@vellumai/assistant 0.11.2 → 0.11.3-staging.1

package/src/daemon/conversation-initial-prompt.ts

@@ -1,43 +1,16 @@
 /**
  * Construction-time system-prompt resolution for a new conversation.
  *
- * The dependency seams (`fetchDelivery`, `deps.warm`, `deps.build`) exist so the
- * warm-then-build sequencing can be unit-tested without mocking the
- * widely-imported guardian-delivery / system-prompt modules — global module
- * mocks of those leak across test files in the shared-process runner.
+ * The dependency seams (`deps.warm`, `deps.build`) exist so the warm-then-build
+ * sequencing can be unit-tested without mocking the widely-imported
+ * guardian-delivery / system-prompt modules — global module mocks of those leak
+ * across test files in the shared-process runner.
  */
-import { getGuardianDeliveryFresh } from "../contacts/guardian-delivery-reader.js";
+import { warmGuardianBindings } from "../contacts/guardian-delivery-reader.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import type { ConversationCreateOptions } from "./handlers/shared.js";
 import type { TrustContext } from "./trust-context-types.js";
 
-type GuardianDeliveryFetch = (input?: {
-  channelTypes?: string[];
-}) => Promise<unknown>;
-
-/**
- * Warm both guardian-binding cache keys the desktop/native persona resolver
- * reads: the `"vellum"`-channel key for `peekGuardianForChannel("vellum")` and
- * the unfiltered key for its `peekAnyGuardian()` fallback. Warming only one
- * would still freeze `users/default.md` when the guardian lives on a non-vellum
- * channel (phone / Telegram).
- *
- * Uses the FRESH reader so warmup bypasses a stale/empty cached entry: a
- * gateway-side binding write (onboarding, rebind) does not invalidate the daemon
- * cache, so a non-fresh read could return an empty binding cached before the
- * guardian existed and freeze `users/default.md` until the TTL expires. The
- * fresh read repopulates the cache the sync `peek*` resolvers then read.
- * Best-effort — the reader swallows failures.
- */
-export async function warmGuardianBindings(
-  fetchDelivery: GuardianDeliveryFetch = getGuardianDeliveryFresh,
-): Promise<void> {
-  await Promise.all([
-    fetchDelivery({ channelTypes: ["vellum"] }),
-    fetchDelivery(),
-  ]);
-}
-
 /**
  * Resolve the system prompt to freeze onto a newly constructed conversation.
  *
@@ -47,11 +20,16 @@ export async function warmGuardianBindings(
  *
  * - An explicit `systemPromptOverride` (including an empty string) is used
  *   verbatim.
- * - A channel-routed conversation that already carries the requester's
- *   `trustContext` (e.g. Slack / Telegram inbound) builds with it, so the
- *   persona resolves the *requester's* `users/<slug>.md` (a DB contact lookup)
- *   rather than the guardian/default profile.
- * - Otherwise (no construction-time identity — the local vellum app sets trust
+ * - A channel-routed conversation carrying a non-guardian requester
+ *   `trustContext` (e.g. Slack / Telegram inbound) builds with it directly:
+ *   the requester's persona (`users/<slug>.md`) resolves via a DB contact
+ *   lookup that needs no guardian binding.
+ * - A guardian-class `trustContext` (background and scheduled turns, memory
+ *   consolidation, managed desktop) warms the guardian binding first: its
+ *   persona resolution reads the sync guardian-delivery cache, which is cold
+ *   in worker processes (schedule worker, memory worker) and after TTL expiry
+ *   in the daemon.
+ * - Otherwise (no construction-time identity: the local vellum app sets trust
  *   after creation) the guardian binding is warmed first so the persona slot
  *   resolves the guardian's `users/<slug>.md` instead of `users/default.md` on
  *   a cold cache.
@@ -67,7 +45,7 @@ export async function resolveInitialSystemPrompt(
     return storedOptions.systemPromptOverride;
   }
   const trustContext = storedOptions?.trustContext;
-  if (trustContext === undefined) {
+  if (trustContext === undefined || trustContext.trustClass === "guardian") {
     await (deps.warm ?? warmGuardianBindings)();
   }
   const build =

package/src/daemon/conversation-lifecycle.ts

@@ -12,6 +12,7 @@ import { getConfig } from "../config/loader.js";
 import { usesConceptPageMemory } from "../config/memory-v3-gate.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
+import { isSuppressedQueuedMessage } from "../persistence/conversation-types.js";
 import {
   enqueueMemoryJob,
   isMemoryEnabled,
@@ -23,10 +24,17 @@ import { resolveCapabilities } from "../runtime/capabilities.js";
 import { isAutoAnalysisConversation } from "../runtime/services/auto-analysis-guard.js";
 import { unregisterConversationSender } from "../tools/browser/browser-screencast.js";
 import { disposeToolProfiler } from "../tools/tool-profiler.js";
-import { type AbortReason, createAbortReason } from "../util/abort-reasons.js";
+import {
+  type AbortReason,
+  createAbortReason,
+  isUserInterruptAbort,
+} from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
 import { unregisterCallNotifiers } from "./conversation-notifiers.js";
-import type { MessageQueue } from "./conversation-queue-manager.js";
+import type {
+  MessageQueue,
+  QueueDrainReason,
+} from "./conversation-queue-manager.js";
 import { resetSkillToolProjection } from "./conversation-skill-tools.js";
 import type { SurfaceData, SurfaceType } from "./message-protocol.js";
 
@@ -112,6 +120,12 @@ export interface AbortContext {
   >;
   accumulatedSurfaceState: Map<string, Record<string, unknown>>;
   readonly queue: MessageQueue;
+  /** Armed when an interrupt leaves queued messages behind, so the drain
+   *  repairs tool_use blocks the killed turn abandoned. */
+  pendingInterruptRepair: boolean;
+  /** Never rejects. Called only when an interrupt preserves the queue but no
+   *  live turn is left to reach its `finally` and drain it. */
+  kickDrainQueue(reason?: QueueDrainReason, origin?: string): Promise<void>;
 }
 
 export interface DisposeContext extends AbortContext {
@@ -129,18 +143,133 @@ export interface DisposeContext extends AbortContext {
 
 // ── abort ─────────────────────────────────────────────────────────────
 
+/** The conversation surface {@link forceClearStaleProcessing} needs. */
+export interface StaleProcessingContext {
+  readonly conversationId: string;
+  setProcessing(value: boolean): void;
+}
+
+/**
+ * Release a processing flag that no live turn owns.
+ *
+ * Callers reach this when `isProcessing()` is true but `abortController` is
+ * null: the turn that owned the flag already tore its controller down (the
+ * agent loop nulls `abortController` before clearing the flag) or died without
+ * ever installing one. Either way no agent-loop release is going to run to
+ * clear it, so signalling the controller would be a silent no-op (`?.abort()`
+ * on null does nothing) and the conversation would stay wedged: every later
+ * submit is rejected with "already processing" and Stop appears dead.
+ * `setProcessing(false)` also nulls the persisted column and emits the metadata
+ * invalidation that drives clients to idle.
+ *
+ * `origin` names the calling site for log correlation.
+ */
+export function forceClearStaleProcessing(
+  ctx: StaleProcessingContext,
+  origin: string,
+): void {
+  log.warn(
+    { conversationId: ctx.conversationId, origin },
+    "Processing latched with no live abort controller; force-clearing the stale processing flag",
+  );
+  ctx.setProcessing(false);
+}
+
+/**
+ * Keep the queue intact across a user interrupt so the messages queued behind
+ * the stopped turn still run.
+ *
+ * A user interrupt ends the turn in flight and nothing else: the aborted turn
+ * unwinds to the agent loop's `finally`, which calls `kickDrainQueue`, so the
+ * queued messages become the next turn. This is the same drain-after-abort
+ * sequence `steerToMessage` relies on.
+ *
+ * An interrupt can land mid-tool, leaving `tool_use` blocks with no results, so
+ * arm the same repair a steer arms: the drained turn then opens with synthetic
+ * results instead of a dangling call.
+ *
+ * `hasLiveTurn` is false when the processing flag was force-cleared because no
+ * controller was left to signal. No agent-loop `finally` runs in that case, so
+ * the drain is kicked here instead; otherwise the preserved messages wait for
+ * an unrelated later turn to finish.
+ */
+function preserveQueueAcrossInterrupt(
+  ctx: AbortContext,
+  { hasLiveTurn }: { hasLiveTurn: boolean },
+): void {
+  if (ctx.queue.isEmpty) {
+    return;
+  }
+  ctx.pendingInterruptRepair = true;
+  log.info(
+    {
+      conversationId: ctx.conversationId,
+      queueDepth: ctx.queue.length,
+      hasLiveTurn,
+    },
+    "User interrupt: preserving queued messages for the interrupted turn's drain",
+  );
+  if (!hasLiveTurn) {
+    void ctx.kickDrainQueue("loop_complete", "abortConversation:no_live_turn");
+  }
+}
+
+/**
+ * Discard the queue when the conversation itself is going away (dispose,
+ * eviction, voice supersession, subagent teardown): there is no turn left for
+ * a queued message to run on.
+ *
+ * This runs whether or not the in-memory flag reads processing. A turn that
+ * cleared the flag can still be unwinding through its awaited turn-boundary
+ * commit with a `kickDrainQueue` ahead of it, and a queue left populated there
+ * drains onto a conversation whose state (and possibly whose durable row) is
+ * already gone.
+ *
+ * Each sender gets two events, both load-bearing. `generation_cancelled`
+ * closes out the turn the message was waiting on; `message_queued_deleted` is
+ * the terminal event for the queued row itself, the same one a user-issued
+ * DELETE emits (`deleteQueuedMessage`). Without the second, a client holds the
+ * pending indicator forever, since no `message_dequeued` is coming. Rows with
+ * no client-visible queued counterpart ({@link isSuppressedQueuedMessage} —
+ * hidden sends and daemon-injected subagent/ACP/wake notifications) are
+ * suppressed for the same reason they get no queued ack: they have no client
+ * row to close.
+ */
+function discardQueueOnAbort(ctx: AbortContext): void {
+  for (const queued of ctx.queue) {
+    queued.onEvent({
+      type: "generation_cancelled",
+      conversationId: ctx.conversationId,
+    });
+    if (isSuppressedQueuedMessage(queued.metadata)) {
+      continue;
+    }
+    queued.onEvent({
+      type: "message_queued_deleted",
+      conversationId: ctx.conversationId,
+      requestId: queued.requestId,
+      ...(queued.clientMessageId
+        ? { clientMessageId: queued.clientMessageId }
+        : {}),
+    });
+  }
+  ctx.queue.clear();
+}
+
 export function abortConversation(
   ctx: AbortContext,
   reason?: AbortReason,
 ): void {
-  if (ctx.isProcessing()) {
-    const effectiveReason =
-      reason ??
-      createAbortReason(
-        "preempted_by_new_message",
-        "abortConversation:default",
-        ctx.conversationId,
-      );
+  const effectiveReason =
+    reason ??
+    createAbortReason(
+      "preempted_by_new_message",
+      "abortConversation:default",
+      ctx.conversationId,
+    );
+  const hasLiveTurn = ctx.abortController !== null;
+  const wasProcessing = ctx.isProcessing();
+  if (wasProcessing) {
     log.info(
       { conversationId: ctx.conversationId, abortReason: effectiveReason },
       "Aborting in-flight processing",
@@ -153,21 +282,7 @@ export function abortConversation(
       // clear it here and risk clobbering a client's optimistic state.
       ctx.abortController.abort(effectiveReason);
     } else {
-      // The flag is set but there is no live controller to signal: the turn
-      // that owned it already tore its controller down (the agent-loop
-      // `finally` nulls `abortController` before clearing the flag) or died
-      // without ever installing one. Either way no agent-loop `finally` is
-      // going to run to clear the flag. Without this branch the abort is a
-      // silent no-op — `?.abort()` does nothing — and the conversation stays
-      // wedged: every later submit is rejected with "already processing" and
-      // Stop appears dead. Force-clear the flag directly so the conversation
-      // frees up. `setProcessing(false)` also nulls the persisted column and
-      // emits the metadata invalidation that drives clients to idle.
-      log.warn(
-        { conversationId: ctx.conversationId },
-        "Abort requested while processing but no live abort controller — force-clearing stale processing flag",
-      );
-      ctx.setProcessing(false);
+      forceClearStaleProcessing(ctx, "abortConversation");
     }
     ctx.prompter.dispose();
     ctx.secretPrompter.dispose();
@@ -175,13 +290,6 @@ export function abortConversation(
     ctx.surfaceActionRequestIds.clear();
     ctx.surfaceState.clear();
     ctx.accumulatedSurfaceState.clear();
-    for (const queued of ctx.queue) {
-      queued.onEvent({
-        type: "generation_cancelled",
-        conversationId: ctx.conversationId,
-      });
-    }
-    ctx.queue.clear();
   } else {
     // The in-memory flag reads idle, but a cancel must still clear a persisted
     // `processing_started_at` that outlived the turn that set it. This is the
@@ -201,6 +309,20 @@ export function abortConversation(
     // reports idle in-memory to clients, so no refetch needs to be pushed.
     ctx.setProcessing(false);
   }
+
+  // The queue decision is independent of the processing flag: an interrupt
+  // hands its queue to the drain, and every other abort kind is a teardown
+  // that must take the queue with it even when the flag already reads idle.
+  if (isUserInterruptAbort(effectiveReason)) {
+    // An idle conversation counts as having a live turn for drain purposes:
+    // either a turn is unwinding toward its own `kickDrainQueue`, or the queue
+    // is empty. Kicking a second drain here would race the first.
+    preserveQueueAcrossInterrupt(ctx, {
+      hasLiveTurn: hasLiveTurn || !wasProcessing,
+    });
+  } else {
+    discardQueueOnAbort(ctx);
+  }
 }
 
 // ── dispose ──────────────────────────────────────────────────────────

package/src/daemon/conversation-messaging.ts

@@ -48,7 +48,7 @@ import {
   extractAttachmentStoredPaths,
   extractImageSourcePaths,
   getConversation,
-  isHiddenMessageMetadata,
+  isSuppressedQueuedMessage,
   provenanceFromTrustContext,
   setConversationOriginChannelIfUnset,
   setConversationOriginInterfaceIfUnset,
@@ -217,11 +217,11 @@ export interface MessagingConversationContext {
   currentTurnAuthContext?: AuthContext;
   currentTurnSourceActorPrincipalId?: string;
   /**
-   * OS surface reported by the connected client ("web" | "ios" | "macos" |
-   * "android"), re-applied from transport metadata on every inbound message.
+   * OS surface reported by the connected client, re-applied from transport
+   * metadata on every inbound message.
    * Persisted under `metadata.client.os` so turn telemetry can attribute the
-   * real platform — the transport `interfaceId` is "web" for the web, iOS,
-   * and macOS apps alike (they share the web renderer).
+   * real platform. The transport `interfaceId` is "web" for browser, mobile,
+   * and desktop apps because they share the web renderer.
    */
   clientOs?: string;
   getTurnChannelContext(): TurnChannelContext | null;
@@ -254,15 +254,15 @@ function serializeUserContentBlocks(
  * by the attachments as inline base64 blocks. The regular upload path persists
  * `workspace_ref` blocks instead (see `persistQueuedMessageBody`).
  */
-export function serializePersistedUserMessageContent(
+export async function serializePersistedUserMessageContent(
   content: string,
   displayContent: string | undefined,
   attachments: MessageAttachmentInput[],
-): string {
+): Promise<string> {
   return serializeUserContentBlocks(
     content,
     displayContent,
-    attachmentsToContentBlocks(attachments),
+    await attachmentsToContentBlocks(attachments),
   );
 }
 
@@ -273,15 +273,15 @@ export function serializePersistedUserMessageContent(
  * the stored original — keeping the per-turn token estimate accurate without a
  * disk read on the hot path.
  */
-function computeReferenceImageDimensions(
+async function computeReferenceImageDimensions(
   attachmentId: string,
   mediaType: string,
-): { width: number; height: number } | null {
+): Promise<{ width: number; height: number } | null> {
   const bytes = getAttachmentContent(attachmentId);
   if (!bytes) {
     return null;
   }
-  const optimized = optimizeImageForTransport(
+  const optimized = await optimizeImageForTransport(
     bytes.toString("base64"),
     mediaType,
   );
@@ -321,11 +321,11 @@ type MaterializeOutcome =
  * endpoint's own rejection); only a recoverable store-write failure is
  * `transient` (inline fallback).
  */
-function materializeUserAttachment(
+async function materializeUserAttachment(
   conversationId: string,
   conversationCreatedAt: number,
   a: MessageAttachmentInput,
-): MaterializeOutcome {
+): Promise<MaterializeOutcome> {
   try {
     if (a.id && attachmentExists(a.id)) {
       const stored = scopeAttachmentToMessageConversation(
@@ -348,7 +348,7 @@ function materializeUserAttachment(
     }
     return {
       kind: "stored",
-      stored: createInlineAttachment(
+      stored: await createInlineAttachment(
         conversationId,
         conversationCreatedAt,
         a.filename,
@@ -376,10 +376,10 @@ function materializeUserAttachment(
 }
 
 /** Build the `workspace_ref` content block for a materialized attachment. */
-function referenceBlockForAttachment(
+async function referenceBlockForAttachment(
   a: MessageAttachmentInput,
   stored: { id: string; mimeType: string; sizeBytes: number },
-): ContentBlock {
+): Promise<ContentBlock> {
   const ref: AttachmentReferenceInput = {
     attachmentId: stored.id,
     filename: a.filename,
@@ -388,7 +388,10 @@ function referenceBlockForAttachment(
     extractedText: a.extractedText,
   };
   if (stored.mimeType.toLowerCase().startsWith("image/")) {
-    const dims = computeReferenceImageDimensions(stored.id, stored.mimeType);
+    const dims = await computeReferenceImageDimensions(
+      stored.id,
+      stored.mimeType,
+    );
     if (dims) {
       ref.width = dims.width;
       ref.height = dims.height;
@@ -399,13 +402,13 @@ function referenceBlockForAttachment(
 
 /** Inline base64 fallback block for an attachment that could not be stored as
  * a reference, so the upload survives a reload. Null when there are no bytes. */
-function inlineBlockForAttachment(
+async function inlineBlockForAttachment(
   a: MessageAttachmentInput,
-): ContentBlock | null {
+): Promise<ContentBlock | null> {
   if (!a.data) {
     return null;
   }
-  return attachmentsToContentBlocks([a])[0] ?? null;
+  return (await attachmentsToContentBlocks([a]))[0] ?? null;
 }
 
 /**
@@ -419,15 +422,15 @@ function inlineBlockForAttachment(
  * survives; a validation/upload rejection is dropped (never reaches content or
  * the model).
  */
-function prepareUserAttachmentReferences(
+async function prepareUserAttachmentReferences(
   conversationId: string,
   conversationCreatedAt: number,
   attachments: MessageAttachmentInput[],
-): PreparedUserAttachment[] {
+): Promise<PreparedUserAttachment[]> {
   const prepared: PreparedUserAttachment[] = [];
   for (let i = 0; i < attachments.length; i++) {
     const a = attachments[i];
-    const outcome = materializeUserAttachment(
+    const outcome = await materializeUserAttachment(
       conversationId,
       conversationCreatedAt,
       a,
@@ -435,7 +438,7 @@ function prepareUserAttachmentReferences(
     if (outcome.kind === "stored") {
       prepared.push({
         position: i,
-        block: referenceBlockForAttachment(a, outcome.stored),
+        block: await referenceBlockForAttachment(a, outcome.stored),
         link: { attachmentId: outcome.stored.id },
       });
       continue;
@@ -445,7 +448,7 @@ function prepareUserAttachmentReferences(
     }
     // transient: keep the upload by inlining its bytes (dropped only when the
     // recoverable failure left us with no bytes to inline).
-    const inline = inlineBlockForAttachment(a);
+    const inline = await inlineBlockForAttachment(a);
     if (inline) {
       prepared.push({ position: i, block: inline });
     } else {
@@ -633,16 +636,17 @@ export function enqueueMessage(
   }
   // Ack the accepted enqueue on the sender's event sink. Emitting here,
   // rather than at each ingress call site, is what guarantees every path
-  // that queues (HTTP send, surface actions, agent wake, subagent
-  // notifications) surfaces the queued row live. Hidden sends are
-  // suppressed from the transcript at every stage, including this ack,
-  // and `position` counts visible items only: both mirror the
-  // list-messages queued-snapshot filter so a live ack and a cold reload
-  // render the same row at the same position.
-  if (!isHiddenMessageMetadata(metadata)) {
+  // that queues a person's prompt (HTTP send, surface actions, CLI signal)
+  // surfaces the queued row live. Rows with no client-visible counterpart —
+  // hidden sends and daemon-injected notifications (subagent/ACP/wake) — are
+  // suppressed from the transcript at every stage, including this ack, and
+  // `position` counts visible items only: both mirror the list-messages
+  // queued-snapshot filter so a live ack and a cold reload render the same
+  // row at the same position.
+  if (!isSuppressedQueuedMessage(metadata)) {
     const position = ctx.queue
       .snapshot()
-      .filter((item) => !isHiddenMessageMetadata(item.metadata)).length;
+      .filter((item) => !isSuppressedQueuedMessage(item.metadata)).length;
     onEvent?.({
       type: "message_queued",
       conversationId: ctx.conversationId,
@@ -699,6 +703,19 @@ export interface PersistMessageOptions {
    * thread it: the queue round-trips `metadata`, not these options.
    */
   scripted?: boolean;
+  /**
+   * OS surface this row's own request or transport reported, threaded by the
+   * ingress that built it (the send route's request body, a queued message's
+   * `transport`). Stamps `metadata.clientOsFromRequest` when it matches the
+   * `client.os` this row persists.
+   *
+   * `ctx.clientOs` alone is not that evidence: it is a live conversation
+   * field only a transport-carrying message refreshes, so a transport-less
+   * turn (surface action, signal ingress) inherits whatever an earlier send
+   * left there. Omitting this option therefore reads as "inherited", which is
+   * what a consumer that must not misattribute a turn to a surface needs.
+   */
+  requestClientOs?: string;
 }
 
 // ── persistUserMessage ───────────────────────────────────────────────
@@ -767,9 +784,9 @@ export async function persistUserMessage(
     return result;
   } catch (err) {
     // Clear the flag, but never let a clear failure mask the original error
-    // or skip the bookkeeping reset. `setProcessing` reverts its own
-    // in-memory flag when its persist throws, so the conversation is left
-    // consistent either way.
+    // or skip the bookkeeping reset. `setProcessing(false)` releases in memory
+    // regardless of its advisory mirror write, so the guard here is purely
+    // defensive against future changes.
     try {
       ctx.setProcessing(false);
     } catch (clearErr) {
@@ -807,6 +824,7 @@ export async function persistQueuedMessageBody(
     displayContent,
     clientMessageId,
     skipIndexing,
+    requestClientOs,
   } = options;
   const attachmentInputs: MessageAttachmentInput[] = attachments.map(
     (attachment) => ({
@@ -818,7 +836,7 @@ export async function persistQueuedMessageBody(
       filePath: attachment.filePath,
     }),
   );
-  const cleanMessage = createUserMessage(content, attachmentInputs);
+  const cleanMessage = await createUserMessage(content, attachmentInputs);
   let pushedToHistory = false;
 
   try {
@@ -839,13 +857,19 @@ export async function persistQueuedMessageBody(
     // non-boolean through would be worse than dropping it: sqlite stores it
     // verbatim, and `turn-events-store` narrows anything that isn't 1 to
     // `false`, turning a junk string into a confident "the user typed this".
+    // `clientOsFromRequest` comes out for the same reason and a sharper one:
+    // it is derived below from what this persist can actually see, and a bag
+    // value surviving the spread would let a caller assert an origin the row
+    // never reported.
     const {
       slackInbound: rawSlackInbound,
       scripted: rawScriptedFromMetadata,
+      clientOsFromRequest: _rawClientOsFromRequest,
       ...metadataWithoutSlackInbound
     } = (metadata ?? {}) as Record<string, unknown> & {
       slackInbound?: SlackInboundMessageMetadata;
       scripted?: unknown;
+      clientOsFromRequest?: unknown;
     };
     const slackMeta = buildSlackMetaForPersistence({
       slackInbound: rawSlackInbound,
@@ -895,6 +919,22 @@ export async function persistQueuedMessageBody(
     const clientBag =
       Object.keys(clientEntries).length > 0 ? { client: clientEntries } : {};
 
+    // Per-row evidence for the `client.os` stamped just above, kept as a
+    // sibling of the bag so `TurnTelemetryEvent.client` stays exactly the
+    // forwarded `$.client`. Set only when this row itself reported the OS:
+    // through the caller's own client bag (the request's client-metadata
+    // headers, round-tripped through the queue) or through this row's
+    // transport, which `requestClientOs` carries. An inherited `ctx.clientOs`
+    // names the surface of an EARLIER turn, so it leaves the marker off and a
+    // consumer reading origin (the reply-push presence gate) treats the turn
+    // as coming from somewhere unknown.
+    const callerOs = callerClient?.os;
+    const resolvedRequestClientOs = parseClientOs(requestClientOs);
+    const clientOsFromRequest =
+      (typeof callerOs === "string" && callerOs.length > 0) ||
+      (resolvedRequestClientOs !== null &&
+        resolvedRequestClientOs === clientOs);
+
     const mergedMetadata = {
       ...metadataWithoutSlackInbound,
       ...provenance,
@@ -911,6 +951,7 @@ export async function persistQueuedMessageBody(
           }
         : {}),
       ...clientBag,
+      ...(clientOsFromRequest ? { clientOsFromRequest: true } : {}),
       ...(imageSourcePaths ? { imageSourcePaths } : {}),
       ...(slackMeta ? { slackMeta } : {}),
       // Scripted-turn marker, forwarded by `turn-events-store` onto
@@ -944,7 +985,7 @@ export async function persistQueuedMessageBody(
     // once the message id exists.
     const conversationCreatedAt =
       getConversation(ctx.conversationId)?.createdAt ?? Date.now();
-    const preparedAttachments = prepareUserAttachmentReferences(
+    const preparedAttachments = await prepareUserAttachmentReferences(
       ctx.conversationId,
       conversationCreatedAt,
       attachmentInputs,
@@ -1011,9 +1052,9 @@ export async function persistQueuedMessageBody(
     // by rewriting that block to inline base64 so the upload survives even
     // though the store anchor was lost, then persist the corrected content.
     let repairedBlocks: ContentBlock[] | null = null;
-    preparedAttachments.forEach((p, idx) => {
+    for (const [idx, p] of preparedAttachments.entries()) {
       if (!p.link) {
-        return;
+        continue;
       }
       try {
         const scopedAttachmentId = linkAttachmentToMessage(
@@ -1024,7 +1065,9 @@ export async function persistQueuedMessageBody(
         attachmentInputs[p.position].storedPath =
           getFilePathForAttachment(scopedAttachmentId) ?? undefined;
       } catch (err) {
-        const inline = inlineBlockForAttachment(attachmentInputs[p.position]);
+        const inline = await inlineBlockForAttachment(
+          attachmentInputs[p.position],
+        );
         log.error(
           { attachmentId: p.link.attachmentId, err, repaired: inline != null },
           "Failed to link user attachment; repairing persisted content to inline",
@@ -1034,7 +1077,7 @@ export async function persistQueuedMessageBody(
           repairedBlocks[idx] = inline;
         }
       }
-    });
+    }
     if (repairedBlocks) {
       updateMessageContent(
         persistedUserMessage.id,