@vellumai/assistant 0.10.12 → 0.11.0-staging.1

package/src/live-voice/live-voice-session.ts

@@ -7,7 +7,8 @@ import {
 } from "../calls/media-turn-detector.js";
 import { sanitizeForTts } from "../calls/tts-text-sanitizer.js";
 import {
-  couldBeControlMarker,
+  isIncompleteControlMarkerTail,
+  MINIMIZE_ROOM_MARKER,
   stripInternalSpeechMarkers,
 } from "../calls/voice-control-protocol.js";
 import type {
@@ -32,13 +33,12 @@ import {
 } from "../calls/voice-triage-escalate.js";
 import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getConfig } from "../config/loader.js";
-import type { AssistantConfig } from "../config/schema.js";
 import {
   type LiveVoiceFrontModelConfig,
   LiveVoiceFrontModelConfigSchema,
 } from "../config/schemas/live-voice.js";
 import { ABORT_WATCHDOG_MS } from "../daemon/abort-watchdog.js";
-import { findConversation } from "../daemon/conversation-registry.js";
+import { isRefusedInReadOnlyPass } from "../daemon/conversation-tool-setup.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import { ensureConversationExists } from "../persistence/conversation-crud.js";
 import {
@@ -46,6 +46,7 @@ import {
   supportsBoundary,
 } from "../providers/speech-to-text/provider-catalog.js";
 import type { ResolveStreamingTranscriberOptions } from "../providers/speech-to-text/resolve.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { publishConversationListAndMetadataChanged } from "../runtime/sync/resource-sync-events.js";
 import { detectPcm16SpeechActivity } from "../stt/speech-energy.js";
 import type {
@@ -54,13 +55,12 @@ import type {
   SttStreamServerEvent,
 } from "../stt/types.js";
 import { getSubagentManager } from "../subagent/index.js";
+import { getToolOwner } from "../tools/registry.js";
 import { extractSpeakableSegments } from "../tts/speakable-segments.js";
 import { createAbortReason } from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
-import { pickAckPhrase, pickProgressPhrase } from "./ack-phrases.js";
 import {
   createVoiceFrontDecider,
-  type VoiceEndpointAction,
   type VoiceFrontDecider,
   type VoiceProgressTextInput,
 } from "./front-decision.js";
@@ -76,6 +76,7 @@ import {
   type LiveVoiceMetricsEvent,
   type LiveVoiceSpokenAckKind,
   type LiveVoiceTurnSeedMarks,
+  type VoiceEndpointAction,
 } from "./live-voice-metrics.js";
 import {
   type LiveVoiceSession as LiveVoiceSessionContract,
@@ -88,6 +89,7 @@ import type {
   LiveVoiceTtsOptions,
   LiveVoiceTtsResult,
 } from "./live-voice-tts.js";
+import { pickProgressPhrase } from "./progress-phrases.js";
 import {
   type LiveVoiceClientFrame,
   type LiveVoiceClientUpdateConfigFrame,
@@ -244,11 +246,10 @@ export interface LiveVoiceSessionOptions {
    */
   frontModelConfig?: Partial<LiveVoiceFrontModelConfig>;
   /**
-   * Front-model decision/phrasing service: semantic endpointing on
-   * silence-fired turn-ends (a "hold" keeps the utterance open through a
-   * bounded extension window) and LLM-phrased acks. The production factory
-   * constructs it from `liveVoice.frontModel` config when unset; `null`
-   * disables front-model LLM calls (energy endpointing + static ack phrasing).
+   * Front-model phrasing service: spoken acks and progress narration. The
+   * production factory constructs it from `liveVoice.frontModel` config when
+   * unset; `null` disables front-model LLM calls, so no ack is ever spoken
+   * and narration falls back to its static phrases.
    */
   frontDecider?: VoiceFrontDecider | null;
   /**
@@ -380,6 +381,13 @@ interface TurnProgressState {
   // op, on start (not completion), so a burst of slow tools still trips the
   // threshold while they run.
   opsSinceNarration: number;
+  // Bumped by every observable change to the turn's tool activity — an op
+  // starting or finishing. The idle trigger compares it against
+  // `narratedEpoch` so a tick with nothing new to report stays silent.
+  stateEpoch: number;
+  // The `stateEpoch` the last spoken narration described: the activity the
+  // user has already been told about.
+  narratedEpoch: number;
   // Narrations actually spoken this turn — the metrics count and the
   // decider's 1-based updateIndex. Rate, not count, bounds narration:
   // idleIntervalMs/minGapMs cap the cadence and the session duration cap
@@ -428,6 +436,9 @@ interface ActiveAssistantTurn {
   progress: TurnProgressState;
   assistantCompleted: boolean;
   ttsDone: boolean;
+  // Latched when the leg's stream contains MINIMIZE_ROOM_MARKER; consumed
+  // once at TTS drain, where the minimize_room frame goes out after tts_done.
+  minimizeRequested: boolean;
   // A tts_audio frame actually went out to the client — latches on the first
   // forwarded chunk so the firstTtsAudio metric is marked exactly once per turn.
   ttsAudioStarted: boolean;
@@ -473,6 +484,10 @@ interface ActiveAssistantTurn {
   // or reference it in reply to the user, without ever speaking it unprompted.
   // Null when no continuation result is pending for this turn.
   continuationResult: string | null;
+  // Set when a barge-in handed the interrupted work to a background subagent:
+  // that request's transcript, so the model can tell the user the work is
+  // still running instead of appearing to have dropped it.
+  handedOffRequest: string | null;
   // The agent run started a definitive tool use this turn — tool use implies
   // a guaranteed-slow turn, so acknowledgment logic can key off this.
   toolUseStarted: boolean;
@@ -487,9 +502,9 @@ interface ActiveAssistantTurn {
   // A spoken ack was enqueued this turn. Every ack trigger shares this
   // one-per-turn budget so a slow turn never stacks fillers.
   ackSpoken: boolean;
-  // An LLM-phrased ack generation is awaiting the decider (llmAckText).
-  // While true, the ack has not yet stamped `lastFloorHolderAtMs`, so
-  // narration must treat it as a floor-holder-in-waiting and stand down —
+  // An ack generation is awaiting the decider. While true, the ack has not
+  // yet stamped `lastFloorHolderAtMs`, so narration must treat it as a
+  // floor-holder-in-waiting and stand down —
   // otherwise a progress phrase could land back-to-back with the ack.
   ackGenerationPending: boolean;
   // Pending slow-first-delta ack timer; null once cleared or fired.
@@ -516,13 +531,87 @@ interface ActiveAssistantTurn {
   assistantAudioSampleRate?: number;
 }
 
+/**
+ * Control-marker hygiene for one model leg's delta stream, shared by the
+ * front-door answer stage and the default/escalated leg. The returned flush
+ * forwards the stripped (stripInternalSpeechMarkers) prefix of `raw` that has
+ * not been emitted yet and cannot contain a still-streaming control marker:
+ * the flush stops at the first "[" whose tail is an incomplete marker
+ * (isIncompleteControlMarkerTail) and holds from there until a later delta
+ * completes or disproves it; `force` (leg completion) emits the held tail so
+ * real text that merely resembles a marker prefix is not dropped. The scan
+ * runs forward from the emitted boundary — not from the last "[" — so
+ * brackets INSIDE a streaming marker body (a JSON array or "]"-bearing string
+ * in ASK_GUARDIAN_APPROVAL) can neither mask the marker's start nor pass as
+ * its terminator. As a side effect the force flush latches the turn's
+ * `minimizeRequested` when the completed stream ENDS with
+ * MINIMIZE_ROOM_MARKER — terminal position only, matching the prompt's
+ * "end the reply with it" contract, so a reply whose CONTENT happens to
+ * contain "[-1]" (an array literal, a temperature) never minimizes the
+ * room. The marker itself is stripped wherever it appears (the shared
+ * marker-strip convention), so the latch is the only observable.
+ */
+function createControlMarkerHoldback(
+  turn: ActiveAssistantTurn,
+  emit: (chunk: string) => void,
+): (raw: string, opts?: { force?: boolean }) => void {
+  let emitted = 0;
+  return (raw, opts) => {
+    if (
+      opts?.force === true &&
+      !turn.minimizeRequested &&
+      raw.trimEnd().endsWith(MINIMIZE_ROOM_MARKER)
+    ) {
+      turn.minimizeRequested = true;
+    }
+    let safeEnd = raw.length;
+    if (opts?.force !== true) {
+      for (
+        let i = raw.indexOf("[", emitted);
+        i !== -1;
+        i = raw.indexOf("[", i + 1)
+      ) {
+        if (isIncompleteControlMarkerTail(raw.slice(i))) {
+          safeEnd = i;
+          break;
+        }
+      }
+    }
+    if (safeEnd > emitted) {
+      emit(stripInternalSpeechMarkers(raw.slice(emitted, safeEnd)));
+      emitted = safeEnd;
+    }
+  };
+}
+
 // Base control prompt for every live-voice turn. When a turn starts from a
 // barge-in, the interruption merge note is appended to it (see
 // buildInterruptionMergeNote) so the model reconciles the interrupted request
 // with the new utterance.
-const LIVE_VOICE_CONTROL_PROMPT =
-  "You are speaking in a local live voice session. Keep replies brief and conversational. You cannot display cards, forms, or any on-screen UI during the call — convey everything in speech. " +
-  VOICE_NO_SETUP_FLOWS_RULE;
+const LIVE_VOICE_CONTROL_PROMPT_BASE =
+  "You are speaking in a local live voice session. Keep replies brief and conversational. You cannot display cards, forms, or any on-screen UI during the call — convey everything in speech. ";
+
+// MINIMIZE_ROOM_MARKER teaching, appended for the legs that can actually put
+// something on screen — the main leg and the escalated leg. The front-door
+// (fast) leg never receives it: that leg is toolless, so it has nothing to
+// show, and its decision rule promises that apart from a leading verdict
+// token every character is spoken verbatim — teaching it the marker would
+// contradict that rule and could only produce spurious minimizes.
+//
+// The teaching deliberately keeps the no-interactive-UI rule intact
+// (live-voice turns are non-interactive, JARVIS-1291): the marker does not
+// render UI — it asks the client to reveal the screen the call overlay
+// covers. The gate in createControlMarkerHoldback strips it from speech, and
+// completeTtsForTurn sends the minimize_room frame only after the reply's
+// TTS drains, so "end your reply with it" is the whole contract the model
+// needs.
+//
+// The narration guidance is load-bearing: without it, the base prompt's
+// convey-everything-in-speech rule reads to the model as "the user can never
+// see the screen", and it minimizes the room while telling the user it has
+// no way to show them anything ("check it from the app later").
+const LIVE_VOICE_MINIMIZE_MARKER_TEACHING =
+  "The call renders as a full-screen overlay covering the app. If this reply created or changed something on screen worth looking at (an app, a page, a document), you may end the reply with the marker [-1]: after you finish speaking, the overlay minimizes so the user can see the screen while the call continues. The user is in the app and sees what you made the moment the overlay minimizes, so when you end with the marker, speak as if you are showing it to them right now (for example, close with something like: take a look) — never say you cannot show it, that you cannot display it because this is a voice call, or that they should check it later. Use it at most once per reply, only when there is genuinely something new to show, never speak the marker aloud or mention it, and never emit any other bracketed marker. ";
 
 // System-level guidance appended to a barge-in turn's control prompt so the
 // model treats the new utterance as a continuation of the request it was cut
@@ -542,21 +631,60 @@ function buildResurfaceContextNote(continuationResult: string): string {
   return `Earlier the user interrupted you, and in the background you finished the reply they cut off. What you worked out was: "${continuationResult}". If their current message relates to it, use it to answer; otherwise you may briefly offer it or leave it aside, and do not repeat it verbatim if it no longer fits.`;
 }
 
-// Assemble a turn's model-facing control prompt: the base live-voice rules plus
+// Appended to the turn that follows a barge-in whose interrupted work was
+// handed to a background subagent. Without this the assistant simply stops
+// talking about the request it was mid-way through, and the user has no way to
+// know the work survived — it reads as dropped. The model decides whether to
+// mention it, because only it can tell "keep working on that" (the foreground
+// turn continues the same work, so announcing a background copy would be
+// confusing) from a genuine topic change (where "I'm still working on that in
+// the background" is exactly what the user needs to hear).
+function buildHandoffAnnouncementNote(handedOffRequest: string): string {
+  return `You handed your unfinished work on "${handedOffRequest}" to a background task, which is still running. If the user has moved to a different topic, briefly let them know you are still working on it in the background before answering them. If they are asking you to continue that same work, just continue and do not mention the background task.`;
+}
+
+// Assemble a leg's model-facing control prompt: the base live-voice rules,
+// the [-1] minimize teaching (withheld from the front-door leg — see
+// LIVE_VOICE_MINIMIZE_MARKER_TEACHING), the shared no-setup-flows rule, plus
 // any pending barge-in merge context and/or completed-continuation context. A
-// turn can carry both (a barge-in follow-up that also has a continuation result
-// waiting); the notes are model-only and never render as user bubbles.
-function buildVoiceControlPrompt(turn: ActiveAssistantTurn): string {
-  let prompt = LIVE_VOICE_CONTROL_PROMPT;
+// turn can carry both (a barge-in follow-up that also has a continuation
+// result waiting); the notes are model-only and never render as user bubbles.
+function buildVoiceControlPrompt(
+  turn: ActiveAssistantTurn,
+  leg: { frontDoor?: boolean },
+): string {
+  let prompt =
+    LIVE_VOICE_CONTROL_PROMPT_BASE +
+    (leg.frontDoor === true ? "" : LIVE_VOICE_MINIMIZE_MARKER_TEACHING) +
+    VOICE_NO_SETUP_FLOWS_RULE;
   if (turn.interruptedRequest) {
     prompt = `${prompt}\n\n${buildInterruptionMergeNote(turn.interruptedRequest)}`;
   }
   if (turn.continuationResult) {
     prompt = `${prompt}\n\n${buildResurfaceContextNote(turn.continuationResult)}`;
   }
+  if (turn.handedOffRequest) {
+    prompt = `${prompt}\n\n${buildHandoffAnnouncementNote(turn.handedOffRequest)}`;
+  }
   return prompt;
 }
 
+// Delivered into the conversation when a continuation finishes AFTER the voice
+// session ended. There is no next voice turn to fold into, so this lands as a
+// normal turn in the thread — where the user actually goes looking for the
+// work. Framed as a system-style report rather than a user request so the
+// reply reads as "here is what I finished", not a fresh instruction.
+function buildClosedSessionDeliveryPrompt(
+  interruptedRequest: string,
+  answer: string,
+): string {
+  const what =
+    interruptedRequest.length > 0
+      ? `their earlier request ("${interruptedRequest}")`
+      : "their earlier request";
+  return `[Background work finished] The voice call ended while you were still finishing ${what} in the background. You have now finished it. Tell the user briefly that it is done and give them the result. Do not re-run any tool calls; the work is already complete. What you produced was:\n\n${answer}`;
+}
+
 // Objective handed to the background subagent that continues a barged-in turn.
 // The subagent forks the live conversation, so it already sees the interrupted
 // turn's completed tool calls in history and resumes from there. The request
@@ -565,12 +693,51 @@ function buildVoiceControlPrompt(turn: ActiveAssistantTurn): string {
 // the forked history.
 function buildDuplexContinuationObjective(interruptedRequest: string): string {
   const base =
-    "You were in the middle of responding to the user's most recent request when they interrupted you. Finish that response now. Do not repeat any tool calls whose results are already present in the conversation. You are running unattended in the background with a read-only toolset: you cannot send, write, delete, purchase, or otherwise change anything, and most tools (including memory writes and any that take an action) are unavailable here. Do the read-only work you can. If finishing the request needs an action or a tool you do not have, do not attempt it; instead say plainly what you would do, so the user can approve it on their next turn.";
+    "You were in the middle of responding to the user's most recent request when they interrupted you. Finish that response now. Do not repeat any tool calls whose results are already present in the conversation. You are running unattended in the background: permission policy may auto-deny higher-risk actions with no one to approve them. If an action you need is denied, do not retry it; finish what you can and say plainly what remains, so the user can trigger it on their next turn.";
   return interruptedRequest.length > 0
     ? `${base} Their request was: "${interruptedRequest}".`
     : base;
 }
 
+// Built-ins beyond the strict read-only allowlist that cannot contend with a
+// background continuation's writes: they touch no workspace, host, or
+// extension state. `skill_load` reads skill files and registers tool
+// definitions — and it is the FIRST call of a barge-in follow-up that
+// re-enters the skill the interrupted turn was using, so counting it as
+// consequential would kill nearly every continuation doing skill-based work
+// at the moment it matters most.
+// `web_fetch` sits on the core SIDE_EFFECT_TOOLS list because an UNATTENDED
+// run firing off external requests is a permission concern — a different
+// question from this gate's, which is only "can these two writers corrupt the
+// same local state?". A network read cannot, so it does not contend.
+const FOREGROUND_NON_CONTENDING_TOOLS: ReadonlySet<string> = new Set([
+  "skill_load",
+  "web_fetch",
+]);
+
+// Foreground-wins classification: does this foreground tool start force the
+// running continuations to be aborted? The question is LOCAL-STATE
+// CONTENTION ("could these two writers corrupt the same workspace, host, or
+// extension state?"), NOT permission — this gate never affects what a tool is
+// allowed to do. Fail closed anyway: anything that is not a provably
+// non-contending BUILT-IN contends, because skill/plugin/MCP/workspace tools
+// carry no "writes local state" metadata and some of them (app_*, document_*)
+// very much do. `skill_execute` always contends: it is a dispatcher whose
+// resolved inner tool can mutate.
+function foregroundToolContendsWithContinuation(toolName: string): boolean {
+  if (toolName === "skill_execute") {
+    return true;
+  }
+  const ownerKind = getToolOwner(toolName)?.kind;
+  if (
+    FOREGROUND_NON_CONTENDING_TOOLS.has(toolName) &&
+    ownerKind === "default"
+  ) {
+    return false;
+  }
+  return isRefusedInReadOnlyPass(toolName, ownerKind);
+}
+
 // Upper bound on how long a barge-in waits for the interrupted turn's teardown
 // to settle before giving up on the continuation. The teardown settles once the
 // aborted turn's agent loop reaches its `finally`, which can wait out BOTH the
@@ -605,9 +772,11 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // synchronously before its spawn, so interrupt()/close() abort a continuation
   // even if a stop lands while it is still spawning.
   private readonly detachControllers = new Set<AbortController>();
-  // Bumped whenever a stop (interrupt/close) fires. A barge-in captures this
-  // before its async teardown; if it has changed by the time the detach would
-  // spawn, a stop landed during the gap and the continuation is not started.
+  // Bumped whenever detached runs are invalidated: a stop (interrupt/close),
+  // a newer barge-in superseding them, or a foreground-wins abort. A barge-in
+  // captures this (after its own bump) before its async teardown; if it has
+  // changed by the time the detach would spawn, an invalidation landed during
+  // the gap and the continuation is not started.
   private detachStopGeneration = 0;
   // Bumped SYNCHRONOUSLY at each barge-in (in barge order), before the async
   // detach runs. Only the latest-started detach (detachSeq === detachSequence)
@@ -670,6 +839,11 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // starts as context. Consumed (and cleared) when that turn launches; cleared
   // on a hard stop (abortDetachedRuns) so a stale result never surfaces later.
   private pendingContinuationResult: string | null = null;
+  // Set when a continuation actually spawns: the request it took over, so the
+  // NEXT turn can tell the user the work is still running. Consumed by that
+  // turn; cleared when the continuation finishes (by then the result note
+  // takes over and "still running" would be stale).
+  private pendingHandoffRequest: string | null = null;
   private readonly maxPendingAudioBytes: number;
   // Set on VAD speech onset; consumed when the first speech chunk is routed
   // to an utterance so the metric lands on the right turn.
@@ -706,13 +880,10 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   /** The cycle whose grace timer is armed (only the newest release has one). */
   private finalizeGraceCycle: UtteranceCycle | null = null;
   private readonly finalizeGraceMs: number;
-  // Rotates through the ack phrase list across the session's turns.
-  private ackPhraseCounter = 0;
   // Rotates through the progress fallback phrases across the session's turns.
   private progressPhraseCounter = 0;
-  // Front-model service: semantic endpointing on
-  // silence-fired turn-ends and LLM-phrased acks; null disables both LLM
-  // capabilities (energy endpointing + static ack phrasing remain).
+  // Front-model service: phrases spoken acks and progress narration; null
+  // disables both (the turn then holds the floor with silence).
   private readonly frontDecider: VoiceFrontDecider | null;
   // Complete front-model tunables: the constructor schema-parses the partial
   // option once, so every field carries its `liveVoice.frontModel` schema
@@ -897,7 +1068,14 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.turnDetector?.dispose();
     this.clearEndpointExtensionTimer();
     this.stopSessionTranscriber();
-    this.abortDetachedRuns();
+    // Deliberately NOT aborting detached continuations: outliving the call is
+    // the entire premise of the handoff. Hanging up used to destroy the work
+    // the user had just asked to keep — and the natural test sequence (barge
+    // in, hear the answer, close the room, go look for the result) hit that
+    // every time. A deliberate `interrupt()` still aborts; ending the session
+    // does not. With no next voice turn to fold into, a continuation that
+    // finishes after this point delivers into the conversation instead (see
+    // the completion handler in detachInterruptedTurn).
     await this.cancelAssistantTurn("session_closed");
     if (shouldEmitSessionEndMetrics) {
       await this.emitSessionEndMetrics();
@@ -1415,11 +1593,20 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       .trim();
     this.pendingInterruptedRequest =
       interruptedRequest.length > 0 ? interruptedRequest : null;
-    // A fresh interruption supersedes any already-stashed continuation result:
-    // drop it synchronously here so the barge-in follow-up (or any later) turn
-    // can't consume an older answer before this barge-in's own continuation
-    // completes. Cleared even when no continuation ultimately detaches.
-    this.pendingContinuationResult = null;
+    // A fresh interruption supersedes every earlier detached run, not just its
+    // stashed result: abort still-running continuations (and skip pending
+    // detaches) before this barge-in's own continuation can launch, so two
+    // full-ability background writers never share the workspace. The stashed
+    // result is dropped with them so the barge-in follow-up (or any later)
+    // turn can't consume an older answer before this barge-in's own
+    // continuation completes. This barge-in's detach snapshots the stop
+    // generation AFTER this bump (below), so it is unaffected. The abort is
+    // signal-level, with the same accepted residual as the foreground-wins
+    // gate (see the tool_use_start handler): a tool call already executing in
+    // the superseded run is not awaited. The replacement's detach still waits
+    // out the interrupted TURN's teardown before forking, which bounds the
+    // overlap to that one abandoned call.
+    this.abortDetachedRuns({ reason: "superseded_by_new_barge_in" });
     // Order this barge-in among concurrent detaches SYNCHRONOUSLY, in barge
     // order — the actual detach runs after an async teardown chain, and those
     // chains can interleave, so bumping there could assign sequences out of
@@ -1429,8 +1616,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.clearFillerTimers(turn);
     // Tagged reason: provider catch-sites classify untagged caller aborts as
     // retryable transport failures (ERROR log + futile retry against the
-    // aborted signal). This signal reaches the brain leg and, with llmAckText
-    // on, in-flight ack generation.
+    // aborted signal). This signal reaches the brain leg and any in-flight
+    // ack generation.
     turn.abortController.abort(
       createAbortReason("voice_session_aborted", "live-voice-barge-in"),
     );
@@ -1445,6 +1632,16 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     // Snapshot the stop generation before the async teardown: a stop that lands
     // during it must cancel the pending detach (checked in detachInterruptedTurn).
     const stopGeneration = this.detachStopGeneration;
+    log.info(
+      {
+        turnId: turn.turnId,
+        detachSeq,
+        // The two facts that decide whether a continuation is even eligible.
+        assistantCompleted: turn.assistantCompleted,
+        hasTeardownWait: teardownWait !== undefined,
+      },
+      "Voice barge-in cancelled a turn",
+    );
     void (async () => {
       await this.finishMetricsTurn(
         turn.utterance,
@@ -1467,8 +1664,12 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // settle before forking, so its partial — including any completed tool calls —
   // is already in the conversation the subagent forks from and a side-effecting
   // continuation cannot repeat a call the interrupted turn already ran.
-  // Resurfacing the subagent's result is a follow-up; for now it runs silently
-  // and a later stop/interrupt aborts it.
+  // The continuation runs with full subagent abilities under the standard
+  // non-interactive permission policy; if a foreground turn starts its own
+  // side-effecting tool, the foreground-wins abort in the tool_use_start
+  // handler kills the continuation before the two can race on the workspace.
+  // The run stays silent (never spoken unprompted) and a later stop/interrupt
+  // aborts it.
   private detachInterruptedTurn(
     turn: ActiveAssistantTurn,
     stopGeneration: number,
@@ -1476,18 +1677,41 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     detachSeq: number,
   ): void {
     const spawn = this.spawnBackgroundContinuation;
-    if (
-      !spawn ||
-      this.isClosed ||
-      // The model already finished generating (barge-in during TTS playback of a
-      // complete reply): there is nothing to continue, so a continuation would
-      // just re-do a finished answer.
-      turn.assistantCompleted ||
-      // A stop (interrupt/close) landed during the barge-in teardown: honor it
-      // and do not start the continuation.
-      this.detachStopGeneration !== stopGeneration ||
-      !isAssistantFeatureFlagEnabled("voice-duplex-handoff", getConfig())
-    ) {
+    // Every skip is logged with its reason — the handoff is silent by design,
+    // so without this a dropped continuation is indistinguishable from a
+    // never-attempted one (tail with: grep -i "voice duplex").
+    const skipReason = !spawn
+      ? "no_spawner"
+      : this.isClosed
+        ? "session_closed"
+        : // The model already finished generating (barge-in during TTS playback
+          // of a complete reply): there is nothing to continue, so a
+          // continuation would just re-do a finished answer.
+          turn.assistantCompleted
+          ? "assistant_already_completed"
+          : // A stop (interrupt/close) or a superseding invalidation landed
+            // during the barge-in teardown: honor it.
+            this.detachStopGeneration !== stopGeneration
+            ? "invalidated_during_barge_teardown"
+            : !isAssistantFeatureFlagEnabled(
+                  "voice-duplex-handoff",
+                  getConfig(),
+                )
+              ? "flag_disabled"
+              : null;
+    if (skipReason !== null || !spawn) {
+      // debug for the always-off configurations, info for the dynamic skips.
+      if (skipReason === "flag_disabled" || skipReason === "no_spawner") {
+        log.debug(
+          { turnId: turn.turnId, skipReason },
+          "Voice duplex continuation skipped",
+        );
+      } else {
+        log.info(
+          { turnId: turn.turnId, skipReason },
+          "Voice duplex continuation skipped",
+        );
+      }
       return;
     }
     // Embed the interrupted request in the objective so the continuation knows
@@ -1501,6 +1725,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     // controller.abort(), which the spawn's signal wiring honors).
     const controller = new AbortController();
     this.detachControllers.add(controller);
+    const detachStartedAtMs = Date.now();
     void (async () => {
       try {
         // Wait for the interrupted turn's teardown to settle its partial into
@@ -1528,12 +1753,46 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
           // The continuation is best-effort, so a rare dropped one is the safe
           // trade.
           if (!settled) {
+            log.info(
+              {
+                turnId: turn.turnId,
+                skipReason: controller.signal.aborted
+                  ? "invalidated_during_teardown_wait"
+                  : "teardown_settle_timeout",
+                waitedMs: Date.now() - detachStartedAtMs,
+                timeoutMs: this.detachTeardownSettleTimeoutMs,
+              },
+              "Voice duplex continuation skipped",
+            );
             return;
           }
         }
-        if (controller.signal.aborted || this.isClosed) {
+        // A closed session is NOT a reason to skip: the work outlives the
+        // call, and its result is delivered into the conversation below.
+        // Only an explicit invalidation (stop/interrupt/supersede) stops it.
+        if (controller.signal.aborted) {
+          log.info(
+            {
+              turnId: turn.turnId,
+              skipReason: "invalidated_before_spawn",
+              waitedMs: Date.now() - detachStartedAtMs,
+            },
+            "Voice duplex continuation skipped",
+          );
           return;
         }
+        log.info(
+          {
+            turnId: turn.turnId,
+            teardownWaitMs: Date.now() - detachStartedAtMs,
+            interruptedRequest,
+          },
+          "Voice duplex continuation starting",
+        );
+        // The next turn tells the user this is still running. Set before the
+        // await so a follow-up turn launching during the run picks it up.
+        this.pendingHandoffRequest =
+          interruptedRequest.length > 0 ? interruptedRequest : null;
         const resultText = await spawn({
           parentConversationId: this.conversationId,
           objective: buildDuplexContinuationObjective(interruptedRequest),
@@ -1547,20 +1806,59 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         // barge-in has started, an older continuation completing (before or
         // after it, empty or not) can't surface a stale answer. Only non-empty
         // text is actually surfaced.
-        if (
+        this.pendingHandoffRequest = null;
+        const answer = resultText.trim();
+        const notInvalidated =
           !controller.signal.aborted &&
-          !this.isClosed &&
           this.detachStopGeneration === stopGeneration &&
-          detachSeq === this.detachSequence
-        ) {
-          const answer = resultText.trim();
+          detachSeq === this.detachSequence;
+        // Two destinations, decided by whether a next voice turn still exists.
+        // Live session: stash for that turn's control prompt (never spoken
+        // unprompted). Session closed: there is no next turn, so deliver into
+        // the conversation — the call is over, nobody is being talked over,
+        // and the thread is exactly where the user goes looking for the work.
+        const deliverToConversation =
+          notInvalidated && this.isClosed && answer.length > 0;
+        if (notInvalidated && !this.isClosed) {
           this.pendingContinuationResult = answer.length > 0 ? answer : null;
         }
+        if (deliverToConversation) {
+          const { injectMessageIntoParent } =
+            await import("../subagent/notify.js");
+          injectMessageIntoParent(
+            this.conversationId,
+            buildClosedSessionDeliveryPrompt(interruptedRequest, answer),
+          );
+        }
+        log.info(
+          {
+            turnId: turn.turnId,
+            ranMs: Date.now() - detachStartedAtMs,
+            resultChars: answer.length,
+            // Where the answer went. "stashed" = folded into the next voice
+            // turn; "conversation" = the call had ended, so it was delivered
+            // into the thread; "dropped" = a stop/interrupt or a newer
+            // barge-in landed while it ran.
+            resultDestination: !notInvalidated
+              ? "dropped"
+              : answer.length === 0
+                ? "empty"
+                : this.isClosed
+                  ? "conversation"
+                  : "stashed",
+          },
+          "Voice duplex continuation finished",
+        );
       } catch (err) {
         // A stop/interrupt aborts via the signal; that rejection is expected.
-        if (!controller.signal.aborted) {
+        if (controller.signal.aborted) {
+          log.info(
+            { turnId: turn.turnId, ranMs: Date.now() - detachStartedAtMs },
+            "Voice duplex continuation aborted mid-run",
+          );
+        } else {
           log.warn(
-            { err, turnId: turn.turnId },
+            { err, turnId: turn.turnId, ranMs: Date.now() - detachStartedAtMs },
             "Voice duplex handoff continuation failed",
           );
         }
@@ -1571,9 +1869,37 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   }
 
   // Abort every background continuation this session started and drop its
-  // handle. A client interrupt or session close is a hard stop for detached
-  // work; the continuation's own `.finally` removes it from the set too.
-  private abortDetachedRuns(): void {
+  // handle. Called on a hard stop (client interrupt / session close), when a
+  // newer barge-in supersedes the detached runs, and on a foreground-wins
+  // abort; the continuation's own `.finally` removes it from the set too.
+  // `keepPendingResult` is the foreground-wins variant: the foreground turn is
+  // claiming the workspace, so running continuations must die (and pending
+  // detaches must be skipped), but an already-completed continuation's stashed
+  // answer stays — it cannot race anything, and the next turn's "use only if
+  // relevant" framing makes a stale one harmless.
+  private abortDetachedRuns(opts?: {
+    keepPendingResult?: boolean;
+    // Why the runs are being invalidated, for the log line below. Every
+    // caller passes one: an unexplained dead continuation is the single
+    // hardest thing to debug about this feature.
+    reason?: string;
+    // The foreground tool whose start tripped the contention gate, if any.
+    toolName?: string;
+  }): void {
+    const aborted = this.detachControllers.size;
+    const hadPendingResult = this.pendingContinuationResult !== null;
+    if (aborted > 0 || hadPendingResult) {
+      log.info(
+        {
+          conversationId: this.conversationId,
+          reason: opts?.reason ?? "unspecified",
+          ...(opts?.toolName ? { toolName: opts.toolName } : {}),
+          abortedRuns: aborted,
+          droppedPendingResult: hadPendingResult && !opts?.keepPendingResult,
+        },
+        "Voice duplex continuations invalidated",
+      );
+    }
     // Bump the generation so a barge-in whose async teardown is still in flight
     // (its detach not yet spawned) sees the stop and skips the continuation.
     this.detachStopGeneration += 1;
@@ -1583,7 +1909,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.detachControllers.clear();
     // A hard stop also drops any completed continuation's result still waiting
     // to fold into the next turn, so it can't surface after the user reset.
-    this.pendingContinuationResult = null;
+    if (!opts?.keepPendingResult) {
+      this.pendingContinuationResult = null;
+    }
   }
 
   // VAD closed the utterance — the analog of ptt_release: emit
@@ -1618,30 +1946,18 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         }
         return;
       }
-      // Semantic endpointing: a silence boundary may be a thinking pause —
-      // let the front decider hold the utterance open. Only detector-timer
+      // Semantic endpointing: a silence boundary may be a thinking pause, so
+      // the unified front-door leg itself is the endpoint decision. When it
+      // launches, the boundary is deferred to the verdict — commit releases
+      // the utterance, hold replays the boundary via the extension timer.
+      // When speculation is inapplicable (no text, cap reached, a turn
+      // already active) fall through and release. Only detector-timer
       // silences qualify; max-duration always releases, and a manual client
       // release (ptt_release forced the boundary) is the user saying "answer
-      // now" — never second-guess it. The gate is synchronous (null) whenever
-      // the decider is not consulted, so that release path keeps its exact
-      // event ordering — an extra await here would shift utterance release
-      // across the persistent-transcriber flush attribution.
+      // now" — never second-guess it.
       if (reason === "silence" && !manualRelease) {
-        if (this.frontDoorRoutingActive()) {
-          // Unified front-door: the leg itself is the endpoint decision.
-          // When it launches, the boundary is deferred to the verdict —
-          // commit releases the utterance, hold replays the boundary via
-          // the extension timer. When speculation is inapplicable (no
-          // text, cap reached, a turn already active) fall through and
-          // release exactly as before.
-          if (await this.launchSpeculativeAssistantTurn(utterance)) {
-            return;
-          }
-        } else {
-          const holdDecision = this.maybeHoldUtteranceOpen(utterance);
-          if (holdDecision && (await holdDecision)) {
-            return;
-          }
+        if (await this.launchSpeculativeAssistantTurn(utterance)) {
+          return;
         }
       }
       await this.sendFrame({ type: "utterance_end", reason });
@@ -1649,96 +1965,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     })().catch(() => {});
   }
 
-  /**
-   * Semantic-endpointing gate for a silence-fired turn-end. Returns `null`
-   * synchronously when the decider is not consulted (no decider,
-   * extension cap reached, nothing transcribed) — the boundary then releases
-   * exactly as before. Otherwise resolves `true` when the boundary must NOT
-   * release the utterance now: either the decider held it open (the extension
-   * timer replays the boundary), or the world moved on during the decision
-   * (speech resumed, utterance superseded) and a fresh boundary owns the
-   * release. Every decider failure resolves as "release" within
-   * `endpointDecisionTimeoutMs` (fail-open), so consulting it adds at most
-   * that much end-of-turn latency.
-   */
-  private maybeHoldUtteranceOpen(
-    utterance: UtteranceCycle,
-  ): Promise<boolean> | null {
-    const decider = this.frontDecider;
-    if (!decider) {
-      return null;
-    }
-    if (
-      utterance.endpointExtensionCount >=
-      this.frontModelConfig.endpointMaxExtensions
-    ) {
-      return null;
-    }
-    const transcriptSoFar = utterance.finalTranscriptSegments.join(" ").trim();
-    const latestPartial = utterance.latestPartialText;
-    if (transcriptSoFar.length === 0 && !latestPartial) {
-      // Nothing transcribed yet: there is no text to judge.
-      return null;
-    }
-    return this.decideUtteranceHold(
-      decider,
-      utterance,
-      transcriptSoFar,
-      latestPartial,
-    );
-  }
-
-  private async decideUtteranceHold(
-    decider: VoiceFrontDecider,
-    utterance: UtteranceCycle,
-    transcriptSoFar: string,
-    latestPartial: string | null,
-  ): Promise<boolean> {
-    const generation = this.vadSpeechGeneration;
-    const decisionStartedAtMs = this.metricsClock();
-    const decision = await decider
-      .decideEndpoint({
-        transcriptSoFar,
-        latestPartial,
-        silenceThresholdMs: this.silenceThresholdMs,
-        extensionCount: utterance.endpointExtensionCount,
-      })
-      // The decider contract never rejects, but the enclosing boundary flow
-      // swallows rejections — a rejecting decider (a buggy stub, a future
-      // regression) would silently drop the silence boundary. Belt and
-      // braces: rejection degrades to release, mirroring speakGeneratedAck.
-      .catch(() => ({ action: "release" as const }));
-    const decisionLatencyMs = Math.max(
-      0,
-      this.metricsClock() - decisionStartedAtMs,
-    );
-    // Re-check the world after the await: the decision window is bounded but
-    // real, and a release based on a stale snapshot could cut off speech.
-    if (
-      this.isUtteranceStale(utterance) ||
-      utterance.released ||
-      utterance.completed
-    ) {
-      return true;
-    }
-    if (generation !== this.vadSpeechGeneration) {
-      // Speech resumed during the decision: the utterance keeps accumulating
-      // and the detector's next turn-end re-runs the whole decision. The
-      // discarded decision is not recorded — only acted-on outcomes count.
-      return true;
-    }
-    this.markEndpointDecision(utterance, decision.action, decisionLatencyMs);
-    if (decision.action !== "hold") {
-      return false;
-    }
-    utterance.endpointExtensionCount += 1;
-    this.armEndpointExtensionTimer(utterance);
-    return true;
-  }
-
   // Arms the hold-extension replay: after `endpointExtensionMs` of continued
-  // silence the deferred silence boundary re-fires (and the decider is
-  // consulted again, bounded by `endpointMaxExtensions`).
+  // silence the deferred silence boundary re-fires (and a fresh front-door
+  // leg judges it again, bounded by `endpointMaxExtensions`).
   private armEndpointExtensionTimer(utterance: UtteranceCycle): void {
     this.clearEndpointExtensionTimer();
     this.endpointExtensionTimer = setTimeout(() => {
@@ -1757,18 +1986,6 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     }, this.frontModelConfig.endpointExtensionMs);
   }
 
-  /**
-   * Whether front-door routing is active: the single `voice-mode` flag.
-   * Governs both halves of the unified front door — the speculative leg that
-   * decides the endpoint, and the escalation hand-off — so the two can never
-   * disagree. The decider-based hold path (`decideEndpoint`) runs as the
-   * flag-off fallback, so endpointing stays model-decided either way.
-   */
-  private frontDoorRoutingActive(config?: AssistantConfig): boolean {
-    const cfg = config ?? getConfig();
-    return isAssistantFeatureFlagEnabled("voice-mode", cfg);
-  }
-
   /**
    * Unified front-door: dispatch the assistant turn speculatively at the
    * silence boundary, judging the transcript accumulated so far — the same
@@ -2414,7 +2631,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     // without ever reaching finalizePendingUtterance).
     this.pendingInterruptedRequest = null;
     // ...and it hard-stops any detached background continuations.
-    this.abortDetachedRuns();
+    this.abortDetachedRuns({ reason: "client_interrupt" });
     const utterance = this.currentUtterance;
     this.stopSessionTranscriber();
     if (utterance) {
@@ -2520,9 +2737,12 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.pendingInterruptedRequest = null;
     const continuationResult = this.pendingContinuationResult;
     this.pendingContinuationResult = null;
+    const handedOffRequest = this.pendingHandoffRequest;
+    this.pendingHandoffRequest = null;
     await this.launchAssistantTurn(utterance, content, {
       interruptedRequest,
       continuationResult,
+      handedOffRequest,
     });
   }
 
@@ -2538,6 +2758,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       // Set when a background continuation finished the interrupted reply: its
       // answer, appended to the turn's control prompt as context.
       continuationResult?: string | null;
+      // Set when a barge-in handed this request's work to a background
+      // subagent, so the model can say it is still running.
+      handedOffRequest?: string | null;
       // Unified front-door: dispatch without releasing the utterance. The
       // thinking frame and floor-holding timers are deferred until the leg's
       // leading verdict commits the turn (see commitSpeculativeTurn); a hold
@@ -2561,6 +2784,11 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       progress: {
         ops: [],
         opsSinceNarration: 0,
+        // Equal epochs at launch: a turn that has done nothing observable yet
+        // has nothing to narrate, so the idle trigger waits for tool activity
+        // or the maxSilenceMs heartbeat.
+        stateEpoch: 0,
+        narratedEpoch: 0,
         updatesSpoken: 0,
         lastFloorHolderAtMs: null,
         lastAudibleAtMs: Date.now(),
@@ -2569,6 +2797,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       },
       assistantCompleted: false,
       ttsDone: false,
+      minimizeRequested: false,
       ttsAudioStarted: false,
       finalized: false,
       speculativePending: opts?.speculative === true,
@@ -2582,6 +2811,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       speculativeBuffer: "",
       interruptedRequest: opts?.interruptedRequest ?? null,
       continuationResult: opts?.continuationResult ?? null,
+      handedOffRequest: opts?.handedOffRequest ?? null,
       toolUseStarted: false,
       firstDeltaSeen: false,
       deltaEpoch: 0,
@@ -2635,11 +2865,10 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       }, this.frontModelConfig.endpointDecisionTimeoutMs);
     }
 
-    const cfg = getConfig();
-
     // Slow-first-delta spoken ack: if the model produces no delta within the
-    // budget, a short static phrase holds the floor. Only meaningful on TTS
-    // sessions — a text-only session has no audio gap to bridge.
+    // budget, a short front-model-phrased sentence holds the floor. Only
+    // meaningful on TTS sessions — a text-only session has no audio gap to
+    // bridge.
     if (this.streamTtsAudio && !opts?.speculative) {
       this.armAckTimer(activeTurn);
     }
@@ -2657,26 +2886,14 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       this.armProgressIdleTimer(activeTurn);
     }
 
-    // Triage-and-escalate (Voice Mode): active whenever the `voice-mode` flag
-    // is on. A live-voice session already implies voice-mode client-side; the
-    // explicit server-side check keeps the gate honest when the daemon's flag
-    // copy lags (it falls back to the decider-based hold path until it lands).
-    const escalateEnabled = this.frontDoorRoutingActive(cfg);
-
-    // Front-door leg: with routing on, a fast model fronts the turn (the
-    // `voiceFrontDoor` call site pins it) and may hand off on the escalate
-    // verdict; with it off, a single leg runs on the call-site default —
-    // byte-for-byte the prior behavior.
-    await this.startAssistantLeg(
-      activeTurn,
-      escalateEnabled
-        ? {
-            content,
-            routingLeg: "front-door",
-            frontDoor: true,
-          }
-        : { content },
-    );
+    // Front-door leg: a fast model fronts every turn (the `voiceFrontDoor`
+    // call site pins it) and may hand off to a quality leg on the escalate
+    // verdict.
+    await this.startAssistantLeg(activeTurn, {
+      content,
+      routingLeg: "front-door",
+      frontDoor: true,
+    });
   }
 
   /**
@@ -2710,29 +2927,32 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     }
     const { token, utterance, turnId } = activeTurn;
 
-    // Front-door verdict gate (verdict-first protocol — see
-    // voice-triage-escalate.ts). `rawText` accumulates this leg's full
-    // stream; the leg starts in `deciding` until its leading tokens
-    // classify as hold / escalate / answer. An answer flushes through
-    // `flushFrontDoor` (with `frontDoorEmitted` tracking what has been
-    // forwarded); an escalation buffers the post-verdict stream into
-    // `bridgeRaw` until the bridge is complete, then hands off.
+    // `rawText` accumulates this leg's full stream. A front-door leg starts
+    // in `deciding` until its leading tokens classify as hold / escalate /
+    // answer: an answer flushes through the shared marker holdback, while an
+    // escalation buffers the post-verdict stream into `bridgeRaw` until the
+    // bridge is complete, then hands off. A default/escalated leg flushes
+    // every delta through the same holdback, so a stray control marker from
+    // the main model is stripped instead of spoken.
     let rawText = "";
-    let frontDoorEmitted = 0;
     let frontDoorStage: "deciding" | "answer" | "bridging" | "handedOff" =
       "deciding";
     let bridgeRaw = "";
 
-    const emitFrontDoor = (chunk: string): void => {
+    const emitLegText = (chunk: string): void => {
       if (chunk.length === 0) {
         return;
       }
       this.markFirstAssistantDelta(utterance, turnId);
       this.markFirstDeltaForAck(activeTurn);
-      // Same send-time abort gate as the default-leg delta path: a front-door
-      // delta queued behind a backed-up outbound frame must not be written
-      // once barge-in aborts the turn. Escalation aborts the front-door handle,
-      // not this turn's controller, so legitimate front-door text still sends.
+      // Send-time abort gate: a delta queued behind a backed-up outbound
+      // frame must not be written once barge-in aborts the turn, or the
+      // cancelled reply's text leaks ahead of turn_cancelled. Key off this
+      // turn's own abort signal — a normal message_complete finalizes and
+      // clears activeAssistantTurn while trailing deltas may still be
+      // draining, so an activeAssistantTurn-based guard would drop them.
+      // Escalation aborts the front-door handle, not this turn's controller,
+      // so legitimate front-door text still sends.
       void this.sendFrame(
         { type: "assistant_text_delta", text: chunk },
         () => !activeTurn.abortController.signal.aborted && !this.isClosed,
@@ -2740,26 +2960,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       this.bufferAssistantTextForTts(token, chunk);
     };
 
-    // Forward the stripped, non-partial-marker prefix that has not been
-    // emitted yet (answer stage only). A trailing "[…" that could still
-    // become a control marker is held back until a later delta disproves
-    // it; a real partial that never completes is simply never spoken.
-    const flushFrontDoor = (): void => {
-      let safeEnd = rawText.length;
-      const lastOpen = rawText.lastIndexOf("[");
-      if (lastOpen >= frontDoorEmitted) {
-        const tail = rawText.slice(lastOpen);
-        if (!tail.includes("]") && couldBeControlMarker(tail)) {
-          safeEnd = lastOpen;
-        }
-      }
-      if (safeEnd > frontDoorEmitted) {
-        emitFrontDoor(
-          stripInternalSpeechMarkers(rawText.slice(frontDoorEmitted, safeEnd)),
-        );
-        frontDoorEmitted = safeEnd;
-      }
-    };
+    const flushLegText = createControlMarkerHoldback(activeTurn, emitLegText);
 
     // Hand off once enough of the post-verdict stream has arrived to cap
     // the bridge (sentence terminator or hard cap). Until then nothing is
@@ -2782,7 +2983,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         assistantMessageChannel: "vellum",
         userMessageInterface: "macos",
         assistantMessageInterface: "macos",
-        voiceControlPrompt: buildVoiceControlPrompt(activeTurn),
+        voiceControlPrompt: buildVoiceControlPrompt(activeTurn, {
+          ...(leg.frontDoor !== undefined ? { frontDoor: leg.frontDoor } : {}),
+        }),
         content: leg.content,
         isInbound: true,
         launchedAtMs: activeTurn.launchedAtMs,
@@ -2856,7 +3059,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
                 }
                 frontDoorStage = "answer";
               }
-              flushFrontDoor();
+              flushLegText(rawText);
               return;
             }
             // Defensive: speculative legs are always front-door today, but a
@@ -2871,24 +3074,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
                 return;
               }
             }
-            this.markFirstAssistantDelta(utterance, turnId);
-            this.markFirstDeltaForAck(activeTurn);
-            void this.sendFrame(
-              {
-                type: "assistant_text_delta",
-                text: msg.text,
-              },
-              // Re-check at send time (mirrors the tts_audio path): a delta
-              // already queued behind a backed-up outbound frame must not be
-              // written once barge-in has aborted the turn, or the cancelled
-              // reply's text leaks ahead of turn_cancelled. Key off this turn's
-              // own abort signal — a normal message_complete finalizes and
-              // clears activeAssistantTurn while trailing deltas may still be
-              // draining, so an activeAssistantTurn-based guard would drop them.
-              () =>
-                !activeTurn.abortController.signal.aborted && !this.isClosed,
-            );
-            this.bufferAssistantTextForTts(token, msg.text);
+            rawText += msg.text;
+            flushLegText(rawText);
           },
           message_complete: (msg) => {
             const current = this.activeAssistantTurn;
@@ -2930,6 +3117,13 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
             if (leg.frontDoor && current.escalationHandedOff) {
               return;
             }
+            // A held "[…"-tail that never completed a marker is real text —
+            // force-flush it before assistantCompleted closes the TTS buffer
+            // and completeTtsForTurn signals the drain, so it is spoken and
+            // emitted rather than dropped.
+            if (!leg.frontDoor && msg.type === "message_complete") {
+              flushLegText(rawText, { force: true });
+            }
             current.assistantCompleted = true;
             if (msg.type === "generation_cancelled") {
               void this.finalizeAssistantTurn(
@@ -2964,6 +3158,38 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
               return;
             }
             current.toolUseStarted = true;
+            // Foreground wins the workspace: the continuation runs with full
+            // subagent abilities (it can write files, run commands), so the
+            // moment a live turn starts a consequential tool the two could
+            // race on the same workspace, host, or extension state. Kill
+            // running continuations and skip pending detaches; a continuation
+            // only survives while foreground turns stay provably read-only
+            // (the topic-change case it exists for). Fail closed: only
+            // provably non-contending built-ins keep a continuation alive
+            // (see foregroundToolContendsWithContinuation) — a name-based
+            // side-effect denylist misses mutators like plugin/MCP/skill
+            // tools. Over-aborting only drops a best-effort salvage;
+            // under-aborting risks a write race.
+            // An already-completed continuation's stashed answer is kept — it
+            // cannot race anything.
+            //
+            // Accepted residual: the abort is signal-level. A tool call
+            // already executing inside the continuation is not awaited (the
+            // agent loop abandons the in-flight promise on cancellation), so
+            // that one call can briefly overlap the foreground tool. Closing
+            // it would take a cross-conversation execution lock that the
+            // subagent model deliberately does not have — parallel subagents
+            // share the workspace with the parent everywhere — and awaiting
+            // background teardown here would stall the live call's turn.
+            // This gate already makes voice stricter than that baseline; the
+            // residual is bounded to one in-flight call at barge-over time.
+            if (foregroundToolContendsWithContinuation(toolName)) {
+              this.abortDetachedRuns({
+                keepPendingResult: true,
+                reason: "foreground_tool_contends",
+                toolName,
+              });
+            }
             // The op counts toward the narration threshold on start (not
             // completion) so a burst of slow tools still trips the ops
             // trigger while they run.
@@ -2975,6 +3201,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
               startedAtMs: Date.now(),
             });
             current.progress.opsSinceNarration += 1;
+            current.progress.stateEpoch += 1;
             log.debug({ turnId, toolName }, "Live voice turn started tool use");
             // Definitive tool use means the turn is guaranteed slow: speak
             // the floor-holding ack now instead of waiting out the
@@ -3008,14 +3235,27 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
                   )
                 : undefined) ??
               findLastIncompleteOp(current.progress.ops, event.toolName);
+            // A long-running op finishing is the beat the user has been
+            // waiting through: it narrates immediately rather than waiting for
+            // `opsThreshold` more ops, which on a one-slow-tool turn never
+            // arrive. Short ops stay on the ops trigger — narrating every
+            // quick lookup is the chatter this cadence exists to avoid.
+            let trigger: "ops" | "op_complete" = "ops";
             if (op) {
               op.completedAtMs = Date.now();
               if (event.isError !== undefined) {
                 op.isError = event.isError;
               }
               op.resultPreview = event.resultPreview;
+              if (
+                op.completedAtMs - op.startedAtMs >=
+                this.frontModelConfig.progress.longOpMs
+              ) {
+                trigger = "op_complete";
+              }
             }
-            this.maybeNarrateProgress(current, "ops");
+            current.progress.stateEpoch += 1;
+            this.maybeNarrateProgress(current, trigger);
           },
         },
         onError: (message) => {
@@ -3271,10 +3511,10 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // the user's ears — not time since launch, so it covers mid-turn silences
   // for the whole turn. On expiry with audio still pending, or with the
   // silence not yet a full interval old, it re-arms for the remainder; only a
-  // full interval of audible silence narrates. The cadence is deliberately
-  // flat and uncapped: long pauses feel longest, so updates keep coming at
-  // the same interval (minGapMs is the spacing floor) for as long as the
-  // turn stays silent.
+  // full interval of audible silence reaches the narration gatekeeper. The
+  // interval is a polling cadence, not a speaking cadence: most ticks find
+  // nothing new to report and stay quiet, so what the user hears follows the
+  // turn's tool activity (with `maxSilenceMs` as the heartbeat ceiling).
   private armProgressIdleTimer(
     turn: ActiveAssistantTurn,
     delayMs?: number,
@@ -3302,16 +3542,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     }, delayMs ?? this.frontModelConfig.progress.idleIntervalMs);
   }
 
-  // Wall-clock instant the current audible silence turns a full interval old:
-  // measured from the latest of the last emitted segment, the estimated
-  // client playback end, and the last enqueued filler.
+  // Wall-clock instant the current audible silence turns a full interval old.
   private progressIdleDeadlineMs(turn: ActiveAssistantTurn): number {
     return (
-      Math.max(
-        turn.progress.lastAudibleAtMs,
-        this.assistantPlaybackTailUntilMs,
-        turn.progress.lastFloorHolderAtMs ?? 0,
-      ) + this.frontModelConfig.progress.idleIntervalMs
+      this.progressSilenceSinceMs(turn) +
+      this.frontModelConfig.progress.idleIntervalMs
+    );
+  }
+
+  // When the turn's current audible silence began: the latest of the last
+  // emitted segment, the estimated client playback end, and the last enqueued
+  // filler.
+  private progressSilenceSinceMs(turn: ActiveAssistantTurn): number {
+    return Math.max(
+      turn.progress.lastAudibleAtMs,
+      this.assistantPlaybackTailUntilMs,
+      turn.progress.lastFloorHolderAtMs ?? 0,
     );
   }
 
@@ -3379,17 +3625,39 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     );
   }
 
+  // The idle tick has something worth saying when the turn's tool activity has
+  // moved since the last narration described it, or when the silence has run
+  // past `maxSilenceMs` — the heartbeat ceiling that proves the assistant is
+  // still alive on a turn with no observable activity at all. Every other tick
+  // stays quiet, so the cadence follows the work rather than the clock.
+  private progressIdleHasSomethingToSay(turn: ActiveAssistantTurn): boolean {
+    const { progress } = turn;
+    if (progress.stateEpoch !== progress.narratedEpoch) {
+      return true;
+    }
+    const silentForMs = Date.now() - this.progressSilenceSinceMs(turn);
+    if (silentForMs >= this.frontModelConfig.progress.maxSilenceMs) {
+      return true;
+    }
+    log.debug(
+      { turnId: turn.turnId, silentForMs },
+      "Live voice progress narration held — nothing new since the last update",
+    );
+    return false;
+  }
+
   // Gatekeeper for spoken progress narration: it speaks only while the turn
   // is audibly silent, spaced `minGapMs` from any spoken floor-holder (ack or
-  // narration), one generation at a time, and — on the ops trigger — only
-  // once `opsThreshold` ops accumulated. No per-turn count cap: the cadence
-  // guards bound the rate, and going quiet deep into a long turn is the
-  // failure mode narration exists to prevent. Every failing guard
-  // short-circuits silently; a skipped ops trigger keeps its accumulated
-  // count, so the next tool event or idle tick retries.
+  // narration), one generation at a time, and — per trigger — only once the
+  // ops trigger has `opsThreshold` ops accumulated or the idle trigger has
+  // something new to report. No per-turn count cap: the cadence guards bound
+  // the rate, and going quiet deep into a long turn is the failure mode
+  // narration exists to prevent. Every failing guard short-circuits silently;
+  // a skipped ops trigger keeps its accumulated count, so the next tool event
+  // or idle tick retries.
   private maybeNarrateProgress(
     turn: ActiveAssistantTurn,
-    trigger: "ops" | "idle",
+    trigger: "ops" | "idle" | "op_complete",
   ): void {
     const cfg = this.frontModelConfig.progress;
     const { progress } = turn;
@@ -3406,7 +3674,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       progress.narrationInFlight ||
       (progress.lastFloorHolderAtMs !== null &&
         Date.now() - progress.lastFloorHolderAtMs < cfg.minGapMs) ||
-      (trigger === "ops" && progress.opsSinceNarration < cfg.opsThreshold)
+      (trigger === "ops" && progress.opsSinceNarration < cfg.opsThreshold) ||
+      (trigger === "idle" && !this.progressIdleHasSomethingToSay(turn))
     ) {
       return;
     }
@@ -3418,18 +3687,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // on the turn's ordered TTS queue. The decider internally bounds the call
   // by `progress.generationTimeoutMs` and resolves null on every failure
   // mode; on null the idle trigger falls back to a static phrase (silence is
-  // actively harmful there) while the ops trigger stays silent — a generic
-  // filler is not worth it when narration was merely opportunistic.
+  // actively harmful there) while the tool-activity triggers stay silent — a
+  // generic filler is not worth it when narration was merely opportunistic.
   private async speakProgressUpdate(
     turn: ActiveAssistantTurn,
     frontDecider: VoiceFrontDecider,
-    trigger: "ops" | "idle",
+    trigger: "ops" | "idle" | "op_complete",
   ): Promise<void> {
     const { progress } = turn;
     progress.narrationInFlight = true;
     // Any delta that lands while the decider call is in flight makes the
     // generated text stale — and proves the model is speaking again.
     const deltaEpochAtLaunch = turn.deltaEpoch;
+    // The activity this update describes. Tool events that land mid-generation
+    // are news the generated text cannot carry, so they must leave the idle
+    // trigger armed rather than count as already narrated.
+    const stateEpochAtLaunch = progress.stateEpoch;
     try {
       const now = Date.now();
       const currentOp = findLastIncompleteOp(progress.ops);
@@ -3469,7 +3742,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       // condition may have flipped while generating, and a delta that landed
       // mid-generation (deltaEpoch moved) makes the text stale even when the
       // resulting audio has already drained by now. The ack-generation and
-      // floor re-checks close the race with a generated ack (llmAckText) that
+      // floor re-checks close the race with a generated ack that
       // STARTED after this generation did — the entry guard rejects a
       // narration while an ack generation is already pending, but cannot see
       // one that begins mid-generation: while that ack is pending it has not
@@ -3489,7 +3762,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       }
       let raw = generated;
       if (raw === null) {
-        if (trigger === "ops") {
+        if (trigger !== "idle") {
           return;
         }
         raw = pickProgressPhrase(this.progressPhraseCounter++);
@@ -3498,6 +3771,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         return;
       }
       progress.opsSinceNarration = 0;
+      progress.narratedEpoch = stateEpochAtLaunch;
       progress.updatesSpoken += 1;
       // Like the ack mark, recorded only when narration audio actually
       // enqueued (decider text or static fallback alike).
@@ -3521,30 +3795,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     kind: LiveVoiceSpokenAckKind,
     toolName?: string,
   ): void {
-    activeTurn.ackSpoken = true;
-    if (this.frontModelConfig.llmAckText && this.frontDecider) {
-      // Optimistic ackSpoken above keeps the one-per-turn budget honest for
-      // any other ack trigger while the generation is in flight; the async
-      // path undoes it if the ack turns out moot.
-      void this.speakGeneratedAck(
-        activeTurn,
-        this.frontDecider,
-        kind,
-        toolName,
-      );
+    if (!this.frontDecider) {
+      // No decider, no ack: a canned line is worse than the silence, which
+      // progress narration already covers once the turn runs long.
       return;
     }
-    this.enqueueAckPhrase(activeTurn, this.pickStaticAckPhrase(kind), kind);
-  }
-
-  private pickStaticAckPhrase(kind: LiveVoiceSpokenAckKind): string {
-    return pickAckPhrase(kind, this.ackPhraseCounter++);
+    activeTurn.ackSpoken = true;
+    // Optimistic ackSpoken above keeps the one-per-turn budget honest for
+    // any other ack trigger while the generation is in flight; the async
+    // path undoes it if the ack turns out moot.
+    void this.speakGeneratedAck(activeTurn, this.frontDecider, kind, toolName);
   }
 
-  // LLM-phrased ack (liveVoice.frontModel.llmAckText): ask the front model
-  // for one short contextual sentence, static phrase on null. The decider
+  // Ask the front model for one short contextual sentence. The decider
   // internally bounds the call by `ackGenerationTimeoutMs` and resolves null
-  // on every failure mode, so the enqueue never waits beyond that budget.
+  // on every failure mode, so the enqueue never waits beyond that budget; a
+  // null generation speaks nothing.
   private async speakGeneratedAck(
     activeTurn: ActiveAssistantTurn,
     frontDecider: VoiceFrontDecider,
@@ -3567,23 +3833,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         // The decider contract never rejects; belt-and-braces for a stub.
         .catch(() => null);
       // Liveness re-check after the await: any turnCanSpeakFiller condition
-      // may have flipped while generating, mooting the ack. Undo the
-      // optimistic ackSpoken so the flag reflects reality.
-      if (!this.turnCanSpeakFiller(activeTurn)) {
+      // may have flipped while generating, mooting the ack. A null generation
+      // (no provider, timeout, unusable output) speaks nothing. Either way,
+      // undo the optimistic ackSpoken so the flag reflects reality and a
+      // later trigger this turn can still hold the floor.
+      if (generated === null || !this.turnCanSpeakFiller(activeTurn)) {
         activeTurn.ackSpoken = false;
         return;
       }
-      this.enqueueAckPhrase(
-        activeTurn,
-        generated ?? this.pickStaticAckPhrase(kind),
-        kind,
-      );
+      this.enqueueAckPhrase(activeTurn, generated, kind);
     } finally {
       activeTurn.ackGenerationPending = false;
     }
   }
 
-  // Records the ack-spoken metric only when a phrase actually enqueues.
+  // Records the ack-spoken metric only when a phrase actually enqueues; a
+  // phrase that sanitizes away releases the turn's ack budget again.
   private enqueueAckPhrase(
     activeTurn: ActiveAssistantTurn,
     raw: string,
@@ -3591,7 +3856,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   ): void {
     if (this.enqueueFillerPhrase(activeTurn, raw)) {
       this.markAckSpoken(activeTurn, kind);
+      return;
     }
+    activeTurn.ackSpoken = false;
   }
 
   // Sanitize and enqueue one filler sentence (spoken ack or progress
@@ -3664,6 +3931,20 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
             !this.isClosed,
         );
 
+        // Drain-scoped minimize: the latched marker is consumed here, after
+        // the turn's speech has fully drained — never mid-speech, never for
+        // a barged-in turn, at most once per turn.
+        if (
+          currentTurn.minimizeRequested &&
+          !currentTurn.abortController.signal.aborted
+        ) {
+          currentTurn.minimizeRequested = false;
+          await this.sendFrame(
+            { type: "minimize_room", turnId: currentTurn.turnId },
+            () => !this.isClosed,
+          );
+        }
+
         if (this.activeAssistantTurn?.token === token) {
           if (currentTurn.handle && currentTurn.finalized) {
             this.activeAssistantTurn = null;
@@ -4450,12 +4731,32 @@ async function defaultSpawnBackgroundContinuation(args: {
   label: string;
   signal: AbortSignal;
 }): Promise<string> {
-  const parentConversation = findConversation(args.parentConversationId);
-  if (!parentConversation) {
-    throw new Error(
-      `Cannot detach interrupted voice turn: conversation ${args.parentConversationId} is not resident.`,
-    );
+  // getOrCreateConversation (not a raw registry read): it rebuilds a stale
+  // instance and awaits loadFromDb, so the snapshot below sees the persisted
+  // history. A raw findConversation can return a cold instance whose in-memory
+  // `messages` is empty, which silently forks a continuation with no context.
+  const { getOrCreateConversation } =
+    await import("../daemon/conversation-store.js");
+  const parentConversation = await getOrCreateConversation(
+    args.parentConversationId,
+  );
+  // Belt-and-suspenders for a resident-but-unhydrated instance: the teardown
+  // settle that gated this spawn guarantees the interrupted turn's partial is
+  // persisted, so an empty in-memory history on a conversation that has rows
+  // means the instance is cold — hydrate before snapshotting. A genuinely new
+  // conversation loads zero rows; harmless.
+  if (parentConversation.getMessages().length === 0) {
+    await parentConversation.loadFromDb();
   }
+  // The bridge stamps trust per-turn and clears it at teardown, which has
+  // settled by now — inheriting from the parent would read the cleared window
+  // and run the continuation fail-closed as `unknown`, denying every
+  // consequential tool. Resolve the same guardian trust the foreground turn
+  // ran under and pass it explicitly (resolution itself stays fail-closed:
+  // on a miss the continuation runs as `unknown`, exactly as before).
+  const trustContext = await resolveLocalLiveVoiceTrustContext(
+    args.parentConversationId,
+  );
   return await getSubagentManager().spawnAndAwait(
     {
       parentConversationId: args.parentConversationId,
@@ -4463,18 +4764,34 @@ async function defaultSpawnBackgroundContinuation(args: {
       objective: args.objective,
       fork: true,
       sendResultToUser: false,
-      // Read-only: the continuation runs unattended while the user talks to the
-      // live session, so it must never take an unapproved side effect. Any
-      // side-effecting tool is refused; the continuation surfaces the intended
-      // action for the user to approve on their next turn (via the resurface
-      // context) instead.
-      denySideEffectTools: true,
-      parentMessages: [...parentConversation.messages],
+      // Full subagent abilities: the continuation runs like any other
+      // background subagent, so it can genuinely finish build-shaped work
+      // (JARVIS-1354). Side effects are governed by the standard
+      // non-interactive permission path under the explicit trust context
+      // resolved above — auto-approved up to the background risk threshold,
+      // auto-denied above it — the same policy the foreground voice turn it
+      // continues ran under. Workspace write races with the user's next
+      // foreground turn are prevented by the session's foreground-wins abort
+      // (a side-effecting tool start on a live turn aborts running
+      // continuations; see the tool_use_start handler).
+      ...(trustContext ? { trustContext } : {}),
+      parentMessages: [...parentConversation.getMessages()],
       parentSystemPrompt: parentConversation.getCurrentSystemPrompt(),
     },
-    // No client-facing events: the continuation is silent; its result is folded
-    // into the next user turn as context, never spoken on its own.
-    () => {},
+    // Broadcast subagent events to clients attached to this conversation so
+    // the continuation appears in the UI like any other handoff — a background
+    // run the user cannot see reads as the assistant silently dropping their
+    // work. "Silent" means never SPOKEN unprompted (live-voice has no unbidden
+    // TTS); it was never meant to mean invisible.
+    //
+    // NOT the conversation's own sender: the voice bridge resets that to a
+    // no-op at turn teardown (see voice-session-bridge's clientCallbackInstalled
+    // reset), and the detach deliberately waits for that teardown before
+    // spawning — so a sender-based route is guaranteed to be dead by the time
+    // these events fire. `broadcastMessage` is the same path the bridge itself
+    // uses to reach an attached web client. The subagent events carry
+    // `parentConversationId`, not `conversationId`, so scope explicitly.
+    (msg) => broadcastMessage(msg, args.parentConversationId),
     { signal: args.signal },
   );
 }