The confirmation cards of the chat (spec §12 Ф2, Б2.2): a write the model asked for waits for the user, who runs it, turns it down or asks for it again.

A turn never writes (PhoenixKitAgent.Turns.Runner): core answers a write of a live session with a preview and holds the call in a confirmation row bound to the user (PhoenixKit.API.Executor.execute_as/5, allow: :all), and the turn stores a tool message needs_confirmation with the row's uuid (confirmation_uuid) and the answer that asked for it (assistant_message_uuid), and ends there. A card is that message; it waits while the chat has no notice with the same confirmation_uuid.

Like PhoenixKitAgent.Conversations, every function acts for a live browser session and takes the answer of MultiSession.impersonated?/1 for it: an impersonated session, a session that cannot act, a user who may not use the assistant, someone else's chat, or a message that is not a card of it, are refused before anything else is read (the refusals of Conversations.owned_conversation/3, then :not_waiting).

A click

confirm/5, reject/5 and repeat/5 take the user's turn lock for the click (PhoenixKitAgent.Turns.Locks.acquire_user/4): while a turn of the user runs, a click is {:error, :turn_running}, while another click runs {:error, :click_running}, and no turn starts while a click runs (the turn is refused :click_in_flight). The lock blocks a turn for 30 s from the moment it was last kept: a process next to the click, under PhoenixKitAgent.Confirmations.TaskSupervisor, keeps it fresh every 10 s for as long as the click runs (Locks.keep_user/4; config :phoenix_kit_agent, click_keep_ms:, held between 100 ms and 15 s, half the hold), and stops with it, so a lock never released (its node went down) frees the user's turns 30 s after its last keep. Should the database refuse the keeps for longer than the hold, a turn may start while the click still runs. A click calls no model and stores no user message, so it spends neither money nor a turn of the user's limits. The card is read again under the lock.

• confirm/5 redeems the row (Executor.redeem_as/6) with the same tool and the arguments the model sent — the registry name of the card and PhoenixKitAgent.Turns.Tools.arguments/1 of the call in its assistant message — under the rights of the session that clicks, now. Core checks everything again (the session, the tool and its module, the "Agent may act" box, the scope and the permission, the rate limit, the input, a fresh dry run against the preview's fingerprint) and spends the row atomically before the handler runs.
• reject/5 turns the row down (PhoenixKit.API.Confirm.reject_for_user/2).
• repeat/5, for a card whose row ran out (or that core has deleted), asks for the same call again (execute_as/5): a new card.

What became of the card is a new notice with its confirmation_uuid, the tool's name and tool_outcome:

• confirmed — the handler ran; and also for a row core had spent already with no notice of it here (core's used to redeem_as/6 or reject_for_user/2, read back as used with get_for_user/2, or, when that read is withheld because the user may no longer use the tool, with lookup_for_user/2): the click that spent it was lost after core spent it, and core spends the row right before the handler runs. Should the row not read so, the card keeps waiting with the reason;
• rejected;
• expired — the row ran out, or is gone: core's invalid (it deletes its rows) reads as expired too;
• changed — the values changed under the preview: core holds the call in a new row, which is a new card with the same assistant message, stored right after the notice in the same transaction (as is the new card of "Ask again" with the expired notice of a card not yet closed): both are there, or neither;
• failed — only when the handler failed after core spent the row (an error of redeem_as/6 with the row used).

A notice the chat refuses (it was deleted meanwhile) makes the click {:error, :not_stored}, whatever core did.

A card can also stop waiting with no click to say so: its row ran out, core deleted it, or the click that settled it was lost with its node. settle_lapsed/3 (the chat panel, when it opens a chat) and settle_lapsed_in_turn/2 (a turn, before it reads the history) give such a card its notice by what core's row says — used is confirmed, rejected is rejected, a row that ran out or is gone is expired — so neither the panel nor the model takes it for waiting. A card the user may no longer run (the right to its tool is gone) still waits, for "Cancel the change".

A refusal before the row is spent — the session, the rights, the module's box, the handler's own dry run, the rate limit — writes nothing: the card keeps waiting and the click answers {:error, {:refused, code}} with core's code. Such a notice is the only thing of a click the model learns, in the history of the next turn (PhoenixKitAgent.Turns.History), where a card with no notice yet reads as waiting.

Neither the arguments, nor the preview, nor what the handler returned are stored or logged here.