@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/daemon/conversation-tool-setup.ts

@@ -83,10 +83,10 @@ import { FALLBACK_TURN_TRUST, resolveTrustClass } from "./trust-context.js";
 
 const log = getLogger("conversation-tool-setup");
 
-import type { ToolSetupContext } from "./tool-setup-types.js";
+import type { SubagentToolStats } from "./tool-setup-types.js";
 export type {
   SubagentToolGateMode,
-  ToolSetupContext,
+  SubagentToolStats,
   WakeToolContextPin,
 } from "./tool-setup-types.js";
 
@@ -112,7 +112,7 @@ export type {
  */
 export function resolveConversationAttribution(
   ctx: Pick<
-    ToolSetupContext,
+    Conversation,
     "conversationId" | "currentCallSite" | "currentTurnOverrideProfile"
   >,
 ): UsageAttributionSnapshot | null {
@@ -197,8 +197,13 @@ export function getEffectiveEnabledPluginSet(conv: {
  * own implementation) does not slip through. `skill_execute` is the dispatcher —
  * its resolved inner tool is classified by the same check in the executor gate,
  * so exposing the wrapper is safe.
+ *
+ * Exported so a role allowlist that relies on this gate for its read-only
+ * guarantee (the advisor consult) can be asserted to stay inside the set: a name
+ * outside it is admitted by the role and then refused at dispatch, which reads
+ * as a broken tool rather than a policy decision.
  */
-const READ_ONLY_ALLOWED_TOOLS: ReadonlySet<string> = new Set([
+export const READ_ONLY_ALLOWED_TOOLS: ReadonlySet<string> = new Set([
   "file_read",
   "file_list",
   "code_search",
@@ -232,7 +237,7 @@ export function createToolExecutor(
   executor: ToolExecutor,
   prompter: PermissionPrompter,
   secretPrompter: SecretPrompter,
-  ctx: ToolSetupContext,
+  ctx: Conversation,
 ): (
   name: string,
   input: Record<string, unknown>,
@@ -311,6 +316,45 @@ export function createToolExecutor(
     };
   };
 
+  // Machine tool-call accounting for the subagent truth envelope. Recorded
+  // here because this closure is the single dispatch choke point every tool
+  // call passes through, including the `skill_execute` indirection (counted
+  // under the resolved inner tool name, not the wrapper). Non-subagent
+  // conversations never reach the counters.
+  const subagentStats = (): SubagentToolStats | undefined =>
+    ctx.isSubagent === true ? ctx.subagentToolStats : undefined;
+
+  const recordToolDispatch = (): void => {
+    const stats = subagentStats();
+    if (stats) {
+      stats.calls++;
+    }
+  };
+
+  const recordToolResult = (
+    toolName: string,
+    toolInput: Record<string, unknown>,
+    result: ToolExecutionResult,
+  ): void => {
+    const stats = subagentStats();
+    if (!stats || result.isError) {
+      return;
+    }
+    stats.succeeded++;
+    // Both file tools name their target `path`. A Set dedupes repeated edits
+    // of the same file, so the count reads as "files touched", not "writes".
+    // These two are the only writes with a path to attribute: a builder can
+    // also write through the shell, a document tool, or an MCP tool, and those
+    // are invisible here, which is why the footer names the two tools it
+    // counts (see `formatSubagentToolStats`).
+    if (toolName === "file_write" || toolName === "file_edit") {
+      const target = toolInput.path;
+      if (typeof target === "string" && target.length > 0) {
+        stats.filesWritten.add(target);
+      }
+    }
+  };
+
   return async (
     name: string,
     input: Record<string, unknown>,
@@ -357,7 +401,7 @@ export function createToolExecutor(
       trustClass: resolveTrustClass(turnTrust),
       executionChannel: turnTrust.sourceChannel,
       requestOrigin: ctx.currentTurnRequestOrigin,
-      sourceActorPrincipalId: turnTrust.guardianPrincipalId,
+      sourceActorPrincipalId: ctx.getTurnActorPrincipalId(),
       callSessionId: ctx.callSessionId,
       triggeredBySurfaceAction:
         ctx.surfaceActionRequestIds?.has(ctx.currentRequestId ?? "") ?? false,
@@ -390,6 +434,7 @@ export function createToolExecutor(
       isPlatformHosted: getIsPlatform(),
       transportInterface: ctx.transportInterface,
       overrideProfile: ctx.currentTurnOverrideProfile,
+      cronRunId: ctx.currentTurnCronRunId,
       invokingCallSite: ctx.currentCallSite ?? "mainAgent",
       attribution: resolveConversationAttribution(ctx),
       enabledPluginSet: effectiveEnabledPluginSet,
@@ -505,12 +550,14 @@ export function createToolExecutor(
         return pluginRejection;
       }
 
+      recordToolDispatch();
       const rawResult = await executor.execute(
         toolName,
         toolInput,
         toolContext,
       );
       const result = augmentSkillExecuteError(toolName, toolInput, rawResult);
+      recordToolResult(toolName, toolInput, result);
       if (toolContext.approvedViaPrompt) {
         ctx.approvedViaPromptThisTurn = true;
       }
@@ -520,11 +567,13 @@ export function createToolExecutor(
       return result;
     }
 
+    recordToolDispatch();
     const result = await executor.execute(
       executionName,
       executionInput,
       toolContext,
     );
+    recordToolResult(executionName, executionInput, result);
     if (toolContext.approvedViaPrompt) {
       ctx.approvedViaPromptThisTurn = true;
     }
@@ -547,7 +596,7 @@ export function createToolExecutor(
  */
 export function createProxyApprovalCallback(
   _prompter: PermissionPrompter,
-  _ctx: ToolSetupContext,
+  _ctx: Conversation,
 ): ProxyApprovalCallback {
   return async (_request: ProxyApprovalRequest): Promise<boolean> => {
     // Proxied asks follow the same non-host auto-allow contract as regular

package/src/daemon/conversation-turn-finalize.ts

@@ -1,5 +1,5 @@
 /**
- * End-of-turn finalize work that runs OFF the send-button critical path.
+ * End-of-turn finalize work that runs after the terminal SSE.
  *
  * The web/Capacitor/CLI clients re-enable the composer the moment they observe
  * the terminal `message_complete` / `assistant_activity_state("idle")` SSE, so
@@ -9,10 +9,21 @@
  * None of the work here gates delivery of the reply: memory/attention indexing
  * only feeds the NEXT turn's retrieval and a sidebar indicator, tool-result
  * truncation only reshapes the in-memory history the next turn is built from,
- * and the disk-view mirror is a durability convenience. The agent loop persists
- * the reply content synchronously and emits the terminal SSE first, then drains
- * this module's work before the turn's `finally` starts the next turn — so the
- * bookkeeping still completes within the turn, just after the composer is free.
+ * and the disk-view mirror is a durability convenience. The work is split by
+ * whether a step is safe to overlap the NEXT turn:
+ *
+ * - {@link settleTurnContent} runs while the turn still holds the processing
+ *   lock. Its steps rewrite `ctx.messages` and append to the conversation's disk
+ *   view, both of which the next turn also writes, so they must finish before
+ *   the lock releases. Every step is synchronous apart from the stranded-content
+ *   fold, so holding the lock across them costs the queue nothing: synchronous
+ *   work blocks the event loop either way.
+ * - {@link runDeferredTurnTail} runs detached, after the lock releases, chained
+ *   by `chainTurnTail` so two turns' tails never overlap each other. Its steps
+ *   are keyed by the message ids this turn produced and are network-bound
+ *   (embeddings, vector upserts, the assistant-reply push notification), which
+ *   is the work that must not hold the lock:
+ *   a slow index otherwise leaves the next send queued behind an idle-looking UI.
  */
 
 import type pino from "pino";
@@ -42,20 +53,25 @@ import {
 } from "./inflight-message-content.js";
 import { conversationMetadataSyncTag } from "./message-types/sync.js";
 
-/** Minimal live-conversation surface the deferred tail reads and rewrites. */
+/** Minimal live-conversation surface the finalize steps read and rewrite. */
 interface TurnTailContext {
   readonly conversationId: string;
   messages: Message[];
 }
 
-/** Minimal per-run handler state the deferred tail consumes. */
-interface TurnTailState {
-  readonly deferredFinalizeEffects: ReadonlyArray<() => Promise<void>>;
+/** Minimal per-run handler state {@link settleTurnContent} consumes. */
+interface TurnContentState {
   readonly lastAssistantMessageId: string | undefined;
   /** In-flight content writers the turn left behind (see EventHandlerState). */
   readonly inflightWriters: Map<string, InflightContentWriter>;
 }
 
+/** Minimal per-run handler state the detached tail consumes. */
+interface TurnTailState {
+  readonly deferredFinalizeEffects: ReadonlyArray<() => Promise<void>>;
+  readonly lastAssistantMessageId: string | undefined;
+}
+
 /**
  * Build the deferred finalize side-effect for one finalized assistant row:
  * memory segment indexing, lexical indexing, and attention projection.
@@ -129,95 +145,36 @@ export function buildDeferredFinalizeEffect(params: {
 }
 
 /**
- * Drain a turn's deferred bookkeeping after the terminal SSE has re-enabled the
- * composer but before the agent loop's `finally` commits and drains the queue
- * for the next turn. Ordering with the next turn is preserved (this completes
- * before `drainQueue`), while the last-token→send-button latency no longer
- * includes it. Every step is best-effort.
+ * Settle the turn's content while the processing lock is still held.
  *
- * `generationCompletedAt` is stamped when the agent loop returns; the emitted
- * `criticalSectionMs` / `deferredTailMs` split makes the previously-uninstrumented
- * end-of-turn window measurable.
+ * These steps run after the terminal SSE (so they are off the last-token to
+ * composer-enabled path) but before the lock releases, because each one writes
+ * a resource the next turn also writes: the in-memory history array and the
+ * conversation's append-only disk view. The processing lock is the only
+ * per-conversation serialization those resources have, so letting these steps
+ * run past the release would let a fast follow-up turn interleave with them.
+ * Every step is best-effort.
  */
-export async function runDeferredTurnTail(params: {
+export async function settleTurnContent(params: {
   ctx: TurnTailContext;
-  state: TurnTailState;
+  state: TurnContentState;
   rlog: pino.Logger;
-  generationCompletedAt: number;
-  /**
-   * True only for a `message_complete` turn that produced a genuine reply. A
-   * handed-off generation is not the end of the run, a cancelled one has no
-   * final reply, and a provider-error turn's only assistant row is the
-   * synthetic error text.
-   */
-  turnCompleted: boolean;
-  /** Id of the row that opened this turn, for the notification producer. */
-  userMessageId: string | undefined;
-  /**
-   * True when this turn's reply streams to the app and nowhere else, for the
-   * notification producer's delivery-surface gates.
-   */
-  replyDeliveredInAppOnly?: boolean;
 }): Promise<void> {
-  const {
-    ctx,
-    state,
-    rlog,
-    generationCompletedAt,
-    turnCompleted,
-    userMessageId,
-    replyDeliveredInAppOnly,
-  } = params;
-  const tailStartedAt = Date.now();
+  const { ctx, state, rlog } = params;
 
-  // Conversation row for the notification producer below. Guarded like every
-  // step below, because this runs after the terminal SSE and a SQLite hiccup
-  // must not escape into the loop's outer catch.
-  let conversation: ConversationRow | null = null;
-  try {
-    conversation = getConversation(ctx.conversationId);
-  } catch (err) {
-    rlog.warn({ err }, "Failed to read conversation for end-of-turn work");
-  }
-
-  // Per-message memory/attention finalize side-effects deferred from
-  // `handleMessageComplete`: one closure per assistant row produced this turn,
-  // in production order.
-  for (const effect of state.deferredFinalizeEffects) {
-    try {
-      await effect();
-    } catch (err) {
-      rlog.warn({ err }, "Deferred finalize side-effect failed (non-fatal)");
-    }
-  }
-
-  // Notify about a finished reply the user is no longer looking at. Ordered
-  // after the loop above so the producer's unseen check reads the attention
-  // cursor this turn's last row just projected. Not awaited: the pipeline
-  // awaits the platform adapter's HTTP dispatch, which retries with backoff,
-  // and nothing below here depends on the emit. The producer never rejects.
-  if (turnCompleted && state.lastAssistantMessageId) {
-    void emitAssistantReplyNotification({
-      conversationId: ctx.conversationId,
-      assistantMessageId: state.lastAssistantMessageId,
-      userMessageId,
-      ...(replyDeliveredInAppOnly ? { replyDeliveredInAppOnly: true } : {}),
-      rlog,
-      conversation,
-    });
-  }
-
-  // Fresh row for the two filesystem steps below. The awaited work above is
-  // long enough for the user to delete the conversation, and the row read at
-  // the top of the tail stays truthy across that deletion, so spooling or
-  // mirroring against it would rebuild a deleted conversation's directory from
-  // in-memory history. A row that is gone skips both steps exactly as an
-  // unreadable one does.
+  // Conversation row for the two filesystem steps below. Read here rather than
+  // reused from anywhere earlier in the turn: the turn is long enough for the
+  // user to delete the conversation, and a row read before that deletion stays
+  // truthy across it, so spooling or mirroring against it would rebuild a
+  // deleted conversation's directory from in-memory history. A row that is gone
+  // skips both steps exactly as an unreadable one does. Guarded like every step
+  // below, because this runs after the terminal SSE and a SQLite hiccup must not
+  // escape into the loop's outer catch.
   let liveConversation: ConversationRow | null = null;
   try {
     liveConversation = getConversation(ctx.conversationId);
   } catch (err) {
-    rlog.warn({ err }, "Failed to re-read conversation for end-of-turn work");
+    rlog.warn({ err }, "Failed to read conversation for end-of-turn work");
   }
 
   // Post-turn tool-result truncation: spool oversized results to disk and
@@ -275,10 +232,98 @@ export async function runDeferredTurnTail(params: {
   } catch (err) {
     rlog.warn({ err }, "Failed to sync assistant message to disk (non-fatal)");
   }
+}
+
+/**
+ * Drain a turn's deferred bookkeeping after the processing lock has released.
+ *
+ * Runs detached from the agent loop and chained through `chainTurnTail`, so a
+ * slow index never holds the next turn's send behind an idle composer, yet two
+ * turns' tails still run in turn order even when the second turn ran on a
+ * rebuilt `Conversation` instance. Every step is best-effort and keyed by a
+ * message id this turn produced, so it neither reads nor writes state the next
+ * turn owns.
+ *
+ * `criticalSectionMs` is the lock-held window the agent loop measured from the
+ * end of generation; paired with `deferredTailMs` it splits the end-of-turn
+ * window into the part a waiting sender feels and the part it no longer does.
+ */
+export async function runDeferredTurnTail(params: {
+  conversationId: string;
+  state: TurnTailState;
+  rlog: pino.Logger;
+  criticalSectionMs: number;
+  /**
+   * True only for a `message_complete` turn that produced a genuine reply. A
+   * handed-off generation is not the end of the run, a cancelled one has no
+   * final reply, and a provider-error turn's only assistant row is the
+   * synthetic error text.
+   */
+  turnCompleted: boolean;
+  /** Id of the row that opened this turn, for the notification producer. */
+  userMessageId: string | undefined;
+  /**
+   * True when this turn's reply streams to the app and nowhere else, for the
+   * notification producer's delivery-surface gates.
+   */
+  replyDeliveredInAppOnly?: boolean;
+}): Promise<void> {
+  const {
+    conversationId,
+    state,
+    rlog,
+    criticalSectionMs,
+    turnCompleted,
+    userMessageId,
+    replyDeliveredInAppOnly,
+  } = params;
+  const tailStartedAt = Date.now();
+
+  // Conversation row for the notification producer below. Guarded like every
+  // step here, because this runs after the terminal SSE and a SQLite hiccup must
+  // not escape into the detached tail's caller.
+  let conversation: ConversationRow | null = null;
+  try {
+    conversation = getConversation(conversationId);
+  } catch (err) {
+    rlog.warn({ err }, "Failed to read conversation for end-of-turn work");
+  }
+
+  // Per-message memory/attention finalize side-effects deferred from
+  // `handleMessageComplete`: one closure per assistant row produced this turn,
+  // in production order.
+  for (const effect of state.deferredFinalizeEffects) {
+    try {
+      await effect();
+    } catch (err) {
+      rlog.warn({ err }, "Deferred finalize side-effect failed (non-fatal)");
+    }
+  }
+
+  // Notify about a finished reply the user is no longer looking at. Ordered
+  // after the loop above so the producer's unseen check reads the attention
+  // cursor this turn's last row just projected; that projection is the
+  // network-bound work this whole tail exists to keep off the lock, so the
+  // check necessarily runs with the conversation already free. A follow-up
+  // send that beats it there advances the cursor and suppresses the push,
+  // which is the right answer: a user typing the next message is looking at
+  // the reply. Not awaited: the pipeline awaits the platform adapter's HTTP
+  // dispatch, which retries with backoff, and nothing below here depends on
+  // the emit. The producer never rejects.
+  if (turnCompleted && state.lastAssistantMessageId) {
+    void emitAssistantReplyNotification({
+      conversationId,
+      assistantMessageId: state.lastAssistantMessageId,
+      userMessageId,
+      ...(replyDeliveredInAppOnly ? { replyDeliveredInAppOnly: true } : {}),
+      rlog,
+      conversation,
+    });
+  }
 
   rlog.info(
     {
-      criticalSectionMs: tailStartedAt - generationCompletedAt,
+      criticalSectionMs,
       deferredTailMs: Date.now() - tailStartedAt,
     },
     "End-of-turn work complete",

package/src/daemon/conversation.ts

@@ -96,6 +96,7 @@ import type { OnboardingContext } from "../types/onboarding-context.js";
 import type { AbortReason } from "../util/abort-reasons.js";
 import { UserError } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
+import { withSqliteRetry } from "../util/sqlite-retry.js";
 import type { WorkspaceGitService } from "../workspace/git-service.js";
 import type { commitTurnChanges } from "../workspace/turn-commit.js";
 import type { AssistantAttachmentDraft } from "./assistant-attachments.js";
@@ -154,7 +155,7 @@ import {
 } from "./conversation-surfaces.js";
 import type {
   SubagentToolGateMode,
-  ToolSetupContext,
+  SubagentToolStats,
   WakeToolContextPin,
 } from "./conversation-tool-setup.js";
 import {
@@ -275,8 +276,8 @@ export interface ConversationConstructorOptions {
    * Give this conversation's LLM calls provider-native (server-side) web
    * search when the resolved provider supports it (see
    * {@link AgentLoopConfig.enableNativeWebSearch}). Set by the subagent manager
-   * for the tool-less advisor consult so it can ground guidance with live web
-   * access; non-native providers get nothing. Defaults to false.
+   * for the advisor consult so it can ground guidance with live web access;
+   * non-native providers get nothing. Defaults to false.
    */
   enableNativeWebSearch?: boolean;
   /**
@@ -360,6 +361,20 @@ export class Conversation {
    * @internal
    */
   subagentDeniedToolNames = new Set<string>();
+  /**
+   * Machine tool-call counters for this conversation when it runs as a
+   * subagent child. Recorded by the tool executor (gated on {@link isSubagent},
+   * so parent conversations never accumulate anything here) and harvested by
+   * the SubagentManager into the child's state when the run ends, where it
+   * becomes the stats footer on the parent's completion notification and on
+   * `subagent_read`. Ephemeral, never persisted.
+   * @internal
+   */
+  subagentToolStats: SubagentToolStats = {
+    calls: 0,
+    succeeded: 0,
+    filesWritten: new Set<string>(),
+  };
   /**
    * How {@link subagentAllowedTools} is enforced — see
    * {@link SubagentToolGateMode}. Set and restored alongside the allowlist
@@ -481,6 +496,14 @@ export class Conversation {
    */
   wakePersonaOverride?: SystemPromptPersonaOverride;
   /** @internal */ currentTurnOverrideProfile?: string;
+  /**
+   * The firing's `cron_runs.id` when a schedule triggered the current turn.
+   * Exposed on the live conversation so the tool context can forward it to
+   * delegated LLM work (subagent spawns and messages), whose usage rows then
+   * attribute to the same firing.
+   * @internal
+   */
+  currentTurnCronRunId?: string | null;
   /** @internal */ currentTurnIsNonInteractive?: boolean;
   /** @internal */ currentTurnModelProfileNoticeKey?: string;
   /** @internal */ currentTurnRequestOrigin?: string;
@@ -538,11 +561,23 @@ export class Conversation {
    * @internal
    */
   pendingSteerRepair = false;
+  /**
+   * Set by `abortConversation` when a user interrupt (Stop / Esc / the CLI
+   * cancel signal) ends a turn that still has messages queued behind it. Those
+   * messages survive the abort and drain into the next turn, so the drain path
+   * owes them the same synthetic tool_result repair a steer gets: the killed
+   * turn may have left `tool_use` blocks with no results. Unlike
+   * `pendingSteerRepair` this does not promote a single head message. An
+   * interrupt has nothing to promote, so the drain batches the queue the way it
+   * would after any other turn. Cleared after repair.
+   * @internal
+   */
+  pendingInterruptRepair = false;
   /**
    * When true, side-effect tools must prompt even if a trust/allow rule
    * would auto-allow. Set by non-interactive callers (e.g. non-guardian
    * phone voice) so their auto-deny handler reliably sees a
-   * `confirmation_request` event. See ToolSetupContext.forcePromptSideEffects.
+   * `confirmation_request` event. See `forcePromptSideEffects` below.
    * @internal
    */
   forcePromptSideEffects = false;
@@ -605,7 +640,7 @@ export class Conversation {
   /** @internal */ clientTimezone?: string;
   /**
    * @internal
-   * The client's OS surface ("web" | "ios" | "macos"), reported separately
+   * The client's OS surface, reported separately
    * from the transport `interfaceId` so the assistant's per-turn context can
    * show the real platform without affecting host-proxy/transport gating.
    * This is the LIVE value (re-applied from transport on every inbound
@@ -765,7 +800,7 @@ export class Conversation {
       this.executor,
       this.prompter,
       this.secretPrompter,
-      this as ToolSetupContext,
+      this,
     );
 
     const config = getConfig();
@@ -1564,38 +1599,45 @@ export class Conversation {
    * Mutate the server-authoritative `processing` flag. Web/Capacitor/CLI
    * caches treat this flag as the source of truth for the avatar streaming
    * ring and thinking indicator, so the `true → false` clear must announce
-   * itself: the daemon flips it in the agent-loop `finally`, which runs after
-   * the user-visible terminal SSE events, and a racing metadata refetch can
-   * otherwise re-read the not-yet-cleared `true` and clobber the client's
+   * itself: the daemon flips it once the finished turn's content is settled,
+   * after the user-visible terminal SSE events, and a racing metadata refetch
+   * can otherwise re-read the not-yet-cleared `true` and clobber the client's
    * optimistic `false`.
    *
    * Emitting a metadata invalidation on the clear lets every client GET the
    * authoritative `false`, per the multi-client-sync contract in AGENTS.md
    * ("emit the invalidation after the canonical state write succeeds").
+   *
+   * The two directions have different failure semantics because the in-memory
+   * flag and the persisted column serve different readers. Acquiring is
+   * strict: a failed persist reverts the in-memory flag and re-throws, so the
+   * caller's existing failure handling runs and the two never disagree about a
+   * turn that is starting. Clearing is not: the in-memory flag is the queue
+   * gate this process enforces, while the column is advisory state for
+   * out-of-process readers that the boot-time stale-processing sweep already
+   * recovers. Reverting a clear because a mirror write lost a race with
+   * SQLITE_BUSY would latch the conversation into "busy" for the rest of the
+   * daemon's life, so the clear always sticks.
    */
   setProcessing(value: boolean): void {
     const wasProcessing = this._processing;
     this._processing = value;
     // Persist the cross-process source of truth so out-of-process callers
     // (retrospective CLI, future detached workers) can detect mid-turn state
-    // by reading the conversations row directly. If the write fails (e.g.
-    // SQLITE_BUSY), the persisted column keeps its prior value, so revert the
-    // in-memory flag to match rather than stranding `processing = true` in
-    // memory against a NULL column. Re-throw so callers' existing failure
-    // handling still runs.
-    try {
-      setConversationProcessingStartedAt(
-        this.conversationId,
-        value ? Date.now() : null,
-      );
-    } catch (err) {
-      this._processing = wasProcessing;
-      throw err;
+    // by reading the conversations row directly.
+    if (value) {
+      try {
+        setConversationProcessingStartedAt(this.conversationId, Date.now());
+      } catch (err) {
+        this._processing = wasProcessing;
+        throw err;
+      }
+    } else {
+      this.mirrorProcessingCleared();
     }
     if (!value && this.idleWaiters.size > 0) {
-      // Notify only after the persisted write above committed — a thrown
-      // write reverts the in-memory flag and re-throws, so waiters must not
-      // observe a release that never happened. Copy-and-clear so a waiter
+      // The in-memory flag is the release, so waiters are notified on it
+      // rather than on the advisory mirror write. Copy-and-clear so a waiter
       // registered from inside a notification can't be re-entered.
       const waiters = [...this.idleWaiters];
       this.idleWaiters.clear();
@@ -1610,6 +1652,37 @@ export class Conversation {
     }
   }
 
+  /**
+   * Mirror a released processing lock into the advisory `processing_started_at`
+   * column, without ever reporting failure back to the release.
+   *
+   * `withSqliteRetry` runs its first attempt synchronously, so the common case
+   * is the same single write the acquire direction performs; only a contended
+   * write falls back to the backoff retries, which run detached. The retry
+   * re-checks the in-memory flag because a new turn may have acquired the lock
+   * (and written its own timestamp) while the backoff slept, and a late clear
+   * would then blank a column that describes a live turn.
+   */
+  private mirrorProcessingCleared(): void {
+    void withSqliteRetry(
+      () => {
+        if (this._processing) {
+          return;
+        }
+        setConversationProcessingStartedAt(this.conversationId, null);
+      },
+      {
+        op: "conversation:clearProcessing",
+        context: { conversationId: this.conversationId },
+      },
+    ).catch((err: unknown) => {
+      log.error(
+        { err, conversationId: this.conversationId },
+        "Failed to clear the persisted processing marker; the conversation is released in memory and the boot-time stale-processing sweep recovers the column",
+      );
+    });
+  }
+
   /**
    * Wait until this conversation's processing lock releases.
    *
@@ -1746,8 +1819,13 @@ export class Conversation {
     return this.queue.snapshot();
   }
 
-  removeQueuedMessage(requestId: string): boolean {
-    return this.queue.removeByRequestId(requestId) !== undefined;
+  /**
+   * Drop a queued message by request id. Returns the removed entry so callers
+   * can pair a cancellation event with the same visibility metadata the
+   * enqueue ack used, or `undefined` when nothing matched.
+   */
+  removeQueuedMessage(requestId: string): QueuedMessage | undefined {
+    return this.queue.removeByRequestId(requestId);
   }
 
   canHandoffAtCheckpoint(): boolean {
@@ -2583,6 +2661,12 @@ export class Conversation {
        * forwarded into {@link runAgentLoopImpl} and threaded to `recordUsage`.
        */
       cronRunId?: string | null;
+      /**
+       * See {@link runAgentLoopImpl}: trust this turn runs under. Queue
+       * drains pass the sender's trust captured at enqueue so the run is not
+       * reset to the conversation's most recent actor.
+       */
+      turnTrustContext?: TrustContext;
     },
   ): Promise<void> {
     const { onEvent, ...rest } = options ?? {};

package/src/daemon/disk-pressure-guard-lifecycle.ts

@@ -16,10 +16,10 @@ const log = getLogger("disk-pressure-guard-lifecycle");
 
 let diskPressureStartupSampleTimer: ReturnType<typeof setTimeout> | null = null;
 
-function runDeferredDiskPressureStartupSample(): void {
+async function runDeferredDiskPressureStartupSample(): Promise<void> {
   diskPressureStartupSampleTimer = null;
   try {
-    const status = evaluateDiskPressureNow();
+    const status = await evaluateDiskPressureNow();
     if (status.error) {
       log.warn(
         { error: status.error },