@vellumai/assistant 0.9.1-staging.1 → 0.10.0-staging.2

package/src/context/compactor.ts

@@ -37,10 +37,8 @@ import type {
   ProviderResponse,
   ToolDefinition,
 } from "../providers/types.js";
-import {
-  isUntrustedTrustClass,
-  type TrustClass,
-} from "../runtime/actor-trust-resolver.js";
+import { type TrustClass } from "../runtime/actor-trust-resolver.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import { getLogger } from "../util/logger.js";
 import { stripInjectionsForCompaction } from "./strip-injections.js";
 import {
@@ -387,7 +385,7 @@ export function collectImageManifest(
   actorTrustClass?: TrustClass,
 ): ManifestEntry[] {
   const allRows = getMessages(conversationId);
-  const rows = isUntrustedTrustClass(actorTrustClass)
+  const rows = !resolveCapabilities(actorTrustClass).canAccessMemory
     ? filterMessagesForUntrustedActor(allRows)
     : allRows;
   const entries: ManifestEntry[] = [];
@@ -847,6 +845,69 @@ function buildCompactionRequest(
   return [...stripHistoricalWebSearchResults(history).messages, instruction];
 }
 
+// Token headroom a compaction summary call reserves on top of its history: room
+// for the instruction message and the summary the model emits, so a request
+// front-truncated to `compactionPrefixBudget` still fits the context window.
+const COMPACTION_INSTRUCTION_TOKEN_RESERVE = 800;
+const COMPACTION_OUTPUT_BUDGET_RATIO = 0.15;
+
+// Largest history (in estimated tokens) a compaction summary call may carry
+// while leaving room for the instruction and the emitted summary within
+// `maxInputTokens`.
+function compactionPrefixBudget(maxInputTokens: number): number {
+  return (
+    maxInputTokens -
+    COMPACTION_INSTRUCTION_TOKEN_RESERVE -
+    Math.floor(maxInputTokens * COMPACTION_OUTPUT_BUDGET_RATIO)
+  );
+}
+
+// Front-truncate the history handed to a compaction summary call so the call
+// itself fits the context window. Drops messages from the front until the
+// estimated prompt fits `budgetTokens`, then prepends a marker noting how many
+// were dropped so the model knows the summary covers only the visible portion.
+// Returns the input untouched when it already fits or holds a single message —
+// so a below-budget call keeps its prefix byte-aligned with the agent's warm
+// cache and pays no extra cache write.
+function truncateHistoryToBudget(args: {
+  messages: Message[];
+  systemPrompt: string;
+  budgetTokens: number;
+  providerName: string;
+}): Message[] {
+  const { messages, systemPrompt, budgetTokens, providerName } = args;
+  let estimate = estimatePromptTokens(messages, systemPrompt, { providerName });
+  if (estimate <= budgetTokens || messages.length <= 1) {
+    return messages;
+  }
+  let dropCount = 0;
+  while (estimate > budgetTokens && dropCount < messages.length - 1) {
+    dropCount++;
+    estimate = estimatePromptTokens(messages.slice(dropCount), systemPrompt, {
+      providerName,
+    });
+  }
+  if (dropCount === 0) {
+    return messages;
+  }
+  log.info(
+    { dropCount, budgetTokens, totalMessages: messages.length },
+    "Compaction summary input exceeds context window — truncating from front",
+  );
+  return [
+    {
+      role: "user" as const,
+      content: [
+        {
+          type: "text" as const,
+          text: `[${dropCount} earlier messages truncated — summary covers only the visible portion]`,
+        },
+      ],
+    },
+    ...messages.slice(dropCount),
+  ];
+}
+
 export async function runAssistantDrivenCompaction(
   args: CompactionRunArgs,
 ): Promise<CompactionRunResult> {
@@ -881,7 +942,19 @@ export async function runAssistantDrivenCompaction(
     args.targetTokens,
   );
 
-  const requestMessages = buildCompactionRequest(args.messages, instruction);
+  // Bound the summary call's own input to the context window. With no tool
+  // pair to anchor an emergency split, an overflow recovery routes the full
+  // history straight here, so the summary call must front-truncate itself or
+  // it overflows in turn. `args.messages` stays intact for tail resolution
+  // below — only the outbound request is truncated. A below-budget history is
+  // returned untouched, keeping the prefix aligned with the agent's warm cache.
+  const summaryHistory = truncateHistoryToBudget({
+    messages: args.messages,
+    systemPrompt: args.systemPrompt,
+    budgetTokens: compactionPrefixBudget(args.maxInputTokens),
+    providerName: args.provider.tokenEstimationProvider ?? args.provider.name,
+  });
+  const requestMessages = buildCompactionRequest(summaryHistory, instruction);
 
   let response: ProviderResponse;
   try {
@@ -1296,55 +1369,16 @@ export async function runEmergencyCompaction(
   const keptTail = stripInjectionsForCompaction(
     args.messages.slice(splitIndex),
   );
-  let prefix = args.messages.slice(0, splitIndex);
-
-  // If the prefix itself exceeds the context window, truncate messages
-  // from the front so the model can at least see the recent portion.
-  // Reserve budget for the instruction message + output.
-  const instructionBudget = 800; // ~tokens for the emergency prompt
-  const outputBudget = Math.floor(args.maxInputTokens * 0.15);
-  const prefixBudget = args.maxInputTokens - instructionBudget - outputBudget;
-
-  let prefixEstimate = estimatePromptTokens(prefix, args.systemPrompt, {
+  // Bound the prefix to the context window so the summary call fits, reserving
+  // budget for the instruction message and the emitted summary. Truncates from
+  // the front, keeping the recent portion the summary most needs.
+  const prefix = truncateHistoryToBudget({
+    messages: args.messages.slice(0, splitIndex),
+    systemPrompt: args.systemPrompt,
+    budgetTokens: compactionPrefixBudget(args.maxInputTokens),
     providerName: args.provider.tokenEstimationProvider ?? args.provider.name,
   });
 
-  if (prefixEstimate > prefixBudget && prefix.length > 1) {
-    log.info(
-      {
-        prefixEstimate,
-        prefixBudget,
-        prefixMessages: prefix.length,
-      },
-      "Emergency compaction: prefix exceeds context window — truncating from front",
-    );
-    // Drop messages from the front until we fit. Keep at least the first
-    // message (may be an existing summary) and try to preserve recent context.
-    let dropCount = 0;
-    while (prefixEstimate > prefixBudget && dropCount < prefix.length - 1) {
-      dropCount++;
-      const truncated = prefix.slice(dropCount);
-      prefixEstimate = estimatePromptTokens(truncated, args.systemPrompt, {
-        providerName:
-          args.provider.tokenEstimationProvider ?? args.provider.name,
-      });
-    }
-    if (dropCount > 0) {
-      prefix = [
-        {
-          role: "user" as const,
-          content: [
-            {
-              type: "text" as const,
-              text: `[${dropCount} earlier messages truncated — summary covers only the visible portion]`,
-            },
-          ],
-        },
-        ...prefix.slice(dropCount),
-      ];
-    }
-  }
-
   const instruction: Message = {
     role: "user",
     content: [{ type: "text", text: EMERGENCY_COMPACTION_PROMPT }],

package/src/context/strip-injections.ts

@@ -28,6 +28,33 @@ import type { Message } from "../providers/types.js";
  */
 export type InjectionMatcher = string | { prefix: string; suffix: string };
 
+/**
+ * Whether an injected text block matches any of the given matchers. A plain
+ * string matches by prefix; a `{ prefix, suffix }` wrapper requires both ends
+ * so user-authored text merely opening with an injection-like tag is kept.
+ */
+function textBlockMatchesInjection(
+  text: string,
+  matchers: InjectionMatcher[],
+): boolean {
+  return matchers.some((m) =>
+    typeof m === "string"
+      ? text.startsWith(m)
+      : text.startsWith(m.prefix) && text.endsWith(m.suffix),
+  );
+}
+
+/** Drop the matching injection text blocks from a single content array. */
+function filterInjectionBlocks(
+  content: Message["content"],
+  matchers: InjectionMatcher[],
+): Message["content"] {
+  return content.filter(
+    (block) =>
+      block.type !== "text" || !textBlockMatchesInjection(block.text, matchers),
+  );
+}
+
 /**
  * Remove text blocks from user messages that match any of the given matchers.
  * If stripping removes all content blocks from a message, the message itself
@@ -43,14 +70,7 @@ export function stripUserTextBlocksByPrefix(
   return messages
     .map((message) => {
       if (message.role !== "user") return message;
-      const nextContent = message.content.filter((block) => {
-        if (block.type !== "text") return true;
-        return !matchers.some((m) =>
-          typeof m === "string"
-            ? block.text.startsWith(m)
-            : block.text.startsWith(m.prefix) && block.text.endsWith(m.suffix),
-        );
-      });
+      const nextContent = filterInjectionBlocks(message.content, matchers);
       if (nextContent.length === message.content.length) return message;
       if (nextContent.length === 0) return null;
       return { ...message, content: nextContent };
@@ -60,6 +80,30 @@ export function stripUserTextBlocksByPrefix(
     );
 }
 
+/**
+ * Tail-scoped variant of {@link stripUserTextBlocksByPrefix}: remove matching
+ * text blocks from ONLY the last message, and only when that message is a user
+ * message. This mirrors the runtime injection step, which applies every
+ * per-turn block to the tail user message, so clearing the tail's stale copies
+ * before re-injection makes re-injection idempotent.
+ *
+ * The tail message is retained even if all of its blocks are removed, so the
+ * role-`"user"` tail invariant the re-injection step relies on is preserved.
+ * Earlier messages are untouched, so per-message historical grounding (e.g.
+ * each turn's `<turn_context>`) survives and the stable cached prefix — which
+ * lives entirely before the tail — is never disturbed.
+ */
+export function stripTailUserTextBlocksByPrefix(
+  messages: Message[],
+  matchers: InjectionMatcher[],
+): Message[] {
+  const last = messages[messages.length - 1];
+  if (!last || last.role !== "user") return messages;
+  const nextContent = filterInjectionBlocks(last.content, matchers);
+  if (nextContent.length === last.content.length) return messages;
+  return [...messages.slice(0, -1), { ...last, content: nextContent }];
+}
+
 /**
  * Full-wrapper matcher for the memory-v3 ephemeral `<memory_spotlight>` block.
  * Shared by the per-turn scoped strip ({@link stripSpotlightInjections}) and
@@ -88,8 +132,12 @@ export const NOW_SCRATCHPAD_STRIP_PREFIXES: InjectionMatcher[] = [
   "<now_scratchpad>",
 ];
 
-/** Matchers stripped by the pipeline (order doesn't matter — single pass). */
-const RUNTIME_INJECTION_PREFIXES: InjectionMatcher[] = [
+/**
+ * Matchers stripped by the compaction pipeline (order doesn't matter — single
+ * pass). Exported so the post-compaction re-injection path can reuse this set
+ * as the base of its idempotency strip without duplicating it.
+ */
+export const RUNTIME_INJECTION_PREFIXES: InjectionMatcher[] = [
   "<channel_capabilities>",
   "<channel_command_context>",
   "<disk_pressure_warning>",

package/src/context/token-estimator.ts

@@ -305,7 +305,7 @@ export function estimateMessagesTokens(
 }
 
 /** Estimate token cost for a single tool definition. */
-function estimateToolDefinitionTokens(tool: ToolDefinition): number {
+export function estimateToolDefinitionTokens(tool: ToolDefinition): number {
   return (
     TOOL_DEFINITION_OVERHEAD_TOKENS +
     estimateTextTokens(tool.name) +

package/src/daemon/__tests__/conversation-lifecycle-auto-analyze.test.ts

@@ -236,8 +236,9 @@ describe("disposeConversation — auto-analysis enqueue", () => {
 
   test("untrusted conversation — enqueues neither graph_extract nor conversation_analyze", () => {
     // `unknown` is the trust class used for untrusted actors. The disposal
-    // code short-circuits on `isUntrustedTrustClass()` so neither enqueue
-    // path should fire. This preserves the memory trust boundary.
+    // code short-circuits when `resolveCapabilities(trustClass).canAccessMemory`
+    // is false, so neither enqueue path should fire. This preserves the
+    // memory trust boundary.
     const ctx = makeDisposeContext({
       conversationId: "conv-untrusted",
       trustClass: "unknown",

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -1184,6 +1184,7 @@ export async function finalizePendingToolResultRow(
     let provenanceTrustClass:
       | "guardian"
       | "trusted_contact"
+      | "unverified_contact"
       | "unknown"
       | undefined;
     let automated: boolean | undefined;
@@ -1845,6 +1846,7 @@ export async function handleMessageComplete(
     let provenanceTrustClass:
       | "guardian"
       | "trusted_contact"
+      | "unverified_contact"
       | "unknown"
       | undefined;
     let automated: boolean | undefined;

package/src/daemon/conversation-agent-loop.ts

@@ -70,9 +70,9 @@ import type { UserPromptSubmitContext } from "../plugin-api/types.js";
 import { runHook } from "../plugins/pipeline.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
-import { isUntrustedTrustClass } from "../runtime/actor-trust-resolver.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import type { ActivationMomentParam } from "../telemetry/activation-funnel.js";
 import type { UsageActor } from "../usage/actors.js";
@@ -187,6 +187,67 @@ export interface AssistantSurface {
   activationMoment?: ActivationMomentParam;
 }
 
+// ── abort watchdog ───────────────────────────────────────────────────
+
+/**
+ * Generous backstop that drives an aborted turn to its `finally` even if some
+ * awaited operation fails to observe the abort signal.
+ *
+ * Abort is otherwise cooperative and already wired into the slow paths: the
+ * provider call forwards the signal to its HTTP/streaming fetch, and tool
+ * execution races the signal so a stuck tool can't block cancellation. This
+ * watchdog only fires when a future code path silently ignores abort — without
+ * it, such a path would hang the loop forever and latch the conversation's
+ * `processing` flag true (the wedged "Thinking…" indicator). It is
+ * defense-in-depth, not the primary mechanism, so the timeout is deliberately
+ * generous; in the common case abort settles in-flight work well before it.
+ */
+const ABORT_WATCHDOG_MS = 45_000;
+
+/**
+ * Race `work` against an abort watchdog. The watchdog stays disarmed until the
+ * signal fires; once it does, the turn has `timeoutMs` to settle before the
+ * watchdog rejects with the signal's own abort reason so the caller unwinds to
+ * its `finally` and the reason classifies as a user cancellation downstream.
+ * The abandoned `work` promise keeps running detached — its eventual rejection
+ * is swallowed so it can't surface as an unhandled rejection.
+ */
+async function withAbortWatchdog<T>(
+  work: Promise<T>,
+  signal: AbortSignal,
+  timeoutMs: number,
+  onFire: () => void,
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let onAbort: (() => void) | undefined;
+  const watchdog = new Promise<never>((_, reject) => {
+    const arm = () => {
+      timer = setTimeout(() => {
+        onFire();
+        // Propagate the signal's own reason (an `AbortReason` for daemon-owned
+        // cancels) so the loop's catch classifies this as a user cancellation;
+        // fall back to a tagged AbortError when the signal carries no reason.
+        reject(
+          signal.reason ??
+            new DOMException("The operation was aborted", "AbortError"),
+        );
+      }, timeoutMs);
+    };
+    if (signal.aborted) arm();
+    else {
+      onAbort = arm;
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+  });
+  try {
+    return await Promise.race([work, watchdog]);
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+    void work.catch(() => {});
+  }
+}
+
 // ── runAgentLoop ─────────────────────────────────────────────────────
 
 export async function runAgentLoopImpl(
@@ -902,22 +963,36 @@ export async function runAgentLoopImpl(
       msgs: Message[],
       compactInPlace = false,
     ): Promise<Message[]> => {
-      const { history, exitReason, newMessages } = await ctx.agentLoop.run({
-        messages: msgs,
-        onEvent: eventHandler,
-        signal: abortController.signal,
-        requestId: reqId,
-        onCheckpoint,
-        callSite: turnCallSite,
-        trust: loopTrust,
-        overrideProfile: turnOverrideProfile,
-        ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
-        resolveOverrideProfile: resolveCurrentOverrideProfile,
-        resolveContextWindow,
-        compactInPlace,
-        isNonInteractive,
-        modelProfileKey,
-      });
+      const watchdogMs = ctx.abortWatchdogMs ?? ABORT_WATCHDOG_MS;
+      const { history, exitReason, newMessages } = await withAbortWatchdog(
+        ctx.agentLoop.run({
+          messages: msgs,
+          onEvent: eventHandler,
+          signal: abortController.signal,
+          requestId: reqId,
+          onCheckpoint,
+          callSite: turnCallSite,
+          trust: loopTrust,
+          overrideProfile: turnOverrideProfile,
+          ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
+          resolveOverrideProfile: resolveCurrentOverrideProfile,
+          resolveContextWindow,
+          compactInPlace,
+          isNonInteractive,
+          modelProfileKey,
+        }),
+        abortController.signal,
+        watchdogMs,
+        () =>
+          rlog.error(
+            {
+              conversationId: ctx.conversationId,
+              requestId: reqId,
+              timeoutMs: watchdogMs,
+            },
+            "Abort watchdog fired — agent loop did not settle after cancel; forcing turn to finally",
+          ),
+      );
       lastRunNewMessages = newMessages;
       if (exitReason === "handoff") {
         yieldedForHandoff = true;
@@ -1450,6 +1525,12 @@ export async function runAgentLoopImpl(
 
     ctx.profiler.emitSummary(ctx.traceEmitter, reqId);
 
+    // Tear down this turn's per-turn state. Abort reliably drives the loop to
+    // this `finally` within a bounded time — cooperative signal propagation
+    // (provider fetch + tool race) backed by the abort watchdog — so a
+    // cancelled turn always unwinds before any resend can start a new one.
+    // There is therefore only ever one turn alive, and clearing the shared
+    // state below cannot clobber a concurrent turn.
     ctx.abortController = null;
     ctx.setProcessing(false);
     ctx.onConfirmationOutcome = undefined;
@@ -1589,9 +1670,9 @@ export async function applyCompactionResult(
   // in-context boundary rather than the raw mirror so the persisted count
   // stays consistent with what the new summary represents and never
   // double-counts an unsliced untrusted view.
-  const inContextCompactedCount = isUntrustedTrustClass(
+  const inContextCompactedCount = !resolveCapabilities(
     ctx.trustContext?.trustClass,
-  )
+  ).canAccessMemory
     ? 0
     : ctx.contextCompactedMessageCount;
   ctx.contextCompactedMessageCount =

package/src/daemon/conversation-history.ts

@@ -23,7 +23,7 @@ const log = getLogger("conversation-history");
 
 // ── Helpers ──────────────────────────────────────────────────────────
 
-function isToolResultBlock(
+export function isToolResultBlock(
   block: ContentBlock | Record<string, unknown>,
 ): boolean {
   return (

package/src/daemon/conversation-lifecycle.ts

@@ -16,10 +16,8 @@ import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
 import { disposeContextWindowManager } from "../plugins/defaults/compaction/manager-store.js";
 import type { ContentBlock, Message } from "../providers/types.js";
-import {
-  isUntrustedTrustClass,
-  type TrustClass,
-} from "../runtime/actor-trust-resolver.js";
+import { type TrustClass } from "../runtime/actor-trust-resolver.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import { unregisterConversationSender } from "../tools/browser/browser-screencast.js";
 import { type AbortReason, createAbortReason } from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
@@ -147,7 +145,7 @@ export function disposeConversation(ctx: DisposeContext): void {
   // Trigger graph extraction for end-of-conversation sweep.
   // Only extract from guardian conversations to preserve the memory trust
   // boundary — untrusted content must not influence future memory retrieval.
-  if (!isUntrustedTrustClass(ctx.trustContext?.trustClass)) {
+  if (resolveCapabilities(ctx.trustContext?.trustClass).canAccessMemory) {
     // Recursion guard: skip graph_extract for auto-analysis conversations.
     // The analysis agent writes memory directly via tools, so extracting
     // from its reflective musings would double-write into the memory graph.

package/src/daemon/conversation-process.ts

@@ -28,7 +28,10 @@ import {
 import { extractPreferences } from "../notifications/preference-extractor.js";
 import { createPreference } from "../notifications/preferences-store.js";
 import type { ContextWindowResult } from "../plugins/defaults/compaction/window-manager.js";
-import { routeGuardianReply } from "../runtime/guardian-reply-router.js";
+import {
+  type GuardianPendingScope,
+  routeGuardianReply,
+} from "../runtime/guardian-reply-router.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import { getLogger } from "../util/logger.js";
 import type { CleanResult, Conversation } from "./conversation.js";
@@ -153,7 +156,7 @@ function resolveQueuedTurnInterfaceContext(
 }
 
 /** Build a SlashContext from the current conversation state and config. */
-function buildSlashContext(
+export function buildSlashContext(
   content: string,
   conversation: Conversation,
 ): SlashContext | undefined {
@@ -1407,9 +1410,14 @@ export async function processMessage(
           "vellum",
         ).map((request) => request.id)
       : [];
-  const canonicalPendingRequestIdsForConversation =
+  // Empty hints → leave the scope unset (identity-fallback): the desktop
+  // guardian can still resolve their pending work by identity/principal.
+  const pendingScope: GuardianPendingScope | undefined =
     canonicalPendingRequestHintIdsForConversation.length > 0
-      ? canonicalPendingRequestHintIdsForConversation
+      ? {
+          mode: "scoped",
+          requestIds: canonicalPendingRequestHintIdsForConversation,
+        }
       : undefined;
 
   // ── Canonical guardian reply router (desktop/conversation path) ──
@@ -1428,7 +1436,7 @@ export async function processMessage(
           conversation.trustContext?.guardianPrincipalId ?? undefined,
       },
       conversationId: conversation.conversationId,
-      pendingRequestIds: canonicalPendingRequestIdsForConversation,
+      pendingScope,
       // Desktop path: disable NL classification to avoid consuming non-decision
       // messages while a tool confirmation is pending. Deterministic code-prefix
       // and callback parsing remain active.

package/src/daemon/conversation-runtime-assembly.ts

@@ -9,9 +9,9 @@ import { statSync } from "node:fs";
 import { join } from "node:path";
 
 import { type ChannelId, parseInterfaceId } from "../channels/types.js";
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
+import { isMemoryV3Live } from "../config/memory-v3-gate.js";
 import type { LLMCallSite, LLMConfig } from "../config/schemas/llm.js";
 import {
   NOW_SCRATCHPAD_STRIP_PREFIXES,
@@ -62,11 +62,11 @@ import type {
 import type { ContentBlock, Message } from "../providers/types.js";
 import {
   type ActorTrustContext,
-  isUntrustedTrustClass,
   resolveActorTrust,
   type TrustClass,
 } from "../runtime/actor-trust-resolver.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import { channelStatusToMemberStatus } from "../runtime/routes/inbound-stages/acl-enforcement.js";
 import { getSubagentManager } from "../subagent/index.js";
 import type { SubagentState } from "../subagent/types.js";
@@ -125,8 +125,8 @@ export interface InboundActorContext {
   actorSenderDisplayName?: string;
   /** Guardian-managed display name from the contact record. */
   actorMemberDisplayName?: string;
-  /** Trust classification: guardian, trusted_contact, or unknown. */
-  trustClass: "guardian" | "trusted_contact" | "unknown";
+  /** Trust classification: see TrustClass. */
+  trustClass: TrustClass;
   /** Guardian identity for this (assistant, channel) binding. */
   guardianIdentity?: string;
   /** Member status when the actor has a contact record. */
@@ -916,7 +916,7 @@ function filterSlackConversationRowsForActor(
   rows: MessageRow[],
   trustClass: TrustClass | undefined,
 ): MessageRow[] {
-  if (!isUntrustedTrustClass(trustClass)) return rows;
+  if (resolveCapabilities(trustClass).canAccessMemory) return rows;
   const nonSlackVisibleRows = filterMessagesForUntrustedActor(rows);
   const nonSlackVisibleIds = new Set(nonSlackVisibleRows.map((row) => row.id));
   return rows.filter((row) => {
@@ -1009,6 +1009,7 @@ function rowToRenderable(row: SlackTranscriptInputRow): RenderableSlackMessage {
       if (
         outer.provenanceTrustClass === "guardian" ||
         outer.provenanceTrustClass === "trusted_contact" ||
+        outer.provenanceTrustClass === "unverified_contact" ||
         outer.provenanceTrustClass === "unknown"
       ) {
         provenanceTrustClass = outer.provenanceTrustClass;
@@ -1322,9 +1323,9 @@ export function loadSlackChronologicalContext(
     options,
   );
   return assembleSlackChronologicalContext(rows, capabilities, {
-    contextSummary: isUntrustedTrustClass(options.trustClass)
-      ? null
-      : options.contextSummary,
+    contextSummary: resolveCapabilities(options.trustClass).canAccessMemory
+      ? options.contextSummary
+      : null,
   });
 }
 
@@ -1536,8 +1537,8 @@ export interface RuntimeInjectionBlocks {
    */
   memoryV3InjectedBlock?: string;
   /**
-   * True when memory-v3 superseded v2 as this turn's `<memory>` source — the
-   * `memory-v3-live` flag is on AND the v3 injector produced a block (possibly
+   * True when memory-v3 superseded v2 as this turn's `<memory>` source —
+   * `memory.v3.live` is on AND the v3 injector produced a block (possibly
    * empty-text on an all-repeat turn), i.e. exactly when assembly stripped
    * v2's fresh tail block. The user-prompt-submit hook keys v2's
    * `memoryInjectedBlock` metadata persist off this so a stripped v2 block is
@@ -2177,7 +2178,7 @@ export async function applyRuntimeInjections(
   // no-op, keeping the v2 path bit-for-bit identical.
   let runMessagesForAssembly = stripSpotlightInjections(runMessages);
 
-  // v2 suppression: when the `memory-v3-live` flag is on AND the v3 injector
+  // v2 suppression: when `memory.v3.live` is on AND the v3 injector
   // produced a block this turn (possibly empty-text on an all-repeat turn), v3
   // owns the `<memory>` layer. v2's `prepareMemory` already prepended its own
   // fresh `<memory>` block to the tail user message — strip the TAIL's v2
@@ -2196,10 +2197,7 @@ export async function applyRuntimeInjections(
   // (`produce()` → null) leaves v2's block intact — fallback rather than a
   // memory-less turn. Idempotent: re-injection sites that already stripped
   // see no change. Flag off → bit-for-bit identical to the v2 path.
-  const suppressV2MemoryForV3 = isAssistantFeatureFlagEnabled(
-    "memory-v3-live",
-    getConfig(),
-  );
+  const suppressV2MemoryForV3 = isMemoryV3Live(getConfig());
   const v3ProducedBlock = afterMemory.some((b) => b.id === MEMORY_V3_BLOCK_ID);
   const memoryV3Active = suppressV2MemoryForV3 && v3ProducedBlock;
   if (memoryV3Active) {