@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/live-voice/live-voice-session.ts

@@ -7,7 +7,8 @@ import {
 } from "../calls/media-turn-detector.js";
 import { sanitizeForTts } from "../calls/tts-text-sanitizer.js";
 import {
-  couldBeControlMarker,
+  isIncompleteControlMarkerTail,
+  MINIMIZE_ROOM_MARKER,
   stripInternalSpeechMarkers,
 } from "../calls/voice-control-protocol.js";
 import type {
@@ -30,22 +31,22 @@ import {
   MIN_SPOKEN_BRIDGE_CHARS,
   type VoiceRoutingLeg,
 } from "../calls/voice-triage-escalate.js";
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { getConfig } from "../config/loader.js";
-import type { AssistantConfig } from "../config/schema.js";
 import {
   type LiveVoiceFrontModelConfig,
   LiveVoiceFrontModelConfigSchema,
 } from "../config/schemas/live-voice.js";
 import { ABORT_WATCHDOG_MS } from "../daemon/abort-watchdog.js";
-import { findConversation } from "../daemon/conversation-registry.js";
+import { isRefusedInReadOnlyPass } from "../daemon/conversation-tool-setup.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
+import { isInstalledStaticSkillLoad } from "../permissions/checker.js";
 import { ensureConversationExists } from "../persistence/conversation-crud.js";
 import {
   listProviderIds,
   supportsBoundary,
 } from "../providers/speech-to-text/provider-catalog.js";
 import type { ResolveStreamingTranscriberOptions } from "../providers/speech-to-text/resolve.js";
+import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { publishConversationListAndMetadataChanged } from "../runtime/sync/resource-sync-events.js";
 import { detectPcm16SpeechActivity } from "../stt/speech-energy.js";
 import type {
@@ -54,13 +55,12 @@ import type {
   SttStreamServerEvent,
 } from "../stt/types.js";
 import { getSubagentManager } from "../subagent/index.js";
+import { getToolOwner } from "../tools/registry.js";
 import { extractSpeakableSegments } from "../tts/speakable-segments.js";
 import { createAbortReason } from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
-import { pickAckPhrase, pickProgressPhrase } from "./ack-phrases.js";
 import {
   createVoiceFrontDecider,
-  type VoiceEndpointAction,
   type VoiceFrontDecider,
   type VoiceProgressTextInput,
 } from "./front-decision.js";
@@ -76,6 +76,7 @@ import {
   type LiveVoiceMetricsEvent,
   type LiveVoiceSpokenAckKind,
   type LiveVoiceTurnSeedMarks,
+  type VoiceEndpointAction,
 } from "./live-voice-metrics.js";
 import {
   type LiveVoiceSession as LiveVoiceSessionContract,
@@ -88,6 +89,7 @@ import type {
   LiveVoiceTtsOptions,
   LiveVoiceTtsResult,
 } from "./live-voice-tts.js";
+import { pickProgressPhrase } from "./progress-phrases.js";
 import {
   type LiveVoiceClientFrame,
   type LiveVoiceClientUpdateConfigFrame,
@@ -151,6 +153,22 @@ const BARGE_IN_MAX_TOLERATED_SILENCE_RATIO = 4;
 // a segment is at most ~180 chars of speech (~10 s of 24 kHz mono PCM
 // ≈ 480 KB), so one buffered segment is an acceptable bound.
 const TTS_MAX_OPEN_SYNTHESIS_JOBS = 2;
+// Audible silence required before a finished background continuation's result
+// is spoken into a live call. Long enough that the announcement lands in a real
+// lull rather than on the heels of the turn that just ended; short enough that
+// the user is not left wondering whether the work survived.
+const CONTINUATION_ANNOUNCE_SILENCE_MS = 1_500;
+// How many times a pending announcement re-arms itself against a client
+// playback tail that outlasted its timer. Each re-arm waits out the whole
+// remaining tail, so one covers a reply of any length; the rest cover a fresh
+// reply's audio landing between two checks. Beyond the cap the announcement
+// falls back to the stash rather than chasing a call that keeps talking.
+const CONTINUATION_ANNOUNCE_MAX_DRAIN_REARMS = 3;
+// `content` of an announcement turn. The answer never rides here — it goes in
+// the model-facing control prompt (buildLiveDeliveryNote), so the only thing
+// persisted on the user side is this marker, and it persists hidden.
+export const CONTINUATION_DELIVERY_CONTENT =
+  "(background work finished — deliver it now)";
 
 export type LiveVoiceStreamingTranscriberResolver = (
   options: ResolveStreamingTranscriberOptions,
@@ -167,12 +185,13 @@ export type LiveVoiceTtsStreamer = (
   options: LiveVoiceTtsOptions,
 ) => Promise<LiveVoiceTtsResult>;
 
-// Runs an interrupted live-voice turn to completion on a background subagent
-// (true-duplex handoff, gated behind voice-duplex-handoff). The run stays silent
-// (no parent notification, never spoken unprompted); it RESOLVES with the
-// continuation's final answer text, which the session folds into the next turn
-// the user starts as context. Aborts when `signal` fires (rejecting). Injected
-// for testability; the factory wires the real SubagentManager-backed impl.
+// Runs an interrupted live-voice turn to completion on a background subagent.
+// The run itself is silent (no parent notification); it RESOLVES with the
+// continuation's final answer text, and the session decides where that goes —
+// the next turn the user starts, an announcement into audible silence, or the
+// conversation once the call has ended. Aborts when `signal` fires (rejecting).
+// Injected for testability; the factory wires the real SubagentManager-backed
+// impl.
 export type LiveVoiceBackgroundContinuationSpawner = (args: {
   parentConversationId: string;
   objective: string;
@@ -244,17 +263,15 @@ export interface LiveVoiceSessionOptions {
    */
   frontModelConfig?: Partial<LiveVoiceFrontModelConfig>;
   /**
-   * Front-model decision/phrasing service: semantic endpointing on
-   * silence-fired turn-ends (a "hold" keeps the utterance open through a
-   * bounded extension window) and LLM-phrased acks. The production factory
-   * constructs it from `liveVoice.frontModel` config when unset; `null`
-   * disables front-model LLM calls (energy endpointing + static ack phrasing).
+   * Front-model phrasing service: spoken acks and progress narration. The
+   * production factory constructs it from `liveVoice.frontModel` config when
+   * unset; `null` disables front-model LLM calls, so no ack is ever spoken
+   * and narration falls back to its static phrases.
    */
   frontDecider?: VoiceFrontDecider | null;
   /**
-   * Spawns the background continuation for a barged-in turn when the
-   * `voice-duplex-handoff` flag is on. The factory wires the real
-   * SubagentManager-backed implementation; tests inject a stub.
+   * Spawns the background continuation for a barged-in turn. The factory wires
+   * the real SubagentManager-backed implementation; tests inject a stub.
    */
   spawnBackgroundContinuation?: LiveVoiceBackgroundContinuationSpawner;
   /**
@@ -272,6 +289,12 @@ export interface LiveVoiceSessionOptions {
    * teardown budget (`resolveProcessingWaitMs`).
    */
   detachTeardownSettleTimeoutMs?: number;
+  /**
+   * Overrides the audible silence a finished continuation waits out before its
+   * result is announced into a live, idle call (test hook). Defaults to
+   * `CONTINUATION_ANNOUNCE_SILENCE_MS`.
+   */
+  continuationAnnounceSilenceMs?: number;
 }
 
 type LiveVoiceUtterancePhase =
@@ -300,6 +323,13 @@ interface UtteranceCycle {
   // this set at a time — see pumpFinalizeQueue.
   finalizeRequested: boolean;
   transcriber: StreamingTranscriber | null;
+  // Manual (push-to-talk) capture routed at least one chunk into this cycle.
+  // It is the only evidence the user is mid-utterance before STT emits
+  // anything: the pending buffers empty out as soon as the transcriber is
+  // streaming, and the archival buffer only fills when audio archiving is on.
+  // server_vad has the turn detector for the same question, and never sets
+  // this — its ingress is handleServerVadAudio.
+  manualAudioCaptured: boolean;
   pendingAudioChunks: Buffer[];
   pendingAudioBytes: number;
   finalTranscriptSegments: string[];
@@ -380,6 +410,13 @@ interface TurnProgressState {
   // op, on start (not completion), so a burst of slow tools still trips the
   // threshold while they run.
   opsSinceNarration: number;
+  // Bumped by every observable change to the turn's tool activity — an op
+  // starting or finishing. The idle trigger compares it against
+  // `narratedEpoch` so a tick with nothing new to report stays silent.
+  stateEpoch: number;
+  // The `stateEpoch` the last spoken narration described: the activity the
+  // user has already been told about.
+  narratedEpoch: number;
   // Narrations actually spoken this turn — the metrics count and the
   // decider's 1-based updateIndex. Rate, not count, bounds narration:
   // idleIntervalMs/minGapMs cap the cadence and the session duration cap
@@ -428,6 +465,9 @@ interface ActiveAssistantTurn {
   progress: TurnProgressState;
   assistantCompleted: boolean;
   ttsDone: boolean;
+  // Latched when the leg's stream contains MINIMIZE_ROOM_MARKER; consumed
+  // once at TTS drain, where the minimize_room frame goes out after tts_done.
+  minimizeRequested: boolean;
   // A tts_audio frame actually went out to the client — latches on the first
   // forwarded chunk so the firstTtsAudio metric is marked exactly once per turn.
   ttsAudioStarted: boolean;
@@ -468,11 +508,29 @@ interface ActiveAssistantTurn {
   // merges it with this turn's utterance instead of treating that utterance as
   // a fresh follow-up. Null for an ordinary (non-barge-in) turn.
   interruptedRequest: string | null;
-  // The completed background continuation's answer (voice-duplex-handoff),
-  // folded into this turn's control prompt as context so the model can deliver
-  // or reference it in reply to the user, without ever speaking it unprompted.
-  // Null when no continuation result is pending for this turn.
+  // The completed background continuation's answer, folded into this turn's
+  // control prompt as context so the model can deliver or reference it in reply
+  // to the user's own utterance. Null when no continuation result is pending.
   continuationResult: string | null;
+  // Set only on an announcement turn: the interrupted request and the
+  // continuation's answer, which the turn exists solely to deliver. The turn has
+  // no user utterance behind it — `content` is CONTINUATION_DELIVERY_CONTENT and
+  // the answer rides the control prompt (buildLiveDeliveryNote).
+  continuationDelivery: ContinuationDelivery | null;
+  // Set when a barge-in handed the interrupted work to a background subagent:
+  // that request's transcript, so the model can tell the user the work is
+  // still running instead of appearing to have dropped it.
+  handedOffRequest: string | null;
+  // The queued announcement this turn consumed alongside `continuationResult`
+  // — the two are routes for one answer, so launching consumes both. Held here
+  // so a rolled-back speculative dispatch can re-arm it (see
+  // restorePendingTurnContext). Null on the announcement turn itself, which
+  // owns its delivery outright.
+  consumedAnnouncement: ContinuationDelivery | null;
+  // `detachStopGeneration` at the moment this turn consumed the pending
+  // context. A bump since then means a stop/interrupt/supersede deliberately
+  // dropped the continuation, so a rollback must not resurrect it.
+  pendingContextStopGeneration: number;
   // The agent run started a definitive tool use this turn — tool use implies
   // a guaranteed-slow turn, so acknowledgment logic can key off this.
   toolUseStarted: boolean;
@@ -487,9 +545,9 @@ interface ActiveAssistantTurn {
   // A spoken ack was enqueued this turn. Every ack trigger shares this
   // one-per-turn budget so a slow turn never stacks fillers.
   ackSpoken: boolean;
-  // An LLM-phrased ack generation is awaiting the decider (llmAckText).
-  // While true, the ack has not yet stamped `lastFloorHolderAtMs`, so
-  // narration must treat it as a floor-holder-in-waiting and stand down —
+  // An ack generation is awaiting the decider. While true, the ack has not
+  // yet stamped `lastFloorHolderAtMs`, so narration must treat it as a
+  // floor-holder-in-waiting and stand down —
   // otherwise a progress phrase could land back-to-back with the ack.
   ackGenerationPending: boolean;
   // Pending slow-first-delta ack timer; null once cleared or fired.
@@ -516,13 +574,87 @@ interface ActiveAssistantTurn {
   assistantAudioSampleRate?: number;
 }
 
+/**
+ * Control-marker hygiene for one model leg's delta stream, shared by the
+ * front-door answer stage and the default/escalated leg. The returned flush
+ * forwards the stripped (stripInternalSpeechMarkers) prefix of `raw` that has
+ * not been emitted yet and cannot contain a still-streaming control marker:
+ * the flush stops at the first "[" whose tail is an incomplete marker
+ * (isIncompleteControlMarkerTail) and holds from there until a later delta
+ * completes or disproves it; `force` (leg completion) emits the held tail so
+ * real text that merely resembles a marker prefix is not dropped. The scan
+ * runs forward from the emitted boundary — not from the last "[" — so
+ * brackets INSIDE a streaming marker body (a JSON array or "]"-bearing string
+ * in ASK_GUARDIAN_APPROVAL) can neither mask the marker's start nor pass as
+ * its terminator. As a side effect the force flush latches the turn's
+ * `minimizeRequested` when the completed stream ENDS with
+ * MINIMIZE_ROOM_MARKER — terminal position only, matching the prompt's
+ * "end the reply with it" contract, so a reply whose CONTENT happens to
+ * contain "[-1]" (an array literal, a temperature) never minimizes the
+ * room. The marker itself is stripped wherever it appears (the shared
+ * marker-strip convention), so the latch is the only observable.
+ */
+function createControlMarkerHoldback(
+  turn: ActiveAssistantTurn,
+  emit: (chunk: string) => void,
+): (raw: string, opts?: { force?: boolean }) => void {
+  let emitted = 0;
+  return (raw, opts) => {
+    if (
+      opts?.force === true &&
+      !turn.minimizeRequested &&
+      raw.trimEnd().endsWith(MINIMIZE_ROOM_MARKER)
+    ) {
+      turn.minimizeRequested = true;
+    }
+    let safeEnd = raw.length;
+    if (opts?.force !== true) {
+      for (
+        let i = raw.indexOf("[", emitted);
+        i !== -1;
+        i = raw.indexOf("[", i + 1)
+      ) {
+        if (isIncompleteControlMarkerTail(raw.slice(i))) {
+          safeEnd = i;
+          break;
+        }
+      }
+    }
+    if (safeEnd > emitted) {
+      emit(stripInternalSpeechMarkers(raw.slice(emitted, safeEnd)));
+      emitted = safeEnd;
+    }
+  };
+}
+
 // Base control prompt for every live-voice turn. When a turn starts from a
 // barge-in, the interruption merge note is appended to it (see
 // buildInterruptionMergeNote) so the model reconciles the interrupted request
 // with the new utterance.
-const LIVE_VOICE_CONTROL_PROMPT =
-  "You are speaking in a local live voice session. Keep replies brief and conversational. You cannot display cards, forms, or any on-screen UI during the call — convey everything in speech. " +
-  VOICE_NO_SETUP_FLOWS_RULE;
+const LIVE_VOICE_CONTROL_PROMPT_BASE =
+  "You are speaking in a local live voice session. Keep replies brief and conversational. You cannot display cards, forms, or any on-screen UI during the call — convey everything in speech. ";
+
+// MINIMIZE_ROOM_MARKER teaching, appended for the legs that can actually put
+// something on screen — the main leg and the escalated leg. The front-door
+// (fast) leg never receives it: that leg is toolless, so it has nothing to
+// show, and its decision rule promises that apart from a leading verdict
+// token every character is spoken verbatim — teaching it the marker would
+// contradict that rule and could only produce spurious minimizes.
+//
+// The teaching deliberately keeps the no-interactive-UI rule intact
+// (live-voice turns are non-interactive, JARVIS-1291): the marker does not
+// render UI — it asks the client to reveal the screen the call overlay
+// covers. The gate in createControlMarkerHoldback strips it from speech, and
+// completeTtsForTurn sends the minimize_room frame only after the reply's
+// TTS drains, so "end your reply with it" is the whole contract the model
+// needs.
+//
+// The narration guidance is load-bearing: without it, the base prompt's
+// convey-everything-in-speech rule reads to the model as "the user can never
+// see the screen", and it minimizes the room while telling the user it has
+// no way to show them anything ("check it from the app later").
+const LIVE_VOICE_MINIMIZE_MARKER_TEACHING =
+  "The call renders as a full-screen overlay covering the app. If this reply created or changed something on screen worth looking at (an app, a page, a document), you may end the reply with the marker [-1]: after you finish speaking, the overlay minimizes so the user can see the screen while the call continues. The user is in the app and sees what you made the moment the overlay minimizes, so when you end with the marker, speak as if you are showing it to them right now (for example, close with something like: take a look) — never say you cannot show it, that you cannot display it because this is a voice call, or that they should check it later. Use it at most once per reply, only when there is genuinely something new to show, never speak the marker aloud or mention it, and never emit any other bracketed marker. ";
 
 // System-level guidance appended to a barge-in turn's control prompt so the
 // model treats the new utterance as a continuation of the request it was cut
@@ -533,30 +665,143 @@ function buildInterruptionMergeNote(interruptedRequest: string): string {
 }
 
 // System-level guidance appended to the NEXT turn's control prompt after a
-// background continuation (voice-duplex-handoff) finished the reply the user
-// interrupted. Folds the completed answer in as context so the model can
-// deliver or reference it in reply to the user; it must never be spoken
-// unprompted (live-voice is non-interactive, JARVIS-1291). Reaches the model
-// only; it is not a user message and never renders as a transcript bubble.
+// background continuation finished the reply the user interrupted. Folds the
+// completed answer in as context so the model can deliver or reference it in
+// its reply to whatever the user just said — this turn answers the user, so the
+// result is offered only if it fits. Reaches the model only; it is not a user
+// message and never renders as a transcript bubble.
 function buildResurfaceContextNote(continuationResult: string): string {
   return `Earlier the user interrupted you, and in the background you finished the reply they cut off. What you worked out was: "${continuationResult}". If their current message relates to it, use it to answer; otherwise you may briefly offer it or leave it aside, and do not repeat it verbatim if it no longer fits.`;
 }
 
-// Assemble a turn's model-facing control prompt: the base live-voice rules plus
-// any pending barge-in merge context and/or completed-continuation context. A
-// turn can carry both (a barge-in follow-up that also has a continuation result
-// waiting); the notes are model-only and never render as user bubbles.
-function buildVoiceControlPrompt(turn: ActiveAssistantTurn): string {
-  let prompt = LIVE_VOICE_CONTROL_PROMPT;
+// Appended to the turn that follows a barge-in whose interrupted work was
+// handed to a background subagent. Without this the assistant simply stops
+// talking about the request it was mid-way through, and the user has no way to
+// know the work survived — it reads as dropped. The model decides whether to
+// mention it, because only it can tell "keep working on that" (the foreground
+// turn continues the same work, so announcing a background copy would be
+// confusing) from a genuine topic change (where "I'm still working on that in
+// the background" is exactly what the user needs to hear).
+function buildHandoffAnnouncementNote(handedOffRequest: string): string {
+  return `You handed your unfinished work on "${handedOffRequest}" to a background task, which is still running. If the user has moved to a different topic, briefly let them know you are still working on it in the background before answering them. If they are asking you to continue that same work, just continue and do not mention the background task.`;
+}
+
+// Names the interrupted request inside a delivery prompt. A barge-in can fire
+// before any transcript landed, so the request may be empty.
+function describeInterruptedRequest(request: string): string {
+  return request.length > 0
+    ? `their earlier request ("${request}")`
+    : "their earlier request";
+}
+
+// A finished background continuation waiting to be delivered: the request it
+// took over and the answer it produced.
+interface ContinuationDelivery {
+  request: string;
+  answer: string;
+}
+
+// Appended to an announcement turn's control prompt: the turn the session
+// starts on its own when a background continuation finishes while the call is
+// live and nobody is speaking. There is no user utterance behind it, so this
+// note is the whole instruction and the answer rides here rather than in the
+// turn's `content`. Reaches the model only; it is not a user message and never
+// renders as a transcript bubble.
+function buildLiveDeliveryNote(request: string, answer: string): string {
+  const what = describeInterruptedRequest(request);
+  return `The user interrupted you earlier, and in the background you finished ${what}. The call is still live and nobody is speaking, so tell them briefly that it is done and give them the result. Do not re-run any tool calls; the work is already complete, and do not repeat it verbatim if it no longer fits. What you produced was:\n\n${answer}`;
+}
+
+// Assemble a leg's model-facing control prompt: the base live-voice rules,
+// the [-1] minimize teaching (withheld from the front-door leg — see
+// LIVE_VOICE_MINIMIZE_MARKER_TEACHING), the shared no-setup-flows rule, plus
+// any pending barge-in merge context, completed-continuation context, and/or
+// the announcement instruction. A turn can carry several (a barge-in follow-up
+// that also has a continuation result waiting); the notes are model-only and
+// never render as user bubbles.
+function buildVoiceControlPrompt(
+  turn: ActiveAssistantTurn,
+  leg: { frontDoor?: boolean },
+): string {
+  let prompt =
+    LIVE_VOICE_CONTROL_PROMPT_BASE +
+    (leg.frontDoor === true ? "" : LIVE_VOICE_MINIMIZE_MARKER_TEACHING) +
+    VOICE_NO_SETUP_FLOWS_RULE;
   if (turn.interruptedRequest) {
     prompt = `${prompt}\n\n${buildInterruptionMergeNote(turn.interruptedRequest)}`;
   }
   if (turn.continuationResult) {
     prompt = `${prompt}\n\n${buildResurfaceContextNote(turn.continuationResult)}`;
   }
+  if (turn.handedOffRequest) {
+    prompt = `${prompt}\n\n${buildHandoffAnnouncementNote(turn.handedOffRequest)}`;
+  }
+  if (turn.continuationDelivery) {
+    prompt = `${prompt}\n\n${buildLiveDeliveryNote(
+      turn.continuationDelivery.request,
+      turn.continuationDelivery.answer,
+    )}`;
+  }
   return prompt;
 }
 
+// Delivered into the conversation when a continuation finishes AFTER the voice
+// session ended. There is no next voice turn to fold into, so this lands as a
+// normal turn in the thread — where the user actually goes looking for the
+// work. Framed as a system-style report rather than a user request so the
+// reply reads as "here is what I finished", not a fresh instruction.
+function buildClosedSessionDeliveryPrompt(
+  interruptedRequest: string,
+  answer: string,
+): string {
+  const what = describeInterruptedRequest(interruptedRequest);
+  return `[Background work finished] The voice call ended before the completed result for ${what} could be delivered. Tell the user briefly that it is done and give them the result. Do not re-run any tool calls; the work is already complete. What you produced was:\n\n${answer}`;
+}
+
+// A fresh cycle: nothing captured, nothing released, no metrics turn open.
+function createUtteranceCycle(): UtteranceCycle {
+  return {
+    phase: "pending",
+    released: false,
+    assistantTurnStarted: false,
+    completed: false,
+    finalizeRequested: false,
+    transcriber: null,
+    manualAudioCaptured: false,
+    pendingAudioChunks: [],
+    pendingAudioBytes: 0,
+    finalTranscriptSegments: [],
+    latestPartialText: null,
+    endpointExtensionCount: 0,
+    heldSpeculativeContent: null,
+    turnId: null,
+    userMessageId: null,
+    userAudioChunks: [],
+    metricsTurnStarted: false,
+    metricsTurnFinished: false,
+    stashedMetricsMarks: {
+      firstAudioAtMs: null,
+      firstPartialAtMs: null,
+      speechStartAtMs: null,
+      utteranceEndAtMs: null,
+      finalTranscriptAtMs: null,
+    },
+  };
+}
+
+// Carrier cycle for an assistant-initiated turn: the turn machinery is
+// utterance-shaped (metrics marks, audio archival, turn ids all hang off a
+// cycle), but an announcement has no capture behind it. The record starts fully
+// released with an empty transcript so nothing routes audio into it, and it is
+// never installed as `currentUtterance` — that field belongs to the VAD cycle.
+function createSyntheticUtterance(): UtteranceCycle {
+  return {
+    ...createUtteranceCycle(),
+    phase: "transcriber_closed",
+    released: true,
+  };
+}
+
 // Objective handed to the background subagent that continues a barged-in turn.
 // The subagent forks the live conversation, so it already sees the interrupted
 // turn's completed tool calls in history and resumes from there. The request
@@ -565,12 +810,63 @@ function buildVoiceControlPrompt(turn: ActiveAssistantTurn): string {
 // the forked history.
 function buildDuplexContinuationObjective(interruptedRequest: string): string {
   const base =
-    "You were in the middle of responding to the user's most recent request when they interrupted you. Finish that response now. Do not repeat any tool calls whose results are already present in the conversation. You are running unattended in the background with a read-only toolset: you cannot send, write, delete, purchase, or otherwise change anything, and most tools (including memory writes and any that take an action) are unavailable here. Do the read-only work you can. If finishing the request needs an action or a tool you do not have, do not attempt it; instead say plainly what you would do, so the user can approve it on their next turn.";
+    "You were in the middle of responding to the user's most recent request when they interrupted you. Finish that response now. Do not repeat any tool calls whose results are already present in the conversation. You are running unattended in the background: permission policy may auto-deny higher-risk actions with no one to approve them. If an action you need is denied, do not retry it; finish what you can and say plainly what remains, so the user can trigger it on their next turn.";
   return interruptedRequest.length > 0
     ? `${base} Their request was: "${interruptedRequest}".`
     : base;
 }
 
+// Built-ins beyond the strict read-only allowlist that cannot contend with a
+// background continuation's writes, whatever their input: they touch no
+// workspace, host, or extension state. `web_fetch` sits on the core
+// SIDE_EFFECT_TOOLS list because an UNATTENDED run firing off external requests
+// is a permission concern — a different question from this gate's, which is
+// only "can these two writers corrupt the same local state?". A network read
+// cannot, so it does not contend.
+//
+// `skill_load` is exempt per-invocation rather than by name. Re-entering an
+// already-installed static skill is the first call of nearly every barge-in
+// follow-up, and killing the continuation there would defeat the feature at the
+// moment it matters most — but a load that auto-installs a missing skill or
+// renders an inline command expansion writes local state and executes shell, so
+// it contends like anything else.
+const FOREGROUND_NON_CONTENDING_TOOLS: ReadonlySet<string> = new Set([
+  "web_fetch",
+]);
+
+// Foreground-wins classification: does this foreground tool start force the
+// running continuations to be aborted? The question is LOCAL-STATE
+// CONTENTION ("could these two writers corrupt the same workspace, host, or
+// extension state?"), NOT permission — this gate never affects what a tool is
+// allowed to do. Fail closed anyway: anything that is not a provably
+// non-contending BUILT-IN contends, because skill/plugin/MCP/workspace tools
+// carry no "writes local state" metadata and some of them (app_*, document_*)
+// very much do. `skill_execute` always contends: it is a dispatcher whose
+// resolved inner tool can mutate.
+function foregroundToolContendsWithContinuation(
+  toolName: string,
+  input?: Record<string, unknown>,
+): boolean {
+  if (toolName === "skill_execute") {
+    return true;
+  }
+  const ownerKind = getToolOwner(toolName)?.kind;
+  if (ownerKind === "default") {
+    if (FOREGROUND_NON_CONTENDING_TOOLS.has(toolName)) {
+      return false;
+    }
+    // Last, and behind the name checks above: `isInstalledStaticSkillLoad`
+    // re-reads the skill catalog from disk, so only a `skill_load` pays for it.
+    // Absent input fails closed — an unknown target could be an auto-install.
+    if (toolName === "skill_load") {
+      return (
+        input === undefined || !isInstalledStaticSkillLoad(toolName, input)
+      );
+    }
+  }
+  return isRefusedInReadOnlyPass(toolName, ownerKind);
+}
+
 // Upper bound on how long a barge-in waits for the interrupted turn's teardown
 // to settle before giving up on the continuation. The teardown settles once the
 // aborted turn's agent loop reaches its `finally`, which can wait out BOTH the
@@ -595,19 +891,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   private readonly archiveAudio: LiveVoiceSessionAudioArchiver | null;
   private readonly spawnBackgroundContinuation: LiveVoiceBackgroundContinuationSpawner | null;
   // Reads the interrupted turn's teardown promise so the barge-in path can wait
-  // for it to settle before forking the continuation (voice-duplex-handoff).
+  // for it to settle before forking the continuation.
   private readonly getTurnTeardown:
     | ((conversationId: string) => Promise<void> | undefined)
     | null;
   private readonly detachTeardownSettleTimeoutMs: number;
+  private readonly continuationAnnounceSilenceMs: number;
   // Abort handles for background continuations started when a barge-in detached
-  // an interrupted turn (voice-duplex-handoff). Each controller is registered
-  // synchronously before its spawn, so interrupt()/close() abort a continuation
-  // even if a stop lands while it is still spawning.
+  // an interrupted turn. Each controller is registered synchronously before
+  // its spawn, so interrupt()/close() abort a continuation even if a stop lands
+  // while it is still spawning.
   private readonly detachControllers = new Set<AbortController>();
-  // Bumped whenever a stop (interrupt/close) fires. A barge-in captures this
-  // before its async teardown; if it has changed by the time the detach would
-  // spawn, a stop landed during the gap and the continuation is not started.
+  // Bumped whenever detached runs are invalidated: a stop (interrupt/close),
+  // a newer barge-in superseding them, or a foreground-wins abort. A barge-in
+  // captures this (after its own bump) before its async teardown; if it has
+  // changed by the time the detach would spawn, an invalidation landed during
+  // the gap and the continuation is not started.
   private detachStopGeneration = 0;
   // Bumped SYNCHRONOUSLY at each barge-in (in barge order), before the async
   // detach runs. Only the latest-started detach (detachSeq === detachSequence)
@@ -665,11 +964,28 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // Consumed (and cleared) when that turn launches; cleared if the barge-in
   // utterance is discarded, so it can never attach to a later, unrelated turn.
   private pendingInterruptedRequest: string | null = null;
-  // Set when a background continuation (voice-duplex-handoff) finishes the reply
-  // a barge-in cut off: its final answer, folded into the next turn the user
-  // starts as context. Consumed (and cleared) when that turn launches; cleared
-  // on a hard stop (abortDetachedRuns) so a stale result never surfaces later.
+  // Set when a background continuation finishes the reply a barge-in cut off:
+  // its final answer, folded into the next turn the user starts as context.
+  // Consumed (and cleared) when that turn launches; cleared on a hard stop
+  // (abortDetachedRuns) so a stale result never surfaces later, and cleared by
+  // an announcement that delivers the same answer itself — an announcement the
+  // user cuts short hands it straight back.
   private pendingContinuationResult: string | null = null;
+  // The same finished continuation, queued for an announcement turn: the
+  // session speaks the result on its own once the call has been quiet for
+  // `continuationAnnounceSilenceMs`. This and `pendingContinuationResult` are
+  // armed together and are two routes for ONE answer — whichever fires first
+  // clears the other, so the user hears it exactly once. An announcement whose
+  // turn fails to start, or whose turn a barge-in cuts short, hands the answer
+  // back to the stash, so a lost delivery costs the announcement, not the
+  // answer.
+  private pendingAnnouncement: ContinuationDelivery | null = null;
+  private announcementTimer: ReturnType<typeof setTimeout> | null = null;
+  // Set when a continuation actually spawns: the request it took over, so the
+  // NEXT turn can tell the user the work is still running. Consumed by that
+  // turn; cleared when the continuation finishes (by then the result note
+  // takes over and "still running" would be stale).
+  private pendingHandoffRequest: string | null = null;
   private readonly maxPendingAudioBytes: number;
   // Set on VAD speech onset; consumed when the first speech chunk is routed
   // to an utterance so the metric lands on the right turn.
@@ -706,13 +1022,10 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   /** The cycle whose grace timer is armed (only the newest release has one). */
   private finalizeGraceCycle: UtteranceCycle | null = null;
   private readonly finalizeGraceMs: number;
-  // Rotates through the ack phrase list across the session's turns.
-  private ackPhraseCounter = 0;
   // Rotates through the progress fallback phrases across the session's turns.
   private progressPhraseCounter = 0;
-  // Front-model service: semantic endpointing on
-  // silence-fired turn-ends and LLM-phrased acks; null disables both LLM
-  // capabilities (energy endpointing + static ack phrasing remain).
+  // Front-model service: phrases spoken acks and progress narration; null
+  // disables both (the turn then holds the floor with silence).
   private readonly frontDecider: VoiceFrontDecider | null;
   // Complete front-model tunables: the constructor schema-parses the partial
   // option once, so every field carries its `liveVoice.frontModel` schema
@@ -757,6 +1070,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.detachTeardownSettleTimeoutMs =
       options.detachTeardownSettleTimeoutMs ??
       defaultDetachTeardownSettleTimeoutMs();
+    this.continuationAnnounceSilenceMs =
+      options.continuationAnnounceSilenceMs ?? CONTINUATION_ANNOUNCE_SILENCE_MS;
     this.emitMetrics = options.emitMetrics ?? false;
     this.createTurnId = options.createTurnId ?? randomUUID;
     this.conversationId =
@@ -896,8 +1211,18 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.state = "closed";
     this.turnDetector?.dispose();
     this.clearEndpointExtensionTimer();
+    // There is no longer anyone on the call to speak to, so a queued
+    // announcement cannot be spoken — but the answer behind it is finished
+    // work the user asked for, so it takes the same conversation route a
+    // continuation finishing after this point takes. Then the queue is
+    // cleared: the announcement is dead either way.
+    await this.deliverPendingContinuationToConversation();
+    this.clearContinuationAnnouncement();
     this.stopSessionTranscriber();
-    this.abortDetachedRuns();
+    // Detached continuations outlive the call. A deliberate `interrupt()`
+    // aborts them; ending the session leaves them running. With no next voice
+    // turn to fold into, a continuation that finishes after this point delivers
+    // into the conversation instead (see detachInterruptedTurn).
     await this.cancelAssistantTurn("session_closed");
     if (shouldEmitSessionEndMetrics) {
       await this.emitSessionEndMetrics();
@@ -912,32 +1237,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // mode, again after every finalized turn (per-utterance phase tracks the
   // cycle).
   private async beginUtterance(): Promise<UtteranceStartResult> {
-    const utterance: UtteranceCycle = {
-      phase: "pending",
-      released: false,
-      assistantTurnStarted: false,
-      completed: false,
-      finalizeRequested: false,
-      transcriber: null,
-      pendingAudioChunks: [],
-      pendingAudioBytes: 0,
-      finalTranscriptSegments: [],
-      latestPartialText: null,
-      endpointExtensionCount: 0,
-      heldSpeculativeContent: null,
-      turnId: null,
-      userMessageId: null,
-      userAudioChunks: [],
-      metricsTurnStarted: false,
-      metricsTurnFinished: false,
-      stashedMetricsMarks: {
-        firstAudioAtMs: null,
-        firstPartialAtMs: null,
-        speechStartAtMs: null,
-        utteranceEndAtMs: null,
-        finalTranscriptAtMs: null,
-      },
-    };
+    const utterance = createUtteranceCycle();
     this.currentUtterance = utterance;
     // Speech parked while the previous cycle wound down belongs to this
     // cycle: buffer it before the transcriber arms, and capture the detector
@@ -1118,6 +1418,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       return;
     }
 
+    // The chunk belongs to an utterance the user is still holding the button
+    // for, whether or not the transcriber has produced any text for it yet.
+    utterance.manualAudioCaptured = true;
     this.collectUserAudio(utterance, chunk);
     if (utterance.phase === "pending") {
       // The transcriber is still arming (session start overlaps the STT
@@ -1415,11 +1718,32 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       .trim();
     this.pendingInterruptedRequest =
       interruptedRequest.length > 0 ? interruptedRequest : null;
-    // A fresh interruption supersedes any already-stashed continuation result:
-    // drop it synchronously here so the barge-in follow-up (or any later) turn
-    // can't consume an older answer before this barge-in's own continuation
-    // completes. Cleared even when no continuation ultimately detaches.
-    this.pendingContinuationResult = null;
+    // A fresh interruption supersedes every earlier detached run, not just its
+    // stashed result: abort still-running continuations (and skip pending
+    // detaches) before this barge-in's own continuation can launch, so two
+    // full-ability background writers never share the workspace. The stashed
+    // result is dropped with them so the barge-in follow-up (or any later)
+    // turn can't consume an older answer before this barge-in's own
+    // continuation completes. This barge-in's detach snapshots the stop
+    // generation AFTER this bump (below), so it is unaffected. The abort is
+    // signal-level, with the same accepted residual as the foreground-wins
+    // gate (see the tool_use_start handler): a tool call already executing in
+    // the superseded run is not awaited. The replacement's detach still waits
+    // out the interrupted TURN's teardown before forking, which bounds the
+    // overlap to that one abandoned call.
+    this.abortDetachedRuns({ reason: "superseded_by_new_barge_in" });
+    // An announcement turn is the one interruption with nothing to continue:
+    // the work is already finished, which is why detachInterruptedTurn skips it
+    // as `announcement_turn`. The analog of "the interrupted work survives" is
+    // therefore the stash — the answer goes back into it so the user's next real
+    // turn still carries it, and the announcement (cut short, at best partly
+    // spoken) is not the delivery it was supposed to be. The restore sits after
+    // the abort above, which clears the stash, so nothing in this sequence
+    // re-drops it. Only a barge-in restores: interrupt/close/a superseding new
+    // continuation are resets the user asked for, and their answer stays gone.
+    if (turn.continuationDelivery !== null) {
+      this.pendingContinuationResult = turn.continuationDelivery.answer;
+    }
     // Order this barge-in among concurrent detaches SYNCHRONOUSLY, in barge
     // order — the actual detach runs after an async teardown chain, and those
     // chains can interleave, so bumping there could assign sequences out of
@@ -1429,8 +1753,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.clearFillerTimers(turn);
     // Tagged reason: provider catch-sites classify untagged caller aborts as
     // retryable transport failures (ERROR log + futile retry against the
-    // aborted signal). This signal reaches the brain leg and, with llmAckText
-    // on, in-flight ack generation.
+    // aborted signal). This signal reaches the brain leg and any in-flight
+    // ack generation.
     turn.abortController.abort(
       createAbortReason("voice_session_aborted", "live-voice-barge-in"),
     );
@@ -1445,6 +1769,16 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     // Snapshot the stop generation before the async teardown: a stop that lands
     // during it must cancel the pending detach (checked in detachInterruptedTurn).
     const stopGeneration = this.detachStopGeneration;
+    log.debug(
+      {
+        turnId: turn.turnId,
+        detachSeq,
+        // The two facts that decide whether a continuation is even eligible.
+        assistantCompleted: turn.assistantCompleted,
+        hasTeardownWait: teardownWait !== undefined,
+      },
+      "Voice barge-in cancelled a turn",
+    );
     void (async () => {
       await this.finishMetricsTurn(
         turn.utterance,
@@ -1454,21 +1788,26 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       );
       await this.sendFrame({ type: "turn_cancelled", turnId: turn.turnId });
       await this.cancelAssistantTurn("barge_in");
-      // Keep the interrupted turn's work alive on a background subagent
-      // (voice-duplex-handoff); the detach waits for its teardown to settle the
-      // partial into history before forking.
+      // Keep the interrupted turn's work alive on a background subagent; the
+      // detach waits for its teardown to settle the partial into history before
+      // forking.
       this.detachInterruptedTurn(turn, stopGeneration, teardownWait, detachSeq);
     })().catch(() => {});
   }
 
-  // True-duplex handoff (voice-duplex-handoff): keep a barged-in turn's work
-  // alive by continuing it on a background subagent instead of discarding it.
+  // Keep a barged-in turn's work alive by continuing it on a background
+  // subagent instead of discarding it.
   // Waits for the interrupted turn's bridge teardown (captured at barge-in) to
   // settle before forking, so its partial — including any completed tool calls —
   // is already in the conversation the subagent forks from and a side-effecting
   // continuation cannot repeat a call the interrupted turn already ran.
-  // Resurfacing the subagent's result is a follow-up; for now it runs silently
-  // and a later stop/interrupt aborts it.
+  // The continuation runs with full subagent abilities under the standard
+  // non-interactive permission policy; if a foreground turn starts its own
+  // side-effecting tool, the foreground-wins abort in the tool_use_start
+  // handler kills the continuation before the two can race on the workspace.
+  // The run itself makes no sound; its result reaches the user through the next
+  // turn they start, an announcement into audible silence, or the conversation
+  // once the call ends. A later stop/interrupt aborts it.
   private detachInterruptedTurn(
     turn: ActiveAssistantTurn,
     stopGeneration: number,
@@ -1476,18 +1815,39 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     detachSeq: number,
   ): void {
     const spawn = this.spawnBackgroundContinuation;
-    if (
-      !spawn ||
-      this.isClosed ||
-      // The model already finished generating (barge-in during TTS playback of a
-      // complete reply): there is nothing to continue, so a continuation would
-      // just re-do a finished answer.
-      turn.assistantCompleted ||
-      // A stop (interrupt/close) landed during the barge-in teardown: honor it
-      // and do not start the continuation.
-      this.detachStopGeneration !== stopGeneration ||
-      !isAssistantFeatureFlagEnabled("voice-duplex-handoff", getConfig())
-    ) {
+    // Every skip is logged with its reason — the handoff is silent by design,
+    // so without this a dropped continuation is indistinguishable from a
+    // never-attempted one (tail with: grep -i "voice duplex").
+    if (!spawn) {
+      log.debug(
+        { turnId: turn.turnId, skipReason: "no_spawner" },
+        "Voice duplex continuation skipped",
+      );
+      return;
+    }
+    const skipReason = this.isClosed
+      ? "session_closed"
+      : // Barging in over an announcement means the user is answering it, not
+        // asking for it to be finished in the background — there is no pending
+        // request behind an announcement turn to continue. Its answer is
+        // already finished, so bargeIn returns it to the stash instead.
+        turn.continuationDelivery !== null
+        ? "announcement_turn"
+        : // The model already finished generating (barge-in during TTS playback
+          // of a complete reply): there is nothing to continue, so a
+          // continuation would just re-do a finished answer.
+          turn.assistantCompleted
+          ? "assistant_already_completed"
+          : // A stop (interrupt/close) or a superseding invalidation landed
+            // during the barge-in teardown: honor it.
+            this.detachStopGeneration !== stopGeneration
+            ? "invalidated_during_barge_teardown"
+            : null;
+    if (skipReason !== null) {
+      log.info(
+        { turnId: turn.turnId, skipReason },
+        "Voice duplex continuation skipped",
+      );
       return;
     }
     // Embed the interrupted request in the objective so the continuation knows
@@ -1501,6 +1861,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     // controller.abort(), which the spawn's signal wiring honors).
     const controller = new AbortController();
     this.detachControllers.add(controller);
+    const detachStartedAtMs = Date.now();
     void (async () => {
       try {
         // Wait for the interrupted turn's teardown to settle its partial into
@@ -1528,39 +1889,119 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
           // The continuation is best-effort, so a rare dropped one is the safe
           // trade.
           if (!settled) {
+            log.info(
+              {
+                turnId: turn.turnId,
+                skipReason: controller.signal.aborted
+                  ? "invalidated_during_teardown_wait"
+                  : "teardown_settle_timeout",
+                waitedMs: Date.now() - detachStartedAtMs,
+                timeoutMs: this.detachTeardownSettleTimeoutMs,
+              },
+              "Voice duplex continuation skipped",
+            );
             return;
           }
         }
-        if (controller.signal.aborted || this.isClosed) {
+        // A closed session is NOT a reason to skip: the work outlives the
+        // call, and its result is delivered into the conversation below.
+        // Only an explicit invalidation (stop/interrupt/supersede) stops it.
+        if (controller.signal.aborted) {
+          log.info(
+            {
+              turnId: turn.turnId,
+              skipReason: "invalidated_before_spawn",
+              waitedMs: Date.now() - detachStartedAtMs,
+            },
+            "Voice duplex continuation skipped",
+          );
           return;
         }
+        log.debug(
+          {
+            turnId: turn.turnId,
+            teardownWaitMs: Date.now() - detachStartedAtMs,
+            interruptedRequest,
+          },
+          "Voice duplex continuation starting",
+        );
+        // The next turn tells the user this is still running. Set before the
+        // await so a follow-up turn launching during the run picks it up.
+        this.pendingHandoffRequest =
+          interruptedRequest.length > 0 ? interruptedRequest : null;
         const resultText = await spawn({
           parentConversationId: this.conversationId,
           objective: buildDuplexContinuationObjective(interruptedRequest),
           label: `voice-continue-${turn.turnId}`,
           signal: controller.signal,
         });
-        // Fold the completed continuation's answer into the next turn the user
-        // starts (never spoken unprompted). Re-check the stop guards after the
-        // await: an interrupt/close during the run must suppress it. Only the
-        // latest-started detach may populate the result, so once a newer
-        // barge-in has started, an older continuation completing (before or
-        // after it, empty or not) can't surface a stale answer. Only non-empty
-        // text is actually surfaced.
-        if (
+        // Route the completed continuation's answer. Re-check the stop guards
+        // after the await: an interrupt/close during the run must suppress it.
+        // Only the latest-started detach may populate the result, so once a
+        // newer barge-in has started, an older continuation completing (before
+        // or after it, empty or not) can't surface a stale answer. Only
+        // non-empty text is actually surfaced.
+        this.pendingHandoffRequest = null;
+        const answer = resultText.trim();
+        const notInvalidated =
           !controller.signal.aborted &&
-          !this.isClosed &&
           this.detachStopGeneration === stopGeneration &&
-          detachSeq === this.detachSequence
-        ) {
-          const answer = resultText.trim();
+          detachSeq === this.detachSequence;
+        // Two destinations, decided by whether a next voice turn still exists.
+        // Live session: stash for the next turn the user starts, AND queue an
+        // announcement that speaks it into audible silence if the user says
+        // nothing — the two are routes for one answer and cancel each other,
+        // so it is delivered exactly once. Session closed: there is no next
+        // turn and nobody to speak to, so deliver into the conversation — the
+        // thread is exactly where the user goes looking for the work.
+        const deliverToConversation =
+          notInvalidated && this.isClosed && answer.length > 0;
+        if (notInvalidated && !this.isClosed) {
           this.pendingContinuationResult = answer.length > 0 ? answer : null;
+          if (answer.length > 0) {
+            this.pendingAnnouncement = { request: interruptedRequest, answer };
+            this.scheduleContinuationAnnouncement();
+          }
         }
+        if (deliverToConversation) {
+          const { injectMessageIntoParent } =
+            await import("../subagent/notify.js");
+          injectMessageIntoParent(
+            this.conversationId,
+            buildClosedSessionDeliveryPrompt(interruptedRequest, answer),
+          );
+        }
+        log.info(
+          {
+            turnId: turn.turnId,
+            ranMs: Date.now() - detachStartedAtMs,
+            resultChars: answer.length,
+            // Where the answer went. "stashed" = queued for the next voice
+            // turn and for an announcement into silence, whichever comes first
+            // (the announcement logs "announced" when it wins);
+            // "conversation" = the call had ended, so it was delivered into the
+            // thread; "dropped" = a stop/interrupt or a newer barge-in landed
+            // while it ran.
+            resultDestination: !notInvalidated
+              ? "dropped"
+              : answer.length === 0
+                ? "empty"
+                : this.isClosed
+                  ? "conversation"
+                  : "stashed",
+          },
+          "Voice duplex continuation finished",
+        );
       } catch (err) {
         // A stop/interrupt aborts via the signal; that rejection is expected.
-        if (!controller.signal.aborted) {
+        if (controller.signal.aborted) {
+          log.debug(
+            { turnId: turn.turnId, ranMs: Date.now() - detachStartedAtMs },
+            "Voice duplex continuation aborted mid-run",
+          );
+        } else {
           log.warn(
-            { err, turnId: turn.turnId },
+            { err, turnId: turn.turnId, ranMs: Date.now() - detachStartedAtMs },
             "Voice duplex handoff continuation failed",
           );
         }
@@ -1571,9 +2012,37 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   }
 
   // Abort every background continuation this session started and drop its
-  // handle. A client interrupt or session close is a hard stop for detached
-  // work; the continuation's own `.finally` removes it from the set too.
-  private abortDetachedRuns(): void {
+  // handle. Called on a hard stop (client interrupt / session close), when a
+  // newer barge-in supersedes the detached runs, and on a foreground-wins
+  // abort; the continuation's own `.finally` removes it from the set too.
+  // `keepPendingResult` is the foreground-wins variant: the foreground turn is
+  // claiming the workspace, so running continuations must die (and pending
+  // detaches must be skipped), but an already-completed continuation's stashed
+  // answer stays — it cannot race anything, and the next turn's "use only if
+  // relevant" framing makes a stale one harmless.
+  private abortDetachedRuns(opts?: {
+    keepPendingResult?: boolean;
+    // Why the runs are being invalidated, for the log line below. Every
+    // caller passes one: an unexplained dead continuation is the single
+    // hardest thing to debug about this feature.
+    reason?: string;
+    // The foreground tool whose start tripped the contention gate, if any.
+    toolName?: string;
+  }): void {
+    const aborted = this.detachControllers.size;
+    const hadPendingResult = this.pendingContinuationResult !== null;
+    if (aborted > 0 || hadPendingResult) {
+      log.debug(
+        {
+          conversationId: this.conversationId,
+          reason: opts?.reason ?? "unspecified",
+          ...(opts?.toolName ? { toolName: opts.toolName } : {}),
+          abortedRuns: aborted,
+          droppedPendingResult: hadPendingResult && !opts?.keepPendingResult,
+        },
+        "Voice duplex continuations invalidated",
+      );
+    }
     // Bump the generation so a barge-in whose async teardown is still in flight
     // (its detach not yet spawned) sees the stop and skips the continuation.
     this.detachStopGeneration += 1;
@@ -1583,7 +2052,266 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     this.detachControllers.clear();
     // A hard stop also drops any completed continuation's result still waiting
     // to fold into the next turn, so it can't surface after the user reset.
+    if (!opts?.keepPendingResult) {
+      this.pendingContinuationResult = null;
+    }
+    // The announcement dies either way: even the foreground-wins variant (which
+    // keeps the stash) has a foreground turn claiming the floor, so speaking up
+    // on our own is exactly what must not happen.
+    this.clearContinuationAnnouncement();
+  }
+
+  private clearContinuationAnnouncement(): void {
+    this.pendingAnnouncement = null;
+    if (this.announcementTimer) {
+      clearTimeout(this.announcementTimer);
+      this.announcementTimer = null;
+    }
+  }
+
+  /**
+   * Hang-up delivery for a continuation that already finished: the call is
+   * ending, so neither route that was armed for its answer can still run — the
+   * announcement has nobody to speak to and the stash has no next voice turn to
+   * fold into. Deliver it into the conversation instead, exactly as a
+   * continuation finishing after the close does, because that thread is where
+   * the user goes looking for the work ("barge in, hear the answer, close the
+   * room, go look for the result").
+   *
+   * Best-effort and consume-once: the fields are emptied whether or not the
+   * injection lands, so a close cannot deliver twice.
+   */
+  private async deliverPendingContinuationToConversation(): Promise<void> {
+    const activeTurn = this.activeAssistantTurn;
+    const activeAnnouncement = activeTurn?.continuationDelivery ?? null;
+    const announcement = this.pendingAnnouncement ?? activeAnnouncement;
+    const answer = announcement?.answer ?? this.pendingContinuationResult;
+    const request = announcement?.request ?? "";
+    this.pendingAnnouncement = null;
+    this.pendingContinuationResult = null;
+    if (activeTurn !== null) {
+      activeTurn.continuationDelivery = null;
+    }
+    if (answer === null || answer.length === 0) {
+      return;
+    }
+    try {
+      const { injectMessageIntoParent } = await import("../subagent/notify.js");
+      injectMessageIntoParent(
+        this.conversationId,
+        buildClosedSessionDeliveryPrompt(request, answer),
+      );
+      log.info(
+        {
+          conversationId: this.conversationId,
+          resultChars: answer.length,
+          resultDestination: "conversation",
+        },
+        "Voice duplex continuation delivered on session close",
+      );
+    } catch (err) {
+      log.warn(
+        { err, conversationId: this.conversationId },
+        "Voice duplex continuation delivery on session close failed",
+      );
+    }
+  }
+
+  /**
+   * Live-voice is non-interactive (JARVIS-1291) and the session never starts a
+   * turn on its own — with one narrow exception, this: a background
+   * continuation the user asked for has finished, the call is still live, and
+   * nobody is speaking. Arms the silence timer that decides whether that
+   * exception applies. Re-arming resets the wait, so a run of arms collapses
+   * into one announcement.
+   *
+   * The silence the timer waits out starts when the audio the client already
+   * has queued runs out, so a continuation finishing at the tail end of a long
+   * spoken reply waits for that reply to actually finish playing.
+   *
+   * `retry` marks the single re-arm a user-speech blocker gets. An active
+   * assistant turn keeps the announcement queued without polling; releasing
+   * the turn re-arms the timer against the actual playback tail.
+   */
+  private scheduleContinuationAnnouncement(
+    retry = false,
+    drainRearms = 0,
+  ): void {
+    if (this.announcementTimer) {
+      clearTimeout(this.announcementTimer);
+    }
+    // Queued client-side audio is the previous reply still being audible, so
+    // the silence window only begins once it has drained.
+    const drainMs = Math.max(0, this.assistantPlaybackTailUntilMs - Date.now());
+    this.announcementTimer = setTimeout(() => {
+      this.announcementTimer = null;
+      const blockedBy = this.continuationAnnouncementBlocker();
+      if (blockedBy === null) {
+        void this.announceContinuation().catch((err: unknown) => {
+          log.warn({ err }, "Voice duplex continuation announcement failed");
+        });
+        return;
+      }
+      log.debug(
+        { conversationId: this.conversationId, blockedBy, retry, drainRearms },
+        "Voice duplex continuation announcement deferred",
+      );
+      // A tail that grew while the timer ran (the reply was still streaming
+      // TTS when it was armed) is a wait of known length rather than a busy
+      // call, so it re-arms against the new deadline without spending the
+      // single retry the busy-call blockers get — otherwise a long reply's
+      // playback alone outlasts the budget and the announcement is dropped
+      // even though the call goes idle right after. The tail only extends
+      // while a turn is active, which blocks earlier, so the re-arms converge;
+      // the cap bounds the interleaving where a fresh turn's audio lands
+      // between two checks.
+      if (
+        blockedBy === "playback_draining" &&
+        drainRearms < CONTINUATION_ANNOUNCE_MAX_DRAIN_REARMS
+      ) {
+        this.scheduleContinuationAnnouncement(retry, drainRearms + 1);
+        return;
+      }
+      if (blockedBy === "turn_active") {
+        return;
+      }
+      if (retry || this.pendingAnnouncement === null) {
+        this.pendingAnnouncement = null;
+        return;
+      }
+      this.scheduleContinuationAnnouncement(true, drainRearms);
+    }, drainMs + this.continuationAnnounceSilenceMs);
+  }
+
+  private clearActiveAssistantTurn(token: symbol): void {
+    if (this.activeAssistantTurn?.token !== token) {
+      return;
+    }
+    this.activeAssistantTurn = null;
+    if (
+      this.pendingAnnouncement !== null &&
+      !this.isClosed &&
+      this.state !== "failed"
+    ) {
+      this.scheduleContinuationAnnouncement();
+    }
+  }
+
+  // Why the session must not speak up right now, or null when the call is
+  // genuinely idle: live, no turn running, and no user speech anywhere in
+  // flight (onset latch, barge-in guard, detector, or a cycle that has already
+  // captured something). The server-VAD re-arm keeps an empty cycle armed
+  // between turns, so an untouched `currentUtterance` IS the idle state.
+  private continuationAnnouncementBlocker(): string | null {
+    if (this.pendingAnnouncement === null) {
+      return "nothing_pending";
+    }
+    if (this.isClosed || this.state === "failed" || !this.startVoiceTurn) {
+      return "session_unavailable";
+    }
+    if (this.activeAssistantTurn !== null) {
+      return "turn_active";
+    }
+    // The turn can be cleared server-side (tts_done sent) while the client is
+    // still playing the audio it queued: that tail is the previous reply still
+    // being audible, so announcing over it is announcing over the assistant.
+    if (Date.now() < this.assistantPlaybackTailUntilMs) {
+      return "playback_draining";
+    }
+    if (this.vadSpeechStartPending || this.pendingBargeIn !== null) {
+      return "speech_onset";
+    }
+    if (this.turnDetector?.isActive === true) {
+      return "user_speaking";
+    }
+    const utterance = this.currentUtterance;
+    // Every transcript-derived signal here trails the STT provider, so on its
+    // own it leaves manual mode blind to a user who is talking right now and
+    // has no text yet — hence the captured-audio flag, which manual ingress
+    // sets from the first chunk.
+    if (
+      utterance !== null &&
+      !utterance.completed &&
+      (utterance.released ||
+        utterance.assistantTurnStarted ||
+        utterance.manualAudioCaptured ||
+        utterance.finalTranscriptSegments.length > 0 ||
+        utterance.latestPartialText !== null)
+    ) {
+      return "utterance_in_flight";
+    }
+    return null;
+  }
+
+  // Speak the finished continuation's result on a turn the session starts
+  // itself. The turn rides a synthetic cycle rather than the armed VAD one —
+  // `currentUtterance` belongs to the capture loop, and overwriting it would
+  // collide with the user's next real utterance.
+  private async announceContinuation(): Promise<void> {
+    const pending = this.pendingAnnouncement;
+    if (!pending) {
+      return;
+    }
+    this.pendingAnnouncement = null;
+    // The two routes for one answer are mutually exclusive: while this turn is
+    // in flight the stash must not deliver the same answer again. It comes back
+    // only if this turn provably never started (below) or a barge-in cuts it
+    // short before it delivers (see bargeIn).
     this.pendingContinuationResult = null;
+    // Pins the invalidation state this hand-off was decided in: a hard stop
+    // landing while the turn starts owns the drop, and must not be undone by
+    // the restore below.
+    const stopGeneration = this.detachStopGeneration;
+    let started: boolean;
+    try {
+      started = await this.launchAssistantTurn(
+        createSyntheticUtterance(),
+        CONTINUATION_DELIVERY_CONTENT,
+        { continuationDelivery: pending },
+      );
+    } catch (err) {
+      // A throw before the leg's own error handling (an outbound frame write
+      // rejecting, say) leaves the same state a false return does: nothing
+      // persisted, nothing spoken, and the stash already emptied above. Take
+      // the identical fallback rather than letting the answer die with the
+      // rejection.
+      started = false;
+      log.warn(
+        { err, conversationId: this.conversationId },
+        "Voice duplex continuation announcement threw while starting",
+      );
+    }
+    if (started) {
+      log.info(
+        {
+          conversationId: this.conversationId,
+          resultChars: pending.answer.length,
+          resultDestination: "announced",
+        },
+        "Voice duplex continuation announced",
+      );
+      return;
+    }
+    // The turn never reached the bridge (the conversation is busy from another
+    // surface, or the bridge threw), so nothing was persisted or spoken. Hand
+    // the answer back to the stash — the user's next turn is the fallback route
+    // that exists for exactly this. A newer continuation's answer already in
+    // the stash wins over this older one rather than being overwritten.
+    const restashed =
+      !this.isClosed &&
+      this.detachStopGeneration === stopGeneration &&
+      this.pendingContinuationResult === null;
+    if (restashed) {
+      this.pendingContinuationResult = pending.answer;
+    }
+    log.warn(
+      {
+        conversationId: this.conversationId,
+        resultChars: pending.answer.length,
+        resultDestination: restashed ? "stashed" : "dropped",
+      },
+      "Voice duplex continuation announcement could not start",
+    );
   }
 
   // VAD closed the utterance — the analog of ptt_release: emit
@@ -1618,30 +2346,18 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         }
         return;
       }
-      // Semantic endpointing: a silence boundary may be a thinking pause —
-      // let the front decider hold the utterance open. Only detector-timer
+      // Semantic endpointing: a silence boundary may be a thinking pause, so
+      // the unified front-door leg itself is the endpoint decision. When it
+      // launches, the boundary is deferred to the verdict — commit releases
+      // the utterance, hold replays the boundary via the extension timer.
+      // When speculation is inapplicable (no text, cap reached, a turn
+      // already active) fall through and release. Only detector-timer
       // silences qualify; max-duration always releases, and a manual client
       // release (ptt_release forced the boundary) is the user saying "answer
-      // now" — never second-guess it. The gate is synchronous (null) whenever
-      // the decider is not consulted, so that release path keeps its exact
-      // event ordering — an extra await here would shift utterance release
-      // across the persistent-transcriber flush attribution.
+      // now" — never second-guess it.
       if (reason === "silence" && !manualRelease) {
-        if (this.frontDoorRoutingActive()) {
-          // Unified front-door: the leg itself is the endpoint decision.
-          // When it launches, the boundary is deferred to the verdict —
-          // commit releases the utterance, hold replays the boundary via
-          // the extension timer. When speculation is inapplicable (no
-          // text, cap reached, a turn already active) fall through and
-          // release exactly as before.
-          if (await this.launchSpeculativeAssistantTurn(utterance)) {
-            return;
-          }
-        } else {
-          const holdDecision = this.maybeHoldUtteranceOpen(utterance);
-          if (holdDecision && (await holdDecision)) {
-            return;
-          }
+        if (await this.launchSpeculativeAssistantTurn(utterance)) {
+          return;
         }
       }
       await this.sendFrame({ type: "utterance_end", reason });
@@ -1649,96 +2365,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     })().catch(() => {});
   }
 
-  /**
-   * Semantic-endpointing gate for a silence-fired turn-end. Returns `null`
-   * synchronously when the decider is not consulted (no decider,
-   * extension cap reached, nothing transcribed) — the boundary then releases
-   * exactly as before. Otherwise resolves `true` when the boundary must NOT
-   * release the utterance now: either the decider held it open (the extension
-   * timer replays the boundary), or the world moved on during the decision
-   * (speech resumed, utterance superseded) and a fresh boundary owns the
-   * release. Every decider failure resolves as "release" within
-   * `endpointDecisionTimeoutMs` (fail-open), so consulting it adds at most
-   * that much end-of-turn latency.
-   */
-  private maybeHoldUtteranceOpen(
-    utterance: UtteranceCycle,
-  ): Promise<boolean> | null {
-    const decider = this.frontDecider;
-    if (!decider) {
-      return null;
-    }
-    if (
-      utterance.endpointExtensionCount >=
-      this.frontModelConfig.endpointMaxExtensions
-    ) {
-      return null;
-    }
-    const transcriptSoFar = utterance.finalTranscriptSegments.join(" ").trim();
-    const latestPartial = utterance.latestPartialText;
-    if (transcriptSoFar.length === 0 && !latestPartial) {
-      // Nothing transcribed yet: there is no text to judge.
-      return null;
-    }
-    return this.decideUtteranceHold(
-      decider,
-      utterance,
-      transcriptSoFar,
-      latestPartial,
-    );
-  }
-
-  private async decideUtteranceHold(
-    decider: VoiceFrontDecider,
-    utterance: UtteranceCycle,
-    transcriptSoFar: string,
-    latestPartial: string | null,
-  ): Promise<boolean> {
-    const generation = this.vadSpeechGeneration;
-    const decisionStartedAtMs = this.metricsClock();
-    const decision = await decider
-      .decideEndpoint({
-        transcriptSoFar,
-        latestPartial,
-        silenceThresholdMs: this.silenceThresholdMs,
-        extensionCount: utterance.endpointExtensionCount,
-      })
-      // The decider contract never rejects, but the enclosing boundary flow
-      // swallows rejections — a rejecting decider (a buggy stub, a future
-      // regression) would silently drop the silence boundary. Belt and
-      // braces: rejection degrades to release, mirroring speakGeneratedAck.
-      .catch(() => ({ action: "release" as const }));
-    const decisionLatencyMs = Math.max(
-      0,
-      this.metricsClock() - decisionStartedAtMs,
-    );
-    // Re-check the world after the await: the decision window is bounded but
-    // real, and a release based on a stale snapshot could cut off speech.
-    if (
-      this.isUtteranceStale(utterance) ||
-      utterance.released ||
-      utterance.completed
-    ) {
-      return true;
-    }
-    if (generation !== this.vadSpeechGeneration) {
-      // Speech resumed during the decision: the utterance keeps accumulating
-      // and the detector's next turn-end re-runs the whole decision. The
-      // discarded decision is not recorded — only acted-on outcomes count.
-      return true;
-    }
-    this.markEndpointDecision(utterance, decision.action, decisionLatencyMs);
-    if (decision.action !== "hold") {
-      return false;
-    }
-    utterance.endpointExtensionCount += 1;
-    this.armEndpointExtensionTimer(utterance);
-    return true;
-  }
-
   // Arms the hold-extension replay: after `endpointExtensionMs` of continued
-  // silence the deferred silence boundary re-fires (and the decider is
-  // consulted again, bounded by `endpointMaxExtensions`).
+  // silence the deferred silence boundary re-fires (and a fresh front-door
+  // leg judges it again, bounded by `endpointMaxExtensions`).
   private armEndpointExtensionTimer(utterance: UtteranceCycle): void {
     this.clearEndpointExtensionTimer();
     this.endpointExtensionTimer = setTimeout(() => {
@@ -1757,18 +2386,6 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     }, this.frontModelConfig.endpointExtensionMs);
   }
 
-  /**
-   * Whether front-door routing is active: the single `voice-mode` flag.
-   * Governs both halves of the unified front door — the speculative leg that
-   * decides the endpoint, and the escalation hand-off — so the two can never
-   * disagree. The decider-based hold path (`decideEndpoint`) runs as the
-   * flag-off fallback, so endpointing stays model-decided either way.
-   */
-  private frontDoorRoutingActive(config?: AssistantConfig): boolean {
-    const cfg = config ?? getConfig();
-    return isAssistantFeatureFlagEnabled("voice-mode", cfg);
-  }
-
   /**
    * Unified front-door: dispatch the assistant turn speculatively at the
    * silence boundary, judging the transcript accumulated so far — the same
@@ -1903,15 +2520,20 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   /**
    * Abort a speculative leg and roll back everything it touched: the
    * persisted user message (via the handle's discard), the active-turn
-   * slot, and the utterance's turn-started latch, so the utterance can be
-   * re-dispatched (hold replay) or keep accumulating (speech resumed).
-   * Nothing was ever user-visible — no frames were sent for this turn.
+   * slot, the pending context it consumed, and the utterance's turn-started
+   * latch, so the utterance can be re-dispatched (hold replay) or keep
+   * accumulating (speech resumed). Nothing was ever user-visible — no frames
+   * were sent for this turn.
    */
   private discardSpeculativeTurn(
     turn: ActiveAssistantTurn,
     reason: string,
   ): void {
     turn.speculativePending = false;
+    // The dispatch is being unwound, so the barge-in merge note, the finished
+    // continuation's answer, and its queued announcement all go back to the
+    // session — the turn that would have delivered them is gone.
+    this.restorePendingTurnContext(turn);
     // Latched before the handle check: when the discard beats the bridge
     // handle's resolution (startVoiceTurn still persisting), the handle's
     // arrival in startAssistantLeg completes the rollback via discard().
@@ -2414,7 +3036,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     // without ever reaching finalizePendingUtterance).
     this.pendingInterruptedRequest = null;
     // ...and it hard-stops any detached background continuations.
-    this.abortDetachedRuns();
+    this.abortDetachedRuns({ reason: "client_interrupt" });
     const utterance = this.currentUtterance;
     this.stopSessionTranscriber();
     if (utterance) {
@@ -2514,38 +3136,116 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       return;
     }
 
-    // Consume any pending barge-in merge context and completed-continuation
-    // context for this turn (each feeds exactly the next launched turn).
-    const interruptedRequest = this.pendingInterruptedRequest;
+    await this.launchAssistantTurn(utterance, content);
+  }
+
+  /**
+   * Take the barge-in merge context, the completed-continuation context, and
+   * the handoff note for the turn being launched — each feeds exactly the next
+   * launched turn — and cancel the queued announcement, because the turn this
+   * context rides delivers the same answer and would otherwise say it twice.
+   *
+   * Every real user turn consumes here, speculative or not: a speculative
+   * dispatch latches `assistantTurnStarted`, so a turn that skipped this would
+   * never pick the context up on any later pass. A rolled-back dispatch hands
+   * it all back (restorePendingTurnContext).
+   */
+  private consumePendingTurnContext(): {
+    interruptedRequest: string | null;
+    continuationResult: string | null;
+    handedOffRequest: string | null;
+    announcement: ContinuationDelivery | null;
+  } {
+    const consumed = {
+      interruptedRequest: this.pendingInterruptedRequest,
+      continuationResult: this.pendingContinuationResult,
+      handedOffRequest: this.pendingHandoffRequest,
+      announcement: this.pendingAnnouncement,
+    };
     this.pendingInterruptedRequest = null;
-    const continuationResult = this.pendingContinuationResult;
     this.pendingContinuationResult = null;
-    await this.launchAssistantTurn(utterance, content, {
-      interruptedRequest,
-      continuationResult,
-    });
+    this.pendingHandoffRequest = null;
+    this.clearContinuationAnnouncement();
+    return consumed;
+  }
+
+  /**
+   * Hand a turn's consumed pending context back to the session because the
+   * turn never happened: a speculative dispatch was discarded or held, or the
+   * launch never reached the bridge. Without this a hold verdict would destroy
+   * a finished continuation's answer outright — the stash was already emptied
+   * and no later turn would ever see it.
+   *
+   * Restores are conservative. A hard stop (interrupt/close/supersede) bumps
+   * `detachStopGeneration`, and that drop is deliberate — never undone here.
+   * Anything newer already sitting in a slot wins over the older value being
+   * returned to it.
+   */
+  private restorePendingTurnContext(turn: ActiveAssistantTurn): void {
+    const interruptedRequest = turn.interruptedRequest;
+    const continuationResult = turn.continuationResult;
+    const handedOffRequest = turn.handedOffRequest;
+    const announcement = turn.consumedAnnouncement;
+    // One restore per turn: the rollback paths overlap (a discarded turn whose
+    // leg start also fails), and the second pass must be a no-op.
+    turn.interruptedRequest = null;
+    turn.continuationResult = null;
+    turn.handedOffRequest = null;
+    turn.consumedAnnouncement = null;
+    if (
+      this.isClosed ||
+      this.detachStopGeneration !== turn.pendingContextStopGeneration
+    ) {
+      return;
+    }
+    if (this.pendingInterruptedRequest === null) {
+      this.pendingInterruptedRequest = interruptedRequest;
+    }
+    if (this.pendingContinuationResult === null) {
+      this.pendingContinuationResult = continuationResult;
+    }
+    // "Still running" is stale the moment a result exists, which is why the
+    // detach clears the handoff note when it finishes — don't reinstate it
+    // against a continuation that has since completed.
+    if (
+      this.pendingHandoffRequest === null &&
+      this.pendingContinuationResult === null
+    ) {
+      this.pendingHandoffRequest = handedOffRequest;
+    }
+    if (announcement !== null && this.pendingAnnouncement === null) {
+      this.pendingAnnouncement = announcement;
+      this.scheduleContinuationAnnouncement();
+    }
   }
 
   // Build the ActiveAssistantTurn for a released utterance and drive its model
-  // leg.
+  // leg. Resolves true once the leg has a live turn handle, false when the
+  // dispatch never reached the bridge — the signal a caller with a fallback
+  // route (announceContinuation) needs, since a failed start is otherwise
+  // handled entirely inside startAssistantLeg.
   private async launchAssistantTurn(
     utterance: UtteranceCycle,
     content: string,
     opts?: {
-      // Set on a barge-in follow-up turn: the interrupted request's transcript,
-      // appended to the turn's control prompt so the model merges the two.
-      interruptedRequest?: string | null;
-      // Set when a background continuation finished the interrupted reply: its
-      // answer, appended to the turn's control prompt as context.
-      continuationResult?: string | null;
+      // Set on an announcement turn: the finished continuation this turn exists
+      // to deliver. Its answer goes in the control prompt, not in `content`.
+      continuationDelivery?: ContinuationDelivery | null;
       // Unified front-door: dispatch without releasing the utterance. The
       // thinking frame and floor-holding timers are deferred until the leg's
       // leading verdict commits the turn (see commitSpeculativeTurn); a hold
       // verdict rolls everything back instead.
       speculative?: boolean;
     },
-  ): Promise<void> {
+  ): Promise<boolean> {
     utterance.assistantTurnStarted = true;
+    // The announcement turn IS the delivery of the pending continuation, so it
+    // must not also consume the stash — feeding it both would deliver the same
+    // answer twice. Every other turn is a real user turn and takes the context.
+    const pending =
+      opts?.continuationDelivery == null
+        ? this.consumePendingTurnContext()
+        : null;
     const token = Symbol("live-voice-assistant-turn");
     const turnId = this.ensureTurnId(utterance);
     this.startMetricsTurnIfNeeded(utterance, turnId);
@@ -2561,6 +3261,11 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       progress: {
         ops: [],
         opsSinceNarration: 0,
+        // Equal epochs at launch: a turn that has done nothing observable yet
+        // has nothing to narrate, so the idle trigger waits for tool activity
+        // or the maxSilenceMs heartbeat.
+        stateEpoch: 0,
+        narratedEpoch: 0,
         updatesSpoken: 0,
         lastFloorHolderAtMs: null,
         lastAudibleAtMs: Date.now(),
@@ -2569,6 +3274,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       },
       assistantCompleted: false,
       ttsDone: false,
+      minimizeRequested: false,
       ttsAudioStarted: false,
       finalized: false,
       speculativePending: opts?.speculative === true,
@@ -2580,8 +3286,12 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       verdictDeadlineTimer: null,
       discardRequested: false,
       speculativeBuffer: "",
-      interruptedRequest: opts?.interruptedRequest ?? null,
-      continuationResult: opts?.continuationResult ?? null,
+      interruptedRequest: pending?.interruptedRequest ?? null,
+      continuationResult: pending?.continuationResult ?? null,
+      handedOffRequest: pending?.handedOffRequest ?? null,
+      consumedAnnouncement: pending?.announcement ?? null,
+      pendingContextStopGeneration: this.detachStopGeneration,
+      continuationDelivery: opts?.continuationDelivery ?? null,
       toolUseStarted: false,
       firstDeltaSeen: false,
       deltaEpoch: 0,
@@ -2605,7 +3315,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     if (!opts?.speculative) {
       await this.sendFrame({ type: "thinking", turnId });
       if (!this.isActiveAssistantTurn(token)) {
-        return;
+        this.restorePendingTurnContext(activeTurn);
+        return false;
       }
     } else {
       // Verdict-deadline fail-open: the deferred-everything window is only
@@ -2635,11 +3346,10 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       }, this.frontModelConfig.endpointDecisionTimeoutMs);
     }
 
-    const cfg = getConfig();
-
     // Slow-first-delta spoken ack: if the model produces no delta within the
-    // budget, a short static phrase holds the floor. Only meaningful on TTS
-    // sessions — a text-only session has no audio gap to bridge.
+    // budget, a short front-model-phrased sentence holds the floor. Only
+    // meaningful on TTS sessions — a text-only session has no audio gap to
+    // bridge.
     if (this.streamTtsAudio && !opts?.speculative) {
       this.armAckTimer(activeTurn);
     }
@@ -2657,33 +3367,30 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       this.armProgressIdleTimer(activeTurn);
     }
 
-    // Triage-and-escalate (Voice Mode): active whenever the `voice-mode` flag
-    // is on. A live-voice session already implies voice-mode client-side; the
-    // explicit server-side check keeps the gate honest when the daemon's flag
-    // copy lags (it falls back to the decider-based hold path until it lands).
-    const escalateEnabled = this.frontDoorRoutingActive(cfg);
-
-    // Front-door leg: with routing on, a fast model fronts the turn (the
-    // `voiceFrontDoor` call site pins it) and may hand off on the escalate
-    // verdict; with it off, a single leg runs on the call-site default —
-    // byte-for-byte the prior behavior.
-    await this.startAssistantLeg(
-      activeTurn,
-      escalateEnabled
-        ? {
-            content,
-            routingLeg: "front-door",
-            frontDoor: true,
-          }
-        : { content },
-    );
+    // Front-door leg: a fast model fronts every turn (the `voiceFrontDoor`
+    // call site pins it) and may hand off to a quality leg on the escalate
+    // verdict.
+    const started = await this.startAssistantLeg(activeTurn, {
+      content,
+      routingLeg: "front-door",
+      frontDoor: true,
+    });
+    if (!started) {
+      // Nothing was persisted or spoken, so the context this turn consumed goes
+      // back to the session rather than dying with the failed dispatch.
+      this.restorePendingTurnContext(activeTurn);
+    }
+    return started;
   }
 
   /**
    * Drive one model leg of an assistant turn through the session bridge,
    * streaming its deltas to the live-voice client and TTS. Returns once the
    * leg's turn handle is acquired (or the start fails) — turn completion stays
-   * callback-driven via message_complete, exactly as the single-leg path did.
+   * callback-driven via message_complete. The resolved boolean is whether the
+   * bridge actually handed back a turn handle: false means the leg never
+   * started (no bridge wired, or the start threw and was reported as an error
+   * frame), so nothing of this turn was persisted or spoken.
    *
    * A turn runs one leg normally. Under triage-and-escalate the front-door leg
    * (`frontDoor: true`) runs the verdict-first protocol: its leading tokens
@@ -2704,35 +3411,38 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       frontDoor?: boolean;
       spokenEscalationBridge?: string;
     },
-  ): Promise<void> {
+  ): Promise<boolean> {
     if (!this.startVoiceTurn) {
-      return;
+      return false;
     }
     const { token, utterance, turnId } = activeTurn;
 
-    // Front-door verdict gate (verdict-first protocol — see
-    // voice-triage-escalate.ts). `rawText` accumulates this leg's full
-    // stream; the leg starts in `deciding` until its leading tokens
-    // classify as hold / escalate / answer. An answer flushes through
-    // `flushFrontDoor` (with `frontDoorEmitted` tracking what has been
-    // forwarded); an escalation buffers the post-verdict stream into
-    // `bridgeRaw` until the bridge is complete, then hands off.
+    // `rawText` accumulates this leg's full stream. A front-door leg starts
+    // in `deciding` until its leading tokens classify as hold / escalate /
+    // answer: an answer flushes through the shared marker holdback, while an
+    // escalation buffers the post-verdict stream into `bridgeRaw` until the
+    // bridge is complete, then hands off. A default/escalated leg flushes
+    // every delta through the same holdback, so a stray control marker from
+    // the main model is stripped instead of spoken.
     let rawText = "";
-    let frontDoorEmitted = 0;
     let frontDoorStage: "deciding" | "answer" | "bridging" | "handedOff" =
       "deciding";
     let bridgeRaw = "";
 
-    const emitFrontDoor = (chunk: string): void => {
+    const emitLegText = (chunk: string): void => {
       if (chunk.length === 0) {
         return;
       }
       this.markFirstAssistantDelta(utterance, turnId);
       this.markFirstDeltaForAck(activeTurn);
-      // Same send-time abort gate as the default-leg delta path: a front-door
-      // delta queued behind a backed-up outbound frame must not be written
-      // once barge-in aborts the turn. Escalation aborts the front-door handle,
-      // not this turn's controller, so legitimate front-door text still sends.
+      // Send-time abort gate: a delta queued behind a backed-up outbound
+      // frame must not be written once barge-in aborts the turn, or the
+      // cancelled reply's text leaks ahead of turn_cancelled. Key off this
+      // turn's own abort signal — a normal message_complete finalizes and
+      // clears activeAssistantTurn while trailing deltas may still be
+      // draining, so an activeAssistantTurn-based guard would drop them.
+      // Escalation aborts the front-door handle, not this turn's controller,
+      // so legitimate front-door text still sends.
       void this.sendFrame(
         { type: "assistant_text_delta", text: chunk },
         () => !activeTurn.abortController.signal.aborted && !this.isClosed,
@@ -2740,26 +3450,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       this.bufferAssistantTextForTts(token, chunk);
     };
 
-    // Forward the stripped, non-partial-marker prefix that has not been
-    // emitted yet (answer stage only). A trailing "[…" that could still
-    // become a control marker is held back until a later delta disproves
-    // it; a real partial that never completes is simply never spoken.
-    const flushFrontDoor = (): void => {
-      let safeEnd = rawText.length;
-      const lastOpen = rawText.lastIndexOf("[");
-      if (lastOpen >= frontDoorEmitted) {
-        const tail = rawText.slice(lastOpen);
-        if (!tail.includes("]") && couldBeControlMarker(tail)) {
-          safeEnd = lastOpen;
-        }
-      }
-      if (safeEnd > frontDoorEmitted) {
-        emitFrontDoor(
-          stripInternalSpeechMarkers(rawText.slice(frontDoorEmitted, safeEnd)),
-        );
-        frontDoorEmitted = safeEnd;
-      }
-    };
+    const flushLegText = createControlMarkerHoldback(activeTurn, emitLegText);
 
     // Hand off once enough of the post-verdict stream has arrived to cap
     // the bridge (sentence terminator or hard cap). Until then nothing is
@@ -2782,11 +3473,19 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         assistantMessageChannel: "vellum",
         userMessageInterface: "macos",
         assistantMessageInterface: "macos",
-        voiceControlPrompt: buildVoiceControlPrompt(activeTurn),
+        voiceControlPrompt: buildVoiceControlPrompt(activeTurn, {
+          ...(leg.frontDoor !== undefined ? { frontDoor: leg.frontDoor } : {}),
+        }),
         content: leg.content,
         isInbound: true,
         launchedAtMs: activeTurn.launchedAtMs,
         signal: activeTurn.abortController.signal,
+        // An announcement turn's content is a fixed marker, not user speech:
+        // persist it hidden and suppress its echo so nothing renders as a user
+        // bubble for a turn the user never started.
+        ...(activeTurn.continuationDelivery !== null
+          ? { hiddenSyntheticPrompt: true }
+          : {}),
         ...(leg.overrideProfile != null
           ? { overrideProfile: leg.overrideProfile }
           : {}),
@@ -2856,7 +3555,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
                 }
                 frontDoorStage = "answer";
               }
-              flushFrontDoor();
+              flushLegText(rawText);
               return;
             }
             // Defensive: speculative legs are always front-door today, but a
@@ -2871,24 +3570,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
                 return;
               }
             }
-            this.markFirstAssistantDelta(utterance, turnId);
-            this.markFirstDeltaForAck(activeTurn);
-            void this.sendFrame(
-              {
-                type: "assistant_text_delta",
-                text: msg.text,
-              },
-              // Re-check at send time (mirrors the tts_audio path): a delta
-              // already queued behind a backed-up outbound frame must not be
-              // written once barge-in has aborted the turn, or the cancelled
-              // reply's text leaks ahead of turn_cancelled. Key off this turn's
-              // own abort signal — a normal message_complete finalizes and
-              // clears activeAssistantTurn while trailing deltas may still be
-              // draining, so an activeAssistantTurn-based guard would drop them.
-              () =>
-                !activeTurn.abortController.signal.aborted && !this.isClosed,
-            );
-            this.bufferAssistantTextForTts(token, msg.text);
+            rawText += msg.text;
+            flushLegText(rawText);
           },
           message_complete: (msg) => {
             const current = this.activeAssistantTurn;
@@ -2930,6 +3613,13 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
             if (leg.frontDoor && current.escalationHandedOff) {
               return;
             }
+            // A held "[…"-tail that never completed a marker is real text —
+            // force-flush it before assistantCompleted closes the TTS buffer
+            // and completeTtsForTurn signals the drain, so it is spoken and
+            // emitted rather than dropped.
+            if (!leg.frontDoor && msg.type === "message_complete") {
+              flushLegText(rawText, { force: true });
+            }
             current.assistantCompleted = true;
             if (msg.type === "generation_cancelled") {
               void this.finalizeAssistantTurn(
@@ -2940,6 +3630,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
               return;
             }
             current.assistantMessageId = msg.messageId ?? null;
+            current.continuationDelivery = null;
             this.completeTtsForTurn(token);
           },
           persisted_user_message_id: (messageId) => {
@@ -2964,6 +3655,40 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
               return;
             }
             current.toolUseStarted = true;
+            // Foreground wins the workspace: the continuation runs with full
+            // subagent abilities (it can write files, run commands), so the
+            // moment a live turn starts a consequential tool the two could
+            // race on the same workspace, host, or extension state. Kill
+            // running continuations and skip pending detaches; a continuation
+            // only survives while foreground turns stay provably read-only
+            // (the topic-change case it exists for). Fail closed: only
+            // provably non-contending built-ins keep a continuation alive
+            // (see foregroundToolContendsWithContinuation) — a name-based
+            // side-effect denylist misses mutators like plugin/MCP/skill
+            // tools. Over-aborting only drops a best-effort salvage;
+            // under-aborting risks a write race.
+            // An already-completed continuation's stashed answer is kept — it
+            // cannot race anything.
+            //
+            // Accepted residual: the abort is signal-level. A tool call
+            // already executing inside the continuation is not awaited (the
+            // agent loop abandons the in-flight promise on cancellation), so
+            // that one call can briefly overlap the foreground tool. Closing
+            // it would take a cross-conversation execution lock that the
+            // subagent model deliberately does not have — parallel subagents
+            // share the workspace with the parent everywhere — and awaiting
+            // background teardown here would stall the live call's turn.
+            // This gate already makes voice stricter than that baseline; the
+            // residual is bounded to one in-flight call at barge-over time.
+            if (
+              foregroundToolContendsWithContinuation(toolName, detail?.input)
+            ) {
+              this.abortDetachedRuns({
+                keepPendingResult: true,
+                reason: "foreground_tool_contends",
+                toolName,
+              });
+            }
             // The op counts toward the narration threshold on start (not
             // completion) so a burst of slow tools still trips the ops
             // trigger while they run.
@@ -2975,6 +3700,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
               startedAtMs: Date.now(),
             });
             current.progress.opsSinceNarration += 1;
+            current.progress.stateEpoch += 1;
             log.debug({ turnId, toolName }, "Live voice turn started tool use");
             // Definitive tool use means the turn is guaranteed slow: speak
             // the floor-holding ack now instead of waiting out the
@@ -3008,14 +3734,27 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
                   )
                 : undefined) ??
               findLastIncompleteOp(current.progress.ops, event.toolName);
+            // A long-running op finishing is the beat the user has been
+            // waiting through: it narrates immediately rather than waiting for
+            // `opsThreshold` more ops, which on a one-slow-tool turn never
+            // arrive. Short ops stay on the ops trigger — narrating every
+            // quick lookup is the chatter this cadence exists to avoid.
+            let trigger: "ops" | "op_complete" = "ops";
             if (op) {
               op.completedAtMs = Date.now();
               if (event.isError !== undefined) {
                 op.isError = event.isError;
               }
               op.resultPreview = event.resultPreview;
+              if (
+                op.completedAtMs - op.startedAtMs >=
+                this.frontModelConfig.progress.longOpMs
+              ) {
+                trigger = "op_complete";
+              }
             }
-            this.maybeNarrateProgress(current, "ops");
+            current.progress.stateEpoch += 1;
+            this.maybeNarrateProgress(current, trigger);
           },
         },
         onError: (message) => {
@@ -3056,27 +3795,31 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         } else {
           handle.abort();
         }
-        return;
+        // The bridge ran: the leg's user row was persisted (or explicitly
+        // rolled back by the discard above), so this counts as started even
+        // though a newer turn owns the session.
+        return true;
       }
       if (current.finalized) {
-        this.activeAssistantTurn = null;
-        return;
+        this.clearActiveAssistantTurn(token);
+        return true;
       }
       // The front-door leg may have handed off before its handle resolved;
       // abort it rather than exposing it as the turn's live handle.
       if (leg.frontDoor && current.escalationHandedOff) {
         handle.abort();
-        return;
+        return true;
       }
 
       current.handle = handle;
+      return true;
     } catch (err) {
       if (!this.isActiveAssistantTurn(token)) {
-        return;
+        return false;
       }
 
       this.clearFillerTimers(activeTurn);
-      this.activeAssistantTurn = null;
+      this.clearActiveAssistantTurn(token);
       await this.sendFrame({
         type: "error",
         code: LiveVoiceProtocolErrorCode.InvalidField,
@@ -3086,6 +3829,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       });
       await this.finalizePendingUtterance(utterance, "assistant_start_error");
       this.scheduleRearmAfterTurn();
+      return false;
     }
   }
 
@@ -3271,10 +4015,10 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // the user's ears — not time since launch, so it covers mid-turn silences
   // for the whole turn. On expiry with audio still pending, or with the
   // silence not yet a full interval old, it re-arms for the remainder; only a
-  // full interval of audible silence narrates. The cadence is deliberately
-  // flat and uncapped: long pauses feel longest, so updates keep coming at
-  // the same interval (minGapMs is the spacing floor) for as long as the
-  // turn stays silent.
+  // full interval of audible silence reaches the narration gatekeeper. The
+  // interval is a polling cadence, not a speaking cadence: most ticks find
+  // nothing new to report and stay quiet, so what the user hears follows the
+  // turn's tool activity (with `maxSilenceMs` as the heartbeat ceiling).
   private armProgressIdleTimer(
     turn: ActiveAssistantTurn,
     delayMs?: number,
@@ -3302,16 +4046,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     }, delayMs ?? this.frontModelConfig.progress.idleIntervalMs);
   }
 
-  // Wall-clock instant the current audible silence turns a full interval old:
-  // measured from the latest of the last emitted segment, the estimated
-  // client playback end, and the last enqueued filler.
+  // Wall-clock instant the current audible silence turns a full interval old.
   private progressIdleDeadlineMs(turn: ActiveAssistantTurn): number {
     return (
-      Math.max(
-        turn.progress.lastAudibleAtMs,
-        this.assistantPlaybackTailUntilMs,
-        turn.progress.lastFloorHolderAtMs ?? 0,
-      ) + this.frontModelConfig.progress.idleIntervalMs
+      this.progressSilenceSinceMs(turn) +
+      this.frontModelConfig.progress.idleIntervalMs
+    );
+  }
+
+  // When the turn's current audible silence began: the latest of the last
+  // emitted segment, the estimated client playback end, and the last enqueued
+  // filler.
+  private progressSilenceSinceMs(turn: ActiveAssistantTurn): number {
+    return Math.max(
+      turn.progress.lastAudibleAtMs,
+      this.assistantPlaybackTailUntilMs,
+      turn.progress.lastFloorHolderAtMs ?? 0,
     );
   }
 
@@ -3379,17 +4129,39 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     );
   }
 
+  // The idle tick has something worth saying when the turn's tool activity has
+  // moved since the last narration described it, or when the silence has run
+  // past `maxSilenceMs` — the heartbeat ceiling that proves the assistant is
+  // still alive on a turn with no observable activity at all. Every other tick
+  // stays quiet, so the cadence follows the work rather than the clock.
+  private progressIdleHasSomethingToSay(turn: ActiveAssistantTurn): boolean {
+    const { progress } = turn;
+    if (progress.stateEpoch !== progress.narratedEpoch) {
+      return true;
+    }
+    const silentForMs = Date.now() - this.progressSilenceSinceMs(turn);
+    if (silentForMs >= this.frontModelConfig.progress.maxSilenceMs) {
+      return true;
+    }
+    log.debug(
+      { turnId: turn.turnId, silentForMs },
+      "Live voice progress narration held — nothing new since the last update",
+    );
+    return false;
+  }
+
   // Gatekeeper for spoken progress narration: it speaks only while the turn
   // is audibly silent, spaced `minGapMs` from any spoken floor-holder (ack or
-  // narration), one generation at a time, and — on the ops trigger — only
-  // once `opsThreshold` ops accumulated. No per-turn count cap: the cadence
-  // guards bound the rate, and going quiet deep into a long turn is the
-  // failure mode narration exists to prevent. Every failing guard
-  // short-circuits silently; a skipped ops trigger keeps its accumulated
-  // count, so the next tool event or idle tick retries.
+  // narration), one generation at a time, and — per trigger — only once the
+  // ops trigger has `opsThreshold` ops accumulated or the idle trigger has
+  // something new to report. No per-turn count cap: the cadence guards bound
+  // the rate, and going quiet deep into a long turn is the failure mode
+  // narration exists to prevent. Every failing guard short-circuits silently;
+  // a skipped ops trigger keeps its accumulated count, so the next tool event
+  // or idle tick retries.
   private maybeNarrateProgress(
     turn: ActiveAssistantTurn,
-    trigger: "ops" | "idle",
+    trigger: "ops" | "idle" | "op_complete",
   ): void {
     const cfg = this.frontModelConfig.progress;
     const { progress } = turn;
@@ -3406,7 +4178,8 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       progress.narrationInFlight ||
       (progress.lastFloorHolderAtMs !== null &&
         Date.now() - progress.lastFloorHolderAtMs < cfg.minGapMs) ||
-      (trigger === "ops" && progress.opsSinceNarration < cfg.opsThreshold)
+      (trigger === "ops" && progress.opsSinceNarration < cfg.opsThreshold) ||
+      (trigger === "idle" && !this.progressIdleHasSomethingToSay(turn))
     ) {
       return;
     }
@@ -3418,18 +4191,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   // on the turn's ordered TTS queue. The decider internally bounds the call
   // by `progress.generationTimeoutMs` and resolves null on every failure
   // mode; on null the idle trigger falls back to a static phrase (silence is
-  // actively harmful there) while the ops trigger stays silent — a generic
-  // filler is not worth it when narration was merely opportunistic.
+  // actively harmful there) while the tool-activity triggers stay silent — a
+  // generic filler is not worth it when narration was merely opportunistic.
   private async speakProgressUpdate(
     turn: ActiveAssistantTurn,
     frontDecider: VoiceFrontDecider,
-    trigger: "ops" | "idle",
+    trigger: "ops" | "idle" | "op_complete",
   ): Promise<void> {
     const { progress } = turn;
     progress.narrationInFlight = true;
     // Any delta that lands while the decider call is in flight makes the
     // generated text stale — and proves the model is speaking again.
     const deltaEpochAtLaunch = turn.deltaEpoch;
+    // The activity this update describes. Tool events that land mid-generation
+    // are news the generated text cannot carry, so they must leave the idle
+    // trigger armed rather than count as already narrated.
+    const stateEpochAtLaunch = progress.stateEpoch;
     try {
       const now = Date.now();
       const currentOp = findLastIncompleteOp(progress.ops);
@@ -3469,7 +4246,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       // condition may have flipped while generating, and a delta that landed
       // mid-generation (deltaEpoch moved) makes the text stale even when the
       // resulting audio has already drained by now. The ack-generation and
-      // floor re-checks close the race with a generated ack (llmAckText) that
+      // floor re-checks close the race with a generated ack that
       // STARTED after this generation did — the entry guard rejects a
       // narration while an ack generation is already pending, but cannot see
       // one that begins mid-generation: while that ack is pending it has not
@@ -3489,7 +4266,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       }
       let raw = generated;
       if (raw === null) {
-        if (trigger === "ops") {
+        if (trigger !== "idle") {
           return;
         }
         raw = pickProgressPhrase(this.progressPhraseCounter++);
@@ -3498,6 +4275,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         return;
       }
       progress.opsSinceNarration = 0;
+      progress.narratedEpoch = stateEpochAtLaunch;
       progress.updatesSpoken += 1;
       // Like the ack mark, recorded only when narration audio actually
       // enqueued (decider text or static fallback alike).
@@ -3521,30 +4299,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
     kind: LiveVoiceSpokenAckKind,
     toolName?: string,
   ): void {
-    activeTurn.ackSpoken = true;
-    if (this.frontModelConfig.llmAckText && this.frontDecider) {
-      // Optimistic ackSpoken above keeps the one-per-turn budget honest for
-      // any other ack trigger while the generation is in flight; the async
-      // path undoes it if the ack turns out moot.
-      void this.speakGeneratedAck(
-        activeTurn,
-        this.frontDecider,
-        kind,
-        toolName,
-      );
+    if (!this.frontDecider) {
+      // No decider, no ack: a canned line is worse than the silence, which
+      // progress narration already covers once the turn runs long.
       return;
     }
-    this.enqueueAckPhrase(activeTurn, this.pickStaticAckPhrase(kind), kind);
-  }
-
-  private pickStaticAckPhrase(kind: LiveVoiceSpokenAckKind): string {
-    return pickAckPhrase(kind, this.ackPhraseCounter++);
+    activeTurn.ackSpoken = true;
+    // Optimistic ackSpoken above keeps the one-per-turn budget honest for
+    // any other ack trigger while the generation is in flight; the async
+    // path undoes it if the ack turns out moot.
+    void this.speakGeneratedAck(activeTurn, this.frontDecider, kind, toolName);
   }
 
-  // LLM-phrased ack (liveVoice.frontModel.llmAckText): ask the front model
-  // for one short contextual sentence, static phrase on null. The decider
+  // Ask the front model for one short contextual sentence. The decider
   // internally bounds the call by `ackGenerationTimeoutMs` and resolves null
-  // on every failure mode, so the enqueue never waits beyond that budget.
+  // on every failure mode, so the enqueue never waits beyond that budget; a
+  // null generation speaks nothing.
   private async speakGeneratedAck(
     activeTurn: ActiveAssistantTurn,
     frontDecider: VoiceFrontDecider,
@@ -3567,23 +4337,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
         // The decider contract never rejects; belt-and-braces for a stub.
         .catch(() => null);
       // Liveness re-check after the await: any turnCanSpeakFiller condition
-      // may have flipped while generating, mooting the ack. Undo the
-      // optimistic ackSpoken so the flag reflects reality.
-      if (!this.turnCanSpeakFiller(activeTurn)) {
+      // may have flipped while generating, mooting the ack. A null generation
+      // (no provider, timeout, unusable output) speaks nothing. Either way,
+      // undo the optimistic ackSpoken so the flag reflects reality and a
+      // later trigger this turn can still hold the floor.
+      if (generated === null || !this.turnCanSpeakFiller(activeTurn)) {
         activeTurn.ackSpoken = false;
         return;
       }
-      this.enqueueAckPhrase(
-        activeTurn,
-        generated ?? this.pickStaticAckPhrase(kind),
-        kind,
-      );
+      this.enqueueAckPhrase(activeTurn, generated, kind);
     } finally {
       activeTurn.ackGenerationPending = false;
     }
   }
 
-  // Records the ack-spoken metric only when a phrase actually enqueues.
+  // Records the ack-spoken metric only when a phrase actually enqueues; a
+  // phrase that sanitizes away releases the turn's ack budget again.
   private enqueueAckPhrase(
     activeTurn: ActiveAssistantTurn,
     raw: string,
@@ -3591,7 +4360,9 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
   ): void {
     if (this.enqueueFillerPhrase(activeTurn, raw)) {
       this.markAckSpoken(activeTurn, kind);
+      return;
     }
+    activeTurn.ackSpoken = false;
   }
 
   // Sanitize and enqueue one filler sentence (spoken ack or progress
@@ -3664,10 +4435,22 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
             !this.isClosed,
         );
 
-        if (this.activeAssistantTurn?.token === token) {
-          if (currentTurn.handle && currentTurn.finalized) {
-            this.activeAssistantTurn = null;
-          }
+        // Drain-scoped minimize: the latched marker is consumed here, after
+        // the turn's speech has fully drained — never mid-speech, never for
+        // a barged-in turn, at most once per turn.
+        if (
+          currentTurn.minimizeRequested &&
+          !currentTurn.abortController.signal.aborted
+        ) {
+          currentTurn.minimizeRequested = false;
+          await this.sendFrame(
+            { type: "minimize_room", turnId: currentTurn.turnId },
+            () => !this.isClosed,
+          );
+        }
+
+        if (currentTurn.handle && currentTurn.finalized) {
+          this.clearActiveAssistantTurn(token);
         }
 
         // Re-arm only after the terminal tts_done frame so a slow or failing
@@ -4147,7 +4930,7 @@ export class LiveVoiceSession implements LiveVoiceSessionContract {
       this.activeAssistantTurn?.token === turn.token &&
       turn.handle
     ) {
-      this.activeAssistantTurn = null;
+      this.clearActiveAssistantTurn(turn.token);
     }
 
     if (options.rearm ?? true) {
@@ -4440,21 +5223,70 @@ export function createLiveVoiceSession(
 // the interrupted turn. The fork inherits the conversation's current messages
 // (which include the interrupted turn's completed tool calls after teardown),
 // so it resumes without repeating them. Uses spawnAndAwait (synchronous mode)
-// so the terminal parent-notification is skipped — the continuation stays
-// silent (never spoken unprompted); its final answer is RETURNED so the session
-// can fold it into the next turn the user starts. The `signal` aborts the child
-// on a stop/interrupt (spawnAndAwait then rejects).
-async function defaultSpawnBackgroundContinuation(args: {
+// so the terminal parent-notification is skipped — the run itself says nothing;
+// its final answer is RETURNED so the session decides how it reaches the user.
+// The `signal` aborts the child on a stop/interrupt (spawnAndAwait then
+// rejects).
+//
+// Exported for tests only: every production caller reaches it through the
+// `spawnBackgroundContinuation` option default in `createLiveVoiceSession`.
+export async function defaultSpawnBackgroundContinuation(args: {
   parentConversationId: string;
   objective: string;
   label: string;
   signal: AbortSignal;
 }): Promise<string> {
-  const parentConversation = findConversation(args.parentConversationId);
-  if (!parentConversation) {
-    throw new Error(
-      `Cannot detach interrupted voice turn: conversation ${args.parentConversationId} is not resident.`,
-    );
+  // Trust first, before anything can hydrate: the bridge stamps trust per-turn
+  // and clears it at teardown, which has settled by now — inheriting from the
+  // parent would read the cleared window and run the continuation fail-closed
+  // as `unknown`, denying every consequential tool. Resolve the same guardian
+  // trust the foreground turn ran under and pass it explicitly (resolution
+  // itself stays fail-closed: on a miss the continuation runs as `unknown`,
+  // exactly as an unstamped turn does).
+  const trustContext = await resolveLocalLiveVoiceTrustContext(
+    args.parentConversationId,
+  );
+  // getOrCreateConversation (not a raw registry read): it rebuilds a stale
+  // instance and awaits loadFromDb, so the snapshot below sees the persisted
+  // history. A raw findConversation can return a cold instance whose in-memory
+  // `messages` is empty, which silently forks a continuation with no context.
+  const { getOrCreateConversation } =
+    await import("../daemon/conversation-store.js");
+  const parentConversation = await getOrCreateConversation(
+    args.parentConversationId,
+  );
+  // Hydration runs under the resolved trust: `loadFromDb` filters history by
+  // the instance's own trust class, so a load with no trust context drops
+  // memory blocks and forces the compaction summary to null — the fork would
+  // inherit a lobotomized snapshot. Stamp for the duration of the load and
+  // restore the prior value, the same set-load-restore idiom
+  // `elevatePointerConversationToGuardian` uses to un-filter a cold pointer
+  // turn. The restore matters: the bridge owns this conversation's trust
+  // per-turn and expects the window between turns to be empty.
+  //
+  // `ensureActorScopedHistory` reloads exactly when the resident history was
+  // loaded under a different trust class — covering both the never-loaded cold
+  // instance and the untrusted load `getOrCreateConversation` may have just
+  // run — and no-ops when the history is already guardian-scoped. Without a
+  // guardian to stamp there is nothing to re-scope, so an unhydrated instance
+  // falls back to a plain load; a genuinely new conversation reads zero rows,
+  // harmless.
+  const priorTrustContext = parentConversation.trustContext;
+  if (trustContext) {
+    const stampedTrustContext = { ...trustContext };
+    parentConversation.setTrustContext(stampedTrustContext);
+    try {
+      await parentConversation.ensureActorScopedHistory();
+    } finally {
+      // Only undo the stamp this block installed: the user's next foreground
+      // turn can start during the load and stamp its own trust, and clearing
+      // that would run the live turn fail-closed.
+      if (parentConversation.trustContext === stampedTrustContext) {
+        parentConversation.setTrustContext(priorTrustContext ?? null);
+      }
+    }
+  } else if (parentConversation.getMessages().length === 0) {
+    await parentConversation.loadFromDb();
   }
   return await getSubagentManager().spawnAndAwait(
     {
@@ -4463,18 +5295,35 @@ async function defaultSpawnBackgroundContinuation(args: {
       objective: args.objective,
       fork: true,
       sendResultToUser: false,
-      // Read-only: the continuation runs unattended while the user talks to the
-      // live session, so it must never take an unapproved side effect. Any
-      // side-effecting tool is refused; the continuation surfaces the intended
-      // action for the user to approve on their next turn (via the resurface
-      // context) instead.
-      denySideEffectTools: true,
-      parentMessages: [...parentConversation.messages],
+      // Full subagent abilities: the continuation runs like any other
+      // background subagent, so it can genuinely finish build-shaped work
+      // (JARVIS-1354). Side effects are governed by the standard
+      // non-interactive permission path under the explicit trust context
+      // resolved above — auto-approved up to the background risk threshold,
+      // auto-denied above it — the same policy the foreground voice turn it
+      // continues ran under. Workspace write races with the user's next
+      // foreground turn are prevented by the session's foreground-wins abort
+      // (a side-effecting tool start on a live turn aborts running
+      // continuations; see the tool_use_start handler).
+      ...(trustContext ? { trustContext } : {}),
+      parentMessages: [...parentConversation.getMessages()],
       parentSystemPrompt: parentConversation.getCurrentSystemPrompt(),
     },
-    // No client-facing events: the continuation is silent; its result is folded
-    // into the next user turn as context, never spoken on its own.
-    () => {},
+    // Broadcast subagent events to clients attached to this conversation so
+    // the continuation appears in the UI like any other handoff — a background
+    // run the user cannot see reads as the assistant silently dropping their
+    // work. "Silent" means the RUN makes no sound of its own — its result is
+    // spoken by a session turn, on the session's terms; it was never meant to
+    // mean invisible.
+    //
+    // NOT the conversation's own sender: the voice bridge resets that to a
+    // no-op at turn teardown (see voice-session-bridge's clientCallbackInstalled
+    // reset), and the detach deliberately waits for that teardown before
+    // spawning — so a sender-based route is guaranteed to be dead by the time
+    // these events fire. `broadcastMessage` is the same path the bridge itself
+    // uses to reach an attached web client. The subagent events carry
+    // `parentConversationId`, not `conversationId`, so scope explicitly.
+    (msg) => broadcastMessage(msg, args.parentConversationId),
     { signal: args.signal },
   );
 }