samagotchi 0.121.0 → 0.121.1

data/lib/samagotchi/relay_watcher.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "worker_sidecar"
+require_relative "worker_link"
 require_relative "log"
 
 module Samagotchi
@@ -20,7 +20,7 @@ module Samagotchi
     # @param live [#call] whether the parent's worker is up
     # @return [Thread]
     def start(engine:, question_id:, relay_id:, parent_dir:, interval: INTERVAL,
-              live: -> { WorkerSidecar.live(parent_dir, unlink: false) })
+              live: -> { WorkerLink.resolve(parent_dir, unlink: false).live? })
       Thread.new do
         loop do
           sleep(interval)

data/lib/samagotchi/remote_attach_command.rb

@@ -48,7 +48,7 @@ module Samagotchi
       ignored(id) if existing
       launch(id, existing: existing)
     rescue TerminalUI::AttachLauncher::Error, SessionAccess::RemoteFailed, SessionAccess::Refused,
-           SessionManager::OwnedByTUI, ModelProfile::MissingModel, ArgumentError => e
+           SessionManager::OwnedByTUI, ModelProfile::MissingModel, Toolkit::Refused, ArgumentError => e
       e.is_a?(SessionAccess::BadRequest) ? usage(e.message) : failed(e.message)
     rescue Interrupt
       CLI::Exit::INTERRUPTED

data/lib/samagotchi/reply_wait/poll.rb

@@ -5,6 +5,7 @@ require_relative "../session_inbox"
 require_relative "../turn_checkpoint"
 require_relative "../continue_offer"
 require_relative "../steer"
+require_relative "../worker_link"
 
 module Samagotchi
   module ReplyWait
@@ -164,11 +165,16 @@ module Samagotchi
         pending = session.pending_question
         return nil unless pending && !@baseline&.question?(pending.id) &&
                           (@turn.nil? || ReplyWait.own_question?(session, @turn, @claimed)) &&
-                          session.waiting_question(live: SessionManager.worker_live?(@id, state_dir: @state_dir))
+                          session.waiting_question(live: worker_owned?)
 
         Result.new(status: :waiting_for_answer, question: pending, session: session)
       end
 
+      # A worker holds the session's lock (a chi REPL's question is its own).
+      def worker_owned?
+        WorkerLink.resolve(Session.session_dir(@id, state_dir: @state_dir), unlink: false).worker_owned?
+      end
+
       # A participant's turn its worker holds while the owner's Continue
       # offer stands (Worker#run_input_files): it waits for the owner's
       # answer to that question, whenever it was asked (the baseline's
@@ -176,7 +182,7 @@ module Samagotchi
       def held(session)
         pending = session.pending_question
         return nil unless @participant_input && !@claimed && pending&.kind.to_s == ContinueOffer::KIND &&
-                          session.waiting_question(live: SessionManager.worker_live?(@id, state_dir: @state_dir))
+                          session.waiting_question(live: worker_owned?)
 
         Result.new(status: :waiting_for_answer, question: pending, session: session)
       end

data/lib/samagotchi/reply_wait.rb

@@ -4,7 +4,7 @@ require_relative "session"
 require_relative "turn_note"
 require_relative "session_inbox"
 require_relative "turn_checkpoint"
-require_relative "worker_sidecar"
+require_relative "worker_link"
 require_relative "reply_wait/poll"
 
 module Samagotchi
@@ -214,9 +214,10 @@ module Samagotchi
       running || queued || ended
     end
 
-    # Whether the session's worker sidecar names TURN_IDS_FEATURE.
+    # Whether the session's live worker names TURN_IDS_FEATURE.
     def turn_ids?(session_dir)
-      WorkerSidecar.read(session_dir)&.features&.include?(TURN_IDS_FEATURE) || false
+      link = WorkerLink.resolve(session_dir, unlink: false)
+      link.live? && link.features.include?(TURN_IDS_FEATURE)
     end
 
     # A pending question is a turn: wait's (its enqueued_id) only when that

data/lib/samagotchi/review_command.rb

@@ -61,7 +61,7 @@ module Samagotchi
       start(parsed.options, parsed.args)
     rescue ReviewStart::Refused, SessionAccess::BadRequest => e
       refused(e.message)
-    rescue ModelProfile::MissingModel => e
+    rescue ModelProfile::MissingModel, Toolkit::Refused => e
       refused("could not start: #{e.message}")
     rescue ArgumentError => e
       refused(e.is_a?(Session::AmbiguousId) ? e.message : e.message.sub(/\ASession not found: /, "no session "))

data/lib/samagotchi/run_options.rb

@@ -165,6 +165,7 @@ module Samagotchi
                  chi review FILE... [--dir DIR] | --from ID   a review session to share (chi share)
                  chi memory <ls|rm> [--scope project|system]   the memories; rm moves one to the bundle trash
                  chi bundle <install|upgrade|uninstall|status|diff|list|build|trash|new|test|check|try>
+                 chi guardrails replay [--dry-run] [--threshold T] [--model M]   seed System 1's record from answered approvals
                  chi desktop <install|upgrade|uninstall|status>   macOS "Send to chi" helper
                  chi models [--format json] [TEXT]   the models --model takes, from every host
                  chi remote <add|ls|rm>           other machines' chi web, for chi --remote NAME

data/lib/samagotchi/session.rb

@@ -427,10 +427,14 @@ module Samagotchi
     #   seed); [] by default
     # @param setup [SessionSetup] the session's own settings (none by default)
     # @param now [Time] its created_at and updated_at (a spec's clock)
+    # @raise [Toolkit::Refused] its toolkit (setup's, else the configured
+    #   one SessionManager.spawn_session gives it) builds on a config kit
+    #   with an invalid groups: (Toolkit.check_new!)
     def self.new_session(mode:, model_name:, working_directory:, test_run: nil,
                          preloaded_memory_names: [], muted_memory_names: [], parent_id: nil, messages: [],
                          scratch: false, model_typed: nil, delegate: false, setup: SessionSetup.new, continues: nil,
                          review: nil, now: Time.now)
+      Toolkit.check_new!(setup.toolkit || Toolkit.configured(delegate: delegate))
       now = now.iso8601(3)
       resolved_test = if test_run.nil?
                         test_session_env?

data/lib/samagotchi/session_access/local.rb

@@ -14,6 +14,7 @@ require_relative "../context_sources"
 require_relative "../send_command/busy"
 require_relative "../chi_invocation"
 require_relative "../worker_sidecar"
+require_relative "../worker_link"
 require_relative "../review_start"
 require_relative "../launch_mode"
 require_relative "../participants"
@@ -95,13 +96,22 @@ module Samagotchi
         session = show(id)
         raise Refused.new(LaunchMode::SCRATCH_LEFTOVER, code: "scratch") if session.scratch
 
-        live = WorkerSidecar.live(session_dir(id), unlink: true)
-        return Woken.new(woke: false, sidecar: live) if live
+        link = WorkerLink.resolve(session_dir(id), unlink: true)
+        case link
+        when WorkerLink::Live then return Woken.new(woke: false, sidecar: link.sidecar)
+        when WorkerLink::Skew then raise Refused.new(link.message(id), code: "worker_newer")
+        when WorkerLink::Starting
+          # A worker that never publishes its Bridge (a failed start, a
+          # crash's teardown) lets go of the lock: then resume, not 504.
+          found = WorkerLink.await(id, session_dir: session_dir(id), timeout: wait,
+                                       give_up: ->(link) { !link.worker_owned? })
+          return Woken.new(woke: false, sidecar: found.live? ? found.sidecar : nil) if found.worker_owned?
+        end
 
         OwnerLock.await_release(session_dir(id))
         SessionManager.resume_session(id, **dir)
-        found = BridgeClient.wait_for(id, session_dir: session_dir(id), timeout: wait)
-        Woken.new(woke: true, sidecar: found && WorkerSidecar.read(session_dir(id)))
+        found = WorkerLink.await(id, session_dir: session_dir(id), timeout: wait)
+        Woken.new(woke: true, sidecar: found.live? ? found.sidecar : nil)
       end
 
       # The session's worker now, never started (chi web's GET …/worker).
@@ -109,8 +119,8 @@ module Samagotchi
       # @raise [ArgumentError] no such session
       def worker(id)
         show(id)
-        WorkerState.new(sidecar: WorkerSidecar.live(session_dir(id), unlink: true),
-                        stopped: Session.stopped_marker?(id, state_dir: state_dir!), owner: owner(id))
+        WorkerState.new(link: WorkerLink.resolve(session_dir(id), unlink: true),
+                        stopped: Session.stopped_marker?(id, state_dir: state_dir!))
       end
 
       # --- create and send
@@ -148,7 +158,7 @@ module Samagotchi
       # Whether a just-created session's worker came up (its Bridge
       # answers) within +timeout+ seconds.
       def await_worker(id, timeout:)
-        BridgeClient.wait_for(id, session_dir: session_dir(id), timeout: timeout)
+        WorkerLink.await(id, session_dir: session_dir(id), timeout: timeout).live?
       end
 
       # Copies of +refs+ (ImageStore refs stored in +from+) in the
@@ -479,7 +489,7 @@ module Samagotchi
       # The block's post to the session's live worker, again on a 408 (the
       # worker didn't take it in time).
       def on_worker(id)
-        client = BridgeClient.discover(id, session_dir: session_dir(id)) or return nil
+        client = WorkerLink.client(id, session_dir: session_dir(id)) or return nil
         reply = nil
         2.times do
           reply = yield client

data/lib/samagotchi/session_access/remote.rb

@@ -12,6 +12,7 @@ require_relative "../bridge_client"
 require_relative "../session_continue"
 require_relative "../guardrails/parent_policy"
 require_relative "../model_profile"
+require_relative "../web/grants"
 require_relative "http_transport"
 require_relative "../chi_invocation"
 
@@ -679,6 +680,10 @@ module Samagotchi
         # No model configured there, or --model's host unknown there: what
         # spawn_session raises here (chi send: could not start a session).
         when "invalid_model" then raise ModelProfile::MissingModel, message.to_s
+        # A toolkit whose config kit's groups: is invalid there: the same.
+        when "toolkit_refused" then raise Toolkit::Refused, message.to_s
+        # The grants store doesn't read there: chi share says what it says here.
+        when "grants_unwritable" then raise Web::Grants::Unwritable, message.to_s
         when /\Ainvalid_/, "missing_fields", "bad_images"
           # invalid_participant: chi share's name, kind or ttl, an archived session
           raise BadRequest.new(message.to_s, code: error)

data/lib/samagotchi/session_access/web_bridge_client.rb

@@ -6,6 +6,7 @@ require_relative "../session_access"
 require_relative "../bridge_client"
 require_relative "../delivery"
 require_relative "../log"
+require_relative "../worker_link"
 require_relative "http_transport"
 
 module Samagotchi
@@ -39,9 +40,6 @@ module Samagotchi
       # A read a join waits on (a turn's saved records, the children
       # counts): a slow chi web can't hold the join up for long (L9).
       JOIN_READ_TIMEOUT = 5
-      # chi web answers no live worker for the session (Mapping).
-      NO_WORKER = "no live worker for session %s on %s"
-
       # chi web's answers as the session's Bridge would have given them.
       module Mapping
         module_function
@@ -60,7 +58,7 @@ module Samagotchi
         def response(route, reply, session_id:, remote:)
           json = reply.json.is_a?(Hash) ? reply.json : {}
           case [reply.status, json["error"]]
-          in [503, "not_live"] | [404, "not_found"] then raise Unreachable, format(NO_WORKER, session_id, remote)
+          in [503, "not_live"] | [404, "not_found"] then raise Unreachable, "#{WorkerLink.not_live(session_id)} on #{remote}"
           in [504, _] then bridge(408, error: "deadline_passed", detail: json["detail"])
           in [501, _] if route == :command && json["command"]
             bridge(400, error: "unknown_command", detail: json["detail"], command: json["command"])
@@ -69,6 +67,8 @@ module Samagotchi
           end
         end
 
+        def stream(sock, status, headers) = BridgeClient::StreamOpen.classify(sock, status, headers)
+
         def bridge(status, **body) = BridgeClient::Response.new(status: status, body: JSON.generate(body.compact))
       end
 
@@ -198,24 +198,35 @@ module Samagotchi
                                             idle_timeout: STREAM_IDLE_TIMEOUT, &on_event).start
       end
 
-      # GET /api/sessions/:id/stream through StreamRequest, with the token
-      # as Bearer. A chunked response (a proxy in between: no decoding in
-      # v1) and an https chi web (no TLS on the stream yet) are logged and
-      # read as unreachable.
-      # @return [Array(TCPSocket, Integer, Hash), nil] see StreamRequest.open
-      def connect_stream(query: "", last_event_id: nil, timeout: nil)
+      # GET /api/sessions/:id/stream through StreamRequest, classifying chi
+      # web's stream answers as Bridge outcomes.
+      # @param header_timeout [Float] see BridgeClient::STREAM_HEADER_TIMEOUT
+      # @yield [sock] called after response headers arrive, before classifying a
+      #   refusal; EventStream uses it to publish the socket for #close
+      # @return [BridgeClient::StreamOpen::Opened, BridgeClient::StreamOpen::Refused,
+      #   BridgeClient::StreamOpen::Unreachable]
+      def open_stream(query: "", last_event_id: nil, header_timeout: BridgeClient::STREAM_HEADER_TIMEOUT, attempts: 1)
         uri = URI(@remote.entry.url)
         return refused("tls_unsupported") if uri.scheme == "https"
 
         token = @remote.entry.token
-        opened = BridgeClient::StreamRequest.open(host: uri.hostname, port: uri.port,
-                                                  path: "/api/sessions/#{@session_id}/stream#{query}",
-                                                  last_event_id: last_event_id, timeout: timeout,
-                                                  headers: token ? { "Authorization" => "Bearer #{token}" } : {})
-        return opened unless opened && opened[2]["transfer-encoding"].to_s.downcase.include?("chunked")
+        connection = BridgeClient::StreamRequest.open(host: uri.hostname, port: uri.port,
+                                                      path: "/api/sessions/#{@session_id}/stream#{query}",
+                                                      last_event_id: last_event_id, timeout: header_timeout,
+                                                      headers: token ? { "Authorization" => "Bearer #{token}" } : {})
+        return BridgeClient::StreamOpen::Unreachable.new(attempts: 1) unless connection
+
+        sock, status, headers = connection
+        unless !block_given? || yield(sock)
+          sock.close rescue nil
+          return BridgeClient::StreamOpen::Unreachable.new(attempts: 1)
+        end
+        return refused("chunked_unsupported", sock) if headers["transfer-encoding"].to_s.downcase.include?("chunked")
 
-        opened[0].close rescue nil
-        refused("chunked_unsupported")
+        Mapping.stream(sock, status, headers)
+      rescue SystemCallError, SocketError, IOError
+        sock&.close rescue nil
+        BridgeClient::StreamOpen::Unreachable.new(attempts: 1)
       end
 
       private
@@ -234,9 +245,10 @@ module Samagotchi
         raise Unreachable, e.message
       end
 
-      def refused(reason)
+      def refused(reason, sock = nil)
+        sock&.close rescue nil
         Log.warn(:attached, "stream_refused", reason: reason, remote: @remote.name)
-        nil
+        BridgeClient::StreamOpen::Unreachable.new(attempts: 1)
       end
     end
   end

data/lib/samagotchi/session_access.rb

@@ -179,15 +179,27 @@ module Samagotchi
     end
 
     # A session's worker as an attach finds it (Local#worker, chi web's GET
-    # …/worker): +sidecar+ the live worker's WorkerSidecar (port, version,
-    # features, epoch; nil: none runs), +stopped+ its stop marker, +owner+
-    # its OwnerLock::Owner (a worker, a chi REPL, nil).
-    WorkerState = Data.define(:sidecar, :stopped, :owner) do
-      def live? = !sidecar.nil?
-
-      # No Bridge, and the owner is a worker leaving (writing its recap on
-      # leave): a wake waits for it (Local#wake).
-      def leaving? = !live? && !!owner&.leaving?
+    # …/worker): +link+ the one WorkerLink outcome every field reads, +stopped+
+    # its stop marker.
+    WorkerState = Data.define(:link, :stopped) do
+      # @return [WorkerSidecar, nil] the live worker's (port, version,
+      #   features, epoch; nil: none answers)
+      def sidecar = link.live? ? link.sidecar : nil
+
+      # @return [OwnerLock::Owner, nil] a worker, a chi REPL, nil
+      def owner = link.owner
+
+      def live? = link.live?
+
+      # The owner is a worker leaving (writing its recap on leave): a wake
+      # waits for it (Local#wake).
+      def leaving? = link.is_a?(WorkerLink::Leaving)
+
+      # A worker holds the lock past WorkerLink::START_LIMIT with no Bridge.
+      def stuck? = link.is_a?(WorkerLink::Starting) && link.stuck
+
+      # A worker whose sidecar speaks a newer protocol than this chi.
+      def skew? = link.is_a?(WorkerLink::Skew)
     end
 
     # What a wake for an attach did (Local#wake, chi web's POST …/wake):

data/lib/samagotchi/session_continue.rb

@@ -9,6 +9,7 @@ require_relative "child_move"
 require_relative "archive_store"
 require_relative "recap_store"
 require_relative "bridge_client"
+require_relative "worker_link"
 require_relative "model_profile"
 require_relative "log"
 require_relative "session_manager"
@@ -303,10 +304,8 @@ module Samagotchi
     # answers at once. Best effort: the continue goes on without. A review
     # fork (ReviewStart) asks the same, with nothing archived after.
     def self.recap_before_archive(id, state_dir, wait:)
-      return unless SessionManager.worker_live?(id, state_dir: state_dir)
-
       dir = Session.session_dir(id, state_dir: state_dir)
-      client = BridgeClient.discover(id, session_dir: dir) or return
+      client = WorkerLink.client(id, session_dir: dir) or return
       before = RecapStore.read(dir)
       reply = client.request_recap
       asked = reply.status == 200 && reply.json.is_a?(Hash) ? reply.json["request"] : nil

data/lib/samagotchi/session_manager.rb

@@ -25,6 +25,7 @@ require_relative "turn_note"
 require_relative "owner_lock"
 require_relative "bridge_client"
 require_relative "worker_sidecar"
+require_relative "worker_link"
 require_relative "worker_signals"
 require_relative "log"
 require_relative "log_path"
@@ -40,6 +41,7 @@ require_relative "plugin_session_state"
 require_relative "context_sources"
 require_relative "session_chain"
 require_relative "child_move"
+require_relative "tools/task_runtime"
 
 module Samagotchi
   # SessionManager coordinates background session processes.
@@ -587,7 +589,7 @@ module Samagotchi
 
     # How long after a spawn a resume trusts that worker to take the
     # session, while it runs (and the session wasn't stopped since).
-    WORKER_START_GRACE = 30.0
+    WORKER_START_GRACE = WorkerLink::START_LIMIT
 
     @spawns = {}
     @spawns_mutex = Mutex.new
@@ -626,15 +628,17 @@ module Samagotchi
     # the next prompt starts one on the newest chi anyway), :unsupported (a
     # worker from before restarts, running +version+: stop it instead), a
     # WorkerIdleExit#hold_for_restart hold (:turn_running, :reminders, ...),
-    # or :failed (the worker answered something else).
+    # :fallback_held (disk-visible work blocks an unresponsive-worker restart),
+    # or :failed (the worker answered something else or didn't release).
     class RestartRefused < StandardError
-      attr_reader :session_id, :reason, :version
+      attr_reader :session_id, :reason, :version, :holds
 
-      def initialize(session_id, reason, version: nil)
+      def initialize(session_id, reason, version: nil, holds: [])
         @session_id = session_id
         @reason = reason.to_sym
         @version = version
-        super(RestartRefused.words(session_id, @reason, version))
+        @holds = Array(holds).map(&:to_sym).freeze
+        super(RestartRefused.words(session_id, @reason, version, @holds))
       end
 
       HOLDS = {
@@ -650,13 +654,17 @@ module Samagotchi
       }.freeze
 
       # What the CLI and the web say.
-      def self.words(session_id, reason, version = nil)
+      def self.words(session_id, reason, version = nil, holds = [])
         case reason
         when :not_running
           "session #{session_id} has no running worker; the next prompt starts one on the newest chi"
         when :unsupported
           "session #{session_id}'s worker runs chi #{version || "(older)"}, which can't restart: " \
             "chi sessions stop #{session_id}, then any prompt starts it on the newest chi"
+        when :fallback_held
+          why = holds.map { |hold| HOLDS.fetch(hold, hold.to_s.tr("_", " ")) }.join("; ")
+          "session #{session_id} has disk-visible work that a restart might lose#{": #{why}" unless why.empty?}; " \
+            "run `chi sessions stop #{session_id}`, then any prompt starts it on the newest chi"
         when :failed then "session #{session_id}'s worker didn't take the restart"
         else "not now: #{HOLDS.fetch(reason, reason.to_s.tr("_", " "))}"
         end
@@ -668,12 +676,14 @@ module Samagotchi
     Restarted = Struct.new(:session_id, :from_version, :version, keyword_init: true)
 
     RESTART_WAIT = 10.0
+    # A TERMed worker writes its recap on leave (an LLM call) while it still
+    # holds the lock: STOP_WAIT plus the recap's own wait (SessionContinue::RECAP_WAIT).
+    FALLBACK_STOP_WAIT = 40
 
     # Hand a session to a new worker on the newest chi installed: ask its
     # worker (POST /exit restart: true), which leaves only when nothing would
-    # be lost and starts its successor (Worker#exit_request), then wait up to
-    # +wait+ seconds for the successor's Bridge. Web tabs and attached
-    # terminals reconnect to it.
+    # be lost and starts its successor. If the worker cannot be asked, stop
+    # it without a stop marker and resume only when disk shows no work to lose.
     # @return [Restarted]
     # @raise [OwnedByTUI] a chi REPL owns the session
     # @raise [RestartRefused]
@@ -683,23 +693,109 @@ module Samagotchi
       Session.load(session_id, state_dir: sd) # ArgumentError for none
       owner = refuse_tui!(session_id, state_dir: sd)
       dir = Session.session_dir(session_id, state_dir: sd)
-      sidecar = owner&.worker? && WorkerSidecar.live(dir, unlink: false)
-      raise RestartRefused.new(session_id, :not_running) unless sidecar
+      link = WorkerLink.resolve(dir, unlink: false, owner: owner)
+      if link.is_a?(WorkerLink::Skew)
+        return restart_fallback(session_id, owner: owner, sidecar: link.sidecar, state_dir: sd, wait: wait, why: :skew)
+      end
+
+      if link.is_a?(WorkerLink::Starting)
+        return restart_fallback(session_id, owner: owner, sidecar: nil, state_dir: sd, wait: wait, why: :starting_stuck) if link.stuck
+
+        raise RestartRefused.new(session_id, :starting)
+      end
+      raise RestartRefused.new(session_id, :not_running) unless link.live?
+
+      sidecar = link.sidecar
       unless sidecar.features.include?("restart")
         raise RestartRefused.new(session_id, :unsupported, version: sidecar.version)
       end
 
-      reply = BridgeClient.for_sidecar(session_id, sidecar).request_exit(client_id: client_id, restart: true)
+      begin
+        reply = BridgeClient.for_sidecar(session_id, sidecar).request_exit(client_id: client_id, restart: true)
+      rescue SystemCallError, IOError => e
+        return restart_fallback(session_id, owner: owner, sidecar: sidecar, state_dir: sd, wait: wait, why: :unreachable,
+                                                                        error: e)
+      end
       raise RestartRefused.new(session_id, reply.json&.fetch("reason", nil) || :failed) if reply.status == 409
+      if reply.secret_refused?
+        return restart_fallback(session_id, owner: owner, sidecar: sidecar, state_dir: sd, wait: wait, why: :bridge_secret)
+      end
       raise RestartRefused.new(session_id, :failed) unless reply.status == 200
 
       Log.info(:worker, "restart", sid: session_id, from: sidecar.version, by: client_id)
-      fresh = BridgeClient.poll(wait, interval: 0.1) do
-        found = WorkerSidecar.live(dir, unlink: false)
-        found if found && found.started_at != sidecar.started_at
+      fresh = WorkerLink.await(session_id, session_dir: dir, timeout: wait, unlink: false, interval: 0.1,
+                               until: ->(live) { live.epoch != sidecar.epoch || live.started_at != sidecar.started_at })
+      # Timed out: the last outcome, the old worker's Live too, is no successor.
+      changed = fresh.live? && (fresh.epoch != sidecar.epoch || fresh.started_at != sidecar.started_at)
+      version = fresh.version if changed
+      Restarted.new(session_id: session_id, from_version: sidecar.version, version: version)
+    end
+
+    def self.restart_fallback(session_id, owner:, sidecar:, state_dir:, wait:, why:, error: nil)
+      Log.info(:worker, "restart_fallback", sid: session_id, why: why, error: error&.class&.name, msg: error&.message)
+      dir = Session.session_dir(session_id, state_dir: state_dir)
+      session = Session.load(session_id, state_dir: state_dir)
+      holds = restart_fallback_holds(session, dir)
+      raise RestartRefused.new(session_id, :fallback_held, holds: holds) unless holds.empty?
+      raise RestartRefused.new(session_id, :failed, version: sidecar&.version) unless (owner&.pid || 0).to_i.positive?
+
+      # The ask may have taken READ_TIMEOUT: TERM only the owner read at the
+      # start; a successor that took the lock meanwhile is awaited, not killed.
+      current = session_owner(session_id, state_dir: state_dir)
+      if current.nil?
+        resume_session(session_id, state_dir: state_dir)
+      elsif current.pid == owner.pid && current.started_at == owner.started_at
+        begin
+          Process.kill("TERM", owner.pid)
+        rescue Errno::ESRCH
+          nil
+        rescue SystemCallError => e
+          Log.warn(:worker, "restart_fallback_failed", sid: session_id, why: why, error: e.class.name, msg: e.message)
+          raise RestartRefused.new(session_id, :failed, version: sidecar&.version)
+        end
+        unless wait_for_owner_release(session_id, timeout: FALLBACK_STOP_WAIT, state_dir: state_dir)
+          raise RestartRefused.new(session_id, :failed, version: sidecar&.version)
+        end
+
+        resume_session(session_id, state_dir: state_dir)
+      end
+      previous_epoch = sidecar&.epoch
+      previous_started_at = sidecar&.started_at
+      fresh = WorkerLink.await(session_id, session_dir: dir, timeout: wait, unlink: false, interval: 0.1,
+                               until: ->(live) { live.epoch != previous_epoch || live.started_at != previous_started_at })
+      changed = fresh.live? && (fresh.epoch != previous_epoch || fresh.started_at != previous_started_at)
+      Restarted.new(session_id: session_id, from_version: sidecar&.version, version: (fresh.version if changed))
+    end
+    private_class_method :restart_fallback
+
+    def self.restart_fallback_holds(session, session_dir)
+      holds = []
+      holds << :turn_running if session.status == Session::STATUS_RUNNING
+      holds << :question_pending if session.pending_question
+      holds << :input_queued unless SessionInbox.find_new_input_files(session_dir).empty?
+      holds << :background_tasks if running_created_task?(session)
+      holds
+    end
+    private_class_method :restart_fallback_holds
+
+    def self.running_created_task?(session)
+      root = session.working_directory.to_s
+      return false if root.empty?
+
+      Tools::TaskRuntime.created_ids_in(session.messages).any? do |id|
+        next false unless Tools::TaskRuntime::TASK_ID.match?(id)
+
+        path = File.join(root, Tools::TaskRuntime::TASKS_DIR, id, Tools::TaskRuntime::METADATA_FILENAME)
+        next false unless File.file?(path)
+
+        Tools::TaskRecord.from_file(JSON.parse(File.read(path)))&.running?
+      rescue JSON::ParserError, SystemCallError => e
+        Log.warn(:worker, "restart_task_check_failed", sid: session.id, task_id: id,
+                                                           error: e.class.name, msg: e.message)
+        true
       end
-      Restarted.new(session_id: session_id, from_version: sidecar.version, version: fresh&.version)
     end
+    private_class_method :running_created_task?
 
     # Stop a session by sending TERM to its process.
     # With +wait+ (seconds), also wait for the owner to let go of the session,
@@ -741,7 +837,7 @@ module Samagotchi
     private_class_method def self.cancel_running_turn(session_id, state_dir:)
       return unless Session.load(session_id, state_dir: state_dir).status == Session::STATUS_RUNNING
 
-      client = BridgeClient.discover(session_id, session_dir: Session.session_dir(session_id, state_dir: state_dir))
+      client = WorkerLink.client(session_id, session_dir: Session.session_dir(session_id, state_dir: state_dir))
       return unless client && client.cancel(reason: STOP_CANCEL_REASON).status == 202
 
       BridgeClient.poll(STOP_CANCEL_WAIT) do
@@ -757,7 +853,7 @@ module Samagotchi
     # session keeps. "pid" is the pid file workers wrote until 2026-10-01:
     # nothing writes or reads it now, but a folder from before still has one
     # and is still empty.
-    EMPTY_SKELETON_FILES = ["pid", "owner.lock", WorkerSidecar::FILE, AnalyticsFile::NAME].freeze
+    EMPTY_SKELETON_FILES = ["pid", "owner.lock", WorkerLink::FILE, AnalyticsFile::NAME].freeze
     EMPTY_DIRS = [SessionInbox::INPUT_DIR, SessionInbox::NOTES_DIR, "images"].freeze
     EMPTY_SKELETON_DIRS = (EMPTY_DIRS + [SessionInbox::OUTPUT_DIR]).freeze
 
@@ -1252,7 +1348,10 @@ module Samagotchi
     def self.deliver_turn(session_id, prompt:, client_id: nil, images: [], delivery: nil, no_interrupt: false,
                           author: nil, pending_limit: nil, state_dir: nil, manager: self, bridge: nil)
       session_dir = Session.session_dir(session_id, state_dir: state_dir || Session.default_state_dir)
-      bridge ||= -> { BridgeClient.wait_for(session_id, session_dir: session_dir, timeout: TURN_BRIDGE_WAIT) }
+      bridge ||= lambda do
+        link = WorkerLink.await(session_id, session_dir: session_dir, timeout: TURN_BRIDGE_WAIT)
+        link.live? ? link.client(session_id) : nil
+      end
       manager.resume_session(session_id, state_dir: state_dir)
       if (client = bridge.call)
         # A worker from before queueing (no "delivery" feature) ignores the
@@ -1404,15 +1503,6 @@ module Samagotchi
       OwnerLock.owner(Session.session_dir(session_id, state_dir: state_dir || Session.default_state_dir))
     end
 
-    # A worker owns the session now: the one rule for whether a saved
-    # pending question waits for anyone (Session#waiting_question's live:).
-    # A chi REPL's question is its own (nothing else can answer it), and one
-    # a dead worker saved waits for no one.
-    # @return [Boolean]
-    def self.worker_live?(session_id, state_dir: nil)
-      !!session_owner(session_id, state_dir: state_dir)&.worker?
-    end
-
     # The session's owner (#session_owner), unless it is the interactive
     # TUI, which nothing else may resume, stop or delete.
     # @return [OwnerLock::Owner, nil]