# Sarah memory, voice, session, and control audit

**Date:** 2026-08-23

**Issue:** `OpenAgentsInc/openagents.com` #89

**Question:** Of the gaps reported after the launch episode, which still exist

in `main`, and what is the evidence either way?

Each gap below states its current status and the exact test that holds it. A

gap marked *held* was already closed in code but had no test naming the

behavior the report asked about; a gap marked *fixed* needed code in this

change.

## 1. Automatic memory saves, consent, and version history

**Held.** A profile-memory write requires consent evidence in the current

message, and `OpenAgents.Memory.Consent` returns

`:memory_consent_required` or `:memory_consent_mismatch` rather than writing

silently. Correction supersedes instead of overwriting, so the prior claim

stays readable as history and `/memory` shows the superseded row.

Evidence: `test/openagents/tools/profile_memory_tools_test.exs`,

`test/openagents/profile_memory_test.exs`,

`test/openagents_web/live/memory_live_test.exs`.

## 2. Voice tool calls in the same ordered activity stream as text

**Fixed.** Voice tool steps were durable in `voice_tool_steps`, but the

transcript only projected the steps of a live session. After the call ended, a

reload showed the spoken answer with no record of the tools that produced it,

while a text turn kept its activity attached to its assistant message.

`Voice.list_tool_step_activity_by_message/1` now joins tool steps to the

assistant message through the voice response receipt, and `ChatLive` merges

that projection with the text projection and orders both by step sequence. One

assistant message therefore carries one ordered activity list regardless of

modality.

Evidence: `test/openagents_web/live/chat_live_test.exs`, "voice tool activity

stays in the ordered transcript after the call ends";

`test/openagents/voice_test.exs`, "a refused host limit is durable and keyed to

the assistant message it belongs to".

## 3. Tool-call budget, visible limit, and typed terminal reason

**Fixed on the voice side.** The text runtime already budgets the loop and

records a typed `tool_call_limit_reached` outcome on the step that exceeded it,

with a runaway backstop above the budget

(`test/openagents/turn_tool_loop_test.exs`). The voice runtime sent the same

typed refusal to the provider but wrote nothing durable, so a truncated call

read back as a complete one.

`Voice.refuse_tool_step/4` now records the refusal as a terminal step with

status `refused`, the typed code, and the host executor disclosure, so the

refusal is evidence in the transcript rather than only a provider-side message.

Evidence: `test/openagents/voice_sessions_test.exs`, "the tool-call limit

refuses the next call and drives one tool-free report".

## 4. Voice session timeout, reconnect, resume, and failure

**Held.** The session budget warns at 80 percent and ends with a visible

reason at the ceiling; sideband loss reconnects under the same generation;

admission times out; a runtime restart fails the admitted generation

deterministically without inventing transcript or usage; a new generation is

admitted with prior conversation and tool evidence.

Evidence: `test/openagents/voice_sessions_test.exs` and

`test/openagents/voice_test.exs`, tests named for each of those behaviors.

## 5. Memory authorization across owners and versions

**Held, now proven.** `OpenAgents.ProfileMemory` scopes every read and

mutation by `owner_visitor_id`, including the locked queries that back forget

and purge. The report asked for a reproduction, so the test now walks a second

owner through the whole surface — list, get, correct, purge, transition, and

each forget mode — against another owner's record and its superseded versions,

and asserts the owner cannot read it, change it, delete it, or learn from the

result that it exists. A forget that targets nothing reports

`already_absent`, which is the same answer an empty account gets.

Evidence: `test/openagents/profile_memory_test.exs`.

## 6. Leaderboard opt-out

**Fixed.** `Leaderboard.ranked_query/1` already excluded accounts with

`public_leaderboard_opted_out`, but nothing let an account set the field: there

was no writer, no control, and no cache invalidation, so the column was

unreachable and the cached projection could serve a withheld account until an

unrelated recompute.

`Accounts.set_public_leaderboard_opt_out/2` writes the preference and

invalidates the cached projection on every change, including the change that

removes the account. `/memory` carries the control and states the current

state. Every public read of the board — the LiveView, the cached server, and

the recompute behind it — goes through `Leaderboard.ranked_query/1`, and no

other module projects the board, so one write covers every public surface.

Evidence: `test/openagents/leaderboard_test.exs`, "an account can withhold

itself from the board and publish itself again";

`test/openagents_web/live/memory_live_test.exs`, "the way back is a link, and

the board preference is the account's to set".

## 7. Return control on the memory page

**Fixed.** `/memory` is a page with an address, but its return control still

sent `toggle_memory`, an event from when memory was a panel inside the

conversation. No handler existed, so the control raised instead of returning.

It navigates to `/sarah` now.

Evidence: `test/openagents_web/live/memory_live_test.exs`.

    }

  end

  @doc """

  Sets whether this account is withheld from the public leaderboard.

  The board is the one projection that crosses the account boundary

  (`INVARIANTS.md` LEADERBOARD-001), so the account it is about decides whether

  it appears. The cached projection is invalidated on every change, including a

  change that removes the account, so opting out takes effect on the next push

  to connected viewers rather than at the next unrelated recompute.

  """

  @spec set_public_leaderboard_opt_out(User.t(), boolean()) ::

          {:ok, User.t()} | {:error, Ecto.Changeset.t()}

  def set_public_leaderboard_opt_out(%User{} = user, opted_out?) when is_boolean(opted_out?) do

    case user |> User.leaderboard_changeset(opted_out?) |> Repo.update() do

      {:ok, updated} ->

        :ok = OpenAgents.Leaderboard.invalidate()

        {:ok, updated}

      {:error, changeset} ->

        {:error, changeset}

    end

  end

  @doc "Rewraps every retained GitHub token atomically; returns only the rotated count."

  @spec rotate_github_tokens!() :: non_neg_integer()

  def rotate_github_tokens! do

    |> unique_constraint(:github_id)

  end

  def leaderboard_changeset(user, opted_out?) when is_boolean(opted_out?) do

    user

    |> cast(%{public_leaderboard_opted_out: opted_out?}, [:public_leaderboard_opted_out])

    |> validate_required([:public_leaderboard_opted_out])

  end

  def ban_changeset(user, reason_code) do

    user

    |> cast(

    )

  end

  @doc """

  Voice tool-step activity keyed by the assistant message each step belongs to.

  A voice tool call is durable evidence of the same authority a text tool call

  has, so it belongs beside the assistant message it produced rather than only

  in the live session panel, which empties when the call ends or the page

  reloads. The response receipt carries the assistant message, so the join is

  the receipt.

  Selects the same bounded projection as `list_tool_step_activity/1`, so

  INVARIANTS.md UI-002 holds: already-scrubbed durable values and never a

  provider identifier.

  """

  @spec list_tool_step_activity_by_message([String.t()]) :: %{String.t() => [map()]}

  def list_tool_step_activity_by_message([]), do: %{}

  def list_tool_step_activity_by_message(assistant_message_ids)

      when is_list(assistant_message_ids) do

    from(step in ToolStep,

      join: receipt in ResponseReceipt,

      on: receipt.id == step.voice_response_receipt_id,

      where: receipt.assistant_message_id in ^assistant_message_ids,

      order_by: [asc: step.sequence],

      select:

        {receipt.assistant_message_id,

         %{

           id: step.id,

           sequence: step.sequence,

           tool_name: step.tool_name,

           status: step.status,

           raw_arguments: step.raw_arguments,

           result: step.result,

           error: step.error,

           executor_id: step.executor_id,

           executor_disclosure: step.executor_disclosure,

           requested_at: step.requested_at,

           started_at: step.started_at,

           completed_at: step.completed_at

         }}

    )

    |> Repo.all()

    |> Enum.group_by(&elem(&1, 0), &elem(&1, 1))

  end

  @spec record_client_event(Session.t(), String.t(), {String.t(), integer() | nil}) ::

          {:ok, ClientEvent.t()} | {:error, term()}

  def record_client_event(%Session{} = session, kind, {browser_family, browser_major}) do

  def complete_tool_step(%Session{}, %ToolStep{}, _outcome),

    do: {:error, :invalid_tool_outcome}

  @doc """

  Refuses a requested tool step with a typed host reason.

  A host limit that only answers the provider is invisible: the caller hears a

  turn that stops using tools and no one can tell whether the tool ran, failed,

  or was never allowed. Writing the refusal as a terminal step puts the reason

  in the same ordered activity stream a text refusal appears in.

  """

  @spec refuse_tool_step(Session.t(), ToolStep.t(), String.t(), String.t()) ::

          {:ok, ToolStep.t()} | {:error, term()}

  def refuse_tool_step(%Session{} = session, %ToolStep{} = step, code, message)

      when is_binary(code) and is_binary(message) do

    complete_tool_step(session, step, %{

      "schema" => "sarah.tool_outcome.v1",

      "call_id" => step.provider_call_id,

      "module_ref" => %{

        "module_id" => step.module_id,

        "tool_name" => step.tool_name,

        "version" => step.tool_version

      },

      "executor_ref" => %{"id" => "sarah.host", "disclosure" => "Sarah host execution limits"},

      "status" => "refused",

      "result" => nil,

      "error" => %{"code" => code, "message" => message},

      "target_receipt_refs" => [],

      "attribution_refs" => []

    })

  end

  @spec tool_continuation_output(ToolStep.t()) :: {:ok, map()} | {:error, term()}

  def tool_continuation_output(%ToolStep{id: step_id}) do

    step = Repo.get!(ToolStep, step_id)

  # Hitting the per-turn tool budget refuses the call instead of failing the

  # session; once the active response finishes, one tool-free response is

  # driven so the model reports what it already has instead of going silent.

  defp refuse_tool_call_limit(%ProviderEvent{payload: payload}, state) do

    _ =

      send_tool_refusal(

        state,

        payload["call_id"],

        "tool_call_limit_reached",

        "This turn reached the host limit of #{@maximum_tool_calls} tool calls. " <>

          "Do not call tools again this turn; report what you already have."

      )

  #

  # The refusal is also written as a terminal step, so the budget is visible in

  # the transcript with its typed reason. A limit that only answers the provider

  # lets a truncated run look like a complete one.

  defp refuse_tool_call_limit(%ProviderEvent{payload: payload} = event, state) do

    message =

      "This turn reached the host limit of #{@maximum_tool_calls} tool calls. " <>

        "Do not call tools again this turn; report what you already have."

    _ = record_refused_tool_step(event, state, "tool_call_limit_reached", message)

    _ = send_tool_refusal(state, payload["call_id"], "tool_call_limit_reached", message)

    {:noreply, %{state | limit_refused?: true}}

  end

  defp record_refused_tool_step(event, state, code, message) do

    with {:ok, step, _disposition} <-

           Voice.request_tool_step(state.session, event, state.tool_snapshot),

         {:ok, refused_step} <- Voice.refuse_tool_step(state.session, step, code, message) do

      {:ok, refused_step}

    end

  end

  defp send_tool_refusal(state, call_id, code, message) do

    refusal = %{

      "schema" => "sarah.tool_continuation.v1",

  defp composer_form, do: to_form(%{"message" => ""}, as: :chat)

  # Keyed by assistant message so the transcript can show what Sarah did next to

  # what she said, and so a reload rebuilds it from PostgreSQL.

  # what she said, and so a reload rebuilds it from PostgreSQL. Voice steps are

  # merged in from their response receipts: a spoken tool call carries the same

  # authority as a typed one, so it stays in the ordered stream after the call

  # ends instead of vanishing with the live panel.

  defp message_activity(messages) do

    messages

    |> Enum.filter(&(&1.role == "assistant"))

    |> Enum.map(& &1.id)

    |> Conversations.list_tool_step_activity_by_message()

    assistant_message_ids =

      messages

      |> Enum.filter(&(&1.role == "assistant"))

      |> Enum.map(& &1.id)

    text = Conversations.list_tool_step_activity_by_message(assistant_message_ids)

    voice = Voice.list_tool_step_activity_by_message(assistant_message_ids)

    Map.merge(text, voice, fn _message_id, text_steps, voice_steps ->

      Enum.sort_by(text_steps ++ voice_steps, & &1.sequence)

    end)

  end

  defp first_id([message | _messages]), do: message.id

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Accounts

  alias OpenAgents.Analytics

  alias OpenAgents.Conversations

  alias OpenAgents.DataRights

     |> assign(:memory_status, nil)

     |> assign(:pending_memory_action, nil)

     |> assign(:reset_enabled?, DataRights.reset_enabled?())

     |> assign(:leaderboard_opted_out?, current_user.public_leaderboard_opted_out)

     |> assign(:recording_config, Recordings.config())

     |> assign(:privacy_delete_form, to_form(%{"confirmation" => ""}, as: :privacy))

     |> reload_memory()}

        pending_memory_action={@pending_memory_action}

        privacy_delete_form={@privacy_delete_form}

        recording_config={@recording_config}

        leaderboard_opted_out?={@leaderboard_opted_out?}

      />

    </Layouts.app>

    """

    end

  end

  # The public board is the one projection that leaves the account boundary, so

  # the account it is about decides whether it appears there. The control states

  # the current publication state rather than a bare toggle, since "leaderboard"

  # on its own does not say which way it is set.

  def handle_event("set_leaderboard_visibility", %{"opted_out" => opted_out}, socket)

      when opted_out in ["true", "false"] do

    opted_out? = opted_out == "true"

    case Accounts.set_public_leaderboard_opt_out(socket.assigns.current_user, opted_out?) do

      {:ok, user} ->

        message =

          if opted_out?,

            do: "Your account no longer appears on the public leaderboard.",

            else: "Your account appears on the public leaderboard again."

        {:noreply,

         socket

         |> assign(:current_user, user)

         |> assign(:leaderboard_opted_out?, user.public_leaderboard_opted_out)

         |> assign(:memory_status, {:ok, message})}

      {:error, _changeset} ->

        {:noreply,

         assign(

           socket,

           :memory_status,

           {:error, "Sarah could not change your leaderboard preference. Try again."}

         )}

    end

  end

  def handle_event("cancel_memory_action", _params, socket) do

    {:noreply, assign(socket, :pending_memory_action, nil)}

  end

  attr :pending_memory_action, :any, default: nil

  attr :privacy_delete_form, :any, required: true

  attr :recording_config, :map, required: true

  attr :leaderboard_opted_out?, :boolean, required: true

  defp memory_manager(assigns) do

    ~H"""

        <div class="memory-header__actions">

          <%!-- The way out of a panel belongs in the panel. This used to be a

          sidebar row, which meant leaving depended on chrome outside the thing

          you were leaving. --%>

          you were leaving. Memory is a place with its own URL, so the way back

          navigates to the conversation rather than toggling a panel. --%>

          <.text_button

            id="toggle-memory"

            phx-click="toggle_memory"

            navigate={~p"/sarah"}

            aria-label="Return to conversation"

          >

            <.icon name="arrow-left" /> Return to conversation

        <.memory_record :for={record <- @memory_records} record={record} />

      </div>

      <.card id="leaderboard-preference" aria-labelledby="leaderboard-preference-heading">

        <header>

          <h2 id="leaderboard-preference-heading">Public leaderboard</h2>

          <p>

            The public leaderboard publishes a rank, your GitHub login, name, avatar, and one

            token total. It publishes nothing else about your account.

          </p>

          <p id="leaderboard-preference-state">

            <%= if @leaderboard_opted_out? do %>

              Your account is withheld from the board.

            <% else %>

              Your account appears on the board when its token total is above zero.

            <% end %>

          </p>

        </header>

        <footer>

          <.button

            id="toggle-leaderboard-preference"

            size={:sm}

            variant={:secondary}

            phx-click="set_leaderboard_visibility"

            phx-value-opted_out={to_string(not @leaderboard_opted_out?)}

          >

            <%= if @leaderboard_opted_out? do %>

              SHOW ME ON THE LEADERBOARD

            <% else %>

              HIDE ME FROM THE LEADERBOARD

            <% end %>

          </.button>

        </footer>

      </.card>

      <.card

        id="privacy-controls"

        variant={:danger}

^docs/2026-08-21-hot-deploy-gap-audit\.md:

^docs/2026-08-21-repository-storage-architecture-audit\.md:

^docs/2026-08-21-sarah-computers-and-scv-architecture-audit\.md:

^docs/2026-08-23-sarah-memory-voice-session-control-audit\.md:

^docs/chat-inference-plan\.md:

^docs/component-library\.md:

^docs/episode-triage\.md:

    assert Leaderboard.compute_entries() == []

  end

  test "an account can withhold itself from the board and publish itself again" do

    user = account("self-withheld")

    complete_typed_turn(user, "Publish me first.", %{

      "input_tokens" => 60,

      "output_tokens" => 40,

      "total_tokens" => 100

    })

    assert [_entry] = Leaderboard.compute_entries()

    assert Enum.map(Leaderboard.refresh(), & &1.github_login) == [user.github_login]

    assert {:ok, withheld} = Accounts.set_public_leaderboard_opt_out(user, true)

    assert withheld.public_leaderboard_opted_out

    assert Leaderboard.compute_entries() == []

    assert Leaderboard.refresh() == []

    assert {:ok, published} = Accounts.set_public_leaderboard_opt_out(withheld, false)

    refute published.public_leaderboard_opted_out

    assert Enum.map(Leaderboard.refresh(), & &1.github_login) == [user.github_login]

  end

  test "drops an account from the board when it deletes its data" do

    user = account("erased")

             )

  end

  test "deletion, correction, and purge refuse another owner's record and leak no existence" do

    {first_owner, first_conversation} = owner("profile-delete-first-browser")

    {second_owner, second_conversation} = owner("profile-delete-second-browser")

    first_source = source_message(first_conversation, "Remember my private project is Atlas.")

    second_source = source_message(second_conversation, "Remember my private project is Beacon.")

    {:ok, candidate} =

      ProfileMemory.create_candidate(

        first_owner,

        attributes(first_source, category: "project", claim: "My project is Atlas.")

      )

    {:ok, active} =

      ProfileMemory.transition(first_owner, candidate.id, candidate.generation, "active")

    foreign_selector = %{

      "mode" => "record",

      "record_id" => active.id,

      "expected_generation" => active.generation

    }

    absent_selector = %{

      "mode" => "record",

      "record_id" => Ecto.UUID.generate(),

      "expected_generation" => active.generation

    }

    # Identical answers: the second owner cannot tell a record it may not touch

    # from one that was never stored.

    assert {:ok, %{disposition: "already_absent", records: []}} =

             ProfileMemory.forget_active(second_owner, foreign_selector)

    assert {:ok, %{disposition: "already_absent", records: []}} =

             ProfileMemory.forget_active(second_owner, absent_selector)

    assert {:error, :not_found} =

             ProfileMemory.correct(

               second_owner,

               active.id,

               active.generation,

               attributes(second_source, category: "project", claim: "My project is Beacon.")

             )

    assert {:error, :not_found} =

             ProfileMemory.purge(second_owner, active.id, active.generation)

    # A stale generation is no shortcut around ownership, and forgetting in one

    # scope leaves the other scope's record active.

    assert {:error, :not_found} =

             ProfileMemory.transition(second_owner, active.id, active.generation + 1, "forgotten")

    assert {:ok, [listed]} = ProfileMemory.list_current(first_owner)

    assert listed.id == active.id

    assert listed.status == "active"

    assert {:ok, %{disposition: "forgotten", records: [forgotten]}} =

             ProfileMemory.forget_active(first_owner, foreign_selector)

    assert forgotten.id == active.id

    assert {:ok, []} = ProfileMemory.list_current(first_owner)

    # Purge is the only irreversible path, so it stays owner-scoped and terminal.

    assert {:error, :not_found} =

             ProfileMemory.purge(second_owner, forgotten.id, forgotten.generation)

    assert {:ok, :purged} =

             ProfileMemory.purge(first_owner, forgotten.id, forgotten.generation)

    assert {:error, :not_found} = ProfileMemory.get(first_owner, forgotten.id)

  end

  test "database backstops reject orphan activation, source deletion, and in-place claim edits" do

    {owner, conversation} = owner("profile-database-constraints")

    {_foreign_owner, foreign_conversation} = owner("profile-database-foreign-source")

                    %{"type" => "response.create", "response" => %{"tool_choice" => "none"}}},

                   1_000

    # The refusal the provider hears is also evidence the person can read: a

    # truncated run must not read back as a complete one.

    assert refused =

             Enum.find(Voice.list_tool_step_activity(session), &(&1.status == "refused"))

    assert refused.error["code"] == "tool_call_limit_reached"

    assert refused.error["message"] =~ "host limit of 8 tool calls"

    alive = Voice.get_session!(session.id)

    assert alive.status in ~w(listening responding)

    assert is_pid(VoiceSessions.whereis(session.id))

           ]

  end

  test "a refused host limit is durable and keyed to the assistant message it belongs to" do

    {:ok, conversation} = Conversations.ensure_conversation("voice-durable-activity-browser")

    snapshot = Registry.current!()

    {:ok, session} = Voice.admit_session(conversation, enabled_config())

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        event(:user_transcript_final, "evt-user-activity", %{

          "item_id" => "item-user-activity",

          "response_id" => nil,

          "content" => "Keep looking things up."

        })

      )

    assert {:ok, context} =

             Voice.capture_response_context(session, "item-user-activity", snapshot)

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        event(:response_started, "evt-start-activity", %{"response_id" => "response-activity"}),

        response_context: context

      )

    request =

      event(:tool_call_requested, "evt-tool-activity", %{

        "response_id" => "response-activity",

        "item_id" => "item-call-activity",

        "call_id" => "call-activity",

        "tool_name" => "memory_list",

        "raw_arguments" => ~s({"category":"","first":1})

      })

    {:ok, session, _event, :created} =

      Voice.record_provider_event(session, session.generation, request)

    assert {:ok, requested, :created} = Voice.request_tool_step(session, request, snapshot)

    assert {:ok, refused} =

             Voice.refuse_tool_step(

               session,

               requested,

               "tool_call_limit_reached",

               "This turn reached the host limit of 8 tool calls."

             )

    assert refused.status == "refused"

    assert refused.error["code"] == "tool_call_limit_reached"

    assert refused.executor_id == "sarah.host"

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        event(:assistant_transcript_final, "evt-assistant-activity", %{

          "item_id" => "item-assistant-activity",

          "response_id" => "response-activity",

          "content" => "I stopped short of finishing."

        })

      )

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        event(:response_completed, "evt-done-activity", %{

          "response_id" => "response-activity",

          "status" => "completed",

          "usage" => %{}

        })

      )

    assert [receipt] = Voice.list_response_receipts(session)

    assistant_message_id = receipt.assistant_message_id

    assert is_binary(assistant_message_id)

    assert %{^assistant_message_id => [activity]} =

             Voice.list_tool_step_activity_by_message([assistant_message_id])

    assert activity.tool_name == "memory_list"

    assert activity.status == "refused"

    assert activity.error["code"] == "tool_call_limit_reached"

    refute Map.has_key?(activity, :provider_call_id)

    assert Voice.list_tool_step_activity_by_message([]) == %{}

    assert Voice.list_tool_step_activity_by_message([Ecto.UUID.generate()]) == %{}

  end

  defp event(kind, event_id, payload) do

    %ProviderEvent{kind: kind, provider_event_id: event_id, payload: payload}

  end

    refute has_element?(view, "#messages-voice-live-item-live-1")

  end

  test "voice tool activity stays in the ordered transcript after the call ends", %{conn: conn} do

    key = "voice-durable-activity-credential-0000000000000"

    user = github_user(key)

    conn = log_in_github_user(conn, key)

    assert {:ok, opening, _html} = live(conn, ~p"/sarah")

    GenServer.stop(opening.pid)

    conversation = Conversations.get_conversation_for_user(user)

    snapshot = OpenAgents.Tools.Registry.current!()

    config = OpenAgents.Voice.Config.build!(enabled_voice())

    assert {:ok, session} = Voice.admit_session(conversation, config)

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        voice_event(:user_transcript_final, "evt-chat-user", %{

          "item_id" => "item-chat-user",

          "response_id" => nil,

          "content" => "Look through what you remember."

        })

      )

    assert {:ok, context} = Voice.capture_response_context(session, "item-chat-user", snapshot)

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        voice_event(:response_started, "evt-chat-start", %{"response_id" => "response-chat"}),

        response_context: context

      )

    request =

      voice_event(:tool_call_requested, "evt-chat-tool", %{

        "response_id" => "response-chat",

        "item_id" => "item-chat-call",

        "call_id" => "call-chat",

        "tool_name" => "memory_list",

        "raw_arguments" => ~s({"category":"","first":1})

      })

    {:ok, session, _event, :created} =

      Voice.record_provider_event(session, session.generation, request)

    assert {:ok, requested, :created} = Voice.request_tool_step(session, request, snapshot)

    assert {:ok, _refused} =

             Voice.refuse_tool_step(

               session,

               requested,

               "tool_call_limit_reached",

               "This turn reached the host limit of 8 tool calls."

             )

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        voice_event(:assistant_transcript_final, "evt-chat-assistant", %{

          "item_id" => "item-chat-assistant",

          "response_id" => "response-chat",

          "content" => "I stopped short of finishing that."

        })

      )

    {:ok, session, _event, :created} =

      Voice.record_provider_event(

        session,

        session.generation,

        voice_event(:response_completed, "evt-chat-done", %{

          "response_id" => "response-chat",

          "status" => "completed",

          "usage" => %{}

        })

      )

    assert {:ok, _ended} = Voice.end_session(session, session.generation, "test_end")

    assert [receipt] = Voice.list_response_receipts(session)

    assistant_message_id = receipt.assistant_message_id

    assert {:ok, view, html} = live(conn, ~p"/sarah")

    assert html =~ "I stopped short of finishing that."

    # The spoken tool call sits in the assistant row it belongs to, not in the

    # live panel, which a reload empties.

    assert has_element?(view, "#tool-activity-messages-#{assistant_message_id}")

    refute has_element?(view, "#live-tool-activity")

    row = view |> element("#tool-activity-messages-#{assistant_message_id}") |> render()

    assert row =~ "wasn't permitted"

    assert row =~ "Denied"

    assert row =~ "tool_call_limit_reached"

  end

  test "reload preserves one canonical greeting without fake recognition", %{conn: conn} do

    key = "reload-browser-credential-0000000000000000"

    user = github_user(key)

    do_eventually(assertion, deadline)

  end

  defp voice_event(kind, event_id, payload) do

    %OpenAgents.Voice.ProviderEvent{

      kind: kind,

      provider_event_id: event_id,

      payload: payload

    }

  end

  defp enabled_voice do

    [

      enabled: true,

    refute has_element?(view, "#message-form")

  end

  test "the way back is a link, and the board preference is the account's to set", %{conn: conn} do

    token = "memory-preference-browser-credential-0000000000000"

    conn = log_in_github_user(conn, token)

    user = github_user(token)

    assert {:ok, view, _html} = live(conn, ~p"/memory")

    # A page is left by navigating, not by toggling a panel that is not there.

    assert has_element?(view, "#toggle-memory[href='/sarah']")

    assert render(view) =~ "Your account appears on the board"

    view |> element("#toggle-leaderboard-preference") |> render_click()

    assert render(view) =~ "no longer appears on the public leaderboard"

    assert render(view) =~ "Your account is withheld from the board."

    assert OpenAgents.Repo.get!(OpenAgents.Accounts.User, user.id).public_leaderboard_opted_out

    view |> element("#toggle-leaderboard-preference") |> render_click()

    assert render(view) =~ "Your account appears on the board"

    refute OpenAgents.Repo.get!(OpenAgents.Accounts.User, user.id).public_leaderboard_opted_out

  end

  test "correction preserves supersession and reconciles another open tab", %{conn: conn} do

    token = "memory-correction-browser-credential-0000000000000"

    %{record: record} = create_profile_memory(token, "I prefer concise answers")