Audio backpressure: discard stale speech before queues grow

TL;DR: Bound audio queues by bytes, queued duration, age, and response ownership, then recheck freshness at playback admission. When a response becomes stale or overload makes coherent delivery impossible, cancel that response and recover deliberately instead of silently dropping arbitrary speech fragments or moving the backlog into another layer.

---

The first answer sounds fast. Later answers arrive behind old speech, and an interruption stops generation while the caller still hears a sentence that no longer belongs to the task.

That failure can happen with healthy model and synthesis services. If production runs ahead of playback, the application accumulates a conversational backlog even when every component reports successful work.

The interruption safety guide defines how old responses lose ownership. This guide adds a bounded queue, deterministic overload tests, and an accounting model that keeps local queue limits separate from downstream media buffers.

The examples are generic and synthetic. They can help evaluate an application using 60db Agent, but they make no claim about its private implementation or measured performance.

As of November 2026, the public Python asyncio queue documentation still makes the default queue unbounded when maxsize is zero. Even a positive item limit does not by itself bound the audio duration or age represented by those items.

Table of contents

1. Define what the queue is allowed to hold
2. Choose an overload policy that preserves meaning
3. Build a bounded response queue
4. Propagate pressure to the producer
5. Account for downstream buffers
6. Test age, invalidation, and stalled consumers
7. Measure the operating envelope
8. Recover without replaying obsolete speech
9. Frequently asked questions
10. Make freshness an admission rule

Define what the queue is allowed to hold

Audio freshness is a property of time and conversation state. A chunk can fit comfortably in memory while belonging to a response that the caller already corrected.

Begin with the owner. Every chunk should identify the response generation and task revision under which it was created, so an admission gate can reject output that no longer matches current intent.

Then define duration. A fixed number of items can represent very different amounts of speech when chunk sizes vary, so item count is an incomplete measure of conversational delay.

Track bytes separately. Encoded payload size matters for memory and transport pressure, while represented audio duration matters for the amount of speech waiting to play.

Age needs a named origin. A chunk's age can start when generation produced it, when the application accepted it, or when it entered a particular queue; those intervals answer different questions.

For a local admission policy, use a local monotonic creation or receipt time and state which one it is. The Python time documentation defines a monotonic clock suitable for local elapsed intervals.

Do not compare monotonic timestamps from different machines as if they shared an origin. If a producer is remote, record local receipt age separately from any upstream age estimate and carry the uncertainty into reporting.

An output queue also needs a terminal state. After hangup or transfer removes the player's authority, no newly arriving chunk should reopen it just because the queue has spare capacity.

The shutdown semantics guide supplies that lifecycle boundary. Treat closure as a policy event, not merely a moment when the consumer happened to stop reading.

The figure shows two checks because validity can change while a chunk waits. A check at producer startup cannot protect a later playback boundary from a correction that arrives in between.

Keep the duration source explicit. For uncompressed PCM, derive it from valid sample framing and sample rate; for an encoded format, use a trusted decoder or codec framing information appropriate to that format.

Do not trust an unvalidated caller-supplied duration field to enforce memory or latency limits. The real adapter must validate payload shape and declared media properties at its trust boundary.

The chunk-size guide examines that framing choice. Queue policy should consume the actual represented duration rather than assuming every chunk has the same size because the first fixture did.

Choose an overload policy that preserves meaning

Dropping the oldest item is common for visual updates and sensor snapshots. Speech has a different failure mode: removing a word or clause can change the meaning of everything that follows.

A synthetic sentence such as "Do not use the fictional east entrance" becomes misleading if the dropped fragment contains the negation. A queue policy must respect that semantic risk even when its memory accounting is correct.

Choose whether the queued unit is a raw frame, a self-contained phrase, or a whole response. A coarse unit is easier to cancel coherently, while a fine unit provides more precise media control but needs a separate content model for recovery.

For this guide's example, any age or capacity breach invalidates the current response and clears its local queue. The application must then stop controllable downstream media and choose a fresh recovery response under a separate policy.

That choice sacrifices some reusable work to preserve a simple invariant. No remaining fragment of the failed response is quietly spliced into the caller's next answer.

The table uses ✓ for an objective the strategy can satisfy under the stated local model and ✗ for an objective it does not provide alone. It compares application policies rather than measuring any library or vendor.

A blocking queue can provide useful pressure when the producer supports pausing. It becomes unsafe when waiting indefinitely keeps an obsolete response alive or when the producer continues buffering elsewhere.

Set a bounded wait and recheck ownership and age after the wait. A coroutine that wakes for a slot can still hold canceled or expired speech.

The Streams standard describes backpressure in stream pipelines. That machinery helps coordinate production and consumption, while the application still owns the decision that an old utterance should no longer be spoken.

Use different policies for different data. A durable business operation request cannot be discarded merely because speech output is overloaded; its authorization and result must be reconciled through the business system.

The speculative tool guide keeps that boundary separate. Cancel disposable generation and reads where supported, but inspect authoritative state for writes that may already have been accepted.

Do not solve overload by increasing the buffer until the test stops failing. A larger buffer can move the failure from memory pressure to delayed, stale conversation, which is harder for ordinary service health checks to notice.

Build a bounded response queue

The example below models a single-owner local queue. It bounds bytes and represented duration, expires old queued output, and invalidates all locally queued speech when coherent delivery fails.

It uses Python's deque for explicit accounting. Save the script as fresh_audio_queue.py and run it with Python 3; the tests use synthetic payloads and a supplied local clock.

import asyncio
from collections import deque
from dataclasses import dataclass
from math import isfinite


@dataclass(frozen=True)
class Chunk:
    generation: int
    created_ms: float
    duration_ms: int
    payload: bytes


class FreshQueue:
    """Single owner and one ordered consumer; at most one held chunk."""

    def __init__(self, max_bytes, max_duration_ms, max_age_ms):
        if (not isinstance(max_bytes, int) or isinstance(max_bytes, bool)
                or not all(isfinite(x) and x > 0
                           for x in (max_bytes, max_duration_ms, max_age_ms))):
            raise ValueError("Positive limits required")
        self.max_bytes = max_bytes
        self.max_duration_ms = max_duration_ms
        self.max_age_ms = max_age_ms
        self.generation = 0
        self.closed = False
        self.items = deque()
        self.bytes = 0
        self.duration_ms = 0
        self.last_now = float("-inf")
        self.last_accepted_created_ms = float("-inf")

    def _time(self, now):
        if not isfinite(now) or now < self.last_now:
            raise ValueError("Finite nondecreasing local time required")
        self.last_now = now

    def invalidate(self):
        self.generation += 1
        self.items.clear()
        self.bytes = self.duration_ms = 0
        self.last_accepted_created_ms = float("-inf")

    def _expire(self, now):
        if self.items and now - self.items[0].created_ms > self.max_age_ms:
            self.invalidate()
            return True
        return False

    def put(self, chunk, now):
        self._time(now)
        if self.closed:
            return "closed"
        if (not isinstance(chunk.payload, bytes) or not chunk.payload
                or not isinstance(chunk.duration_ms, int) or chunk.duration_ms <= 0
                or not isfinite(chunk.created_ms) or chunk.created_ms > now):
            raise ValueError("Invalid local chunk metadata")
        if chunk.generation != self.generation:
            return "stale-generation"
        if chunk.created_ms < self.last_accepted_created_ms:
            raise ValueError("Out-of-order local creation time")
        if self._expire(now):
            return "expired-response"
        if now - chunk.created_ms > self.max_age_ms:
            self.invalidate()
            return "expired-response"
        if (self.bytes + len(chunk.payload) > self.max_bytes
                or self.duration_ms + chunk.duration_ms > self.max_duration_ms):
            self.invalidate()
            return "overload-response"
        # Creation history survives dequeue and resets only on invalidation.
        self.items.append(chunk)
        self.last_accepted_created_ms = chunk.created_ms
        self.bytes += len(chunk.payload)
        self.duration_ms += chunk.duration_ms
        return "accepted"

    def pop(self, now):
        self._time(now)
        if self.closed:
            return "closed", None
        if self._expire(now):
            return "expired-response", None
        if not self.items:
            return "empty", None
        chunk = self.items.popleft()
        self.bytes -= len(chunk.payload)
        self.duration_ms -= chunk.duration_ms
        return "ready", chunk

    def submit(self, chunk, now, *, clear_pending, write):
        # Previously validated held chunk; synchronous single-owner admission.
        self._time(now)
        if self.closed:
            return "closed"
        if chunk.generation != self.generation:
            return "stale-generation"
        if self._expire(now):
            return "expired-response"
        if now - chunk.created_ms > self.max_age_ms:
            self.invalidate()
            return "expired-response"
        if clear_pending:
            return "clear-pending"
        # write must accept into the ordered writer without await or reentry.
        write(chunk)
        return "admitted"

    def close(self):
        self.invalidate()
        self.closed = True


if __name__ == "__main__":
    # All limits, payloads, and times below are synthetic test inputs.
    q = FreshQueue(8, 60, 100)
    assert q.put(Chunk(0, 0, 30, b"aaaa"), 0) == "accepted"
    assert q.put(Chunk(0, 10, 30, b"bbbb"), 10) == "accepted"
    assert q.put(Chunk(0, 20, 1, b"c"), 20) == "overload-response"
    assert q.bytes == q.duration_ms == 0 and q.generation == 1
    assert q.put(Chunk(0, 20, 10, b"d"), 20) == "stale-generation"
    assert q.put(Chunk(1, 20, 10, b"d"), 20) == "accepted"
    assert q.pop(121) == ("expired-response", None) and q.generation == 2
    assert q.pop(121) == ("empty", None)
    assert q.put(Chunk(2, 121, 10, b"e"), 121) == "accepted"
    q.invalidate()
    assert q.pop(122) == ("empty", None)
    q.close()
    assert q.pop(122) == ("closed", None)
    assert q.put(Chunk(q.generation, 122, 10, b"f"), 122) == "closed"
    by_bytes = FreshQueue(4, 100, 100)
    assert by_bytes.put(Chunk(0, 0, 1, b"12345"), 0) == "overload-response"
    by_time = FreshQueue(100, 4, 100)
    assert by_time.put(Chunk(0, 0, 5, b"x"), 0) == "overload-response"
    edge = FreshQueue(4, 4, 100)
    assert edge.put(Chunk(0, 0, 4, b"1234"), 0) == "accepted"
    status, held = edge.pop(1)
    assert status == "ready" and not edge.items
    writes = []  # Synthetic local ordered-writer acceptance, not a carrier.
    assert edge.submit(held, 2, clear_pending=True, write=writes.append) == "clear-pending"
    assert not writes
    edge.invalidate()
    assert edge.put(Chunk(1, 102, 4, b"new!"), 102) == "accepted"
    # Old held audio is also over-age; it must not invalidate fresh generation 1.
    assert edge.submit(held, 102, clear_pending=False, write=writes.append) == "stale-generation"
    assert edge.generation == 1 and len(edge.items) == 1 and edge.bytes == 4
    assert not writes

    async def delayed_sender():
        delayed = FreshQueue(4, 4, 100)
        assert delayed.put(Chunk(0, 0, 4, b"1234"), 0) == "accepted"
        status, held = delayed.pop(1)
        assert status == "ready" and not delayed.items
        await asyncio.sleep(0)  # Yield; supplied clock models elapsed sender wait.
        assert held.generation == delayed.generation == 0
        assert delayed.submit(held, 101, clear_pending=False,
                              write=writes.append) == "expired-response"
        assert delayed.generation == 1 and not writes

    asyncio.run(delayed_sender())
    fresh = FreshQueue(4, 4, 100)
    assert fresh.put(Chunk(0, 0, 4, b"1234"), 0) == "accepted"
    status, held = fresh.pop(1)
    assert status == "ready"
    assert fresh.submit(held, 100, clear_pending=False, write=writes.append) == "admitted"
    assert writes == [held]  # Exact age limit is allowed; only age > limit expires.
    fresh.close()
    assert fresh.submit(held, 100, clear_pending=False, write=writes.append) == "closed"
    assert writes == [held]
    barrier = FreshQueue(4, 4, 100)
    assert barrier.put(Chunk(0, 0, 4, b"1234"), 0) == "accepted"
    status, held = barrier.pop(1)
    assert status == "ready"
    wire = []  # Synthetic ordered writer, no remote playback claim.
    assert barrier.submit(held, 2, clear_pending=True, write=wire.append) == "clear-pending"
    assert not wire
    wire.append("clear")  # Owner establishes clear order before releasing barrier.
    assert barrier.submit(held, 2, clear_pending=False, write=wire.append) == "admitted"
    assert wire == ["clear", held]
    ordered = FreshQueue(16, 100, 100)
    assert ordered.put(Chunk(0, 10, 10, b"first"), 10) == "accepted"
    assert ordered.pop(10)[0] == "ready" and not ordered.items
    try:
        ordered.put(Chunk(0, 9, 10, b"older"), 11)
        raise AssertionError("Creation order must survive a drained queue")
    except ValueError:
        pass
    assert ordered.generation == 0 and not ordered.items
    assert ordered.bytes == ordered.duration_ms == 0
    assert ordered.last_accepted_created_ms == 10
    assert ordered.put(Chunk(0, 10, 10, b"equal"), 11) == "accepted"
    ordered.invalidate()
    assert ordered.last_accepted_created_ms == float("-inf")
    assert ordered.put(Chunk(1, 9, 10, b"new"), 12) == "accepted"
    assert ordered.last_accepted_created_ms == 9
    print("Synthetic queue outcomes and final-admission regression checks passed")

The code is a queue model rather than a production media adapter. The payloads are arbitrary synthetic bytes, and the declared durations are trusted local test metadata, so a real decoder and payload validator remain required before live media enters this structure.

The oldest-first expiry check depends on nondecreasing creation times within a generation. A generation-wide last-accepted timestamp survives dequeue, so draining the queue cannot admit older speech later. Equal timestamps are allowed; invalidation resets the creation history.

If your producer can deliver out of order, choose a documented reordering policy before admission or examine all queued ages under a bounded data structure. Do not remove the check merely because an asynchronous producer sometimes completes later chunks first.

The supplied clock makes tests deterministic. Production code can obtain now from a monotonic local clock, while remote timestamps need an explicit conversion or a separate age field.

The queue methods require one serialized owner and one ordered consumer. That consumer must admit or discard its held chunk before dequeuing another; the queue cannot prevent external parallel senders from reordering held media. The asynchronous test models a sender yielding before admission.

pop returns a status and optional chunk: ready, empty, closed, or expired-response. Handle expiry as a response-level failure even when synthesis has finished; it requires downstream cancellation and recovery, while empty means only that nothing is locally queued.

submit rechecks ownership, age, closure, and the clear barrier for a previously validated held chunk. Its synchronous write callback must accept into the same bounded ordered writer without awaiting or reentering the controller. Admitted proves local writer acceptance only.

No await may separate this final check from admission. If an adapter must wait for writer capacity, wait first and call submit with a fresh local time afterward; a write exception is not successful admission. Reject a generation mismatch before any expiry side effect so an old held chunk cannot invalidate a newer response. Release the clear barrier only after its required order is established by the writer owner.

Every expired-response or overload-response outcome signals response-level failure. The controller must cancel upstream work, clear controllable downstream media, and choose recovery; later empty outcomes do not replace that required handling.

Propagate pressure to the producer

A local bound helps only if the producer reacts. If synthesis keeps producing while the queue rejects output, the application may spend resources creating speech that can never be used.

When a producer supports flow control, stop requesting additional output before reaching a hard limit. Keep the hard limit as a safety boundary, because advisory pressure can arrive too late or be ignored by a remote service.

If the producer supports cancellation rather than pause, cancel the current response on a breach and reject late output by generation. A canceled task can still have callbacks or network data in flight.

The Python task cancellation documentation describes cancellation as a cooperative mechanism. Application ownership checks remain necessary at the output boundary even when a cancellation request succeeds locally.

Do not launch a new generation while an old clear can still flush its media. Serialize the outbound clear ahead of new-generation audio, using an admission barrier until the ordered writer has accepted the clear in the required wire order.

The playback acknowledgment guide explains that cancellation race. Without the barrier, fresh audio can enter the old buffer and receive a returned mark whose cause the application misclassifies.

Keep pressure state distinct from terminal state. A temporarily slow consumer can recover while the call remains active, whereas a closed call must reject all future output regardless of available capacity.

A retry policy needs limits too. Repeatedly restarting synthesis after every queue breach can create a loop that consumes resources while never delivering a coherent answer.

Choose a bounded recovery count and a user-visible fallback suitable to the product. The progressive no-input guide provides a related principle: recovery speech should stop after a declared boundary rather than repeating forever.

Avoid producing long waiting messages during an audio backlog. They join the same constrained path and can delay the useful answer further.

The truthful waiting-speech guide keeps those messages tied to observable state. Silence, a short acknowledgment, and a fresh summary are policy choices, not reasons to accumulate unlimited output.

When pressure spans several stages, record which stage first blocked or rejected work. A TTS input queue, synthesis output queue, encoder queue, socket queue, and provider buffer can each hold speech, so fixing one without observing the others can move the backlog instead of removing it.

Account for downstream buffers

A bounded application queue does not bound the whole playback path. Bytes handed to a socket, provider, browser graph, or device can remain queued after the application removes its local copy.

List the buffers your integration controls and the ones it can only observe. For every boundary, name the clear operation, the completion evidence, and what happens when the connection closes.

The WebSockets standard defines browser bufferedAmount for local application data awaiting network transmission. It does not include every operating-system or network-device buffer, so report its scope accurately.

A low socket queue can coexist with a large provider playback queue. Sending synthesized audio faster than real-time consumption can move the backlog downstream while the application queue appears almost empty.

Twilio's public Media Streams message contract documents buffering and clear behavior. Use the supported clear path when invalidating output, while preserving ambiguous completion evidence for media affected by the clear race.

For a custom browser player, inspect scheduled sources as well as pending decoded chunks. Removing a chunk from an application array does not automatically unschedule a source already admitted to the audio graph.

The overlap policy guide separates gain changes from ownership. Reducing volume can make a backlog quieter without removing it or making its content current.

A pacing strategy should respect the actual delivery contract. Avoid sending an entire long utterance immediately merely because transport writes succeed; use bounded downstream admission or verified progress where the provider exposes it.

Do not simulate pacing by sleeping for a duration calculated from unchecked metadata. Validate media framing and account for cancellation during waits, otherwise a stale sender can wake and submit old audio after the controller moved on.

The RTP congestion-control requirements describe the low-delay needs of interactive media. Network congestion control and conversational freshness solve related but different problems: one protects network behavior, while the application must still reject obsolete task output.

Keep a residual-output measure after stop. The interval between local invalidation and last observed old audio at the measured endpoint reveals how much output was already beyond the controllable boundary.

State that endpoint. A server log, a provider receipt, and a consented acoustic recording can show different portions of the path, and their values should not be presented as interchangeable.

Conceptual: Local queue depth excludes sender-held speech and downstream media.

Test age, invalidation, and stalled consumers

The smallest useful test suite includes both capacity accounting and inconvenient event schedules. A queue that passes a steady-state producer/consumer example can still fail when the consumer pauses or the caller corrects the task.

Test each limit independently. Use one fixture that exceeds bytes while duration remains below its limit and another that exceeds duration while bytes remain small, so the suite proves both gates rather than only the first expression in a combined branch.

Test exact boundaries. A chunk at the configured limit should follow the documented inclusive or exclusive rule, and a chunk just beyond it should trigger the expected response-level failure.

Test age at queue admission, dequeue, and final writer admission. Assert that dequeue expiry differs from empty, and that a held chunk expires after a sender wait even with an empty queue and unchanged generation.

Test stale generations before and after overload. Old output arriving after invalidation must remain rejected even when the local queue has been cleared and now has ample capacity.

Test consumer-held output. Pop a chunk, wait in the sender, invalidate the response, then deliver the send attempt; the final gate must reject it under the current generation.

Test termination while the producer is waiting. Closing the call should wake or cancel the producer under the runtime's supported mechanism and leave the terminal output gate closed.

The regression testing guide provides a structure for retaining these schedules. Assertions should name the behavioral invariant, such as no old-generation admission after correction, rather than checking only the queue length.

The example tests capacity, dequeue outcomes, held age after a synthetic wait, stale ownership, clear ordering, closure, and exact-age admission. It also verifies creation order after draining, equal timestamps, and history reset. Real adapters still need payload, clock, and writer-failure tests.

Include out-of-order completion from parallel synthesis if your implementation allows it. Decide whether the response can be reordered safely before queue admission, and reject content that lacks a valid sequence position.

A stall test should use a deterministic clock or controlled scheduler where possible. Long sleeps make unit tests slow and flaky while giving less precise evidence about the age boundary.

Then run a transport integration trial. A correct local model cannot prove that a real provider clear, browser source stop, or sender cancellation behaves as your adapter assumes.

Use synthetic speech for that trial and preserve the declared media format. The latency benchmark guide helps keep warm/cold conditions, timing boundaries, and failure counts visible in the report.

Conceptual: Recheck age after a wait; an empty local queue does not make an expired held chunk admissible.

Measure the operating envelope

Report queue duration and oldest age alongside memory. A memory-only dashboard can look healthy while the caller waits behind stale speech that occupies very few encoded bytes.

Use separate fields for current depth, high-water depth, oldest local age, admitted duration, and rejection reason. State whether depth refers to the application queue, sender queue, or provider buffer estimate.

A queued-duration total is not always a wall-clock waiting estimate. Pauses, gain policy, playback rate, and downstream buffers can change how quickly the queued content advances.

The outcome metrics guide connects these diagnostics to task success. Track whether overload recovery preserved the caller's goal, not just whether a queue eventually returned to zero.

Count discarded responses separately from discarded chunks. One response split into many chunks should not appear as many independent user-visible failures without a corresponding response-level count.

Keep rejection reasons distinct. Stale intent after correction, local capacity overload, expired age, malformed payload, and terminal-call rejection point to different owners and different fixes.

An increase in stale-generation rejections can be a sign that safety gates are doing useful work. Review why obsolete work is still being produced before interpreting every rejection as a media defect.

A rise in expiry under the same workload can indicate a stalled consumer or new buffering. Compare queue wait with execution time and downstream evidence before replacing the synthesis service.

The observability guide helps correlate the response path. Use opaque identifiers and content-free reasons so ordinary metrics do not become a transcript store.

Choose production limits from a declared workload and user requirement. The synthetic script's limits only exercise branches; they do not establish a recommended operating point for any codec, device, language, or provider.

A load report should include rejected, canceled, disconnected, and incomplete trials. Excluding them from latency percentiles can make a system look faster precisely when it is shedding the work that exceeds its envelope.

The cost-per-success guide adds another useful view. Generating discarded speech, retrying responses, and forcing repeated calls can matter more than a low nominal cost per audio chunk.

Conceptual: Vary bytes, represented duration, and local age independently so the rejection reason identifies the breached limit.

Recover without replaying obsolete speech

After a response-level breach, stop controllable old output and reconcile task state before speaking again. The queue knows that delivery failed its policy; it does not know which new sentence best serves the caller.

A caller correction usually requires a fresh answer under the revised facts. A temporary network stall with unchanged facts can permit a short summary or a restart at a safe semantic boundary.

The resumption guide provides the decision framework. Use delivery evidence and current intent rather than blindly draining whatever remains in memory.

Do not replay an arbitrary tail of a canceled encoded stream. It can begin inside a word, omit a negation, or depend on an earlier phrase the caller did not receive.

If the output was only explanatory, a concise fresh sentence can be cheaper and safer than reconstructing an exact media position. If the content contained a task instruction, repeat the smallest complete instruction whose delivery is uncertain.

If a business action was in flight, query or reconcile its authoritative state. A speech queue breach does not undo an accepted booking or prove that a timed-out write failed.

The workflow enforcement guide keeps that operation boundary explicit. The recovery response should report known state and uncertainty rather than inventing success to fill the silence.

Preserve caller input through recovery. An overloaded output path must not close capture just as the caller explains the correction or asks to stop.

The echo diagnosis guide helps when a backlog creates repeated false interruptions. Old output returning through the microphone can keep producing new candidate turns unless the return path is addressed too.

Separate byte pressure from time pressure

Encoded audio can be small in memory and still represent a long stretch of speech. A memory budget that looks generous for a particular codec can permit a large conversational delay, so byte and duration limits need independent reasons and independent test cases.

Duration pressure can also appear with a fast producer on a healthy network. If synthesis emits a complete response quickly and the application hands it downstream immediately, the bottleneck is real-time listening rather than model execution or network bandwidth.

Use a synthetic producer that emits faster than the consumer advances. Record every admission and completion in the simulated schedule, then assert that the chosen bound is enforced before the backlog becomes an arbitrary amount of future speech.

Change only one dimension in the next fixture. Hold represented duration constant while increasing payload bytes, then hold bytes nearly constant while increasing declared valid duration; the expected reason should identify the limit the test intended to cross.

Do not use compressed byte count to estimate spoken duration unless the codec contract supports that calculation. Variable-rate encoding and container metadata can make that shortcut wrong, and the error can hide in a test that used only one fixed-size fixture.

Give control events priority without breaking order

A stop or clear must remain deliverable when the media path is busy. That does not mean sending it through an unrelated unordered channel and assuming the receiver will apply it before already queued media.

Use the transport's supported control mechanism and an explicit ordering rule. If the protocol carries clear and media on one ordered writer, prioritize clear at the application admission layer while respecting frames the writer has already accepted.

After invalidation, reject old-generation media still waiting outside that writer. New-generation media must wait behind the clear barrier, because prioritization alone cannot protect it from being flushed by the cancellation it overtook.

Keep diagnostic events out of the critical path. A slow metrics exporter should not prevent clear or termination; buffer or drop optional telemetry under its own bounded policy while retaining the minimum local evidence required to explain the decision.

Test the system with the optional exporter unavailable. The caller's stop control should still close output admission, and the system should report the telemetry gap separately rather than treating missing metrics as permission to continue stale playback.

Audit buffering after dependency changes

An SDK upgrade can change chunking, prefetch, or internal buffering without changing the application's queue class. Repeat the downstream stall and cancellation trials when the media library or transport adapter changes, especially if its default write behavior is different.

Keep a small boundary inventory beside the test report. Name which component owns each queue, which metric exposes its size or age, and which operation can stop or clear it; mark unobservable buffers explicitly.

A provider migration needs the same inventory. A mark or completion callback with a familiar name can describe a different event, so verify the new contract before reusing the old queue dashboard and recovery assumptions.

The transport comparison is useful during that review. The relevant decision is who owns playback and cancellation at the deployed boundary, rather than which transport label sounds faster.

Avoid adding a second buffering abstraction simply to hide these differences. Prefer a small adapter contract with explicit capabilities and unsupported states, then test each implementation against its actual public semantics.

Preserve a useful overload incident record

An incident report should show the response generation, local admission times, queue totals, first breach reason, cancellation attempt, and final observed old output. Those content-free fields often reveal whether pressure began upstream, in the sender, or beyond the application's control.

Keep the caller's revised intent in the restricted task record rather than duplicating it into media metrics. The public or broadly shared report can identify a correction event without exposing the corrected personal value.

State the observation cutoff and missing evidence. If the provider connection disappeared before acknowledgment, describe unknown downstream delivery instead of claiming that every queued segment was discarded successfully.

End the report with the reproduced invariant and the check that now guards it. A concise event schedule showing stale output rejected after correction is more durable than an anecdote that the call sounded better after increasing a buffer.

Keep the handoff between queue and sender explicit

A consumer can remove a chunk and still wait before submitting it to the next boundary. During that wait, the queue's local accounting no longer includes the chunk, but the response still owns work that could become audible.

Track the held chunk as in-flight output. Immediately before atomic ordered submission, submit checks current ownership, age, closure, and barrier state; age expiry invalidates the response even when the queue is empty. After any await, rerun the gate with fresh local time.

If the next boundary has an ordered clear barrier, the sender must respect it too. A generation check alone cannot prevent fresh output from entering ahead of an older clear that is still waiting to be written.

Test the combined schedule with a paused writer. Invalidate old output, begin clear, attempt fresh submission, and assert that submission waits until clear is established in wire order or the session closes.

This closes a common accounting gap. Local queue memory can be zero while a sender holds old media and a provider still holds earlier output, so the incident report needs each boundary rather than one aggregate number labeled buffer.

Keep recovery bounded under sustained overload

A fresh summary can also fail if the consumer remains unavailable. Give recovery attempts a separate small budget and stop generating more speech when the endpoint cannot accept useful output.

The fallback should match the product surface. A browser can show a concise visible status if that channel is available; a phone call may need a declared termination or handoff path rather than repeated spoken apologies that join the same blocked queue.

Do not assume the alternate channel succeeded. Its delivery and authorization requirements remain separate, and a failed voice response does not automatically authorize sending account information through another channel.

Record sustained overload as an operational failure with its observed boundary. Preserve enough content-free evidence to diagnose it, then clean up the producer, sender, player, and call state under the terminal contract.

---

Frequently asked questions

What is audio backpressure in a voice agent?

It is the mechanism that slows, pauses, rejects, or cancels production when downstream audio cannot be consumed within the application's limits. A complete policy also checks whether the speech still belongs to current caller intent.

Why is an item-count limit insufficient?

Different items can represent different byte sizes and audio durations. Bound those quantities explicitly, and track age so a small queue cannot retain old speech indefinitely.

Should the queue drop its oldest audio frame?

Arbitrary frame loss can remove words or clauses and change spoken meaning. Use a declared semantic policy, such as canceling the affected response, unless the media and conversation design can safely recover the missing content.

What does the example queue guarantee?

Within one serialized owner, it bounds local queue bytes and declared duration and exposes expiry explicitly. Final admission also rejects stale or aged held chunks. It does not validate codecs, clear provider buffers, or prove remote playback.

Are the example limits production recommendations?

No. The values are synthetic branch-testing inputs. Select real limits from the codec, workload, endpoint behavior, and caller requirements, then measure the resulting operating envelope.

Why check freshness again at dequeue?

A chunk can be fresh when admitted and expire while waiting. Conversation intent can also change during that interval, so producer-time validation alone cannot protect playback.

Does dequeue mean a chunk can now play safely?

No. After any asynchronous wait, recheck generation, age, closure, and clear-barrier state immediately before atomic ordered submission. Expired held speech invalidates the response even when the queue is empty and its generation is unchanged.

Can a bounded queue move backlog elsewhere?

Yes. A producer, encoder, socket, provider, or device can retain output after the application queue drains. Inventory and observe the whole path before claiming an end-to-end bound.

Does WebSocket bufferedAmount measure all queued audio?

No. The browser field has a local application-to-network scope and excludes other buffering. Use it for that boundary and keep provider playback or device scheduling evidence separate.

Should canceled tasks still need generation checks?

Yes. Cancellation is cooperative and in-flight data or callbacks can still arrive. Reject obsolete output at the final admission gate even when upstream cancellation was requested successfully.

What is the safest overload response for speech?

There is no universal policy, but canceling an incoherent response and recovering from current facts gives a simple safety invariant. The application must still stop downstream media and choose a useful, bounded recovery.

Can queue expiry roll back a business action?

No. A write may already have been accepted by an external system. Reconcile authoritative operation state and keep the spoken delivery failure separate from the action's actual outcome.

Which clock should measure chunk age?

Use a local monotonic clock for local elapsed age. Remote timestamps require an explicit alignment model or a separate upstream-age estimate, because independent monotonic clocks have different origins.

Why reject out-of-order creation times?

The example retains the last accepted creation timestamp throughout each generation, including after dequeue empties the queue. Older timestamps are rejected, equality is allowed, and invalidation resets history. External senders must still preserve dequeue order.

How should a blocked producer handle interruption?

Wake or cancel it under the runtime's supported mechanism and reject its old generation when it resumes. A newly available slot does not make an obsolete response current again.

Should critical control events share the media queue?

Do not let a large speech backlog prevent clear, stop, or termination from reaching its owner. Preserve the transport's required ordering and use a control path whose admission cannot be starved by optional media work.

What should metrics report during overload?

Report bytes, queued duration, oldest age, affected responses, and reasons at each observed boundary. Include rejected and incomplete trials in workload reports instead of calculating latency only from the easy survivors.

How should recovery avoid repeated stale speech?

Discard invalid output, reconcile current task facts, and produce a short self-contained response when appropriate. Limit recovery attempts so a persistently unavailable endpoint cannot trigger an endless synthesis loop.

Can lowering output volume fix a backlog?

It changes audibility while leaving queued content and ownership unchanged. A full-duplex mix policy can use ducking temporarily, but stale or overloaded speech still needs cancellation or a supported pacing strategy.

What should a platform evaluation ask for?

Ask where audio can queue, which limits and cancellation controls are exposed, and what events prove downstream progress. Test those public boundaries with synthetic overload and interruption schedules before making a delivery claim.

Make freshness an admission rule

A useful audio queue protects both resource limits and current intent. Track bytes, duration, local age, and ownership; reject obsolete output again at the final gate; and preserve downstream uncertainty when local memory no longer contains the media.

Start with the deterministic queue model and add adapter tests for held chunks, clear ordering, and stalled consumers. Measure the declared workload with failures included, then choose limits that meet the actual caller experience your product promises.

For a 60db Agent integration, evaluate the observable media boundaries and cancellation controls available to your application. The goal is coherent current speech under load, with a bounded recovery when that cannot be delivered.