samagotchi 0.134.0 → 0.135.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1400c2aa3cceb5a84b6aa0d5610021b5e5893415afa37f98e8c99efe291de436
-  data.tar.gz: eda23134194381fd10460ba0b026ae10aa5a8aaf674fbc9dc4504359b1acb86d
+  metadata.gz: 93a0efdc96f935536f82621c8c70c078cf4d89a9a88ce2a6881b77a9e545de30
+  data.tar.gz: c8fd5b64ba27f5ad4d83369f58990cc53d449f6eb498050f32e2199216fcb9b6
 SHA512:
-  metadata.gz: 7029cb713c02b4c3099ade377bc57618ec6467c2a1f04a4b21c7ebd3fbb6e34705e1ad54fe547672becdc6553824b785c96222e310690fd707a12c0fb057e852
-  data.tar.gz: e7400f091254ba9ffdf04f14160e8d6816cbe264016f8be8558c9da091edcc33bf34ed93652c83b6647be728a349b31631db49fc26e483280deda75a7658e5e3
+  metadata.gz: 478a7f90b5f012fa5c26cc571743191dc78550b9227880d01957e922606f495f35a6d4f4e6dba65fe2edacc0274fb57a48b67377efd704ea7f4034e0a03c1bb0
+  data.tar.gz: 66e0a258aa80f18ddbee8d40430c77f19b74dc0b335a889379e795f3e38e21282ec283018b63563318e3b9fb03ee170143ae1e68ca1131fce923422d3ddeb248

data/CHANGELOG.md

@@ -7,6 +7,53 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.135.0] - 2026-10-30
+
+### Added
+
+- Web: Revise on a finished answer: your next message rewrites it, and once that turn completes the earlier version
+  folds in place to one stub row ("v1 · its first line · N lines — superseded by v2", a click unfolds it); the newest
+  answer's "v2 · 1 earlier ▾" chip lists the versions by their prompts. Stacks show on every owner's page, live and
+  after a reload.
+
+### Changed
+
+- Guardrails: a file or string check (`test -f x`, `[ -d dir ]`, `[ "$a" = b ]`) counts as read-only, so
+  `test -f x && cat x` no longer asks where `cat x` alone wouldn't.
+
+### Removed
+
+- Web: the turn view (`web.view: turn`, `chi web --web-view`, `SAMAGOTCHI_WEB_VIEW`, `?view=`): the stage is the only
+  view; finished turns still show as blocks of steps in the history. A config.yml that still sets `web.view` warns
+  about an unknown key; a chi web started with `--web-view` doesn't come back from an Update restart (start it again
+  without the flag).
+
+### Fixed
+
+- Web: opening another session clears the previous one's init row, markdown tip and card actions at once; they no
+  longer stayed when the open failed.
+- Web: a canceled turn's timing shows in the info bar right away, not at the next unrelated redraw.
+- Web: the info bar follows a terminal taking the open session (its Continue and Stop, the title's ✎) at once, not at
+  the hub's next event.
+- Web: Verify fresh on a verdict's card says it's unavailable as soon as the open session's worker goes, not at the
+  hub's next event.
+- Web: a turn's end no longer shows the session idle while the next queued turn already runs (its late re-read wrote
+  the stored "idle" over "running").
+- Web: a sign-in that lapsed behind an auth proxy is reported (the sign-in prompt) by the notification bell and the
+  push devices list too.
+- Pair turns: a program is judged by its name in any case, as macOS's disk runs it: `GIT config …`, `CHI share`,
+  `NOHUP`, `PRINTENV` or `Bash -c` are refused like their lower-case names (System 1's memories exemption reads
+  `MAKE` or `RUBY x.rb` the same way). More spellings that hid a command are caught: fish's `--command S` and
+  `-C`/`--init-command S`, `PROMPT_COMMAND` and a `$(…)` kept in a value bash expands later (`PS4='$(…)' bash -x`),
+  the program behind `xcrun`, `arch`, `script`, `builtin`, `uv run`, `pnpm exec`, `bunx` and a wrapper's value option
+  (`env -u X`, `sudo -u root`), the command lines `env -S`, `ssh -o ProxyCommand=`, `hyperfine` and `parallel` run,
+  `php -B/-R/-E`, `perl -de`, `jruby`/`raku`/`julia -e`. git or chi behind a program chi doesn't know
+  (`some-runner git config …`, `chronic chi share x`) and a `$(…)` kept in a value now ask you (refused when what it
+  runs reads as git config or chi). `git add maintenance start` no longer asks you; `git lfs update` does.
+
+Update with `chi update`, then restart `chi web` (without `--web-view`) and the session workers (`chi sessions
+restart`). `chi home doctor` says what else to do.
+
 ## [0.134.0] - 2026-10-30
 
 ### Added
@@ -5143,7 +5190,8 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.134.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.135.0...HEAD
+[0.135.0]: https://github.com/dm1try/samagotchi/compare/v0.134.0...v0.135.0
 [0.134.0]: https://github.com/dm1try/samagotchi/compare/v0.133.0...v0.134.0
 [0.133.0]: https://github.com/dm1try/samagotchi/compare/v0.132.0...v0.133.0
 [0.132.0]: https://github.com/dm1try/samagotchi/compare/v0.131.0...v0.132.0

data/bin/chi

@@ -234,7 +234,7 @@ if options[:dir]
   exit 2
 end
 
-# `chi web`: its flags (--port, --open, --web-view…) went through the parser above.
+# `chi web`: its flags (--port, --open…) went through the parser above.
 options[:web] = true if web
 
 # The first interactive start of a new installed chi says what `chi update` would update.
@@ -253,9 +253,8 @@ if options[:web]
   port = options[:web_port] || Samagotchi::Config.get("web.port")
   markdown = options[:web_markdown]
   markdown = Samagotchi::Config.get("web.markdown") if markdown.nil?
-  view = Samagotchi::Config.get("web.view")
   exit Samagotchi::Web::Server.launch(port: port, scope: options[:scope] || "project", open_browser: options[:web_open],
-                                      markdown: markdown, view: view, new_token: options[:new_token], tunnel: options[:tunnel],
+                                      markdown: markdown, new_token: options[:new_token], tunnel: options[:tunnel],
                                       working_set: Samagotchi::Config.get("web.working_set"),
                                       annotate_presets: Samagotchi::Config.get("web.annotate_presets"),
                                       editor: Samagotchi::Config.get("web.editor"),

data/docs/architecture.md

@@ -236,6 +236,9 @@ agent logic and can be used without any terminal rendering; the UI is a thin lay
   run's own prompts until their turns end; `#run` distinguishes an empty answer from a
   prompt this terminal removed before it ran (both exit 1), as well as chi's other outcomes.
   Without a capable terminal it falls back to `PlainSurface` (append-only).
+- The browser's page (`lib/samagotchi/web/public/`: `app.js` for the owner, `participant.js` for a participant) is a
+  client of chi web: where its state lives, which redraw follows which write, its render idioms, stale-answer guards,
+  storage keys and streams are in [internals/web-frontend.md](internals/web-frontend.md).
 
 #### Using the core
 
@@ -532,16 +535,16 @@ The page's frequent reads of `GET /api/sessions/:id` stay light too:
   (`turn_model.js` `questionRefs`) before the card draws, so the stage's asking slot (`stage_slots.js`
   `drawAsking(text, refs)`) pairs them on its raw draw and again after its markdown swap; the card pairs its
   question text and its kept reply (`question_cards.js`); the step's closed `.gen-text` takes them
-  (`turn_view.js`; on a reload its `data-answer-at`, the message's `display_refs`) and `linkTextRefs` pairs it at
+  (`turn_block.js`; on a reload its `data-answer-at`, the message's `display_refs`) and `linkTextRefs` pairs it at
   the turn's end and after a reload. A closed step's text is markdown too with `web.markdown` on: a reload's
-  from its message's `html` (`turn_view.js` `textTemplate`), a live turn's from `POST /api/render` on its step's
+  from its message's `html` (`turn_block.js` `textTemplate`), a live turn's from `POST /api/render` on its step's
   first open after the turn's end (`markdown_place.js` `renderStepTexts`, which pairs its refs again after the
   swap); the text as written stays on it as `data-copy-source` (`stepText`, a reloaded card's kept reply). A file ref outside the
   session's folder is dropped, as a reload drops it: the folder `/tail` names, else (an older worker) the hub's
   session list entry's, else (refs to check, no hub entry) the session file's; with no folder known at all, every
   file ref is dropped rather than shown unchecked.
   A plugin tool's row refs (`refs`, `RowRefs`) ride its tool events and, on a reload, its part (saved as
-  `tool_refs`); `turn_view.js` binds them to the row's title (`refs.js bindRowRefs`: the first on the title,
+  `tool_refs`); `turn_block.js` binds them to the row's title (`refs.js bindRowRefs`: the first on the title,
   the others in its menu).
 - `?timing=1`: the whole timing (`analytics.json` merged with the worker's `/state`) and
   `turn_count`, when the page's merge came up short.

data/docs/cli.md

@@ -17,7 +17,6 @@
 - `chi web --tunnel tailscale` — the Web UI over https on your tailnet, for your phone anywhere: Tailscale Serve (never Funnel) on this machine's `<machine>.<tailnet>.ts.net` name for this run, the owner your Tailscale login, turned off on exit (see [Tailscale Serve](configuration.md#tailscale-serve-your-tailnet)); `--tunnel` without `web` exits 2
 - `chi web push ls [--format json]`, `chi web push rm ID`, `chi web push test [ID]` — the phones chi web pushes to (see [Phone notifications](configuration.md#phone-notifications-web-push)): list them (short id, label, origin, added, last delivery, done turns, last error; `stale` for one made on another public URL than chi web's now: never sent to), remove one, or send a test notification to ID or to every device not stale. chi web need not run; nothing printed holds a device's push address or keys. A usage error exits 2; a store others can read, a corrupt one, an unknown device or a failed test push exit 1. This machine only: `chi --remote X web push` exits 2
 - `chi web --web-markdown` — opt in to sanitized Markdown rendering for completed assistant messages, the stage's asking text and a resolved question card's reply
-- `chi web --web-view turn` — draw turns with the turn view (each turn as one block of steps, the running one at the bottom of the history) instead of the default stage view (the running turn pinned above the composer); `?view=stage|turn` on the page URL overrides it (see [Web views](#web-views))
 - `chi web --no-web-working-set` — turns the stage view's working set off (on by default; `--web-working-set` turns a config's `web.working_set: false` back on): what each turn brought into the model's context, in the stage and under each finished turn; `?working_set=1|0` on the page URL overrides it (see [The working set](#the-working-set))
 - `chi sessions list|stop|restart|archive|unarchive|delete|prune|clean|stats` — manage persisted sessions; `list` shows this git project's, `list --scope=all` every one, a delegated session with `↳ <parent>`, `list --archived` the archived ones too (see [Sessions](sessions.md)). `stats ID` prints a session's cost, tokens and progress, and its own settings (`--set`; a `settings:` line), from a live worker's `GET stats`, else its saved `analytics.json` (`--format json` one object, with `settings`), without running a model turn. A usage error (an unknown subcommand or flag, a flag missing its value, `stop`, `restart` or `delete` with no ids, a bad `list --format` or `--scope`, a `--days`, `--keep` or `--limit` that isn't a whole number) exits 2; an unknown or refused session exits 1
 - `chi note [--source NAME] [-m TEXT] (ID|PREFIX)... | --all` — add a context note (TEXT or stdin) to sessions: background the model sees on its next turn; it starts no turn (see [Sessions: Context notes](sessions.md#context-notes))
@@ -1037,29 +1036,31 @@ the keys of sessions gone from the list are dropped when the list loads);
 other viewers and the participant page are not affected. A jump into a
 folded answer (a claim link, say) unfolds it for that page load.
 
-### Web views
-
-`web.view` picks how the page draws a turn: `stage` (the default: the
-running turn pinned above the composer, below) or `turn` (each turn as one
-block of steps in the history, the running one at the bottom, below).
-
-```sh
-chi web --web-view turn      # stage is the default
-```
-
-The setting also supports `SAMAGOTCHI_WEB_VIEW=turn` or the global config:
-
-```yaml
-web:
-  view: turn
-```
-
-`?view=stage` or `?view=turn` on the page URL picks the view for that page
-load, whatever the config says; the parameter is dropped when you switch
-between the project and all-sessions views. The terminal UIs are not
-affected.
-
-**The stage view** pins the running turn above the composer, in its own
+**Revise** rewrites an answer and stacks the versions. A finished turn's
+final answer has a Revise button on its bottom edge (on hover; always shown
+on a touch screen), unless it's a Verify turn's answer, a canceled or failed
+turn's partial answer, or an earlier version in a stack. Revise arms the
+composer with a chip, "Revising: ‹its first line› ✕"; your next message (say
+"cut it shorter") is sent as a Revise of that answer. ✕, emptying the box or
+opening another session lets go of it. When the Revise turn completes with an
+answer, the earlier version folds where it was into one stub row,
+"▸ v1 · “its first line” · 84 lines — superseded by v2": its prompt, its
+steps and its answer, all behind it (a warn card, a verdict card and the
+recap stay on view). Click the stub to unfold that version in place (kept per
+browser, with the folded answers); a time divider between two folded stubs
+moves into the later stub. The newest version has a chip, "v3 · 2 earlier ▾",
+listing every version by its prompt; pick one to jump to its stub. Revise
+again on the newest version adds to the stack. Stacks are session data (the
+stamp is on the Revise prompt, see [sessions.md](sessions.md), Revise
+stacks): every owner's page shows them, live and after a reload; the
+participant page doesn't draw them yet. A session whose worker predates
+Revise (started by an older chi) disables the button and shows the chip as
+"Revise: restart this session to use Revise"; a message sent then is a plain
+one. A Revise turn that fails comes back into the composer with its chip.
+
+### How the page draws a turn
+
+**The stage** pins the running turn above the composer, in its own
 card, so it stays on screen without scrolling: a status row (what it is
 doing, the step, the elapsed time), your prompt on one line, the newest
 narration sentence (else the newest thinking one, in italics; click it for
@@ -1078,8 +1079,8 @@ stage's bottom edge takes you to it. Once answered, the model's
 question or its own approval keeps that reply (a delegate's relayed
 approval, a hook's question and the step limit don't): two muted lines
 under its `question → answer` line, the whole text when you open the card,
-in both views and after a reload. The chip at the stage's bottom edge, `N steps · M tool
-calls` with one tick per call, opens the turn view's block right above it (newest step first
+live and after a reload. The chip at the stage's bottom edge, `N steps · M tool
+calls` with one tick per call, opens the turn block right above it (newest step first
 while it runs; a tick opens its step). Below the chip, past a dashed rule, wait the
 messages queued for after the turn and the commands queued for its end; they go into
 the history after the turn's answer. `▾` folds the stage to its status
@@ -1094,10 +1095,11 @@ message moves it at once. The history is never scrolled while a turn runs, and o
 follows the hand-off if you were at its end. The `/` command list opens
 over the stage's lower edge.
 
-**The turn view** shows a turn as *one block* where the work
-happens. The running
-generation is the live part at the bottom (its thinking, its narration, its
-tool rows), the earlier ones stack above it collapsed to one line each
+**The turn block** shows a turn's work as *one block*: in the stage's cloud
+while the turn runs (newest step first), in the history after the hand-off
+and on a reload. The running
+generation is the live part on top (its thinking, its narration, its
+tool rows), the earlier ones below it collapsed to one line each
 (their narration's first line, else their first call's title such as
 `edit lib/a.rb`, and a call count), expandable for inspection. A tool row
 says what the call did: a file's path relative to the session's folder, a
@@ -1116,8 +1118,8 @@ first line, so a mid-turn note reads without a click), and each run of steps
 that only called tools or thought sits behind one `· N steps` line that
 shows them; old turns open the same way after a reload. A turn whose steps
 said nothing collapses the block to its summary (`3 steps
-· 8 tool calls · execute ×7 · read ×1`). Either way the answer expands from
-the box into a normal bubble under it (Markdown, annotate). A plain answer
+· 8 tool calls · execute ×7 · read ×1`). Either way the answer is a normal
+bubble under the block (Markdown, annotate). A plain answer
 without tools ends exactly as it does today. Rows the code collapses stay
 as you toggled them. A reloaded session shows the same block
 from the saved messages (each step's thinking, narration, tool parameters
@@ -1130,7 +1132,10 @@ steps saved before that have none, so they show no thinking. An `edit` or
 made (up to 120 lines or 8 KB), live and after a reload (see
 [Guardrails](guardrails.md#ask) for the diff an approval shows first).
 
-**When things happened**, in both views and on a participant's review page: where 10 minutes or
+`web.view`, `chi web --web-view`, `SAMAGOTCHI_WEB_VIEW` and `?view=` were removed with the turn view (the
+stage is the only view; a config.yml that still sets `web.view:` warns about an unknown key).
+
+**When things happened**, on the owner's page and on a participant's review page: where 10 minutes or
 more of quiet passed between the end of one activity and the start of the next (a turn, a context
 note, a reminder), the history has one dim centred line, `── 14:32 · 47 min later ──`; the date is
 added when the day changed or the turn wasn't today (`── Sat 24 Oct 09:10 · 13 h later ──`).
@@ -1147,7 +1152,7 @@ it read, edited or wrote, the memories it read or wrote and the URLs it
 fetched. It is on by default; `web.working_set: false` (or `chi web
 --no-web-working-set`, `SAMAGOTCHI_WEB_WORKING_SET=false`; `?working_set=0` on
 the page URL for one page load, `?working_set=1` back on) turns it off, and the
-session bar shows the `mem N` chip again. The turn view ignores it.
+session bar shows the `mem N` chip again.
 
 - **The rail**, on the right of the stage's live slots: the running turn's set
   in four lines, folded as it grows (files under one folder become

data/docs/configuration.md

@@ -2184,8 +2184,7 @@ column says so, a `--kebab-name` flag. The maps (`hosts:`, `models:`,
 | `web.port` | `4567` | `--port` | `chi web`'s port. See [CLI](cli.md). |
 | `web.host` | `127.0.0.1` | yes | `127.0.0.1`, `::1` or `localhost`; `lan` (this machine's private IPv4 address) or one of its IPv4 addresses also opens `chi web` to the network, with an access token, asked of this machine's 127.0.0.1 too (its `Local:` link carries a one-time code; `chi web --new-token` replaces the token). Anything else binds `127.0.0.1` with a warning. See [CLI: chi web on your phone](cli.md#chi-web-on-your-phone). |
 | `web.markdown` | `false` | yes | Render answers as Markdown in `chi web`. |
-| `web.view` | `stage` | yes | How `chi web` draws a turn: `stage` (the running turn pinned above the composer) or `turn` (one block per turn in the history). See [CLI](cli.md#web-views). |
-| `web.working_set` | `true` | yes | The stage view's working set: the files, memories and URLs a turn brought into the model's context, in a rail in the stage, a footprint line under each finished turn and a `set N` chip in place of the mem chip; `false` brings the mem chip back. `?working_set=1` or `?working_set=0` on the page URL overrides it for that page load; the turn view ignores it. See [CLI: the working set](cli.md#the-working-set). |
+| `web.working_set` | `true` | yes | The stage view's working set: the files, memories and URLs a turn brought into the model's context, in a rail in the stage, a footprint line under each finished turn and a `set N` chip in place of the mem chip; `false` brings the mem chip back. `?working_set=1` or `?working_set=0` on the page URL overrides it for that page load. See [CLI: the working set](cli.md#the-working-set). |
 | `web.annotate_presets` | `Agreed\|Could you please elaborate?` | yes | Quick replies next to Annotate in `chi web`, `\|`-separated (a YAML list works too); `""` in the file or on the CLI leaves only Annotate (an empty env value means the default). See [CLI](cli.md#web-annotate-presets). |
 | `web.editor` | `vscode` | yes | What a file ref in `chi web` (a file tool row's title, a diff line) opens, for a viewer on this machine: a preset (`vscode`, `vscode-insiders`, `cursor`, `zed`) or a URL template with `{path}` and an optional `{line}`; `none` turns refs off. See [Opening files from chi web](#opening-files-from-chi-web). |
 | `web.start_dir` | the folder `chi web` runs in | | The folder `chi web` starts in (`chi web --start-dir DIR` for one run): its page (the printed link, a bare `/`, the LAN link and QR code, the Home Screen app) opens on that folder's project, outside a repo on every session, and a new session from the all view starts there; the header's project picker switches projects. `~` and a relative path (resolved from your home folder) work; one that isn't a folder stops `chi web` from starting. `chi web` never changes its own folder. See [CLI](cli.md). |

data/docs/guardrails.md

@@ -54,6 +54,11 @@ changed: `diff +3 −1` under the row on the web (closed, it survives a
 reload) and ` +3 −1` at the end of the terminal's tool line. The model never
 sees these diffs.
 
+The card also carries the ask's facts as `approval:` (tool, command or paths, where, rule, scopes, preview…):
+`Guardrails::Approval.payload` builds them as a `Guardrails::ApprovalFacts` value, which System 1 and the parent
+checks read in the worker; the card and the session file get its `to_h`, the same hash every UI reads, and a saved
+card comes back through `ApprovalFacts.from_h` (string or symbol keys, missing fields nil).
+
 Who answers:
 
 - REPL (`chi --no-shared`, with or without `-p`): at the `? ` prompt.
@@ -516,10 +521,36 @@ own, one another interpreter runs (`ruby -e`, `python - <<EOF`) by its text
 variable a program runs through a shell (`PairCommand::COMMAND_ENV`:
 `GIT_EDITOR`, `GIT_SEQUENCE_EDITOR`, `EDITOR`, `VISUAL`, `GIT_EXTERNAL_DIFF`,
 `GIT_SSH_COMMAND`, `GIT_SSH`, `GIT_PROXY_COMMAND`, `GIT_PAGER`, `PAGER`,
-`MANPAGER`, `GIT_ASKPASS`, `SSH_ASKPASS`), as a prefix, `env`'s or `export`'s:
-read as `sh -c` would run it, for the refusals and for an outside write. A heredoc written as data (`cat`,
+`MANPAGER`, `GIT_ASKPASS`, `SSH_ASKPASS`, bash's `PROMPT_COMMAND`), as a prefix,
+`env`'s or `export`'s: read as `sh -c` would run it, for the refusals and for
+an outside write. An assigned value that keeps a `$(…)`, `${ …; }` or backticks
+as text (`PS4='$(…)' bash -x`, `PS0`, `PS1`, `$'\x24(…)'`: the shell expands it
+later), a prefix's, a bare assignment's or `export`'s (not `grep 'X=$(…)'`), is
+refused for what its `$(…)` runs (`PS4='$(git config …)'`), and otherwise the
+owner approves it (`PairBoundary::NET`: `CFLAGS='$(BASE)' make`).
+The program is found behind the wrappers (`env`, `sudo`, `timeout`, `xargs`,
+`nice`, `exec`, `command`, `builtin`, `xcrun`, `arch`, `script`'s file, `npx`,
+`bunx`, `uvx`, and two-word ones: `uv`/`poetry`/`pdm`/`hatch`/`pipx run`,
+`pnpm`/`yarn exec`/`dlx`, `npm exec`/`x`, `bun x`, `mise exec`/`x`) and their
+value options (`env -u X`, `sudo -u root`, `timeout -s KILL 5`; `xcrun -r`,
+`sudo -n` are flags). A command line a program takes as text is read as a
+command: `env -S S` (`-vS S` too), `script -c S`, `npx`/`npm exec -c S`
+(`--call`), `rsync -e S` (`--rsh`), ssh's (scp's, sftp's) `-o ProxyCommand=S`
+(`LocalCommand`, `KnownHostsCommand`: they run here), `hyperfine`'s arguments,
+`parallel`'s and `watch`'s. And as a net for a runner no list knows, any word
+but the program's (a wrapper's option value too) that names git is read as git
+from there, one naming chi before a chi command counts (`chronic chi share x`;
+not `cp bin/chi /tmp/x`), and a command line starting with git or chi is read
+as a command (`some-runner 'git config k v'`): a hit asks the owner
+(`PairBoundary::NET`), it doesn't refuse, since chi can't tell whether that
+word runs (`gh pr create --title 'git config fix'` asks too). A read stays a
+read, and a command that only reads (`rg 'git config'`) isn't netted. A heredoc written as data (`cat`,
 `tee`, `git commit -F -`) is not looked into: where it goes is checked. A
 command the checks can't read is refused, never let through on a text match.
+A program is told by its name in any case, on every disk (`GIT config`, `Chi
+share`, `/bin/SH -c`, `NOHUP`: a disk that folds case, macOS's default, runs
+them as git, chi, sh, nohup; `ShellLex.program_name`), and so is chi or git
+config in a script's text.
 
 And it **asks the owner** before a `write` or `edit` that may land outside the
 session's project root, and before a command that may write there, every time:
@@ -552,7 +583,8 @@ rule lowers it), so it comes even in auto mode. A command fails closed
   install -g`, `corepack enable`, `rustup`/`pyenv`/`rbenv`/`asdf`/`volta`/`nvm`
   installs and globals, `code --install-extension`, `gh auth`/`config
   set`/`extension install`, `launchctl` but its reading verbs, `git maintenance register`/`start`, `git
-  lfs install`, `scalar register`/`clone`; a project
+  lfs install`/`update` (git's words from its subcommand on: not `git add
+  maintenance start`), `scalar register`/`clone`; a project
   install such as `npm install` or `bundle install` and build caches don't
   count), and no shell or interpreter that reads its script from stdin: one
   on the receiving end of a pipe whatever its options (`… | sh`, `| bash -x`,
@@ -560,8 +592,10 @@ rule lowers it), so it comes even in auto mode. A command fails closed
   or with no script at all: chi can't see that script. A shell's `-e`, `-x`
   and `-o …` are flags, only `-c` (or a cluster holding it, `-ec`, `-cx`)
   hands it a script: the first word after its options (`sh -c -- S`, `bash -c
-  -x S`); an interpreter's own code flag does (`python -c`, `ruby -e`,
-  `node -e`/`-p`/`--eval=`, `perl -e`/`-E`, `php -r`), alone or in a cluster
+  -x S`), and fish's `--command S` (`--command=S`) or `-C`/`--init-command S`,
+  a command it runs first (also attached, `-C'S'`, in a cluster, `-lC S`, and
+  by a prefix fish takes, `--comm`, `--init`); an interpreter's own code flag does (`python -c`, `ruby -e`,
+  `node -e`/`-p`/`--eval=`, `perl -e`/`-E`, `php -r`/`-B`/`-R`/`-E`, `jruby`/`raku`/`julia -e`), alone or in a cluster
   (`ruby -we`, `perl -le`, `node -pe`, `python3 -Ic`, `python3 -c'…'`;
   `PairCommand.cluster_code_at`: a letter that takes the rest of the word,
   `ruby -rset`, holds no code). A script file it names (`sh
@@ -570,11 +604,15 @@ rule lowers it), so it comes even in auto mode. A command fails closed
   Accepted gaps (an accident guard for a trusted team): a script file the turn
   wrote and then runs; inline scripts read only by their text for paths
   (`find … -exec sh -c '…'`, `flock … sh -c`, `awk 'BEGIN{system(…)}'`,
-  `deno eval`); a `GIT_CONFIG_*` set by `printf -v` or `read` and exported
-  (it affects that command only); a variable outside `COMMAND_ENV` whose
-  value a program runs (`LESSOPEN`, a tool's own `*_EDITOR`); `npx -y`,
+  `deno eval`); a `GIT_CONFIG_*` or a `COMMAND_ENV` variable set by `printf -v`
+  or `read` and exported (`printf -v GIT_PAGER …; export GIT_PAGER; git log`);
+  a variable outside `COMMAND_ENV` whose value a program runs (`LESSOPEN`,
+  `BROWSER`, a tool's own `*_EDITOR`; `GIT_EXEC_PATH` runs only a file the
+  turn wrote); an interpreter no list names (as `awk`); `npx -y`,
   `npm exec`, `pnpm dlx`, `uvx`: they fetch into a cache, which doesn't count,
-  and run the package as in-project work.
+  and run the package (judged as the program) as in-project work; a wrapper's
+  value option no list names (`uv run --with x git …` reads `x` as the program;
+  the net still reads the git or chi after it).
 
 Anything else asks: `rm -rf ~/x`, `sed -i … ~/x`, `curl -o ~/x`, `dd of=~/x`,
 `touch`/`mkdir` outside, `perl -pi … ~/x`, `cd .. && make`, `cd && make`, and
@@ -726,6 +764,11 @@ checked even after the database name, and only its read/display options are
 allowed (unknown options and dot-command arguments are rejected). `gh` allows
 only `run list|view`, `pr list|view|diff|checks`, `issue list|view` and
 `repo view`; `--web`/`-w`, `gh api` and `pr checks --watch` are not read-only.
+`test` and `[ … ]` (with its closing `]`) are read-only as one check, optionally after `!`: a file or string
+test (`-e`, `-f`, `-d`, `-s`, `-r`, `-w`, `-x`, `-L`, `-h`, `-b`, `-c`, `-p`, `-S`, `-g`, `-u`, `-k`, `-O`, `-G`,
+`-n`, `-z` with one operand) or a comparison (`=`, `==`, `!=`, `-eq`, `-ne`, `-lt`, `-le`, `-gt`, `-ge`), so
+`test -f x && cat x` and `[ -d dir ] && ls dir` only read; `-a`/`-o`, `( … )`, any other operator or a missing
+operand, and `[[ … ]]` are not.
 `$(…)`, backticks, `$VAR` (other than `$HOME`, `$XDG_*`, `$TMPDIR` and `$PWD`
 at a word's start), an env prefix, `sh -c`, `xargs`, `eval`, `sudo` and the
 like make a command not read-only, as does a `task_create` `env:` that sets `BASH_ENV`, `ENV`, `CDPATH`, `IFS`,
@@ -873,6 +916,7 @@ every surface answers for the same paths):
 | in a dir: `under?` (case-folded on a folding disk; `fold: false` exact), `strictly_under?`, `within?` (root resolved too) | `PathResolve` | `under?`: ShellPaths, ReviewPaths, PairCommand, ChildBoundary, SelfProtect's words; `Outside.within?` and RmTargets' `strictly_under?` fold only when the dir exists (a missing session root keeps the case it was typed in); `within?`: ProtectedPaths, ScratchWrites, ParentApprovals, SelfProtect's paths |
 | tmp dirs and "not one the session is in" | `PathResolve.tmp_roots(session:)` (exact case) | Outside (`Outside.tmp_roots` is the list it and Targets read), RmTargets; `touches_chi?` takes all of them |
 | a shell word's `~`, `$HOME`, XDG dirs, `$TMPDIR` | `PathResolve.expand_word` | ShellPaths::Walk, ShellGitDirs; PairCommand has its own `~`/`$HOME` (`expand_tilde`) |
+| a program word's name: basename, case-folded on every disk (`GIT`, `/bin/SH`, `ſh`) | `ShellLex.program_name` / `.program?` | PairCommand, ImplicitWriters, SelfProtect's file runners, ShellGitDirs, SharedGit |
 | chi's dirs | `ChiDirs.protected` / `.touches` / `.self_protect` / `.review` | ParentApprovals, Targets, SelfProtect, ReviewPaths (`ProtectedPaths` and `ScratchWrites` get theirs from the wiring) |
 
 Left apart on purpose: `Targets.prompt_memory_path?` compares in any case on

data/docs/internals/engine.md

@@ -76,7 +76,10 @@ Engine#run_turn(session, prompt, on_event:, max_iterations:, cancel_controller:,
   │     #   messages, goes IDLE, records last_turn (enqueued_id: the turn's input, from its origin;
   │     #   a continue turn's origin carries its offer turn's, ContinueOffer#run_continue_turn),
   │     #   and :turn_completed {result, turn_summary, display_pending} or :turn_canceled
-  │     #   {cancellation_reason, cancelled_by, duration_ms} is emitted
+  │     #   {cancellation_reason, cancelled_by, duration_ms} is emitted; before the replace,
+  │     #   stamp_opening puts a Verify turn's `verify` and a completed Revise turn's `revises`
+  │     #   (re-targeted to its stack's top) on the opening message, metadata never sent, and
+  │     #   :turn_completed carries `verdict` / `revises` when there are
   │     # then the :after_turn hook (status, messages, present: the AnswerDisplay presenter,
   │     #   refs: the AnswerRefs adder)
   │     # store_answer_display (one replace of the answer: `display` and/or `display_refs`;
@@ -330,7 +333,7 @@ One iteration with tool calls:
   stored under the real path; at most `RowRefs::MAX_REFS` and `MAX_BYTES`). `ToolRowFields.for` can't build it (no plugins on a reload), so the run carries it
   as `refs:`, saved with the result as `tool_refs` (`ToolResponse::SAVED_KEYS`, never sent), and
   `MessageParts#tool_part` reads it back through `RowRefs.for_display` (checked again). The page binds them to the
-  row's title (`refs.js bindRowRefs`, from `turn_view.js` live and on a reload): the first ref on it, the rest in its
+  row's title (`refs.js bindRowRefs`, from `turn_block.js` live and on a reload): the first ref on it, the rest in its
   menu.
 - Settles an ask verdict after `:tool_call_started`, so a UI shows the tool line and then the approval.
 - Dispatches through `KernelLoop#dispatch_tool_call`, or writes the denial text. Unknown tools are answered in
@@ -545,7 +548,7 @@ Turn events (the main ones; `Events` in `events.rb` keeps the shared sets):
 | `:working_set_updated` | after `:generation_started` (the running turn's conversation, the turn's strategy) and once in `end_turn` before the end event (the kept messages), only when the set differs from the last one emitted for the session and is not empty, except one empty event when the last one had items (a rollback emptied the set): a tool-free turn emits none (`Engine#emit_working_set`); between turns `Engine#announce_working_set` announces it under the next turn's strategy (after a `/working-set` op, held behind the command's `command_ran`) | `{items: [{kind, key, state (live\|stale\|forgotten\|dropped), tokens, ops, count, first_id, pinned, has_drop}], at, adds?: [{kind, key, label}]}` (`WorkingSet`, internals/working-set.md; `adds` while the user's adds are pending) |
 | `:hook_notice` | a hook's or plugin's notify during a turn | `{hook, text, level}` (announced with `between_turns: true` outside a turn) |
 | `:guardrail_warning` | a guardrails line during a turn | `{message}` |
-| `:turn_completed` | normal end | Engine event `{result, turn_summary, display_pending}`; the Bridge's SSE frame omits `result` (answer remains in `turn_summary.output`) |
+| `:turn_completed` | normal end | Engine event `{result, turn_summary, display_pending}`, plus `verdict` (a Verify turn's recorded verdict) and `revises` (a Revise turn's stamp, `{turn_id}`) when there are; the Bridge's SSE frame omits `result` (answer remains in `turn_summary.output`) |
 | `:turn_canceled` | Stop, hook stop, Ctrl-C | `{cancellation_reason, cancelled_by?, duration_ms}` |
 | `:turn_failed` | an error | `{error_class, message, duration_ms, error_kind?, retryable?, host?, summary?}` |
 | `:answer_display` | after the after_turn hooks (observers only, not the sink) | `{display, refs?}` (display a string, or nil; refs the count of the answer's refs, only when a hook attached some) |

data/docs/internals/participants.md

@@ -583,7 +583,7 @@ message's `author_name`, `turn_started`'s, or the panel's list (`participant_nam
 A review turn proposes; the owner applies (D4, §3 Apply-as-quote). A pair turn acted itself: no Apply under it
 (`ReviewApply.review_turn?`: a participant's opening message not stamped `pair`; the route answers it
 `not_review_turn`, and its "latest" skips it). Under each participant's review turn that has a
-reply, the owner's page shows **Apply** (`review_apply.js`; drawn by the history render, `turn_view.js`, and at a live
+reply, the owner's page shows **Apply** (`review_apply.js`; drawn by the history render, `turn_block.js`, and at a live
 turn's end from its `turn_started`'s turn id and author, in the stage while the stage holds the turn; a full-width
 button on a phone). It reads `GET …/apply?turn=T` and puts the answer in the composer, after whatever is typed there,
 never sent: the owner reads it, edits it, sends it or not. While the composer holds it (`deliveryControl.hold()`,