@vellumai/assistant 0.11.4-dev.202608191709.8efdf64 → 0.11.4-dev.202608191810.7fe7b7a

package/openapi.yaml

@@ -23035,6 +23035,51 @@ paths:
                         additionalProperties: {}
                       - type: "null"
                     description: Pending secret request or null
+                  pendingQuestion:
+                    anyOf:
+                      - type: object
+                        properties:
+                          requestId:
+                            type: string
+                          entries:
+                            type: array
+                            items:
+                              type: object
+                              properties:
+                                id:
+                                  type: string
+                                question:
+                                  type: string
+                                description:
+                                  type: string
+                                options:
+                                  type: array
+                                  items:
+                                    type: object
+                                    properties:
+                                      id:
+                                        type: string
+                                      label:
+                                        type: string
+                                      description:
+                                        type: string
+                                    required:
+                                      - id
+                                      - label
+                                    additionalProperties: false
+                                freeTextPlaceholder:
+                                  type: string
+                              required:
+                                - id
+                                - question
+                                - options
+                              additionalProperties: false
+                        required:
+                          - requestId
+                          - entries
+                        additionalProperties: false
+                      - type: "null"
+                    description: Outstanding ask_question prompt or null
                   interactions:
                     type: array
                     items:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.4-dev.202608191709.8efdf64",
+  "version": "0.11.4-dev.202608191810.7fe7b7a",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/background-workers-disk-pressure.test.ts

@@ -99,7 +99,7 @@ mock.module("../persistence/conversation-crud.js", () => ({
   parseConversation: (row: unknown) => row,
   provenanceFromTrustContext: () => ({ source: "user" }),
   relinkAttachments: mock(() => {}),
-  selectSlackMetaCandidateMetadata: () => null,
+  selectProviderMetaCandidateMetadata: () => null,
   setConversationOriginChannelIfUnset: mock(() => {}),
   setConversationOriginInterfaceIfUnset: mock(() => {}),
   setConversationInferenceProfile: mock(() => {}),

package/src/__tests__/conversation-lifecycle.test.ts

@@ -652,14 +652,12 @@ describe("loadFromDb metadata injection rehydration", () => {
     expect(messages[2].content).toEqual([{ type: "text", text: "Tail" }]);
   });
 
-  test("internal-channel trusted_contact view still rehydrates memoryV2StaticBlock", async () => {
-    // Rehydration keys on `sourceChannel`, not `trustClass`: injection uses
-    // `shouldExposePersonalMemory`, which exposes personal memory whenever
-    // `sourceChannel === "vellum"` regardless of actor trust class. So a
-    // trusted_contact view arriving over the internal `"vellum"` channel
-    // rehydrates `memoryV2StaticBlock`. The rehydrate gate must match
-    // injection so a daemon-restart reload of the same conversation produces
-    // an identical prefix.
+  test("internal-channel trusted_contact view does not rehydrate memoryV2StaticBlock", async () => {
+    // Rehydration keys on the actor, not the surface: a trusted_contact is
+    // denied personal memory on the internal `"vellum"` channel exactly as it
+    // is on a remote one. Injection and rehydration share
+    // `canSeePersonalMemory`, so a daemon-restart reload of the same
+    // conversation produces an identical prefix.
     mockConversation = defaultConv();
     mockDbMessages = [
       {
@@ -697,13 +695,8 @@ describe("loadFromDb metadata injection rehydration", () => {
     const messages = conversation.getMessages();
 
     expect(messages).toHaveLength(3);
-    expect(messages[0].content).toEqual([
-      {
-        type: "text",
-        text: "<info>\n## Essentials\n\nAlice prefers VS Code.\n</info>",
-      },
-      { type: "text", text: "First" },
-    ]);
+    // The persisted block stays out: the console is a surface, not an actor.
+    expect(messages[0].content).toEqual([{ type: "text", text: "First" }]);
   });
 
   test("rehydration order matches injection-time order for the full personal-memory set", async () => {
@@ -1047,12 +1040,14 @@ describe("loadFromDb metadata injection rehydration", () => {
     expect(messages[2].content).toEqual([{ type: "text", text: "Tail" }]);
   });
 
-  test("ensureActorScopedHistory reloads when sourceChannel changes within the same trust class", async () => {
-    // Regression: cache invalidation previously keyed only on trust class.
-    // `loadFromDb` gates `memoryV2StaticBlock` rehydration on `sourceChannel`
-    // via `shouldExposePersonalMemory`, so a same-trust-class reuse from a
-    // different channel (e.g. internal `vellum` → remote channel) must
-    // re-run `loadFromDb` or stale personal-memory exposure persists.
+  test("ensureActorScopedHistory reloads when the actor's memory visibility changes", async () => {
+    // Reuse of a resident conversation by a different actor must re-run
+    // `loadFromDb`, or the incoming actor inherits the previous actor's
+    // transcript with its personal-memory blocks still spliced in.
+    //
+    // Driven by a trust-class change rather than a channel change: personal
+    // memory is keyed on the actor, so two channels at the same class are the
+    // same view and reloading between them would prove nothing.
     mockConversation = defaultConv();
     mockDbMessages = [
       {
@@ -1080,10 +1075,9 @@ describe("loadFromDb metadata injection rehydration", () => {
     ];
 
     const conversation = makeConversation();
-    // First load: internal channel, trusted_contact actor → personal memory
-    // exposed via `shouldExposePersonalMemory({sourceChannel: "vellum", ...})`.
+    // First load: guardian actor → personal memory exposed.
     conversation.setTrustContext({
-      trustClass: "trusted_contact",
+      trustClass: "guardian",
       sourceChannel: "vellum",
     });
     await conversation.ensureActorScopedHistory();
@@ -1095,8 +1089,8 @@ describe("loadFromDb metadata injection rehydration", () => {
       { type: "text", text: "First" },
     ]);
 
-    // Reuse with the same trust class but a remote channel. The cache must
-    // invalidate and trigger a reload that strips the personal-memory block.
+    // Reuse by a contact. The cache must invalidate and trigger a reload that
+    // strips the personal-memory block.
     conversation.setTrustContext({
       trustClass: "trusted_contact",
       sourceChannel: "telegram",

package/src/__tests__/conversation-pairing.test.ts

@@ -47,6 +47,14 @@ const getConversationMock = mock((id: string) => {
   return mockExistingConversations[id] ?? null;
 });
 
+const messagesInvalidated: string[] = [];
+
+mock.module("../runtime/sync/resource-sync-events.js", () => ({
+  publishConversationMessagesChanged: (conversationId: string) => {
+    messagesInvalidated.push(conversationId);
+  },
+}));
+
 mock.module("../persistence/conversation-crud.js", () => ({
   setConversationProcessingStartedAt: () => {},
   isConversationProcessing: () => false,
@@ -144,6 +152,7 @@ describe("pairDeliveryWithConversation", () => {
   beforeEach(() => {
     createConversationMock.mockClear();
     addMessageMock.mockClear();
+    messagesInvalidated.length = 0;
     getConversationMock.mockClear();
     getBindingByChannelChatMock.mockClear();
     upsertOutboundBindingMock.mockClear();
@@ -870,6 +879,183 @@ describe("pairDeliveryWithConversation", () => {
     expect(addMessageMock).not.toHaveBeenCalled();
   });
 
+  // ── Passive default: body appended to the producing conversation ───
+  //
+  // The home feed points "Go to Conversation" at `sourceContextId`, so the
+  // body has to land there for that button to open something that contains
+  // the notification the user tapped.
+
+  test("passive vellum signal appends the body to the producing conversation", async () => {
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "schedule",
+      title: "Daily Briefing Delivery",
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+    });
+    const copy = makeCopy({ body: "Daily Briefing for Tuesday." });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      copy,
+    );
+
+    expect(result.conversationId).toBe("conv-producer");
+    expect(result.messageId).toBe("msg-001");
+    expect(result.createdNewConversation).toBe(false);
+    expect(result.conversationFallbackUsed).toBe(false);
+    // Appending must never mint a sidebar entry.
+    expect(createConversationMock).not.toHaveBeenCalled();
+    expect(addMessageMock).toHaveBeenCalledTimes(1);
+    const [conversationId, role] = addMessageMock.mock.calls[0]!;
+    expect(conversationId).toBe("conv-producer");
+    expect(role).toBe("assistant");
+    // `addMessage` publishes the metadata tag alone, so a client holding this
+    // conversation open needs the messages tag to refetch the transcript.
+    expect(messagesInvalidated).toContain("conv-producer");
+  });
+
+  test("appends for a foreground producer the home feed will not mirror", async () => {
+    // `resolveHomeFeedMirror` declines a signal that is neither
+    // `assistant_tool`, nor flagged async-background, nor produced by a
+    // background-typed conversation, so no card is written for this one. The
+    // append is deliberately not gated on that: the vellum banner still
+    // deep-links to this conversation, and the client suppresses the banner
+    // entirely when the user is already viewing it, leaving the transcript as
+    // the only place the notification can land.
+    mockExistingConversations["conv-foreground"] = {
+      id: "conv-foreground",
+      source: "user",
+      title: "An ordinary chat",
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceChannel: "plugin",
+      sourceContextId: "conv-foreground",
+      attentionHints: {
+        requiresAction: false,
+        urgency: "medium",
+        isAsyncBackground: false,
+        visibleInSourceNow: false,
+      },
+    });
+    const copy = makeCopy({ body: "Something you asked to watch changed." });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      copy,
+    );
+
+    expect(result.conversationId).toBe("conv-foreground");
+    expect(createConversationMock).not.toHaveBeenCalled();
+    expect(addMessageMock).toHaveBeenCalledTimes(1);
+    expect(messagesInvalidated).toContain("conv-foreground");
+  });
+
+  test("appended notification body skips indexing", async () => {
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "schedule",
+      title: null,
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+    });
+
+    await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+    );
+
+    const options = addMessageMock.mock.calls[0]![3] as {
+      skipIndexing?: boolean;
+    };
+    expect(options.skipIndexing).toBe(true);
+  });
+
+  test("passive vellum signal appends regardless of the producing conversation's source", async () => {
+    // The reuse_existing branch requires a source match; appending to the
+    // producing conversation does not, since the row already exists and the
+    // feed links to it either way.
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "user",
+      title: null,
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+      conversationMetadata: { source: "notification" },
+    });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+    );
+
+    expect(result.conversationId).toBe("conv-producer");
+    expect(createConversationMock).not.toHaveBeenCalled();
+  });
+
+  test("passive vellum signal with a sentinel sourceContextId appends nothing", async () => {
+    // Producers pass job ids, call session ids and `access-req-*` strings
+    // here. Those resolve to no row, which matches the feed hiding the button.
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "job-1234",
+    });
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+    );
+
+    expect(result.conversationId).toBeNull();
+    expect(result.messageId).toBeNull();
+    expect(createConversationMock).not.toHaveBeenCalled();
+    expect(addMessageMock).not.toHaveBeenCalled();
+  });
+
+  test("passive vellum signal appends to the producer, not the reuse_existing target", async () => {
+    mockExistingConversations["conv-producer"] = {
+      id: "conv-producer",
+      source: "schedule",
+      title: null,
+    };
+    mockExistingConversations["conv-hinted"] = {
+      id: "conv-hinted",
+      source: "notification",
+      title: null,
+    };
+    const signal = makeSignal({
+      requiresConversation: undefined,
+      sourceContextId: "conv-producer",
+    });
+    const conversationAction: ConversationAction = {
+      action: "reuse_existing",
+      conversationId: "conv-hinted",
+    };
+
+    const result = await pairDeliveryWithConversation(
+      signal,
+      "vellum" as NotificationChannel,
+      makeCopy(),
+      { conversationAction },
+    );
+
+    expect(result.conversationId).toBe("conv-producer");
+    expect(addMessageMock).toHaveBeenCalledTimes(1);
+    expect(addMessageMock.mock.calls[0]![0]).toBe("conv-producer");
+  });
+
   // ── conversationMetadata.conversationType override ─────────────────
 
   test("uses conversationMetadata.conversationType when set, overriding channel strategy", async () => {

package/src/__tests__/conversation-runtime-assembly.test.ts

@@ -1496,6 +1496,17 @@ describe("stripInjectionsForCompaction memory/info wrapper matching", () => {
 // applyRuntimeInjections with nowScratchpad
 // ---------------------------------------------------------------------------
 
+/**
+ * Personal-memory content (NOW.md, PKB, v3 cards) is gated on the actor's
+ * trust class, so suites asserting that content have to name the actor they
+ * are about. Left unset, the injector substitutes the low-trust fallback and
+ * the assertion silently becomes a test of the gate instead of the content.
+ */
+const GUARDIAN_TRUST_FIXTURE = {
+  trustClass: "guardian",
+  sourceChannel: "vellum",
+} as const;
+
 describe("applyRuntimeInjections with nowScratchpad", () => {
   const baseMessages: Message[] = [
     {
@@ -1513,6 +1524,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
     seedNowScratchpad("Current focus: fix the bug");
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
     });
 
     expect(result.length).toBe(1);
@@ -1527,6 +1539,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
     seedNowScratchpad("scratchpad notes");
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
     });
 
     // Scratchpad comes first (before user content)
@@ -1542,6 +1555,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
   test("does not inject when the NOW.md file is absent", async () => {
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
     });
 
     expect(result.length).toBe(1);
@@ -1552,6 +1566,7 @@ describe("applyRuntimeInjections with nowScratchpad", () => {
     seedNowScratchpad("Current focus: fix the bug");
     const { messages: result } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "minimal",
     });
 
@@ -2873,6 +2888,7 @@ describe("applyRuntimeInjections — PKB relevance hints", () => {
   function makePkbOptions(overrides: Record<string, unknown> = {}) {
     return {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       ...overrides,
     };
   }
@@ -3159,7 +3175,7 @@ describe("applyRuntimeInjections — PKB relevance hints", () => {
     // filtered out.
     const { messages: initialResult } = await applyRuntimeInjections(
       preCompactionMessages,
-      { conversationId: FALLBACK_CONVERSATION_ID },
+      makePkbOptions(),
     );
     // Unwrap the injected reminder from the last user message.
     const initialTexts = extractTexts(initialResult);
@@ -3193,7 +3209,7 @@ describe("applyRuntimeInjections — PKB relevance hints", () => {
     // should be filtered, and beta (no longer "in context") should appear.
     const { messages: rebuiltResult } = await applyRuntimeInjections(
       postCompactionMessages,
-      { conversationId: FALLBACK_CONVERSATION_ID },
+      makePkbOptions(),
     );
     const rebuiltTexts = extractTexts(rebuiltResult);
     const rebuiltReminder = rebuiltTexts.find(
@@ -6652,6 +6668,7 @@ describe("applyRuntimeInjections blocks.pkbSystemReminder", () => {
     pkbSearchThrows = null;
     const { blocks } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "full",
     });
 
@@ -6663,6 +6680,7 @@ describe("applyRuntimeInjections blocks.pkbSystemReminder", () => {
     seedPkbContent();
     const { blocks } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "minimal",
     });
 
@@ -6672,6 +6690,7 @@ describe("applyRuntimeInjections blocks.pkbSystemReminder", () => {
   test("not captured when PKB inactive", async () => {
     const { blocks } = await applyRuntimeInjections(baseMessages, {
       conversationId: FALLBACK_CONVERSATION_ID,
+      trust: GUARDIAN_TRUST_FIXTURE,
       mode: "full",
     });
 

package/src/__tests__/notification-vellum-adapter.test.ts

@@ -1,4 +1,28 @@
-import { describe, expect, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Mocks: declared before imports that depend on them ──────────────
+
+let updateMessageContentShouldThrow = false;
+
+const updateMessageContentMock = mock(
+  (_messageId: string, _content: string) => {
+    if (updateMessageContentShouldThrow) {
+      throw new Error("DB write failed");
+    }
+  },
+);
+
+mock.module("../persistence/conversation-crud.js", () => ({
+  updateMessageContent: updateMessageContentMock,
+}));
+
+const messagesInvalidated: string[] = [];
+
+mock.module("../runtime/sync/resource-sync-events.js", () => ({
+  publishConversationMessagesChanged: (conversationId: string) => {
+    messagesInvalidated.push(conversationId);
+  },
+}));
 
 import type { AssistantEvent } from "../api/index.js";
 import { VellumAdapter } from "../notifications/adapters/macos.js";
@@ -156,3 +180,102 @@ describe("VellumAdapter remotePushDispatched pass-through", () => {
     expect(intent.remotePushDispatched).toBeUndefined();
   });
 });
+
+describe("VellumAdapter update", () => {
+  beforeEach(() => {
+    updateMessageContentMock.mockClear();
+    updateMessageContentShouldThrow = false;
+    messagesInvalidated.length = 0;
+  });
+
+  test("rewrites the persisted conversation message with the new body", async () => {
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      {
+        deliveryId: "delivery-1",
+        destination: "vellum",
+        messageId: "msg-1",
+        conversationId: "conv-1",
+      },
+      { title: "Daily Briefing", body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(true);
+    expect(result.messageId).toBe("msg-1");
+    expect(updateMessageContentMock).toHaveBeenCalledTimes(1);
+    expect(updateMessageContentMock.mock.calls[0]).toEqual([
+      "msg-1",
+      "Revised briefing text.",
+    ]);
+    // A client holding the conversation open refetches on this tag alone.
+    expect(messagesInvalidated).toEqual(["conv-1"]);
+  });
+
+  test("rewrites without a conversation to invalidate", async () => {
+    // Deliveries recorded before the pairing carried a conversation have none
+    // to name, and the rewrite still stands on its own.
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(true);
+    expect(updateMessageContentMock).toHaveBeenCalledTimes(1);
+    expect(messagesInvalidated).toHaveLength(0);
+  });
+
+  test("leaves the message untouched on a title-only edit", async () => {
+    // The feed rewrites its summary only when the patch carries a body, so
+    // writing the title here would put the conversation out of step with the
+    // card it is supposed to match.
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { title: "Daily Briefing" },
+    );
+
+    expect(result.success).toBe(true);
+    expect(updateMessageContentMock).not.toHaveBeenCalled();
+  });
+
+  test("writes an empty body through, matching the feed summary patch", async () => {
+    const { adapter } = captureBroadcast();
+
+    await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { title: "Daily Briefing", body: "" },
+    );
+
+    expect(updateMessageContentMock.mock.calls[0]![1]).toBe("");
+  });
+
+  test("skips deliveries that persisted no conversation message", async () => {
+    const { adapter } = captureBroadcast();
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: null },
+      { body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("missing_message_id");
+    expect(updateMessageContentMock).not.toHaveBeenCalled();
+  });
+
+  test("reports failure without throwing when the write fails", async () => {
+    const { adapter } = captureBroadcast();
+    updateMessageContentShouldThrow = true;
+
+    const result = await adapter.update!(
+      { deliveryId: "delivery-1", destination: "vellum", messageId: "msg-1" },
+      { body: "Revised briefing text." },
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.error).toBe("DB write failed");
+  });
+});

package/src/__tests__/personal-memory-auth-bypass.test.ts

@@ -14,7 +14,10 @@
  */
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-import { isPersonalMemoryAllowed } from "../daemon/trust-context.js";
+import {
+  FALLBACK_TURN_TRUST,
+  isPersonalMemoryAllowed,
+} from "../daemon/trust-context.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 
@@ -45,16 +48,29 @@ describe("isPersonalMemoryAllowed — no exposure to non-guardian channel actors
     expect(isPersonalMemoryAllowed(slack("unverified_contact"))).toBe(false);
   });
 
-  test("allows personal memory for the guardian and for local / internal turns", () => {
+  test("allows personal memory for the guardian and for local / native turns", () => {
     expect(isPersonalMemoryAllowed(slack("guardian"))).toBe(true);
-    // Local/native turn — no resolved actor.
+    // Local/native turn: no actor bound at all. `resolveTrustClass` elevates
+    // this to guardian under a disabled-auth posture, so identity resolution
+    // admits it rather than the memory gate carving out an exception.
     expect(isPersonalMemoryAllowed(undefined)).toBe(true);
-    // Internal vellum-channel flow.
+  });
+
+  test("blocks personal memory for the fail-closed fallback trust", () => {
+    // `{vellum, unknown}` is FALLBACK_TURN_TRUST, not an internal flow: it is
+    // what the daemon substitutes when no per-turn actor was captured. Its own
+    // contract is to bias to `unknown` "so a missing snapshot cannot
+    // accidentally grant elevated trust", and every other consumer treats it
+    // as low-trust and never guardian. Personal memory is elevated trust, so
+    // the gate has to agree with them.
+    expect(isPersonalMemoryAllowed(FALLBACK_TURN_TRUST)).toBe(false);
+    // And a resolved non-guardian is denied on the console for the same
+    // reason: a surface is not an actor.
     expect(
       isPersonalMemoryAllowed({
         sourceChannel: "vellum",
-        trustClass: "unknown",
+        trustClass: "unverified_contact",
       }),
-    ).toBe(true);
+    ).toBe(false);
   });
 });

package/src/daemon/conversation.ts

@@ -1119,11 +1119,10 @@ export class Conversation {
       preStrippedCount = boundary === -1 ? slicedDbMessages.length : boundary;
     }
 
-    // The injection-time personal-memory gate, so background/local
-    // conversations (sourceChannel `undefined` or `"vellum"`) can rehydrate
-    // the persisted v2 static memory block. The shared helper folds in the
-    // HTTP-auth-disabled dev bypass so rehydration and injection agree on the
-    // effective trust class.
+    // The injection-time personal-memory gate, so rehydration of the persisted
+    // blocks admits exactly the actors injection would. The shared helper folds
+    // in the HTTP-auth-disabled dev bypass, so a turn with no bound actor
+    // resolves the same way on both paths.
     const personalMemoryAllowed = isPersonalMemoryAllowed(this.trustContext);
     // Pruned v3 card slugs, read lazily on the first row that carries a v3
     // block (most conversations carry none, so most loads never query). The
@@ -1513,11 +1512,12 @@ export class Conversation {
 
   async ensureActorScopedHistory(): Promise<void> {
     const currentTrustClass = this.trustContext?.trustClass;
-    // `loadFromDb` gates personal-memory rehydration on `sourceChannel` too
-    // (via `isPersonalMemoryAllowed`), so a same-trust-class reuse from a
-    // different channel (e.g. internal `vellum` → remote channel) must also
-    // trigger a reload. Otherwise stale personal-memory blocks can leak to
-    // an untrusted remote turn, or be hidden when they should be present.
+    // Tracked alongside the trust class because `loadFromDb` gates
+    // personal-memory rehydration on `isPersonalMemoryAllowed`, which folds in
+    // the disabled-auth elevation of an unbound actor: two contexts can share a
+    // trust class and still differ here. A reuse that changes the answer has to
+    // reload, or stale personal-memory blocks persist into a turn that must not
+    // see them, or stay stripped from one that should.
     const currentPersonalMemoryAllowed = isPersonalMemoryAllowed(
       this.trustContext,
     );