@vellumai/assistant 0.11.1 → 0.11.2-staging.2

package/src/daemon/conversation-error.ts

@@ -12,9 +12,11 @@ import {
   isImageUnprocessableError,
 } from "../plugins/defaults/image-recovery/detect.js";
 import { ConnectionResolutionError } from "../providers/connection-resolution.js";
+import { PROVIDER_CATALOG } from "../providers/model-catalog.js";
 import { getProviderRoutingSource } from "../providers/registry.js";
 import { isAbortReason } from "../util/abort-reasons.js";
 import {
+  type ProviderCredentialSource,
   ProviderError,
   type ProviderErrorReason,
   ProviderNotConfiguredError,
@@ -63,6 +65,14 @@ export interface ClassifiedConversationError {
 export interface ConversationErrorAttribution {
   connectionName?: string;
   profileName?: string;
+  /** Whether the resolved turn route uses Vellum-managed inference. */
+  isManagedRoute?: boolean;
+  /**
+   * Which credential the failed request presented. Splits the non-managed side
+   * of `isManagedRoute` into personal keys, subscription logins, and keyless
+   * endpoints so rejection copy names the right thing to fix.
+   */
+  credentialSource?: ProviderCredentialSource;
 }
 
 // Network-level error patterns (connection refused, timeout, DNS, reset)
@@ -181,6 +191,11 @@ export interface ErrorContext {
    * underlying connection name is generic.
    */
   profileName?: string;
+  /**
+   * Whether the resolved turn route uses Vellum-managed inference. Turn routing
+   * takes precedence over the provider registry's boot-time default.
+   */
+  isManagedRoute?: boolean;
 }
 
 /**
@@ -253,9 +268,22 @@ export function classifyConversationError(
   // credential-related classifications can name the exact slot to fix.
   // A `ProviderNotConfiguredError` instance carries its own attribution
   // (from the throw site) which takes priority over context when present.
+  // The failed call's own route wins field by field — it is resolved at
+  // dispatch, while context describes the turn and can be stale for this
+  // call. Per-field, so a route carrying only some fields doesn't blank the
+  // rest.
+  const providerRoute =
+    error instanceof ProviderError ? error.routeAttribution : undefined;
+  const connectionName = providerRoute?.connectionName ?? ctx.connectionName;
+  const profileName = providerRoute?.profileName ?? ctx.profileName;
+  const isManagedRoute = providerRoute?.isManagedRoute ?? ctx.isManagedRoute;
   const attribution: ConversationErrorAttribution = {
-    ...(ctx.connectionName ? { connectionName: ctx.connectionName } : {}),
-    ...(ctx.profileName ? { profileName: ctx.profileName } : {}),
+    ...(connectionName ? { connectionName } : {}),
+    ...(profileName ? { profileName } : {}),
+    ...(isManagedRoute !== undefined ? { isManagedRoute } : {}),
+    ...(providerRoute?.credentialSource
+      ? { credentialSource: providerRoute.credentialSource }
+      : {}),
   };
 
   // Dedicated classification for missing provider API key
@@ -354,15 +382,28 @@ function classifyCore(
   message: string,
   attribution: ConversationErrorAttribution = {},
 ): Omit<ClassifiedConversationError, "debugDetails"> {
+  const isManagedRoute =
+    error instanceof ProviderError &&
+    (attribution.isManagedRoute ??
+      getProviderRoutingSource(error.provider) === "managed-proxy");
+  // Which credential the request actually presented. Only rejection copy needs
+  // this finer axis; every other branch keys off `isManagedRoute`. Routes that
+  // predate per-request stamping collapse to the managed/personal split.
+  const credentialSource: ProviderCredentialSource =
+    attribution.credentialSource ??
+    (isManagedRoute ? "vellum-managed" : "byok");
+
   // Prefer the semantic reason stamped by the provider layer, regardless of
   // HTTP status — statusless errors (e.g. SDK streaming failures) still carry a
   // reason. Reasons that map cleanly win here; `bad_request`/`unknown` (and a
   // reason-less error) fall through to the status switch + regex battery below.
   if (error instanceof ProviderError && error.reason) {
     const c = reasonToClassification(error.reason, {
-      routingSource: getProviderRoutingSource(error.provider),
+      isManagedRoute,
+      credentialSource,
       attribution,
       message,
+      providerName: error.provider,
     });
     if (c) {
       return c;
@@ -376,26 +417,24 @@ function classifyCore(
       return contextTooLargeClassification();
     }
     if (error.statusCode === 401 || error.statusCode === 403) {
-      // Both managed-proxy and user-key 401/403s reach this branch.
-      // Managed-proxy routes through the assistant API key; if that
-      // credential is stale, the user cannot fix it from model settings.
-      // Everything else is a user-set credential that the upstream provider
-      // rejected, so emit `PROVIDER_INVALID_KEY` and let the chat banner point
-      // at Settings.
-      const providerName = error.provider;
-      if (getProviderRoutingSource(providerName) === "managed-proxy") {
-        return managedKeyInvalidClassification();
-      }
-      return invalidApiKeyClassification(attribution);
+      // Managed routes through the assistant API key; if that credential is
+      // stale, the user cannot fix it from model settings. Everything else is
+      // a credential the user owns, so the copy names which one to update and
+      // the chat banner points at Settings.
+      return rejectedCredentialClassification(
+        error.provider,
+        credentialSource,
+        attribution,
+      );
     }
     if (error.statusCode === 402) {
-      if (isManagedBalanceError(error)) {
+      if (isManagedRoute) {
         return managedBalanceClassification();
       }
       return providerBillingClassification();
     }
     if (error.statusCode === 429) {
-      if (isManagedUsageLimitError(error, message)) {
+      if (isManagedUsageLimitError(message, isManagedRoute)) {
         return managedUsageLimitClassification();
       }
       return rateLimitClassification();
@@ -452,7 +491,11 @@ function classifyCore(
         // Mirror the 401/403 branch: a credential-shaped 4xx is an
         // "invalid key" surface (banner: "Invalid API key"), distinct
         // from "no key configured" (banner: "API key required").
-        return invalidApiKeyClassification(attribution);
+        return rejectedCredentialClassification(
+          error.provider,
+          credentialSource,
+          attribution,
+        );
       }
       if (isImageDimensionsTooLargeError(message)) {
         return {
@@ -508,7 +551,7 @@ function classifyCore(
   }
 
   // Regex fallback for non-ProviderError or ProviderError without statusCode
-  return classifyByMessage(error, message);
+  return classifyByMessage(message, isManagedRoute);
 }
 
 /**
@@ -540,17 +583,21 @@ function extractProviderDetail(message: string): string | undefined {
 function reasonToClassification(
   reason: ProviderErrorReason,
   args: {
-    routingSource?: string;
+    isManagedRoute: boolean;
+    credentialSource: ProviderCredentialSource;
     attribution?: ConversationErrorAttribution;
     message: string;
+    providerName: string;
   },
 ): Omit<ClassifiedConversationError, "debugDetails"> | null {
-  const managed = args.routingSource === "managed-proxy";
+  const managed = args.isManagedRoute;
   switch (reason) {
     case "invalid_credentials":
-      return managed
-        ? managedKeyInvalidClassification()
-        : invalidApiKeyClassification(args.attribution);
+      return rejectedCredentialClassification(
+        args.providerName,
+        args.credentialSource,
+        args.attribution,
+      );
     case "rate_limited":
       // Match managed usage-limit body patterns, as the legacy path does.
       if (
@@ -670,18 +717,13 @@ function isStreamingError(message: string): boolean {
   return STREAMING_ERROR_PATTERNS.some((p) => p.test(message));
 }
 
-function isManagedUsageLimitError(error: unknown, message: string): boolean {
-  if (
-    error instanceof ProviderError &&
-    getProviderRoutingSource(error.provider) === "managed-proxy"
-  ) {
-    return true;
-  }
-  return MANAGED_USAGE_LIMIT_PATTERNS.some((p) => p.test(message));
-}
-
-function isManagedBalanceError(error: ProviderError): boolean {
-  return getProviderRoutingSource(error.provider) === "managed-proxy";
+function isManagedUsageLimitError(
+  message: string,
+  isManagedRoute: boolean,
+): boolean {
+  return (
+    isManagedRoute || MANAGED_USAGE_LIMIT_PATTERNS.some((p) => p.test(message))
+  );
 }
 
 function isProviderBillingError(message: string): boolean {
@@ -694,8 +736,14 @@ function managedBalanceClassification(): Omit<
 > {
   return {
     code: "PROVIDER_BILLING",
+    // This classification feeds two surfaces with different semantics: the
+    // terminal provider-error path (the turn ends with no reply) and the
+    // non-terminal memory-v3 degraded notice (a normal reply still follows).
+    // Keep the wording context-neutral so it is true in both places; the
+    // terminal persist site in conversation-agent-loop.ts swaps in
+    // assistant-voice copy for the synthetic assistant row.
     userMessage:
-      "You've run out of credits. Add funds to continue using the assistant.",
+      "You're out of credits. Add credits in Settings → Billing to continue.",
     retryable: false,
     errorCategory: "credits_exhausted",
   };
@@ -756,13 +804,21 @@ function managedUsageLimitClassification(): Omit<
   };
 }
 
+/**
+ * Deliberately instruction-free. The assistant API key is provisioned and
+ * pushed by the platform — the assistant only ever reads it — so there is no
+ * Settings affordance to re-provision it and no user action that would help.
+ * The copy's job is to rule out the user's own provider key as the cause;
+ * clients that can offer a real next step attach one (web renders Doctor).
+ */
 function managedKeyInvalidClassification(): Omit<
   ClassifiedConversationError,
   "debugDetails"
 > {
   return {
     code: "MANAGED_KEY_INVALID",
-    userMessage: "Couldn't refresh assistant credentials.",
+    userMessage:
+      "Vellum's managed inference credential was rejected. This isn't a personal provider API key — Vellum provisions this one, so there's nothing to update in Settings.",
     retryable: false,
     errorCategory: "managed_key_invalid",
   };
@@ -845,6 +901,76 @@ function describeAttribution(
   return "";
 }
 
+function providerDisplayName(providerName: string): string {
+  return (
+    PROVIDER_CATALOG.find((provider) => provider.id === providerName)
+      ?.displayName ?? providerName
+  );
+}
+
+function classificationAttribution(
+  attribution: ConversationErrorAttribution | undefined,
+): Pick<ClassifiedConversationError, "connectionName" | "profileName"> {
+  return {
+    ...(attribution?.connectionName
+      ? { connectionName: attribution.connectionName }
+      : {}),
+    ...(attribution?.profileName
+      ? { profileName: attribution.profileName }
+      : {}),
+  };
+}
+
+function rejectedCredentialClassification(
+  providerName: string,
+  credentialSource: ProviderCredentialSource,
+  attribution?: ConversationErrorAttribution,
+): Omit<ClassifiedConversationError, "debugDetails"> {
+  switch (credentialSource) {
+    case "vellum-managed":
+      return managedKeyInvalidClassification();
+    case "oauth-subscription":
+      return subscriptionLoginRejectedClassification(providerName, attribution);
+    case "no-auth":
+      return endpointAuthenticationRequiredClassification(
+        providerName,
+        attribution,
+      );
+    case "byok":
+      return invalidApiKeyClassification(providerName, attribution);
+  }
+}
+
+function endpointAuthenticationRequiredClassification(
+  providerName: string,
+  attribution?: ConversationErrorAttribution,
+): Omit<ClassifiedConversationError, "debugDetails"> {
+  const provider = providerDisplayName(providerName);
+  const target = describeAttribution(attribution);
+  return {
+    code: "PROVIDER_API",
+    userMessage: `The ${provider} endpoint${target} requires authentication, but that connection is configured without credentials. Configure authentication for that endpoint in Settings → Models & Services.`,
+    retryable: false,
+    errorCategory: "provider_endpoint_auth_required",
+    ...classificationAttribution(attribution),
+  };
+}
+
+function subscriptionLoginRejectedClassification(
+  providerName: string,
+  attribution?: ConversationErrorAttribution,
+): Omit<ClassifiedConversationError, "debugDetails"> {
+  const provider = providerDisplayName(providerName);
+  const target = describeAttribution(attribution);
+  return {
+    code: "PROVIDER_API",
+    userMessage: `Your ${provider} subscription login${target} was rejected by ${provider}. Reconnect that account in Settings → Models & Services.`,
+    retryable: false,
+    errorCategory: "provider_subscription_auth",
+    ...classificationAttribution(attribution),
+  };
+}
+
 /**
  * Classification for an invalid (rejected by the upstream provider, e.g.
  * Anthropic 401/403) API key. Distinct from `PROVIDER_NOT_CONFIGURED`
@@ -853,22 +979,17 @@ function describeAttribution(
  * different recovery actions (update vs. add).
  */
 function invalidApiKeyClassification(
+  providerName: string,
   attribution?: ConversationErrorAttribution,
 ): Omit<ClassifiedConversationError, "debugDetails"> {
+  const provider = providerDisplayName(providerName);
   const target = describeAttribution(attribution);
   return {
     code: "PROVIDER_INVALID_KEY",
-    userMessage: target
-      ? `The API key${target} was rejected by the provider. Update it in Settings → Models & Services.`
-      : "Your API key was rejected by the provider. Update it in Settings → Models & Services.",
+    userMessage: `Your personal ${provider} API key${target} was rejected by ${provider}. Update that key in Settings → Models & Services.`,
     retryable: false,
     errorCategory: "provider_invalid_key",
-    ...(attribution?.connectionName
-      ? { connectionName: attribution.connectionName }
-      : {}),
-    ...(attribution?.profileName
-      ? { profileName: attribution.profileName }
-      : {}),
+    ...classificationAttribution(attribution),
   };
 }
 
@@ -906,8 +1027,8 @@ function providerNotConfiguredClassification(
  * short-circuit and the status switch both decline to classify.
  */
 function classifyByMessage(
-  error: unknown,
   message: string,
+  isManagedRoute: boolean,
 ): Omit<ClassifiedConversationError, "debugDetails"> {
   // Empty-request-messages is always an internal construction failure — check
   // it before the provider/network patterns so a ProviderError that carries the
@@ -924,7 +1045,7 @@ function classifyByMessage(
   // Check rate limit first (before network, since 429 could match both)
   for (const pattern of RATE_LIMIT_PATTERNS) {
     if (pattern.test(message)) {
-      if (isManagedUsageLimitError(error, message)) {
+      if (isManagedUsageLimitError(message, isManagedRoute)) {
         return managedUsageLimitClassification();
       }
       return rateLimitClassification();

package/src/daemon/conversation-messaging.ts

@@ -670,6 +670,35 @@ export interface PersistMessageOptions {
    * memory or search; see `ProcessMessageOptions.skipUserMessageIndexing`.
    */
   skipIndexing?: boolean;
+  /**
+   * True when this turn was auto-sent on the user's behalf rather than typed
+   * by them: onboarding research prompts, the personality `<system-message>`,
+   * research corrections, hidden kickoff greetings, the legacy pre-chat
+   * bootstrap, and `[User action on ...]` surface synthetics.
+   *
+   * Stamped onto `messages.metadata.scripted` and forwarded to
+   * `TurnTelemetryEvent.scripted`, where activation metrics exclude it. This
+   * is the consent-independent replacement for classifying turns by
+   * text-matching their content in diagnostics-gated traces. That classifier
+   * can only see owners who opted into diagnostics, so it silently counted
+   * scripted turns as real messages for everyone else (ANT-10).
+   *
+   * Defaults to `false`: a daemon that knows about the field asserts "the user
+   * typed this" for ordinary sends, which is what makes a user's activation
+   * measurable. This is only safe because every auto-send path is marked at
+   * its source. See the merged-metadata note below for the list.
+   *
+   * Callers persisting machine-authored content into a `standard` conversation
+   * MUST pass `true`. A wrong `false` is trusted downstream and re-inflates
+   * activation. (Machine-authored turns in `background` / `scheduled`
+   * conversations are already excluded from activation by conversation type,
+   * and the `assert_scripted_signals_agree` dbt test catches any straggler
+   * whose text matches a known template.)
+   *
+   * May also be carried in the `metadata` bag, which is how queued sends
+   * thread it: the queue round-trips `metadata`, not these options.
+   */
+  scripted?: boolean;
 }
 
 // ── persistUserMessage ───────────────────────────────────────────────
@@ -805,15 +834,46 @@ export async function persistQueuedMessageBody(
     // The caller-supplied metadata may include it (channel ingress threads it
     // through `Server.processMessage`); we materialize it into the typed
     // `slackMeta` sub-key below when the turn channel is Slack.
-    const { slackInbound: rawSlackInbound, ...metadataWithoutSlackInbound } =
-      (metadata ?? {}) as Record<string, unknown> & {
-        slackInbound?: SlackInboundMessageMetadata;
-      };
+    // `scripted` is pulled out of the raw bag alongside `slackInbound` so the
+    // spread below can never re-introduce an unvalidated value. Letting a
+    // non-boolean through would be worse than dropping it: sqlite stores it
+    // verbatim, and `turn-events-store` narrows anything that isn't 1 to
+    // `false`, turning a junk string into a confident "the user typed this".
+    const {
+      slackInbound: rawSlackInbound,
+      scripted: rawScriptedFromMetadata,
+      ...metadataWithoutSlackInbound
+    } = (metadata ?? {}) as Record<string, unknown> & {
+      slackInbound?: SlackInboundMessageMetadata;
+      scripted?: unknown;
+    };
     const slackMeta = buildSlackMetaForPersistence({
       slackInbound: rawSlackInbound,
       turnChannel: turnCtx?.userMessageChannel,
     });
 
+    // See the `scripted` note on the merged metadata below. Only a real
+    // boolean in the bag counts: a stray truthy string must not be read as a
+    // scripted assertion.
+    const scriptedFromMetadata =
+      typeof rawScriptedFromMetadata === "boolean"
+        ? rawScriptedFromMetadata
+        : undefined;
+    // `automated` (machine-authored, set by the messaging skill and the memory
+    // skill-card) implies scripted: it is by definition not a turn the user
+    // typed. Only a DEFAULT: an explicit `scripted` wins, so a caller can
+    // mark an automated message as a real turn if that is ever right. Note the
+    // two flags are not interchangeable in the other direction: `automated`
+    // also suppresses memory extraction, so scripted onboarding turns that
+    // should still be indexed must not be marked automated to get counted out.
+    const scriptedFromAutomated =
+      metadataWithoutSlackInbound.automated === true ? true : undefined;
+    const resolvedScripted =
+      options.scripted ??
+      scriptedFromMetadata ??
+      scriptedFromAutomated ??
+      false;
+
     // Client attribution for turn telemetry, stored under the `client`
     // metadata bag which `turn-events-store` forwards onto
     // `TurnTelemetryEvent.client`. The bag merges two sources per key:
@@ -853,6 +913,29 @@ export async function persistQueuedMessageBody(
       ...clientBag,
       ...(imageSourcePaths ? { imageSourcePaths } : {}),
       ...(slackMeta ? { slackMeta } : {}),
+      // Scripted-turn marker, forwarded by `turn-events-store` onto
+      // `TurnTelemetryEvent.scripted`. Written LAST so it cannot be
+      // half-overwritten by the raw metadata spread above.
+      //
+      // Resolved from the typed option first, then the metadata bag. The bag
+      // is how queued sends carry it, since the queue round-trips `metadata`
+      // but not `PersistMessageOptions` (same carrier as the `hidden` flag).
+      //
+      // Always stamped, including the `false` default: a daemon that knows
+      // about the field asserts "the user typed this" for ordinary sends, and
+      // that assertion is what makes a user's activation MEASURABLE
+      // downstream. Absent would mean "unknown", which is strictly worse
+      // information than a truthful false.
+      //
+      // Defaulting to false is only safe because every auto-send path is now
+      // marked at its source: the web onboarding flows (research prompt,
+      // kickoff, personality, corrections, legacy bootstrap), `[User action
+      // on ...]` surface synthetics, and anything flagged `automated`. A new
+      // auto-send path that forgets to mark itself lands here as a false and
+      // is believed. The `assert_scripted_signals_agree` dbt test is the
+      // backstop: it fires when a turn claiming `false` matches a known
+      // scripted template.
+      scripted: resolvedScripted,
     };
 
     // Materialize each attachment into an attachment-store row up front so the

package/src/daemon/conversation-process.ts

@@ -24,12 +24,14 @@ import { extractPreferences } from "../notifications/preference-extractor.js";
 import { createPreference } from "../notifications/preferences-store.js";
 import {
   addMessage,
+  isEchoSuppressedUserMessage,
   isHiddenMessageMetadata,
   provenanceFromTrustContext,
   recordConversationPersistedSeq,
   setConversationOriginChannelIfUnset,
   setConversationOriginInterfaceIfUnset,
 } from "../persistence/conversation-crud.js";
+import { isReplyPushIneligibleUserMessage } from "../persistence/conversation-types.js";
 import type { ContextWindowResult } from "../plugins/defaults/compaction/window-manager.js";
 import { getCurrentSeq } from "../runtime/assistant-stream-state.js";
 import {
@@ -63,48 +65,6 @@ import { resolveVerificationSessionIntent } from "./verification-session-intent.
 
 const log = getLogger("conversation-process");
 
-/**
- * Daemon-injected run lifecycle notifications — subagent (`subagentNotification`),
- * ACP run (`acpNotification`), and any wake trigger (the persisted
- * `<background_event source="...">` row every wake reads) — are persisted into
- * the parent conversation so the orchestrator wakes and reads the trigger, but
- * they are internal scaffolding: the user sees the wake through its inline card
- * ("Conversation Woke", or a terminal card for a backgrounded bash run), not a
- * chat turn. Skip the `user_message_echo` broadcast for these so they never
- * render as a live user bubble; the persisted row is filtered from the rendered
- * transcript on the client.
- *
- * Messages explicitly flagged `hidden` (a hidden `POST /messages` send that
- * queued behind an in-flight turn, e.g. the channel-setup wizard-close
- * marker) are suppressed the same way — the immediate route path already
- * skips their echo, and the persisted `hidden` metadata keeps them out of
- * the fetched transcript.
- */
-export function isEchoSuppressedUserMessage(
-  metadata: Record<string, unknown> | undefined,
-): boolean {
-  return (
-    isHiddenMessageMetadata(metadata) ||
-    metadata?.subagentNotification != null ||
-    metadata?.acpNotification != null ||
-    isBackgroundEventMetadata(metadata)
-  );
-}
-
-/**
- * True when the row is a persisted `<background_event source="...">` trigger —
- * every wake, scheduled run, and backgrounded-tool completion stamps one (see
- * {@link persistWakeTriggerMessage}). The permission mode such a turn ran under
- * varies (most run interactive; clientless/headless wakes do not) and is
- * recorded separately in `backgroundEventInteractive`; this predicate only
- * identifies the row as a background event.
- */
-export function isBackgroundEventMetadata(
-  metadata: Record<string, unknown> | undefined,
-): boolean {
-  return typeof metadata?.backgroundEventSource === "string";
-}
-
 /** Locale-formatted count for the user-facing context stats cards. */
 const fmt = (n: number | undefined) => (n ?? 0).toLocaleString("en-US");
 
@@ -331,6 +291,12 @@ async function buildPassthroughBatch(
     if (candidate.transport?.clientOs !== head.transport?.clientOs) {
       break;
     }
+    // Same head-wins problem for the app on screen: batching a message sent
+    // while a different app was open would run it against the head's
+    // `visible_app`, pointing "the app" at the wrong one.
+    if (candidate.transport?.visibleAppId !== head.transport?.visibleAppId) {
+      break;
+    }
     if (candidate.sourceActorPrincipalId !== head.sourceActorPrincipalId) {
       break;
     }
@@ -769,6 +735,7 @@ async function drainSingleMessage(
     conversation.applyHostEnvFromTransport(next.transport);
     conversation.applyClientTimezoneFromTransport(next.transport);
     conversation.applyClientOsFromTransport(next.transport);
+    conversation.applyVisibleAppFromTransport(next.transport);
   }
 
   conversation.currentTurnAuthContext = next.authContext;
@@ -963,7 +930,11 @@ async function drainSingleMessage(
       conversation.emitActivityState("thinking", "context_compacting", {
         requestId: next.requestId,
       });
-      const result = await conversation.forceCompact();
+      // Push the usage refresh to the queued item's own sink, the one the
+      // result card below streams on. `sendToClient` is reset to a no-op once
+      // an interactive turn finishes, so a `/compact` draining behind one
+      // would otherwise refresh nothing.
+      const result = await conversation.forceCompact(next.onEvent);
       const responseText = formatCompactResult(result);
 
       const assistantMsg = createAssistantMessage(responseText);
@@ -1345,6 +1316,7 @@ async function drainBatch(
     conversation.applyHostEnvFromTransport(head.transport);
     conversation.applyClientTimezoneFromTransport(head.transport);
     conversation.applyClientOsFromTransport(head.transport);
+    conversation.applyVisibleAppFromTransport(head.transport);
   }
 
   conversation.currentTurnAuthContext = head.authContext;
@@ -1392,6 +1364,11 @@ async function drainBatch(
   let lastSuccessfulCurrentPage: string | undefined;
   let lastSuccessfulContent: string | undefined;
   let lastUserMessageId: string | undefined;
+  // `messages.id` of the last member the reply-push producer would actually
+  // notify about. Selected with the producer's own eligibility predicate so a
+  // trailing row it suppresses (a hidden marker, a channel send) cannot stand
+  // in for the prompt ahead of it and swallow that prompt's push.
+  let lastPushEligibleUserMessageId: string | undefined;
   // Members whose persist succeeded. `fanOutOnEvent` below must only
   // broadcast agent-loop events to these — clients whose persist failed
   // already received an error event and must not also receive the
@@ -1557,6 +1534,10 @@ async function drainBatch(
       continue;
     }
 
+    if (!isReplyPushIneligibleUserMessage(qm.metadata)) {
+      lastPushEligibleUserMessageId = lastUserMessageId;
+    }
+
     // Broadcast the user message to all hub subscribers so passive devices
     // see each batched user turn before the assistant reply starts streaming.
     if (!isEchoSuppressedUserMessage(qm.metadata)) {
@@ -1693,7 +1674,13 @@ async function drainBatch(
     isUserMessage?: boolean;
     titleText?: string;
     isHiddenPrompt?: boolean;
-  } = { isUserMessage: true };
+    notifyUserMessageId?: string;
+  } = {
+    isUserMessage: true,
+  };
+  if (lastPushEligibleUserMessageId !== undefined) {
+    drainLoopOptions.notifyUserMessageId = lastPushEligibleUserMessageId;
+  }
   // Source interactive flag from the last successfully-persisted sibling so
   // a trailing failed tail doesn't flip the agent loop's interactivity.
   const lastSuccessfulBatchEntry =
@@ -1761,6 +1748,26 @@ export interface ProcessMessageOptions {
   displayContent?: string;
   /** JWT-verified committer principal for turn-scoped host-proxy authorization. */
   sourceActorPrincipalId?: string;
+  /**
+   * True when this turn was auto-sent on the user's behalf rather than typed
+   * (see `PersistMessageOptions.scripted`). Forwarded to persistence so the
+   * turn is excluded from activation counts. Defaults to false. A caller
+   * sending machine-authored content into a `standard` conversation must set
+   * it explicitly.
+   *
+   * Related to `metadata.automated` below but not the same knob: `automated`
+   * implies scripted (machine-authored is by definition not typed), while
+   * `scripted` carries no memory-indexing side effect. A caller that wants a
+   * turn excluded from activation but still indexed sets this, not that.
+   */
+  scripted?: boolean;
+  /**
+   * Extra metadata stamped onto the persisted user row alongside the channel
+   * and provenance fields the turn derives. Callers that drive a turn on
+   * someone's behalf use it to mark the row's provenance (e.g. the plugin-api
+   * facade stamps `automated`).
+   */
+  metadata?: Record<string, unknown>;
 }
 
 // ── processMessage ───────────────────────────────────────────────────
@@ -1785,6 +1792,8 @@ export async function processMessage(
     overrideProfile,
     displayContent,
     sourceActorPrincipalId,
+    scripted,
+    metadata: callerMetadata,
   } = options;
   await conversation.ensureActorScopedHistory();
   // Snapshot persona context at turn start so later tool turns can't pick up
@@ -2057,7 +2066,8 @@ export async function processMessage(
       conversation.emitActivityState("thinking", "context_compacting", {
         requestId,
       });
-      const result = await conversation.forceCompact();
+      // Same sink the result card below streams on (see the drain branch).
+      const result = await conversation.forceCompact(onEvent);
       const responseText = formatCompactResult(result);
 
       const assistantMsg = createAssistantMessage(responseText);
@@ -2196,6 +2206,8 @@ export async function processMessage(
       attachments,
       requestId,
       displayContent,
+      scripted,
+      ...(callerMetadata ? { metadata: callerMetadata } : {}),
     });
     publishConversationMessagesChanged(conversation.conversationId);
   } catch (err) {