Audit and resolve Sarah memory, voice, session, and control gaps #89

Outcome

Reproduce and resolve the concrete Sarah defects identified during the production launch, using one issue to track evidence and separate child changes where needed.

Current behavior

Episode 270 identified automatic-memory, voice-tool visibility, tool-loop, session, delete-memory authorization, and leaderboard preference gaps. The current board does not record whether each gap remains reproducible or has shipped since the episode.

Source: docs/episode-triage.md, episode 270 and batch 6 integration notes.

Work

• Verify whether automatic memory saves occur with visible consent and version history.
• Show voice tool calls and results in the same ordered activity stream as text.
• Replace the hard-coded four-tool-call cap with a budgeted, visible loop limit and typed terminal reason.
• Define voice session timeout, reconnect, resume, and failure behavior.
• Reproduce and fix delete-memory authorization across owners and versions.
• Add a leaderboard opt-out and remove opted-out accounts from public projections.
• File child issues for independently deployable fixes and link exact evidence.

Acceptance criteria

• Each reported gap has a current reproduction or a linked production receipt proving it no longer exists.
• Text and voice expose the same tool authority, ordered events, cancellation, and terminal reasons.
• One owner cannot read, delete, restore, or infer another owner's memory.
• Tool limits fail visibly and never describe a truncated run as complete.
• Leaderboard opt-out takes effect across web, API, cache, and analytics projections.

Verification

Use focused LiveView, voice, memory authorization, recovery, budget, preference, and privacy tests. Run exact-candidate browser qualification and mix precommit.

Dependencies

Coordinate chat work with #55 and the shared tool runtime.