@vellumai/assistant 0.11.10 → 0.11.11-staging.1

package/src/daemon/host-file-proxy.ts

@@ -9,6 +9,7 @@ import {
   ambiguousSameUserError,
   enforceSameActorOrErrorResult,
   pickSameUserAutoResolve,
+  snapshotHostProxyActorPrincipalId,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { readAudioBase64 } from "../tools/shared/filesystem/audio-read.js";
@@ -183,12 +184,11 @@ export class HostFileProxy {
         conversationId,
         kind: "host_file",
         targetClientId: resolvedTargetClientId,
-        targetActorPrincipalId:
-          resolvedTargetClientId != null
-            ? assistantEventHub.getActorPrincipalIdForClient(
-                resolvedTargetClientId,
-              )
-            : undefined,
+        targetActorPrincipalId: snapshotHostProxyActorPrincipalId({
+          hub: assistantEventHub,
+          targetClientId: resolvedTargetClientId,
+          sourceActorPrincipalId,
+        }),
         rpcResolve: resolve as (v: unknown) => void,
         rpcReject: reject,
         timer,

package/src/daemon/host-proxy-base.ts

@@ -21,6 +21,7 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
+import { snapshotHostProxyActorPrincipalId } from "../runtime/auth/same-actor.js";
 import type { PendingInteraction } from "../runtime/pending-interactions.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -142,6 +143,7 @@ export abstract class HostProxyBase<TRequest, TResultPayload> {
     extraFields?: Record<string, unknown>,
     targetClientId?: string,
     timeoutMsOverride?: number,
+    sourceActorPrincipalId?: string,
   ): Promise<TResultPayload> {
     const requestId = uuid();
     const effectiveTimeoutMs = timeoutMsOverride ?? this.timeoutMs;
@@ -206,15 +208,14 @@ export abstract class HostProxyBase<TRequest, TResultPayload> {
       // (HostCuProxy bypasses dispatchRequest entirely with its own inline
       //  request method that registers directly, which is why CU works
       //  without this base-level fix.)
-      // Snapshot the target's actorPrincipalId at registration time so the
-      // result-route same-actor check has a stable value to compare against —
-      // the target client's SSE subscription may briefly disconnect between
-      // dispatch and result submission, which would make a live hub lookup
-      // falsely 403 a legitimate result.
-      const targetActorPrincipalId =
-        targetClientId != null
-          ? assistantEventHub.getActorPrincipalIdForClient(targetClientId)
-          : undefined;
+      // Snapshot the actor principal at registration so the result-route
+      // same-actor check has a stable value. Targeted dispatch uses the
+      // target client; untargeted dispatch uses the turn's source actor.
+      const targetActorPrincipalId = snapshotHostProxyActorPrincipalId({
+        hub: assistantEventHub,
+        targetClientId,
+        sourceActorPrincipalId,
+      });
       pendingInteractions.register(requestId, {
         conversationId,
         kind: this.resultPendingKind,

package/src/daemon/host-transfer-proxy.ts

@@ -13,6 +13,7 @@ import {
   ambiguousSameUserError,
   enforceSameActorOrErrorResult,
   pickSameUserAutoResolve,
+  snapshotHostProxyActorPrincipalId,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
@@ -259,24 +260,22 @@ export class HostTransferProxy {
             sha256,
             fileBuffer,
             targetClientId: resolvedTargetClientId,
-            targetActorPrincipalId:
-              resolvedTargetClientId != null
-                ? assistantEventHub.getActorPrincipalIdForClient(
-                    resolvedTargetClientId,
-                  )
-                : undefined,
+            targetActorPrincipalId: snapshotHostProxyActorPrincipalId({
+              hub: assistantEventHub,
+              targetClientId: resolvedTargetClientId,
+              sourceActorPrincipalId,
+            }),
           });
 
           pendingInteractions.register(requestId, {
             conversationId: input.conversationId,
             kind: "host_transfer",
             targetClientId: resolvedTargetClientId,
-            targetActorPrincipalId:
-              resolvedTargetClientId != null
-                ? assistantEventHub.getActorPrincipalIdForClient(
-                    resolvedTargetClientId,
-                  )
-                : undefined,
+            targetActorPrincipalId: snapshotHostProxyActorPrincipalId({
+              hub: assistantEventHub,
+              targetClientId: resolvedTargetClientId,
+              sourceActorPrincipalId,
+            }),
             rpcResolve: resolve as (v: unknown) => void,
             rpcReject: reject,
             timer,
@@ -450,24 +449,22 @@ export class HostTransferProxy {
         filePath: input.destPath,
         overwrite: input.overwrite,
         targetClientId: resolvedTargetClientId,
-        targetActorPrincipalId:
-          resolvedTargetClientId != null
-            ? assistantEventHub.getActorPrincipalIdForClient(
-                resolvedTargetClientId,
-              )
-            : undefined,
+        targetActorPrincipalId: snapshotHostProxyActorPrincipalId({
+          hub: assistantEventHub,
+          targetClientId: resolvedTargetClientId,
+          sourceActorPrincipalId,
+        }),
       });
 
       pendingInteractions.register(requestId, {
         conversationId: input.conversationId,
         kind: "host_transfer",
         targetClientId: resolvedTargetClientId,
-        targetActorPrincipalId:
-          resolvedTargetClientId != null
-            ? assistantEventHub.getActorPrincipalIdForClient(
-                resolvedTargetClientId,
-              )
-            : undefined,
+        targetActorPrincipalId: snapshotHostProxyActorPrincipalId({
+          hub: assistantEventHub,
+          targetClientId: resolvedTargetClientId,
+          sourceActorPrincipalId,
+        }),
         rpcResolve: resolve as (v: unknown) => void,
         rpcReject: reject,
         timer,

package/src/daemon/mcp-reload-service.ts

@@ -12,6 +12,7 @@ import {
 } from "../mcp/effective-config.js";
 import { getMcpServerManager } from "../mcp/manager.js";
 import { migrateLegacyMcpHeaders } from "../mcp/mcp-header-store.js";
+import { signalMcpReloaded } from "../mcp/reload-signal.js";
 import { createMcpToolsFromServer } from "../tools/mcp/mcp-tool-factory.js";
 import { registerMcpTools, unregisterAllMcpTools } from "../tools/registry.js";
 import { getLogger } from "../util/logger.js";
@@ -154,6 +155,11 @@ async function doReload(): Promise<McpReloadResult> {
     // to evict sessions.
 
     log.info({ serverCount, toolCount }, "MCP servers reloaded");
+    // Other processes hold their own connections to the same servers and have
+    // no watcher of their own; this is how they learn the set moved. Only on
+    // success: a reload that failed before the teardown left this process on
+    // its existing servers, so there is nothing for anyone to mirror.
+    signalMcpReloaded();
     return { success: true, serverCount, toolCount, servers };
   } catch (err) {
     const error = err instanceof Error ? err.message : String(err);

package/src/daemon/providers-setup.ts

@@ -1,8 +1,7 @@
 import { maybeDefaultSpeechToManaged } from "../config/managed-speech-defaults.js";
 import { rehydratePlatformCredentials } from "../config/platform-rehydration.js";
 import type { AssistantConfig } from "../config/types.js";
-import { buildEffectiveMcpConfig } from "../mcp/effective-config.js";
-import { getMcpServerManager } from "../mcp/manager.js";
+import { startConfiguredMcpServers } from "../mcp/startup.js";
 import { gmailMessagingProvider } from "../messaging/providers/gmail/adapter.js";
 import { outlookMessagingProvider } from "../messaging/providers/outlook/adapter.js";
 import { slackProvider as slackMessagingProvider } from "../messaging/providers/slack/adapter.js";
@@ -11,8 +10,7 @@ import { whatsappMessagingProvider } from "../messaging/providers/whatsapp/adapt
 import { registerMessagingProvider } from "../messaging/registry.js";
 import { initializeProviders } from "../providers/registry.js";
 import { validateSubagentRoleAllowlists } from "../subagent/validate-allowlists.js";
-import { createMcpToolsFromServer } from "../tools/mcp/mcp-tool-factory.js";
-import { initializeTools, registerMcpTools } from "../tools/registry.js";
+import { initializeTools } from "../tools/registry.js";
 import { getLogger } from "../util/logger.js";
 import { initWatcherEngine } from "../watcher/engine.js";
 import { registerWatcherProvider } from "../watcher/provider-registry.js";
@@ -63,28 +61,9 @@ export async function initializeProvidersAndTools(
   }
 
   // Start MCP servers — workspace-configured and plugin-declared alike —
-  // and register their tools.
-  const mcpConfig = buildEffectiveMcpConfig(config.mcp);
-  if (Object.keys(mcpConfig.servers).length > 0) {
-    const manager = getMcpServerManager();
-    try {
-      const serverToolInfos = await manager.start(mcpConfig);
-      for (const { serverId, serverConfig, tools } of serverToolInfos) {
-        const mcpTools = createMcpToolsFromServer(
-          tools,
-          serverId,
-          serverConfig,
-          manager,
-        );
-        registerMcpTools(serverId, mcpTools);
-      }
-    } catch (err) {
-      log.error(
-        { err },
-        "MCP server initialization failed — continuing without MCP tools",
-      );
-    }
-  }
+  // and register their tools. Shared with the schedule worker, which hosts
+  // agent turns in its own process and so needs its own connections.
+  await startConfiguredMcpServers(config.mcp);
 
   log.info("Daemon startup: providers and tools initialized");
 }

package/src/heartbeat/heartbeat-service.ts

@@ -21,6 +21,10 @@ import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { runBackgroundJob } from "../runtime/background-job-runner.js";
 import { hasReceivedUserMessage } from "../runtime/pre-first-message-gate.js";
 import { computeNextRunAt } from "../schedule/recurrence-engine.js";
+import {
+  hourInTimeZone,
+  resolveScheduleTimezone,
+} from "../schedule/schedule-timezone.js";
 import { readTextFileSync } from "../util/fs.js";
 import { getLogger } from "../util/logger.js";
 import { getWorkspaceDir, getWorkspacePromptPath } from "../util/platform.js";
@@ -117,8 +121,10 @@ function refreshBackgroundWakeIntentSoon(reason: string): void {
 }
 
 export interface HeartbeatDeps {
-  /** Override for current hour (0-23), for testing. */
+  /** Override for current hour (0-23), for testing. Used when no timezone is resolved. */
   getCurrentHour?: () => number;
+  /** Override for "now", for testing timezone-aware active hours. */
+  now?: () => Date;
 }
 
 export interface ManagedWakeHeartbeatRunOptions {
@@ -351,7 +357,7 @@ export class HeartbeatService {
       const nextRunAt = computeNextRunAt({
         syntax: "cron",
         expression: config.cronExpression!,
-        timezone: config.timezone,
+        timezone: resolveScheduleTimezone(config.timezone),
       });
       this._nextRunAt = nextRunAt;
       if (this.timer) {
@@ -543,22 +549,15 @@ export class HeartbeatService {
 
     // Active hours guard — only applied when both bounds are set.
     // The schema rejects configs where only one bound is provided.
+    // Hours are wall-clock in the heartbeat timezone (explicit, then the
+    // user's configured/detected zone). Host-local is the last resort so a
+    // managed container whose clock is UTC does not treat 8:00-22:00 as UTC.
     if (
       !force &&
       config.activeHoursStart != null &&
       config.activeHoursEnd != null
     ) {
-      let hour: number;
-      if (this.cronMode && config.timezone) {
-        const parts = new Intl.DateTimeFormat("en-US", {
-          timeZone: config.timezone,
-          hourCycle: "h23",
-          hour: "numeric",
-        }).formatToParts(new Date());
-        hour = Number(parts.find((p) => p.type === "hour")!.value);
-      } else {
-        hour = this.deps.getCurrentHour?.() ?? new Date().getHours();
-      }
+      const hour = currentHourForHeartbeat(config, this.deps);
       if (
         !isWithinActiveHours(
           hour,
@@ -569,6 +568,7 @@ export class HeartbeatService {
         log.debug(
           {
             hour,
+            timezone: resolveScheduleTimezone(config.timezone),
             activeHoursStart: config.activeHoursStart,
             activeHoursEnd: config.activeHoursEnd,
           },
@@ -1011,6 +1011,18 @@ function isDiskPressureBackgroundLocked(logKey: string): boolean {
   return true;
 }
 
+function currentHourForHeartbeat(
+  config: HeartbeatConfig,
+  deps: HeartbeatDeps,
+): number {
+  const now = deps.now?.() ?? new Date();
+  const timezone = resolveScheduleTimezone(config.timezone);
+  if (timezone) {
+    return hourInTimeZone(timezone, now);
+  }
+  return deps.getCurrentHour?.() ?? now.getHours();
+}
+
 /**
  * Check if the given hour falls within the active window.
  * Handles overnight windows (e.g. start=22, end=6).
@@ -1026,3 +1038,50 @@ function isWithinActiveHours(
   // Overnight window: e.g. 22-6 means 22,23,0,1,2,3,4,5
   return hour >= start || hour < end;
 }
+
+function stringOrNull(value: unknown): string | null {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+
+function rawObject(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value as Record<string, unknown>;
+}
+
+/**
+ * Cron next-run is computed in the resolved timezone at schedule time. Interval
+ * active hours are evaluated live, so only cron needs a reschedule when the
+ * fallback zone changes and heartbeat.timezone is unset.
+ */
+export function shouldRescheduleHeartbeatForTimezoneChange(
+  previousRaw: Record<string, unknown>,
+  nextRaw: Record<string, unknown>,
+): boolean {
+  const nextHeartbeat = rawObject(nextRaw.heartbeat);
+  if (stringOrNull(nextHeartbeat?.timezone)) {
+    return false;
+  }
+  if (!stringOrNull(nextHeartbeat?.cronExpression)) {
+    return false;
+  }
+  const previousUi = rawObject(previousRaw.ui);
+  const nextUi = rawObject(nextRaw.ui);
+  return (
+    stringOrNull(previousUi?.userTimezone) !==
+      stringOrNull(nextUi?.userTimezone) ||
+    stringOrNull(previousUi?.detectedTimezone) !==
+      stringOrNull(nextUi?.detectedTimezone)
+  );
+}
+
+export function rescheduleHeartbeatIfTimezoneChanged(
+  previousRaw: Record<string, unknown>,
+  nextRaw: Record<string, unknown>,
+): void {
+  if (!shouldRescheduleHeartbeatForTimezoneChange(previousRaw, nextRaw)) {
+    return;
+  }
+  HeartbeatService.getInstance()?.reconfigure();
+}

package/src/live-voice/__tests__/live-voice-photo.test.ts

@@ -53,6 +53,7 @@ import {
   _pendingFrameReclaimCountForTests,
   _setProcessingWaitMsForTests,
   _standaloneImageQueueSizeForTests,
+  newestPersistedSightFrame,
   pendingStandaloneImagePersist,
   persistAmbientSightFrame,
   persistLiveVoicePhoto,
@@ -462,6 +463,39 @@ describe("persistLiveVoicePhoto", () => {
 });
 
 describe("persistAmbientSightFrame", () => {
+  test("reports where the daemon's half of the persist went", async () => {
+    const live = liveConversation("Live voice sight frame timing");
+    try {
+      const attachment = await uploadAttachment(
+        "frame.png",
+        "image/png",
+        IMAGE_BASE64,
+      );
+
+      const result = await persistAmbientSightFrame(
+        live.id,
+        attachment.id,
+        "voice",
+      );
+      expect(result.ok).toBe(true);
+      // Three legs, each a whole non-negative number of milliseconds: nothing
+      // was queued ahead of it and no turn held the flag, so the first two are
+      // near zero, and the write is whatever the store took.
+      expect(result.timing).toBeDefined();
+      for (const leg of Object.values(result.timing!)) {
+        expect(Number.isInteger(leg)).toBe(true);
+        expect(leg).toBeGreaterThanOrEqual(0);
+      }
+      expect(Object.keys(result.timing!).sort()).toEqual([
+        "flagWaitMs",
+        "queueWaitMs",
+        "writeMs",
+      ]);
+    } finally {
+      live.dispose();
+    }
+  });
+
   test("tags the row with the attachment it carries", async () => {
     const live = liveConversation("Live voice sight frame");
     try {
@@ -1596,6 +1630,44 @@ describe("standalone image persists are serialized per conversation", () => {
   });
 });
 
+describe("newestPersistedSightFrame", () => {
+  test("is null for a conversation that carries no frame", () => {
+    const live = liveConversation("Sight newest none");
+    try {
+      expect(newestPersistedSightFrame(live.id)).toBeNull();
+    } finally {
+      live.dispose();
+    }
+  });
+
+  test("names the last frame written, by the id the row carries", async () => {
+    const live = liveConversation("Sight newest");
+    try {
+      const first = await uploadFrame("first.png");
+      const second = await uploadFrame("second.png");
+      expect((await persistAmbientSightFrame(live.id, first, "voice")).ok).toBe(
+        true,
+      );
+      expect(
+        (await persistAmbientSightFrame(live.id, second, "voice")).ok,
+      ).toBe(true);
+
+      // A frame already linked elsewhere is stored under a fresh id, so the
+      // answer is read from the rows rather than assumed from the argument.
+      const rows = getMessages(live.id);
+      const storedSecond = sightFrameAttachmentIdsFromMetadata(
+        metadataOf(rows[1]),
+      )[0];
+      expect(newestPersistedSightFrame(live.id)).toEqual({
+        attachmentId: storedSecond,
+        capturedAt: rows[1].createdAt,
+      });
+    } finally {
+      live.dispose();
+    }
+  });
+});
+
 describe("pendingStandaloneImagePersist", () => {
   test("reports nothing for a conversation with no image queued", async () => {
     const live = liveConversation("Sight pending idle");

package/src/live-voice/__tests__/live-voice-sight-frame.test.ts

@@ -212,6 +212,87 @@ describe("live-voice sight_frame frame", () => {
       expect(result.error.frameType).toBe("sight_frame");
     }
   });
+
+  test("carries the client's timing through as sent", () => {
+    const timing = {
+      reason: "forced",
+      armToKeepMs: 40,
+      keepToEncodedMs: 30,
+      encodedToUploadedMs: 200,
+      uploadedToSentMs: 0,
+      bytes: 12345,
+    };
+    const result = validateLiveVoiceClientFrame({
+      type: "sight_frame",
+      attachmentId: "att-1",
+      timing,
+    });
+    expect(result).toEqual({
+      ok: true,
+      frame: { type: "sight_frame", attachmentId: "att-1", timing },
+    });
+  });
+
+  test("an ambient keep's timing has no arm", () => {
+    const timing = {
+      reason: "novel",
+      keepToEncodedMs: 30,
+      encodedToUploadedMs: 200,
+      uploadedToSentMs: 12,
+      bytes: 12345,
+    };
+    const result = validateLiveVoiceClientFrame({
+      type: "sight_frame",
+      attachmentId: "att-1",
+      timing,
+    });
+    expect(result).toEqual({
+      ok: true,
+      frame: { type: "sight_frame", attachmentId: "att-1", timing },
+    });
+  });
+
+  test("rejects a timing with a negative or fractional duration, naming the field", () => {
+    for (const bad of [
+      { keepToEncodedMs: -1 },
+      { encodedToUploadedMs: 1.5 },
+      { uploadedToSentMs: "0" },
+      { armToKeepMs: -5 },
+      { bytes: null },
+      { reason: "" },
+    ]) {
+      const result = validateLiveVoiceClientFrame({
+        type: "sight_frame",
+        attachmentId: "att-1",
+        timing: {
+          reason: "novel",
+          keepToEncodedMs: 30,
+          encodedToUploadedMs: 200,
+          uploadedToSentMs: 0,
+          bytes: 1,
+          ...bad,
+        },
+      });
+      expect(result.ok).toBe(false);
+      if (!result.ok) {
+        expect(result.error.code).toBe("invalid_field");
+        expect(result.error.field).toBe("timing");
+        expect(result.error.frameType).toBe("sight_frame");
+      }
+    }
+  });
+
+  test("rejects a timing that is not an object", () => {
+    const result = validateLiveVoiceClientFrame({
+      type: "sight_frame",
+      attachmentId: "att-1",
+      timing: "fast",
+    });
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error.field).toBe("timing");
+    }
+  });
 });
 
 describe("live-voice camera frames kept mid-call", () => {

package/src/live-voice/live-voice-photo.ts

@@ -90,6 +90,7 @@ import {
   getMessageById,
   MessageInsertPreconditionError,
   recordConversationPersistedSeq,
+  selectNewestSightFrameCapture,
 } from "../persistence/conversation-crud.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import { getCurrentSeq } from "../runtime/assistant-stream-state.js";
@@ -134,6 +135,29 @@ const SIGHT_FRAME_MESSAGE_CONTENT = "(camera frame)";
 export interface LiveVoicePhotoResult {
   readonly ok: boolean;
   readonly messageId?: string;
+  /**
+   * Where the daemon's half of a persist went, on the ordinary success path.
+   * Absent on failure and on the recovery path that reports a row the write
+   * threw after landing, where the marks say nothing about the row.
+   */
+  readonly timing?: LiveVoicePhotoPersistTiming;
+}
+
+/**
+ * The daemon leg of one standalone image, as durations between its marks.
+ *
+ * Together with the client leg a `sight_frame` can carry (see
+ * `LiveVoiceSightFrameTiming` in `protocol.ts`) and the session's own
+ * distance-from-speech-onset, this is what says which leg a frame that missed
+ * its turn was lost in.
+ */
+export interface LiveVoicePhotoPersistTiming {
+  /** Behind this conversation's earlier standalone images. */
+  readonly queueWaitMs: number;
+  /** Polling for the processing flag, which a running turn holds. */
+  readonly flagWaitMs: number;
+  /** Materializing the attachment and inserting the row. */
+  readonly writeMs: number;
 }
 
 /**
@@ -175,8 +199,9 @@ async function enqueueStandaloneImagePersist(
   attachmentId: string,
   kind: "photo" | "sight_frame",
   content: string,
-  job: () => Promise<LiveVoicePhotoResult>,
+  job: (queueWaitMs: number) => Promise<LiveVoicePhotoResult>,
 ): Promise<LiveVoicePhotoResult> {
+  const queuedAtMs = Date.now();
   let queue = standaloneImageQueues.get(conversationId);
   if (!queue) {
     queue = {
@@ -215,7 +240,7 @@ async function enqueueStandaloneImagePersist(
       );
       return { ok: false };
     }
-    return job();
+    return job(Date.now() - queuedAtMs);
   });
   // The tail must survive a failed job, or one rejection would strand every
   // image queued behind it.
@@ -265,6 +290,33 @@ export const SIGHT_FRAME_TURN_HOLD_MS = 800;
  * Settles, never rejects: the caller is choosing how long to wait, not whether
  * the image landed.
  */
+/** The newest camera frame a conversation's rows carry. */
+export interface NewestSightFrame {
+  readonly attachmentId: string;
+  /** When the row carrying it was written, in wall-clock milliseconds. */
+  readonly capturedAt: number;
+}
+
+/**
+ * The camera frame a turn launching now would read as the current view, or
+ * null when the conversation carries none.
+ *
+ * For the turn's own log: which frame the answer is about is otherwise
+ * invisible, and the failure this instruments is exactly a turn reading the
+ * frame before the one the question was asked about. Read from the rows, the
+ * same source retention ranks frames by, so a frame that landed is counted
+ * and a frame still in flight is not. One indexed row, since it runs on every
+ * voice turn.
+ */
+export function newestPersistedSightFrame(
+  conversationId: string,
+): NewestSightFrame | null {
+  const newest = selectNewestSightFrameCapture(conversationId);
+  return newest === null
+    ? null
+    : { attachmentId: newest.attachmentId, capturedAt: newest.createdAt };
+}
+
 export function pendingStandaloneImagePersist(
   conversationId: string,
 ): Promise<void> | null {
@@ -672,13 +724,14 @@ function persistStandaloneImage(
     attachmentId,
     kind,
     persistOptions.content,
-    () =>
+    (queueWaitMs) =>
       writeStandaloneImage(
         conversationId,
         attachmentId,
         kind,
         incarnation,
         persistOptions,
+        queueWaitMs,
       ),
   );
 }
@@ -718,6 +771,7 @@ async function writeStandaloneImage(
     | "insertPrecondition"
     | "onUndiscardedAttachments"
   >,
+  queueWaitMs: number,
 ): Promise<LiveVoicePhotoResult> {
   const { content } = persistOptions;
   // The id the row is inserted under, so a failure can ask whether the insert
@@ -768,7 +822,9 @@ async function writeStandaloneImage(
     // A turn holds the lock for its whole run. Waiting rather than queueing:
     // the conversation's queue drains into a turn, which is the one thing this
     // must not cause.
+    const flagWaitStartedAtMs = Date.now();
     const owner = await acquireProcessingFlag(conversation);
+    const flagAcquiredAtMs = Date.now();
     if (owner === null) {
       log.warn(
         { conversationId, attachmentId, kind },
@@ -828,7 +884,15 @@ async function writeStandaloneImage(
 
       announcePersistedImage(conversationId, content, persisted.id);
 
-      return { ok: true, messageId: persisted.id };
+      return {
+        ok: true,
+        messageId: persisted.id,
+        timing: {
+          queueWaitMs,
+          flagWaitMs: flagAcquiredAtMs - flagWaitStartedAtMs,
+          writeMs: Date.now() - flagAcquiredAtMs,
+        },
+      };
     } finally {
       // Only this job's own hold is released. A turn that claimed the flag
       // away mid-write owns it now, and clearing there would free a turn that