@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/providers/server-tool-pairing.ts

@@ -0,0 +1,134 @@
+// Single source of truth for pairing server-side tool blocks (e.g. native
+// web_search) across a message list. Pure leaf module: consumed by the
+// provider formatter, load-time history repair, and any other pass that must
+// distinguish a genuine orphan from a pair the provider manages itself.
+
+/**
+ * Minimal structural message shape shared by daemon `Message[]` and
+ * `Anthropic.MessageParam[]`.
+ */
+export interface ServerToolPairingMessage {
+  role: string;
+  content: string | ReadonlyArray<unknown>;
+}
+
+/** Type-guard for server_tool_use blocks. */
+export function isServerToolUseBlock(
+  block: unknown,
+): block is { type: "server_tool_use"; id: string; name: string } {
+  return (
+    typeof block === "object" &&
+    block != null &&
+    (block as { type: string }).type === "server_tool_use"
+  );
+}
+
+/** Type-guard for web_search_tool_result blocks. */
+export function isWebSearchToolResultBlock(block: unknown): block is {
+  type: "web_search_tool_result";
+  tool_use_id: string;
+  content: unknown;
+} {
+  return (
+    typeof block === "object" &&
+    block != null &&
+    (block as { type: string }).type === "web_search_tool_result"
+  );
+}
+
+function isToolResultShapedBlock(block: unknown): boolean {
+  return (
+    typeof block === "object" &&
+    block != null &&
+    (block as { type?: string }).type === "tool_result"
+  );
+}
+
+function contentBlocks(msg: ServerToolPairingMessage): ReadonlyArray<unknown> {
+  return Array.isArray(msg.content) ? msg.content : [];
+}
+
+/**
+ * Pairing analysis for server-side tool blocks across the whole message list.
+ *
+ * Server-side tools are provider-executed, and the pair can legitimately span
+ * messages: when the model requests a server tool and a client tool in the
+ * same parallel tool-call group, the API defers the search (stop_reason
+ * `tool_use`, no result emitted) and executes it on the next request, placing
+ * the web_search_tool_result at the head of the next assistant message. Both
+ * the deferred tail and the resulting split pair must be sent back verbatim
+ * for the provider to pair and execute them.
+ */
+export interface ServerToolPairing {
+  /**
+   * Ids with a complete use/result pair: the server_tool_use appears in the
+   * same message as its web_search_tool_result or in an earlier one.
+   */
+  resolvedPairIds: Set<string>;
+  /**
+   * Unanswered use ids in the final assistant message of an active tool-loop
+   * continuation (only user messages after it, carrying tool_result blocks or
+   * nothing at all). The provider executes these on this request.
+   */
+  deferredUseIds: Set<string>;
+  /** Ids whose use/result pair spans two messages. */
+  crossMessageIds: Set<string>;
+}
+
+export function analyzeServerToolPairing(
+  messages: ReadonlyArray<ServerToolPairingMessage>,
+): ServerToolPairing {
+  const useIndexById = new Map<string, number>();
+  const resultIndexById = new Map<string, number>();
+  let lastAssistantIndex = -1;
+
+  messages.forEach((msg, index) => {
+    if (msg.role !== "assistant") {
+      // Server-tool blocks legitimately live only in assistant messages; a
+      // stray result in a user message is a repair concern, not a pair.
+      return;
+    }
+    lastAssistantIndex = index;
+    for (const block of contentBlocks(msg)) {
+      if (isServerToolUseBlock(block) && !useIndexById.has(block.id)) {
+        useIndexById.set(block.id, index);
+      }
+      if (
+        isWebSearchToolResultBlock(block) &&
+        !resultIndexById.has(block.tool_use_id)
+      ) {
+        resultIndexById.set(block.tool_use_id, index);
+      }
+    }
+  });
+
+  const resolvedPairIds = new Set<string>();
+  const crossMessageIds = new Set<string>();
+  useIndexById.forEach((useIndex, id) => {
+    const resultIndex = resultIndexById.get(id);
+    if (resultIndex !== undefined && resultIndex >= useIndex) {
+      resolvedPairIds.add(id);
+      if (resultIndex > useIndex) {
+        crossMessageIds.add(id);
+      }
+    }
+  });
+
+  const deferredUseIds = new Set<string>();
+  if (lastAssistantIndex >= 0) {
+    const trailing = messages.slice(lastAssistantIndex + 1);
+    const trailingAllUser = trailing.every((m) => m.role === "user");
+    const trailingHasToolResult = trailing.some((m) =>
+      contentBlocks(m).some(isToolResultShapedBlock),
+    );
+    if (trailingAllUser && (trailing.length === 0 || trailingHasToolResult)) {
+      for (const block of contentBlocks(messages[lastAssistantIndex])) {
+        if (isServerToolUseBlock(block) && !resolvedPairIds.has(block.id)) {
+          deferredUseIds.add(block.id);
+        }
+      }
+    }
+  }
+
+  return { resolvedPairIds, deferredUseIds, crossMessageIds };
+}

package/src/providers/speech-to-text/__tests__/resolve.test.ts

@@ -58,9 +58,27 @@ mock.module("../../../security/credential-key.js", () => ({
 
 let mockVellumAvailable = false;
 
+/**
+ * Arguments the managed batch adapter was called with. The managed path has
+ * no constructor to spy on (the platform connection is the credential), so
+ * the language it forwards is observable only at the transcribe call.
+ */
+const vellumManagedTranscribeCalls: Array<{
+  mimeType: string;
+  language: string | undefined;
+}> = [];
+
 mock.module("../vellum-managed.js", () => ({
   vellumManagedSpeechAvailable: async () => mockVellumAvailable,
-  vellumManagedTranscribe: async () => ({ text: "" }),
+  vellumManagedTranscribe: async (
+    _audio: Buffer,
+    mimeType: string,
+    _signal?: AbortSignal,
+    language?: string,
+  ) => {
+    vellumManagedTranscribeCalls.push({ mimeType, language });
+    return { text: "" };
+  },
   sttErrorFromManagedSpeech: (failure: unknown) => new Error(String(failure)),
 }));
 
@@ -172,6 +190,7 @@ mock.module("../xai-realtime.js", () => ({
 // ---------------------------------------------------------------------------
 
 const {
+  effectiveSttLanguage,
   resolveBatchTranscriber,
   sttCredentialGapReason,
   resolveConversationStreamingSttCapability,
@@ -1044,7 +1063,9 @@ describe("vellum managed resolution", () => {
     expect(vellumStreamCtorCalls).toEqual([
       {
         connection: mockVelayConnection,
-        options: { sampleRate: 24000 },
+        // No language is configured here, so the managed default rides along
+        // with the connection plumbing this test is about.
+        options: { sampleRate: 24000, language: "multi" },
       },
     ]);
   });
@@ -1178,16 +1199,76 @@ describe("resolveStreamingTranscriber language plumbing", () => {
     expect(deepgramCtorCalls[0]?.options).toMatchObject({ language: "hi" });
   });
 
-  test("no configured language leaves the option off entirely", async () => {
-    // Regression guard for the default path: adapters must see no `language`
-    // key at all, so behavior for existing users is byte-identical.
+  test("no configured language falls to multilingual on BYOK Deepgram", async () => {
+    // Unset is not a neutral state on Deepgram: sending no language decodes
+    // as English, so an unconfigured Hindi speaker gets English-sounding
+    // nonsense. The default fills that gap with code-switching, which also
+    // pins nova-3 the way any explicit language does.
     mockProviderKeys = { deepgram: "dg-key" };
     applyConfig({ provider: "deepgram" });
 
     await resolveStreamingTranscriber({ sampleRate: 16000 });
 
     expect(deepgramCtorCalls).toHaveLength(1);
-    expect(deepgramCtorCalls[0]?.options).not.toHaveProperty("language");
+    expect(deepgramCtorCalls[0]?.options).toMatchObject({
+      language: "multi",
+      model: "nova-3",
+    });
+  });
+
+  test("no configured language falls to multilingual on the managed relay", async () => {
+    // The relay dials Deepgram server-side, so it inherits the same English
+    // default and needs the same fill-in.
+    mockVellumAvailable = true;
+    mockVelayConnection = {
+      wsBaseUrl: "ws://gateway.test",
+      httpBaseUrl: "http://gateway.test",
+      mintServiceToken: () => "vk-test",
+    };
+    applyConfig({ provider: "vellum" });
+
+    await resolveStreamingTranscriber({ sampleRate: 24000 });
+
+    expect(vellumStreamCtorCalls).toEqual([
+      {
+        connection: mockVelayConnection,
+        options: { sampleRate: 24000, language: "multi" },
+      },
+    ]);
+  });
+
+  test("an explicitly configured language still wins over the default", async () => {
+    // The default only fills the unset case: someone who picked Tamil (off
+    // the code-switching roster entirely) must keep it.
+    mockProviderKeys = { deepgram: "dg-key" };
+    applyConfig({ provider: "deepgram", language: "ta" });
+
+    await resolveStreamingTranscriber({ sampleRate: 16000 });
+
+    expect(deepgramCtorCalls[0]?.options).toMatchObject({ language: "ta" });
+  });
+
+  test("an explicit English pin is honored rather than treated as unset", async () => {
+    // "en" is what the settings picker writes for a deliberate English pin,
+    // so it must not collapse back into the multilingual default.
+    mockProviderKeys = { deepgram: "dg-key" };
+    applyConfig({ provider: "deepgram", language: "en" });
+
+    await resolveStreamingTranscriber({ sampleRate: 16000 });
+
+    expect(deepgramCtorCalls[0]?.options).toMatchObject({ language: "en" });
+  });
+
+  test("providers that detect natively keep receiving no language when unset", async () => {
+    // xAI reads unset as native auto-detection, so the multilingual default
+    // would replace a broader capability with a ten-language one.
+    mockProviderKeys = { xai: "xai-key" };
+    applyConfig({ provider: "xai" });
+
+    await resolveStreamingTranscriber({ sampleRate: 16000 });
+
+    expect(xaiCtorCalls).toHaveLength(1);
+    expect(xaiCtorCalls[0]?.options).not.toHaveProperty("language");
   });
 
   test("providers that auto-detect natively never receive a language", async () => {
@@ -1245,6 +1326,61 @@ describe("resolveStreamingTranscriber language plumbing", () => {
       model: "nova-3",
     });
   });
+
+  test("managed batch forwards the configured language to the platform", async () => {
+    // The platform proxy passes it to Deepgram server-side, so a managed
+    // voice note decodes in the same language the live session does.
+    vellumManagedTranscribeCalls.length = 0;
+    mockVellumAvailable = true;
+    applyConfig({ provider: "vellum", language: "ta" });
+
+    const transcriber = await resolveBatchTranscriber();
+    await transcriber!.transcribe({
+      audio: Buffer.from("fake-audio"),
+      mimeType: "audio/ogg",
+    });
+
+    expect(vellumManagedTranscribeCalls).toHaveLength(1);
+    expect(vellumManagedTranscribeCalls[0]?.language).toBe("ta");
+  });
+
+  test("managed batch falls to multilingual when no language is configured", async () => {
+    // The gap this closes: managed voice notes used to decode as English no
+    // matter what the user had chosen, because nothing was forwarded.
+    vellumManagedTranscribeCalls.length = 0;
+    mockVellumAvailable = true;
+    applyConfig({ provider: "vellum" });
+
+    const transcriber = await resolveBatchTranscriber();
+    await transcriber!.transcribe({
+      audio: Buffer.from("fake-audio"),
+      mimeType: "audio/ogg",
+    });
+
+    expect(vellumManagedTranscribeCalls).toHaveLength(1);
+    expect(vellumManagedTranscribeCalls[0]?.language).toBe("multi");
+  });
+
+  test("batch resolution falls to multilingual when no language is configured", async () => {
+    // Dictation and voice notes ride the batch path, and they read the same
+    // config the live session does. A user whose spoken language works in
+    // voice mode must not find it broken in a voice note.
+    deepgramBatchCtorCalls.length = 0;
+    mockProviderKeys = { deepgram: "dg-key" };
+    applyConfig({ provider: "deepgram" });
+
+    const transcriber = await resolveBatchTranscriber();
+    await transcriber!.transcribe({
+      audio: Buffer.from("fake-audio"),
+      mimeType: "audio/ogg",
+    });
+
+    expect(deepgramBatchCtorCalls).toHaveLength(1);
+    expect(deepgramBatchCtorCalls[0]?.options).toMatchObject({
+      language: "multi",
+      model: "nova-3",
+    });
+  });
 });
 
 describe("sttCredentialGapReason", () => {
@@ -1254,3 +1390,48 @@ describe("sttCredentialGapReason", () => {
     expect(sttCredentialGapReason("deepgram")).toContain("API key");
   });
 });
+
+describe("effectiveSttLanguage", () => {
+  test("fills the unset case only where unset would mean English", () => {
+    // Deepgram and the managed relay decode language-less audio as English,
+    // so leaving them unset is a silent pin rather than a neutral state.
+    expect(effectiveSttLanguage("deepgram", undefined)).toBe("multi");
+    expect(effectiveSttLanguage("vellum", undefined)).toBe("multi");
+    // Everyone else detects natively from the audio; filling in a ten-language
+    // roster would narrow what they can already do.
+    expect(effectiveSttLanguage("xai", undefined)).toBeUndefined();
+    expect(effectiveSttLanguage("google-gemini", undefined)).toBeUndefined();
+    expect(effectiveSttLanguage("openai-whisper", undefined)).toBeUndefined();
+  });
+
+  test("a configured language always wins, including English", () => {
+    // The default decides what happens when nobody has chosen, nothing more.
+    expect(effectiveSttLanguage("deepgram", "ta")).toBe("ta");
+    expect(effectiveSttLanguage("deepgram", "en")).toBe("en");
+    expect(effectiveSttLanguage("vellum", "multi")).toBe("multi");
+    expect(effectiveSttLanguage("xai", "hi")).toBe("hi");
+  });
+});
+
+describe("the multilingual default reaches configs with no stt block", () => {
+  test("a config that omits services.stt entirely still resolves multilingual", () => {
+    // The services-level default supplies the stt block for a fresh
+    // workspace. Handing that default a literal would short-circuit the
+    // inner parse and leave `language` undefined, so the block is parsed
+    // through its own schema and the field default materializes.
+    setConfig("services", {});
+    expect(getConfig().services.stt.language).toBe("multi");
+  });
+
+  test("a config that omits only the language gets it filled", () => {
+    setConfig("services", { stt: { provider: "deepgram", providers: {} } });
+    expect(getConfig().services.stt.language).toBe("multi");
+  });
+
+  test("an explicit language is never overwritten by the default", () => {
+    setConfig("services", {
+      stt: { provider: "deepgram", language: "ta", providers: {} },
+    });
+    expect(getConfig().services.stt.language).toBe("ta");
+  });
+});

package/src/providers/speech-to-text/deepgram.ts

@@ -105,6 +105,7 @@ export const DEEPGRAM_NOVA3_MONOLINGUAL_CODES = [
   "tl",
   "tr",
   "uk",
+  "ur",
   "vi",
   "zh",
 ] as const;

package/src/providers/speech-to-text/resolve.ts

@@ -16,6 +16,64 @@ import {
 
 const log = getLogger("stt-resolver");
 
+// ---------------------------------------------------------------------------
+// Default spoken language
+// ---------------------------------------------------------------------------
+
+/**
+ * Providers that decode language-less audio as English rather than detecting
+ * the spoken language: Deepgram directly, and the managed relay, which dials
+ * Deepgram server-side. For these, an unset `services.stt.language` is not a
+ * neutral state: it is a silent English pin that returns non-English speech
+ * as English-sounding nonsense.
+ *
+ * Providers absent from this set need no default: xAI, Gemini and Whisper all
+ * detect natively from the audio when no language is sent.
+ */
+const MULTILINGUAL_DEFAULT_PROVIDERS: ReadonlySet<SttProviderId> = new Set([
+  "deepgram",
+  "vellum",
+] as SttProviderId[]);
+
+/**
+ * The language an unset config resolves to on the providers above: nova-3's
+ * code-switching mode, which follows a speaker between the ten languages of
+ * Deepgram's multi roster (`DEEPGRAM_MULTI_LANGUAGE_CODES` in `deepgram.ts`)
+ * without being told which one they are speaking. Chosen over an English pin
+ * because the failure it replaces is
+ * silent: a Hindi speaker under the English default gets fluent-looking
+ * garbage rather than an error, and has no way to tell recognition is
+ * misconfigured from the transcript alone.
+ *
+ * It is a default, not a ceiling. Speakers of the other 39 languages on the
+ * monolingual roster still pick theirs explicitly, and that pick continues to
+ * win here. This only decides what happens when nobody has chosen.
+ */
+const DEFAULT_MULTILINGUAL_CODE = "multi";
+
+/**
+ * The spoken language to transcribe with, given what config holds and which
+ * provider will receive it. Configured values always win; the default only
+ * fills the unset case, and only where unset would otherwise mean English.
+ *
+ * Applied inside the resolvers rather than at the config layer so config keeps
+ * recording what the user chose (or that they chose nothing). The settings
+ * surfaces read that distinction to show which rows are defaults, and the live
+ * session compares raw config values to decide whether a language change needs
+ * a re-dial.
+ */
+export function effectiveSttLanguage(
+  providerId: SttProviderId,
+  configured: string | undefined,
+): string | undefined {
+  if (configured) {
+    return configured;
+  }
+  return MULTILINGUAL_DEFAULT_PROVIDERS.has(providerId)
+    ? DEFAULT_MULTILINGUAL_CODE
+    : undefined;
+}
+
 // ---------------------------------------------------------------------------
 // Batch transcriber resolver (existing public API — unchanged contract)
 // ---------------------------------------------------------------------------
@@ -38,7 +96,10 @@ export async function resolveBatchTranscriber(): Promise<BatchTranscriber | null
   // change cannot pair one setting's old value with another's new value.
   const stt = getConfig().services.stt;
   const provider = stt.provider;
-  const language = stt.language;
+  const language = effectiveSttLanguage(
+    provider as SttProviderId,
+    stt.language,
+  );
 
   // Look up credential provider via the catalog.
   const credentialProviderName = getCredentialProvider(
@@ -54,11 +115,12 @@ export async function resolveBatchTranscriber(): Promise<BatchTranscriber | null
   }
 
   if (provider === "vellum") {
-    // Managed batch transcription rides the platform's speech proxy, which
-    // accepts no language parameter, so `services.stt.language` does not
-    // apply here; streaming is the path that honors it for managed speech.
+    // Managed batch rides the platform's speech proxy, which forwards the
+    // language to Deepgram server-side. A platform build predating that
+    // field ignores it rather than failing, so the daemon can send one
+    // before the platform side deploys.
     return (await sttProviderKeyResolves("vellum"))
-      ? createDaemonBatchTranscriber(null, "vellum")
+      ? createDaemonBatchTranscriber(null, "vellum", language)
       : null;
   }
 
@@ -304,9 +366,11 @@ export interface ResolveStreamingTranscriberOptions {
    * Defaults to `services.stt.language`; pass explicitly to override the
    * config for a single session.
    *
-   * See {@link CreateStreamingTranscriberOptions.language} for how each
-   * provider treats it: notably, leaving it unset is not auto-detection on
-   * Deepgram or the managed relay.
+   * Leaving both unset does not reach the adapters as "no language": on
+   * Deepgram and the managed relay, where that would mean English rather
+   * than detection, {@link effectiveSttLanguage} fills in code-switching
+   * first. See {@link CreateStreamingTranscriberOptions.language} for how
+   * each adapter treats what it finally receives.
    */
   language?: string;
 }
@@ -339,8 +403,14 @@ export async function resolveStreamingTranscriber(
   const provider = options.providerId ?? (stt.provider as SttProviderId);
   // Config-level language applies to every streaming caller (live voice,
   // dictation, telephony) unless one overrides it for a single session, so
-  // the setting lands in one place rather than at each call site.
-  const language = options.language ?? stt.language;
+  // the setting lands in one place rather than at each call site. An unset
+  // config falls to the provider's default (see `effectiveSttLanguage`),
+  // which is where a caller passing no language gets multilingual rather
+  // than a silent English pin.
+  const language = effectiveSttLanguage(
+    provider,
+    options.language ?? stt.language,
+  );
   const diarizePreference: DiarizePreference = options.diarize ?? "off";
 
   // Look up credential provider via the catalog.

package/src/providers/speech-to-text/vellum-managed.ts

@@ -95,8 +95,14 @@ export async function vellumManagedTranscribe(
   audio: Buffer,
   mimeType: string,
   signal?: AbortSignal,
+  language?: string,
 ): Promise<SttTranscribeResult> {
-  const result = await managedSpeechTranscribe({ audio, mimeType, signal });
+  const result = await managedSpeechTranscribe({
+    audio,
+    mimeType,
+    signal,
+    language,
+  });
   if (!result.ok) {
     throw sttErrorFromManagedSpeech(result);
   }

package/src/providers/speech-to-text/vellum-speech-relay-connection.ts

@@ -59,7 +59,9 @@ export async function resolveSpeechRelayConnection(): Promise<SpeechRelayConnect
     mintToken({
       aud: "vellum-gateway",
       sub: DAEMON_SERVICE_SUB,
-      scope_profile: "gateway_service_v1",
+      // Least-privilege (ATL-1033): this token rides in the dial URL, so it
+      // must open nothing but the speech relay.
+      scope_profile: "speech_relay_v1",
       policy_epoch: CURRENT_POLICY_EPOCH,
       ttlSeconds: RELAY_TOKEN_TTL_SECONDS,
     });

package/src/providers/types.ts

@@ -332,12 +332,32 @@ export interface SendMessageConfig {
    */
   logit_bias?: Record<string, number>;
   /**
-   * When true, the most recent user message's content varies across
-   * otherwise-identical turns (e.g. a per-turn memory block was injected into
-   * it). The provider places the primary long-TTL cache breakpoint on the most
-   * recent *stable* user message instead of the volatile latest one, so the
-   * cached prefix stays reusable across turns. Default false — existing
-   * behavior.
+   * When true, the TURN-STARTING user message carries content that will not
+   * recur byte-identically on the next turn, so a long-TTL breakpoint placed
+   * on it could never be read back across turns. The agent loop is the only
+   * producer: it sets the flag from the history it is about to send, when the
+   * turn-starting message carries a memory-v3 `<memory_spotlight>` block (the
+   * one injected block strip-and-replaced from every user message each turn).
+   *
+   * The flag describes the turn, not the request, so it holds for every
+   * request the turn makes, including tool-loop iterations, whose trailing
+   * tool-result message is user-role but carries no injected blocks.
+   *
+   * Consumed by the Anthropic client only, where it selects the TTL of the
+   * turn-start breakpoint: short instead of long. The block is still marked,
+   * so the turn's tool-loop iterations read the prefix back and each hit
+   * refreshes the entry; nothing is spent on a long-TTL entry whose bytes
+   * change before the next turn could reach it. Holding the flag steady across
+   * the turn is what keeps that one boundary on a single TTL; marking it at
+   * two would bill two writes for one reusable prefix.
+   *
+   * The OpenAI Responses transport ignores the flag and marks every markable
+   * user item: a volatile message is fixed within its own turn, so the write is
+   * prepaid once and read back by each tool-loop iteration.
+   *
+   * Default false. Providers that place no message-level breakpoints, or that
+   * key their cache on a request-level identifier rather than message bytes,
+   * can ignore it.
    */
   mutableLatestUserMessage?: boolean;
   /**

package/src/providers/vellum-model-routing.ts

@@ -55,16 +55,15 @@ export const VELLUM_MANAGED_CONNECTION_NAME = "vellum";
 
 /**
  * Whether a connection is the provider-agnostic Vellum-managed connection.
+ * The provider column alone identifies the managed route: platform auth
+ * always accompanies it (auth derivation pairs them, the connection routes
+ * reject writes that split them, and DB migration 361 reconciles stored
+ * rows).
  * Structurally typed so this stays a pure module with no connection-schema
  * import.
  */
-export function isVellumManagedConnection(conn: {
-  provider: string;
-  auth: { type: string };
-}): boolean {
-  return (
-    conn.provider === VELLUM_MANAGED_PROVIDER && conn.auth.type === "platform"
-  );
+export function isVellumManagedConnection(conn: { provider: string }): boolean {
+  return conn.provider === VELLUM_MANAGED_PROVIDER;
 }
 
 export interface VellumModelRoute {

package/src/runtime/AGENTS.md

@@ -12,6 +12,8 @@ The single HTTP send endpoint is `POST /v1/messages`. Key behaviors:
 
 Do NOT add new send endpoints. All message ingress should go through `POST /v1/messages` (HTTP).
 
+**A user interrupt ends the turn, not the queue.** `POST /v1/conversations/:id/cancel` (Stop / Esc, and the CLI's cancel signal file) aborts the turn in flight; anything the same user queued behind it survives and runs on that turn's drain, because the aborted loop reaches its `finally`, which calls `kickDrainQueue` like any other turn end. `abortConversation` discards the queue only for abort kinds where the conversation itself is going away (dispose, eviction, voice supersession, subagent teardown), and every discarded row a client is showing gets `message_queued_deleted` alongside `generation_cancelled` (echo-suppressed rows are skipped, since they never got a `message_queued` ack to close). Two invariants to keep: an unconditional `queue.clear()` emits no per-row terminal event, so clients keep rendering a queued row whose cancel/steer buttons are dead (DELETE 404s, steer reports `not_processing`) and whose message is silently lost on the next reload; and a teardown must discard even when the processing flag already reads idle, since a turn that cleared the flag can still be unwinding through its awaited turn-boundary commit with a `kickDrainQueue` ahead of it.
+
 ### Channel inbound honors "queue if busy" via defer-until-idle
 
 Channel inbound turns (Slack/Telegram/etc. — `processChannelMessageInBackground`) obey the same "process when the current turn completes" contract, but they do **not** route through the conversation's queue. A channel turn delivers its reply back through the provider callback URL (streaming session + `finalizeEventDelivery` + processed/delivery bookkeeping); the queue drain fans replies onto the SSE hub only and performs none of that. So a channel turn that arrives while the conversation is mid-turn is **deferred until the processing lock frees** (`withChannelTurnAdmission` in `routes/inbound-stages/channel-turn-admission.ts`: per-conversation single-flight for FIFO ordering + event-driven `waitForIdle`), then run with its delivery orchestration intact.