@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/plugins/defaults/memory/memory-retrospective-job.ts

@@ -46,6 +46,7 @@ import {
   type ConversationRow,
   deleteConversation,
   getConversation,
+  getConversationProcessingStartedAt,
   isConversationProcessing,
 } from "@vellumai/plugin-api";
 
@@ -56,7 +57,7 @@ import {
 } from "../../../channels/types.js";
 import { isV3TierActive } from "../../../config/memory-v3-gate.js";
 import type { AssistantConfig } from "../../../config/types.js";
-import { getGuardianDelivery } from "../../../contacts/guardian-delivery-reader.js";
+import { warmGuardianBindings } from "../../../contacts/guardian-delivery-reader.js";
 import { extractTurnContextTimestamp } from "../../../context/compactor.js";
 import {
   formatLocalTimestamp,
@@ -72,7 +73,6 @@ import {
   enqueueMemoryJob,
   type MemoryJob,
   type MemoryJobType,
-  upsertMemoryRetrospectiveJob,
 } from "../../../persistence/jobs-store.js";
 import { resolveUserSlug } from "../../../prompts/persona-resolver.js";
 import type { SystemPromptPersonaOverride } from "../../../prompts/system-prompt.js";
@@ -88,6 +88,7 @@ import {
   MEMORY_RETROSPECTIVE_FORK_SOURCE,
   MEMORY_RETROSPECTIVE_GROUP_ID,
   MEMORY_RETROSPECTIVE_INSTRUCTION_KIND,
+  MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT,
   MEMORY_RETROSPECTIVE_ORIGIN,
   MEMORY_RETROSPECTIVE_SOURCE,
   SKILL_MANAGEMENT_SKILL_ID,
@@ -112,15 +113,17 @@ const log = getLogger("memory-retrospective-job");
 const FOLLOW_UP_JOB_TYPES: readonly MemoryJobType[] = [] as const;
 
 /**
- * Fallback delay for re-upserting a run that was skipped because the source
- * conversation was mid-turn. The PRIMARY requeue is event-driven: the
- * mid-turn skip leaves `lastRunAt` unbumped, so the message-indexing pass on
- * the turn's final assistant message re-enqueues immediately. This timed row
- * only covers a turn that aborts without ever persisting another message.
- * Each retried attempt re-checks the processing flag and re-upserts at the
- * same cadence, so the loop self-resolves when the turn ends.
+ * Age past which a source conversation's persisted `processing_started_at`
+ * stamp is treated as stranded rather than live, and the retrospective
+ * proceeds despite it. A turn-end flag clear can fail and be swallowed under
+ * DB-lock contention while the daemon stays up, and the monitor-process
+ * reaper only clears flags older than the daemon's boot time, so an
+ * in-process stranded flag otherwise blocks a conversation's retrospectives
+ * indefinitely. Proceeding risks only forking a half-finished display turn
+ * (a review-quality concern; the fork copies complete persisted turns), which
+ * is strictly better than never forming memories for the conversation again.
  */
-export const SOURCE_PROCESSING_REQUEUE_DELAY_MS = 60_000;
+export const STALE_SOURCE_PROCESSING_OVERRIDE_MS = 6 * 60 * 60 * 1000;
 
 /** Watchdog check_name for the per-run retrospective outcome counter. */
 const MEMORY_RETROSPECTIVE_RUN_CHECK_NAME = "memory_retrospective_run";
@@ -132,6 +135,7 @@ export type MemoryRetrospectiveOutcome =
   | { kind: "source_dormant" }
   | { kind: "source_processing" }
   | { kind: "wake_failed"; reason?: string; conversationId?: string }
+  | { kind: "no_usable_output"; reason?: string; conversationId?: string }
   | {
       kind: "invoked";
       backgroundConversationId: string;
@@ -150,6 +154,20 @@ export async function memoryRetrospectiveJob(
     return { kind: "no_new_messages" };
   }
 
+  // Execution-time twin of the enqueue funnel's `memory.retrospective.enabled`
+  // gate: rows queued before the flag was turned off drain as no-ops instead
+  // of forking. The CLI's manual `memory retrospective run` calls
+  // `runForkBasedRetrospective` directly and so is unaffected: an operator's
+  // explicit request overrides the flag, matching the lookback and
+  // user-activity gates.
+  if (!config.memory.retrospective.enabled) {
+    log.info(
+      { jobId: job.id, sourceConversationId },
+      "Skipping job: memory.retrospective.enabled is false",
+    );
+    return { kind: "disabled" };
+  }
+
   // Central health counter (admin analytics groups on the watchdog
   // check_name): one event per run with its outcome kind. A run that
   // throws records outcome "error" before the exception continues to the
@@ -186,7 +204,9 @@ export async function memoryRetrospectiveJob(
   }
   emitRunOutcome(
     outcome.kind,
-    outcome.kind === "wake_failed" ? outcome.reason : undefined,
+    outcome.kind === "wake_failed" || outcome.kind === "no_usable_output"
+      ? outcome.reason
+      : undefined,
   );
   return outcome;
 }
@@ -271,34 +291,36 @@ export async function runForkBasedRetrospective(
   // persisted message — including the turn's final assistant message — so an
   // unbumped `lastRunAt` lets that turn-end pass re-enqueue with no cooldown
   // suppression. That is the primary, event-driven requeue: the retrospective
-  // runs right after the colliding turn completes. Mid-turn attempts are
-  // cheap no-ops (existence + processing check) that recur at most once per
-  // persisted message and coalesce into a single pending row via the upsert.
-  // The timed re-upsert below is a fallback for a turn that aborts without
-  // ever indexing another message (the lifecycle/disposal enqueue remains
-  // the last-resort net). Both state pointers stay untouched, so nothing is
-  // lost. Returning (not throwing) keeps the jobs-worker from
-  // retry-with-backoff.
+  // runs right after the colliding turn completes. The `source_processing`
+  // outcome maps to a bounded deferral of the SAME job row at the worker
+  // (see `resolveRetrospectiveOutcome` in `job-handlers.ts`); turn-end
+  // trigger upserts coalesce onto that pending row, so the event-driven
+  // retry keeps its immediacy while a stranded flag can no longer mint an
+  // unbounded stream of fresh rows. Both state pointers stay untouched, so
+  // nothing is lost.
+  //
+  // Stranded-flag override: a swallowed turn-end flag clear leaves the
+  // persisted stamp set while the daemon stays up, where the monitor
+  // process's boot-time-fenced reaper never touches it. A stamp older than
+  // `STALE_SOURCE_PROCESSING_OVERRIDE_MS` is treated as stranded and the run
+  // proceeds; a set-but-stampless flag reads as live (deferral bounds it).
   if (await isConversationProcessing(sourceConversationId)) {
-    try {
-      upsertMemoryRetrospectiveJob(
-        { conversationId: sourceConversationId },
-        Date.now() + SOURCE_PROCESSING_REQUEUE_DELAY_MS,
-      );
+    const processingStartedAt =
+      await getConversationProcessingStartedAt(sourceConversationId);
+    const stale =
+      processingStartedAt != null &&
+      startedAtMs - processingStartedAt > STALE_SOURCE_PROCESSING_OVERRIDE_MS;
+    if (!stale) {
       log.info(
-        {
-          sourceConversationId,
-          requeueDelayMs: SOURCE_PROCESSING_REQUEUE_DELAY_MS,
-        },
-        "memory-retrospective (fork): source conversation is mid-turn; requeued",
-      );
-    } catch (err) {
-      log.warn(
-        { err, sourceConversationId },
-        "memory-retrospective (fork): mid-turn fallback requeue failed; relying on the turn-end trigger check",
+        { sourceConversationId, processingStartedAt },
+        "memory-retrospective (fork): source conversation is mid-turn; deferring",
       );
+      return { kind: "source_processing" };
     }
-    return { kind: "source_processing" };
+    log.warn(
+      { sourceConversationId, processingStartedAt },
+      "memory-retrospective (fork): processing flag is stale beyond the override window; proceeding despite it",
+    );
   }
 
   const state = getRetrospectiveState(sourceConversationId);
@@ -457,10 +479,11 @@ export async function runForkBasedRetrospective(
   // parity — the fork always runs execution gate mode below, so the source's
   // full tool surface stays on the wire while the allowlist holds at
   // execution time.
-  // Warm the vellum guardian-delivery cache so the sync slug resolution inside
-  // resolveSourceParityPins (resolveUserSlug(undefined)) hits a fresh key
-  // instead of falling back to "default" on a cold/TTL-expired cache.
-  await getGuardianDelivery({ channelTypes: ["vellum"] });
+  // Warm both guardian-delivery cache keys (vellum + unfiltered) so the sync
+  // slug resolution inside resolveSourceParityPins (resolveUserSlug(undefined)),
+  // including its any-channel fallback, hits fresh keys instead of falling
+  // back to "default" on a cold/TTL-expired cache.
+  await warmGuardianBindings();
   const { personaOverride, toolContextPin } = resolveSourceParityPins(
     sourceConversation,
     newMessages,
@@ -549,25 +572,65 @@ export async function runForkBasedRetrospective(
   }
 
   if (wakeSucceeded) {
-    return await finalizeSuccessfulRetrospective({
-      config,
-      sourceConversationId,
-      retrospectiveConversationId: forkId,
-      cutoffMessageId,
-      newMessageCount: newMessages.length,
-      prior,
-      priorRemembers,
-      logFields: {
-        kind: "fork",
-        windowStartTimestamp,
-        durationMs: Date.now() - startedAtMs,
-      },
-    });
+    // Fail-closed finalization: `invoked: true` proves only that the wake
+    // went live, not that the run produced anything. The agent loop swallows
+    // provider rejections into a normal no-output return, an exhausted output
+    // budget can stop a run before any visible text or tool call, and a
+    // model may reply with analysis (or nothing) without saving. Advancement
+    // past the window therefore requires POSITIVE evidence from THIS run,
+    // one of:
+    //   - a memory-writing tool call on the fork's post-boundary tail whose
+    //     execution verifiably succeeded (matching non-error tool_result), or
+    //   - the explicit no-findings reply the instruction mandates (an
+    //     assistant text block that is exactly the sentinel phrase), with no
+    //     memory-writing tool attempts at all; a run that attempted a save
+    //     and failed cannot advance by also claiming no findings.
+    // The evidence read is run-specific by construction
+    // (`loadRetrospectiveRunMessages` scopes to rows after the fork
+    // boundary), so a prior run's persisted saves can never satisfy it, and
+    // it reads the DB rather than the returned history, so a checkpoint that
+    // went live and persisted saves counts even when a later in-loop repair
+    // rebased the returned tail. A run with neither evidence kind follows
+    // the wake-failure path: cursor, remembered log, and the prior
+    // retrospective (the dedup baseline) stay untouched and the window
+    // remains retryable.
+    const runEvidence = await collectRetrospectiveRunEvidence(forkId);
+    const reviewedNoFindings =
+      runEvidence.explicitNoFindings &&
+      runEvidence.durableToolAttemptCount === 0;
+    if (runEvidence.durableToolCallCount === 0 && !reviewedNoFindings) {
+      log.warn(
+        {
+          sourceConversationId,
+          forkId,
+          newMessageCount: newMessages.length,
+          durableToolAttempts: runEvidence.durableToolAttemptCount,
+        },
+        "memory-retrospective (fork): run produced neither a verified durable write nor an explicit no-findings reply; leaving window retryable",
+      );
+    } else {
+      return await finalizeSuccessfulRetrospective({
+        config,
+        sourceConversationId,
+        retrospectiveConversationId: forkId,
+        cutoffMessageId,
+        newMessageCount: newMessages.length,
+        prior,
+        priorRemembers,
+        runRemembers: runEvidence.remembers,
+        logFields: {
+          kind: "fork",
+          windowStartTimestamp,
+          durationMs: Date.now() - startedAtMs,
+          noFindings: reviewedNoFindings,
+        },
+      });
+    }
   }
 
-  // Wake failed. Bump `lastRunAt` only so the cooldown gate applies, leave
-  // `lastProcessedMessageId` alone so the next attempt re-processes the
-  // same messages. Then clean up the orphan fork.
+  // Wake failed or produced no usable output. Bump `lastRunAt` only so the
+  // cooldown gate applies, leave `lastProcessedMessageId` alone so the next
+  // attempt re-processes the same messages. Then clean up the orphan fork.
   await bumpRetrospectiveLastRunAt(sourceConversationId, Date.now());
   await safeDeleteRetrospectiveConversation(
     forkId,
@@ -578,6 +641,13 @@ export async function runForkBasedRetrospective(
     throw threw;
   }
 
+  if (wakeSucceeded) {
+    return {
+      kind: "no_usable_output",
+      reason: failureReason ?? "run persisted no memory-writing tool call",
+      conversationId: forkId,
+    };
+  }
   return {
     kind: "wake_failed",
     reason: failureReason,
@@ -786,6 +856,12 @@ async function finalizeSuccessfulRetrospective(args: {
   newMessageCount: number;
   prior: PriorRetrospective | null;
   priorRemembers: string[];
+  /**
+   * The `remember` contents extracted from this run's persisted tail by the
+   * caller's usable-output check; passed through so the evidence that gated
+   * advancement is exactly the evidence folded into the log.
+   */
+  runRemembers: string[];
   /** Per-kind extras for the success log line (e.g. `kind`, fork anchor). */
   logFields: Record<string, unknown>;
 }): Promise<MemoryRetrospectiveOutcome> {
@@ -797,12 +873,10 @@ async function finalizeSuccessfulRetrospective(args: {
     newMessageCount,
     prior,
     priorRemembers,
+    runRemembers,
     logFields,
   } = args;
 
-  const runRemembers = await extractRetrospectiveRunRemembers(
-    retrospectiveConversationId,
-  );
   await upsertRetrospectiveState({
     conversationId: sourceConversationId,
     lastProcessedMessageId: cutoffMessageId,
@@ -1003,9 +1077,204 @@ async function extractRetrospectiveRunRemembers(
   if (runMessages == null) {
     return [];
   }
+  // Deliberately unfiltered by execution success: this reads a PRIOR run for
+  // the <already_remembered> dedup baseline, where over-inclusion is the
+  // safe direction (worst case a fact is not re-saved) and old runs predate
+  // result-verified evidence. The CURRENT run's log append goes through
+  // `collectRetrospectiveRunEvidence`, which does verify execution.
   return extractRememberContents(runMessages);
 }
 
+/**
+ * Tool names whose persisted `tool_use` blocks count as durable memory work
+ * for the fail-closed advancement gate: `remember` writes the memory buffer,
+ * `scaffold_managed_skill` writes a managed skill. Read-only tools on the
+ * retrospective allowlist (`skill_load`, `find_similar_skills`) deliberately
+ * do not qualify: a run that only browsed produced nothing durable.
+ */
+const DURABLE_RETROSPECTIVE_TOOLS: ReadonlySet<string> = new Set([
+  "remember",
+  "scaffold_managed_skill",
+]);
+
+/**
+ * Read the durable evidence a retrospective run persisted: its `remember`
+ * contents plus a count of every memory-writing tool call on the run's
+ * post-boundary tail whose EXECUTION succeeded. A `tool_use` block alone
+ * proves only that the model asked; the durable write happens inside the
+ * executor, so a call counts (and its facts feed the remembered log) only
+ * when a matching non-error `tool_result` is persisted on the same tail. A
+ * failed or missing execution therefore leaves the window retryable, and a
+ * failed `remember`'s facts never enter the `<already_remembered>` baseline
+ * where they would suppress the retry's re-save. A load failure
+ * (`runMessages == null`) reports zero durable calls, which the advancement
+ * gate treats as "not proven usable" (fail-closed).
+ */
+async function collectRetrospectiveRunEvidence(
+  conversationId: string,
+): Promise<{
+  remembers: string[];
+  /** Memory-writing tool calls whose execution verifiably succeeded. */
+  durableToolCallCount: number;
+  /** Memory-writing tool calls the run attempted, regardless of outcome. */
+  durableToolAttemptCount: number;
+  /**
+   * The run replied with exactly the mandated no-findings sentinel text
+   * ({@link MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT}) in a persisted assistant
+   * text block. Strict whole-block equality: prose that merely mentions the
+   * phrase does not qualify, so an analysis-only reply stays unusable.
+   */
+  explicitNoFindings: boolean;
+}> {
+  const conv = await getConversation(conversationId);
+  const runMessages = await loadRetrospectiveRunMessages(
+    conversationId,
+    conv?.source ?? null,
+  );
+  if (runMessages == null) {
+    return {
+      remembers: [],
+      durableToolCallCount: 0,
+      durableToolAttemptCount: 0,
+      explicitNoFindings: false,
+    };
+  }
+  const succeededIds = collectSuccessfulToolResultIds(runMessages);
+  return {
+    remembers: extractRememberContents(runMessages, succeededIds),
+    durableToolCallCount: countDurableToolUses(runMessages, succeededIds),
+    durableToolAttemptCount: countDurableToolUses(runMessages, null),
+    explicitNoFindings: hasExplicitNoFindingsReply(runMessages),
+  };
+}
+
+/**
+ * Whether any persisted assistant row on the run's tail carries a text block
+ * that is exactly the no-findings sentinel (after trimming). The instruction
+ * template mandates this exact reply for a reviewed-and-nothing-to-save
+ * pass, making it the positive persisted artifact that distinguishes a
+ * legitimate no-findings review from an empty or unusable response.
+ */
+function hasExplicitNoFindingsReply(messages: MessageLike[]): boolean {
+  for (const msg of messages) {
+    if (msg.role !== "assistant") {
+      continue;
+    }
+    let blocks: unknown = msg.content;
+    if (typeof blocks === "string") {
+      try {
+        blocks = JSON.parse(blocks);
+      } catch {
+        continue;
+      }
+    }
+    if (!Array.isArray(blocks)) {
+      continue;
+    }
+    for (const block of blocks) {
+      if (!block || typeof block !== "object") {
+        continue;
+      }
+      const b = block as Record<string, unknown>;
+      if (
+        b.type === "text" &&
+        typeof b.text === "string" &&
+        b.text.trim() === MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT
+      ) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Ids of `tool_result` blocks on the run's user rows whose execution did not
+ * report an error. Robust to malformed content JSON the same way
+ * `extractRememberContents` is.
+ */
+function collectSuccessfulToolResultIds(messages: MessageLike[]): Set<string> {
+  const ids = new Set<string>();
+  for (const msg of messages) {
+    if (msg.role !== "user") {
+      continue;
+    }
+    let blocks: unknown = msg.content;
+    if (typeof blocks === "string") {
+      try {
+        blocks = JSON.parse(blocks);
+      } catch {
+        continue;
+      }
+    }
+    if (!Array.isArray(blocks)) {
+      continue;
+    }
+    for (const block of blocks) {
+      if (!block || typeof block !== "object") {
+        continue;
+      }
+      const b = block as Record<string, unknown>;
+      // guard:allow-tool-result-only: success evidence for locally-executed
+      // durable memory tools; server-side web_search_tool_result never
+      // corresponds to a durable write and carries no is_error flag.
+      if (
+        b.type === "tool_result" &&
+        typeof b.tool_use_id === "string" &&
+        b.is_error !== true
+      ) {
+        ids.add(b.tool_use_id);
+      }
+    }
+  }
+  return ids;
+}
+
+/**
+ * Count persisted `tool_use` blocks whose `name` is in
+ * {@link DURABLE_RETROSPECTIVE_TOOLS} across the run's assistant rows.
+ * With a `succeededIds` set, only calls whose id has a matching successful
+ * `tool_result` count (verified executions); with `null`, every attempt
+ * counts regardless of outcome.
+ */
+function countDurableToolUses(
+  messages: MessageLike[],
+  succeededIds: ReadonlySet<string> | null,
+): number {
+  let count = 0;
+  for (const msg of messages) {
+    if (msg.role !== "assistant") {
+      continue;
+    }
+    let blocks: unknown = msg.content;
+    if (typeof blocks === "string") {
+      try {
+        blocks = JSON.parse(blocks);
+      } catch {
+        continue;
+      }
+    }
+    if (!Array.isArray(blocks)) {
+      continue;
+    }
+    for (const block of blocks) {
+      if (!block || typeof block !== "object") {
+        continue;
+      }
+      const b = block as Record<string, unknown>;
+      if (
+        b.type === "tool_use" &&
+        DURABLE_RETROSPECTIVE_TOOLS.has(String(b.name)) &&
+        (succeededIds === null ||
+          (typeof b.id === "string" && succeededIds.has(b.id)))
+      ) {
+        count += 1;
+      }
+    }
+  }
+  return count;
+}
+
 interface MessageLike {
   role: string;
   content: string | ContentBlock[];
@@ -1016,7 +1285,10 @@ interface MessageLike {
  * `"remember"` and return the `input.content` strings in order. Robust to
  * malformed content JSON — unparseable rows are skipped, not propagated.
  */
-function extractRememberContents(messages: MessageLike[]): string[] {
+function extractRememberContents(
+  messages: MessageLike[],
+  succeededIds?: ReadonlySet<string>,
+): string[] {
   const contents: string[] = [];
   for (const msg of messages) {
     if (msg.role !== "assistant") {
@@ -1044,6 +1316,16 @@ function extractRememberContents(messages: MessageLike[]): string[] {
       if (b.name !== "remember") {
         continue;
       }
+      // When a success set is provided, only executions that reported a
+      // non-error tool_result contribute facts: a failed remember never
+      // wrote the buffer, and logging its facts would suppress the retry's
+      // re-save via <already_remembered>.
+      if (
+        succeededIds !== undefined &&
+        (typeof b.id !== "string" || !succeededIds.has(b.id))
+      ) {
+        continue;
+      }
       const input = b.input;
       if (!input || typeof input !== "object") {
         continue;

package/src/plugins/defaults/memory/memory-retrospective-prompt.ts

@@ -27,6 +27,7 @@
  */
 
 import { getLogger } from "./logging.js";
+import { MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT } from "./memory-retrospective-constants.js";
 import { getWorkspaceDir } from "./paths.js";
 import { loadPromptOverride } from "./prompt-override.js";
 
@@ -43,6 +44,13 @@ function neutralizeSentinels(s: string): string {
   );
 }
 
+/**
+ * The sentence mandating the exact no-findings reply. Built from
+ * {@link MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT} so the instruction and the
+ * finalizer's acceptance check can never drift apart.
+ */
+const NO_FINDINGS_MANDATE = `If nothing new is worth saving, reply with exactly "${MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT}" and stop.`;
+
 /**
  * Bundled fork-instruction template. Exported so tests (and any future
  * "Load default" affordance) can reference the canonical body verbatim.
@@ -63,7 +71,7 @@ Two dedup sources to skip:
 1. Anything semantically captured in <already_remembered> above (from prior retrospective passes).
 2. Anything you already called \`remember\` on inline within your review window — those appear as \`tool_use\` blocks with \`name: "remember"\` in your history.
 
-For everything else in your review window, use the \`remember\` tool on facts, plans, decisions, preferences, names, dates, felt moments, corrections, commitments, or anything else concrete and worth carrying forward. When several facts are worth saving, pass them all as an array to a single \`remember\` call rather than calling it once per fact. If nothing new is worth saving, say "Nothing new to save." and stop.
+For everything else in your review window, use the \`remember\` tool on facts, plans, decisions, preferences, names, dates, felt moments, corrections, commitments, or anything else concrete and worth carrying forward. When several facts are worth saving, pass them all as an array to a single \`remember\` call rather than calling it once per fact. ${NO_FINDINGS_MANDATE}
 {{SKILL_AUTHORING_SECTION}}`;
 
 /** Placeholder names recognized in the bundled template and overrides. */
@@ -140,7 +148,9 @@ export interface ForkInstructionArgs {
  * override resolves to a usable file (bounded to a regular file under 1 MiB by
  * the shared {@link loadPromptOverride}), else the bundled
  * {@link RETROSPECTIVE_INSTRUCTION_TEMPLATE}; both get the same placeholder
- * substitution.
+ * substitution. An override additionally gets the no-findings mandate
+ * appended after its body: the exact-reply sentinel is the finalizer's
+ * advancement contract, so it holds regardless of what the override says.
  */
 export function buildForkInstruction({
   windowStartTimestamp,
@@ -175,7 +185,7 @@ export function buildForkInstruction({
     label: "retrospective prompt",
   });
 
-  return substituteInstructionParts(
+  const rendered = substituteInstructionParts(
     override ?? RETROSPECTIVE_INSTRUCTION_TEMPLATE,
     {
       AVAILABLE_TOOLS_LINE: availableToolsLine,
@@ -186,6 +196,16 @@ export function buildForkInstruction({
         : "",
     },
   );
+  if (override == null) {
+    return rendered;
+  }
+  // The finalizer recognizes a no-findings review only by the exact
+  // MEMORY_RETROSPECTIVE_NO_FINDINGS_TEXT reply, so the mandate is part of
+  // the advancement contract, not prompt styling: an override body that
+  // drops it would leave every no-findings window permanently retryable.
+  // Appended outside the override so a custom prompt cannot break the
+  // contract.
+  return `${rendered}\n\n${NO_FINDINGS_MANDATE}`;
 }
 
 /**

package/src/plugins/defaults/memory/substrate/consolidation-lock.ts

@@ -31,11 +31,16 @@ const log = getLogger("memory-v2-consolidate");
 
 /**
  * Hard timeout for the consolidation run. Consolidation reads the buffer,
- * rewrites several files, and re-encodes essentials/threads: generous
- * upper bound so a slow run isn't killed mid-edit, but bounded so a stuck
- * provider can't pin the worker indefinitely.
+ * rewrites several files, and re-encodes essentials/threads: on a mature
+ * corpus a full pass legitimately runs ~20 minutes under cross-process write
+ * contention, so the bound leaves headroom above that while still keeping a
+ * stuck run from pinning the worker indefinitely. Matches the default
+ * `timeouts.backgroundTurnTimeoutSec` budget for heartbeat/background turns.
+ * Overrunning it marks the run failed and skips its follow-up jobs (reembeds,
+ * v3 maintenance) even though the agent's file edits land, so the bound must
+ * comfortably exceed a healthy run's duration.
  */
-export const CONSOLIDATION_TIMEOUT_MS = 15 * 60 * 1000;
+export const CONSOLIDATION_TIMEOUT_MS = 30 * 60 * 1000;
 
 /**
  * Age past which a lock held by an apparently-live PID is taken over anyway.

package/src/plugins/defaults/memory/substrate/sweep-job.ts

@@ -36,6 +36,7 @@ import { z } from "zod";
 
 import { usesConceptPageMemory } from "../../../../config/memory-v3-gate.js";
 import type { AssistantConfig } from "../../../../config/types.js";
+import { warmGuardianBindings } from "../../../../contacts/guardian-delivery-reader.js";
 import { emitNotificationSignal } from "../../../../notifications/emit-signal.js";
 import { getDb } from "../../../../persistence/db-connection.js";
 import type { MemoryJob } from "../../../../persistence/jobs-store.js";
@@ -155,6 +156,12 @@ export async function memoryV2SweepJob(
       return 0;
     }
 
+    // Warm both guardian-delivery cache keys (vellum + unfiltered) so
+    // resolveUserName's sync guardian-file resolution, including its
+    // any-channel fallback, hits fresh keys instead of falling back to
+    // users/default.md on this worker process's cold cache.
+    await warmGuardianBindings();
+
     const systemPrompt = renderSweepPrompt({
       assistantName: getAssistantName(),
       userName: resolveUserName(workspaceDir),

package/src/plugins/defaults/memory/v1/graph/injection.ts

@@ -349,7 +349,7 @@ export async function resolveInjectionImages(
         continue;
       }
 
-      const optimized = optimizeImageForTransport(
+      const optimized = await optimizeImageForTransport(
         data.data.toString("base64"),
         data.mimeType,
       );

package/src/plugins/defaults/memory/v2/router.ts

@@ -41,6 +41,7 @@ import {
 import { z } from "zod";
 
 import type { AssistantConfig } from "../../../../config/types.js";
+import { warmGuardianBindings } from "../../../../contacts/guardian-delivery-reader.js";
 import {
   cachedTextBlock,
   extractToolUse,
@@ -393,6 +394,13 @@ async function runRouterBatch(
     provider,
   } = params;
 
+  // Warm both guardian-delivery cache keys (vellum + unfiltered) so
+  // resolveUserName's sync guardian-file resolution, including its
+  // any-channel fallback, hits fresh keys instead of falling back to
+  // users/default.md on a cold/TTL-expired cache. Two local-socket IPC
+  // reads per batch, dwarfed by the batch's provider call.
+  await warmGuardianBindings();
+
   const systemPrompt = resolveRouterPrompt(
     config.memory?.v2?.router?.router_prompt_path ?? null,
     workspaceDir,