agentus 0.10.1 → 0.11.1

package/README.md

@@ -57,7 +57,7 @@ background process comes back as a turn of its own), an **ACP session that write
 cockpit-side failure is diagnosable afterwards), and a **DeepSeek web backend** (search +
 extract on the model key) — come from the fork's integration build instead. That is a five-line install:
 [§ Which Hermes to run](docs/installation.md#which-hermes-to-run) — currently the tag
-`agentus/v0.22.0/merge-20261022-2226`, on Hermes `v0.22.0`.
+`agentus/v0.22.0/merge-20261023-0540`, on Hermes `v0.22.0`.
 
 The first slot you start will use the Hermes home **your own agent already uses**
 (`~/.hermes`) unless the backend row names another one — see "HERMES_HOME" below.

package/README.zh-CN.md

@@ -51,7 +51,7 @@ web bundle、配套 APK —— 然后直接退出，不启动任何东西）。
 以及 **DeepSeek 的 web 后端**（搜索 + 正文抓取，共用模型 key）—— 来自 fork 的集成构建（tag）。
 装法就五行：
 [§ 该跑哪份 Hermes](docs/installation.zh-CN.md#该跑哪份-hermes) —— 当前是 tag
-`agentus/v0.22.0/merge-20261022-2226`，基座 Hermes `v0.22.0`。
+`agentus/v0.22.0/merge-20261023-0540`，基座 Hermes `v0.22.0`。
 
 你启动的第一个 slot 会使用**你自己的 agent 已经在用的**那个 Hermes home（`~/.hermes`），除非后端那一行
 指定了另一个 —— 见下面的「HERMES_HOME」。

package/docs/installation.md

@@ -60,7 +60,7 @@ ref and gets rebuilt, while a tag never moves — so pin the tag. The `agentus/`
 ours apart from upstream's own tags (`v0.22.0`, `v0.22.0+canary.*`), and the timestamp in the
 last segment sorts, so "newest" is a `sort -V`.
 
-**Current integration build: `agentus/v0.22.0/merge-20261022-2226`** — the newest tag on the fork,
+**Current integration build: `agentus/v0.22.0/merge-20261023-0540`** — the newest tag on the fork,
 built on Hermes `v0.22.0`. This line is for orientation only, not the source of truth: the
 `TAG=$(…)` step below resolves the newest one on every run, so read it there if this sentence
 ever looks stale.

package/docs/installation.zh-CN.md

@@ -52,7 +52,7 @@ agentus/<hermes 内部版本>/merge-<YYYYMMDD-HHMM>
 tag。`agentus/` 这个前缀也把它和上游自己的 tag（`v0.22.0`、`v0.22.0+canary.*`）分开；最后一段是时间戳，
 可排序，所以「最新」就是一次 `sort -V`。
 
-**当前集成构建：`agentus/v0.22.0/merge-20261022-2226`** —— fork 上最新的那个 tag，基座 Hermes
+**当前集成构建：`agentus/v0.22.0/merge-20261023-0540`** —— fork 上最新的那个 tag，基座 Hermes
 `v0.22.0`。这行只为一眼看个大概，不是权威：下面的 `TAG=$(…)` 每次都会自己解析出最新，觉得这行过期就
 以它为准。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentus",
-  "version": "0.10.1",
+  "version": "0.11.1",
   "description": "Multi-session web cockpit for ACP-speaking coding agents (Qoder CLI / Hermes). UI has no intelligence — the agent lives in spawned CLI subprocesses.",
   "license": "Apache-2.0",
   "repository": {

package/packages/server/src/acp/agent-owner.ts

@@ -0,0 +1,141 @@
+// WHICH agent processes belong to THIS data directory.
+//
+// `reclaimOrphans()` used to ask one question — `process.kill(pid, 0)`, "is this number alive?" — and
+// then SIGKILL it. Two ways that ends a session that was perfectly healthy:
+//   1. pid reuse: the agent died with the previous server, the number went to something else, and the
+//      next boot killed an unrelated process;
+//   2. two servers on one data dir (incident 2026-10-22 §7): the second one reclaimed the first one's
+//      agents — every minute, forever, because it kept failing to listen and retrying.
+//
+// A pid is a weak identity, so each spawn now leaves a receipt next to the store:
+//   <DATA_DIR>/agents/<pid>.json = { pid, sessionId, dataDir, serverInstance, startedAt, cmd }
+// and a reclaim only kills when the receipt proves the process is an agent of this data dir from a
+// PREVIOUS server run. No receipt (rows written by older builds) → the argv must still look like an
+// ACP agent; otherwise the pid is dropped with a warning instead of being killed.
+
+import fs from "node:fs";
+import path from "node:path";
+import { commandLineOf, pidAlive } from "../instance-lock.js";
+
+export interface AgentReceipt {
+  pid: number;
+  sessionId: string;
+  dataDir: string;
+  /** The server run that spawned it — the same value as the instance lock's `instanceId`. */
+  serverInstance: string;
+  startedAt: number;
+  cmd: string;
+}
+
+export interface Verdict {
+  /** Nothing to kill: the pid is already gone. Not an error, never worth a warning. */
+  gone: boolean;
+  /** Safe to SIGKILL: the receipt proves ownership. */
+  kill: boolean;
+  /** Human-readable reason, logged either way (the operator's next 5-minute diagnosis). */
+  why: string;
+}
+
+function agentsDir(dataDir: string): string {
+  return path.join(dataDir, "agents");
+}
+
+function receiptPath(dataDir: string, pid: number): string {
+  return path.join(agentsDir(dataDir), `${pid}.json`);
+}
+
+/** Best effort: bookkeeping must never fail a session. */
+export function recordAgentOwner(dataDir: string | null, receipt: Omit<AgentReceipt, "dataDir"> & { dataDir?: string }): void {
+  const dir = dataDir ?? receipt.dataDir;
+  if (!dir) return;
+  try {
+    fs.mkdirSync(agentsDir(dir), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(
+      receiptPath(dir, receipt.pid),
+      JSON.stringify({ ...receipt, dataDir: path.resolve(dir) }, null, 2),
+      { mode: 0o600 },
+    );
+  } catch { /* an unreadable receipt only makes reclaim more conservative */ }
+}
+
+export function forgetAgentOwner(dataDir: string | null, pid: number | null | undefined): void {
+  if (!dataDir || !pid) return;
+  try { fs.unlinkSync(receiptPath(dataDir, pid)); } catch { /* already gone */ }
+}
+
+function readReceipt(dataDir: string, pid: number): AgentReceipt | null {
+  try {
+    const j = JSON.parse(fs.readFileSync(receiptPath(dataDir, pid), "utf8")) as Partial<AgentReceipt>;
+    if (typeof j.pid !== "number") return null;
+    return {
+      pid: j.pid,
+      sessionId: typeof j.sessionId === "string" ? j.sessionId : "",
+      dataDir: typeof j.dataDir === "string" ? j.dataDir : "",
+      serverInstance: typeof j.serverInstance === "string" ? j.serverInstance : "",
+      startedAt: typeof j.startedAt === "number" ? j.startedAt : 0,
+      cmd: typeof j.cmd === "string" ? j.cmd : "",
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Does this argv look like a CLI coding agent run over ACP? Fallback for rows without a receipt. */
+export function looksLikeAcpAgent(cmd: string | null): boolean {
+  if (!cmd) return false;
+  if (/mock[\\/]agent\.mjs\b/.test(cmd)) return true;          // the bundled mock backend
+  if (/\bqodercli\b/.test(cmd)) return true;
+  if (/\bhermes\b/.test(cmd) && /\bacp\b/.test(cmd)) return true;
+  if (/\b(claude-code|claude|opencode|codex)\b/.test(cmd) && /\bacp\b/.test(cmd)) return true;
+  return false;
+}
+
+/**
+ * Decide whether `pid` (recorded on session `sessionId`) may be killed by the startup reclaim.
+ *
+ * `serverInstance` is OUR instance id: a receipt naming it means the process is ours, so it is not an
+ * orphan at all (this also makes the call safe to use while running).
+ */
+export function verifyAgentOwner(
+  dataDir: string | null,
+  pid: number,
+  sessionId: string,
+  serverInstance: string,
+): Verdict {
+  if (!pidAlive(pid)) return { gone: true, kill: false, why: `pid ${pid} already gone` };
+
+  const cmd = commandLineOf(pid);
+  if (!cmd) return { gone: true, kill: false, why: `pid ${pid} vanished while checking` };
+
+  if (!dataDir) {
+    // No data dir wired in (unit tests, odd embedders): fall back to the argv shape, and say so.
+    return looksLikeAcpAgent(cmd)
+      ? { gone: false, kill: true, why: `pid ${pid} matches an ACP agent (no data dir to compare)` }
+      : { gone: false, kill: false, why: `pid ${pid} is not an ACP agent (${cmd.slice(0, 120)})` };
+  }
+
+  const receipt = readReceipt(dataDir, pid);
+  if (receipt) {
+    if (receipt.dataDir && path.resolve(receipt.dataDir) !== path.resolve(dataDir)) {
+      return { gone: false, kill: false, why: `pid ${pid} was spawned by the server of ${receipt.dataDir}` };
+    }
+    if (receipt.sessionId && receipt.sessionId !== sessionId) {
+      return { gone: false, kill: false, why: `pid ${pid} belongs to session ${receipt.sessionId}, not ${sessionId}` };
+    }
+    if (receipt.serverInstance && receipt.serverInstance === serverInstance) {
+      return { gone: false, kill: false, why: `pid ${pid} was spawned by THIS server run` };
+    }
+    if (!looksLikeAcpAgent(cmd)) {
+      // Receipt says ours, argv says something else: the pid was recycled after all. Trust the argv.
+      return { gone: false, kill: false, why: `pid ${pid} no longer runs an ACP agent (${cmd.slice(0, 120)})` };
+    }
+    return { gone: false, kill: true, why: `pid ${pid} = agent of session ${sessionId} from a previous run (receipt)` };
+  }
+
+  // Receipt-less row (written before this file existed, or the file was lost). Judge by argv only:
+  // a non-agent process must NEVER be killed for a stale database row.
+  if (!looksLikeAcpAgent(cmd)) {
+    return { gone: false, kill: false, why: `pid ${pid} is not an ACP agent (${cmd.slice(0, 120)})` };
+  }
+  return { gone: false, kill: true, why: `pid ${pid} matches an ACP agent (no receipt: legacy row)` };
+}

package/packages/server/src/acp/session-manager.ts

@@ -15,6 +15,8 @@ import type {
   RequestPermissionResponse,
 } from "@agentclientprotocol/sdk";
 import { BACKENDS, buildSpawnEnv, nativePlanSourceOf, type BackendSpec } from "./backends.js";
+import { forgetAgentOwner, recordAgentOwner, verifyAgentOwner } from "./agent-owner.js";
+import { thinkingOptionOf, voiceAppliesToPrompt, voiceModeBlock } from "./voice-mode.js";
 import {
   byActivity,
   coldPage as pageCold,
@@ -287,10 +289,17 @@ export class SessionManager {
    *  to hibernate. Default ON — this is the CLI/gateway behaviour, and the whole point is that the
    *  agent takes its own result instead of the operator noticing a stale screen. */
   #completionWake: () => boolean = () => true;
+  /** The data directory this server owns, and the id of THIS run. Both come from the instance lock
+   *  in index.ts; together they are the only evidence that a recorded pid is an agent OF THIS STORE
+   *  from a PREVIOUS run — see `agent-owner.ts` and the 2026-10-22 incident. */
+  #dataDir: string | null = null;
+  #instanceId = "";
 
-  constructor(store: Store, emit: Emitter) {
+  constructor(store: Store, emit: Emitter, opts: { dataDir?: string | null; instanceId?: string } = {}) {
     this.#store = store;
     this.#emit = emit;
+    this.#dataDir = opts.dataDir ?? null;
+    this.#instanceId = opts.instanceId ?? "";
   }
 
   /** Wire the operator's 「后台任务完成唤醒」 switch in (index.ts → settings.agent.completionWake). */
@@ -304,6 +313,17 @@ export class SessionManager {
     this.#planHint = read;
   }
 
+  /** 语音通话（issue #48）：which session is on a call RIGHT NOW, or null when nobody is.
+   *  Wired from index.ts to the notify centre's presence — 「在打电话」 already has exactly one
+   *  answer in this process, and a second source would drift. Optional: with nothing wired the
+   *  manager never injects anything, which is the pre-#48 behaviour. */
+  #callLive: () => string | null = () => null;
+  /** Serialises call-state transitions (see syncCallState). */
+  #callSync: Promise<void> = Promise.resolve();
+  setCallLiveSource(read: () => string | null): void {
+    this.#callLive = read;
+  }
+
   list(): SessionInfo[] {
     // Most recently CHATTED first — the cockpit's left rail is a launch pad, not a log file, and
     // creation order is the wrong key for that: the session you talked to a minute ago is the
@@ -361,17 +381,44 @@ export class SessionManager {
     return this.#sessions.get(id)?.busy ?? false;
   }
 
-  /** Reclaim orphans from a previous server run (AC5): kill recorded pids. */
+  /** Reclaim orphans from a previous server run (AC5): kill recorded pids — but only the ones that are
+   *  provably agents of THIS data dir (see `agent-owner.ts`).
+   *
+   *  A pid in the database is a claim, not proof. Three things it can be:
+   *    · an agent of this store that outlived the previous server → kill it, it holds the browser's
+   *      session id and nothing will ever answer through it again;
+   *    · a pid that died with the previous server and got recycled by something else → leave it alone,
+   *      say so in the log, and drop it from the row;
+   *    · an agent of ANOTHER server on the same data dir (the 2026-10-22 accident: a second instance
+   *      that could not even listen reclaimed the live cockpit's slots on every retry) → leave it
+   *      alone. The instance lock in index.ts refuses that second server outright; this is the second
+   *      line of defence, for the case where the claim was lost or hand-edited.
+   *
+   *  Never throws: the boot must not fail because one row is odd. */
   reclaimOrphans(): number {
     let killed = 0;
+    let skipped = 0;
     for (const row of this.#store.listSessions(true)) {
       if (row.pid == null) continue;
-      try {
-        process.kill(row.pid, 0); // alive?
-        process.kill(row.pid, "SIGKILL");
-        killed++;
-      } catch {
-        /* already gone */
+      const pid = row.pid;
+      const verdict = verifyAgentOwner(this.#dataDir, pid, row.id, this.#instanceId);
+      if (verdict.kill) {
+        try {
+          process.kill(pid, "SIGKILL");
+          killed++;
+          forgetAgentOwner(this.#dataDir, pid);
+          console.log(`[agentus] reclaim: killed pid ${pid} (session ${row.id}) — ${verdict.why}`);
+        } catch (err) {
+          console.log(`[agentus] reclaim: pid ${pid} (session ${row.id}) was gone before the kill — ${(err as Error).message}`);
+        }
+      } else if (verdict.gone) {
+        console.log(`[agentus] reclaim: nothing to kill for session ${row.id} — ${verdict.why}`);
+        forgetAgentOwner(this.#dataDir, pid);
+      } else {
+        // Alive but not provably ours. Do NOT kill; do drop the pid so the next boot does not
+        // re-examine (and re-endanger) the same number.
+        skipped++;
+        console.warn(`[agentus] reclaim: SKIPPED pid ${pid} (session ${row.id}) — ${verdict.why}`);
       }
       if (row.status !== "closed") {
         // Only a turn that was ACTUALLY in flight can be reported as interrupted. A `ready` session
@@ -385,9 +432,145 @@ export class SessionManager {
         if (wasRunning) this.#finalizePlan(row.id, "interrupted");
       }
     }
+    if (skipped) {
+      console.warn(
+        `[agentus] reclaim: ${skipped} recorded pid(s) left running — they are not this data dir's agents`
+        + ` (${this.#dataDir ?? "no data dir"})`,
+      );
+    }
     return killed;
   }
 
+  /** 语音通话的三种时刻（issue #48）。Called from the presence path (index.ts) whenever the
+   *  cockpit reports who is on a call.
+   *
+   *  A call has no "start"/"end" message of its own — the page only says, every 30 s, "I am on a
+   *  call with X". So transitions are DERIVED from that one fact, and each transition owes the agent
+   *  a block (entering: the style constraint; leaving: an explanation of what the last N turns were).
+   *  Nothing is sent at the moment of the transition itself: a bare prompt would make the agent
+   *  answer 「好的，我了解了」 into the microphone. The block rides the next real prompt.
+   */
+  async syncCallState(): Promise<void> {
+    // Serialised: presence arrives on a 30 s beat AND on every visibility/enter/leave event, and two
+    // overlapping runs used to interleave the dial switch — a hang-up that restored the operator's
+    // level could be overtaken by the lowering of the call that had just ended, leaving the session
+    // stuck on the lowest level with its snapshot already cleared (review B2).
+    this.#callSync = this.#callSync
+      .then(() => this.#syncCallStateOnce())
+      .catch(() => { /* presence is a hint: never break the caller */ });
+    return this.#callSync;
+  }
+
+  async #syncCallStateOnce(): Promise<void> {
+    const live = this.#callLive();
+    for (const v of this.#store.listInCall()) {
+      if (v.sessionId !== live) await this.#endCall(v.sessionId);
+    }
+    if (live && !this.#store.getVoiceMode(live).inCall) await this.#beginCall(live);
+  }
+
+  async #beginCall(id: string): Promise<void> {
+    const prev = this.#store.getVoiceMode(id);
+    if (prev.inCall) return; // idempotent: a second presence beat for the same call changes nothing
+    if (!this.#store.getSession(id)) return; // a call with a session this store has never seen
+    const s = this.#sessions.get(id);
+    const choice = s ? thinkingOptionOf(s.info.configOptions) : null;
+    // A snapshot left behind by an earlier call (the restore could not run: slot was cold, or the
+    // process died) is still the operator's real level — never overwrite it with the pressed-down
+    // value we may have persisted onto the session row (review B1).
+    const before = prev.thoughtBefore ?? choice?.current ?? null;
+    this.#store.upsertVoiceMode(id, {
+      inCall: true, boundary: "enter", turns: 0,
+      thoughtBefore: before,
+      thoughtTouched: prev.thoughtBefore ? prev.thoughtTouched : false,
+    });
+    // A call is full-duplex: waiting 20 s for a first token reads as a dead line to the operator.
+    // Lower the dial for the call and put the operator's own choice back on hang-up (see #restoreThought).
+    if (s && choice && choice.lowest && before !== choice.lowest && !this.#store.getVoiceMode(id).thoughtTouched) {
+      await this.setConfig(id, choice.id, choice.lowest, { internal: true }).catch(() => { /* the block still goes out */ });
+      // A hang-up can land while the switch is in flight: if the call is already over, put it back
+      // now rather than leaving the session on the pressed-down level.
+      if (!this.#store.getVoiceMode(id).inCall) await this.#restoreThought(id);
+    }
+  }
+
+  async #endCall(id: string): Promise<void> {
+    const v = this.#store.getVoiceMode(id);
+    // Nothing was actually said (no prompt ever rode this call): owe nothing. An exit block here
+    // would tell the agent "the conversation above was spoken", which is false — and it is cheap to
+    // trigger (opening the call overlay and closing it, a denied microphone) (review B3).
+    const owed = v.turns > 0;
+    this.#store.upsertVoiceMode(id, { inCall: false, boundary: owed ? "exit" : null, ...(owed ? {} : { turns: 0 }) });
+    await this.#restoreThought(id);
+  }
+
+  /** Put the operator's thinking level back after a call. Clears the snapshot ONLY when the level
+   *  really went back — a slot that is no longer in memory (idle reap, restart) or a rejected value
+   *  keeps it, so the next resume can finish the job instead of silently staying on the call level
+   *  (review M2). */
+  async #restoreThought(id: string): Promise<boolean> {
+    const v = this.#store.getVoiceMode(id);
+    if (!v.thoughtBefore) return true; // nothing to put back
+    if (v.thoughtTouched) {
+      // The operator picked a level during the call: theirs wins, the snapshot is moot.
+      this.#store.upsertVoiceMode(id, { thoughtBefore: null, thoughtTouched: false });
+      return true;
+    }
+    const s = this.#sessions.get(id);
+    if (!s) return false;
+    const choice = thinkingOptionOf(s.info.configOptions);
+    if (!choice || !choice.lowest) return false;
+    try {
+      await this.setConfig(id, choice.id, v.thoughtBefore, { internal: true });
+    } catch {
+      return false;
+    }
+    this.#store.upsertVoiceMode(id, { thoughtBefore: null, thoughtTouched: false });
+    return true;
+  }
+
+  /** Attach this prompt's voice block, and settle what it settles. Synchronous on purpose: it runs
+   *  inside the send path, and a slow store write must not delay the operator's words.
+   *
+   *  Returns a settle() to call once the turn is actually delivered: a prompt that threw before the
+   *  agent saw it must not consume a boundary or count as a spoken turn (review m1). */
+  #applyVoiceMode(s: LiveSession, blocks: unknown[], opts: { operator: boolean }): (delivered: boolean) => void {
+    // A background-completion wake is not a spoken turn: letting it consume the boundary injected
+    // "the call is over" into a synthetic turn nobody reads, so the operator's next real message
+    // never learned it, and each wake inflated the turn count (review M1).
+    if (!opts.operator) return () => { /* nothing owed to a synthetic turn */ };
+    const live = this.#callLive();
+    let v = this.#store.getVoiceMode(s.info.id);
+    // Converge on the ONE authority (presence) in both directions: a page that closed mid-call never
+    // reports a hang-up, so the exit boundary must be derived here or the model stays on a call for
+    // ever; and a call that started while this slot was cold has no enter boundary recorded.
+    if (v.inCall && live !== s.info.id) {
+      const owed = v.turns > 0;
+      v = this.#store.upsertVoiceMode(s.info.id, { inCall: false, boundary: owed ? "exit" : null, ...(owed ? {} : { turns: 0 }) });
+      void this.#restoreThought(s.info.id);
+    } else if (!v.inCall && live === s.info.id) {
+      v = this.#store.upsertVoiceMode(s.info.id, { inCall: true, boundary: v.boundary ?? "enter", turns: 0 });
+    }
+    const block = voiceModeBlock(s.info.id, { inCall: v.inCall, boundary: v.boundary, turns: v.turns });
+    if (block) blocks.push(block);
+    const hadBoundary = Boolean(v.boundary);
+    const counted = v.inCall;
+    if (!hadBoundary && !counted) return () => { /* steady state, nothing to settle */ };
+    return (delivered: boolean) => {
+      if (!delivered) return;
+      if (hadBoundary) this.#store.upsertVoiceMode(s.info.id, { boundary: null });
+      if (counted) this.#store.upsertVoiceMode(s.info.id, { turns: this.#store.getVoiceMode(s.info.id).turns + 1 });
+    };
+  }
+
+  /** Bind a freshly spawned agent to (this data dir, this session, this server run). Bookkeeping only:
+   *  a failure here makes a later reclaim more conservative, never a session fail. */
+  #stampAgentReceipt(pid: number, sessionId: string, cmd: string): void {
+    recordAgentOwner(this.#dataDir, {
+      pid, sessionId, startedAt: Date.now(), serverInstance: this.#instanceId, cmd,
+    });
+  }
+
   /** Last stderr lines from a session's agent (for diagnosing failed turns). */
   stderrTail(id: string, lines = 12): string {
     const s = this.#sessions.get(id);
@@ -529,6 +712,12 @@ export class SessionManager {
       throw new Error(why);
     }
 
+    const pid: number = child.pid;
+
+    // The receipt that makes a later reclaim provable (agent-owner.ts). Written BEFORE the handshake,
+    // because the handshake can fail and leave a running process behind.
+    this.#stampAgentReceipt(pid, id, `${spec.cmd} ${args.join(" ")}`);
+
     const live: LiveSession = {
       info: {
         id, backend, acpSessionId: null, cwd,
@@ -709,6 +898,8 @@ export class SessionManager {
       throw new Error(why);
     }
 
+    this.#stampAgentReceipt(child.pid, id, `${spec.cmd} ${args.join(" ")}`);
+
     const live: LiveSession = {
       info: {
         id, backend: row.backend, acpSessionId: row.acpSessionId, cwd: row.cwd,
@@ -847,6 +1038,20 @@ export class SessionManager {
             .catch(() => {});
         }
       }
+      // 通话中 resume（页面刷新、空闲回收后再唤起）：把通话档位重新压下去，否则「恢复的会话」会带着
+      // 用户平时的高思考档沉默十几秒 —— 正是 issue #48 要消除的那种卡死手感。反过来，通话已经结束却
+      // 留着快照（挂断时会话不在内存，还原没跑成）就要在这里补还原，否则会话永远停在通话档（review M2）。
+      {
+        const vm = this.#store.getVoiceMode(id);
+        if (vm.inCall) {
+          const knob = thinkingOptionOf(live.info.configOptions);
+          if (knob && knob.current !== knob.lowest) {
+            await this.setConfig(id, knob.id, knob.lowest, { internal: true }).catch(() => { /* keep going */ });
+          }
+        } else if (vm.thoughtBefore && !vm.thoughtTouched) {
+          await this.#restoreThought(id);
+        }
+      }
       live.info.status = "ready";
       this.#updateSession(live);
       // a resumed slot is the same evidence as a fresh one: the row does work
@@ -1084,6 +1289,12 @@ export class SessionManager {
         if (reminder) blocks.push(reminder);
       }
     }
+    // 语音通话模式（issue #48）: entering, staying in, and leaving a call each owe the agent one
+    // sentence it cannot infer — that its output is being SPOKEN, or that the speaking is over.
+    // Rides the same `_meta`-tagged resource channel as the plan reminder; the operator's own words
+    // are untouched (the transcript stores `text`, never the blocks). A background wake (`origin`)
+    // is not a spoken turn and must not consume a boundary.
+    const settleVoice = this.#applyVoiceMode(s, blocks, { operator: voiceAppliesToPrompt(opts) });
     s.turnSeq += 1;
     s.busy = true;
     // The operator has spoken: from here anything the agent says is an ANSWER, not its own history
@@ -1121,6 +1332,9 @@ export class SessionManager {
         prompt: blocks as any,
       });
       const terminalState = res?.stopReason === "cancelled" ? "interrupted" : "ended";
+      // The agent has the block (a cancelled turn still received it): NOW the boundary is spent and
+      // the turn counts.
+      settleVoice(true);
       this.#finalizePlan(sessionId, terminalState);
       this.#emit({ t: "turn-end", sessionId, stopReason: res?.stopReason, durationMs: Date.now() - turnStartedAt });
     } catch (err) {
@@ -1254,7 +1468,7 @@ export class SessionManager {
     this.#updateSession(s);
   }
 
-  async setConfig(sessionId: string, configId: string, value: string | number | boolean): Promise<void> {
+  async setConfig(sessionId: string, configId: string, value: string | number | boolean, opts: { internal?: boolean } = {}): Promise<void> {
     const s = this.#need(sessionId);
     if (!s.conn || !s.info.acpSessionId) throw new Error("session not ready");
     const requested = String(value);
@@ -1298,6 +1512,17 @@ export class SessionManager {
         this.#settleRow(s, cur.seq, payload);
       }
     }
+    // 通话中操作者自己调了思考档位 → 以他为准，挂断时不再还原（issue #48）。`internal` marks the
+    // cockpit's own lowering/restoring, which must NOT count as the operator's choice. Only a pick the
+    // AGENT actually accepted counts: a rejected value would otherwise make the hang-up skip the
+    // restore and strand the session on the call's level (review m4).
+    if (!opts.internal && !rejected && actual === requested) {
+      const vm = this.#store.getVoiceMode(sessionId);
+      if (vm.inCall) {
+        const knob = thinkingOptionOf(s.info.configOptions);
+        if (knob && knob.id === configId) this.#store.upsertVoiceMode(sessionId, { thoughtTouched: true });
+      }
+    }
     if (rejected) {
       this.#emit({
         t: "config-rejected",
@@ -2202,6 +2427,8 @@ export class SessionManager {
   }
 
   #onChildExit(live: LiveSession, code: number | null, sig: string | null): void {
+    // The process is gone, so is its claim: leave no receipt that a later boot would try to honour.
+    forgetAgentOwner(this.#dataDir, live.child?.pid ?? live.info.pid);
     // If we initiated close, session was already removed — ignore.
     if (!this.#sessions.has(live.info.id)) return;
     // …and if we are REPLACING this slot's process (restart), the exit is the one we asked for: the