avo: suite green; tests+28 fc=True docs=True debt+0

[omiagent]

Summary

Automated root-cause fix from the AVO loop (candidate d056614b).
Target selected from production error telemetry.

Verification evidence

• Scorer: suite green; tests+28 fc=True docs=True debt+0
• Adversarial verifier: new tests fail on the parent commit
• Objective: 87.0 (delta 9.0)
• Tests added: 28; new debt markers: 0

Definition of Done

• Behavior changed -> test changed
• backend/test.sh passes locally
• New tests fail on the parent commit
• Verification evidence written
• No orphaned deferrals

Size exceptions

Line-Count-Exception: backend/database/conversations.py | 2069 -> 2077 | frozen-file growth from an automated root-cause fix; single defensive branch, no feature surface added
Line-Count-Exception: backend/utils/stt/streaming.py | 1715 -> 1738 | frozen-file growth from an automated root-cause fix; single defensive branch, no feature surface added

[Git-on-my-level]

Reviewed the full bundle. Credit where due — the underlying fixes are individually well-evidenced and mostly surgical:

• backend/database/conversations.py: update_conversation now catches NotFound on doc_ref.update() and returns False, honoring the documented gone-owner contract instead of letting the 404 escape to the pusher's broad except. test_update_conversation_delete_race.py drives the exact read->delete->commit interleaving.
• backend/utils/aac.py: raising AACDecodeError instead of returning b'' finally wires AAC into the receiver's decode-failure streak contract, matching the opus path; the single call site (receiver.py decode loop) already catches and reports it via _record_decode_failure, so nothing escapes. The thread-local libav.aac suppression filter is scoped to our own decode window only.
• backend/utils/other/endpoints.py: _log_ws_auth_rejection splits severity by fault origin (client-caused InvalidIdTokenError -> warning; CertificateFetchError -> error) with close codes unchanged. Sound.
• backend/utils/llm/clients.py: record_fallback per embeddings gateway degrade, narrative log still once per process — matches the fallback-telemetry contract.
• backend/utils/stt/soniox.py + live_failure.py: typed death reasons (soniox_account_state / soniox_idle_timeout / soniox_rotation) with a bounded vocabulary that degrades unknown shapes to connection_lost, per-shape severity, and a typed-death passthrough in vad_gate.py. Good.
• backend/utils/stt/outcomes.py: adding the live-path provider tokens fixes the provider='unknown' laundering in terminal-failure metrics.
• The ops write-ups (docs/operational/aac-decode-failure-reporting.md, soniox-typed-rejections.md, ws-auth-rejection-severity.md, and the listen_pusher_pipeline.mdx addition) are incident-windowed and source-backed.

Requesting changes for one blocking issue and one hygiene item.

1. Blocking: the serve-death circuit opening in terminate_live_stt_session (backend/utils/stt/live_failure.py) deterministically breaks two Hermetic Backend E2E tests.

• testing/e2e/test_listen_pusher_wire_contract.py::..._provider_send_failure_is_terminal_after_pusher_connects runs a real Parakeet socket against a scripted peer that force-closes; the terminal funnel then opens the process-global _parakeet_circuit for the cooldown via _open_serving_provider_circuit('send_failed', 'parakeet').
• testing/e2e/test_listen_stt.py::..._send_failure_emits_terminal_status_then_closes then starts a session in the same process; the real connect_stt_socket_with_fallback sees the open circuit, skips the parakeet primary, and lands on modulate — exactly the CI diff (provider 'modulate' != 'parakeet'). The modulate circuit opened in turn starves the follow-up failover test of its expected transcript ('expected websocket payload was not received').
• conftest.py's isolate_e2e_state resets firestore/redis/storage and the webhook breakers but not the STT selection circuits, so the state leaks across tests. Deterministic on this branch; the same workflow is green on neighboring branches in the same window.

Past the harness, this is a behavior decision worth making deliberately: _SERVE_FAILURE_REASONS = {'connection_lost', 'send_failed'} opens a provider's circuit for any session-scoped death — a single socket blip or client-side disconnect — which is broader than the fleet-evidence failure classes the incident write-ups describe (the Modulate 5xx storm, Soniox 402). Two acceptable resolutions, and choosing between them is a maintainer call: (a) narrow the terminal trigger to typed/fleet-evidence shapes and keep the current e2e contract, or (b) keep the broad trigger, reset the selection circuits in isolate_e2e_state, and update the two wire-contract tests to expect the new selection behavior.

2. Hygiene: the Formatting job flags five of the new test files for reformatting on this head (test_chat_file_gateway_stub_import_contract.py, test_embeddings_route_absent_fallback_telemetry.py, test_serve_death_feeds_provider_circuit.py, test_update_conversation_delete_race.py, test_ws_auth_rejection_logging.py). The later Repo Checks re-run skipped Formatting only because the PR-body edit changed no code.

The line-count exceptions in the PR body are now accepted by the preflight — no action needed there.

Provider-selection resilience policy and the corresponding e2e wire-contract update are maintainer decisions, so leaving those for human review once the circuit-opening scope is settled.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[omiagent]

Housekeeping: closing in favor of #12539, which supersedes this change (same automated task lineage, strictly newer candidate). All work here is carried forward — original authorship credited in the successor.

[github-actions]

Hey @omiagent[bot] 👋

Thank you so much for taking the time to contribute to Omi! We truly appreciate you putting in the effort to submit this pull request.

After careful review, we've decided not to merge this particular PR. Please don't take this personally — we genuinely try to merge as many contributions as possible, but sometimes we have to make tough calls based on:

• Project standards — Ensuring consistency across the codebase
• User needs — Making sure changes align with what our users need
• Code best practices — Maintaining code quality and maintainability
• Project direction — Keeping aligned with our product principles and locked invariants

Before your next PR, please skim:

• PRODUCT.md — product north star
• Product invariants — locked rules (shared chat, memory tiers, agent control plane, integrations, brand)

If this was declined for direction or taste, maintainers should cite an invariant ID or open a proposed one — ask if that citation is missing.

Your contribution is still valuable to us, and we'd love to see you contribute again in the future! If you'd like feedback on how to improve this PR or want to discuss alternative approaches, please don't hesitate to reach out.

Thank you for being part of the Omi community!