@securecoms/agent-bridge 0.26.1 → 0.26.2

package/dist/bin.js

@@ -28383,9 +28383,9 @@ async function recordInboundMemory(sink, channelId, senderId, text, messageId, m
   } catch {
   }
 }
-async function recordOutboundMemory(sink, channelId, text, messageId) {
+async function recordOutboundMemory(sink, channelId, text, messageId, modality = "text") {
   try {
-    await sink.record({ conversationId: channelId, role: "agent", text, modality: "text", messageId });
+    await sink.record({ conversationId: channelId, role: "agent", text, modality, messageId });
   } catch {
   }
 }
@@ -29110,6 +29110,15 @@ function logPendingCommitResolved(outcome) {
       writeServiceLog("info", "mls.pending_commit.resolved.unknown");
   }
 }
+var OWNER_DM_DEFAULT_READ_GRANTS = Object.freeze([
+  Object.freeze({ tool: "current_time", mode: "read" }),
+  Object.freeze({ tool: "web_search", mode: "read" })
+]);
+var NO_TOOL_GRANTS = Object.freeze([]);
+function ownerDmDefaultGrantsEnabled(env = process.env) {
+  const v = env.SECURECOMS_OWNER_DM_DEFAULT_GRANTS;
+  return v === void 0 || v === "on";
+}
 var VAULT_REF_BARE_TEXT = "[Files link]";
 var VOICE_MODE_GUIDANCE = "Reply immediately and conversationally, one short sentence per message; never bundle multiple points into one message.";
 var FAST_PATH_SPOKEN_GUIDANCE = "A one-sentence spoken acknowledgement has already been sent for this turn. Reply only with information it did not contain, in one or two short sentences; if there is nothing to add, send nothing.";
@@ -29121,6 +29130,20 @@ function selectVoiceGuidance(isDm, voiceDefaultResponder) {
   }
   return VOICE_MODE_GUIDANCE;
 }
+var VOICE_COALESCE_WINDOW_MS = 0;
+var VOICE_COALESCE_WINDOW_MAX_MS = 5e3;
+function voiceCoalesceWindowFromEnv(env = process.env) {
+  const raw = env.SECURECOMS_VOICE_COALESCE_MS;
+  if (raw === void 0 || !/^\d{1,6}$/.test(raw.trim())) return VOICE_COALESCE_WINDOW_MS;
+  return Math.min(Number(raw.trim()), VOICE_COALESCE_WINDOW_MAX_MS);
+}
+function waitMs(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve3) => {
+    const t = setTimeout(resolve3, ms);
+    t.unref?.();
+  });
+}
 var DEFAULT_MAX_BUFFER = 1e3;
 var DEFAULT_MAX_DELIVERY_ATTEMPTS = 5;
 var REDELIVERY_BACKOFF_BASE_MS = 5e3;
@@ -29405,6 +29428,7 @@ var BridgeAgent = class _BridgeAgent {
     this.fastLlm = deps.fastLlm ?? (cfg.voice?.fastPath.enabled ? new FastLlmClient(cfg.voice.fastPath, this.fetchImpl) : void 0);
     this.voiceSettingsSource = cfg.voice ? "file" : "none";
     this.latency = deps.latency ?? new LatencyRecorder();
+    this.voiceCoalesceWindowMs = Math.max(0, deps.voiceCoalesceWindowMs ?? voiceCoalesceWindowFromEnv());
     this.maxBuffer = deps.maxBuffer ?? DEFAULT_MAX_BUFFER;
     this.maxDeliveryAttempts = deps.maxDeliveryAttempts ?? DEFAULT_MAX_DELIVERY_ATTEMPTS;
     this.maxAgentHops = deps.maxAgentHops ?? DEFAULT_MAX_AGENT_HOPS;
@@ -29653,6 +29677,19 @@ var BridgeAgent = class _BridgeAgent {
   /** Room send-floor tokens reserved by queued fast replies, per channel (F3). */
   fastReplyReserved = /* @__PURE__ */ new Map();
   static FAST_REPLY_MAX_JOBS = 32;
+  /** Voice repeats (a): see {@link VOICE_COALESCE_WINDOW_MS}. */
+  voiceCoalesceWindowMs;
+  /** H1: fast-path reply ids being published right now (recorded as voice memory). */
+  spokenReplyIds = /* @__PURE__ */ new Set();
+  /** Open coalescing windows, keyed by channel + speaker. */
+  voiceCoalescing = /* @__PURE__ */ new Map();
+  /** Ids of every coalesced fragment (capped FIFO): a redelivered row is acked, never a second turn. */
+  voiceCoalescedIds = /* @__PURE__ */ new Set();
+  /** Merged turn id -> the absorbed fragments' held frames, retired with it. */
+  voiceCoalescedTails = /* @__PURE__ */ new Map();
+  /** (4) recv.lag: application queue ids already measured (capped FIFO), so a re-pulled row is not re-counted. */
+  recvLagSeen = /* @__PURE__ */ new Set();
+  static RECV_LAG_SEEN_CAP = 2e3;
   /** Fast-path turns handed to the runtime behind a spoken ack (LLM [[DEFER]], pre-check, or ack_only). */
   fastPathDeferred = 0;
   /** Of those, `full`-mode turns the deterministic pre-check deferred without calling the fast model. */
@@ -29746,6 +29783,8 @@ var BridgeAgent = class _BridgeAgent {
    * back to the delivery-row-driven Task 11 behaviour only.
    */
   selfHealSweepEnabled = process.env.SECURECOMS_SELF_HEAL_SWEEP !== "false";
+  /** Read once at startup; see ownerDmDefaultGrantsEnabled. */
+  ownerDmDefaultGrants = ownerDmDefaultGrantsEnabled();
   /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
   static SELF_HEAL_SWEEP_INTERVAL_MS = SELF_HEAL_SWEEP_INTERVAL_MS;
   /**
@@ -31110,7 +31149,8 @@ var BridgeAgent = class _BridgeAgent {
   /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
   afterPublish(channelId, body, id, opts) {
     if (opts.agentTurn !== false) this.agentHops.noteOwnSend(channelId);
-    if (body.kind === "text") void recordOutboundMemory(this.memory, channelId, body.text, id);
+    const modality = this.spokenReplyIds.has(id) ? "voice" : "text";
+    if (body.kind === "text") void recordOutboundMemory(this.memory, channelId, body.text, id, modality);
   }
   isIdempotentSend(messageId, opts) {
     if (opts.inReplyTo === void 0 && opts.idempotencyKey === void 0) return false;
@@ -31288,26 +31328,26 @@ var BridgeAgent = class _BridgeAgent {
       } catch (e) {
         if (e instanceof ReplyInFlightError) {
           if (inFlight >= REPLY_IN_FLIGHT_RETRIES) throw e;
-          const waitMs2 = Math.min(
+          const waitMs3 = Math.min(
             REPLY_RATE_LIMIT_MAX_WAIT_MS,
             Math.max(REPLY_IN_FLIGHT_BASE_WAIT_MS * 2 ** inFlight, e.retryAfterSec * 1e3)
           );
           inFlight++;
-          writeServiceLog("info", "reply.in_flight_retry", { attempt: inFlight, wait_ms: waitMs2 });
-          await this.replySleep(waitMs2);
+          writeServiceLog("info", "reply.in_flight_retry", { attempt: inFlight, wait_ms: waitMs3 });
+          await this.replySleep(waitMs3);
           continue;
         }
         const backendSec = backendRetryAfterSec(e);
         const wait = e instanceof RateLimitedError ? e.retryAfterMs : backendSec !== void 0 ? backendSec * 1e3 : null;
         if (wait === null) throw e;
-        const waitMs = Math.min(REPLY_RATE_LIMIT_MAX_WAIT_MS, Math.max(REPLY_RATE_LIMIT_MIN_WAIT_MS, wait));
+        const waitMs2 = Math.min(REPLY_RATE_LIMIT_MAX_WAIT_MS, Math.max(REPLY_RATE_LIMIT_MIN_WAIT_MS, wait));
         if (rateLimited >= REPLY_RATE_LIMIT_RETRIES) {
-          throw e instanceof RateLimitedError ? e : new RateLimitedError(channelId, waitMs);
+          throw e instanceof RateLimitedError ? e : new RateLimitedError(channelId, waitMs2);
         }
         rateLimited++;
         this.replyRateLimitRetries++;
-        writeServiceLog("info", "reply.rate_limited_retry", { attempt: rateLimited, wait_ms: waitMs });
-        await this.replySleep(waitMs);
+        writeServiceLog("info", "reply.rate_limited_retry", { attempt: rateLimited, wait_ms: waitMs2 });
+        await this.replySleep(waitMs2);
       }
     }
   }
@@ -31796,6 +31836,13 @@ var BridgeAgent = class _BridgeAgent {
     if (needsRuntime(text)) return { kind: "ack", line: deferAck(messageId), intent: true };
     return { kind: "fast" };
   }
+  noteVoiceCoalesced(messageId) {
+    this.voiceCoalescedIds.add(messageId);
+    if (this.voiceCoalescedIds.size > _BridgeAgent.FAST_PATH_SEEN_CAP) {
+      const oldest = this.voiceCoalescedIds.values().next().value;
+      if (oldest !== void 0) this.voiceCoalescedIds.delete(oldest);
+    }
+  }
   markFastPathSeen(messageId) {
     this.fastPathSeen.add(messageId);
     if (this.fastPathSeen.size > _BridgeAgent.FAST_PATH_SEEN_CAP) {
@@ -31812,22 +31859,36 @@ var BridgeAgent = class _BridgeAgent {
    * reserve a room send-floor token until they finish. A job never throws.
    */
   enqueueFastReply(channelId, job, spends = true) {
-    if (spends) {
-      this.fastReplyJobs++;
-      this.fastReplyReserved.set(channelId, (this.fastReplyReserved.get(channelId) ?? 0) + 1);
-    }
+    const release = spends ? this.reserveFastReply(channelId) : void 0;
     const prev = this.fastReplyChains.get(channelId) ?? Promise.resolve();
     const next = prev.then(() => this.outsideIngestCycle(job)).catch((e) => writeServiceLog("warn", "voice.fast_reply_job_failed", {}, e)).finally(() => {
-      if (spends) {
-        this.fastReplyJobs--;
-        const left3 = (this.fastReplyReserved.get(channelId) ?? 1) - 1;
-        if (left3 > 0) this.fastReplyReserved.set(channelId, left3);
-        else this.fastReplyReserved.delete(channelId);
-      }
+      release?.();
       if (this.fastReplyChains.get(channelId) === next) this.fastReplyChains.delete(channelId);
     });
     this.fastReplyChains.set(channelId, next);
   }
+  /** Count a fast reply against FAST_REPLY_MAX_JOBS and reserve its room send-floor token; returns the release. */
+  reserveFastReply(channelId) {
+    this.fastReplyJobs++;
+    this.fastReplyReserved.set(channelId, (this.fastReplyReserved.get(channelId) ?? 0) + 1);
+    return () => {
+      this.fastReplyJobs--;
+      const left3 = (this.fastReplyReserved.get(channelId) ?? 1) - 1;
+      if (left3 > 0) this.fastReplyReserved.set(channelId, left3);
+      else this.fastReplyReserved.delete(channelId);
+    };
+  }
+  /**
+   * Speak a planned fast turn ("ack" or "fast") and settle its held frame:
+   * retired when the fast model answered alone, otherwise released to the
+   * runtime (with the "ack already spoken" guidance only when an ack or a
+   * deferring fast reply was actually published — F3).
+   */
+  async speakAndSettle(turn, plan, held, heldAfterAck, fastText, guidance, fastSpeaker, greeting) {
+    const outcome = plan.kind === "ack" ? await this.sendFastLine(turn.channelId, turn.messageId, plan.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidance, fastSpeaker, greeting);
+    if (outcome === "answered") await this.settleHeldRuntimeMessage(held, false);
+    else await this.settleHeldRuntimeMessage(outcome === "deferred" ? heldAfterAck : held, true);
+  }
   /**
    * Stage a runtime frame without overtaking a turn of the same channel that
    * is still queued behind the fast path (F2): while the channel has a queue,
@@ -31843,10 +31904,19 @@ var BridgeAgent = class _BridgeAgent {
   async settleFastReplies() {
     while (this.fastReplyChains.size) await Promise.all([...this.fastReplyChains.values()]);
   }
+  /** Send a line the voice fast path speaks: its memory record is "voice" (H1). */
+  async sendSpoken(channelId, text, messageId) {
+    this.spokenReplyIds.add(messageId);
+    try {
+      await this.send(channelId, text, messageId);
+    } finally {
+      this.spokenReplyIds.delete(messageId);
+    }
+  }
   /** Speak a fixed acknowledgement line; failures are counted, never thrown. */
   async sendFastLine(channelId, messageId, line) {
     try {
-      await this.send(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId));
+      await this.sendSpoken(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId));
       this.fastPathSent++;
       return true;
     } catch (e) {
@@ -31903,7 +31973,7 @@ var BridgeAgent = class _BridgeAgent {
       const raw = await this.latency.time("voice.fast_llm", () => fastLlm.complete(messages));
       const { reply, defer } = splitFastReply(raw, 200, maxSentences);
       if (!reply) return "failed";
-      await this.send(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
+      await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
       this.fastPathSent++;
       if (defer) this.fastPathDeferred++;
       return defer ? "deferred" : "answered";
@@ -31936,15 +32006,48 @@ var BridgeAgent = class _BridgeAgent {
     }
   }
   /** Settle a held frame: the fast path answered alone (retire it) or the runtime answers next (release it, in channel order). */
-  settleHeldRuntimeMessage(message, release) {
+  async settleHeldRuntimeMessage(message, release) {
     if (!this.runtimePendingIds.has(message.message_id)) return;
     if (!release) {
       this.ackRuntimeMessages([message.message_id]);
       return;
     }
-    this.buffer.push(message);
+    const memory = await this.memoryAtRelease(message);
+    if (this.closingDown || !this.runtimePendingIds.has(message.message_id)) return;
+    this.buffer.push(memory === message.memory ? message : { ...message, memory });
     this.wakeListeners();
   }
+  /**
+   * Voice repeats (b): a held frame's memory was read when its turn ARRIVED,
+   * before the replies queued ahead of it (an earlier turn's fast reply, this
+   * turn's own ack) were spoken. The runtime replaces its history with the
+   * frame's memory, so with the arrival snapshot it answered an
+   * already-answered turn again. At release the context is re-read and the
+   * AGENT turns it holds beyond the snapshot (afterPublish ->
+   * recordOutboundMemory) are appended to the snapshot. Peer turns recorded
+   * since (this turn itself, later turns) are not, so the frame stays
+   * prior-turn-only for what the runtime is about to answer. New turns are
+   * found by recorded time, never by `seq` (the OpenClaw provider renumbers
+   * seq per read). A failed re-read keeps the arrival snapshot.
+   */
+  async memoryAtRelease(message) {
+    const prior = message.memory;
+    if (!prior || !this.mayReadOpenClawMemoryForTurn(message.authorization)) return prior;
+    let fresh;
+    try {
+      fresh = await this.memory.context(message.channel_id, _BridgeAgent.TURN_MEMORY_LIMIT);
+    } catch {
+      return prior;
+    }
+    const after = prior.recent.reduce((max, turn) => Math.max(max, turn.ts ?? 0), message.ts);
+    const spoken = fresh.recent.filter((turn) => turn.role === "agent" && turn.ts !== void 0 && turn.ts > after);
+    if (spoken.length === 0) return prior;
+    return {
+      recent: [...prior.recent, ...spoken].slice(-_BridgeAgent.TURN_MEMORY_LIMIT),
+      facts: prior.facts
+    };
+  }
+  static TURN_MEMORY_LIMIT = 50;
   /**
    * List channels in one enclave (default: the daemon's own home enclave).
    * Task 3: called per-*known* enclave by refreshChannelMeta so a
@@ -32206,10 +32309,22 @@ var BridgeAgent = class _BridgeAgent {
    * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
    * guess. The returned object and grant array are frozen before they cross the
    * daemon boundary so one consumer cannot widen a later execution check.
+   *
+   * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
+   * the kill switch is on, the channel is a DM, and EITHER
+   *   (a) audience is owner_dm AND the sender is the pinned structural owner
+   *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
+   *       alone gets nothing; OR
+   *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
+   *       relayed `speaker_identity_id` (passed by the caller only for relay
+   *       turns) is that same pinned owner, whose roster row is the agent's
+   *       owner. A speaker claim from any non-relay sender gets nothing.
+   * Everything else gets the frozen empty list.
    */
-  authorizationFor(channelId, senderId) {
+  authorizationFor(channelId, senderId, relaySpeakerId) {
     const meta = this.freshMeta(channelId);
-    const sender = this.freshRoster(channelId)?.get(senderId);
+    const roster = this.freshRoster(channelId);
+    const sender = roster?.get(senderId);
     let audience = "unknown";
     if (meta && sender) {
       if (sender.is_agent) audience = "agent_to_agent";
@@ -32218,11 +32333,22 @@ var BridgeAgent = class _BridgeAgent {
       else if (sender.is_partner) audience = "partner_room";
       else audience = "team_room";
     }
+    let tool_grants = NO_TOOL_GRANTS;
+    if (this.ownerDmDefaultGrants && meta?.is_dm === true && sender) {
+      const pinned = this.channelOwner.get(channelId);
+      const ownerId = pinned && pinned !== "anomalous" ? pinned.identityId : void 0;
+      if (ownerId !== void 0) {
+        const ownerDirect = audience === "owner_dm" && senderId === ownerId;
+        const owner = roster?.get(ownerId);
+        const ownerRelayed = relaySpeakerId !== void 0 && sender.is_relay && relaySpeakerId === ownerId && owner !== void 0 && !owner.is_agent && owner.is_agent_owner;
+        if (ownerDirect || ownerRelayed) tool_grants = OWNER_DM_DEFAULT_READ_GRANTS;
+      }
+    }
     return Object.freeze({
       version: 1,
       audience,
       sender_membership: sender ? "active" : "unknown",
-      tool_grants: Object.freeze([])
+      tool_grants
     });
   }
   /**
@@ -32730,11 +32856,36 @@ var BridgeAgent = class _BridgeAgent {
     this.ingestInFlight = entry;
     return promise;
   }
+  /**
+   * (4) recv.lag = server message created_at -> this pull's completion, per
+   * application row, counted once per queue id. It makes the daemon-side
+   * receive delay measurable (recv.pull alone times only the HTTP call).
+   * Cross-clock: daemon-vs-server skew lands in the sample; a negative lag
+   * is clamped to 0. The server serialises a naive UTC datetime (no offset),
+   * which Date.parse would read as LOCAL time, so a bare timestamp is UTC.
+   */
+  recordRecvLag(rows) {
+    const now = Date.now();
+    for (const row of rows) {
+      if (row.message_type !== "application" || typeof row.queue_id !== "string") continue;
+      if (typeof row.created_at !== "string" || this.recvLagSeen.has(row.queue_id)) continue;
+      const iso = /(Z|[+-]\d{2}:?\d{2})$/i.test(row.created_at) ? row.created_at : `${row.created_at}Z`;
+      const createdAt = Date.parse(iso);
+      if (!Number.isFinite(createdAt)) continue;
+      this.recvLagSeen.add(row.queue_id);
+      if (this.recvLagSeen.size > _BridgeAgent.RECV_LAG_SEEN_CAP) {
+        const oldest = this.recvLagSeen.values().next().value;
+        if (oldest !== void 0) this.recvLagSeen.delete(oldest);
+      }
+      this.latency.record("recv.lag", Math.max(0, now - createdAt));
+    }
+  }
   async ingestCycle() {
     if (this.closingDown) return;
     const cycleStart = performance.now();
     try {
       const rows = await this.latency.time("recv.pull", () => this.backend.pullDelivery(this.cfg.deviceId));
+      this.recordRecvLag(rows);
       const channelIds = /* @__PURE__ */ new Set();
       for (const row of rows) {
         if (row.connect_channel_id) channelIds.add(row.connect_channel_id);
@@ -32991,21 +33142,23 @@ var BridgeAgent = class _BridgeAgent {
             )?.name;
             const turnAuthorization = this.authorizationFor(
               m.channelId,
-              m.envelope.sender_id
+              m.envelope.sender_id,
+              speaker?.identityId
             );
             const runtimeMemory = this.memoryForTurn(m.channelId, turnAuthorization);
             const voiceGuidance = m.voiceMode ? selectVoiceGuidance(meta?.is_dm, m.voiceDefaultResponder) : void 0;
             const humanTurn = senderIsAgent !== true || speaker !== void 0;
             const fastPathEligible = Boolean(m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
+            const turnText = parsed.text;
+            const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
+            const coalescible = this.voiceCoalesceWindowMs > 0 && m.voiceMode === true && speaker !== void 0 && parsed.transcribed === true && voiceGuidance !== void 0 && !isCallStart;
             let fastPathRoomBlocked = false;
-            if (fastPathEligible && meta && meta.is_dm === false) {
+            if (!coalescible && fastPathEligible && meta && meta.is_dm === false) {
               const reserved = this.fastReplyReserved.get(m.channelId) ?? 0;
               if (this.rateFloor.available(`room:${m.channelId}`) - reserved < 2) fastPathRoomBlocked = true;
             }
             if (fastPathRoomBlocked) this.fastPathSkipped++;
             const fastPathFiring = fastPathEligible && !fastPathRoomBlocked && !this.pausedChannels.has(m.channelId);
-            const turnText = parsed.text;
-            const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
             const fastGreeting = isCallStart && fastPathFiring;
             const runtimeVoice = (ackSent) => m.voiceMode ? {
               voice: true,
@@ -33026,6 +33179,95 @@ var BridgeAgent = class _BridgeAgent {
               ...speaker ? { speaker } : {},
               ...runtimeVoice(ackSent)
             });
+            if (coalescible) {
+              if (this.voiceCoalescedIds.has(m.messageId) || this.runtimePendingIds.has(m.messageId)) {
+                acked.push(m.queueId);
+                continue;
+              }
+              const windowKey = `${m.channelId}\0${speaker.identityId}`;
+              const open = this.voiceCoalescing.get(windowKey);
+              if (open && !open.closed) {
+                open.ids.push(m.messageId);
+                open.parts.push(turnText);
+                const staging = (async () => {
+                  const ok = await this.stageHeldRuntimeMessage(runtimeEntry(false, await runtimeMemory));
+                  if (!ok) {
+                    const i = open.ids.indexOf(m.messageId);
+                    if (i > 0) {
+                      open.ids.splice(i, 1);
+                      open.parts.splice(i, 1);
+                    }
+                  }
+                  return ok;
+                })();
+                open.pending = Promise.all([open.pending, staging]);
+                if (!await staging) continue;
+                this.noteVoiceCoalesced(m.messageId);
+                acked.push(m.queueId);
+                continue;
+              }
+              const held = runtimeEntry(false, await runtimeMemory);
+              if (!await this.stageHeldRuntimeMessage(held)) continue;
+              this.noteVoiceCoalesced(m.messageId);
+              const win = {
+                speakerId: speaker.identityId,
+                ids: [m.messageId],
+                parts: [turnText],
+                closed: false,
+                pending: Promise.resolve()
+              };
+              this.voiceCoalescing.set(windowKey, win);
+              const openedAt = Date.now();
+              const channelId = m.channelId;
+              const senderId = m.envelope.sender_id;
+              const isRoom = meta?.is_dm === false;
+              this.enqueueFastReply(channelId, async () => {
+                await waitMs(openedAt + this.voiceCoalesceWindowMs - Date.now());
+                win.closed = true;
+                if (this.voiceCoalescing.get(windowKey) === win) this.voiceCoalescing.delete(windowKey);
+                await win.pending;
+                if (this.closingDown) return;
+                const [firstId, ...tailIds] = win.ids;
+                if (tailIds.length) this.voiceCoalescedTails.set(firstId, tailIds);
+                const text = win.parts.join(" ");
+                const merged = { ...held, text };
+                void recordInboundMemory(this.memory, channelId, senderId, text, firstId, "voice");
+                let roomBlocked = false;
+                if (fastPathEligible && isRoom) {
+                  const reserved = this.fastReplyReserved.get(channelId) ?? 0;
+                  if (this.rateFloor.available(`room:${channelId}`) - reserved < 2) roomBlocked = true;
+                }
+                if (roomBlocked) this.fastPathSkipped++;
+                const plan = fastPathEligible && !roomBlocked && !this.pausedChannels.has(channelId) ? this.planFastPath(firstId, text, false) : void 0;
+                if (!plan || plan.kind === "dup" || plan.kind === "skip") {
+                  if (plan?.kind === "skip" && plan.full) this.fastPathSkipped++;
+                  await this.settleHeldRuntimeMessage(merged, true);
+                  return;
+                }
+                this.markFastPathSeen(firstId);
+                if (plan.kind === "ack") {
+                  this.fastPathDeferred++;
+                  if (plan.intent) this.fastPathIntentDeferred++;
+                }
+                const release = this.reserveFastReply(channelId);
+                try {
+                  await this.speakAndSettle(
+                    { channelId, messageId: firstId, senderId, authorization: turnAuthorization },
+                    plan,
+                    merged,
+                    { ...merged, ...runtimeVoice(true) },
+                    text,
+                    voiceGuidance,
+                    speaker,
+                    false
+                  );
+                } finally {
+                  release();
+                }
+              }, false);
+              acked.push(m.queueId);
+              continue;
+            }
             if (fastPathFiring) {
               const fastSpeaker = speaker ?? (senderName ? { identityId: m.envelope.sender_id, displayName: senderName } : void 0);
               const fastText = fastGreeting ? greetingTurnFor(this.voiceSettings ?? DEFAULT_VOICE_SETTINGS, fastSpeaker?.displayName) : parsed.text;
@@ -33051,11 +33293,11 @@ var BridgeAgent = class _BridgeAgent {
                   this.fastPathDeferred++;
                   if (ack.intent) this.fastPathIntentDeferred++;
                 }
-                this.enqueueFastReply(m.channelId, async () => {
-                  const outcome = ack ? await this.sendFastLine(turn.channelId, turn.messageId, ack.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidanceForFast, fastSpeaker, greeting);
-                  if (outcome === "answered") this.settleHeldRuntimeMessage(held, false);
-                  else this.settleHeldRuntimeMessage(outcome === "deferred" ? { ...held, ...runtimeVoice(true) } : held, true);
-                });
+                const heldAfterAck = { ...held, ...runtimeVoice(true) };
+                this.enqueueFastReply(
+                  m.channelId,
+                  () => this.speakAndSettle(turn, ack ?? plan, held, heldAfterAck, fastText, guidanceForFast, fastSpeaker, greeting)
+                );
               }
             } else {
               if (!await this.stageRuntimeMessageInOrder(runtimeEntry(false, await runtimeMemory))) continue;
@@ -33476,6 +33718,11 @@ var BridgeAgent = class _BridgeAgent {
       this.deliveryAttempts.delete(messageId);
       this.redeliverNotBefore.delete(messageId);
       this.supersedeRefundable.delete(messageId);
+      const tails = this.voiceCoalescedTails.get(messageId);
+      if (tails) {
+        this.voiceCoalescedTails.delete(messageId);
+        this.ackRuntimeMessages(tails);
+      }
     }
   }
   async restoreRuntimeInbox() {

package/dist/bridge-agent.d.ts

@@ -51,10 +51,32 @@ export type BridgeToolGrant = {
 };
 /**
  * Immutable authorization context derived from authenticated backend roster
- * data. The E2E plaintext never contributes to these claims. Tool grants are
- * intentionally empty until the channel-grant persistence/API lands; this
- * makes the new contract fail closed during staged deployment.
+ * data. The E2E plaintext never contributes to these claims, with ONE bounded
+ * exception: a relayed voice turn's `speaker_identity_id`, honoured only when
+ * the envelope's authenticated sender is the channel's server-marked relay.
+ *
+ * Tool grants (architect ruling, 2026-10-02): until channel-grant persistence
+ * lands, the ONLY non-empty grant list is OWNER_DM_DEFAULT_READ_GRANTS
+ * (`current_time` + `web_search`, read mode), and only on a DM whose sender is
+ * the pinned structural owner (or a relayed voice turn whose speaker is). Every
+ * other audience, an unpinned or anomalous owner, and the kill switch
+ * `SECURECOMS_OWNER_DM_DEFAULT_GRANTS` (anything but unset/`on`) get `[]`.
+ * SEC-06 is LIVE for these two tools: docs/security/sec-06-runtime-bounds-audit.md.
+ */
+/**
+ * Architect ruling 2026-10-02: the default read grants an owner DM carries.
+ * A frozen constant in the daemon, NOT runtime config: a runtime cannot widen
+ * it, and the runtime's own tool allow-list still intersects it (a tool the
+ * runtime does not load is never offered). `fetch_url`, `echo`, `sql_query`
+ * and `http_request` are deliberately absent.
+ */
+export declare const OWNER_DM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
+/**
+ * Kill switch for OWNER_DM_DEFAULT_READ_GRANTS, read once at BridgeAgent
+ * construction (daemon startup). Unset or exactly `on` keeps the grants;
+ * any other value (`off`, `0`, `false`, empty) sends `[]` on every turn.
  */
+export declare function ownerDmDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
 export interface BridgeAuthorization {
     readonly version: 1;
     readonly audience: AgentAudience;
@@ -272,6 +294,13 @@ export interface BridgeAgentDeps {
     fastLlm?: {
         complete(messages: ChatMessage[]): Promise<string>;
     };
+    /**
+     * Voice repeats (a): how long a relayed transcribed voice turn waits for
+     * the rest of a VAD-split utterance, measured from its first fragment
+     * (default: env `SECURECOMS_VOICE_COALESCE_MS`, else 0 = disabled).
+     * Injected so tests do not wait the full window.
+     */
+    voiceCoalesceWindowMs?: number;
     /**
      * B7 (FileSafe vault): persistence for the vault kekset's owner-pin TOFU
      * state. Defaults to a {@link FileOwnerAuthorityStore} at
@@ -280,6 +309,22 @@ export interface BridgeAgentDeps {
      */
     vaultOwnerStore?: OwnerAuthorityStore;
 }
+/**
+ * Voice repeats (a), owner report 2026-10-02: one spoken question reached the
+ * bridge as two relayed turns ~2 s apart (the relay's VAD split it), which
+ * produced a fast reply to the fragment, an ack, and a runtime answer.
+ * Relayed transcribed voice turns from the same speaker on the same channel
+ * that arrive within this window of the FIRST fragment are joined into one
+ * turn before the fast path plans it. The cost is that every relayed voice
+ * turn waits this long before it is answered, so it is OFF by default (0):
+ * the observed ~2 s split would not fit a window short enough for live
+ * voice. Enable with env `SECURECOMS_VOICE_COALESCE_MS` (read at startup).
+ */
+export declare const VOICE_COALESCE_WINDOW_MS = 0;
+/** Upper bound for the window: a typo must not park every voice turn for minutes. */
+export declare const VOICE_COALESCE_WINDOW_MAX_MS = 5000;
+/** `SECURECOMS_VOICE_COALESCE_MS` as integer ms, clamped to VOICE_COALESCE_WINDOW_MAX_MS; anything else is 0 (disabled). */
+export declare function voiceCoalesceWindowFromEnv(env?: NodeJS.ProcessEnv): number;
 /** Default inbound-buffer cap (messages) when deps.maxBuffer is unset. */
 export declare const DEFAULT_MAX_BUFFER = 1000;
 /**
@@ -738,6 +783,19 @@ export declare class BridgeAgent {
     /** Room send-floor tokens reserved by queued fast replies, per channel (F3). */
     private readonly fastReplyReserved;
     private static readonly FAST_REPLY_MAX_JOBS;
+    /** Voice repeats (a): see {@link VOICE_COALESCE_WINDOW_MS}. */
+    private readonly voiceCoalesceWindowMs;
+    /** H1: fast-path reply ids being published right now (recorded as voice memory). */
+    private readonly spokenReplyIds;
+    /** Open coalescing windows, keyed by channel + speaker. */
+    private readonly voiceCoalescing;
+    /** Ids of every coalesced fragment (capped FIFO): a redelivered row is acked, never a second turn. */
+    private readonly voiceCoalescedIds;
+    /** Merged turn id -> the absorbed fragments' held frames, retired with it. */
+    private readonly voiceCoalescedTails;
+    /** (4) recv.lag: application queue ids already measured (capped FIFO), so a re-pulled row is not re-counted. */
+    private readonly recvLagSeen;
+    private static readonly RECV_LAG_SEEN_CAP;
     /** Fast-path turns handed to the runtime behind a spoken ack (LLM [[DEFER]], pre-check, or ack_only). */
     private fastPathDeferred;
     /** Of those, `full`-mode turns the deterministic pre-check deferred without calling the fast model. */
@@ -830,6 +888,8 @@ export declare class BridgeAgent {
      * back to the delivery-row-driven Task 11 behaviour only.
      */
     private readonly selfHealSweepEnabled;
+    /** Read once at startup; see ownerDmDefaultGrantsEnabled. */
+    private readonly ownerDmDefaultGrants;
     /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
     private static readonly SELF_HEAL_SWEEP_INTERVAL_MS;
     /**
@@ -1658,6 +1718,7 @@ export declare class BridgeAgent {
      * Owner report 2026-10-02 (calls never used tools) motivates "ack".
      */
     private planFastPath;
+    private noteVoiceCoalesced;
     private markFastPathSeen;
     /**
      * Off-cycle per-channel queue: one promise chain per channel, so within a
@@ -1668,6 +1729,15 @@ export declare class BridgeAgent {
      * reserve a room send-floor token until they finish. A job never throws.
      */
     private enqueueFastReply;
+    /** Count a fast reply against FAST_REPLY_MAX_JOBS and reserve its room send-floor token; returns the release. */
+    private reserveFastReply;
+    /**
+     * Speak a planned fast turn ("ack" or "fast") and settle its held frame:
+     * retired when the fast model answered alone, otherwise released to the
+     * runtime (with the "ack already spoken" guidance only when an ack or a
+     * deferring fast reply was actually published — F3).
+     */
+    private speakAndSettle;
     /**
      * Stage a runtime frame without overtaking a turn of the same channel that
      * is still queued behind the fast path (F2): while the channel has a queue,
@@ -1676,6 +1746,8 @@ export declare class BridgeAgent {
     private stageRuntimeMessageInOrder;
     /** Test seam: resolves once every queued fast reply has settled. */
     settleFastReplies(): Promise<void>;
+    /** Send a line the voice fast path speaks: its memory record is "voice" (H1). */
+    private sendSpoken;
     /** Speak a fixed acknowledgement line; failures are counted, never thrown. */
     private sendFastLine;
     /**
@@ -1705,6 +1777,21 @@ export declare class BridgeAgent {
     private stageHeldRuntimeMessage;
     /** Settle a held frame: the fast path answered alone (retire it) or the runtime answers next (release it, in channel order). */
     private settleHeldRuntimeMessage;
+    /**
+     * Voice repeats (b): a held frame's memory was read when its turn ARRIVED,
+     * before the replies queued ahead of it (an earlier turn's fast reply, this
+     * turn's own ack) were spoken. The runtime replaces its history with the
+     * frame's memory, so with the arrival snapshot it answered an
+     * already-answered turn again. At release the context is re-read and the
+     * AGENT turns it holds beyond the snapshot (afterPublish ->
+     * recordOutboundMemory) are appended to the snapshot. Peer turns recorded
+     * since (this turn itself, later turns) are not, so the frame stays
+     * prior-turn-only for what the runtime is about to answer. New turns are
+     * found by recorded time, never by `seq` (the OpenClaw provider renumbers
+     * seq per read). A failed re-read keeps the arrival snapshot.
+     */
+    private memoryAtRelease;
+    private static readonly TURN_MEMORY_LIMIT;
     /**
      * List channels in one enclave (default: the daemon's own home enclave).
      * Task 3: called per-*known* enclave by refreshChannelMeta so a
@@ -1867,6 +1954,17 @@ export declare class BridgeAgent {
      * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
      * guess. The returned object and grant array are frozen before they cross the
      * daemon boundary so one consumer cannot widen a later execution check.
+     *
+     * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
+     * the kill switch is on, the channel is a DM, and EITHER
+     *   (a) audience is owner_dm AND the sender is the pinned structural owner
+     *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
+     *       alone gets nothing; OR
+     *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
+     *       relayed `speaker_identity_id` (passed by the caller only for relay
+     *       turns) is that same pinned owner, whose roster row is the agent's
+     *       owner. A speaker claim from any non-relay sender gets nothing.
+     * Everything else gets the frozen empty list.
      */
     private authorizationFor;
     /**
@@ -2015,6 +2113,15 @@ export declare class BridgeAgent {
      */
     private ingestOnce;
     private startIngestCycle;
+    /**
+     * (4) recv.lag = server message created_at -> this pull's completion, per
+     * application row, counted once per queue id. It makes the daemon-side
+     * receive delay measurable (recv.pull alone times only the HTTP call).
+     * Cross-clock: daemon-vs-server skew lands in the sample; a negative lag
+     * is clamped to 0. The server serialises a naive UTC datetime (no offset),
+     * which Date.parse would read as LOCAL time, so a bare timestamp is UTC.
+     */
+    private recordRecvLag;
     private ingestCycle;
     drain(channelId: string | undefined, waitSeconds: number): Promise<BridgeMessage[]>;
     /** Notify-only SSE signal: fired after a buffer push. Listener pulls via takeBuffered. */

package/dist/index.js

@@ -27971,9 +27971,9 @@ async function recordInboundMemory(sink, channelId, senderId, text, messageId, m
   } catch {
   }
 }
-async function recordOutboundMemory(sink, channelId, text, messageId) {
+async function recordOutboundMemory(sink, channelId, text, messageId, modality = "text") {
   try {
-    await sink.record({ conversationId: channelId, role: "agent", text, modality: "text", messageId });
+    await sink.record({ conversationId: channelId, role: "agent", text, modality, messageId });
   } catch {
   }
 }
@@ -28958,6 +28958,15 @@ function logPendingCommitResolved(outcome) {
       writeServiceLog2("info", "mls.pending_commit.resolved.unknown");
   }
 }
+var OWNER_DM_DEFAULT_READ_GRANTS = Object.freeze([
+  Object.freeze({ tool: "current_time", mode: "read" }),
+  Object.freeze({ tool: "web_search", mode: "read" })
+]);
+var NO_TOOL_GRANTS = Object.freeze([]);
+function ownerDmDefaultGrantsEnabled(env = process.env) {
+  const v = env.SECURECOMS_OWNER_DM_DEFAULT_GRANTS;
+  return v === void 0 || v === "on";
+}
 var VAULT_REF_BARE_TEXT = "[Files link]";
 var VOICE_MODE_GUIDANCE = "Reply immediately and conversationally, one short sentence per message; never bundle multiple points into one message.";
 var FAST_PATH_SPOKEN_GUIDANCE = "A one-sentence spoken acknowledgement has already been sent for this turn. Reply only with information it did not contain, in one or two short sentences; if there is nothing to add, send nothing.";
@@ -28969,6 +28978,20 @@ function selectVoiceGuidance(isDm, voiceDefaultResponder) {
   }
   return VOICE_MODE_GUIDANCE;
 }
+var VOICE_COALESCE_WINDOW_MS = 0;
+var VOICE_COALESCE_WINDOW_MAX_MS = 5e3;
+function voiceCoalesceWindowFromEnv(env = process.env) {
+  const raw = env.SECURECOMS_VOICE_COALESCE_MS;
+  if (raw === void 0 || !/^\d{1,6}$/.test(raw.trim())) return VOICE_COALESCE_WINDOW_MS;
+  return Math.min(Number(raw.trim()), VOICE_COALESCE_WINDOW_MAX_MS);
+}
+function waitMs(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => {
+    const t = setTimeout(resolve, ms);
+    t.unref?.();
+  });
+}
 var DEFAULT_MAX_BUFFER = 1e3;
 var DEFAULT_MAX_DELIVERY_ATTEMPTS = 5;
 var REDELIVERY_BACKOFF_BASE_MS = 5e3;
@@ -29253,6 +29276,7 @@ var BridgeAgent = class _BridgeAgent {
     this.fastLlm = deps.fastLlm ?? (cfg.voice?.fastPath.enabled ? new FastLlmClient(cfg.voice.fastPath, this.fetchImpl) : void 0);
     this.voiceSettingsSource = cfg.voice ? "file" : "none";
     this.latency = deps.latency ?? new LatencyRecorder();
+    this.voiceCoalesceWindowMs = Math.max(0, deps.voiceCoalesceWindowMs ?? voiceCoalesceWindowFromEnv());
     this.maxBuffer = deps.maxBuffer ?? DEFAULT_MAX_BUFFER;
     this.maxDeliveryAttempts = deps.maxDeliveryAttempts ?? DEFAULT_MAX_DELIVERY_ATTEMPTS;
     this.maxAgentHops = deps.maxAgentHops ?? DEFAULT_MAX_AGENT_HOPS;
@@ -29501,6 +29525,19 @@ var BridgeAgent = class _BridgeAgent {
   /** Room send-floor tokens reserved by queued fast replies, per channel (F3). */
   fastReplyReserved = /* @__PURE__ */ new Map();
   static FAST_REPLY_MAX_JOBS = 32;
+  /** Voice repeats (a): see {@link VOICE_COALESCE_WINDOW_MS}. */
+  voiceCoalesceWindowMs;
+  /** H1: fast-path reply ids being published right now (recorded as voice memory). */
+  spokenReplyIds = /* @__PURE__ */ new Set();
+  /** Open coalescing windows, keyed by channel + speaker. */
+  voiceCoalescing = /* @__PURE__ */ new Map();
+  /** Ids of every coalesced fragment (capped FIFO): a redelivered row is acked, never a second turn. */
+  voiceCoalescedIds = /* @__PURE__ */ new Set();
+  /** Merged turn id -> the absorbed fragments' held frames, retired with it. */
+  voiceCoalescedTails = /* @__PURE__ */ new Map();
+  /** (4) recv.lag: application queue ids already measured (capped FIFO), so a re-pulled row is not re-counted. */
+  recvLagSeen = /* @__PURE__ */ new Set();
+  static RECV_LAG_SEEN_CAP = 2e3;
   /** Fast-path turns handed to the runtime behind a spoken ack (LLM [[DEFER]], pre-check, or ack_only). */
   fastPathDeferred = 0;
   /** Of those, `full`-mode turns the deterministic pre-check deferred without calling the fast model. */
@@ -29594,6 +29631,8 @@ var BridgeAgent = class _BridgeAgent {
    * back to the delivery-row-driven Task 11 behaviour only.
    */
   selfHealSweepEnabled = process.env.SECURECOMS_SELF_HEAL_SWEEP !== "false";
+  /** Read once at startup; see ownerDmDefaultGrantsEnabled. */
+  ownerDmDefaultGrants = ownerDmDefaultGrantsEnabled();
   /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
   static SELF_HEAL_SWEEP_INTERVAL_MS = SELF_HEAL_SWEEP_INTERVAL_MS;
   /**
@@ -30958,7 +30997,8 @@ var BridgeAgent = class _BridgeAgent {
   /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
   afterPublish(channelId, body, id, opts) {
     if (opts.agentTurn !== false) this.agentHops.noteOwnSend(channelId);
-    if (body.kind === "text") void recordOutboundMemory(this.memory, channelId, body.text, id);
+    const modality = this.spokenReplyIds.has(id) ? "voice" : "text";
+    if (body.kind === "text") void recordOutboundMemory(this.memory, channelId, body.text, id, modality);
   }
   isIdempotentSend(messageId, opts) {
     if (opts.inReplyTo === void 0 && opts.idempotencyKey === void 0) return false;
@@ -31136,26 +31176,26 @@ var BridgeAgent = class _BridgeAgent {
       } catch (e) {
         if (e instanceof ReplyInFlightError) {
           if (inFlight >= REPLY_IN_FLIGHT_RETRIES) throw e;
-          const waitMs2 = Math.min(
+          const waitMs3 = Math.min(
             REPLY_RATE_LIMIT_MAX_WAIT_MS,
             Math.max(REPLY_IN_FLIGHT_BASE_WAIT_MS * 2 ** inFlight, e.retryAfterSec * 1e3)
           );
           inFlight++;
-          writeServiceLog2("info", "reply.in_flight_retry", { attempt: inFlight, wait_ms: waitMs2 });
-          await this.replySleep(waitMs2);
+          writeServiceLog2("info", "reply.in_flight_retry", { attempt: inFlight, wait_ms: waitMs3 });
+          await this.replySleep(waitMs3);
           continue;
         }
         const backendSec = backendRetryAfterSec(e);
         const wait = e instanceof RateLimitedError ? e.retryAfterMs : backendSec !== void 0 ? backendSec * 1e3 : null;
         if (wait === null) throw e;
-        const waitMs = Math.min(REPLY_RATE_LIMIT_MAX_WAIT_MS, Math.max(REPLY_RATE_LIMIT_MIN_WAIT_MS, wait));
+        const waitMs2 = Math.min(REPLY_RATE_LIMIT_MAX_WAIT_MS, Math.max(REPLY_RATE_LIMIT_MIN_WAIT_MS, wait));
         if (rateLimited >= REPLY_RATE_LIMIT_RETRIES) {
-          throw e instanceof RateLimitedError ? e : new RateLimitedError(channelId, waitMs);
+          throw e instanceof RateLimitedError ? e : new RateLimitedError(channelId, waitMs2);
         }
         rateLimited++;
         this.replyRateLimitRetries++;
-        writeServiceLog2("info", "reply.rate_limited_retry", { attempt: rateLimited, wait_ms: waitMs });
-        await this.replySleep(waitMs);
+        writeServiceLog2("info", "reply.rate_limited_retry", { attempt: rateLimited, wait_ms: waitMs2 });
+        await this.replySleep(waitMs2);
       }
     }
   }
@@ -31644,6 +31684,13 @@ var BridgeAgent = class _BridgeAgent {
     if (needsRuntime(text)) return { kind: "ack", line: deferAck(messageId), intent: true };
     return { kind: "fast" };
   }
+  noteVoiceCoalesced(messageId) {
+    this.voiceCoalescedIds.add(messageId);
+    if (this.voiceCoalescedIds.size > _BridgeAgent.FAST_PATH_SEEN_CAP) {
+      const oldest = this.voiceCoalescedIds.values().next().value;
+      if (oldest !== void 0) this.voiceCoalescedIds.delete(oldest);
+    }
+  }
   markFastPathSeen(messageId) {
     this.fastPathSeen.add(messageId);
     if (this.fastPathSeen.size > _BridgeAgent.FAST_PATH_SEEN_CAP) {
@@ -31660,22 +31707,36 @@ var BridgeAgent = class _BridgeAgent {
    * reserve a room send-floor token until they finish. A job never throws.
    */
   enqueueFastReply(channelId, job, spends = true) {
-    if (spends) {
-      this.fastReplyJobs++;
-      this.fastReplyReserved.set(channelId, (this.fastReplyReserved.get(channelId) ?? 0) + 1);
-    }
+    const release = spends ? this.reserveFastReply(channelId) : void 0;
     const prev = this.fastReplyChains.get(channelId) ?? Promise.resolve();
     const next = prev.then(() => this.outsideIngestCycle(job)).catch((e) => writeServiceLog2("warn", "voice.fast_reply_job_failed", {}, e)).finally(() => {
-      if (spends) {
-        this.fastReplyJobs--;
-        const left3 = (this.fastReplyReserved.get(channelId) ?? 1) - 1;
-        if (left3 > 0) this.fastReplyReserved.set(channelId, left3);
-        else this.fastReplyReserved.delete(channelId);
-      }
+      release?.();
       if (this.fastReplyChains.get(channelId) === next) this.fastReplyChains.delete(channelId);
     });
     this.fastReplyChains.set(channelId, next);
   }
+  /** Count a fast reply against FAST_REPLY_MAX_JOBS and reserve its room send-floor token; returns the release. */
+  reserveFastReply(channelId) {
+    this.fastReplyJobs++;
+    this.fastReplyReserved.set(channelId, (this.fastReplyReserved.get(channelId) ?? 0) + 1);
+    return () => {
+      this.fastReplyJobs--;
+      const left3 = (this.fastReplyReserved.get(channelId) ?? 1) - 1;
+      if (left3 > 0) this.fastReplyReserved.set(channelId, left3);
+      else this.fastReplyReserved.delete(channelId);
+    };
+  }
+  /**
+   * Speak a planned fast turn ("ack" or "fast") and settle its held frame:
+   * retired when the fast model answered alone, otherwise released to the
+   * runtime (with the "ack already spoken" guidance only when an ack or a
+   * deferring fast reply was actually published — F3).
+   */
+  async speakAndSettle(turn, plan, held, heldAfterAck, fastText, guidance, fastSpeaker, greeting) {
+    const outcome = plan.kind === "ack" ? await this.sendFastLine(turn.channelId, turn.messageId, plan.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidance, fastSpeaker, greeting);
+    if (outcome === "answered") await this.settleHeldRuntimeMessage(held, false);
+    else await this.settleHeldRuntimeMessage(outcome === "deferred" ? heldAfterAck : held, true);
+  }
   /**
    * Stage a runtime frame without overtaking a turn of the same channel that
    * is still queued behind the fast path (F2): while the channel has a queue,
@@ -31691,10 +31752,19 @@ var BridgeAgent = class _BridgeAgent {
   async settleFastReplies() {
     while (this.fastReplyChains.size) await Promise.all([...this.fastReplyChains.values()]);
   }
+  /** Send a line the voice fast path speaks: its memory record is "voice" (H1). */
+  async sendSpoken(channelId, text, messageId) {
+    this.spokenReplyIds.add(messageId);
+    try {
+      await this.send(channelId, text, messageId);
+    } finally {
+      this.spokenReplyIds.delete(messageId);
+    }
+  }
   /** Speak a fixed acknowledgement line; failures are counted, never thrown. */
   async sendFastLine(channelId, messageId, line) {
     try {
-      await this.send(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId));
+      await this.sendSpoken(channelId, line, fastReplyId(this.replyIdKey, this.cfg.identityId, channelId, messageId));
       this.fastPathSent++;
       return true;
     } catch (e) {
@@ -31751,7 +31821,7 @@ var BridgeAgent = class _BridgeAgent {
       const raw = await this.latency.time("voice.fast_llm", () => fastLlm.complete(messages));
       const { reply, defer } = splitFastReply(raw, 200, maxSentences);
       if (!reply) return "failed";
-      await this.send(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
+      await this.sendSpoken(m.channelId, reply, fastReplyId(this.replyIdKey, this.cfg.identityId, m.channelId, m.messageId));
       this.fastPathSent++;
       if (defer) this.fastPathDeferred++;
       return defer ? "deferred" : "answered";
@@ -31784,15 +31854,48 @@ var BridgeAgent = class _BridgeAgent {
     }
   }
   /** Settle a held frame: the fast path answered alone (retire it) or the runtime answers next (release it, in channel order). */
-  settleHeldRuntimeMessage(message, release) {
+  async settleHeldRuntimeMessage(message, release) {
     if (!this.runtimePendingIds.has(message.message_id)) return;
     if (!release) {
       this.ackRuntimeMessages([message.message_id]);
       return;
     }
-    this.buffer.push(message);
+    const memory = await this.memoryAtRelease(message);
+    if (this.closingDown || !this.runtimePendingIds.has(message.message_id)) return;
+    this.buffer.push(memory === message.memory ? message : { ...message, memory });
     this.wakeListeners();
   }
+  /**
+   * Voice repeats (b): a held frame's memory was read when its turn ARRIVED,
+   * before the replies queued ahead of it (an earlier turn's fast reply, this
+   * turn's own ack) were spoken. The runtime replaces its history with the
+   * frame's memory, so with the arrival snapshot it answered an
+   * already-answered turn again. At release the context is re-read and the
+   * AGENT turns it holds beyond the snapshot (afterPublish ->
+   * recordOutboundMemory) are appended to the snapshot. Peer turns recorded
+   * since (this turn itself, later turns) are not, so the frame stays
+   * prior-turn-only for what the runtime is about to answer. New turns are
+   * found by recorded time, never by `seq` (the OpenClaw provider renumbers
+   * seq per read). A failed re-read keeps the arrival snapshot.
+   */
+  async memoryAtRelease(message) {
+    const prior = message.memory;
+    if (!prior || !this.mayReadOpenClawMemoryForTurn(message.authorization)) return prior;
+    let fresh;
+    try {
+      fresh = await this.memory.context(message.channel_id, _BridgeAgent.TURN_MEMORY_LIMIT);
+    } catch {
+      return prior;
+    }
+    const after = prior.recent.reduce((max, turn) => Math.max(max, turn.ts ?? 0), message.ts);
+    const spoken = fresh.recent.filter((turn) => turn.role === "agent" && turn.ts !== void 0 && turn.ts > after);
+    if (spoken.length === 0) return prior;
+    return {
+      recent: [...prior.recent, ...spoken].slice(-_BridgeAgent.TURN_MEMORY_LIMIT),
+      facts: prior.facts
+    };
+  }
+  static TURN_MEMORY_LIMIT = 50;
   /**
    * List channels in one enclave (default: the daemon's own home enclave).
    * Task 3: called per-*known* enclave by refreshChannelMeta so a
@@ -32054,10 +32157,22 @@ var BridgeAgent = class _BridgeAgent {
    * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
    * guess. The returned object and grant array are frozen before they cross the
    * daemon boundary so one consumer cannot widen a later execution check.
+   *
+   * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
+   * the kill switch is on, the channel is a DM, and EITHER
+   *   (a) audience is owner_dm AND the sender is the pinned structural owner
+   *       (`channelOwner`, never "anomalous") — a lying `is_agent_owner` flag
+   *       alone gets nothing; OR
+   *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
+   *       relayed `speaker_identity_id` (passed by the caller only for relay
+   *       turns) is that same pinned owner, whose roster row is the agent's
+   *       owner. A speaker claim from any non-relay sender gets nothing.
+   * Everything else gets the frozen empty list.
    */
-  authorizationFor(channelId, senderId) {
+  authorizationFor(channelId, senderId, relaySpeakerId) {
     const meta = this.freshMeta(channelId);
-    const sender = this.freshRoster(channelId)?.get(senderId);
+    const roster = this.freshRoster(channelId);
+    const sender = roster?.get(senderId);
     let audience = "unknown";
     if (meta && sender) {
       if (sender.is_agent) audience = "agent_to_agent";
@@ -32066,11 +32181,22 @@ var BridgeAgent = class _BridgeAgent {
       else if (sender.is_partner) audience = "partner_room";
       else audience = "team_room";
     }
+    let tool_grants = NO_TOOL_GRANTS;
+    if (this.ownerDmDefaultGrants && meta?.is_dm === true && sender) {
+      const pinned = this.channelOwner.get(channelId);
+      const ownerId = pinned && pinned !== "anomalous" ? pinned.identityId : void 0;
+      if (ownerId !== void 0) {
+        const ownerDirect = audience === "owner_dm" && senderId === ownerId;
+        const owner = roster?.get(ownerId);
+        const ownerRelayed = relaySpeakerId !== void 0 && sender.is_relay && relaySpeakerId === ownerId && owner !== void 0 && !owner.is_agent && owner.is_agent_owner;
+        if (ownerDirect || ownerRelayed) tool_grants = OWNER_DM_DEFAULT_READ_GRANTS;
+      }
+    }
     return Object.freeze({
       version: 1,
       audience,
       sender_membership: sender ? "active" : "unknown",
-      tool_grants: Object.freeze([])
+      tool_grants
     });
   }
   /**
@@ -32578,11 +32704,36 @@ var BridgeAgent = class _BridgeAgent {
     this.ingestInFlight = entry;
     return promise;
   }
+  /**
+   * (4) recv.lag = server message created_at -> this pull's completion, per
+   * application row, counted once per queue id. It makes the daemon-side
+   * receive delay measurable (recv.pull alone times only the HTTP call).
+   * Cross-clock: daemon-vs-server skew lands in the sample; a negative lag
+   * is clamped to 0. The server serialises a naive UTC datetime (no offset),
+   * which Date.parse would read as LOCAL time, so a bare timestamp is UTC.
+   */
+  recordRecvLag(rows) {
+    const now = Date.now();
+    for (const row of rows) {
+      if (row.message_type !== "application" || typeof row.queue_id !== "string") continue;
+      if (typeof row.created_at !== "string" || this.recvLagSeen.has(row.queue_id)) continue;
+      const iso = /(Z|[+-]\d{2}:?\d{2})$/i.test(row.created_at) ? row.created_at : `${row.created_at}Z`;
+      const createdAt = Date.parse(iso);
+      if (!Number.isFinite(createdAt)) continue;
+      this.recvLagSeen.add(row.queue_id);
+      if (this.recvLagSeen.size > _BridgeAgent.RECV_LAG_SEEN_CAP) {
+        const oldest = this.recvLagSeen.values().next().value;
+        if (oldest !== void 0) this.recvLagSeen.delete(oldest);
+      }
+      this.latency.record("recv.lag", Math.max(0, now - createdAt));
+    }
+  }
   async ingestCycle() {
     if (this.closingDown) return;
     const cycleStart = performance.now();
     try {
       const rows = await this.latency.time("recv.pull", () => this.backend.pullDelivery(this.cfg.deviceId));
+      this.recordRecvLag(rows);
       const channelIds = /* @__PURE__ */ new Set();
       for (const row of rows) {
         if (row.connect_channel_id) channelIds.add(row.connect_channel_id);
@@ -32839,21 +32990,23 @@ var BridgeAgent = class _BridgeAgent {
             )?.name;
             const turnAuthorization = this.authorizationFor(
               m.channelId,
-              m.envelope.sender_id
+              m.envelope.sender_id,
+              speaker?.identityId
             );
             const runtimeMemory = this.memoryForTurn(m.channelId, turnAuthorization);
             const voiceGuidance = m.voiceMode ? selectVoiceGuidance(meta?.is_dm, m.voiceDefaultResponder) : void 0;
             const humanTurn = senderIsAgent !== true || speaker !== void 0;
             const fastPathEligible = Boolean(m.voiceMode && humanTurn && this.fastLlm && voiceGuidance);
+            const turnText = parsed.text;
+            const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
+            const coalescible = this.voiceCoalesceWindowMs > 0 && m.voiceMode === true && speaker !== void 0 && parsed.transcribed === true && voiceGuidance !== void 0 && !isCallStart;
             let fastPathRoomBlocked = false;
-            if (fastPathEligible && meta && meta.is_dm === false) {
+            if (!coalescible && fastPathEligible && meta && meta.is_dm === false) {
               const reserved = this.fastReplyReserved.get(m.channelId) ?? 0;
               if (this.rateFloor.available(`room:${m.channelId}`) - reserved < 2) fastPathRoomBlocked = true;
             }
             if (fastPathRoomBlocked) this.fastPathSkipped++;
             const fastPathFiring = fastPathEligible && !fastPathRoomBlocked && !this.pausedChannels.has(m.channelId);
-            const turnText = parsed.text;
-            const isCallStart = turnText.trim() === VOICE_CALL_START_MARKER;
             const fastGreeting = isCallStart && fastPathFiring;
             const runtimeVoice = (ackSent) => m.voiceMode ? {
               voice: true,
@@ -32874,6 +33027,95 @@ var BridgeAgent = class _BridgeAgent {
               ...speaker ? { speaker } : {},
               ...runtimeVoice(ackSent)
             });
+            if (coalescible) {
+              if (this.voiceCoalescedIds.has(m.messageId) || this.runtimePendingIds.has(m.messageId)) {
+                acked.push(m.queueId);
+                continue;
+              }
+              const windowKey = `${m.channelId}\0${speaker.identityId}`;
+              const open = this.voiceCoalescing.get(windowKey);
+              if (open && !open.closed) {
+                open.ids.push(m.messageId);
+                open.parts.push(turnText);
+                const staging = (async () => {
+                  const ok = await this.stageHeldRuntimeMessage(runtimeEntry(false, await runtimeMemory));
+                  if (!ok) {
+                    const i = open.ids.indexOf(m.messageId);
+                    if (i > 0) {
+                      open.ids.splice(i, 1);
+                      open.parts.splice(i, 1);
+                    }
+                  }
+                  return ok;
+                })();
+                open.pending = Promise.all([open.pending, staging]);
+                if (!await staging) continue;
+                this.noteVoiceCoalesced(m.messageId);
+                acked.push(m.queueId);
+                continue;
+              }
+              const held = runtimeEntry(false, await runtimeMemory);
+              if (!await this.stageHeldRuntimeMessage(held)) continue;
+              this.noteVoiceCoalesced(m.messageId);
+              const win = {
+                speakerId: speaker.identityId,
+                ids: [m.messageId],
+                parts: [turnText],
+                closed: false,
+                pending: Promise.resolve()
+              };
+              this.voiceCoalescing.set(windowKey, win);
+              const openedAt = Date.now();
+              const channelId = m.channelId;
+              const senderId = m.envelope.sender_id;
+              const isRoom = meta?.is_dm === false;
+              this.enqueueFastReply(channelId, async () => {
+                await waitMs(openedAt + this.voiceCoalesceWindowMs - Date.now());
+                win.closed = true;
+                if (this.voiceCoalescing.get(windowKey) === win) this.voiceCoalescing.delete(windowKey);
+                await win.pending;
+                if (this.closingDown) return;
+                const [firstId, ...tailIds] = win.ids;
+                if (tailIds.length) this.voiceCoalescedTails.set(firstId, tailIds);
+                const text = win.parts.join(" ");
+                const merged = { ...held, text };
+                void recordInboundMemory(this.memory, channelId, senderId, text, firstId, "voice");
+                let roomBlocked = false;
+                if (fastPathEligible && isRoom) {
+                  const reserved = this.fastReplyReserved.get(channelId) ?? 0;
+                  if (this.rateFloor.available(`room:${channelId}`) - reserved < 2) roomBlocked = true;
+                }
+                if (roomBlocked) this.fastPathSkipped++;
+                const plan = fastPathEligible && !roomBlocked && !this.pausedChannels.has(channelId) ? this.planFastPath(firstId, text, false) : void 0;
+                if (!plan || plan.kind === "dup" || plan.kind === "skip") {
+                  if (plan?.kind === "skip" && plan.full) this.fastPathSkipped++;
+                  await this.settleHeldRuntimeMessage(merged, true);
+                  return;
+                }
+                this.markFastPathSeen(firstId);
+                if (plan.kind === "ack") {
+                  this.fastPathDeferred++;
+                  if (plan.intent) this.fastPathIntentDeferred++;
+                }
+                const release = this.reserveFastReply(channelId);
+                try {
+                  await this.speakAndSettle(
+                    { channelId, messageId: firstId, senderId, authorization: turnAuthorization },
+                    plan,
+                    merged,
+                    { ...merged, ...runtimeVoice(true) },
+                    text,
+                    voiceGuidance,
+                    speaker,
+                    false
+                  );
+                } finally {
+                  release();
+                }
+              }, false);
+              acked.push(m.queueId);
+              continue;
+            }
             if (fastPathFiring) {
               const fastSpeaker = speaker ?? (senderName ? { identityId: m.envelope.sender_id, displayName: senderName } : void 0);
               const fastText = fastGreeting ? greetingTurnFor(this.voiceSettings ?? DEFAULT_VOICE_SETTINGS, fastSpeaker?.displayName) : parsed.text;
@@ -32899,11 +33141,11 @@ var BridgeAgent = class _BridgeAgent {
                   this.fastPathDeferred++;
                   if (ack.intent) this.fastPathIntentDeferred++;
                 }
-                this.enqueueFastReply(m.channelId, async () => {
-                  const outcome = ack ? await this.sendFastLine(turn.channelId, turn.messageId, ack.line) ? "deferred" : "failed" : await this.runFastReply(turn, fastText, guidanceForFast, fastSpeaker, greeting);
-                  if (outcome === "answered") this.settleHeldRuntimeMessage(held, false);
-                  else this.settleHeldRuntimeMessage(outcome === "deferred" ? { ...held, ...runtimeVoice(true) } : held, true);
-                });
+                const heldAfterAck = { ...held, ...runtimeVoice(true) };
+                this.enqueueFastReply(
+                  m.channelId,
+                  () => this.speakAndSettle(turn, ack ?? plan, held, heldAfterAck, fastText, guidanceForFast, fastSpeaker, greeting)
+                );
               }
             } else {
               if (!await this.stageRuntimeMessageInOrder(runtimeEntry(false, await runtimeMemory))) continue;
@@ -33324,6 +33566,11 @@ var BridgeAgent = class _BridgeAgent {
       this.deliveryAttempts.delete(messageId);
       this.redeliverNotBefore.delete(messageId);
       this.supersedeRefundable.delete(messageId);
+      const tails = this.voiceCoalescedTails.get(messageId);
+      if (tails) {
+        this.voiceCoalescedTails.delete(messageId);
+        this.ackRuntimeMessages(tails);
+      }
     }
   }
   async restoreRuntimeInbox() {

package/dist/memory-taps.d.ts

@@ -12,6 +12,7 @@ interface MemorySink {
  *  for a turn whose InboxEntry had the server-set `voiceMode` flag, so memory
  *  continuity reflects how the turn actually arrived. */
 export declare function recordInboundMemory(sink: MemorySink, channelId: string, senderId: string, text: string, messageId: string, modality?: "text" | "voice"): Promise<void>;
-/** Record the agent's own outbound text reply. Best-effort. */
-export declare function recordOutboundMemory(sink: MemorySink, channelId: string, text: string, messageId: string): Promise<void>;
+/** Record the agent's own outbound reply. Best-effort. `modality` is "voice"
+ *  for a line the voice fast path spoke (H1), else "text". */
+export declare function recordOutboundMemory(sink: MemorySink, channelId: string, text: string, messageId: string, modality?: "text" | "voice"): Promise<void>;
 export {};

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.26.1";
+export declare const BRIDGE_VERSION = "0.26.2";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.26.1",
+  "version": "0.26.2",
   "type": "module",
   "engines": {
     "node": ">=22.5.0"