@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/runtime/access-request-helper.ts

@@ -56,6 +56,12 @@ export interface AccessRequestParams {
   previousMemberStatus?: Exclude<ChannelStatus, "unverified">;
   /** Preview of the requester's original message, shown to the guardian. */
   messagePreview?: string;
+  /** Slack-specific: user is from an external workspace (Slack Connect). */
+  isStranger?: boolean;
+  /** Slack-specific: user is a guest / restricted account. */
+  isRestricted?: boolean;
+  /** Slack message timestamp for permalink construction. */
+  messageTs?: string;
 }
 
 export type AccessRequestResult =
@@ -92,6 +98,9 @@ export function notifyGuardianOfAccessRequest(
     actorUsername,
     previousMemberStatus,
     messagePreview,
+    isStranger,
+    isRestricted,
+    messageTs,
   } = params;
 
   if (!actorExternalId) {
@@ -193,15 +202,10 @@ export function notifyGuardianOfAccessRequest(
 
   let vellumDeliveryId: string | null = null;
   // When the access request originates from a text channel with
-  // notification delivery support (Slack, Telegram), route the guardian
-  // notification to that same channel only. Delivering on the macOS
-  // client as well is noisy and approving from there doesn't work
-  // because the desktop path lacks the channel delivery context needed
-  // to deliver the verification code. Phone is excluded because it is
-  // not a deliverable notification channel.
-  // When the guardian was resolved via a verified same-channel contact,
-  // route only to that channel — delivering on desktop as well is noisy
-  // and the desktop path lacks the channel delivery context for approval.
+  // notification delivery support (Slack, Telegram) and the guardian was
+  // resolved via a verified same-channel contact, route the notification
+  // only to that channel to reduce noise. Phone is excluded because it
+  // is not a deliverable notification channel.
   // When the guardian was NOT verified on the source channel (e.g. resolved
   // via vellum anchor), route to all channels so the guardian can see
   // the request on desktop/other channels where they ARE verified.
@@ -238,6 +242,9 @@ export function notifyGuardianOfAccessRequest(
       guardianResolutionSource,
       previousMemberStatus: previousMemberStatus ?? null,
       messagePreview: messagePreview ?? null,
+      ...(isStranger !== undefined ? { isStranger } : {}),
+      ...(isRestricted !== undefined ? { isRestricted } : {}),
+      ...(messageTs ? { messageTs } : {}),
     },
     dedupeKey: `access-request:${canonicalRequest.id}`,
     onConversationCreated: (info) => {

package/src/runtime/agent-wake.ts

@@ -7,6 +7,13 @@
  *
  * Semantics:
  *   - Resolves the conversation context exactly as a normal user turn.
+ *   - Runs the conversation's auto-threshold compaction gate
+ *     (`conversation.maybeCompact()`) before snapshotting the history —
+ *     the wake bypasses the orchestrator's in-loop compaction, so this is
+ *     its turn-start equivalent. Callers can pass
+ *     `suppressAutoCompaction: true` to skip it; a suppressed wake whose
+ *     input exceeds the effective context window fails deterministically
+ *     with `reason: "context_overflow"` instead of compacting.
  *   - Appends `hint` as a non-persisted assistant message sandwiched
  *     between two static user messages — never shows up in the transcript
  *     or SSE feed. The assistant role prevents prompt injection (LLMs
@@ -56,6 +63,11 @@ import {
   classifyDiskPressureTurnPolicy,
   type DiskPressureTurnPolicyDecision,
 } from "../daemon/disk-pressure-policy.js";
+import { looksLikeContextOverflowError } from "../daemon/parse-actual-tokens-from-error.js";
+import type {
+  SubagentToolGateMode,
+  WakeToolContextPin,
+} from "../daemon/tool-setup-types.js";
 import type { TrustContext } from "../daemon/trust-context.js";
 import {
   broadcastWakeSurface,
@@ -73,6 +85,7 @@ import {
   recordRequestLog,
   setAgentLoopExitReasonOnLatestLog,
 } from "../memory/llm-request-log-store.js";
+import type { SystemPromptPersonaOverride } from "../prompts/system-prompt.js";
 import type { Message } from "../providers/types.js";
 import { getLogger } from "../util/logger.js";
 
@@ -86,6 +99,14 @@ const WAKE_PREAMBLE =
 const WAKE_POSTAMBLE =
   "[system] End of message from external system, continue the conversation.";
 
+/**
+ * Warn line shared by the two reactive over-window failure sites (provider
+ * rejection escaped as a throw / swallowed into a no-output stop). The
+ * pre-flight estimate site logs its own distinct message.
+ */
+const OVER_WINDOW_REJECTION_LOG_MESSAGE =
+  "agent-wake: provider rejected the input as over-window with auto-compaction suppressed; failing the wake";
+
 export interface WakeOptions {
   conversationId: string;
   hint: string;
@@ -113,6 +134,19 @@ export interface WakeOptions {
    * tune the model/profile and observability bucket independently.
    */
   callSite?: LLMCallSite;
+  /**
+   * Run the wake's LLM calls under this inference profile, floated ABOVE the
+   * call site's named profile and call-site overrides (the resolver's
+   * `forceOverrideProfile` escape hatch). When set, it replaces the
+   * conversation's own pinned-profile lookup. Used by fork-based memory
+   * retrospectives to resolve the SAME model/thinking/effort as the source
+   * conversation's turns so the provider prompt-cache prefix can be reused.
+   * A profile name that no longer exists in `llm.profiles` silently falls
+   * back to normal call-site resolution (the resolver's standard
+   * missing-reference semantics). Logging/attribution still bucket under
+   * `callSite`.
+   */
+  forceOverrideProfile?: string;
   /**
    * Role to use for the injected hint message. Defaults to `"assistant"` so
    * the hint is sandwiched between two static user bookends — the canonical
@@ -124,22 +158,25 @@ export interface WakeOptions {
    */
   hintRole?: "assistant" | "user";
   /**
-   * Documented intent: this wake must not trigger auto-threshold compaction.
+   * Skip the wake's pre-run auto-threshold compaction gate and refuse to
+   * run over-window instead of compacting.
    *
-   * Today this is automatically satisfied because the wake invokes
-   * `conversation.agentLoop.run()` directly, bypassing the daemon orchestrator
-   * (`conversation-agent-loop.ts`) where the compaction pipeline lives. The
-   * flag is recorded in the wake's structured log line so operators can
-   * verify the contract holds across refactors. If compaction is ever moved
-   * into `AgentLoop.run` or invoked from the wake path, callers that pass
-   * `true` here MUST be updated to suppress it; callers that pass `false`
-   * (or omit it) MUST tolerate compaction firing.
+   * By default the wake runs `conversation.maybeCompact()` before
+   * snapshotting the history — the wake invokes `conversation.agentLoop.run()`
+   * directly with the loop's in-loop budget gate disabled, so this pre-run
+   * gate is the wake path's equivalent of the turn-start compaction the
+   * daemon orchestrator (`conversation-agent-loop.ts`) performs for user
+   * turns. Passing `true` skips the gate entirely; if the wake input would
+   * then exceed the effective context window, the wake fails fast with
+   * `reason: "context_overflow"` instead of compacting, and a provider
+   * context-overflow rejection mid-run is mapped to the same failure.
    *
    * Used by fork-based memory retrospectives: the wake operates on a
-   * freshly-forked conversation that may already be near (or past) the
-   * source's auto-threshold, but the goal is to operate on that exact
-   * context — running a compaction LLM call before the wake's own first
-   * call would waste tokens and defeat prompt-cache reuse.
+   * freshly-forked throwaway conversation that may already be near (or
+   * past) the source's auto-threshold, but the goal is to operate on that
+   * exact context — running a compaction LLM call before the wake's own
+   * first call would waste tokens, defeat prompt-cache reuse, and fire
+   * compaction side-effects on a fork that is deleted afterwards.
    */
   suppressAutoCompaction?: boolean;
   /**
@@ -161,9 +198,48 @@ export interface WakeOptions {
   /**
    * Optional exact tool allowlist for this wake. Used by internal maintenance
    * jobs that need the assistant's judgment but must not execute arbitrary
-   * side-effect tools.
+   * side-effect tools. Enforcement depends on `toolGateMode`: in `"wire"`
+   * mode (default) the tool definitions sent to the provider are filtered to
+   * the allowlist; in `"execution"` mode the full tool surface stays on the
+   * wire and non-allowlisted calls are rejected with an error tool_result
+   * before their executor runs. Either way, only allowlisted tools can
+   * execute during the wake.
    */
   allowedTools?: readonly string[];
+  /**
+   * How `allowedTools` is enforced — see {@link SubagentToolGateMode} for the
+   * wire-vs-execution semantics and cache-parity rationale. Defaults to
+   * `"wire"` (the historical behavior, byte-identical when absent). Ignored
+   * when `allowedTools` is absent.
+   */
+  toolGateMode?: SubagentToolGateMode;
+  /**
+   * Client-context pin applied (and restored) alongside `allowedTools` for
+   * the duration of the wake — see {@link WakeToolContextPin}. Pass only
+   * with `toolGateMode: "execution"`: it exists purely so the wire tool
+   * definitions resolve under the SOURCE conversation's client context
+   * (provider prompt-cache parity) and is pointless when the wire is
+   * allowlist-filtered anyway. Definition resolution only — pinned-in tools
+   * remain execution-rejected by the gate. Ignored when `allowedTools` is
+   * absent.
+   */
+  toolContextPin?: WakeToolContextPin;
+  /**
+   * Explicit persona/channel slugs for the wake's system-prompt build,
+   * applied to the conversation for the duration of the run and restored
+   * afterwards. Wakes bypass the orchestrator's turn-start persona snapshot,
+   * so their prompt is otherwise built from whatever snapshot the
+   * conversation already holds — for a freshly hydrated conversation (the
+   * fork-retrospective case) that is the no-trust-context derivation
+   * (guardian persona + "vellum" channel) regardless of which actor/channel
+   * the conversation belongs to. Used by fork-based memory retrospectives to
+   * render the SOURCE conversation's persona sections — both for review
+   * quality and for byte-parity with the source's cached system-prompt
+   * prefix. May also pin `hasNoClient` for the prompt build (see
+   * {@link SystemPromptPersonaOverride}). Prompt-build selection only; trust
+   * class and approval semantics are governed solely by `trustContext`.
+   */
+  personaOverride?: SystemPromptPersonaOverride;
 }
 
 /**
@@ -177,7 +253,14 @@ export type WakeSkipReason =
   | "archived"
   | "timeout"
   | "no_resolver"
-  | "disk_pressure";
+  | "disk_pressure"
+  /**
+   * The wake input exceeds the effective context window and the caller
+   * suppressed auto-compaction (`suppressAutoCompaction: true`), so the
+   * run cannot proceed without the compaction it was told not to perform.
+   * Only possible on suppressed wakes.
+   */
+  | "context_overflow";
 
 export interface WakeResult {
   invoked: boolean;
@@ -331,10 +414,12 @@ function classifyWakeDiskPressurePolicy(opts: WakeOptions): {
 }
 
 /**
- * Trust snapshot the wake hands to the agent loop. A wake has no compaction
- * path (it runs with overflow recovery disabled), so this snapshot is unread
- * except on the disk-pressure cleanup-mode path, whose guardian value scopes
- * the compactor's image manifest if cleanup ever compacts. Other wakes pass an
+ * Trust snapshot the wake hands to the agent loop. The wake's loop run has
+ * no in-loop compaction path (it runs with overflow recovery disabled; the
+ * wake compacts via the pre-run gate instead, which resolves trust from the
+ * conversation's own trust context), so this snapshot is unread except on
+ * the disk-pressure cleanup-mode path, whose guardian value scopes the
+ * compactor's image manifest if cleanup ever compacts. Other wakes pass an
  * `unknown`-class snapshot so a missing actor cannot grant elevated trust.
  */
 function buildWakeTrust(
@@ -420,6 +505,7 @@ export async function wakeAgentForOpportunity(
   deps?: WakeDeps,
 ): Promise<WakeResult> {
   const { conversationId, hint, source } = opts;
+  const suppressAutoCompaction = opts.suppressAutoCompaction === true;
   const resolveTarget = deps?.resolveTarget ?? defaultResolveTarget;
   const nowFn = deps?.now ?? Date.now;
   const startedAt = nowFn();
@@ -486,6 +572,85 @@ export async function wakeAgentForOpportunity(
       conversation.setTrustContext(opts.trustContext);
     }
 
+    // Honor the conversation's pinned inference-profile override (if any).
+    // Without this, scheduled-task wakes and other opportunity wakes bypass
+    // `runAgentLoopImpl` entirely and execute under workspace defaults,
+    // silently violating the user's pinned preference. A caller-supplied
+    // `forceOverrideProfile` replaces that lookup and additionally floats the
+    // profile above the call-site layers (see the option's doc). Resolve the
+    // effective context budget here as well because wakes bypass the normal
+    // user-turn path that computes it for tool-result truncation. Read before
+    // `setProcessing(true)` so a thrown DB/config read can't strand the
+    // processing flag.
+    const forceOverrideProfile = opts.forceOverrideProfile !== undefined;
+    const overrideProfile =
+      opts.forceOverrideProfile ??
+      getConversationOverrideProfile(conversationId);
+    const callSite = opts.callSite ?? "mainAgent";
+    const config = getConfig();
+    const effectiveContextWindow = resolveEffectiveContextWindow({
+      llm: config.llm,
+      callSite,
+      overrideProfile,
+      forceOverrideProfile,
+    });
+
+    // Apply the caller's persona override for the duration of the run. The
+    // wake's agent loop builds the system prompt through the conversation's
+    // resolveSystemPrompt callback, which reads this field; cleared (below,
+    // before drainQueue) so a queued user turn never builds its prompt under
+    // the wake's override. Assigned only AFTER the profile/config reads above
+    // — those can throw, and they run before the try/finally that clears the
+    // override, so an earlier assignment would strand the override on the
+    // cached Conversation and corrupt every later prompt build on it.
+    if (opts.personaOverride) {
+      conversation.wakePersonaOverride = opts.personaOverride;
+    }
+    const clearWakePersonaOverride = (): void => {
+      if (opts.personaOverride) {
+        conversation.wakePersonaOverride = undefined;
+      }
+    };
+
+    // Mark processing for the duration of the wake — including the pre-run
+    // compaction gate below, whose summary LLM call must not race a user
+    // send into a concurrent agent loop on the same conversation. A user
+    // message arriving while the flag is set is queued by `enqueueMessage()`
+    // and drained after the wake's tail is pushed + persisted. This happens
+    // before applying a wake-scoped tool allowlist so a concurrent user turn
+    // cannot start under the wake's restricted tool set.
+    conversation.setProcessing(true);
+
+    // ── Pre-run auto-compaction gate ──────────────────────────────────
+    // The wake invokes `conversation.agentLoop.run()` with the loop's
+    // in-loop budget gate disabled (see `resolveContextWindow` below), so
+    // the orchestrator's turn-start compaction never fires for wakes.
+    // Mirror it here: run the conversation's auto-threshold compaction
+    // before snapshotting the baseline — a successful compaction replaces
+    // `conversation.messages`, so it must precede the snapshot. Callers
+    // like fork-based memory retrospectives suppress this gate: the fork
+    // is throwaway and a summarization LLM call on it is wasted spend.
+    // Failure is non-fatal — the wake proceeds on the uncompacted history
+    // exactly as it would have before the gate existed. The gate's window
+    // sizing is threaded from the wake's own call-site resolution above —
+    // without it, `maybeCompact` sizes the threshold against `mainAgent`,
+    // which can pass un-compacted a wake whose call site resolves a smaller
+    // window (and then overflow at the provider).
+    if (!suppressAutoCompaction) {
+      try {
+        await conversation.maybeCompact({
+          callSite,
+          overrideProfile,
+          forceOverrideProfile,
+        });
+      } catch (err) {
+        log.warn(
+          { conversationId, source, err },
+          "agent-wake: pre-run auto-compaction failed; continuing with the uncompacted history",
+        );
+      }
+    }
+
     const baseline = conversation.getMessages();
     // Snapshot the baseline length BEFORE the run starts. Incremental
     // persistence pushes onto `conversation.messages` mid-run, which grows the
@@ -564,6 +729,14 @@ export async function wakeAgentForOpportunity(
     // so the latest-row lookup in `setAgentLoopExitReasonOnLatestLog`
     // can see the freshly-persisted final usage row.
     let pendingExitReason: string | null = null;
+    // Set when the provider rejects a call as context-too-large while
+    // auto-compaction is suppressed. The loop has no recovery ladder to
+    // drive (overflow recovery is disabled for wakes), so it swallows the
+    // rejection into a graceful no-output stop — which would read as a
+    // *successful* silent no-op to callers like the memory-retrospective
+    // job. Capture the signal here so the wake can fail deterministically
+    // instead (`reason: "context_overflow"`).
+    let suppressedContextOverflow = false;
     const persistLog = (record: PendingLog): void => {
       try {
         recordRequestLog(
@@ -572,7 +745,7 @@ export async function wakeAgentForOpportunity(
           JSON.stringify(record.rawResponse),
           undefined,
           record.provider,
-          "mainAgent",
+          callSite,
         );
       } catch (err) {
         log.warn(
@@ -658,6 +831,19 @@ export async function wakeAgentForOpportunity(
           persistExitReason(event.reason);
         }
       }
+      // Detect an over-window rejection on a compaction-suppressed wake.
+      // `provider_error` fires at the provider-call site; `error` fires from
+      // the loop's generic catch — check both so a rewrapping retry layer
+      // can't hide the signal. The heuristic check also catches adapter
+      // paths (e.g. managed-proxy rewrappers) that surface the overflow as
+      // an untyped error the typed `instanceof` check would miss.
+      if (
+        suppressAutoCompaction &&
+        (event.type === "provider_error" || event.type === "error") &&
+        looksLikeContextOverflowError(event.error)
+      ) {
+        suppressedContextOverflow = true;
+      }
       if (mode === "buffering") {
         buffered.push(event);
         return;
@@ -758,23 +944,6 @@ export async function wakeAgentForOpportunity(
       persistedTailIndex += newMessages.length;
     };
 
-    // Honor the conversation's pinned inference-profile override (if any).
-    // Without this, scheduled-task wakes and other opportunity wakes bypass
-    // `runAgentLoopImpl` entirely and execute under workspace defaults,
-    // silently violating the user's pinned preference. Resolve the effective
-    // context budget here as well because wakes bypass the normal user-turn
-    // path that computes it for tool-result truncation. Read before
-    // `setProcessing(true)` so a thrown DB/config read can't strand the
-    // processing flag.
-    const overrideProfile = getConversationOverrideProfile(conversationId);
-    const callSite = opts.callSite ?? "mainAgent";
-    const config = getConfig();
-    const effectiveContextWindow = resolveEffectiveContextWindow({
-      llm: config.llm,
-      callSite,
-      overrideProfile,
-    });
-
     let wakeToolScopeRestored = false;
     let restoreWakeToolScope: (() => void) | null = null;
     const restoreWakeAllowedTools = (): void => {
@@ -796,6 +965,8 @@ export async function wakeAgentForOpportunity(
         restoreWakeToolScope = scopeWakeAllowedTools(
           conversation,
           new Set(opts.allowedTools),
+          opts.toolGateMode,
+          opts.toolContextPin,
         );
         return true;
       } catch (err) {
@@ -807,14 +978,6 @@ export async function wakeAgentForOpportunity(
       }
     };
 
-    // Mark processing for the duration of the run so a concurrent user
-    // send is queued by `enqueueMessage()` rather than spawning a second
-    // concurrent agent loop on the same conversation (which would
-    // interleave writes to `conversation.messages`). This happens before
-    // applying a wake-scoped tool allowlist so a concurrent user turn cannot
-    // start under the wake's restricted tool set.
-    conversation.setProcessing(true);
-
     // Fires after each tool-execution turn finalizes (assistant message
     // + matching tool_result user message both in history). A single
     // tool turn is unambiguous evidence of output — promote to live
@@ -834,7 +997,64 @@ export async function wakeAgentForOpportunity(
     let toolUseNames: string[] = [];
     let tailMessageCount = 0;
     let drainedInTry = false;
+    // Set when the wake fails with `reason: "context_overflow"`. The finally
+    // block skips its generic outcome log for this path — the failure
+    // already logged its own dedicated warn line.
+    let failedContextOverflow = false;
+    // Shared failure path for an over-window condition on a
+    // compaction-suppressed wake (reached from the pre-flight estimate, from
+    // the run's catch when the rejection escaped as a throw, or post-run when
+    // the loop swallowed it into a graceful no-output stop and only the event
+    // capture saw it). `extraLogFields` is spread into the warn line so each
+    // site can attach its own context (err, token estimates).
+    const failSuppressedContextOverflow = (
+      logMessage: string,
+      extraLogFields: Record<string, unknown> = {},
+    ): WakeResult => {
+      failedContextOverflow = true;
+      log.warn({ conversationId, source, ...extraLogFields }, logMessage);
+      return {
+        invoked: false,
+        producedToolCalls: false,
+        reason: "context_overflow" as const,
+      };
+    };
     try {
+      // ── Over-window policy under suppressed auto-compaction ─────────
+      // The pre-run gate above is the wake's only compaction path (the
+      // loop's in-loop budget gate stays disabled), so when the caller
+      // suppressed it an over-window input has no recovery. Fail fast and
+      // deterministically — before spending any LLM call — instead of
+      // letting the provider reject the run into a silent no-op. Estimated
+      // with the same estimator the auto-compaction pre-check uses; an
+      // estimator failure proceeds fail-open (the reactive
+      // `suppressedContextOverflow` capture below still maps a provider
+      // rejection to the same failure).
+      if (suppressAutoCompaction) {
+        let estimatedInputTokens: number | null = null;
+        try {
+          estimatedInputTokens =
+            conversation.contextWindowManager.estimateInputTokens(runInput);
+        } catch (err) {
+          log.warn(
+            { conversationId, source, err },
+            "agent-wake: over-window pre-flight estimate failed; proceeding without it",
+          );
+        }
+        if (
+          estimatedInputTokens !== null &&
+          estimatedInputTokens > effectiveContextWindow.maxInputTokens
+        ) {
+          return failSuppressedContextOverflow(
+            "agent-wake: input exceeds the effective context window and auto-compaction is suppressed; failing fast",
+            {
+              estimatedInputTokens,
+              maxInputTokens: effectiveContextWindow.maxInputTokens,
+            },
+          );
+        }
+      }
+
       if (!applyWakeAllowedTools()) {
         return {
           invoked: false,
@@ -859,16 +1079,33 @@ export async function wakeAgentForOpportunity(
           callSite,
           trust: wakeTrust,
           overrideProfile,
-          // Wake runs have no orchestrator-side mid-loop compaction path,
-          // so the budget gate stays disabled (`overflowRecovery.enabled =
-          // false`); `maxInputTokens` is still supplied for tool-result
-          // truncation.
+          forceOverrideProfile,
+          // The wake's compaction lives in the pre-run gate above
+          // (`conversation.maybeCompact()`), never in the loop: the in-loop
+          // budget gate and overflow-recovery ladder stay disabled because
+          // the wake's tail accounting holds external indexes into the
+          // returned history (`baselineLength` + hint count), which an
+          // in-loop compaction rebase would invalidate. `maxInputTokens` is
+          // still supplied for tool-result truncation.
           resolveContextWindow: () => ({
             maxInputTokens: effectiveContextWindow.maxInputTokens,
             overflowRecovery: { enabled: false, safetyMarginRatio: 0 },
           }),
         }));
       } catch (err) {
+        // An over-window throw on a compaction-suppressed wake is the
+        // suppression contract's failure mode, not a generic loop error —
+        // surface it as a deterministic failed result. The heuristic check
+        // also catches rewrapped (untyped) provider overflow errors.
+        if (
+          suppressedContextOverflow ||
+          (suppressAutoCompaction && looksLikeContextOverflowError(err))
+        ) {
+          return failSuppressedContextOverflow(
+            OVER_WINDOW_REJECTION_LOG_MESSAGE,
+            { err },
+          );
+        }
         // Capture the error for post-finally logging, then short-circuit
         // the rest of the try body — no tail to push/persist when the
         // run threw mid-flight. The outer finally still runs to release
@@ -877,6 +1114,15 @@ export async function wakeAgentForOpportunity(
         return { invoked: true, producedToolCalls: false };
       }
 
+      // The loop swallows provider rejections into a graceful no-output
+      // stop, so an over-window rejection on a compaction-suppressed wake
+      // surfaces only through the event stream (captured into
+      // `suppressedContextOverflow` by `onEvent`). Map it to a deterministic
+      // failure instead of the silent no-op it would otherwise read as.
+      if (suppressedContextOverflow) {
+        return failSuppressedContextOverflow(OVER_WINDOW_REJECTION_LOG_MESSAGE);
+      }
+
       // Run completed cleanly. The canonical user-turn pattern
       // (conversation-agent-loop.ts:1860, 2106-2126) updates
       // `ctx.messages` first, then clears the flag via `ctx.setProcessing(false)`, then
@@ -925,6 +1171,7 @@ export async function wakeAgentForOpportunity(
       // processing to already be false). The finally block handles the
       // error/early-return paths where no tail was produced.
       restoreWakeAllowedTools();
+      clearWakePersonaOverride();
       try {
         conversation.setProcessing(false);
       } catch (err) {
@@ -952,6 +1199,7 @@ export async function wakeAgentForOpportunity(
       // `drainedInTry` is still false.
       if (!drainedInTry) {
         restoreWakeAllowedTools();
+        clearWakePersonaOverride();
         try {
           conversation.setProcessing(false);
         } catch (err) {
@@ -971,9 +1219,12 @@ export async function wakeAgentForOpportunity(
       }
 
       const durationMs = nowFn() - startedAt;
-      const suppressAutoCompaction = opts.suppressAutoCompaction === true;
       const suppressWakeSurface = opts.suppressWakeSurface === true;
-      if (runError) {
+      if (failedContextOverflow) {
+        // Already logged its own dedicated warn line at the failure site;
+        // a generic "silent no-op" line here would misclassify a failed
+        // wake as a successful empty one.
+      } else if (runError) {
         log.error(
           {
             conversationId,