Tool-copied preview strings: refuse only when they could mislead

When an LLM agent must copy an opaque server-minted string (here, a ~300-char micro preview of a video shown on a confirmation card) into a write call, exact-equality checks turn a rare one-character copy error into a refused write. Give each frame a checksum so a garbled frame decodes to null and the UI just skips it. Then on the server refuse only when the copied value contains a frame that decodes but wasn't minted for that file, or a different duration. That keeps the anti-swap guarantee (the card can't show video A while sending B) without punishing harmless copy noise. Also, in VoiceOS, an agent may route 'pull up my <app> profile' to the built-in open_app action (it opens the website) unless your read tool's description names show/pull up/see profile explicitly.