@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/calls/call-controller.ts

@@ -31,7 +31,10 @@ import {
   getSilenceTimeoutMs,
   getUserConsultationTimeoutMs,
 } from "./call-constants.js";
-import { addPointerMessage, formatDuration } from "./call-pointer-messages.js";
+import {
+  formatDuration,
+  postPointerMessageSafe,
+} from "./call-pointer-messages.js";
 import {
   fireCallQuestionNotifier,
   fireCallTranscriptNotifier,
@@ -239,7 +242,7 @@ export class CallController {
   }
 
   /**
-   * Handle a final caller utterance from the ConversationRelay.
+   * Handle a final caller utterance from the call transport.
    * Caller utterances always trigger normal turns, even when a guardian
    * consultation is pending — the consultation is tracked separately.
    */
@@ -361,10 +364,15 @@ export class CallController {
    * interruption on initial inbound media frames that arrive before
    * the assistant has had a chance to produce its first response.
    *
+   * @param onAccepted Invoked synchronously after the speaking gate
+   *   passes but before {@link handleInterrupt} runs. Transports use this
+   *   to flush queued outbound audio without wiping the end-of-turn mark
+   *   that handleInterrupt enqueues — and without flushing at all when
+   *   the barge-in is ignored.
    * @returns `true` if the barge-in was accepted (assistant was speaking),
    *   `false` if it was ignored (assistant idle or processing).
    */
-  handleBargeIn(): boolean {
+  handleBargeIn(onAccepted?: () => void): boolean {
     if (this.state !== "speaking") {
       log.debug(
         {
@@ -380,6 +388,7 @@ export class CallController {
       { callSessionId: this.callSessionId },
       "Barge-in accepted — interrupting assistant speech",
     );
+    onAccepted?.();
     this.handleInterrupt();
     return true;
   }
@@ -395,11 +404,6 @@ export class CallController {
     const wasSpeaking = this.state === "speaking";
     this.abortCurrentTurn();
     this.llmRunVersion++;
-    // Cancel in-flight synthesized TTS on barge-in
-    if (this.activeSynthesisAbort) {
-      this.activeSynthesisAbort.abort();
-      this.activeSynthesisAbort = null;
-    }
     // Explicitly terminate the in-progress TTS turn so the relay can
     // immediately hand control back to the caller after barge-in.
     if (wasSpeaking) {
@@ -483,6 +487,16 @@ export class CallController {
     }
     this.abortController.abort();
     this.abortController = new AbortController();
+    // Abort any in-flight synthesized-TTS playback too, so a superseded or
+    // torn-down turn's audio isn't streamed to the caller after they move on.
+    if (this.activeSynthesisAbort) {
+      this.activeSynthesisAbort.abort();
+      this.activeSynthesisAbort = null;
+    }
+    // Drop the aborted turn's unsent buffered text on transports that
+    // accumulate tokens (media-stream), so it cannot leak into the next
+    // turn's synthesis.
+    this.transport.discardPendingText?.();
   }
 
   private formatCallerUtterance(
@@ -523,7 +537,10 @@ export class CallController {
     }
 
     try {
-      this.state = "speaking";
+      // Stay in `processing` through the lock-wait and LLM generation; flip to
+      // `speaking` only when real outbound audio/tokens start (see
+      // beginSpeaking). This keeps barge-in from aborting a silent turn.
+      this.state = "processing";
 
       const fullResponseText = await this.streamTtsTokens(
         content,
@@ -561,6 +578,21 @@ export class CallController {
         );
         return;
       }
+      if (this.isLockContentionError(err) && this.isCurrentRun(runVersion)) {
+        log.debug(
+          { callSessionId: this.callSessionId },
+          "Prior voice turn wedged past lock-hold budget; re-prompting caller",
+        );
+        // Reaching here means the prior turn is genuinely wedged past the full
+        // lock-hold wait budget, so surface a brief natural re-prompt (never a
+        // technical-error message) and re-arm listening. last=true doubles as
+        // the end-of-turn marker.
+        this.transport.sendTextToken("Sorry, could you say that again?", true);
+        this.state = "idle";
+        this.resetSilenceTimer();
+        this.flushPendingInstructions();
+        return;
+      }
       log.error({ err, callSessionId: this.callSessionId }, "Voice turn error");
       this.transport.sendTextToken(
         "I'm sorry, I encountered a technical issue. Could you repeat that?",
@@ -586,13 +618,14 @@ export class CallController {
     // The catalog's callMode determines the call path: synthesized-play
     // providers buffer text, synthesize via provider API, and stream
     // audio chunks to Twilio via play-URL. Native-twilio providers
-    // stream text tokens to the relay for Twilio's built-in TTS.
+    // stream text tokens through the transport, which re-synthesizes
+    // them via daemon TTS on media-stream.
     //
     // When the transport requires WAV (media-stream), request WAV so
     // the audio store entry and any downstream fetch/transcode receives
     // PCM that audioBufferToFrames can convert to mu-law.
     const { provider, useSynthesizedPath, audioFormat } =
-      resolveCallTtsProvider({
+      await resolveCallTtsProvider({
         preferWav: this.transport.requiresWavAudio,
       });
 
@@ -613,6 +646,7 @@ export class CallController {
       if (useSynthesizedPath) {
         synthesizedTextBuffer += cleaned;
       } else {
+        this.beginSpeakingOnAudioStart(runVersion);
         this.transport.sendTextToken(cleaned, false);
       }
     };
@@ -732,6 +766,10 @@ export class CallController {
     const sanitizedSynthText = sanitizeForTts(synthesizedTextBuffer.trim());
     if (useSynthesizedPath && provider && sanitizedSynthText.length > 0) {
       if (!this.isCurrentRun(runVersion)) return fullResponseText;
+      // Do NOT flip to `speaking` here — provider synthesis latency (or the
+      // no-audio fallback window) would still be silent. The transition happens
+      // inside synthesizeAndStreamAudio when the play URL / first audio chunk
+      // (or native fallback token) is actually emitted.
       await this.synthesizeAndStreamAudio(
         provider,
         sanitizedSynthText,
@@ -740,12 +778,18 @@ export class CallController {
       );
     }
 
+    // Synthesized playback (and its native fallback) can await provider
+    // latency; re-check the run wasn't superseded meanwhile so a stale turn
+    // doesn't inject its end-of-turn marker (or fallback text) into the next
+    // turn's output stream.
+    if (!this.isCurrentRun(runVersion)) return fullResponseText;
+
     // Signal end of this turn's speech.  An empty token with `last: true`
-    // tells ConversationRelay to start listening — it does NOT trigger TTS
+    // tells the transport to start listening — it does NOT trigger TTS
     // synthesis.  This is required even when a synthesized provider handled
-    // all audio playback, because ConversationRelay still needs the
-    // end-of-turn signal to transition from "assistant speaking" to
-    // "caller speaking" state.
+    // all audio playback, because the transport still needs the end-of-turn
+    // signal to transition from "assistant speaking" to "caller speaking"
+    // state.
     this.transport.sendTextToken("", true);
 
     // Mark the greeting's first response as awaiting ack
@@ -764,7 +808,7 @@ export class CallController {
   private async synthesizeAndStreamAudio(
     provider: TtsProvider,
     text: string,
-    _runVersion: number,
+    runVersion: number,
     format: "mp3" | "wav" | "opus" = "mp3",
   ): Promise<void> {
     let handle: ReturnType<typeof createStreamingEntry> | null = null;
@@ -788,6 +832,14 @@ export class CallController {
       const url = `${baseUrl}/v1/audio/${handle.audioId}`;
       const sendPlayUrlOnce = (): void => {
         if (playUrlSent) return;
+        // Superseded/aborted while synthesis was pending — don't start playing
+        // a stale response after the caller has already moved on.
+        if (!this.isCurrentRun(runVersion)) return;
+        // Audio is now reaching the caller (or, on transports with an
+        // audio-start signal, will be the moment the first fetched frame
+        // goes out) — flip to `speaking` so barge-in can interrupt (it
+        // stays `processing` until this point).
+        this.beginSpeakingOnAudioStart(runVersion);
         this.transport.sendPlayUrl(url);
         playUrlSent = true;
       };
@@ -870,11 +922,18 @@ export class CallController {
           { err, provider: provider.id, errName, errCode },
           "TTS synthesis failed — falling back to native token TTS",
         );
-        // If synthesis fails before any audio has started, degrade to
-        // token-based speech on ConversationRelay so the caller still
+        // If synthesis fails before any audio has started on a non-WAV
+        // transport, degrade to token-based speech so the caller still
         // hears a response instead of silence. This fallback is only
         // used for providers whose catalog entry allows native fallback.
-        if (!playUrlSent && !this.transport.requiresWavAudio) {
+        // Skip it entirely for a superseded run so a stale response can't
+        // leak into the next caller turn.
+        if (
+          !playUrlSent &&
+          !this.transport.requiresWavAudio &&
+          this.isCurrentRun(runVersion)
+        ) {
+          this.beginSpeakingOnAudioStart(runVersion);
           this.transport.sendTextToken(text, false);
         }
       }
@@ -1196,22 +1255,14 @@ export class CallController {
       const durationMs = currentSession.startedAt
         ? Date.now() - currentSession.startedAt
         : 0;
-      addPointerMessage(
+      postPointerMessageSafe(
         currentSession.initiatedFromConversationId,
         "completed",
         currentSession.toNumber,
         {
           duration: durationMs > 0 ? formatDuration(durationMs) : undefined,
         },
-      ).catch((err) => {
-        log.warn(
-          {
-            conversationId: currentSession.initiatedFromConversationId,
-            err,
-          },
-          "Skipping pointer write — origin conversation may no longer exist",
-        );
-      });
+      );
     }
     this.state = "idle";
   }
@@ -1221,6 +1272,54 @@ export class CallController {
     return err.name === "AbortError" || err.name === "APIUserAbortError";
   }
 
+  /**
+   * Transient teardown race: a new voice turn reached the session bridge
+   * before the previous turn released the conversation processing lock.
+   * This is not a real error and must never be spoken to the caller.
+   */
+  private isLockContentionError(err: unknown): boolean {
+    return (
+      err instanceof Error &&
+      err.message.includes("already processing a message")
+    );
+  }
+
+  /**
+   * Flip from the pre-speech `processing` phase to `speaking` at the moment the
+   * first real outbound audio/token is emitted. Guarded so a superseded or
+   * aborted (idle) turn never (re)enters `speaking`, and so barge-in
+   * (handleBargeIn, gated on `speaking`) can't abort a turn that is still
+   * waiting for the processing lock or generating with no audio yet.
+   */
+  private beginSpeaking(runVersion: number): void {
+    if (!this.isCurrentRun(runVersion)) return;
+    if (this.state === "processing") {
+      this.state = "speaking";
+    }
+  }
+
+  /**
+   * Flip to `speaking` when outbound audio genuinely starts.
+   *
+   * Transports that buffer text and synthesize asynchronously (e.g.
+   * media-stream) expose an audio-start signal; on those, the flip is
+   * deferred until the transport reports the first audio frame actually
+   * went out — otherwise a turn whose tokens are merely buffered (no
+   * audible output yet) would be barge-in-abortable, leaving the caller
+   * with silence. Transports without the signal emit audio immediately,
+   * so the flip happens inline. Both paths stay gated by isCurrentRun
+   * via {@link beginSpeaking}.
+   */
+  private beginSpeakingOnAudioStart(runVersion: number): void {
+    if (this.transport.setAudioStartCallback) {
+      this.transport.setAudioStartCallback(() =>
+        this.beginSpeaking(runVersion),
+      );
+    } else {
+      this.beginSpeaking(runVersion);
+    }
+  }
+
   private isCurrentRun(runVersion: number): boolean {
     return runVersion === this.llmRunVersion;
   }
@@ -1456,22 +1555,14 @@ export class CallController {
           const durationMs = currentSession.startedAt
             ? Date.now() - currentSession.startedAt
             : 0;
-          addPointerMessage(
+          postPointerMessageSafe(
             currentSession.initiatedFromConversationId,
             "completed",
             currentSession.toNumber,
             {
               duration: durationMs > 0 ? formatDuration(durationMs) : undefined,
             },
-          ).catch((err) => {
-            log.warn(
-              {
-                conversationId: currentSession.initiatedFromConversationId,
-                err,
-              },
-              "Skipping pointer write — origin conversation may no longer exist",
-            );
-          });
+          );
         }
       }, 3000);
     }, maxDurationMs);
@@ -1481,15 +1572,10 @@ export class CallController {
     if (this.silenceTimer) clearTimeout(this.silenceTimer);
     if (this.destroyed) return;
     this.silenceTimer = setTimeout(() => {
-      // During guardian wait states, the relay heartbeat timer handles
-      // periodic updates — suppress the generic "Are you still there?"
-      // which is confusing when the caller is waiting on a decision.
-      // Two paths: in-call consultation (pendingGuardianInput) and
-      // inbound access-request wait (relay state).
-      if (
-        this.pendingGuardianInput ||
-        this.transport.getConnectionState() === "awaiting_guardian_decision"
-      ) {
+      // During an in-call guardian consultation, suppress the generic
+      // "Are you still there?" — it is confusing when the caller is
+      // waiting on a decision.
+      if (this.pendingGuardianInput) {
         log.debug(
           { callSessionId: this.callSessionId },
           "Silence timeout suppressed during guardian wait",

package/src/calls/call-domain.ts

@@ -25,7 +25,7 @@ import { getSecureKeyAsync } from "../security/secure-keys.js";
 import { getLogger } from "../util/logger.js";
 import { upsertActiveCallLease } from "./active-call-lease.js";
 import { isDeniedNumber } from "./call-constants.js";
-import { addPointerMessage } from "./call-pointer-messages.js";
+import { postPointerMessageSafe } from "./call-pointer-messages.js";
 import { getCallController, unregisterCallController } from "./call-state.js";
 import { isTerminalState } from "./call-state-machine.js";
 import {
@@ -39,9 +39,8 @@ import {
   updateCallSession,
 } from "./call-store.js";
 import { activeMediaStreamSessions } from "./media-stream-server.js";
-import { activeRelayConnections } from "./relay-server.js";
 import { getTwilioConfig } from "./twilio-config.js";
-import { TwilioConversationRelayProvider } from "./twilio-provider.js";
+import { TwilioVoiceProvider } from "./twilio-provider.js";
 import type { CallSession } from "./types.js";
 import { preflightVoiceIngress } from "./voice-ingress-preflight.js";
 
@@ -49,21 +48,6 @@ const log = getLogger("call-domain");
 
 const E164_REGEX = /^\+\d+$/;
 
-function postFailedCallPointer(
-  conversationId: string,
-  phoneNumber: string,
-  reason: string,
-): void {
-  addPointerMessage(conversationId, "failed", phoneNumber, {
-    reason,
-  }).catch((pointerErr) => {
-    log.warn(
-      { conversationId, err: pointerErr },
-      "Failed to post call-failed pointer message",
-    );
-  });
-}
-
 // ── Result types ─────────────────────────────────────────────────────
 
 interface StartCallResult {
@@ -228,7 +212,7 @@ export async function resolveCallerIdentity(
   }
 
   // Verify the user number is eligible as a caller ID with Twilio
-  const provider = new TwilioConversationRelayProvider();
+  const provider = new TwilioVoiceProvider();
   const eligibility = await provider.checkCallerIdEligibility(userNumber);
   if (!eligibility.eligible) {
     log.warn(
@@ -428,12 +412,14 @@ export async function startCall(
 
     const preflightResult = await preflightVoiceIngress();
     if (!preflightResult.ok) {
-      postFailedCallPointer(conversationId, phoneNumber, preflightResult.error);
+      postPointerMessageSafe(conversationId, "failed", phoneNumber, {
+        reason: preflightResult.error,
+      });
       return preflightResult;
     }
 
     const ingressConfig = preflightResult.ingressConfig;
-    const provider = new TwilioConversationRelayProvider();
+    const provider = new TwilioVoiceProvider();
 
     const session = createCallSession({
       conversationId,
@@ -531,12 +517,7 @@ export async function startCall(
     );
 
     // Post a concise pointer message in the initiating conversation
-    addPointerMessage(conversationId, "started", phoneNumber).catch((err) => {
-      log.warn(
-        { conversationId, err },
-        "Failed to post call-started pointer message",
-      );
-    });
+    postPointerMessageSafe(conversationId, "started", phoneNumber);
 
     return {
       ok: true,
@@ -569,7 +550,9 @@ export async function startCall(
       });
     }
 
-    postFailedCallPointer(conversationId, phoneNumber, msg);
+    postPointerMessageSafe(conversationId, "failed", phoneNumber, {
+      reason: msg,
+    });
 
     return { ok: false, error: `Error initiating call: ${msg}`, status: 500 };
   }
@@ -662,7 +645,7 @@ export async function cancelCall(
   // Terminate the call via the provider API
   if (session.providerCallSid) {
     try {
-      const provider = new TwilioConversationRelayProvider();
+      const provider = new TwilioVoiceProvider();
       await provider.endCall(session.providerCallSid);
     } catch (endErr) {
       log.warn(
@@ -672,14 +655,6 @@ export async function cancelCall(
     }
   }
 
-  // End the relay connection if active
-  const relayConnection = activeRelayConnections.get(callSessionId);
-  if (relayConnection) {
-    relayConnection.endSession(reason);
-    relayConnection.destroy();
-    activeRelayConnections.delete(callSessionId);
-  }
-
   // End the media-stream session if active
   const mediaStreamSession = activeMediaStreamSessions.get(callSessionId);
   if (mediaStreamSession) {
@@ -914,7 +889,8 @@ type StartVerificationCallResult =
  *
  * Creates a minimal call session with a voice channel binding and
  * passes `verificationSessionId` as a custom parameter so the
- * relay server can detect this is a guardian verification call.
+ * media-stream server's `routeSetup` can detect this is a guardian
+ * verification call.
  */
 export async function startVerificationCall(
   input: StartVerificationCallInput,
@@ -933,7 +909,7 @@ export async function startVerificationCall(
 
   try {
     const config = loadConfig();
-    const provider = new TwilioConversationRelayProvider();
+    const provider = new TwilioVoiceProvider();
 
     // Resolve the assistant's Twilio number as the caller ID
     const identityResult = await resolveCallerIdentity(config);
@@ -1045,8 +1021,8 @@ type StartInviteCallResult = { ok: true; callSid: string } | CallError;
  * Initiate an outbound call to deliver a voice invite to a contact.
  *
  * Creates a minimal call session with a voice channel binding and
- * passes invite-specific custom parameters so the relay server can
- * detect this is an invite redemption call.
+ * passes invite-specific custom parameters so the media-stream
+ * server's `routeSetup` can detect this is an invite redemption call.
  */
 export async function startInviteCall(
   input: StartInviteCallInput,
@@ -1065,7 +1041,7 @@ export async function startInviteCall(
 
   try {
     const config = loadConfig();
-    const provider = new TwilioConversationRelayProvider();
+    const provider = new TwilioVoiceProvider();
 
     // Resolve the assistant's Twilio number as the caller ID
     const identityResult = await resolveCallerIdentity(config);

package/src/calls/call-pointer-messages.ts

@@ -3,17 +3,21 @@
  * so the user sees call lifecycle events without the full transcript
  * (which lives in the dedicated voice conversation).
  *
- * Trust-aware: trusted audiences get pointer messages routed through the
- * daemon conversation as a conversation turn (the assistant generates the text).
- * Untrusted/unknown audiences always receive deterministic fallback text
- * written directly to the conversation store.
+ * Trust-aware: the owner's own conversations get pointer messages routed through
+ * the daemon conversation as an owner self-maintenance turn (the assistant
+ * generates the text). Contact and unknown audiences always receive
+ * deterministic fallback text written directly to the conversation store, so a
+ * guardian-elevated turn never rehydrates private history into a non-owner
+ * conversation.
  */
 
+import { runPointerMessageTurn } from "../daemon/pointer-turn-runner.js";
 import {
   addMessage,
   getConversationOriginChannel,
   getConversationRecentProvenanceTrustClass,
 } from "../persistence/conversation-crud.js";
+import { isContactTrustClass } from "../runtime/trust-class.js";
 import { getLogger } from "../util/logger.js";
 import {
   buildPointerInstruction,
@@ -32,77 +36,39 @@ type PointerEvent =
 
 type PointerAudienceMode = "auto" | "trusted" | "untrusted";
 
-/**
- * Daemon-injected function that sends a message through the daemon conversation
- * pipeline (persistAndProcessMessage), letting the assistant generate the
- * pointer text as a natural conversation turn.
- *
- * @param requiredFacts - facts that must appear verbatim in the generated
- *   text (phone number, duration, outcome keyword, etc.). The processor
- *   should validate the output and throw if any are missing so the
- *   deterministic fallback fires.
- */
-type PointerMessageProcessor = (
-  conversationId: string,
-  instruction: string,
-  requiredFacts?: string[],
-) => Promise<void>;
-
-// ---------------------------------------------------------------------------
-// Module-level processor injection (set by daemon lifecycle at startup)
-// ---------------------------------------------------------------------------
-
-let pointerMessageProcessor: PointerMessageProcessor | undefined;
-
-/**
- * Inject the daemon-provided pointer message processor.
- * Called from daemon/lifecycle.ts at startup, following the same pattern
- * as setRelayBroadcast.
- */
-export function setPointerMessageProcessor(
-  processor: PointerMessageProcessor,
-): void {
-  pointerMessageProcessor = processor;
-}
-
-/** @internal Reset for tests. */
-export function resetPointerMessageProcessor(): void {
-  pointerMessageProcessor = undefined;
-}
-
 // ---------------------------------------------------------------------------
 // Trust resolution
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve whether the audience for a pointer message is trusted.
+ * Resolve whether the pointer audience is the assistant's owner (guardian)
+ * rather than a contact or unknown caller.
  *
- * Trusted when:
- * - recent message provenance trust class is 'guardian', 'trusted_contact',
- *   or 'unverified_contact'
- * - conversation origin channel is 'vellum' (desktop app)
+ * Owner when:
+ * - recent message provenance trust class is 'guardian', or
+ * - conversation origin channel is 'vellum' (desktop app).
  *
- * Untrusted by default when insufficient evidence.
+ * Known non-guardian contacts ('trusted_contact' / 'unverified_contact') and
+ * unknown callers are NOT the owner: routing their pointer status through the
+ * daemon turn would run it under the internal guardian context, rehydrating
+ * guardian-only history that then leaks into the contact's own conversation.
+ * They take the deterministic fallback instead. Defaults to non-owner when
+ * evidence is insufficient.
  */
-function resolvePointerAudienceTrust(conversationId: string): boolean {
+function resolvePointerAudienceIsOwner(conversationId: string): boolean {
   try {
-    // Check provenance trust class on recent messages first — this catches
-    // identity-known non-guardian contacts (trusted and unverified) who
-    // initiate calls from gateway channels (e.g. WhatsApp) where the
-    // conversation itself isn't desktop-origin.
+    // Provenance is read from persisted message metadata, so it survives
+    // conversation eviction — a known contact is diverted to the deterministic
+    // fallback even on a cold load where the in-memory trust context is absent.
     const provenance =
       getConversationRecentProvenanceTrustClass(conversationId);
-    if (
-      provenance === "guardian" ||
-      provenance === "trusted_contact" ||
-      provenance === "unverified_contact"
-    )
-      return true;
+    if (isContactTrustClass(provenance)) return false;
+    if (provenance === "guardian") return true;
 
     const originChannel = getConversationOriginChannel(conversationId);
     if (originChannel === "vellum") return true;
   } catch {
-    // Conversation may not exist or DB may be unavailable — default untrusted.
+    // Conversation may not exist or DB may be unavailable — default to non-owner.
   }
 
   return false;
@@ -153,17 +119,17 @@ export async function addPointerMessage(
   const outcomeKeyword = eventOutcomeKeywords[event];
   if (outcomeKeyword) requiredFacts.push(outcomeKeyword);
 
-  const trustedAudience =
+  const ownerAudience =
     audienceMode === "trusted" ||
-    (audienceMode === "auto" && resolvePointerAudienceTrust(conversationId));
+    (audienceMode === "auto" && resolvePointerAudienceIsOwner(conversationId));
 
-  if (trustedAudience && pointerMessageProcessor) {
+  if (ownerAudience) {
     // Route through the daemon conversation — the assistant generates the
-    // pointer text as a natural conversation turn, shaped by context,
+    // pointer text as a natural owner self-maintenance turn, shaped by context,
     // identity, and preferences.
     const instruction = buildPointerInstruction(context);
     try {
-      await pointerMessageProcessor(conversationId, instruction, requiredFacts);
+      await runPointerMessageTurn(conversationId, instruction, requiredFacts);
       return;
     } catch (err) {
       log.warn(
@@ -171,10 +137,10 @@ export async function addPointerMessage(
         "Daemon pointer processing failed, falling back to deterministic",
       );
     }
-  } else if (!trustedAudience && pointerMessageProcessor) {
+  } else {
     log.debug(
       { event, conversationId },
-      "Untrusted audience — using deterministic pointer copy",
+      "Non-owner audience — using deterministic pointer copy",
     );
   }
 
@@ -194,6 +160,24 @@ export async function addPointerMessage(
   );
 }
 
+/**
+ * Fire-and-forget pointer write that tolerates an evicted origin
+ * conversation: failures are logged at warn level and swallowed.
+ */
+export function postPointerMessageSafe(
+  conversationId: string,
+  event: PointerEvent,
+  phoneNumber: string,
+  extra?: Parameters<typeof addPointerMessage>[3],
+): void {
+  addPointerMessage(conversationId, event, phoneNumber, extra).catch((err) => {
+    log.warn(
+      { conversationId, err },
+      "Skipping pointer write — origin conversation may no longer exist",
+    );
+  });
+}
+
 /**
  * Format a duration in milliseconds into a human-friendly string.
  */