@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/calls/__tests__/voice-triage-escalate.test.ts

@@ -4,6 +4,7 @@ import { DEEPGRAM_MULTI_LANGUAGE_CODES } from "../../providers/speech-to-text/de
 import {
   capEscalationBridge,
   classifyFrontDoorLeading,
+  createFrontDoorStreamGate,
   ESCALATE_VERDICT_TOKEN,
   escalatedContinuationRule,
   ESCALATION_CONTINUATION_CONTENT,
@@ -84,6 +85,14 @@ describe("front-door decision rule", () => {
     expect(rule.toLowerCase()).toContain("tool");
   });
 
+  test("escalates when an answer needs personal memory absent from context", () => {
+    expect(rule.toLowerCase()).toContain("saved personal fact");
+    expect(rule.toLowerCase()).toContain("escalate rather than guessing");
+    expect(rule.toLowerCase()).toContain(
+      "personal context that is already present is yours to use directly",
+    );
+  });
+
   test("demands a silent decision — no narrated reasoning in spoken output", () => {
     // Regression: a weak front-door model narrated its triage deliberation
     // aloud ("Context is complete — Alex paused...") before the bridge.
@@ -439,3 +448,96 @@ describe("live-voice escalation orchestration (end-to-end — TODO)", () => {
     () => {},
   );
 });
+
+describe("createFrontDoorStreamGate", () => {
+  /** Feed `deltas` through a gate and return what it released, in order. */
+  function release(
+    deltas: string[],
+    opts?: { holdEnabled?: boolean; finish?: boolean },
+  ): string[] {
+    const gate = createFrontDoorStreamGate(opts?.holdEnabled === true);
+    const out = deltas
+      .map((delta) => gate.push(delta))
+      .filter((chunk) => chunk.length > 0);
+    if (opts?.finish !== false) {
+      const trailing = gate.finish();
+      if (trailing.length > 0) {
+        out.push(trailing);
+      }
+    }
+    return out;
+  }
+
+  test("an answer passes through delta by delta", () => {
+    expect(release(["It is ", "Tuesday."])).toEqual(["It is ", "Tuesday."]);
+  });
+
+  test("leading text held while the verdict was pending is not lost", () => {
+    expect(release(["[", "A] is the option."])).toEqual(["[A] is the option."]);
+  });
+
+  test("an escalation releases the capped bridge and nothing else", () => {
+    expect(
+      release([
+        ESCALATE_VERDICT_TOKEN,
+        " Let me check your calendar.",
+        " rambling past the cap",
+      ]),
+    ).toEqual(["Let me check your calendar."]);
+  });
+
+  test("a verdict token split across deltas still never escapes", () => {
+    expect(release(["[", "1", "] One moment.", " more"])).toEqual([
+      "One moment.",
+    ]);
+  });
+
+  test("a too-short bridge releases nothing, matching the audio-only fallback", () => {
+    // Under MIN_SPOKEN_BRIDGE_CHARS the session discards the model's bridge
+    // and plays a canned fallback with no caption and no persisted row, so
+    // releasing the capped text would show words the caller never heard.
+    expect(release([ESCALATE_VERDICT_TOKEN, " ok"])).toEqual([]);
+    expect(release([ESCALATE_VERDICT_TOKEN, " ."])).toEqual([]);
+  });
+
+  test("a too-short bridge releases nothing via finish either", () => {
+    const gate = createFrontDoorStreamGate(false);
+    expect(gate.push(`${ESCALATE_VERDICT_TOKEN} ok`)).toBe("");
+    expect(gate.finish()).toBe("");
+  });
+
+  test("a bridge at the spoken threshold is still released", () => {
+    // The boundary belongs to the spoken side: the session speaks anything
+    // that is not BELOW the threshold, so the gate must release it too.
+    expect(release([ESCALATE_VERDICT_TOKEN, " Sure."])).toEqual(["Sure."]);
+  });
+
+  test("a bridge with no terminator is released by finish", () => {
+    const gate = createFrontDoorStreamGate(false);
+    expect(gate.push("[1] Let me check")).toBe("");
+    expect(gate.finish()).toBe("Let me check");
+  });
+
+  test("a bridge is dropped when the leg never finishes (cancellation)", () => {
+    expect(release(["[1] Let me check"], { finish: false })).toEqual([]);
+  });
+
+  test("a hold verdict releases nothing", () => {
+    expect(release([HOLD_VERDICT_TOKEN], { holdEnabled: true })).toEqual([]);
+  });
+
+  test("the hold token is ordinary text on a leg that was never taught it", () => {
+    // A non-speculative leg's prompt has no hold branch, so its output must
+    // not be swallowed by a token it could only have parroted.
+    expect(release([`${HOLD_VERDICT_TOKEN} is the index.`])).toEqual([
+      `${HOLD_VERDICT_TOKEN} is the index.`,
+    ]);
+  });
+
+  test("nothing more escapes after the bridge is released", () => {
+    const gate = createFrontDoorStreamGate(false);
+    expect(gate.push("[1] One moment.")).toBe("One moment.");
+    expect(gate.push(" and a leaked continuation")).toBe("");
+    expect(gate.finish()).toBe("");
+  });
+});

package/src/calls/call-controller.ts

@@ -21,6 +21,7 @@ import type { TrustContext } from "../daemon/trust-context-types.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 import { getCatalogProvider } from "../tts/provider-catalog.js";
+import { createReasoningTagFilter } from "../tts/reasoning-tag-filter.js";
 import { extractSpeakableSegments } from "../tts/speakable-segments.js";
 import {
   type AudioStoreSink,
@@ -728,6 +729,12 @@ export class CallController {
     // could be the start of a control marker.
     let ttsBuffer = "";
     let fullResponseText = "";
+    // Reasoning models can inline <think> spans in the content stream when a
+    // profile has not opted into parseThinkTags. Neither the spoken path nor
+    // the post-turn consumers of fullResponseText (transcripts,
+    // assistant_spoke, END_CALL/ASK_GUARDIAN detection) may see them: both
+    // are fed only filtered text.
+    const reasoningFilter = createReasoningTagFilter();
 
     // Synthesized path: text is split at speakable boundaries as it streams
     // and each segment is synthesized while the LLM keeps generating. The
@@ -930,8 +937,13 @@ export class CallController {
         if (!this.isCurrentRun(runVersion)) {
           return;
         }
-        fullResponseText += text;
-        ttsBuffer += text;
+        // One filter feeds both consumers: the spoken stream and the text
+        // used for transcripts, assistant_spoke, and END_CALL/ASK_GUARDIAN
+        // marker detection. A control marker inside a reasoning span must
+        // never trigger a real action the caller did not hear.
+        const speakable = reasoningFilter.push(text);
+        fullResponseText += speakable;
+        ttsBuffer += speakable;
         ttsBuffer = stripInternalSpeechMarkers(ttsBuffer);
         flushSafeText();
       };
@@ -1010,7 +1022,11 @@ export class CallController {
       return fullResponseText;
     }
 
-    // Final sweep: strip any remaining control markers from the buffer
+    // Final sweep: release any held-back partial tag to both consumers,
+    // then strip any remaining control markers from the buffer.
+    const filterTail = reasoningFilter.flush();
+    fullResponseText += filterTail;
+    ttsBuffer += filterTail;
     ttsBuffer = stripInternalSpeechMarkers(ttsBuffer);
     if (ttsBuffer.length > 0) {
       emitSafeChunk(ttsBuffer);

package/src/calls/call-setup-flow.ts

@@ -1393,7 +1393,6 @@ export class CallSetupFlow {
 
     try {
       const accessResult = await ndeps.notifyGuardianOfAccessRequest({
-        canonicalAssistantId: accessRequest.assistantId,
         sourceChannel: "phone",
         conversationExternalId: accessRequest.fromNumber,
         actorExternalId: accessRequest.fromNumber,

package/src/calls/media-stream-stt-session.ts

@@ -538,6 +538,17 @@ export class MediaStreamSttSession {
     switch (event.type) {
       case "partial":
         return;
+      case "finalized":
+        return;
+      case "turn-start":
+      case "eager-turn-end":
+      case "turn-resumed":
+      case "turn-end":
+        // The local VAD and the provider's boundary finals own turn
+        // taking. Listed case-by-case rather than under `default` so the
+        // exhaustiveness check flags this site when turn detection is
+        // wired in.
+        return;
       case "final": {
         const durationMs = Math.round(this.utteranceAudioMs);
         this.utteranceAudioMs = 0;
@@ -570,6 +581,10 @@ export class MediaStreamSttSession {
           this.enterBatchMode();
         }
         return;
+      default: {
+        const _exhaustive: never = event;
+        return;
+      }
     }
   }
 

package/src/calls/voice-session-bridge.ts

@@ -34,6 +34,7 @@ import {
   recordConversationPersistedSeq,
   updateMessageContent,
 } from "../persistence/conversation-crud.js";
+import { VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND } from "../plugin-api/constants.js";
 import { pinnedListeningLanguage } from "../providers/speech-to-text/provider-catalog.js";
 import type { ContentBlock } from "../providers/types.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
@@ -55,6 +56,7 @@ import {
   stripInternalSpeechMarkers,
 } from "./voice-control-protocol.js";
 import {
+  createFrontDoorStreamGate,
   escalatedContinuationRule,
   ESCALATION_CONTINUATION_CONTENT,
   frontDoorCapabilityDigest,
@@ -407,18 +409,6 @@ export interface VoiceTurnHandle {
  * on a live phone call" framing (the session system prompt already
  * provides assistant identity) and guardian context (injected separately).
  */
-/**
- * Steering shared by every voice channel. A sign-in flow opens a browser
- * window mid-call that the caller may be unable to see or complete, whether it
- * is reached through a ui-surface tool or through shell and CLI tools (e.g.
- * `assistant oauth connect`). Tell the model to speak the limitation and defer
- * the flow to text chat instead.
- *
- * This outlives the ui-surface restriction it was written alongside: a
- * live-voice call can now show surfaces, but a browser window handing control
- * to a third party mid-call is a different problem, and one a minimized room
- * does not solve.
- */
 /**
  * How long a live-voice call waits on an approval before deciding it itself.
  *
@@ -429,8 +419,23 @@ export interface VoiceTurnHandle {
  */
 const VOICE_APPROVAL_TIMEOUT_MS = 45_000;
 
-export const VOICE_NO_SETUP_FLOWS_RULE =
-  "Never start account connections, OAuth or sign-in flows, or any other action that opens a browser window or needs the user's screen during this call — not even through shell or CLI tools. If the task needs one, say so briefly and offer to finish it in text chat after the call.";
+/**
+ * Telephony-only steering. A sign-in flow opens a browser window on a screen
+ * the caller does not have in front of them, whether it is reached through a
+ * ui-surface tool or through shell and CLI tools (e.g. `assistant oauth
+ * connect`). Tell the model to speak the limitation and defer the flow to text
+ * chat instead.
+ *
+ * Scoped to the phone because the screen is what decides it. A phone call has
+ * no screen, so the `open_url` signal a CLI tool can reach lands somewhere the
+ * caller will never see, and that signal bus carries no capability or
+ * conversation context, so this rule is the only thing standing in front of it
+ * here. A live-voice call is the opposite case: the user is holding the screen,
+ * and the room minimizes itself to hand it back (see
+ * LIVE_VOICE_SETUP_FLOW_TEACHING).
+ */
+const PHONE_NO_SETUP_FLOWS_RULE =
+  "Never start account connections, OAuth or sign-in flows, or any other action that opens a browser window or needs the user's screen during this call, not even through shell or CLI tools. If the task needs one, say so briefly and offer to finish it in text chat after the call.";
 
 /**
  * The pre-speech tail of the speak-the-caller's-language rule. A monolingual
@@ -551,7 +556,7 @@ function buildVoiceCallControlPrompt(opts: {
     '10. Do not make up information. If you are unsure, use [ASK_GUARDIAN: your question] to consult your guardian. For tool permission requests, use [ASK_GUARDIAN_APPROVAL: {"question":"...","toolName":"...","input":{...}}].',
     `11. Your text is sent directly to a text-to-speech engine. Never use markdown formatting (asterisks, headers, backticks, links) or emojis in your spoken responses. Write plain conversational text only. Protocol markers like ${opts.isCallerGuardian ? "[END_CALL]" : "[ASK_GUARDIAN: ...] and [END_CALL]"} are not spoken text and should still be used normally.`,
     `12. Speak the caller's language: reply in the language of the caller's most recent actual speech, and follow them if they switch languages mid-call. Synthetic user turns (parenthetical markers like the call-connected and verification-completed notices) are not caller speech and never set the language. Before the caller has spoken, such as on the opening greeting turn, ${preSpeechLanguageRuleFragment(config.services.stt.language, config.services.stt.provider)}.`,
-    `13. ${VOICE_NO_SETUP_FLOWS_RULE}`,
+    `13. ${PHONE_NO_SETUP_FLOWS_RULE}`,
   );
 
   // Triage-and-escalate routing rules. The front-door leg decides and may
@@ -779,11 +784,13 @@ export async function startVoiceTurn(
   // model wakes, but they are not user speech and must not render as a live
   // user bubble. Their echo is suppressed below (parity with
   // `isEchoSuppressedUserMessage` on the text path).
+  const isEscalationContinuation =
+    opts.content === ESCALATION_CONTINUATION_CONTENT;
   const isSyntheticVoicePrompt =
     opts.hiddenSyntheticPrompt === true ||
     opts.content === CALL_OPENING_MARKER ||
     opts.content === CALL_VERIFICATION_COMPLETE_MARKER ||
-    opts.content === ESCALATION_CONTINUATION_CONTENT;
+    isEscalationContinuation;
 
   // The escalation-continuation prompt is a pure internal instruction ("give
   // the full answer now"), not a real utterance and not the sort of scaffolding
@@ -795,8 +802,7 @@ export async function startVoiceTurn(
   // affects client display. A caller whose prompt text is not a fixed sentinel
   // opts into the same treatment with `hiddenSyntheticPrompt`.
   const isHiddenSyntheticPrompt =
-    opts.hiddenSyntheticPrompt === true ||
-    opts.content === ESCALATION_CONTINUATION_CONTENT;
+    opts.hiddenSyntheticPrompt === true || isEscalationContinuation;
 
   // Build the call-control protocol prompt so the model knows how to emit
   // control markers (ASK_GUARDIAN, END_CALL, etc.) and recognize opener turns.
@@ -930,10 +936,10 @@ export async function startVoiceTurn(
   // failed while no concurrent turn held the lock). Paths where this turn
   // LOST the conversation to a concurrent winner must use `restoreTurnState`
   // instead — this reset-to-defaults would clobber the winner's live state.
-  // The client callback is only reset when this turn actually installed it
-  // (tracked via `clientCallbackInstalled`); otherwise cleanup would detach
-  // an active sender installed by a prior turn.
-  let clientCallbackInstalled = false;
+  // The approval observer is only detached when this turn installed it
+  // (`detachApprovalObserver` is set); otherwise cleanup would detach an
+  // observer installed by a prior turn.
+  let detachApprovalObserver: (() => void) | undefined;
   /**
    * Confirmations this voice turn left pending for the user to answer, and the
    * timers that stop them waiting forever.
@@ -972,11 +978,10 @@ export async function startVoiceTurn(
     conversation.setVoiceCallControlPrompt(null);
     conversation.callSessionId = undefined;
     conversation.forcePromptSideEffects = false;
-    if (clientCallbackInstalled) {
-      // Reset the client callback to a no-op so the stale closure doesn't
-      // intercept events from future turns on the same conversation.
-      conversation.updateClient(() => {}, true);
-    }
+    // Detach so the stale closure doesn't act on events from future turns on
+    // the same conversation.
+    detachApprovalObserver?.();
+    detachApprovalObserver = undefined;
   };
 
   const requestId = uuidv7();
@@ -990,6 +995,9 @@ export async function startVoiceTurn(
         // `isVoiceSessionUserMessage` for why the channel fields cannot carry it.
         voiceSessionTurn: true,
         ...(isHiddenSyntheticPrompt ? { hidden: true } : {}),
+        ...(isEscalationContinuation
+          ? { messageKind: VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND }
+          : {}),
         ...(opts.voiceTelemetry
           ? {
               // Projected onto `TurnTelemetryEvent.client` by
@@ -1241,24 +1249,25 @@ export async function startVoiceTurn(
     publishConversationMessagesChanged(opts.conversationId);
   }
 
-  // Hook into conversation to intercept confirmation_request and secret_request events.
-  // Voice auto-denies/auto-allows/auto-resolves these since there's no interactive UI.
+  // Observe confirmation_request and secret_request events so voice can
+  // auto-deny/auto-allow/auto-resolve them (there is no interactive UI on a
+  // call). Delivery is not this observer's job: the conversation's sink has
+  // already put each event on the wire before the observer sees it, which is
+  // what keeps a resolution's `interaction_resolved` after the request it
+  // answers.
   let lastError: string | null = null;
-  conversation.updateClient(async (msg: AssistantEvent) => {
+  const handleVoiceEvent = async (msg: AssistantEvent): Promise<void> => {
     // The user (or anything else) answered: stop the fallback from firing on a
     // request that is already decided.
     if (msg.type === "interaction_resolved") {
       settleVoiceApproval(msg.requestId);
     }
     if (msg.type === "confirmation_request") {
-      // Broadcast the request BEFORE resolving it: resolution synchronously
-      // broadcasts `interaction_resolved` (handleConfirmationResponse →
-      // prompter → pending-interactions), and attached clients (e.g. the
-      // web app behind a live-voice room) clear their approval card only on
-      // that event — resolving first would put `interaction_resolved`
-      // before `confirmation_request` on the wire, leaving an orphaned card
-      // whose Allow/Deny buttons 404.
-      broadcastMessage(msg);
+      // The request is already on the wire (the sink delivered it before this
+      // observer ran), so a resolution below lands after it: attached clients
+      // (e.g. the web app behind a live-voice room) clear their approval card
+      // only on `interaction_resolved`, and the reverse order would leave an
+      // orphaned card whose Allow/Deny buttons 404.
       if (!isGuardian) {
         // Non-guardian voice callers have no interactive approval UI.
         // The pre-exec gate (tool-approval-handler.ts) handles grant
@@ -1416,9 +1425,15 @@ export async function startVoiceTurn(
       conversation.handleSecretResponse(msg.requestId, undefined, "store");
       return;
     }
-    broadcastMessage(msg);
+  };
+  detachApprovalObserver = conversation.addEventObserver((msg) => {
+    handleVoiceEvent(msg).catch((err) => {
+      log.warn(
+        { turnId, eventType: msg.type, err },
+        "Voice approval observer failed",
+      );
+    });
   });
-  clientCallbackInstalled = true;
 
   // Registered before the agent loop starts so the NEXT turn on this
   // conversation waits for this turn's `finally { cleanup() }` — not just
@@ -1447,6 +1462,34 @@ export async function startVoiceTurn(
   // Set by the handle's discard(): the whole leg must leave no trace.
   let discarded = false;
 
+  // Verdict-first gate on the hub broadcast. A front-door leg's raw stream
+  // carries its routing verdict, so hub subscribers (web, passive devices)
+  // read it through the gate and see only the text the caller heard. Every
+  // other leg, including the escalated continuation that answers for real,
+  // broadcasts its deltas untouched.
+  const frontDoorStreamGate =
+    opts.routingLeg === "front-door"
+      ? createFrontDoorStreamGate(opts.unifiedVerdict === true)
+      : null;
+
+  /**
+   * Broadcast one agent-loop event to hub subscribers, holding a front-door
+   * leg's control-plane text back at the boundary rather than emitting it and
+   * repairing the transcript afterwards. Text released by the gate travels as
+   * an ordinary delta on the leg's own reserved row, so a client that renders
+   * the stream lands on the same text the teardown hygiene pass persists.
+   */
+  const broadcastLegEvent = (msg: AssistantEvent): void => {
+    if (frontDoorStreamGate === null || msg.type !== "assistant_text_delta") {
+      broadcastMessage(msg);
+      return;
+    }
+    const released = frontDoorStreamGate.push(msg.text);
+    if (released.length > 0) {
+      broadcastMessage({ ...msg, text: released });
+    }
+  };
+
   /**
    * Teardown transcript hygiene. Runs after the agent loop has fully
    * settled — including the stranded-content fold that finalizes an aborted
@@ -1474,6 +1517,12 @@ export async function startVoiceTurn(
    * the escalated leg — blocked on this turn's teardown — snapshots it, so
    * the quality model never sees the marker text either. Best-effort: a
    * hiccup here must not escalate into a turn-level failure.
+   *
+   * This pass owns the PERSISTED row, which the agent loop writes from the
+   * model's raw output regardless of what was broadcast. The live hub stream
+   * is gated separately by `broadcastLegEvent`, so the refetch this pass
+   * publishes confirms text a subscriber already holds instead of correcting
+   * it.
    */
   const finalizeVoiceLegTranscript = async (): Promise<void> => {
     if (reservedAssistantRowId == null) {
@@ -1617,7 +1666,24 @@ export async function startVoiceTurn(
           } else if (msg.type === "conversation_error") {
             lastError = msg.userMessage;
           }
-          broadcastMessage(msg);
+          if (frontDoorStreamGate !== null && msg.type === "message_complete") {
+            // A leg that completed mid-bridge (a holding phrase with no
+            // sentence terminator) still hands off and speaks what arrived,
+            // so release it ahead of the completion frame. A cancelled leg
+            // never hands off, and correspondingly never flushes.
+            const trailing = frontDoorStreamGate.finish();
+            if (trailing.length > 0) {
+              broadcastMessage({
+                type: "assistant_text_delta",
+                text: trailing,
+                ...(reservedAssistantRowId !== null
+                  ? { messageId: reservedAssistantRowId }
+                  : {}),
+                conversationId: opts.conversationId,
+              });
+            }
+          }
+          broadcastLegEvent(msg);
 
           // Forward voice-relevant events to the real-time event sink
           if (msg.type === "assistant_text_delta") {
@@ -1654,11 +1720,19 @@ export async function startVoiceTurn(
         // ordinary call-agent resolution.
         callSite:
           opts.routingLeg === "front-door" ? "voiceFrontDoor" : "callAgent",
+        // A caller is on the line, so the turn is interactive: approval prompts
+        // must be raised rather than pre-denied, because the approval observer
+        // above is what decides them (auto-resolve for a non-guardian caller,
+        // a real card the guardian can answer).
+        isInteractive: true,
         // The escalation-continuation prompt is a transcript-suppressed machine
         // signal (persisted `hidden`), so flag the turn to match — keeps
         // prompt-as-user-speech consumers (e.g. title generation) from treating
         // it as user speech.
         ...(isHiddenSyntheticPrompt ? { isHiddenPrompt: true } : {}),
+        ...(isEscalationContinuation
+          ? { messageKind: VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND }
+          : {}),
         // Triage-and-escalate routing pins this turn to the fast front-door or
         // strong escalation profile. `forceOverrideProfile` floats it above the
         // callAgent call-site layers (callAgent is not `mainAgent`, so the

package/src/calls/voice-triage-escalate.ts

@@ -221,6 +221,108 @@ export function classifyFrontDoorLeading(
   return "answer";
 }
 
+/**
+ * Verdict-first gate over a front-door leg's delta stream: given the leg's
+ * raw deltas in order, it releases only the text the caller actually hears.
+ * A front-door leg's raw stream is a control plane, not assistant speech,
+ * until its leading tokens classify, so anything downstream of the model
+ * that shows text to a person reads the stream through this gate.
+ *
+ * `push` returns the text released by that delta (empty while the gate is
+ * holding). `finish` is called when the leg completes normally and releases
+ * a bridge that stopped short of a sentence terminator. A leg that is
+ * cancelled instead spoke nothing past what `push` already released, so it
+ * simply never calls `finish`.
+ */
+export interface FrontDoorStreamGate {
+  push(deltaText: string): string;
+  finish(): string;
+}
+
+/**
+ * Build a {@link FrontDoorStreamGate}. `holdEnabled` mirrors
+ * {@link classifyFrontDoorLeading}: true only for speculative (unified
+ * front-door) legs, whose decision rule is the only one that teaches the
+ * hold token.
+ *
+ * The three verdicts release differently, matching what the caller hears:
+ *
+ * - `hold`: the leg is discarded and its row deleted, so nothing is ever
+ *   released.
+ * - `escalate`: the only spoken text is the capped holding phrase, released
+ *   in one piece once the bridge is complete (exactly what
+ *   {@link capEscalationBridge} yields, so the released text, the audio, and
+ *   the persisted row agree). The verdict token and anything streamed past
+ *   the cap are dropped. A bridge shorter than
+ *   {@link MIN_SPOKEN_BRIDGE_CHARS} releases nothing at all: the session
+ *   substitutes an audio-only canned fallback for it, so there is no
+ *   displayed text for the gate to agree with.
+ * - `answer`: the leg's output IS the reply, so every delta passes through,
+ *   including the leading text held back while the verdict was pending.
+ */
+export function createFrontDoorStreamGate(
+  holdEnabled: boolean,
+): FrontDoorStreamGate {
+  let raw = "";
+  let stage: "deciding" | "answer" | "bridging" | "done" = "deciding";
+  let bridgeRaw = "";
+  let releasedChars = 0;
+
+  const releaseBridge = (): string => {
+    stage = "done";
+    const capped = capEscalationBridge(bridgeRaw);
+    // Below the spoken threshold the session throws the model's bridge away
+    // and plays a canned fallback that is audio-only, deleting the row rather
+    // than persisting a phrase the model never really produced (see
+    // `usesFallbackBridge` in `live-voice-session.ts`). Releasing the capped
+    // text here would put words on a subscriber's screen that the caller never
+    // heard, which is the same spoken/displayed divergence this gate exists to
+    // prevent.
+    return capped.length < MIN_SPOKEN_BRIDGE_CHARS ? "" : capped;
+  };
+
+  return {
+    push(deltaText: string): string {
+      raw += deltaText;
+      if (stage === "done") {
+        return "";
+      }
+      if (stage === "bridging") {
+        bridgeRaw += deltaText;
+        return isEscalationBridgeComplete(bridgeRaw) ? releaseBridge() : "";
+      }
+      if (stage === "deciding") {
+        const verdict = classifyFrontDoorLeading(raw.trimStart(), holdEnabled);
+        if (verdict === "pending") {
+          return "";
+        }
+        if (verdict === "hold") {
+          stage = "done";
+          return "";
+        }
+        if (verdict === "escalate") {
+          stage = "bridging";
+          bridgeRaw = raw.trimStart().slice(ESCALATE_VERDICT_TOKEN.length);
+          return isEscalationBridgeComplete(bridgeRaw) ? releaseBridge() : "";
+        }
+        stage = "answer";
+      }
+      // Answer stage: release everything not yet released, which on the
+      // transition includes the leading text the pending verdict held.
+      const chunk = raw.slice(releasedChars);
+      releasedChars = raw.length;
+      return chunk;
+    },
+    finish(): string {
+      if (stage === "bridging") {
+        return releaseBridge();
+      }
+      stage = "done";
+      return "";
+    },
+  };
+}
+
 /**
  * The escalated leg runs as its own voice turn. Rather than re-persist the
  * caller's utterance (it is already in history from the front-door leg), the
@@ -273,8 +375,8 @@ export function frontDoorDecisionRule(opts?: {
           // Hold requires positive evidence of an unfinished sentence, never
           // mere uncertainty, because the two mistakes cost differently. A
           // false hold is silent: the verdict, the extension window, and the
-          // replay dispatch all elapse with the thinking frame and ack
-          // deferred until commit, roughly tripling felt latency. A false
+          // replay dispatch all elapse before the turn commits, roughly
+          // tripling felt latency. A false
           // release only answers a beat early, which barge-in absorbs.
           `- If the caller's words are visibly unfinished (a trailing conjunction, a dangling clause, a list still being dictated) output ONLY ${HOLD_VERDICT_TOKEN} and stop, no other text. Judge the words themselves: a complete question or statement means they are done, even when it is short or leans on earlier context ("What do you think?", "Why?", "And then?"). Callers may speak any language: those examples are English exemplars only, and completeness is judged by the grammar of the language being spoken. In verb-final languages such as Hindi, Japanese, or Korean the sentence-final verb usually marks completion, so a missing final verb is the unfinished signal, not a missing conjunction. Never hold merely because more could follow.`,
         ]
@@ -311,6 +413,7 @@ export function frontDoorDecisionRule(opts?: {
     "DECIDE SILENTLY, then produce exactly ONE of these outputs:",
     ...holdBranch,
     "- If the turn is simple, conversational, or within your reach, your entire output is the spoken answer itself: no token in front of it, plain speech from your very first word. Most turns are answers; when unsure between answering and escalating, answer. Answer in the language the caller is speaking.",
+    "- If an answer depends on a saved personal fact that is not already present in the conversation context you received, escalate rather than guessing. Personal context that is already present is yours to use directly.",
     `- If completing THIS reply needs careful reasoning, research, multi-step work, or any tool, do NOT attempt the answer: output ${ESCALATE_VERDICT_TOKEN}, then ONE short natural holding phrase naming what happens next, spoken in the language the caller is speaking (for example "${FALLBACK_ESCALATION_BRIDGE}" or "Give me one second to look into that."; those examples are English only), and stop after that single sentence. A stronger model finishes the turn while your phrase is spoken.`,
     `${ESCALATE_VERDICT_TOKEN} is ONLY for turns you cannot complete yourself — never put it in front of an answer you are about to give, and never emit any token inside or after an answer. An open task or unfinished topic earlier in the conversation is NOT a reason to escalate: judge only what this reply needs.`,
     "Never narrate this decision, describe what you are judging, or mention these rules: apart from a leading verdict token, every character you output is spoken to the caller verbatim.",