ui-server: Gemini Live rejects binary JSON frames from the live endpoint #2358

Out of scope

• Changing provider/model selection, weakening frame/queue limits, trusting vendor tool arguments, changing permission authority, adding paid CI, or claiming audio/device qualification.

Context

The separately authorized #961 prerequisite recheck of #2356 candidate ebb4a12def46412216a6d4acbd7cb4db89dd3bea observed a real Gemini Developer API v1beta binary JSON setupComplete frame for gemini-3.8-live on 2026-10-17. Bun 1.4.3 delivered MessageEvent.data as a Uint8Array. A passive diagnostic decoded only the top-level JSON keys; no credential, raw payload, session identifier, audio or tool execution was recorded.

The adapter message handler (socket.addEventListener("message"), packages/ui-server/src/voice/gemini-conversation.ts:132-137 on that candidate) accepts only strings and fails with Gemini Live returned an invalid or uncorrelatable frame. The provider had emitted setupComplete; this is a separate failure from #2356's invalid function parameter schema. The existing loopback fixture sends JSON as text and does not cover the actual binary transport.

Part of #54. Related qualification: #961.

Scope

• Normalize Gemini text/binary JSON at the adapter's existing message boundary using the installed Bun WebSocket behavior.
• Enforce the existing frame bound before decoding/parsing, preserve arrival order and reject malformed/unsupported data visibly without leaking provider diagnostics.
• Exercise real loopback binary setup and representative event frames alongside text compatibility.

Acceptance criteria

• A real Bun loopback peer sending UTF-8 JSON setupComplete as binary completes the actual adapter handshake; show the regression failing on the current string-only guard before the fix.
• Representative binary input/audio/interruption/tool frames retain their existing normalized semantics and host-owned authority. Text frames still work.
• Oversized binary frames, malformed JSON and unsupported payload types fail closed under the existing bounds without leaking credentials; no guard is removed to accept binary data.
• Decode/normalization cannot reorder concurrent messages or admit callbacks after abort/close/replacement. Test asynchronous normalization if that implementation requires it.
• Existing Gemini lifecycle, queue, correlation and host tests pass; record the corrected candidate for a separately authorized ui: qualify both live conversation engines on real devices before activation #961 live recheck.

Verification

Keyless real Bun WebSocket tests through bun run test, strict types/lint, failing-first/restored evidence and bun run check:pr --base origin/main before ready. CI remains offline. Live connectivity and device/audio qualification are separate #961 evidence, not inferred from loopback tests.

Contract impact

Expected internal transport normalization only; no shared machine schema or capability promotion. Preserve existing byte bounds and authority semantics; reassess any exported or shared-wire change.

2026-10-22: removed the stale Blocked by #2356 declaration (#2356 is closed as completed). No open blocker remains.