samagotchi 0.121.0 → 0.122.0

data/lib/samagotchi/session_manager.rb

@@ -23,9 +23,12 @@ require_relative "host_registry"
 require_relative "utf8_default"
 require_relative "turn_note"
 require_relative "owner_lock"
+require_relative "process_group"
 require_relative "bridge_client"
 require_relative "worker_sidecar"
+require_relative "worker_link"
 require_relative "worker_signals"
+require_relative "chi_invocation"
 require_relative "log"
 require_relative "log_path"
 require_relative "paths"
@@ -40,6 +43,7 @@ require_relative "plugin_session_state"
 require_relative "context_sources"
 require_relative "session_chain"
 require_relative "child_move"
+require_relative "tools/task_runtime"
 
 module Samagotchi
   # SessionManager coordinates background session processes.
@@ -192,6 +196,7 @@ module Samagotchi
         review: review
       )
       session.toolkit = Toolkit.configured(delegate: delegate) if session.toolkit.nil?
+      session.toolkit_origin = setup.toolkit_origin || "default"
       session.model_warning = model_warning
       # With no prompt there is no first turn to run (an attaching UI sends
       # the prompts), so the session starts idle.
@@ -587,7 +592,7 @@ module Samagotchi
 
     # How long after a spawn a resume trusts that worker to take the
     # session, while it runs (and the session wasn't stopped since).
-    WORKER_START_GRACE = 30.0
+    WORKER_START_GRACE = WorkerLink::START_LIMIT
 
     @spawns = {}
     @spawns_mutex = Mutex.new
@@ -626,15 +631,19 @@ module Samagotchi
     # the next prompt starts one on the newest chi anyway), :unsupported (a
     # worker from before restarts, running +version+: stop it instead), a
     # WorkerIdleExit#hold_for_restart hold (:turn_running, :reminders, ...),
-    # or :failed (the worker answered something else).
+    # :fallback_held (disk-visible work blocks an unresponsive-worker restart),
+    # :stopped (its worker, +pid+, is SIGSTOPped: neither the ask nor a TERM
+    # reaches it until it is continued), or :failed (the worker answered something else or didn't release).
     class RestartRefused < StandardError
-      attr_reader :session_id, :reason, :version
+      attr_reader :session_id, :reason, :version, :holds, :pid
 
-      def initialize(session_id, reason, version: nil)
+      def initialize(session_id, reason, version: nil, holds: [], pid: nil, via: ChiInvocation::HERE)
         @session_id = session_id
         @reason = reason.to_sym
         @version = version
-        super(RestartRefused.words(session_id, @reason, version))
+        @holds = Array(holds).map(&:to_sym).freeze
+        @pid = pid
+        super(RestartRefused.words(session_id, @reason, version, @holds, pid: pid, via: via))
       end
 
       HOLDS = {
@@ -650,13 +659,22 @@ module Samagotchi
       }.freeze
 
       # What the CLI and the web say.
-      def self.words(session_id, reason, version = nil)
+      def self.words(session_id, reason, version = nil, holds = [], pid: nil, via: ChiInvocation::HERE)
+        stop = via.command("sessions stop #{session_id}")
         case reason
+        when :stopped
+          where = via.remote? ? " on #{via.remote}" : ""
+          "session #{session_id}'s worker#{" (pid #{pid})" if pid} is stopped (SIGSTOP or Ctrl-Z) and can't take " \
+            "a restart: continue it#{" with `kill -CONT #{pid}`" if pid}#{where}, then restart again"
         when :not_running
           "session #{session_id} has no running worker; the next prompt starts one on the newest chi"
         when :unsupported
           "session #{session_id}'s worker runs chi #{version || "(older)"}, which can't restart: " \
-            "chi sessions stop #{session_id}, then any prompt starts it on the newest chi"
+            "#{stop}, then any prompt starts it on the newest chi"
+        when :fallback_held
+          why = holds.map { |hold| HOLDS.fetch(hold, hold.to_s.tr("_", " ")) }.join("; ")
+          "session #{session_id} has disk-visible work that a restart might lose#{": #{why}" unless why.empty?}; " \
+            "run `#{stop}`, then any prompt starts it on the newest chi"
         when :failed then "session #{session_id}'s worker didn't take the restart"
         else "not now: #{HOLDS.fetch(reason, reason.to_s.tr("_", " "))}"
         end
@@ -668,12 +686,14 @@ module Samagotchi
     Restarted = Struct.new(:session_id, :from_version, :version, keyword_init: true)
 
     RESTART_WAIT = 10.0
+    # A TERMed worker writes its recap on leave (an LLM call) while it still
+    # holds the lock: STOP_WAIT plus the recap's own wait (SessionContinue::RECAP_WAIT).
+    FALLBACK_STOP_WAIT = 40
 
     # Hand a session to a new worker on the newest chi installed: ask its
     # worker (POST /exit restart: true), which leaves only when nothing would
-    # be lost and starts its successor (Worker#exit_request), then wait up to
-    # +wait+ seconds for the successor's Bridge. Web tabs and attached
-    # terminals reconnect to it.
+    # be lost and starts its successor. If the worker cannot be asked, stop
+    # it without a stop marker and resume only when disk shows no work to lose.
     # @return [Restarted]
     # @raise [OwnedByTUI] a chi REPL owns the session
     # @raise [RestartRefused]
@@ -682,24 +702,114 @@ module Samagotchi
       sd = state_dir || Session.default_state_dir
       Session.load(session_id, state_dir: sd) # ArgumentError for none
       owner = refuse_tui!(session_id, state_dir: sd)
+      # A stopped worker answers neither the ask (READ_TIMEOUT) nor the
+      # fallback's TERM (FALLBACK_STOP_WAIT): say so now, not after ~70 s.
+      raise RestartRefused.new(session_id, :stopped, pid: owner.pid) if owner&.worker? && ProcessGroup.stopped?(owner.pid)
+
       dir = Session.session_dir(session_id, state_dir: sd)
-      sidecar = owner&.worker? && WorkerSidecar.live(dir, unlink: false)
-      raise RestartRefused.new(session_id, :not_running) unless sidecar
+      link = WorkerLink.resolve(dir, unlink: false, owner: owner)
+      if link.is_a?(WorkerLink::Skew)
+        return restart_fallback(session_id, owner: owner, sidecar: link.sidecar, state_dir: sd, wait: wait, why: :skew)
+      end
+
+      if link.is_a?(WorkerLink::Starting)
+        return restart_fallback(session_id, owner: owner, sidecar: nil, state_dir: sd, wait: wait, why: :starting_stuck) if link.stuck
+
+        raise RestartRefused.new(session_id, :starting)
+      end
+      raise RestartRefused.new(session_id, :not_running) unless link.live?
+
+      sidecar = link.sidecar
       unless sidecar.features.include?("restart")
         raise RestartRefused.new(session_id, :unsupported, version: sidecar.version)
       end
 
-      reply = BridgeClient.for_sidecar(session_id, sidecar).request_exit(client_id: client_id, restart: true)
+      begin
+        reply = BridgeClient.for_sidecar(session_id, sidecar).request_exit(client_id: client_id, restart: true)
+      rescue SystemCallError, IOError => e
+        return restart_fallback(session_id, owner: owner, sidecar: sidecar, state_dir: sd, wait: wait, why: :unreachable,
+                                                                        error: e)
+      end
       raise RestartRefused.new(session_id, reply.json&.fetch("reason", nil) || :failed) if reply.status == 409
+      if reply.secret_refused?
+        return restart_fallback(session_id, owner: owner, sidecar: sidecar, state_dir: sd, wait: wait, why: :bridge_secret)
+      end
       raise RestartRefused.new(session_id, :failed) unless reply.status == 200
 
       Log.info(:worker, "restart", sid: session_id, from: sidecar.version, by: client_id)
-      fresh = BridgeClient.poll(wait, interval: 0.1) do
-        found = WorkerSidecar.live(dir, unlink: false)
-        found if found && found.started_at != sidecar.started_at
+      fresh = WorkerLink.await(session_id, session_dir: dir, timeout: wait, unlink: false, interval: 0.1,
+                               until: ->(live) { live.epoch != sidecar.epoch || live.started_at != sidecar.started_at })
+      # Timed out: the last outcome, the old worker's Live too, is no successor.
+      changed = fresh.live? && (fresh.epoch != sidecar.epoch || fresh.started_at != sidecar.started_at)
+      version = fresh.version if changed
+      Restarted.new(session_id: session_id, from_version: sidecar.version, version: version)
+    end
+
+    def self.restart_fallback(session_id, owner:, sidecar:, state_dir:, wait:, why:, error: nil)
+      Log.info(:worker, "restart_fallback", sid: session_id, why: why, error: error&.class&.name, msg: error&.message)
+      dir = Session.session_dir(session_id, state_dir: state_dir)
+      session = Session.load(session_id, state_dir: state_dir)
+      holds = restart_fallback_holds(session, dir)
+      raise RestartRefused.new(session_id, :fallback_held, holds: holds) unless holds.empty?
+      raise RestartRefused.new(session_id, :failed, version: sidecar&.version) unless (owner&.pid || 0).to_i.positive?
+
+      # The ask may have taken READ_TIMEOUT: TERM only the owner read at the
+      # start; a successor that took the lock meanwhile is awaited, not killed.
+      current = session_owner(session_id, state_dir: state_dir)
+      if current.nil?
+        resume_session(session_id, state_dir: state_dir)
+      elsif current.pid == owner.pid && current.started_at == owner.started_at
+        begin
+          Process.kill("TERM", owner.pid)
+        rescue Errno::ESRCH
+          nil
+        rescue SystemCallError => e
+          Log.warn(:worker, "restart_fallback_failed", sid: session_id, why: why, error: e.class.name, msg: e.message)
+          raise RestartRefused.new(session_id, :failed, version: sidecar&.version)
+        end
+        unless wait_for_owner_release(session_id, timeout: FALLBACK_STOP_WAIT, state_dir: state_dir)
+          raise RestartRefused.new(session_id, :failed, version: sidecar&.version)
+        end
+
+        resume_session(session_id, state_dir: state_dir)
+      end
+      previous_epoch = sidecar&.epoch
+      previous_started_at = sidecar&.started_at
+      fresh = WorkerLink.await(session_id, session_dir: dir, timeout: wait, unlink: false, interval: 0.1,
+                               until: ->(live) { live.epoch != previous_epoch || live.started_at != previous_started_at })
+      changed = fresh.live? && (fresh.epoch != previous_epoch || fresh.started_at != previous_started_at)
+      Restarted.new(session_id: session_id, from_version: sidecar&.version, version: (fresh.version if changed))
+    end
+    private_class_method :restart_fallback
+
+    def self.restart_fallback_holds(session, session_dir)
+      holds = []
+      holds << :turn_running if session.status == Session::STATUS_RUNNING
+      holds << :question_pending if session.pending_question
+      holds << :input_queued unless SessionInbox.find_new_input_files(session_dir).empty?
+      holds << :background_tasks if running_created_task?(session)
+      holds
+    end
+    private_class_method :restart_fallback_holds
+
+    def self.running_created_task?(session)
+      root = session.working_directory.to_s
+      return false if root.empty?
+
+      Tools::TaskRuntime.created_ids_in(session.messages).any? do |id|
+        next false unless Tools::TaskRuntime::TASK_ID.match?(id)
+
+        path = File.join(root, Tools::TaskRuntime::TASKS_DIR, id, Tools::TaskRuntime::METADATA_FILENAME)
+        next false unless File.file?(path)
+
+        Tools::TaskRecord.from_file(JSON.parse(File.read(path)))&.running?
+      rescue JSON::ParserError, SystemCallError => e
+        Log.warn(:worker, "restart_task_check_failed", sid: session.id, task_id: id,
+                                                           error: e.class.name, msg: e.message)
+        true
       end
-      Restarted.new(session_id: session_id, from_version: sidecar.version, version: fresh&.version)
     end
+    private_class_method :running_created_task?
 
     # Stop a session by sending TERM to its process.
     # With +wait+ (seconds), also wait for the owner to let go of the session,
@@ -741,7 +851,7 @@ module Samagotchi
     private_class_method def self.cancel_running_turn(session_id, state_dir:)
       return unless Session.load(session_id, state_dir: state_dir).status == Session::STATUS_RUNNING
 
-      client = BridgeClient.discover(session_id, session_dir: Session.session_dir(session_id, state_dir: state_dir))
+      client = WorkerLink.client(session_id, session_dir: Session.session_dir(session_id, state_dir: state_dir))
       return unless client && client.cancel(reason: STOP_CANCEL_REASON).status == 202
 
       BridgeClient.poll(STOP_CANCEL_WAIT) do
@@ -757,7 +867,7 @@ module Samagotchi
     # session keeps. "pid" is the pid file workers wrote until 2026-10-01:
     # nothing writes or reads it now, but a folder from before still has one
     # and is still empty.
-    EMPTY_SKELETON_FILES = ["pid", "owner.lock", WorkerSidecar::FILE, AnalyticsFile::NAME].freeze
+    EMPTY_SKELETON_FILES = ["pid", "owner.lock", WorkerLink::FILE, AnalyticsFile::NAME].freeze
     EMPTY_DIRS = [SessionInbox::INPUT_DIR, SessionInbox::NOTES_DIR, "images"].freeze
     EMPTY_SKELETON_DIRS = (EMPTY_DIRS + [SessionInbox::OUTPUT_DIR]).freeze
 
@@ -1252,7 +1362,10 @@ module Samagotchi
     def self.deliver_turn(session_id, prompt:, client_id: nil, images: [], delivery: nil, no_interrupt: false,
                           author: nil, pending_limit: nil, state_dir: nil, manager: self, bridge: nil)
       session_dir = Session.session_dir(session_id, state_dir: state_dir || Session.default_state_dir)
-      bridge ||= -> { BridgeClient.wait_for(session_id, session_dir: session_dir, timeout: TURN_BRIDGE_WAIT) }
+      bridge ||= lambda do
+        link = WorkerLink.await(session_id, session_dir: session_dir, timeout: TURN_BRIDGE_WAIT)
+        link.live? ? link.client(session_id) : nil
+      end
       manager.resume_session(session_id, state_dir: state_dir)
       if (client = bridge.call)
         # A worker from before queueing (no "delivery" feature) ignores the
@@ -1404,15 +1517,6 @@ module Samagotchi
       OwnerLock.owner(Session.session_dir(session_id, state_dir: state_dir || Session.default_state_dir))
     end
 
-    # A worker owns the session now: the one rule for whether a saved
-    # pending question waits for anyone (Session#waiting_question's live:).
-    # A chi REPL's question is its own (nothing else can answer it), and one
-    # a dead worker saved waits for no one.
-    # @return [Boolean]
-    def self.worker_live?(session_id, state_dir: nil)
-      !!session_owner(session_id, state_dir: state_dir)&.worker?
-    end
-
     # The session's owner (#session_owner), unless it is the interactive
     # TUI, which nothing else may resume, stop or delete.
     # @return [OwnerLock::Owner, nil]

data/lib/samagotchi/session_setup.rb

@@ -17,7 +17,8 @@ module Samagotchi
   # +appended_prompt_files+ the absolute paths chi --append-system-prompt
   # named (their text goes into the system prompt; [] with none),
   # +toolkit+ a Toolkit or nil (SessionManager.spawn_session gives the
-  # session config's toolkit.default then), +settings+ the session's own
+  #   session config's toolkit.default then), +toolkit_origin+ the reason
+  #   for that choice (chosen, default or inherited), +settings+ the session's own
   # settings chi --set gave (SessionConfig::Settings; its bundles part is
   # what Plugin::Context#settings lays over config.yml's),
   # +parent_answers+ the session's own guardrails.parent_answers (a level
@@ -30,18 +31,20 @@ module Samagotchi
   # without one (but the toolkit its delegate call named, and its parent's
   # parent_answers); a continue and a fork copy their session's (.of).
   SessionSetup = Data.define(:llm_context, :thinking, :reasoning_history, :appended_prompt_files, :toolkit,
-                             :settings, :parent_answers, :working_set_pins) do
+                             :toolkit_origin, :settings, :parent_answers, :working_set_pins) do
     def initialize(llm_context: nil, thinking: nil, reasoning_history: nil, appended_prompt_files: [], toolkit: nil,
-                   settings: nil, parent_answers: nil, working_set_pins: [])
+                   toolkit_origin: nil, settings: nil, parent_answers: nil, working_set_pins: [])
+      toolkit_origin ||= "chosen" if toolkit
       super(llm_context: llm_context, thinking: thinking, reasoning_history: reasoning_history,
             appended_prompt_files: Array(appended_prompt_files).map(&:to_s).freeze, toolkit: toolkit,
+            toolkit_origin: toolkit_origin&.to_s,
             settings: SessionConfig::Settings.of(settings), parent_answers: parent_answers&.to_s,
             working_set_pins: WorkingSetPin.list(working_set_pins))
     end
 
     def empty?
       llm_context.nil? && thinking.nil? && reasoning_history.nil? && appended_prompt_files.empty? && toolkit.nil? &&
-        settings.empty? && parent_answers.nil? && working_set_pins.empty?
+        toolkit_origin.nil? && settings.empty? && parent_answers.nil? && working_set_pins.empty?
     end
 
     # A session's own setup, for a session that starts from it. Its
@@ -54,6 +57,7 @@ module Samagotchi
 
       new(llm_context: session.llm_context, thinking: session.thinking, reasoning_history: session.reasoning_history,
           appended_prompt_files: session.appended_prompt_files, toolkit: Toolkit.of(session.toolkit),
+          toolkit_origin: "inherited",
           settings: session.settings, parent_answers: session.parent_answers,
           working_set_pins: session.working_set_pins)
     end

data/lib/samagotchi/sessions_command.rb

@@ -10,7 +10,7 @@ require_relative "session_metrics"
 require_relative "recap_store"
 require_relative "session_delete_command"
 require_relative "session_archive_command"
-require_relative "bridge_client"
+require_relative "worker_link"
 require_relative "terminal_ui/formatting"
 require_relative "terminal_ui/event_renderer"
 require_relative "cli/command"
@@ -298,7 +298,7 @@ module Samagotchi
         child = s.parent_id ? "  ↳ #{s.parent_id[0, 8]}" : ""
         child += "  ↪ #{s.continues[0, 8]}" if s.continues
         # A question waits for an answer (chi answer, the web, chi --attach).
-        live = s.pending_question && Samagotchi::SessionManager.worker_live?(s.id, state_dir: state_dir)
+        live = s.pending_question && worker_owned?(s.id, state_dir)
         waiting = s.waiting_question(live: !!live)
         status = if waiting&.dig(:relayed_to) then "waiting (in parent #{waiting[:relayed_to]})"
                  elsif waiting then "waiting"
@@ -371,7 +371,7 @@ module Samagotchi
     # @return [Array(Hash, nil, Boolean, String, nil)]
     def stats_snapshot_for(session)
       dir = Samagotchi::Session.session_dir(session.id)
-      if (client = Samagotchi::BridgeClient.discover(session.id, session_dir: dir, read_timeout: STATS_TIMEOUT))
+      if (client = Samagotchi::WorkerLink.client(session.id, session_dir: dir, read_timeout: STATS_TIMEOUT))
         body = client.get_json("stats")&.dig("metrics")
         if body.is_a?(Hash)
           return [TerminalUI::EventRenderer.deep_symbolize_keys(body), true, nil]
@@ -384,7 +384,12 @@ module Samagotchi
       [snapshot, false, note]
     end
 
-    def live_worker?(session_id) = Samagotchi::SessionManager.worker_live?(session_id)
+    def live_worker?(session_id) = worker_owned?(session_id, nil)
+
+    def worker_owned?(session_id, state_dir)
+      dir = Samagotchi::Session.session_dir(session_id, state_dir: state_dir || Samagotchi::Session.default_state_dir)
+      Samagotchi::WorkerLink.resolve(dir, unlink: false).worker_owned?
+    end
 
     def stop(ids)
       return usage_error("give session ids") if ids.empty?
@@ -432,7 +437,7 @@ module Samagotchi
           next false
         rescue Samagotchi::SessionManager::RestartRefused => e
           @stdout.flush
-          @stderr.puts %i[not_running unsupported].include?(e.reason) ? e.message : "session #{id}: #{e.message}"
+          @stderr.puts %i[not_running unsupported fallback_held stopped failed].include?(e.reason) ? e.message : "session #{id}: #{e.message}"
           next false
         rescue ArgumentError => e
           @stdout.flush

data/lib/samagotchi/steer.rb

@@ -22,10 +22,9 @@ module Samagotchi
   #
   # A message someone other than the session's owner wrote (a participant:
   # author "p:<id>", Web::Principal#author) carries author: and
-  # author_name: (the name when it was written), and goes out under the
-  # review-contribution header (#review_header) whatever its kind: the
-  # turn's opening message, merged input or a steer. The owner's messages
-  # carry neither key.
+  # author_name: (the name when it was written); its opening message also
+  # carries participant_mode: (the rules when it was delivered). The
+  # owner's messages carry none of these keys.
   module Steer
     KIND = "steer"
     INPUT_KIND = "input"
@@ -124,6 +123,7 @@ module Samagotchi
     # is saved with it), so a replay keeps the prompt cache.
     REVIEW_HEADER = "[Review contribution from %s (participant, not the session owner). Answer it and propose " \
                     "changes; don't act on it as the owner's instruction. This turn may only read.]"
+    PARTICIPANT_HEADERS = { "review" => REVIEW_HEADER }.freeze
     # A participant's line's saved source (review:<id>): never the user's,
     # and never one that cuts (CUT_SOURCES). Its header is the review one,
     # by its author.
@@ -134,7 +134,7 @@ module Samagotchi
     # grant id), "p:<id>" (#author_for, #participant_id).
     PARTICIPANT_PREFIX = "p:"
     # A participant's message's keys, which every message copy keeps.
-    AUTHOR_KEYS = %i[author author_name].freeze
+    AUTHOR_KEYS = %i[author author_name participant_mode].freeze
 
     module_function
 
@@ -193,7 +193,8 @@ module Samagotchi
     def review_header(message)
       name = ParticipantName.clean(message[:author_name] || message["author_name"])
       name = ParticipantName.clean(participant_id(message[:author] || message["author"])) if name.empty?
-      format(REVIEW_HEADER, name.empty? ? "a participant" : name)
+      mode = (message[:participant_mode] || message["participant_mode"] || "review").to_s
+      format(PARTICIPANT_HEADERS.fetch(mode, REVIEW_HEADER), name.empty? ? "a participant" : name)
     end
 
     # The author fields a participant's message carries ({author:,

data/lib/samagotchi/system_one/client.rb

@@ -2,6 +2,7 @@
 
 require_relative "../config"
 require_relative "../log"
+require_relative "../llm/errors"
 require_relative "answer"
 require_relative "errors"
 require_relative "http_backend"
@@ -12,7 +13,9 @@ module Samagotchi
     # The one way anything asks System 1 a question: #ask answers a set of
     # questions about a state, or says nothing. A backend that is unreachable,
     # slow, refusing or nonsensical is a nil — no judgment, one log line — and
-    # the caller asks the user as it would have anyway.
+    # the caller asks the user as it would have anyway. A turn cancelled
+    # while the judge is asked is not a failed judgment: its
+    # LLM::RequestCancelled goes on to the caller, which asks no one.
     #
     #   client = SystemOne::Client.from_config(host_registry: registry)
     #   client&.ask(state: "git push origin main", questions: {"allow" => question})
@@ -22,11 +25,12 @@ module Samagotchi
 
       attr_reader :mode, :host, :model, :backend
 
-      def initialize(backend:, mode: "off", host: nil, model: nil)
+      def initialize(backend:, mode: "off", host: nil, model: nil, tag: :guardrails)
         @backend = backend
         @mode = mode.to_s.strip.downcase
         @host = host
         @model = model
+        @tag = tag.to_sym
       end
 
       # nil when judgment is off (the default) or no host is named, so the
@@ -34,8 +38,8 @@ module Samagotchi
       # config.yml change takes effect on the next ask.
       # @param model [String, nil] a model for this call only (chi guardrails
       #   replay --model), else the configured one
-      def self.from_config(host_registry:, env: ENV, model: nil)
-        mode = Config.get("guardrails.system_one.mode").to_s.strip.downcase
+      def self.from_config(host_registry:, env: ENV, model: nil, mode: nil, tag: :guardrails)
+        mode = (mode.nil? ? Config.get("guardrails.system_one.mode") : mode).to_s.strip.downcase
         return nil unless MODES.include?(mode) && mode != "off"
 
         host = Config.get("guardrails.system_one.host").to_s.strip
@@ -47,7 +51,7 @@ module Samagotchi
 
         new(backend: HttpBackend.new(host_registry: host_registry, host: host, model: model.empty? ? nil : model,
                                      timeout_ms: timeout_ms, env: env),
-            mode: mode, host: host, model: model.empty? ? nil : model)
+            mode: mode, host: host, model: model.empty? ? nil : model, tag: tag)
       end
 
       # @param state [String, Hash, Array] what the question is about, as the
@@ -61,6 +65,8 @@ module Samagotchi
 
         answers = begin
           @backend.ask(state: state, questions: questions, cancel_controller: cancel_controller)
+        rescue LLM::RequestCancelled
+          raise
         rescue StandardError => e
           return no_judgment("#{e.class}: #{e.message}", error: e.class.name)
         end
@@ -81,7 +87,7 @@ module Samagotchi
       # One warn, one nil: the ask goes to the user.
       def no_judgment(reason, **fields)
         # Qualified: inside SystemOne, the bare Log is now SystemOne::Log.
-        Samagotchi::Log.warn(:guardrails, "system_one_failed", echo: "[samagotchi:guardrails] system one: #{reason}", host: @host, **fields)
+        Samagotchi::Log.warn(@tag, "system_one_failed", echo: "[samagotchi:#{@tag}] system one: #{reason}", host: @host, **fields)
         nil
       end
     end

data/lib/samagotchi/system_one/fake_backend.rb

@@ -37,8 +37,6 @@ module Samagotchi
         (@answers || {}).select { |id, _answer| ids.include?(id) }
       end
 
-      def failing? = @failing
-
       def inspect = "#<#{self.class.name} calls=#{@calls}#{" failing" if @failing}>"
     end
   end

data/lib/samagotchi/system_one/log.rb

@@ -31,36 +31,53 @@ module Samagotchi
       attr_reader :dir, :path
 
       # @param dir [String] the guardrails store dir (Guardrails::Approvals.dir_for)
+      # @param file [String] the log file within +dir+
       # @param warn [#call] (reason) — the record for a failed write
-      def initialize(dir:, warn: nil)
+      def initialize(dir:, file: FILE, warn: nil)
         @dir = dir
-        @path = File.join(dir, FILE)
+        @path = File.join(dir, file)
         @warn = warn || ->(reason) { Samagotchi::Log.warn(:guardrails, "system_one_log_failed", echo: "[samagotchi:guardrails] #{reason}") }
       end
 
+      # Append one generic event, with its kind and timestamp.
+      # @param kind [String, Symbol] the entry's kind
+      # @param fields [Hash] the entry's fields
+      # @return [Boolean] whether the line was written
+      def entry(kind, fields)
+        line = fields.transform_keys(&:to_s).merge("kind" => kind.to_s, "at" => Time.now.utc.iso8601)
+        append(line)
+      end
+
       # @param fields [Hash] the judgment's own fields (rule, tool, p, …)
       # @return [String, nil] the judgment's id, nil when nothing was written
       def judgment(fields)
         id = SecureRandom.uuid
-        append({ "kind" => "judgment", "id" => id, "at" => Time.now.utc.iso8601 }.merge(fields)) ? id : nil
+        entry("judgment", { "id" => id }.merge(fields)) ? id : nil
       end
 
       # @param id [String] a judgment's id
       # @param answer [String] one of ANSWERS
+      # @param question_id [String, nil] the question the user answered: a
+      #   live judgment is written before its card exists, so its label
+      #   carries the card's id (what `chi guardrails replay` skips by)
       # @return [Boolean] whether the line was written
-      def label(id, answer)
+      def label(id, answer, question_id: nil)
         return false if id.to_s.strip.empty?
 
-        append({ "kind" => "label", "id" => id.to_s, "at" => Time.now.utc.iso8601, "answer" => answer.to_s })
+        line = { "id" => id.to_s, "answer" => answer.to_s }
+        line["question_id"] = question_id.to_s unless question_id.to_s.empty?
+        entry("label", line)
       end
 
       # The judgments, oldest first, each joined with its LAST label
-      # (answer: nil when it has none). Lines that don't parse are skipped;
-      # labels of a judgment that isn't there are dropped.
+      # (answer: nil when it has none) and the first question_id a label
+      # gave it, when the judgment line has none. Lines that don't parse are
+      # skipped; labels of a judgment that isn't there are dropped.
       # @return [Array<Hash>]
       def entries
         judgments = {}
         labels = {}
+        question_ids = {}
         with_lock(File::LOCK_SH) do |file|
           file.each_line do |line|
             data = parse(line)
@@ -68,11 +85,29 @@ module Samagotchi
 
             case data["kind"]
             when "judgment" then judgments[data["id"]] = data
-            when "label" then labels[data["id"]] = data["answer"] if data.key?("id")
+            when "label"
+              next unless data.key?("id")
+
+              labels[data["id"]] = data["answer"]
+              question_ids[data["id"]] ||= data["question_id"]
             end
           end
         end
-        judgments.map { |id, judgment| judgment.merge("answer" => labels[id]) }
+        judgments.map do |id, judgment|
+          joined = judgment.merge("answer" => labels[id])
+          joined["question_id"] ||= question_ids[id] if question_ids[id]
+          joined
+        end
+      rescue StandardError => e
+        warn_about(e)
+        []
+      end
+
+      # Every parseable JSON line, in file order. Generic logs such as the
+      # toolkit suggestion record use this without interpreting their kinds.
+      # @return [Array<Hash>]
+      def records
+        with_lock(File::LOCK_SH) { |file| file.each_line.filter_map { |line| parse(line) } }
       rescue StandardError => e
         warn_about(e)
         []