@vellumai/assistant 0.11.8 → 0.11.9-staging.1

package/src/daemon/conversation-messaging.ts

@@ -15,7 +15,6 @@ import {
   type MessageAttachmentInput,
 } from "../agent/attachments.js";
 import { optimizeImageForTransport } from "../agent/image-optimize.js";
-import { createUserMessage } from "../agent/message-types.js";
 import type { AssistantEvent } from "../api/index.js";
 import type {
   TurnChannelContext,
@@ -27,6 +26,10 @@ import {
   parseInterfaceId,
 } from "../channels/types.js";
 import { parseImageDimensions } from "../context/image-dimensions.js";
+import {
+  type ProviderMessageMetadata,
+  providerMessageMetadataSchema,
+} from "../messaging/provider-message-metadata.js";
 import {
   buildSlackTimezoneMetadata,
   type SlackMessageMetadata,
@@ -68,11 +71,16 @@ import {
 } from "../providers/types.js";
 import type { AuthContext } from "../runtime/auth/types.js";
 import { getLogger } from "../util/logger.js";
-import { withSqliteRetry } from "../util/sqlite-retry.js";
 import type { MessageQueue } from "./conversation-queue-manager.js";
 import type { SlackInboundMessageMetadata } from "./handlers/shared.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
 import type { ConversationTransportMetadata } from "./message-types/conversations.js";
+import {
+  assembleUserContentBlocks,
+  offloadLinkPlan,
+  offloadOversizedText,
+  type PortOversizedContext,
+} from "./port-oversized-content.js";
 import type { TrustContext } from "./trust-context-types.js";
 import { restingTrust } from "./trust-context-types.js";
 import { postUnsendableImageNotice } from "./unsendable-image-notice.js";
@@ -217,6 +225,8 @@ export interface MessagingConversationContext {
   messages: Message[];
   isProcessing(): boolean;
   setProcessing(value: boolean): void;
+  acquireProcessingFenced(): Promise<number | null>;
+  releaseProcessing(owner: number): boolean;
   abortController: AbortController | null;
   currentRequestId?: string;
   readonly queue: MessageQueue;
@@ -267,11 +277,8 @@ export async function serializePersistedUserMessageContent(
   displayContent: string | undefined,
   attachments: MessageAttachmentInput[],
 ): Promise<string> {
-  return serializeUserContentBlocks(
-    content,
-    displayContent,
-    await attachmentsToContentBlocks(attachments),
-  );
+  const attachmentBlocks = await attachmentsToContentBlocks(attachments);
+  return serializeUserContentBlocks(content, displayContent, attachmentBlocks);
 }
 
 /**
@@ -501,17 +508,19 @@ async function prepareUserAttachmentReferences(
  * backstop, and swallowed on failure: cleaning up must never mask the error
  * that caused it.
  */
-function discardAttemptAttachments(attachmentIds: string[]): void {
+function discardAttemptAttachments(attachmentIds: string[]): string[] {
   if (attachmentIds.length === 0) {
-    return;
+    return [];
   }
   try {
     deleteOrphanAttachments(attachmentIds);
+    return [];
   } catch (err) {
     log.warn(
       { err, attachmentIds },
       "Could not discard the attachments of a failed persist attempt",
     );
+    return attachmentIds;
   }
 }
 
@@ -748,6 +757,37 @@ export function buildSlackMetaForPersistence(params: {
   return writeSlackMetadata(slackMeta);
 }
 
+/**
+ * Build the neutral channel envelope persisted under the `providerMeta` key
+ * on a user message's `metadata` JSON, the non-Slack counterpart of
+ * {@link buildSlackMetaForPersistence}. Returns `null` (do not include the
+ * key) when the turn channel does not match the envelope's own `source`, so
+ * a stale plumbing field can never tag a row with another channel's
+ * identity. Slack turns also return `null`: Slack still writes `slackMeta`,
+ * which `readProviderMetadata` maps onto the neutral shape on read, and a
+ * `providerMeta` key on a Slack row would shadow that richer envelope.
+ *
+ * TRANSITIONAL: the Slack exclusion exists only while Slack writes its own
+ * envelope; do not extend it.
+ */
+export function buildProviderMetaForPersistence(params: {
+  channelInbound: ProviderMessageMetadata | undefined;
+  turnChannel: string | undefined;
+}): string | null {
+  const inbound = params.channelInbound;
+  if (!inbound) {
+    return null;
+  }
+  if (params.turnChannel !== inbound.source || inbound.source === "slack") {
+    return null;
+  }
+  const parsed = providerMessageMetadataSchema.safeParse(inbound);
+  if (!parsed.success) {
+    return null;
+  }
+  return JSON.stringify(parsed.data);
+}
+
 // ── EnqueueMessageOptions ────────────────────────────────────────────
 
 /** Options for `enqueueMessage`. Only `content` is required; everything
@@ -961,6 +1001,30 @@ export interface PersistMessageOptions {
    * exactly the one retention has to be able to stub.
    */
   sightFrameAttachmentIds?: readonly string[];
+  /**
+   * Answered synchronously at the top of every insert attempt, immediately
+   * before that attempt's statement. False aborts the persist with a
+   * `MessageInsertPreconditionError` and inserts nothing.
+   *
+   * For a caller whose right to write can lapse while this persist runs.
+   * Everything ahead of the insert (attachment materialization, content
+   * building) is awaited, and the insert retries itself on contention across
+   * an awaited backoff, so a caller that answered before calling has only
+   * answered for the moment it called. Threaded down to the insert rather
+   * than checked here, so each attempt asks for itself.
+   */
+  insertPrecondition?: () => boolean;
+  /**
+   * Told the ids this attempt materialized for itself and then could not
+   * delete, so a caller that owns the cleanup can come back to them.
+   *
+   * An attachment already linked to another conversation is CLONED into this
+   * one under a fresh id, and only this function knows that id. A caller
+   * retrying the delete under the id it handed in would reclaim nothing: that
+   * row is still linked where it came from, and the clone nobody names
+   * survives every pass.
+   */
+  onUndiscardedAttachments?: (attachmentIds: readonly string[]) => void;
 }
 
 // ── persistUserMessage ───────────────────────────────────────────────
@@ -1002,38 +1066,46 @@ export async function persistUserMessage(
   ctx.currentRequestId = reqId;
   ctx.abortController = new AbortController();
 
+  let owner: number | null = null;
   try {
-    // `setProcessing(true)` persists the flag and can throw (e.g.
-    // SQLITE_BUSY). Keeping it inside the try ensures a failure here unwinds
-    // the request-id/abort bookkeeping below rather than stranding it.
-    //
-    // This is the first DB write on the message-send path — it precedes the
-    // (already retried) message insert — so under transient WAL contention it
-    // must retry too, or the turn dies here before the insert is ever reached.
-    // `setProcessing` reverts its in-memory flag when its persist throws, so
-    // each attempt is safe to re-run.
-    await withSqliteRetry(() => ctx.setProcessing(true), {
-      op: "conversation:setProcessing",
-      context: { conversationId: ctx.conversationId },
-    });
+    // Taking the flag rather than setting it: the read and the take are one
+    // step, so nothing can claim it in between, and the hold is released only
+    // by the claim that took it. Its advisory mirror write is detached, which
+    // is what closes the window a retry around a strict set used to open. That
+    // retry re-ran the set after an awaited backoff, and the set reverted the
+    // in-memory flag before rethrowing, so the conversation read idle for the
+    // length of the sleep and anything waiting for idle could take the flag
+    // while this turn was still starting.
+    // Fenced: the flag is taken and its marker is durable before anything
+    // this turn writes, because a reconnecting client and the out-of-process
+    // retrospective worker read that marker to decide a turn is live. Null is
+    // a conversation that belongs to someone else, whether it was already held
+    // or was claimed away while the marker landed. A throw is the marker
+    // refusing to persist, with the claim already given back.
+    owner = await ctx.acquireProcessingFenced();
+    if (owner === null) {
+      throw new Error(CONVERSATION_BUSY_MESSAGE);
+    }
     const result = await persistQueuedMessageBody(ctx, {
       ...options,
       attachments,
       requestId: reqId,
     });
     if (result.deduplicated) {
-      ctx.setProcessing(false);
+      ctx.releaseProcessing(owner);
       ctx.abortController = null;
       ctx.currentRequestId = undefined;
     }
     return result;
   } catch (err) {
-    // Clear the flag, but never let a clear failure mask the original error
-    // or skip the bookkeeping reset. `setProcessing(false)` releases in memory
-    // regardless of its advisory mirror write, so the guard here is purely
-    // defensive against future changes.
+    // Release this turn's own hold, but never let a failure there mask the
+    // original error or skip the bookkeeping reset. A hold another caller
+    // claimed since is left alone, and one this call never took is nothing to
+    // release.
     try {
-      ctx.setProcessing(false);
+      if (owner !== null) {
+        ctx.releaseProcessing(owner);
+      }
     } catch (clearErr) {
       log.error(
         { err: clearErr, conversationId: ctx.conversationId },
@@ -1088,6 +1160,7 @@ export async function persistQueuedMessageBody(
   // exactly the shape a link-aware delete reads as collectible, so the cleanup
   // must stop at the insert.
   let preparedAttachments: PreparedUserAttachment[] = [];
+  let portedAttachmentIds: string[] = [];
   let messageInserted = false;
 
   try {
@@ -1119,11 +1192,13 @@ export async function persistQueuedMessageBody(
     // never reported.
     const {
       slackInbound: rawSlackInbound,
+      channelInbound: rawChannelInbound,
       scripted: rawScriptedFromMetadata,
       clientOsFromRequest: _rawClientOsFromRequest,
       ...metadataWithoutSlackInbound
     } = (metadata ?? {}) as Record<string, unknown> & {
       slackInbound?: SlackInboundMessageMetadata;
+      channelInbound?: ProviderMessageMetadata;
       scripted?: unknown;
       clientOsFromRequest?: unknown;
     };
@@ -1131,6 +1206,10 @@ export async function persistQueuedMessageBody(
       slackInbound: rawSlackInbound,
       turnChannel: turnCtx?.userMessageChannel,
     });
+    const providerMeta = buildProviderMetaForPersistence({
+      channelInbound: rawChannelInbound,
+      turnChannel: turnCtx?.userMessageChannel,
+    });
 
     // See the `scripted` note on the merged metadata below. Only a real
     // boolean in the bag counts: a stray truthy string must not be read as a
@@ -1210,6 +1289,7 @@ export async function persistQueuedMessageBody(
       ...(clientOsFromRequest ? { clientOsFromRequest: true } : {}),
       ...(imageSourcePaths ? { imageSourcePaths } : {}),
       ...(slackMeta ? { slackMeta } : {}),
+      ...(providerMeta ? { providerMeta } : {}),
       // Scripted-turn marker, forwarded by `turn-events-store` onto
       // `TurnTelemetryEvent.scripted`. Written LAST so it cannot be
       // half-overwritten by the raw metadata spread above.
@@ -1259,22 +1339,42 @@ export async function persistQueuedMessageBody(
       preparedAttachments,
     );
     const sightFrameRenames = sightFrameBlockRenames(sightFrameEntries);
-    // The blocks are built from the ids the caller held, so a cloned frame is
-    // pointed at its stored row before the message reaches the live history.
+
+    const portCtx: PortOversizedContext = {
+      conversationId: ctx.conversationId,
+      conversationCreatedAt,
+    };
+    const persistText = displayContent !== undefined ? displayContent : content;
+    const persistOffload = await offloadOversizedText(persistText, portCtx);
+    const liveOffload =
+      persistText === content
+        ? persistOffload
+        : await offloadOversizedText(content, portCtx);
+    const attachmentBlocks = preparedAttachments.map((p) => p.block);
+    const persistBlocks = assembleUserContentBlocks(
+      persistOffload.text,
+      attachmentBlocks,
+      persistOffload.fileBlock,
+    );
+    const liveBlocks = assembleUserContentBlocks(
+      liveOffload.text,
+      attachmentBlocks,
+      liveOffload.fileBlock,
+    );
+    const offloadPlan = offloadLinkPlan(
+      persistOffload.attachmentId,
+      liveOffload.attachmentId,
+    );
+    portedAttachmentIds = offloadPlan.linkIds;
+
+    // Workspace-ref blocks (including offloaded oversized text) so the live
+    // turn matches persist: video and huge strings stay off the prompt.
     const cleanMessage = restampInlineAttachmentIds(
-      await createUserMessage(content, sentAttachments),
+      { role: "user", content: liveBlocks },
       sightFrameRenames,
     );
 
-    // When displayContent is provided (e.g. original text before recording
-    // intent stripping), persist that to DB so users see the full message
-    // after restart. The in-memory userMessage (sent to the LLM) still uses
-    // the stripped content.
-    const contentToPersist = serializeUserContentBlocks(
-      content,
-      displayContent,
-      preparedAttachments.map((p) => p.block),
-    );
+    const contentToPersist = JSON.stringify(persistBlocks);
     // Composed here rather than with the rest of the metadata above, because
     // materialization is what decides the id each frame is stored under.
     const sightFrameIds = sightFrameTagIds(sightFrameEntries);
@@ -1292,11 +1392,17 @@ export async function persistQueuedMessageBody(
         clientMessageId,
         id: requestId,
         ...(skipIndexing ? { skipIndexing: true } : {}),
+        // Handed down rather than answered here: the insert retries itself on
+        // contention, so the question belongs where each attempt can ask it.
+        ...(options.insertPrecondition
+          ? { insertPrecondition: options.insertPrecondition }
+          : {}),
       },
     );
     messageInserted = true;
 
     if (persistedUserMessage.deduplicated) {
+      discardAttemptAttachments(portedAttachmentIds);
       return { id: persistedUserMessage.id, deduplicated: true };
     }
 
@@ -1371,14 +1477,52 @@ export async function persistQueuedMessageBody(
     if (repairedBlocks) {
       updateMessageContent(
         persistedUserMessage.id,
-        serializeUserContentBlocks(content, displayContent, repairedBlocks),
+        JSON.stringify(
+          assembleUserContentBlocks(
+            persistOffload.text,
+            repairedBlocks,
+            persistOffload.fileBlock,
+          ),
+        ),
       );
     }
 
-    // Persist the resolved paths so history reloads can rebuild the same
-    // annotation block the in-memory message carries below.
+    let nextPortPosition =
+      preparedAttachments.reduce((max, p) => Math.max(max, p.position), -1) + 1;
+    for (const attachmentId of portedAttachmentIds) {
+      try {
+        const scopedId = linkAttachmentToMessage(
+          persistedUserMessage.id,
+          attachmentId,
+          nextPortPosition,
+        );
+        nextPortPosition += 1;
+        const storedPath = getFilePathForAttachment(scopedId) ?? undefined;
+        // Display-only offloads stay linked (GC + persisted workspace_ref)
+        // but must not be named on the model-facing list.
+        if (
+          offloadPlan.modelFacingIds.has(attachmentId) &&
+          liveOffload.filename
+        ) {
+          sentAttachments.push({
+            filename: liveOffload.filename,
+            mimeType: "text/plain",
+            data: "",
+            storedPath,
+          });
+        }
+      } catch (err) {
+        log.error(
+          { attachmentId, err },
+          "Failed to link offloaded oversized content attachment",
+        );
+      }
+    }
+
+    // Same list enrichMessageWithSourcePaths sees, so history reload rebuilds
+    // an identical annotation block (prefix-cache parity).
     const attachmentStoredPaths =
-      extractAttachmentStoredPaths(attachmentInputs);
+      extractAttachmentStoredPaths(sentAttachments);
     if (attachmentStoredPaths) {
       updateMessageMetadata(persistedUserMessage.id, { attachmentStoredPaths });
     }
@@ -1428,9 +1572,13 @@ export async function persistQueuedMessageBody(
       ctx.messages.pop();
     }
     if (!messageInserted) {
-      discardAttemptAttachments(
-        attemptCreatedAttachmentIds(attachmentInputs, preparedAttachments),
-      );
+      const undiscarded = discardAttemptAttachments([
+        ...attemptCreatedAttachmentIds(attachmentInputs, preparedAttachments),
+        ...portedAttachmentIds,
+      ]);
+      if (undiscarded.length > 0) {
+        options.onUndiscardedAttachments?.(undiscarded);
+      }
     }
     throw err;
   }

package/src/daemon/conversation-process.ts

@@ -1932,7 +1932,6 @@ export async function processMessage(
   if (trimmedContent.length > 0) {
     const routerResult = await routeGuardianReply({
       messageText: trimmedContent,
-      channel: "vellum",
       actor: {
         actorPrincipalId:
           conversation.trustContext?.guardianPrincipalId ?? undefined,
@@ -2124,7 +2123,15 @@ export async function processMessage(
 
   // /compact — force context compaction, persist exchange, return message ID.
   if (slashResult.kind === "compact") {
-    conversation.setProcessing(true);
+    // Taken rather than set: `processMessage` never checks the flag itself, so
+    // the idle decision behind this branch was made by a caller several awaits
+    // ago (history scoping, guardian routing, slash resolution all sit
+    // between). A hold taken since belongs to a real turn, and this reports
+    // busy the way that caller's own gate does rather than claiming it away.
+    const compactOwner = await conversation.acquireProcessingFenced();
+    if (compactOwner === null) {
+      throw new Error(CONVERSATION_BUSY_MESSAGE);
+    }
     let persistedCompactMessage = false;
     try {
       const pmTurnCtx = conversation.getTurnChannelContext();
@@ -2195,7 +2202,7 @@ export async function processMessage(
       }
       throw err;
     } finally {
-      conversation.setProcessing(false);
+      conversation.releaseProcessing(compactOwner);
       // `kickQueueDrain` never rejects, so a failed drain in this `finally`
       // cannot mask the error the try block is unwinding, and its retry plus
       // sender notification replace a silently stranded queue.
@@ -2205,7 +2212,15 @@ export async function processMessage(
 
   // /clean — strip runtime injections, return message ID. No LLM call.
   if (slashResult.kind === "clean") {
-    conversation.setProcessing(true);
+    // Taken rather than set: `processMessage` never checks the flag itself, so
+    // the idle decision behind this branch was made by a caller several awaits
+    // ago (history scoping, guardian routing, slash resolution all sit
+    // between). A hold taken since belongs to a real turn, and this reports
+    // busy the way that caller's own gate does rather than claiming it away.
+    const cleanOwner = await conversation.acquireProcessingFenced();
+    if (cleanOwner === null) {
+      throw new Error(CONVERSATION_BUSY_MESSAGE);
+    }
     let persistedCleanMessage = false;
     try {
       const pmTurnCtx = conversation.getTurnChannelContext();
@@ -2272,7 +2287,7 @@ export async function processMessage(
       }
       throw err;
     } finally {
-      conversation.setProcessing(false);
+      conversation.releaseProcessing(cleanOwner);
       // Same never-rejecting drain as the `/compact` branch above.
       await kickQueueDrain(conversation, "loop_complete", "clean_command");
     }

package/src/daemon/conversation-runtime-assembly.ts

@@ -27,15 +27,13 @@ import {
   quarantineRefusedExchanges,
 } from "../context/refusal-quarantine.js";
 import {
+  MEMORY_SPOTLIGHT_MATCHER,
   NOW_SCRATCHPAD_STRIP_PREFIXES,
-  stripSpotlightInjections,
+  stripTailUserTextBlocksByPrefix,
   stripUserTextBlocksByPrefix,
 } from "../context/strip-injections.js";
 import { getDocumentsForConversation } from "../documents/document-store.js";
-import {
-  readSlackMetadata,
-  readSlackMetadataFromMessageMetadata,
-} from "../messaging/providers/slack/message-metadata.js";
+import { readSlackMetadataFromMessageMetadata } from "../messaging/providers/slack/message-metadata.js";
 import {
   compareSlackTs,
   extractTagLineTexts,
@@ -64,6 +62,7 @@ import {
 import {
   MEMORY_V3_BLOCK_ID,
   MEMORY_V3_COMMIT_META_KEY,
+  MEMORY_V3_SPOTLIGHT_BLOCK_ID,
 } from "../plugins/defaults/memory/v3/types.js";
 import { getRegisteredInjectors } from "../plugins/injector-registry.js";
 import type {
@@ -74,9 +73,11 @@ import type {
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { TrustClass } from "../runtime/actor-trust-resolver.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
+import { trustClassSchema } from "../runtime/trust-class.js";
 import type { SubagentState } from "../subagent/types.js";
 import { TERMINAL_STATUSES } from "../subagent/types.js";
 import { canonicalizeInboundIdentity } from "../util/canonicalize-identity.js";
+import { safeParseRecord } from "../util/json.js";
 import { getLogger } from "../util/logger.js";
 import { channelSupportsInlineOptions } from "./channel-ui-capability.js";
 import { findConversationOrSubagent } from "./conversation-registry.js";
@@ -821,7 +822,8 @@ export function buildChannelCapabilityBlock(
     caps.supportsVoiceInput &&
     !isGroupChatType(caps.chatType) &&
     clientOs !== "macos" &&
-    clientOs !== "windows"
+    clientOs !== "windows" &&
+    clientOs !== "linux"
   ) {
     return null;
   }
@@ -849,6 +851,13 @@ export function buildChannelCapabilityBlock(
     );
   }
 
+  if (clientOs === "linux") {
+    lines.push("");
+    lines.push(
+      "On Linux, prefer CLI via `host_bash` over computer use tools, which take over the user's cursor. Use foreground computer use only when no scripting alternative exists or the user explicitly asks.",
+    );
+  }
+
   if (!caps.dashboardCapable) {
     lines.push("");
     lines.push("CHANNEL CONSTRAINTS:");
@@ -1152,29 +1161,12 @@ function placeholderForBlockType(type: ContentBlock["type"]): string | null {
  *   renderer drops the redundant `@user` placeholder.
  */
 function rowToRenderable(row: SlackTranscriptInputRow): RenderableSlackMessage {
-  let slackMeta: ReturnType<typeof readSlackMetadata> = null;
-  let provenanceTrustClass: TrustClass | undefined;
-  if (row.metadata) {
-    try {
-      const outer = JSON.parse(row.metadata) as {
-        slackMeta?: unknown;
-        provenanceTrustClass?: unknown;
-      };
-      if (typeof outer.slackMeta === "string") {
-        slackMeta = readSlackMetadata(outer.slackMeta);
-      }
-      if (
-        outer.provenanceTrustClass === "guardian" ||
-        outer.provenanceTrustClass === "trusted_contact" ||
-        outer.provenanceTrustClass === "unverified_contact" ||
-        outer.provenanceTrustClass === "unknown"
-      ) {
-        provenanceTrustClass = outer.provenanceTrustClass;
-      }
-    } catch {
-      // Malformed metadata — fall through to legacy/null treatment.
-    }
-  }
+  const slackMeta = readSlackMetadataFromMessageMetadata(row.metadata);
+  const provenanceTrustClass = row.metadata
+    ? trustClassSchema.safeParse(
+        safeParseRecord(row.metadata).provenanceTrustClass,
+      ).data
+    : undefined;
 
   const isReaction = slackMeta?.eventKind === "reaction";
   let senderLabel: string | null;
@@ -1876,6 +1868,13 @@ export interface RuntimeInjectionBlocks {
    * (`MEMORY_V3_INJECTED_BLOCK_METADATA_KEY`).
    */
   memoryV3InjectedBlock?: string;
+  /**
+   * Rendered `<memory_spotlight>` body spliced onto this turn's user
+   * message. Persisted by the user-prompt-submit hook under
+   * `metadata.memoryV3SpotlightBlock`. Historical turns keep the block they
+   * were sent with; a new spotlight is added only on the new tail.
+   */
+  memoryV3SpotlightBlock?: string;
   /**
    * True when memory-v3 superseded v2 as this turn's `<memory>` source —
    * `memory.v3.live` is on AND the v3 injector produced a block (possibly
@@ -2065,6 +2064,7 @@ function applyInjectionBlock(
       ];
     }
   }
+  return runMessages;
 }
 
 /**
@@ -2297,7 +2297,7 @@ function fallbackTurnTrust(
  *     the user tail content.
  *
  * Returns the final message array plus a `blocks` object holding the exact
- * injected text for each captured block — callers persist those bytes to
+ * injected text for each captured block. Callers persist those bytes to
  * message metadata for later byte-exact rehydration.
  */
 export async function applyRuntimeInjections(
@@ -2511,6 +2511,7 @@ export async function applyRuntimeInjections(
   let pkbSystemReminderCaptured: string | undefined;
   let memoryV2StaticCaptured: string | undefined;
   let memoryV3Captured: string | undefined;
+  let memoryV3SpotlightCaptured: string | undefined;
   let backgroundTurnCaptured: string | undefined;
   let channelCapabilitiesCaptured: string | undefined;
   let nonInteractiveContextCaptured: string | undefined;
@@ -2560,6 +2561,11 @@ export async function applyRuntimeInjections(
           }
           break;
         }
+        case MEMORY_V3_SPOTLIGHT_BLOCK_ID:
+          if (block.text.length > 0) {
+            memoryV3SpotlightCaptured = block.text;
+          }
+          break;
       }
     }
   }
@@ -2578,16 +2584,18 @@ export async function applyRuntimeInjections(
       ? injectorChainPieces.join("\n\n")
       : undefined;
 
-  // ── Step 0: memory-v3 ephemeral-spotlight strip + v2 tail suppression ──
+  // ── Step 0: tail spotlight strip + v2 tail suppression ──
   //
-  // Spotlight strip (unconditional): the `<memory_spotlight>` block is
-  // ephemeral by contract — re-rendered at the current tail each turn — so any
-  // spotlight riding history from a previous turn is stale and is removed
-  // here. This is a SCOPED strip of only that block id: the frozen `<memory>`
-  // card blocks on historical messages are untouched (the cache contract).
-  // With the v3 flag off no spotlight blocks exist and this is a content
-  // no-op, keeping the v2 path bit-for-bit identical.
-  let runMessagesForAssembly = stripSpotlightInjections(runMessages);
+  // Spotlight strip (tail only): mid-turn re-entry and post-compact can
+  // hand back a tail that already carries this turn's `<memory_spotlight>`.
+  // Strip that leftover from the tail so Step 2 splices a single fresh
+  // copy. Historical user messages keep the spotlight they were sent with,
+  // so the provider prefix through those messages stays byte-identical.
+  // Frozen `<memory>` card blocks are untouched. With the v3 flag off no
+  // spotlight blocks exist and this is a content no-op.
+  let runMessagesForAssembly = stripTailUserTextBlocksByPrefix(runMessages, [
+    MEMORY_SPOTLIGHT_MATCHER,
+  ]);
 
   // v2 suppression: when `memory.v3.live` is on AND the v3 injector
   // produced a block this turn (possibly empty-text on an all-repeat turn), v3
@@ -2794,6 +2802,7 @@ export async function applyRuntimeInjections(
       pkbContextBlock: pkbContextCaptured,
       memoryV2StaticBlock: memoryV2StaticCaptured,
       memoryV3InjectedBlock: memoryV3Captured,
+      memoryV3SpotlightBlock: memoryV3SpotlightCaptured,
       backgroundTurnBlock: backgroundTurnCaptured,
       channelCapabilitiesBlock: channelCapabilitiesCaptured,
       nonInteractiveContextBlock: nonInteractiveContextCaptured,