samagotchi 0.127.0 → 0.129.0

data/lib/samagotchi/web/public/composer.css

@@ -53,6 +53,7 @@ body.has-session.composer-folded #composeGrip::after{opacity:1;width:48px;margin
    info bar's buttons while folded, the stage card's bottom in the stage view); it reaches 7 px below the edge, the info bar's
    border and padding, so it never covers a button of the bar. */
 @media(max-width:600px){
+  .composer-card-foot{padding-top:4px;padding-bottom:4px}
   #composeGrip{width:96px;height:26px;margin:-19px auto -7px}
   #composeGrip::after{top:17px;opacity:1}
 }

data/lib/samagotchi/web/public/notify.js

@@ -3,6 +3,7 @@
 // title badge for what it returns, while the tab is not in front.
 
 import { clip } from "./format.js";
+import { isParticipantAuthor } from "./participant_model.js";
 
 // The bell's state. OS notifications need a secure context: on chi web
 // over http at a LAN address the API is missing or always denied, so the
@@ -164,7 +165,7 @@ export function attentionText(session, attention) {
   const seconds = Math.round(Number(session?.last_turn?.seconds) || 0);
   const verdict = session?.last_verdict;
   // An owner's verdict has no participant author (none, "" or "owner").
-  const byParticipant = !!verdict?.by && verdict.by !== "owner";
+  const byParticipant = isParticipantAuthor(verdict?.by);
   const who = verdict?.by_name || (byParticipant ? "A participant" : "You");
   const verdictReason = clip(String(verdict?.reason || ""), VERDICT_REASON_MAX);
   const verdictIcon = { confirmed: "✅", refuted: "❌", unclear: "❓" }[verdict?.verdict] || "";

data/lib/samagotchi/web/public/participant.html

@@ -122,9 +122,10 @@ main{flex:1;min-height:0;overflow-y:auto;padding:16px 16px 8px}
 #composer textarea{font:inherit;line-height:1.45;padding:2px 0}
 #composer textarea:disabled{cursor:not-allowed}
 #composer .actions-col #send{height:30px;min-height:30px;line-height:30px;padding:0 16px;font-weight:600}
+/* The key hint wraps to at most two lines (a narrow card cuts the second's end); the whole text is its title. */
+.p-hint.composer-line{color:var(--text-faint);height:auto;max-height:36px;display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2;line-clamp:2}
 /* The participant's own usage (participant_model.js usageItems: the fields their grant's exposure shows), one line in
    the card's footer, the end cut. Folded, it stays under the grip. */
-.p-hint.composer-line{color:var(--text-faint);white-space:nowrap;text-overflow:ellipsis}
 .p-foot{min-width:0}
 .p-foot:has(> .p-usage[hidden]){display:none}
 /* Folded before the usage loads, the card keeps a footer's height under its grip, not a 2 px sliver. */
@@ -151,7 +152,7 @@ button.small{font-size:12px;padding:2px 8px}
   .p-people .p-person:nth-child(n+4){display:none}
   main{padding:12px 16px 6px}
   .p-bubble{padding:9px 12px}
-  .p-hint,.p-note{display:none}
+  .p-hint.composer-line,.p-note{display:none}
 }
 /* Under 16px iOS Safari zooms the page on focus (and a Home Screen app never zooms back). */
 @media (max-width:600px),(pointer:coarse){#composer textarea{font-size:16px}}

data/lib/samagotchi/web/public/participant.js

@@ -12,7 +12,7 @@
 // (spend vs cap, queue, link expiry, model). The owner's participant view
 // mounts none.
 import {
-  authorColor, participantAuthor, authorLabel, toolLine, refusalText, dequeueText, endedText, streamURL, reloads, endsLiveTurn, liveFrom, applyLive,
+  authorColor, participantAuthor, isParticipantAuthor, authorLabel, toolLine, refusalText, dequeueText, endedText, streamURL, reloads, endsLiveTurn, liveFrom, applyLive,
   liveText, withToolSteps, pickSubject, subjectBody, subjectsKey, narrowView, retryDelay, retries, threadGaps, usageItems,
   modeCopy,
 } from "./participant_model.js";
@@ -22,10 +22,11 @@ import { createAuthLost, lostAnswer } from "./auth_lost.js";
 import { REPLACE_SESSION_TEXT, fragmentCode, tradeFragmentCode } from "./token_fragment.js";
 import { createAnnotateBar } from "./annotate_bar.js";
 import { parsePresets } from "./annotate_presets.js";
-import { VERIFY_PRESET, withVerify } from "./verify_preset.js";
+import { VERIFY_PRESET, VERIFY_UNAVAILABLE, withVerify } from "./verify_preset.js";
 import { appendQuote } from "./annotations.js";
 import { messageAuthorData, participantQuote, participantSource } from "./participant_annotate.js";
 import { claimFromHash, selectionClaim, showClaim } from "./claim_link.js";
+import { CHECK_NOT_ON_PAGE } from "./verdict_card.js";
 import { freshURL, placeVerdictWithFresh, settleRunning } from "./verdict_fresh.js";
 import { mountComposer } from "./composer_mount.js";
 import { PROMPT_LINE_PX } from "./composer_size.js";
@@ -234,7 +235,7 @@ function render() {
   const copy = modeCopy(viewer.mode);
   $("note").textContent = ownerView ? "" : copy.note;
   $("hint").textContent = `⏎ sends, ⇧⏎ a new line, ↑ an earlier comment. ${copy.hint}`;
-  $("hint").title = $("hint").textContent; // one line in the card: the whole text on hover
+  $("hint").title = $("hint").textContent; // at most two lines in the card: the whole text on hover
   $("head").hidden = false;
   $("main").hidden = false;
   renderPlan();
@@ -343,7 +344,7 @@ function messageNode(message) {
     const who = el("div", "p-who");
     who.append(el("b", "", authorLabel(message)));
     if (message.merged) who.append(el("span", "p-tag", "added mid-turn"));
-    if (message.author) who.append(el("span", "p-tag", modeCopy(message.participant_mode).tag));
+    if (isParticipantAuthor(message.author)) who.append(el("span", "p-tag", modeCopy(message.participant_mode).tag));
     node.append(who);
     const text = message.content + (message.images ? `\n[${message.images} image${message.images > 1 ? "s" : ""}]` : "");
     node.append(el("div", "p-bubble", text));
@@ -413,13 +414,17 @@ function renderThread() {
     const author = record.by || null;
     const viewer = data.viewer || {};
     let who = ownerView ? "You" : "Owner";
-    if (author && author !== "owner") {
+    if (isParticipantAuthor(author)) {
       if (!ownerView && author === participantAuthor(viewer.id)) who = "You";
       else {
         who = (data.participants || []).find((participant) => participantAuthor(participant.id) === author)?.name || "A participant";
       }
     }
-    placeVerdictWithFresh(thread, record, { who, author }, verifyFreshState());
+    placeVerdictWithFresh(thread, record, {
+      who,
+      author,
+      onMissingCheck: () => showClaimNote(CHECK_NOT_ON_PAGE),
+    }, verifyFreshState());
   }
   if (atBottom || !thread.dataset.drawn) main.scrollTop = main.scrollHeight;
   thread.dataset.drawn = "1";
@@ -429,12 +434,16 @@ function renderThread() {
 // participant starts one while their grant could run a turn now
 // (can_comment); the owner looking through the participant view never
 // does, and no one here gets a link to the child's session.
+const freshErrors = {};
 function verifyFreshState() {
   if (!Array.isArray(data.fresh_running)) data.fresh_running = [];
+  const unavailable = data.session?.verify_unavailable === true;
   return {
     verdicts: data.verdicts || [],
     running: data.fresh_running,
-    canStart: !ownerView && !ended && !!data.viewer?.can_comment,
+    errors: freshErrors,
+    canStart: !unavailable && !ownerView && !ended && !!data.viewer?.can_comment,
+    unavailableReason: unavailable ? VERIFY_UNAVAILABLE : null,
     start: async (of) => {
       const { ok, body } = await api(freshURL(sessionId, of), {
         method: "POST", body: "{}", headers: { "Content-Type": "application/json" },
@@ -650,6 +659,8 @@ for (const button of $("viewSeg").querySelectorAll("button")) {
 // while this participant can't comment.
 const annotateBar = createAnnotateBar({
   presets: withVerify(parsePresets(body.annotatePresets)),
+  disabledPreset: (preset) => preset === VERIFY_PRESET
+    && data?.session?.verify_unavailable === true ? VERIFY_UNAVAILABLE : null,
   canAnnotate: () => !ownerView && !ended && !!data?.viewer?.can_comment,
   roots: () => [$("planDoc"), $("thread")],
   isLive: (root) => !!root.closest?.(".p-msg.live"),

data/lib/samagotchi/web/public/participant_model.js

@@ -9,6 +9,7 @@ import { fullTime, gapText } from "./format.js";
 // (Steer.author_for / PARTICIPANT_PREFIX): the one place the web spells it.
 export const PARTICIPANT_PREFIX = "p:";
 export const participantAuthor = (id) => `${PARTICIPANT_PREFIX}${id}`;
+export const isParticipantAuthor = (by) => typeof by === "string" && by.startsWith(PARTICIPANT_PREFIX);
 
 // Six author colours (tokens.css --author-1..6), one per participant id,
 // the same on every page that shows them (the owner's badges too).
@@ -22,13 +23,13 @@ export function authorSlot(author) {
 
 // The CSS colour of an author: a participant's slot, else the owner's.
 export function authorColor(author) {
-  return author ? `var(--author-${authorSlot(author)})` : "var(--author-owner)";
+  return isParticipantAuthor(author) ? `var(--author-${authorSlot(author)})` : "var(--author-owner)";
 }
 
 // Who wrote a user message or started a turn, as the page names them.
 export function authorLabel(item) {
   if (item?.mine) return "You";
-  if (item?.author) return item.author_name || "A participant";
+  if (isParticipantAuthor(item?.author)) return item.author_name || "A participant";
   if (item?.automatic) return "Automatic";
   return "Owner";
 }

data/lib/samagotchi/web/public/participant_names.js

@@ -4,7 +4,7 @@
 // prompt's own author_name (a saved message, turn_started) comes first; a
 // badge drawn before the list came, with neither, says UNNAMED until
 // nameUnnamedBadges names it.
-import { authorColor, participantAuthor } from "./participant_model.js";
+import { authorColor, isParticipantAuthor, participantAuthor } from "./participant_model.js";
 
 export const UNNAMED = "a participant";
 
@@ -28,7 +28,7 @@ export function participantName(author) {
 // +mode+: the turn's participant_mode stamp ("review", "pair"; the
 // message's, or turn_started's), kept as mode: when known.
 export function authorBadge(author, name = null, mode = null) {
-  if (!author || author === "owner") return null;
+  if (!isParticipantAuthor(author)) return null;
   const known = name || participantName(author);
   return { author, name: known || UNNAMED, color: authorColor(author), ...(known ? {} : { unnamed: true }), ...(mode ? { mode } : {}) };
 }

data/lib/samagotchi/web/public/question_card.js

@@ -3,6 +3,7 @@
 // command or paths, where and why. Its options end in "Deny"; the answer's
 // last option denies. A page that doesn't know approvals still shows the
 // plain question text, which says the same.
+import { isParticipantAuthor, PARTICIPANT_PREFIX } from "./participant_model.js";
 
 export function isApproval(pq) {
   return !!pq && pq.kind === "approval";
@@ -68,7 +69,9 @@ export function relayView(pq) {
 export function approvalAsker(pq) {
   const a = (pq && pq.approval) || {};
   if (!a.author) return null;
-  return a.author_name ? String(a.author_name) : String(a.author).replace(/^p:/, "");
+  const author = String(a.author);
+  return a.author_name ? String(a.author_name)
+    : isParticipantAuthor(author) ? author.slice(PARTICIPANT_PREFIX.length) : author;
 }
 
 // @return {null | {tool, what, isCommand, where, why, paths?, preview?, delegate?, asker?}};

data/lib/samagotchi/web/public/session_state.js

@@ -53,6 +53,7 @@ export function emptySessionState() {
     // worker_version / worker_features): the info bar's stale-worker badge.
     workerVersion: null,
     workerFeatures: [],
+    bridgeUp: false,
     // The LLM context strategy, apply rule and budget the next turn runs
     // under, each with its source (the info bar's llm ctx chip), or null.
     llmContext: null,
@@ -95,6 +96,7 @@ export function sessionStateFrom(data) {
     // not at the session's next hub event (followSelectedSession).
     workerVersion: s.worker_version || null,
     workerFeatures: Array.isArray(s.worker_features) ? s.worker_features : [],
+    bridgeUp: s.bridge_up === true,
     timing: normalizeTiming(data.timing),
   };
   // The saved fill, so a reloaded or stopped session shows it before its

data/lib/samagotchi/web/public/stream_handlers.js

@@ -55,6 +55,7 @@ import {
 import { commandView, drawCommandBubble, historyHasCommandBubble } from "./commands.js";
 import { keepEarlyRestore, restoreAction } from "./restore.js";
 import { PAIR, setBadgeMode } from "./participant_names.js";
+import { isParticipantAuthor } from "./participant_model.js";
 
 export function createStreamHandlers(deps) {
   const {
@@ -163,12 +164,13 @@ export function createStreamHandlers(deps) {
       // A participant's review turn: its id and author, for Apply at its end
       // (turn_completed names neither). A pair turn acted itself: no Apply.
       const author = data.author || data.origin?.author;
+      const participant = isParticipantAuthor(author);
       const pair = data.participant_mode === PAIR;
-      liveTurn.review = author && author !== "owner" && data.turn_id && !pair ? { turn_id: data.turn_id, author, author_name: data.author_name } : null;
+      liveTurn.review = participant && data.turn_id && !pair ? { turn_id: data.turn_id, author, author_name: data.author_name } : null;
       // Its prompt drawn while queued takes the turn's mode now.
       if (data.participant_mode) setBadgeMode(promptBubble, data.participant_mode);
       // The owner's input queues behind it (the composer's delivery line).
-      liveTurn.participantTurn = !!(author && author !== "owner");
+      liveTurn.participantTurn = participant;
       setTurnRunning(true);
       setLiveStatus("running");
       liveTurn.timing.detach();

data/lib/samagotchi/web/public/verdict_card.js

@@ -1,10 +1,23 @@
+import { ownerClaimHash } from "./claim_link.js";
+
 const TYPES = Object.freeze({
   confirmed: { icon: "✅", label: "confirmed" },
   refuted: { icon: "❌", label: "refuted" },
   unclear: { icon: "❓", label: "unclear" },
 });
 
-export function placeVerdict(root, record, { who = "Owner", author = null } = {}) {
+export const CHECK_NOT_ON_PAGE = "That check is no longer on this page.";
+
+export function ownerCheckHash(sessions, currentSessionId, checkTurnId) {
+  if (!Array.isArray(sessions) || typeof checkTurnId !== "string") return null;
+  const session = sessions.find((candidate) =>
+    candidate?.id !== currentSessionId
+    && Array.isArray(candidate.verdicts)
+    && candidate.verdicts.some((verdict) => verdict?.check_turn_id === checkTurnId));
+  return session ? ownerClaimHash(session.id, { turnId: checkTurnId }) : null;
+}
+
+export function placeVerdict(root, record, { who = "Owner", author = null, onMissingCheck = null } = {}) {
   const anchor = record?.anchor;
   const type = TYPES[record?.verdict];
   if (!root || !type || typeof anchor?.turn_id !== "string" || typeof anchor?.quote !== "string"
@@ -47,8 +60,10 @@ export function placeVerdict(root, record, { who = "Owner", author = null } = {}
   link.textContent = "View check";
   link.addEventListener("click", (event) => {
     event.preventDefault();
-    [...root.querySelectorAll("[data-turn-id]")].find((element) => element.dataset.turnId === record.check_turn_id)
-      ?.scrollIntoView?.({ behavior: "smooth", block: "center" });
+    const check = [...root.querySelectorAll("[data-turn-id]")]
+      .find((element) => element.dataset.turnId === record.check_turn_id);
+    if (check) check.scrollIntoView?.({ behavior: "smooth", block: "center" });
+    else onMissingCheck?.(record);
   });
   card.append(heading, quote, reason, link);
 

data/lib/samagotchi/web/public/verdict_fresh.js

@@ -29,7 +29,8 @@ export function settleRunning(running, record) {
 // Places a session verdict as the pages draw them: an original verdict's
 // card (verdict_card.js) with its Verify fresh part, or a fresh verdict on
 // its original's card. +fresh+: {verdicts (all of the session's), running
-// (the page's own array; a start adds to it), canStart, start(of) → Promise
+// (the page's own array; a start adds to it), errors (the page's own
+// object, check id → the last start error, so a redraw shows it again), canStart, start(of) → Promise
 // of {ok, child_id, error}, childHref(id) → a link to the child or null}.
 export function placeVerdictWithFresh(root, record, opts = {}, fresh = {}) {
   if (record?.fresh) {
@@ -43,6 +44,11 @@ export function placeVerdictWithFresh(root, record, opts = {}, fresh = {}) {
   return card;
 }
 
+// Every verdict card under +root+ drawn again from +fresh+ (the gate changed).
+export function redrawFresh(root, fresh = {}) {
+  for (const card of root?.querySelectorAll?.(".verify-verdict") || []) renderFresh(card, fresh);
+}
+
 // The card's Verify fresh part, drawn again from +fresh+: the fresh
 // verdicts, the running check, else the button (an unclear verdict, and a
 // viewer who could run a turn now).
@@ -79,6 +85,17 @@ export function renderFresh(card, fresh = {}) {
     const link = childLink(typeof run === "string" ? null : run.child_id);
     if (link) line.append(" ", link);
     part.append(line);
+  } else if (card.classList.contains("unclear") && fresh.unavailableReason) {
+    const button = doc.createElement("button");
+    button.type = "button";
+    button.className = "verify-fresh-btn";
+    button.textContent = "Verify fresh";
+    button.title = fresh.unavailableReason;
+    button.disabled = true;
+    const note = doc.createElement("p");
+    note.className = "verify-fresh-unavailable";
+    note.textContent = fresh.unavailableReason;
+    part.append(button, note);
   } else if (card.classList.contains("unclear") && fresh.canStart && fresh.start) {
     const button = doc.createElement("button");
     button.type = "button";
@@ -89,10 +106,11 @@ export function renderFresh(card, fresh = {}) {
     part.append(button);
   }
 
-  if (card.dataset.freshError) {
+  const error = (fresh.errors ||= {})[of];
+  if (error) {
     const line = doc.createElement("p");
     line.className = "verify-fresh-error";
-    line.textContent = card.dataset.freshError;
+    line.textContent = error;
     part.append(line);
   }
   if (part.childNodes.length) card.append(part);
@@ -109,12 +127,12 @@ async function startFresh(card, button, fresh) {
     result = { ok: false, error: error?.message };
   }
   if (result?.ok) {
-    delete card.dataset.freshError;
+    if (fresh.errors) delete fresh.errors[of];
     if (fresh.running && !fresh.running.some((entry) => runningOf(entry) === of)) {
       fresh.running.push(result.child_id ? { of, child_id: result.child_id } : of);
     }
   } else {
-    card.dataset.freshError = result?.error || "Couldn't start a fresh check.";
+    (fresh.errors ||= {})[of] = result?.error || "Couldn't start a fresh check.";
   }
   renderFresh(card, fresh);
 }

data/lib/samagotchi/web/public/verify_card.css

@@ -11,6 +11,7 @@
 .verify-fresh-result{font-weight:600;color:var(--text-bright)}
 .verify-fresh-running{color:var(--text-muted);font-style:italic}
 .verify-fresh-error{color:var(--danger-text)}
+.verify-fresh-unavailable{color:var(--text-muted)}
 .verify-fresh-link{color:var(--accent);font-weight:400}
 .verify-fresh-btn{font:inherit;font-size:12px;font-weight:600;padding:3px 12px;border-radius:8px;cursor:pointer;background:var(--accent-bg);color:var(--accent);border:1px solid var(--accent-border)}
 .verify-fresh-btn:hover{border-color:var(--accent)}

data/lib/samagotchi/web/public/verify_preset.js

@@ -12,6 +12,12 @@ export const VERIFY_PRESET = Object.freeze({
     + "End with a line `Verdict: confirmed|refuted|unclear — <one-line reason>`.",
 });
 
+export const VERIFY_UNAVAILABLE = "restart this session to use Verify";
+
+export function verifyWorkerUnavailable(workerFeatures, bridgeUp) {
+  return bridgeUp === true && Array.isArray(workerFeatures) && !workerFeatures.includes("verify");
+}
+
 // +presets+ (annotate_presets.js parsePresets) with Verify after them.
 export function withVerify(presets) {
   return [...(presets || []), VERIFY_PRESET];

data/lib/samagotchi/web/verify_fresh_routes.rb

@@ -33,14 +33,18 @@ module Samagotchi
       def handle_verify_fresh(req, id, of)
         clicker = principal(req).owner? ? nil : principal(req).grant
         session = @session_class.load(id, state_dir: default_state_dir)
-        if clicker && (refused = participant_cap_refusal(clicker) || fresh_worker_refusal(session))
+        if clicker && (refused = participant_cap_refusal(clicker) || fresh_worker_refusal(session, participant: true))
           return verify_fresh_refused(clicker, of, *refused)
         end
 
         by = Steer.sender_author(field_of(VerifyFresh.original(session.verdicts, of), :by))
         runner = by ? verdict_author_grant(id, by) : clicker
         return author_link_ended(clicker, id, of, by) if by && runner.nil?
-        if runner && runner != clicker && (refused = participant_cap_refusal(runner) || fresh_worker_refusal(session))
+        if runner && runner != clicker && (refused = participant_cap_refusal(runner) ||
+                                                   fresh_worker_refusal(session, participant: true))
+          return verify_fresh_refused(clicker, of, *refused, runner: runner)
+        end
+        if (refused = fresh_worker_refusal(session))
           return verify_fresh_refused(clicker, of, *refused, runner: runner)
         end
 
@@ -76,12 +80,13 @@ module Samagotchi
 
       def field_of(record, key) = record && (record[key] || record[key.to_s])
 
-      # A live worker of the session that predates participants' turns runs
-      # no participant's turn (Delivery::REVIEW_UNAVAILABLE): no fresh
-      # child for one either. nil to go on.
-      def fresh_worker_refusal(session)
+      # A live worker must support VerifyFresh's parent checks. For a
+      # participant's child it must also have the review boundary.
+      def fresh_worker_refusal(session, participant: false)
         features = ParticipantMode.live_features(session, default_state_dir)
-        return nil if features.nil? || features.include?(Delivery::REVIEW_FEATURE)
+        return nil if features.nil?
+        return [409, VerifyAnchor::UNAVAILABLE["error"], VerifyAnchor::UNAVAILABLE["detail"]] if VerifyAnchor.worker_unavailable?(features)
+        return nil unless participant && !features.include?(Delivery::REVIEW_FEATURE)
 
         [409, Delivery::REVIEW_UNAVAILABLE["error"], Delivery::REVIEW_UNAVAILABLE["detail"]]
       end

data/lib/samagotchi/worker.rb

@@ -168,6 +168,10 @@ module Samagotchi
       @loop_started = false
       @left_loop = false
       @signal_mutex = Mutex.new
+      # The exit being taken or taken (:exit, :delete, :restart), claimed
+      # under its own lock before #exit_request's slow stop-all (#claim_exit).
+      @exit_claim = nil
+      @exit_claim_mutex = Mutex.new
       @grace_expired = false
       # The running turn has ended (its end event) and its after_turn hooks
       # run: a signal's grace waits for them (#signalled).
@@ -1583,41 +1587,89 @@ module Samagotchi
     def exit_request(client_id, delete: false, restart: false, stop: false, ask: true)
       # The Bridge serves before the idle-exit policy exists.
       return WorkerIdleExit::Hold.new(reason: :starting) unless @idle_exit
-      # One exit is already taken: the first one decides how the worker
-      # leaves (a later stop-all can't turn a restart, whose reminders go to
-      # the next worker, into a plain exit). Held at the leave, it is
-      # forgotten and the next request counts again.
-      return nil if @exit_requested
 
-      if restart
-        hold = @idle_exit.hold_for_restart
-        return WorkerIdleExit::Hold.new(reason: hold) if hold
-      else
-        # /exit names the tasks it waits for (D3), from the one look that found them.
-        # The ask covers the delegate children too, but only for a plain /exit: an
-        # exit that deletes the session, or one a UI won't ask about, ignores them.
-        hold = @idle_exit.request_hold(requester: client_id, hint: TASK_STOP_HINT, ask: ask && !delete)
-        if hold
-          # A hold the user can't stop here: no ask, today's refusal.
-          return hold unless hold.ask?
-          # The ask's 409: the list, for the terminal to ask with.
-          return hold unless stop
-
-          @stopped_holds = @hold_stop.stop_all
-          # An unstoppable hold may have arrived while stopping (a child stopped
-          # here is no longer counted).
-          recheck = @idle_exit.request_hold(requester: client_id, hint: TASK_STOP_HINT)
-          return recheck if recheck
-        end
+      kind = if restart then :restart
+             elsif delete then :delete
+             else :exit
+             end
+      # One exit at a time, and the first one taken decides how the worker
+      # leaves (a later stop-all can't turn a restart, whose reminders go to
+      # the next worker, into a plain exit): claimed before the slow
+      # stop-all, so a request of another kind meanwhile is refused (409),
+      # not told it went through. Held at the leave, it is forgotten and the
+      # next request counts again.
+      refused = claim_exit(kind)
+      return refused.value if refused
+
+      hold = exit_hold(client_id, kind: kind, stop: stop, ask: ask)
+      if hold
+        forget_exit
+        return hold
       end
 
       @stopped_holds = nil unless stop
-      @exit_requested = true
       @exit_requested_by = client_id
-      @exit_deletes = delete && !restart
-      @exit_restart = restart
+      @exit_deletes = kind == :delete
+      @exit_restart = kind == :restart
+      @exit_requested = true
       @waker.wake
       nil
+    rescue StandardError
+      # A look or a stop that raised lets the claim go (the Bridge answers 500).
+      forget_exit unless @exit_requested
+      raise
+    end
+
+    # One answer for an exit request that doesn't get the claim, boxed so a
+    # nil (accepted) is told apart from "claimed".
+    ExitRefused = Data.define(:value)
+
+    # @return [ExitRefused, nil] nil when this request now holds the claim;
+    #   else its answer: nil (accepted: an exit of the same kind is already
+    #   taken) or WorkerIdleExit.leaving (one of another kind is, or is still
+    #   being taken)
+    def claim_exit(kind)
+      @exit_claim_mutex.synchronize do
+        next ExitRefused.new(value: nil) if @exit_claim == kind && @exit_requested
+        next ExitRefused.new(value: WorkerIdleExit.leaving(@exit_claim)) if @exit_claim
+
+        @exit_claim = kind
+        nil
+      end
+    end
+
+    # The taken exit is let go: held at the leave, or its hand-off failed.
+    def forget_exit
+      @exit_claim_mutex.synchronize do
+        @exit_requested = nil
+        @exit_restart = false
+        @exit_claim = nil
+      end
+    end
+
+    # What keeps the worker up for this request, nil when nothing does; a
+    # stop request stops what the user can stop first (#exit_request).
+    # @return [WorkerIdleExit::Hold, nil]
+    def exit_hold(client_id, kind:, stop:, ask:)
+      if kind == :restart
+        hold = @idle_exit.hold_for_restart
+        return hold && WorkerIdleExit::Hold.new(reason: hold)
+      end
+
+      # /exit names the tasks it waits for (D3), from the one look that found them.
+      # The ask covers the delegate children too, but only for a plain /exit: an
+      # exit that deletes the session, or one a UI won't ask about, ignores them.
+      hold = @idle_exit.request_hold(requester: client_id, hint: TASK_STOP_HINT, ask: ask && kind != :delete)
+      return nil unless hold
+      # A hold the user can't stop here: no ask, today's refusal.
+      return hold unless hold.ask?
+      # The ask's 409: the list, for the terminal to ask with.
+      return hold unless stop
+
+      @stopped_holds = @hold_stop.stop_all
+      # An unstoppable hold may have arrived while stopping (a child stopped
+      # here is no longer counted).
+      @idle_exit.request_hold(requester: client_id, hint: TASK_STOP_HINT)
     end
 
     # #leave_idle for an exit a client asked for: check again with the event
@@ -1636,8 +1688,7 @@ module Samagotchi
                    @idle_exit.hold_for_request(requester: @exit_requested_by, streams: false)
                  end
           if hold
-            @exit_requested = nil
-            @exit_restart = false
+            forget_exit
             Log.info(:worker, "exit_held", reason: hold)
             next false
           end
@@ -1666,8 +1717,7 @@ module Samagotchi
       end
       true
     rescue StandardError => e
-      @exit_requested = nil
-      @exit_restart = false
+      forget_exit
       Log.warn(:worker, "reminders_carry_failed", error: e.class.name, msg: e.message)
       false
     end

data/lib/samagotchi/worker_idle_exit.rb

@@ -39,6 +39,23 @@ module Samagotchi
       def ask? = !holds.empty?
     end
 
+    # The 409 reason for an exit request when another client's exit, of
+    # another kind, is already taken (Worker#exit_request): the first one
+    # decides how the worker leaves, so a restart asked after a plain /exit
+    # is refused rather than told "restarting".
+    LEAVING = { exit: :leaving_exit, delete: :leaving_delete, restart: :leaving_restart }.freeze
+    # What each of those says, for every client's refusal line
+    # (TerminalUI::ExitLines, SessionManager::RestartRefused).
+    LEAVING_WORDS = {
+      leaving_exit: "the worker is already leaving as a plain exit",
+      leaving_delete: "the worker is already leaving as an exit that deletes the session",
+      leaving_restart: "the worker is already leaving as a restart"
+    }.freeze
+
+    # @param kind [Symbol] the exit already taken (:exit, :delete or :restart)
+    # @return [Hold] the refusal for a request of another kind
+    def self.leaving(kind) = Hold.new(reason: LEAVING.fetch(kind))
+
     # One kind of hold the exit ask offers to stop: +kind+ (:reminders,
     # :background_tasks or :delegates) and its +items+ (#HoldItem). The 409's
     # +holds+ is this in JSON: `{kind:, items: [{id:, label:, detail:}]}`.

data/lib/samagotchi/worker_link.rb

@@ -121,7 +121,7 @@ module Samagotchi
     # @param owner [OwnerLock::Owner, nil, :read] the lock's holder as the
     #   caller already read it (nil: free); :read reads it here
     # @return [Live, Starting, Leaving, None, Stale, Skew]
-    def resolve(session_dir, unlink:, owner: :read, host: BridgeClient::HOST)
+    def resolve(session_dir, unlink:, owner: :read)
       owner = OwnerLock.owner(session_dir) if owner == :read
       stamp = file_stamp(session_dir)
       sidecar = WorkerSidecar.read(session_dir)
@@ -136,7 +136,7 @@ module Samagotchi
 
     # @return [BridgeClient, nil] a client for the session's Live worker
     def client(session_id, session_dir:, unlink: true, host: BridgeClient::HOST, read_timeout: BridgeClient::READ_TIMEOUT)
-      link = resolve(session_dir, unlink: unlink, host: host)
+      link = resolve(session_dir, unlink: unlink)
       link.live? ? link.client(session_id, host: host, read_timeout: read_timeout) : nil
     end
 
@@ -152,11 +152,11 @@ module Samagotchi
     # @return [Live, Starting, Leaving, None, Stale, Skew] the outcome it
     #   stopped at, else the last one seen
     def await(_session_id, session_dir:, timeout:, unlink: true, interval: BridgeClient::SPAWN_POLL_INTERVAL,
-              until: nil, give_up: nil, host: BridgeClient::HOST)
+              until: nil, give_up: nil)
       wanted = binding.local_variable_get(:until) # a keyword: no plain read
       last = nil
       found = BridgeClient.poll(timeout, interval: interval) do
-        last = resolve(session_dir, unlink: unlink, host: host)
+        last = resolve(session_dir, unlink: unlink)
         last if (last.live? && (wanted.nil? || wanted.call(last))) || give_up&.call(last)
       end
       found || last
@@ -189,7 +189,15 @@ module Samagotchi
     def unowned(session_dir, sidecar, owner, stamp, unlink)
       return None.new(owner: owner) unless sidecar
 
-      unlink_unchanged(session_dir, stamp) if unlink
+      if unlink
+        # A worker that took the lock and wrote its sidecar since the lock
+        # was read (before the stamp): its fresh file is the one stamped, so
+        # read the lock again just before the unlink, and take that worker.
+        fresh = OwnerLock.owner(session_dir)
+        return resolve(session_dir, unlink: false, owner: fresh) if fresh&.worker?
+
+        unlink_unchanged(session_dir, stamp)
+      end
       Stale.new(sidecar: sidecar, reason: :lock_free, owner: owner)
     end
     private_class_method :unowned