diff --git a/.chronus/changes/wujin-voice_submodule-2026-7-12-16-36-34.md b/.chronus/changes/wujin-voice_submodule-2026-7-12-16-36-34.md
new file mode 100644
index 000000000000..718110429490
--- /dev/null
+++ b/.chronus/changes/wujin-voice_submodule-2026-7-12-16-36-34.md
@@ -0,0 +1,7 @@
+---
+changeKind: feature
+packages:
+  - azure-ai-agentserver-invocations
+---
+
+Added the experimental `azure.ai.agentserver.invocations.voice` typed event relay, a synchronous connection-termination signal for developer-owned task cancellation, and the `basic_voice_agent` full-duplex sample.
\ No newline at end of file
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/MANIFEST.in b/sdk/agentserver/azure-ai-agentserver-invocations/MANIFEST.in
index cd83a6c13bfa..7021c00dddc3 100644
--- a/sdk/agentserver/azure-ai-agentserver-invocations/MANIFEST.in
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/MANIFEST.in
@@ -1,7 +1,7 @@
 include *.md
 include LICENSE
 recursive-include tests *.py
-recursive-include samples *.py *.md
+recursive-include samples *.py *.md *.txt *.yaml
 include azure/__init__.py
 include azure/ai/__init__.py
 include azure/ai/agentserver/__init__.py
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/README.md b/sdk/agentserver/azure-ai-agentserver-invocations/README.md
index dd2548c9ede8..c7518d70fdb4 100644
--- a/sdk/agentserver/azure-ai-agentserver-invocations/README.md
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/README.md
@@ -4,6 +4,7 @@ The `azure-ai-agentserver-invocations` package provides the invocation protocol
 
 - **HTTP** (`invocations` protocol) — `POST /invocations`, `GET /invocations/{id}`, `POST /invocations/{id}/cancel`, `GET /invocations/docs/openapi.json`, `GET /invocations/docs/asyncapi.{json,yaml}`.
 - **WebSocket** (`invocations_ws` protocol) — full-duplex streaming at `/invocations_ws`, registered with `@app.ws_handler`.
+- **Voice Live Bridge** — an experimental typed event relay in the `azure.ai.agentserver.invocations.voice` submodule, layered on `invocations_ws`.
 
 ## Getting started
 
@@ -309,6 +310,102 @@ The handler receives a Starlette [`WebSocket`][starlette-ws] and returns `None`.
 
 [starlette-ws]: https://www.starlette.io/websockets/
 
+## Typed Voice Live Bridge submodule (preview)
+
+`VoiceAgentServerHost` provides typed `on_<event>` decorators over the existing
+`invocations_ws` transport. Each callback receives an immutable event and a
+send-only `Session`:
+
+```python
+from azure.ai.agentserver.invocations.voice import (
+    ResponseCreated,
+    ResponseDone,
+    ResponseOutputTextDone,
+    Session,
+    SessionReady,
+    SessionRejected,
+    SessionStart,
+    UserMessage,
+    VoiceAgentServerHost,
+    new_item_id,
+    new_response_id,
+)
+
+app = VoiceAgentServerHost()
+
+
+@app.on_session_start
+async def on_session_start(session: Session, event: SessionStart) -> None:
+    if event.protocol_version != "1.0":
+        await session.send(
+            SessionRejected(code="protocol_mismatch", retriable=False)
+        )
+        return
+    # Restore durable application state here when event.reconnect is true.
+    await session.send(SessionReady())
+
+
+@app.on_user_message
+async def on_user_message(session: Session, event: UserMessage) -> None:
+    response_id = new_response_id()
+    item_id = new_item_id()
+    await session.send(
+        ResponseCreated(response_id=response_id, in_reply_to=(event.item_id,))
+    )
+    await session.send(
+        ResponseOutputTextDone(
+            response_id=response_id,
+            item_id=item_id,
+            text="Hello from the hosted text agent.",
+        )
+    )
+    await session.send(ResponseDone(response_id=response_id))
+```
+
+The submodule is deliberately a thin typed event relay. It decodes one inbound frame,
+dispatches the corresponding callback, encodes explicit outbound messages, and
+serializes concurrent WebSocket writes. It does **not** own pending responses,
+terminal arbitration, timeout/cancel operations, generation tasks, history, or
+reconnect state.
+
+When the peer or proxy closes the WebSocket, `@app.on_disconnect` receives a
+local `SessionDisconnected` event. This callback represents only the observed
+peer disconnect.
+
+`@app.on_connection_terminating` is the common cleanup signal for every
+in-process exit from the connection handler, including peer disconnect, local
+protocol close, callback failure, transport failure, and task cancellation. It
+is synchronous so applications can promptly call `Task.cancel()` or set their
+own stop signals without making WebSocket teardown wait for asynchronous
+cleanup. The callback must be non-blocking and must not send frames. The SDK
+invokes it once as each connection handler unwinds, and applications must keep
+their signaling idempotent. The SDK does not retain, join, or guarantee
+completion of application-owned tasks.
+
+For the Voice WebSocket relay, shutdown cancellation remains cancellation while
+the SDK is awaiting WebSocket accept or receive, even if the ASGI transport
+returns normally or translates the cancellation into a standard exception. This
+guarantee requires the transport operation to eventually settle after receiving
+cancellation; a transport that suppresses cancellation and never returns is
+outside the contract.
+
+After repeated cancellation requests, the Voice endpoint is guaranteed to remain
+cancelled. The exact nested `asyncio.CancelledError` instance or message selected
+from a transport-defined exception graph is unspecified.
+
+Voice callback cancellation is cooperative. A callback that catches
+`asyncio.CancelledError` must re-raise it after its own cleanup. If application
+code catches cancellation and returns normally, recovery is outside the SDK
+contract; the SDK does not forcibly terminate or retain that callback.
+
+For full-duplex streaming, the agent creates and owns a generation task, returns
+from `on_user_message`, and cancels that task from `on_barge_in`,
+`on_response_cancelled`, `on_response_timeout`, or
+`on_connection_terminating`. Each task remains responsible for its own
+asynchronous resource cleanup. See the complete
+[`basic_voice_agent`](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent)
+sample.
+
 ### Reference: configuration
 
 | Environment variable | Default | Description |
@@ -340,6 +437,7 @@ Visit the [Samples](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/
 | [async_invoke_agent](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/agentserver/azure-ai-agentserver-invocations/samples/async_invoke_agent/) | Long-running operations with polling and cancellation |
 | [ws_invoke_agent](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/agentserver/azure-ai-agentserver-invocations/samples/ws_invoke_agent/) | Combined `POST /invocations` (HTTP) and `/invocations_ws` (WebSocket) host |
 | [ws_bidirectional_streaming_agent](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/agentserver/azure-ai-agentserver-invocations/samples/ws_bidirectional_streaming_agent/) | Full-duplex `/invocations_ws` agent: concurrent token streams + mid-flight cancel (relies on the SDK's WS protocol Ping/Pong keep-alive, not application-level heartbeats) |
+| [basic_voice_agent](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/) | Typed Voice Live Bridge callbacks with developer-owned full-duplex streaming and cancellation |
 
 ## Contributing
 
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/api.md b/sdk/agentserver/azure-ai-agentserver-invocations/api.md
index 8593e6499ec0..65952b6f5b13 100644
--- a/sdk/agentserver/azure-ai-agentserver-invocations/api.md
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/api.md
@@ -6,11 +6,11 @@ namespace azure.ai.agentserver.invocations
         property ws_ping_interval: float    # Read-only
 
         def __init__(
-                self, 
-                *, 
-                asyncapi_spec_json: Optional[dict[str, Any]] = ..., 
-                asyncapi_spec_yaml: Optional[str] = ..., 
-                openapi_spec: Optional[dict[str, Any]] = ..., 
+                self,
+                *,
+                asyncapi_spec_json: Optional[dict[str, Any]] = ...,
+                asyncapi_spec_yaml: Optional[str] = ...,
+                openapi_spec: Optional[dict[str, Any]] = ...,
                 **kwargs: Any
             ) -> None: ...
 
@@ -29,4 +29,703 @@ namespace azure.ai.agentserver.invocations
         def ws_handler(self, fn: WSHandler) -> WSHandler: ...
 
 
+namespace azure.ai.agentserver.invocations.voice
+
+    @experimental
+    def azure.ai.agentserver.invocations.voice.new_item_id() -> str: ...
+
+
+    @experimental
+    def azure.ai.agentserver.invocations.voice.new_message_id() -> str: ...
+
+
+    @experimental
+    def azure.ai.agentserver.invocations.voice.new_response_id() -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.AgentError(_OutboundMessage):
+        code: str
+        id: str
+        item_id: Optional[str]
+        message: str
+        response_id: Optional[str]
+        ts: str
+        type: ClassVar[str] = error
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                code: str,
+                message: str,
+                response_id: str | None = None,
+                item_id: str | None = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.BargeIn(_InboundMessage):
+        heard_text: str
+        id: str
+        item_id: Optional[str]
+        response_id: str
+        ts: str
+        type: ClassVar[str] = barge_in
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                response_id: str,
+                heard_text: str,
+                item_id: str | None = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.EndCall(_OutboundMessage):
+        id: str
+        mode: EndCallMode = EndCallMode.DRAIN
+        reason: str
+        ts: str
+        type: ClassVar[str] = end_call
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                reason: str,
+                mode: EndCallMode = ...
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    class azure.ai.agentserver.invocations.voice.EndCallMode(str, Enum, metaclass=CaseInsensitiveEnumMeta):
+        DRAIN = "drain"
+        IMMEDIATE = "immediate"
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.InputTextPart:
+        text: str
+        type: Literal["input_text"] = input_text
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(text: str) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseAccepted(_InboundMessage):
+        id: str
+        response_id: str
+        ts: str
+        type: ClassVar[str] = response.accepted
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                response_id: str
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseCancel(_OutboundMessage):
+        id: str
+        reason: Optional[str]
+        response_id: str
+        ts: str
+        type: ClassVar[str] = response.cancel
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                response_id: str,
+                reason: str | None = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseCancelled(_InboundMessage):
+        heard_text: str
+        id: str
+        item_id: Optional[str]
+        response_id: str
+        ts: str
+        type: ClassVar[str] = response.cancelled
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                response_id: str,
+                heard_text: str,
+                item_id: str | None = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseCreated(_OutboundMessage):
+        admission_timeout_ms: Optional[int]
+        id: str
+        in_reply_to: Optional[tuple[str, Ellipsis]]
+        response_id: str
+        supersede_key: Optional[str]
+        ts: str
+        type: ClassVar[str] = response.created
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                response_id: str,
+                in_reply_to: tuple = None,
+                admission_timeout_ms: int | None = None,
+                supersede_key: str | None = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseDone(_OutboundMessage):
+        id: str
+        response_id: str
+        ts: str
+        type: ClassVar[str] = response.done
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                response_id: str
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseDropped(_InboundMessage):
+        id: str
+        reason: str
+        response_id: str
+        ts: str
+        type: ClassVar[str] = response.dropped
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                response_id: str,
+                reason: str
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseNone(_OutboundMessage):
+        id: str
+        in_reply_to: tuple[str, Ellipsis]
+        reason: Optional[str]
+        ts: str
+        type: ClassVar[str] = response.none
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                in_reply_to: tuple,
+                reason: str | None = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseOutputTextDelta(_OutboundMessage):
+        delta: str
+        id: str
+        item_id: str
+        response_id: str
+        ts: str
+        type: ClassVar[str] = response.output_text.delta
+        voice: Optional[Mapping[str, Any]]
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                response_id: str,
+                item_id: str,
+                delta: str,
+                voice: Mapping = None
+            ) -> None: ...
+
+        def __post_init__(self) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseOutputTextDone(_OutboundMessage):
+        id: str
+        item_id: str
+        response_id: str
+        text: str
+        ts: str
+        type: ClassVar[str] = response.output_text.done
+        voice: Optional[Mapping[str, Any]]
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                response_id: str,
+                item_id: str,
+                text: str,
+                voice: Mapping = None
+            ) -> None: ...
+
+        def __post_init__(self) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseTimeout(_InboundMessage):
+        id: str
+        item_ids: Optional[tuple[str, Ellipsis]]
+        response_id: Optional[str]
+        stage: str
+        ts: str
+        type: ClassVar[str] = response.timeout
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                stage: str,
+                response_id: str | None = None,
+                item_ids: tuple = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.ResponseTimeouts:
+        first_output_ms: int
+        idle_ms: int
+        max_duration_ms: int
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                first_output_ms: int,
+                idle_ms: int,
+                max_duration_ms: int
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    class azure.ai.agentserver.invocations.voice.Session:
+
+        def __init__(self) -> None: ...
+
+        async def send(self, message: OutboundVoiceMessage) -> None: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.SessionDisconnected:
+        code: int
+        reason: Optional[str]
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(code: int, reason: str | None = None) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.SessionEnd(_InboundMessage):
+        id: str
+        reason: str
+        ts: str
+        type: ClassVar[str] = session.end
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                reason: str
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.SessionReady(_OutboundMessage):
+        id: str
+        ts: str
+        type: ClassVar[str] = session.ready
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(id: str = ..., ts: str = ...) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.SessionRejected(_OutboundMessage):
+        code: str
+        id: str
+        message: Optional[str]
+        retriable: bool
+        ts: str
+        type: ClassVar[str] = session.rejected
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str = ...,
+                ts: str = ...,
+                code: str,
+                retriable: bool,
+                message: str | None = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.SessionStart(_InboundMessage):
+        caller: Optional[Mapping[str, Any]]
+        greeting: Optional[str]
+        id: str
+        no_input_timeout_ms: Optional[int]
+        protocol_version: str
+        reconnect: bool
+        response_timeouts: ResponseTimeouts
+        ts: str
+        type: ClassVar[str] = session.start
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                protocol_version: str,
+                reconnect: bool,
+                response_timeouts: ResponseTimeouts,
+                greeting: str | None = None,
+                no_input_timeout_ms: int | None = None,
+                caller: Mapping = None
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.UserMessage(_InboundMessage):
+        content: tuple[InputTextPart, Ellipsis]
+        id: str
+        item_id: str
+        ts: str
+        type: ClassVar[str] = user.message
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                item_id: str,
+                content: tuple
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.UserNoInput(_InboundMessage):
+        count: int
+        id: str
+        item_id: str
+        ts: str
+        type: ClassVar[str] = user.no_input
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(
+                id: str,
+                ts: str,
+                item_id: str,
+                count: int
+            ) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    @dataclass(frozen=True, kw_only=True, repr=False)
+    class azure.ai.agentserver.invocations.voice.UserSpeechStarted(_InboundMessage):
+        id: str
+        ts: str
+        type: ClassVar[str] = user.speech_started
+
+        def __delattr__() -> None: ...
+
+        def __eq__() -> None: ...
+
+        def __hash__() -> None: ...
+
+        def __init__(id: str, ts: str) -> None: ...
+
+        def __setattr__() -> None: ...
+
+        def _voice_model_repr(self: Any) -> str: ...
+
+
+    @experimental
+    class azure.ai.agentserver.invocations.voice.VoiceAgentServerHost(InvocationAgentServerHost):
+        property routes: list[BaseRoute]    # Read-only
+        property ws_ping_interval: float    # Read-only
+
+        def __init__(
+                self,
+                *,
+                asyncapi_spec_json: dict[str, Any] | None = ...,
+                asyncapi_spec_yaml: str | None = ...,
+                openapi_spec: dict[str, Any] | None = ...,
+                **kwargs: Any
+            ) -> None: ...
+
+        def cancel_invocation_handler(self, fn: Callable[[Request], Awaitable[Response]]) -> Callable[[Request], Awaitable[Response]]: ...
+
+        def get_asyncapi_spec_json(self) -> Optional[dict[str, Any]]: ...
+
+        def get_asyncapi_spec_yaml(self) -> Optional[str]: ...
+
+        def get_invocation_handler(self, fn: Callable[[Request], Awaitable[Response]]) -> Callable[[Request], Awaitable[Response]]: ...
+
+        def get_openapi_spec(self) -> Optional[dict[str, Any]]: ...
+
+        def invoke_handler(self, fn: Callable[[Request], Awaitable[Response]]) -> Callable[[Request], Awaitable[Response]]: ...
+
+        def on_barge_in(self, callback: BargeInCallback) -> BargeInCallback: ...
+
+        def on_connection_terminating(self, callback: ConnectionTerminatingCallback) -> ConnectionTerminatingCallback: ...
+
+        def on_disconnect(self, callback: DisconnectCallback) -> DisconnectCallback: ...
+
+        def on_response_accepted(self, callback: ResponseAcceptedCallback) -> ResponseAcceptedCallback: ...
+
+        def on_response_cancelled(self, callback: ResponseCancelledCallback) -> ResponseCancelledCallback: ...
+
+        def on_response_dropped(self, callback: ResponseDroppedCallback) -> ResponseDroppedCallback: ...
+
+        def on_response_timeout(self, callback: ResponseTimeoutCallback) -> ResponseTimeoutCallback: ...
+
+        def on_session_end(self, callback: SessionEndCallback) -> SessionEndCallback: ...
+
+        def on_session_start(self, callback: SessionStartCallback) -> SessionStartCallback: ...
+
+        def on_user_message(self, callback: UserMessageCallback) -> UserMessageCallback: ...
+
+        def on_user_no_input(self, callback: UserNoInputCallback) -> UserNoInputCallback: ...
+
+        def on_user_speech_started(self, callback: UserSpeechStartedCallback) -> UserSpeechStartedCallback: ...
+
+        def ws_handler(self, fn: Any) -> NoReturn: ...
+
+
 ```
\ No newline at end of file
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/api.metadata.yml b/sdk/agentserver/azure-ai-agentserver-invocations/api.metadata.yml
index b3a77c616f75..1ec41090eb4d 100644
--- a/sdk/agentserver/azure-ai-agentserver-invocations/api.metadata.yml
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/api.metadata.yml
@@ -1,3 +1,3 @@
-apiMdSha256: 28f40971c3ed93df127abaf7faf714a62065ef4440aaf511b9269c584811520c
+apiMdSha256: 8c81198c94f9b6d95391cc58b11d3769ec0de8850d93a2c5e736046e82d25f63
 parserVersion: 0.3.31
 pythonVersion: 3.11.15
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/__init__.py b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/__init__.py
new file mode 100644
index 000000000000..ec9cfc7169b3
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/__init__.py
@@ -0,0 +1,98 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Typed Voice Live Bridge event relay over ``invocations_ws``."""
+
+from ._models import (
+    AgentError,
+    BargeIn,
+    EndCall,
+    EndCallMode,
+    InboundVoiceMessage,
+    InputTextPart,
+    OutboundVoiceMessage,
+    ResponseAccepted,
+    ResponseCancel,
+    ResponseCancelled,
+    ResponseCreated,
+    ResponseDone,
+    ResponseDropped,
+    ResponseNone,
+    ResponseOutputTextDelta,
+    ResponseOutputTextDone,
+    ResponseTimeout,
+    ResponseTimeouts,
+    SessionDisconnected,
+    SessionEnd,
+    SessionReady,
+    SessionRejected,
+    SessionStart,
+    UserMessage,
+    UserNoInput,
+    UserSpeechStarted,
+    new_item_id,
+    new_message_id,
+    new_response_id,
+)
+from ._session import Session
+from ._voice_host import (
+    BargeInCallback,
+    ConnectionTerminatingCallback,
+    DisconnectCallback,
+    ResponseAcceptedCallback,
+    ResponseCancelledCallback,
+    ResponseDroppedCallback,
+    ResponseTimeoutCallback,
+    SessionEndCallback,
+    SessionStartCallback,
+    UserMessageCallback,
+    UserNoInputCallback,
+    UserSpeechStartedCallback,
+    VoiceAgentServerHost,
+)
+
+__all__ = [
+    "AgentError",
+    "BargeIn",
+    "BargeInCallback",
+    "ConnectionTerminatingCallback",
+    "DisconnectCallback",
+    "EndCall",
+    "EndCallMode",
+    "InboundVoiceMessage",
+    "InputTextPart",
+    "OutboundVoiceMessage",
+    "ResponseAccepted",
+    "ResponseAcceptedCallback",
+    "ResponseCancel",
+    "ResponseCancelled",
+    "ResponseCancelledCallback",
+    "ResponseCreated",
+    "ResponseDone",
+    "ResponseDropped",
+    "ResponseDroppedCallback",
+    "ResponseNone",
+    "ResponseOutputTextDelta",
+    "ResponseOutputTextDone",
+    "ResponseTimeout",
+    "ResponseTimeoutCallback",
+    "ResponseTimeouts",
+    "Session",
+    "SessionDisconnected",
+    "SessionEnd",
+    "SessionEndCallback",
+    "SessionReady",
+    "SessionRejected",
+    "SessionStart",
+    "SessionStartCallback",
+    "UserMessage",
+    "UserMessageCallback",
+    "UserNoInput",
+    "UserNoInputCallback",
+    "UserSpeechStarted",
+    "UserSpeechStartedCallback",
+    "VoiceAgentServerHost",
+    "new_item_id",
+    "new_message_id",
+    "new_response_id",
+]
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_codec.py b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_codec.py
new file mode 100644
index 000000000000..067e54f17e36
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_codec.py
@@ -0,0 +1,731 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Context-free codec for the Voice Live Bridge text/control profile."""
+
+from __future__ import annotations
+
+import datetime
+import json
+import math
+import re
+from collections.abc import Mapping, Sequence
+from types import MappingProxyType
+from typing import Any, cast
+
+from azure.ai.agentserver.core import experimental
+
+from ._models import (
+    AgentError,
+    BargeIn,
+    EndCall,
+    EndCallMode,
+    InboundVoiceMessage,
+    InputTextPart,
+    OutboundVoiceMessage,
+    ResponseAccepted,
+    ResponseCancel,
+    ResponseCancelled,
+    ResponseCreated,
+    ResponseDone,
+    ResponseDropped,
+    ResponseNone,
+    ResponseOutputTextDelta,
+    ResponseOutputTextDone,
+    ResponseTimeout,
+    ResponseTimeouts,
+    SessionEnd,
+    SessionReady,
+    SessionRejected,
+    SessionStart,
+    UserMessage,
+    UserNoInput,
+    UserSpeechStarted,
+)
+
+MAX_FRAME_BYTES = 1_048_576
+MAX_IDENTIFIER_BYTES = 256
+MAX_INTEGER_DIGITS = 128
+MAX_JSON_DEPTH = 32
+MAX_JSON_NODES = 8_192
+MAX_ADMISSION_TIMEOUT_MS = 60_000
+
+_CREDENTIAL_FIELD = re.compile(
+    r"(?:^|_)(?:authorization(?:_header)?|credentials?|password|passwd|pwd|secret(?:_value)?|"
+    r"api_(?:key|token)|auth_token|bearer_token|access_(?:key|token)|refresh_token|id_token|"
+    r"client_(?:assertion|secret)|private_key|connection_string|sas(?:_token|_url)?|account_key|"
+    r"subscription_key|shared_access_(?:key|signature))(?:_|$)"
+)
+_COMPACT_CREDENTIAL_FIELDS = frozenset(
+    {
+        "accesskey",
+        "accesstoken",
+        "accountkey",
+        "apikey",
+        "apitoken",
+        "authorization",
+        "authorizationheader",
+        "authtoken",
+        "azurepwd",
+        "azuresas",
+        "bearertoken",
+        "clientassertion",
+        "clientsecret",
+        "connectionstring",
+        "credential",
+        "credentials",
+        "idtoken",
+        "password",
+        "passwd",
+        "privatekey",
+        "pwd",
+        "refreshtoken",
+        "sas",
+        "sastoken",
+        "sasurl",
+        "secret",
+        "secretvalue",
+        "sharedaccesskey",
+        "sharedaccesssignature",
+        "subscriptionkey",
+    }
+)
+_COMPACT_CREDENTIAL_SUFFIXES = _COMPACT_CREDENTIAL_FIELDS - {"azurepwd", "azuresas", "pwd", "sas"}
+_COMPACT_CREDENTIAL_MARKERS = _COMPACT_CREDENTIAL_SUFFIXES - {"secret"}
+_VOICE_TYPE_ALIASES = {"azure-platform": "azure-standard", "custom": "azure-custom"}
+_VOICE_TYPES = {
+    "openai",
+    "azure-standard",
+    "azure-custom",
+    "azure-personal",
+    "avatar-voice-sync",
+    "azure-realtime-native",
+}
+_VOICE_STRING_FIELDS = frozenset({"endpoint_id", "model", "name"})
+_VOICE_NON_EMPTY_STRING_FIELDS = frozenset({"endpoint_id", "name"})
+_VOICE_NULLABLE_STRING_FIELDS = frozenset(
+    {
+        "custom_lexicon_url",
+        "custom_text_normalization_url",
+        "locale",
+        "multi_talker_speaker_name",
+        "pitch",
+        "rate",
+        "style",
+        "volume",
+    }
+)
+_RFC3339 = re.compile(
+    r"^(?P<date>[0-9]{4}-[0-9]{2}-[0-9]{2})T(?P<time>(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9])"
+    r"(?:\.[0-9]{1,9})?(?:Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])$"
+)
+_KNOWN_UNSUPPORTED_INBOUND = {
+    "conversation.item.create",
+    "conversation.item.delete",
+    "dtmf",
+    "dtmf.collect.cancelled",
+    "dtmf.collect.rejected",
+    "handoff.failed",
+}
+_OUTBOUND_TYPES = {
+    "end_call",
+    "error",
+    "response.cancel",
+    "response.created",
+    "response.done",
+    "response.none",
+    "response.output_text.delta",
+    "response.output_text.done",
+    "session.ready",
+    "session.rejected",
+}
+
+
+@experimental
+class VoiceProtocolError(ValueError):
+    """Raised when one frame violates the selected Voice protocol profile.
+
+    :param message: Content-free diagnostic detail.
+    :param close_code: RFC 6455 close code for the violation.
+    """
+
+    def __init__(self, message: str, *, close_code: int = 1002) -> None:
+        super().__init__(message)
+        self.close_code = close_code
+
+
+@experimental
+class VoiceUnsupportedMessageError(VoiceProtocolError):
+    """Raised for a known Protocol 1.0 family excluded from this profile."""
+
+    def __init__(self, message: str) -> None:
+        super().__init__(message, close_code=1003)
+
+
+def decode_inbound_message(frame: str) -> InboundVoiceMessage | None:  # pylint: disable=too-many-return-statements
+    """Decode one Bridge-to-agent text frame.
+
+    Unknown future message types return ``None`` for forward compatibility.
+    The function retains no ID, payload, or cross-message state.
+
+    :param frame: One WebSocket text frame.
+    :type frame: str
+    :return: An immutable selected message, or ``None`` for an unknown type.
+    :rtype: InboundVoiceMessage or None
+    :raises VoiceProtocolError: If the frame is malformed or violates the selected profile.
+    """
+    payload = _decode_json_object(frame)
+    message_type = _required_string(payload, "type", non_empty=True)
+    message_id = _identifier(payload, "id")
+    timestamp = _timestamp(payload.get("ts"))
+
+    if message_type in _KNOWN_UNSUPPORTED_INBOUND:
+        raise VoiceUnsupportedMessageError("Voice message type is not supported by this profile")
+    if message_type in _OUTBOUND_TYPES:
+        raise VoiceProtocolError("Agent-to-Bridge message received in the inbound direction")
+
+    common = {"id": message_id, "ts": timestamp}
+    if message_type == "session.start":
+        return _parse_session_start(payload, common)
+    if message_type == "user.message":
+        return _parse_user_message(payload, common)
+    if message_type == "user.no_input":
+        return UserNoInput(
+            **common,
+            item_id=_prefixed_identifier(payload, "item_id", "in_"),
+            count=_positive_integer(payload, "count"),
+        )
+    if message_type == "user.speech_started":
+        return UserSpeechStarted(**common)
+    if message_type == "barge_in":
+        return BargeIn(
+            **common,
+            response_id=_prefixed_identifier(payload, "response_id", "r_"),
+            item_id=_optional_prefixed_identifier(payload, "item_id", "it_"),
+            heard_text=_required_string(payload, "heard_text"),
+        )
+    if message_type == "response.accepted":
+        return ResponseAccepted(
+            **common,
+            response_id=_prefixed_identifier(payload, "response_id", "r_"),
+        )
+    if message_type == "response.dropped":
+        return ResponseDropped(
+            **common,
+            response_id=_prefixed_identifier(payload, "response_id", "r_"),
+            reason=_required_string(payload, "reason", non_empty=True),
+        )
+    if message_type == "response.cancelled":
+        return ResponseCancelled(
+            **common,
+            response_id=_prefixed_identifier(payload, "response_id", "r_"),
+            item_id=_optional_prefixed_identifier(payload, "item_id", "it_"),
+            heard_text=_required_string(payload, "heard_text"),
+        )
+    if message_type == "response.timeout":
+        return _parse_response_timeout(payload, common)
+    if message_type == "session.end":
+        return SessionEnd(
+            **common,
+            reason=_required_string(payload, "reason", non_empty=True),
+        )
+    return None
+
+
+def encode_outbound_message(message: OutboundVoiceMessage) -> str:
+    """Validate and encode one agent-to-Bridge message.
+
+    :param message: Immutable selected outbound message.
+    :type message: OutboundVoiceMessage
+    :return: One compact JSON text frame.
+    :rtype: str
+    :raises TypeError: If *message* is not a selected outbound model.
+    :raises ValueError: If one field is invalid or the encoded frame is too large.
+    """
+    if not isinstance(
+        message,
+        (
+            SessionReady,
+            SessionRejected,
+            ResponseCreated,
+            ResponseNone,
+            ResponseOutputTextDelta,
+            ResponseOutputTextDone,
+            ResponseDone,
+            ResponseCancel,
+            EndCall,
+            AgentError,
+        ),
+    ):
+        raise TypeError("message must be a selected outbound Voice message")
+
+    payload: dict[str, Any] = {
+        "type": message.type,
+        "id": _validate_identifier_value(message.id, "id"),
+        "ts": _timestamp(message.ts),
+    }
+    if isinstance(message, SessionRejected):
+        payload.update(
+            code=_validate_string_value(message.code, "code", non_empty=True),
+            retriable=_validate_boolean_value(message.retriable, "retriable"),
+        )
+        _put_optional_string(payload, "message", message.message)
+    elif isinstance(message, ResponseCreated):
+        payload["response_id"] = _validate_prefixed_identifier_value(message.response_id, "response_id", "r_")
+        if message.in_reply_to is not None:
+            payload["in_reply_to"] = _validate_input_prefix(message.in_reply_to)
+            if message.admission_timeout_ms is not None or message.supersede_key is not None:
+                raise ValueError("reply response.created cannot contain proactive admission controls")
+        else:
+            if message.admission_timeout_ms is not None:
+                payload["admission_timeout_ms"] = _validate_admission_timeout_ms(message.admission_timeout_ms)
+            _put_optional_string(payload, "supersede_key", message.supersede_key, non_empty=True)
+    elif isinstance(message, ResponseNone):
+        payload["in_reply_to"] = _validate_input_prefix(message.in_reply_to)
+        _put_optional_string(payload, "reason", message.reason)
+    elif isinstance(message, ResponseOutputTextDelta):
+        payload.update(
+            response_id=_validate_prefixed_identifier_value(message.response_id, "response_id", "r_"),
+            item_id=_validate_prefixed_identifier_value(message.item_id, "item_id", "it_"),
+            delta=_validate_string_value(message.delta, "delta", non_empty=True),
+        )
+        _put_optional_voice(payload, message.voice)
+    elif isinstance(message, ResponseOutputTextDone):
+        payload.update(
+            response_id=_validate_prefixed_identifier_value(message.response_id, "response_id", "r_"),
+            item_id=_validate_prefixed_identifier_value(message.item_id, "item_id", "it_"),
+            text=_validate_string_value(message.text, "text"),
+        )
+        _put_optional_voice(payload, message.voice)
+    elif isinstance(message, ResponseDone):
+        payload["response_id"] = _validate_prefixed_identifier_value(message.response_id, "response_id", "r_")
+    elif isinstance(message, ResponseCancel):
+        payload["response_id"] = _validate_prefixed_identifier_value(message.response_id, "response_id", "r_")
+        _put_optional_string(payload, "reason", message.reason)
+    elif isinstance(message, EndCall):
+        if not isinstance(message.mode, EndCallMode):
+            raise TypeError("mode must be an EndCallMode")
+        payload.update(
+            reason=_validate_string_value(message.reason, "reason", non_empty=True),
+            mode=message.mode.value,
+        )
+    elif isinstance(message, AgentError):
+        payload.update(
+            code=_validate_string_value(message.code, "code", non_empty=True),
+            message=_validate_string_value(message.message, "message"),
+        )
+        if message.response_id is not None:
+            payload["response_id"] = _validate_prefixed_identifier_value(
+                message.response_id,
+                "response_id",
+                "r_",
+            )
+        if message.item_id is not None:
+            if message.response_id is None:
+                raise ValueError("item_id requires response_id")
+            payload["item_id"] = _validate_prefixed_identifier_value(message.item_id, "item_id", "it_")
+
+    try:
+        frame = json.dumps(payload, separators=(",", ":"), ensure_ascii=False, allow_nan=False)
+        encoded_size = len(frame.encode("utf-8"))
+    except (TypeError, ValueError, UnicodeEncodeError) as exc:
+        raise ValueError("Voice message contains a value that cannot be encoded") from exc
+    if encoded_size > MAX_FRAME_BYTES:
+        raise ValueError("Voice message exceeds the maximum encoded frame size")
+    return frame
+
+
+def _parse_session_start(payload: Mapping[str, Any], common: Mapping[str, str]) -> SessionStart:
+    timeout_payload = _required_mapping(payload, "response_timeouts")
+    reconnect = payload.get("reconnect")
+    if not isinstance(reconnect, bool):
+        raise VoiceProtocolError("session.start reconnect must be a boolean")
+    if reconnect and "greeting" in payload:
+        raise VoiceProtocolError("session.start greeting must be absent on reconnect")
+    greeting = _optional_string(payload, "greeting")
+    no_input_timeout_ms = (
+        _positive_integer(payload, "no_input_timeout_ms") if "no_input_timeout_ms" in payload else None
+    )
+    caller = None
+    if "caller" in payload:
+        caller_payload = _required_mapping(payload, "caller")
+        _reject_caller_credentials(caller_payload)
+        caller = cast(Mapping[str, Any], _freeze_json(caller_payload))
+    return SessionStart(
+        **common,
+        protocol_version=_required_string(payload, "protocol_version", non_empty=True),
+        reconnect=reconnect,
+        response_timeouts=ResponseTimeouts(
+            first_output_ms=_positive_integer(timeout_payload, "first_output_ms"),
+            idle_ms=_positive_integer(timeout_payload, "idle_ms"),
+            max_duration_ms=_positive_integer(timeout_payload, "max_duration_ms"),
+        ),
+        greeting=greeting,
+        no_input_timeout_ms=no_input_timeout_ms,
+        caller=caller,
+    )
+
+
+def _parse_user_message(payload: Mapping[str, Any], common: Mapping[str, str]) -> UserMessage | None:
+    raw_content = payload.get("content")
+    if not isinstance(raw_content, list) or not raw_content:
+        raise VoiceProtocolError("user.message content must be a non-empty array")
+    content: list[InputTextPart] = []
+    for raw_part in raw_content:
+        if not isinstance(raw_part, dict):
+            raise VoiceProtocolError("user.message content parts must be objects")
+        part_type = raw_part.get("type")
+        if part_type == "input_text":
+            content.append(InputTextPart(text=_required_string(raw_part, "text")))
+        elif part_type == "input_image":
+            raise VoiceUnsupportedMessageError("Image content is not supported by this profile")
+        elif not isinstance(part_type, str):
+            raise VoiceProtocolError("user.message content part type must be a string")
+    if not content:
+        return None
+    return UserMessage(
+        **common,
+        item_id=_prefixed_identifier(payload, "item_id", "in_"),
+        content=tuple(content),
+    )
+
+
+def _parse_response_timeout(payload: Mapping[str, Any], common: Mapping[str, str]) -> ResponseTimeout:
+    has_response_id = "response_id" in payload
+    has_item_ids = "item_ids" in payload
+    if has_response_id == has_item_ids:
+        raise VoiceProtocolError("response.timeout requires exactly one target")
+    if has_response_id:
+        response_id = _prefixed_identifier(payload, "response_id", "r_")
+        item_ids = None
+    else:
+        raw_item_ids = payload.get("item_ids")
+        if not isinstance(raw_item_ids, list) or not raw_item_ids:
+            raise VoiceProtocolError("response.timeout item_ids must be a non-empty array")
+        try:
+            item_ids = tuple(_validate_prefixed_identifier_value(item, "item_ids", "in_") for item in raw_item_ids)
+        except (TypeError, ValueError) as exc:
+            raise VoiceProtocolError(str(exc)) from exc
+        if len(set(item_ids)) != len(item_ids):
+            raise VoiceProtocolError("response.timeout item_ids must be unique")
+        response_id = None
+    return ResponseTimeout(
+        **common,
+        stage=_required_string(payload, "stage", non_empty=True),
+        response_id=response_id,
+        item_ids=item_ids,
+    )
+
+
+def _decode_json_object(frame: str) -> dict[str, Any]:
+    if not isinstance(frame, str):
+        raise TypeError("frame must be text")
+    try:
+        encoded_size = len(frame.encode("utf-8"))
+    except UnicodeEncodeError as exc:
+        raise VoiceProtocolError("Voice frame contains invalid Unicode") from exc
+    if encoded_size > MAX_FRAME_BYTES:
+        raise VoiceProtocolError("Voice frame exceeds the maximum size", close_code=1009)
+    try:
+        value = json.loads(
+            frame,
+            object_pairs_hook=_object_without_duplicate_keys,
+            parse_constant=_reject_json_constant,
+            parse_int=_parse_integer,
+        )
+    except (json.JSONDecodeError, RecursionError, ValueError) as exc:
+        raise VoiceProtocolError("Voice frame is not valid JSON") from exc
+    if not isinstance(value, dict):
+        raise VoiceProtocolError("Voice frame must be a JSON object")
+    _validate_json_tree(value)
+    return cast(dict[str, Any], value)
+
+
+def _object_without_duplicate_keys(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    value: dict[str, Any] = {}
+    for key, item in pairs:
+        if key in value:
+            raise ValueError("duplicate JSON object key")
+        value[key] = item
+    return value
+
+
+def _reject_json_constant(value: str) -> Any:
+    raise ValueError(f"non-standard JSON constant: {value}")
+
+
+def _parse_integer(value: str) -> int:
+    digits = value[1:] if value.startswith("-") else value
+    if len(digits) > MAX_INTEGER_DIGITS:
+        raise ValueError("JSON integer exceeds the maximum digit count")
+    return int(value)
+
+
+def _validate_json_tree(value: Any) -> None:
+    pending: list[tuple[Any, int]] = [(value, 1)]
+    nodes = 0
+    while pending:
+        current, depth = pending.pop()
+        nodes += 1
+        if nodes > MAX_JSON_NODES:
+            raise VoiceProtocolError("Voice frame exceeds the maximum JSON node count")
+        if depth > MAX_JSON_DEPTH:
+            raise VoiceProtocolError("Voice frame exceeds the maximum JSON depth")
+        if isinstance(current, str):
+            try:
+                current.encode("utf-8")
+            except UnicodeEncodeError as exc:
+                raise VoiceProtocolError("Voice frame contains invalid Unicode") from exc
+        elif isinstance(current, float):
+            if not math.isfinite(current):
+                raise VoiceProtocolError("Voice frame contains a non-finite number")
+        elif isinstance(current, dict):
+            for key in current:
+                try:
+                    key.encode("utf-8")
+                except UnicodeEncodeError as exc:
+                    raise VoiceProtocolError("Voice frame contains invalid Unicode") from exc
+            pending.extend((item, depth + 1) for item in current.values())
+        elif isinstance(current, list):
+            pending.extend((item, depth + 1) for item in current)
+        elif current is not None and not isinstance(current, (bool, int)):
+            raise VoiceProtocolError("Voice frame contains an unsupported JSON value")
+
+
+def _timestamp(value: Any) -> str:
+    if not isinstance(value, str):
+        raise VoiceProtocolError("ts must be a string")
+    match = _RFC3339.fullmatch(value)
+    if match is None:
+        raise VoiceProtocolError("ts must match the RFC 3339 profile")
+    try:
+        datetime.datetime.strptime(
+            f"{match.group('date')}T{match.group('time')}",
+            "%Y-%m-%dT%H:%M:%S",
+        )
+    except ValueError as exc:
+        raise VoiceProtocolError("ts must contain a valid calendar timestamp") from exc
+    return value
+
+
+def _required_mapping(payload: Mapping[str, Any], name: str) -> Mapping[str, Any]:
+    value = payload.get(name)
+    if not isinstance(value, dict):
+        raise VoiceProtocolError(f"{name} must be an object")
+    return value
+
+
+def _required_string(payload: Mapping[str, Any], name: str, *, non_empty: bool = False) -> str:
+    try:
+        value = payload[name]
+    except KeyError as exc:
+        raise VoiceProtocolError(f"{name} is required") from exc
+    try:
+        return _validate_string_value(value, name, non_empty=non_empty)
+    except (TypeError, ValueError) as exc:
+        raise VoiceProtocolError(str(exc)) from exc
+
+
+def _optional_string(payload: Mapping[str, Any], name: str) -> str | None:
+    if name not in payload:
+        return None
+    return _required_string(payload, name)
+
+
+def _positive_integer(payload: Mapping[str, Any], name: str) -> int:
+    try:
+        value = payload[name]
+    except KeyError as exc:
+        raise VoiceProtocolError(f"{name} is required") from exc
+    try:
+        return _validate_positive_integer_value(value, name)
+    except (TypeError, ValueError) as exc:
+        raise VoiceProtocolError(str(exc)) from exc
+
+
+def _identifier(payload: Mapping[str, Any], name: str) -> str:
+    value = _required_string(payload, name, non_empty=True)
+    try:
+        return _validate_identifier_value(value, name)
+    except (TypeError, ValueError) as exc:
+        raise VoiceProtocolError(str(exc)) from exc
+
+
+def _prefixed_identifier(payload: Mapping[str, Any], name: str, prefix: str) -> str:
+    value = _identifier(payload, name)
+    if not value.startswith(prefix) or len(value) == len(prefix):
+        raise VoiceProtocolError(f"{name} must start with {prefix}")
+    return value
+
+
+def _optional_prefixed_identifier(payload: Mapping[str, Any], name: str, prefix: str) -> str | None:
+    if name not in payload:
+        return None
+    return _prefixed_identifier(payload, name, prefix)
+
+
+def _validate_string_value(value: Any, name: str, *, non_empty: bool = False) -> str:
+    if not isinstance(value, str):
+        raise TypeError(f"{name} must be a string")
+    if non_empty and not value:
+        raise ValueError(f"{name} must be non-empty")
+    try:
+        value.encode("utf-8")
+    except UnicodeEncodeError as exc:
+        raise ValueError(f"{name} contains invalid Unicode") from exc
+    return value
+
+
+def _validate_boolean_value(value: Any, name: str) -> bool:
+    if not isinstance(value, bool):
+        raise TypeError(f"{name} must be a boolean")
+    return value
+
+
+def _validate_positive_integer_value(value: Any, name: str) -> int:
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise TypeError(f"{name} must be an integer")
+    if value <= 0:
+        raise ValueError(f"{name} must be positive")
+    return value
+
+
+def _validate_admission_timeout_ms(value: Any) -> int:
+    timeout = _validate_positive_integer_value(value, "admission_timeout_ms")
+    if timeout > MAX_ADMISSION_TIMEOUT_MS:
+        raise ValueError("admission_timeout_ms must be at most 60000")
+    return timeout
+
+
+def _validate_identifier_value(value: Any, name: str) -> str:
+    identifier = _validate_string_value(value, name, non_empty=True)
+    if len(identifier.encode("utf-8")) > MAX_IDENTIFIER_BYTES:
+        raise ValueError(f"{name} exceeds the maximum identifier size")
+    return identifier
+
+
+def _validate_prefixed_identifier_value(value: Any, name: str, prefix: str) -> str:
+    identifier = _validate_identifier_value(value, name)
+    if not identifier.startswith(prefix) or len(identifier) == len(prefix):
+        raise ValueError(f"{name} must start with {prefix}")
+    return identifier
+
+
+def _validate_input_prefix(value: Any) -> list[str]:
+    if not isinstance(value, tuple) or not value:
+        raise ValueError("in_reply_to must be a non-empty tuple")
+    validated = [_validate_prefixed_identifier_value(item, "in_reply_to", "in_") for item in value]
+    if len(set(validated)) != len(validated):
+        raise ValueError("in_reply_to must contain unique identifiers")
+    return validated
+
+
+def _put_optional_string(
+    payload: dict[str, Any],
+    name: str,
+    value: str | None,
+    *,
+    non_empty: bool = False,
+) -> None:
+    if value is not None:
+        payload[name] = _validate_string_value(value, name, non_empty=non_empty)
+
+
+def _put_optional_voice(payload: dict[str, Any], value: Mapping[str, Any] | None) -> None:
+    normalized = _normalize_voice(value)
+    if normalized is not None:
+        payload["voice"] = normalized
+
+
+def _normalize_voice(value: Mapping[str, Any] | None) -> dict[str, Any] | None:
+    """Validate and materialize an optional Voice Live voice merge patch.
+
+    :param value: Optional immutable or mutable voice merge patch.
+    :type value: Mapping[str, Any] or None
+    """
+    if value is None:
+        return None
+    if not isinstance(value, Mapping) or not value:
+        raise TypeError("voice must be a non-empty mapping")
+    materialized = cast(dict[str, Any], _thaw_json(value))
+    _validate_json_tree(materialized)
+    if "type" in materialized:
+        voice_type = materialized["type"]
+        if not isinstance(voice_type, str):
+            raise TypeError("voice.type must be a string")
+        voice_type = _VOICE_TYPE_ALIASES.get(voice_type, voice_type)
+        if voice_type not in _VOICE_TYPES:
+            raise ValueError("voice.type is not a supported Voice Live variant")
+        materialized["type"] = voice_type
+
+    for field_name in _VOICE_STRING_FIELDS:
+        if field_name in materialized:
+            _validate_string_value(
+                materialized[field_name],
+                f"voice.{field_name}",
+                non_empty=field_name in _VOICE_NON_EMPTY_STRING_FIELDS,
+            )
+
+    for field_name in _VOICE_NULLABLE_STRING_FIELDS:
+        field_value = materialized.get(field_name)
+        if field_value is not None:
+            if not isinstance(field_value, str):
+                raise TypeError(f"voice.{field_name} must be a string or null")
+            _validate_string_value(field_value, f"voice.{field_name}")
+
+    temperature = materialized.get("temperature")
+    if temperature is not None:
+        if isinstance(temperature, bool) or not isinstance(temperature, (int, float)):
+            raise TypeError("voice.temperature must be a number or null")
+        if not 0.0 <= temperature <= 1.0:
+            raise ValueError("voice.temperature must be between 0.0 and 1.0")
+
+    prefer_locales = materialized.get("prefer_locales")
+    if prefer_locales is not None:
+        if not isinstance(prefer_locales, list) or any(not isinstance(locale, str) for locale in prefer_locales):
+            raise TypeError("voice.prefer_locales must be an array of strings or null")
+        for locale in prefer_locales:
+            _validate_string_value(locale, "voice.prefer_locales")
+    return materialized
+
+
+def _normalize_field_name(value: Any) -> str:
+    key_text = re.sub(r"([A-Z]+)([A-Z][a-z])", r"\1_\2", str(value))
+    key_text = re.sub(r"(?<=[a-z0-9])(?=[A-Z])", "_", key_text).casefold()
+    return re.sub(r"[^a-z0-9]+", "_", key_text).strip("_")
+
+
+def _reject_caller_credentials(value: Mapping[str, Any]) -> None:
+    pending: list[Any] = [value]
+    while pending:
+        current = pending.pop()
+        if isinstance(current, Mapping):
+            for key, item in current.items():
+                normalized_key = _normalize_field_name(key)
+                compact_key = normalized_key.replace("_", "")
+                if (
+                    _CREDENTIAL_FIELD.search(normalized_key)
+                    or compact_key in _COMPACT_CREDENTIAL_FIELDS
+                    or any(compact_key.endswith(suffix) for suffix in _COMPACT_CREDENTIAL_SUFFIXES)
+                    or any(marker in compact_key for marker in _COMPACT_CREDENTIAL_MARKERS)
+                ):
+                    raise VoiceProtocolError("session.start caller must not contain credentials")
+                pending.append(item)
+        elif isinstance(current, Sequence) and not isinstance(current, (str, bytes, bytearray)):
+            pending.extend(current)
+
+
+def _freeze_json(value: Any) -> Any:
+    if isinstance(value, dict):
+        return MappingProxyType({str(key): _freeze_json(item) for key, item in value.items()})
+    if isinstance(value, list):
+        return tuple(_freeze_json(item) for item in value)
+    return value
+
+
+def _thaw_json(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return {str(key): _thaw_json(item) for key, item in value.items()}
+    if isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
+        return [_thaw_json(item) for item in value]
+    return value
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_models.py b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_models.py
new file mode 100644
index 000000000000..772f77464482
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_models.py
@@ -0,0 +1,750 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Immutable messages for the Voice Live Bridge text/control profile."""
+
+from __future__ import annotations
+
+import datetime
+import math
+import reprlib
+import uuid
+from collections.abc import Mapping, Sequence
+from dataclasses import MISSING, dataclass, field, fields
+from enum import Enum
+from types import MappingProxyType
+from typing import Any, ClassVar, Literal
+
+from azure.core import CaseInsensitiveEnumMeta
+
+from azure.ai.agentserver.core import experimental
+
+
+@experimental
+def new_message_id() -> str:
+    """Create one stateless Bridge message identifier.
+
+    :return: A new ``m_`` identifier.
+    :rtype: str
+    """
+    return f"m_{uuid.uuid4().hex}"
+
+
+@experimental
+def new_response_id() -> str:
+    """Create one stateless agent response identifier.
+
+    :return: A new ``r_`` identifier.
+    :rtype: str
+    """
+    return f"r_{uuid.uuid4().hex}"
+
+
+@experimental
+def new_item_id() -> str:
+    """Create one stateless agent output-item identifier.
+
+    :return: A new ``it_`` identifier.
+    :rtype: str
+    """
+    return f"it_{uuid.uuid4().hex}"
+
+
+def new_timestamp() -> str:
+    """Create one UTC RFC 3339 timestamp with millisecond precision.
+
+    :return: The current UTC timestamp.
+    :rtype: str
+    """
+    return datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+
+
+_MAX_MODEL_REPR_LENGTH = 1024
+_REDACTED_REPR = "<redacted>"
+_SAFE_REPR_FIELDS = frozenset(
+    {
+        "admission_timeout_ms",
+        "code",
+        "count",
+        "first_output_ms",
+        "id",
+        "idle_ms",
+        "in_reply_to",
+        "item_id",
+        "item_ids",
+        "max_duration_ms",
+        "mode",
+        "no_input_timeout_ms",
+        "protocol_version",
+        "reconnect",
+        "response_id",
+        "response_timeouts",
+        "retriable",
+        "stage",
+        "ts",
+        "type",
+    }
+)
+_MODEL_REPR = reprlib.Repr()
+_MODEL_REPR.maxstring = 128
+_MODEL_REPR.maxother = 128
+
+
+def _voice_model_repr(self: Any) -> str:
+    """Return a bounded representation that redacts payload fields by default.
+
+    :return: The safe representation of the Voice model.
+    :rtype: str
+    """
+    values = []
+    for model_field in fields(self):
+        value = getattr(self, model_field.name)
+        if model_field.name not in _SAFE_REPR_FIELDS and value is not None:
+            value_repr = _REDACTED_REPR
+        else:
+            value_repr = _MODEL_REPR.repr(value)
+        values.append(f"{model_field.name}={value_repr}")
+
+    rendered = f"{type(self).__name__}({', '.join(values)})"
+    if len(rendered) <= _MAX_MODEL_REPR_LENGTH:
+        return rendered
+    return f"{rendered[:_MAX_MODEL_REPR_LENGTH - 4]}...)"
+
+
+def _freeze_json(value: Any, name: str, *, require_finite_numbers: bool = False) -> Any:
+    if isinstance(value, Mapping):
+        if any(not isinstance(key, str) for key in value):
+            raise TypeError(f"{name} keys must be strings")
+        return MappingProxyType(
+            {
+                key: _freeze_json(item, name, require_finite_numbers=require_finite_numbers)
+                for key, item in value.items()
+            }
+        )
+    if isinstance(value, Sequence) and not isinstance(value, (str, bytes, bytearray)):
+        return tuple(_freeze_json(item, name, require_finite_numbers=require_finite_numbers) for item in value)
+    if require_finite_numbers and isinstance(value, float) and not math.isfinite(value):
+        raise TypeError(f"{name} must contain only finite numbers")
+    if value is None or isinstance(value, (str, bool, int, float)):
+        return value
+    raise TypeError(f"{name} must contain only JSON-compatible values")
+
+
+def _document_dataclass_defaults(*model_types: type[Any]) -> None:
+    """Attach accurate defaults to generated dataclass constructor docs.
+
+    :param model_types: Voice dataclass types whose generated constructors need documentation.
+    :type model_types: type
+    """
+    for model_type in model_types:
+        default_lines = []
+        for model_field in fields(model_type):
+            if not model_field.init:
+                continue
+            if model_field.default_factory is not MISSING:
+                default_value = "..."
+            elif model_field.default is MISSING:
+                continue
+            elif model_field.default is None:
+                default_value = "None"
+            else:
+                default_value = "..."
+            default_lines.append(f":param {model_field.name}: Default value is {default_value}.")
+        if default_lines:
+            model_type.__init__.__doc__ = "\n".join(default_lines) + "\n\n"
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseTimeouts:
+    """Response deadlines selected by the Bridge.
+
+    :ivar first_output_ms: Maximum milliseconds until first output.
+    :vartype first_output_ms: int
+    :ivar idle_ms: Maximum milliseconds between output progress messages.
+    :vartype idle_ms: int
+    :ivar max_duration_ms: Absolute maximum response duration in milliseconds.
+    :vartype max_duration_ms: int
+    """
+
+    first_output_ms: int
+    idle_ms: int
+    max_duration_ms: int
+    __repr__ = _voice_model_repr
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class InputTextPart:
+    """One text part from an ordered ``user.message``.
+
+    :ivar text: Final recognized or application-supplied text.
+    :vartype text: str
+    :ivar type: Content-part discriminator. Always ``"input_text"``.
+    :vartype type: str
+    """
+
+    text: str
+    type: Literal["input_text"] = field(default="input_text", init=False)
+    __repr__ = _voice_model_repr
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class SessionDisconnected:
+    """Local transport-disconnect event.
+
+    This event is not a Bridge wire message. It lets application code release
+    connection-scoped work after the peer or proxy closes the WebSocket.
+
+    :ivar code: RFC 6455 close code reported by the transport.
+    :vartype code: int
+    :ivar reason: Optional close reason reported by the transport.
+    :vartype reason: str or None
+    """
+
+    code: int
+    reason: str | None = None
+    __repr__ = _voice_model_repr
+
+
+@dataclass(frozen=True, kw_only=True, repr=False)
+class _InboundMessage:
+    """Common fields received from the Bridge."""
+
+    id: str
+    ts: str
+    type: ClassVar[str]
+    __repr__ = _voice_model_repr
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class SessionStart(_InboundMessage):
+    """Bridge application-start event.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar protocol_version: Exact Bridge protocol version.
+    :vartype protocol_version: str
+    :ivar reconnect: Whether this transport reattaches the logical session.
+    :vartype reconnect: bool
+    :ivar response_timeouts: Effective response deadlines.
+    :vartype response_timeouts: ResponseTimeouts
+    :ivar greeting: Optional Bridge-owned greeting.
+    :vartype greeting: str or None
+    :ivar no_input_timeout_ms: Optional user-silence threshold.
+    :vartype no_input_timeout_ms: int or None
+    :ivar caller: Optional immutable caller context.
+    :vartype caller: Mapping[str, Any] or None
+    """
+
+    type: ClassVar[str] = "session.start"
+    protocol_version: str
+    reconnect: bool
+    response_timeouts: ResponseTimeouts
+    greeting: str | None = None
+    no_input_timeout_ms: int | None = None
+    caller: Mapping[str, Any] | None = None
+
+    def __init__(
+        self,
+        *,
+        id: str,
+        ts: str,
+        protocol_version: str,
+        reconnect: bool,
+        response_timeouts: ResponseTimeouts,
+        greeting: str | None = None,
+        no_input_timeout_ms: int | None = None,
+        caller: Mapping[str, Any] | None = None,
+    ) -> None:
+        if caller is not None:
+            if not isinstance(caller, Mapping):
+                raise TypeError("caller must be a mapping")
+            caller = _freeze_json(caller, "caller", require_finite_numbers=True)
+        _InboundMessage.__init__(self, id=id, ts=ts)
+        object.__setattr__(self, "protocol_version", protocol_version)
+        object.__setattr__(self, "reconnect", reconnect)
+        object.__setattr__(self, "response_timeouts", response_timeouts)
+        object.__setattr__(self, "greeting", greeting)
+        object.__setattr__(self, "no_input_timeout_ms", no_input_timeout_ms)
+        object.__setattr__(self, "caller", caller)
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class UserMessage(_InboundMessage):
+    """Completed user text turn.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar item_id: Bridge-allocated input item identifier.
+    :vartype item_id: str
+    :ivar content: Supported text parts in wire order.
+    :vartype content: tuple[InputTextPart, ...]
+    """
+
+    type: ClassVar[str] = "user.message"
+    item_id: str
+    content: tuple[InputTextPart, ...]
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class UserNoInput(_InboundMessage):
+    """Bridge-generated user-silence turn.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar item_id: Bridge-allocated input item identifier.
+    :vartype item_id: str
+    :ivar count: Consecutive no-input count.
+    :vartype count: int
+    """
+
+    type: ClassVar[str] = "user.no_input"
+    item_id: str
+    count: int
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class UserSpeechStarted(_InboundMessage):
+    """Advisory signal that caller speech began while no response was open.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    """
+
+    type: ClassVar[str] = "user.speech_started"
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class BargeIn(_InboundMessage):
+    """Caller interruption and playback snapshot.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Interrupted response identifier.
+    :vartype response_id: str
+    :ivar heard_text: Text played before the interruption.
+    :vartype heard_text: str
+    :ivar item_id: Output item playing at the interruption, if any.
+    :vartype item_id: str or None
+    """
+
+    type: ClassVar[str] = "barge_in"
+    response_id: str
+    heard_text: str
+    item_id: str | None = None
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseAccepted(_InboundMessage):
+    """Bridge acceptance of a proactive response admission request.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Accepted proactive response identifier.
+    :vartype response_id: str
+    """
+
+    type: ClassVar[str] = "response.accepted"
+    response_id: str
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseDropped(_InboundMessage):
+    """Bridge rejection or expiry of a proactive response request.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Dropped proactive response identifier.
+    :vartype response_id: str
+    :ivar reason: Open-enum drop reason supplied by the Bridge.
+    :vartype reason: str
+    """
+
+    type: ClassVar[str] = "response.dropped"
+    response_id: str
+    reason: str
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseCancelled(_InboundMessage):
+    """Winning self-cancel playback outcome from the Bridge.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Cancelled response identifier.
+    :vartype response_id: str
+    :ivar heard_text: Text played before cancellation completed.
+    :vartype heard_text: str
+    :ivar item_id: Output item playing at cancellation, if any.
+    :vartype item_id: str or None
+    """
+
+    type: ClassVar[str] = "response.cancelled"
+    response_id: str
+    heard_text: str
+    item_id: str | None = None
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseTimeout(_InboundMessage):
+    """Bridge response or pending-input timeout event.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar stage: Open-enum timeout stage.
+    :vartype stage: str
+    :ivar response_id: Timed-out response identifier, when a response was open.
+    :vartype response_id: str or None
+    :ivar item_ids: Timed-out input identifiers before response creation.
+    :vartype item_ids: tuple[str, ...] or None
+    """
+
+    type: ClassVar[str] = "response.timeout"
+    stage: str
+    response_id: str | None = None
+    item_ids: tuple[str, ...] | None = None
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class SessionEnd(_InboundMessage):
+    """Bridge-initiated session termination event.
+
+    :ivar id: Wire message identifier.
+    :vartype id: str
+    :ivar ts: Sender timestamp.
+    :vartype ts: str
+    :ivar reason: Open-enum session termination reason.
+    :vartype reason: str
+    """
+
+    type: ClassVar[str] = "session.end"
+    reason: str
+
+
+InboundVoiceMessage = (
+    SessionStart
+    | UserMessage
+    | UserNoInput
+    | UserSpeechStarted
+    | BargeIn
+    | ResponseAccepted
+    | ResponseDropped
+    | ResponseCancelled
+    | ResponseTimeout
+    | SessionEnd
+)
+
+
+@dataclass(frozen=True, kw_only=True, repr=False)
+class _OutboundMessage:
+    """Common fields generated independently for each outbound message."""
+
+    id: str = field(default_factory=new_message_id)
+    ts: str = field(default_factory=new_timestamp)
+    type: ClassVar[str]
+    __repr__ = _voice_model_repr
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class SessionReady(_OutboundMessage):
+    """Explicit positive application-readiness acknowledgement.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    """
+
+    type: ClassVar[str] = "session.ready"
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class SessionRejected(_OutboundMessage):
+    """Explicit negative application-readiness acknowledgement.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar code: Open-enum rejection code.
+    :vartype code: str
+    :ivar retriable: Whether the Bridge may retry activation.
+    :vartype retriable: bool
+    :ivar message: Optional sanitized diagnostic detail.
+    :vartype message: str or None
+    """
+
+    type: ClassVar[str] = "session.rejected"
+    code: str
+    retriable: bool
+    message: str | None = None
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseCreated(_OutboundMessage):
+    """Open a reply response or request proactive admission.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Agent-allocated response identifier.
+    :vartype response_id: str
+    :ivar in_reply_to: Ordered input prefix for a reply, or None for proactive admission.
+    :vartype in_reply_to: tuple[str, ...] or None
+    :ivar admission_timeout_ms: Optional proactive admission timeout.
+    :vartype admission_timeout_ms: int or None
+    :ivar supersede_key: Optional proactive supersession key.
+    :vartype supersede_key: str or None
+    """
+
+    type: ClassVar[str] = "response.created"
+    response_id: str
+    in_reply_to: tuple[str, ...] | None = None
+    admission_timeout_ms: int | None = None
+    supersede_key: str | None = None
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseNone(_OutboundMessage):
+    """Explicitly decline an ordered input prefix.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar in_reply_to: Non-empty ordered input prefix being declined.
+    :vartype in_reply_to: tuple[str, ...]
+    :ivar reason: Optional open-enum decline reason.
+    :vartype reason: str or None
+    """
+
+    type: ClassVar[str] = "response.none"
+    in_reply_to: tuple[str, ...]
+    reason: str | None = None
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseOutputTextDelta(_OutboundMessage):
+    """One streaming text increment for an output item.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Owning response identifier.
+    :vartype response_id: str
+    :ivar item_id: Output item identifier.
+    :vartype item_id: str
+    :ivar delta: Non-empty text increment.
+    :vartype delta: str
+    :ivar voice: Optional immutable Voice Live synthesis merge patch.
+    :vartype voice: Mapping[str, Any] or None
+    """
+
+    type: ClassVar[str] = "response.output_text.delta"
+    response_id: str
+    item_id: str
+    delta: str
+    voice: Mapping[str, Any] | None = None
+
+    def __post_init__(self) -> None:
+        if self.voice is not None:
+            object.__setattr__(self, "voice", _freeze_json(self.voice, "voice"))
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseOutputTextDone(_OutboundMessage):
+    """Complete one streamed or non-streamed output item.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Owning response identifier.
+    :vartype response_id: str
+    :ivar item_id: Output item identifier.
+    :vartype item_id: str
+    :ivar text: Complete output item text.
+    :vartype text: str
+    :ivar voice: Optional immutable Voice Live synthesis merge patch.
+    :vartype voice: Mapping[str, Any] or None
+    """
+
+    type: ClassVar[str] = "response.output_text.done"
+    response_id: str
+    item_id: str
+    text: str
+    voice: Mapping[str, Any] | None = None
+
+    def __post_init__(self) -> None:
+        if self.voice is not None:
+            object.__setattr__(self, "voice", _freeze_json(self.voice, "voice"))
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseDone(_OutboundMessage):
+    """Explicit normal response-level terminator.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Completed response identifier.
+    :vartype response_id: str
+    """
+
+    type: ClassVar[str] = "response.done"
+    response_id: str
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class ResponseCancel(_OutboundMessage):
+    """Request cancellation of an open or pending proactive response.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar response_id: Response or pending proactive request to cancel.
+    :vartype response_id: str
+    :ivar reason: Optional open-enum cancellation reason.
+    :vartype reason: str or None
+    """
+
+    type: ClassVar[str] = "response.cancel"
+    response_id: str
+    reason: str | None = None
+
+
+@experimental
+class EndCallMode(str, Enum, metaclass=CaseInsensitiveEnumMeta):
+    """Closed call-ending mode."""
+
+    DRAIN = "drain"
+    IMMEDIATE = "immediate"
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class EndCall(_OutboundMessage):
+    """Ask the Bridge to end the call.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar reason: Non-empty call-ending reason.
+    :vartype reason: str
+    :ivar mode: Closed call-ending mode.
+    :vartype mode: EndCallMode
+    """
+
+    type: ClassVar[str] = "end_call"
+    reason: str
+    mode: EndCallMode = EndCallMode.DRAIN
+
+
+@experimental
+@dataclass(frozen=True, kw_only=True, repr=False)
+class AgentError(_OutboundMessage):
+    """Report an explicit response- or session-scoped agent failure.
+
+    :ivar id: Generated wire message identifier.
+    :vartype id: str
+    :ivar ts: Generated sender timestamp.
+    :vartype ts: str
+    :ivar code: Open-enum agent error code.
+    :vartype code: str
+    :ivar message: Sanitized diagnostic detail.
+    :vartype message: str
+    :ivar response_id: Related response identifier, when response-scoped.
+    :vartype response_id: str or None
+    :ivar item_id: Related output item identifier, when available.
+    :vartype item_id: str or None
+    """
+
+    type: ClassVar[str] = "error"
+    code: str
+    message: str
+    response_id: str | None = None
+    item_id: str | None = None
+
+
+_document_dataclass_defaults(
+    ResponseTimeouts,
+    InputTextPart,
+    SessionDisconnected,
+    SessionStart,
+    UserMessage,
+    UserNoInput,
+    UserSpeechStarted,
+    BargeIn,
+    ResponseAccepted,
+    ResponseDropped,
+    ResponseCancelled,
+    ResponseTimeout,
+    SessionEnd,
+    SessionReady,
+    SessionRejected,
+    ResponseCreated,
+    ResponseNone,
+    ResponseOutputTextDelta,
+    ResponseOutputTextDone,
+    ResponseDone,
+    ResponseCancel,
+    EndCall,
+    AgentError,
+)
+
+
+OutboundVoiceMessage = (
+    SessionReady
+    | SessionRejected
+    | ResponseCreated
+    | ResponseNone
+    | ResponseOutputTextDelta
+    | ResponseOutputTextDone
+    | ResponseDone
+    | ResponseCancel
+    | EndCall
+    | AgentError
+)
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_session.py b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_session.py
new file mode 100644
index 000000000000..e6f9483948dc
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_session.py
@@ -0,0 +1,408 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Thin connection context for explicit Voice event sends."""
+
+from __future__ import annotations
+
+import asyncio  # pylint: disable=do-not-import-asyncio
+import contextvars
+import sys
+from collections.abc import Coroutine, MutableMapping
+from threading import Lock
+from typing import Any, TypeVar, cast
+
+from starlette.types import Send
+from starlette.websockets import WebSocket, WebSocketDisconnect, WebSocketState
+
+from azure.ai.agentserver.core import experimental
+
+from ._codec import encode_outbound_message
+from ._models import OutboundVoiceMessage, SessionDisconnected
+
+_VOICE_SESSION_SCOPE_KEY = "azure.ai.agentserver.invocations.voice.session"
+_VOICE_CLOSE_CODE_SCOPE_KEY = "azure.ai.agentserver.invocations.voice.close_code"
+_VOICE_DISCONNECT_EVENT_SCOPE_KEY = "azure.ai.agentserver.invocations.voice.disconnect_event"
+CLOSE_TIMEOUT_SECONDS = 5.0
+_MAX_CLOSE_ATTEMPTS = 256
+_CLOSE_ATTEMPTS: set[asyncio.Task[None]] = set()
+_CLOSE_ATTEMPT_RESERVATIONS = 0
+_CLOSE_ATTEMPT_LOCK = Lock()
+
+
+_TransportResultT = TypeVar("_TransportResultT")
+
+
+class _OperationCancellationState:
+    __slots__ = ("cancellation", "cancellation_requests", "operation_cancel_requested")
+
+    def __init__(self) -> None:
+        self.cancellation: asyncio.CancelledError | None = None
+        self.cancellation_requests = 0
+        self.operation_cancel_requested = False
+
+
+class _OperationCancellationWaiter(asyncio.Future):
+    __slots__ = ("operation", "state")
+
+    def __init__(self, operation: asyncio.Task[Any], state: _OperationCancellationState) -> None:
+        super().__init__()
+        self.operation = operation
+        self.state = state
+
+    def cancel(self, msg: object | None = None) -> bool:
+        if self.done():
+            return False
+        self.state.cancellation = asyncio.CancelledError(msg) if msg is not None else asyncio.CancelledError()
+        self.state.cancellation_requests += 1
+        self.state.operation_cancel_requested = self.operation.cancel(msg)
+        return True
+
+
+def _close_coroutine(coroutine: Coroutine[Any, Any, Any]) -> None:
+    coroutine.close()
+
+
+def _find_cancellation(error: BaseException) -> asyncio.CancelledError | None:
+    pending = [error]
+    seen: set[int] = set()
+    while pending:
+        current = pending.pop()
+        if id(current) in seen:
+            continue
+        seen.add(id(current))
+        if isinstance(current, asyncio.CancelledError):
+            return current
+        if current.__context__ is not None:
+            pending.append(current.__context__)
+        if current.__cause__ is not None:
+            pending.append(current.__cause__)
+    return None
+
+
+def _unlink_exception(error: BaseException, target: BaseException) -> None:
+    pending = [error]
+    seen: set[int] = set()
+    while pending:
+        current = pending.pop()
+        if id(current) in seen:
+            continue
+        seen.add(id(current))
+        cause = current.__cause__
+        context = current.__context__
+        if cause is target:
+            current.__cause__ = None
+        elif cause is not None:
+            pending.append(cause)
+        if context is target:
+            current.__context__ = None
+        elif context is not None:
+            pending.append(context)
+
+
+def _task_cancellation_requests() -> int | None:
+    if sys.version_info < (3, 11):
+        return None
+    try:
+        task = asyncio.current_task()
+    except RuntimeError:
+        return None
+    cancelling = getattr(task, "cancelling", None)
+    return int(cancelling()) if callable(cancelling) else None
+
+
+def _raise_task_cancellation(
+    error: BaseException,
+    cancellation_requests: int | None,
+) -> None:
+    cancellation = _find_cancellation(error)
+    if cancellation is None or cancellation is error:
+        return
+    current_requests = _task_cancellation_requests()
+    task_cancelled = (
+        cancellation_requests is not None and current_requests is not None and current_requests > cancellation_requests
+    )
+    if not task_cancelled:
+        return
+    _unlink_exception(error, cancellation)
+    raise cancellation from error
+
+
+def _transfer_send_result(operation: asyncio.Task[BaseException | None], waiter: _OperationCancellationWaiter) -> None:
+    if waiter.done():
+        if not operation.cancelled():
+            operation.exception()
+        return
+    if operation.cancelled():
+        cancellation = waiter.state.cancellation
+        if cancellation is None:
+            try:
+                operation.result()
+            except asyncio.CancelledError as operation_cancellation:
+                cancellation = operation_cancellation
+        waiter.set_result(cancellation)
+        return
+    waiter.set_result(operation.result())
+
+
+async def _run_send_operation(
+    operation_coroutine: Coroutine[Any, Any, BaseException | None],
+    state: _OperationCancellationState,
+) -> None:
+    try:
+        operation = asyncio.create_task(operation_coroutine, name="voice_websocket_send")
+    except BaseException:  # pylint: disable=broad-exception-caught
+        _close_coroutine(operation_coroutine)
+        raise
+    waiter = _OperationCancellationWaiter(operation, state)
+    operation.add_done_callback(lambda completed: _transfer_send_result(completed, waiter))
+    outcome = await waiter
+    if isinstance(outcome, BaseException):
+        error = outcome
+        cancellation = state.cancellation
+        if cancellation is None:
+            raise error
+        nested_cancellation = _find_cancellation(error)
+        if nested_cancellation is not None:
+            if nested_cancellation is not error:
+                _unlink_exception(error, nested_cancellation)
+                raise nested_cancellation from error
+            raise error
+        raise cancellation from error
+    if state.cancellation is not None:
+        raise state.cancellation
+
+
+def _transfer_transport_result(operation: asyncio.Task[Any], waiter: _OperationCancellationWaiter) -> None:
+    if waiter.done():
+        if not operation.cancelled():
+            operation.exception()
+        return
+    if operation.cancelled():
+        try:
+            operation.result()
+        except asyncio.CancelledError as cancellation:
+            waiter.set_result((None, cancellation))
+        return
+    error = operation.exception()
+    waiter.set_result((None, error) if error is not None else (operation.result(), None))
+
+
+async def _run_transport_operation(
+    operation_coroutine: Coroutine[Any, Any, _TransportResultT],
+) -> _TransportResultT:
+    """Run one SDK-owned transport await without losing owner cancellation.
+
+    :param operation_coroutine: SDK-owned transport coroutine to execute.
+    :type operation_coroutine: Coroutine[Any, Any, _TransportResultT]
+    :return: The result produced by the transport coroutine.
+    :rtype: _TransportResultT
+
+    The transport must eventually settle after cancellation. A single delivered
+    cancellation preserves its nested identity when available. After repeated
+    owner cancellation, the latest saved owner request wins; exact cancellation
+    identity from a transport-defined exception graph is unspecified. This helper
+    is not used for application callbacks, whose cancellation is cooperative.
+    """
+    state = _OperationCancellationState()
+    try:
+        operation = asyncio.create_task(operation_coroutine, name="voice_websocket_transport")
+    except BaseException:  # pylint: disable=broad-exception-caught
+        _close_coroutine(operation_coroutine)
+        raise
+    waiter = _OperationCancellationWaiter(operation, state)
+    operation.add_done_callback(lambda completed: _transfer_transport_result(completed, waiter))
+    result, error = cast(tuple[Any, BaseException | None], await waiter)
+    if state.cancellation is not None:
+        if error is None:
+            raise state.cancellation
+        nested_cancellation = _find_cancellation(error)
+        if state.cancellation_requests == 1 and state.operation_cancel_requested and nested_cancellation is not None:
+            if nested_cancellation is not error:
+                _unlink_exception(error, nested_cancellation)
+                raise nested_cancellation from error
+            raise error
+        raise state.cancellation from error
+    if error is not None:
+        raise error
+    return cast(_TransportResultT, result)
+
+
+async def _run_close_attempt(
+    send_lock: asyncio.Lock,
+    send: Send,
+    message: dict[str, Any],
+) -> None:
+    async with send_lock:
+        await send(message)
+
+
+def _observe_close_attempt(task: asyncio.Task[None]) -> None:
+    with _CLOSE_ATTEMPT_LOCK:
+        _CLOSE_ATTEMPTS.discard(task)
+    if task.cancelled():
+        return
+    task.exception()
+
+
+def _start_close_attempt(
+    send_lock: asyncio.Lock,
+    websocket: WebSocket,
+    code: int,
+    reason: str,
+) -> asyncio.Task[None] | None:
+    global _CLOSE_ATTEMPT_RESERVATIONS  # pylint: disable=global-statement
+    send = websocket._send  # pylint: disable=protected-access
+    message = {"type": "websocket.close", "code": code, "reason": reason}
+    with _CLOSE_ATTEMPT_LOCK:
+        application_state = websocket.application_state
+        if application_state == WebSocketState.DISCONNECTED:
+            return None
+        if len(_CLOSE_ATTEMPTS) + _CLOSE_ATTEMPT_RESERVATIONS >= _MAX_CLOSE_ATTEMPTS:
+            raise RuntimeError("Voice WebSocket close attempt limit reached")
+        _CLOSE_ATTEMPT_RESERVATIONS += 1
+        websocket.application_state = WebSocketState.DISCONNECTED
+    close_coroutine = _run_close_attempt(send_lock, send, message)
+    try:
+        task = contextvars.Context().run(asyncio.create_task, close_coroutine, name="voice_websocket_close")
+    except BaseException as creation_error:  # pylint: disable=broad-exception-caught
+        with _CLOSE_ATTEMPT_LOCK:
+            _CLOSE_ATTEMPT_RESERVATIONS -= 1
+            websocket.application_state = application_state
+        try:
+            _close_coroutine(close_coroutine)
+        except BaseException:  # pylint: disable=broad-exception-caught
+            pass
+        raise creation_error
+    with _CLOSE_ATTEMPT_LOCK:
+        _CLOSE_ATTEMPT_RESERVATIONS -= 1
+        _CLOSE_ATTEMPTS.add(task)
+    task.add_done_callback(_observe_close_attempt, context=contextvars.Context())
+    return task
+
+
+@experimental
+class Session:
+    """Send-only context for one accepted Voice WebSocket connection.
+
+    ``Session`` retains only transport write serialization and a terminal write
+    gate. Agent code owns response IDs, pending work, generation tasks,
+    terminal-event correlation, cancellation, history, and reconnect
+    restoration.
+
+    Instances are created by :class:`VoiceAgentServerHost` and supplied to
+    registered callbacks.
+    """
+
+    __slots__ = ("_send_lock", "_terminal", "_websocket")
+    _send_lock: asyncio.Lock
+    _terminal: bool
+    _websocket: WebSocket
+
+    def __init__(self) -> None:
+        raise TypeError("Session instances are created by VoiceAgentServerHost")
+
+    @classmethod
+    def _create(cls, websocket: WebSocket) -> "Session":
+        current = cls._current(websocket)
+        if current is not None:
+            return current
+        instance = object.__new__(cls)
+        instance._websocket = websocket
+        instance._send_lock = asyncio.Lock()
+        instance._terminal = False
+        scope = getattr(websocket, "scope", None)
+        if isinstance(scope, MutableMapping):
+            scope[_VOICE_SESSION_SCOPE_KEY] = instance
+        return instance
+
+    @classmethod
+    def _current(cls, websocket: WebSocket) -> "Session | None":
+        scope = getattr(websocket, "scope", None)
+        if not isinstance(scope, MutableMapping):
+            return None
+        current = scope.get(_VOICE_SESSION_SCOPE_KEY)
+        return current if isinstance(current, cls) else None
+
+    @classmethod
+    def _release(cls, websocket: WebSocket, session: "Session") -> None:
+        scope = getattr(websocket, "scope", None)
+        if isinstance(scope, MutableMapping) and scope.get(_VOICE_SESSION_SCOPE_KEY) is session:
+            del scope[_VOICE_SESSION_SCOPE_KEY]
+
+    def _begin_termination(self) -> None:
+        self._terminal = True
+
+    def _start_close(self, code: int, reason: str) -> asyncio.Task[None] | None:
+        self._begin_termination()
+        return _start_close_attempt(self._send_lock, self._websocket, code, reason)
+
+    @staticmethod
+    async def _wait_close(attempt: asyncio.Task[None] | None, deadline: float) -> None:
+        if attempt is None:
+            return
+        loop = asyncio.get_running_loop()
+        remaining = max(0.0, deadline - loop.time())
+        done, _ = await asyncio.wait((attempt,), timeout=remaining)
+        if not done:
+            raise TimeoutError("Voice WebSocket close deadline elapsed")
+        attempt.result()
+
+    async def _close(
+        self,
+        code: int,
+        reason: str,
+        deadline: float | None = None,
+    ) -> None:
+        self._begin_termination()
+        loop = asyncio.get_running_loop()
+        if deadline is None:
+            deadline = loop.time() + CLOSE_TIMEOUT_SECONDS
+        remaining = deadline - loop.time()
+        if remaining <= 0:
+            raise TimeoutError("Voice WebSocket close deadline elapsed")
+        attempt = self._start_close(code, reason)
+        await self._wait_close(attempt, deadline)
+
+    def _ensure_writable(self) -> None:
+        if self._terminal:
+            raise RuntimeError("Voice Session is terminating")
+
+    async def send(self, message: OutboundVoiceMessage) -> None:
+        """Encode and send one explicit agent-to-Bridge event.
+
+        Concurrent calls are serialized at the WebSocket write boundary. The
+        method does not retry, infer commitment, or update protocol state.
+
+        :param message: One immutable selected outbound message.
+        :type message: OutboundVoiceMessage
+        """
+        self._ensure_writable()
+        frame = encode_outbound_message(message)
+        cancellation_state = _OperationCancellationState()
+
+        async def send_frame() -> BaseException | None:
+            try:
+                async with self._send_lock:
+                    self._ensure_writable()
+                    try:
+                        await self._websocket.send_text(frame)
+                    except WebSocketDisconnect as error:
+                        if cancellation_state.cancellation is None or _find_cancellation(error) is None:
+                            self._begin_termination()
+                            scope = getattr(self._websocket, "scope", None)
+                            if isinstance(scope, MutableMapping):
+                                raw_reason = getattr(error, "reason", None)
+                                reason = raw_reason if isinstance(raw_reason, str) and raw_reason else None
+                                code = int(error.code or 1006)
+                                scope.setdefault(_VOICE_CLOSE_CODE_SCOPE_KEY, code)
+                                scope.setdefault(
+                                    _VOICE_DISCONNECT_EVENT_SCOPE_KEY,
+                                    SessionDisconnected(code=code, reason=reason),
+                                )
+                        return error
+            except BaseException as error:  # pylint: disable=broad-exception-caught
+                return error
+            return None
+
+        await _run_send_operation(send_frame(), cancellation_state)
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_voice_host.py b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_voice_host.py
new file mode 100644
index 000000000000..da487efeff97
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/azure/ai/agentserver/invocations/voice/_voice_host.py
@@ -0,0 +1,891 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Typed event relay over the existing Invocations WebSocket transport."""
+
+from __future__ import annotations
+
+import asyncio  # pylint: disable=do-not-import-asyncio
+import inspect
+import logging
+import time
+import uuid
+from collections.abc import Awaitable, Callable, MutableMapping
+from typing import Any, NoReturn, TypeVar, cast
+
+from opentelemetry import baggage as _otel_baggage, context as _otel_context
+from opentelemetry.propagators.textmap import Getter
+from starlette.routing import Host, Match, Mount, Router, WebSocketRoute
+from starlette.types import Receive, Scope, Send
+from starlette.websockets import WebSocket, WebSocketDisconnect, WebSocketState
+
+from azure.ai.agentserver.core import (
+    FoundryAgentRequestContext,
+    experimental,
+    set_request_context,
+)
+from azure.ai.agentserver.core._platform_headers import (  # pylint: disable=import-error,no-name-in-module
+    FOUNDRY_CALL_ID,
+    REQUEST_ID,
+    SERVER_VERSION,
+    USER_ID,
+)
+
+from .._constants import InvocationsWSConstants
+from .._invocation import InvocationAgentServerHost
+from . import _session as _session_transport
+from ._codec import MAX_FRAME_BYTES, VoiceProtocolError, decode_inbound_message
+from ._models import (
+    BargeIn,
+    InboundVoiceMessage,
+    ResponseAccepted,
+    ResponseCancelled,
+    ResponseDropped,
+    ResponseTimeout,
+    SessionDisconnected,
+    SessionEnd,
+    SessionStart,
+    UserMessage,
+    UserNoInput,
+    UserSpeechStarted,
+)
+from ._session import Session
+
+SessionStartCallback = Callable[[Session, SessionStart], Awaitable[None]]
+UserMessageCallback = Callable[[Session, UserMessage], Awaitable[None]]
+UserNoInputCallback = Callable[[Session, UserNoInput], Awaitable[None]]
+UserSpeechStartedCallback = Callable[[Session, UserSpeechStarted], Awaitable[None]]
+BargeInCallback = Callable[[Session, BargeIn], Awaitable[None]]
+ResponseAcceptedCallback = Callable[[Session, ResponseAccepted], Awaitable[None]]
+ResponseDroppedCallback = Callable[[Session, ResponseDropped], Awaitable[None]]
+ResponseCancelledCallback = Callable[[Session, ResponseCancelled], Awaitable[None]]
+ResponseTimeoutCallback = Callable[[Session, ResponseTimeout], Awaitable[None]]
+SessionEndCallback = Callable[[Session, SessionEnd], Awaitable[None]]
+DisconnectCallback = Callable[[Session, SessionDisconnected], Awaitable[None]]
+ConnectionTerminatingCallback = Callable[[Session], None]
+
+_CallbackT = TypeVar("_CallbackT", bound=Callable[..., Awaitable[None]])
+_AwaitedT = TypeVar("_AwaitedT")
+_VoiceCallback = Callable[[Session, Any], Awaitable[None]]
+logger = logging.getLogger("azure.ai.agentserver")
+_VOICE_AUTHORITY_ROUTE = object()
+_VOICE_CLOSE_CODE = _session_transport._VOICE_CLOSE_CODE_SCOPE_KEY  # pylint: disable=protected-access
+_VOICE_DISCONNECT_EVENT = _session_transport._VOICE_DISCONNECT_EVENT_SCOPE_KEY  # pylint: disable=protected-access
+_VOICE_TERMINATION_DEADLINE = "azure.ai.agentserver.invocations.voice.termination_deadline"
+_VOICE_ROUTE_CONFLICT = "VoiceAgentServerHost cannot own /invocations_ws because the route is already registered"
+
+
+def _is_async_callable(callback: Callable[..., Any]) -> bool:
+    for candidate in (callback, getattr(callback, "__call__", None)):
+        if candidate is None:
+            continue
+        unwrapped = inspect.unwrap(candidate)
+        if inspect.iscoroutinefunction(unwrapped) or inspect.isasyncgenfunction(unwrapped):
+            return True
+    return False
+
+
+class _VoiceWebSocketRoute(WebSocketRoute):
+    """Reserved Voice route that preserves matching Host and Mount authority."""
+
+    def __init__(self, endpoint: Callable[..., Any], *, router: Router) -> None:
+        super().__init__(InvocationsWSConstants.ROUTE_PATH, endpoint, name="invocations_ws")
+        self._router = router
+
+    def matches(self, scope: Scope) -> tuple[Match, Scope]:
+        match, child_scope = super().matches(scope)
+        if match is not Match.FULL:
+            return match, child_scope
+        for route in tuple(self._router.routes):
+            if route is self or not isinstance(route, (Host, Mount)):
+                continue
+            authority_match, authority_scope = route.matches(scope)
+            if authority_match is Match.FULL:
+                selected_scope: dict[Any, Any] = dict(authority_scope)
+                selected_scope[_VOICE_AUTHORITY_ROUTE] = route
+                return Match.FULL, cast(Scope, selected_scope)
+        return match, child_scope
+
+    async def handle(self, scope: Scope, receive: Receive, send: Send) -> None:
+        authority_route = scope.pop(cast(Any, _VOICE_AUTHORITY_ROUTE), None)
+        if isinstance(authority_route, (Host, Mount)):
+            await authority_route.handle(scope, receive, send)
+            return
+        await super().handle(scope, receive, send)
+
+
+class _VoiceHeaderGetter(Getter[list[tuple[bytes, bytes]]]):
+    """Read raw Voice upgrade headers with W3C multi-value semantics."""
+
+    def get(self, carrier: list[tuple[bytes, bytes]], key: str) -> list[str] | None:
+        normalized_key = key.lower().encode("latin-1")
+        values = [value.decode("latin-1") for name, value in carrier if name.lower() == normalized_key]
+        if not values:
+            return None
+        if key.lower() == "traceparent":
+            return values if len(values) == 1 else None
+        if key.lower() in ("baggage", "tracestate"):
+            return [",".join(values)]
+        return values
+
+    def keys(self, carrier: list[tuple[bytes, bytes]]) -> list[str]:
+        return list(dict.fromkeys(name.decode("latin-1").lower() for name, _ in carrier))
+
+
+_VOICE_HEADER_GETTER = _VoiceHeaderGetter()
+
+
+def _extract_voice_websocket_context(websocket: WebSocket) -> Any:
+    try:
+        raw_headers: list[tuple[bytes, bytes]] = websocket.scope.get("headers", [])
+        from opentelemetry.propagate import extract  # pylint: disable=import-outside-toplevel
+
+        context = extract(carrier=raw_headers, getter=_VOICE_HEADER_GETTER)
+        request_ids = _VOICE_HEADER_GETTER.get(raw_headers, REQUEST_ID) or []
+        request_id = next((value for value in request_ids if value), None)
+        if request_id:
+            context = _otel_baggage.set_baggage("x_request_id", request_id, context=context)
+        return context
+    except BaseException:  # pylint: disable=broad-exception-caught
+        return _otel_context.Context()
+
+
+def _selected_voice_close_code(websocket: WebSocket, default_code: int) -> int:
+    scope = getattr(websocket, "scope", None)
+    if not isinstance(scope, MutableMapping):
+        return default_code
+    selected = scope.get(_VOICE_CLOSE_CODE)
+    return int(selected) if isinstance(selected, int) else default_code
+
+
+def _select_voice_close_code(websocket: WebSocket, code: int) -> None:
+    scope = getattr(websocket, "scope", None)
+    if isinstance(scope, MutableMapping):
+        scope.setdefault(_VOICE_CLOSE_CODE, code)
+
+
+def _raise_voice_disconnect(websocket: WebSocket, code: int, reason: str) -> NoReturn:
+    _select_voice_close_code(websocket, code)
+    raise WebSocketDisconnect(code=code, reason=reason)
+
+
+def _raise_wrapped_cancellation(
+    error: BaseException,
+    cancellation_requests: int | None,
+) -> None:
+    _session_transport._raise_task_cancellation(error, cancellation_requests)  # pylint: disable=protected-access
+
+
+def _task_cancellation_requests() -> int | None:
+    return _session_transport._task_cancellation_requests()  # pylint: disable=protected-access
+
+
+def _begin_voice_termination(websocket: WebSocket, session: Session) -> float:
+    session._begin_termination()  # pylint: disable=protected-access
+    loop = asyncio.get_running_loop()
+    scope = getattr(websocket, "scope", None)
+    if isinstance(scope, MutableMapping):
+        selected = scope.get(_VOICE_TERMINATION_DEADLINE)
+        if isinstance(selected, (int, float)):
+            return float(selected)
+        deadline = loop.time() + _session_transport.CLOSE_TIMEOUT_SECONDS
+        scope[_VOICE_TERMINATION_DEADLINE] = deadline
+        return deadline
+    return loop.time() + _session_transport.CLOSE_TIMEOUT_SECONDS
+
+
+def _selected_voice_termination_deadline(websocket: WebSocket) -> float:
+    scope = getattr(websocket, "scope", None)
+    if isinstance(scope, MutableMapping):
+        selected = scope.get(_VOICE_TERMINATION_DEADLINE)
+        if isinstance(selected, (int, float)):
+            return float(selected)
+    return asyncio.get_running_loop().time() + _session_transport.CLOSE_TIMEOUT_SECONDS
+
+
+def _peek_voice_disconnect_event(websocket: WebSocket) -> SessionDisconnected | None:
+    scope = getattr(websocket, "scope", None)
+    if not isinstance(scope, MutableMapping):
+        return None
+    event = scope.get(_VOICE_DISCONNECT_EVENT)
+    return event if isinstance(event, SessionDisconnected) else None
+
+
+def _take_voice_disconnect_event(websocket: WebSocket) -> SessionDisconnected | None:
+    scope = getattr(websocket, "scope", None)
+    if not isinstance(scope, MutableMapping):
+        return None
+    event = scope.pop(_VOICE_DISCONNECT_EVENT, None)
+    return event if isinstance(event, SessionDisconnected) else None
+
+
+async def _raise_pending_cancellation() -> None:
+    await asyncio.sleep(0)
+
+
+async def _raise_pending_or_consumed_cancellation(cancellation_requests: int | None) -> None:
+    await _raise_pending_cancellation()
+    current_requests = _task_cancellation_requests()
+    if cancellation_requests is not None and current_requests is not None and current_requests > cancellation_requests:
+        raise asyncio.CancelledError()
+
+
+async def _await_with_cancellation_guard(
+    awaitable: Awaitable[_AwaitedT],
+    *,
+    on_success: Callable[[], object] | None = None,
+) -> _AwaitedT:
+    cancellation_requests = _task_cancellation_requests()
+    result = await awaitable
+    if on_success is not None:
+        on_success()
+    await _raise_pending_or_consumed_cancellation(cancellation_requests)
+    return result
+
+
+async def _receive_voice_transport_message(websocket: WebSocket) -> MutableMapping[str, Any]:
+    message = await _session_transport._run_transport_operation(websocket.receive())  # pylint: disable=protected-access
+    await _raise_pending_cancellation()
+    return message
+
+
+@experimental
+class VoiceAgentServerHost(InvocationAgentServerHost):
+    """Invocations host with typed Voice event decorators.
+
+    The host performs only per-frame decoding and static callback dispatch.
+    Agent code owns IDs, application tasks, response lifecycle, terminal-event
+    correlation, cancellation, history, and reconnect restoration.
+
+    :param openapi_spec: Optional OpenAPI document inherited from Invocations.
+    :param asyncapi_spec_json: Optional AsyncAPI JSON document.
+    :param asyncapi_spec_yaml: Optional AsyncAPI YAML document.
+    :param kwargs: Remaining :class:`InvocationAgentServerHost` options.
+    """
+
+    def __init__(
+        self,
+        *,
+        openapi_spec: dict[str, Any] | None = None,
+        asyncapi_spec_json: dict[str, Any] | None = None,
+        asyncapi_spec_yaml: str | None = None,
+        **kwargs: Any,
+    ) -> None:
+        self._voice_callbacks: dict[str, _VoiceCallback] = {}
+        self._connection_terminating_callback: ConnectionTerminatingCallback | None = None
+        self._voice_route: _VoiceWebSocketRoute | None = None
+        super().__init__(
+            openapi_spec=openapi_spec,
+            asyncapi_spec_json=asyncapi_spec_json,
+            asyncapi_spec_yaml=asyncapi_spec_yaml,
+            **kwargs,
+        )
+        super().ws_handler(self._handle_voice_connection)
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] == "websocket":
+            scope = dict(scope)
+            self._ensure_ws_route_registered()
+        await super().__call__(scope, receive, send)
+
+    def _ensure_ws_route_registered(self) -> None:
+        voice_route = self._voice_route
+        if voice_route is None:
+            voice_route = _VoiceWebSocketRoute(self._ws_endpoint, router=self.router)
+            self._voice_route = voice_route
+        routes = self.router.routes
+        for route in routes:
+            if (
+                route is not voice_route
+                and isinstance(route, WebSocketRoute)
+                and getattr(route, "path", None) == InvocationsWSConstants.ROUTE_PATH
+            ):
+                raise RuntimeError(_VOICE_ROUTE_CONFLICT)
+        if voice_route in routes:
+            routes.remove(voice_route)
+        routes.insert(0, voice_route)
+
+    async def _ws_endpoint(self, websocket: WebSocket) -> None:
+        session_id = self.config.session_id or str(uuid.uuid4())
+        start_ns = time.monotonic_ns()
+        trace_token = None
+        try:
+            try:
+                trace_token = _otel_context.attach(_extract_voice_websocket_context(websocket))
+            except BaseException:  # pylint: disable=broad-exception-caught
+                trace_token = None
+            platform_token = set_request_context(
+                FoundryAgentRequestContext(
+                    call_id=websocket.headers.get(FOUNDRY_CALL_ID) or None,
+                    user_id=websocket.headers.get(USER_ID) or None,
+                    session_id=session_id,
+                )
+            )
+            try:
+                await self._run_voice_endpoint(websocket, session_id, start_ns)
+            finally:
+                platform_token.var.reset(platform_token)
+        finally:
+            if trace_token is not None:
+                trace_token.var.reset(trace_token)
+
+    async def _run_voice_endpoint(self, websocket: WebSocket, session_id: str, start_ns: int) -> None:
+        try:
+            accept_error, voice_session, close_code, handler_exc, pending_error = (
+                await self._run_voice_connection_context(
+                    websocket,
+                    session_id,
+                )
+            )
+        except asyncio.CancelledError:
+            self._emit_voice_close_event(
+                session_id=session_id,
+                start_ns=start_ns,
+                close_code=InvocationsWSConstants.CLOSE_INTERNAL_ERROR,
+                error_code="cancelled",
+            )
+            raise
+
+        if accept_error is not None:
+            if voice_session is not None:
+                await self._complete_voice_endpoint(
+                    websocket=websocket,
+                    voice_session=voice_session,
+                    session_id=session_id,
+                    start_ns=start_ns,
+                    close_code=close_code,
+                    handler_exc=None,
+                    pending_error=None,
+                    error_code_override="accept_failed",
+                )
+            self._report_voice_accept_failure(
+                session_id,
+                start_ns,
+                accept_error,
+                emit_event=voice_session is None,
+            )
+            return
+
+        if voice_session is None:
+            raise RuntimeError("Voice WebSocket accepted without a Session")
+        await self._complete_voice_endpoint(
+            websocket=websocket,
+            voice_session=voice_session,
+            session_id=session_id,
+            start_ns=start_ns,
+            close_code=close_code,
+            handler_exc=handler_exc,
+            pending_error=pending_error,
+        )
+
+    async def _run_voice_connection_context(
+        self,
+        websocket: WebSocket,
+        session_id: str,
+    ) -> tuple[Exception | None, Session | None, int, BaseException | None, BaseException | None]:
+        accept_error: Exception | None = None
+        voice_session: Session | None = None
+        close_code = InvocationsWSConstants.CLOSE_NORMAL
+        handler_exc: BaseException | None = None
+        pending_error: BaseException | None = None
+        try:
+            accept_error = await self._accept_voice_websocket(websocket)
+            if accept_error is None:
+                voice_session, close_code, handler_exc, pending_error = await self._run_accepted_voice_handler(
+                    websocket,
+                    session_id,
+                )
+            elif websocket.application_state == WebSocketState.CONNECTED:
+                voice_session = Session._create(websocket)  # pylint: disable=protected-access
+                _begin_voice_termination(websocket, voice_session)
+                close_code = InvocationsWSConstants.CLOSE_INTERNAL_ERROR
+        finally:
+            if voice_session is not None:
+                Session._release(websocket, voice_session)  # pylint: disable=protected-access
+        return accept_error, voice_session, close_code, handler_exc, pending_error
+
+    async def _accept_voice_websocket(
+        self,
+        websocket: WebSocket,
+    ) -> Exception | None:
+        try:
+            await _session_transport._run_transport_operation(  # pylint: disable=protected-access
+                websocket.accept(
+                    headers=[
+                        (
+                            SERVER_VERSION.encode("latin-1"),
+                            self._build_server_version().encode("latin-1"),  # pylint: disable=protected-access
+                        )
+                    ]
+                )
+            )
+            await _raise_pending_cancellation()
+        except Exception as exc:  # pylint: disable=broad-exception-caught
+            return exc
+        return None
+
+    async def _run_accepted_voice_handler(
+        self,
+        websocket: WebSocket,
+        session_id: str,
+    ) -> tuple[Session, int, BaseException | None, BaseException | None]:
+        voice_session = Session._create(websocket)  # pylint: disable=protected-access
+        close_code = InvocationsWSConstants.CLOSE_NORMAL
+        handler_exc: BaseException | None = None
+        pending_error: BaseException | None = None
+        cancellation_requests = _task_cancellation_requests()
+        try:
+            close_code, handler_exc = await self._invoke_user_handler(websocket, session_id)
+            await _raise_pending_cancellation()
+            close_code = _selected_voice_close_code(websocket, close_code)
+        except BaseException as exc:  # pylint: disable=broad-exception-caught
+            if isinstance(exc, Exception):
+                try:
+                    _raise_wrapped_cancellation(exc, cancellation_requests)
+                except asyncio.CancelledError as cancellation:
+                    exc = cancellation
+            close_code = _selected_voice_close_code(websocket, InvocationsWSConstants.CLOSE_INTERNAL_ERROR)
+            handler_exc = exc
+            pending_error = exc
+        return voice_session, close_code, handler_exc, pending_error
+
+    async def _complete_voice_endpoint(
+        self,
+        *,
+        websocket: WebSocket,
+        voice_session: Session,
+        session_id: str,
+        start_ns: int,
+        close_code: int,
+        handler_exc: BaseException | None,
+        pending_error: BaseException | None,
+        error_code_override: str | None = None,
+    ) -> None:
+        deadline = _selected_voice_termination_deadline(websocket)
+        cancellation = handler_exc if isinstance(handler_exc, asyncio.CancelledError) else None
+        disconnect_event = _peek_voice_disconnect_event(websocket)
+        close_attempt: asyncio.Task[None] | None = None
+        close_error: Exception | None = None
+        if error_code_override is not None:
+            error_code = error_code_override
+        elif handler_exc is None:
+            error_code = None
+        elif isinstance(handler_exc, asyncio.CancelledError):
+            error_code = "cancelled"
+        else:
+            error_code = "internal_error"
+        if cancellation is None and disconnect_event is None and close_code not in {1005, 1006, 1015}:
+            reason = "Internal server error" if close_code == InvocationsWSConstants.CLOSE_INTERNAL_ERROR else ""
+            try:
+                close_attempt = voice_session._start_close(close_code, reason)  # pylint: disable=protected-access
+            except Exception as exc:  # pylint: disable=broad-exception-caught
+                close_error = exc
+
+        termination_error = self._notify_connection_terminating(voice_session)
+        disconnect_error: BaseException | None = None
+        try:
+            await _raise_pending_cancellation()
+            if close_attempt is not None:
+                try:
+                    await voice_session._wait_close(close_attempt, deadline)  # pylint: disable=protected-access
+                except Exception as exc:  # pylint: disable=broad-exception-caught
+                    close_error = exc
+            disconnect_event = _take_voice_disconnect_event(websocket)
+            disconnect_error = await self._notify_peer_disconnect(
+                voice_session,
+                disconnect_event,
+            )
+            await _raise_pending_cancellation()
+        except asyncio.CancelledError:
+            error_code = "cancelled"
+            raise
+        finally:
+            self._emit_voice_close_event(
+                session_id=session_id,
+                start_ns=start_ns,
+                close_code=close_code,
+                error_code=(
+                    "internal_error" if termination_error is not None or disconnect_error is not None else error_code
+                ),
+            )
+
+        if pending_error is not None:
+            raise pending_error
+        self._report_voice_endpoint_errors(
+            session_id=session_id,
+            handler_error=handler_exc if isinstance(handler_exc, Exception) else None,
+            termination_error=termination_error,
+            disconnect_error=disconnect_error,
+            close_error=close_error,
+        )
+
+    @staticmethod
+    def _report_voice_endpoint_errors(
+        *,
+        session_id: str,
+        handler_error: Exception | None,
+        termination_error: BaseException | None,
+        disconnect_error: BaseException | None,
+        close_error: Exception | None,
+    ) -> None:
+        if handler_error is not None:
+            try:
+                logger.error("Voice WebSocket handler raised for session %s", session_id, exc_info=handler_error)
+            except BaseException:  # pylint: disable=broad-exception-caught
+                pass
+        if termination_error is not None:
+            try:
+                logger.error("Voice connection termination callback failed", exc_info=termination_error)
+            except BaseException:  # pylint: disable=broad-exception-caught
+                pass
+        if disconnect_error is not None:
+            try:
+                logger.error("Voice disconnect callback failed", exc_info=disconnect_error)
+            except BaseException:  # pylint: disable=broad-exception-caught
+                pass
+        if close_error is not None:
+            try:
+                logger.debug("Error closing Voice WebSocket session %s", session_id, exc_info=close_error)
+            except BaseException:  # pylint: disable=broad-exception-caught
+                pass
+
+    def _report_voice_accept_failure(
+        self,
+        session_id: str,
+        start_ns: int,
+        accept_error: Exception,
+        *,
+        emit_event: bool,
+    ) -> None:
+        if emit_event:
+            self._emit_voice_close_event(
+                session_id=session_id,
+                start_ns=start_ns,
+                close_code=InvocationsWSConstants.CLOSE_INTERNAL_ERROR,
+                error_code="accept_failed",
+            )
+        try:
+            logger.error("Voice WebSocket accept failed for session %s", session_id, exc_info=accept_error)
+        except BaseException:  # pylint: disable=broad-exception-caught
+            pass
+
+    async def _invoke_user_handler(
+        self,
+        websocket: WebSocket,
+        session_id: str,
+    ) -> tuple[int, BaseException | None]:
+        ws_fn = self._ws_fn
+        if ws_fn is None:
+            raise RuntimeError("_invoke_user_handler called with no registered ws_handler")
+        cancellation_requests = _task_cancellation_requests()
+        try:
+            await ws_fn(websocket)
+            return InvocationsWSConstants.CLOSE_NORMAL, None
+        except WebSocketDisconnect as exc:
+            _raise_wrapped_cancellation(exc, cancellation_requests)
+            return int(exc.code) if exc.code else InvocationsWSConstants.CLOSE_NORMAL, None
+        except Exception as exc:  # pylint: disable=broad-exception-caught
+            _raise_wrapped_cancellation(exc, cancellation_requests)
+            return InvocationsWSConstants.CLOSE_INTERNAL_ERROR, exc
+
+    def _emit_voice_close_event(
+        self,
+        *,
+        session_id: str,
+        start_ns: int,
+        close_code: int,
+        error_code: str | None,
+    ) -> None:
+        duration_ms = (time.monotonic_ns() - start_ns) // 1_000_000
+        try:
+            self._emit_close_event(session_id, close_code, duration_ms, error_code=error_code)
+        except BaseException:  # pylint: disable=broad-exception-caught
+            pass
+
+    def ws_handler(self, fn: Any) -> NoReturn:
+        """Reject raw-handler registration on the typed Voice host.
+
+        :param fn: Raw handler supplied by the caller.
+        :type fn: Any
+        :raises RuntimeError: Always; the typed host owns ``/invocations_ws``.
+        """
+        del fn
+        raise RuntimeError("VoiceAgentServerHost owns /invocations_ws; use on_<event> decorators")
+
+    def on_session_start(self, callback: SessionStartCallback) -> SessionStartCallback:
+        """Register the ``session.start`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: SessionStartCallback
+        :return: The callback, unchanged.
+        :rtype: SessionStartCallback
+        """
+        return self._register_voice_callback(SessionStart.type, callback)
+
+    def on_user_message(self, callback: UserMessageCallback) -> UserMessageCallback:
+        """Register the ``user.message`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: UserMessageCallback
+        :return: The callback, unchanged.
+        :rtype: UserMessageCallback
+        """
+        return self._register_voice_callback(UserMessage.type, callback)
+
+    def on_user_no_input(self, callback: UserNoInputCallback) -> UserNoInputCallback:
+        """Register the ``user.no_input`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: UserNoInputCallback
+        :return: The callback, unchanged.
+        :rtype: UserNoInputCallback
+        """
+        return self._register_voice_callback(UserNoInput.type, callback)
+
+    def on_user_speech_started(self, callback: UserSpeechStartedCallback) -> UserSpeechStartedCallback:
+        """Register the ``user.speech_started`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: UserSpeechStartedCallback
+        :return: The callback, unchanged.
+        :rtype: UserSpeechStartedCallback
+        """
+        return self._register_voice_callback(UserSpeechStarted.type, callback)
+
+    def on_barge_in(self, callback: BargeInCallback) -> BargeInCallback:
+        """Register the ``barge_in`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: BargeInCallback
+        :return: The callback, unchanged.
+        :rtype: BargeInCallback
+        """
+        return self._register_voice_callback(BargeIn.type, callback)
+
+    def on_response_accepted(self, callback: ResponseAcceptedCallback) -> ResponseAcceptedCallback:
+        """Register the ``response.accepted`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: ResponseAcceptedCallback
+        :return: The callback, unchanged.
+        :rtype: ResponseAcceptedCallback
+        """
+        return self._register_voice_callback(ResponseAccepted.type, callback)
+
+    def on_response_dropped(self, callback: ResponseDroppedCallback) -> ResponseDroppedCallback:
+        """Register the ``response.dropped`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: ResponseDroppedCallback
+        :return: The callback, unchanged.
+        :rtype: ResponseDroppedCallback
+        """
+        return self._register_voice_callback(ResponseDropped.type, callback)
+
+    def on_response_cancelled(self, callback: ResponseCancelledCallback) -> ResponseCancelledCallback:
+        """Register the ``response.cancelled`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: ResponseCancelledCallback
+        :return: The callback, unchanged.
+        :rtype: ResponseCancelledCallback
+        """
+        return self._register_voice_callback(ResponseCancelled.type, callback)
+
+    def on_response_timeout(self, callback: ResponseTimeoutCallback) -> ResponseTimeoutCallback:
+        """Register the ``response.timeout`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: ResponseTimeoutCallback
+        :return: The callback, unchanged.
+        :rtype: ResponseTimeoutCallback
+        """
+        return self._register_voice_callback(ResponseTimeout.type, callback)
+
+    def on_session_end(self, callback: SessionEndCallback) -> SessionEndCallback:
+        """Register the ``session.end`` callback.
+
+        :param callback: Async callback receiving the thin Session and event.
+        :type callback: SessionEndCallback
+        :return: The callback, unchanged.
+        :rtype: SessionEndCallback
+        """
+        return self._register_voice_callback(SessionEnd.type, callback)
+
+    def on_disconnect(self, callback: DisconnectCallback) -> DisconnectCallback:
+        """Register the peer transport-disconnect callback.
+
+        :param callback: Async callback receiving the thin Session and transport event.
+        :type callback: DisconnectCallback
+        :return: The callback, unchanged.
+        :rtype: DisconnectCallback
+        """
+        return self._register_voice_callback("disconnect", callback)
+
+    def on_connection_terminating(self, callback: ConnectionTerminatingCallback) -> ConnectionTerminatingCallback:
+        """Register a synchronous signal that the connection handler is exiting.
+
+        The host invokes the callback once whenever the connection handler
+        unwinds in process. The callback must return promptly, be idempotent,
+        and must not send frames. Applications can use it to synchronously
+        cancel their connection-owned tasks or set their own stop signals. The
+        SDK does not wait for those tasks to finish.
+
+        :param callback: Synchronous callback receiving the thin Session.
+        :type callback: ConnectionTerminatingCallback
+        :return: The callback, unchanged.
+        :rtype: ConnectionTerminatingCallback
+        :raises TypeError: If the callback is async or cannot accept Session.
+        :raises RuntimeError: If a callback is already registered.
+        """
+        try:
+            is_async = _is_async_callable(callback)
+        except ValueError as exc:
+            raise TypeError("on_connection_terminating expects a synchronous function") from exc
+        if is_async:
+            raise TypeError("on_connection_terminating expects a synchronous function")
+        try:
+            inspect.signature(callback).bind(None)
+        except TypeError as exc:
+            raise TypeError("Connection terminating callback must accept Session") from exc
+        if self._connection_terminating_callback is not None:
+            raise RuntimeError("A callback is already registered for connection termination")
+        self._connection_terminating_callback = callback
+        return callback
+
+    def _register_voice_callback(self, message_type: str, callback: _CallbackT) -> _CallbackT:
+        if not inspect.iscoroutinefunction(callback):
+            raise TypeError(f"on_{message_type.replace('.', '_')} expects an async function")
+        try:
+            inspect.signature(callback).bind(None, None)
+        except TypeError as exc:
+            raise TypeError("Voice callbacks must accept Session and event positional arguments") from exc
+        if message_type in self._voice_callbacks:
+            raise RuntimeError(f"A callback is already registered for {message_type}")
+        self._voice_callbacks[message_type] = cast(_VoiceCallback, callback)
+        return cast(_CallbackT, callback)
+
+    def _notify_connection_terminating(self, session: Session) -> BaseException | None:
+        terminating_callback = self._connection_terminating_callback
+        if terminating_callback is None:
+            return None
+        try:
+            result = terminating_callback(session)
+            if result is not None:
+                raise TypeError("Connection terminating callback must return None")
+        except BaseException as exc:  # pylint: disable=broad-exception-caught
+            return exc
+        return None
+
+    async def _notify_peer_disconnect(
+        self,
+        session: Session,
+        event: SessionDisconnected | None,
+    ) -> BaseException | None:
+        callback = self._voice_callbacks.get("disconnect")
+        if callback is None or event is None:
+            return None
+        cancellation_requests = _task_cancellation_requests()
+        try:
+            await callback(session, event)
+        except asyncio.CancelledError as exc:
+            current_requests = _task_cancellation_requests()
+            if (
+                cancellation_requests is not None
+                and current_requests is not None
+                and current_requests > cancellation_requests
+            ):
+                raise
+            return exc
+        except Exception as exc:  # pylint: disable=broad-exception-caught
+            _raise_wrapped_cancellation(exc, cancellation_requests)
+            return exc
+        except BaseException as exc:  # pylint: disable=broad-exception-caught
+            _raise_wrapped_cancellation(exc, cancellation_requests)
+            return exc
+        await _raise_pending_or_consumed_cancellation(cancellation_requests)
+        return None
+
+    async def _handle_voice_connection(self, websocket: WebSocket) -> None:
+        bound_session = Session._current(websocket)  # pylint: disable=protected-access
+        session = bound_session or Session._create(websocket)  # pylint: disable=protected-access
+        try:
+            while True:
+                raw_message = await _receive_voice_transport_message(websocket)
+                raw_type = raw_message.get("type")
+                if raw_type == "websocket.disconnect":
+                    code = int(raw_message.get("code") or 1000)
+                    raw_reason = raw_message.get("reason")
+                    reason = raw_reason if isinstance(raw_reason, str) else None
+                    _select_voice_close_code(websocket, code)
+                    _begin_voice_termination(websocket, session)
+                    websocket.scope.setdefault(
+                        _VOICE_DISCONNECT_EVENT,
+                        SessionDisconnected(code=code, reason=reason),
+                    )
+                    raise WebSocketDisconnect(
+                        code=code,
+                        reason=reason,
+                    )
+                if raw_type != "websocket.receive":
+                    reason = "Invalid Voice WebSocket event"
+                    _raise_voice_disconnect(websocket, 1002, reason)
+                frame = raw_message.get("text")
+                if frame is None:
+                    reason = "Voice messages must be text frames"
+                    _raise_voice_disconnect(websocket, 1003, reason)
+                try:
+                    event = decode_inbound_message(frame)
+                except VoiceProtocolError as exc:
+                    reason = "Invalid Voice message"
+                    try:
+                        _raise_voice_disconnect(websocket, exc.close_code, reason)
+                    except WebSocketDisconnect as disconnect:
+                        raise disconnect from exc
+                if event is None:
+                    continue
+                callback = self._voice_callbacks.get(event.type)
+                if callback is not None:
+                    await _await_with_cancellation_guard(
+                        callback(session, cast(InboundVoiceMessage, event)),
+                        on_success=(
+                            (lambda: _begin_voice_termination(websocket, session))
+                            if isinstance(event, SessionEnd)
+                            else None
+                        ),
+                    )
+                if isinstance(event, SessionEnd):
+                    return
+        finally:
+            _begin_voice_termination(websocket, session)
+            if bound_session is None:
+                Session._release(websocket, session)  # pylint: disable=protected-access
+                termination_error = self._notify_connection_terminating(session)
+                disconnect_error = await self._notify_peer_disconnect(
+                    session,
+                    _take_voice_disconnect_event(websocket),
+                )
+                if termination_error is not None:
+                    try:
+                        logger.error("Voice connection termination callback failed", exc_info=termination_error)
+                    except BaseException:  # pylint: disable=broad-exception-caught
+                        pass
+                if disconnect_error is not None:
+                    try:
+                        logger.error("Voice disconnect callback failed", exc_info=disconnect_error)
+                    except BaseException:  # pylint: disable=broad-exception-caught
+                        pass
+
+    def _build_hypercorn_config(self, host: str, port: int) -> object:
+        """Create a Hypercorn config with the Voice frame admission limit.
+
+        :param host: Network interface to bind.
+        :type host: str
+        :param port: Port to bind.
+        :type port: int
+        :return: Configured Hypercorn config.
+        :rtype: hypercorn.config.Config
+        """
+        config = super()._build_hypercorn_config(host, port)
+        setattr(config, "websocket_max_message_size", MAX_FRAME_BYTES)
+        return config
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/pyproject.toml b/sdk/agentserver/azure-ai-agentserver-invocations/pyproject.toml
index 8293c85afe13..b581cf85f5df 100644
--- a/sdk/agentserver/azure-ai-agentserver-invocations/pyproject.toml
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/pyproject.toml
@@ -22,6 +22,7 @@ keywords = ["azure", "azure sdk", "agent", "agentserver", "invocations"]
 
 dependencies = [
     "azure-ai-agentserver-core>=2.1.0b1",
+    "azure-core>=1.37.0",
     # Constraint on the transitive aiohttp: the `--pre` CI install otherwise
     # resolves the unbuildable aiohttp 4.0.0a1 alpha. Cap must be <4.0.0a0
     # (<4.0.0 still admits 4.0.0a1 under PEP 440).
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/README.md b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/README.md
new file mode 100644
index 000000000000..330e09b76eb9
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/README.md
@@ -0,0 +1,57 @@
+# Basic Voice Agent
+
+This sample hosts a text-only agent for the Voice Live Bridge protocol `1.0`.
+The SDK relays typed events while the application owns response generation,
+task cancellation, and correlation.
+
+## Prerequisites
+
+- Python 3.10 or later
+- A deployed hosted agent configured for the Voice Live Bridge
+
+## Install
+
+Create and activate a virtual environment, then install the sample dependency:
+
+```bash
+python -m venv .venv
+source .venv/bin/activate  # Windows: .venv\Scripts\activate
+python -m pip install -r requirements.txt
+```
+
+For local SDK development, install the sibling packages or their wheels instead
+of the published dependency:
+
+```bash
+python -m pip install \
+  /path/to/azure_ai_agentserver_core-2.1.0b1-py3-none-any.whl \
+  /path/to/azure_ai_agentserver_invocations-1.1.0b2-py3-none-any.whl
+```
+
+## Run
+
+```bash
+python basic_voice_agent.py
+```
+
+The server listens on `0.0.0.0` and uses the `PORT` environment variable when
+set; otherwise it listens on port `8088`. The hosted platform connects to the
+`/invocations_ws` route.
+
+## Deploy
+
+Use the accompanying `agent.manifest.yaml` when configuring the hosted agent.
+The three declarations are required together: `invocations_ws`,
+`voiceLiveCompatible: "true"`, and exact `bridgeProtocolVersion: "1.0"`.
+Omitting the version selects the previously shipped non-Bridge integration.
+
+The sample intentionally uses a simulated model stream. Replace
+`generate_answer` with the application's model call while preserving the
+application-owned task cleanup shown by the event callbacks.
+
+`on_connection_terminating` synchronously cancels the sample's generation tasks
+whenever the connection handler exits. The tasks remain responsible for their
+own asynchronous resource cleanup, while `on_session_end` provides the graceful
+path that also waits for them. The termination callback must stay non-blocking;
+the SDK does not join application tasks or guarantee cleanup after process
+termination.
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/agent.manifest.yaml b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/agent.manifest.yaml
new file mode 100644
index 000000000000..60529d7c861b
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/agent.manifest.yaml
@@ -0,0 +1,5 @@
+name: basic-voice-agent
+protocols:
+  - invocations_ws
+voiceLiveCompatible: "true"
+bridgeProtocolVersion: "1.0"
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/basic_voice_agent.py b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/basic_voice_agent.py
new file mode 100644
index 000000000000..1e352a982d46
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/basic_voice_agent.py
@@ -0,0 +1,219 @@
+"""Basic full-duplex Voice Live Bridge agent using the Invocations submodule.
+
+The Voice SDK only decodes events, dispatches callbacks, and serializes
+``Session.send`` calls. This sample deliberately owns its generation tasks and
+terminal-event correlation in application code.
+"""
+
+import asyncio
+import logging
+from collections.abc import AsyncIterator
+from dataclasses import dataclass
+
+from azure.ai.agentserver.invocations.voice import (
+    BargeIn,
+    InputTextPart,
+    ResponseCancelled,
+    ResponseCreated,
+    ResponseDone,
+    ResponseNone,
+    ResponseOutputTextDelta,
+    ResponseOutputTextDone,
+    ResponseTimeout,
+    Session,
+    SessionDisconnected,
+    SessionEnd,
+    SessionReady,
+    SessionRejected,
+    SessionStart,
+    UserMessage,
+    VoiceAgentServerHost,
+    new_item_id,
+    new_response_id,
+)
+
+logger = logging.getLogger("azure.ai.agentserver")
+app = VoiceAgentServerHost()
+SUPPORTED_PROTOCOL_VERSION = "1.0"
+
+
+@dataclass(frozen=True)
+class Generation:
+    """Application-owned generation task and its input correlation."""
+
+    session: Session
+    input_ids: tuple[str, ...]
+    task: asyncio.Task[None]
+
+
+GenerationKey = tuple[int, str]
+
+generations: dict[GenerationKey, Generation] = {}
+input_generations: dict[tuple[int, str], GenerationKey] = {}
+
+
+async def generate_answer(text: str) -> AsyncIterator[str]:
+    """Simulate a streaming model response."""
+    for chunk in ("You said: ", text):
+        await asyncio.sleep(0.1)
+        yield chunk
+
+
+async def stream_response(
+    session: Session,
+    *,
+    response_id: str,
+    item_id: str,
+    in_reply_to: tuple[str, ...],
+    text: str,
+) -> None:
+    """Translate one model stream into explicit Bridge output events."""
+    await session.send(ResponseCreated(response_id=response_id, in_reply_to=in_reply_to))
+    chunks: list[str] = []
+    async for delta in generate_answer(text):
+        chunks.append(delta)
+        await session.send(
+            ResponseOutputTextDelta(
+                response_id=response_id,
+                item_id=item_id,
+                delta=delta,
+            )
+        )
+    await session.send(
+        ResponseOutputTextDone(
+            response_id=response_id,
+            item_id=item_id,
+            text="".join(chunks),
+        )
+    )
+    await session.send(ResponseDone(response_id=response_id))
+
+
+def generation_finished(key: GenerationKey, completed: asyncio.Task[None]) -> None:
+    """Release application correlation and observe task failures."""
+    generation = generations.get(key)
+    if generation is None or generation.task is not completed:
+        return
+    del generations[key]
+    for input_id in generation.input_ids:
+        input_key = (id(generation.session), input_id)
+        if input_generations.get(input_key) == key:
+            del input_generations[input_key]
+    if not completed.cancelled() and (exception := completed.exception()) is not None:
+        logger.error(
+            "Voice response generation failed",
+            exc_info=(type(exception), exception, exception.__traceback__),
+        )
+
+
+def cancel_generation(session: Session, response_id: str) -> None:
+    """Cancel one application-owned generation task when present."""
+    generation = generations.get((id(session), response_id))
+    if generation is not None:
+        generation.task.cancel()
+
+
+def cancel_session_generation_tasks(session: Session) -> tuple[asyncio.Task[None], ...]:
+    """Synchronously signal every application-owned task for one connection."""
+    tasks = tuple(generation.task for generation in tuple(generations.values()) if generation.session is session)
+    for task in tasks:
+        task.cancel()
+    return tasks
+
+
+async def cancel_session_generations(session: Session) -> None:
+    """Cancel and join all application-owned tasks for one connection."""
+    tasks = cancel_session_generation_tasks(session)
+    if tasks:
+        await asyncio.gather(*tasks, return_exceptions=True)
+
+
+@app.on_session_start
+async def on_session_start(session: Session, event: SessionStart) -> None:
+    """Restore application state when needed, then acknowledge readiness."""
+    if event.protocol_version != SUPPORTED_PROTOCOL_VERSION:
+        await session.send(SessionRejected(code="protocol_mismatch", retriable=False))
+        return
+    if event.reconnect:
+        logger.info("Voice transport reattached; restore durable application state here")
+    await session.send(SessionReady())
+
+
+@app.on_user_message
+async def on_user_message(session: Session, event: UserMessage) -> None:
+    """Start generation without blocking later full-duplex control events."""
+    text = " ".join(part.text for part in event.content if isinstance(part, InputTextPart))
+    if not text:
+        await session.send(ResponseNone(in_reply_to=(event.item_id,), reason="no_reply_needed"))
+        return
+
+    response_id = new_response_id()
+    item_id = new_item_id()
+    input_ids = (event.item_id,)
+    key = (id(session), response_id)
+    task = asyncio.create_task(
+        stream_response(
+            session,
+            response_id=response_id,
+            item_id=item_id,
+            in_reply_to=input_ids,
+            text=text,
+        ),
+        name=f"voice-response-{response_id}",
+    )
+    generations[key] = Generation(session=session, input_ids=input_ids, task=task)
+    input_generations[(id(session), event.item_id)] = key
+
+    def on_generation_finished(completed: asyncio.Task[None]) -> None:
+        generation_finished(key, completed)
+
+    task.add_done_callback(on_generation_finished)
+
+
+@app.on_barge_in
+async def on_barge_in(session: Session, event: BargeIn) -> None:
+    """Stop generation and reconcile history from the playback snapshot."""
+    cancel_generation(session, event.response_id)
+    logger.info("Caller heard %d characters before barge-in", len(event.heard_text))
+
+
+@app.on_response_cancelled
+async def on_response_cancelled(session: Session, event: ResponseCancelled) -> None:
+    """Handle the terminal outcome of an explicit self-cancel request."""
+    cancel_generation(session, event.response_id)
+
+
+@app.on_response_timeout
+async def on_response_timeout(session: Session, event: ResponseTimeout) -> None:
+    """Stop the application task targeted by the Bridge timeout."""
+    if event.response_id is not None:
+        cancel_generation(session, event.response_id)
+        return
+    for input_id in event.item_ids or ():
+        key = input_generations.get((id(session), input_id))
+        if key is not None and (generation := generations.get(key)) is not None:
+            generation.task.cancel()
+
+
+@app.on_session_end
+async def on_session_end(session: Session, event: SessionEnd) -> None:
+    """Cancel and join all application tasks for this connection."""
+    logger.info("Voice session ended: %s", event.reason)
+    await cancel_session_generations(session)
+
+
+@app.on_disconnect
+async def on_disconnect(session: Session, event: SessionDisconnected) -> None:
+    """Observe a peer transport disconnect."""
+    del session
+    logger.info("Voice transport disconnected with close code %d", event.code)
+
+
+@app.on_connection_terminating
+def on_connection_terminating(session: Session) -> None:
+    """Synchronously cancel application tasks whenever the handler exits."""
+    cancel_session_generation_tasks(session)
+
+
+if __name__ == "__main__":
+    app.run()
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/requirements.txt b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/requirements.txt
new file mode 100644
index 000000000000..3c4ceb9ef4bf
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/samples/basic_voice_agent/requirements.txt
@@ -0,0 +1 @@
+azure-ai-agentserver-invocations>=1.1.0b2
\ No newline at end of file
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_basic_voice_agent.py b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_basic_voice_agent.py
new file mode 100644
index 000000000000..296c0c507ffc
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_basic_voice_agent.py
@@ -0,0 +1,182 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Behavior tests for the developer-owned lifecycle in the basic Voice sample."""
+
+import asyncio
+import importlib.util
+import sys
+from pathlib import Path
+
+import pytest
+import yaml
+
+import azure.ai.agentserver.invocations.voice as voice
+from azure.ai.agentserver.invocations.voice import (
+    InputTextPart,
+    ResponseTimeouts,
+    SessionDisconnected,
+    SessionEnd,
+    SessionReady,
+    SessionRejected,
+    SessionStart,
+    UserMessage,
+)
+
+_SAMPLE_ROOT = Path(__file__).parents[2] / "samples" / "basic_voice_agent"
+
+
+class _CapturingSession:
+    def __init__(self):
+        self.messages = []
+
+    async def send(self, message):
+        self.messages.append(message)
+
+
+@pytest.fixture
+def sample_module(monkeypatch):
+    class QuietVoiceAgentServerHost(voice.VoiceAgentServerHost):
+        def __init__(self, **kwargs):
+            kwargs["configure_observability"] = None
+            super().__init__(**kwargs)
+
+    monkeypatch.setattr(voice, "VoiceAgentServerHost", QuietVoiceAgentServerHost)
+    module_name = "_basic_voice_agent_sample"
+    sys.modules.pop(module_name, None)
+    spec = importlib.util.spec_from_file_location(module_name, _SAMPLE_ROOT / "basic_voice_agent.py")
+    if spec is None or spec.loader is None:
+        raise RuntimeError("Unable to load the basic Voice sample")
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[module_name] = module
+    try:
+        spec.loader.exec_module(module)
+        yield module
+    finally:
+        if hasattr(module, "generations"):
+            module.generations.clear()
+        if hasattr(module, "input_generations"):
+            module.input_generations.clear()
+        sys.modules.pop(module_name, None)
+
+
+def _session_start(protocol_version):
+    return SessionStart(
+        id="m_start",
+        ts="2026-08-12T00:00:00Z",
+        protocol_version=protocol_version,
+        reconnect=False,
+        response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+    )
+
+
+def test_sample_includes_setup_run_and_bridge_manifest():
+    readme = (_SAMPLE_ROOT / "README.md").read_text(encoding="utf-8")
+    requirements = (_SAMPLE_ROOT / "requirements.txt").read_text(encoding="utf-8").splitlines()
+    assert "python -m pip install -r requirements.txt" in readme
+    assert "python basic_voice_agent.py" in readme
+    assert "/invocations_ws" in readme
+    assert requirements == ["azure-ai-agentserver-invocations>=1.1.0b2"]
+
+    manifest = yaml.safe_load((_SAMPLE_ROOT / "agent.manifest.yaml").read_text(encoding="utf-8"))
+    assert manifest["protocols"] == ["invocations_ws"]
+    assert manifest["voiceLiveCompatible"] == "true"
+    assert manifest["bridgeProtocolVersion"] == "1.0"
+
+
+@pytest.mark.asyncio
+async def test_session_start_accepts_only_the_supported_protocol(sample_module):
+    unsupported_session = _CapturingSession()
+    await sample_module.on_session_start(unsupported_session, _session_start("2.0"))
+    assert len(unsupported_session.messages) == 1
+    rejection = unsupported_session.messages[0]
+    assert isinstance(rejection, SessionRejected)
+    assert rejection.code == "protocol_mismatch"
+    assert rejection.retriable is False
+
+    supported_session = _CapturingSession()
+    await sample_module.on_session_start(supported_session, _session_start("1.0"))
+    assert len(supported_session.messages) == 1
+    assert isinstance(supported_session.messages[0], SessionReady)
+
+
+@pytest.mark.asyncio
+async def test_connection_termination_cancels_sample_owned_generation(sample_module, monkeypatch):
+    generation_started = asyncio.Event()
+    generation_release = asyncio.Event()
+
+    async def blocked_generation(_text):
+        generation_started.set()
+        await generation_release.wait()
+        yield "not reached"
+
+    monkeypatch.setattr(sample_module, "generate_answer", blocked_generation)
+    session = _CapturingSession()
+    await sample_module.on_user_message(
+        session,
+        UserMessage(
+            id="m_user",
+            ts="2026-08-12T00:00:00Z",
+            item_id="in_1",
+            content=(InputTextPart(text="hello"),),
+        ),
+    )
+    await asyncio.wait_for(generation_started.wait(), timeout=1)
+    generation = next(iter(sample_module.generations.values()))
+
+    await sample_module.on_disconnect(session, SessionDisconnected(code=1006))
+    assert not generation.task.done()
+
+    sample_module.on_connection_terminating(session)
+
+    with pytest.raises(asyncio.CancelledError):
+        await generation.task
+    await asyncio.sleep(0)
+
+    assert generation.task.cancelled()
+    assert not sample_module.generations
+    assert not sample_module.input_generations
+
+
+@pytest.mark.asyncio
+async def test_session_end_joins_cleanup_before_later_termination_signals(sample_module, monkeypatch):
+    generation_started = asyncio.Event()
+    cleanup_finished = asyncio.Event()
+
+    async def blocked_generation(_text):
+        generation_started.set()
+        try:
+            await asyncio.Future()
+        finally:
+            cleanup_finished.set()
+        yield "not reached"
+
+    monkeypatch.setattr(sample_module, "generate_answer", blocked_generation)
+    session = _CapturingSession()
+    await sample_module.on_user_message(
+        session,
+        UserMessage(
+            id="m_user",
+            ts="2026-08-12T00:00:00Z",
+            item_id="in_1",
+            content=(InputTextPart(text="hello"),),
+        ),
+    )
+    await asyncio.wait_for(generation_started.wait(), timeout=1)
+    generation = next(iter(sample_module.generations.values()))
+
+    await sample_module.on_session_end(
+        session,
+        SessionEnd(id="m_end", ts="2026-08-12T00:00:01Z", reason="completed"),
+    )
+
+    assert cleanup_finished.is_set()
+    assert generation.task.cancelled()
+    assert not sample_module.generations
+    assert not sample_module.input_generations
+
+    await sample_module.on_disconnect(session, SessionDisconnected(code=1000))
+    sample_module.on_connection_terminating(session)
+
+    assert not sample_module.generations
+    assert not sample_module.input_generations
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_codec.py b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_codec.py
new file mode 100644
index 000000000000..257c95075080
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_codec.py
@@ -0,0 +1,815 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Tests for context-free Voice message decoding and encoding."""
+
+import dataclasses
+import inspect
+import json
+from types import MappingProxyType
+
+import pytest
+
+import azure.ai.agentserver.invocations.voice as voice
+from azure.ai.agentserver.invocations.voice import (
+    AgentError,
+    BargeIn,
+    EndCall,
+    InputTextPart,
+    ResponseCancel,
+    ResponseCancelled,
+    ResponseCreated,
+    ResponseDone,
+    ResponseNone,
+    ResponseOutputTextDelta,
+    ResponseOutputTextDone,
+    ResponseTimeout,
+    ResponseTimeouts,
+    SessionDisconnected,
+    SessionReady,
+    SessionRejected,
+    SessionStart,
+    UserMessage,
+)
+from azure.ai.agentserver.invocations.voice._codec import (
+    VoiceProtocolError,
+    VoiceUnsupportedMessageError,
+    decode_inbound_message,
+    encode_outbound_message,
+)
+from azure.ai.agentserver.invocations.voice._models import InboundVoiceMessage, OutboundVoiceMessage
+
+
+def _frame(message_type: str, **fields):
+    return json.dumps(
+        {
+            "type": message_type,
+            "id": "m_1",
+            "ts": "2026-08-12T00:00:00Z",
+            **fields,
+        }
+    )
+
+
+@pytest.mark.parametrize(
+    "frame",
+    [
+        _frame(
+            "session.start",
+            protocol_version="1.0",
+            reconnect=False,
+            response_timeouts={"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+        ),
+        _frame("user.message", item_id="in_1", content=[{"type": "input_text", "text": "hello"}]),
+        _frame("user.no_input", item_id="in_2", count=1),
+        _frame("user.speech_started"),
+        _frame("barge_in", response_id="r_1", heard_text="heard"),
+        _frame("response.accepted", response_id="r_2"),
+        _frame("response.dropped", response_id="r_3", reason="queue_full"),
+        _frame("response.cancelled", response_id="r_4", heard_text="heard"),
+        _frame("response.timeout", item_ids=["in_3"], stage="first_output"),
+        _frame("session.end", reason="caller_hangup"),
+    ],
+)
+def test_decode_all_selected_inbound_messages(frame):
+    event = decode_inbound_message(frame)
+    assert event is not None
+    assert dataclasses.is_dataclass(event)
+    assert event.id == "m_1"
+
+
+def test_session_start_caller_is_deeply_read_only():
+    event = decode_inbound_message(
+        _frame(
+            "session.start",
+            protocol_version="1.0",
+            reconnect=False,
+            response_timeouts={"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+            caller={"custom_parameters": {"campaign": ["renewal"]}},
+        )
+    )
+    assert event is not None
+    assert isinstance(event.caller, MappingProxyType)
+    custom_parameters = event.caller["custom_parameters"]
+    assert isinstance(custom_parameters, MappingProxyType)
+    assert custom_parameters["campaign"] == ("renewal",)
+
+
+def test_direct_session_start_caller_is_deeply_immutable():
+    caller = {"custom_parameters": {"campaign": ["renewal"]}}
+    event = SessionStart(
+        id="m_1",
+        ts="2026-08-12T00:00:00Z",
+        protocol_version="1.0",
+        reconnect=False,
+        response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+        caller=caller,
+    )
+
+    caller["custom_parameters"]["campaign"].append("changed")
+    caller["custom_parameters"]["new_field"] = "changed"
+
+    assert isinstance(event.caller, MappingProxyType)
+    custom_parameters = event.caller["custom_parameters"]
+    assert isinstance(custom_parameters, MappingProxyType)
+    assert custom_parameters == {"campaign": ("renewal",)}
+    with pytest.raises(TypeError):
+        custom_parameters["campaign"] = ("changed",)
+
+
+def test_direct_session_start_copies_pre_frozen_caller_mapping():
+    source = {"custom_parameters": {"campaign": ("renewal",)}}
+    caller = MappingProxyType(source)
+    event = SessionStart(
+        id="m_1",
+        ts="2026-08-12T00:00:00Z",
+        protocol_version="1.0",
+        reconnect=False,
+        response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+        caller=caller,
+    )
+
+    source["custom_parameters"]["campaign"] = ("changed",)
+
+    assert event.caller == {"custom_parameters": {"campaign": ("renewal",)}}
+    assert event.caller is not caller
+
+
+def test_direct_session_start_accepts_absent_caller():
+    event = SessionStart(
+        id="m_1",
+        ts="2026-08-12T00:00:00Z",
+        protocol_version="1.0",
+        reconnect=False,
+        response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+    )
+
+    assert event.caller is None
+
+
+@pytest.mark.parametrize("caller", [["value"], "value", 1, True])
+def test_direct_session_start_rejects_non_mapping_caller(caller):
+    with pytest.raises(TypeError, match="caller must be a mapping"):
+        SessionStart(
+            id="m_1",
+            ts="2026-08-12T00:00:00Z",
+            protocol_version="1.0",
+            reconnect=False,
+            response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+            caller=caller,
+        )
+
+
+@pytest.mark.parametrize("value", [float("nan"), float("inf"), float("-inf")])
+def test_direct_session_start_rejects_non_finite_caller_number(value):
+    with pytest.raises(TypeError, match="caller must contain only finite numbers"):
+        SessionStart(
+            id="m_1",
+            ts="2026-08-12T00:00:00Z",
+            protocol_version="1.0",
+            reconnect=False,
+            response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+            caller={"custom_parameters": {"values": [value]}},
+        )
+
+    event = SessionStart(
+        id="m_1",
+        ts="2026-08-12T00:00:00Z",
+        protocol_version="1.0",
+        reconnect=False,
+        response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+        caller={"custom_parameters": {"values": [1.5]}},
+    )
+    assert event.caller == {"custom_parameters": {"values": (1.5,)}}
+
+
+@pytest.mark.parametrize("value", [-1.5, 0.0, 1.5])
+def test_direct_session_start_accepts_finite_caller_number(value):
+    event = SessionStart(
+        id="m_1",
+        ts="2026-08-12T00:00:00Z",
+        protocol_version="1.0",
+        reconnect=False,
+        response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+        caller={"value": value},
+    )
+
+    assert event.caller == {"value": value}
+
+
+def test_direct_session_start_caller_freeze_failure_allows_retry():
+    fields = {
+        "id": "m_1",
+        "ts": "2026-08-12T00:00:00Z",
+        "protocol_version": "1.0",
+        "reconnect": False,
+        "response_timeouts": ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+    }
+
+    with pytest.raises(TypeError, match="caller must contain only JSON-compatible values"):
+        SessionStart(**fields, caller={"custom_parameters": {"invalid"}})
+
+    event = SessionStart(**fields, caller={"custom_parameters": {"campaign": ["renewal"]}})
+    assert event.caller == {"custom_parameters": {"campaign": ("renewal",)}}
+
+
+@pytest.mark.parametrize(
+    "caller",
+    [
+        {"authorization": "Bearer customer-secret"},
+        {"custom_parameters": {"api_key": "customer-secret"}},
+        {"future_context": [{"client-secret": "customer-secret"}]},
+        {"future_context": {"proxy_authorization": "Bearer customer-secret"}},
+        {"future_context": {"azureApiKey": "customer-secret"}},
+        {"future_context": {"bearer_token": "customer-secret"}},
+        {"future_context": {"auth_token": "customer-secret"}},
+        {"future_context": {"apiToken": "customer-secret"}},
+        {"future_context": {"secretValue": "customer-secret"}},
+        {"future_context": {"authorizationHeader": "Bearer customer-secret"}},
+        {"future_context": {"sas_url": "https://example.test/?sig=customer-secret"}},
+        {"future_context": {"APIKey": "customer-secret"}},
+        {"future_context": {"APIKEY": "customer-secret"}},
+        {"future_context": {"SASUrl": "https://example.test/?sig=customer-secret"}},
+        {"future_context": {"SASURL": "https://example.test/?sig=customer-secret"}},
+        {"future_context": {"ClientSecret": "customer-secret"}},
+        {"future_context": {"CLIENTSECRET": "customer-secret"}},
+        {"future_context": {"AUTHORIZATIONHEADER": "Bearer customer-secret"}},
+        {"future_context": {"AZUREAPIKEY": "customer-secret"}},
+        {"future_context": {"PROXYAUTHORIZATION": "Bearer customer-secret"}},
+        {"future_context": {"XAPITOKEN": "customer-secret"}},
+        {"future_context": {"SERVICECLIENTSECRET": "customer-secret"}},
+        {"future_context": {"PROXYSECRET": "customer-secret"}},
+        {"future_context": {"AZURESAS": "customer-secret"}},
+        {"future_context": {"AZUREPWD": "customer-secret"}},
+        {"future_context": {"password_count": 1}},
+        {"future_context": {"password-count": 1}},
+        {"future_context": {"passwordCount": 1}},
+        {"future_context": {"PasswordCount": 1}},
+        {"future_context": {"PASSWORDCOUNT": 1}},
+    ],
+)
+def test_session_start_rejects_credential_bearing_caller_context(caller):
+    with pytest.raises(VoiceProtocolError, match="must not contain credentials"):
+        decode_inbound_message(
+            _frame(
+                "session.start",
+                protocol_version="1.0",
+                reconnect=False,
+                response_timeouts={"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+                caller=caller,
+            )
+        )
+
+
+def test_session_start_preserves_safe_open_caller_context():
+    event = decode_inbound_message(
+        _frame(
+            "session.start",
+            protocol_version="1.0",
+            reconnect=False,
+            response_timeouts={"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+            caller={
+                "future_context": {
+                    "token_count": 7,
+                    "secretary_name": "Ada",
+                    "SECRETARYNAME": "Grace",
+                    "apiVersion": "2026-08-13",
+                    "APIStatus": "available",
+                    "KANSAS": "Wichita",
+                    "sessionId": "session-1",
+                    "sasquatch": True,
+                }
+            },
+        )
+    )
+
+    assert event is not None
+    assert event.caller == {
+        "future_context": {
+            "token_count": 7,
+            "secretary_name": "Ada",
+            "SECRETARYNAME": "Grace",
+            "apiVersion": "2026-08-13",
+            "APIStatus": "available",
+            "KANSAS": "Wichita",
+            "sessionId": "session-1",
+            "sasquatch": True,
+        }
+    }
+
+
+def test_session_start_rejects_invalid_unicode_in_caller_key():
+    with pytest.raises(VoiceProtocolError, match="invalid Unicode"):
+        decode_inbound_message(
+            _frame(
+                "session.start",
+                protocol_version="1.0",
+                reconnect=False,
+                response_timeouts={"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+                caller={"\ud800": "value"},
+            )
+        )
+
+
+@pytest.mark.parametrize("reconnect", [False, True])
+def test_session_start_rejects_explicit_null_greeting(reconnect):
+    with pytest.raises(VoiceProtocolError, match="greeting"):
+        decode_inbound_message(
+            _frame(
+                "session.start",
+                protocol_version="1.0",
+                reconnect=reconnect,
+                greeting=None,
+                response_timeouts={"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+            )
+        )
+
+
+def test_session_start_reconnect_rejects_present_greeting():
+    with pytest.raises(VoiceProtocolError, match="must be absent on reconnect"):
+        decode_inbound_message(
+            _frame(
+                "session.start",
+                protocol_version="1.0",
+                reconnect=True,
+                greeting="welcome back",
+                response_timeouts={"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+            )
+        )
+
+
+def test_selected_registry_is_exactly_ten_each_direction():
+    inbound = InboundVoiceMessage.__args__
+    outbound = OutboundVoiceMessage.__args__
+    assert len(inbound) == 10
+    assert len(outbound) == 10
+    assert len({message.type for message in inbound}) == 10
+    assert len({message.type for message in outbound}) == 10
+
+
+def test_all_public_voice_callables_are_experimental():
+    missing = []
+    for name in voice.__all__:
+        value = getattr(voice, name)
+        if (inspect.isclass(value) or inspect.isfunction(value)) and "This is an experimental" not in (
+            value.__doc__ or ""
+        ):
+            missing.append(name)
+    assert not missing
+
+
+def test_codec_exceptions_are_not_exported_from_public_voice_namespace():
+    assert not hasattr(voice, "VoiceProtocolError")
+    assert not hasattr(voice, "VoiceUnsupportedMessageError")
+
+
+def test_all_public_voice_dataclasses_share_safe_repr():
+    public_models = [getattr(voice, name) for name in voice.__all__ if dataclasses.is_dataclass(getattr(voice, name))]
+    assert public_models
+    assert all(model.__repr__.__name__ == "_voice_model_repr" for model in public_models)
+
+
+def test_voice_model_repr_redacts_sensitive_payloads():
+    sensitive = "customer-secret-value"
+    ani = "+14255550123"
+    models = [
+        SessionStart(
+            id="m_1",
+            ts="2026-08-12T00:00:00Z",
+            protocol_version="1.0",
+            reconnect=False,
+            response_timeouts=ResponseTimeouts(first_output_ms=1, idle_ms=2, max_duration_ms=3),
+            greeting=sensitive,
+            caller={"ani": ani, "custom_parameters": {"secret": sensitive}},
+        ),
+        UserMessage(
+            id="m_2",
+            ts="2026-08-12T00:00:00Z",
+            item_id="in_1",
+            content=(InputTextPart(text=sensitive),),
+        ),
+        BargeIn(
+            id="m_3",
+            ts="2026-08-12T00:00:00Z",
+            response_id="r_1",
+            heard_text=sensitive,
+        ),
+        ResponseCancelled(
+            id="m_4",
+            ts="2026-08-12T00:00:00Z",
+            response_id="r_1",
+            heard_text=sensitive,
+        ),
+        SessionDisconnected(code=1006, reason=sensitive),
+        SessionRejected(code="startup_failed", retriable=False, message=sensitive),
+        ResponseOutputTextDelta(
+            response_id="r_1",
+            item_id="it_1",
+            delta=sensitive,
+            voice={"custom_lexicon_url": f"https://example.test/?sig={sensitive}"},
+        ),
+        ResponseOutputTextDone(response_id="r_1", item_id="it_1", text=sensitive),
+        AgentError(code="backend_error", message=sensitive),
+    ]
+
+    for model in models:
+        rendered = repr(model)
+        assert rendered.startswith(f"{type(model).__name__}(")
+        assert len(rendered) <= 1024
+        assert "<redacted>" in rendered
+        assert sensitive not in rendered
+        assert ani not in rendered
+
+
+def test_voice_model_repr_is_bounded_for_large_identifier_collections():
+    event = ResponseTimeout(
+        id="m_1",
+        ts="2026-08-12T00:00:00Z",
+        stage="first_output",
+        item_ids=tuple(f"in_{index}_{'x' * 250}" for index in range(100)),
+    )
+
+    rendered = repr(event)
+    assert rendered.startswith("ResponseTimeout(")
+    assert "stage='first_output'" in rendered
+    assert len(rendered) <= 1024
+
+
+def test_outbound_voice_mapping_is_deeply_immutable_and_alias_is_normalized():
+    voice = {"type": "azure-platform", "name": "en-US-Ava", "prefer_locales": ["en-US"]}
+    event = ResponseOutputTextDelta(response_id="r_1", item_id="it_1", delta="hello", voice=voice)
+
+    voice["type"] = "not-a-voice"
+    voice["prefer_locales"].append("fr-FR")
+    assert event.voice == {"type": "azure-platform", "name": "en-US-Ava", "prefer_locales": ("en-US",)}
+    with pytest.raises(TypeError):
+        event.voice["name"] = "changed"
+
+    encoded = json.loads(encode_outbound_message(event))
+    assert encoded["voice"] == {"type": "azure-standard", "name": "en-US-Ava", "prefer_locales": ["en-US"]}
+
+
+@pytest.mark.parametrize(
+    "voice",
+    [
+        {"type": "not-a-voice"},
+        {"type": 1},
+        {},
+    ],
+)
+def test_outbound_voice_rejects_invalid_configuration(voice):
+    event = ResponseOutputTextDone(response_id="r_1", item_id="it_1", text="hello", voice=voice)
+
+    with pytest.raises((TypeError, ValueError)):
+        encode_outbound_message(event)
+
+
+@pytest.mark.parametrize(
+    ("voice", "error_type", "message"),
+    [
+        pytest.param({"name": None}, TypeError, "voice.name must be a string", id="name-null"),
+        pytest.param({"name": 42}, TypeError, "voice.name must be a string", id="name-type"),
+        pytest.param({"name": ""}, ValueError, "voice.name must be non-empty", id="name-empty"),
+        pytest.param(
+            {"endpoint_id": None},
+            TypeError,
+            "voice.endpoint_id must be a string",
+            id="endpoint-null",
+        ),
+        pytest.param(
+            {"endpoint_id": 123},
+            TypeError,
+            "voice.endpoint_id must be a string",
+            id="endpoint-type",
+        ),
+        pytest.param(
+            {"endpoint_id": ""},
+            ValueError,
+            "voice.endpoint_id must be non-empty",
+            id="endpoint-empty",
+        ),
+        pytest.param({"model": None}, TypeError, "voice.model must be a string", id="model-null"),
+        pytest.param({"model": []}, TypeError, "voice.model must be a string", id="model-type"),
+        pytest.param(
+            {"temperature": True},
+            TypeError,
+            "voice.temperature must be a number or null",
+            id="temperature-bool",
+        ),
+        pytest.param(
+            {"temperature": "0.5"},
+            TypeError,
+            "voice.temperature must be a number or null",
+            id="temperature-type",
+        ),
+        pytest.param(
+            {"temperature": float("nan")},
+            VoiceProtocolError,
+            "Voice frame contains a non-finite number",
+            id="temperature-nan",
+        ),
+        pytest.param(
+            {"temperature": float("inf")},
+            VoiceProtocolError,
+            "Voice frame contains a non-finite number",
+            id="temperature-positive-inf",
+        ),
+        pytest.param(
+            {"temperature": float("-inf")},
+            VoiceProtocolError,
+            "Voice frame contains a non-finite number",
+            id="temperature-negative-inf",
+        ),
+        pytest.param(
+            {"temperature": -0.01},
+            ValueError,
+            "voice.temperature must be between 0.0 and 1.0",
+            id="temperature-low",
+        ),
+        pytest.param(
+            {"temperature": 1.01},
+            ValueError,
+            "voice.temperature must be between 0.0 and 1.0",
+            id="temperature-high",
+        ),
+        pytest.param(
+            {"locale": 1},
+            TypeError,
+            "voice.locale must be a string or null",
+            id="locale-type",
+        ),
+        pytest.param(
+            {"style": False},
+            TypeError,
+            "voice.style must be a string or null",
+            id="style-type",
+        ),
+        pytest.param(
+            {"pitch": []},
+            TypeError,
+            "voice.pitch must be a string or null",
+            id="pitch-type",
+        ),
+        pytest.param(
+            {"rate": {}},
+            TypeError,
+            "voice.rate must be a string or null",
+            id="rate-type",
+        ),
+        pytest.param(
+            {"volume": 1.0},
+            TypeError,
+            "voice.volume must be a string or null",
+            id="volume-type",
+        ),
+        pytest.param(
+            {"custom_lexicon_url": 1},
+            TypeError,
+            "voice.custom_lexicon_url must be a string or null",
+            id="lexicon-type",
+        ),
+        pytest.param(
+            {"custom_text_normalization_url": []},
+            TypeError,
+            "voice.custom_text_normalization_url must be a string or null",
+            id="normalization-type",
+        ),
+        pytest.param(
+            {"multi_talker_speaker_name": 1},
+            TypeError,
+            "voice.multi_talker_speaker_name must be a string or null",
+            id="speaker-type",
+        ),
+        pytest.param(
+            {"prefer_locales": "en-US"},
+            TypeError,
+            "voice.prefer_locales must be an array of strings or null",
+            id="locales-type",
+        ),
+        pytest.param(
+            {"prefer_locales": ["en-US", 1]},
+            TypeError,
+            "voice.prefer_locales must be an array of strings or null",
+            id="locale-item-type",
+        ),
+    ],
+)
+def test_outbound_voice_rejects_invalid_known_field(voice, error_type, message):
+    event = ResponseOutputTextDone(response_id="r_1", item_id="it_1", text="hello", voice=voice)
+
+    with pytest.raises(error_type, match=message):
+        encode_outbound_message(event)
+
+
+@pytest.mark.parametrize("temperature", [0, 0.0, 0.5, 1, 1.0, None])
+def test_outbound_voice_accepts_temperature_boundaries(temperature):
+    event = ResponseOutputTextDone(
+        response_id="r_1",
+        item_id="it_1",
+        text="hello",
+        voice={"temperature": temperature},
+    )
+
+    assert json.loads(encode_outbound_message(event))["voice"] == {"temperature": temperature}
+
+
+def test_outbound_voice_accepts_empty_model_as_string_field_shape():
+    event = ResponseOutputTextDone(
+        response_id="r_1",
+        item_id="it_1",
+        text="hello",
+        voice={"model": ""},
+    )
+
+    assert json.loads(encode_outbound_message(event))["voice"] == {"model": ""}
+
+
+@pytest.mark.parametrize(
+    ("alias", "normalized"),
+    [("azure-platform", "azure-standard"), ("custom", "azure-custom")],
+)
+def test_outbound_voice_writes_alias_normalization_to_wire(alias, normalized):
+    event = ResponseOutputTextDone(
+        response_id="r_1",
+        item_id="it_1",
+        text="hello",
+        voice={"type": alias},
+    )
+
+    assert json.loads(encode_outbound_message(event))["voice"] == {"type": normalized}
+    assert event.voice == {"type": alias}
+
+
+def test_outbound_voice_validation_failure_is_repeatable_and_does_not_mutate_model():
+    event = ResponseOutputTextDone(
+        response_id="r_1",
+        item_id="it_1",
+        text="hello",
+        voice={
+            "type": "azure-platform",
+            "temperature": 2.0,
+            "prefer_locales": ["en-US"],
+        },
+    )
+
+    for _ in range(2):
+        with pytest.raises(ValueError, match="voice.temperature must be between 0.0 and 1.0"):
+            encode_outbound_message(event)
+        assert event.voice == {
+            "type": "azure-platform",
+            "temperature": 2.0,
+            "prefer_locales": ("en-US",),
+        }
+
+
+def test_outbound_voice_accepts_all_known_fields_and_preserves_unknown_fields():
+    voice = {
+        "type": "azure-platform",
+        "name": "en-US-Ava",
+        "endpoint_id": "endpoint-1",
+        "model": "model-1",
+        "temperature": 0.5,
+        "locale": None,
+        "style": "chat",
+        "pitch": None,
+        "rate": "+10%",
+        "volume": None,
+        "custom_lexicon_url": "https://example.test/lexicon.xml",
+        "custom_text_normalization_url": None,
+        "prefer_locales": ["en-US", "fr-FR"],
+        "multi_talker_speaker_name": None,
+        "future_field": {"nested": [1, True, None]},
+    }
+    event = ResponseOutputTextDone(response_id="r_1", item_id="it_1", text="hello", voice=voice)
+
+    encoded = json.loads(encode_outbound_message(event))["voice"]
+
+    assert encoded == {**voice, "type": "azure-standard"}
+    assert event.voice["type"] == "azure-platform"
+    assert event.voice["prefer_locales"] == ("en-US", "fr-FR")
+
+
+@pytest.mark.parametrize("mutable_leaf", [bytearray(b"secret"), {"mutable-set"}])
+def test_outbound_voice_rejects_non_json_mutable_leaves(mutable_leaf):
+    with pytest.raises(TypeError, match="JSON-compatible"):
+        ResponseOutputTextDelta(
+            response_id="r_1",
+            item_id="it_1",
+            delta="hello",
+            voice={"future_field": mutable_leaf},
+        )
+
+
+def test_outbound_voice_preserves_additive_fields_for_bridge_validation():
+    voice = {"future_field": {"value": 1}}
+    event = ResponseOutputTextDone(response_id="r_1", item_id="it_1", text="hello", voice=voice)
+
+    assert json.loads(encode_outbound_message(event))["voice"] == voice
+
+
+def test_unknown_message_is_ignored_without_state():
+    assert decode_inbound_message(_frame("future.message", value=1)) is None
+
+
+@pytest.mark.parametrize(
+    "message_type",
+    [
+        "conversation.item.create",
+        "conversation.item.delete",
+        "dtmf",
+        "dtmf.collect.cancelled",
+        "dtmf.collect.rejected",
+        "handoff.failed",
+    ],
+)
+def test_known_excluded_message_fails_loud(message_type):
+    with pytest.raises(VoiceUnsupportedMessageError):
+        decode_inbound_message(_frame(message_type))
+
+
+def test_image_content_fails_loud():
+    with pytest.raises(VoiceUnsupportedMessageError):
+        decode_inbound_message(
+            _frame(
+                "user.message",
+                item_id="in_1",
+                content=[{"type": "input_image", "image_ref": "https://example/image", "mime_type": "image/png"}],
+            )
+        )
+
+
+@pytest.mark.parametrize(
+    "frame",
+    [
+        "[]",
+        '{"type":"session.end","type":"session.end","id":"m_1","ts":"2026-08-12T00:00:00Z"}',
+        _frame("response.done", response_id="r_1"),
+        _frame("response.timeout", response_id="r_1", item_ids=["in_1"], stage="idle"),
+        _frame("response.timeout", item_ids=[1], stage="idle"),
+        _frame("session.end", reason="caller_hangup", ts="not-a-timestamp"),
+    ],
+)
+def test_invalid_inbound_frame_fails_context_free(frame):
+    with pytest.raises(VoiceProtocolError):
+        decode_inbound_message(frame)
+
+
+@pytest.mark.parametrize(
+    "timestamp",
+    [
+        "٢٠٢٦-08-12T00:00:00Z",
+        "2026-08-12T00:00:00.١Z",
+        "2026-08-12T00:00:00+٠١:00",
+    ],
+)
+def test_timestamp_rejects_non_ascii_digits(timestamp):
+    with pytest.raises(VoiceProtocolError, match="RFC 3339"):
+        decode_inbound_message(_frame("session.end", reason="completed", ts=timestamp))
+
+
+@pytest.mark.parametrize(
+    "message",
+    [
+        SessionReady(),
+        SessionRejected(code="startup_failed", retriable=False),
+        ResponseCreated(response_id="r_1", in_reply_to=("in_1",)),
+        ResponseNone(in_reply_to=("in_1",)),
+        ResponseOutputTextDelta(response_id="r_1", item_id="it_1", delta="hel"),
+        ResponseOutputTextDone(response_id="r_1", item_id="it_1", text="hello"),
+        ResponseDone(response_id="r_1"),
+        ResponseCancel(response_id="r_1"),
+        EndCall(reason="completed"),
+        AgentError(code="backend_error", message="failed"),
+    ],
+)
+def test_encode_all_selected_outbound_messages(message):
+    payload = json.loads(encode_outbound_message(message))
+    assert payload["type"] == message.type
+    assert payload["id"].startswith("m_")
+    assert payload["ts"].endswith("Z")
+
+
+def test_streaming_item_is_explicit_frames():
+    response_id = "r_1"
+    item_id = "it_1"
+    messages = [
+        ResponseCreated(response_id=response_id, in_reply_to=("in_1",)),
+        ResponseOutputTextDelta(response_id=response_id, item_id=item_id, delta="hel"),
+        ResponseOutputTextDelta(response_id=response_id, item_id=item_id, delta="lo"),
+        ResponseOutputTextDone(response_id=response_id, item_id=item_id, text="hello"),
+        ResponseDone(response_id=response_id),
+    ]
+    payloads = [json.loads(encode_outbound_message(message)) for message in messages]
+    assert [payload["type"] for payload in payloads] == [
+        "response.created",
+        "response.output_text.delta",
+        "response.output_text.delta",
+        "response.output_text.done",
+        "response.done",
+    ]
+    assert payloads[-2]["text"] == "".join(payload["delta"] for payload in payloads[1:3])
+
+
+def test_outbound_validation_does_not_consult_prior_messages():
+    message = ResponseDone(response_id="r_never_opened_here")
+    assert json.loads(encode_outbound_message(message))["response_id"] == "r_never_opened_here"
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_host.py b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_host.py
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_protocol_findings.py b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_protocol_findings.py
new file mode 100644
index 000000000000..da83e0ae8eed
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_protocol_findings.py
@@ -0,0 +1,295 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Regression tests for reviewed Voice protocol findings."""
+
+import asyncio
+import json
+import logging
+from unittest.mock import AsyncMock
+
+import pytest
+from starlette.testclient import TestClient
+from starlette.websockets import WebSocketDisconnect
+
+from azure.ai.agentserver.invocations.voice import _voice_host as voice_host_module
+from azure.ai.agentserver.invocations.voice import (
+    ResponseCreated,
+    SessionEnd,
+    SessionReady,
+    UserSpeechStarted,
+    VoiceAgentServerHost,
+)
+from azure.ai.agentserver.invocations.voice._codec import MAX_FRAME_BYTES, encode_outbound_message
+
+from conftest import _records_with_ws_extras
+
+
+def _voice_frame(message_type, message_id, **fields):
+    return {
+        "type": "websocket.receive",
+        "text": json.dumps(
+            {
+                "type": message_type,
+                "id": message_id,
+                "ts": "2026-08-12T00:00:00Z",
+                **fields,
+            }
+        ),
+    }
+
+
+@pytest.mark.parametrize(
+    ("frame_kind", "frame", "expected_code"),
+    [
+        pytest.param("text", "not-json", 1002, id="invalid-json"),
+        pytest.param("bytes", b"binary", 1003, id="binary-frame"),
+        pytest.param("oversized-text", None, 1009, id="oversized-text"),
+    ],
+)
+def test_voice_sdk_close_code_matches_structured_telemetry(caplog, frame_kind, frame, expected_code):
+    app = VoiceAgentServerHost(configure_observability=None)
+
+    with caplog.at_level(logging.INFO, logger="azure.ai.agentserver"):
+        with pytest.raises(WebSocketDisconnect) as raised:
+            with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+                if frame_kind == "text":
+                    websocket.send_text(frame)
+                elif frame_kind == "oversized-text":
+                    websocket.send_text("x" * (MAX_FRAME_BYTES + 1))
+                else:
+                    websocket.send_bytes(frame)
+                websocket.receive_text()
+
+    assert raised.value.code == expected_code
+    records = _records_with_ws_extras(caplog.records)
+    assert records
+    assert getattr(records[-1], "azure.ai.agentserver.invocations_ws.close_code") == expected_code
+
+
+def test_proactive_admission_timeout_enforces_protocol_maximum():
+    frame = json.loads(
+        encode_outbound_message(
+            ResponseCreated(
+                response_id="r_boundary",
+                admission_timeout_ms=60_000,
+            )
+        )
+    )
+    assert frame["admission_timeout_ms"] == 60_000
+
+    with pytest.raises(ValueError, match="at most 60000"):
+        encode_outbound_message(
+            ResponseCreated(
+                response_id="r_too_late",
+                admission_timeout_ms=60_001,
+            )
+        )
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("register_session_end_callback", [False, True])
+async def test_session_end_commits_terminal_and_stops_dispatch(register_session_end_callback):
+    app = VoiceAgentServerHost(configure_observability=None)
+    websocket = AsyncMock()
+    websocket.scope = {}
+    websocket.receive.side_effect = [
+        _voice_frame("session.end", "m_end", reason="completed"),
+        _voice_frame("user.speech_started", "m_late"),
+    ]
+    session_end_events = []
+    later_events = []
+    disconnect_events = []
+    terminating_sessions = []
+
+    if register_session_end_callback:
+
+        @app.on_session_end
+        async def on_session_end(session, event):
+            assert isinstance(event, SessionEnd)
+            session_end_events.append((session, event))
+            await session.send(SessionReady())
+
+    @app.on_user_speech_started
+    async def on_user_speech_started(_session, event):
+        assert isinstance(event, UserSpeechStarted)
+        later_events.append(event)
+        raise AssertionError("event after session.end was dispatched")
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnect_events.append(event)
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    await app._handle_voice_connection(websocket)  # pylint: disable=protected-access
+
+    assert websocket.receive.await_count == 1
+    assert len(session_end_events) == int(register_session_end_callback)
+    assert later_events == []
+    assert disconnect_events == []
+    assert len(terminating_sessions) == 1
+    with pytest.raises(RuntimeError, match="Voice Session is terminating"):
+        await terminating_sessions[0].send(SessionReady())
+    assert websocket.send_text.await_count == int(register_session_end_callback)
+
+
+@pytest.mark.asyncio
+async def test_session_end_commits_terminal_before_post_callback_cancellation_probe(monkeypatch):
+    app = VoiceAgentServerHost(configure_observability=None)
+    websocket = AsyncMock()
+    websocket.scope = {}
+    websocket.receive.side_effect = [_voice_frame("session.end", "m_end", reason="completed")]
+    callback_sessions = []
+    probe_entered = asyncio.Event()
+    release_probe = asyncio.Event()
+    probe_calls = 0
+    raise_pending_cancellation = voice_host_module._raise_pending_cancellation  # pylint: disable=protected-access
+
+    async def gate_post_callback_probe():
+        nonlocal probe_calls
+        probe_calls += 1
+        if probe_calls == 2:
+            probe_entered.set()
+            await release_probe.wait()
+            return
+        await raise_pending_cancellation()
+
+    monkeypatch.setattr(voice_host_module, "_raise_pending_cancellation", gate_post_callback_probe)
+
+    @app.on_session_end
+    async def on_session_end(session, event):
+        assert isinstance(event, SessionEnd)
+        callback_sessions.append(session)
+
+    handler = asyncio.create_task(app._handle_voice_connection(websocket))  # pylint: disable=protected-access
+    try:
+        await asyncio.wait_for(probe_entered.wait(), timeout=1)
+        assert len(callback_sessions) == 1
+        outcomes = await asyncio.gather(callback_sessions[0].send(SessionReady()), return_exceptions=True)
+        assert len(outcomes) == 1
+        assert isinstance(outcomes[0], RuntimeError)
+        assert str(outcomes[0]) == "Voice Session is terminating"
+        assert websocket.send_text.await_count == 0
+    finally:
+        release_probe.set()
+        await asyncio.wait_for(handler, timeout=1)
+
+    assert probe_calls == 2
+
+
+@pytest.mark.asyncio
+async def test_session_end_callback_failure_still_commits_terminal():
+    app = VoiceAgentServerHost(configure_observability=None)
+    websocket = AsyncMock()
+    websocket.scope = {}
+    websocket.receive.side_effect = [
+        _voice_frame("session.end", "m_end", reason="completed"),
+        _voice_frame("user.speech_started", "m_late"),
+    ]
+    callback_sessions = []
+    later_events = []
+    terminating_sessions = []
+
+    class SessionEndCallbackError(Exception):
+        pass
+
+    @app.on_session_end
+    async def on_session_end(session, event):
+        assert isinstance(event, SessionEnd)
+        callback_sessions.append(session)
+        raise SessionEndCallbackError("session.end callback failed")
+
+    @app.on_user_speech_started
+    async def on_user_speech_started(_session, event):
+        later_events.append(event)
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    with pytest.raises(SessionEndCallbackError, match="session.end callback failed"):
+        await app._handle_voice_connection(websocket)  # pylint: disable=protected-access
+
+    assert websocket.receive.await_count == 1
+    assert len(callback_sessions) == 1
+    assert later_events == []
+    assert terminating_sessions == callback_sessions
+    with pytest.raises(RuntimeError, match="Voice Session is terminating"):
+        await callback_sessions[0].send(SessionReady())
+
+
+@pytest.mark.asyncio
+async def test_session_end_callback_cancellation_still_commits_terminal():
+    app = VoiceAgentServerHost(configure_observability=None)
+    websocket = AsyncMock()
+    websocket.scope = {}
+    websocket.receive.side_effect = [
+        _voice_frame("session.end", "m_end", reason="completed"),
+        _voice_frame("user.speech_started", "m_late"),
+    ]
+    callback_sessions = []
+    later_events = []
+    disconnect_events = []
+    terminating_sessions = []
+
+    @app.on_session_end
+    async def on_session_end(session, event):
+        assert isinstance(event, SessionEnd)
+        callback_sessions.append(session)
+        raise asyncio.CancelledError("session.end callback cancelled")
+
+    @app.on_user_speech_started
+    async def on_user_speech_started(_session, event):
+        later_events.append(event)
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnect_events.append(event)
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await app._handle_voice_connection(websocket)  # pylint: disable=protected-access
+
+    assert raised.value.args == ("session.end callback cancelled",)
+    assert websocket.receive.await_count == 1
+    assert len(callback_sessions) == 1
+    assert later_events == []
+    assert disconnect_events == []
+    assert terminating_sessions == callback_sessions
+    with pytest.raises(RuntimeError, match="Voice Session is terminating"):
+        await callback_sessions[0].send(SessionReady())
+    assert websocket.send_text.await_count == 0
+
+
+@pytest.mark.asyncio
+async def test_non_terminal_event_continues_dispatch():
+    app = VoiceAgentServerHost(configure_observability=None)
+    websocket = AsyncMock()
+    websocket.scope = {}
+    websocket.receive.side_effect = [
+        _voice_frame("user.speech_started", "m_first"),
+        _voice_frame("user.speech_started", "m_second"),
+    ]
+    observed_events = []
+
+    class SecondEventObserved(Exception):
+        pass
+
+    @app.on_user_speech_started
+    async def on_user_speech_started(_session, event):
+        assert isinstance(event, UserSpeechStarted)
+        observed_events.append(event)
+        if len(observed_events) == 2:
+            raise SecondEventObserved("second non-terminal event observed")
+
+    with pytest.raises(SecondEventObserved, match="second non-terminal event observed"):
+        await app._handle_voice_connection(websocket)  # pylint: disable=protected-access
+
+    assert websocket.receive.await_count == 2
+    assert [event.id for event in observed_events] == ["m_first", "m_second"]
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_session.py b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_session.py
new file mode 100644
index 000000000000..ad57fab3547f
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_session.py
@@ -0,0 +1,448 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Tests for the thin Voice Session context."""
+
+import asyncio
+import json
+import sys
+import threading
+
+import pytest
+from starlette.websockets import WebSocketDisconnect, WebSocketState
+
+from azure.ai.agentserver.invocations.voice import EndCall, Session, SessionReady
+from azure.ai.agentserver.invocations.voice import _session as session_module
+
+
+class _BlockingWebSocket:
+    def __init__(self):
+        self.entered = asyncio.Event()
+        self.release = asyncio.Event()
+        self.frames = []
+        self.closes = []
+        self.close_error = None
+        self.application_state = WebSocketState.CONNECTED
+        self.active_sends = 0
+        self.maximum_active_sends = 0
+        self._send = self._send_message
+
+    async def _send_message(self, message):
+        if message["type"] == "websocket.close":
+            await self.close(code=message["code"], reason=message["reason"])
+
+    async def send_text(self, frame):
+        self.active_sends += 1
+        self.maximum_active_sends = max(self.maximum_active_sends, self.active_sends)
+        self.frames.append(json.loads(frame))
+        self.entered.set()
+        await self.release.wait()
+        self.active_sends -= 1
+
+    async def close(self, *, code, reason):
+        self.active_sends += 1
+        self.maximum_active_sends = max(self.maximum_active_sends, self.active_sends)
+        self.closes.append((code, reason))
+        self.active_sends -= 1
+        if self.close_error is not None:
+            raise self.close_error
+
+
+async def _finish_close_attempts(baseline):
+    outstanding = set(session_module._CLOSE_ATTEMPTS) - baseline  # pylint: disable=protected-access
+    if outstanding:
+        await asyncio.wait_for(asyncio.gather(*outstanding, return_exceptions=True), timeout=1)
+    await asyncio.sleep(0)
+    assert set(session_module._CLOSE_ATTEMPTS) == baseline  # pylint: disable=protected-access
+
+
+def test_session_cannot_be_constructed_by_customer():
+    with pytest.raises(TypeError, match="created by VoiceAgentServerHost"):
+        Session()
+
+
+@pytest.mark.asyncio
+async def test_session_has_only_transport_and_send_gate_and_serializes_writes():
+    websocket = _BlockingWebSocket()
+    session = Session._create(websocket)  # pylint: disable=protected-access
+    assert not hasattr(session, "__dict__")
+    assert set(Session.__slots__) == {"_websocket", "_send_lock", "_terminal"}
+
+    first = asyncio.create_task(session.send(SessionReady()))
+    await websocket.entered.wait()
+    second = asyncio.create_task(session.send(EndCall(reason="completed")))
+    await asyncio.sleep(0)
+    assert len(websocket.frames) == 1
+
+    websocket.release.set()
+    await asyncio.gather(first, second)
+    assert websocket.maximum_active_sends == 1
+    assert [frame["type"] for frame in websocket.frames] == ["session.ready", "end_call"]
+
+
+@pytest.mark.asyncio
+async def test_session_serializes_application_send_and_close():
+    websocket = _BlockingWebSocket()
+    session = Session._create(websocket)  # pylint: disable=protected-access
+
+    send_task = asyncio.create_task(session.send(SessionReady()))
+    await websocket.entered.wait()
+    close_task = asyncio.create_task(session._close(1002, "protocol error"))  # pylint: disable=protected-access
+    await asyncio.sleep(0)
+
+    assert websocket.closes == []
+    websocket.release.set()
+    await asyncio.gather(send_task, close_task)
+
+    assert websocket.maximum_active_sends == 1
+    assert websocket.closes == [(1002, "protocol error")]
+
+
+@pytest.mark.asyncio
+async def test_session_close_cancellation_does_not_wait_for_blocked_send():
+    websocket = _BlockingWebSocket()
+    session = Session._create(websocket)  # pylint: disable=protected-access
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    send_task = asyncio.create_task(session.send(SessionReady()))
+    close_task = None
+    try:
+        await asyncio.wait_for(websocket.entered.wait(), timeout=1)
+        close_task = asyncio.create_task(session._close(1002, "protocol error"))  # pylint: disable=protected-access
+        await asyncio.sleep(0)
+
+        with pytest.raises(RuntimeError, match="terminating"):
+            await session.send(EndCall(reason="too late"))
+
+        close_task.cancel("queued-close-cancel")
+        with pytest.raises(asyncio.CancelledError) as raised:
+            await asyncio.wait_for(close_task, timeout=1)
+
+        assert raised.value.args == (("queued-close-cancel",) if sys.version_info >= (3, 11) else ())
+        assert websocket.closes == []
+        with pytest.raises(RuntimeError, match="terminating"):
+            await session.send(EndCall(reason="too late"))
+    finally:
+        websocket.release.set()
+        await asyncio.wait_for(asyncio.gather(send_task, return_exceptions=True), timeout=1)
+        if close_task is not None and not close_task.done():
+            close_task.cancel()
+            await asyncio.wait_for(asyncio.gather(close_task, return_exceptions=True), timeout=1)
+        await _finish_close_attempts(baseline_attempts)
+    assert not session._send_lock.locked()  # pylint: disable=protected-access
+    assert websocket.closes == [(1002, "protocol error")]
+
+
+@pytest.mark.asyncio
+async def test_session_queued_cancellation_skips_transport_close():
+    websocket = _BlockingWebSocket()
+    websocket.close_error = OSError("transport close failed")
+    session = Session._create(websocket)  # pylint: disable=protected-access
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    send_task = asyncio.create_task(session.send(SessionReady()))
+    close_task = None
+    try:
+        await asyncio.wait_for(websocket.entered.wait(), timeout=1)
+        close_task = asyncio.create_task(session._close(1002, "protocol error"))  # pylint: disable=protected-access
+        await asyncio.sleep(0)
+        close_task.cancel()
+
+        with pytest.raises(asyncio.CancelledError):
+            await asyncio.wait_for(close_task, timeout=1)
+
+        assert websocket.closes == []
+        with pytest.raises(RuntimeError, match="terminating"):
+            await session.send(EndCall(reason="too late"))
+    finally:
+        websocket.release.set()
+        await asyncio.wait_for(asyncio.gather(send_task, return_exceptions=True), timeout=1)
+        if close_task is not None and not close_task.done():
+            close_task.cancel()
+            await asyncio.wait_for(asyncio.gather(close_task, return_exceptions=True), timeout=1)
+        await _finish_close_attempts(baseline_attempts)
+    assert not session._send_lock.locked()  # pylint: disable=protected-access
+    assert websocket.closes == [(1002, "protocol error")]
+
+
+@pytest.mark.asyncio
+async def test_session_close_does_not_infer_cancellation_from_exception_graph():
+    websocket = _BlockingWebSocket()
+    cancellation = asyncio.CancelledError("transport cancellation")
+    close_error = OSError("transport wrapped cancellation")
+    close_error.__cause__ = RuntimeError("independent cause")
+    close_error.__context__ = cancellation
+    websocket.close_error = close_error
+    session = Session._create(websocket)  # pylint: disable=protected-access
+
+    with pytest.raises(OSError) as raised:
+        await session._close(1002, "protocol error")  # pylint: disable=protected-access
+
+    assert raised.value is close_error
+    assert close_error.__cause__ is not None
+    assert close_error.__context__ is cancellation
+
+
+def test_find_cancellation_prefers_explicit_cause_branch():
+    cause_cancellation = asyncio.CancelledError("explicit cause")
+    context_cancellation = asyncio.CancelledError("implicit context")
+    wrapper = OSError("transport wrapper")
+    wrapper.__cause__ = cause_cancellation
+    wrapper.__context__ = context_cancellation
+
+    assert session_module._find_cancellation(wrapper) is cause_cancellation  # pylint: disable=protected-access
+
+
+def test_untracked_generic_wrapper_does_not_become_task_cancellation():
+    cancellation = asyncio.CancelledError("inner cancellation")
+    wrapper = RuntimeError("callback wrapper")
+    wrapper.__cause__ = cancellation
+
+    session_module._raise_task_cancellation(wrapper, None)  # pylint: disable=protected-access
+
+    assert wrapper.__cause__ is cancellation
+
+
+@pytest.mark.asyncio
+async def test_send_operation_closes_coroutine_when_task_construction_fails(monkeypatch):
+    websocket = _BlockingWebSocket()
+    session = Session._create(websocket)  # pylint: disable=protected-access
+    closed_coroutines = []
+    close_coroutine = session_module._close_coroutine  # pylint: disable=protected-access
+
+    def track_close(coroutine):
+        closed_coroutines.append(coroutine)
+        close_coroutine(coroutine)
+
+    def fail_create_task(_coroutine, *, name=None):
+        del name
+        raise RuntimeError("send task construction failed")
+
+    monkeypatch.setattr(session_module, "_close_coroutine", track_close)
+    monkeypatch.setattr(session_module.asyncio, "create_task", fail_create_task)
+
+    with pytest.raises(RuntimeError, match="send task construction failed"):
+        await session.send(SessionReady())
+
+    assert len(closed_coroutines) == 1
+    assert websocket.frames == []
+
+
+@pytest.mark.asyncio
+async def test_send_cancellation_before_transport_operation_starts():
+    websocket = _BlockingWebSocket()
+    session = Session._create(websocket)  # pylint: disable=protected-access
+
+    send_task = asyncio.create_task(session.send(SessionReady()))
+    send_task.cancel("pre-start-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(send_task, timeout=1)
+
+    assert raised.value.args == (("pre-start-cancel",) if sys.version_info >= (3, 11) else ())
+    assert send_task.cancelled()
+    assert websocket.frames == []
+    assert [task for task in asyncio.all_tasks() if task.get_name() == "voice_websocket_send"] == []
+
+
+@pytest.mark.asyncio
+async def test_send_side_peer_loss_closes_gate_before_queued_writer_enters_transport():
+    class PeerLossWebSocket:
+        def __init__(self):
+            self.application_state = WebSocketState.CONNECTED
+            self.scope = {}
+            self.send_started = asyncio.Event()
+            self.release_send = asyncio.Event()
+            self.frames = []
+
+        async def send_text(self, frame):
+            self.frames.append(json.loads(frame))
+            self.send_started.set()
+            await self.release_send.wait()
+            raise WebSocketDisconnect(code=1006)
+
+    websocket = PeerLossWebSocket()
+    session = Session._create(websocket)  # pylint: disable=protected-access
+    first_send = asyncio.create_task(session.send(SessionReady()))
+    await websocket.send_started.wait()
+    second_send = asyncio.create_task(session.send(EndCall(reason="queued")))
+    await asyncio.sleep(0)
+
+    websocket.release_send.set()
+    first_result, second_result = await asyncio.gather(first_send, second_send, return_exceptions=True)
+
+    assert isinstance(first_result, WebSocketDisconnect)
+    assert isinstance(second_result, RuntimeError)
+    assert str(second_result) == "Voice Session is terminating"
+    assert [frame["type"] for frame in websocket.frames] == ["session.ready"]
+
+
+@pytest.mark.asyncio
+async def test_session_close_recomputes_deadline_after_attempt_start(monkeypatch):
+    current_time = 0.0
+    observed_timeouts = []
+
+    class FakeLoop:
+        @staticmethod
+        def time():
+            return current_time
+
+    class CompletedAttempt:
+        @staticmethod
+        def result():
+            return None
+
+    def start_close_attempt(*_args):
+        nonlocal current_time
+        current_time = 4.0
+        return CompletedAttempt()
+
+    async def wait_for_attempt(attempts, *, timeout):
+        observed_timeouts.append(timeout)
+        return set(attempts), set()
+
+    monkeypatch.setattr(session_module.asyncio, "get_running_loop", lambda: FakeLoop())
+    monkeypatch.setattr(session_module, "_start_close_attempt", start_close_attempt)
+    monkeypatch.setattr(session_module.asyncio, "wait", wait_for_attempt)
+    session = Session._create(_BlockingWebSocket())  # pylint: disable=protected-access
+
+    await session._close(1002, "protocol error", deadline=5.0)  # pylint: disable=protected-access
+
+    assert observed_timeouts == [1.0]
+
+
+@pytest.mark.asyncio
+async def test_close_attempt_rolls_back_when_task_construction_fails_and_can_retry(monkeypatch):
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+    create_task = asyncio.create_task
+    create_attempts = 0
+    closed_coroutines = []
+    close_coroutine = session_module._close_coroutine  # pylint: disable=protected-access
+
+    def track_close(coroutine):
+        closed_coroutines.append(coroutine)
+        close_coroutine(coroutine)
+
+    def fail_first_create_task(coroutine, *, name=None):
+        nonlocal create_attempts
+        create_attempts += 1
+        if create_attempts == 1:
+            raise RuntimeError("task construction failed")
+        return create_task(coroutine, name=name)
+
+    monkeypatch.setattr(session_module.asyncio, "create_task", fail_first_create_task)
+    monkeypatch.setattr(session_module, "_close_coroutine", track_close)
+    websocket = _BlockingWebSocket()
+
+    with pytest.raises(RuntimeError, match="task construction failed"):
+        session_module._start_close_attempt(  # pylint: disable=protected-access
+            asyncio.Lock(),
+            websocket,
+            1002,
+            "failed close",
+        )
+
+    assert set(session_module._CLOSE_ATTEMPTS) == baseline_attempts  # pylint: disable=protected-access
+    assert session_module._CLOSE_ATTEMPT_RESERVATIONS == 0  # pylint: disable=protected-access
+    assert websocket.application_state == WebSocketState.CONNECTED
+    assert websocket.closes == []
+    assert len(closed_coroutines) == 1
+    assert closed_coroutines[0].cr_frame is None
+
+    retry = session_module._start_close_attempt(  # pylint: disable=protected-access
+        asyncio.Lock(),
+        websocket,
+        1002,
+        "retry close",
+    )
+
+    assert retry is not None
+    await _finish_close_attempts(baseline_attempts)
+    assert create_attempts == 2
+    assert websocket.application_state == WebSocketState.DISCONNECTED
+    assert websocket.closes == [(1002, "retry close")]
+    assert len(closed_coroutines) == 1
+    assert session_module._CLOSE_ATTEMPT_RESERVATIONS == 0  # pylint: disable=protected-access
+
+
+def test_close_attempt_cap_is_atomic_across_event_loop_threads(monkeypatch):
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+    monkeypatch.setattr(session_module, "_MAX_CLOSE_ATTEMPTS", len(baseline_attempts) + 1)
+    barrier = threading.Barrier(2)
+    results = []
+    result_lock = threading.Lock()
+
+    def worker():
+        async def run():
+            attempt = None
+            try:
+                attempt = session_module._start_close_attempt(  # pylint: disable=protected-access
+                    asyncio.Lock(),
+                    _BlockingWebSocket(),
+                    1002,
+                    "thread close",
+                )
+                outcome = "admitted"
+            except RuntimeError as exc:
+                outcome = str(exc)
+            barrier.wait(timeout=1)
+            if attempt is not None:
+                await asyncio.wait_for(attempt, timeout=1)
+            with result_lock:
+                results.append(outcome)
+
+        asyncio.run(run())
+
+    threads = [threading.Thread(target=worker, daemon=True) for _ in range(2)]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join(timeout=2)
+
+    assert all(not thread.is_alive() for thread in threads)
+    assert sorted(results) == ["Voice WebSocket close attempt limit reached", "admitted"]
+    assert session_module._CLOSE_ATTEMPT_RESERVATIONS == 0  # pylint: disable=protected-access
+    assert set(session_module._CLOSE_ATTEMPTS) == baseline_attempts  # pylint: disable=protected-access
+
+
+@pytest.mark.asyncio
+async def test_session_close_attempt_cap_fails_closed_and_recovers(monkeypatch):
+    monkeypatch.setattr(session_module, "CLOSE_TIMEOUT_SECONDS", 0.01)
+    monkeypatch.setattr(session_module, "_MAX_CLOSE_ATTEMPTS", 1)
+    close_started = asyncio.Event()
+    close_release = asyncio.Event()
+
+    class CancellationResistantCloseWebSocket(_BlockingWebSocket):
+        async def close(self, *, code, reason):
+            self.closes.append((code, reason))
+            close_started.set()
+            try:
+                await close_release.wait()
+            except asyncio.CancelledError:
+                await close_release.wait()
+
+    first_websocket = CancellationResistantCloseWebSocket()
+    first_session = Session._create(first_websocket)  # pylint: disable=protected-access
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    try:
+        with pytest.raises(TimeoutError, match="deadline elapsed"):
+            await asyncio.wait_for(  # pylint: disable=protected-access
+                first_session._close(1002, "protocol error"),
+                timeout=1,
+            )
+        await asyncio.wait_for(close_started.wait(), timeout=1)
+        outstanding = set(session_module._CLOSE_ATTEMPTS) - baseline_attempts  # pylint: disable=protected-access
+        assert len(outstanding) == 1
+
+        second_websocket = _BlockingWebSocket()
+        second_session = Session._create(second_websocket)  # pylint: disable=protected-access
+        with pytest.raises(RuntimeError, match="close attempt limit reached"):
+            await asyncio.wait_for(  # pylint: disable=protected-access
+                second_session._close(1002, "protocol error"),
+                timeout=1,
+            )
+        assert second_websocket.closes == []
+    finally:
+        close_release.set()
+        await _finish_close_attempts(baseline_attempts)
diff --git a/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_transport_findings.py b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_transport_findings.py
new file mode 100644
index 000000000000..6132d4b8fade
--- /dev/null
+++ b/sdk/agentserver/azure-ai-agentserver-invocations/tests/voice/test_voice_transport_findings.py
@@ -0,0 +1,2598 @@
+# ---------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# ---------------------------------------------------------
+"""Voice-only WebSocket route and upgrade-context regressions."""
+
+import asyncio
+import json
+import logging
+import sys
+
+import pytest
+import opentelemetry.propagate as otel_propagate
+from opentelemetry import baggage, trace
+from starlette.applications import Starlette
+from starlette.routing import Host, Mount, WebSocketRoute
+from starlette.testclient import TestClient
+from starlette.websockets import WebSocket, WebSocketDisconnect
+
+from azure.ai.agentserver.core import get_request_context
+from azure.ai.agentserver.invocations.voice import Session, SessionReady, VoiceAgentServerHost
+from azure.ai.agentserver.invocations.voice import _session as session_module
+from azure.ai.agentserver.invocations.voice import _voice_host as voice_host_module
+from azure.ai.agentserver.invocations.voice._codec import MAX_FRAME_BYTES
+
+
+class _LoggingBaseException(BaseException):
+    pass
+
+
+class _RaisingLogHandler(logging.Handler):
+    def __init__(self, failure):
+        super().__init__()
+        self.failure = failure
+
+    def emit(self, _record):
+        raise self.failure
+
+
+def _session_start_frame() -> dict[str, object]:
+    return {
+        "type": "session.start",
+        "id": "m_start",
+        "ts": "2026-08-12T00:00:00Z",
+        "protocol_version": "1.0",
+        "reconnect": False,
+        "response_timeouts": {"first_output_ms": 1, "idle_ms": 2, "max_duration_ms": 3},
+    }
+
+
+def _websocket_with_headers(headers: list[tuple[bytes, bytes]]) -> WebSocket:
+    async def receive():
+        return {"type": "websocket.disconnect", "code": 1000}
+
+    async def send(_message):
+        return None
+
+    return WebSocket(
+        {
+            "type": "websocket",
+            "asgi": {"version": "3.0", "spec_version": "2.4"},
+            "scheme": "ws",
+            "path": "/invocations_ws",
+            "raw_path": b"/invocations_ws",
+            "query_string": b"",
+            "headers": headers,
+            "client": ("test", 1),
+            "server": ("testserver", 80),
+            "subprotocols": [],
+            "state": {},
+        },
+        receive,
+        send,
+    )
+
+
+async def _finish_close_attempts(baseline):
+    outstanding = set(session_module._CLOSE_ATTEMPTS) - baseline  # pylint: disable=protected-access
+    if outstanding:
+        await asyncio.wait_for(asyncio.gather(*outstanding, return_exceptions=True), timeout=1)
+    await asyncio.sleep(0)
+    assert set(session_module._CLOSE_ATTEMPTS) == baseline  # pylint: disable=protected-access
+
+
+def _live_voice_send_tasks():
+    return [task for task in asyncio.all_tasks() if task.get_name() == "voice_websocket_send" and not task.done()]
+
+
+def _live_voice_transport_tasks():
+    return [task for task in asyncio.all_tasks() if task.get_name() == "voice_websocket_transport" and not task.done()]
+
+
+async def _raise_callback_local_cancellation(source):
+    if source == "wait_for":
+        await asyncio.wait_for(asyncio.Future(), timeout=0)
+    elif source == "timeout":
+        timeout = getattr(asyncio, "timeout", None)
+        if timeout is None:
+            pytest.skip("asyncio.timeout requires Python 3.11")
+        async with timeout(0):
+            await asyncio.Future()
+    else:
+        child = asyncio.create_task(asyncio.Future())
+        child.cancel("callback-child")
+        try:
+            await child
+        except asyncio.CancelledError as cancellation:
+            raise RuntimeError("callback wrapped its child cancellation") from cancellation
+
+
+def _tracks_task_cancellation_requests():
+    return sys.version_info >= (3, 11)
+
+
+def test_voice_route_rejects_same_scope_exact_conflict():
+    async def conflicting_endpoint(websocket: WebSocket) -> None:
+        await websocket.accept()
+
+    with pytest.raises(RuntimeError, match="route is already registered"):
+        VoiceAgentServerHost(
+            routes=[WebSocketRoute("/invocations_ws", conflicting_endpoint)],
+            configure_observability=None,
+        )
+
+
+def test_voice_route_precedes_same_scope_catch_all():
+    selected = []
+
+    async def catch_all(websocket: WebSocket) -> None:
+        selected.append("catch_all")
+        await websocket.accept()
+        await websocket.send_text("catch_all")
+
+    app = VoiceAgentServerHost(
+        routes=[WebSocketRoute("/{path:path}", catch_all)],
+        configure_observability=None,
+    )
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        selected.append("voice")
+        await session.send(SessionReady())
+
+    with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+        websocket.send_json(_session_start_frame())
+        assert websocket.receive_json()["type"] == "session.ready"
+
+    assert selected == ["voice"]
+
+
+def test_voice_route_rejects_late_same_scope_exact_conflict():
+    async def conflicting_endpoint(websocket: WebSocket) -> None:
+        await websocket.accept()
+
+    app = VoiceAgentServerHost(configure_observability=None)
+    app.routes.insert(0, WebSocketRoute("/invocations_ws", conflicting_endpoint))
+
+    with pytest.raises(RuntimeError, match="route is already registered"):
+        with TestClient(app).websocket_connect("/invocations_ws"):
+            pass
+
+
+def test_voice_route_precedes_late_same_scope_catch_all():
+    selected = []
+
+    async def catch_all(websocket: WebSocket) -> None:
+        selected.append("catch_all")
+        await websocket.accept()
+        await websocket.send_text("catch_all")
+
+    app = VoiceAgentServerHost(configure_observability=None)
+    app.routes.insert(0, WebSocketRoute("/{path:path}", catch_all))
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        selected.append("voice")
+        await session.send(SessionReady())
+
+    with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+        websocket.send_json(_session_start_frame())
+        assert websocket.receive_json()["type"] == "session.ready"
+
+    assert selected == ["voice"]
+
+
+@pytest.mark.parametrize("authority_kind", ["host", "mount"])
+def test_voice_route_preserves_host_and_mount_authority(authority_kind):
+    async def authority_endpoint(websocket: WebSocket) -> None:
+        await websocket.accept()
+        await websocket.send_text("authority")
+
+    nested = Starlette(routes=[WebSocketRoute("/invocations_ws", authority_endpoint)])
+    authority_route = Host("tenant.example", app=nested) if authority_kind == "host" else Mount("/", app=nested)
+    app = VoiceAgentServerHost(routes=[authority_route], configure_observability=None)
+
+    headers = {"host": "tenant.example"} if authority_kind == "host" else {}
+    with TestClient(app).websocket_connect("/invocations_ws", headers=headers) as websocket:
+        assert websocket.receive_text() == "authority"
+
+
+def test_voice_route_tracks_live_authority_add_remove_and_reorder():
+    async def first_endpoint(websocket: WebSocket) -> None:
+        await websocket.accept()
+        await websocket.send_text("first")
+
+    async def second_endpoint(websocket: WebSocket) -> None:
+        await websocket.accept()
+        await websocket.send_text("second")
+
+    first = Mount("/", app=Starlette(routes=[WebSocketRoute("/invocations_ws", first_endpoint)]))
+    second = Mount("/", app=Starlette(routes=[WebSocketRoute("/invocations_ws", second_endpoint)]))
+    app = VoiceAgentServerHost(configure_observability=None)
+
+    app.routes.extend((first, second))
+    with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+        assert websocket.receive_text() == "first"
+
+    app.routes.remove(first)
+    with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+        assert websocket.receive_text() == "second"
+
+    app.routes.insert(1, first)
+    with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+        assert websocket.receive_text() == "first"
+
+
+def test_voice_route_preserves_live_matching_and_nonmatching_host_authority():
+    async def authority_endpoint(websocket: WebSocket) -> None:
+        await websocket.accept()
+        await websocket.send_text("authority")
+
+    app = VoiceAgentServerHost(configure_observability=None)
+    app.routes.insert(
+        0,
+        Host(
+            "tenant.example",
+            app=Starlette(routes=[WebSocketRoute("/invocations_ws", authority_endpoint)]),
+        ),
+    )
+
+    with TestClient(app).websocket_connect("/invocations_ws", headers={"host": "tenant.example"}) as websocket:
+        assert websocket.receive_text() == "authority"
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        await session.send(SessionReady())
+
+    with TestClient(app).websocket_connect("/invocations_ws", headers={"host": "other.example"}) as websocket:
+        websocket.send_json(_session_start_frame())
+        assert websocket.receive_json()["type"] == "session.ready"
+
+
+def test_voice_upgrade_binds_context_and_returns_server_header(monkeypatch):
+    monkeypatch.setenv("FOUNDRY_AGENT_SESSION_ID", "session-1")
+    observed = []
+    app = VoiceAgentServerHost(configure_observability=None)
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        platform_context = get_request_context()
+        span_context = trace.get_current_span().get_span_context()
+        observed.append(
+            {
+                "call_id": platform_context.call_id,
+                "user_id": platform_context.user_id,
+                "session_id": platform_context.session_id,
+                "trace_id": f"{span_context.trace_id:032x}",
+                "request_id": baggage.get_baggage("x_request_id"),
+            }
+        )
+        await session.send(SessionReady())
+
+    expected_trace_id = "11111111111111111111111111111111"
+    headers = {
+        "x-agent-foundry-call-id": "call-1",
+        "x-agent-user-id": "user-1",
+        "x-request-id": "request-1",
+        "traceparent": f"00-{expected_trace_id}-2222222222222222-01",
+    }
+    with TestClient(app).websocket_connect("/invocations_ws", headers=headers) as websocket:
+        websocket.send_text(json.dumps(_session_start_frame()))
+        assert websocket.receive_json()["type"] == "session.ready"
+        response_headers = dict(websocket.extra_headers or [])
+        assert response_headers[b"x-platform-server"]
+
+    assert observed == [
+        {
+            "call_id": "call-1",
+            "user_id": "user-1",
+            "session_id": "session-1",
+            "trace_id": expected_trace_id,
+            "request_id": "request-1",
+        }
+    ]
+    platform_context = get_request_context()
+    assert (platform_context.call_id, platform_context.user_id, platform_context.session_id) == (None, None, None)
+
+
+@pytest.mark.asyncio
+async def test_voice_cleanup_callbacks_and_diagnostics_keep_connection_context(monkeypatch):
+    monkeypatch.setenv("FOUNDRY_AGENT_SESSION_ID", "cleanup-session")
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    expected_trace_id = "11111111111111111111111111111111"
+    observations = []
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(_message):
+        return None
+
+    websocket = _websocket_with_headers(
+        [
+            (b"x-agent-foundry-call-id", b"cleanup-call"),
+            (b"x-agent-user-id", b"cleanup-user"),
+            (b"x-request-id", b"cleanup-request"),
+            (b"traceparent", f"00-{expected_trace_id}-2222222222222222-01".encode()),
+        ]
+    )
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+
+    def observe(stage, session=None):
+        platform_context = get_request_context()
+        span_context = trace.get_current_span().get_span_context()
+        observations.append(
+            (
+                stage,
+                platform_context.call_id,
+                platform_context.user_id,
+                platform_context.session_id,
+                baggage.get_baggage("x_request_id"),
+                f"{span_context.trace_id:032x}",
+            )
+        )
+        if session is not None:
+            assert Session._current(websocket) is None  # pylint: disable=protected-access
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        observe("terminating", session)
+
+    @app.on_disconnect
+    async def on_disconnect(session, _event):
+        observe("disconnect", session)
+
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, _code, _duration_ms, *, error_code=None: observe("telemetry")
+    )
+
+    baseline_platform_context = get_request_context()
+    baseline_trace_id = trace.get_current_span().get_span_context().trace_id
+    baseline_request_id = baggage.get_baggage("x_request_id")
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert observations == [
+        ("terminating", "cleanup-call", "cleanup-user", "cleanup-session", "cleanup-request", expected_trace_id),
+        ("disconnect", "cleanup-call", "cleanup-user", "cleanup-session", "cleanup-request", expected_trace_id),
+        ("telemetry", "cleanup-call", "cleanup-user", "cleanup-session", "cleanup-request", expected_trace_id),
+    ]
+    platform_context = get_request_context()
+    assert (
+        platform_context.call_id,
+        platform_context.user_id,
+        platform_context.session_id,
+        trace.get_current_span().get_span_context().trace_id,
+        baggage.get_baggage("x_request_id"),
+    ) == (
+        baseline_platform_context.call_id,
+        baseline_platform_context.user_id,
+        baseline_platform_context.session_id,
+        baseline_trace_id,
+        baseline_request_id,
+    )
+
+
+def test_voice_upgrade_preserves_repeated_w3c_headers():
+    expected_trace_id = "11111111111111111111111111111111"
+    websocket = _websocket_with_headers(
+        [
+            (b"traceparent", f"00-{expected_trace_id}-2222222222222222-01".encode()),
+            (b"tracestate", b"vendor1=value1"),
+            (b"tracestate", b"vendor2=value2"),
+            (b"baggage", b"tenant.id=tenant-1"),
+            (b"baggage", b"region=west"),
+            (b"x-request-id", b""),
+            (b"x-request-id", b"request-first"),
+            (b"x-request-id", b"request-second"),
+        ]
+    )
+
+    context = voice_host_module._extract_voice_websocket_context(websocket)  # pylint: disable=protected-access
+    span_context = trace.get_current_span(context).get_span_context()
+
+    assert f"{span_context.trace_id:032x}" == expected_trace_id
+    assert span_context.trace_state.get("vendor1") == "value1"
+    assert span_context.trace_state.get("vendor2") == "value2"
+    assert baggage.get_baggage("tenant.id", context=context) == "tenant-1"
+    assert baggage.get_baggage("region", context=context) == "west"
+    assert baggage.get_baggage("x_request_id", context=context) == "request-first"
+
+
+def test_voice_upgrade_rejects_duplicate_traceparent():
+    websocket = _websocket_with_headers(
+        [
+            (b"traceparent", b"00-11111111111111111111111111111111-2222222222222222-01"),
+            (b"traceparent", b"00-33333333333333333333333333333333-4444444444444444-01"),
+        ]
+    )
+
+    context = voice_host_module._extract_voice_websocket_context(websocket)  # pylint: disable=protected-access
+    assert trace.get_current_span(context).get_span_context().trace_id == 0
+
+
+def test_voice_upgrade_ignores_context_extraction_failure(monkeypatch):
+    def fail_extract(*_args, **_kwargs):
+        raise RuntimeError("context extraction failed")
+
+    monkeypatch.setattr(otel_propagate, "extract", fail_extract)
+    app = VoiceAgentServerHost(configure_observability=None)
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        await session.send(SessionReady())
+
+    with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+        websocket.send_json(_session_start_frame())
+        assert websocket.receive_json()["type"] == "session.ready"
+
+
+def test_voice_upgrade_ignores_context_attachment_failure(monkeypatch):
+    def fail_attach(_context):
+        raise RuntimeError("context attachment failed")
+
+    monkeypatch.setattr(voice_host_module._otel_context, "attach", fail_attach)
+    app = VoiceAgentServerHost(configure_observability=None)
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        await session.send(SessionReady())
+
+    with TestClient(app).websocket_connect("/invocations_ws") as websocket:
+        websocket.send_json(_session_start_frame())
+        assert websocket.receive_json()["type"] == "session.ready"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    ("inbound", "expected_code"),
+    [
+        ({"type": "websocket.receive", "text": "not-json"}, 1002),
+        ({"type": "websocket.receive", "bytes": b"binary"}, 1003),
+        ({"type": "websocket.receive", "text": "x" * (MAX_FRAME_BYTES + 1)}, 1009),
+    ],
+)
+async def test_voice_selected_close_survives_cancellation_during_send(inbound, expected_code):
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [{"type": "websocket.connect"}, inbound]
+    close_started = asyncio.Event()
+    close_release = asyncio.Event()
+    close_events = []
+    sent_messages = []
+
+    async def receive():
+        if inbound_events:
+            return inbound_events.pop(0)
+        await asyncio.Future()
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.close":
+            close_started.set()
+            await close_release.wait()
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    try:
+        await asyncio.wait_for(close_started.wait(), timeout=1)
+        task.cancel()
+        with pytest.raises(asyncio.CancelledError):
+            await asyncio.wait_for(task, timeout=1)
+    finally:
+        close_release.set()
+        if not task.done():
+            task.cancel()
+            await asyncio.gather(task, return_exceptions=True)
+        await _finish_close_attempts(baseline_attempts)
+
+    wire_closes = [message for message in sent_messages if message["type"] == "websocket.close"]
+    assert [message["code"] for message in wire_closes] == [expected_code]
+    assert close_events == [(expected_code, "cancelled")]
+    assert set(session_module._CLOSE_ATTEMPTS) == baseline_attempts  # pylint: disable=protected-access
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("expected_code", [1002, 1003, 1009])
+async def test_voice_selected_close_survives_transport_failure(expected_code):
+    app = VoiceAgentServerHost(configure_observability=None)
+    if expected_code == 1002:
+        inbound = {"type": "websocket.receive", "text": "not-json"}
+    elif expected_code == 1003:
+        inbound = {"type": "websocket.receive", "bytes": b"binary"}
+    else:
+        inbound = {"type": "websocket.receive", "text": "x" * (MAX_FRAME_BYTES + 1)}
+    inbound_events = [{"type": "websocket.connect"}, inbound]
+    close_events = []
+    sent_messages = []
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.close":
+            raise OSError("transport close failed")
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    wire_closes = [message for message in sent_messages if message["type"] == "websocket.close"]
+    assert [message["code"] for message in wire_closes] == [expected_code]
+    assert close_events == [(expected_code, None)]
+
+
+@pytest.mark.asyncio
+async def test_voice_stalled_close_releases_endpoint_session_and_context(monkeypatch):
+    monkeypatch.setattr(session_module, "CLOSE_TIMEOUT_SECONDS", 0.01)
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+    close_started = asyncio.Event()
+    close_release = asyncio.Event()
+    close_cancelled = False
+    close_contexts = []
+    close_session_bindings = []
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        if message["type"] != "websocket.close":
+            return
+        close_contexts.append(get_request_context().session_id)
+        close_session_bindings.append(Session._current(websocket))  # pylint: disable=protected-access
+        close_started.set()
+        try:
+            await close_release.wait()
+        except asyncio.CancelledError:
+            nonlocal close_cancelled
+            close_cancelled = True
+            raise
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    try:
+        await asyncio.wait_for(close_started.wait(), timeout=1)
+        await asyncio.wait_for(endpoint_task, timeout=1)
+
+        outstanding = set(session_module._CLOSE_ATTEMPTS) - baseline_attempts  # pylint: disable=protected-access
+        assert len(outstanding) == 1
+        assert not next(iter(outstanding)).done()
+        assert Session._current(websocket) is None  # pylint: disable=protected-access
+        assert close_contexts == [None]
+        assert close_session_bindings == [None]
+        assert close_cancelled is False
+    finally:
+        close_release.set()
+        if not endpoint_task.done():
+            endpoint_task.cancel()
+            await asyncio.gather(endpoint_task, return_exceptions=True)
+        await _finish_close_attempts(baseline_attempts)
+
+    assert set(session_module._CLOSE_ATTEMPTS) == baseline_attempts  # pylint: disable=protected-access
+
+
+@pytest.mark.asyncio
+async def test_voice_accept_unknown_commit_fails_closed():
+    app = VoiceAgentServerHost(configure_observability=None)
+    sent_messages = []
+    close_events = []
+
+    async def receive():
+        return {"type": "websocket.connect"}
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.accept":
+            raise OSError("accept failed after commit")
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.close"]
+    assert sent_messages[-1]["code"] == 1011
+    assert close_events == [(1011, "accept_failed")]
+    assert Session._current(websocket) is None  # pylint: disable=protected-access
+
+
+@pytest.mark.asyncio
+async def test_voice_peer_disconnect_closes_write_gate_before_callback():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    late_send_errors = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(session, _event):
+        with pytest.raises(RuntimeError, match="terminating") as raised:
+            await session.send(SessionReady())
+        late_send_errors.append(raised.value)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert len(late_send_errors) == 1
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+
+
+@pytest.mark.asyncio
+async def test_voice_abnormal_disconnect_code_is_observed_but_never_sent():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1006},
+    ]
+    observed_codes = []
+    close_events = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        observed_codes.append(event.code)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert observed_codes == [1006]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    assert close_events == [(1006, None)]
+
+
+@pytest.mark.asyncio
+async def test_voice_close_deadline_covers_blocked_application_send(monkeypatch):
+    monkeypatch.setattr(session_module, "CLOSE_TIMEOUT_SECONDS", 0.01)
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+    send_started = asyncio.Event()
+    send_release = asyncio.Event()
+    send_tasks = []
+    retained_sessions = []
+    sent_messages = []
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        retained_sessions.append(session)
+        send_tasks.append(asyncio.create_task(session.send(SessionReady())))
+        await send_started.wait()
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.send":
+            send_started.set()
+            await send_release.wait()
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+
+    try:
+        await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+        assert Session._current(websocket) is None  # pylint: disable=protected-access
+        with pytest.raises(RuntimeError, match="terminating"):
+            await retained_sessions[0].send(SessionReady())
+        assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.send"]
+    finally:
+        send_release.set()
+        await asyncio.gather(*send_tasks, return_exceptions=True)
+        await _finish_close_attempts(baseline_attempts)
+
+
+@pytest.mark.asyncio
+async def test_voice_accept_local_timeout_is_not_connection_cancellation(monkeypatch):
+    monkeypatch.setattr(voice_host_module, "_task_cancellation_requests", lambda: None)
+    app = VoiceAgentServerHost(configure_observability=None)
+    close_events = []
+    sent_messages = []
+
+    async def receive():
+        return {"type": "websocket.connect"}
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.accept":
+            await asyncio.wait_for(asyncio.Future(), timeout=0)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert not endpoint_task.cancelled()
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.close"]
+    assert close_events == [(1011, "accept_failed")]
+
+
+@pytest.mark.asyncio
+async def test_voice_accept_direct_cancellation_emits_one_diagnostic_without_cleanup_or_close_io():
+    app = VoiceAgentServerHost(configure_observability=None)
+    accept_started = asyncio.Event()
+    close_events = []
+    terminating_sessions = []
+    disconnects = []
+    sent_messages = []
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnects.append(event)
+
+    async def receive():
+        return {"type": "websocket.connect"}
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.accept":
+            accept_started.set()
+            await asyncio.Future()
+
+    websocket = _websocket_with_headers(
+        [
+            (b"x-agent-foundry-call-id", b"accept-call"),
+            (b"traceparent", b"00-11111111111111111111111111111111-2222222222222222-01"),
+        ]
+    )
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+
+    def emit_close_event(_session_id, code, _duration_ms, *, error_code=None):
+        close_events.append(
+            (
+                code,
+                error_code,
+                get_request_context().call_id,
+                f"{trace.get_current_span().get_span_context().trace_id:032x}",
+            )
+        )
+
+    app._emit_close_event = emit_close_event  # type: ignore[method-assign]  # pylint: disable=protected-access
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(accept_started.wait(), timeout=1)
+    endpoint_task.cancel("accept-direct-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert raised.value.args == (("accept-direct-cancel",) if sys.version_info >= (3, 11) else ())
+    assert close_events == [(1011, "cancelled", "accept-call", "11111111111111111111111111111111")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    assert terminating_sessions == []
+    assert disconnects == []
+    assert Session._current(websocket) is None  # pylint: disable=protected-access
+    assert set(session_module._CLOSE_ATTEMPTS) == baseline_attempts  # pylint: disable=protected-access
+    assert get_request_context().call_id is None
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("source", ["wait_for", "timeout", "inner_task"])
+async def test_voice_callback_local_cancellation_graph_is_internal_error(source):
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    close_events = []
+    disconnects = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(_session, _event):
+        await _raise_callback_local_cancellation(source)
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnects.append(event)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert not endpoint_task.cancelled()
+    assert disconnects == []
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.close"]
+    assert sent_messages[-1]["code"] == 1011
+    assert close_events == [(1011, "internal_error")]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("source", ["wait_for", "timeout"])
+async def test_voice_send_local_timeout_is_internal_error(source):
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    close_events = []
+    disconnects = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        if source == "wait_for":
+            await asyncio.wait_for(session.send(SessionReady()), timeout=0.01)
+            return
+        timeout = getattr(asyncio, "timeout", None)
+        if timeout is None:
+            pytest.skip("asyncio.timeout requires Python 3.11")
+        async with timeout(0.01):
+            await session.send(SessionReady())
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnects.append(event)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.send":
+            await asyncio.Future()
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert not endpoint_task.cancelled()
+    assert disconnects == []
+    assert [message["type"] for message in sent_messages] == [
+        "websocket.accept",
+        "websocket.send",
+        "websocket.close",
+    ]
+    assert sent_messages[-1]["code"] == 1011
+    assert close_events == [(1011, "internal_error")]
+    assert _live_voice_send_tasks() == []
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("source", ["wait_for", "timeout", "inner_task"])
+async def test_voice_disconnect_local_cancellation_graph_is_internal_error(source):
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    close_events = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(_session, _event):
+        await _raise_callback_local_cancellation(source)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert not endpoint_task.cancelled()
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    assert close_events == [(1001, "internal_error")]
+
+
+@pytest.mark.asyncio
+async def test_voice_recovers_cancellation_wrapped_by_disconnect_callback():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    callback_started = asyncio.Event()
+    captured_cancellations = []
+    close_events = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(_session, _event):
+        callback_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as cancellation:
+            captured_cancellations.append(cancellation)
+            raise RuntimeError("disconnect wrapped cancellation") from cancellation
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(callback_started.wait(), timeout=1)
+    endpoint_task.cancel("disconnect-owner-cancel")
+
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    if _tracks_task_cancellation_requests():
+        with pytest.raises(asyncio.CancelledError) as raised:
+            await asyncio.wait_for(endpoint_task, timeout=1)
+        assert len(captured_cancellations) == 1
+        assert raised.value is captured_cancellations[0]
+        assert raised.value.args == ("disconnect-owner-cancel",)
+        assert endpoint_task.cancelled()
+        assert close_events == [(1001, "cancelled")]
+    else:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+        assert len(captured_cancellations) == 1
+        assert not endpoint_task.cancelled()
+        assert close_events == [(1001, "internal_error")]
+
+
+@pytest.mark.asyncio
+async def test_voice_handler_cancellation_does_not_start_new_close_io():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [{"type": "websocket.connect"}]
+    handler_waiting = asyncio.Event()
+    close_events = []
+    sent_messages = []
+
+    async def receive():
+        if inbound_events:
+            return inbound_events.pop(0)
+        handler_waiting.set()
+        await asyncio.Future()
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    try:
+        await asyncio.wait_for(handler_waiting.wait(), timeout=1)
+        task.cancel("shutdown")
+        with pytest.raises(asyncio.CancelledError) as raised:
+            await asyncio.wait_for(task, timeout=1)
+    finally:
+        if not task.done():
+            task.cancel()
+            await asyncio.gather(task, return_exceptions=True)
+
+    assert raised.value.args == (("shutdown",) if sys.version_info >= (3, 11) else ())
+    assert close_events == [(1011, "cancelled")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+
+
+@pytest.mark.asyncio
+async def test_voice_preserves_explicit_handler_cancellation_identity():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    cancellation = asyncio.CancelledError("handler cancellation")
+    close_events = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(_session, _event):
+        raise cancellation
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    if sys.version_info >= (3, 11):
+        assert raised.value is cancellation
+    else:
+        assert raised.value.args == ()
+    assert close_events == [(1011, "cancelled")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+
+
+@pytest.mark.asyncio
+async def test_voice_materializes_callback_self_cancellation_before_finalization():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    close_events = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(_session, _event):
+        asyncio.current_task().cancel("callback-self-cancel")
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert raised.value.args == (("callback-self-cancel",) if sys.version_info >= (3, 11) else ())
+    assert close_events == [(1011, "cancelled")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+
+
+@pytest.mark.asyncio
+async def test_voice_recovers_cancellation_wrapped_by_handler():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    callback_started = asyncio.Event()
+    captured_cancellations = []
+    close_events = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(_session, _event):
+        callback_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as exc:
+            captured_cancellations.append(exc)
+            raise RuntimeError("handler wrapped cancellation") from exc
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(callback_started.wait(), timeout=1)
+    endpoint_task.cancel("shutdown-identity")
+
+    if _tracks_task_cancellation_requests():
+        with pytest.raises(asyncio.CancelledError) as raised:
+            await asyncio.wait_for(endpoint_task, timeout=1)
+        assert len(captured_cancellations) == 1
+        assert raised.value is captured_cancellations[0]
+        assert raised.value.args == ("shutdown-identity",)
+        assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+        assert close_events == [(1011, "cancelled")]
+    else:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+        assert len(captured_cancellations) == 1
+        assert not endpoint_task.cancelled()
+        assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.close"]
+        assert close_events == [(1011, "internal_error")]
+
+
+@pytest.mark.asyncio
+async def test_voice_recovers_cancellation_wrapped_during_accept_without_task_counter(monkeypatch):
+    monkeypatch.setattr(voice_host_module, "_task_cancellation_requests", lambda: None)
+    app = VoiceAgentServerHost(configure_observability=None)
+    accept_started = asyncio.Event()
+    captured_cancellations = []
+    close_events = []
+    sent_messages = []
+
+    async def receive():
+        return {"type": "websocket.connect"}
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.accept":
+            accept_started.set()
+            try:
+                await asyncio.Future()
+            except asyncio.CancelledError as exc:
+                captured_cancellations.append(exc)
+                raise OSError("accept wrapped cancellation") from exc
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(accept_started.wait(), timeout=1)
+    endpoint_task.cancel("accept-wrapper-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+    assert len(captured_cancellations) == 1
+    assert captured_cancellations[0].args == ("accept-wrapper-cancel",)
+    assert raised.value.args == (("accept-wrapper-cancel",) if sys.version_info >= (3, 11) else ())
+    if sys.version_info >= (3, 11):
+        assert raised.value is captured_cancellations[0]
+    assert endpoint_task.cancelled()
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    assert close_events == [(1011, "cancelled")]
+    assert _live_voice_transport_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_voice_recovers_cancellation_wrapped_during_receive_without_task_counter(monkeypatch):
+    monkeypatch.setattr(voice_host_module, "_task_cancellation_requests", lambda: None)
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [{"type": "websocket.connect"}]
+    receive_started = asyncio.Event()
+    captured_cancellations = []
+    wrapped_errors = []
+    close_events = []
+    sent_messages = []
+
+    async def receive():
+        if inbound_events:
+            return inbound_events.pop(0)
+        receive_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as cancellation:
+            captured_cancellations.append(cancellation)
+        error = OSError("receive wrapped cancellation")
+        wrapped_errors.append(error)
+        raise error
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(receive_started.wait(), timeout=1)
+    endpoint_task.cancel("receive-wrapper-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+    assert len(captured_cancellations) == 1
+    assert captured_cancellations[0].args == ("receive-wrapper-cancel",)
+    assert wrapped_errors[0].__cause__ is None
+    assert wrapped_errors[0].__context__ is None
+    assert raised.value.args == (("receive-wrapper-cancel",) if sys.version_info >= (3, 11) else ())
+    assert endpoint_task.cancelled()
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    assert close_events == [(1011, "cancelled")]
+    assert Session._current(websocket) is None  # pylint: disable=protected-access
+    assert _live_voice_transport_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_transport_operation_construction_failure_closes_coroutine_and_allows_retry(monkeypatch):
+    create_task = session_module.asyncio.create_task
+    close_coroutine = session_module._close_coroutine  # pylint: disable=protected-access
+    closed_coroutines = []
+    attempts = 0
+
+    def fail_once(coroutine, *, name=None):
+        nonlocal attempts
+        attempts += 1
+        if attempts == 1:
+            raise RuntimeError("transport task construction failed")
+        return create_task(coroutine, name=name)
+
+    def track_close(coroutine):
+        closed_coroutines.append(coroutine)
+        close_coroutine(coroutine)
+
+    async def operation(result):
+        return result
+
+    monkeypatch.setattr(session_module.asyncio, "create_task", fail_once)
+    monkeypatch.setattr(session_module, "_close_coroutine", track_close)
+
+    with pytest.raises(RuntimeError, match="transport task construction failed"):
+        await session_module._run_transport_operation(operation("first"))  # pylint: disable=protected-access
+
+    assert len(closed_coroutines) == 1
+    assert (
+        await session_module._run_transport_operation(operation("retry")) == "retry"
+    )  # pylint: disable=protected-access
+    assert _live_voice_transport_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_transport_operation_repeated_cancellation_drains_to_latest_owner():
+    operation_started = asyncio.Event()
+    first_cancellation_caught = asyncio.Event()
+    captured_cancellations = []
+    wrappers = []
+
+    async def operation():
+        operation_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as first_cancellation:
+            captured_cancellations.append(first_cancellation)
+            first_cancellation_caught.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as second_cancellation:
+            captured_cancellations.append(second_cancellation)
+            wrapper = OSError("transport wrapped terminal cancellation")
+            wrappers.append(wrapper)
+            raise wrapper from second_cancellation
+
+    owner = asyncio.create_task(
+        session_module._run_transport_operation(operation())  # pylint: disable=protected-access
+    )
+    await asyncio.wait_for(operation_started.wait(), timeout=1)
+    owner.cancel("first-cancel")
+    await asyncio.wait_for(first_cancellation_caught.wait(), timeout=1)
+    owner.cancel("terminal-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(owner, timeout=1)
+
+    assert [cancellation.args for cancellation in captured_cancellations] == [
+        ("first-cancel",),
+        ("terminal-cancel",),
+    ]
+    assert raised.value.args == (("terminal-cancel",) if sys.version_info >= (3, 11) else ())
+    assert wrappers[0].__cause__ is captured_cancellations[-1]
+    assert owner.cancelled()
+    assert _live_voice_transport_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_transport_operation_repeated_cancellation_ignores_stale_explicit_cause():
+    operation_started = asyncio.Event()
+    first_cancellation_caught = asyncio.Event()
+    captured_cancellations = []
+    wrappers = []
+
+    async def operation():
+        operation_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as first_cancellation:
+            captured_cancellations.append(first_cancellation)
+            first_cancellation_caught.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as latest_cancellation:
+            captured_cancellations.append(latest_cancellation)
+            wrapper = OSError("transport selected stale cancellation")
+            wrappers.append(wrapper)
+            raise wrapper from captured_cancellations[0]
+
+    owner = asyncio.create_task(
+        session_module._run_transport_operation(operation())  # pylint: disable=protected-access
+    )
+    await asyncio.wait_for(operation_started.wait(), timeout=1)
+    owner.cancel("first-cancel")
+    await asyncio.wait_for(first_cancellation_caught.wait(), timeout=1)
+    owner.cancel("latest-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(owner, timeout=1)
+
+    assert [cancellation.args for cancellation in captured_cancellations] == [
+        ("first-cancel",),
+        ("latest-cancel",),
+    ]
+    assert wrappers[0].__cause__ is captured_cancellations[0]
+    assert wrappers[0].__context__ is captured_cancellations[1]
+    assert raised.value.args == (("latest-cancel",) if sys.version_info >= (3, 11) else ())
+    assert owner.cancelled()
+    assert _live_voice_transport_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_transport_operation_late_owner_cancellation_supersedes_completed_child_cancellation(monkeypatch):
+    operation_started = asyncio.Event()
+    transfer_ready = asyncio.Event()
+    captured_cancellations = []
+    wrappers = []
+    pending_transfer = []
+    transfer_result = session_module._transfer_transport_result  # pylint: disable=protected-access
+
+    def hold_transfer(operation, waiter):
+        pending_transfer.append((operation, waiter))
+        transfer_ready.set()
+
+    async def operation():
+        operation_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as cancellation:
+            captured_cancellations.append(cancellation)
+            wrapper = OSError("transport wrapped first cancellation")
+            wrappers.append(wrapper)
+            raise wrapper from cancellation
+
+    monkeypatch.setattr(session_module, "_transfer_transport_result", hold_transfer)
+    owner = asyncio.create_task(
+        session_module._run_transport_operation(operation())  # pylint: disable=protected-access
+    )
+    await asyncio.wait_for(operation_started.wait(), timeout=1)
+    owner.cancel("first-cancel")
+    await asyncio.wait_for(transfer_ready.wait(), timeout=1)
+    assert len(pending_transfer) == 1
+    operation_task, waiter = pending_transfer[0]
+    assert operation_task.done()
+    assert not owner.done()
+
+    owner.cancel("latest-cancel")
+    transfer_result(operation_task, waiter)
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(owner, timeout=1)
+
+    assert captured_cancellations[0].args == ("first-cancel",)
+    assert raised.value.args == (("latest-cancel",) if sys.version_info >= (3, 11) else ())
+    assert wrappers[0].__cause__ is captured_cancellations[0]
+    assert owner.cancelled()
+    assert _live_voice_transport_tasks() == []
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("cancel_phase", ["before-transfer", "after-transfer"])
+async def test_transport_operation_cancellation_at_result_transfer_boundary(monkeypatch, cancel_phase):
+    transfer_ready = asyncio.Event()
+    pending_transfer = []
+    transfer_result = session_module._transfer_transport_result  # pylint: disable=protected-access
+
+    def hold_transfer(operation, waiter):
+        pending_transfer.append((operation, waiter))
+        transfer_ready.set()
+
+    async def operation():
+        return "transport-result"
+
+    monkeypatch.setattr(session_module, "_transfer_transport_result", hold_transfer)
+    owner = asyncio.create_task(
+        session_module._run_transport_operation(operation())  # pylint: disable=protected-access
+    )
+    await asyncio.wait_for(transfer_ready.wait(), timeout=1)
+    assert len(pending_transfer) == 1
+    operation_task, waiter = pending_transfer[0]
+    assert operation_task.done()
+    assert not owner.done()
+
+    if cancel_phase == "before-transfer":
+        owner.cancel("before-transfer-cancel")
+        await asyncio.sleep(0)
+        assert not owner.done()
+        transfer_result(operation_task, waiter)
+        expected_message = "before-transfer-cancel"
+    else:
+        transfer_result(operation_task, waiter)
+        owner.cancel("after-transfer-cancel")
+        expected_message = "after-transfer-cancel"
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(owner, timeout=1)
+
+    assert raised.value.args == ((expected_message,) if sys.version_info >= (3, 11) else ())
+    assert owner.cancelled()
+    assert _live_voice_transport_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_voice_accept_cannot_consume_owner_cancellation():
+    app = VoiceAgentServerHost(configure_observability=None)
+    accept_started = asyncio.Event()
+    consumed_cancellations = []
+    terminating_sessions = []
+    close_events = []
+    sent_messages = []
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.accept":
+            accept_started.set()
+            try:
+                await asyncio.Future()
+            except asyncio.CancelledError as cancellation:
+                consumed_cancellations.append(cancellation)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(accept_started.wait(), timeout=1)
+    endpoint_task.cancel("accept-consumed-owner-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+    assert raised.value.args == (("accept-consumed-owner-cancel",) if sys.version_info >= (3, 11) else ())
+    assert endpoint_task.cancelled()
+    assert terminating_sessions == []
+    assert close_events == [(1011, "cancelled")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    assert len(consumed_cancellations) == 1
+    assert consumed_cancellations[0].args == ("accept-consumed-owner-cancel",)
+    assert Session._current(websocket) is None  # pylint: disable=protected-access
+
+
+@pytest.mark.asyncio
+async def test_voice_receive_cannot_consume_owner_cancellation():
+    app = VoiceAgentServerHost(configure_observability=None)
+    receive_started = asyncio.Event()
+    consumed_cancellations = []
+    terminating_sessions = []
+    close_events = []
+    sent_messages = []
+    inbound_events = [{"type": "websocket.connect"}]
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    async def receive():
+        if inbound_events:
+            return inbound_events.pop(0)
+        receive_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as cancellation:
+            consumed_cancellations.append(cancellation)
+            return {"type": "websocket.receive", "text": "not-json"}
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(receive_started.wait(), timeout=1)
+    endpoint_task.cancel("receive-consumed-owner-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+    assert raised.value.args == (("receive-consumed-owner-cancel",) if sys.version_info >= (3, 11) else ())
+    assert endpoint_task.cancelled()
+    assert close_events == [(1011, "cancelled")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+    assert len(consumed_cancellations) == 1
+    assert consumed_cancellations[0].args == ("receive-consumed-owner-cancel",)
+    assert len(terminating_sessions) == 1
+    assert Session._current(websocket) is None  # pylint: disable=protected-access
+
+
+@pytest.mark.asyncio
+async def test_python310_application_callback_may_suppress_owner_cancellation(monkeypatch):
+    monkeypatch.setattr(voice_host_module, "_task_cancellation_requests", lambda: None)
+    app = VoiceAgentServerHost(configure_observability=None)
+    callback_started = asyncio.Event()
+    consumed_cancellations = []
+    terminating_sessions = []
+    close_events = []
+    sent_messages = []
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+
+    @app.on_session_start
+    async def on_session_start(_session, _event):
+        callback_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as cancellation:
+            consumed_cancellations.append(cancellation)
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(callback_started.wait(), timeout=1)
+    endpoint_task.cancel("event-consumed-owner-cancel")
+
+    await asyncio.wait_for(endpoint_task, timeout=1)
+    assert not endpoint_task.cancelled()
+    assert close_events == [(1002, None)]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.close"]
+    assert len(consumed_cancellations) == 1
+    assert consumed_cancellations[0].args == ("event-consumed-owner-cancel",)
+    assert len(terminating_sessions) == 1
+    assert Session._current(websocket) is None  # pylint: disable=protected-access
+
+
+@pytest.mark.asyncio
+async def test_voice_send_recovers_caller_cancellation_before_disconnect_classification():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    send_started = asyncio.Event()
+    captured_cancellations = []
+    application_cancellations = []
+    close_events = []
+    disconnects = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        try:
+            await session.send(SessionReady())
+        except asyncio.CancelledError as cancellation:
+            application_cancellations.append(cancellation)
+            raise
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnects.append(event)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.send":
+            send_started.set()
+            try:
+                await asyncio.Future()
+            except asyncio.CancelledError as cancellation:
+                captured_cancellations.append(cancellation)
+                raise OSError("send wrapped cancellation") from cancellation
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(send_started.wait(), timeout=1)
+    endpoint_task.cancel("send-owner-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert len(captured_cancellations) == 1
+    assert application_cancellations == captured_cancellations
+    assert captured_cancellations[0].args == ("send-owner-cancel",)
+    if _tracks_task_cancellation_requests():
+        assert raised.value is captured_cancellations[0]
+        assert raised.value.args == ("send-owner-cancel",)
+    else:
+        assert raised.value.args == ()
+    assert endpoint_task.cancelled()
+    assert disconnects == []
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.send"]
+    assert close_events == [(1011, "cancelled")]
+    assert _live_voice_send_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_voice_send_repeated_cancellation_drains_to_terminal_owner():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    send_started = asyncio.Event()
+    first_cancellation_caught = asyncio.Event()
+    captured_cancellations = []
+    close_events = []
+    disconnects = []
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        await session.send(SessionReady())
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnects.append(event)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        if message["type"] != "websocket.send":
+            return
+        send_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as first_cancellation:
+            captured_cancellations.append(first_cancellation)
+            first_cancellation_caught.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as second_cancellation:
+            captured_cancellations.append(second_cancellation)
+            raise OSError("send wrapped terminal cancellation") from second_cancellation
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(send_started.wait(), timeout=1)
+    endpoint_task.cancel("first-cancel")
+    await asyncio.wait_for(first_cancellation_caught.wait(), timeout=1)
+    endpoint_task.cancel("terminal-cancel")
+
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert [cancellation.args for cancellation in captured_cancellations] == [
+        ("first-cancel",),
+        ("terminal-cancel",),
+    ]
+    if _tracks_task_cancellation_requests():
+        assert raised.value is captured_cancellations[-1]
+    else:
+        assert raised.value.args == ()
+    assert disconnects == []
+    assert close_events == [(1011, "cancelled")]
+    assert _live_voice_send_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_voice_send_side_peer_loss_dispatches_disconnect_once():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    terminating_sessions = []
+    disconnects = []
+    close_events = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        await session.send(SessionReady())
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+
+    @app.on_disconnect
+    async def on_disconnect(session, event):
+        disconnects.append((session, event.code, event.reason))
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.send":
+            raise OSError("peer transport closed")
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert len(terminating_sessions) == 1
+    assert disconnects == [(terminating_sessions[0], 1006, None)]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.send"]
+    assert close_events == [(1006, None)]
+    assert Session._current(websocket) is None  # pylint: disable=protected-access
+    assert _live_voice_send_tasks() == []
+
+
+@pytest.mark.asyncio
+async def test_voice_send_side_peer_loss_wins_later_receive_disconnect():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        {"type": "websocket.disconnect", "code": 1001, "reason": "later receive"},
+    ]
+    observed_send_errors = []
+    disconnects = []
+    close_events = []
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        with pytest.raises(WebSocketDisconnect) as raised:
+            await session.send(SessionReady())
+        observed_send_errors.append(raised.value.code)
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnects.append((event.code, event.reason))
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.send":
+            raise OSError("peer transport closed")
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert observed_send_errors == [1006]
+    assert disconnects == [(1006, None)]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.send"]
+    assert close_events == [(1006, None)]
+    assert _live_voice_send_tasks() == []
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("telemetry_error", [RuntimeError("telemetry"), asyncio.CancelledError("telemetry")])
+async def test_voice_telemetry_failure_does_not_prevent_internal_error_close(telemetry_error):
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+    ]
+    sent_messages = []
+
+    @app.on_session_start
+    async def on_session_start(_session, _event):
+        raise RuntimeError("callback failed")
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+
+    def fail_telemetry(*_args, **_kwargs):
+        raise telemetry_error
+
+    app._emit_close_event = fail_telemetry  # type: ignore[method-assign]  # pylint: disable=protected-access
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    close_messages = [message for message in sent_messages if message["type"] == "websocket.close"]
+    assert [message["code"] for message in close_messages] == [1011]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("callback_kind", ["event", "disconnect"])
+@pytest.mark.parametrize(
+    "logging_failure",
+    [RuntimeError("logging"), _LoggingBaseException("logging"), asyncio.CancelledError("logging")],
+)
+async def test_voice_logging_failure_preserves_callback_outcome(callback_kind, logging_failure):
+    app = VoiceAgentServerHost(configure_observability=None)
+    if callback_kind == "event":
+        inbound_events = [
+            {"type": "websocket.connect"},
+            {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        ]
+        expected_code = 1011
+
+        @app.on_session_start
+        async def on_session_start(_session, _event):
+            raise ValueError("callback failed")
+
+    else:
+        inbound_events = [
+            {"type": "websocket.connect"},
+            {"type": "websocket.disconnect", "code": 1001},
+        ]
+        expected_code = 1001
+
+        @app.on_disconnect
+        async def on_disconnect(_session, _event):
+            raise ValueError("callback failed")
+
+    close_events = []
+    sent_messages = []
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+    handler = _RaisingLogHandler(logging_failure)
+    old_level = voice_host_module.logger.level
+    voice_host_module.logger.setLevel(logging.ERROR)
+    voice_host_module.logger.addHandler(handler)
+    try:
+        await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+    finally:
+        voice_host_module.logger.removeHandler(handler)
+        voice_host_module.logger.setLevel(old_level)
+
+    assert close_events == [(expected_code, "internal_error")]
+    close_messages = [message for message in sent_messages if message["type"] == "websocket.close"]
+    expected_wire_codes = [expected_code] if callback_kind == "event" else []
+    assert [message["code"] for message in close_messages] == expected_wire_codes
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    ("peer_loss", "close_failure"),
+    [(True, False), (False, False), (True, True)],
+    ids=["peer-loss", "successful-send-negative-control", "peer-loss-close-failure"],
+)
+async def test_voice_teardown_observes_in_flight_send_outcome_before_disconnect_dispatch(peer_loss, close_failure):
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+    send_started = asyncio.Event()
+    release_send = asyncio.Event()
+    retained_sessions = []
+    send_tasks = []
+    termination_calls = []
+    disconnects = []
+    close_events = []
+    sent_messages = []
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        retained_sessions.append(session)
+        send_tasks.append(asyncio.create_task(session.send(SessionReady())))
+        await asyncio.wait_for(send_started.wait(), timeout=1)
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        termination_calls.append(session)
+        release_send.set()
+
+    @app.on_disconnect
+    async def on_disconnect(session, event):
+        disconnects.append((session, event.code, event.reason))
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.send":
+            send_started.set()
+            await release_send.wait()
+            if peer_loss:
+                raise OSError("peer transport closed during teardown")
+        elif message["type"] == "websocket.close" and close_failure:
+            raise OSError("close transport failed after peer loss")
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    try:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+        send_results = await asyncio.wait_for(asyncio.gather(*send_tasks, return_exceptions=True), timeout=1)
+
+        assert termination_calls == retained_sessions
+        if peer_loss:
+            assert len(send_results) == 1
+            assert isinstance(send_results[0], WebSocketDisconnect)
+            assert send_results[0].code == 1006
+            assert disconnects == [(retained_sessions[0], 1006, None)]
+        else:
+            assert send_results == [None]
+            assert disconnects == []
+
+        disconnect_key = session_module._VOICE_DISCONNECT_EVENT_SCOPE_KEY  # pylint: disable=protected-access
+        assert disconnect_key not in websocket.scope
+        assert [message["type"] for message in sent_messages] == [
+            "websocket.accept",
+            "websocket.send",
+            "websocket.close",
+        ]
+        assert sent_messages[-1]["code"] == 1002
+        assert close_events == [(1002, None)]
+        assert Session._current(websocket) is None  # pylint: disable=protected-access
+        with pytest.raises(RuntimeError, match="terminating"):
+            await retained_sessions[0].send(SessionReady())
+        assert _live_voice_send_tasks() == []
+    finally:
+        release_send.set()
+        if not endpoint_task.done():
+            endpoint_task.cancel()
+            await asyncio.gather(endpoint_task, return_exceptions=True)
+        await asyncio.gather(*send_tasks, return_exceptions=True)
+        await _finish_close_attempts(baseline_attempts)
+
+
+@pytest.mark.asyncio
+async def test_voice_cleanup_precedes_close_serialized_behind_application_send():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+    send_started = asyncio.Event()
+    release_send = asyncio.Event()
+    close_started = asyncio.Event()
+    terminating = asyncio.Event()
+    sent_messages = []
+    generation_tasks = []
+    active_writes = 0
+    maximum_active_writes = 0
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        generation_tasks.append(asyncio.create_task(session.send(SessionReady())))
+        await asyncio.wait_for(send_started.wait(), timeout=1)
+
+    @app.on_connection_terminating
+    def on_connection_terminating(_session):
+        terminating.set()
+
+    async def receive():
+        if inbound_events:
+            return inbound_events.pop(0)
+        await asyncio.Future()
+
+    async def send(message):
+        nonlocal active_writes, maximum_active_writes
+        active_writes += 1
+        maximum_active_writes = max(maximum_active_writes, active_writes)
+        sent_messages.append(message)
+        try:
+            if message["type"] == "websocket.send":
+                send_started.set()
+                await release_send.wait()
+            elif message["type"] == "websocket.close":
+                close_started.set()
+        finally:
+            active_writes -= 1
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    try:
+        await asyncio.wait_for(terminating.wait(), timeout=1)
+        await asyncio.sleep(0)
+        assert not close_started.is_set()
+
+        release_send.set()
+        await asyncio.wait_for(endpoint_task, timeout=1)
+        await asyncio.wait_for(asyncio.gather(*generation_tasks), timeout=1)
+    finally:
+        release_send.set()
+        if not endpoint_task.done():
+            endpoint_task.cancel()
+            await asyncio.wait_for(asyncio.gather(endpoint_task, return_exceptions=True), timeout=1)
+        for generation_task in generation_tasks:
+            if not generation_task.done():
+                generation_task.cancel()
+        await asyncio.wait_for(asyncio.gather(*generation_tasks, return_exceptions=True), timeout=1)
+        await _finish_close_attempts(baseline_attempts)
+
+    assert maximum_active_writes == 1
+    assert [message["type"] for message in sent_messages] == [
+        "websocket.accept",
+        "websocket.send",
+        "websocket.close",
+    ]
+    assert sent_messages[-1]["code"] == 1002
+
+
+@pytest.mark.asyncio
+async def test_voice_cleanup_marks_session_terminal_before_cancelling_application_work():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+    generation_started = asyncio.Event()
+    generation_tasks = []
+    late_send_errors = []
+    sent_messages = []
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    async def generation(session):
+        generation_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError:
+            try:
+                await session.send(SessionReady())
+            except RuntimeError as exc:
+                late_send_errors.append(exc)
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        generation_tasks.append(asyncio.create_task(generation(session)))
+        await generation_started.wait()
+
+    @app.on_connection_terminating
+    def on_connection_terminating(_session):
+        for task in generation_tasks:
+            task.cancel()
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+
+    try:
+        await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+        await asyncio.wait_for(asyncio.gather(*generation_tasks), timeout=1)
+    finally:
+        for generation_task in generation_tasks:
+            if not generation_task.done():
+                generation_task.cancel()
+        await asyncio.wait_for(asyncio.gather(*generation_tasks, return_exceptions=True), timeout=1)
+        await _finish_close_attempts(baseline_attempts)
+
+    assert len(late_send_errors) == 1
+    assert str(late_send_errors[0]) == "Voice Session is terminating"
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.close"]
+
+
+@pytest.mark.asyncio
+async def test_voice_endpoint_cancellation_does_not_wait_for_blocked_application_send():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": json.dumps(_session_start_frame())},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+    send_started = asyncio.Event()
+    release_send = asyncio.Event()
+    terminating = asyncio.Event()
+    close_events = []
+    sent_messages = []
+    generation_tasks = []
+    retained_sessions = []
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    @app.on_session_start
+    async def on_session_start(session, _event):
+        retained_sessions.append(session)
+        generation_tasks.append(asyncio.create_task(session.send(SessionReady())))
+        await asyncio.wait_for(send_started.wait(), timeout=1)
+
+    @app.on_connection_terminating
+    def on_connection_terminating(_session):
+        terminating.set()
+
+    async def receive():
+        if inbound_events:
+            return inbound_events.pop(0)
+        await asyncio.Future()
+
+    async def send(message):
+        sent_messages.append(message)
+        if message["type"] == "websocket.send":
+            send_started.set()
+            await release_send.wait()
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    try:
+        await asyncio.wait_for(terminating.wait(), timeout=1)
+        endpoint_task.cancel("shutdown")
+        with pytest.raises(asyncio.CancelledError) as raised:
+            await asyncio.wait_for(endpoint_task, timeout=1)
+
+        assert raised.value.args == (("shutdown",) if sys.version_info >= (3, 11) else ())
+        assert Session._current(websocket) is None  # pylint: disable=protected-access
+        assert close_events == [(1002, "cancelled")]
+        assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.send"]
+        with pytest.raises(RuntimeError, match="terminating"):
+            await retained_sessions[0].send(SessionReady())
+    finally:
+        release_send.set()
+        if not endpoint_task.done():
+            endpoint_task.cancel()
+            await asyncio.gather(endpoint_task, return_exceptions=True)
+        await asyncio.gather(*generation_tasks, return_exceptions=True)
+        await _finish_close_attempts(baseline_attempts)
+
+
+@pytest.mark.asyncio
+async def test_voice_disconnect_callback_failure_preserves_peer_close_code():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001, "reason": "going away"},
+    ]
+    close_events = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(_session, _event):
+        raise RuntimeError("disconnect callback failed")
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert close_events == [(1001, "internal_error")]
+    close_messages = [message for message in sent_messages if message["type"] == "websocket.close"]
+    assert close_messages == []
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("terminal_source", ["peer", "protocol", "accept_failure"])
+@pytest.mark.parametrize("termination_error_kind", ["exception", "cancellation"])
+async def test_voice_termination_callback_failure_is_internal_error(
+    terminal_source,
+    termination_error_kind,
+):
+    app = VoiceAgentServerHost(configure_observability=None)
+    if terminal_source == "peer":
+        inbound_events = [
+            {"type": "websocket.connect"},
+            {"type": "websocket.disconnect", "code": 1001},
+        ]
+        expected_code = 1001
+        expected_message_types = ["websocket.accept"]
+    elif terminal_source == "protocol":
+        inbound_events = [
+            {"type": "websocket.connect"},
+            {"type": "websocket.receive", "text": "not-json"},
+        ]
+        expected_code = 1002
+        expected_message_types = ["websocket.accept", "websocket.close"]
+    else:
+        inbound_events = [{"type": "websocket.connect"}]
+        expected_code = 1011
+        expected_message_types = ["websocket.accept", "websocket.close"]
+
+    terminating_sessions = []
+    disconnects = []
+    close_events = []
+    sent_messages = []
+
+    @app.on_connection_terminating
+    def on_connection_terminating(session):
+        terminating_sessions.append(session)
+        if termination_error_kind == "cancellation":
+            raise asyncio.CancelledError("termination hook cancellation")
+        raise RuntimeError("termination hook failed")
+
+    @app.on_disconnect
+    async def on_disconnect(_session, event):
+        disconnects.append(event.code)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+        if terminal_source == "accept_failure" and message["type"] == "websocket.accept":
+            raise OSError("accept failed after commit")
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert not endpoint_task.cancelled()
+    assert len(terminating_sessions) == 1
+    assert disconnects == ([1001] if terminal_source == "peer" else [])
+    assert [message["type"] for message in sent_messages] == expected_message_types
+    assert close_events == [(expected_code, "internal_error")]
+
+
+@pytest.mark.asyncio
+async def test_voice_termination_failure_wins_classification_during_endpoint_cancellation():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.receive", "text": "not-json"},
+    ]
+    termination_contexts = []
+    close_events = []
+    sent_messages = []
+    endpoint_task = None
+    baseline_attempts = set(session_module._CLOSE_ATTEMPTS)  # pylint: disable=protected-access
+
+    @app.on_connection_terminating
+    def on_connection_terminating(_session):
+        termination_contexts.append(get_request_context().call_id)
+        assert endpoint_task is asyncio.current_task()
+        endpoint_task.cancel("cleanup-cancel")
+        raise RuntimeError("termination hook failed")
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([(b"x-agent-foundry-call-id", b"cleanup-cancel-call")])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append(
+            (code, error_code, get_request_context().call_id)
+        )
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    try:
+        with pytest.raises(asyncio.CancelledError) as raised:
+            await asyncio.wait_for(endpoint_task, timeout=1)
+    finally:
+        await _finish_close_attempts(baseline_attempts)
+
+    assert raised.value.args == (("cleanup-cancel",) if sys.version_info >= (3, 11) else ())
+    assert termination_contexts == ["cleanup-cancel-call"]
+    assert close_events == [(1002, "internal_error", "cleanup-cancel-call")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept", "websocket.close"]
+    assert get_request_context().call_id is None
+
+
+@pytest.mark.asyncio
+async def test_voice_both_cleanup_hook_failures_preserve_peer_code():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    close_events = []
+    sent_messages = []
+
+    @app.on_connection_terminating
+    def on_connection_terminating(_session):
+        raise RuntimeError("termination hook failed")
+
+    @app.on_disconnect
+    async def on_disconnect(_session, _event):
+        raise RuntimeError("disconnect hook failed")
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    await asyncio.wait_for(app._ws_endpoint(websocket), timeout=1)  # pylint: disable=protected-access
+
+    assert close_events == [(1001, "internal_error")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+
+
+@pytest.mark.asyncio
+async def test_voice_direct_disconnect_hook_cancellation_is_internal_error():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    close_events = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(_session, _event):
+        raise asyncio.CancelledError("hook-local cancellation")
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert not endpoint_task.cancelled()
+    assert close_events == [(1001, "internal_error")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+
+
+@pytest.mark.asyncio
+async def test_voice_disconnect_callback_self_cancellation_is_diagnosed():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    close_events = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(_session, _event):
+        asyncio.current_task().cancel("disconnect-self-cancel")
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    with pytest.raises(asyncio.CancelledError) as raised:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+
+    assert raised.value.args == (("disconnect-self-cancel",) if sys.version_info >= (3, 11) else ())
+    assert endpoint_task.cancelled()
+    assert close_events == [(1001, "cancelled")]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
+
+
+@pytest.mark.asyncio
+async def test_voice_disconnect_callback_cannot_consume_owner_cancellation():
+    app = VoiceAgentServerHost(configure_observability=None)
+    inbound_events = [
+        {"type": "websocket.connect"},
+        {"type": "websocket.disconnect", "code": 1001},
+    ]
+    callback_started = asyncio.Event()
+    consumed_cancellations = []
+    close_events = []
+    sent_messages = []
+
+    @app.on_disconnect
+    async def on_disconnect(_session, _event):
+        callback_started.set()
+        try:
+            await asyncio.Future()
+        except asyncio.CancelledError as cancellation:
+            consumed_cancellations.append(cancellation)
+
+    async def receive():
+        return inbound_events.pop(0)
+
+    async def send(message):
+        sent_messages.append(message)
+
+    websocket = _websocket_with_headers([])
+    websocket._receive = receive  # pylint: disable=protected-access
+    websocket._send = send  # pylint: disable=protected-access
+    app._emit_close_event = (  # type: ignore[method-assign]  # pylint: disable=protected-access
+        lambda _session_id, code, _duration_ms, *, error_code=None: close_events.append((code, error_code))
+    )
+
+    endpoint_task = asyncio.create_task(app._ws_endpoint(websocket))  # pylint: disable=protected-access
+    await asyncio.wait_for(callback_started.wait(), timeout=1)
+    endpoint_task.cancel("consumed-owner-cancel")
+
+    if _tracks_task_cancellation_requests():
+        with pytest.raises(asyncio.CancelledError) as raised:
+            await asyncio.wait_for(endpoint_task, timeout=1)
+        assert len(consumed_cancellations) == 1
+        assert consumed_cancellations[0].args == ("consumed-owner-cancel",)
+        assert raised.value.args == ()
+        assert endpoint_task.cancelled()
+        assert close_events == [(1001, "cancelled")]
+    else:
+        await asyncio.wait_for(endpoint_task, timeout=1)
+        assert len(consumed_cancellations) == 1
+        assert not endpoint_task.cancelled()
+        assert close_events == [(1001, None)]
+    assert [message["type"] for message in sent_messages] == ["websocket.accept"]
diff --git a/sdk/agentserver/cspell.yaml b/sdk/agentserver/cspell.yaml
index 5a328242466b..291fa9434220 100644
--- a/sdk/agentserver/cspell.yaml
+++ b/sdk/agentserver/cspell.yaml
@@ -40,6 +40,7 @@ words:
   - dedup
   - dedups
   - dones
+  - dtmf
   - Dunders
   - elts
   - ename
@@ -57,6 +58,7 @@ words:
   - hdrs
   - hypercorn
   - idless
+  - idtoken
   - impls
   - injectively
   - inmemory
@@ -91,6 +93,7 @@ words:
   - RAPI
   - rchain
   - RDWR
+  - retriable
   - rtype
   - sess
   - starlette
@@ -108,6 +111,7 @@ words:
   - unstarted
   - valeriepham
   - Vnext
+  - xapitoken
   - xhigh
 ignorePaths:
   - sdk/agentserver/azure-ai-agentserver-activity/**/*.csv