samagotchi 0.124.0 → 0.126.0

data/lib/samagotchi/children_status.rb

@@ -86,11 +86,16 @@ module Samagotchi
                 state: state_of(session, row, reply), waiting: row[:waiting], live: !!row[:live],
                 delegate: session.delegate?, cwd: session.working_directory, branch: GitHead.branch(session.working_directory),
                 last_reply: reply && first_line(session.id, reply, state_dir: state_dir),
-                last_reply_at: reply && reply_time(reply), reported: !reply.nil? && cursor.reply_file == reply,
+                last_reply_at: reply && reply_time(reply), reported: !reply.nil? && reported?(session, cursor, reply),
                 updated_at: session.updated_at, archived: !!row[:archived])
     end
     private_class_method :child
 
+    # A reply the parent was given; a Verify fresh child's always counts
+    # (its verdict goes to the parent's card, never a report).
+    def reported?(session, cursor, reply) = !session.verify_fresh.nil? || cursor.reply_file == reply
+    private_class_method :reported?
+
     def state_of(session, row, reply)
       return "waiting" if row[:waiting]
       return "running" if Tools::Delegate.running?(row)

data/lib/samagotchi/engine.rb

@@ -15,6 +15,8 @@ require_relative "steer"
 require_relative "turn_note"
 require_relative "turn_endings"
 require_relative "turn_origin"
+require_relative "verify_anchor"
+require_relative "verdict"
 require_relative "model_profile"
 require_relative "effective_model"
 require_relative "session_setting"
@@ -901,10 +903,12 @@ module Samagotchi
 
     # Event types #announce accepts: facts about the session's input queue,
     # a failed turn's prompt handed back and the continue offer, which live
-    # UIs need in the event log, emitted outside any turn's stream.
+    # UIs need in the event log, emitted outside any turn's stream; a
+    # Verify fresh child's verdict landing on its card (:verdict_recorded).
     ANNOUNCEABLE_EVENTS = %i[turn_enqueued turn_dequeued input_merged prompt_restored continue_offered continue_resolved
                              command_queued command_ran context_added card hook_notice guardrail_warning
-                             plugin_init_started plugin_init_finished working_set_updated participants_changed].freeze
+                             plugin_init_started plugin_init_finished working_set_updated participants_changed
+                             verdict_recorded].freeze
 
     # Put a transport-level event into the ordered event log. Unlike turn
     # events it reaches only persistent observers (no turn sink, no memory
@@ -1589,7 +1593,10 @@ module Samagotchi
       seconds = turn.elapsed
       synchronize_events do
         kept, event = yield(seconds)
+        stamp_verify_anchor(kept, turn)
         replace_session_messages(turn.session, kept) if kept
+        verdict = record_verdict(turn, outcome)
+        event[:verdict] = verdict if verdict
         emit_working_set(turn.on_event, turn.session, turn.session.messages)
         turn.session.status = Session::STATUS_IDLE
         record_last_turn(turn.session, outcome, seconds, turn.origin, event, limit: exhausted ? turn.limit : nil)
@@ -1602,6 +1609,31 @@ module Samagotchi
     end
     private :end_turn
 
+    def stamp_verify_anchor(messages, turn)
+      return unless turn.verify && messages.is_a?(Array)
+
+      opening = messages.reverse.find do |message|
+        (message[:role] || message["role"]).to_s == "user" &&
+          (message[:turn_id] || message["turn_id"]).to_s == turn.id
+      end
+      opening[:verify] = turn.verify.to_h if opening
+    end
+    private :stamp_verify_anchor
+
+    def record_verdict(turn, outcome)
+      return unless outcome == "completed" && turn.verify
+
+      answer = AnswerTail.find(turn.session.messages, turn_id: turn.id)
+      parsed = Verdict.parse(answer && (answer[:content] || answer["content"]))
+      return unless parsed
+
+      record = { anchor: turn.verify.to_h, verdict: parsed.verdict, reason: parsed.reason,
+                 by: turn.origin.author, check_turn_id: turn.id, at: Time.now.iso8601(3) }
+      turn.session.verdicts = turn.session.verdicts + [record]
+      record
+    end
+    private :record_verdict
+
     def save_quietly(session)
       session.save(state_dir: session_state_dir)
     rescue StandardError => e
@@ -2011,7 +2043,7 @@ module Samagotchi
     # +wall+: the wall time it started (MessageTime.now, once): the
     # :turn_started event's at and its user message's (and reminders') stamp.
     Turn = Struct.new(:session, :prompt, :continue, :on_event, :controller, :origin, :started_at, :messages, :ended,
-                      :settings, :id, :limit, :resumed, :resume_from, :wall) do
+                      :settings, :id, :limit, :resumed, :resume_from, :wall, :verify) do
       def resumed? = resumed ? true : false
 
       # The turn's boundary events carry the origin only when it names a
@@ -2083,9 +2115,9 @@ module Samagotchi
     # re-raises; a provider error adds error_kind:, retryable:, host: and a
     # one-line summary:.
     def run_turn(session, prompt, on_event: nil, max_iterations: nil, cancel_controller: nil, max_tool_output_chars: nil, pending_input: nil, continue: false,
-                 origin: TurnOrigin::NONE, images: [], id: nil, resumed: false, resume_from: nil)
+                 origin: TurnOrigin::NONE, images: [], id: nil, resumed: false, resume_from: nil, verify: nil)
       turn = begin_turn(session, prompt, on_event: on_event, cancel_controller: cancel_controller, origin: origin,
-                                         continue: continue, id: id)
+                                         continue: continue, id: id, verify: verify)
       if continue
         turn.resumed = resumed
         turn.resume_from = resume_from
@@ -2133,8 +2165,11 @@ module Samagotchi
     # The turn's state before anything can fail it: the session running,
     # the turn flag, its cancel controller and sink. The cross-thread state
     # is set here and cleared in #release_turn only.
-    def begin_turn(session, prompt, on_event:, cancel_controller:, origin:, continue:, id: nil)
+    def begin_turn(session, prompt, on_event:, cancel_controller:, origin:, continue:, id: nil, verify: nil)
       origin = TurnOrigin.of(origin)
+      # A participant's Verify fresh child: every turn is theirs (their
+      # author, boundary and cap), whoever started it.
+      origin = session.verify_fresh.origin_for(origin) if session.respond_to?(:verify_fresh) && session.verify_fresh
       # Track the active session for recap and status snapshot.
       @session = session
       # status is turn state: running now, idle again before the turn's end
@@ -2157,7 +2192,7 @@ module Samagotchi
 
       Turn.new(session: session, prompt: continue ? nil : prompt, continue: continue, on_event: on_event,
                controller: effective_controller, origin: origin, started_at: Process.clock_gettime(Process::CLOCK_MONOTONIC),
-               id: id || SecureRandom.uuid, wall: MessageTime.now)
+               id: id || SecureRandom.uuid, wall: MessageTime.now, verify: VerifyAnchor.from(verify))
     end
     private :begin_turn
 
@@ -2360,6 +2395,7 @@ module Samagotchi
       unless turn.continue
         user_message = { role: "user", content: turn.prompt, turn_id: turn.id, **author_fields(turn.origin.author),
                          **participant_mode_fields(turn.origin.author), MessageTime::KEY => turn.at }
+        user_message[:verify] = turn.verify.to_h if turn.verify
         user_message[:images] = image_refs unless image_refs.empty?
         turn.messages << user_message
         session.last_prompt = turn.prompt

data/lib/samagotchi/guardrail_wiring.rb

@@ -109,9 +109,18 @@ module Samagotchi
       @git = Guardrails::GitInfo.new
       author = turn_author
       @turn_entry = author && @participant.call(author)
-      @turn_mode = author && ParticipantMode.for_turn(@session_lookup.call, @turn_entry)
+      @turn_mode = author && participant_turn_mode(@session_lookup.call, @turn_entry)
     end
 
+    # A participant's turn's mode: in a Verify fresh child the one saved
+    # on it at spawn (VerifyFreshOrigin#turn_mode: :review unless saved
+    # :pair), never looked up again; elsewhere ParticipantMode.for_turn.
+    def participant_turn_mode(session, entry)
+      fresh = session.respond_to?(:verify_fresh) && session.verify_fresh
+      fresh ? fresh.turn_mode : ParticipantMode.for_turn(session, entry)
+    end
+    private :participant_turn_mode
+
     # The running participant turn's mode (ParticipantMode.for_turn: :pair
     # only in a working session for a participant invited to act), decided
     # at its start; nil for the owner's turns. The boundary in #checks, the

data/lib/samagotchi/llm/chat_loop.rb

@@ -447,6 +447,7 @@ module Samagotchi
           message[:images] = entry[:images] if entry[:images].is_a?(Array) && !entry[:images].empty?
           message[:turn_id] = entry[:turn_id] if entry[:turn_id]
           message[:turn_start] = true if entry[:turn_start] == true
+          message[:verify] = entry[:verify] if entry[:verify].is_a?(Hash)
           message[:thinking] = entry[:thinking] if entry[:thinking].is_a?(String) && !entry[:thinking].empty?
           message[:anthropic_content] = entry[:anthropic_content] if entry[:anthropic_content].is_a?(Array)
           ToolResponse::SAVED_KEYS.each { |key| message[key] = entry[key] if entry[key] }

data/lib/samagotchi/process_group.rb

@@ -119,7 +119,7 @@ module Samagotchi
     # How long #stop waits for +stopped+ after the KILL by default.
     KILL_WAIT_SEC = 1.0
 
-    # TERMs the group, waits up to +grace+ for +stopped+, then KILLs it and
+    # TERMs (and CONTs) the group, waits up to +grace+ for +stopped+, then KILLs it and
     # waits up to +kill_wait+ for +stopped+ again (a KILL is delivered, not
     # done, when kill returns).
     #
@@ -146,6 +146,15 @@ module Samagotchi
       extra = walk ? descendant_groups(pgid) : []
       signal(pgid, "TERM", **signal_options)
       extra.each { |group| signal(group, "TERM") }
+      # A stopped process (SIGSTOP, Ctrl-Z) holds the TERM pending, its
+      # handler unrun, until it is continued: CONT it after the TERM, so it
+      # resumes with the TERM already waiting (a CONT first would let it run
+      # unsignalled, to be stopped again) and stops within the grace, not by
+      # the KILL. A running process ignores the CONT. Always quiet: a group
+      # the TERM already ended may be zombies only by now, which macOS
+      # refuses a signal with EPERM.
+      signal(pgid, "CONT", **signal_options, quiet: QUIET)
+      extra.each { |group| signal(group, "CONT") }
       # +stopped+ is asked until it says true once (it may reap: a second
       # wait on a reaped pid raises ECHILD), then only the extra groups.
       done = false

data/lib/samagotchi/reminder_carry.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "time"
+require_relative "atomic_file"
+require_relative "log"
+
+module Samagotchi
+  # A restart's hand-off of the session's reminders, which otherwise live only
+  # in the worker's Engine: the leaving worker writes `<id>/reminders.json`
+  # (Worker#leave_on_request, as it takes a restart) and its successor takes
+  # it as it starts (Worker#start): read and deleted before its Engine is
+  # built, restored into the Engine's store after. Only an asked
+  # restart writes one: a stop, an idle exit, a crash and a fallback restart
+  # (a TERM) drop the reminders as before, and a stop or an archive removes a
+  # file left behind (SessionManager.stop_session, .archive_session); a
+  # restart a stop landed on starts no successor (.run_session_loop). A file is honoured only by the same
+  # session, within WINDOW of its writing (a successor starts in seconds), so
+  # one no successor read can't bring reminders back a day later.
+  module ReminderCarry
+    FILE = "reminders.json"
+    # Seconds a hand-off stays good after it was written.
+    WINDOW = 120
+
+    module_function
+
+    def path(session_dir) = File.join(session_dir, FILE)
+
+    # Write +store+'s reminders for the successor; no reminders, no file.
+    # @return [Integer] how many were written
+    # @raise [SystemCallError] when the write fails (the caller stays up)
+    def write(session_dir, session_id:, store:, wall: Time.now)
+      entries = store.export(wall: wall)
+      if entries.empty?
+        remove(session_dir)
+        return 0
+      end
+
+      body = { "session_id" => session_id, "written_at" => wall.getutc.iso8601(3), "reminders" => entries }
+      AtomicFile.write(path(session_dir), "#{JSON.generate(body)}\n", perm: 0o600)
+      entries.size
+    end
+
+    # Read the hand-off and delete it. A file of another session, outside
+    # WINDOW or unreadable, or one found as a stopped session starts, is
+    # deleted unused (log reminders_carry_dropped; at warn unless stopped).
+    # @return [Array<Hash>, nil] the entries for ReminderStore#restore, nil
+    #   when there is none to restore
+    def take(session_dir, session_id:, stopped: false, wall: Time.now)
+      file = path(session_dir)
+      return nil unless File.exist?(file)
+
+      data = read(file)
+      remove(session_dir)
+      why = drop_reason(data, session_id, stopped, wall)
+      return data["reminders"] unless why
+
+      if why == :stopped
+        Log.info(:worker, "reminders_carry_dropped", why: why)
+      else
+        Log.warn(:worker, "reminders_carry_dropped", why: why)
+      end
+      nil
+    end
+
+    # @return [true]
+    def remove(session_dir)
+      FileUtils.rm_f(path(session_dir))
+      true
+    end
+
+    def read(file)
+      data = JSON.parse(File.read(file))
+      data.is_a?(Hash) ? data : nil
+    rescue JSON::ParserError, SystemCallError
+      nil
+    end
+
+    def drop_reason(data, session_id, stopped, wall)
+      return :unreadable unless data
+      return :stopped if stopped
+      return :other_session unless data["session_id"] == session_id
+
+      written = Time.iso8601(data["written_at"].to_s)
+      :stale if (wall - written).abs > WINDOW
+    rescue ArgumentError
+      :stale
+    end
+    private_class_method :read, :drop_reason
+  end
+end

data/lib/samagotchi/reminder_store.rb

@@ -2,6 +2,7 @@
 
 require "monitor"
 require "securerandom"
+require "time"
 
 module Samagotchi
   # Thread-safe store for periodic reminders registered by the agent.
@@ -122,10 +123,58 @@ module Samagotchi
       end
     end
 
+    # The reminders as a restart hands them to the next worker (ReminderCarry):
+    # each one's id, name, description and interval, and its next fire as
+    # wall-clock ISO time, since the monotonic clock doesn't cross processes.
+    # @return [Array<Hash{String => Object}>]
+    def export(wall: Time.now, mono: Process.clock_gettime(Process::CLOCK_MONOTONIC))
+      @mutex.synchronize do
+        @reminders.each_value.map do |r|
+          { "id" => r[:id], "name" => r[:name], "description" => r[:description],
+            "interval_minutes" => r[:interval_minutes],
+            "next_fire_at" => (wall + (r[:next_fire_at] - mono)).utc.iso8601(3) }
+        end
+      end
+    end
+
+    # Take back what #export wrote in another process. A reminder keeps its
+    # id and schedule: one overdue is due now (once, no catch-up), one further
+    # ahead than its interval (a clock that jumped) is due one interval from
+    # now. An entry #register would refuse, or with no time, is skipped.
+    # @param entries [Array<Hash>] #export's, parsed from JSON
+    # @return [Array<String>] the names restored
+    def restore(entries, wall: Time.now, mono: Process.clock_gettime(Process::CLOCK_MONOTONIC))
+      return [] unless entries.is_a?(Array)
+
+      restored = entries.filter_map { |entry| restored_entry(entry, wall, mono) }
+      @mutex.synchronize { restored.each { |r| @reminders[r[:name]] = r } }
+      restored.map { |r| r[:name] }
+    end
+
     # Clear all reminders.
     # Called when the session ends or the engine is reset.
     def clear_all
       @mutex.synchronize { @reminders.clear }
     end
+
+    private
+
+    def restored_entry(entry, wall, mono)
+      return nil unless entry.is_a?(Hash)
+
+      name = entry["name"].to_s.strip
+      description = entry["description"].to_s.strip
+      interval = Integer(entry["interval_minutes"], exception: false)
+      return nil if name.empty? || description.empty? || interval.nil? || !(1..1440).cover?(interval)
+
+      next_wall = Time.iso8601(entry["next_fire_at"].to_s)
+      period = interval * 60
+      next_fire = mono + (next_wall - wall).clamp(0, period)
+      id = entry["id"].is_a?(String) && !entry["id"].empty? ? entry["id"] : SecureRandom.hex(6)
+      { id: id, name: name, description: description, interval_minutes: interval,
+        last_fire_at: next_fire - period, next_fire_at: next_fire }
+    rescue ArgumentError
+      nil
+    end
   end
 end

data/lib/samagotchi/session.rb

@@ -20,6 +20,10 @@ require_relative "project_scope"
 require_relative "guardrails/parent_levels"
 
 module Samagotchi
+  # Loaded on first use (a Verify fresh child): keeps the bundle test kit's
+  # load budget (spec/samagotchi/testing/sandbox_spec.rb).
+  autoload :VerifyFreshOrigin, File.expand_path("verify_fresh_origin", __dir__)
+
   # archive_store requires this file.
   autoload :ArchiveStore, File.expand_path("archive_store", __dir__)
 
@@ -134,6 +138,14 @@ module Samagotchi
       @last_turn = LastTurn.from_file(value)
     end
 
+    # Verdict cards recorded by completed Verify turns, in append order.
+    # A missing field stays missing until the first verdict is recorded.
+    def verdicts = @verdicts || []
+
+    def verdicts=(values)
+      @verdicts = values.nil? ? nil : Array(values)
+    end
+
     # The mark of a turn a worker checkpointed and never finished
     # (InterruptedTurn), as loaded; the next worker settles it and sets it
     # to nil. While a turn runs, #turn_checkpoint's marker is saved instead.
@@ -280,6 +292,20 @@ module Samagotchi
     # Whether this is a review session (chi review, the web's Start review).
     def review? = !@review.nil?
 
+    # A Verify fresh child's requester, rules and claim (VerifyFreshOrigin),
+    # nil for any other session. Set once, at spawn (VerifyFresh.start).
+    attr_reader :verify_fresh
+
+    # @param value [VerifyFreshOrigin, Hash, nil] the session file's form too
+    def verify_fresh=(value)
+      @verify_fresh = value.nil? ? nil : VerifyFreshOrigin.of(value)
+    end
+
+    # The session whose participants.json names this session's
+    # participants: a Verify fresh child's parent (its requester's grant is
+    # the parent's), else the session itself.
+    def participants_source_id = @verify_fresh && @parent_id ? @parent_id : @id
+
     # How many tool outputs its history holds: its tool messages
     # (tool_response, a chat loop's tool; a native step's one message holds
     # every call's output and counts once).
@@ -333,7 +359,7 @@ module Samagotchi
                    last_turn: nil, model_typed: nil, delegate: false, llm_context: nil, prompt_notes: [],
                    continues: nil, thinking: nil, reasoning_history: nil, appended_prompt_files: [],
                    toolkit: nil, toolkit_origin: "chosen", settings: nil, interrupted_turn: nil, parent_answers: nil, title: nil,
-                   working_set_pins: [], review: nil)
+                   working_set_pins: [], review: nil, verdicts: nil, verify_fresh: nil)
       @id = id
       @metadata_version = metadata_version
       @mode = mode
@@ -370,6 +396,8 @@ module Samagotchi
       self.parent_answers = parent_answers
       self.working_set_pins = working_set_pins
       self.review = review
+      self.verdicts = verdicts
+      self.verify_fresh = verify_fresh
       self.interrupted_turn = interrupted_turn
       @turn_checkpoint = nil
       @archived = false
@@ -539,6 +567,7 @@ module Samagotchi
       "parent_id" => nil,
       "scratch" => false,
       "last_turn" => nil,
+      "verdicts" => nil,
       "delegate" => false,
       "llm_context" => nil,
       "continues" => nil,
@@ -553,12 +582,13 @@ module Samagotchi
       "parent_answers" => nil,
       "working_set_pins" => [],
       "review" => nil,
-      "first_turn_id" => nil
+      "first_turn_id" => nil,
+      "verify_fresh" => nil
     }.freeze
 
     # FIELDS a session file has only when set: a session without them saves
     # as it did before they existed.
-    OPTIONAL_FIELDS = %w[review first_turn_id].freeze
+    OPTIONAL_FIELDS = %w[review first_turn_id verdicts verify_fresh].freeze
 
     # A session from a parsed session file. +messages+ false leaves the
     # conversation out (the lists' lightweight summaries).
@@ -712,6 +742,13 @@ module Samagotchi
                 when "last_turn" then @last_turn&.to_file
                 when "working_set_pins" then @working_set_pins.map(&:to_file)
                 when "review" then @review&.to_file
+                when "verify_fresh" then @verify_fresh&.to_file
+                when "verdicts"
+                  @verdicts&.map do |record|
+                    scrub_utf8(record.to_h do |key, entry|
+                      [key.to_s, entry.is_a?(Hash) ? stringify_message_keys(entry) : entry]
+                    end)
+                  end
                 when "used_memory_names", "preloaded_memory_names", "muted_memory_names", "appended_prompt_files"
                   Array(instance_variable_get(:"@#{key}"))
                 else instance_variable_get(:"@#{key}")

data/lib/samagotchi/session_inbox.rb

@@ -12,6 +12,10 @@ require_relative "steer"
 require_relative "turn_origin"
 
 module Samagotchi
+  # Loaded on first use (a Verify turn's input): keeps the bundle test kit's
+  # load budget (spec/samagotchi/testing/sandbox_spec.rb).
+  autoload :VerifyAnchor, File.expand_path("verify_anchor", __dir__)
+
   # A session directory's file inbox and outbox (see SessionManager for the
   # layout): input/ holds one JSON file per queued turn, notes/ the context
   # notes a worker adds between turns, output/ one text file per reply,
@@ -53,7 +57,7 @@ module Samagotchi
     # @param now [Time] the time the file is named by (a spec's clock)
     # @return [String, false] the input file's path, or false
     def self.write_input(session_dir, prompt:, client_id: nil, enqueued_id: nil, no_interrupt: false, images: [],
-                         delivery: nil, author: nil, now: Time.now)
+                         delivery: nil, author: nil, verify: nil, now: Time.now)
       images = Array(images)
       input_dir = File.join(session_dir, INPUT_DIR)
       FileUtils.mkdir_p(input_dir)
@@ -63,7 +67,7 @@ module Samagotchi
                  "no_interrupt" => (no_interrupt ? true : nil),
                  "delivery" => (Delivery.queue?(delivery) ? Delivery::QUEUE : nil),
                  "images" => (images.empty? ? nil : images.map { |image| image.transform_keys(&:to_s) }),
-                 "author" => author }.compact
+                 "author" => author, "verify" => VerifyAnchor.from(verify)&.to_file }.compact
       AtomicFile.write(path, JSON.generate(record))
       path
     rescue StandardError
@@ -228,9 +232,9 @@ module Samagotchi
     # (+no_interrupt+, --no-interrupt), its +images+ ({file:, name:} refs),
     # and its +delivery+ ("queue" or nil; a file without the key is one an
     # older chi wrote, so nil).
-    Input = Data.define(:prompt, :origin, :no_interrupt, :images, :delivery) do
-      def initialize(prompt:, origin: nil, no_interrupt: false, images: [], delivery: nil)
-        super(prompt:, origin: TurnOrigin.of(origin), no_interrupt:, images:, delivery:)
+    Input = Data.define(:prompt, :origin, :no_interrupt, :images, :delivery, :verify) do
+      def initialize(prompt:, origin: nil, no_interrupt: false, images: [], delivery: nil, verify: nil)
+        super(prompt:, origin: TurnOrigin.of(origin), no_interrupt:, images:, delivery:, verify: verify && VerifyAnchor.from(verify))
       end
     end
     # A file that doesn't parse, or isn't a JSON object: no prompt.
@@ -246,7 +250,7 @@ module Samagotchi
       origin = TurnOrigin.from(data.slice("client_id", "enqueued_id", "author"))
       images = Array(data["images"]).select { |image| image.is_a?(Hash) }.map { |image| image.transform_keys(&:to_sym) }
       Input.new(prompt: data["prompt"].to_s, origin: origin, no_interrupt: data["no_interrupt"] == true,
-                images: images, delivery: Delivery.queue?(data["delivery"]) ? Delivery::QUEUE : nil)
+                images: images, delivery: Delivery.queue?(data["delivery"]) ? Delivery::QUEUE : nil, verify: data["verify"])
     rescue JSON::ParserError
       UNREADABLE_INPUT
     end
@@ -278,9 +282,11 @@ module Samagotchi
       true
     end
 
-    # A parsed input file's #waits_for_turn_end?.
+    # A parsed input file's #waits_for_turn_end?. A Verify turn waits too:
+    # merged into a running turn as a steer, its anchor would be lost.
     def self.turn_end_data?(data)
-      Array(data["images"]).any? || Delivery.queue?(data["delivery"]) || Steer.participant_author?(data["author"])
+      Array(data["images"]).any? || Delivery.queue?(data["delivery"]) || Steer.participant_author?(data["author"]) ||
+        data["verify"].is_a?(Hash)
     end
 
     # How the unclaimed input file carrying +enqueued_id+ waits: :turn_end

data/lib/samagotchi/session_manager.rb

@@ -36,6 +36,7 @@ require_relative "model_profile"
 require_relative "installed_gem"
 require_relative "installed_versions"
 require_relative "recap_store"
+require_relative "reminder_carry"
 require_relative "archive_store"
 require_relative "continue_offer"
 require_relative "image_store"
@@ -163,6 +164,8 @@ module Samagotchi
     #   turn sees it
     # @param review [SessionReview, nil] a review session's (ReviewStart; a
     #   continue keeps its previous link's)
+    # @param verify_fresh [VerifyFreshOrigin, nil] a Verify fresh child's
+    #   requester, rules and claim (VerifyFresh.start)
     # @param before_spawn [#call, nil] (session) runs once the session and
     #   its note are saved, before its worker spawns
     # @return [Session] with #seed_images_dropped: refs whose file was gone,
@@ -170,7 +173,7 @@ module Samagotchi
     def self.spawn_session(prompt:, mode: "assist", working_directory: nil, model_name: nil, state_dir: nil,
                            memories: [], muted_memories: [], parent_id: nil, messages: [], images_from: nil,
                            preview: nil, title: nil, delegate: false, setup: SessionSetup.new, continues: nil, note: nil,
-                           note_source: "chi", before_spawn: nil, review: nil)
+                           note_source: "chi", before_spawn: nil, review: nil, verify_fresh: nil)
       sd = state_dir || Session.default_state_dir
       # The resolved ref is stored (a resumed session keeps its model when an
       # alias is retargeted), with the name as typed beside it. A wrong host
@@ -197,6 +200,8 @@ module Samagotchi
       )
       session.toolkit = Toolkit.configured(delegate: delegate) if session.toolkit.nil?
       session.toolkit_origin = setup.toolkit_origin || "default"
+      # Saved before the worker starts: its first turn is already the requester's.
+      session.verify_fresh = verify_fresh
       session.model_warning = model_warning
       # With no prompt there is no first turn to run (an attaching UI sends
       # the prompts), so the session starts idle.
@@ -402,6 +407,9 @@ module Samagotchi
       stopped = tree.select { |sid| owners[sid] }
       stopped.each { |sid| stop_session(sid, state_dir: sd, wait: wait) }
       archived, discarded = tree.partition { |sid| ArchiveStore.archive(sid, state_dir: sd) }
+      # A restart's reminders hand-off no successor took (the stop above
+      # removes a live one's): archived sessions keep no reminders.
+      archived.each { |sid| ReminderCarry.remove(Session.session_dir(sid, state_dir: sd)) }
       # D8: an archive ends the review (unarchiving doesn't restore it).
       Participants.end_sessions(archived, by: "archive", state_dir: sd)
       { id: id, archived: archived, stopped: stopped, discarded: discarded }
@@ -663,7 +671,8 @@ module Samagotchi
         input_queued: "a prompt is queued",
         continue_offered: "the step-limit question waits for an answer",
         question_pending: "a question or approval waits for an answer",
-        reminders: "it has reminders, which a restart would drop",
+        # Only a worker from before ReminderCarry still holds a restart for its reminders.
+        reminders: "it has reminders, which its worker's older chi can't carry over a restart",
         command_running: "a /btw (or another command) is still running",
         relays_open: "a delegate's approval relayed here is open or just answered",
         background_tasks: "background tasks it started are still running"
@@ -822,7 +831,7 @@ module Samagotchi
     end
     private_class_method :running_created_task?
 
-    # Stop a session by sending TERM to its process.
+    # Stop a session by sending TERM (then CONT, for a stopped one) to its process.
     # With +wait+ (seconds), also wait for the owner to let go of the session,
     # so a resume right after spawns a fresh worker instead of finding the
     # dying one.
@@ -838,15 +847,29 @@ module Samagotchi
       cancel_running_turn(session_id, state_dir: sd)
       # Mark first: a worker that has not taken the lock yet sees it and exits.
       Session.mark_stopped(session_id, state_dir: sd)
+      # A stop drops the reminders: a restart's hand-off no successor took
+      # yet must not bring them back on the next resume.
+      ReminderCarry.remove(Session.session_dir(session_id, state_dir: sd))
       pid = owner&.pid.to_i
       begin
         Process.kill("TERM", pid) if pid && pid > 0
       rescue Errno::ESRCH
         nil # already exited
       end
+      continue_stopped(pid)
       wait_for_owner_release(session_id, timeout: wait, state_dir: sd) if wait
     end
 
+    # A stopped worker (SIGSTOP, Ctrl-Z) runs its TERM handler only once
+    # continued: CONT it after the TERM (as ProcessGroup.stop does), so it
+    # leaves now rather than outliving the stop's wait. Best effort: one the
+    # TERM ended may be gone already.
+    private_class_method def self.continue_stopped(pid)
+      Process.kill("CONT", pid) if pid && pid > 0
+    rescue Errno::ESRCH, Errno::EPERM
+      nil
+    end
+
     STOP_CANCEL_WAIT = 3.0
     # How long a stop from the CLI (chi sessions stop, delete, a continue's
     # orphan) waits for the worker to let go of the session, here or
@@ -1137,8 +1160,13 @@ module Samagotchi
       # A restart starts its successor here, on the newest chi installed
       # (worker_command), once this one's lock is free.
       # Delegate reports that rang while it left wake one too.
-      if result == :restart ||
-         (%i[idle_exit exit_requested].include?(result) &&
+      if result == :restart && Session.stopped_marker?(session_id, state_dir: sd)
+        # A stop landed as it left: no successor (resume_session would clear
+        # the stop), and the reminders go with it.
+        ReminderCarry.remove(session_dir)
+        Log.info(:worker, "restart_dropped", why: :stopped)
+      elsif result == :restart ||
+            (%i[idle_exit exit_requested].include?(result) &&
           (!SessionInbox.find_new_input_files(session_dir).empty? || worker.wake_due?))
         resume_session(session_id, state_dir: sd)
       elsif worker.discard?
@@ -1286,10 +1314,10 @@ module Samagotchi
     #   session's images/
     # @return [String, false] the input file's path, or false.
     def self.write_turn_input(session_id, prompt:, client_id: nil, enqueued_id: nil, no_interrupt: false, state_dir: nil,
-                              images: [], delivery: nil, author: nil)
+                              images: [], delivery: nil, author: nil, verify: nil)
       session_dir = Session.session_dir(session_id, state_dir: state_dir || Session.default_state_dir)
       SessionInbox.write_input(session_dir, prompt: prompt, client_id: client_id, enqueued_id: enqueued_id,
-                                            no_interrupt: no_interrupt, images: images, delivery: delivery, author: author)
+                                            no_interrupt: no_interrupt, images: images, delivery: delivery, author: author, verify: verify)
     end
 
     # How long a turn waits for the Bridge of a worker a resume just spawned.
@@ -1371,7 +1399,8 @@ module Samagotchi
     # @raise [OwnedByTUI] a chi REPL owns the session
     # @raise [ArgumentError] no such session
     def self.deliver_turn(session_id, prompt:, client_id: nil, images: [], delivery: nil, no_interrupt: false,
-                          author: nil, pending_limit: nil, state_dir: nil, manager: self, bridge: nil)
+                          author: nil, pending_limit: nil, verify: nil, state_dir: nil, manager: self, bridge: nil)
+      verify = VerifyAnchor.from(verify)
       session_dir = Session.session_dir(session_id, state_dir: state_dir || Session.default_state_dir)
       bridge ||= lambda do
         link = WorkerLink.await(session_id, session_dir: session_dir, timeout: TURN_BRIDGE_WAIT)
@@ -1393,6 +1422,7 @@ module Samagotchi
           options[:no_interrupt] = true if no_interrupt
           options[:author] = author if author
           options[:pending_limit] = pending_limit if author && pending_limit
+          options[:verify] = verify if verify
           reply = client.post_turn(**options)
           ack = reply.json
           return DeliverResult.new(status: :accepted, via: :bridge, ack: ack) if reply.status == 202 && ack.is_a?(Hash)
@@ -1430,6 +1460,7 @@ module Samagotchi
       input[:delivery] = delivery unless Delivery.next_step?(delivery)
       input[:no_interrupt] = true if no_interrupt
       input[:author] = author if author
+      input[:verify] = verify if verify
       path = participant_queue_lock(session_dir, author && pending_limit) do
         # No worker: the participant's waiting files are all their turns,
         # counted and written under one lock (the Bridge counts under its).