samagotchi 0.159.0 → 0.161.0

data/lib/samagotchi/schedules.rb

@@ -8,7 +8,9 @@ require "fileutils"
 
 require_relative "atomic_file"
 require_relative "archive_store"
+require_relative "worker_presence"
 require_relative "client_id"
+require_relative "command_intake"
 require_relative "config"
 require_relative "continue_offer"
 require_relative "delivery"
@@ -18,6 +20,8 @@ require_relative "session_chain"
 require_relative "session_inbox"
 require_relative "session_manager"
 require_relative "session_row"
+require_relative "state_format"
+require_relative "turn_checkpoint"
 require_relative "worker_link"
 
 module Samagotchi
@@ -59,8 +63,16 @@ module Samagotchi
     PROMPT_MAX_BYTES = SessionInbox::NOTE_MAX_BYTES
     # Seconds a tick waits for a live worker's GET /activity.
     ACTIVITY_TIMEOUT = 2.0
+    # A chain firing can wait 30 s for a recap and 5 s for an archive; 5 s
+    # more leaves margin before an unfinished turn is called interrupted.
+    FIRING_TIMEOUT = 40
+    PENDING_MIN_SECONDS = 10 * 60
+    PENDING_MAX_SECONDS = 6 * 60 * 60
     # Refusals that mean "not now" rather than "this schedule is broken".
-    SKIP_REASONS = %w[busy queued offer busy_child queued_child offer_child continued open_children].freeze
+    # (starting: the link's worker holds no lock yet, e.g. another ticker's
+    # firing just continued the chain.)
+    SKIP_REASONS = %w[busy queued offer busy_child queued_child offer_child starting starting_child continued
+                      open_children].freeze
 
     # The add itself is wrong (no prompt, two recurrence kinds, a scratch
     # target): a usage error, exit 2.
@@ -79,15 +91,21 @@ module Samagotchi
     # puts the clock back to it.
     Entry = Data.define(:id, :title, :anchor, :head, :mode, :prompt, :recurrence, :busy, :catch_up,
                         :keep_links, :max_failures, :max_skips, :next_due, :due_was, :last_fired, :last_result,
-                        :firing_since, :failures, :skips, :enabled, :created_at) do
+                        :firing_since, :firing_token, :pending_session_id, :pending_turn_id, :failures, :skips, :enabled,
+                        :created_at, :extra) do
       # The recurrence comes back from JSON with string keys: every reader of
       # it below matches on `recurrence[:kind]`, so it is symbolised here once.
-      # A file written by a newer chi may carry keys this one does not know:
-      # they are dropped rather than raising in Data#initialize.
-      def self.from_h(hash)
-        fields = hash.transform_keys(&:to_sym).select { |key| Entry.members.include?(key) }
+      def self.from_record(record)
+        fields = record.attributes
         recurrence = fields[:recurrence]
-        new(**fields, recurrence: recurrence.is_a?(Hash) ? recurrence.transform_keys(&:to_sym) : recurrence)
+        fields[:recurrence] = recurrence.transform_keys(&:to_sym) if recurrence.is_a?(Hash)
+        new(**fields, extra: record.extra)
+      end
+
+      def to_h
+        fields = super
+        extra = fields.delete(:extra) || {}
+        extra.transform_keys(&:to_s).merge(fields.transform_keys(&:to_s))
       end
 
       def due?(now)
@@ -111,6 +129,38 @@ module Samagotchi
       def target_words = "#{mode} · #{head.to_s[0, 8]}"
     end
 
+    FORMAT = StateFormat.new(
+      version: VERSION,
+      members: [
+        StateFormat.required(:id),
+        StateFormat.added(:title, in_version: VERSION, default: nil),
+        StateFormat.required(:anchor),
+        StateFormat.added(:head, in_version: VERSION, default: ->(values) { values[:anchor] }),
+        StateFormat.required(:mode),
+        StateFormat.required(:prompt),
+        StateFormat.required(:recurrence),
+        StateFormat.added(:busy, in_version: VERSION, default: "skip"),
+        StateFormat.added(:catch_up, in_version: VERSION, default: "once"),
+        StateFormat.added(:keep_links, in_version: VERSION, default: 5),
+        StateFormat.added(:max_failures, in_version: VERSION, default: 3),
+        StateFormat.added(:max_skips, in_version: VERSION, default: 12),
+        StateFormat.required(:next_due),
+        StateFormat.added(:due_was, in_version: VERSION, default: nil),
+        StateFormat.added(:last_fired, in_version: VERSION, default: nil),
+        StateFormat.added(:last_result, in_version: VERSION, default: nil),
+        StateFormat.added(:firing_since, in_version: VERSION, default: nil),
+        StateFormat.added(:firing_token, in_version: VERSION, default: nil),
+        StateFormat.added(:pending_session_id, in_version: VERSION, default: nil),
+        StateFormat.added(:pending_turn_id, in_version: VERSION, default: nil),
+        StateFormat.added(:failures, in_version: VERSION, default: 0),
+        StateFormat.added(:skips, in_version: VERSION, default: 0),
+        StateFormat.added(:enabled, in_version: VERSION, default: true),
+        StateFormat.added(:created_at, in_version: VERSION, default: nil),
+        StateFormat.extra(:extra, in_version: VERSION)
+      ],
+      document_members: [StateFormat.added(:last_tick_at, in_version: VERSION, default: nil)]
+    )
+
     # What one entry did in a tick: "fired", "skipped", "missed", "failed" or
     # "dry" (a --dry-run's "would fire"). +detail+ is the reason.
     Outcome = Data.define(:id, :title, :status, :detail, :entry) do
@@ -144,10 +194,20 @@ module Samagotchi
     # @param include_disabled [Boolean] the disabled and the fired one-offs too
     # @return [Array<Entry>] every entry, the earliest due first
     def entries(include_disabled: false)
-      list = read.sort_by { |entry| [entry.next_due.to_s, entry.id] }
+      list = read.entries.grep(Entry).sort_by { |entry| [entry.next_due.to_s, entry.id] }
       include_disabled ? list : list.select(&:enabled)
     end
 
+    def protected_session_ids
+      index = Index.new(@state_dir)
+      entries.flat_map { |entry| [entry.anchor, entry.head, target_of(entry, index).first] }.compact.uniq
+    end
+
+    def protecting(session_id)
+      index = Index.new(@state_dir)
+      entries.find { |entry| target_of(entry, index).first == session_id }
+    end
+
     # @param id_or_name [String] an id, a unique prefix of one, or a title
     # @return [Entry, nil]
     # @raise [Usage] the prefix or the title names more than one schedule
@@ -155,7 +215,7 @@ module Samagotchi
       given = id_or_name.to_s.strip
       return nil if given.empty?
 
-      list = read
+      list = read.entries.grep(Entry)
       exact = list.find { |entry| entry.id == given }
       return exact if exact
 
@@ -188,6 +248,9 @@ module Samagotchi
 
       prompt = prompt.to_s
       raise Usage, "a schedule needs a prompt" if prompt.strip.empty?
+      # It fires from a schedule, never a person: a shell line would be
+      # refused at every firing (CommandIntake); a /word one is the model's text.
+      raise Usage, CommandIntake::REFUSED if CommandIntake.shell_line?(prompt)
       if prompt.bytesize > PROMPT_MAX_BYTES
         raise Usage, "the prompt is #{prompt.bytesize} bytes; the limit is 16 KiB (#{PROMPT_MAX_BYTES} bytes)"
       end
@@ -223,10 +286,10 @@ module Samagotchi
         max_failures: int_or_default(max_failures, "schedule.default_max_failures", 3, min: 1),
         max_skips: int_or_default(max_skips, "schedule.default_max_skips", 12, min: 1),
         next_due: next_due_for(recurrence, from: now).utc.iso8601, due_was: nil,
-        last_fired: nil, last_result: nil, firing_since: nil,
-        failures: 0, skips: 0, enabled: true, created_at: now.utc.iso8601
+        last_fired: nil, last_result: nil, firing_since: nil, firing_token: nil, pending_session_id: nil,
+        pending_turn_id: nil, failures: 0, skips: 0, enabled: true, created_at: now.utc.iso8601, extra: {}
       )
-      write_under_lock { |list| list << entry }
+      write_under_lock { |file| file.entries << entry }
       entry
     end
 
@@ -284,6 +347,7 @@ module Samagotchi
     def tick(dry_run: false, now: @clock.call)
       outcomes = []
       pending = []
+      prune_after = []
       index = nil
 
       FileUtils.mkdir_p(@store_dir)
@@ -295,27 +359,65 @@ module Samagotchi
           return Tick.new(locked: true, outcomes: [])
         end
 
-        list = read
+        file = read(strict: true)
+        list = file.entries.grep(Entry)
         # Ordered by the moment each entry is due, then id: with one chain
         # firing per tick, the entries of that chain take turns (a skipped
         # entry keeps its `next_due`, so the earliest waiting one goes next).
         # File order would let the first entry added win every tick and starve
         # the rest into their max_skips.
-        due = list.select { |entry| entry.enabled && entry.due?(now) }
+        updated = file.entries.dup
+        pending_ids = []
+        in_flight = []
+        resolved_chains = []
+        prune_after = []
+        updated.each_with_index do |entry, position|
+          next unless entry.is_a?(Entry)
+
+          if entry.firing_since && !entry.pending_turn_id && firing_expired?(entry, now)
+            interrupted = failed(entry, "interrupted")
+            interrupted = interrupted.with(enabled: false) if entry.recurrence[:kind] == "date"
+            updated[position] = interrupted
+            pending_ids << entry.id
+            outcomes << Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "interrupted",
+                                    entry: interrupted)
+            next
+          end
+          next unless entry.pending_turn_id
+
+          outcome = resolve_pending(entry, now)
+          pending_ids << entry.id
+          if outcome
+            updated[position] = finish_pending(entry, outcome)
+            outcomes << outcome
+            if outcome.status == "fired" && entry.mode == CHAIN
+              resolved_chains << entry
+              prune_after << entry if entry.keep_links.positive?
+            end
+          else
+            in_flight << entry
+            detail = pending_detail(entry)
+            outcomes << Outcome.new(id: entry.id, title: entry.title, status: "pending", detail: detail, entry: entry)
+          end
+        end
+        due = list.select { |entry| entry.enabled && !pending_ids.include?(entry.id) && entry.due?(now) }
                   .sort_by { |entry| [entry.next_due.to_s, entry.id] }
-        return Tick.new(locked: false, outcomes: []) if due.empty?
+        if due.empty?
+          write(file: file.with(entries: updated, attributes: file.attributes.merge(last_tick_at: now.utc.iso8601))) unless dry_run
+          next
+        end
 
         # One session listing for the whole tick: a chain walk re-globbing
         # every session per call is the tick's dominant cost.
         index = Index.new(@state_dir)
-        updated = list.dup
         # One firing per chain per tick. A second chain entry of the same chain
         # would continue the link the first one just made: that link has no
         # worker lock yet and is not in this tick's index, so the busy check
         # cannot see it, and its prompt would be archived before it ever ran.
-        fired_chains = {}
+        fired_chains = resolved_chains.to_h { |entry| [chain_key(index, entry), true] }
+        pending_chains = in_flight.select { |entry| entry.mode == CHAIN }.map { |entry| chain_key(index, entry) }
         due.each do |entry|
-          position = updated.index { |candidate| candidate.id == entry.id }
+          position = updated.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
           verdict = check(entry, index)
           if verdict
             kind, reason = verdict
@@ -332,6 +434,12 @@ module Samagotchi
             outcomes << Outcome.new(id: entry.id, title: entry.title, status: "skipped", detail: reason, entry: entry)
             next
           end
+          if entry.mode == CHAIN && pending_chains.include?(chain_key(index, entry))
+            reason = "a schedule turn is still pending in this chain"
+            updated[position] = skipped(entry, reason) unless dry_run
+            outcomes << Outcome.new(id: entry.id, title: entry.title, status: "skipped", detail: reason, entry: entry)
+            next
+          end
           if dry_run
             fired_chains[chain_key(index, entry)] = true if entry.mode == CHAIN
             outcomes << Outcome.new(id: entry.id, title: entry.title, status: "dry", detail: entry.recurrence_words, entry: entry)
@@ -347,10 +455,16 @@ module Samagotchi
           pending << advanced
           fired_chains[chain_key(index, entry)] = true if entry.mode == CHAIN
         end
-        write(list: updated) unless dry_run
+        write(file: file.with(entries: updated, attributes: file.attributes.merge(last_tick_at: now.utc.iso8601))) unless dry_run
       end
 
-      pending.each { |entry| outcomes << fire_and_record(entry, index) }
+      pending.each do |entry|
+        outcome = fire_and_record(entry, index)
+        outcomes << outcome
+        prune_after << outcome.entry if outcome.status == "fired" && entry.mode == CHAIN && entry.keep_links.positive?
+      end
+      index ||= Index.new(@state_dir) unless prune_after.empty?
+      prune_after.each { |entry| prune(entry, index) }
       Tick.new(locked: false, outcomes: outcomes)
     end
 
@@ -358,22 +472,53 @@ module Samagotchi
     # A refusal is recorded exactly as a tick records one — the counters move,
     # and max_skips or max_failures can disable a schedule that can never run.
     # `due_was` is not involved: run-now is not a scheduled occurrence, so
-    # there is no clock to put back and next_due stays where it was.
+    # there is no clock to put back and next_due stays where it was. Reserve the
+    # firing under the file lock before the action, the way a tick does.
     # @return [Outcome]
     def run_now(id_or_name)
       entry = lookup(id_or_name)
       return Outcome.new(id: id_or_name.to_s, status: "failed", detail: "no such schedule") if entry.nil?
 
       index = Index.new(@state_dir)
-      verdict = check(entry, index)
-      if verdict
-        kind, reason = verdict
-        status = kind == :skip ? "skipped" : "failed"
-        record_refusal(entry, status, reason)
-        return Outcome.new(id: entry.id, title: entry.title, status: status, detail: reason, entry: entry)
+      reserved = nil
+      outcome = nil
+      write_under_lock do |file|
+        position = file.entries.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
+        if position.nil?
+          outcome = Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "no such schedule")
+          next
+        end
+
+        current = file.entries[position]
+        if current.pending_turn_id
+          outcome = Outcome.new(id: current.id, title: current.title, status: "pending",
+                                detail: "already waiting for turn #{current.pending_turn_id}", entry: current)
+          next
+        end
+        if current.firing_since
+          outcome = Outcome.new(id: current.id, title: current.title, status: "pending",
+                                detail: "already firing since #{current.firing_since}", entry: current)
+          next
+        end
+
+        verdict = check(current, index)
+        if verdict
+          kind, reason = verdict
+          status = kind == :skip ? "skipped" : "failed"
+          updated = status == "skipped" ? skipped(current, reason) : failed(current, reason)
+          file.entries[position] = updated
+          outcome = Outcome.new(id: current.id, title: current.title, status: status, detail: reason, entry: updated)
+          next
+        end
+
+        reserved = advance(current, @clock.call)
+        file.entries[position] = reserved
       end
 
-      fire_and_record(advance(entry, @clock.call), index)
+      return outcome if outcome
+      return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "no such schedule") unless reserved
+
+      fire_and_record(reserved, index)
     end
 
     # Minutes between the hub's ticks when schedule.auto_tick is on.
@@ -382,6 +527,20 @@ module Samagotchi
       value.positive? ? value : 5
     end
 
+    def tick_warning(now: @clock.call)
+      return if Config.get("schedule.auto_tick")
+
+      last_tick_at = read.attributes[:last_tick_at]
+      stale_after = self.class.tick_interval_minutes * 120
+      return if last_tick_at && now - Time.iso8601(last_tick_at.to_s) <= stale_after
+
+      "Warning: no schedule tick in the last #{stale_after / 60} minutes; set schedule.auto_tick: true or " \
+        "run `chi schedule tick` from cron."
+    rescue ArgumentError
+      "Warning: no schedule tick in the last #{self.class.tick_interval_minutes * 2} minutes; " \
+        "set schedule.auto_tick: true or run `chi schedule tick` from cron."
+    end
+
     # A recurrence from the CLI's flags or the tool's arguments. Blank strings
     # (what a model sends for the fields it did not use) count as absent.
     # @return [Hash] {kind:, ...}
@@ -522,21 +681,30 @@ module Samagotchi
     #   than reading as empty: a write starting from an empty list would rewrite
     #   the file and lose every schedule on it. Listing stays lenient.
     def read(strict: false)
-      return [] unless File.exist?(path)
+      return FORMAT.read({}, collection: "schedules") unless File.exist?(path)
 
-      data = JSON.parse(File.read(path))
-      Array(data["schedules"]).map { |hash| Entry.from_h(hash) }
-    rescue JSON::ParserError => e
+      file = FORMAT.read(JSON.parse(File.read(path)), collection: "schedules")
+      file.with(entries: file.entries.map do |record|
+        if record.readable?
+          Entry.from_record(record)
+        else
+          Log.warn(:worker, "schedule_entry_unreadable",
+                   id: record.raw.is_a?(Hash) ? record.raw["id"] : nil,
+                   missing: record.missing.map(&:to_s))
+          record
+        end
+      end)
+    rescue JSON::ParserError, StateFormat::InvalidDocument => e
       Log.warn(:worker, "store_unreadable", error: e.class.name, msg: e.message)
       raise Corrupt, "#{path} is not readable JSON (#{e.message}): fix or remove it before changing schedules" if strict
 
-      []
+      FORMAT.read({}, collection: "schedules")
     end
 
-    def write(list:)
+    def write(file:)
       FileUtils.mkdir_p(@store_dir)
       FileUtils.mkdir_p(@state_dir)
-      body = { "version" => VERSION, "updated_at" => Time.now.utc.iso8601, "schedules" => list.map(&:to_h) }
+      body = FORMAT.write(file, collection: "schedules", updated_at: Time.now.utc.iso8601)
       AtomicFile.write(path, "#{JSON.pretty_generate(body)}\n")
     end
 
@@ -546,9 +714,9 @@ module Samagotchi
       FileUtils.mkdir_p(@state_dir)
       File.open(lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
         lock.flock(File::LOCK_EX)
-        list = read(strict: true)
-        yield(list)
-        write(list: list)
+        file = read(strict: true)
+        yield(file)
+        write(file: file)
       end
     end
 
@@ -558,15 +726,15 @@ module Samagotchi
       entry = lookup(id_or_name)
       return nil if entry.nil?
 
-      write_under_lock do |list|
-        position = list.index { |candidate| candidate.id == entry.id }
+      write_under_lock do |file|
+        position = file.entries.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
         next if position.nil?
 
         if delete
-          list[position] = nil
-          list.compact!
+          file.entries[position] = nil
+          file.entries.compact!
         else
-          list[position] = entry.with(enabled: enabled, last_result: enabled ? "enabled" : "disabled")
+          file.entries[position] = entry.with(enabled: enabled, last_result: enabled ? "enabled" : "disabled")
         end
       end
       entry
@@ -641,9 +809,10 @@ module Samagotchi
     # arriving from an older file is still spent.
     def reschedule(entry, now)
       if entry.recurrence[:kind] == "date"
-        entry.with(next_due: nil, last_result: "missed", firing_since: nil, enabled: false)
+        entry.with(next_due: nil, last_result: "missed", firing_since: nil, firing_token: nil, enabled: false)
       else
-        entry.with(next_due: next_due_for(entry.recurrence, from: now).utc.iso8601, last_result: "missed", firing_since: nil)
+        entry.with(next_due: next_due_for(entry.recurrence, from: now).utc.iso8601, last_result: "missed",
+                   firing_since: nil, firing_token: nil)
       end
     end
 
@@ -657,20 +826,120 @@ module Samagotchi
       one_off = entry.recurrence[:kind] == "date"
       entry.with(due_was: entry.next_due,
                  next_due: one_off ? nil : next_due_for(entry.recurrence, from: now).utc.iso8601,
-                 last_fired: now.utc.iso8601, firing_since: now.utc.iso8601, last_result: nil,
+                 last_fired: now.utc.iso8601, firing_since: now.utc.iso8601, firing_token: SecureRandom.uuid,
+                 last_result: nil,
                  enabled: one_off ? false : entry.enabled)
     end
 
     def skipped(entry, reason)
       skips = entry.skips + 1
       disabled = skips >= entry.max_skips
-      entry.with(skips: skips, firing_since: nil,
+      entry.with(skips: skips, firing_since: nil, firing_token: nil, pending_session_id: nil, pending_turn_id: nil,
                  last_result: disabled ? "disabled: #{reason}" : "skipped", enabled: !disabled)
     end
 
     def failed(entry, reason)
       failures = entry.failures + 1
-      entry.with(failures: failures, firing_since: nil, last_result: reason, enabled: failures < entry.max_failures)
+      entry.with(failures: failures, firing_since: nil, firing_token: nil, pending_session_id: nil, pending_turn_id: nil,
+                 last_result: reason, enabled: failures < entry.max_failures)
+    end
+
+    def pending_detail(entry)
+      session = Session.load(entry.pending_session_id, state_dir: @state_dir)
+      question = session.pending_question
+      return "turn is waiting for an answer" if question_started?(question, entry)
+
+      "waiting for turn #{entry.pending_turn_id}"
+    rescue Session::NotFound
+      "waiting for turn #{entry.pending_turn_id}"
+    end
+
+    def resolve_pending(entry, now)
+      session = Session.load(entry.pending_session_id, state_dir: @state_dir)
+      turn = session.last_turn if session.last_turn&.enqueued_id == entry.pending_turn_id
+      turn ||= TurnCheckpoint.settled_turn(Session.session_dir(entry.pending_session_id, state_dir: @state_dir),
+                                           entry.pending_turn_id)
+      if SessionInbox.reply_for(Session.session_dir(entry.pending_session_id, state_dir: @state_dir), entry.pending_turn_id)
+        return Outcome.new(id: entry.id, title: entry.title, status: "fired", detail: "turn completed", entry: entry)
+      end
+
+      question = session.pending_question
+      if question_started?(question, entry) && !question_after_turn?(question, turn)
+        return nil unless pending_expired?(entry, now)
+
+        return Outcome.new(id: entry.id, title: entry.title, status: "failed",
+                           detail: "no outcome", entry: entry)
+      end
+
+      if turn
+        return Outcome.new(id: entry.id, title: entry.title, status: "fired", detail: "turn completed", entry: entry) if
+          turn.outcome == "completed"
+
+        reason = [turn.outcome, turn.error_kind, turn.cancel_reason, turn.stopped_by].compact.join(": ")
+        return Outcome.new(id: entry.id, title: entry.title, status: "failed",
+                           detail: "turn #{reason.empty? ? "did not complete" : reason}", entry: entry)
+      end
+
+      return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "no outcome", entry: entry) if
+        pending_expired?(entry, now)
+
+      nil
+    rescue Session::NotFound
+      Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "session gone", entry: entry)
+    end
+
+    def question_after_turn?(question, turn)
+      return false unless question&.created_at && turn&.ended_at
+
+      Time.iso8601(question.created_at) > Time.iso8601(turn.ended_at)
+    rescue ArgumentError
+      false
+    end
+
+    def question_started?(question, entry)
+      return false unless question&.created_at && entry.firing_since
+
+      Time.iso8601(question.created_at) >= Time.iso8601(entry.firing_since)
+    rescue ArgumentError
+      false
+    end
+
+    def firing_expired?(entry, now)
+      Time.iso8601(entry.firing_since) + FIRING_TIMEOUT <= now
+    rescue ArgumentError
+      false
+    end
+
+    def pending_expired?(entry, now)
+      return true unless entry.firing_since
+
+      Time.iso8601(entry.firing_since) + pending_window(entry) <= now
+    rescue ArgumentError
+      true
+    end
+
+    def pending_window(entry)
+      seconds = case entry.recurrence[:kind]
+                when "every"
+                  self.class.interval_seconds(entry.recurrence[:interval])
+                when "weekday"
+                  # Weekly intervals exceed the cap; for run-now, due_was may
+                  # equal next_due and cannot represent that interval.
+                  PENDING_MAX_SECONDS
+                end
+      (seconds || PENDING_MAX_SECONDS).clamp(PENDING_MIN_SECONDS, PENDING_MAX_SECONDS)
+    rescue ArgumentError, TypeError
+      PENDING_MAX_SECONDS
+    end
+
+    def finish_pending(entry, outcome)
+      if outcome.status == "fired"
+        entry.with(firing_since: nil, firing_token: nil, due_was: nil, pending_session_id: nil, pending_turn_id: nil,
+                   last_result: outcome.detail, failures: 0, skips: 0)
+      else
+        updated = failed(entry, outcome.detail).with(due_was: nil)
+        entry.recurrence[:kind] == "date" ? updated.with(enabled: false) : updated
+      end
     end
 
     # :skip (busy now, try the next tick) or :fail (the target is gone or
@@ -716,12 +985,13 @@ module Samagotchi
     def busy_reason(entry, index, target)
       dir = Session.session_dir(target, state_dir: @state_dir)
       owner = SessionManager.session_owner(target, state_dir: @state_dir)
-      link = WorkerLink.resolve(dir, unlink: false, owner: owner)
+      presence = WorkerPresence.read(target, state_dir: @state_dir, owner: owner, link: :look)
+      link = presence.link
 
-      if link.worker_owned?
+      if presence.worker_owned?
         # A worker that has not published its Bridge yet (or is closing it):
         # nothing can be read from it, and firing now would race with it.
-        return [:skip, "its worker is starting or leaving"] unless link.live?
+        return [:skip, "its worker is starting or leaving"] unless presence.live?
 
         activity = ask_activity(link, target)
         if activity == :old
@@ -746,6 +1016,11 @@ module Samagotchi
 
         nil
       end
+      # A worker being started for it holds no lock yet (another ticker's
+      # firing just continued the chain to it, a resume): a chain firing
+      # would archive it from under that worker (its archive refuses it too).
+      # A queued turn is fine: the starting worker takes it.
+      return [:skip, "its worker is starting or leaving"] if entry.mode == CHAIN && presence.starting?
 
       file_busy_reason(index.session(target), dir)
     end
@@ -784,7 +1059,6 @@ module Samagotchi
     def fire_and_record(entry, index)
       outcome = fire(entry, index)
       record(entry, outcome)
-      prune(outcome.entry, index) if outcome.status == "fired" && entry.mode == CHAIN && entry.keep_links.positive?
       outcome
     end
 
@@ -800,12 +1074,25 @@ module Samagotchi
     def fire_chain(entry, index)
       head, _reason = target_of(entry, index)
       return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "the chain is gone", entry: entry) if head.nil?
+      # One stored before #add refused it: its link would refuse the line,
+      # so it fails here, with no link started and nothing archived.
+      if CommandIntake.shell_line?(entry.prompt)
+        return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: CommandIntake::REFUSED, entry: entry)
+      end
 
       # `last:<head>` so SessionContinue.run's own TRIES/`:moved` loop follows
-      # a continue a human made between here and its lock.
-      link = SessionContinue.run("last:#{head}", prompt: entry.prompt, state_dir: @state_dir)
-      Outcome.new(id: entry.id, title: entry.title, status: "fired", detail: "new link #{link.id[0, 8]}",
-                  entry: entry.with(head: link.id))
+      # a continue a human made between here and its lock. The link's first
+      # turn is the schedule's (its origin), as a same-mode firing's is.
+      link = SessionContinue.run("last:#{head}", prompt: entry.prompt, state_dir: @state_dir,
+                                                 client_id: ClientId.schedule(entry.id))
+      turn_id = link.first_turn_id
+      if turn_id.to_s.empty?
+        return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "the new link has no turn id",
+                           entry: entry)
+      end
+
+      Outcome.new(id: entry.id, title: entry.title, status: "pending", detail: "new link #{link.id[0, 8]}",
+                  entry: entry.with(head: link.id, pending_session_id: link.id, pending_turn_id: turn_id))
     rescue SessionContinue::Refused => e
       classify(entry, e.reason, e.message)
     rescue SessionManager::ArchiveRefused => e
@@ -820,14 +1107,25 @@ module Samagotchi
       # listing and this moment archives the target it just resolved to.
       dir = Session.session_dir(target, state_dir: @state_dir)
       return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "archived", entry: entry) if ArchiveStore.archived?(dir)
+      # One stored before #add refused it: the Bridge would refuse it, but a
+      # delivery that falls back to the input file is accepted.
+      if CommandIntake.shell_line?(entry.prompt)
+        return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: CommandIntake::REFUSED, entry: entry)
+      end
 
       result = SessionManager.deliver_turn(target, prompt: entry.prompt,
                                           client_id: ClientId.schedule(entry.id),
                                           delivery: Delivery::QUEUE, state_dir: @state_dir)
       if result.accepted?
+        if result.enqueued_id.to_s.empty?
+          return Outcome.new(id: entry.id, title: entry.title, status: "failed", detail: "the accepted turn has no id",
+                             entry: entry)
+        end
+
         # The head follows the turn: the next tick resolves from the link this
         # one fired into, so the walk survives a link deleted in between.
-        Outcome.new(id: entry.id, title: entry.title, status: "fired", detail: "queued a turn", entry: entry.with(head: target))
+        Outcome.new(id: entry.id, title: entry.title, status: "pending", detail: "queued a turn",
+                    entry: entry.with(head: target, pending_session_id: target, pending_turn_id: result.enqueued_id))
       else
         Outcome.new(id: entry.id, title: entry.title, status: "failed",
                     detail: "the turn was not accepted (#{result.status}: #{result.error || result.detail})", entry: entry)
@@ -842,32 +1140,32 @@ module Samagotchi
     # A run-now refused before anything was tried: the same counters a tick
     # moves for a skip or a failure. `due_was` is untouched — run-now is not a
     # scheduled occurrence, so there is no occurrence to put the clock back to.
-    def record_refusal(entry, status, reason)
-      write_under_lock do |list|
-        position = list.index { |candidate| candidate.id == entry.id }
-        next if position.nil?
-
-        stored = list[position]
-        list[position] = status == "skipped" ? skipped(stored, reason) : failed(stored, reason)
-      end
-    end
-
     # The result goes back under the lock before any pruning, so a prune that
     # raises midway cannot lose the new head.
     def record(entry, outcome)
-      write_under_lock do |list|
-        position = list.index { |candidate| candidate.id == entry.id }
-        next if position.nil?
+      write_under_lock do |file|
+        position = file.entries.index { |candidate| candidate.is_a?(Entry) && candidate.id == entry.id }
+        stored = position && file.entries[position]
+        unless stored&.firing_token == entry.firing_token && !entry.firing_token.to_s.empty?
+          Log.warn(:worker, "schedule_record_stale", id: entry.id, token: entry.firing_token)
+          next
+        end
 
-        stored = list[position]
-        updated = if outcome.status == "fired"
+        updated = case outcome.status
+                  when "pending"
+                    stored.with(head: outcome.entry.head, pending_session_id: outcome.entry.pending_session_id,
+                                pending_turn_id: outcome.entry.pending_turn_id,
+                                firing_since: stored.firing_since || entry.firing_since,
+                                due_was: stored.due_was || entry.due_was, last_result: outcome.detail)
+                  when "fired"
                     # Any success clears the skip and failure counters: twelve
                     # skips spread over months do not kill a healthy schedule.
                     # A `date` schedule is a one-off: `advance` already left it
                     # with no next_due and disabled, and a firing keeps it so.
-                    stored.with(head: outcome.entry.head, last_result: outcome.detail, firing_since: nil,
+                    stored.with(head: outcome.entry.head, last_result: outcome.detail, firing_since: nil, firing_token: nil,
+                                pending_session_id: nil, pending_turn_id: nil,
                                 failures: 0, skips: 0, last_fired: @clock.call.utc.iso8601)
-                  elsif outcome.status == "skipped"
+                  when "skipped"
                     skipped(stored, outcome.detail).with(firing_since: nil)
                   else
                     failed(stored, outcome.detail)
@@ -876,8 +1174,8 @@ module Samagotchi
         # A skip or a failure is "not now", not "late": the occurrence the tick
         # tried comes back, so the next tick tries it again. max_skips and
         # max_failures bound how often that happens.
-        updated = updated.with(next_due: stored.due_was) if outcome.status != "fired" && !stored.due_was.nil?
-        list[position] = updated
+        updated = updated.with(next_due: stored.due_was) if %w[failed skipped].include?(outcome.status) && !stored.due_was.nil?
+        file.entries[position] = updated
       end
     end