCache,
 } from "../../../../persistence/embeddings/embedding-cache.js";
 import { embeddingInputContentHash } from "../../../../persistence/embeddings/embedding-types.js";
-import { resolveQdrantUrl } from "../../../../persistence/embeddings/qdrant-client.js";
 import { getLogger } from "../../../../util/logger.js";
+import { embedWithBackend, resolveQdrantUrl } from "../embeddings.js";
 import type { Section } from "./types.js";
 
 const log = getLogger("memory-v3-section-dense-store");
@@ -77,12 +76,10 @@ let _collectionReady = false;
  * Shared by both section-dense lanes (this store and the dense read lane in
  * `dense.ts`) so they reuse one client instance and one reset hook.
  */
-export function getSectionDenseClient(
-  config: AssistantConfig,
-): QdrantRestClient {
+export function getSectionDenseClient(): QdrantRestClient {
   if (_client) return _client;
   _client = new QdrantRestClient({
-    url: resolveQdrantUrl(config),
+    url: resolveQdrantUrl(),
     checkCompatibility: false,
   });
   return _client;
@@ -108,7 +105,7 @@ export async function ensureSectionCollection(
 ): Promise<void> {
   if (_collectionReady) return;
 
-  const client = getSectionDenseClient(config);
+  const client = getSectionDenseClient();
   const vectorSize = config.memory.qdrant.vectorSize;
   const onDisk = config.memory.qdrant.onDisk;
 
@@ -218,7 +215,7 @@ export async function ensureSectionCollection(
 export async function recreateSectionCollection(
   config: AssistantConfig,
 ): Promise<void> {
-  const client = getSectionDenseClient(config);
+  const client = getSectionDenseClient();
   const exists = await client.collectionExists(SECTION_COLLECTION);
   if (exists.exists) {
     await client.deleteCollection(SECTION_COLLECTION);
@@ -296,7 +293,7 @@ export async function upsertSections(
 
   if (points.length === 0) return;
 
-  await getSectionDenseClient(config).upsert(SECTION_COLLECTION, {
+  await getSectionDenseClient().upsert(SECTION_COLLECTION, {
     wait: true,
     points,
   });
@@ -418,7 +415,7 @@ export async function deleteSectionsForArticle(
 ): Promise<void> {
   await ensureSectionCollection(config);
 
-  await getSectionDenseClient(config).delete(SECTION_COLLECTION, {
+  await getSectionDenseClient().delete(SECTION_COLLECTION, {
     wait: true,
     filter: { must: [{ key: "article", match: { value: article } }] },
   });
@@ -440,7 +437,7 @@ export async function listSectionArticles(
 ): Promise<string[]> {
   await ensureSectionCollection(config);
 
-  const client = getSectionDenseClient(config);
+  const client = getSectionDenseClient();
   const articles = new Set<string>();
   let offset: string | number | undefined = undefined;
   const maxIterations = 10_000;

package/src/plugins/defaults/memory/v3/section-needle.ts

@@ -25,6 +25,14 @@ const HEAD_WEIGHT = 2.5;
 /** `body`-field weight in the BM25F term-frequency blend. */
 const BODY_WEIGHT = 1;
 
+/** A scored section-needle hit: the article, its best-scoring section index
+ *  (into `SectionIndex.sections`), and that section's raw BM25F score. */
+export interface SectionNeedleScoredHit {
+  article: Slug;
+  section: number;
+  score: number;
+}
+
 export interface SectionNeedle {
   /**
    * Returns up to `k` distinct articles ranked by BM25F score (descending),
@@ -32,6 +40,11 @@ export interface SectionNeedle {
    * `SectionIndex.sections`). Ties break by `(article, ordinal)`.
    */
   query(text: string, k: number): { article: Slug; section: number }[];
+  /**
+   * Like {@link query} but includes the raw BM25F score per hit, in the same
+   * rank order (score desc, then (article, ordinal) asc).
+   */
+  queryScored(text: string, k: number): SectionNeedleScoredHit[];
   /**
    * Highest-scoring section index (into `SectionIndex.sections`) for `article`
    * against `queryText`. Returns the article's first section index when no term
@@ -164,10 +177,7 @@ export function buildSectionNeedle(index: SectionIndex): SectionNeedle {
     return sa.article.localeCompare(sc.article) || sa.ordinal - sc.ordinal;
   }
 
-  function query(
-    text: string,
-    k: number,
-  ): { article: Slug; section: number }[] {
+  function queryScored(text: string, k: number): SectionNeedleScoredHit[] {
     if (k <= 0 || docCount === 0) return [];
 
     const queryTerms = new Set(tokenize(text));
@@ -179,17 +189,27 @@ export function buildSectionNeedle(index: SectionIndex): SectionNeedle {
     // Dedupe to distinct articles, keeping each article's best (first-ranked)
     // section, until we have `k` articles.
     const seen = new Set<Slug>();
-    const result: { article: Slug; section: number }[] = [];
+    const result: SectionNeedleScoredHit[] = [];
     for (const doc of ranked) {
       const article = sections[doc]!.article;
       if (seen.has(article)) continue;
       seen.add(article);
-      result.push({ article, section: doc });
+      result.push({ article, section: doc, score: scores.get(doc) ?? 0 });
       if (result.length >= k) break;
     }
     return result;
   }
 
+  function query(
+    text: string,
+    k: number,
+  ): { article: Slug; section: number }[] {
+    return queryScored(text, k).map(({ article, section }) => ({
+      article,
+      section,
+    }));
+  }
+
   function bestSection(article: Slug, queryText: string): number {
     const docs = index.byArticle.get(article);
     if (!docs || docs.length === 0) return -1;
@@ -211,5 +231,5 @@ export function buildSectionNeedle(index: SectionIndex): SectionNeedle {
     return best;
   }
 
-  return { query, bestSection, idf };
+  return { query, queryScored, bestSection, idf };
 }

package/src/plugins/defaults/memory/v3/shadow-plugin.ts

@@ -44,6 +44,7 @@ import { buildEdgeGraph } from "./edge.js";
 import type { EntityIndex } from "./entity-lane.js";
 import { buildEntityIndex } from "./entity-lane.js";
 import { computeFreshSet } from "./fresh-set.js";
+import { isMemoryV3InjectionGateEnabled } from "./gate-flag.js";
 import { computeHotSet } from "./hot-set.js";
 import { computeLearnedEdgeGraph } from "./learned-edges.js";
 import type { OrchestrateResult } from "./orchestrate.js";
@@ -586,6 +587,10 @@ export async function observeTurn(
     if (cfg.memory.enabled === false) return null;
     const lanes = await getLanes(cfg);
     const v3 = cfg.memory.v3;
+    // Resolve the effective gate enable once for the turn: the feature flag
+    // AND the `memory.v3.gate.enabled` config kill-switch. Tuning lives in
+    // `memory.v3.gate`.
+    const gateEnabled = isMemoryV3InjectionGateEnabled(cfg);
     // Re-resolve the corpus-adaptive tuning each turn from the CURRENT config
     // (with the lane-build corpus-size signal) so a live config.json edit to a
     // per-turn knob (selectorEnabled, denseK, replyQueryK, edge.*) takes effect
@@ -619,6 +624,11 @@ export async function observeTurn(
         v3.selectorPromptPath,
         getWorkspaceDir(),
       ),
+      // Per-turn injection gate: the `memory.v3.gate` tuning with the raw
+      // config `enabled` overwritten by the effective enable (flag AND config).
+      // The spread is the compile-time drift guard — if the gate schema and
+      // `V3GateConfig` diverge, this stops typechecking.
+      gateConfig: { ...v3.gate, enabled: gateEnabled },
     });
 
     // A zero-selection turn over a non-trivial pool is unusual enough to be

package/src/plugins/defaults/memory/v3-eval/eval-packets.ts

@@ -35,10 +35,7 @@ import {
   conversations,
   messages,
 } from "../../../../persistence/schema/index.js";
-import {
-  FRONTMATTER_REGEX,
-  parseFrontmatterFields,
-} from "../../../../skills/frontmatter.js";
+import { FRONTMATTER_REGEX, parseFrontmatterFields } from "../frontmatter.js";
 import { injectedConceptHeader } from "../v2/injected-block-slugs.js";
 import { slugFromConceptPath } from "../v2/page-store.js";
 import { renderCard } from "../v3/card.js";

package/src/plugins/defaults/title-generate/hooks/user-prompt-submit.ts

@@ -19,6 +19,11 @@ import { getConversation } from "../../../../persistence/conversation-crud.js";
 import { queueGenerateConversationTitle } from "../../../../persistence/conversation-title-service.js";
 
 const userPromptSubmit: HookFunction<UserPromptSubmitContext> = async (ctx) => {
+  // Hidden machine signals (e.g. the channel-setup wizard-close marker) are
+  // not user speech — a title minted from one would surface invisible
+  // scaffolding text in the sidebar, and the LLM call is wasted.
+  if (ctx.isHiddenPrompt) return;
+
   // System conversations (background/scheduled) carry a deterministic title
   // from bootstrap. Their own job prompts arrive as non-interactive turns and
   // must not spend an LLM call on a title nobody reads — only a genuine user

package/src/plugins/defaults/turn-context/injectors.ts

@@ -32,6 +32,7 @@ const unifiedTurnContextInjector: Injector = {
     const text = buildUnifiedTurnContextBlock({
       timestamp,
       interfaceName: ctx.interfaceName,
+      clientOs: ctx.clientOs,
       channelName: ctx.channelName,
       actorContext: ctx.actorContext,
       configuredUserTimezone: ctx.configuredUserTimezone,

package/src/plugins/defaults/turn-context/unified-turn-context.ts

@@ -18,6 +18,7 @@ import { resolveCapabilities } from "../../../runtime/capabilities.js";
 export interface UnifiedTurnContextOptions {
   timestamp: string;
   interfaceName?: string;
+  clientOs?: string;
   channelName?: string;
   actorContext?: InboundActorContext | null;
   configuredUserTimezone?: string | null;
@@ -100,6 +101,9 @@ export function buildUnifiedTurnContextBlock(
   if (options.interfaceName) {
     lines.push(`interface: ${options.interfaceName}`);
   }
+  if (options.clientOs) {
+    lines.push(`client_os: ${options.clientOs}`);
+  }
 
   // Actor identity and trust fields — only for non-guardian turns.
   if (options.actorContext) {
@@ -182,6 +186,14 @@ export function buildUnifiedTurnContextBlock(
 
     // Behavioral guidance - only for non-guardian actors where social
     // engineering defense matters. Guardian case needs no instruction.
+    //
+    // Scope: this is identity/verification hygiene (don't infer guardian status
+    // from tone, don't self-approve, don't explain the verification system).
+    // Its complement — the data-disclosure boundary (never reveal the guardian's
+    // private data: schedule, contacts, files, memories) — lives in the
+    // `users/default.md` persona guardrail, gated by
+    // `derivePersonaTrustFlags()` in `runtime/trust-class.ts`. Keep the two
+    // distinct.
     switch (resolveCapabilities(ctx.trustClass).promptTrustGuidance) {
       case "social-engineering-defense": {
         lines.push("");

package/src/plugins/injector-registry.ts

@@ -96,8 +96,16 @@ export function unregisterPluginInjectors(pluginName: string): void {
  * and tool registries honor. The order-sorted union is memoized across the
  * filter (rebuilt only on a registration change); only the small per-plugin
  * disabled check re-runs each call.
+ *
+ * `effectiveEnabledPlugins` layers the per-chat plugin scope on top of the
+ * global disabled check: when non-null, an injector's contributing plugin must
+ * also be a member of the set or the injector is excluded for this turn. `null`
+ * (or omitted) means no per-chat restriction — every globally-enabled plugin's
+ * injectors run, unchanged.
  */
-export function getRegisteredInjectors(): Injector[] {
+export function getRegisteredInjectors(
+  effectiveEnabledPlugins?: Set<string> | null,
+): Injector[] {
   if (cachedChain === null) {
     const pairs: Array<{ plugin: string; injector: Injector }> = [];
     for (const [plugin, injectors] of injectorsByPlugin) {
@@ -110,7 +118,10 @@ export function getRegisteredInjectors(): Injector[] {
   const isEnabled = (plugin: string): boolean => {
     let enabled = enabledByPlugin.get(plugin);
     if (enabled === undefined) {
-      enabled = !isPluginDisabled(plugin);
+      enabled =
+        !isPluginDisabled(plugin) &&
+        (effectiveEnabledPlugins == null ||
+          effectiveEnabledPlugins.has(plugin));
       enabledByPlugin.set(plugin, enabled);
     }
     return enabled;