samagotchi 0.109.0 → 0.111.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 296c5f9af0f1605fb4f2d92a82c7bcd0e435adcebded5e7c18638aeb1c651595
-  data.tar.gz: 57b18910dabdcc0b0239f9986d49ee369f6231dd5c182bc1b885812e6be4ecbb
+  metadata.gz: c3030ebe01072de864d730b27cfc709368d48948260f07b3e37fa83f8ba4b87a
+  data.tar.gz: 38f33d3c633d5467c8200817c2a12fc5fd0e287cf87cbd5233f0486326280eed
 SHA512:
-  metadata.gz: 969c44f06a17ccceb15b7bcfa7253c7543da71142c3d535c697844622832b69e4a9002f85e1ec6f1226edfda9001b347a2c0df186b683d5b75a4249ab555ebb3
-  data.tar.gz: a1724dec2c5e7a76794a74b9ffca5d3f85d60f9529a85114cfba656a5958f6401aab48ec1264b4e49db4384db2ceee830dca992b5645caef43f988c9b13d9ca9
+  metadata.gz: af19fcb8e29f712f43098d68d466bb8e68bdfc3b87177d7a2f99e73a2b609a535322ab181cacae03d7cf00e774a2f28933ff5b3ba30446d3e4112724f213bf6f
+  data.tar.gz: 72fb51ec5f3d216a36e27a040643517104fc8988f8010b6bdc70ac4f3b2bd2db281a4cc629a54b75e88dfbe46b78d02014bfc65142f39e40e6952ab13c919f7f

data/CHANGELOG.md

@@ -8,6 +8,60 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.111.0] - 2026-10-24
+
+### Added
+
+- chi web: push notifications to a phone's Home Screen app (approvals and questions) over an https public URL
+  (`chi web --tunnel tailscale`): add chi web to the Home Screen, tap the bell. An answered question's notification goes
+  when the app opens (every push shows one: iOS drops an app that pushes silently). New settings `web.push.enabled` (default on) and `web.push.contact`. See
+  docs/configuration.md (Phone notifications).
+
+### Fixed
+
+- `chi send --new --wait` now knows the id of the turn the new session's first prompt runs, so a `--timeout` or
+  Ctrl-C there says `still running: chi send --wait --turn <T> <ID>` instead of the vaguer "waits again", and
+  `chi send --wait --turn <T> <ID>` gets that turn's reply (`--format json` carries its `turn_id`). chi web's
+  create answers the first turn's id as `first_turn_id`, so the same holds for `chi --remote … send --new --wait`.
+- Web: a session's stream dropping mid-turn (a phone briefly offline) no longer shows "canceled (worker exited)"
+  while the worker runs on; the page re-reads first and shows it only when no worker took the turn. A re-read that
+  fails (the network still down) is retried with a backoff, and a stage that lets go of a turn clears its status row
+  and chip, so it no longer reads "thinking · step 1" for a turn it stopped following.
+
+Update with `chi update` (the system bundle 0.111.0), then restart `chi web`.
+
+## [0.110.0] - 2026-10-24
+
+### Added
+
+- Experimental: `chi web --tunnel tailscale`: chi web on your phone anywhere on your tailnet over https (Tailscale
+  Serve on this machine's `ts.net` name, never Funnel), with your Tailscale login as the owner (or
+  `web.proxy.owner`), for this run only (nothing written to config.yml). It checks Tailscale, the certificate and
+  what Serve already has on port 443 before it changes anything, adopts a serve left by an earlier run, refuses
+  anything else on 443, prints the owner link's QR code, warns when Tailnet Lock is off, and turns the serve off on
+  exit (only while 443 still serves exactly what it set). The proxied start line (`web.public_url`) also shows its
+  link's QR code at a terminal now. See docs/configuration.md (Tailscale Serve).
+- Sessions record when each message happened: prompts, lines merged into a turn, reminders, notes and the model's
+  replies carry `at` in the session file (never sent to the model); plugins see it in `ctx.messages`.
+- Reminders tell the model the local time they came due (`[SYSTEM: REMINDERS DUE 2026-10-24 14:32 local]`), so it
+  can reason about how long ago something happened.
+- Terminal (attached and the REPL): a dim `── 14:32 · 47 min later ──` divider before what comes after 10 minutes
+  or more of quiet, a `── last activity 14:32 · 47 min ago ──` line when attaching after such a gap, and the recap's
+  time in its head (`recap 14:32>`). See docs/cli.md (Time gaps).
+- Web: a dim `── 14:32 · 47 min later ──` line in the history where 10 minutes or more of quiet passed between
+  turns, notes or reminders (live and after a reload, the participant's review page too), each prompt, answer and
+  note's full time on hover, and the recap's time in its label (`recap · 14:32`).
+
+### Fixed
+
+- `chi send --wait` with no message on a running turn that has no turn id (a session's first prompt, a reminder
+  turn), and a `chi send --wait -m` whose message merged into the running turn, end `canceled` (`worker_stopped`)
+  when that turn's worker dies and the next worker settles it, instead of waiting until `--timeout`.
+- Attached TUI: joining an older session (one with no saved record of the call) shows a call the guardrails denied
+  as `blocked`, not `error`.
+
+Update with `chi update` (the system bundle 0.110.0), then restart `chi web`.
+
 ## [0.109.0] - 2026-10-24
 
 ### Added
@@ -4196,7 +4250,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.109.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.111.0...HEAD
+[0.111.0]: https://github.com/dm1try/samagotchi/compare/v0.110.0...v0.111.0
+[0.110.0]: https://github.com/dm1try/samagotchi/compare/v0.109.0...v0.110.0
 [0.109.0]: https://github.com/dm1try/samagotchi/compare/v0.108.0...v0.109.0
 [0.108.0]: https://github.com/dm1try/samagotchi/compare/v0.107.0...v0.108.0
 [0.107.0]: https://github.com/dm1try/samagotchi/compare/v0.106.0...v0.107.0

data/bin/chi

@@ -120,6 +120,10 @@ if options[:new_token] && !web
   warn "Error: --new-token goes with chi web (chi web --new-token)"
   exit 1
 end
+if options[:tunnel] && !web
+  warn "Error: --tunnel goes with chi web (chi web --tunnel tailscale)"
+  exit 2
+end
 if options[:sets] && web
   warn "Error: --set is a new session's (chi --set, chi send --new --set), not chi web's"
   exit 2
@@ -208,7 +212,7 @@ if options[:web]
   markdown = Samagotchi::Config.get("web.markdown") if markdown.nil?
   view = Samagotchi::Config.get("web.view")
   exit Samagotchi::Web::Server.launch(port: port, scope: options[:scope] || "project", open_browser: options[:web_open],
-                                      markdown: markdown, view: view, new_token: options[:new_token],
+                                      markdown: markdown, view: view, new_token: options[:new_token], tunnel: options[:tunnel],
                                       working_set: Samagotchi::Config.get("web.working_set"),
                                       annotate_presets: Samagotchi::Config.get("web.annotate_presets"),
                                       editor: Samagotchi::Config.get("web.editor"))

data/docs/architecture.md

@@ -153,7 +153,7 @@ agent logic and can be used without any terminal rendering; the UI is a thin lay
 | UI | `Samagotchi::TerminalUI` | Interactive REPL (Reline), rendering (ANSI, spinner, status line), REPL commands. Delegates all core work to an `Engine`. |
 | Model loops and adapters | `KernelLoop`, `LLM::ChatLoop`, `Samagotchi::Client`, `LLM::OpenAIChat`, `LLM::AnthropicMessages`, `LLM::HTTP` | The model↔tool loops and the HTTP adapters they talk through (see "Model loops and adapters"). |
 | Bridge (SSE/HTTP) | `Samagotchi::Bridge`, `SessionManager` | The **single live client transport**: an SSE read stream + HTTP POST turn/cancel/answer surface that attaches to a worker's existing `Engine` via `Engine#subscribe`. Every session worker starts it (bound `127.0.0.1`, no auth, localhost-only). |
-| Web (Rack) | `Samagotchi::Web::App`, `SessionManager` | Single-port `127.0.0.1:4567` control plane via `rack`+`webrick` (serve `index.html` + `/api/*`). With `web.host: lan` (or one of this machine's IPv4 addresses) the server also listens on that address, where every request but this machine's needs the access token (`App#token_gate`: the `chi_token` cookie or `Authorization: Bearer`; [CLI](cli.md#chi-web-on-your-phone)). Experimental: behind an auth proxy (`web.public_url`, `Web::ProxyGate`) every request needs the token, this machine's too, and one that came through the proxy also the configured identity header for the owner ([configuration.md](configuration.md#behind-an-auth-proxy)). A request goes through, in order: the Host check (`local_host_header?`: loopback names, the LAN address, the public host), the cross-site check (`cross_site?`: Origin this server's or the public origin, no `Sec-Fetch-Site` cross-site/same-site on a POST or `/api`), the frame check (`framed?`: a frame/embed/object load from another origin, 403 `framed`; every HTML answer carries `X-Frame-Options: DENY` and `frame-ancestors 'none'`), the token gate (`token_gate` → `principal_for`, `proxied_principal` for a proxied request; the `?token=` / `POST /api/token` trade sets the cookie, `__Host-chi_token` through the proxy; with `web.public_url` a direct request takes Bearer only, and chi's token-less `/api/info` probe gets `probe_info`), then the route's permission (`Principal#permits?`). It talks to each worker's Bridge (`App#relay`, `bridge_get`; `/stream` proxies it) and reads the session files; no `Engine` of its own. Markdown (`web.markdown`) is rendered here only (`Web::MarkdownRenderer`): the answers it serves, card bodies, and `POST /api/render` for a text the page already shows. `bin/chi web` entrypoint. |
+| Web (Rack) | `Samagotchi::Web::App`, `SessionManager` | Single-port `127.0.0.1:4567` control plane via `rack`+`webrick` (serve `index.html` + `/api/*`). With `web.host: lan` (or one of this machine's IPv4 addresses) the server also listens on that address, where every request but this machine's needs the access token (`App#token_gate`: the `chi_token` cookie or `Authorization: Bearer`; [CLI](cli.md#chi-web-on-your-phone)). Experimental: behind an auth proxy (`web.public_url`, `Web::ProxyGate`) every request needs the token, this machine's too, and one that came through the proxy also the configured identity header for the owner ([configuration.md](configuration.md#behind-an-auth-proxy)). A request goes through, in order: the Host check (`local_host_header?`: loopback names, the LAN address, the public host), the cross-site check (`cross_site?`: Origin this server's or the public origin, no `Sec-Fetch-Site` cross-site/same-site on a POST or `/api`), the frame check (`framed?`: a frame/embed/object load from another origin, 403 `framed`; every HTML answer carries `X-Frame-Options: DENY` and `frame-ancestors 'none'`), the token gate (`token_gate` → `principal_for`, `proxied_principal` for a proxied request; the `?token=` / `POST /api/token` trade sets the cookie, `__Host-chi_token` through the proxy; with `web.public_url` a direct request takes Bearer only, and chi's token-less `/api/info` probe gets `probe_info`), then the route's permission (`Principal#permits?`). It talks to each worker's Bridge (`App#relay`, `bridge_get`; `/stream` proxies it) and reads the session files; no `Engine` of its own. Markdown (`web.markdown`) is rendered here only (`Web::MarkdownRenderer`): the answers it serves, card bodies, and `POST /api/render` for a text the page already shows. `App` keeps the gate, `ROUTES` and the helpers the handlers share; its handlers live in mixins it includes, each a `Web::` module with private methods: `SessionAccessRoutes` (`web/session_access_routes.rb`), `ParticipantAccess` (`web/participant_access.rb`), `ParticipantsAdmin` (`web/participants_admin.rb`), `ParticipantReview` (`web/participant_review.rb`), `MessageDisplay` (`web/message_display.rb`), `SessionShow` (`web/session_show.rb`), `SessionCreate` (`web/session_create.rb`), `SessionControl` (`web/session_control.rb`), `PushRoutes` (`web/push_routes.rb`) and `ProxyGate` (`web/proxy_gate.rb`). Exact paths in `GATE_FREE_PATHS` are served before the token gate (the fragment trade's script, and the Home Screen app's manifest, service worker and icons). `bin/chi web` entrypoint. |
 | Sessions | `Samagotchi::Session`, `SessionManager` | File-based `~/.local/state/samagotchi/sessions/<uuid>.json` + sidecar `input/`/`output/`; retention (14d/500) + ordering (`updated_at desc`). |
 
 - `bin/chi` in REPL mode (see `LaunchMode` above) builds `TerminalUI`. `TerminalUI#run` is the single
@@ -530,7 +530,7 @@ model: [internals/remote-sessions.md](internals/remote-sessions.md).
 |---|---|---|---|---|
 | `GET /api/sessions/resolve?id=` | owner | an id or a unique prefix | 200 `{id}` | 404 `not_found`; 400 `ambiguous_id` with `ids` |
 | `GET /api/sessions/summaries` | owner | `dir` (a folder: its project; none: every project), `cwd`, `live=1`, `archived=1`, `tests=0`, `sort`, `order`, `limit` | 200: the rows `chi sessions list` prints (`SessionManager.session_summaries`: `status`, `live`, `busy`, `owner`, `recap`, `ctx_pct`, `waiting`, `waiting_id`, `title`, `preview`, …) | 400 `invalid_dir`, `invalid_cwd` |
-| `POST /api/sessions` (more fields) | owner | `toolkit`, `tools`, `no_tools`, `parent_answers`; `client_id` (`cli:send`/`cli:answer`: the first line is checked as chi send checks it); `check_vision: true` (images follow) | 201 adds `model_warning` and `parent_answers_warning` (a level looser than config.yml's, capped) | 400 `invalid_toolkit`, `invalid_parent_answers`, `invalid_continues` (beside `continues`); 403 `parent_answers_refused`, `parent_continue_refused`; 422 `no_vision` |
+| `POST /api/sessions` (more fields) | owner | `toolkit`, `tools`, `no_tools`, `parent_answers`; `client_id` (`cli:send`/`cli:answer`: the first line is checked as chi send checks it); `check_vision: true` (images follow) | 201 adds `model_warning`, `parent_answers_warning` (a level looser than config.yml's, capped) and `first_turn_id` (the id the prompt it starts with gets for its turn; null for an `idle` create) | 400 `invalid_toolkit`, `invalid_parent_answers`, `invalid_continues` (beside `continues`); 403 `parent_answers_refused`, `parent_continue_refused`; 422 `no_vision` |
 | `POST /api/sessions/:id/turn` (more fields) | owner | `client_id` as above; `check_vision: true` with `images` | as before | 403 `parent_answers_refused`, `parent_continue_refused`; 422 `no_vision` |
 | `POST /api/sessions/:id/wait/prepare` | owner | `question_id` (absent: the pending one; `null`: none), `turn`, `created`, `busy` (+ `queue`) | 200 `{session_id, cursor, baseline: {messages, question_id, last_turn}, own_turn, known_turn, running, live, settled, last_turn_id}` (`WaitStart`) | 409 `busy`, `waiting` (`SendCommand::Busy`'s words, and its fields: `question`, `parent_strategy`) |
 | `POST /api/sessions/:id/wait` | owner | `cursor`, `baseline`, `turn`, `queued`, `ended_before`, `owner_grace`, `timeout` (capped at 30 s) | 200: `ReplyWait::Result`'s fields (`status`: `done`, `waiting_for_answer`, `no_reply`, `error`, `stopped`, `worker_gone`, or `timeout`: ask again; `text`, `file`, `question` as `PendingQuestion#to_file`, `outcome`, `limit`, `error_kind`, `retryable`, `cancel_reason`, `stopped_by`, `kept_steps`, `turn_id`, `origin`; never the session) and `parent_strategy` `{name, allowed, origin}` (`ParentReport.strategy_for`, this server's config.yml) | 400 `invalid_wait`; 503 `server_stopping` |
@@ -610,9 +610,10 @@ so later requests and resumed sessions pair them, and their reasoning (`thinking
 turn goes on from the run it resumes, `reasoning_since:`). It has its own system prompt
 (no raw-prompt tool declarations; the tools go as JSON schemas).
 
-`Engine#build_stream_event_handler` is the one seam both loops' streams pass
-through: with a `:generation_progress` hook registered it feeds a
-`Hooks::StreamWatch` each chunk's thinking and text after the UIs had it. A
+`Engine#build_stream_event_handler` (`EventFanout`'s, which the Engine forwards
+to) is the one seam both loops' streams pass through: with a
+`:generation_progress` hook registered it feeds a `Hooks::StreamWatch` each
+chunk's thinking and text after the UIs had it. A
 hook's `stop_generation` cancels the generation's own controller (a child of
 the turn's, `CancellationController#generation`), and each loop takes the cut
 as an empty answer and asks again.
@@ -700,7 +701,9 @@ A map of the parts the overview above doesn't name (paths under `lib/samagotchi/
 | LLM context strategies | `llm_context_strategy.rb`, `llm_context_view.rb`, `llm_context_stale.rb`, `llm_context_forget.rb` | What a request sends of the history (none, stale, forget) ([internals/llm-context-forget.md](internals/llm-context-forget.md)). |
 | Session chains | `session_continue.rb` (`SessionContinue`), `session_chain.rb` (`SessionChain`) | A session that continues an earlier one. `SessionChain.opener_for` gives the text web `continue →` prefills in the new link: the previous link's own first typed message when that link continues one itself, else nil (the 201's `opener`; not saved) ([sessions.md](sessions.md)). |
 | Review sessions | `review_start.rb` (`ReviewStart`), `session_review.rb` (`SessionReview`, the session's `review` field), `review_command.rb` (`ReviewCommand`, `chi review`), `review_apply.rb` (`ReviewApply`) | A session made to be shared: idle, its subjects project files checked by `Guardrails::ReviewPaths`, a fork of a working session from its recap (`--from`); Apply quotes a participant's review turn into the owner's composer ([sessions.md](sessions.md#review-sessions), [internals/participants.md](internals/participants.md)). |
-| Behind an auth proxy | `web/public_url.rb` (`Web::PublicUrl`: `web.public_url`, `web.proxy.identity_header`, `web.proxy.owner`), `web/proxy_gate.rb` (`Web::ProxyGate`, mixed into App; `RawHeaderNames`, prepended to WEBrick's request by `Web::Server`), `web/link_codes.rb` (`Web::LinkCodes`: the links' one-time codes), `proxy_trace.rb` (`ProxyTrace`), `web/public/token_fragment.js`, `web/public/auth_lost.js` | Experimental: chi web behind an auth proxy. Every request needs the token; a proxied one's owner also needs the identity header (one clean value under one name); the `__Host-` cookie, an absolute `Location` from the public URL, https links with a one-time code in the fragment; the page's lost-sign-in banner. Bridges refuse proxy traces ([configuration.md](configuration.md#behind-an-auth-proxy)). |
+| chi web's routes | `web/app.rb` (`Web::App`: the gate, `ROUTES`, the shared helpers), `web/message_display.rb` (`Web::MessageDisplay`: saved messages and cards as display items, `POST /api/render`), `web/session_show.rb` (`Web::SessionShow`: `GET /api/sessions/:id` with its `cards`, `tail` and `timing` re-reads, `GET …/output`, the timing payload), `web/session_create.rb` (`Web::SessionCreate`: `POST /api/sessions`, a continue, a review fork), `web/session_control.rb` (`Web::SessionControl`: answer, command, turn and images, cancel, stop, restart, archive, delete), `web/push_routes.rb` (`Web::PushRoutes`: `/api/push`, its subscriptions and test) | The handlers `App`'s `ROUTES` name, in the file that holds their kind; each mixin is included in `App` and reads its helpers and ivars, so `app.send(:handle_show, …)` and the specs that stub `App` methods work as before. |
+| Web Push | `web/push.rb` (`Web::Push`: `Runtime`, `preflight!`, the `web.push.*` settings), `web/push/crypto.rb` (`Push::Crypto`: RFC 8291 aes128gcm, RFC 8292 VAPID), `web/push/store.rb` (`Push::Store`, `Store::Sub`: `web-push/vapid.pem`, `subscriptions.json`), `web/push/client.rb` (`Push::Client`, `Client::Result`), `web/push/attention.rb` (`Push::Attention`: notify.js's rules in Ruby), `web/push/notifier.rb` (`Push::Notifier`, a hub subscriber with a sender thread), `web/push_routes.rb` (`Web::PushRoutes`), `web/private_files.rb` (`Web::PrivateFiles`, shared with the grants), `public/sw.js`, `public/push.js`, `public/manifest.webmanifest` | chi web pushes approvals and questions to the owner's Home Screen app over an https public URL: the Notifier turns the hub's new approvals and questions into show pushes after a hold (each carries the keys still open, and the badge; no close push: every push shows a notification); the bell (`notifications.js`) subscribes the device, and the service worker and the page close the answered ones. See [internals/web-push.md](internals/web-push.md). |
+| Behind an auth proxy | `web/public_url.rb` (`Web::PublicUrl`: `web.public_url`, `web.proxy.identity_header`, `web.proxy.owner`), `web/proxy_gate.rb` (`Web::ProxyGate`, mixed into App; `RawHeaderNames`, prepended to WEBrick's request by `Web::Server`), `web/link_codes.rb` (`Web::LinkCodes`: the links' one-time codes), `proxy_trace.rb` (`ProxyTrace`), `web/public/token_fragment.js`, `web/public/auth_lost.js`, `web/tunnel.rb` + `web/tunnel/tailscale.rb` (`Web::Tunnel`, `Web::Tunnel::Tailscale`: `chi web --tunnel tailscale`, Tailscale Serve set for one run and the PublicUrl it makes) | Experimental: chi web behind an auth proxy. Every request needs the token; a proxied one's owner also needs the identity header (one clean value under one name); the `__Host-` cookie, an absolute `Location` from the public URL, https links with a one-time code in the fragment; the page's lost-sign-in banner. Bridges refuse proxy traces ([configuration.md](configuration.md#behind-an-auth-proxy)). |
 | Participants | `participants.rb` (`Participants`, the `participants.json` sidecar), `share_command.rb` (`ShareCommand`, `chi share`), `session_participants.rb`, `participants_watch.rb`, `web/grants.rb` (`Web::Grants`), `web/principal.rb` (`Web::Principal`), `web/participant_access.rb` (`Web::ParticipantAccess`: the participant's gate and routes), `web/participants_admin.rb` (`Web::ParticipantsAdmin`: the owner's invite, list, revoke, cap and Apply routes), `web/participant_review.rb` + `web/participant_view.rb` (`Web::ParticipantReview`, `Web::ParticipantView`), `web/participant_stream_filter.rb`, `guardrails/review_boundary.rb` + `guardrails/review_paths.rb` | The people or agents an owner invites to review one session through chi web: their grants and gate, what they read, their read-only review turns ([internals/participants.md](internals/participants.md), [guardrails.md](guardrails.md)). |
 | Analytics | `analytics_file.rb` (`AnalyticsFile`), `session_metrics/totals.rb` (`SessionMetrics::Totals`), `session_metrics/model_segment.rb` (`SessionMetrics::ModelSegment`) | A session's `analytics.json` (`SessionMetrics#persist`); the sums over its turn records (`Totals`: tokens, cost, speeds, kept as running counters) and their split per model after a `/model` switch (`ModelSegment`: a run of turns on one model, the `model_segments` rows); `session_metrics/cost.rb` (`SessionMetrics::Cost`): the spend `ctx.cost` reads; `session_metrics/usage.rb` (`SessionMetrics::Usage`): the work `ctx.usage` reads. `session_metrics/side_totals.rb` (`SessionMetrics::SideTotals`) and `side_usage.rb` (`SideUsage`): the side requests' sums, apart from the turns'. |
 | Images / vision | `image_store.rb` (`ImageStore`), `vision_support.rb`, `vision_context.rb` | Stored prompt images and whether a model takes them. |

data/docs/cli.md

@@ -13,6 +13,7 @@
 - A session id can be shortened to any unique prefix (like git): `chi --attach 2ea8`. `--resume`, `--attach`, `sessions stop`, `sessions archive` and `sessions delete` take one; an ambiguous prefix lists the sessions it matches.
 - `chi web [--port 4567] [--open] [--scope=all]` — start the Web UI (single localhost port session control plane) on this git project's sessions (`--scope=all`, or a folder in no repo: every session); if a chi web already runs on the port, print (with `--open`, open) its page for this folder and exit. Something else on the port (an older chi web too) exits 1 with "port N is in use"
 - `chi web --web-host lan` — the Web UI on your home network too, for your phone: a link with an access token and its QR code (see [chi web on your phone](#chi-web-on-your-phone)); `chi web --new-token` replaces the token
+- `chi web --tunnel tailscale` — the Web UI over https on your tailnet, for your phone anywhere: Tailscale Serve (never Funnel) on this machine's `<machine>.<tailnet>.ts.net` name for this run, the owner your Tailscale login, turned off on exit (see [Tailscale Serve](configuration.md#tailscale-serve-your-tailnet)); `--tunnel` without `web` exits 2
 - `chi web --web-markdown` — opt in to sanitized Markdown rendering for completed assistant messages, the stage's asking text and a resolved question card's reply
 - `chi web --web-view turn` — draw turns with the turn view (each turn as one block of steps, the running one at the bottom of the history) instead of the default stage view (the running turn pinned above the composer); `?view=stage|turn` on the page URL overrides it (see [Web views](#web-views))
 - `chi web --no-web-working-set` — turns the stage view's working set off (on by default; `--web-working-set` turns a config's `web.working_set: false` back on): what each turn brought into the model's context, in the stage and under each finished turn; `?working_set=1|0` on the page URL overrides it (see [The working set](#the-working-set))
@@ -1012,6 +1013,16 @@ steps saved before that have none, so they show no thinking. An `edit` or
 made (up to 120 lines or 8 KB), live and after a reload (see
 [Guardrails](guardrails.md#ask) for the diff an approval shows first).
 
+**When things happened**, in both views and on a participant's review page: where 10 minutes or
+more of quiet passed between the end of one activity and the start of the next (a turn, a context
+note, a reminder), the history has one dim centred line, `── 14:32 · 47 min later ──`; the date is
+added when the day changed or the turn wasn't today (`── Sat 24 Oct 09:10 · 13 h later ──`).
+Nothing marks active work: a long turn followed at once by the next has no line. Hovering a prompt,
+an answer, a note or a reminder shows its full local time, and the recap's label says when it was
+written (`recap · 14:32`). The times are the history entries' `at` (see
+[sessions.md](sessions.md)); a session saved before them takes its turns' times from their timing
+records, and shows no hover times.
+
 ### The working set
 
 The stage view shows what a turn brought into the model's context: the files
@@ -1164,6 +1175,12 @@ access token", paste the token there (the part of the link after
   office guest network), and run `chi web --new-token` if a link leaks.
 - On http the browser has no notifications: the bell is hidden on the phone,
   and the tab title still counts what needs you.
+- Off the home Wi-Fi: `chi web --tunnel tailscale` gives chi web an https
+  name on your tailnet (Tailscale Serve) for its run and prints its link's QR
+  code; see [Tailscale Serve](configuration.md#tailscale-serve-your-tailnet).
+- Notifications on the phone, also while chi web isn't open there: on the tunnel's https link, Add to Home Screen,
+  open the Chi app and tap its bell; approvals and questions then push to the phone (see
+  [Phone notifications](configuration.md#phone-notifications-web-push)).
 
 ### Remote sessions
 
@@ -1332,7 +1349,10 @@ chi share revoke --all          # every link to every session
 - `chi --remote studio share …` invites on studio: the link names studio's LAN address. Locally, the link names
   this machine's running chi web, on the port it listens on (it records it in `$XDG_STATE_HOME/samagotchi/web.json`;
   `web.port` when none answers there); without one on the LAN, chi says the link opens on this machine only (as
-  the participant there too: a participant's link never opens as the owner).
+  the participant there too: a participant's link never opens as the owner). With `web.public_url` the link is
+  `https://<public url>/#code=…`; with `chi web --tunnel tailscale` too (its `ts.net` name, which web.json records
+  while that chi web answers on its port: a chi web on another port takes web.json over, and the link falls back to
+  127.0.0.1). A tunnel link opens only on a device on your tailnet; the grant still decides.
 - The owner's own token and the `chi web --new-token` rotation are separate: rotating it ends no participant's link.
 - **In the attached terminal.** A participant's message reads `Alex ▸ review> is step 3 right?`, the name in that
   participant's own colour (queued, running, and the last exchange when you join); yours stay as they were. A line
@@ -1433,6 +1453,28 @@ working on, what came of it and what is still open, not a turn-by-turn log.
 - It uses the session's own model unless `recap:` names one;
   `recap: false` turns it off. See configuration.md.
 
+## Time gaps (terminal)
+
+Both terminals (attached and the REPL) show when things happened without a
+time on every line:
+
+- A dim divider marks a quiet gap of 10 minutes or more, before what comes
+  next: `── 14:32 · 47 min later ──`, the date added when the day changed
+  (`── Sat 24 Oct 09:10 · 13 h later ──`). The gap runs from the end of the
+  last activity (a turn's end, a reminder, a context note, a recap) to the
+  start of the next (a prompt, yours above its line or another UI's, a
+  reminder turn, a note, a recap), so nothing is marked during a turn or
+  between turns run back to back. A command (`/stats`, `!cmd`) is no
+  activity.
+- Attaching to a session whose last activity was 10 minutes ago or more
+  says when, after the join block: `── last activity 14:32 · 47 min ago ──`
+  (from the newest timed message, else the saved recap's time). With
+  `--resume` the REPL marks the gap before the first prompt instead.
+- A recap names the local time it was written: `recap 14:32>`, `recap 14:32
+  (before the last 2 turns)>`.
+- Only live activity and the join: neither terminal replays the history, so
+  older gaps aren't marked. `--non-interactive` prints none.
+
 ## Tool Activity Log
 
 Samagotchi now prints a concise, human-friendly tool activity log in normal

data/docs/configuration.md

@@ -1591,8 +1591,9 @@ web:
 - Only a viewer on this machine opens the editor: a loopback request, or this machine on its own LAN address
   (`web.host: lan`, the LAN URL or its QR code opened here). A phone gets the targets that need no editor (an
   answer's ref shows its row in the turn; see the refs in [sessions.md](sessions.md)); a row's title stays plain
-  text there. An SSH tunnel or a local reverse proxy (`tailscale serve`) looks like loopback, so a remote viewer
-  behind one gets an editor target that can't open.
+  text there. An SSH tunnel or a local reverse proxy (`tailscale serve`) looks like loopback unless `web.public_url`
+  is set (then a request through it is never this machine's viewer), so without it a remote viewer behind one gets an
+  editor target that can't open.
 - `GET /api/sessions/:id` (and its `?tail=1`) carries `capabilities.editor` (true for such a viewer) and
   `editor_url`, the template (null otherwise).
 
@@ -1668,12 +1669,146 @@ one.
 | nginx `auth_request` + oauth2-proxy (`--set-xauthrequest`) | `X-Auth-Request-Email` | Only as nginx sets it from the auth reply (`auth_request_set $email $upstream_http_x_auth_request_email; proxy_set_header X-Auth-Request-Email $email;`), which replaces a client's copy; nginx drops underscore spellings by default. Checked with nginx 1.27. |
 | Caddy `forward_auth` (`copy_headers X-Auth-Request-Email`) | the copied header | Replaced from the auth reply; Caddy passes an underscore spelling through, which chi refuses. Checked with Caddy 2.8. |
 | Cloudflare Access | `Cf-Access-Authenticated-User-Email` | Not checked yet: verify with an echo. chi trusts the header only; it doesn't validate the `Cf-Access-Jwt-Assertion` token. |
-| Tailscale Serve | `Tailscale-User-Login` | Not checked yet: verify with an echo. Funnel (public) requests carry no identity: with the header set they are refused, leave it unset to let the token decide. |
+| Tailscale Serve | `Tailscale-User-Login` | Replaced, not appended (`Tailscale-User-Name`, `X-Forwarded-For`, `X-Forwarded-Host` too); `X-Forwarded-For` = the requesting device's tailnet IP, Host = the public name. Tailnet only. Checked with Tailscale 1.104.2 (macOS). Not checked: Funnel and tagged-device requests; never use Funnel. See [Tailscale Serve](#tailscale-serve-your-tailnet). |
 | Authelia, Authentik (behind nginx, Caddy, Traefik) | `Remote-Email` (Authelia), `X-Authentik-Email` (Authentik) | Not checked yet; only as the front proxy copies it from the auth reply (the nginx and Caddy rows). |
 | A TLS proxy with no sign-in (nginx, Caddy, an SSH tunnel) | leave unset | The token alone decides. |
 
 Keep the state dir (`web-token`, the grants) out of any folder others can read, such as a team's shared folder.
 
+### Tailscale Serve (your tailnet)
+
+chi web on your phone away from the home Wi-Fi: [Tailscale](https://tailscale.com) Serve gives this Mac an https
+name on your tailnet, `https://<machine>.<tailnet>.ts.net`, with a real certificate, and tells chi web who is asking
+(your Tailscale login, next to chi's token). Only devices on your tailnet reach it: with Tailscale off on the phone the
+name doesn't load. By hand, on the Mac that runs chi web (or steps 1–2, then
+[`chi web --tunnel tailscale`](#chi-web---tunnel-tailscale) does 3–5 for one run):
+
+1. Install Tailscale on the Mac and the phone and sign both in with the same login. **Rename the machines first**
+   (admin console → Machines): HTTPS certificates go into the public Certificate Transparency log, so the
+   `<machine>.<tailnet>.ts.net` name is public once a certificate is issued, and a later rename puts a new name there.
+2. Turn on HTTPS certificates (admin console → DNS; they need MagicDNS on).
+3. Serve chi web's port on the tailnet, never on the internet:
+
+   ```sh
+   tailscale serve --bg 4567
+   ```
+
+   On macOS the app's CLI is `/Applications/Tailscale.app/Contents/MacOS/Tailscale` unless you installed `tailscale`
+   on your PATH. `tailscale serve status` shows what it serves; `tailscale serve --https=443 off` turns it off. Turn
+   it off when you stop using it: while it is on, whatever listens on 127.0.0.1:4567 is reachable from your tailnet.
+4. Tell chi web its public name and whose login is the owner (config.yml; `chi web` reads it at start):
+
+   ```yaml
+   web:
+     public_url: https://chi-host.example-tailnet.ts.net
+     proxy:
+       identity_header: Tailscale-User-Login
+       owner: owner@example.com      # your Tailscale login
+   ```
+
+   Your login: `tailscale whois <the phone's 100.x IP>` (the User block), or `tailscale status --json`
+   (`User["<Self.UserID>"].LoginName`), or start without `owner` and read it off the 401 page's detail ("owner token
+   with identity …"). A login made with Sign in with Apple is a private-relay address (`…@privaterelay.appleid.com`):
+   it is stable, use it as it is. Every device signed in with that login (the phone, a laptop, an iPad) is the owner,
+   each with the token too.
+5. `chi web` prints `Proxied: https://chi-host.example-tailnet.ts.net/#code=chc_…`; open that link on the phone (copy,
+   AirDrop or type it). The code works once, within 10 minutes (`chi web` again prints a new one); the phone then
+   keeps the `__Host-chi_token` cookie.
+
+#### `chi web --tunnel tailscale`
+
+Steps 3–5 in one command, after steps 1–2 (Tailscale signed in, HTTPS certificates on):
+
+```sh
+chi web --tunnel tailscale
+```
+
+```
+Chi Web on http://127.0.0.1:4567/ (public: …)
+Proxied: https://chi-host.example-tailnet.ts.net/#code=chc_…   ← opens chi web as you once, within 10 minutes (…)
+         (owner owner@example.com by Tailscale-User-Login, and the token; …)
+         via Tailscale Serve (tailnet only), owner owner@example.com (this machine's Tailscale login)
+Tailnet Lock is off: a device Tailscale's servers add to your tailnet could reach this page; tailscale lock init turns it on (…)
+<the link's QR code>
+```
+
+- It checks before it changes anything: Tailscale is connected, this machine has its `ts.net` name and a certificate
+  for it, and what Serve already has on port 443. Nothing there: it runs
+  `tailscale serve --bg --https=443 http://127.0.0.1:<port>`. Exactly that one handler for this port (a leftover of an
+  earlier run killed hard, or step 3 done by hand): it adopts it. Anything else on 443 (another port, other paths, TCP
+  forwarding, Funnel) is refused and left alone. Serve's other ports are never touched.
+- The owner is `web.proxy.owner` if config.yml has it, else this machine's own Tailscale login (a tagged machine has
+  none: set `web.proxy.owner`). `public_url` and `identity_header` are the tunnel's for this run, never written to
+  config.yml: a `web.public_url` or `web.proxy.identity_header` that says otherwise (in config.yml or the environment)
+  is refused, so a config from step 4 with this machine's name works as it is.
+- On exit (Ctrl-C, a kill, closing the terminal) it runs `tailscale serve --https=443 off`, but only while 443 still
+  serves exactly what it set; if you changed 443 meanwhile it leaves it and says so. Killed hard (`kill -9`, a power
+  loss) the serve stays on: Serve answers 502 for the name while nothing listens on the port, and whatever later
+  listens on 127.0.0.1:<port> is reachable from your tailnet; the next `chi web --tunnel tailscale` adopts it and
+  turns it off on exit, a plain `chi web` doesn't look.
+- A chi web already on the port is refused ("stop that one first"): `--tunnel` starts its own.
+- The `tailscale` it runs: `SAMAGOTCHI_TAILSCALE_CLI` if set, else `tailscale` on PATH, else the macOS app's
+  `/Applications/Tailscale.app/Contents/MacOS/Tailscale`.
+- Tailnet Lock off is a warning line, never a refusal.
+
+- **Never Funnel** (`tailscale funnel`): it puts the name on the public internet. This recipe was checked on the
+  tailnet only; Funnel requests weren't.
+- Recommended: **Tailnet Lock** (`tailscale lock init`, see Tailscale's docs): new devices then need a signature from a
+  device you trust before they join, not only Tailscale's coordination server's say-so. chi web works either way.
+- What Serve sends (checked with Tailscale 1.104.2 on macOS): it **replaces** a client's `Tailscale-User-Login`,
+  `Tailscale-User-Name`, `X-Forwarded-For` and `X-Forwarded-Host` (never appends); `X-Forwarded-For` is the
+  requesting device's tailnet IP, Host the public name, and chi web's peer is 127.0.0.1. A process on this Mac can
+  still reach 127.0.0.1:4567 directly with headers of its own: there the token decides, as with any proxy.
+- While chi web isn't running Serve answers 502 for the name (checked). Not checked yet: requests from a tagged
+  device (expect no user login, so refused with `identity_header` set), and whether the serve stays on across a
+  reboot.
+- A participant's link (`chi share`, the Invite dialog) is a `https://<machine>.<tailnet>.ts.net/…` link too: it opens
+  only on a device on your tailnet (or one you shared this machine with in Tailscale); the grant still decides.
+- Without Serve, a plain tailnet IP (`web.host: 100.x.y.z`) works like the LAN (see
+  [chi web on your phone](cli.md#chi-web-on-your-phone)): token only, plain http in the browser (WireGuard encrypts
+  the path) so no `Secure` cookie and no notifications, and no identity.
+
+### Phone notifications (Web Push)
+
+chi web as an app on your iPhone's Home Screen that buzzes (the Watch too) when a session waits on an **approval** or
+a **question**, also while the app is closed. A tap opens that session; once it is answered anywhere (the Mac, the
+phone, `chi answer`), its notification goes when you open the app (or swipe it away). Every
+push shows a notification: iOS turns off an app's pushes after a few that show none.
+
+What it needs:
+
+- chi web on an **https** public URL: `chi web --tunnel tailscale` ([above](#chi-web---tunnel-tailscale)) or a
+  `web.public_url`. On the LAN's plain http there is no push (no secure context: the bell is hidden); use the tunnel.
+- iOS 16.4 or later, and chi web **added to the Home Screen**: iOS gives push to a Home Screen app only.
+- No Apple account or registration: chi web signs its pushes with a key of its own (VAPID).
+
+Turning it on, on the phone: open the `Proxied:` link in Safari → Share → **Add to Home Screen** → open the **Chi**
+app → tap the **bell** at the top → Allow. A test notification arrives at once. Tap the
+bell again to turn it off on that phone. In a browser tab the bell stays the tab's own notifications (while the tab
+is in the background), as before.
+
+- **What is sent**: the session's name and the reason ("needs approval", "needs an answer"), never the question or
+  the command, as the tab's notification on the Mac. The session's name shows on the lock screen and the Watch.
+- **What Apple sees**: the push is end-to-end encrypted to the phone; Apple's push service sees that this machine
+  pushes to that device, and when. A subscription holds no device name and no personal data (an opaque address on
+  `web.push.apple.com` and two keys); chi names it itself ("iPhone · 2026-10-24", from the User-Agent's device class
+  and the date).
+- **When**: an approval or a question that is still open 3 s after it was asked (3.5 s for a delegated child's
+  approval, which its parent may relay instead); one push per question; a step-limit question, a failed or a long
+  turn don't push yet. A push arrives even while you look at the page (the phone can't tell chi web that it is in
+  front yet).
+- **The files**: `$XDG_STATE_HOME/samagotchi/web-push/` (next to `web-token`): `vapid.pem` (chi web's key) and
+  `subscriptions.json` (the devices), 0600 in a 0700 folder; chi web refuses to start when others can read them.
+  Subscriptions belong to the public URL they were made on: after renaming the machine or the tailnet, turn the bell
+  on again on the phone (the old ones are never sent to).
+- `web.push.enabled: false` turns it off; `web.push.contact` (a `mailto:` address or an `https://` URL; default:
+  the public URL) is the contact the push services see in chi web's key. A value that is neither stops `chi web`
+  (Apple refuses it); a `[chi web] the push service refused chi's VAPID token` line means the contact or the key was
+  refused, and pushes stop until chi web restarts.
+- The app keeps its own cookie (iOS copies Safari's when it is added, 400 days): `chi web --new-token` logs it out
+  (it shows the "needs chi web's access token" page; paste the token there). Pushes keep coming meanwhile.
+- chi web not running: no pushes (Serve answers 502; a tap couldn't open the page anyway).
+
 ## All settings
 
 Every setting below takes the three forms described in
@@ -1804,6 +1939,8 @@ column says so, a `--kebab-name` flag. The maps (`hosts:`, `models:`,
 | `web.public_url` | | | Experimental. The https origin people open `chi web` at through an auth proxy (`https://host` or `https://host:port`, no path); set, every request needs the access token, this machine's too, and links use it. A value that isn't an https origin stops `chi web` from starting. See [Behind an auth proxy](#behind-an-auth-proxy). |
 | `web.proxy.identity_header` | | | Experimental. The request header the proxy puts the signed-in user's email in (`X-Forwarded-Email` for oauth2-proxy), checked next to the token: only one the proxy sets *and* replaces. Unset or `none`: the token alone decides. See [Behind an auth proxy](#behind-an-auth-proxy). |
 | `web.proxy.owner` | | | Experimental. Your email as the identity header carries it (any case): a proxied request is the owner only with this identity and the token. Unset: nobody is the owner by identity. Needs `web.proxy.identity_header`. |
+| `web.push.enabled` | `true` | | Push notifications to a phone's Home Screen app (approvals and questions) when the bell there is on. Does anything only with an https public URL (`web.public_url`, or `chi web --tunnel tailscale`'s) and once a device subscribed; `false` turns the pushes and the routes off. See [Phone notifications](#phone-notifications-web-push). |
+| `web.push.contact` | the public URL | | The contact the push services see in chi web's VAPID token: a `mailto:` address or an `https://` URL. Anything else stops `chi web` from starting (Apple refuses it). |
 | `history.file` | state dir | | Prompt history path, shared by the TUI and the web composer. |
 | `no_interrupt` | `false` | `--no-interrupt` | Raise the step limit of a turn to 1000 (or `turn.max_iterations`, when larger); a top-level key. |
 | `no_default_input` | `false` | `--no-default-input` | Don't pre-fill `default.input`; a top-level key. |

data/docs/internals/engine.md

@@ -25,12 +25,14 @@ Engine#run_turn(session, prompt, on_event:, max_iterations:, cancel_controller:,
   │     # TurnState#begin!(controller:, sink:) (a new CancellationController when none is given),
   │     # a recap in flight invalidated, GuardrailWiring#begin_turn(origin)
   │     # Returns a Turn {session, prompt (nil on a continue), continue, on_event, controller,
-  │     #                 origin, started_at, id (the caller's id:, else a new uuid), resumed, resume_from}
+  │     #                 origin, started_at, id (the caller's id:, else a new uuid), resumed, resume_from,
+  │     #                 wall (MessageTime.now)}
   │
   ├── Client.swap_probe_cancel(turn.controller)   # a Stop cuts this turn's /props probes
   │
   ├── prepare_turn(turn, images)
-  │     # Emits :turn_started {session_id, prompt, turn_id, continue: true (only on a continue),
+  │     # Emits :turn_started {session_id, prompt, turn_id, at (the turn's wall time, Turn#wall: read once,
+  │     #                      the user message's and the reminders' stamp too), continue: true (only on a continue),
   │     #                      resumed: true (only on a step-limit Continue: resumed: given),
   │     #                      images (only when there are any), cut_after (the model's cut wait, s)}
   │     # refresh_profile! (may ask the server's /props once)
@@ -91,7 +93,7 @@ StandardError in run_turn:
   → if turn.ended (it came from the after_turn/session_end hooks): logged as post_turn_error, re-raised
   → else: end_turn(turn, "failed", save: true) (a save that fails there is logged, turn_end_save_failed)
      # Both loops call LLM::FailedTurn.attach(e, conversation) before re-raising, so
-     # failed_messages keeps the loop's partial conversation (tool iterations included),
+     # failed_messages (TurnEndings) keeps the loop's partial conversation (tool iterations included),
      # else turn.messages, with TurnNote.failed(summary, continued: turn.continue) at the tail.
      # :turn_failed {error_class, message, duration_ms}; a provider error adds
      # error_kind, retryable, host and summary.
@@ -155,7 +157,7 @@ Stopped before the model was asked (prepare_turn returned false):
 The Engine does not talk to models directly. `Engine#backend` picks the loop the effective model's host speaks:
 
 ```
-Engine#backend → backend_for(effective_model)    # EffectiveModel.of(@host_registry, @model_choice)
+Engine#backend → backend_for(effective_model)    # EffectiveModel.of(@host_registry, @model_binding.choice)
   → host entry chat? (an api in LLM::Adapters::BY_API: openai, anthropic): LLM::ChatLoop (one per Engine, built on first use)
   → else:                                                     LLM::NativeBackend wrapping the Engine's KernelLoop
 ```
@@ -197,7 +199,9 @@ KernelLoop#run(messages, max_iterations:, on_stream_event:, cancel_controller:,
 
 `turn.conversation` is the loop's own copy, not the Engine's `turn.messages`. A failure attaches it to the error
 (`LLM::FailedTurn.attach`), so `Engine#failed_messages` can keep it; an Interrupt (Ctrl-C) too, for
-`Engine#ctrl_c_messages` (see Error paths).
+`Engine#ctrl_c_messages` (see Error paths). Both are `TurnEndings`', with the other pure builders of a turn's end
+(`kept_messages`, `failed_event`, `turn_summary`, `stop_facts`); the Engine forwards to it and keeps `end_turn`,
+`complete_turn`, `store_answer_display` and `record_last_turn`.
 
 ### ChatLoop (the chat APIs)
 
@@ -395,13 +399,14 @@ what a resolve gives, all without a `/model`. Frozen, so any thread may hold one
 - The Engine's readers take one (`Engine#effective_model`); those whose fallback always covered the resolve go
   through `SessionModelSettings#model_setting` (`session_model_settings.rb`: the Engine forwards its readers of the session's settings there). A turn takes one in `turn_settings` (before the hooks) and one in `generate` (after
   them); `system_prompt`, `steer_cut_after` (at `:turn_started`) and the turn-end warm-up take their own;
-  `stats_snapshot` and `session_state_snapshot` take one each (the latter nil-tolerant).
+  `stats_snapshot` and `session_state_snapshot` take one each (the latter nil-tolerant; both `EngineSnapshots`',
+  `engine_snapshots.rb`, which the Engine forwards to).
 - Never resolved (they hold on a broken resolve): `effective_model_ref`, `bare_model_name`,
   `guardrail_model_name`, `sync_model_key!`, `served_model(probe: false)` (`HostRegistry#model_ref`/`#bare_name`).
 - Readers on other threads: the Bridge (`/state`, `/stats`, the SSE reset, a steer's cut wait), the worker's
   command thread, the recap thread and plugin threads (`session_model_recap_target`), the REPL.
-- `ModelChoice` (`@model_choice`) holds the name and the typed name as one value, so a reader on another thread
-  never pairs one model's name with another's typed name.
+- `ModelChoice` (`ModelBinding#choice`) holds the name and the typed name as one value, so a reader on another
+  thread never pairs one model's name with another's typed name.
 - `EffectiveModel.of_session` builds a saved session's (no worker): `Web::App`, `LLMContextStrategy.for_session`.
 
 `SessionSetting` names the four per-session settings (llm_context, thinking, reasoning_history, toolkit): the
@@ -409,6 +414,21 @@ session's own value, the commands that move each chip, its chip from an Effectiv
 readers, a saved session's chip, and how the web takes a worker snapshot's. The session state, `/stats` (no
 toolkit), a `:command_ran` and the web's session JSON list them from it.
 
+### ModelBinding (the choice and its profile)
+
+`ModelBinding` (`model_binding.rb`) holds the session's model choice, the profile given to `Engine.new` (until a
+switch), the prompt profile resolved for the choice (kept as a `[choice, resolution]` pair) and the memory overlay
+keys (`#sync_model_key!`), under one mutex; it is ToolkitBinding's counterpart, and the Engine forwards
+`profile_resolution`, `refresh_profile!`, `store_profile`, `apply_profile`, `resolve_profile`, `sync_model_key!`
+and `model_key` to it.
+
+- `#switch!` (`Engine#switch_model!`'s swap) is one assignment under the mutex: a reader on another thread sees
+  the old pair or the new one. It drops the given profile and the kept resolution.
+- `#store_profile` keeps and applies a resolution only while the choice is still the one it was resolved for,
+  by identity (`equal?`, not `==`): a `/stats` probing on a Bridge thread while `/model` runs keeps nothing.
+- `#apply_profile` runs under the mutex: the system prompts built for another profile are dropped, then
+  `KernelLoop#use_profile!`. Nothing else takes the mutex.
+
 ### ThinkingNotices
 
 What a turn's thinking level leads to, said once per session and host (`thinking_notices.rb`): an effort the
@@ -474,7 +494,8 @@ drain hands the message to the model at a boundary, or until the turn ends (`Ste
 
 ### The turn's sink (`on_event`) and the observers
 
-`Engine#emit_event` sends each turn event to the turn's sink (`on_event`, the REPL's renderer) and then to the
+`Engine#emit_event` (`EventFanout#emit_event`, `event_fanout.rb`, which also builds the loops' stream handler and
+emits the working set) sends each turn event to the turn's sink (`on_event`, the REPL's renderer) and then to the
 persistent observers (`Engine#subscribe`), which get a copy with a monotonic `event_seq`. The observers are the
 metrics, the debug log, the thinking tails, and in a worker the Bridge, which streams to the web and the attached
 TUI. Errors in the sink or an observer are caught; they never break the turn.
@@ -491,8 +512,8 @@ Turn events (the main ones; `Events` in `events.rb` keeps the shared sets):
 
 | Event | When | Payload |
 |---|---|---|
-| `:turn_started` | `prepare_turn` | `{session_id, prompt, turn_id, continue?, resumed?, images?, cut_after}` (`resumed`: a step-limit Continue) |
-| `:reminder_injected` | due reminders went into the turn | `{reminders}` |
+| `:turn_started` | `prepare_turn` | `{session_id, prompt, turn_id, at, continue?, resumed?, images?, cut_after}` (`resumed`: a step-limit Continue; `at`: the turn's wall time, its prompt's stamp) |
+| `:reminder_injected` | due reminders went into the turn | `{reminders, at}` (`at`: the turn's wall time, the reminder message's stamp) |
 | `:context_status` | every request (unless `context.status` is off), the current estimate before it; and outside any turn after `/model` (or when a session is loaded on another model than its last turn ran on), to the observers only (`Engine#announce_switched_context!`) | `{iteration, status, usage, bucket, source}`; the switch's form has no `iteration`: `{usage, bucket, context_window_tokens, context_window_source}`, with `usage.source: "switch"`, and `usage` nil when the new window doesn't resolve (internals/context-telemetry.md) |
 | `:generation_started` | a request begins | `{iteration, context_window_tokens, context_window_source, price, model_ref}` (`price`: the turn's `ModelPrice#to_h`, nil without one; `model_ref`: the turn's model, asked `host:model`, added by the Engine's stream handler from the model `#generate` resolved after the `before_turn` hooks, so a hook's switch is the one named; native adds `profile`, `profile_source`) |
 | `:generation_chunk` | each streamed chunk | `{iteration, content, text, thinking, payload, tool_call?}` (SSE clients get the Bridge's projection instead: `{iteration, text, thinking, tool_call?, counts?}`, architecture.md) |
@@ -582,8 +603,11 @@ hook registry (`@hooks.fire`), not on the sink or the observers. The other hook
 ```
 Engine initialization (in this order, among other things):
   @turn_state, @steer_cut (SteerCut: its GenerationPhase and WaitingSteer)
-  @host_registry, @model_choice (ModelChoice: the name and the name as typed); @model_settings (SessionModelSettings: the choice and the session read at use); @client = effective_model.client
-  @given_profile = profile or nil (resolved on first need, so building an Engine makes no network call)
+  @event_fanout (EventFanout: emit_event, the stream handler, the working set; its lookups read at call time)
+  @turn_endings (TurnEndings: the turn endings' builders)
+  @host_registry, @model_binding (ModelBinding: the ModelChoice, i.e. the name and the name as typed, and the given
+    profile or nil: resolved on first need, so building an Engine makes no network call); @model_settings
+    (SessionModelSettings: the choice and the session read at use); @client = effective_model.client
   MemoryBundle::SystemBundle.ensure! (the shipped system bundle installed; a failure is logged, not raised)
   @event_routes (EventRoutes: where a card or a notice goes: held while the plugins load, an anytime command's, an init task's, a turn event, else announced or held)
   @hook_routes (HookRoutes: notices (through @event_routes), hook questions, stop_turn/stop_generation, steer attribution)
@@ -607,9 +631,12 @@ Engine initialization (in this order, among other things):
   @native_backend = LLM::NativeBackend.new(kernel: @kernel)
   @prompt_builder = SystemPrompt.new(...)
   @session_observer with the metrics, the log subscriber and the thinking tails subscribed (subscribe_session_observers)
+  @engine_snapshots (EngineSnapshots: session_state_snapshot and stats_snapshot), built last: nothing reads a
+    snapshot while the Engine is built
 
 Model switching, Engine#switch_model!(model_name, persist_default:, typed:):
-  → checks the host (ModelProfile.check_host!), sets @model_choice (name and typed name in one assignment)
+  → checks the host (ModelProfile.check_host!), sets the choice (ModelBinding#switch!: name and typed name in
+    one assignment)
   → drops the given profile and the profile resolution (resolved again on first need; one that another
     thread finishes for the old model is neither kept nor applied: #store_profile)
   → sync_model_key!, @prompt_builder.reset! (the system prompt is built again)
@@ -655,6 +682,19 @@ logged). Both are display only: `AnswerDisplay::DISPLAY_ONLY` lists `display`, `
 after_generation), while `KernelLoop#sanitize_history` and `ChatLoop#plain` copy them so the stored conversation keeps
 them across turns. `Web::App#messages_for_display` sends `display_refs` re-validated (`AnswerRefs.for_display`).
 
+History stamps: user prompts, merged input and steers, reminders, context and task notes and the model's replies carry
+`at` (`MessageTime::KEY`, `message_time.rb`: a local-offset ISO time with milliseconds), when the entry happened. A
+turn reads the wall clock once (`Turn#wall`, `MessageTime.now`): `:turn_started`'s `at`, its prompt's and its
+reminders' stamps; `Steer::Merge#messages` stamps a merge at the boundary, `ContextNote.message` a note with its
+`created_at` (else now), `KernelLoop#iterate` / `#cancelled_result` and the chat loop's `Run#with_thinking` /
+`Run#canceled` each reply. Tool results, `!cmd` messages and TurnNote notes carry none. Like `display`, `at` must
+survive the two rebuilds: both model branches of `KernelLoop#sanitize_history` and `ChatLoop#plain` copy it (an
+allow-list that drops a key loses it for good on the next turn; `spec/message_time_history_spec.rb` checks both
+loops). It is display-only and never reaches the wire (prompt-caching.md, rule 7), but it is not in
+`AnswerDisplay::DISPLAY_ONLY`: hooks and `ctx.messages` see it. `:recap_ready` carries the saved recap's
+`created_at` (`Engine#emit_recap(created_at:)`, from `IdleRecap#collect`). The UIs' gap dividers come from
+`MessageTime.gap_line` (10 min, `GAP_SECONDS`).
+
 `:question_asked` (`QuestionAsked`, `question_asked.rb`) fires from the two Engine seams where a question of the
 model's opens, never from `QuestionDesk`: `Engine#request_question` (the kernel's `question_handler`, after
 `AskUserQuestion.validate`; not with `interface == :non_interactive`) and the guardrail wiring's `ask:` lambda
@@ -795,6 +835,10 @@ Paths are under `lib/samagotchi/`.
 | File | Role |
 |---|---|
 | `engine.rb` | Engine: turn lifecycle, event emission, plugins, model switching |
+| `event_fanout.rb` | `EventFanout`: how an event reaches the turn's sink and the observers (`emit_event`), the loops' stream handler, the working set's emit and dedupe; the Engine forwards |
+| `engine_snapshots.rb` | `EngineSnapshots`: the UIs' read model, `session_state_snapshot` (cheap, never raises) and `stats_snapshot` (may probe `/props`); the Engine forwards |
+| `model_binding.rb` | `ModelBinding`: the model choice and the prompt profile resolved for it, under one mutex, and the overlay keys; the Engine forwards |
+| `turn_endings.rb` | `TurnEndings`: what each turn ending keeps and announces (the kept messages and their `TurnNote`, `failed_event`, `turn_summary`, `stop_facts`); the Engine forwards |
 | `turn_state.rb` | Cross-thread turn state (running, controller, sink, steers, activity clock) |
 | `steer_cut.rb` | `SteerCut`: the Engine's seam for a message cutting the generation |
 | `generation_phase.rb`, `waiting_steer.rb` | Whether a steer may cut the running generation, and the steer that waits to |