@vellumai/assistant 0.8.0 → 0.8.1

package/src/daemon/approval-generators.ts

@@ -1,6 +1,6 @@
 import { loadConfig } from "../config/loader.js";
-import { CallSiteRoutingProvider } from "../providers/call-site-routing.js";
-import { getProvider, listProviders } from "../providers/registry.js";
+import { wrapWithCallSiteRouting } from "../providers/call-site-routing.js";
+import { resolveDefaultProvider } from "../providers/connection-resolution.js";
 import type { Provider } from "../providers/types.js";
 import {
   APPROVAL_COPY_MAX_TOKENS,
@@ -79,15 +79,18 @@ const VALID_DISPOSITIONS: ReadonlySet<string> = new Set([
 export function createApprovalCopyGenerator(): ApprovalCopyGenerator {
   return async (context, options = {}) => {
     const config = loadConfig();
-    let baseProvider: Provider;
-    try {
-      baseProvider = getProvider(config.llm.default.provider);
-    } catch {
-      return null;
-    }
+    // Connection-aware default-provider resolution. Throws
+    // `ConnectionResolutionError` on hard config errors (missing /
+    // unknown / mismatched connection). Returns null on soft credential
+    // failures (vault miss, transient auth) — we treat null as "no
+    // provider available" and skip generating copy.
+    const baseProvider: Provider | null = await resolveDefaultProvider(config);
+    if (!baseProvider) return null;
     // Wrap so per-call `callSite` can route to an alternative provider
     // transport when `llm.callSites.<id>.provider` overrides the default.
-    const provider = wrapWithCallSiteRouting(baseProvider);
+    // The `wrapWithCallSiteRouting` helper threads `config` through so the
+    // wrapper's per-call resolution is also connection-aware.
+    const provider = wrapWithCallSiteRouting(baseProvider, config);
 
     const fallbackText =
       options.fallbackText?.trim() || getFallbackMessage(context);
@@ -136,12 +139,19 @@ export function createApprovalCopyGenerator(): ApprovalCopyGenerator {
 export function createApprovalConversationGenerator(): ApprovalConversationGenerator {
   return async (context) => {
     const config = loadConfig();
-    if (!listProviders().includes(config.llm.default.provider)) {
+    // Connection-aware default + per-call routing. `resolveDefaultProvider`
+    // throws `ConnectionResolutionError` on hard config errors (missing /
+    // unknown / mismatched connection) and returns null on soft credential
+    // failures (vault miss, transient auth) — we treat null as "no
+    // provider available" and throw a domain-specific error below. We do
+    // not pre-gate on `listProviders()` because the default provider lives
+    // behind a `provider_connection` and never appears in the registry's
+    // initialization-time provider list.
+    const baseProvider = await resolveDefaultProvider(config);
+    if (!baseProvider) {
       throw new Error("No provider available for approval conversation");
     }
-    const provider = wrapWithCallSiteRouting(
-      getProvider(config.llm.default.provider),
-    );
+    const provider = wrapWithCallSiteRouting(baseProvider, config);
 
     const pendingDescription = context.pendingApprovals
       .map((p) => `- Request ${p.requestId}: tool "${p.toolName}"`)
@@ -212,19 +222,3 @@ export function createApprovalConversationGenerator(): ApprovalConversationGener
     return result;
   };
 }
-
-/**
- * Wrap a base Provider so per-call `callSite` metadata can route the actual
- * transport to a different provider when `llm.callSites.<id>.provider`
- * differs from the default. Without this wrapper, only request metadata
- * reflects the callSite — the HTTP transport stays bound to the default.
- */
-function wrapWithCallSiteRouting(base: Provider): Provider {
-  return new CallSiteRoutingProvider(base, (name) => {
-    try {
-      return getProvider(name);
-    } catch {
-      return undefined;
-    }
-  });
-}

package/src/daemon/config-watcher.ts

@@ -18,6 +18,7 @@ import { getConfig, invalidateConfigCache } from "../config/loader.js";
 import type { MemoryCleanupConfig } from "../config/schemas/memory-lifecycle.js";
 import { resetCleanupScheduleThrottle } from "../memory/cleanup-schedule-state.js";
 import { clearEmbeddingBackendCache } from "../memory/embedding-backend.js";
+import { invalidateLlmRequestLogSourceCache } from "../memory/llm-request-log-source.js";
 import { initializeProviders } from "../providers/registry.js";
 import { handleCancelSignal } from "../signals/cancel.js";
 import { handleConversationUndoSignal } from "../signals/conversation-undo.js";
@@ -140,6 +141,7 @@ export class ConfigWatcher {
       return false;
     }
     clearEmbeddingBackendCache();
+    invalidateLlmRequestLogSourceCache();
     // If cleanup retention settings changed, reset the cleanup scheduler
     // throttle so the next worker tick re-enqueues jobs with the new values
     // instead of waiting out the remaining enqueueIntervalMs (default 6h).

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -118,6 +118,12 @@ export interface EventHandlerState {
   orderingErrorDetected: boolean;
   deferredOrderingError: string | null;
   contextTooLargeDetected: boolean;
+  /**
+   * Set when the provider rejects with an image-dimension error. The agent
+   * loop strips or downscales oversized image blocks from ctx.messages and
+   * retries once before surfacing an error to the user.
+   */
+  imageTooLargeDetected: boolean;
   /**
    * The provider error object when context_too_large is detected, preserved
    * so `parseActualTokensFromError` can prefer the typed
@@ -127,6 +133,11 @@ export interface EventHandlerState {
    */
   contextTooLargeError: unknown;
   providerErrorUserMessage: string | null;
+  /**
+   * First persisted assistant row in this run; history keeps this id when it
+   * merges tool-turn rows into one display bubble.
+   */
+  firstAssistantMessageId: string | undefined;
   lastAssistantMessageId: string | undefined;
   readonly pendingToolResults: Map<string, PendingToolResult>;
   readonly persistedToolUseIds: Set<string>;
@@ -220,8 +231,10 @@ export function createEventHandlerState(): EventHandlerState {
     orderingErrorDetected: false,
     deferredOrderingError: null,
     contextTooLargeDetected: false,
+    imageTooLargeDetected: false,
     contextTooLargeError: null,
     providerErrorUserMessage: null,
+    firstAssistantMessageId: undefined,
     lastAssistantMessageId: undefined,
     pendingToolResults: new Map(),
     persistedToolUseIds: new Set(),
@@ -245,6 +258,12 @@ export function createEventHandlerState(): EventHandlerState {
   };
 }
 
+export function getClientDisplayMessageId(
+  state: EventHandlerState,
+): string | undefined {
+  return state.firstAssistantMessageId ?? state.lastAssistantMessageId;
+}
+
 // ── Shared Helper ────────────────────────────────────────────────────
 
 // providerNameOverride should be supplied when the caller already knows the
@@ -781,6 +800,10 @@ function handleError(
     if (classified.code === "CONTEXT_TOO_LARGE") {
       state.contextTooLargeDetected = true;
       state.contextTooLargeError = event.error;
+    } else if (classified.code === "IMAGE_TOO_LARGE") {
+      // Trigger silent recovery: the agent loop will strip/downscale images
+      // in ctx.messages and retry once before surfacing an error.
+      state.imageTooLargeDetected = true;
     } else if (
       classified.code === "PROVIDER_ORDERING" ||
       classified.code === "PROVIDER_WEB_SEARCH"
@@ -1004,6 +1027,7 @@ export async function handleMessageComplete(
     DEFAULT_TIMEOUTS.persistence,
   )) as PersistAddResult;
   const assistantMsg = assistantPersistResult.message;
+  state.firstAssistantMessageId ??= assistantMsg.id;
   state.lastAssistantMessageId = assistantMsg.id;
 
   // Backfill message_id on all LLM request logs from this turn.

package/src/daemon/conversation-agent-loop.ts

@@ -11,6 +11,7 @@ import { join } from "node:path";
 
 import { v4 as uuid } from "uuid";
 
+import { optimizeImageForTransport } from "../agent/image-optimize.js";
 import type {
   AgentEvent,
   AgentLoop,
@@ -28,6 +29,7 @@ import {
   contextWindowConfigFromEffective,
   resolveEffectiveContextWindow,
 } from "../config/llm-context-resolution.js";
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { ContextWindowConfig } from "../config/types.js";
@@ -41,9 +43,7 @@ import {
 } from "../context/token-estimator.js";
 import type { ContextWindowManager } from "../context/window-manager.js";
 import type { ToolProfiler } from "../events/tool-profiling-listener.js";
-import { emitFeedEvent } from "../home/emit-feed-event.js";
 import { writeRelationshipState } from "../home/relationship-state-writer.js";
-import { rewriteFeedTitle } from "../home/rewrite-feed-title.js";
 import {
   clearSentryConversationContext,
   setSentryConversationContext,
@@ -71,11 +71,12 @@ import {
 } from "../memory/conversation-title-service.js";
 import type { ConversationGraphMemory } from "../memory/graph/conversation-graph-memory.js";
 import { recordMemoryRecallLog } from "../memory/memory-recall-log-store.js";
+import { enqueueMemoryRetrospectiveOnCompaction } from "../memory/memory-retrospective-enqueue.js";
 import { PKB_WORKSPACE_SCOPE } from "../memory/pkb/types.js";
 import type { QdrantSparseVector } from "../memory/qdrant-client.js";
 import {
   readMemoryV2StaticContent,
-  shouldLoadMemoryV2Static,
+  shouldExposePersonalMemory,
 } from "../memory/v2/static-context.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import { defaultCompactionTerminal } from "../plugins/defaults/compaction.js";
@@ -147,6 +148,7 @@ import {
   createEventHandlerState,
   dispatchAgentEvent,
   type EventHandlerDeps,
+  getClientDisplayMessageId,
 } from "./conversation-agent-loop-handlers.js";
 import {
   approveHostAttachmentRead,
@@ -679,7 +681,9 @@ export async function runAgentLoopImpl(
     overrideProfile: turnOverrideProfile ?? undefined,
   });
   const turnContextWindowConfig = contextWindowConfigFromEffective(
-    config.llm.default.contextWindow,
+    resolveCallSiteConfig(turnCallSite, config.llm, {
+      overrideProfile: turnOverrideProfile ?? undefined,
+    }).contextWindow,
     effectiveContextWindow,
   );
   (
@@ -1411,33 +1415,44 @@ export async function runAgentLoopImpl(
 
     // The `remember` tool handles scratchpad-style memory writes directly to the graph.
 
+    // Personal-memory trust gate: PKB, NOW.md, and v2 static blocks all
+    // hold private user content. Block exposure to non-guardian actors
+    // arriving over a remote channel; internal/local flows pass through.
+    // See `shouldExposePersonalMemory` for the threat model.
+    const personalMemoryAllowed = shouldExposePersonalMemory({
+      sourceChannel: ctx.trustContext?.sourceChannel,
+      isTrustedActor,
+    });
+
     // Inject NOW.md and PKB content only on the first turn (or after
     // compaction re-strips them).  Old injections persist in history and
     // are never stripped on normal turns — this preserves the cached prefix.
     // PKB/NOW content is sourced from the `memoryRetrieval` pipeline above
     // so plugins can override either source without touching the agent loop.
-    const currentNowContent = memoryResult.nowContent;
+    const currentNowContent = personalMemoryAllowed
+      ? memoryResult.nowContent
+      : null;
     const shouldInjectNowAndPkb = isFirstMessage || compactedThisTurn;
     const nowScratchpad = shouldInjectNowAndPkb ? currentNowContent : null;
 
-    const currentPkbContent = memoryResult.pkbContent;
+    const currentPkbContent = personalMemoryAllowed
+      ? memoryResult.pkbContent
+      : null;
     const pkbContext = shouldInjectNowAndPkb ? currentPkbContent : null;
     const pkbActive = currentPkbContent !== null;
 
-    // V2 static memory block (essentials/threads/recent/buffer). Same
-    // first-turn / post-compaction cadence as PKB. `shouldLoadMemoryV2Static`
-    // also blocks remote-channel non-guardian actors from inducing the
-    // model to recite private memory; `readMemoryV2StaticContent` self-gates
-    // on the v2 flag + config and returns null when v2 is off, so the file
-    // reads are skipped on non-injection turns.
-    const currentMemoryV2Static = shouldLoadMemoryV2Static({
-      shouldInjectNowAndPkb,
-      sourceChannel: ctx.trustContext?.sourceChannel,
-      isTrustedActor,
-    })
+    // V2 static memory block (essentials/threads/recent/buffer).
+    // `currentMemoryV2Static` is the trust-gated content reused by every
+    // re-injection path — it stays non-null on non-full-mode turns so
+    // that mid-turn reducer compaction (which strips the prior `<memory>`
+    // block) can restore the freshest content. `memoryV2Static` is the
+    // first-turn / post-compaction cadence-gated value for initial
+    // injection only. `readMemoryV2StaticContent` self-gates on the v2
+    // flag + config and returns null when v2 is off.
+    const currentMemoryV2Static = personalMemoryAllowed
       ? readMemoryV2StaticContent()
       : null;
-    const memoryV2Static = currentMemoryV2Static;
+    const memoryV2Static = shouldInjectNowAndPkb ? currentMemoryV2Static : null;
 
     // PKB relevance-hint inputs. Resolved once per turn and reused across
     // re-injections so post-compaction rebuilds pick up fresh hints against
@@ -1575,7 +1590,8 @@ export async function runAgentLoopImpl(
       injection.blocks.pkbSystemReminder ||
       injection.blocks.workspaceBlock ||
       injection.blocks.nowScratchpadBlock ||
-      injection.blocks.pkbContextBlock
+      injection.blocks.pkbContextBlock ||
+      injection.blocks.memoryV2StaticBlock
     ) {
       try {
         const metadataUpdates: Record<string, unknown> = {};
@@ -1597,6 +1613,10 @@ export async function runAgentLoopImpl(
         if (injection.blocks.pkbContextBlock) {
           metadataUpdates.pkbContextBlock = injection.blocks.pkbContextBlock;
         }
+        if (injection.blocks.memoryV2StaticBlock) {
+          metadataUpdates.memoryV2StaticBlock =
+            injection.blocks.memoryV2StaticBlock;
+        }
         await runPipeline<PersistArgs, PersistResult>(
           "persistence",
           getMiddlewaresFor("persistence"),
@@ -2240,6 +2260,83 @@ export async function runAgentLoopImpl(
       }
     }
 
+    // ── Image-dimension overflow recovery ──────────────────────────
+    // When the provider rejects because an image block exceeds its pixel
+    // cap, strip every image block from ctx.messages and retry once.
+    // optimizeImageForTransport already ran at upload time; if sips was
+    // unavailable (non-macOS) it returns the same bytes unchanged.  In
+    // that case we swap the block for a text note so the model can tell
+    // the user what happened instead of hard-failing with a red banner.
+    if (state.imageTooLargeDetected) {
+      state.imageTooLargeDetected = false;
+      rlog.warn(
+        { phase: "image-recovery" },
+        "Image too large — stripping oversized image blocks and retrying",
+      );
+      ctx.messages = ctx.messages.map((msg) => {
+        if (!Array.isArray(msg.content)) return msg;
+        if (!msg.content.some((b) => b.type === "image")) return msg;
+        return {
+          ...msg,
+          content: msg.content.flatMap((b): ContentBlock[] => {
+            if (b.type !== "image") return [b];
+            const resized = optimizeImageForTransport(
+              b.source.data,
+              b.source.media_type,
+            );
+            if (resized.data !== b.source.data) {
+              // sips managed to downscale — use the smaller version
+              return [
+                {
+                  ...b,
+                  source: {
+                    type: "base64" as const,
+                    media_type: resized.mediaType,
+                    data: resized.data,
+                  },
+                },
+              ];
+            }
+            // Can't resize — replace with a text annotation so the model
+            // can explain the situation rather than silently dropping context
+            return [
+              {
+                type: "text" as const,
+                text: "(An image was attached but could not be sent — its dimensions exceed the provider limit and automatic resize was not available. Please resize the image and try again.)",
+              },
+            ];
+          }),
+        };
+      });
+      runMessages = ctx.messages;
+      updatedHistory = await ctx.agentLoop.run(
+        runMessages,
+        eventHandler,
+        abortController.signal,
+        reqId,
+        onCheckpoint,
+        turnCallSite,
+        loopTurnCtx,
+        turnOverrideProfile,
+        effectiveContextWindow.maxInputTokens,
+      );
+      if (state.imageTooLargeDetected) {
+        rlog.error(
+          { phase: "image-recovery" },
+          "Image-recovery retry also failed — surfacing error to user",
+        );
+        const classified = classifyConversationError(
+          new Error("Image dimensions too large"),
+          { phase: "agent_loop" },
+        );
+        deps.onEvent(
+          buildConversationErrorMessage(deps.ctx.conversationId, classified),
+        );
+        state.providerErrorUserMessage = classified.userMessage;
+        state.imageTooLargeDetected = false;
+      }
+    }
+
     // ── Bounded context overflow convergence loop ──────────────────
     // When the provider rejects with context-too-large, iterate through
     // reducer tiers (forced compaction, tool-result truncation, media
@@ -2834,6 +2931,7 @@ export async function runAgentLoopImpl(
       ctx.lastAssistantAttachments = assistantAttachments;
       ctx.lastAttachmentWarnings = attachmentResult.directiveWarnings;
       syncLastAssistantMessageToDisk();
+      const clientDisplayMessageId = getClientDisplayMessageId(state);
 
       // Re-check: the user may have cancelled during attachment resolution
       if (abortController.signal.aborted) {
@@ -2874,6 +2972,9 @@ export async function runAgentLoopImpl(
           ...(state.lastAssistantMessageId
             ? { messageId: state.lastAssistantMessageId }
             : {}),
+          ...(clientDisplayMessageId
+            ? { displayMessageId: clientDisplayMessageId }
+            : {}),
         });
       } else {
         ctx.emitActivityState("idle", "message_complete", "global", reqId);
@@ -2897,86 +2998,11 @@ export async function runAgentLoopImpl(
           ...(state.lastAssistantMessageId
             ? { messageId: state.lastAssistantMessageId }
             : {}),
+          ...(clientDisplayMessageId
+            ? { displayMessageId: clientDisplayMessageId }
+            : {}),
         });
 
-        // Emit a home-feed event for background/scheduled conversation completions.
-        // Scoped to message_complete only (not cancelled/handoff), wrapped in
-        // try-catch so malformed message content can never propagate errors.
-        try {
-          const conv = getConversation(ctx.conversationId);
-          if (
-            conv &&
-            (conv.conversationType === "background" ||
-              conv.conversationType === "scheduled")
-          ) {
-            const lastMsg = state.lastAssistantMessageId
-              ? getMessageById(state.lastAssistantMessageId, ctx.conversationId)
-              : undefined;
-            let summary: string;
-            if (lastMsg) {
-              const parsed: unknown = JSON.parse(lastMsg.content);
-              if (typeof parsed === "string") {
-                summary = parsed.slice(0, 200);
-              } else if (Array.isArray(parsed)) {
-                const textBlock = parsed.find(
-                  (b: { type?: string }) => b.type === "text",
-                );
-                summary =
-                  typeof textBlock?.text === "string"
-                    ? textBlock.text.slice(0, 200)
-                    : (conv.title ?? "Background task completed.");
-              } else {
-                summary = conv.title ?? "Background task completed.";
-              }
-            } else {
-              summary = conv.title ?? "Background task completed.";
-            }
-            const feedTitle =
-              conv.title && !isReplaceableTitle(conv.title)
-                ? conv.title
-                : "Background task";
-            const dedupKey = `bg-conv:${ctx.conversationId}`;
-            void emitFeedEvent({
-              source: "assistant",
-              title: feedTitle,
-              summary,
-              dedupKey,
-              conversationId: ctx.conversationId,
-            }).catch((err) => {
-              log.warn(
-                { err, conversationId: ctx.conversationId },
-                "Failed to emit background conversation feed event",
-              );
-            });
-
-            if (isReplaceableTitle(conv.title ?? null)) {
-              void rewriteFeedTitle(feedTitle)
-                .then((prose) => {
-                  if (prose && prose !== feedTitle) {
-                    return emitFeedEvent({
-                      source: "assistant",
-                      title: prose,
-                      summary,
-                      dedupKey,
-                      conversationId: ctx.conversationId,
-                    });
-                  }
-                })
-                .catch((err) => {
-                  log.warn(
-                    { err, conversationId: ctx.conversationId },
-                    "Failed to update feed event with prose title rewrite",
-                  );
-                });
-            }
-          }
-        } catch (feedErr) {
-          log.warn(
-            { err: feedErr, conversationId: ctx.conversationId },
-            "Failed to build home-feed event for background conversation",
-          );
-        }
-
         // Proactive artifact: fire once when the processed turn was the 4th user message.
         // Only trigger for real user-authored turns (not subagent/system messages).
         {
@@ -3274,6 +3300,10 @@ export async function applyCompactionResult(
     ctx.conversationId,
     ctx.trustContext?.trustClass,
   );
+  enqueueMemoryRetrospectiveOnCompaction(
+    ctx.conversationId,
+    ctx.trustContext?.trustClass,
+  );
   const summarySignals = computeSummaryQualitySignals(result.summaryText);
   onEvent({
     type: "context_compacted",

package/src/daemon/conversation-error.ts

@@ -120,6 +120,13 @@ const STREAMING_ERROR_PATTERNS = [
 ];
 
 // User-initiated cancellation patterns — these should NOT produce conversation_error
+// Image-input validation patterns — Anthropic 400s with this message when an image
+// block exceeds the per-side pixel cap. Distinct classification matters because
+// retrying with the same oversized image is futile; the user needs to resize.
+const IMAGE_DIMENSIONS_TOO_LARGE_PATTERNS = [
+  /image dimensions? exceeds? max allowed size/i,
+];
+
 const CANCEL_PATTERNS = [/abort/i, /cancel/i];
 
 /**
@@ -370,6 +377,15 @@ function classifyCore(
           errorCategory: "provider_not_configured",
         };
       }
+      if (isImageDimensionsTooLarge(message)) {
+        return {
+          code: "IMAGE_TOO_LARGE",
+          userMessage:
+            "An attached image is too large for the AI provider — image dimensions must be under 8000 pixels per side. Resize the image and try again.",
+          retryable: false,
+          errorCategory: "image_dimensions_too_large",
+        };
+      }
       return {
         code: "PROVIDER_API",
         userMessage: "The AI provider rejected the request.",
@@ -388,6 +404,11 @@ export function isContextTooLarge(message: string): boolean {
   return CONTEXT_TOO_LARGE_PATTERNS.some((p) => p.test(message));
 }
 
+/** Check whether an error message indicates an image-input dimension failure. */
+function isImageDimensionsTooLarge(message: string): boolean {
+  return IMAGE_DIMENSIONS_TOO_LARGE_PATTERNS.some((p) => p.test(message));
+}
+
 /** Check whether an error message indicates a web-search-specific ordering failure. */
 function isWebSearchOrderingError(message: string): boolean {
   return WEB_SEARCH_ORDERING_PATTERNS.some((p) => p.test(message));

package/src/daemon/conversation-lifecycle.ts

@@ -17,6 +17,7 @@ import {
   type MessageRow,
 } from "../memory/conversation-crud.js";
 import { enqueueMemoryJob } from "../memory/jobs-store.js";
+import { enqueueMemoryRetrospectiveIfEnabled } from "../memory/memory-retrospective-enqueue.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { ContentBlock, Message } from "../providers/types.js";
@@ -183,6 +184,7 @@ export async function loadFromDb(ctx: LoadFromDbContext): Promise<void> {
     ctx.contextCompactedAt = conv?.contextCompactedAt ?? null;
   }
 
+  const personalMemoryAllowed = !isUntrustedTrustClass(trustClass);
   const parsedMessages: Message[] = dbMessages
     .slice(ctx.contextCompactedMessageCount)
     .map((m, index, arr) => {
@@ -215,7 +217,8 @@ export async function loadFromDb(ctx: LoadFromDbContext): Promise<void> {
           // shape right-to-left, since each prepend shifts previously-
           // prepended blocks one slot right:
           //   [<workspace>, <turn_context>, <NOW.md>, <memory __injected>,
-          //    <system_reminder>, <knowledge_base>, ...original]
+          //    <memory>\n…</memory>, <system_reminder>, <knowledge_base>,
+          //    ...original]
           //
           // Persisted non-tail rows rehydrate the full set so Anthropic's
           // prefix cache keeps matching msg[0] across daemon restarts and
@@ -238,15 +241,37 @@ export async function loadFromDb(ctx: LoadFromDbContext): Promise<void> {
             ];
           }
 
+          // The v2 static memory block (essentials/threads/recent/buffer
+          // wrapped in `<memory>…</memory>`) carries personal user memory.
+          // Trust-gated to mirror `shouldExposePersonalMemory` at injection
+          // time — untrusted-actor views must not read persisted personal
+          // memory back through metadata. Skipped on the tail row because
+          // the next turn re-injects fresh content on full-mode turns.
+          if (
+            !isTail &&
+            personalMemoryAllowed &&
+            typeof meta.memoryV2StaticBlock === "string"
+          ) {
+            content = [
+              { type: "text" as const, text: meta.memoryV2StaticBlock },
+              ...content,
+            ];
+          }
+
           // Memory remains rehydrated on all rows (existing behavior).
           // Strip any pre-existing wrapper before re-wrapping so historical
           // rows persisted with the wrapper (v2 path before the
           // injectedBlockText contract was unified with v1's unwrapped form)
-          // don't render double-wrapped after rehydrate.
+          // don't render double-wrapped after rehydrate. Only unwrap when
+          // the full <memory>...</memory> pair is present so we don't mutate
+          // legitimate unwrapped payloads that happen to start with
+          // "<memory>\n" or end with "\n</memory>".
           if (typeof meta.memoryInjectedBlock === "string") {
-            const inner = meta.memoryInjectedBlock
-              .replace(/^<memory>\n/, "")
-              .replace(/\n<\/memory>$/, "");
+            const block = meta.memoryInjectedBlock;
+            const inner =
+              block.startsWith("<memory>\n") && block.endsWith("\n</memory>")
+                ? block.slice("<memory>\n".length, -"\n</memory>".length)
+                : block;
             content = [
               {
                 type: "text" as const,
@@ -411,6 +436,22 @@ export function disposeConversation(ctx: DisposeContext): void {
     } catch {
       // Best-effort — don't block conversation disposal
     }
+
+    try {
+      // Memory-retrospective lifecycle safety-net. The periodic triggers
+      // (interval / message_count / pre-compaction) handle the common
+      // path; lifecycle catches the gap between the last interval fire
+      // and conversation eviction. The job's `no_new_messages` early
+      // return makes this a cheap no-op when the periodic path already
+      // covered things. `enqueueMemoryRetrospectiveIfEnabled` has its
+      // own internal recursion guard.
+      enqueueMemoryRetrospectiveIfEnabled({
+        conversationId: ctx.conversationId,
+        trigger: "lifecycle",
+      });
+    } catch {
+      // Best-effort — don't block conversation disposal
+    }
   }
 
   abortConversation(