@wix/himalaya-cli 0.894.0 → 0.895.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.894.0",
+  "version": "0.895.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -64,5 +64,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "affa459271349fb75d39f363707412430dc0902c842942e21e921614"
+  "falconPackageHash": "9635f5e7048da477ca7b19e75c3c132a21b7425937ed32d85466ec48"
 }

package/templates/beauty-salon-owner/tier5-src/_shared/aria-chat.ts

@@ -536,6 +536,60 @@ export function countTurns(msgs: ConversationMessage[], role: string): number {
   return n;
 }
 
+/** Has the turn stored under `userMessageId` already been answered?
+ *
+ *  Per-TURN, and that is the entire point. A COUNT of assistant replies says
+ *  nothing about WHICH turn was answered: a stalled turn sitting behind a later
+ *  message that did get a reply would read as answered on any count, and expiring
+ *  it there re-posts a question the server is already holding — the duplicate the
+ *  latch exists to prevent.
+ *
+ *  So: find the turn, then look at what follows it UNTIL THE NEXT USER TURN. An
+ *  assistant message in that window answered this one; the next user turn starting
+ *  first means nothing ever did.
+ *
+ *  A turn that is not in the transcript at all reads as UNANSWERED. The id is the
+ *  only evidence we have that it exists, and throwing the latch away on a
+ *  transcript that has not caught up yet is, again, the duplicate.
+ *
+ *  AN EMPTY ASSISTANT ROW IS NOT AN ANSWER — the same rule `countTurns` above
+ *  states, and for the same reason: the service opens an assistant row before it
+ *  has written anything into it. Reading that placeholder as the answer is
+ *  especially bad HERE rather than merely wrong, because the placeholder is
+ *  exactly what a trigger that was accepted and then lost its response leaves
+ *  behind. Calling that turn answered retires the latch and the next identical
+ *  question is persisted a SECOND time — the duplicate this whole latch exists to
+ *  prevent, produced by the machinery meant to prevent it.
+ *
+ *  Gated on the RAW text, via `messageText`, not on anything bubble-shaped: a
+ *  widget-only reply (`<<{"widget":…}>>`) is a real answer whose prose is empty,
+ *  and its non-empty raw text is precisely what separates it from the placeholder.
+ *
+ *  An empty row is SKIPPED rather than treated as a refusal, because the real
+ *  answer commonly lands in a later row of the same turn. */
+export function turnAnswered(msgs: ConversationMessage[], userMessageId: string): boolean {
+  if (!userMessageId) return false;
+  let seen = false;
+  for (const m of msgs) {
+    if (!seen) {
+      if (m.id === userMessageId) seen = true;
+      continue;
+    }
+    const role = m.role || "ASSISTANT";
+    if (role === "USER") return false;              // the next turn began; ours got nothing
+    // BOTH halves. An exact role match, because `MessageRole` also carries
+    // `UNKNOWN` and the wire may grow more (tool, citation, system) — a row that
+    // is merely not-USER is not an answer, and treating it as one retires the
+    // latch and re-posts the question. And non-empty raw text, because the service
+    // opens an assistant row before writing into it. `countTurns` above matches on
+    // exactly these two, and the two scanners read the same transcript: if they
+    // disagree, one of them ends the turn while the other leaves the ladder
+    // running at the fast cadence.
+    if (role === "ASSISTANT" && messageText(m).trim()) return true;
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Local recent-conversation list (himalaya.storage)
 // ---------------------------------------------------------------------------
@@ -694,7 +748,15 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  a transient recovery hint about one failed attempt, not something that
    *  should survive a reload or be persisted with the transcript. Keyed by
    *  conversation AND content so it can only ever re-trigger the exact turn it
-   *  was recorded for. */
+   *  was recorded for.
+   *
+   *  It also has to EXPIRE, and cannot do so on its own clock. A trigger whose
+   *  RESPONSE was lost — a timeout, a reset — failed here while succeeding at the
+   *  service, so the turn runs and the latch is left naming something already
+   *  answered. Re-triggering that does not duplicate anything; it drops the
+   *  owner's next identical question instead, which is quieter and worse. The
+   *  expiry is therefore a question asked of the SERVER at reuse time — see
+   *  `turnAnswered` — rather than anything inferred from local counts. */
   let stalledTurn: { convId: string; content: string; userMessageId: string } | null = null;
 
   /** Refuse a send that is already on its way. State half + latch half. */
@@ -802,6 +864,13 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     // after it fell back to a full send, duplicating the very turn the latch
     // exists to protect.
     let retriedId = "";
+    // The latch as it stood when this send started, and whether it names THIS
+    // send's turn. Out here for the same reason `retriedId` is: the catch has to
+    // tell "the latch I was working on" from "a latch that belongs to another
+    // turn", and clearing the second is how an unrelated failure destroys a turn
+    // the owner is still owed an answer to.
+    let latch: typeof stalledTurn = null;
+    let supersedes = false;
     try {
       const ensured = await ensureConversation(s);
       convId = ensured.convId;
@@ -816,9 +885,34 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // `createConversation`). Sending without it defaulted the turn to
       // `ARIA_ORIGIN`, so a consumer that configured its own origin created the
       // conversation under one name and posted into it under another.
-      const stalled = stalledTurn && stalledTurn.convId === convId && stalledTurn.content === content
-        ? stalledTurn
-        : null;
+      //
+      // Two questions, deliberately separate. Does the latch name the turn THIS
+      // send is about (`supersedes`)? And if so, is that turn still worth
+      // re-triggering (`stalled`)?
+      latch = stalledTurn;
+      supersedes = !!latch && latch.convId === convId && latch.content === content;
+      // …and only while it is still UNANSWERED, which is ASKED rather than
+      // inferred. A trigger whose response was lost failed here while succeeding
+      // at the service, so the answer arrives anyway and the id now names a
+      // finished turn; re-triggering it there does not duplicate anything, it
+      // drops the owner's new question instead and re-answers the old one — a
+      // duplicate is at least visible in the transcript, a dropped question is not.
+      //
+      // One extra GET, on the retry path only. Local state cannot stand in for it:
+      // a COUNT of assistant replies cannot say which turn was answered, and
+      // nothing arms the poll ladder after a failed send, so on the very screen
+      // this protects there may be no tick to advance a count in the first place.
+      //
+      // A read that FAILS leaves the latch alone. Unknown has to mean "still
+      // stalled": that is the shipped behaviour, and the conditions where this read
+      // fails are the same flaky ones that stalled the turn.
+      let stalled = supersedes ? latch : null;
+      if (stalled) {
+        try {
+          const seen = messagesOf(await getConversationMessages(convId));
+          if (turnAnswered(seen, stalled.userMessageId)) stalled = null;
+        } catch { /* unknown — keep the latch, see above */ }
+      }
       if (stalled) {
         retriedId = stalled.userMessageId;
         await triggerAssistantMessage(convId, stalled.userMessageId, { origin });
@@ -833,7 +927,25 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // — the turn has been triggered — so leaving `retriedId` set let the catch
       // below rebuild a latch for a turn already being answered, and the next
       // identical submission triggered it a second time.
-      stalledTurn = null;
+      //
+      // `supersedes`, not unconditional: clearing on ANY success loses a turn that
+      // is still stranded across an UNRELATED message. The owner whose question
+      // failed to trigger asks something else, it goes through, they come back to
+      // the first question — and that retry re-posts it, which is the exact
+      // duplicate the latch exists to prevent, one message later. A turn nothing
+      // has settled stays latched; `after` above is what eventually retires it.
+      //
+      // Still one slot, so an unrelated send that FAILS after storing its own turn
+      // displaces the older one. Narrowing that wants a queue rather than a latch,
+      // and no reported flow reaches it.
+      //
+      // Compared by IDENTITY, not just `supersedes`: `latch` was read before the
+      // awaits above, and actions interleave at every await in this worker (the
+      // `creating` latch says the same). `duplicate()` only refuses IDENTICAL
+      // content, so a second message can be in flight alongside this one and store
+      // its own latch while we wait — clearing on the stale answer would throw
+      // away a turn this send never touched.
+      if (supersedes && stalledTurn === latch) stalledTurn = null;
       retriedId = "";
       // A conversation minted just now starts empty, so the marks taken above
       // from the PREVIOUS conversation's counts would be ahead of it and its
@@ -862,9 +974,27 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // whose trigger failed (the id arrives on the error), or a RE-TRIGGER of
       // an already-stored turn that failed again (no id on the error, because
       // nothing new was stored — the one we were retrying is still the answer).
+      //
+      // "Any other failure clears the latch" holds only for a latch THIS SEND
+      // OWNED. Clearing unconditionally destroys an older, still-stranded turn
+      // that this same send had just correctly preserved on the success path
+      // above — and there is a whole class of failures with nothing stored:
+      // a step-1 failure, a failed create, and (with no `o.poll`) a `busyLoop`
+      // transcript read that throws AFTER delivery, where `retriedId` has already
+      // been cleared so `keptId` is empty. The owner returns to the first question
+      // and it is posted twice: the same defect as the success path, one layer
+      // down and under the same flaky conditions.
+      //
+      // Identity again, and for the reason spelled out on the success path: what
+      // is in the slot now may belong to a send that interleaved with this one.
       const storedId = (e as { storedUserMessageId?: unknown })?.storedUserMessageId;
       const keptId = typeof storedId === "string" && storedId ? storedId : retriedId;
-      stalledTurn = convId && keptId ? { convId, content, userMessageId: keptId } : null;
+      stalledTurn = convId && keptId
+        ? { convId, content, userMessageId: keptId }
+        // Nothing stored by this attempt. Drop the latch only if it is the one
+        // this send was working on and is still the one we captured; otherwise it
+        // belongs to another turn and must survive.
+        : (supersedes && stalledTurn === latch ? null : stalledTurn);
       return {
         ...base, status: "ready", _pending: "",
         // `_siteId` moves with the id or neither does: a conversation remembered

package/templates/community-club-owner/tier5-src/_shared/aria-chat.ts

@@ -536,6 +536,60 @@ export function countTurns(msgs: ConversationMessage[], role: string): number {
   return n;
 }
 
+/** Has the turn stored under `userMessageId` already been answered?
+ *
+ *  Per-TURN, and that is the entire point. A COUNT of assistant replies says
+ *  nothing about WHICH turn was answered: a stalled turn sitting behind a later
+ *  message that did get a reply would read as answered on any count, and expiring
+ *  it there re-posts a question the server is already holding — the duplicate the
+ *  latch exists to prevent.
+ *
+ *  So: find the turn, then look at what follows it UNTIL THE NEXT USER TURN. An
+ *  assistant message in that window answered this one; the next user turn starting
+ *  first means nothing ever did.
+ *
+ *  A turn that is not in the transcript at all reads as UNANSWERED. The id is the
+ *  only evidence we have that it exists, and throwing the latch away on a
+ *  transcript that has not caught up yet is, again, the duplicate.
+ *
+ *  AN EMPTY ASSISTANT ROW IS NOT AN ANSWER — the same rule `countTurns` above
+ *  states, and for the same reason: the service opens an assistant row before it
+ *  has written anything into it. Reading that placeholder as the answer is
+ *  especially bad HERE rather than merely wrong, because the placeholder is
+ *  exactly what a trigger that was accepted and then lost its response leaves
+ *  behind. Calling that turn answered retires the latch and the next identical
+ *  question is persisted a SECOND time — the duplicate this whole latch exists to
+ *  prevent, produced by the machinery meant to prevent it.
+ *
+ *  Gated on the RAW text, via `messageText`, not on anything bubble-shaped: a
+ *  widget-only reply (`<<{"widget":…}>>`) is a real answer whose prose is empty,
+ *  and its non-empty raw text is precisely what separates it from the placeholder.
+ *
+ *  An empty row is SKIPPED rather than treated as a refusal, because the real
+ *  answer commonly lands in a later row of the same turn. */
+export function turnAnswered(msgs: ConversationMessage[], userMessageId: string): boolean {
+  if (!userMessageId) return false;
+  let seen = false;
+  for (const m of msgs) {
+    if (!seen) {
+      if (m.id === userMessageId) seen = true;
+      continue;
+    }
+    const role = m.role || "ASSISTANT";
+    if (role === "USER") return false;              // the next turn began; ours got nothing
+    // BOTH halves. An exact role match, because `MessageRole` also carries
+    // `UNKNOWN` and the wire may grow more (tool, citation, system) — a row that
+    // is merely not-USER is not an answer, and treating it as one retires the
+    // latch and re-posts the question. And non-empty raw text, because the service
+    // opens an assistant row before writing into it. `countTurns` above matches on
+    // exactly these two, and the two scanners read the same transcript: if they
+    // disagree, one of them ends the turn while the other leaves the ladder
+    // running at the fast cadence.
+    if (role === "ASSISTANT" && messageText(m).trim()) return true;
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Local recent-conversation list (himalaya.storage)
 // ---------------------------------------------------------------------------
@@ -694,7 +748,15 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  a transient recovery hint about one failed attempt, not something that
    *  should survive a reload or be persisted with the transcript. Keyed by
    *  conversation AND content so it can only ever re-trigger the exact turn it
-   *  was recorded for. */
+   *  was recorded for.
+   *
+   *  It also has to EXPIRE, and cannot do so on its own clock. A trigger whose
+   *  RESPONSE was lost — a timeout, a reset — failed here while succeeding at the
+   *  service, so the turn runs and the latch is left naming something already
+   *  answered. Re-triggering that does not duplicate anything; it drops the
+   *  owner's next identical question instead, which is quieter and worse. The
+   *  expiry is therefore a question asked of the SERVER at reuse time — see
+   *  `turnAnswered` — rather than anything inferred from local counts. */
   let stalledTurn: { convId: string; content: string; userMessageId: string } | null = null;
 
   /** Refuse a send that is already on its way. State half + latch half. */
@@ -802,6 +864,13 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     // after it fell back to a full send, duplicating the very turn the latch
     // exists to protect.
     let retriedId = "";
+    // The latch as it stood when this send started, and whether it names THIS
+    // send's turn. Out here for the same reason `retriedId` is: the catch has to
+    // tell "the latch I was working on" from "a latch that belongs to another
+    // turn", and clearing the second is how an unrelated failure destroys a turn
+    // the owner is still owed an answer to.
+    let latch: typeof stalledTurn = null;
+    let supersedes = false;
     try {
       const ensured = await ensureConversation(s);
       convId = ensured.convId;
@@ -816,9 +885,34 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // `createConversation`). Sending without it defaulted the turn to
       // `ARIA_ORIGIN`, so a consumer that configured its own origin created the
       // conversation under one name and posted into it under another.
-      const stalled = stalledTurn && stalledTurn.convId === convId && stalledTurn.content === content
-        ? stalledTurn
-        : null;
+      //
+      // Two questions, deliberately separate. Does the latch name the turn THIS
+      // send is about (`supersedes`)? And if so, is that turn still worth
+      // re-triggering (`stalled`)?
+      latch = stalledTurn;
+      supersedes = !!latch && latch.convId === convId && latch.content === content;
+      // …and only while it is still UNANSWERED, which is ASKED rather than
+      // inferred. A trigger whose response was lost failed here while succeeding
+      // at the service, so the answer arrives anyway and the id now names a
+      // finished turn; re-triggering it there does not duplicate anything, it
+      // drops the owner's new question instead and re-answers the old one — a
+      // duplicate is at least visible in the transcript, a dropped question is not.
+      //
+      // One extra GET, on the retry path only. Local state cannot stand in for it:
+      // a COUNT of assistant replies cannot say which turn was answered, and
+      // nothing arms the poll ladder after a failed send, so on the very screen
+      // this protects there may be no tick to advance a count in the first place.
+      //
+      // A read that FAILS leaves the latch alone. Unknown has to mean "still
+      // stalled": that is the shipped behaviour, and the conditions where this read
+      // fails are the same flaky ones that stalled the turn.
+      let stalled = supersedes ? latch : null;
+      if (stalled) {
+        try {
+          const seen = messagesOf(await getConversationMessages(convId));
+          if (turnAnswered(seen, stalled.userMessageId)) stalled = null;
+        } catch { /* unknown — keep the latch, see above */ }
+      }
       if (stalled) {
         retriedId = stalled.userMessageId;
         await triggerAssistantMessage(convId, stalled.userMessageId, { origin });
@@ -833,7 +927,25 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // — the turn has been triggered — so leaving `retriedId` set let the catch
       // below rebuild a latch for a turn already being answered, and the next
       // identical submission triggered it a second time.
-      stalledTurn = null;
+      //
+      // `supersedes`, not unconditional: clearing on ANY success loses a turn that
+      // is still stranded across an UNRELATED message. The owner whose question
+      // failed to trigger asks something else, it goes through, they come back to
+      // the first question — and that retry re-posts it, which is the exact
+      // duplicate the latch exists to prevent, one message later. A turn nothing
+      // has settled stays latched; `after` above is what eventually retires it.
+      //
+      // Still one slot, so an unrelated send that FAILS after storing its own turn
+      // displaces the older one. Narrowing that wants a queue rather than a latch,
+      // and no reported flow reaches it.
+      //
+      // Compared by IDENTITY, not just `supersedes`: `latch` was read before the
+      // awaits above, and actions interleave at every await in this worker (the
+      // `creating` latch says the same). `duplicate()` only refuses IDENTICAL
+      // content, so a second message can be in flight alongside this one and store
+      // its own latch while we wait — clearing on the stale answer would throw
+      // away a turn this send never touched.
+      if (supersedes && stalledTurn === latch) stalledTurn = null;
       retriedId = "";
       // A conversation minted just now starts empty, so the marks taken above
       // from the PREVIOUS conversation's counts would be ahead of it and its
@@ -862,9 +974,27 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // whose trigger failed (the id arrives on the error), or a RE-TRIGGER of
       // an already-stored turn that failed again (no id on the error, because
       // nothing new was stored — the one we were retrying is still the answer).
+      //
+      // "Any other failure clears the latch" holds only for a latch THIS SEND
+      // OWNED. Clearing unconditionally destroys an older, still-stranded turn
+      // that this same send had just correctly preserved on the success path
+      // above — and there is a whole class of failures with nothing stored:
+      // a step-1 failure, a failed create, and (with no `o.poll`) a `busyLoop`
+      // transcript read that throws AFTER delivery, where `retriedId` has already
+      // been cleared so `keptId` is empty. The owner returns to the first question
+      // and it is posted twice: the same defect as the success path, one layer
+      // down and under the same flaky conditions.
+      //
+      // Identity again, and for the reason spelled out on the success path: what
+      // is in the slot now may belong to a send that interleaved with this one.
       const storedId = (e as { storedUserMessageId?: unknown })?.storedUserMessageId;
       const keptId = typeof storedId === "string" && storedId ? storedId : retriedId;
-      stalledTurn = convId && keptId ? { convId, content, userMessageId: keptId } : null;
+      stalledTurn = convId && keptId
+        ? { convId, content, userMessageId: keptId }
+        // Nothing stored by this attempt. Drop the latch only if it is the one
+        // this send was working on and is still the one we captured; otherwise it
+        // belongs to another turn and must survive.
+        : (supersedes && stalledTurn === latch ? null : stalledTurn);
       return {
         ...base, status: "ready", _pending: "",
         // `_siteId` moves with the id or neither does: a conversation remembered

package/templates/events-meetups-owner/tier5-src/_shared/aria-chat.ts

@@ -536,6 +536,60 @@ export function countTurns(msgs: ConversationMessage[], role: string): number {
   return n;
 }
 
+/** Has the turn stored under `userMessageId` already been answered?
+ *
+ *  Per-TURN, and that is the entire point. A COUNT of assistant replies says
+ *  nothing about WHICH turn was answered: a stalled turn sitting behind a later
+ *  message that did get a reply would read as answered on any count, and expiring
+ *  it there re-posts a question the server is already holding — the duplicate the
+ *  latch exists to prevent.
+ *
+ *  So: find the turn, then look at what follows it UNTIL THE NEXT USER TURN. An
+ *  assistant message in that window answered this one; the next user turn starting
+ *  first means nothing ever did.
+ *
+ *  A turn that is not in the transcript at all reads as UNANSWERED. The id is the
+ *  only evidence we have that it exists, and throwing the latch away on a
+ *  transcript that has not caught up yet is, again, the duplicate.
+ *
+ *  AN EMPTY ASSISTANT ROW IS NOT AN ANSWER — the same rule `countTurns` above
+ *  states, and for the same reason: the service opens an assistant row before it
+ *  has written anything into it. Reading that placeholder as the answer is
+ *  especially bad HERE rather than merely wrong, because the placeholder is
+ *  exactly what a trigger that was accepted and then lost its response leaves
+ *  behind. Calling that turn answered retires the latch and the next identical
+ *  question is persisted a SECOND time — the duplicate this whole latch exists to
+ *  prevent, produced by the machinery meant to prevent it.
+ *
+ *  Gated on the RAW text, via `messageText`, not on anything bubble-shaped: a
+ *  widget-only reply (`<<{"widget":…}>>`) is a real answer whose prose is empty,
+ *  and its non-empty raw text is precisely what separates it from the placeholder.
+ *
+ *  An empty row is SKIPPED rather than treated as a refusal, because the real
+ *  answer commonly lands in a later row of the same turn. */
+export function turnAnswered(msgs: ConversationMessage[], userMessageId: string): boolean {
+  if (!userMessageId) return false;
+  let seen = false;
+  for (const m of msgs) {
+    if (!seen) {
+      if (m.id === userMessageId) seen = true;
+      continue;
+    }
+    const role = m.role || "ASSISTANT";
+    if (role === "USER") return false;              // the next turn began; ours got nothing
+    // BOTH halves. An exact role match, because `MessageRole` also carries
+    // `UNKNOWN` and the wire may grow more (tool, citation, system) — a row that
+    // is merely not-USER is not an answer, and treating it as one retires the
+    // latch and re-posts the question. And non-empty raw text, because the service
+    // opens an assistant row before writing into it. `countTurns` above matches on
+    // exactly these two, and the two scanners read the same transcript: if they
+    // disagree, one of them ends the turn while the other leaves the ladder
+    // running at the fast cadence.
+    if (role === "ASSISTANT" && messageText(m).trim()) return true;
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Local recent-conversation list (himalaya.storage)
 // ---------------------------------------------------------------------------
@@ -694,7 +748,15 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  a transient recovery hint about one failed attempt, not something that
    *  should survive a reload or be persisted with the transcript. Keyed by
    *  conversation AND content so it can only ever re-trigger the exact turn it
-   *  was recorded for. */
+   *  was recorded for.
+   *
+   *  It also has to EXPIRE, and cannot do so on its own clock. A trigger whose
+   *  RESPONSE was lost — a timeout, a reset — failed here while succeeding at the
+   *  service, so the turn runs and the latch is left naming something already
+   *  answered. Re-triggering that does not duplicate anything; it drops the
+   *  owner's next identical question instead, which is quieter and worse. The
+   *  expiry is therefore a question asked of the SERVER at reuse time — see
+   *  `turnAnswered` — rather than anything inferred from local counts. */
   let stalledTurn: { convId: string; content: string; userMessageId: string } | null = null;
 
   /** Refuse a send that is already on its way. State half + latch half. */
@@ -802,6 +864,13 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     // after it fell back to a full send, duplicating the very turn the latch
     // exists to protect.
     let retriedId = "";
+    // The latch as it stood when this send started, and whether it names THIS
+    // send's turn. Out here for the same reason `retriedId` is: the catch has to
+    // tell "the latch I was working on" from "a latch that belongs to another
+    // turn", and clearing the second is how an unrelated failure destroys a turn
+    // the owner is still owed an answer to.
+    let latch: typeof stalledTurn = null;
+    let supersedes = false;
     try {
       const ensured = await ensureConversation(s);
       convId = ensured.convId;
@@ -816,9 +885,34 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // `createConversation`). Sending without it defaulted the turn to
       // `ARIA_ORIGIN`, so a consumer that configured its own origin created the
       // conversation under one name and posted into it under another.
-      const stalled = stalledTurn && stalledTurn.convId === convId && stalledTurn.content === content
-        ? stalledTurn
-        : null;
+      //
+      // Two questions, deliberately separate. Does the latch name the turn THIS
+      // send is about (`supersedes`)? And if so, is that turn still worth
+      // re-triggering (`stalled`)?
+      latch = stalledTurn;
+      supersedes = !!latch && latch.convId === convId && latch.content === content;
+      // …and only while it is still UNANSWERED, which is ASKED rather than
+      // inferred. A trigger whose response was lost failed here while succeeding
+      // at the service, so the answer arrives anyway and the id now names a
+      // finished turn; re-triggering it there does not duplicate anything, it
+      // drops the owner's new question instead and re-answers the old one — a
+      // duplicate is at least visible in the transcript, a dropped question is not.
+      //
+      // One extra GET, on the retry path only. Local state cannot stand in for it:
+      // a COUNT of assistant replies cannot say which turn was answered, and
+      // nothing arms the poll ladder after a failed send, so on the very screen
+      // this protects there may be no tick to advance a count in the first place.
+      //
+      // A read that FAILS leaves the latch alone. Unknown has to mean "still
+      // stalled": that is the shipped behaviour, and the conditions where this read
+      // fails are the same flaky ones that stalled the turn.
+      let stalled = supersedes ? latch : null;
+      if (stalled) {
+        try {
+          const seen = messagesOf(await getConversationMessages(convId));
+          if (turnAnswered(seen, stalled.userMessageId)) stalled = null;
+        } catch { /* unknown — keep the latch, see above */ }
+      }
       if (stalled) {
         retriedId = stalled.userMessageId;
         await triggerAssistantMessage(convId, stalled.userMessageId, { origin });
@@ -833,7 +927,25 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // — the turn has been triggered — so leaving `retriedId` set let the catch
       // below rebuild a latch for a turn already being answered, and the next
       // identical submission triggered it a second time.
-      stalledTurn = null;
+      //
+      // `supersedes`, not unconditional: clearing on ANY success loses a turn that
+      // is still stranded across an UNRELATED message. The owner whose question
+      // failed to trigger asks something else, it goes through, they come back to
+      // the first question — and that retry re-posts it, which is the exact
+      // duplicate the latch exists to prevent, one message later. A turn nothing
+      // has settled stays latched; `after` above is what eventually retires it.
+      //
+      // Still one slot, so an unrelated send that FAILS after storing its own turn
+      // displaces the older one. Narrowing that wants a queue rather than a latch,
+      // and no reported flow reaches it.
+      //
+      // Compared by IDENTITY, not just `supersedes`: `latch` was read before the
+      // awaits above, and actions interleave at every await in this worker (the
+      // `creating` latch says the same). `duplicate()` only refuses IDENTICAL
+      // content, so a second message can be in flight alongside this one and store
+      // its own latch while we wait — clearing on the stale answer would throw
+      // away a turn this send never touched.
+      if (supersedes && stalledTurn === latch) stalledTurn = null;
       retriedId = "";
       // A conversation minted just now starts empty, so the marks taken above
       // from the PREVIOUS conversation's counts would be ahead of it and its
@@ -862,9 +974,27 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // whose trigger failed (the id arrives on the error), or a RE-TRIGGER of
       // an already-stored turn that failed again (no id on the error, because
       // nothing new was stored — the one we were retrying is still the answer).
+      //
+      // "Any other failure clears the latch" holds only for a latch THIS SEND
+      // OWNED. Clearing unconditionally destroys an older, still-stranded turn
+      // that this same send had just correctly preserved on the success path
+      // above — and there is a whole class of failures with nothing stored:
+      // a step-1 failure, a failed create, and (with no `o.poll`) a `busyLoop`
+      // transcript read that throws AFTER delivery, where `retriedId` has already
+      // been cleared so `keptId` is empty. The owner returns to the first question
+      // and it is posted twice: the same defect as the success path, one layer
+      // down and under the same flaky conditions.
+      //
+      // Identity again, and for the reason spelled out on the success path: what
+      // is in the slot now may belong to a send that interleaved with this one.
       const storedId = (e as { storedUserMessageId?: unknown })?.storedUserMessageId;
       const keptId = typeof storedId === "string" && storedId ? storedId : retriedId;
-      stalledTurn = convId && keptId ? { convId, content, userMessageId: keptId } : null;
+      stalledTurn = convId && keptId
+        ? { convId, content, userMessageId: keptId }
+        // Nothing stored by this attempt. Drop the latch only if it is the one
+        // this send was working on and is still the one we captured; otherwise it
+        // belongs to another turn and must survive.
+        : (supersedes && stalledTurn === latch ? null : stalledTurn);
       return {
         ...base, status: "ready", _pending: "",
         // `_siteId` moves with the id or neither does: a conversation remembered