How dequid reads your context.
Why the system prompt stays small. How the model fetches the rest — only when the question warrants it.
Cram everything in.
Pay for it every turn.
An LLM is stateless. Every answer is rebuilt from scratch from one request: the system prompt plus your message. To make the model “know” about your documents, memories, or past conversations, those things have to be text inside that request.
The simple thing is to dump it all in. Your vault: in. Every memory ever extracted: in. The last fifty conversations summarised: in. Every person in your address book: in. The request balloons. You pay for it on every turn. The relevant clause often gets truncated. The cache never hits because volatile bits — today's date, the latest memory, the freshest attachment — sit inside the cached prefix.
It works. It works badly. And it is, more or less, what most context-augmented chat products do.
Three layers.
Cheapest first.
Cheapest layer always. The middle one when the model looks. The expensive one only when a look turned up something worth reading in full.
Most turns reach for one search and zero deep reads.
The model gets the right context for the question — not a one-size-fits-none blob.
What the model can reach for.
The inline layer tells the model these tools exist and what each is for. It can call any of them when it judges them useful. They are the entire reach surface — nothing the model fetches falls outside this list.
Every search runs inside the persona.
The model searches everything you've ever stored.
A coding question can surface a memory about your dating life. A customer pitch can surface a private one-on-one. Agentic retrieval over an undifferentiated bag is just Context Bleed with an extra step.
The model can only see what the persona was tagged with.
Vault folders the persona's knowledge points at. Memories not excluded. Chats from folders the persona owns. People the persona knows. The tools enforce the scope — there is no way around it.
The mental model: the persona is a library card with restricted access. The tools are the librarian. Whatever you ask for, the librarian only checks the shelves this card lets you onto. Nothing else is fetchable, by anyone, for any reason.
A pill in chat. A trace in the inspector.
While the model is working, you'll see a single pill in the message — “Running 2 tools…” — and once it's done, “3 tools used · 1.4s”. The chat doesn't fill up with per-tool detail. It stays a chat.
Click the pill and the Inspector opens. The Trace section shows every tool call from this turn: which tool, the arguments, how long it took, what it returned. Each turn's trace is a recipe for the answer — every input the model actually had.
Most people never open it. Some open it once and never again. A few — usually the ones who would also read a flight manual — open it every turn. All three of those are reasonable.
Memory and Context Bleed
Why flat memory leaks. How scoped memory fixes it.