H-6800: Fix concurrent Voice provenance rollback

[kostandinang]

🌟 What is the purpose of this PR?

Prevent overlapping rejected Voice tool answers from restoring stale provenance onto an assistant message. Each failed submission now removes only its own temporary Voice tool-call ID from the latest metadata, preserving successful siblings and unrelated concurrent updates.

🔗 Related links

• H-6800 — Improve Petrinaut Voice turn-taking and answer provenance (internal)
• Donor PR #9512
• Original review finding: stale Voice-ID rollback
• Accepted reconciliation #9564

🚫 Blocked by

• Nothing

🔍 What does this change?

• Coordinate overlapping Voice tool submissions against one pre-submission provenance baseline.
• Roll failed submissions back from current metadata instead of restoring a captured snapshot.
• Preserve successful sibling IDs, pre-existing attribution, independent message-level Voice source, unrelated metadata and concurrent message parts.
• Remove submission coordination state once the overlapping group settles.
• Add regressions for both dual-rejection orders and concurrent metadata updates.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• modifies an npm-publishable library and I have added a changeset file

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

⚠️ Known issues

Direct spoken-user attribution after hydration remains explicitly deferred. This focused fix does not restore the obsolete inline brunch_ask widget provenance slot.

🐾 Next steps

After this fix and the remaining provenance omissions are explicitly accepted, #9512 can close as a donor.

🛡 What tests cover this?

• Both completion orders when two overlapping Voice tool submissions reject.
• One-success/one-failure sibling preservation.
• Typed retry after rejection.
• Pre-existing and independent Voice attribution.
• Unrelated concurrent metadata and message-part preservation.
• Complete ai-assistant-panel.test.tsx: 62 tests.

❓ How to test this?

1. Run yarn workspace @hashintel/petrinaut test:unit --run src/ui/views/Editor/panels/ai-assistant-panel.test.tsx.
2. Run yarn workspace @hashintel/petrinaut lint:tsc.
3. Run yarn workspace @hashintel/petrinaut lint:eslint.

📹 Demo

Not applicable; this repairs internal provenance bookkeeping and is covered by deterministic regressions.

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Sep 9, 2026 12:35pm UTC
petrinaut	Ready	Preview	Sep 9, 2026 12:35pm UTC
petrinaut-docs	Ready	Preview	Sep 9, 2026 12:35pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Sep 9, 2026 12:35pm UTC

[lunelson]

Approved. Two non-blocking observations:

• Voice-ID normalization is repeated across markVoiceToolOrigin, submission-state initialization, and rollback; the added tests also repeat substantial fixture setup. A small shared helper/test harness could reduce drift and noise.
• Low-probability residual risk: submission coordination is keyed by the stable setMessages identity plus message ID, rather than conversation ID. A pending submission across a conversation switch could therefore share coordination state if message IDs collide.

Neither blocks this focused fix.

[kostandinang]

Addressed the duplication in bb46ded1ec: getVoiceToolCallIds now centralizes current/legacy provenance normalization for marking, submission-state initialization, and rollback. The repeated direct-message fixtures now use a small message factory/store.

I kept the coordination key unchanged. AiAssistantPanel keys ConversationAiAssistantPanel by aiAssistant.conversationId, so an actual conversation change remounts useChat and creates a distinct setMessages callback. A pending submission from the old mount therefore cannot share its WeakMap entry with the replacement conversation, even when message IDs collide.

[lunelson]

Re-reviewed after bb46ded1ec. The follow-up centralizes Voice-ID normalization and consolidates the repeated test setup without changing provenance behavior.

I am also withdrawing my earlier conversation-key concern: AiAssistantPanel is keyed by conversationId, so a conversation change remounts the hook tree and isolates the setMessages coordination key. No remaining findings.

[lunelson]

Non-blocking concerns:

• Add an integration regression covering a rejected Voice answer through the panel and confirming the transport does not serialize it as source: "voice".
• Direct-user Voice provenance after reopen remains intentionally unresolved.
• The already-large AI assistant panel now also owns concurrent provenance bookkeeping.
• Local verification in this worktree was blocked by stale or missing workspace package resolution; the PR CI checks passed.