samagotchi 0.121.0 → 0.121.1

data/lib/samagotchi/sessions_command.rb

@@ -10,7 +10,7 @@ require_relative "session_metrics"
 require_relative "recap_store"
 require_relative "session_delete_command"
 require_relative "session_archive_command"
-require_relative "bridge_client"
+require_relative "worker_link"
 require_relative "terminal_ui/formatting"
 require_relative "terminal_ui/event_renderer"
 require_relative "cli/command"
@@ -298,7 +298,7 @@ module Samagotchi
         child = s.parent_id ? "  ↳ #{s.parent_id[0, 8]}" : ""
         child += "  ↪ #{s.continues[0, 8]}" if s.continues
         # A question waits for an answer (chi answer, the web, chi --attach).
-        live = s.pending_question && Samagotchi::SessionManager.worker_live?(s.id, state_dir: state_dir)
+        live = s.pending_question && worker_owned?(s.id, state_dir)
         waiting = s.waiting_question(live: !!live)
         status = if waiting&.dig(:relayed_to) then "waiting (in parent #{waiting[:relayed_to]})"
                  elsif waiting then "waiting"
@@ -371,7 +371,7 @@ module Samagotchi
     # @return [Array(Hash, nil, Boolean, String, nil)]
     def stats_snapshot_for(session)
       dir = Samagotchi::Session.session_dir(session.id)
-      if (client = Samagotchi::BridgeClient.discover(session.id, session_dir: dir, read_timeout: STATS_TIMEOUT))
+      if (client = Samagotchi::WorkerLink.client(session.id, session_dir: dir, read_timeout: STATS_TIMEOUT))
         body = client.get_json("stats")&.dig("metrics")
         if body.is_a?(Hash)
           return [TerminalUI::EventRenderer.deep_symbolize_keys(body), true, nil]
@@ -384,7 +384,12 @@ module Samagotchi
       [snapshot, false, note]
     end
 
-    def live_worker?(session_id) = Samagotchi::SessionManager.worker_live?(session_id)
+    def live_worker?(session_id) = worker_owned?(session_id, nil)
+
+    def worker_owned?(session_id, state_dir)
+      dir = Samagotchi::Session.session_dir(session_id, state_dir: state_dir || Samagotchi::Session.default_state_dir)
+      Samagotchi::WorkerLink.resolve(dir, unlink: false).worker_owned?
+    end
 
     def stop(ids)
       return usage_error("give session ids") if ids.empty?
@@ -432,7 +437,7 @@ module Samagotchi
           next false
         rescue Samagotchi::SessionManager::RestartRefused => e
           @stdout.flush
-          @stderr.puts %i[not_running unsupported].include?(e.reason) ? e.message : "session #{id}: #{e.message}"
+          @stderr.puts %i[not_running unsupported fallback_held failed].include?(e.reason) ? e.message : "session #{id}: #{e.message}"
           next false
         rescue ArgumentError => e
           @stdout.flush

data/lib/samagotchi/system_one/client.rb

@@ -2,6 +2,7 @@
 
 require_relative "../config"
 require_relative "../log"
+require_relative "../llm/errors"
 require_relative "answer"
 require_relative "errors"
 require_relative "http_backend"
@@ -12,7 +13,9 @@ module Samagotchi
     # The one way anything asks System 1 a question: #ask answers a set of
     # questions about a state, or says nothing. A backend that is unreachable,
     # slow, refusing or nonsensical is a nil — no judgment, one log line — and
-    # the caller asks the user as it would have anyway.
+    # the caller asks the user as it would have anyway. A turn cancelled
+    # while the judge is asked is not a failed judgment: its
+    # LLM::RequestCancelled goes on to the caller, which asks no one.
     #
     #   client = SystemOne::Client.from_config(host_registry: registry)
     #   client&.ask(state: "git push origin main", questions: {"allow" => question})
@@ -61,6 +64,8 @@ module Samagotchi
 
         answers = begin
           @backend.ask(state: state, questions: questions, cancel_controller: cancel_controller)
+        rescue LLM::RequestCancelled
+          raise
         rescue StandardError => e
           return no_judgment("#{e.class}: #{e.message}", error: e.class.name)
         end

data/lib/samagotchi/system_one/fake_backend.rb

@@ -37,8 +37,6 @@ module Samagotchi
         (@answers || {}).select { |id, _answer| ids.include?(id) }
       end
 
-      def failing? = @failing
-
       def inspect = "#<#{self.class.name} calls=#{@calls}#{" failing" if @failing}>"
     end
   end

data/lib/samagotchi/system_one/log.rb

@@ -47,20 +47,27 @@ module Samagotchi
 
       # @param id [String] a judgment's id
       # @param answer [String] one of ANSWERS
+      # @param question_id [String, nil] the question the user answered: a
+      #   live judgment is written before its card exists, so its label
+      #   carries the card's id (what `chi guardrails replay` skips by)
       # @return [Boolean] whether the line was written
-      def label(id, answer)
+      def label(id, answer, question_id: nil)
         return false if id.to_s.strip.empty?
 
-        append({ "kind" => "label", "id" => id.to_s, "at" => Time.now.utc.iso8601, "answer" => answer.to_s })
+        line = { "kind" => "label", "id" => id.to_s, "at" => Time.now.utc.iso8601, "answer" => answer.to_s }
+        line["question_id"] = question_id.to_s unless question_id.to_s.empty?
+        append(line)
       end
 
       # The judgments, oldest first, each joined with its LAST label
-      # (answer: nil when it has none). Lines that don't parse are skipped;
-      # labels of a judgment that isn't there are dropped.
+      # (answer: nil when it has none) and the first question_id a label
+      # gave it, when the judgment line has none. Lines that don't parse are
+      # skipped; labels of a judgment that isn't there are dropped.
       # @return [Array<Hash>]
       def entries
         judgments = {}
         labels = {}
+        question_ids = {}
         with_lock(File::LOCK_SH) do |file|
           file.each_line do |line|
             data = parse(line)
@@ -68,11 +75,19 @@ module Samagotchi
 
             case data["kind"]
             when "judgment" then judgments[data["id"]] = data
-            when "label" then labels[data["id"]] = data["answer"] if data.key?("id")
+            when "label"
+              next unless data.key?("id")
+
+              labels[data["id"]] = data["answer"]
+              question_ids[data["id"]] ||= data["question_id"]
             end
           end
         end
-        judgments.map { |id, judgment| judgment.merge("answer" => labels[id]) }
+        judgments.map do |id, judgment|
+          joined = judgment.merge("answer" => labels[id])
+          joined["question_id"] ||= question_ids[id] if question_ids[id]
+          joined
+        end
       rescue StandardError => e
         warn_about(e)
         []

data/lib/samagotchi/system_one/self_protect.rb

@@ -1,10 +1,9 @@
 # frozen_string_literal: true
 
-require_relative "../paths"
 require_relative "../config"
 require_relative "../memory_paths"
-require_relative "../hooks/loader"
 require_relative "../guardrails/protected_paths"
+require_relative "../guardrails/parent_approvals"
 
 module Samagotchi
   module SystemOne
@@ -23,13 +22,17 @@ module Samagotchi
       # there is one agent approving another's, so the user decides them even
       # when they are listed in `guardrails.system_one.rules`.
       NEVER_AUTO = %w[chi-answer-piped chi-answer-http chi-broadcast].freeze
-      # chi's config file, however the user names it in config.yml.
-      CONFIG_FILE = /\Aconfig[\w-]*\.ya?ml\z/i
-      # The dirs as a shell command may spell them when the settings point
-      # elsewhere: chi's default config dir and default state dir. A path
-      # into the memories dir is not a control file.
-      DEFAULT_CONFIG_TEXT = %r{\B~/\.config/samagotchi(?!/memories)}
+      # chi's default state dir as a shell command may spell it when the
+      # settings point elsewhere (the sessions and the guardrails store live
+      # there).
       DEFAULT_STATE_TEXT = %r{\B~/\.local/state/samagotchi}
+      # The characters that end a shell word: a memories path in a command
+      # ends at the first one.
+      WORD_END = %q{[\s'"`;&|<>(){}:,]}
+      # A `..` segment anywhere in a command: with one, a memories path may
+      # climb back out (`memories/../config.yml`, `cd memories && … ../x`),
+      # so the command's memories text is not taken out.
+      CLIMB = %r{(?:\A|[\s/'"=])\.\.(?:/|[\s'"]|\z)}
 
       module_function
 
@@ -39,47 +42,40 @@ module Samagotchi
       def refuse?(approval)
         return false unless approval.is_a?(Hash)
         return true if NEVER_AUTO.include?(fetch(approval, :rule).to_s)
-
-        dirs = control_dirs
-        paths = Array(fetch(approval, :paths)).map(&:to_s).reject(&:empty?)
-        return true if paths.any? { |path| control_path?(path, dirs) }
+        # The test that makes an ask user_only (ParentApprovals#chi_files?:
+        # chi's dirs, however a command spells them), minus the memories.
+        return true if Guardrails::ParentApprovals.chi_files?(beyond_memories(approval))
 
         command = fetch(approval, :command).to_s
-        !command.empty? && control_text?(command, dirs)
-      end
-
-      # The dirs whose files are chi's own: its hooks, its installed bundles,
-      # the guardrails store (approvals.json and judgments.jsonl).
-      # @return [Array<String>]
-      def control_dirs
-        [Hooks::Loader.hooks_dir, MemoryPaths.bundles_dir, File.join(Paths.state_dir, "guardrails")]
-          .compact.map { |dir| dir.to_s.chomp("/") }.reject(&:empty?)
+        command.match?(DEFAULT_STATE_TEXT)
       end
 
-      def control_path?(path, dirs)
-        real = Guardrails::ProtectedPaths.real(path)
-        return true if dirs.any? { |dir| Guardrails::ProtectedPaths.within?(real, dir) }
-        return true if config_file?(real)
-
-        control_text?(path, dirs)
-      end
-
-      # config.yml in chi's config dir — not the memories beside it.
-      def config_file?(path)
-        Guardrails::ProtectedPaths.within?(path, ConfigFile.config_dir) && File.basename(path).match?(CONFIG_FILE)
-      end
-
-      # A command or path naming one of those dirs, in the spelling this
-      # process uses or the default `~/.config/samagotchi` one.
-      def control_text?(text, dirs)
-        dirs.any? { |dir| text.include?(dir) || text.include?(File.expand_path(dir)) } ||
-          text.match?(config_text) || text.match?(DEFAULT_CONFIG_TEXT) || text.match?(DEFAULT_STATE_TEXT)
+      # The approval's facts without what is in the memories dir (not its
+      # installed bundles): the paths under it, and its spellings in the
+      # command unless the command climbs with `..`.
+      def beyond_memories(approval)
+        memories = Guardrails::ProtectedPaths.real(MemoryPaths.system_dir)
+        bundles = Guardrails::ProtectedPaths.real(MemoryPaths.bundles_dir)
+        paths = Array(fetch(approval, :paths)).map(&:to_s).reject do |path|
+          real = Guardrails::ProtectedPaths.real(path)
+          Guardrails::ProtectedPaths.within?(real, memories) && !Guardrails::ProtectedPaths.within?(real, bundles)
+        end
+        command = fetch(approval, :command).to_s
+        unless command.match?(CLIMB)
+          command = command.gsub(memories_text) { |text| text.include?("/.bundles") ? text : "" }
+        end
+        { paths: paths, command: command }
       end
 
-      # chi's config dir as text — everything under it except the memories,
-      # which the model works with.
-      def config_text
-        Regexp.new("#{Regexp.escape(ConfigFile.config_dir)}(?![/]memories)")
+      # The memories dir as a command spells it: the default
+      # `.config/samagotchi/memories`, or this process's own path, with the
+      # rest of that shell word.
+      def memories_text
+        dir = ConfigFile.config_dir
+        prefixes = [".config/samagotchi", dir, Guardrails::ProtectedPaths.real(dir)]
+                   .map { |prefix| Regexp.escape(prefix.to_s.chomp("/")) }.uniq
+        word = WORD_END.sub("[", "[^")
+        Regexp.new("(?:#{prefixes.join("|")})/memories(?=/|#{WORD_END}|\\z)(?:/#{word}*)?")
       end
 
       def fetch(hash, key)

data/lib/samagotchi/terminal_ui/attach_launcher.rb

@@ -6,6 +6,7 @@ require_relative "../model_profile"
 require_relative "../session_manager"
 require_relative "../thinking_command"
 require_relative "../bridge_client"
+require_relative "../worker_link"
 require_relative "../parent_report"
 require_relative "../cli/exit"
 require_relative "../launch_mode"
@@ -207,8 +208,8 @@ module Samagotchi
                                                                          toolkit: toolkit, settings: settings,
                                                                          parent_answers: parent_answers))
                   end
-        client = BridgeClient.wait_for(session.id, session_dir: Session.session_dir(session.id, state_dir: sd), timeout: wait)
-        client || raise(Error, format(LaunchMode::BRIDGE_LATE, session.id))
+        link = WorkerLink.await(session.id, session_dir: Session.session_dir(session.id, state_dir: sd), timeout: wait)
+        link.live? ? link.client(session.id) : raise(Error, format(LaunchMode::BRIDGE_LATE, session.id))
       rescue SessionManager::OwnedByTUI => e
         raise Error, e.message
       rescue ArgumentError => e
@@ -248,9 +249,13 @@ module Samagotchi
       end
 
       # @return [BridgeClient, nil] the running worker's, or nil when none runs
+      # @raise [Error] its worker is newer than this chi (Skew)
       def connect_existing(session_id, state_dir)
         Session.load(session_id, state_dir: state_dir)
-        BridgeClient.discover(session_id, session_dir: Session.session_dir(session_id, state_dir: state_dir))
+        link = WorkerLink.resolve(Session.session_dir(session_id, state_dir: state_dir), unlink: true)
+        raise Error, link.message(session_id) if link.is_a?(WorkerLink::Skew)
+
+        link.live? ? link.client(session_id) : nil
       end
     end
   end

data/lib/samagotchi/terminal_ui/attached_loop.rb

@@ -439,7 +439,7 @@ module Samagotchi
 
       # The stream moved to a new worker (a restart): requests go there too.
       def switch_worker(event)
-        @client = @link.switched(event)
+        @client = @link.switched(event) || @client
         @worker_changed = true
         # The new worker's machine may name another default model.
         @default_model_name = nil
@@ -452,9 +452,11 @@ module Samagotchi
       def closed_line(reason)
         id = @client.session_id
         # The worker asked for a secret this terminal's chi doesn't send.
-        return "Lost the session's worker: #{BridgeSecret::REFUSED}" if reason == BridgeSecret::ERROR
+        return "Lost the session's worker: #{BridgeSecret.refused(id, via: via)}" if reason == BridgeSecret::ERROR
         return remote_closed_line(reason, id) if via.remote?
 
+        return "Lost the session's worker: #{@link.failure}" if reason == "worker_newer" && @link.failure
+
         # Here a stopped session has always read as unreachable.
         reason = "unreachable" if reason == "stopped"
         "Lost the session's worker (#{reason}). Resume it with: #{via.command("--shared --resume #{id}")}"

data/lib/samagotchi/terminal_ui/local_link.rb

@@ -3,7 +3,7 @@
 require_relative "attach_link"
 require_relative "../session"
 require_relative "../bridge_client"
-require_relative "../worker_sidecar"
+require_relative "../worker_link"
 require_relative "../delivery"
 require_relative "../session_inbox"
 require_relative "../image_store"
@@ -42,6 +42,8 @@ module Samagotchi
                      installed_version: -> { InstalledVersions.new.newest },
                      children_counts: ->(id) { ChildrenStatus.counts(id, state_dir: state_dir) })
         @client = client
+        @session_id = client.session_id
+        @host = BridgeClient::HOST
         @state_dir = state_dir
         @delete_session = delete_session
         @archive_session = archive_session
@@ -52,30 +54,36 @@ module Samagotchi
       # The sidecar's worker, nil while none runs; gone once the session was
       # stopped (no worker is coming): its stop marker in +state_dir+.
       def live_worker
-        id = @client.session_id
+        id = @session_id
         return [:gone, "stopped"] if Session.stopped_marker?(id, state_dir: @state_dir)
 
+        link = WorkerLink.resolve(session_dir, unlink: true, host: @host)
+        if link.is_a?(WorkerLink::Skew)
+          @failure = link.message(id)
+          return [:gone, "worker_newer"]
+        end
+
         # Kept: the stream moves to this very client (EventStream), and
         # #switched takes it, port and secret, rather than reading again.
-        @found = BridgeClient.discover(id, session_dir: session_dir, host: @client.host)
+        @found = link.live? ? link.client(id, host: @host) : nil
         [@found, nil]
       end
 
       # A new worker's Bridge: the client #live_worker found for the stream
-      # (the event names its port), with that worker's secret. One the event
-      # doesn't name (another worker since) is read from the sidecar for that
-      # port, none when the sidecar names another one by now: that worker is
-      # gone too, and the stream finds the next.
+      # (the event names its port), with that worker's secret. An event that
+      # names another worker is resolved again; a mismatched sidecar never
+      # becomes a secretless client.
       def switched(event)
         port = AttachLink.event_port(event)
         found = @found
-        @client = if found&.port == port
-                    found
-                  else
-                    sidecar = WorkerSidecar.read(session_dir)
-                    sidecar = WorkerSidecar.new(port: port) unless sidecar&.port == port
-                    BridgeClient.for_sidecar(@client.session_id, sidecar, host: @client.host)
-                  end
+        candidate = if found&.port == port
+                      found
+                    else
+                      link = WorkerLink.resolve(session_dir, unlink: true, host: @host)
+                      link.live? && link.port == port ? link.client(@session_id, host: @host) : nil
+                    end
+        @client = candidate if candidate
+        candidate
       end
 
       # No sidecar to read: true, its Bridge answers (a P0-P2 worker refuses
@@ -139,18 +147,19 @@ module Samagotchi
 
       def via = ChiInvocation::HERE
 
-      # The closing line says it all (unreachable, unknown_session).
-      def failure = nil
+      # The closing line says it all (unreachable, unknown_session); a worker
+      # newer than this chi names itself.
+      attr_reader :failure
 
       def close = nil
 
       private
 
-      def session_dir = Session.session_dir(@client.session_id, state_dir: @state_dir)
+      def session_dir = Session.session_dir(@session_id, state_dir: @state_dir)
 
       def feature?(name)
-        sidecar = WorkerSidecar.read(session_dir)
-        sidecar.nil? || sidecar.features.include?(name)
+        link = WorkerLink.resolve(session_dir, unlink: false)
+        !link.live? || link.features.include?(name)
       end
     end
   end

data/lib/samagotchi/toolkit.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "config"
+require_relative "model_match"
 
 module Samagotchi
   # A session's toolkit: which of the registered tools its prompts declare
@@ -118,8 +119,66 @@ module Samagotchi
       Array(groups).map { |group| group.to_s.strip }.reject(&:empty?).uniq.sort.freeze
     end
 
+    # Whether a source group +name+ is one of +selectors+: fnmatch globs in
+    # the guardrails rules' grammar (ModelMatch::GLOB_FLAGS: any case,
+    # extglob), so `groups: [Chrome]` reaches chrome.
     def self.group_matches?(selectors, name)
-      selectors == :all || selectors.any? { |selector| File.fnmatch?(selector, name.to_s) }
+      selectors == :all || selectors.any? { |selector| File.fnmatch?(selector, name.to_s, ModelMatch::GLOB_FLAGS) }
+    end
+
+    # Why +value+ can't be a kit's groups (a group name or glob, or a list
+    # of them), nil when it can (nil too: its base's groups).
+    def self.groups_error(value)
+      return nil if value.nil? || value.is_a?(String)
+      return nil if value.is_a?(Array) && value.all? { |group| group.is_a?(String) || group.is_a?(Symbol) || group.is_a?(Numeric) }
+
+      "groups must be a list of group names or globs"
+    end
+
+    # config.yml's toolkit.kits.NAME line for a +value+ that can't be its
+    # groups (groups_error), nil when it can: the one wording a worker's
+    # warning and a creation's refusal both start with.
+    def self.config_groups_error(name, value)
+      problem = groups_error(value)
+      problem && "toolkit.kits.#{name}: #{problem}"
+    end
+
+    # A new session refused: its toolkit, or a base it builds on, is a
+    # config.yml kit (toolkit.kits) whose groups: isn't a name or a list of
+    # them. A session never starts on a reach other than the one written
+    # (its base's groups: wider or narrower); the message is the one line
+    # every creation surface shows.
+    class Refused < StandardError
+      # @param toolkit [String] the new session's toolkit name
+      # @param problem [String] config_groups_error's line
+      def self.for(toolkit, problem) = new("#{problem}; fix config.yml to start a session on toolkit #{toolkit}")
+    end
+
+    # Raises Refused when +toolkit+ (a new session's: Session.new_session)
+    # names a config kit, or builds on one through its bases, whose
+    # groups: is invalid (config_groups_error). Only config.yml's kits are
+    # followed: a bundle's (chi.toolkit) refuses at its load, and a name
+    # that doesn't resolve stays the worker's warning.
+    # @param config [Hash, nil] toolkit.kits (config.yml's by default)
+    # @return [Toolkit] +toolkit+
+    # @raise [Refused]
+    def self.check_new!(toolkit, config: config_kits)
+      return toolkit unless toolkit && config.is_a?(Hash)
+
+      name = toolkit.name
+      seen = []
+      until seen.include?(name) || name == REVIEW || BUILTIN_KITS.key?(name)
+        seen << name
+        spec = config[name] || config[name.to_sym]
+        break unless spec.is_a?(Hash)
+
+        spec = spec.transform_keys(&:to_s)
+        problem = config_groups_error(name, spec["groups"])
+        raise Refused.for(toolkit.name, problem) if problem
+
+        name = (spec["base"] || FULL).to_s
+      end
+      toolkit
     end
 
     # A named list of declared tools: +tools+ (:all, every built-in; or the
@@ -304,7 +363,10 @@ module Samagotchi
     #   that isn't a {base:, add:, remove:, prompt:, groups:} map. One with another key
     # (a typo, a tools: list) still loads, with a line naming the key, and
     # so does one whose prompt isn't text or is over PROMPT_MAX characters:
-    # without the prompt, with a line saying why.
+    # without the prompt, with a line saying why. One whose groups: isn't
+    # a name or a list (config_groups_error) loads reaching no group, with
+    # a line: a session saved on it before the typo (no new one starts on
+    # it: check_new!) never reaches wider than written.
     # @param config [Hash, nil] toolkit.kits
     # @param plugins [Array<Kit>]
     # @param errors [Array<String>] gets a line per kit left out or unknown key
@@ -329,6 +391,10 @@ module Samagotchi
             errors << "toolkit.kits.#{name}: #{problem}; the kit loads without it"
             spec.delete("prompt")
           end
+          if (problem = config_groups_error(name, spec["groups"]))
+            errors << "#{problem}; the kit reaches no tool-index group until it is fixed"
+            spec["groups"] = []
+          end
           kits[name] = Kit.new(name: name, base: spec["base"] || FULL, add: spec["add"], remove: spec["remove"],
                                prompt: spec["prompt"], groups: spec["groups"], source: "config")
         end

data/lib/samagotchi/tools/delegate.rb

@@ -81,7 +81,7 @@ module Samagotchi
         started = session.to_s.strip.empty? ? "Started a delegate session" : "Sent the follow-up to delegate #{child_id[0, 8]}"
         "#{note}session: #{child_id}\nstatus: running\n#{started}; #{running_hint(peers)} " \
           "It shows in chi sessions list and the web as a child of this session; the user can attach to it."
-      rescue ArgumentError => e
+      rescue ArgumentError, Toolkit::Refused => e
         "Error: #{e.message}"
       end
 

data/lib/samagotchi/tools/delegate_relay.rb

@@ -2,6 +2,7 @@
 
 require_relative "../session"
 require_relative "../bridge_client"
+require_relative "../worker_link"
 require_relative "../relay"
 require_relative "../guardrails/approval"
 require_relative "../guardrails/parent_policy"
@@ -79,13 +80,14 @@ module Samagotchi
         qid = question.id.to_s
         desk = relay.relay_desk
         relay_id = desk.open(child_id: child_id, child_question_id: qid)
-        client = BridgeClient.discover(child_id, session_dir: Session.session_dir(child_id, state_dir: state_dir))
+        client = WorkerLink.client(child_id, session_dir: Session.session_dir(child_id, state_dir: state_dir))
         post(client, "opened", relay_id, qid)
         Log.info(:turn, "relay_opened", child: child_id[0, 8], id: qid)
 
         fields = Relay.card(child, question, relay_id: relay_id, more: more)
         answer = relay.open_question(fields, watch: watch(child_id, qid, state_dir))
-        settle(answer, fields, label: label(question), client: client, desk: desk, relay_id: relay_id, qid: qid)
+        settle(answer, fields, label: label(question), client: client, desk: desk, relay_id: relay_id, qid: qid,
+                        child_id: child_id)
       ensure
         # A relay that failed before it settled closes, so the desk (which
         # prunes only settled ones) keeps none open; a settled one stays.
@@ -96,7 +98,7 @@ module Samagotchi
       # was answered or cancelled there) or its worker is gone.
       def watch(child_id, qid, state_dir)
         lambda do
-          unless SessionManager.worker_live?(child_id, state_dir: state_dir)
+          unless WorkerLink.resolve(Session.session_dir(child_id, state_dir: state_dir), unlink: false).worker_owned?
             next "child_gone"
           end
 
@@ -109,7 +111,7 @@ module Samagotchi
 
       # Record the parent's answer, tell the child, and say what came of it.
       # @param label [String] the outcome line's start (#label)
-      def settle(answer, fields, label:, client:, desk:, relay_id:, qid:)
+      def settle(answer, fields, label:, client:, desk:, relay_id:, qid:, child_id:)
         if answer.is_a?(Hash) && answer[:error] == "cancelled"
           desk.close(relay_id)
           return closed(answer[:reason].to_s, label, client: client, relay_id: relay_id, qid: qid)
@@ -120,7 +122,7 @@ module Samagotchi
         desk.record(relay_id, selected_indices: dismissed ? [] : answer.selected_indices,
                               freeform: dismissed ? nil : answer.freeform, dismissed: dismissed, by: by)
         response = post(client, "answered", relay_id, qid)
-        Outcome.new(line: line(label, delivered(response, answer, fields, dismissed)), stopped: false)
+        Outcome.new(line: line(label, delivered(response, answer, fields, dismissed, child_id)), stopped: false)
       end
 
       def closed(reason, label, client:, relay_id:, qid:)
@@ -136,12 +138,12 @@ module Samagotchi
       end
 
       # The outcome of an answer the child was told about.
-      def delivered(response, answer, fields, dismissed)
+      def delivered(response, answer, fields, dismissed, child_id)
         return "not delivered (the child's worker is gone)" unless response
 
         # The child's Bridge asked for a secret this worker didn't send (one
         # from before the child's chi): not the child's guardrails refusing.
-        return "not delivered (#{BridgeSecret::REFUSED})" if response.secret_refused?
+        return "not delivered (#{BridgeSecret.refused(child_id)})" if response.secret_refused?
 
         hook = fields[:kind] == HOOK_KIND
         case response.status