samagotchi 0.121.0 → 0.121.1

data/lib/samagotchi/web/public/participant.js

@@ -24,7 +24,9 @@ import { appendQuote } from "./annotations.js";
 import { messageAuthorData, participantQuote, participantSource } from "./participant_annotate.js";
 import { mountComposer } from "./composer_mount.js";
 import { PROMPT_LINE_PX } from "./composer_size.js";
-import { forgetReviewHistory, readReviewHistory, recordReviewComment, rememberReviewHistory } from "./review_history.js";
+import {
+  forgetReviewHistory, pruneReviewHistory, readReviewHistory, recordReviewComment, rememberReviewHistory,
+} from "./review_history.js";
 
 // A link's #code= opened in a browser that already has a cookie: traded
 // first, the page reloads without it.
@@ -54,6 +56,8 @@ let usageTimer = null;
 let failures = 0;
 let loadSeq = 0;
 let ended = false;
+// The other links' ↑/↓ lists went at this page's first read (pruneReviewHistory).
+let historyPruned = false;
 // The Plan view: the subject picked, what it last drew, and which view a
 // narrow screen shows (the thread first).
 let subjectPath = null;
@@ -104,6 +108,8 @@ function showEnded(json) {
   document.title = "chi · review link ended";
 }
 
+const OFFLINE_TEXT = "Can't reach the session — retrying…";
+
 // Reads the review data, draws it and streams from it. One that can't be
 // read (unreachable, a 5xx) keeps what the page shows, says it is
 // retrying, and reads again with a backoff.
@@ -115,18 +121,22 @@ async function load() {
   if (!ok) {
     $("head").hidden = false;
     if (!data) $("title").textContent = "Review";
-    $("offline").hidden = !retries(status);
-    if (retries(status)) {
-      scheduleRetry(retryDelay(failures++));
-    } else {
-      $("note").textContent = status === 404 ? "This session is gone." : `The review couldn't be read (HTTP ${status}).`;
-    }
+    // Said over the thread (#offline), not in the header's rows: the
+    // thread stays where it is.
+    $("offline").textContent = retries(status) ? OFFLINE_TEXT
+      : status === 404 ? "This session is gone." : `The review couldn't be read (HTTP ${status}).`;
+    $("offline").hidden = false;
+    if (retries(status)) scheduleRetry(retryDelay(failures++));
     return;
   }
   failures = 0;
   $("offline").hidden = true;
   data = json;
-  if (!ownerView) rememberReviewHistory(sessionId, data?.viewer?.id);
+  if (!ownerView) {
+    rememberReviewHistory(sessionId, data?.viewer?.id);
+    if (!historyPruned) pruneReviewHistory(sessionId, data?.viewer?.id);
+    historyPruned = true;
+  }
   live = liveFrom(data.current_turn);
   liveStale = false;
   render();
@@ -468,6 +478,7 @@ async function sendComment() {
   if (!prompt) return;
   sending = true;
   $("send").disabled = true;
+  showError("");
   let reply;
   try {
     reply = await api(`/api/sessions/${encodeURIComponent(sessionId)}/turn`, {
@@ -481,7 +492,8 @@ async function sendComment() {
   if (ended) return;
   if (ok) {
     recordReviewComment(data?.viewer?.id, prompt);
-    comment.value = "";
+    // What was typed while the comment was in flight stays in the box.
+    if (comment.value.trim() === prompt) comment.value = "";
     composer.fit();
     composer.drawFoldControls();
     composer.refreshHistory();
@@ -522,6 +534,8 @@ const composer = ownerView ? null : mountComposer({
   fold: { session: () => sessionId || null },
 });
 if (composer) {
+  // An error under the box (a refusal, the images toast) goes at the next edit.
+  $("comment").addEventListener("input", () => showError(""));
   // The session composer's layout (composer.css), and the fold saved in this browser.
   document.body.classList.add("has-session");
   composer.newVisit();

data/lib/samagotchi/web/public/participants_panel.js

@@ -101,6 +101,19 @@ export function chipTemplate(chip) {
     title=${chip.title} aria-label=${chip.title} aria-haspopup="dialog"><span class="pc-dot" aria-hidden="true"></span>${chip.text}</button>`;
 }
 
+// A cap field's dollars (a leading $ allowed): {value}, {value: null} when
+// empty (the Invite then leaves the default cap), or {error}. Both forms read
+// it, so one rule and one wording.
+// @return {{value: number|null}|{error: string}}
+export const CAP_ERROR = "A cap is dollars, 0 to 1000.";
+export function capValue(text) {
+  const clean = String(text ?? "").trim();
+  if (!clean) return { value: null };
+  const value = Number(clean.replace(/^\$/, ""));
+  if (!Number.isFinite(value) || value < 0 || value > 1000) return { error: CAP_ERROR };
+  return { value };
+}
+
 // An email as chi binds a link to it (Grants.clean_identity, which has the
 // last word): one @, no spaces, commas, quotes or angle brackets.
 const EMAIL_RE = /^[^@\s,<>"\\]+@[^@\s,<>"\\]+$/;
@@ -118,15 +131,17 @@ export function inviteBody({ name, kind, days, cap, identity }) {
   if (email) body.identity = email;
   const d = Number(days);
   body.ttl = Math.round((EXPIRY_DAYS.includes(d) ? d : DEFAULT_EXPIRY_DAYS) * 24 * 60 * 60);
-  const capText = String(cap ?? "").trim();
-  if (capText) {
-    const value = Number(capText.replace(/^\$/, ""));
-    if (!Number.isFinite(value) || value < 0 || value > 1000) return { error: "A cap is dollars, 0 to 1000." };
-    body.cap = value;
-  }
+  const capped = capValue(cap);
+  if (capped.error) return { error: capped.error };
+  if (capped.value !== null) body.cap = capped.value;
   return { body };
 }
 
+// The toast for an invite whose panel closed before its answer came.
+export function lateInviteText(name, sessionId) {
+  return `${name}'s review link for ${String(sessionId).slice(0, 8)} is ready (the panel closed before it came); it shows only once.`;
+}
+
 // What Revoke asks first: it can't be undone (chi keeps only the link's
 // digest), as a delete asks.
 export function revokeConfirmText(name) {
@@ -206,7 +221,7 @@ export function panelTemplate(grants, { now, sessionId, invite = null, error = n
 // The control: el (#infoText, where the chip is drawn), session() the open
 // session's id, api {list(id), invite(id, body), revoke(id, pid), cap(id,
 // pid, cap)}, onChange() (the chip's count or presence changed: redraw the
-// bar), toast(text), onNames() (the participants' names changed: name the
+// bar), toast(text, action, {sticky}) (app.js showToast), onNames() (the participants' names changed: name the
 // badges drawn before them, participant_names.js nameUnnamedBadges).
 // startReview({onError}): Start a review of it (a review fork of the open
 // session): the created session, or null (its refusal to onError(text), true
@@ -300,7 +315,10 @@ export function createParticipantsControl({ el, session, api, onChange = () => {
     const asked = ask();
     try {
       const answer = await api.invite(asked.id, body);
-      if (!stillOpen(asked)) return dropped(asked);
+      if (!stillOpen(asked)) {
+        lateInvite(asked, answer.participant?.name || body.name, answer.link);
+        return dropped(asked);
+      }
       invite = { name: answer.participant?.name || body.name, link: answer.link, qr_svg: answer.qr_svg, lan: answer.lan,
                  warning: answer.warning || null, identity: answer.participant?.identity || null, copied: false };
       error = null;
@@ -314,10 +332,27 @@ export function createParticipantsControl({ el, session, api, onChange = () => {
     if (shell.isOpen()) draw();
   }
 
+  // An invite answered after its panel closed: the grant exists and its link
+  // shows only once, so a sticky toast keeps it (Copy link; a failed copy
+  // shows the link itself to select), never a later panel.
+  function lateInvite(asked, name, link) {
+    if (!link) return;
+    const copy = async () => {
+      try {
+        await win.navigator.clipboard.writeText(link);
+        toast(`${name}'s review link copied`);
+      } catch {
+        toast(`${name}'s review link: ${link}`, null, { sticky: true });
+      }
+    };
+    toast(lateInviteText(name, asked.id), { label: "Copy link", run: copy }, { sticky: true });
+  }
+
   async function submitCap(form) {
-    const value = Number(String(form.elements.cap.value).trim().replace(/^\$/, ""));
-    if (!Number.isFinite(value)) {
-      error = "A cap is dollars, 0 to 1000.";
+    // A cleared field is no cap to set (Number("") would be a $0 cap).
+    const { value, error: problem } = capValue(form.elements.cap.value);
+    if (problem || value == null) {
+      error = CAP_ERROR;
       return draw();
     }
     const asked = ask();

data/lib/samagotchi/web/public/push.js

@@ -81,14 +81,15 @@ export async function subscribe({ reg, key, post }) {
   return { subscription: sub, answer };
 }
 
-// Unsubscribes this device and tells chi web to forget it.
+// Tells chi web to forget this device, then unsubscribes it: a DELETE
+// that fails (a flaky connection) throws before anything local changes, so
+// the bell stays on with its subscription and the next tap tries again.
 // @param del (endpoint) => Promise
 // @return whether there was a subscription
 export async function unsubscribe({ reg, del }) {
   const sub = await reg.pushManager.getSubscription();
   if (!sub) return false;
-  const endpoint = sub.endpoint;
+  await del(sub.endpoint);
   await sub.unsubscribe();
-  await del(endpoint);
   return true;
 }

data/lib/samagotchi/web/public/push_devices.js

@@ -98,6 +98,17 @@ export function sheetTemplate(model) {
     }<div class="pd-note">Approvals, questions, step limits, cards and failed turns; quiet while a chi web page is in front.</div>`;
 }
 
+// Puts every switch in +pop+ back to +model+: lit skips a .checked binding
+// whose value is the one it last set, so a switch the app then refused
+// (iOS's Don't Allow, a failed PATCH) would keep its clicked state.
+export function syncSwitches(pop, model) {
+  const rows = [model.thisRow, ...model.others];
+  for (const input of pop.querySelectorAll("input[data-pd]")) {
+    if (input.dataset.pd === "this") input.checked = model.on;
+    else if (input.dataset.pd === "done") input.checked = rows.some((r) => r.id === input.dataset.id && r.done);
+  }
+}
+
 // The sheet at the bell. +state+() the bell's state; +endpoint+() this
 // device's push endpoint (a Promise; null without a subscription);
 // +toggleThis+() the bell's subscribe / unsubscribe (resolves to its
@@ -111,14 +122,17 @@ export function createPushDevices({ button, api, state, endpoint, toggleThis, no
   // Each load's turn: an older answer that arrives late is dropped.
   let loads = 0;
 
-  const draw = () => {
-    if (shell.isOpen()) render(sheetTemplate(sheetModel({ state: state(), info, busy, error, now: now() })), shell.pop);
+  const paint = () => {
+    const model = sheetModel({ state: state(), info, busy, error, now: now() });
+    render(sheetTemplate(model), shell.pop);
+    syncSwitches(shell.pop, model);
   };
+  const draw = () => { if (shell.isOpen()) paint(); };
 
   const shell = createChipPopover({
     id: "pushDevices", className: "ctx-popover push-devices", width: 340, el: doc.createElement("span"),
     anchor: "#notifyBtn", openers: "#notifyBtn", summary: () => ({}), sheet: true, label: "Notifications", doc, win,
-    show: () => render(sheetTemplate(sheetModel({ state: state(), info, busy, error, now: now() })), shell.pop),
+    show: () => paint(),
     onClose: () => { error = ""; },
   });
 

data/lib/samagotchi/web/public/review_history.js

@@ -4,8 +4,9 @@
 // /api/history (the owner may open a link in the same browser, on the same
 // origin: each grant's list and the owner's stay apart). Read and written
 // through storage.js (guarded): a list that can't be read or written is just
-// not there. A link that ends forgets its list.
-import { readStored, removeStored, writeStored } from "./storage.js";
+// not there. A link that ends forgets its list; one that ended while no page
+// was open goes when the next link's page loads (pruneReviewHistory).
+import { readStored, removeStored, storedKeys, writeStored } from "./storage.js";
 
 export const REVIEW_HISTORY_PREFIX = "chi_review_history:";
 const REVIEW_HISTORY_SESSION_PREFIX = "chi_review_history_session:";
@@ -58,3 +59,14 @@ export function forgetReviewHistory(grantId, sessionId) {
   const key = reviewHistoryKey(grantId || remembered);
   if (key) removeStored(key);
 }
+
+// A participant page's first read (+sessionId+, its grant +grantId+): every
+// other grant's list and every other session's pointer go, so the lists of
+// links that ended while no page was open don't stay for good. Without
+// either id (the owner's view, an older server's data) nothing goes.
+export function pruneReviewHistory(sessionId, grantId) {
+  if (!sessionId || !grantId) return;
+  const keep = new Set([reviewHistoryKey(grantId), `${REVIEW_HISTORY_SESSION_PREFIX}${sessionId}`]);
+  for (const key of storedKeys(REVIEW_HISTORY_PREFIX)) if (!keep.has(key)) removeStored(key);
+  for (const key of storedKeys(REVIEW_HISTORY_SESSION_PREFIX)) if (!keep.has(key)) removeStored(key);
+}

data/lib/samagotchi/web/public/review_start.js

@@ -19,10 +19,8 @@ export function readSubjects(text) {
   return { subjects: [...new Set(found)], error: null };
 }
 
-export const parseSubjects = (text) => readSubjects(text).subjects;
-
 // The files as the form shows them again: a path with a space, a comma or
-// a quote in quotes, so parseSubjects reads it back whole.
+// a quote in quotes, so readSubjects reads it back whole.
 export function formatSubjects(subjects) {
   return (subjects || []).map((s) => (/[\s,"]/.test(s) ? `"${s}"` : s)).join(", ");
 }

data/lib/samagotchi/web/public/session_actions.js

@@ -76,9 +76,21 @@ export function createSessionActions({
   // +stopHolds+ is the sheet's "Stop all": the worker's stop-all step, then
   // the stop. A delegate or a background task outlives the worker either way
   // (docs/sessions.md, "Stopping a worker"), which is why the sheet says so.
-  async function stopSelected(id = selected(), { stopHolds = false } = {}) {
-    if (!id) return;
+  // One Stop per session at a time (as reviewingIds): a second tap while the
+  // holds read (or the stop) is under way would be a second confirm.
+  const stopAsks = new Set();
 
+  async function stopSelected(id = selected(), options = {}) {
+    if (!id || stopAsks.has(id)) return;
+    stopAsks.add(id);
+    try {
+      await stopOne(id, options);
+    } finally {
+      stopAsks.delete(id);
+    }
+  }
+
+  async function stopOne(id, { stopHolds = false }) {
     if (!stopHolds) {
       let holds = [];
       try {

data/lib/samagotchi/web/public/storage.js

@@ -21,3 +21,19 @@ export function writeStored(key, value) {
 export function removeStored(key) {
   try { globalThis.localStorage.removeItem(key); } catch (_) {}
 }
+
+// The stored keys that start with +prefix+ ([] when they can't be read), a
+// copy: removing one while walking them is safe.
+export function storedKeys(prefix) {
+  try {
+    const storage = globalThis.localStorage;
+    const keys = [];
+    for (let i = 0; i < storage.length; i++) {
+      const key = storage.key(i);
+      if (typeof key === "string" && key.startsWith(prefix)) keys.push(key);
+    }
+    return keys;
+  } catch (_) {
+    return [];
+  }
+}

data/lib/samagotchi/web/push/client.rb

@@ -76,6 +76,11 @@ module Samagotchi
           result_for(response, ms(started))
         rescue *NETWORK_ERRORS => e
           Result.new(status: :failed, code: nil, ms: ms(started), error: e.is_a?(Timeout::Error) ? "timeout" : e.class.name)
+        rescue StandardError => e
+          # Anything else is this device's failure too (a p256dh off the
+          # curve on disk: Crypto.encrypt raises), never the other devices'
+          # or the Notifier's flush. Its class, never its message.
+          Result.new(status: :failed, code: nil, ms: ms(started), error: e.class.name)
         end
 
         private

data/lib/samagotchi/web/push/store.rb

@@ -201,11 +201,14 @@ module Samagotchi
           added
         end
 
-        # Removes the subscription with this short id or endpoint.
+        # Removes the subscription with this short id or endpoint, only one
+        # subscribed on +origin+ (nil: any; a push service's 404/410).
         # @return [Sub, nil] the one removed
-        def remove(id_or_endpoint)
+        def remove(id_or_endpoint, origin: nil)
           update do |subs|
-            gone = subs.find { |sub| sub.id == id_or_endpoint || sub.endpoint == id_or_endpoint }
+            gone = subs.find do |sub|
+              (sub.id == id_or_endpoint || sub.endpoint == id_or_endpoint) && (origin.nil? || sub.origin == origin)
+            end
             [subs - [gone], gone]
           end
         end
@@ -307,6 +310,7 @@ module Samagotchi
           unless p256dh&.bytesize == 65 && p256dh.getbyte(0) == 4
             raise Invalid, "a push subscription's p256dh must be a P-256 public key (65 bytes, base64url)"
           end
+          raise Invalid, "a push subscription's p256dh is not a point on P-256" unless point?(p256dh)
           raise Invalid, "a push subscription's auth must be 16 bytes (base64url)" unless decoded(keys["auth"])&.bytesize == 16
 
           [endpoint, keys["p256dh"], keys["auth"]]
@@ -331,6 +335,15 @@ module Samagotchi
           @services.any? { |entry| entry.start_with?(".") ? host.end_with?(entry) && host.length > entry.length : host == entry }
         end
 
+        # The key as Crypto.encrypt builds it: 65 bytes starting 0x04 can
+        # still lie off the curve (encrypt would raise on every push).
+        def point?(raw)
+          Crypto.ec_public(raw)
+          true
+        rescue ArgumentError, OpenSSL::OpenSSLError
+          false
+        end
+
         def decoded(text)
           Crypto.unb64u(text)
         rescue ArgumentError

data/lib/samagotchi/web/push_routes.rb

@@ -86,7 +86,8 @@ module Samagotchi
         [204, { "Cache-Control" => "no-store" }, []]
       end
 
-      # {endpoint} → 204: this device's bell turned off.
+      # {endpoint} → 204: this device's bell turned off (only a device
+      # subscribed on this origin, as the other device routes).
       def handle_push_unsubscribe(req)
         return push_off unless @push
 
@@ -94,7 +95,7 @@ module Samagotchi
         endpoint = body["endpoint"] if body.is_a?(Hash)
         return error_response(400, "missing_fields", "endpoint is required") unless endpoint.is_a?(String) && !endpoint.empty?
 
-        gone = @push.store.remove(endpoint)
+        gone = @push.store.remove(endpoint, origin: @push.origin)
         Log.info(:web, "push_unsubscribed", device: gone.id) if gone
         [204, { "Cache-Control" => "no-store" }, []]
       end

data/lib/samagotchi/web/session_access_routes.rb

@@ -256,7 +256,8 @@ module Samagotchi
       # timeout and a margin, on top of +wait+); 409
       # owned_by_tui (a chi REPL has it), 409 scratch (a leftover scratch
       # session, as chi --attach here says); 504 worker_timeout (its Bridge
-      # didn't come in time); 404 not_found.
+      # didn't come in time); 409 worker_newer (a worker whose protocol is newer
+      # than this chi's, not resumed); 404 not_found.
       def handle_wake(req, id)
         body = body_hash(req) or return error_response(400, "invalid_json", "invalid JSON body")
         wait = body.fetch("wait", WAKE_MAX_WAIT)
@@ -284,7 +285,9 @@ module Samagotchi
       # rediscovery and its features after a restart, and before its wake
       # whether the worker is leaving (its recap on leave: the wake waits
       # for it, so the client says so). 200 {session_id, live, stopped,
-      # owner: worker|tui|null, leaving, leave_seconds (its leave's budget
+      # owner: worker|tui|null, leaving, stuck (a worker holds the lock with
+      # no Bridge past WorkerLink::START_LIMIT), skew (its protocol is
+      # newer than this chi's), leave_seconds (its leave's budget
       # left, nil unless leaving), worker: {epoch, started_at, version,
       # features}|null, default_model (this machine's config, as the
       # wake's), parent_strategy}; 404 not_found.
@@ -292,7 +295,7 @@ module Samagotchi
         state = session_access.worker(id)
         leaving = state.leaving?
         json_response(200, { session_id: id, live: state.live?, stopped: state.stopped, owner: state.owner&.kind,
-                             leaving: leaving, leave_seconds: (state.owner.leave_left.round(1) if leaving),
+                             leaving: leaving, stuck: state.stuck?, skew: state.skew?, leave_seconds: (state.owner.leave_left.round(1) if leaving),
                              worker: state.sidecar && worker_json(state.sidecar),
                              default_model: ModelProfile.default_model_name,
                              parent_strategy: strategy_json(session_access.parent_strategy(id)) })
@@ -348,23 +351,28 @@ module Samagotchi
 
       # GET /api/sessions/:id/stats: the live worker's metrics for /stats
       # (its stats route; a worker from before it answers only its state's
-      # metrics). 200 {session_id, metrics}; 503 not_live, 504
-      # worker_timeout, 502 bridge_error.
+      # metrics). 200 {session_id, metrics}; 503 not_live, 504 worker_timeout,
+      # 502 bridge_secret or bridge_error.
       def handle_stats(_req, id)
         @session_class.load(id, state_dir: default_state_dir)
-        client = bridge_client(id) or return with_message(not_live(id))
-
-        status, json = client.get("stats")
-        metrics = json["metrics"] if status == 200 && json.is_a?(Hash)
-        if status == 404 && !(json.is_a?(Hash) && json["error"] == "unknown_session")
-          status, json = client.get("state")
-          metrics = json.dig("session_state_snapshot", "metrics") if status == 200 && json.is_a?(Hash)
+        request = lambda do |client|
+          response = client.get_response("stats")
+          if response.status == 404 && response.json&.dig("error") != "unknown_session"
+            response = client.get_response("state")
+          end
+          response
         end
-        return json_response(200, { session_id: id, metrics: metrics }) if status == 200
-        return with_message(worker_timeout("the stats were not read")) if status.nil?
-        return with_message(not_live(id)) if status == 404
-
-        with_message(error_response(502, "bridge_error", "the stats were not read: the session's worker answered #{status}"))
+        with_message(relay(id, bridge_client(id), request, what: "the stats were not read", cant: "read stats") do |reply|
+          next unless reply.status == 200
+
+          json = reply.json
+          metrics = if json.is_a?(Hash) && json["metrics"]
+                      json["metrics"]
+                    else
+                      json&.dig("session_state_snapshot", "metrics")
+                    end
+          json_response(200, { session_id: id, metrics: metrics })
+        end)
       end
 
       # GET /api/sessions/:id/children/counts: the session's delegates'

data/lib/samagotchi/web/session_create.rb

@@ -28,7 +28,7 @@ module Samagotchi
     # (request_toolkit, request_parent_answers, request_llm_context,
     # request_thinking). Included in App: its ROUTES name handle_create, and
     # its helpers (json_response, error_response, parse_json, request_body,
-    # await_bridge_sidecar, session_to_json, record_history, scope_dir, …) and
+    # await_worker_link, session_to_json, record_history, scope_dir, …) and
     # ivars (@manager, @session_class, @state_dir, @hub) answer. See
     # docs/architecture.md (chi web's routes).
     module SessionCreate
@@ -130,7 +130,7 @@ module Samagotchi
         end
         # The worker's Bridge is the single live transport: wait (bounded) for
         # it so the client can attach without client-side polling.
-        port = await_bridge_sidecar(session.id)&.port
+        port = await_worker_link(session.id).then { |link| link.live? ? link.port : nil }
         # The projection holds it before the page hears back (no tick wait).
         @hub&.touch(session.id)
         record_history(body, prompt) if !idle && PromptHistory.shell_line?(prompt.to_s.strip)
@@ -172,7 +172,7 @@ module Samagotchi
                                               model: model.empty? ? nil : model)
         return error if error
 
-        port = await_bridge_sidecar(session.id)&.port
+        port = await_worker_link(session.id).then { |link| link.live? ? link.port : nil }
         moved = session.moved_children || []
         # The moved delegates' cards fold under the new link now.
         [session.continues, session.id, *moved].each { |sid| @hub&.touch(sid) }
@@ -228,7 +228,7 @@ module Samagotchi
         rescue ArgumentError => e
           return error_response(404, "not_found", e.message)
         end
-        port = await_bridge_sidecar(session.id)&.port
+        port = await_worker_link(session.id).then { |link| link.live? ? link.port : nil }
         @hub&.touch(session.id)
         json_response(201, session_to_json(session).merge(bridge_port: port, model_warning: session.model_warning))
       end

data/lib/samagotchi/web/session_hub.rb

@@ -7,7 +7,7 @@ require "time"
 require_relative "../session"
 require_relative "../session_manager"
 require_relative "../bridge_client"
-require_relative "../worker_sidecar"
+require_relative "../worker_link"
 require_relative "../log"
 require_relative "../installed_versions"
 require_relative "../version"
@@ -353,11 +353,13 @@ module Samagotchi
       def live_stamp(owner, dir)
         return nil unless owner
 
-        { pid: owner.pid, kind: owner.kind, bridge_started_at: bridge_started_at(dir) }
+        { pid: owner.pid, kind: owner.kind, bridge_started_at: bridge_started_at(dir, owner) }
       end
 
-      def bridge_started_at(dir)
-        WorkerSidecar.read(dir)&.started_at
+      # The Live worker's start (the owner already read is the one the link answers by).
+      def bridge_started_at(dir, owner)
+        link = WorkerLink.resolve(dir, unlink: false, owner: owner)
+        link.live? ? link.started_at : nil
       end
 
       def emit(type, data)

data/lib/samagotchi/web/session_summary.rb

@@ -7,7 +7,7 @@ require_relative "../session_metrics"
 require_relative "../llm_context_strategy"
 require_relative "../host_registry"
 require_relative "../bridge_client"
-require_relative "../worker_sidecar"
+require_relative "../worker_link"
 require_relative "../bridge/pending_card"
 
 module Samagotchi
@@ -37,8 +37,9 @@ module Samagotchi
       def build(session, owner:, session_dir:, status: displayed_status(session, owner: owner), root_cache: nil,
                 registry: nil)
         used = Array(session.used_memory_names)
-        up = bridge_up?(session_dir, owner)
-        sidecar = up ? WorkerSidecar.read(session_dir) : nil
+        link = WorkerLink.resolve(session_dir, unlink: false, owner: owner)
+        up = link.live?
+        sidecar = up ? link.sidecar : nil
         saved = SessionMetrics.saved_summary(session_dir, budget_tokens: budget_resolver(session, registry))
         recap_card = RecapStore.card(session_dir)
         {
@@ -93,8 +94,9 @@ module Samagotchi
           # Hidden from the strip and the list unless "include archived".
           archived: ArchiveStore.archived?(session_dir),
           project_root: session.project_root(cache: root_cache),
-          # A worker is reachable: its Bridge sidecar is there and the
-          # owner lock is held. A sidecar a dead worker left is not up.
+          # A worker is reachable: WorkerLink answers Live (the lock held by
+          # a worker whose sidecar names its pid). A sidecar a dead worker
+          # left is not up.
           bridge_up: up,
           # The chi the live worker runs and what it can do (its sidecar;
           # nil and [] without one): the page's stale-worker badge.
@@ -103,7 +105,7 @@ module Samagotchi
           # For the tab's notifications (notify.js): an open question, the
           # running turn's open card with actions, and how the last turn
           # ended. A question saved by a worker that died is not open, nor a
-          # chi REPL's (SessionManager.worker_live?'s rule: only a worker shares it).
+          # chi REPL's (only a worker shares it).
           pending_question: session.waiting_question(live: !!owner&.worker?),
           pending_card: up ? Bridge::PendingCard.read(session_dir) : nil,
           last_turn: session.last_turn&.to_file
@@ -129,16 +131,6 @@ module Samagotchi
         owner ? session.status : Session::STATUS_IDLE
       end
 
-      # @return [Boolean] the sidecar file is there and the session has a
-      #   live owner (the file alone says nothing: the worker may be gone).
-      #   The owner lock, not WorkerSidecar.live's port probe: a list builds
-      #   this for every session, and the lock costs no connect.
-      def bridge_up?(session_dir, owner)
-        !owner.nil? && File.file?(WorkerSidecar.path(session_dir))
-      rescue StandardError
-        false
-      end
-
       def first_preview_for(session)
         raw = session.first_preview || session.last_prompt || ""
         norm = raw.to_s.gsub(/\s+/, " ").strip

data/lib/samagotchi/worker.rb

@@ -720,7 +720,7 @@ module Samagotchi
     # ends the sender's wait on it (chi send --wait, chi web's /wait).
     # @param origin [TurnOrigin] a participant's
     def refuse_participant_turn(origin, reason)
-      TurnCheckpoint.record_refused(@session_dir, origin.enqueued_id, reason: reason)
+      TurnCheckpoint.record_refused(@session_dir, origin.enqueued_id, reason: reason, author: origin.participant_author)
       Participants.log(@session_id, :turn, state_dir: @state_dir, participant: origin.participant_id,
                                            enqueued_id: origin.enqueued_id, status: "refused", reason: reason)
       @engine.announce(type: :turn_dequeued, enqueued_id: origin.enqueued_id, client_id: origin.client_id)