samagotchi 0.127.0 → 0.128.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d35df5e2cd9639c1da812c221e1c256567df7e2f9986df32c6cbc49cc9d6d431
-  data.tar.gz: 7e98badd5615015b9841a9885404c130ff46fddefd05dc70bafd051ae37f92ef
+  metadata.gz: 9b175cb8468dd1b6dccbb74c3c372b0796aa18126b47034d07d11d6ead1e1e22
+  data.tar.gz: e6b6ea98bf78a7a43962a70ab6daf3cd35519c7db1cefdae44ad8021d4274b75
 SHA512:
-  metadata.gz: 3f5eaf2d9dca71dd6951989506b64c67ce905396c3af824521aa6fcc8e974d7a4f7ca6843f307f9915b5b5986b3ab87e2707ca76a771e985fa095a99acf9cedf
-  data.tar.gz: 65b7f35bcd7372d6c51a438c3808937266b035e8e67ac6c48511734d00f78ac12b9de3536359c67ad8797a4dc542e16a04649ece8d0dc7e8e729e6b7f60dd0a2
+  metadata.gz: adcfe4e020e6829703e1b9e1d2836d53bb3ddc336da1001c598853352eef75a3ca3df25b7e4d07d292bdaf8b413be228e57487a8b570365e2fba4cecd98490f0
+  data.tar.gz: d4b57b741cd271740cb0826e0ff50845a5213c1de30b28c9477ba1b126e5448511f5b73861a3380ae2a93e4102e41df9d4093b14a193a61dcbdd7ed6894a11cd

data/CHANGELOG.md

@@ -7,6 +7,29 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.128.0] - 2026-10-28
+
+### Changed
+
+- Verify needs a worker that knows Verify turns: on an older worker chi web disables Verify and Verify fresh with
+  "restart this session to use Verify", and refuses anchored turns and fresh checks sent to it.
+- `sqlite3 -readonly -safe …` (only with both flags and read/display options) and `gh`'s reading subcommands
+  (`run`/`pr`/`issue` list and view, `pr diff`/`checks`, `repo view`; never `--web`, `api` or `--watch`) count as
+  read-only shell commands, so they no longer ask.
+- The shared composer card footer has less vertical padding on phones.
+
+### Fixed
+
+- A Verify turn records a verdict only when its quote is in the reply of the turn it points at; otherwise it runs
+  as a plain turn.
+- A verdict's View check opens the earlier session that holds the check (after a continue), or says the check is
+  no longer on the page, instead of doing nothing.
+- An attached piped prompt that this terminal removed before it ran says so on stderr (still exit 1) instead of
+  "the model gave an empty answer".
+- A participant's key hint wraps to a second line in a narrow comment box instead of being cut after one.
+
+Update with `chi update`.
+
 ## [0.127.0] - 2026-10-28
 
 ### Added
@@ -4787,7 +4810,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.127.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.128.0...HEAD
+[0.128.0]: https://github.com/dm1try/samagotchi/compare/v0.127.0...v0.128.0
 [0.127.0]: https://github.com/dm1try/samagotchi/compare/v0.126.0...v0.127.0
 [0.126.0]: https://github.com/dm1try/samagotchi/compare/v0.125.0...v0.126.0
 [0.125.0]: https://github.com/dm1try/samagotchi/compare/v0.124.0...v0.125.0

data/docs/architecture.md

@@ -173,6 +173,9 @@ agent logic and can be used without any terminal rendering; the UI is a thin lay
   but `RelineSeam` (prepended to `Reline::LineEditor`) sends its drawing to the
   `Screen`. The saved history and cards in a join or resync are rendered by
   `TerminalUI::JoinReplay` with the loop's screen, view, link, gap clock and renderer.
+  With input from a pipe (`chi -p X </dev/null`), `TerminalUI::OwnTurns` keeps this
+  run's own prompts until their turns end; `#run` distinguishes an empty answer from a
+  prompt this terminal removed before it ran (both exit 1), as well as chi's other outcomes.
   Without a capable terminal it falls back to `PlainSurface` (append-only).
 
 #### Using the core

data/docs/guardrails.md

@@ -557,6 +557,11 @@ every command in it (split at `;`, `&&`, `||`, `|`) is `ls`, `cat`, `head`,
 writes or runs something (`sed -i`, `sed 's/a/b/w f'`, `find -delete`/`-exec`,
 `rg --pre`, `sort -o`, `awk` with `>`/`|`/`system(`, `git -c`, `git diff
 --ext-diff`, …) and no redirection other than to `/dev/null` or another fd.
+`sqlite3` is read-only only with both `-readonly` and `-safe`; options are
+checked even after the database name, and only its read/display options are
+allowed (unknown options and dot-command arguments are rejected). `gh` allows
+only `run list|view`, `pr list|view|diff|checks`, `issue list|view` and
+`repo view`; `--web`/`-w`, `gh api` and `pr checks --watch` are not read-only.
 `$(…)`, backticks, `$VAR` (other than `$HOME`, `$XDG_*`, `$TMPDIR` and `$PWD`
 at a word's start), an env prefix, `sh -c`, `xargs`, `eval`, `sudo` and the
 like make a command not read-only. It errs towards asking.

data/docs/internals/participants.md

@@ -362,7 +362,7 @@ fields: a field added to an event later reaches nobody until it is named there.
   owner's participant view has none. The page draws it as one line in the comment box card's footer
   (`.composer-card-foot`, `usageItems`): "$0.42 of
   $2.00 cap · 1/3 queued · link: 6 d left · model", each with a title in words; warn colours from 80% of the cap, a
-  full queue and a link's last day, "over" at the cap. The key hint is the line above the text field (hidden on a
+  full queue and a link's last day, "over" at the cap. The key hint is the line above the text field, wrapping to at most two (hidden on a
   phone). The usage is cut at the end (the model first); folded, it stays as the card's footer under the grip. It is redrawn at each re-read (a
   turn's end, a queued or taken-back comment), not while a turn streams.
 - **A fork's note.** A review fork (`chi review --from`, `/coordinate review`) starts with a note holding the source's
@@ -420,7 +420,11 @@ fields: a field added to an event later reaches nobody until it is named there.
 - **Verify verdict cards** (`verdict_card.js`). The built-in Verify preset carries the selected source turn id and quote
   with the submitted turn, without changing its prompt text. A Verify turn that fails fast and is rolled back hands
   the claim back with its prompt (`prompt_restored`'s `verify`), so the owner's resend from the composer is a Verify
-  turn again. A completed Verify reply whose final non-empty line has
+  turn again. Before the Engine stamps the anchor or records a verdict, it checks that the source turn exists and
+  its assistant reply contains the quote. Matching is case-sensitive, collapses whitespace, and strips common
+  Markdown presentation (links, headings, list/blockquote prefixes, emphasis and code delimiters) from both sides;
+  this matches the rendered text the page selects without treating different casing as the same claim. A fresh child
+  checks the same anchor against its parent's history. A completed Verify reply whose final non-empty line has
   a valid `Verdict: confirmed|refuted|unclear — <reason>` appends a verdict to the session. Both pages place its card
   after the source turn, name its author, show the reason and quote, and link to the checking turn; a live completion
   adds the card without a reload. The participant view receives only the card fields through its allowlist, with the

data/docs/testing.md

@@ -255,14 +255,15 @@ well formed (unique ids, known keys and labels, a rule that exists in its set).
 ## While you work: affected specs
 
 ```sh
-script/affected-specs                 # the specs for this branch's change, best first, at most 10
+script/affected-specs                 # the specs for this branch's change, best first, at most 16
 bundle exec rspec $(script/affected-specs)
 script/affected-specs --why           # with the reason for each pick; --all: no cap; --run: runs them
 script/affected-specs A..B            # another range (A...B: from their merge-base); a single REV: vs the working tree
 ```
 
 A builder runs these while working, not the full suite: the specs the change touched, the specs named after the
-files it changed (`lib/samagotchi/foo/bar.rb` → `spec/foo/bar_spec.rb`, `bar_*_spec.rb`…), the specs that read
+files it changed (`lib/samagotchi/foo/bar.rb` → `spec/foo/bar_spec.rb`, `bar_*_spec.rb`…;
+`lib/samagotchi/foo/bar/baz.rb` → `spec/foo/bar_baz_spec.rb`), the specs that read
 docs or source as text (its `RULES`: add one when a full run catches what the names missed) and the golden of a changed
 file's layer (any `terminal_ui/*.rb` → `spec/terminal_ui_golden_spec.rb`; `turn_flow.rb` and `turn_note.rb`, whose
 words the REPL prints, pick it by a rule). Changes to `tool_declarations.rb` and `system_prompt.rb` also pick the

data/lib/samagotchi/bridge.rb

@@ -11,6 +11,7 @@ require_relative "atomic_file"
 require_relative "bridge_secret"
 require_relative "delivery"
 require_relative "session_inbox"
+require_relative "verify_anchor"
 
 require_relative "bridge/bounded_queue"
 require_relative "bridge/card_store"
@@ -633,6 +634,7 @@ module Samagotchi
     # turn (Guardrails::PairBoundary); a worker without it runs it as a
     # review turn, and chi web says so (Delivery::PAIR_FEATURE).
     FEATURES = ["restart", "task_stop", "reparent", Delivery::QUEUE_FEATURE, ReplyWait::TURN_IDS_FEATURE,
+                VerifyAnchor::FEATURE,
                 SessionInbox::UNQUEUE_FEATURE, Delivery::REVIEW_FEATURE, Delivery::PAIR_FEATURE].freeze
 
     # The routes, by method and what follows /session/:id/: a handler takes

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,6 +1,6 @@
 ---
 name: samagotchi-system
-version: 0.127.0
+version: 0.128.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:

data/lib/samagotchi/engine.rb

@@ -1620,6 +1620,61 @@ module Samagotchi
     end
     private :stamp_verify_anchor
 
+    def verified_anchor(session, anchor)
+      return unless anchor
+
+      source = verify_anchor_source_session(session, anchor)
+      return unless source
+
+      turn = AnswerTail.turn_slice(Array(source.messages), anchor.turn_id)
+      return reject_verify_anchor(anchor, :turn_missing) unless turn
+
+      reply = turn.reverse.find { |message| AnswerTail.answer?(message) }
+      return reject_verify_anchor(anchor, :reply_missing) unless reply
+
+      quote_text = verify_comparison_text(anchor.quote)
+      answer_text = verify_comparison_text(reply[:content] || reply["content"])
+      return reject_verify_anchor(anchor, :quote_missing) if quote_text.empty? || !answer_text.include?(quote_text)
+
+      anchor
+    end
+    private :verified_anchor
+
+    def verify_anchor_source_session(session, anchor)
+      return session unless session.verify_fresh
+
+      fresh = session.verify_fresh
+      return reject_verify_anchor(anchor, :fresh_anchor_mismatch) unless fresh.anchor == anchor
+      return reject_verify_anchor(anchor, :fresh_parent_missing) unless session.parent_id
+
+      Session.load(session.parent_id, state_dir: session_state_dir)
+    rescue ArgumentError, SystemCallError, IOError => e
+      Log.warn(:turn, "verify_anchor_rejected", turn_id: anchor.turn_id, reason: :source_session_unavailable,
+                                                 error: e.class.name)
+      nil
+    end
+    private :verify_anchor_source_session
+
+    def verify_comparison_text(text)
+      OutputFormatter.strip_markup(text)
+                    .gsub(/!\[([^\]]*)\]\([^)]+\)/, '\1')
+                    .gsub(/\[([^\]]+)\]\([^)]+\)/, '\1')
+                    .gsub(/^[ \t]*(?:\#{1,6}[ \t]+|>[ \t]?|[-+*][ \t]+|\d+[.)][ \t]+)/, "")
+                    .gsub(/(\*\*|__|~~|`+)(.+?)\1/m, '\2')
+                    .gsub(/(?<!\w)\*(\S(?:.*?\S)?)\*(?!\w)/m, '\1')
+                    .gsub(/(?<!\w)_(\S(?:.*?\S)?)_(?!\w)/m, '\1')
+                    .tr("|", " ") # a table row's cells; the page copies them without the pipes
+                    .gsub(/\s+/, " ")
+                    .strip
+    end
+    private :verify_comparison_text
+
+    def reject_verify_anchor(anchor, reason)
+      Log.warn(:turn, "verify_anchor_rejected", turn_id: anchor.turn_id, reason:)
+      nil
+    end
+    private :reject_verify_anchor
+
     def record_verdict(turn, outcome)
       return unless outcome == "completed" && turn.verify
 
@@ -2170,6 +2225,7 @@ module Samagotchi
       # A participant's Verify fresh child: every turn is theirs (their
       # author, boundary and cap), whoever started it.
       origin = session.verify_fresh.origin_for(origin) if session.respond_to?(:verify_fresh) && session.verify_fresh
+      verify = verified_anchor(session, VerifyAnchor.from(verify))
       # Track the active session for recap and status snapshot.
       @session = session
       # status is turn state: running now, idle again before the turn's end

data/lib/samagotchi/guardrails/read_only_shell.rb

@@ -130,6 +130,53 @@ module Samagotchi
       # uniq IN OUT writes OUT.
       def uniq(args) = args.reject { |a| a.start_with?("-") }.size <= 1
 
+      SQLITE_OPTIONS = %w[-readonly -safe -json -csv -header -noheader -line -column -box -list -separator -bail
+                          -batch -noinit].freeze
+
+      # sqlite3 can still write or run programs unless both safety flags are
+      # present. Its options may follow the database name, so check every word.
+      def sqlite3(args)
+        options = []
+        positional = []
+        index = 0
+        while index < args.length
+          arg = args[index]
+          if arg == "-separator"
+            return false if index + 1 == args.length
+
+            index += 2
+          elsif SQLITE_OPTIONS.include?(arg)
+            options << arg
+            index += 1
+          elsif arg.start_with?("-", ".")
+            return false
+          else
+            positional << arg
+            index += 1
+          end
+        end
+
+        options.include?("-readonly") && options.include?("-safe") && positional.size >= 2
+      end
+
+      GH_READS = {
+        "run" => %w[list view],
+        "pr" => %w[list view diff checks],
+        "issue" => %w[list view],
+        "repo" => %w[view]
+      }.freeze
+
+      def gh(args)
+        # -w alone or in a bundle of short flags (-cw) opens a browser.
+        return false if args.any? { |arg| arg.match?(/\A-[a-zA-Z]*w/) || arg.start_with?("--web") }
+
+        group, action = args
+        return false unless GH_READS.fetch(group, []).include?(action)
+        return false if group == "pr" && action == "checks" && args.any? { |arg| arg.start_with?("--watch") }
+
+        true
+      end
+
       SED_FLAGS = /\A-[nErsuz]+\z/
       SED_LONG = %w[--quiet --silent --regexp-extended --separate --unbuffered --null-data --posix --debug
                     --sandbox].freeze
@@ -228,7 +275,7 @@ module Samagotchi
       CHECKS = {
         "rg" => method(:rg), "find" => method(:find), "tree" => method(:tree), "file" => method(:file),
         "sort" => method(:sort), "uniq" => method(:uniq), "sed" => method(:sed), "awk" => method(:awk),
-        "git" => method(:git)
+        "git" => method(:git), "sqlite3" => method(:sqlite3), "gh" => method(:gh)
       }.freeze
 
       # A sed script parsed far enough to tell that it only reads: its

data/lib/samagotchi/session_manager.rb

@@ -1408,6 +1408,7 @@ module Samagotchi
       end
       manager.resume_session(session_id, state_dir: state_dir)
       if (client = bridge.call)
+        return verify_unavailable if verify && !worker_has?(session_dir, VerifyAnchor::FEATURE)
         # A worker from before queueing (no "delivery" feature) ignores the
         # field or refuses it; either way a file would steer the running turn.
         return queue_unavailable if Delivery.queue?(delivery) && !worker_queues?(session_dir)
@@ -1533,6 +1534,10 @@ module Samagotchi
       DeliverResult.new(status: :refused, code: 409, ack: Delivery::REVIEW_UNAVAILABLE)
     end
 
+    private_class_method def self.verify_unavailable
+      DeliverResult.new(status: :refused, code: 409, ack: VerifyAnchor::UNAVAILABLE)
+    end
+
     private_class_method def self.turn_timeout
       DeliverResult.new(status: :timeout, via: :bridge,
                         ack: { "error" => "worker_timeout",

data/lib/samagotchi/terminal_ui/attach_launcher.rb

@@ -71,7 +71,8 @@ module Samagotchi
       #   TUI's streams and requests there (#client_id)
       # @return [Symbol] :detached, :closed when the worker went away,
       #   :failed when the --model switch didn't go through, or (input from a
-      #   pipe) :turn_failed / :empty_answer / :unanswered (AttachedLoop#run)
+      #   pipe) :turn_failed / :empty_answer / :removed / :unanswered
+      #   (AttachedLoop#run)
       def run(attach: nil, shared: false, resume: nil, prompt: nil, model: nil, no_interrupt: false, default_input: true,
               memories: [], muted_memories: [], llm_context: {}, thinking: nil, appended_prompt_files: [], toolkit: nil,
               toolkit_flags: [], settings: nil, parent_answers: nil, state_dir: nil, connector: nil)
@@ -146,11 +147,14 @@ module Samagotchi
         err.flush
       end
 
-      # A turn of ours that ended with no answer (input from a pipe): one
-      # line on stderr, as the in-process `chi -p --non-interactive` says
-      # it, so a script doesn't take the silence for an answer (exit 1).
+      # An own turn with no answer, or a prompt removed before it ran
+      # (input from a pipe): one line on stderr, so a script doesn't take
+      # the silence for an answer (exit 1).
       def report_ended(ended, err: $stderr)
-        err.puts(TerminalUI::EMPTY_ANSWER_ERROR) if ended == :empty_answer
+        case ended
+        when :empty_answer then err.puts(TerminalUI::EMPTY_ANSWER_ERROR)
+        when :removed then err.puts("chi: the prompt was removed before it ran")
+        end
       end
 
       # chi's exit status after #run: 0 detached, 3 a question left waiting

data/lib/samagotchi/terminal_ui/attached_loop/queueing.rb

@@ -7,8 +7,8 @@ module Samagotchi
     class AttachedLoop
       # Queue and unqueue handling for the attached loop.
       # Reads @client, @client_id, @first_command_id, @link, @my_queued,
-      # @open_ids, @reader, @screen, @shown_enqueued, @wait_at_eof; writes
-      # @my_queued, @open_ids, @own_empty, @own_failed, @prefilled, @queued_ids,
+      # @own_turns, @reader, @screen, @shown_enqueued, @wait_at_eof; writes
+      # @my_queued, @prefilled, @queued_ids,
       # @shown_enqueued.
       # Calls the loop helpers #author_of, #first_command_flag, #mark_activity,
       # #own?, #prompt_line, #send_prompt, #via, and #worker_down.
@@ -131,19 +131,13 @@ module Samagotchi
 
         # A queued prompt was taken back before it ran (the web's ×, /unqueue
         # in a terminal). One of this run's (wait_at_eof) will have no turn:
-        # it ends the wait, as a failed one does. Another client's shown
-        # line says so.
+        # it ends the wait as :removed. Another client's shown line says so.
         def turn_dequeued(event)
           id = event[:enqueued_id]
           @my_queued.delete(id)
-          if @open_ids.delete?(id)
-            if own?(event[:client_id])
-              @own_empty = true
-              @screen.commit("(removed before it ran)")
-            else
-              @own_failed = true
-              @screen.commit("(your queued message was removed before it ran)")
-            end
+          by_us = own?(event[:client_id])
+          if @own_turns.dequeued(id, by_us: by_us)
+            @screen.commit(by_us ? "(removed before it ran)" : "(your queued message was removed before it ran)")
           elsif @shown_enqueued.delete?(id)
             @screen.commit("(a queued message was removed)")
           end

data/lib/samagotchi/terminal_ui/attached_loop/sending.rb

@@ -10,19 +10,16 @@ require_relative "../image_input"
 module Samagotchi
   class TerminalUI
     class AttachedLoop
-      # Bridge sending, first-command launch, and this run's turn ledger.
-      # Reads @as_parent, @client, @client_id, @display_pending, @first_command_id,
-      # @first_command_line, @first_commands, @first_prompt, @input_ended, @link,
-      # @merged_ids, @my_queued, @no_interrupt, @open_ids, @own_empty, @own_failed,
-      # @queued_ids, @reader, @running, @screen, @sent_ids, @status, @wait_at_eof;
-      # writes @display_pending, @first_command_id, @first_command_line,
-      # @first_commands, @first_prompt, @merged_ids, @my_queued, @open_ids,
-      # @own_empty, @own_failed, @queued_ids, @sent_ids.
-      # Calls the loop helpers #client_id_for, #command_registry, #default_model_name,
-      # #detach, #mark_activity, #older_worker_command, #origin_of, #own?, #paint,
-      # #persist_recent_history, #prompt_line, #put_back_busy_command, #prefill_confirm,
-      # #queue_needs_newer_worker, #send_command, #send_prompt, #stale_worker,
-      # #steer_cut_note, #too_late?, #via, and #worker_down.
+      # Bridge sending and first-command launch.
+      # Reads @as_parent, @client, @client_id, @first_command_id, @first_command_line,
+      # @first_commands, @first_prompt, @link, @my_queued, @no_interrupt, @own_turns,
+      # @queued_ids, @reader, @running, @screen, @status;
+      # writes @first_command_id, @first_command_line, @first_commands, @first_prompt,
+      # @my_queued, @queued_ids.
+      # Calls the loop helpers #command_registry, #default_model_name, #detach,
+      # #mark_activity, #older_worker_command, #origin_of, #own?, #paint,
+      # #persist_recent_history, #prompt_line, #queue_needs_newer_worker,
+      # #stale_worker, #steer_cut_note, #too_late?, #via, and #worker_down.
       module Sending
         private
 
@@ -33,7 +30,7 @@ module Samagotchi
           if reply.status == 202
             # Input from a pipe ends once its output is in (#command_ran).
             command_id = reply.json&.fetch("command_id", nil)
-            @open_ids << command_id if command_id && @wait_at_eof
+            @own_turns.command_sent(command_id) if command_id
             return
           end
           return @screen.commit(stale_worker("run commands")) if reply.status == 404
@@ -49,7 +46,7 @@ module Samagotchi
         end
 
         def command_ran(event)
-          @open_ids.delete(event[:command_id])
+          @own_turns.command_ran(event[:command_id])
           @queued_ids.delete(event[:command_id])
           unless own?(event[:client_id]) || event[:anytime] || event[:card] || event[:queued]
             @screen.commit(prompt_line(event[:client_id], event[:line]))
@@ -147,8 +144,7 @@ module Samagotchi
           reply = @client.post_turn(**options)
           if reply.status == 202
             enqueued_id = reply.json&.fetch("enqueued_id", nil)
-            @sent_ids << enqueued_id if enqueued_id
-            @open_ids << enqueued_id if enqueued_id && @wait_at_eof
+            @own_turns.sent(enqueued_id) if enqueued_id
             @my_queued << enqueued_id if enqueued_id && reply.json&.fetch("delivery", nil) == Delivery::QUEUE
             note = sent_note(reply.json, delivery: delivery, images: images, running: running, choice: choice)
             @screen.commit(note) if note
@@ -172,21 +168,15 @@ module Samagotchi
         # Whether the input's end must wait: the -p prompt isn't sent yet, a
         # prompt this run sent hasn't had its turn, or its turn's after_turn
         # hooks still run (their notices, source-links' sources:, come next).
-        def own_turns_pending? = !@first_prompt.to_s.strip.empty? || !@open_ids.empty? || @display_pending == true
+        def own_turns_pending? = !@first_prompt.to_s.strip.empty? || @own_turns.pending?
 
         # A turn ended: this run's prompt (and ours merged into it) had its turn.
         def own_turn_ended(event)
-          return unless @wait_at_eof
-
-          id = origin_of(event[:origin]).enqueued_id
-          ours = @open_ids.include?(id) || !@merged_ids.empty?
-          @own_failed = true if ours && event[:type] == :turn_failed
-          @own_empty = true if ours && event[:type] == :turn_completed && event.dig(:turn_summary, :empty_answer)
-          # The worker sends answer_display once its after_turn hooks ran.
-          @display_pending = true if ours && event[:type] == :turn_completed && event[:display_pending]
-          @open_ids.delete(id)
-          @open_ids.subtract(@merged_ids)
-          @merged_ids.clear
+          completed = event[:type] == :turn_completed
+          @own_turns.ended(origin_of(event[:origin]).enqueued_id,
+                           failed: event[:type] == :turn_failed,
+                           empty: completed && event.dig(:turn_summary, :empty_answer),
+                           display_pending: completed && event[:display_pending])
         end
 
         # Ours merged into the running turn: they end with it.
@@ -194,22 +184,20 @@ module Samagotchi
           Array(event[:origins]).each do |value|
             origin = origin_of(value)
             id = origin.enqueued_id
-            @merged_ids << id if own?(origin.client_id) && @open_ids.include?(id)
+            @own_turns.merged(id) if own?(origin.client_id)
           end
           nil
         end
 
         def own_prompt_failed
-          @own_failed = true if @wait_at_eof
+          @own_turns.prompt_failed
           nil
         end
 
         # The input ended and nothing of ours is left to wait for.
         def end_of_input
-          detach("Detached; the session keeps running. Re-attach with: #{via.attach(@client.session_id)}") if @input_ended
-          return :turn_failed if @own_failed
-
-          @own_empty ? :empty_answer : :detached
+          detach("Detached; the session keeps running. Re-attach with: #{via.attach(@client.session_id)}") if @own_turns.input_ended?
+          @own_turns.outcome
         end
 
         # The prompt's `@path` images, stored where the worker reads them

data/lib/samagotchi/terminal_ui/attached_loop.rb

@@ -14,6 +14,7 @@ require_relative "image_input"
 require_relative "line_reader"
 require_relative "question_prompt"
 require_relative "join_replay"
+require_relative "own_turns"
 require_relative "exit_lines"
 require_relative "attached_loop/exit_commands"
 require_relative "attached_loop/questions"
@@ -68,8 +69,7 @@ module Samagotchi
       attr_reader :client_id
 
       # @return [String, nil] the model the worker's turns run on, as the
-      #   last command said
-      # @return [String, nil] the worker's model
+      #   last snapshot or model change said (the status row's)
       def model_name = @status[:model]
 
       # @return [QuestionPrompt, nil] the question waiting for an answer
@@ -152,21 +152,12 @@ module Samagotchi
         @join_replay = JoinReplay.new(screen: @screen, view: @view, link: @link, gaps: @gaps, renderer: @renderer)
         @last_idle_interrupt_at = nil
         @next_input_prefill = nil
-        # Prompts this run sent, by enqueued_id: only those come back into
-        # the input when their turn fails (a replayed event must not).
-        @sent_ids = Set.new
         # This run's prompts queued for after the running turn (their ack
         # said queue), oldest first, until their turn starts or they are
         # removed: /unqueue takes back the newest.
         @my_queued = []
         @wait_at_eof = wait_at_eof
-        # Sent and not ended yet (by enqueued_id), the ones merged into the
-        # running turn, whether the input has ended, and whether one of this
-        # run's prompts failed (wait_at_eof only).
-        @open_ids = Set.new
-        @merged_ids = Set.new
-        @input_ended = false
-        @own_failed = false
+        @own_turns = OwnTurns.new(active: wait_at_eof)
         # A continue offer is pending: the prompt asks for the answer.
         @continue_offer = nil
         # The /exit ask is open: the next line is its answer (#answer_exit_ask).
@@ -188,7 +179,8 @@ module Samagotchi
       #   :failed when the first command (--model) didn't go through, or
       #   (wait_at_eof) :turn_failed when one of this run's prompts failed,
       #   :empty_answer when one ended with no answer, and :unanswered when
-      #   a question came after the input ended
+      #   a question came after the input ended; :removed when this run took
+      #   back its only queued prompt before it ran
       # @param input [#call, nil] prompt -> line (nil = Ctrl-D, raising
       #   Interrupt = Ctrl-C); defaults to Reline
       def run(input: nil)
@@ -225,7 +217,7 @@ module Samagotchi
 
             ended = take_early_lines
             return ended if ended
-            return end_of_input if @input_ended && !own_turns_pending?
+            return end_of_input if @own_turns.input_ended? && !own_turns_pending?
           when :line
             # A pipe is read at once: its lines wait for the joining
             # snapshot, which may bring the question they answer.
@@ -256,7 +248,7 @@ module Samagotchi
           # has nothing left to answer it.
           return unanswered_question(@question_pending) if @question
 
-          @input_ended = true
+          @own_turns.end_input
           return nil
         end
         end_of_input if submit(line) == :detach
@@ -303,7 +295,7 @@ module Samagotchi
           own_turn_ended(event)
         when :prompt_restored then restore_prompt(event)
         # The after_turn hooks are done (their notices came before it).
-        when :answer_display then @display_pending = false
+        when :answer_display then @own_turns.displayed
         when :context_status, :used_memories_updated then @status.take_event(event)
         when :participants_changed then participants_changed(event)
         # Another client's anytime command: its line now, before the cards
@@ -333,7 +325,7 @@ module Samagotchi
           refresh_children if Array(event[:origins]).any? { |origin| report_origin?(origin_of(origin)) }
         when :question_requested
           # Nothing is left to answer it with.
-          return unanswered_question(event[:pending_question]) if @input_ended
+          return unanswered_question(event[:pending_question]) if @own_turns.input_ended?
 
           ask(event[:pending_question])
         when :question_answered then question_answered(event)
@@ -515,7 +507,7 @@ module Samagotchi
       # goes back into the input, as the REPL restores it for a retry.
       def restore_prompt(event)
         origin = origin_of(event[:origin])
-        return unless own?(origin.client_id) && @sent_ids.include?(origin.enqueued_id)
+        return unless own?(origin.client_id) && @own_turns.sent?(origin.enqueued_id)
         # Lines from a pipe: nobody to retry it (the REPL's rule).
         return if @wait_at_eof
 

data/lib/samagotchi/terminal_ui/own_turns.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  class TerminalUI
+    # This run's own prompts and commands. Sent prompts are always recorded so
+    # only this run's failed prompts can return to the input. With pipe input
+    # (+active+), this also tracks turns still open, prompts merged into a
+    # running turn, whether input ended, and whether a turn failed, was empty, was removed,
+    # or still has an answer display pending. #outcome is what #run returns
+    # once those turns finish.
+    class OwnTurns
+      def initialize(active:)
+        @active = active
+        @sent = Set.new
+        @open = Set.new
+        @merged = Set.new
+        @input_ended = false
+        @failed = false
+        @empty = false
+        @removed = false
+        @display_pending = false
+      end
+
+      def sent(enqueued_id)
+        @sent << enqueued_id
+        @open << enqueued_id if @active
+      end
+
+      def sent?(enqueued_id) = @sent.include?(enqueued_id)
+
+      def command_sent(command_id)
+        @open << command_id if @active
+      end
+
+      def command_ran(command_id) = @open.delete(command_id)
+
+      def merged(enqueued_id)
+        @merged << enqueued_id if @open.include?(enqueued_id)
+      end
+
+      def ended(enqueued_id, failed:, empty:, display_pending:)
+        return unless @active
+
+        ours = @open.include?(enqueued_id) || !@merged.empty?
+        @failed = true if ours && failed
+        @empty = true if ours && empty
+        @display_pending = true if ours && display_pending
+        @open.delete(enqueued_id)
+        @open.subtract(@merged)
+        @merged.clear
+      end
+
+      def displayed = (@display_pending = false)
+
+      def prompt_failed
+        @failed = true if @active
+      end
+
+      def dequeued(enqueued_id, by_us:)
+        return false unless @open.delete?(enqueued_id)
+
+        by_us ? (@removed = true) : (@failed = true)
+        true
+      end
+
+      def end_input = (@input_ended = true)
+
+      def input_ended? = @input_ended
+
+      def pending? = !@open.empty? || @display_pending
+
+      def outcome
+        return :turn_failed if @failed
+        return :empty_answer if @empty
+        return :removed if @removed
+
+        :detached
+      end
+    end
+  end
+end

data/lib/samagotchi/verify_anchor.rb

@@ -25,4 +25,12 @@ module Samagotchi
 
     def to_file = { "turn_id" => turn_id, "quote" => quote }
   end
+
+  VerifyAnchor::FEATURE = "verify"
+  VerifyAnchor::UNAVAILABLE = {
+    "error" => "verify_unavailable",
+    "detail" => "this session's worker predates Verify turns; restart this session to use Verify"
+  }.freeze
+
+  def VerifyAnchor.worker_unavailable?(features) = !features.nil? && !features.include?(VerifyAnchor::FEATURE)
 end

data/lib/samagotchi/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Samagotchi
-  VERSION = "0.127.0"
+  VERSION = "0.128.0"
   # Sent as the User-Agent of every HTTP request chi makes.
   USER_AGENT = "chi/#{VERSION}"
 end

data/lib/samagotchi/web/participant_review.rb

@@ -51,7 +51,8 @@ module Samagotchi
       #   current_turn, waiting_for_owner, queued: {mine, others}, last_event_id}
       def handle_review(req, id)
         session = @session_class.load(id, state_dir: default_state_dir)
-        mode = ParticipantMode.live(session, state_dir: default_state_dir).to_s
+        features = ParticipantMode.live_features(session, default_state_dir)
+        mode = ParticipantMode.of(session, features: features).to_s
         viewer = participant_viewer(req, session)
         live = bridge_get_json(id, "snapshot")
         turn_snapshot = live && live["snapshot"]
@@ -67,7 +68,8 @@ module Samagotchi
         status = Session::STATUS_IDLE if status == Session::STATUS_RUNNING && current.nil?
         json_response(200, {
           viewer: review_viewer(req, id, session: session, state: state, queued: queued, viewer: viewer, mode: mode),
-          session: { id: session.id, title: participant_title(session), status: status },
+          session: { id: session.id, title: participant_title(session), status: status,
+                     verify_unavailable: VerifyAnchor.worker_unavailable?(features) },
           subjects: review_subjects(session, viewer),
           participants: participant_names(id).map { |entry| entry.slice(:id, :name, :kind) },
           messages: with_reply_html(ParticipantView.messages(shown, viewer, automatic: automatic)),

data/lib/samagotchi/web/public/annotate_bar.js

@@ -32,6 +32,7 @@ import { actionEnabled, actionTitle, sameActions, selectionFields, splitInline }
 //   until its step closes)
 // @param onQuote (text) runs with the quote (and a preset's note) to append
 //   to the composer; the selection is cleared and the bar hidden first
+// @param disabledPreset (preset) → a reason to disable it, else null
 // @param actions () => the open session's annotation actions
 //   (annotate_actions.js annotationActions), read on every selection
 // @param running () => whether a turn runs (a send pill may wait for it)
@@ -56,7 +57,8 @@ import { actionEnabled, actionTitle, sameActions, selectionFields, splitInline }
 // @return {schedule(), hide(), el}; schedule() re-reads the selection on the
 //   next frame (call it on scroll)
 export function createAnnotateBar({
-  presets, canAnnotate, roots, isLive, onQuote, onPreset = () => {}, actions = () => [], running = () => false, onAction = () => {},
+  presets, canAnnotate, roots, isLive, onQuote, onPreset = () => {}, disabledPreset = () => null,
+  actions = () => [], running = () => false, onAction = () => {},
   dock = () => null, source: sourceOf = annotationSource, quote = quoteBlock, link = () => null, onLink = () => {},
   doc = globalThis.document, win = globalThis.window,
 }) {
@@ -80,6 +82,14 @@ export function createAnnotateBar({
     btn.title = text;
     bar.appendChild(btn);
   });
+  const presetButtons = [...bar.children].slice(1, presets.length + 1);
+  function markPresets() {
+    presetButtons.forEach((btn, i) => {
+      const reason = disabledPreset(presets[i]);
+      btn.disabled = !!reason;
+      btn.title = reason || presetParts(presets[i]).text;
+    });
+  }
   // The plugin pills: a separator, the inline ones, then ⋯ and the list
   // it opens. Redrawn only when the session's actions change.
   const group = doc.createElement("span");
@@ -175,6 +185,7 @@ export function createAnnotateBar({
     linkBtn.title = pendingLink?.title || "";
     const list = actions() || [];
     if (!sameActions(list, drawn)) drawActions(list);
+    markPresets();
     markActions();
     bar.hidden = false;
     if (touch?.matches) return placeDocked();
@@ -248,6 +259,7 @@ export function createAnnotateBar({
       return;
     }
     const preset = btn.dataset.index === undefined ? null : presets[Number(btn.dataset.index)];
+    if (btn.disabled || (preset && disabledPreset(preset))) return;
     const text = preset ? presetNote(pendingQuote, presetParts(preset).text) : pendingQuote;
     const fields = { ...pendingFields, source: pendingSource, range: pendingRange };
     win.getSelection()?.removeAllRanges();
@@ -256,7 +268,7 @@ export function createAnnotateBar({
     onQuote(text);
   });
 
-  return { schedule, hide, el: bar };
+  return { schedule, hide, refresh: markPresets, el: bar };
 }
 
 // A preset's button label and note: a text is both.

data/lib/samagotchi/web/public/app.js

@@ -59,12 +59,12 @@ import { createTaskStopper } from "./task_stop.js";
 import { createSystemOneWrongAction } from "./system_one_wrong.js";
 import { appendQuote } from "./annotations.js";
 import { applyComposerText, applyRowTemplate, fetchApply } from "./review_apply.js";
-import { nameVerdictCards } from "./verdict_card.js";
+import { CHECK_NOT_ON_PAGE, nameVerdictCards, ownerCheckHash } from "./verdict_card.js";
 import { freshURL, placeVerdictWithFresh, settleRunning } from "./verdict_fresh.js";
 import { authorBadge, nameUnnamedBadges } from "./participant_names.js";
 import { parsePresets } from "./annotate_presets.js";
 import { createAnnotateBar } from "./annotate_bar.js";
-import { VERIFY_PRESET, withVerify } from "./verify_preset.js";
+import { VERIFY_PRESET, VERIFY_UNAVAILABLE, verifyWorkerUnavailable, withVerify } from "./verify_preset.js";
 import { actionLine, annotationActions, composerWithAction } from "./annotate_actions.js";
 import { copyText, installCopy } from "./copy.js";
 import { createQuestionCards } from "./question_cards.js";
@@ -235,6 +235,7 @@ const composeHintEl = $("#composeHint");
 
 let selected = null;
 let pendingVerifyAnchor = null;
+let annotateBar = null;
 // The session the composer's text was last written in ("" the start page,
 // undefined unknown): the composer is one for every session, and continue →
 // keeps only a draft of its own (fillOpener).
@@ -590,6 +591,7 @@ function followSelectedSession(sess) {
   current.owner = sess.owner || null;
   current.workerVersion = sess.worker_version || null;
   current.workerFeatures = Array.isArray(sess.worker_features) ? sess.worker_features : [];
+  current.bridgeUp = sess.bridge_up === true;
   const streaming = !!(streamControl && streamControl.live);
   if (!streaming) current.status = sess.status;
   updateInfoBar();
@@ -1344,6 +1346,11 @@ function placeVerdict(record) {
   placeVerdictWithFresh(historyEl, record, {
     who: badge ? badge.name : "You",
     author: record.by || null,
+    onMissingCheck: (missing) => {
+      const hash = ownerCheckHash(allSessions, selected, missing.check_turn_id);
+      if (hash) location.hash = hash;
+      else showToast(CHECK_NOT_ON_PAGE);
+    },
   }, verifyFreshState());
 }
 
@@ -1351,11 +1358,13 @@ function placeVerdict(record) {
 // always theirs to start; its running check links to the child's session.
 function verifyFreshState() {
   const id = selected;
+  const unavailable = verifyWorkerUnavailable(current.workerFeatures, current.bridgeUp);
   if (!Array.isArray(current.verifyFresh)) current.verifyFresh = [];
   return {
     verdicts: current.verdicts || [],
     running: current.verifyFresh,
-    canStart: !!id,
+    canStart: !!id && !unavailable,
+    unavailableReason: unavailable ? VERIFY_UNAVAILABLE : null,
     start: async (of) => {
       try {
         const body = await api(freshURL(id, of), { method: "POST", body: "{}" });
@@ -1421,6 +1430,7 @@ async function restartWorker() {
 // The session bar (info_bar_model.js sessionBar): its buttons, and the
 // info line rendered by info_bar.js.
 function updateInfoBar() {
+  annotateBar?.refresh();
   const { buttons, bar } = sessionBar({
     id: selected, state: current, sessions: allSessions, versions, cardTitle: (s) => lists.cardTitle(s),
     continuing: sessionActions.continuing, restarting: restartingIds, streaming: !!streamControl, running: liveTurn.running,
@@ -1574,6 +1584,7 @@ function workerGone(id, { opened = true } = {}) {
     if (!stopped) setLiveStatus("idle");
   }
   if (current.owner === "worker") current.owner = null;
+  current.bridgeUp = false;
   // Its card says "live" (the list's owner, or setLiveStatus's) until the
   // hub's event says otherwise: the worker is gone now, as far as this
   // tab can tell.
@@ -1956,8 +1967,10 @@ function fillComposer(text) {
   promptEl.scrollTop = promptEl.scrollHeight;
 }
 
-const annotateBar = createAnnotateBar({
+annotateBar = createAnnotateBar({
   presets: withVerify(parsePresets(document.body.dataset.annotatePresets)),
+  disabledPreset: (preset) => preset === VERIFY_PRESET
+    && verifyWorkerUnavailable(current.workerFeatures, current.bridgeUp) ? VERIFY_UNAVAILABLE : null,
   canAnnotate: () => !!selected && current.owner !== "tui",
   roots: turnRoots,
   isLive: (root) => liveTurn.running && turnDom.containsLive(root),

data/lib/samagotchi/web/public/composer.css

@@ -53,6 +53,7 @@ body.has-session.composer-folded #composeGrip::after{opacity:1;width:48px;margin
    info bar's buttons while folded, the stage card's bottom in the stage view); it reaches 7 px below the edge, the info bar's
    border and padding, so it never covers a button of the bar. */
 @media(max-width:600px){
+  .composer-card-foot{padding-top:4px;padding-bottom:4px}
   #composeGrip{width:96px;height:26px;margin:-19px auto -7px}
   #composeGrip::after{top:17px;opacity:1}
 }

data/lib/samagotchi/web/public/notify.js

@@ -3,6 +3,7 @@
 // title badge for what it returns, while the tab is not in front.
 
 import { clip } from "./format.js";
+import { isParticipantAuthor } from "./participant_model.js";
 
 // The bell's state. OS notifications need a secure context: on chi web
 // over http at a LAN address the API is missing or always denied, so the
@@ -164,7 +165,7 @@ export function attentionText(session, attention) {
   const seconds = Math.round(Number(session?.last_turn?.seconds) || 0);
   const verdict = session?.last_verdict;
   // An owner's verdict has no participant author (none, "" or "owner").
-  const byParticipant = !!verdict?.by && verdict.by !== "owner";
+  const byParticipant = isParticipantAuthor(verdict?.by);
   const who = verdict?.by_name || (byParticipant ? "A participant" : "You");
   const verdictReason = clip(String(verdict?.reason || ""), VERDICT_REASON_MAX);
   const verdictIcon = { confirmed: "✅", refuted: "❌", unclear: "❓" }[verdict?.verdict] || "";

data/lib/samagotchi/web/public/participant.html

@@ -122,9 +122,10 @@ main{flex:1;min-height:0;overflow-y:auto;padding:16px 16px 8px}
 #composer textarea{font:inherit;line-height:1.45;padding:2px 0}
 #composer textarea:disabled{cursor:not-allowed}
 #composer .actions-col #send{height:30px;min-height:30px;line-height:30px;padding:0 16px;font-weight:600}
+/* The key hint wraps to at most two lines (a narrow card cuts the second's end); the whole text is its title. */
+.p-hint.composer-line{color:var(--text-faint);height:auto;max-height:36px;display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2;line-clamp:2}
 /* The participant's own usage (participant_model.js usageItems: the fields their grant's exposure shows), one line in
    the card's footer, the end cut. Folded, it stays under the grip. */
-.p-hint.composer-line{color:var(--text-faint);white-space:nowrap;text-overflow:ellipsis}
 .p-foot{min-width:0}
 .p-foot:has(> .p-usage[hidden]){display:none}
 /* Folded before the usage loads, the card keeps a footer's height under its grip, not a 2 px sliver. */
@@ -151,7 +152,7 @@ button.small{font-size:12px;padding:2px 8px}
   .p-people .p-person:nth-child(n+4){display:none}
   main{padding:12px 16px 6px}
   .p-bubble{padding:9px 12px}
-  .p-hint,.p-note{display:none}
+  .p-hint.composer-line,.p-note{display:none}
 }
 /* Under 16px iOS Safari zooms the page on focus (and a Home Screen app never zooms back). */
 @media (max-width:600px),(pointer:coarse){#composer textarea{font-size:16px}}

data/lib/samagotchi/web/public/participant.js

@@ -12,7 +12,7 @@
 // (spend vs cap, queue, link expiry, model). The owner's participant view
 // mounts none.
 import {
-  authorColor, participantAuthor, authorLabel, toolLine, refusalText, dequeueText, endedText, streamURL, reloads, endsLiveTurn, liveFrom, applyLive,
+  authorColor, participantAuthor, isParticipantAuthor, authorLabel, toolLine, refusalText, dequeueText, endedText, streamURL, reloads, endsLiveTurn, liveFrom, applyLive,
   liveText, withToolSteps, pickSubject, subjectBody, subjectsKey, narrowView, retryDelay, retries, threadGaps, usageItems,
   modeCopy,
 } from "./participant_model.js";
@@ -22,10 +22,11 @@ import { createAuthLost, lostAnswer } from "./auth_lost.js";
 import { REPLACE_SESSION_TEXT, fragmentCode, tradeFragmentCode } from "./token_fragment.js";
 import { createAnnotateBar } from "./annotate_bar.js";
 import { parsePresets } from "./annotate_presets.js";
-import { VERIFY_PRESET, withVerify } from "./verify_preset.js";
+import { VERIFY_PRESET, VERIFY_UNAVAILABLE, withVerify } from "./verify_preset.js";
 import { appendQuote } from "./annotations.js";
 import { messageAuthorData, participantQuote, participantSource } from "./participant_annotate.js";
 import { claimFromHash, selectionClaim, showClaim } from "./claim_link.js";
+import { CHECK_NOT_ON_PAGE } from "./verdict_card.js";
 import { freshURL, placeVerdictWithFresh, settleRunning } from "./verdict_fresh.js";
 import { mountComposer } from "./composer_mount.js";
 import { PROMPT_LINE_PX } from "./composer_size.js";
@@ -234,7 +235,7 @@ function render() {
   const copy = modeCopy(viewer.mode);
   $("note").textContent = ownerView ? "" : copy.note;
   $("hint").textContent = `⏎ sends, ⇧⏎ a new line, ↑ an earlier comment. ${copy.hint}`;
-  $("hint").title = $("hint").textContent; // one line in the card: the whole text on hover
+  $("hint").title = $("hint").textContent; // at most two lines in the card: the whole text on hover
   $("head").hidden = false;
   $("main").hidden = false;
   renderPlan();
@@ -343,7 +344,7 @@ function messageNode(message) {
     const who = el("div", "p-who");
     who.append(el("b", "", authorLabel(message)));
     if (message.merged) who.append(el("span", "p-tag", "added mid-turn"));
-    if (message.author) who.append(el("span", "p-tag", modeCopy(message.participant_mode).tag));
+    if (isParticipantAuthor(message.author)) who.append(el("span", "p-tag", modeCopy(message.participant_mode).tag));
     node.append(who);
     const text = message.content + (message.images ? `\n[${message.images} image${message.images > 1 ? "s" : ""}]` : "");
     node.append(el("div", "p-bubble", text));
@@ -413,13 +414,17 @@ function renderThread() {
     const author = record.by || null;
     const viewer = data.viewer || {};
     let who = ownerView ? "You" : "Owner";
-    if (author && author !== "owner") {
+    if (isParticipantAuthor(author)) {
       if (!ownerView && author === participantAuthor(viewer.id)) who = "You";
       else {
         who = (data.participants || []).find((participant) => participantAuthor(participant.id) === author)?.name || "A participant";
       }
     }
-    placeVerdictWithFresh(thread, record, { who, author }, verifyFreshState());
+    placeVerdictWithFresh(thread, record, {
+      who,
+      author,
+      onMissingCheck: () => showClaimNote(CHECK_NOT_ON_PAGE),
+    }, verifyFreshState());
   }
   if (atBottom || !thread.dataset.drawn) main.scrollTop = main.scrollHeight;
   thread.dataset.drawn = "1";
@@ -431,10 +436,12 @@ function renderThread() {
 // does, and no one here gets a link to the child's session.
 function verifyFreshState() {
   if (!Array.isArray(data.fresh_running)) data.fresh_running = [];
+  const unavailable = data.session?.verify_unavailable === true;
   return {
     verdicts: data.verdicts || [],
     running: data.fresh_running,
-    canStart: !ownerView && !ended && !!data.viewer?.can_comment,
+    canStart: !unavailable && !ownerView && !ended && !!data.viewer?.can_comment,
+    unavailableReason: unavailable ? VERIFY_UNAVAILABLE : null,
     start: async (of) => {
       const { ok, body } = await api(freshURL(sessionId, of), {
         method: "POST", body: "{}", headers: { "Content-Type": "application/json" },
@@ -650,6 +657,8 @@ for (const button of $("viewSeg").querySelectorAll("button")) {
 // while this participant can't comment.
 const annotateBar = createAnnotateBar({
   presets: withVerify(parsePresets(body.annotatePresets)),
+  disabledPreset: (preset) => preset === VERIFY_PRESET
+    && data?.session?.verify_unavailable === true ? VERIFY_UNAVAILABLE : null,
   canAnnotate: () => !ownerView && !ended && !!data?.viewer?.can_comment,
   roots: () => [$("planDoc"), $("thread")],
   isLive: (root) => !!root.closest?.(".p-msg.live"),

data/lib/samagotchi/web/public/participant_model.js

@@ -9,6 +9,7 @@ import { fullTime, gapText } from "./format.js";
 // (Steer.author_for / PARTICIPANT_PREFIX): the one place the web spells it.
 export const PARTICIPANT_PREFIX = "p:";
 export const participantAuthor = (id) => `${PARTICIPANT_PREFIX}${id}`;
+export const isParticipantAuthor = (by) => typeof by === "string" && by.startsWith(PARTICIPANT_PREFIX);
 
 // Six author colours (tokens.css --author-1..6), one per participant id,
 // the same on every page that shows them (the owner's badges too).
@@ -22,13 +23,13 @@ export function authorSlot(author) {
 
 // The CSS colour of an author: a participant's slot, else the owner's.
 export function authorColor(author) {
-  return author ? `var(--author-${authorSlot(author)})` : "var(--author-owner)";
+  return isParticipantAuthor(author) ? `var(--author-${authorSlot(author)})` : "var(--author-owner)";
 }
 
 // Who wrote a user message or started a turn, as the page names them.
 export function authorLabel(item) {
   if (item?.mine) return "You";
-  if (item?.author) return item.author_name || "A participant";
+  if (isParticipantAuthor(item?.author)) return item.author_name || "A participant";
   if (item?.automatic) return "Automatic";
   return "Owner";
 }

data/lib/samagotchi/web/public/participant_names.js

@@ -4,7 +4,7 @@
 // prompt's own author_name (a saved message, turn_started) comes first; a
 // badge drawn before the list came, with neither, says UNNAMED until
 // nameUnnamedBadges names it.
-import { authorColor, participantAuthor } from "./participant_model.js";
+import { authorColor, isParticipantAuthor, participantAuthor } from "./participant_model.js";
 
 export const UNNAMED = "a participant";
 
@@ -28,7 +28,7 @@ export function participantName(author) {
 // +mode+: the turn's participant_mode stamp ("review", "pair"; the
 // message's, or turn_started's), kept as mode: when known.
 export function authorBadge(author, name = null, mode = null) {
-  if (!author || author === "owner") return null;
+  if (!isParticipantAuthor(author)) return null;
   const known = name || participantName(author);
   return { author, name: known || UNNAMED, color: authorColor(author), ...(known ? {} : { unnamed: true }), ...(mode ? { mode } : {}) };
 }

data/lib/samagotchi/web/public/question_card.js

@@ -3,6 +3,7 @@
 // command or paths, where and why. Its options end in "Deny"; the answer's
 // last option denies. A page that doesn't know approvals still shows the
 // plain question text, which says the same.
+import { isParticipantAuthor, PARTICIPANT_PREFIX } from "./participant_model.js";
 
 export function isApproval(pq) {
   return !!pq && pq.kind === "approval";
@@ -68,7 +69,9 @@ export function relayView(pq) {
 export function approvalAsker(pq) {
   const a = (pq && pq.approval) || {};
   if (!a.author) return null;
-  return a.author_name ? String(a.author_name) : String(a.author).replace(/^p:/, "");
+  const author = String(a.author);
+  return a.author_name ? String(a.author_name)
+    : isParticipantAuthor(author) ? author.slice(PARTICIPANT_PREFIX.length) : author;
 }
 
 // @return {null | {tool, what, isCommand, where, why, paths?, preview?, delegate?, asker?}};

data/lib/samagotchi/web/public/session_state.js

@@ -53,6 +53,7 @@ export function emptySessionState() {
     // worker_version / worker_features): the info bar's stale-worker badge.
     workerVersion: null,
     workerFeatures: [],
+    bridgeUp: false,
     // The LLM context strategy, apply rule and budget the next turn runs
     // under, each with its source (the info bar's llm ctx chip), or null.
     llmContext: null,
@@ -95,6 +96,7 @@ export function sessionStateFrom(data) {
     // not at the session's next hub event (followSelectedSession).
     workerVersion: s.worker_version || null,
     workerFeatures: Array.isArray(s.worker_features) ? s.worker_features : [],
+    bridgeUp: s.bridge_up === true,
     timing: normalizeTiming(data.timing),
   };
   // The saved fill, so a reloaded or stopped session shows it before its

data/lib/samagotchi/web/public/stream_handlers.js

@@ -55,6 +55,7 @@ import {
 import { commandView, drawCommandBubble, historyHasCommandBubble } from "./commands.js";
 import { keepEarlyRestore, restoreAction } from "./restore.js";
 import { PAIR, setBadgeMode } from "./participant_names.js";
+import { isParticipantAuthor } from "./participant_model.js";
 
 export function createStreamHandlers(deps) {
   const {
@@ -163,12 +164,13 @@ export function createStreamHandlers(deps) {
       // A participant's review turn: its id and author, for Apply at its end
       // (turn_completed names neither). A pair turn acted itself: no Apply.
       const author = data.author || data.origin?.author;
+      const participant = isParticipantAuthor(author);
       const pair = data.participant_mode === PAIR;
-      liveTurn.review = author && author !== "owner" && data.turn_id && !pair ? { turn_id: data.turn_id, author, author_name: data.author_name } : null;
+      liveTurn.review = participant && data.turn_id && !pair ? { turn_id: data.turn_id, author, author_name: data.author_name } : null;
       // Its prompt drawn while queued takes the turn's mode now.
       if (data.participant_mode) setBadgeMode(promptBubble, data.participant_mode);
       // The owner's input queues behind it (the composer's delivery line).
-      liveTurn.participantTurn = !!(author && author !== "owner");
+      liveTurn.participantTurn = participant;
       setTurnRunning(true);
       setLiveStatus("running");
       liveTurn.timing.detach();

data/lib/samagotchi/web/public/verdict_card.js

@@ -1,10 +1,23 @@
+import { ownerClaimHash } from "./claim_link.js";
+
 const TYPES = Object.freeze({
   confirmed: { icon: "✅", label: "confirmed" },
   refuted: { icon: "❌", label: "refuted" },
   unclear: { icon: "❓", label: "unclear" },
 });
 
-export function placeVerdict(root, record, { who = "Owner", author = null } = {}) {
+export const CHECK_NOT_ON_PAGE = "That check is no longer on this page.";
+
+export function ownerCheckHash(sessions, currentSessionId, checkTurnId) {
+  if (!Array.isArray(sessions) || typeof checkTurnId !== "string") return null;
+  const session = sessions.find((candidate) =>
+    candidate?.id !== currentSessionId
+    && Array.isArray(candidate.verdicts)
+    && candidate.verdicts.some((verdict) => verdict?.check_turn_id === checkTurnId));
+  return session ? ownerClaimHash(session.id, { turnId: checkTurnId }) : null;
+}
+
+export function placeVerdict(root, record, { who = "Owner", author = null, onMissingCheck = null } = {}) {
   const anchor = record?.anchor;
   const type = TYPES[record?.verdict];
   if (!root || !type || typeof anchor?.turn_id !== "string" || typeof anchor?.quote !== "string"
@@ -47,8 +60,10 @@ export function placeVerdict(root, record, { who = "Owner", author = null } = {}
   link.textContent = "View check";
   link.addEventListener("click", (event) => {
     event.preventDefault();
-    [...root.querySelectorAll("[data-turn-id]")].find((element) => element.dataset.turnId === record.check_turn_id)
-      ?.scrollIntoView?.({ behavior: "smooth", block: "center" });
+    const check = [...root.querySelectorAll("[data-turn-id]")]
+      .find((element) => element.dataset.turnId === record.check_turn_id);
+    if (check) check.scrollIntoView?.({ behavior: "smooth", block: "center" });
+    else onMissingCheck?.(record);
   });
   card.append(heading, quote, reason, link);
 

data/lib/samagotchi/web/public/verdict_fresh.js

@@ -79,6 +79,17 @@ export function renderFresh(card, fresh = {}) {
     const link = childLink(typeof run === "string" ? null : run.child_id);
     if (link) line.append(" ", link);
     part.append(line);
+  } else if (card.classList.contains("unclear") && fresh.unavailableReason) {
+    const button = doc.createElement("button");
+    button.type = "button";
+    button.className = "verify-fresh-btn";
+    button.textContent = "Verify fresh";
+    button.title = fresh.unavailableReason;
+    button.disabled = true;
+    const note = doc.createElement("p");
+    note.className = "verify-fresh-unavailable";
+    note.textContent = fresh.unavailableReason;
+    part.append(button, note);
   } else if (card.classList.contains("unclear") && fresh.canStart && fresh.start) {
     const button = doc.createElement("button");
     button.type = "button";

data/lib/samagotchi/web/public/verify_card.css

@@ -11,6 +11,7 @@
 .verify-fresh-result{font-weight:600;color:var(--text-bright)}
 .verify-fresh-running{color:var(--text-muted);font-style:italic}
 .verify-fresh-error{color:var(--danger-text)}
+.verify-fresh-unavailable{color:var(--text-muted)}
 .verify-fresh-link{color:var(--accent);font-weight:400}
 .verify-fresh-btn{font:inherit;font-size:12px;font-weight:600;padding:3px 12px;border-radius:8px;cursor:pointer;background:var(--accent-bg);color:var(--accent);border:1px solid var(--accent-border)}
 .verify-fresh-btn:hover{border-color:var(--accent)}

data/lib/samagotchi/web/public/verify_preset.js

@@ -12,6 +12,12 @@ export const VERIFY_PRESET = Object.freeze({
     + "End with a line `Verdict: confirmed|refuted|unclear — <one-line reason>`.",
 });
 
+export const VERIFY_UNAVAILABLE = "restart this session to use Verify";
+
+export function verifyWorkerUnavailable(workerFeatures, bridgeUp) {
+  return bridgeUp === true && Array.isArray(workerFeatures) && !workerFeatures.includes("verify");
+}
+
 // +presets+ (annotate_presets.js parsePresets) with Verify after them.
 export function withVerify(presets) {
   return [...(presets || []), VERIFY_PRESET];

data/lib/samagotchi/web/verify_fresh_routes.rb

@@ -33,14 +33,18 @@ module Samagotchi
       def handle_verify_fresh(req, id, of)
         clicker = principal(req).owner? ? nil : principal(req).grant
         session = @session_class.load(id, state_dir: default_state_dir)
-        if clicker && (refused = participant_cap_refusal(clicker) || fresh_worker_refusal(session))
+        if clicker && (refused = participant_cap_refusal(clicker) || fresh_worker_refusal(session, participant: true))
           return verify_fresh_refused(clicker, of, *refused)
         end
 
         by = Steer.sender_author(field_of(VerifyFresh.original(session.verdicts, of), :by))
         runner = by ? verdict_author_grant(id, by) : clicker
         return author_link_ended(clicker, id, of, by) if by && runner.nil?
-        if runner && runner != clicker && (refused = participant_cap_refusal(runner) || fresh_worker_refusal(session))
+        if runner && runner != clicker && (refused = participant_cap_refusal(runner) ||
+                                                   fresh_worker_refusal(session, participant: true))
+          return verify_fresh_refused(clicker, of, *refused, runner: runner)
+        end
+        if (refused = fresh_worker_refusal(session))
           return verify_fresh_refused(clicker, of, *refused, runner: runner)
         end
 
@@ -76,12 +80,13 @@ module Samagotchi
 
       def field_of(record, key) = record && (record[key] || record[key.to_s])
 
-      # A live worker of the session that predates participants' turns runs
-      # no participant's turn (Delivery::REVIEW_UNAVAILABLE): no fresh
-      # child for one either. nil to go on.
-      def fresh_worker_refusal(session)
+      # A live worker must support VerifyFresh's parent checks. For a
+      # participant's child it must also have the review boundary.
+      def fresh_worker_refusal(session, participant: false)
         features = ParticipantMode.live_features(session, default_state_dir)
-        return nil if features.nil? || features.include?(Delivery::REVIEW_FEATURE)
+        return nil if features.nil?
+        return [409, VerifyAnchor::UNAVAILABLE["error"], VerifyAnchor::UNAVAILABLE["detail"]] if VerifyAnchor.worker_unavailable?(features)
+        return nil unless participant && !features.include?(Delivery::REVIEW_FEATURE)
 
         [409, Delivery::REVIEW_UNAVAILABLE["error"], Delivery::REVIEW_UNAVAILABLE["detail"]]
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samagotchi
 version: !ruby/object:Gem::Version
-  version: 0.127.0
+  version: 0.128.0
 platform: ruby
 authors:
 - Dmitry Dedov
@@ -623,6 +623,7 @@ files:
 - lib/samagotchi/terminal_ui/local_link.rb
 - lib/samagotchi/terminal_ui/model_segments_text.rb
 - lib/samagotchi/terminal_ui/one_shot_sink.rb
+- lib/samagotchi/terminal_ui/own_turns.rb
 - lib/samagotchi/terminal_ui/participant_commands.rb
 - lib/samagotchi/terminal_ui/plain_surface.rb
 - lib/samagotchi/terminal_ui/question_prompt.rb