@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240206.7c2bca6

package/src/daemon/handlers/__tests__/config-a2a-invite.test.ts

@@ -26,7 +26,7 @@ import { initializeDb } from "../../../memory/db-init.js";
 import { findById } from "../../../memory/invite-store.js";
 import { createA2AInvite, getA2AConfig } from "../config-a2a.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables(): void {
   const sqlite = getSqlite();

package/src/daemon/handlers/__tests__/config-a2a-redeem.test.ts

@@ -28,7 +28,7 @@ import { getSqlite } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";
 import { getA2AConfig, redeemA2AInvite } from "../config-a2a.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables(): void {
   const sqlite = getSqlite();

package/src/daemon/handlers/__tests__/config-a2a.test.ts

@@ -24,7 +24,7 @@ import { getSqlite } from "../../../memory/db-connection.js";
 import { initializeDb } from "../../../memory/db-init.js";
 import { clearA2AConfig, getA2AConfig, setA2AConfig } from "../config-a2a.js";
 
-initializeDb();
+await initializeDb();
 
 function resetTables(): void {
   const sqlite = getSqlite();

package/src/daemon/handlers/config-channels.ts

@@ -1,15 +1,18 @@
 import { createHash, randomBytes } from "node:crypto";
 
+import { MarkChannelRevokedIpcResponseSchema } from "@vellumai/gateway-client/gateway-ipc-contracts";
+
 import { startVerificationCall } from "../../calls/call-domain.js";
 import type { ChannelId } from "../../channels/types.js";
+import { emitContactChange } from "../../contacts/contact-events.js";
 import {
   findContactChannel,
   findGuardianForChannel,
   getChannelById,
   getContact,
 } from "../../contacts/contact-store.js";
-import { revokeMember } from "../../contacts/contacts-write.js";
 import type { ChannelStatus } from "../../contacts/types.js";
+import { ipcCallPersistent } from "../../ipc/gateway-client.js";
 import { getBindingByChannelChat } from "../../memory/external-conversation-store.js";
 import { resolveGuardianName } from "../../prompts/user-reference.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
@@ -25,6 +28,7 @@ import {
   findActiveSession,
   getGuardianBinding,
   getPendingSession,
+  isGuardianBoundForChannel,
   revokeBinding,
   revokePendingSessions,
   updateSessionDelivery,
@@ -77,19 +81,18 @@ export function getReadinessService(): ChannelReadinessService {
 // Extracted business logic functions
 // ---------------------------------------------------------------------------
 
-export function createInboundChallenge(
+export async function createInboundChallenge(
   channel?: ChannelId,
   rebind?: boolean,
   conversationId?: string,
-): ChannelVerificationSessionResult {
-  const resolvedAssistantId = DAEMON_INTERNAL_ASSISTANT_ID;
+): Promise<ChannelVerificationSessionResult> {
   const resolvedChannel = channel ?? "telegram";
 
-  const existingBinding = getGuardianBinding(
-    resolvedAssistantId,
-    resolvedChannel,
-  );
-  if (existingBinding && !rebind) {
+  // Gateway-backed presence guard: block re-binding when a guardian is already
+  // bound. Null-list (gateway unreachable) is treated as bound, so a transient
+  // miss blocks rather than letting a second binding through.
+  const alreadyBound = await isGuardianBoundForChannel(resolvedChannel);
+  if (alreadyBound && !rebind) {
     return {
       success: false,
       error: "already_bound",
@@ -171,23 +174,21 @@ export function getVerificationStatus(
 // Revoke verification binding
 // ---------------------------------------------------------------------------
 
-export function revokeVerificationForChannel(
+export async function revokeVerificationForChannel(
   channel?: ChannelId,
-): ChannelVerificationSessionResult {
+): Promise<ChannelVerificationSessionResult> {
   const assistantId = DAEMON_INTERNAL_ASSISTANT_ID;
   const resolvedChannel = channel ?? "telegram";
 
-  // Cancel any active outbound session so revoke is a complete teardown.
+  // Session teardown stays assistant-side — it is session state, not the ACL
+  // outcome. Cancel any active outbound session and pending challenges first
+  // (the macOS app uses action: "revoke" to cancel an in-flight challenge even
+  // before a binding exists, e.g. during verification setup).
   cancelOutbound({ channel: resolvedChannel });
-
-  // Always revoke pending challenges first — the macOS app uses
-  // action: "revoke" to cancel an in-flight challenge even before
-  // a binding exists (e.g. during verification setup).
   revokePendingSessions(resolvedChannel);
 
-  // Capture binding before revoking so we can revoke the guardian's
-  // contact record — without this, the guardian would still pass
-  // the ACL check after unbinding.
+  // Capture binding before revoking so we can downgrade the guardian's
+  // channel — without this, the guardian would still pass the ACL check.
   const bindingBeforeRevoke = getGuardianBinding(assistantId, resolvedChannel);
   if (!bindingBeforeRevoke) {
     return {
@@ -197,17 +198,15 @@ export function revokeVerificationForChannel(
     };
   }
 
-  // Revoke the member BEFORE the guardian binding so that
-  // revokeMember sees the channel as active/pending and sets the
-  // correct revokedReason ("guardian_binding_revoked"). If the guardian binding
-  // is revoked first, the channel is already marked revoked and the member
-  // revocation becomes a no-op (wrong reason or skipped entirely).
   const contactResult = findContactChannel({
     channelType: resolvedChannel,
     address: bindingBeforeRevoke.guardianExternalUserId,
     externalChatId: bindingBeforeRevoke.guardianDeliveryChatId,
   });
 
+  // Relay the ACL downgrade to the gateway (source of truth). The gateway's
+  // mark_channel_revoked enforces the guardian guard and dual-writes the
+  // contact-channel status back to the assistant DB.
   if (contactResult) {
     const channelStatus: ChannelStatus = contactResult.channel.status;
     if (
@@ -215,10 +214,25 @@ export function revokeVerificationForChannel(
       channelStatus === "pending" ||
       channelStatus === "unverified"
     ) {
-      revokeMember(contactResult.channel.id, "guardian_binding_revoked");
+      const result = await ipcCallPersistent("mark_channel_revoked", {
+        contactChannelId: contactResult.channel.id,
+        reason: "guardian_binding_revoked",
+      });
+      const parsed = MarkChannelRevokedIpcResponseSchema.parse(result);
+      if (!parsed.ok) {
+        throw new Error("mark_channel_revoked relay returned ok: false");
+      }
+      // The gateway dual-write already set the assistant channel to "revoked",
+      // so the later revokeGuardianBinding lookup (active-only) finds nothing
+      // and won't fire the invalidation. Emit it here so open client views
+      // stop showing the channel as active.
+      emitContactChange();
     }
   }
 
+  // The guardian binding is assistant-owned state the gateway relay does not
+  // manage; tear it down here. The contact-change invalidation is emitted
+  // explicitly above on relay success.
   revokeBinding(assistantId, resolvedChannel);
 
   return {
@@ -565,7 +579,7 @@ export async function handleChannelVerificationSession(
           ...publicResult,
         });
       } else {
-        const result = createInboundChallenge(
+        const result = await createInboundChallenge(
           channel,
           msg.rebind,
           msg.conversationId,
@@ -590,7 +604,7 @@ export async function handleChannelVerificationSession(
         channel,
       });
     } else if (msg.action === "revoke") {
-      const result = revokeVerificationForChannel(channel);
+      const result = await revokeVerificationForChannel(channel);
       broadcastMessage({
         type: "channel_verification_session_response",
         ...result,

package/src/daemon/handlers/conversations.ts

@@ -1,9 +1,12 @@
 import { v4 as uuid } from "uuid";
 
+import { peekAcpSessionManager } from "../../acp/index.js";
+import { resolveCanonicalGuardianRequest } from "../../memory/canonical-guardian-store.js";
 import { clearAll, getConversation } from "../../memory/conversation-crud.js";
 import { resolveConversationId } from "../../memory/conversation-key-store.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { resolveCapabilities } from "../../runtime/capabilities.js";
+import * as pendingInteractions from "../../runtime/pending-interactions.js";
 import { getSubagentManager } from "../../subagent/index.js";
 import { createAbortReason } from "../../util/abort-reasons.js";
 import { UserError } from "../../util/errors.js";
@@ -106,6 +109,12 @@ export function cancelGeneration(conversationId: string): boolean {
   // being cancelled, so enqueuing synthetic messages would trigger
   // unwanted model activity after the user pressed stop.
   getSubagentManager().abortAllForParent(conversationId);
+  // Cancel any in-flight ACP agent sessions this conversation spawned, for the
+  // same reason: a backgrounded ACP prompt would otherwise keep running (and
+  // holding a child process) past the stop and, on completion, enqueue a
+  // follow-up message back into the conversation the user just cancelled. Peek
+  // the singleton so a conversation that never used ACP doesn't spin one up.
+  peekAcpSessionManager()?.cancelForParent(conversationId);
   // The processing flag is cleared by the in-flight turn's `finally`, not here.
   // Abort propagates into the provider call and tool execution (and is backed
   // by the agent loop's abort watchdog), so the turn reaches its `finally`
@@ -382,6 +391,81 @@ export function steerToMessage(
   return { steered: true };
 }
 
+/**
+ * Supersede an open `ask_question` prompt when a new chat message is enqueued
+ * for the same conversation.
+ *
+ * A queued message while a clarification question is open means the user chose
+ * to move on rather than answer it. Steering to that message aborts the parked
+ * turn — which settles the open question via its turn-abort signal — repairs
+ * the dangling `tool_use`, and drains the message, instead of stranding it
+ * behind a prompt no one is going to answer. Only `ask_question` prompts
+ * (`kind: "question"`) trigger this; pending confirmations are handled
+ * separately by the enqueue path's auto-deny.
+ *
+ * Returns `true` when a parked question was found and a steer was issued.
+ */
+export function steerOnEnqueuedMessageIfQuestionParked(
+  conversationId: string,
+  enqueuedRequestId: string,
+): boolean {
+  const hasParkedQuestion = pendingInteractions
+    .getByConversation(conversationId)
+    .some((interaction) => interaction.kind === "question");
+  if (!hasParkedQuestion) return false;
+  steerToMessage(conversationId, enqueuedRequestId);
+  return true;
+}
+
+/**
+ * Supersede interactions left pending by an in-flight turn when a new message
+ * is enqueued for a busy conversation. Centralized so every ingress path (the
+ * HTTP send handler and the CLI signal path) gets identical handling:
+ *
+ *  1. Auto-deny pending confirmations — notify the client and sync the
+ *     canonical guardian record *before* clearing the prompter-owned
+ *     confirmations, so a later guardian reply can't match a stale "pending"
+ *     record and fail with `pending_interaction_not_found`.
+ *  2. Supersede a parked ask_question by steering to the enqueued message.
+ *
+ * Order matters: the steer aborts the turn, which denies the prompter's
+ * confirmations as a side effect, so the canonical/notification sync must run
+ * first. `removeByConversation` preserves `question` entries, so the parked
+ * question is still registered for the steer even after the confirmation sweep.
+ */
+export function supersedePendingInteractionsOnEnqueue(
+  conversationId: string,
+  enqueuedRequestId: string,
+): void {
+  const conversation = findConversation(conversationId);
+  if (!conversation) return;
+
+  if (conversation.hasAnyPendingConfirmation()) {
+    for (const interaction of pendingInteractions.getByConversation(
+      conversationId,
+    )) {
+      if (interaction.kind === "confirmation") {
+        // sendToClient (wired to the SSE hub) delivers the denial to clients.
+        conversation.emitConfirmationStateChanged({
+          conversationId,
+          requestId: interaction.requestId,
+          state: "denied" as const,
+          source: "auto_deny" as const,
+        });
+        // Sync the canonical guardian record so stale "pending" rows aren't
+        // matched by later guardian reply routing.
+        resolveCanonicalGuardianRequest(interaction.requestId, "pending", {
+          status: "denied",
+        });
+      }
+    }
+    conversation.denyAllPendingConfirmations();
+    pendingInteractions.removeByConversation(conversationId);
+  }
+
+  steerOnEnqueuedMessageIfQuestionParked(conversationId, enqueuedRequestId);
+}
+
 // ---------------------------------------------------------------------------
 // HTTP handler (delegates to shared logic)
 // ---------------------------------------------------------------------------

package/src/daemon/handlers/shared.ts

@@ -453,6 +453,13 @@ export function renderHistoryContent(
       // time filter in cleanAssistantContent and migration 222.
       if (isPlaceholderSentinelText(displayText)) continue;
       textParts.push(displayText);
+      // A ui_surface card's plain-text fallback (flagged `_surfaceFallback` by
+      // the approval-card builder) is represented by the adjacent surface for
+      // surface-capable clients. Keep it in the flat `.text` body above (CLI,
+      // search, channel replies, non-surface clients) but don't emit it as a
+      // text segment or content block, or those clients would render the card
+      // AND its fallback text.
+      if (block._surfaceFallback === true) continue;
       ensureSegment();
       currentSegmentParts.push(displayText);
       seenText = true;

package/src/daemon/lifecycle.ts

@@ -58,6 +58,7 @@ import { initQdrantClient, resolveQdrantUrl } from "../memory/qdrant-client.js";
 import { QdrantManager } from "../memory/qdrant-manager.js";
 import { rotateToolInvocations } from "../memory/tool-usage-store.js";
 import { sweepConceptPageFrontmatter } from "../memory/v2/frontmatter-sweep.js";
+import { spawnMemoryWorkerProcess } from "../memory/worker-control.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { backfillManualTokenConnections } from "../oauth/manual-token-connection.js";
 import { seedOAuthProviders } from "../oauth/seed-providers.js";
@@ -121,6 +122,10 @@ import {
   startDiskPressureGuard,
   stopDiskPressureGuard,
 } from "./disk-pressure-guard.js";
+import {
+  startEventLoopWatchdog,
+  stopEventLoopWatchdog,
+} from "./event-loop-watchdog.js";
 import { initializePlugins } from "./external-plugins-bootstrap.js";
 import { backfillSlackInjectionTemplates } from "./handlers/config-slack-channel.js";
 import { installAssistantSymlink } from "./install-symlink.js";
@@ -410,7 +415,7 @@ export async function runDaemon(): Promise<void> {
     // remains reachable for health checks and diagnostics.
     let dbReady = false;
     try {
-      initializeDb();
+      await initializeDb();
       dbReady = true;
       log.info("Daemon startup: DB initialized");
     } catch (err) {
@@ -432,8 +437,14 @@ export async function runDaemon(): Promise<void> {
     }
 
     if (dbReady) {
-      await runWorkspaceMigrations(getWorkspaceDir(), WORKSPACE_MIGRATIONS);
-      log.info("Daemon startup: workspace migrations complete");
+      const migrationSummary = await runWorkspaceMigrations(
+        getWorkspaceDir(),
+        WORKSPACE_MIGRATIONS,
+      );
+      log.info(
+        migrationSummary,
+        "Daemon startup: workspace migrations complete",
+      );
 
       // Seed canonical inference provider_connections and backfill any legacy
       // profiles that pre-date the connection field. Runs after workspace
@@ -816,6 +827,7 @@ export async function runDaemon(): Promise<void> {
     log.info("Daemon startup: DaemonServer started");
     startDiskPressureGuardForLifecycle();
     startOrphanReaper();
+    startEventLoopWatchdog();
 
     // Mutable refs for Qdrant and memory worker so background
     // init can assign them and the shutdown handler always sees the latest value.
@@ -955,8 +967,33 @@ export async function runDaemon(): Promise<void> {
         }
       }
 
-      log.info("Daemon startup: starting memory worker");
-      bgRefs.memoryWorker = startMemoryJobsWorker();
+      // `memory.worker.enabled` selects which worker implementation the daemon
+      // starts: the out-of-process worker (spawned like `assistant memory
+      // worker start`) or the in-process worker on the daemon's event loop.
+      // This flag only affects startup — shutdown stops whichever worker is
+      // actually running (see shutdown-handlers.ts).
+      if (config.memory.worker.enabled) {
+        log.info(
+          "Daemon startup: starting memory worker as a separate process",
+        );
+        try {
+          const { pid, alreadyRunning } = await spawnMemoryWorkerProcess();
+          log.info(
+            { pid, alreadyRunning },
+            alreadyRunning
+              ? "Memory worker process already running — reusing it"
+              : "Memory worker process started",
+          );
+        } catch (err) {
+          log.warn(
+            { err },
+            "Failed to start memory worker process — memory jobs will not be processed",
+          );
+        }
+      } else {
+        log.info("Daemon startup: starting memory worker");
+        bgRefs.memoryWorker = startMemoryJobsWorker();
+      }
 
       // Seed capability graph nodes (new memory graph system)
       try {
@@ -1416,6 +1453,7 @@ export async function runDaemon(): Promise<void> {
         stopGatewayFlagListener();
         stopDiskPressureGuardForLifecycle();
         stopOrphanReaper();
+        stopEventLoopWatchdog();
         cleanupPidFile();
       },
     });
@@ -1431,6 +1469,7 @@ export async function runDaemon(): Promise<void> {
     log.error({ err }, "Daemon startup failed — cleaning up");
     stopDiskPressureGuardForLifecycle();
     stopOrphanReaper();
+    stopEventLoopWatchdog();
     cleanupPidFileIfOwner(process.pid);
     throw err;
   }

package/src/daemon/memory-v2-startup.test.ts

@@ -59,6 +59,18 @@ function configWithV2(enabled: boolean): AssistantConfig {
   return { memory: { v2: { enabled } } } as unknown as AssistantConfig;
 }
 
+/** Poll until `m` has been called at least `n` times, or `timeoutMs` elapses. */
+async function waitForCalls(
+  m: { mock: { calls: unknown[] } },
+  n: number,
+  timeoutMs = 1000,
+): Promise<void> {
+  const start = Date.now();
+  while (m.mock.calls.length < n && Date.now() - start < timeoutMs) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+}
+
 afterEach(() => {
   seedSkill.mockClear();
   seedCli.mockClear();
@@ -128,4 +140,64 @@ describe("maybeReseedCapabilitiesAfterManagedCredential", () => {
 
     expect(seedCli).toHaveBeenCalledTimes(1);
   });
+
+  test("enqueues the v3 maintain pass even when one catalog reseed rejects", async () => {
+    proxyState.prereqs = true;
+    v3State.live = true;
+    seedSkill.mockImplementationOnce(async () => {
+      throw new Error('Embedding backend "gemini" is not configured');
+    });
+
+    await maybeReseedCapabilitiesAfterManagedCredential(configWithV2(true));
+
+    // The CLI catalog seeded, so v3 must still rebuild its lanes — a single
+    // catalog failure cannot suppress the maintain pass.
+    expect(seedCli).toHaveBeenCalledTimes(1);
+    expect(enqueueJob).toHaveBeenCalledTimes(1);
+    expect(enqueueJob).toHaveBeenCalledWith("memory_v3_maintain", {});
+  });
+
+  test("enqueues the v3 maintain pass without blocking when a catalog reseed exceeds the timeout", async () => {
+    proxyState.prereqs = true;
+    v3State.live = true;
+    // Skill reseed never settles — mirrors the wedged getCatalog()/embed seen in
+    // the field. The CLI reseed completes normally.
+    seedSkill.mockImplementationOnce(() => new Promise<void>(() => {}));
+
+    await maybeReseedCapabilitiesAfterManagedCredential(configWithV2(true), {
+      reseedTimeoutMs: 20,
+    });
+
+    // An unbounded `Promise.all` barrier would hang here forever; the bounded
+    // barrier lets the CLI catalog's maintain pass enqueue regardless.
+    expect(seedCli).toHaveBeenCalledTimes(1);
+    expect(enqueueJob).toHaveBeenCalledTimes(1);
+    expect(enqueueJob).toHaveBeenCalledWith("memory_v3_maintain", {});
+  });
+
+  test("re-enqueues the v3 maintain pass when a straggler catalog finishes after the timeout", async () => {
+    proxyState.prereqs = true;
+    v3State.live = true;
+    let resolveSkill!: () => void;
+    seedSkill.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          resolveSkill = resolve;
+        }),
+    );
+
+    await maybeReseedCapabilitiesAfterManagedCredential(configWithV2(true), {
+      reseedTimeoutMs: 10,
+    });
+
+    // Post-barrier enqueue fires once even though the skill catalog is still
+    // embedding.
+    expect(enqueueJob).toHaveBeenCalledTimes(1);
+
+    // The straggler lands; maintain re-enqueues so its late capability rows are
+    // reconciled without waiting out the 6h backstop.
+    resolveSkill();
+    await waitForCalls(enqueueJob, 2);
+    expect(enqueueJob).toHaveBeenCalledTimes(2);
+  });
 });

package/src/daemon/memory-v2-startup.ts

@@ -49,6 +49,36 @@ export function maybeSeedMemoryV2CliCommands(config: AssistantConfig): void {
     .catch((err) => log.warn({ err }, "Failed to seed v2 CLI-command entries"));
 }
 
+/**
+ * Default upper bound on how long
+ * {@link maybeReseedCapabilitiesAfterManagedCredential} waits for the capability
+ * reseeds before enqueuing the v3 maintain pass. The reseeds keep running
+ * detached past this bound — it only stops the barrier from waiting on a wedged
+ * catalog (a stalled `getCatalog()` or a managed-proxy embed that never
+ * returns). A straggler that finishes later re-enqueues maintain.
+ */
+const RESEED_BARRIER_TIMEOUT_MS = 120_000;
+
+/**
+ * Resolve to `true` if `p` settles within `ms`, or `false` if the timeout wins.
+ * Always clears the timer, so a `p` that settles first leaves no pending timer
+ * keeping the event loop (or a test) alive.
+ */
+async function settledWithin(
+  p: Promise<unknown>,
+  ms: number,
+): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timedOut = new Promise<false>((resolve) => {
+    timer = setTimeout(() => resolve(false), ms);
+  });
+  try {
+    return await Promise.race([p.then(() => true), timedOut]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
 /**
  * Re-seed the v2 skill and CLI-command capability entries once a managed-proxy
  * credential lands, closing the first-boot race where the daemon's startup seed
@@ -83,9 +113,23 @@ export function maybeSeedMemoryV2CliCommands(config: AssistantConfig): void {
  * dense store and its lane-invalidation stage forces a rebuild against the now-
  * populated index, so v3 surfaces the skill/CLI pages within seconds instead of
  * waiting out the backstop.
+ *
+ * The maintain enqueue must NOT be gated on both catalogs settling. The two
+ * embeds are independent, and a single wedged catalog (a stalled `getCatalog()`
+ * or a managed-proxy embed that never returns) would otherwise block the v3 lane
+ * rebuild indefinitely, so the catalog that DID seed never reaches the selector.
+ * The barrier is therefore bounded by `reseedTimeoutMs`: maintain is enqueued
+ * once the barrier resolves (the pass is idempotent and reconciles whatever the
+ * page index currently holds), and a straggler catalog that finishes after the
+ * timeout re-enqueues maintain so its late rows are picked up without waiting out
+ * the backstop.
+ *
+ * `reseedTimeoutMs` is injectable for tests; production uses
+ * {@link RESEED_BARRIER_TIMEOUT_MS}.
  */
 export async function maybeReseedCapabilitiesAfterManagedCredential(
   config: AssistantConfig,
+  opts: { reseedTimeoutMs?: number } = {},
 ): Promise<void> {
   if (!config.memory.v2.enabled) return;
 
@@ -115,35 +159,59 @@ export async function maybeReseedCapabilitiesAfterManagedCredential(
     ],
   ];
 
-  await Promise.all(
-    catalogs.map(async ([label, seed]) => {
-      try {
-        await seed();
+  // Each reseed is contained so one catalog's embed failure (or hang) never
+  // rejects the caller or aborts the other. Started here but not awaited as a
+  // single barrier — the bounded wait below decides when to stop waiting.
+  const reseeds = catalogs.map(([label, seed]) =>
+    seed().then(
+      () =>
         log.info(
           `Memory v2 ${label} entries seeded after managed proxy credential update`,
-        );
-      } catch (err) {
+        ),
+      (err: unknown) =>
         log.warn(
           { err },
           `Failed to seed v2 ${label} entries after managed proxy credential update`,
-        );
-      }
-    }),
+        ),
+    ),
   );
 
-  // The stores (and the page index) are now populated; when v3 is live, kick a
-  // maintain pass so it embeds the capability rows into `memory_v3_sections` and
-  // invalidates its lanes immediately rather than waiting out the 6h backstop.
+  // When v3 is live, a maintain pass embeds the freshly-seeded capability rows
+  // into `memory_v3_sections` and invalidates the lanes so v3 surfaces the
+  // skill/CLI pages within seconds instead of waiting out the 6h backstop.
+  // Resolve the gate + enqueuer once and reuse for the post-barrier enqueue and
+  // the straggler re-enqueue below.
   const { isMemoryV3Live } = await import("../config/memory-v3-gate.js");
-  if (!isMemoryV3Live(config)) return;
-  try {
-    const { enqueueMemoryJob } = await import("../memory/jobs-store.js");
-    enqueueMemoryJob("memory_v3_maintain", {});
-  } catch (err) {
+  const v3Live = isMemoryV3Live(config);
+  const enqueueMaintain = async (): Promise<void> => {
+    if (!v3Live) return;
+    try {
+      const { enqueueMemoryJob } = await import("../memory/jobs-store.js");
+      enqueueMemoryJob("memory_v3_maintain", {});
+    } catch (err) {
+      log.warn(
+        { err },
+        "Failed to enqueue memory_v3_maintain after managed proxy credential update",
+      );
+    }
+  };
+
+  // Bound the barrier so a wedged catalog can't block the maintain enqueue
+  // indefinitely; the reseeds keep running detached past the timeout.
+  const timeoutMs = opts.reseedTimeoutMs ?? RESEED_BARRIER_TIMEOUT_MS;
+  const allReseeds = Promise.allSettled(reseeds);
+  const settledInTime = await settledWithin(allReseeds, timeoutMs);
+
+  await enqueueMaintain();
+
+  if (!settledInTime) {
     log.warn(
-      { err },
-      "Failed to enqueue memory_v3_maintain after managed proxy credential update",
+      { timeoutMs },
+      "Capability reseed still running after the barrier timeout — enqueued v3 maintain now; will re-enqueue when the straggler catalog finishes",
     );
+    // The straggler is still embedding; re-enqueue maintain once it lands so its
+    // late capability rows are reconciled without waiting out the 6h backstop.
+    void allReseeds.then(() => enqueueMaintain());
   }
 }
 

package/src/daemon/message-types/inbox.ts

@@ -23,12 +23,6 @@ export interface ContactsInviteRequest {
   externalChatId?: string;
   /** Filter by status (list only). */
   status?: string;
-  /** Invitee's first name (voice invite create only). */
-  friendName?: string;
-  /** Contact display name for personalizing invite instructions (create only). */
-  contactName?: string;
-  /** Guardian's first name (voice invite create only). */
-  guardianName?: string;
 }
 
 export interface AssistantInboxEscalationRequest {

package/src/daemon/message-types/messages.ts

@@ -22,7 +22,6 @@ import type {
   TraceEvent,
   TraceEventKind,
 } from "../../api/events/trace-event.js";
-import type { TurnProfileAutoRoutedEvent } from "../../api/events/turn-profile-auto-routed.js";
 import type { UserMessageEchoEvent } from "../../api/events/user-message-echo.js";
 import type { ChannelId, InterfaceId } from "../../channels/types.js";
 import type { CommandIntent, UserMessageAttachment } from "./shared.js";
@@ -122,8 +121,6 @@ export interface ConfirmationStateChanged {
   toolUseId?: string;
 }
 
-export type { TurnProfileAutoRoutedEvent };
-
 /**
  * Broadcast to clients when a conversation's inference-profile override
  * changes. `profile` is the profile name (a key in `llm.profiles`) or
@@ -172,6 +169,5 @@ export type _MessagesServerMessages =
   | TraceEvent
   | ConfirmationStateChanged
   | AssistantActivityStateEvent
-  | TurnProfileAutoRoutedEvent
   | ConversationInferenceProfileUpdated
   | InteractionResolvedEvent;