samagotchi 0.136.1 → 0.138.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5dbc0c078bedf4518127ba59fef2277480193f98de99dcbd8983bb79a3802d2
-  data.tar.gz: e352d50d3b09a5e2f2a3ddd8dda3b79461e76c7e4743c306fc885e78fa670100
+  metadata.gz: 57a409114b8194ae2d17416055b7f52c468e6a2ab5a650d8f36a4b6a0e0b0b3f
+  data.tar.gz: 78f20cbc62ab65e54c300bad75ec2478388810c1328679c3c48d3842f80cc0a3
 SHA512:
-  metadata.gz: c48493b22b5916b579d1f1fd386f0169f8a26ea71a29f5c77a567045e422f115b8b3ec421cb6f0499e0fc584da7e08840eeebf2650ad5d9bd75a61c41dc34c89
-  data.tar.gz: b9e9e2c78d869fe803ac6dbf54fcacc305b60c4b4ccd354d78b0967d340ad54cbf3f18357bb24c26050d96e4cff3899e90755857979fd9ec6680cc9fd730f46a
+  metadata.gz: e285adda4382592d1cca2811e05eebdc5999d5808fc0f23a0ff7f73a87db6b4cbb504cbc43647feab56db006b66c7439d075398ef2a8eae6339bae3d42824887
+  data.tar.gz: c796ce3b9121c74bf838959f4f1ea97b9213930bd449922f42f617afab92c8eb38f685b7098f9c67c4d20ab1622e51b7fbed99de24a71964159fa892ecec827f

data/CHANGELOG.md

@@ -7,6 +7,61 @@ and commands may change between minor versions. How releases are made:
 [docs/releasing.md](docs/releasing.md).
 ## [Unreleased]
 
+## [0.138.0] - 2026-10-30
+
+### Changed
+
+- Web: All sessions' header is the top bar: the sessions pill shows pressed in the all view and takes you back (Esc
+  too); the search is a pill, "archived" a toggle chip, the count reads "4 · 5 delegates", the storage path a footer
+  under the list.
+- Web: session cards show one mark per state and no status dots: a waiting card a warn outline and "question", an
+  error a red badge, "live" only when not waiting; titles one line; an untitled session reads "Untitled" over its
+  first message.
+- Web: Stop turn is a button in the running turn's status row (the composer's and the bar's Stop buttons are gone);
+  after a reload that knows only that a turn runs, the stage shows that row alone.
+- Web: the session bar reads in three groups (setup, relations, telemetry) with hairlines between, on one line on
+  a desktop; the parent chip reads "↑ id", the clock "7m 52s"; continue is a plain button unless archived.
+- Web: the start composer keeps model, ⚙ and 🧰 left and 🖼 and Start right; the keyboard hint shows under the
+  placeholder only while the box is focused and empty.
+- Web: the "+ URL" chip is gone (`chi context` still attaches URLs).
+- Web: on a phone a tap no longer leaves a hover tint on a card, a bar button, a question option or a fold.
+
+### Fixed
+
+- Web: on a phone the sessions search takes a whole line, so its placeholder reads; the start page keeps the
+  project chip's words.
+- Web: a session with no turn yet shows no clock, not "0ms".
+- Web: the cards' shadow is no longer cut into a band at the sessions list's edges (light theme).
+
+Update with `chi update`, then restart `chi web`.
+
+## [0.137.0] - 2026-10-30
+
+### Changed
+
+- Web: a Revise stack's top answer has a ‹ N/M › switcher that shows an earlier version in its place (view only;
+  Copy copies the version shown; a reload shows the latest).
+- Web: a long prompt folds like a long answer (same threshold, open by default; this browser remembers the fold).
+- Web: every popover behaves like the ⚙ panel: a modal dialog (Tab stays in it, Esc gives focus back to its chip),
+  and on a phone a tap no longer leaves a hover tint.
+- Web: a delegate report's code blocks get copy buttons, like an answer's. On a phone or touch screen a code
+  block's copy button sits in a strip above the first line, not over it.
+- Web: a phone's session bar shows ⚙ on first view, right after the status.
+- Web: the open ⚙ panel's running-turn note follows a turn starting or ending.
+- Web: a markdown delegate report in the running turn's stage reads as one plain row.
+- A Verify or Revise sent during a running turn always queues behind it (it no longer cuts the model's thinking
+  for a line that waits anyway); the page says it queues.
+- Guardrails: a write to the chi shim asks, and only you can allow it, like home.json. A pair turn's plugin tool
+  call that names no command or path asks the owner.
+
+### Fixed
+
+- Web: other viewers of a Verify turn no longer see a Revise offer on its answer until they reload.
+- Web: a stale `?view=` (the removed turn view's) leaves the address bar.
+- Desktop: the helper checks the chi home the helper's chi actually reads.
+
+Update with `chi update`, then restart `chi web`.
+
 ## [0.136.1] - 2026-10-30
 
 ### Changed
@@ -5230,7 +5285,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.136.1...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.138.0...HEAD
+[0.138.0]: https://github.com/dm1try/samagotchi/compare/v0.137.0...v0.138.0
+[0.137.0]: https://github.com/dm1try/samagotchi/compare/v0.136.1...v0.137.0
 [0.136.1]: https://github.com/dm1try/samagotchi/compare/v0.136.0...v0.136.1
 [0.136.0]: https://github.com/dm1try/samagotchi/compare/v0.135.0...v0.136.0
 [0.135.0]: https://github.com/dm1try/samagotchi/compare/v0.134.0...v0.135.0

data/docs/architecture.md

@@ -258,10 +258,10 @@ higher-level events so UIs get clean turn boundaries without inferring them:
 - `:turn_started` — `{ session_id:, prompt:, turn_id:, cut_after: }` (`cut_after`: the seconds a cut waits for this
   model's thinking, `0` = never; plus `continue: true` for a continue turn, `resumed: true` for a step-limit Continue,
   `images:` with the prompt's image refs)
-- `:turn_completed` — `{ result:, turn_summary:, display_pending: }` (`result`: the final
+- `:turn_completed` — `{ turn_id:, result:, turn_summary:, display_pending: }` (`result`: the final
   `LLM::ModelResult`; Engine event (clients get it without `result`); `display_pending`: `after_turn` hooks may still
   present the answer)
-- `:turn_canceled` — `{ cancellation_reason:, cancelled_by:, duration_ms: }` (`cancelled_by`: the bundle or hook label that
+- `:turn_canceled` — `{ turn_id:, cancellation_reason:, cancelled_by:, duration_ms: }` (`cancelled_by`: the bundle or hook label that
   stopped it, for `cancellation_reason: :hook`; else nil)
 
 These are the Engine's raw events. The worker's SSE projection omits `call` from

data/docs/cli.md

@@ -585,7 +585,7 @@ list --archived` shows them too, marked `[archived]` (`archived: true` in
 `--format json`); `chi sessions unarchive ID...` brings them back, and so does
 a message you send to one (the web, an attached terminal, `chi send`), but not
 a delegate's follow-up or a reminder. The web archives from the info bar
-(`archive`, before `stop`); "include archived" by the all-sessions search
+(`archive`, before `stop`); the `archived` toggle by the all-sessions search
 finds archived sessions. `/archive` in a terminal leaves the session and
 archives it (an empty session is discarded instead; `chi scratch` refuses
 it). See
@@ -1023,7 +1023,9 @@ hides it for that browser (`chi_markdown_tip_dismissed` in localStorage).
 Every prompt and answer has a copy button (on hover; always shown, dimmed, on a
 touch screen), and so does each code block of a rendered answer. An answer
 copies its Markdown source, not the rendered text; a code block copies just
-its code; a prompt copies the text as you typed it.
+its code; a prompt copies the text as you typed it. On a phone or a touch
+screen a code block's button sits in a strip above its first line, clear of
+the code.
 
 A long answer (over 25 lines or 2,000 characters of its text) can be folded
 by hand: a "▾ N lines" row is its top edge once its turn has ended. Click
@@ -1031,8 +1033,10 @@ it and the answer closes to one line in its own box,
 "▸ its first line · N lines" (the
 first line of what a hook presented in its place, else its first heading,
 else its first line); click again to unfold. A delegate report's reply
-folds the same way. Folding is this browser's choice, kept per session in
-localStorage (`chi_answer_fold:<session id>`, the last 200 folded answers;
+folds the same way, and so does a long prompt you sent (over the same
+threshold; its folded row shows its first line as typed). A delegate
+report itself starts folded. Folding is this browser's choice, kept per session in
+localStorage (`chi_answer_fold:<session id>`, the last 200 folded answers and prompts;
 the keys of sessions gone from the list are dropped when the list loads);
 other viewers and the participant page are not affected. A jump into a
 folded answer (a claim link, say) unfolds it for that page load.
@@ -1050,7 +1054,11 @@ steps and its answer, all behind it (a warn card, a verdict card and the
 recap stay on view). Click the stub to unfold that version in place (kept per
 browser, with the folded answers); a time divider between two folded stubs
 moves into the later stub. The newest version has a chip, "v3 · 2 earlier ▾",
-listing every version by its prompt; pick one to jump to its stub. Revise
+listing every version by its prompt; pick one to jump to its stub. Before
+that chip, a "‹ 3/3 ›" switcher reads an earlier version's answer in the
+newest one's place (its left edge dashed while it shows; Copy copies the
+version on view); › back to the newest. Switching only changes what this
+page shows, and a reload shows the newest again. Revise
 again on the newest version adds to the stack. Stacks are session data (the
 stamp is on the Revise prompt, see [sessions.md](sessions.md), Revise
 stacks): every owner's page shows them, live and after a reload; the
@@ -1555,8 +1563,8 @@ chi share revoke --all          # every link to every session
   far as it fits the plan. It's quoted: …` and the reply quoted line by line. Read it, edit it, send it: the
   participant's text reaches the model as a quote under your line, never as your instruction. Don't send "do what
   Alex said" instead: that hands their words your tools.
-- **Your side of it.** In the session bar, the participants chip (`invite` while nobody has a link, then `2
-  participants`, with a green dot while one is on their page) opens the panel: each participant's state, last visit,
+- **Your side of it.** In the session bar, the participants chip (`participants · invite` while nobody has a link,
+  then `2 participants`, with a green dot while one is on their page) opens the panel: each participant's state, last visit,
   spend against their cap, turns and expiry, with **Cap** and **Revoke** (revoking ends their page and stream and
   drops their queued comments). **Invite** takes a name, person or agent, the expiry and a cap, and shows the link
   once, with Copy, Share (a phone's share sheet) and its QR code. **Participant view ↗** opens their page for this

data/docs/context.md

@@ -230,8 +230,7 @@ outside: information about your work, never instructions.
 The web's session bar shows a chip per source (name · age; a dot when the
 agent hasn't read a change, red after a failed refresh). A chip opens the
 summary, the hint's link, the text and detach (or mute here, for a project
-source). The "+ URL" chip, there when an installed bundle has a provider,
-attaches a URL; the web never adds a command.
+source). The web attaches nothing itself: `chi context add <URL>` does.
 
 ## Waking
 
@@ -325,9 +324,8 @@ It needs [`gh`](https://cli.github.com), logged in (`gh auth login`).
   open PR #42"). Not in a `chi scratch` session or a delegate child, and
   quietly nothing without `gh`, a login, a repository or an open PR. Once
   you remove it (`chi context rm`, the chip's detach) it stays removed:
-  the next start doesn't bring it back; `chi context add <PR URL>` or "+ URL"
-  does.
-- `chi context add <PR URL>` and the web's "+ URL" attach any PR.
+  the next start doesn't bring it back; `chi context add <PR URL>` does.
+- `chi context add <PR URL>` attaches any PR.
 - `auto_attach` (below) can make it ask first, or attach nothing.
 - The text: title, state, branch, description, reviews, comments (oldest
   first) and checks, every 5 minutes.
@@ -358,10 +356,10 @@ bundles:
   turns the card into a one-line notice. Not here on a PR that is attached
   already changes nothing and says so: `chi context rm pr-42` removes it. A worker restart (idle exit,
   resume) doesn't ask again; once the card has scrolled out of the last 20,
-  `/pr-attach 42` or "+ URL" still attaches it. `/pr-attach` and
+  `/pr-attach 42` or `chi context add <PR URL>` still attaches it. `/pr-attach` and
   `/pr-decline` act only on a PR offered in that session.
-- `off`: nothing is attached or offered. "+ URL", `chi context add <PR URL>`
-  and line links work as before.
+- `off`: nothing is attached or offered. `chi context add <PR URL>` and line
+  links work as before.
 
 `true` and `false` (YAML reads a bare `on`/`off` as those) mean `attach` and
 `off`; an unknown value is `attach`, with a warning in the log. The setting
@@ -392,7 +390,7 @@ links are display only (the model's text stays as it was), and terminals
 show the answer as it is.
 
 - **Which PR**: the session's attached PRs (the branch's, `chi context add
-  <PR URL>`, "+ URL") and the PR URLs in your messages, newest first (a
+  <PR URL>`) and the PR URLs in your messages, newest first (a
   delegate child's task counts: a parent that names the PR there gets links
   in the child's answers). PR URLs in tool output or answers don't count.
 - **Which file**: a file the PR changes, by its path, a renamed file's old

data/docs/guardrails.md

@@ -4,7 +4,7 @@ Every tool call the model makes passes one check before it runs, in both
 loops (native and chat hosts). The verdict is **allow**, **ask** or
 **deny**; the strictest vote wins, and a deny can't be undone by a later
 voter. Of two asks the first one names the rule, except a rule only the
-user may allow (`chi-config`, `chi-home`, `chi-hooks`, `shell-touches-chi`,
+user may allow (`chi-config`, `chi-home`, `chi-shim`, `chi-hooks`, `shell-touches-chi`,
 `chi-context-cmd`, `chi-broadcast`): it takes over, and only the scopes both asks offer
 are offered.
 
@@ -221,7 +221,7 @@ rules off: `guardrails: {disable: [write-outside-repo, git-outside-repo]}`.
 Whatever the setting, a parent can't allow a call on chi's own files: a
 `write`, `edit` or `execute` on the config dir (config.yml, installed bundles'
 rules), the hooks dir or the approval store, by its rule (`chi-config`, `chi-home`,
-`chi-hooks`, `shell-touches-chi`), its paths or its command. "Allow once" on a
+`chi-shim`, `chi-hooks`, `shell-touches-chi`), its paths or its command. "Allow once" on a
 config.yml rewrite would allow everything from then on, so those questions are
 the user's alone (`user_only`): `chi answer` and the worker refuse the allow
 with `only the user can allow it`. The same holds for the guardrails bundle's
@@ -285,7 +285,7 @@ Built in, for `write`, `edit` and `memory_write` (symlinks resolved; see
 - deny: the approval store's dir, installed bundles (`memories/.bundles/`),
   and [attached context](context.md) sources (`<state dir>/context/`: a
   source's command runs later, outside the gate; `chi context` changes them);
-- ask (once or for the session): `config.yml`, `home.json` (the [chi home](configuration.md#the-chi-home): the Ruby every chi launch boots) and the plain hooks dir.
+- ask (once or for the session): `config.yml`, `home.json` (the [chi home](configuration.md#the-chi-home): the Ruby every chi launch boots), the chi shim (`$XDG_STATE_HOME/samagotchi/bin/chi`, the `chi` every tool runs: `chi-shim`) and the plain hooks dir.
 
 `execute` can still reach them; the guardrails bundle asks about shell
 commands that name them.
@@ -497,7 +497,10 @@ message:
   `ruby -run -e httpd`, `php -S`, a static server, a script's `listen(`/
   `HTTPServer`/`createServer`): the owner's browser sends its cookies (chi
   web's on 127.0.0.1 or the LAN address, kept for every port) to the page
-  it opens (`PairBoundary::OPENER`, `PairBoundary::LISTENER`);
+  it opens (`PairBoundary::OPENER`, `PairBoundary::LISTENER`). The list
+  names generic servers only: a project's dev server (`npm run dev`, `npx
+  vite`, `bundle exec rails server`) runs and listens until the execute's
+  limit kills it (above);
 - a program whose name the shell expands: a `$var`, a `$(…)` or a glob in a
   command's name (`bin/ch? …`, `e=ch; ${e}i …`, `$CMD x`), whatever it would
   turn out to be (`PairBoundary::VERB`);
@@ -552,6 +555,10 @@ share`, `/bin/SH -c`, `NOHUP`: a disk that folds case, macOS's default, runs
 them as git, chi, sh, nohup; `ShellLex.program_name`), and so is chi or git
 config in a script's text.
 
+It asks the owner, fresh and once, before a plugin or MCP tool's call whose
+`targets:` name no command or path (`PairBoundary::UNTARGETED`: a browser
+MCP's navigate, say), since nothing here can tell what it reaches.
+
 And it **asks the owner** before a `write` or `edit` that may land outside the
 session's project root, and before a command that may write there, every time:
 the ask is fresh (`Verdict#fresh_ask`: no stored approval answers it, and no
@@ -913,7 +920,7 @@ every surface answers for the same paths):
 | Primitive | Where | Used by |
 |---|---|---|
 | expand (`..` the kernel's way), real, lexical_real, reals | `PathResolve` (`ProtectedPaths` keeps the old names) | every surface |
-| in a dir: `under?` (case-folded on a folding disk; `fold: false` exact), `strictly_under?`, `within?` (root resolved too) | `PathResolve` | `under?`: ShellPaths, ReviewPaths, PairCommand, ChildBoundary, SelfProtect's words; `Outside.within?` and RmTargets' `strictly_under?` fold only when the dir exists (a missing session root keeps the case it was typed in); `within?`: ProtectedPaths, ScratchWrites, ParentApprovals, SelfProtect's paths |
+| in a dir: `under?` (case-folded on a folding disk; `fold: false` exact), `strictly_under?`, `within?` (root resolved too) | `PathResolve` | `under?`: ShellPaths, ReviewPaths, PairCommand, ChildBoundary, SelfProtect's words; `Outside.under_folding_existing?` and RmTargets' `strictly_under?` fold only when the dir exists (a missing session root keeps the case it was typed in); `within?`: ProtectedPaths, ScratchWrites, ParentApprovals, SelfProtect's paths, ChiDirs.review (`ProtectedPaths.within?` is the same predicate) |
 | tmp dirs and "not one the session is in" | `PathResolve.tmp_roots(session:)` (exact case) | Outside (`Outside.tmp_roots` is the list it and Targets read), RmTargets; `touches_chi?` takes all of them |
 | a shell word's `~`, `$HOME`, XDG dirs, `$TMPDIR` | `PathResolve.expand_word` | ShellPaths::Walk, ShellGitDirs; PairCommand has its own `~`/`$HOME` (`expand_tilde`) |
 | a program word's name: basename, case-folded on every disk (`GIT`, `/bin/SH`, `ſh`) | `ShellLex.program_name` / `.program?` | PairCommand, ImplicitWriters, SelfProtect's file runners, ShellGitDirs, SharedGit |

data/docs/internals/engine.md

@@ -79,7 +79,7 @@ Engine#run_turn(session, prompt, on_event:, max_iterations:, cancel_controller:,
   │     #   {cancellation_reason, cancelled_by, duration_ms} is emitted; before the replace,
   │     #   stamp_opening puts a Verify turn's `verify` and a completed Revise turn's `revises`
   │     #   (re-targeted to its stack's top) on the opening message, metadata never sent, and
-  │     #   :turn_completed carries `verdict` / `revises` when there are
+  │     #   every end event carries `turn_id`, :turn_completed `verify` / `verdict` / `revises` when there are
   │     # then the :after_turn hook (status, messages, present: the AnswerDisplay presenter,
   │     #   refs: the AnswerRefs adder)
   │     # store_answer_display (one replace of the answer: `display` and/or `display_refs`;
@@ -548,9 +548,9 @@ Turn events (the main ones; `Events` in `events.rb` keeps the shared sets):
 | `:working_set_updated` | after `:generation_started` (the running turn's conversation, the turn's strategy) and once in `end_turn` before the end event (the kept messages), only when the set differs from the last one emitted for the session and is not empty, except one empty event when the last one had items (a rollback emptied the set): a tool-free turn emits none (`Engine#emit_working_set`); between turns `Engine#announce_working_set` announces it under the next turn's strategy (after a `/working-set` op, held behind the command's `command_ran`) | `{items: [{kind, key, state (live\|stale\|forgotten\|dropped), tokens, ops, count, first_id, pinned, has_drop}], at, adds?: [{kind, key, label}]}` (`WorkingSet`, internals/working-set.md; `adds` while the user's adds are pending) |
 | `:hook_notice` | a hook's or plugin's notify during a turn | `{hook, text, level}` (announced with `between_turns: true` outside a turn) |
 | `:guardrail_warning` | a guardrails line during a turn | `{message}` |
-| `:turn_completed` | normal end | Engine event `{result, turn_summary, display_pending}`, plus `verdict` (a Verify turn's recorded verdict) and `revises` (a Revise turn's stamp, `{turn_id}`) when there are; the Bridge's SSE frame omits `result` (answer remains in `turn_summary.output`) |
-| `:turn_canceled` | Stop, hook stop, Ctrl-C | `{cancellation_reason, cancelled_by?, duration_ms}` |
-| `:turn_failed` | an error | `{error_class, message, duration_ms, error_kind?, retryable?, host?, summary?}` |
+| `:turn_completed` | normal end | Engine event `{turn_id, result, turn_summary, display_pending}`, plus `verify: true` (a Verify turn, verdict or not: the page's `data-verify`), `verdict` (a Verify turn's recorded verdict) and `revises` (a Revise turn's stamp, `{turn_id}`) when there are; the Bridge's SSE frame omits `result` (answer remains in `turn_summary.output`) |
+| `:turn_canceled` | Stop, hook stop, Ctrl-C | `{turn_id, cancellation_reason, cancelled_by?, duration_ms}` |
+| `:turn_failed` | an error | `{turn_id, error_class, message, duration_ms, error_kind?, retryable?, host?, summary?}` |
 | `:answer_display` | after the after_turn hooks (observers only, not the sink) | `{display, refs?}` (display a string, or nil; refs the count of the answer's refs, only when a hook attached some) |
 
 A turn's origin is a `TurnOrigin` (`lib/samagotchi/turn_origin.rb`, a `Data.define` of `client_id`, `enqueued_id`

data/docs/internals/participants.md

@@ -549,7 +549,8 @@ fields: a field added to an event later reaches nobody until it is named there.
   data's `viewer.id`), at most 50, forgotten when the link ends (a 401 with chi's words), never the owner's `GET
   /api/history` (the owner may open a link in the same browser). It lacks: the `/` list and plugin pills (a review turn
   refuses `/` lines), the delivery line and its steer/queue choices (every comment is `POST …/turn`, a queued review
-  turn; Alt+Enter is Enter), the model picker, Stop turn, and images: the chips are mounted but `imagesOff` refuses a
+  turn; Alt+Enter is Enter), the model picker, Stop turn (the owner page's sits in its stage's status row; this
+  page has no stage), and images: the chips are mounted but `imagesOff` refuses a
   paste, drop or pick with one line (the image button is hidden) until participant images land. The grip's floor and
   the fold are the owner page's keys (`chi_composer_floor`, `chi_composer_collapsed`), per browser. The owner's
   participant view mounts none: its dock stays hidden.

data/docs/internals/web-frontend.md

@@ -10,6 +10,10 @@ only library. Pure modules (`*_model.js`, `session_state.js`, `sessions_list.js`
 and have `node --test` specs under `spec/web/public/` (happy-dom for the DOM ones); the pages as a whole are covered
 by `npm run e2e` (`spec/e2e/`). `app.js` has no unit spec.
 
+**`app.js` has a size cap**: `npm run lint` fails past `max-lines` in `eslint.config.js` (counted as `wc -l` counts,
+a little over its size today). A new feature goes into a module of its own, wired from `app.js` in a few lines; a
+refactor that shrinks `app.js` ratchets the cap down with it. Never raise it: extract instead.
+
 **New exports go in new modules.** The static JS is served at unversioned URLs. Today every load revalidates
 (app.rb `serve_static` sends `Cache-Control: no-cache` with a content ETag, and `sw.js` has no fetch handler), but an
 open tab still holds the modules it loaded, and a proxy that ignores `no-cache` can serve an old one: a new export
@@ -19,7 +23,7 @@ page. A factory dep a new version stops passing is the same hazard the other way
 out of `send_turn.js`, `session_actions.js` and `lists_view.js`); a page loaded before keeps all its old modules
 until a reload, so the risk is a mixed cache, not an open tab. `answer_fold.js`, `details_motion.js`,
 `turn_range.js`, `history_reveal.js`, `latest.js`, `session_payload.js`, `method_api.js`, `session_store.js`,
-`session_fields.js`, `feature_gates.js`, `revise_stack.js` and `shell_command.js` are new modules for that reason.
+`session_fields.js`, `feature_gates.js`, `revise_stack.js`, `revise_switch.js`, `shell_command.js`, `stale_params.js` and `popover_modal.js` are new modules for that reason.
 
 ## Two pages, two models
 
@@ -46,7 +50,7 @@ change.
 | **`store.current`** (`session_state.js`: `emptySessionState` / `sessionStateFrom`; per field: `session_fields.js FIELDS`) | the open session's fields, about 40 (info bar, chips, verdicts, timing, worker, stream cursor) | `store.update` / `setStatus` from app.js, `stream_handlers.js`, `send_turn.js` (`firstPreview`, `owner`), `session_actions.js` (`status`); `forgetSession`'s `replaceCurrent`. Two writers in place, on purpose (D8 in `FIELDS`): live_timing.js's `activeTurn`, verdict_fresh.js's running list | the store runs the field's redraws (`FIELDS[key].redraws`) |
 | **`store.sessions`** (the hub's projection) | every card | `store.update({sessions})` from app.js: `openSessionEvents` (`applySessionEvent`), `refresh` (the list fallback), `addCreatedSession`, `applyView` (re-sorted), `replaceSelectedCard` (`setLiveStatus` through `setStatus`, `readTurnEnd`, `setUsedMemories`), the stream's close (`withoutWorker`); `session_actions.js` (`setSessions`) | the store: `lists` and `infoBar`. **Always a new array**; an entry is replaced, never changed in place. `followSelectedSession` copies the open one's owner and worker (`fieldsFromCard`) and, when not streaming, its status (`setStatus(…, "hub")`) into `store.current` |
 | **Factory closures**: the `create*` factories (popovers, panels, views) | each component's own state: open-for, busy, error, its own fetched list | the factory | an `onChange` hook back into app.js, or a getter the factory reads at draw time |
-| **The history DOM** | the conversation as drawn: which turn a bubble belongs to (`data-turn-id`, `data-answer-turn`), kept command bubbles, which texts were shown, unnamed badges, folded answers (`.folded`), Revise stamps (`data-revises` on a prompt; a Verify turn's `data-verify`) and the stacks' folded versions (`.stack-hidden`, `.stack-stub.open`) | `bubbles.js`, `cards_place.js`, `question_cards.js`, `turn_block.js`/`stage_view.js`, `answer_fold.js`, `revise_stack.js`, `stream_handlers.js` (a live `turn_completed`'s `revises` onto its prompt) | read back as state: `turn_range.js turnElements` (one walker for a turn's elements), `keptCommandBubbles`, `seedSeenFromDom`, `nameUnnamedBadges`/`nameVerdictCards`, `answer_fold.js` and `revise_stack.js` (their observers decorate every path that fills `#history`; the stacks are `stacks()` of the stamps, read again on each change, never a store field), `history_reveal.js revealInHistory` (the one way a jump unfolds what hides its target) |
+| **The history DOM** | the conversation as drawn: which turn a bubble belongs to (`data-turn-id`, `data-answer-turn`), kept command bubbles, which texts were shown, unnamed badges, folded answers and long prompts (`.folded`), Revise stamps (`data-revises` on a prompt; a Verify turn's `data-verify`) and the stacks' folded versions (`.stack-hidden`, `.stack-stub.open`); the switcher's version on view is `revise_stack.js`'s own (a copy `.stack-view` before the top answer, the top `.stack-swapped`; never stored) | `bubbles.js`, `cards_place.js`, `question_cards.js`, `turn_block.js`/`stage_view.js`, `answer_fold.js`, `revise_stack.js`, `stream_handlers.js` (a live `turn_completed`'s `revises` and `verify` onto its prompt) | read back as state: `turn_range.js turnElements` (one walker for a turn's elements), `keptCommandBubbles`, `seedSeenFromDom`, `nameUnnamedBadges`/`nameVerdictCards`, `answer_fold.js` and `revise_stack.js` (their observers decorate every path that fills `#history`; the stacks are `stacks()` of the stamps, read again on each change, never a store field), `history_reveal.js revealInHistory` (the one way a jump unfolds what hides its target) |
 | **localStorage** (`storage.js` `readStored`/`writeStored`, guarded) | per-browser choices only | the module that owns the choice | read at start (see Storage keys) |
 | **SSE** | see Streams | the server | owner page: events go into the DOM directly; participant page: an event marks the data stale |
 
@@ -104,10 +108,11 @@ a store write. A value written unchanged redraws nothing (a chunk with the same
 An input the store doesn't hold calls `store.touch(name)` where it changes: `infoBar` for the clock (liveTurn's
 `onTick`), the versions (`noticeVersions`), `restartingIds`, the stream (`startStream`, `workerGone`), the working
 set's and the participants' `onChange`, the continue and review in-flight sets
-(`session_actions.js`); `composer` and `infoBar` for `liveTurn.running` (`setTurnRunning`) and at the end of
-`renderSessionView` (a whole view drawn). Left as they are, on purpose: the `narrowScreen` listener calls
-`updateComposerMode()` (the bar doesn't read it), `applyStripHidden`/`applyView` call `updateSessionTitle()`, and
-`closeStream`/`stream.restart` set `streamControl = null` without a redraw (a resync or a workerGone follows).
+(`session_actions.js`); `composer` and `infoBar` for `liveTurn.running` (`setTurnRunning`, with `settingsPanel`:
+the open ⚙ panel's running-turn note) and at the end of `renderSessionView` (a whole view drawn). Left as they are,
+on purpose: the `narrowScreen` listener calls `updateComposerMode()` (the bar doesn't read it),
+`applyStripHidden`/`applyView` call `updateSessionTitle()`, and `closeStream`/`stream.restart` set
+`streamControl = null` without a redraw (a resync or a workerGone follows).
 
 A function that writes more than once batches its synchronous part, so each redraw runs once: `select` (before its
 `await resync()`), `clearSelection`, the hub's `snapshot` and `session` events, `workerGone`, `setTurnRunning`,
@@ -197,8 +202,13 @@ Three, for one job. Pick by what the piece is:
 
 Listeners: every factory is a page-lifetime singleton, so `addEventListener` without a remove is fine; a per-render
 listener lands on a fresh node. A popover goes through `chip_popover.js createChipPopover` (its own outside-click,
-Esc, placement and resize); `context_chips.js`, `model_picker.js`, `ref_menu.js`, `command_list.js` and the lists'
-families/chains popovers still hand-roll theirs.
+Esc, placement and resize); `context_chips.js` and the lists' families/chains popovers (`families_view.js
+createFamilyPop`) still place their own. Every popover behaves the same (`popover_modal.js`): a modal dialog
+(`modalDialog`: `aria-modal`, Tab wraps inside it), the opener's `aria-expanded` (a lit-drawn chip writes
+`aria-expanded="false"` statically; the shell flips it), Esc closes it and focus goes back to the opener
+(`focusBack`), and its `:hover` tints (the opener's too) sit in `@media(hover:hover)`, so a tap on a phone leaves
+none behind. `model_picker.js`, `command_list.js` (listboxes: the focus stays in the input), `ref_menu.js` (a menu)
+and `update_sheet.js` (a native modal `<dialog>`) aren't popovers in that sense.
 
 ## Stale answers
 
@@ -256,7 +266,7 @@ reach another device or the server.
 | `chi_markdown_tip_dismissed` | `markdown_tip.js` | the markdown tip dismissed |
 | `chi_update_available_shown` | app.js | update notices already shown |
 | `chi_notify`, `chi_push_device` | `notifications.js` (an injected storage) | the bell's state, this device's push id |
-| `chi_answer_fold:<session>` | `answer_fold.js`, `revise_stack.js` | the answers folded by hand, and the Revise stubs unfolded by hand (`stub:<turn id>`) (swept with the session list) |
+| `chi_answer_fold:<session>` | `answer_fold.js`, `revise_stack.js` | the answers and long prompts (`<turn id>:prompt`) folded by hand, and the Revise stubs unfolded by hand (`stub:<turn id>`) (swept with the session list) |
 | `chi_review_history:<grant>`, `chi_review_history_session:<session>` | `review_history.js` (participant page) | a participant's composer history |
 
 sessionStorage: `chi_client_id` (`turn_events.js`: this tab's client id, kept over a reload mid-turn) and

data/docs/plugins.md

@@ -1181,7 +1181,7 @@ a quiet `chi.init` task.
 ### Context providers in the manifest
 
 A bundle can turn URLs into sources for every process, without loading
-plugins (`chi context add URL`, the web's "+ URL", `ctx.context.attach(url:)`):
+plugins (`chi context add URL`, `ctx.context.attach(url:)`):
 
 ```yaml
 # manifest.yml
@@ -2129,7 +2129,7 @@ chi bundle install github-pr      # in the dev profile; needs gh, logged in
 Attaches the branch's open GitHub pull request to a session as `pr-<n>` when
 its worker starts (not in a scratch session or a delegate child; quietly
 nothing without `gh`, a repository or an open PR), and resolves PR URLs for
-`chi context add` and the web's "+ URL". Its script prints the PR as text
+`chi context add`. Its script prints the PR as text
 and a summary of what changed in counts, authors and states only; it wakes
 the session for a review requesting changes, checks turning red, or the PR
 merged or closed. In the web, a `path:line` in a worker's answer links to