@yeaft/webchat-agent 0.1.704 → 0.1.706

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "0.1.704",
+  "version": "0.1.706",
   "description": "Remote agent for Yeaft WebChat — connects worker machines to the central server",
   "main": "index.js",
   "type": "module",

package/unify/archive/tool-results.js

@@ -151,7 +151,15 @@ export async function archiveToolResults({
   };
 }
 
-function formatSize(bytes) {
+/**
+ * Format a byte count as a short human-readable string ("1.5KB", "2.0MB").
+ * Exported so other size-aware helpers (tool-result truncation in the
+ * registry) format identically.
+ *
+ * @param {number} bytes
+ * @returns {string}
+ */
+export function formatSize(bytes) {
   if (bytes < 1024) return `${bytes}B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;

package/unify/engine.js

@@ -34,9 +34,11 @@ import { runStopHooks } from './stop-hooks.js';
 // the constant 'main'.
 const MAIN_THREAD_ID = 'main';
 import { pickEffort, parseEffortPrefix } from './effort.js';
-import { normalizeEffort } from './models.js';
+import { normalizeEffort, resolveContextWindow } from './models.js';
 import { attachRouterPlan, extractPriorPlan, stripMetaForWire } from './router/continuity.js';
 import { resolveThinking } from './router/thinking.js';
+import { approxTokens } from './memory/budget.js';
+import { truncateToolResultIfNeeded } from './tools/registry.js';
 import {
   TOOL_BATCH_SIZE,
   TURN_SUMMARY_THRESHOLD,
@@ -100,6 +102,64 @@ export function mapDebugMessage(m) {
   return out;
 }
 
+/**
+ * task-704b — estimate the total token cost of a system prompt + a
+ * messages array. Used by the pre-flight guard before adapter.stream()
+ * to decide whether to run an emergency archive sweep.
+ *
+ * Why estimate, not exact: a real tokenizer (tiktoken, claude-tokenizer)
+ * adds a heavy dep + per-turn cost for what is fundamentally a guard
+ * rail. `approxTokens` (char/4 with CJK weighting) is the same
+ * estimator the AMS budget code uses; it is monotonic in payload size
+ * and that is the only property the guard rail needs. False positives
+ * cost an unnecessary archive sweep (cheap); false negatives let a
+ * runaway request through (expensive — that is exactly the bug we are
+ * fixing).
+ *
+ * Multi-modal messages: `content` may be an array of content parts
+ * (Anthropic / OpenAI Responses shape). Text parts use approxTokens;
+ * image parts get a fixed 1024-token estimate — a rough average across
+ * vision pricing models. Exact pricing isn't the goal; "this is roughly
+ * how much of the window the message will consume" is.
+ *
+ * @param {string} system
+ * @param {Array<{role:string, content?:any, toolCalls?:Array}>} messages
+ * @returns {number}
+ */
+export function estimateMessagesTokens(system, messages) {
+  let total = approxTokens(typeof system === 'string' ? system : '');
+  if (!Array.isArray(messages)) return total;
+  for (const m of messages) {
+    if (!m) continue;
+    const c = m.content;
+    if (typeof c === 'string') {
+      total += approxTokens(c);
+    } else if (Array.isArray(c)) {
+      for (const part of c) {
+        if (!part) continue;
+        if (part.type === 'text') {
+          // Coerce defensively — a non-string `text` (number, Buffer,
+          // object) would otherwise throw inside approxTokens and abort
+          // the pre-flight estimate, defeating the guard rail.
+          total += approxTokens(typeof part.text === 'string' ? part.text : '');
+        } else if (part.type === 'image') {
+          total += 1024;
+        }
+        // Other multi-modal parts (audio etc.) — skip; not produced today.
+      }
+    }
+    if (Array.isArray(m.toolCalls)) {
+      for (const tc of m.toolCalls) {
+        try {
+          total += approxTokens(JSON.stringify(tc.input || {}));
+        } catch { /* circular — ignore */ }
+        total += approxTokens(typeof tc.name === 'string' ? tc.name : '');
+      }
+    }
+  }
+  return total;
+}
+
 // ─── Engine Events (superset of adapter events) ──────────────────
 
 /**
@@ -603,6 +663,11 @@ export class Engine {
       conversationStore: this.#conversationStore,
       adapter: this.#adapter,
       config: this.#config,
+      // task-704b: per-tool-result hard cap derives from this. Threaded
+      // from the live model (resolveModel(currentModel)) every turn so
+      // fallbackModel switches see the new window. Falls back to
+      // config.maxContextTokens, then 200K, in registry.js.
+      contextWindow: vpCtx?.contextWindow,
       // ViewImage (task-333b PR-B rev-3 P1-A): expose size cap + allowlist
       // via tool ctx so hosts can override via ~/.yeaft/config.json without
       // touching the tool impl.
@@ -1152,6 +1217,17 @@ export class Engine {
         if (exchange?.rawResponse) rawResponse = exchange.rawResponse;
       };
 
+      // task-704b: resolve the live model's context window for this turn.
+      // Used by the per-tool-result cap (passed via toolCtx) and the
+      // pre-flight total-token guard inside the try-block. Hoisted out of
+      // the try so toolCtx (built after the adapter stream) can see it.
+      // Re-resolved every turn because fallbackModel switches change
+      // `currentModel` mid query() — the cap MUST track the model we're
+      // actually about to call. Single resolver in models.js owns the
+      // fallback ladder (registry → config → default) so engine.js and
+      // tools/registry.js can never disagree.
+      const currentContextWindow = resolveContextWindow(currentModel, this.#config);
+
       yield { type: 'turn_start', turnNumber };
 
       try {
@@ -1203,6 +1279,7 @@ export class Engine {
         // message_trace can fetch it on demand. The stub keeps the
         // OpenAI/Anthropic toolCallId pairing intact.
         let wireMessages = stripMetaForWire([...conversationMessages]);
+
         if (this.#yeaftDir && (this.#config?.archive?.toolResults !== false)) {
           try {
             const swept = await archiveToolResults({
@@ -1224,6 +1301,52 @@ export class Engine {
           } catch { /* best-effort */ }
         }
 
+        // task-704b: pre-flight total-token guard. Even with the per-tool
+        // cap (registry.js: 10% of contextWindow per result), N tool
+        // results plus history can still breach the wire limit before we
+        // ever call adapter.stream(). Estimate the total token cost; if
+        // it exceeds PREFLIGHT_RATIO of the live context window, run an
+        // emergency archive sweep with `turnAgeMin: 0` so even
+        // current-turn-but-not-this-call bulky results get stubbed. The
+        // normal sweep above only stubs results older than 5 user turns
+        // — that's the wrong cadence when the *current* turn already has
+        // 4 large grep results.
+        //
+        // PREFLIGHT_RATIO = 0.85 leaves ~15% of the window for the model's
+        // own output tokens + tools metadata + light future history.
+        // The estimator (`estimateMessagesTokens`) is approxTokens
+        // (char/4 with CJK weighting) — good enough for a guard rail; a
+        // real tokenizer would be exact but adds a heavy dep.
+        if (this.#yeaftDir && (this.#config?.archive?.toolResults !== false)) {
+          const PREFLIGHT_RATIO = 0.85;
+          const threshold = Math.floor(currentContextWindow * PREFLIGHT_RATIO);
+          const estimate = estimateMessagesTokens(systemPrompt, wireMessages);
+          if (estimate > threshold) {
+            try {
+              const sweep = await archiveToolResults({
+                root: `${this.#yeaftDir}/memory`,
+                scopeDir: 'user',
+                messages: wireMessages,
+                turnAgeMin: 0,
+                lengthMin: this.#config?.archive?.lengthMin ?? 2000,
+              });
+              wireMessages = sweep.nextMessages;
+              if (sweep.archivedCount > 0) {
+                for (let i = 0; i < conversationMessages.length; i += 1) {
+                  conversationMessages[i] = wireMessages[i];
+                }
+                this.#trace.log?.('preflight_sweep', {
+                  archivedCount: sweep.archivedCount,
+                  archivedBytes: sweep.archivedBytes,
+                  estimateBefore: estimate,
+                  threshold,
+                  contextWindow: currentContextWindow,
+                });
+              }
+            } catch { /* best-effort */ }
+          }
+        }
+
         // Stream from adapter
         for await (const event of this.#adapter.stream({
           model: currentModel,
@@ -1555,7 +1678,7 @@ export class Engine {
       }
 
       // Execute tool calls and feed results back
-      const toolCtx = this.#buildToolContext(signal, { router, senderVpId, inboundEnvelope, taskId, taskMembers, vpPersona });
+      const toolCtx = this.#buildToolContext(signal, { router, senderVpId, inboundEnvelope, taskId, taskMembers, vpPersona, contextWindow: currentContextWindow });
 
       // task-325a: track whether we aborted mid tool-loop so we can
       // break out of the outer while-loop cleanly once the current
@@ -1624,7 +1747,14 @@ export class Engine {
               output = await this.#toolRegistry.execute(tc.name, tc.input, toolCtx);
             } else {
               const tool = this.#tools.get(tc.name);
-              output = await tool.execute(tc.input, { signal });
+              const rawOutput = await tool.execute(tc.input, { signal });
+              // task-704b: legacy #tools branch must apply the same per-tool
+              // cap as ToolRegistry.execute. Otherwise a deployment using
+              // the legacy registration path bypasses the defense entirely.
+              output = truncateToolResultIfNeeded(rawOutput, {
+                contextWindow: currentContextWindow,
+                toolName: tc.name,
+              });
             }
             yield { type: 'tool_end', id: tc.id, name: tc.name, output, isError: false, threadId: this.currentThreadId };
           } catch (err) {

package/unify/groups/group-crud.js

@@ -34,6 +34,7 @@
 
 import { existsSync, renameSync, rmSync, readdirSync, statSync } from 'fs';
 import { randomBytes } from 'crypto';
+import { homedir } from 'os';
 import { join } from 'path';
 import {
   openGroup, createGroup, listGroups, loadGroupMeta,
@@ -42,6 +43,40 @@ import { addVp as rosterAdd, removeVp as rosterRemove, setDefaultVp } from './ro
 import { seedDefaultGroup, DEFAULT_GROUP_ID } from './seed-default.js';
 import { nextGroupId, validateVpId, isReservedVpId } from './ids.js';
 import { scanVpLibrary, DEFAULT_VP_LIB_DIR } from '../vp/vp-store.js';
+import { seedSummaryIfMissingSync, removeScopeDirSync } from '../memory/store-v2.js';
+
+/**
+ * Default memory root used when callers don't pass `options.memoryRoot`.
+ * See `vp/vp-crud.js` for the same default; production code threads
+ * `<yeaftDir>/memory` through to keep test/prod isolation honest.
+ */
+const DEFAULT_MEMORY_ROOT = join(homedir(), '.yeaft', 'memory');
+
+/**
+ * Build the group seed summary body. Uses the group display name + roster
+ * so even an empty conversation has SOMETHING for engine.#prepareAms to
+ * pull into the Layer-A resident summary on the very first turn.
+ *
+ * Format is intentionally short: Dream-v2 will rewrite it in full once
+ * meaningful diffs accumulate.
+ *
+ * @param {{name:string, roster?:string[], defaultVpId?:string|null}} spec
+ * @returns {string}
+ */
+export function buildGroupSeedSummary(spec) {
+  const name = String(spec?.name || '').trim();
+  const roster = Array.isArray(spec?.roster) ? spec.roster : [];
+  const lines = [];
+  if (name) lines.push(`# ${name}`);
+  lines.push('', `Group with ${roster.length} member${roster.length === 1 ? '' : 's'}.`);
+  if (roster.length > 0) {
+    lines.push('', `**Members:** ${roster.join(', ')}`);
+  }
+  if (spec?.defaultVpId) {
+    lines.push('', `**Default VP:** ${spec.defaultVpId}`);
+  }
+  return lines.join('\n').trim();
+}
 
 export class GroupCrudError extends Error {
   constructor(code, groupId, message) {
@@ -78,6 +113,7 @@ export function makeGroupId(name) {
  */
 export function ensureDefaultGroupIfEmpty(yeaftDir, options = {}) {
   const libDir = options.libDir || DEFAULT_VP_LIB_DIR;
+  const memoryRoot = options.memoryRoot || DEFAULT_MEMORY_ROOT;
   const existing = listGroups(groupsRoot(yeaftDir));
   if (existing.length > 0) {
     return { seeded: false, groupId: existing[0].id };
@@ -95,6 +131,7 @@ export function ensureDefaultGroupIfEmpty(yeaftDir, options = {}) {
     name: options.name || 'Default',
     roster: vps,
     defaultVpId,
+    memoryRoot,
   });
   return {
     seeded: created,
@@ -112,7 +149,8 @@ export function ensureDefaultGroupIfEmpty(yeaftDir, options = {}) {
  * @param {{name:string, roster?:string[], defaultVpId?:string|null}} spec
  * @returns {{id:string, name:string, roster:string[], defaultVpId:string|null}}
  */
-export function createGroupFromSpec(yeaftDir, spec) {
+export function createGroupFromSpec(yeaftDir, spec, options = {}) {
+  const memoryRoot = options.memoryRoot || DEFAULT_MEMORY_ROOT;
   const name = String(spec && spec.name || '').trim();
   if (!name) throw new GroupCrudError('invalid_name', null, 'group name required');
 
@@ -145,6 +183,20 @@ export function createGroupFromSpec(yeaftDir, spec) {
   const handle = createGroup(root, { id, name, roster, defaultVpId });
   const meta = handle.getMeta();
   handle.close();
+
+  // Seed Layer-A resident summary so the first session has memory content
+  // even before Dream-v2 has run. No-op if a summary.md already exists.
+  // Best-effort: a memory-root permission failure must NOT break group create.
+  try {
+    seedSummaryIfMissingSync(
+      { kind: 'group', id },
+      buildGroupSeedSummary({ name, roster, defaultVpId }),
+      { root: memoryRoot },
+    );
+  } catch (err) {
+    console.warn(`[group-crud] failed to seed summary.md for ${id}:`, err?.message || err);
+  }
+
   return meta;
 }
 
@@ -216,7 +268,8 @@ export function archiveGroup(yeaftDir, groupId) {
  * behind by the previous soft-archive implementation, so a single
  * delete cleans up legacy state too.
  */
-export function deleteGroup(yeaftDir, groupId) {
+export function deleteGroup(yeaftDir, groupId, options = {}) {
+  const memoryRoot = options.memoryRoot || DEFAULT_MEMORY_ROOT;
   const root = groupsRoot(yeaftDir);
   const srcDir = join(root, groupId);
   const liveExists = existsSync(srcDir) && !!loadGroupMeta(srcDir);
@@ -246,6 +299,14 @@ export function deleteGroup(yeaftDir, groupId) {
     rmSync(dir, { recursive: true, force: true });
   }
 
+  // Cascade: drop the group's memory scope so a recreate with the same id
+  // starts clean. Best-effort — never let memory cleanup fail the CRUD op.
+  try {
+    removeScopeDirSync({ kind: 'group', id: groupId }, { root: memoryRoot });
+  } catch (err) {
+    console.warn(`[group-crud] failed to remove memory dir for ${groupId}:`, err?.message || err);
+  }
+
   return { groupId, deleted: true, legacyCleanedUp: legacyDirs.length };
 }
 

package/unify/groups/seed-default.js

@@ -14,16 +14,47 @@
 
 import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
+import { homedir } from 'os';
 import { openGroup, createGroup, loadGroupMeta } from './group-store.js';
+import { seedSummaryIfMissingSync } from '../memory/store-v2.js';
 
 export const DEFAULT_GROUP_ID = 'grp_default';
 
+/**
+ * Default memory root used when callers don't pass `options.memoryRoot`.
+ * See `groups/group-crud.js` and `vp/vp-crud.js` for the same default;
+ * production code threads `<yeaftDir>/memory` through to keep test/prod
+ * isolation honest.
+ */
+const DEFAULT_MEMORY_ROOT = join(homedir(), '.yeaft', 'memory');
+
+/**
+ * Build the default-group seed summary body. Pulled into a helper so
+ * tests can pin the exact format. Mirrors `buildGroupSeedSummary` in
+ * `group-crud.js` shape, with the "Default group" wording reserved for
+ * the bootstrap path.
+ *
+ * @param {{ name?: string, roster?: string[], defaultVpId?: string|null }} spec
+ * @returns {string}
+ */
+export function buildDefaultGroupSeedSummary(spec) {
+  const name = String(spec?.name || 'Default').trim();
+  const roster = Array.isArray(spec?.roster) ? spec.roster : [];
+  const defaultVpId = spec?.defaultVpId || null;
+  const lines = [`# ${name}`, ''];
+  lines.push(`Default group with ${roster.length} member${roster.length === 1 ? '' : 's'}.`);
+  if (roster.length > 0) lines.push('', `**Members:** ${roster.join(', ')}`);
+  if (defaultVpId) lines.push('', `**Default VP:** ${defaultVpId}`);
+  return lines.join('\n').trim();
+}
+
 /**
  * @param {string} yeaftDir
- * @param {{ defaultVpId?: string|null, roster?: string[], name?: string }} [spec]
+ * @param {{ defaultVpId?: string|null, roster?: string[], name?: string, memoryRoot?: string }} [spec]
  * @returns {{ group: import('./group-store.js').GroupHandle, created: boolean }}
  */
 export function seedDefaultGroup(yeaftDir, spec = {}) {
+  const memoryRoot = spec.memoryRoot || DEFAULT_MEMORY_ROOT;
   const groupsRoot = join(yeaftDir, 'groups');
   if (!existsSync(groupsRoot)) mkdirSync(groupsRoot, { recursive: true });
 
@@ -36,12 +67,29 @@ export function seedDefaultGroup(yeaftDir, spec = {}) {
     ? spec.roster.slice()
     : (spec.defaultVpId ? [spec.defaultVpId] : []);
   const defaultVpId = spec.defaultVpId || roster[0] || null;
+  const name = spec.name || 'Default';
 
   const group = createGroup(groupsRoot, {
     id: DEFAULT_GROUP_ID,
-    name: spec.name || 'Default',
+    name,
     roster,
     defaultVpId,
   });
+
+  // Seed Layer-A resident summary so the very first session — even on a
+  // brand-new install where only `grp_default` exists — renders a non-
+  // empty memory section in the system prompt. No-op once Dream-v2 (or
+  // createGroupFromSpec) has already written one. Best-effort: a memory-
+  // root permission failure must NOT break the bootstrap flow.
+  try {
+    seedSummaryIfMissingSync(
+      { kind: 'group', id: DEFAULT_GROUP_ID },
+      buildDefaultGroupSeedSummary({ name, roster, defaultVpId }),
+      { root: memoryRoot },
+    );
+  } catch (err) {
+    console.warn(`[seed-default] failed to seed summary.md for ${DEFAULT_GROUP_ID}:`, err?.message || err);
+  }
+
   return { group, created: true };
 }

package/unify/history-compact.js

@@ -55,6 +55,7 @@ import { pairSanitize } from './pair-sanitize.js';
 import {
   countTurns as countTurnsImpl,
   indexOfNthTurnFromEnd,
+  sliceLastNTurns,
 } from './turn-utils.js';
 
 /**
@@ -65,27 +66,32 @@ import {
 export const countTurns = countTurnsImpl;
 
 /**
- * Default trigger thresholds (2026-05-01 policy update):
- *   - never compact while total tokens < 30K (soft floor — most
+ * Default trigger thresholds (2026-05-02 policy update):
+ *   - never compact while total tokens < 12K (soft floor — most short
  *     conversations under that aren't worth paying the summarizer
  *     cost; the LLM hasn't started feeling the context yet either),
  *   - otherwise compact if ANY of:
+ *       turnCount > 30           (back-stop for chats with many small turns)
  *       tokens > 40 % of `maxContextTokens` (default 200K → 80K)
  *       tokens > 200K hard ceiling
  *
- * The earlier "turn count > 20" trigger was DROPPED because under
- * the new floor it's effectively dead code — by the time you've sent
- * 20 user prompts that exceed 30K tokens, the fractional threshold
- * has already fired. `turnLimit` and the `turn_count` reason code
- * are still accepted as overrides so tests / future config can re-
- * enable a turn-based trigger if needed; with `turnLimit: Infinity`
- * (the new default) the check is simply skipped.
+ * Lowered from 30K → 12K and re-enabled a turn-count back-stop because
+ * the previous "soft floor of 30K, no turn cap" combination is dead in
+ * the multi-VP fan-out path: hundreds of small turns happily stay below
+ * 30K and never trigger compact, then `runVpTurn` feeds the whole 720+
+ * message snapshot to the LLM and trips the provider's context window.
+ * The snapshot trim in `web-bridge.js#trimSnapshotForBudget` is the
+ * primary defense; this is the second-line trigger that compresses
+ * the on-array form so subsequent turns also stay bounded.
+ *
+ * `turnLimit` and the `turn_count` reason code are still overridable
+ * for tests / future config.
  *
  * Token thresholds are derived from `maxContextTokens` at evaluation
  * time so the policy auto-adjusts to the user's configured context.
  */
-export const DEFAULT_TURN_LIMIT = Infinity;
-export const DEFAULT_MIN_TOKEN_FLOOR = 30_000;
+export const DEFAULT_TURN_LIMIT = 30;
+export const DEFAULT_MIN_TOKEN_FLOOR = 12_000;
 export const DEFAULT_MAX_CONTEXT_TOKENS = 200_000;
 export const DEFAULT_TOKEN_FRACTION = 0.4;
 export const DEFAULT_HARD_TOKEN_CEILING = 200_000;
@@ -106,6 +112,35 @@ export const DEFAULT_TOKEN_LIMIT = Math.min(
  */
 export const DEFAULT_KEEP_RECENT_TURNS = 2;
 
+/**
+ * Default cap on the number of turns kept in the per-call snapshot fed
+ * to `engine.query` (see `trimSnapshotForBudget` below). A turn here is
+ * one user-side prompt — multi-VP `@vp-X` variants of the same prompt
+ * collapse into one turn (see `turn-utils.js#countTurns`).
+ *
+ * Sized in conjunction with `DEFAULT_TURN_LIMIT` (30, the compact-trigger
+ * back-stop): trim to 25 leaves a 5-turn buffer below the compact trigger
+ * so a typical chat sees its history compacted before the trim starts
+ * dropping turns silently. That ordering matters — compact preserves the
+ * tail's lossless 2 turns AND a summary of everything older, whereas trim
+ * just discards anything beyond the cap.
+ *
+ * 25 turns at ~5 messages each (user + assistant + a couple tool steps)
+ * is roughly 100–125 messages — well under the LLM context window for
+ * any reasonable model, and large enough to preserve "what we've been
+ * talking about" context for the model. The hard token-budget cap inside
+ * `trimSnapshotForBudget` tightens this further when individual turns
+ * are large.
+ */
+export const DEFAULT_RECENT_TURN_CAP = 25;
+
+/**
+ * Default per-query token budget for the snapshot (separate from the
+ * `tokenLimit` used by compact triggers). Mirrors the historical default
+ * carried in `~/.yeaft/config.json`'s `messageTokenBudget` field.
+ */
+export const DEFAULT_MESSAGE_TOKEN_BUDGET = 8192;
+
 /**
  * Estimate the token weight of a single message including role overhead
  * and any tool-call structure. Mirrors `dream-v2/segment.js` approach: a
@@ -489,3 +524,69 @@ export async function compactHistory(messages, options) {
     afterTokens: after.tokenCount,
   };
 }
+
+/**
+ * Trim a snapshot of conversation messages so the per-call array fed
+ * to `engine.query` stays bounded.
+ *
+ * Two-stage policy:
+ *   1. **Turn cap** — keep at most `recentTurnCap` turns (default 25)
+ *      via `sliceLastNTurns`. This always cuts at a user-message
+ *      boundary and walks forward through `@vp-X` variants of the
+ *      cut turn so the slice is pair-safe.
+ *   2. **Token budget** — if the trimmed slice still exceeds
+ *      `messageTokenBudget` tokens (default 8192 from
+ *      `~/.yeaft/config.json`), iteratively drop the oldest turn until
+ *      we're under budget. We never drop below 1 turn — even a single
+ *      huge turn is preferable to no context.
+ *
+ * Then run `pairSanitize` as belt-and-suspenders to drop any orphan
+ * tool_use/tool_result that survived the cuts. The transform is
+ * idempotent and never mutates the input.
+ *
+ * Why this exists:
+ *   `runVpTurn` previously fed the entire `conversationMessages` array
+ *   into `engine.query` for every fan-out. With multi-VP turns the
+ *   array grows ~5–8 messages per user prompt, so after a few hundred
+ *   prompts the per-call payload exceeds 100 KB and routinely OOMs the
+ *   provider's context window. `compactHistory` only fires above its
+ *   token soft floor — small chats with many turns stay below that
+ *   floor but still bloat the messages array. This trim is the second-
+ *   line defense: it ALWAYS runs, before every query, regardless of
+ *   compact state.
+ *
+ * Lives in `history-compact.js` alongside `compactHistory` because
+ * both functions are part of the same "bound the messages array fed
+ * to the LLM" surface — keeping them together makes the relationship
+ * between trim (per-call) and compact (global) explicit.
+ *
+ * @param {Array<object>} snapshot
+ * @param {{ messageTokenBudget?: number, recentTurnCap?: number }} [opts]
+ * @returns {Array<object>}
+ */
+export function trimSnapshotForBudget(snapshot, opts = {}) {
+  if (!Array.isArray(snapshot) || snapshot.length === 0) return [];
+
+  const recentTurnCap = Number.isFinite(opts.recentTurnCap) && opts.recentTurnCap > 0
+    ? opts.recentTurnCap
+    : DEFAULT_RECENT_TURN_CAP;
+  const messageTokenBudget = Number.isFinite(opts.messageTokenBudget) && opts.messageTokenBudget > 0
+    ? opts.messageTokenBudget
+    : DEFAULT_MESSAGE_TOKEN_BUDGET;
+
+  // Stage 1: cap by turn count.
+  let trimmed = sliceLastNTurns(snapshot, recentTurnCap);
+
+  // Stage 2: cap by token budget. Drop oldest turn iteratively.
+  // We never drop below ~1 turn — pick a safety floor of 1.
+  let remainingTurnCap = recentTurnCap;
+  let tokens = estimateMessagesTokens(trimmed);
+  while (tokens > messageTokenBudget && remainingTurnCap > 1) {
+    remainingTurnCap--;
+    trimmed = sliceLastNTurns(trimmed, remainingTurnCap);
+    tokens = estimateMessagesTokens(trimmed);
+  }
+
+  // Stage 3: pair-sanitize to drop orphan tool_use/tool_result.
+  return pairSanitize(trimmed);
+}

package/unify/memory/seed-backfill.js

@@ -0,0 +1,177 @@
+/**
+ * memory/seed-backfill.js — Run-once backfill of `summary.md` for VPs and
+ * groups that were created BEFORE the create-time seed was added (PR
+ * "fix-unify-context-and-memory"). Without backfill, an existing user's
+ * `grp_claude` group and `steve` VP never get a Layer-A resident summary —
+ * `engine.#prepareAms` then renders an empty memory section every turn,
+ * which is the user-visible Bug #2.
+ *
+ * Idempotency:
+ *   - Reads `<root>/<scopeDir>/summary.md`. If it already has any non-
+ *     empty content, the backfill is a no-op for that scope.
+ *   - Only seeds when the file is missing OR empty.
+ *
+ * This runs sync at session boot. Failures are logged and swallowed —
+ * a permission error must NEVER prevent the session from loading.
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { parseRoleMd } from '../vp/vp-store.js';
+
+const DEFAULT_MEMORY_ROOT = join(homedir(), '.yeaft', 'memory');
+
+function readIfPresent(path) {
+  try {
+    if (!existsSync(path)) return '';
+    return readFileSync(path, 'utf-8').trim();
+  } catch {
+    return '';
+  }
+}
+
+function writeAtomicSync(path, body) {
+  mkdirSync(join(path, '..'), { recursive: true });
+  writeFileSync(path, (body || '').trim() + '\n', 'utf-8');
+}
+
+/**
+ * Build a synthetic VP summary from the on-disk role.md.
+ *
+ * Delegates frontmatter parsing to `vp-store.js#parseRoleMd` so the
+ * backfill stays in sync with the production loader. The earlier hand-
+ * rolled regex parser silently dropped quoted multi-line scalars and
+ * list-shaped fields — `parseRoleMd` covers both.
+ *
+ * @param {string} libDir
+ * @param {string} vpId
+ * @returns {string|null}
+ */
+function readVpRoleSummary(libDir, vpId) {
+  const rolePath = join(libDir, vpId, 'role.md');
+  if (!existsSync(rolePath)) return null;
+  let raw = '';
+  try { raw = readFileSync(rolePath, 'utf-8'); } catch { return null; }
+
+  const { meta, body } = parseRoleMd(raw);
+  const name = String(meta.name || vpId).trim() || vpId;
+  const role = typeof meta.role === 'string' ? meta.role.trim() : '';
+
+  const persona = typeof body === 'string' ? body.trim() : '';
+  const lines = [`# ${name}`];
+  if (role) lines.push('', `**Role:** ${role}`);
+  if (persona) {
+    const truncated = persona.length > 800 ? persona.slice(0, 800).trim() + '…' : persona;
+    lines.push('', '**Persona:**', '', truncated);
+  }
+  return lines.join('\n').trim();
+}
+
+/**
+ * Walk the VP library and seed `summary.md` for every VP without one.
+ *
+ * @param {{ libDir: string, root?: string }} opts
+ * @returns {{seeded: number, scanned: number}}
+ */
+export function backfillVpSummaries({ libDir, root = DEFAULT_MEMORY_ROOT }) {
+  let scanned = 0;
+  let seeded = 0;
+  if (!existsSync(libDir)) return { scanned, seeded };
+  let entries;
+  try { entries = readdirSync(libDir); } catch { return { scanned, seeded }; }
+  for (const name of entries) {
+    const vpDir = join(libDir, name);
+    let isDir = false;
+    try { isDir = statSync(vpDir).isDirectory(); } catch { /* skip */ }
+    if (!isDir) continue;
+    if (name.startsWith('.')) continue;
+    scanned++;
+    const summaryPath = join(root, 'vp', name, 'summary.md');
+    if (readIfPresent(summaryPath)) continue;
+    const body = readVpRoleSummary(libDir, name);
+    if (!body) continue;
+    try {
+      writeAtomicSync(summaryPath, body);
+      seeded++;
+    } catch (err) {
+      console.warn(`[seed-backfill] vp ${name}: ${err?.message || err}`);
+    }
+  }
+  return { scanned, seeded };
+}
+
+/**
+ * Build a synthetic group summary from group.json on disk.
+ *
+ * @param {string} groupDir
+ * @returns {string|null}
+ */
+function readGroupSummaryBody(groupDir) {
+  const metaPath = join(groupDir, 'group.json');
+  if (!existsSync(metaPath)) return null;
+  let meta;
+  try { meta = JSON.parse(readFileSync(metaPath, 'utf-8')); } catch { return null; }
+  const name = (meta?.name || '').trim();
+  const roster = Array.isArray(meta?.roster) ? meta.roster : [];
+  const defaultVpId = meta?.defaultVpId || null;
+  const lines = [];
+  if (name) lines.push(`# ${name}`);
+  lines.push('', `Group with ${roster.length} member${roster.length === 1 ? '' : 's'}.`);
+  if (roster.length > 0) lines.push('', `**Members:** ${roster.join(', ')}`);
+  if (defaultVpId) lines.push('', `**Default VP:** ${defaultVpId}`);
+  return lines.join('\n').trim();
+}
+
+/**
+ * Walk groups/ and seed `summary.md` for every group without one.
+ *
+ * @param {{ yeaftDir: string, root?: string }} opts
+ * @returns {{seeded: number, scanned: number}}
+ */
+export function backfillGroupSummaries({ yeaftDir, root = DEFAULT_MEMORY_ROOT }) {
+  let scanned = 0;
+  let seeded = 0;
+  const groupsRoot = join(yeaftDir, 'groups');
+  if (!existsSync(groupsRoot)) return { scanned, seeded };
+  let entries;
+  try { entries = readdirSync(groupsRoot); } catch { return { scanned, seeded }; }
+  for (const name of entries) {
+    if (name.startsWith('.')) continue;
+    const groupDir = join(groupsRoot, name);
+    let isDir = false;
+    try { isDir = statSync(groupDir).isDirectory(); } catch { /* skip */ }
+    if (!isDir) continue;
+    scanned++;
+    const summaryPath = join(root, 'group', name, 'summary.md');
+    if (readIfPresent(summaryPath)) continue;
+    const body = readGroupSummaryBody(groupDir);
+    if (!body) continue;
+    try {
+      writeAtomicSync(summaryPath, body);
+      seeded++;
+    } catch (err) {
+      console.warn(`[seed-backfill] group ${name}: ${err?.message || err}`);
+    }
+  }
+  return { scanned, seeded };
+}
+
+/**
+ * Run all backfills sequentially. Best-effort — any per-step error is
+ * logged and the next step still runs.
+ *
+ * @param {{ yeaftDir: string, libDir: string, root?: string }} opts
+ * @returns {{ vp: {scanned:number, seeded:number}, group: {scanned:number, seeded:number} }}
+ */
+export function runSummaryBackfill({ yeaftDir, libDir, root = DEFAULT_MEMORY_ROOT }) {
+  let vp = { scanned: 0, seeded: 0 };
+  let group = { scanned: 0, seeded: 0 };
+  try { vp = backfillVpSummaries({ libDir, root }); } catch (err) {
+    console.warn('[seed-backfill] vp pass failed:', err?.message || err);
+  }
+  try { group = backfillGroupSummaries({ yeaftDir, root }); } catch (err) {
+    console.warn('[seed-backfill] group pass failed:', err?.message || err);
+  }
+  return { vp, group };
+}

package/unify/memory/store-v2.js

@@ -44,6 +44,9 @@ import {
   promises as fsp,
   existsSync,
   mkdirSync,
+  readFileSync,
+  writeFileSync,
+  rmSync,
 } from 'fs';
 import { join, dirname } from 'path';
 import { homedir } from 'os';
@@ -285,6 +288,78 @@ export async function writeSummary(scope, body, opts = {}) {
   await atomicWrite(abs, `${(body || '').trim()}\n`);
 }
 
+/**
+ * Seed a scope's summary.md if (and only if) it is missing or empty. Used
+ * at create-time for VPs and groups so a fresh session has SOMETHING for
+ * `engine.#prepareAms` to pull into the Layer-A resident summary — the
+ * earlier behavior of "no summary.md until Dream-v2 runs" left the memory
+ * section empty for the entire first session.
+ *
+ * Intentionally a no-op if a non-empty summary.md already exists, so this
+ * is safe to call from any place that creates the scope (VP create, group
+ * create, first-session bootstrap) without clobbering Dream-v2's writes.
+ *
+ * @param {Scope} scope
+ * @param {string} body
+ * @param {{ root?: string, currentVpId?: string }} [opts]
+ * @returns {Promise<boolean>}  true if seeded, false if a non-empty summary already existed
+ */
+export async function seedSummaryIfMissing(scope, body, opts = {}) {
+  const existing = await readSummary(scope, opts);
+  if (existing && existing.trim().length > 0) return false;
+  await writeSummary(scope, body, opts);
+  return true;
+}
+
+/**
+ * Sync variant of `seedSummaryIfMissing` for synchronous CRUD entry points
+ * (vp-crud.js / group-crud.js / seed-default.js). Same idempotency contract:
+ * a non-empty existing `summary.md` blocks the seed; missing or empty
+ * triggers an atomic write. Failures are converted into thrown errors so
+ * the caller can decide whether to swallow (best-effort seed) or surface.
+ *
+ * NOTE on `opts.root`: callers MUST pass the configured memory root
+ * (typically `<yeaftDir>/memory`) so a non-default `yeaftDir` doesn't end
+ * up writing under `~/.yeaft/memory/`. The default is provided only for
+ * top-of-tree convenience; production code paths thread the root through.
+ *
+ * @param {Scope} scope
+ * @param {string} body
+ * @param {{ root?: string }} [opts]
+ * @returns {boolean}  true if seeded, false if a non-empty summary already existed
+ */
+export function seedSummaryIfMissingSync(scope, body, opts = {}) {
+  const { root = DEFAULT_MEMORY_ROOT } = opts;
+  const rel = `${scopeDir(scope)}/summary.md`;
+  const abs = join(root, rel);
+  let existing = '';
+  if (existsSync(abs)) {
+    try { existing = readFileSync(abs, 'utf8').trim(); }
+    catch { /* read race — fall through to seed */ }
+  }
+  if (existing) return false;
+  mkdirSync(dirname(abs), { recursive: true });
+  writeFileSync(abs, `${(body || '').trim()}\n`, 'utf8');
+  return true;
+}
+
+/**
+ * Synchronously remove a scope's directory under the memory root. Used by
+ * `deleteVp` / `deleteGroup` to cascade memory cleanup so a recreate of the
+ * same id doesn't see stale `summary.md` / `memory.md` / `segments/` files.
+ *
+ * Idempotent — missing directory is a no-op.
+ *
+ * @param {Scope} scope
+ * @param {{ root?: string }} [opts]
+ */
+export function removeScopeDirSync(scope, opts = {}) {
+  const { root = DEFAULT_MEMORY_ROOT } = opts;
+  const abs = join(root, scopeDir(scope));
+  if (!existsSync(abs)) return;
+  rmSync(abs, { recursive: true, force: true });
+}
+
 // ─── scope discovery ───────────────────────────────────────────
 
 /**

package/unify/models.js

@@ -213,6 +213,43 @@ export function resolveModel(modelName) {
   return info ? { ...info } : null;
 }
 
+/**
+ * Default context window when neither the model registry nor the engine
+ * config has a value. 200K is a conservative middle-ground — most modern
+ * production models (Claude, GPT-5, Gemini) have ≥ 128K.
+ *
+ * Single source of truth: callers (engine.js pre-flight guard,
+ * tools/registry.js per-result cap) MUST use this constant or
+ * {@link resolveContextWindow} instead of hardcoding 200_000.
+ */
+export const DEFAULT_CONTEXT_WINDOW = 200_000;
+
+/**
+ * Resolve the live context window for a model, with an explicit fallback
+ * ladder:
+ *   1. MODEL_REGISTRY entry's `contextWindow` (most accurate)
+ *   2. caller-supplied config override (e.g. `config.maxContextTokens`)
+ *   3. {@link DEFAULT_CONTEXT_WINDOW}
+ *
+ * Used by the per-tool-result cap and the pre-flight token guard so the
+ * defense layers always see the same number, regardless of which seam
+ * resolves it first.
+ *
+ * @param {string} modelName
+ * @param {{ maxContextTokens?: number }} [config]
+ * @returns {number}
+ */
+export function resolveContextWindow(modelName, config) {
+  const info = resolveModel(modelName);
+  if (info && Number.isFinite(info.contextWindow) && info.contextWindow > 0) {
+    return info.contextWindow;
+  }
+  const cfg = config && Number.isFinite(config.maxContextTokens) && config.maxContextTokens > 0
+    ? config.maxContextTokens : null;
+  if (cfg !== null) return cfg;
+  return DEFAULT_CONTEXT_WINDOW;
+}
+
 /**
  * List all known models.
  *

package/unify/session.js

@@ -41,6 +41,7 @@ import { Engine } from './engine.js';
 // AMS each turn and to run `memory/adjust.js` post-turn.
 import { ensureDefaultGroupIfEmpty } from './groups/group-crud.js';
 import { seedDefaultVps } from './vp/seed-defaults.js';
+import { runSummaryBackfill } from './memory/seed-backfill.js';
 import { createV2DreamScheduler } from './dream-v2/session-wiring.js';
 import { openSegmentIndex } from './memory/index-db.js';
 import { syncAll as syncSegmentIndex } from './memory/segment-sync.js';
@@ -236,10 +237,25 @@ export async function loadSession(options = {}) {
       console.warn(`[Yeaft] seedDefaultVps failed: ${err?.message || err}`);
     }
     try {
-      ensureDefaultGroupIfEmpty(yeaftDir);
+      ensureDefaultGroupIfEmpty(yeaftDir, { memoryRoot: join(yeaftDir, 'memory') });
     } catch (err) {
       console.warn(`[Yeaft] ensureDefaultGroupIfEmpty failed: ${err?.message || err}`);
     }
+
+    // task-fix-memory-load: backfill summary.md for VPs / groups created
+    // before the create-time seed was added. Without this, an existing
+    // user's `grp_claude` and `steve` VP have an empty Layer-A resident
+    // summary every turn (memory section in the system prompt is just
+    // the `active_scope` header). Idempotent — only writes when missing.
+    try {
+      runSummaryBackfill({
+        yeaftDir,
+        libDir: join(yeaftDir, 'virtual-persons'),
+        root: join(yeaftDir, 'memory'),
+      });
+    } catch (err) {
+      console.warn(`[Yeaft] runSummaryBackfill failed: ${err?.message || err}`);
+    }
   }
 
   // ─── 6. Load skills ────────────────────────────────────

package/unify/tools/registry.js

@@ -9,6 +9,73 @@
  * still carry a `modes` field, but the registry ignores it.
  */
 
+import { formatSize } from '../archive/tool-results.js';
+import { DEFAULT_CONTEXT_WINDOW } from '../models.js';
+
+/**
+ * Per-tool-result hard cap.
+ *
+ * A single tool can return megabytes (a grep over a large repo, a large
+ * file read, a paginated web fetch). If we forward that verbatim into the
+ * next LLM request the model returns LLMContextError ("context_length_exceeded")
+ * and the user sees a hard failure mid-turn. Cap at a fraction of the
+ * model's context window so even a runaway tool can't kill the request.
+ *
+ * Cap = max(MIN_CAP, floor(contextWindow * RATIO))
+ *   - RATIO = 10%: leaves 90% of context for system prompt, history, the
+ *     model's own output, and other tools called this turn. Generous in
+ *     absolute terms (25.6 KB on a 256 K window, ~20 K on a 200 K window),
+ *     plenty for a real tool result; small enough that 5 such results
+ *     still fit alongside everything else.
+ *   - MIN_CAP = 8 KB: sanity floor for tiny test fixtures (4 K context
+ *     models in tests would otherwise cap at 409 chars, defeating the
+ *     test's purpose). Real production models all have ≥ 32 K context, so
+ *     the floor never bites in practice.
+ *
+ * The truncation lands HERE (not in engine.js when pushing tool results
+ * into messages) so the UI's `tool_end` event, the exec log, AND the
+ * model all see the same truncated content. Truncating later would mean
+ * the user sees the full 2 MB output but the model gets a stub —
+ * confusing.
+ */
+const TOOL_RESULT_CAP_RATIO = 0.10;
+const TOOL_RESULT_MIN_CAP = 8 * 1024;
+
+/**
+ * Truncate a tool result if it exceeds the per-result cap. Non-string
+ * outputs are JSON-stringified first (matching what engine.js eventually
+ * pushes into `content`), then capped.
+ *
+ * Edge cases handled:
+ *   - `undefined` → `JSON.stringify(undefined)` returns `undefined`, not
+ *     a string, so we coerce to `'undefined'` and let the cap apply.
+ *   - circular refs / `JSON.stringify` throws → fall back to `String(...)`.
+ *
+ * @param {unknown} output
+ * @param {{ contextWindow?: number, toolName: string }} opts
+ * @returns {string}
+ */
+export function truncateToolResultIfNeeded(output, { contextWindow, toolName }) {
+  let text;
+  if (typeof output === 'string') {
+    text = output;
+  } else {
+    try {
+      const json = JSON.stringify(output);
+      text = typeof json === 'string' ? json : String(output);
+    } catch {
+      text = String(output);
+    }
+  }
+  const ctx = Number.isFinite(contextWindow) && contextWindow > 0
+    ? contextWindow : DEFAULT_CONTEXT_WINDOW;
+  const cap = Math.max(TOOL_RESULT_MIN_CAP, Math.floor(ctx * TOOL_RESULT_CAP_RATIO));
+  if (text.length <= cap) return text;
+  const head = text.slice(0, cap);
+  const marker = `\n\n[truncated: ${toolName} returned ${formatSize(text.length)}, capped at ${formatSize(cap)}; the model will not see the rest of this output]`;
+  return head + marker;
+}
+
 export class ToolRegistry {
   /** @type {Map<string, import('./types.js').ToolDef>} */
   #tools = new Map();
@@ -93,6 +160,12 @@ export class ToolRegistry {
 
   /**
    * Execute a tool by name.
+   *
+   * The result is passed through {@link truncateToolResultIfNeeded} so that
+   * a single tool can never blow the context window. The cap derives from
+   * `ctx.contextWindow` (the live model's window, threaded by engine.js);
+   * fall back to a 200K default for callers that don't supply it.
+   *
    * @param {string} name
    * @param {object} input
    * @param {import('./types.js').ToolContext} [ctx={}]
@@ -101,7 +174,11 @@ export class ToolRegistry {
   async execute(name, input, ctx = {}) {
     const tool = this.#tools.get(name);
     if (!tool) throw new Error(`Unknown tool: ${name}`);
-    return tool.execute(input, ctx);
+    const output = await tool.execute(input, ctx);
+    return truncateToolResultIfNeeded(output, {
+      contextWindow: ctx.contextWindow,
+      toolName: name,
+    });
   }
 
   /** Number of registered tools. */

package/unify/tools/types.js

@@ -24,6 +24,9 @@
  * @property {(groupId: string) => string[]|null} [getGroupRoster]
  *   — R6: resolve a group's roster (used by TaskCreate / route_forward to
  *   validate `members` ⊆ roster without importing group-store directly).
+ * @property {number} [contextWindow] — current model's context window in
+ *   tokens (used by ToolRegistry.execute to cap a single tool result at a
+ *   fraction of the window so one runaway grep can't blow the wire).
  */
 
 /**

package/unify/vp/vp-crud.js

@@ -19,8 +19,49 @@
 
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'fs';
 import { join } from 'path';
+import { homedir } from 'os';
 import { validateVpId } from '../groups/ids.js';
 import { DEFAULT_VP_LIB_DIR, parseRoleMd } from './vp-store.js';
+import { seedSummaryIfMissingSync, removeScopeDirSync } from '../memory/store-v2.js';
+
+/**
+ * Default memory root used when callers don't pass `options.memoryRoot`.
+ * Memory lives at `<root>/vp/<id>/{summary.md,memory.md,segments/…}` —
+ * see `store-v2.scopeDir`. Production sites should thread the configured
+ * `<yeaftDir>/memory` through `options.memoryRoot` so a non-default yeaft
+ * directory (e.g. tests, sandboxed CI) doesn't write under `~/.yeaft/`.
+ */
+const DEFAULT_MEMORY_ROOT = join(homedir(), '.yeaft', 'memory');
+
+/**
+ * Build the seed summary body for a freshly-created VP. Pulled into a
+ * helper so tests can pin the exact format.
+ *
+ * @param {object} payload  same shape as createVp
+ * @returns {string}
+ */
+export function buildVpSeedSummary(payload) {
+  const id = String(payload?.vpId || '').trim();
+  const name = (payload?.displayName != null ? String(payload.displayName) : id).trim();
+  const role = (payload?.role != null ? String(payload.role) : '').trim();
+  const persona = (typeof payload?.persona === 'string' ? payload.persona : '').trim();
+  const traits = Array.isArray(payload?.traits)
+    ? payload.traits.map(t => String(t)).filter(Boolean)
+    : [];
+
+  const lines = [];
+  lines.push(`# ${name}`);
+  if (role) lines.push('', `**Role:** ${role}`);
+  if (traits.length > 0) lines.push('', `**Traits:** ${traits.join(', ')}`);
+  if (persona) {
+    // Keep the persona body terse — first 800 chars is plenty for an
+    // initial Layer-A resident summary; Dream-v2 will rewrite it as
+    // memory accumulates.
+    const truncated = persona.length > 800 ? persona.slice(0, 800).trim() + '…' : persona;
+    lines.push('', '**Persona:**', '', truncated);
+  }
+  return lines.join('\n').trim();
+}
 
 /**
  * Error thrown by CRUD entry points. Has stable `.code` so callers can map
@@ -106,6 +147,7 @@ function yamlScalar(v) {
  */
 export function createVp(payload, options = {}) {
   const libDir = options.libDir || DEFAULT_VP_LIB_DIR;
+  const memoryRoot = options.memoryRoot || DEFAULT_MEMORY_ROOT;
   const vpId = payload && payload.vpId;
 
   const v = validateVpId(vpId);
@@ -123,6 +165,24 @@ export function createVp(payload, options = {}) {
   mkdirSync(dir, { recursive: true });
   mkdirSync(join(dir, 'memory'), { recursive: true });
   writeFileSync(vpRolePathFor(libDir, vpId), buildRoleMd({ ...payload, vpId }), 'utf-8');
+
+  // Seed the VP's Layer-A resident summary so the first session has SOMETHING
+  // for engine.#loadLayerASummaries to read. Without this, fresh VPs have
+  // an empty memory section in the system prompt until Dream-v2 runs (which
+  // requires a non-empty diff stream — i.e. several turns of activity).
+  // We only seed when the file is missing/empty: this is safe to re-run and
+  // never clobbers Dream-v2 writes. Failures are best-effort: a memory-root
+  // permission failure must NOT break VP creation.
+  try {
+    seedSummaryIfMissingSync(
+      { kind: 'vp', id: vpId },
+      buildVpSeedSummary({ ...payload, vpId }),
+      { root: memoryRoot },
+    );
+  } catch (err) {
+    console.warn(`[vp-crud] failed to seed summary.md for ${vpId}:`, err?.message || err);
+  }
+
   return { vpId, dir };
 }
 
@@ -150,7 +210,9 @@ export function updateVp(payload, options = {}) {
 }
 
 /**
- * Delete a VP — removes the entire VP dir (role.md + memory/).
+ * Delete a VP — removes the entire VP dir (role.md + memory/) AND the
+ * shared memory root's `<root>/vp/<id>/` so a recreate of the same id
+ * doesn't see stale `summary.md` / segments / index entries.
  *
  * Hard constraint: `memory/` contents are scoped to this VP; removing them
  * with the role is the intended CRUD semantic (UX rule is the confirm
@@ -158,10 +220,13 @@ export function updateVp(payload, options = {}) {
  *
  * @param {string} vpId
  * @param {object} [options]
+ * @param {string} [options.libDir]
+ * @param {string} [options.memoryRoot]
  * @returns {{vpId:string}}
  */
 export function deleteVp(vpId, options = {}) {
   const libDir = options.libDir || DEFAULT_VP_LIB_DIR;
+  const memoryRoot = options.memoryRoot || DEFAULT_MEMORY_ROOT;
   // We do NOT run validateVpId here — deleting an already-legacy bad id is
   // legitimate cleanup. But we DO refuse obviously unsafe inputs.
   if (!vpId || typeof vpId !== 'string' || vpId.includes('/') || vpId.includes('\\') || vpId === '..' || vpId === '.') {
@@ -172,6 +237,13 @@ export function deleteVp(vpId, options = {}) {
     throw new VpCrudError('not_found', vpId);
   }
   rmSync(dir, { recursive: true, force: true });
+  // Cascade: drop the VP's memory scope so a recreate with the same id
+  // starts clean. Best-effort — never let memory cleanup fail the CRUD op.
+  try {
+    removeScopeDirSync({ kind: 'vp', id: vpId }, { root: memoryRoot });
+  } catch (err) {
+    console.warn(`[vp-crud] failed to remove memory dir for ${vpId}:`, err?.message || err);
+  }
   return { vpId };
 }
 

package/unify/web-bridge.js

@@ -48,6 +48,7 @@ import { seedDefaultGroup } from './groups/seed-default.js';
 import {
   shouldCompactHistory,
   compactHistory,
+  trimSnapshotForBudget,
 } from './history-compact.js';
 
 /** @type {import('./session.js').Session | null} */
@@ -168,7 +169,9 @@ export function handleUnifyVpCreate(msg) {
   const requestId = msg && msg.requestId;
   const payload = msg && msg.payload;
   try {
-    const { vpId } = createVp(payload || {});
+    const yeaftDir = ctx.CONFIG?.yeaftDir;
+    const memoryRoot = yeaftDir ? join(yeaftDir, 'memory') : undefined;
+    const { vpId } = createVp(payload || {}, memoryRoot ? { memoryRoot } : {});
     sendVpCrudResult({ op: 'create', requestId, ok: true, vpId });
   } catch (err) {
     sendVpCrudResult({
@@ -208,7 +211,9 @@ export function handleUnifyVpDelete(msg) {
   const requestId = msg && msg.requestId;
   const vpId = msg && msg.vpId;
   try {
-    deleteVp(vpId);
+    const yeaftDir = ctx.CONFIG?.yeaftDir;
+    const memoryRoot = yeaftDir ? join(yeaftDir, 'memory') : undefined;
+    deleteVp(vpId, memoryRoot ? { memoryRoot } : {});
     sendVpCrudResult({ op: 'delete', requestId, ok: true, vpId });
   } catch (err) {
     sendVpCrudResult({
@@ -297,7 +302,8 @@ export function handleUnifyCreateGroup(msg) {
   const payload = (msg && msg.payload) || {};
   try {
     const yeaftDir = ctx.CONFIG?.yeaftDir;
-    const group = createGroupFromSpec(yeaftDir, payload);
+    const memoryRoot = yeaftDir ? join(yeaftDir, 'memory') : undefined;
+    const group = createGroupFromSpec(yeaftDir, payload, memoryRoot ? { memoryRoot } : {});
     sendGroupCrudResult({ op: 'create', requestId, ok: true, group });
     sendGroupSnapshotBroadcast();
   } catch (err) {
@@ -376,7 +382,8 @@ export function handleUnifyDeleteGroup(msg) {
   const groupId = msg && msg.groupId;
   try {
     const yeaftDir = ctx.CONFIG?.yeaftDir;
-    const result = deleteGroup(yeaftDir, groupId);
+    const memoryRoot = yeaftDir ? join(yeaftDir, 'memory') : undefined;
+    const result = deleteGroup(yeaftDir, groupId, memoryRoot ? { memoryRoot } : {});
     // Cascade: remove every persisted message stamped with this group id.
     // Hard delete (per user spec): no soft-archive, the bytes are gone.
     // Skipped silently if the session/store isn't initialized — the next
@@ -792,7 +799,7 @@ export async function handleUnifyGroupChat(msg) {
       groupHandle = openGroup(root, groupId);
     } else if (groupId === 'grp_default') {
       try {
-        const seeded = seedDefaultGroup(yeaftDir, {});
+        const seeded = seedDefaultGroup(yeaftDir, { memoryRoot: join(yeaftDir, 'memory') });
         groupHandle = seeded.group;
       } catch (seedErr) {
         seedFailed = true;
@@ -1146,9 +1153,16 @@ async function runVpTurn({ prompt, groupId, vpId, turnId, groupCoordinator, vpAb
         vpId,
         turnId,
       };
+      // Always trim the snapshot before passing to engine.query. This is
+      // the second-line defense (history-compact only fires above 30K
+      // tokens — small chats with many turns still bloat the messages
+      // array). See `trimSnapshotForBudget` doc-block for policy.
+      const trimmedMessages = trimSnapshotForBudget(baseSnapshot, {
+        messageTokenBudget: session?.config?.messageTokenBudget,
+      });
       for await (const event of session.engine.query({
         prompt,
-        messages: baseSnapshot,
+        messages: trimmedMessages,
         signal: vpAbort.signal,
         ...queryOpts,
       })) {