samagotchi 0.159.0 → 0.161.0

data/lib/samagotchi/web/session_hub.rb

@@ -6,6 +6,7 @@ require "time"
 
 require_relative "../session"
 require_relative "../session_manager"
+require_relative "../session_continue"
 require_relative "../schedules"
 require_relative "../bridge_client"
 require_relative "../worker_link"
@@ -45,6 +46,7 @@ module Samagotchi
       # all sessions this often (a one-shot or an older chi's REPL that
       # opened an old session without saving it has no file signal until its first save).
       FULL_PROBE_INTERVAL = 10.0
+      SCHEDULE_TICK_STOP_WAIT = 5.0
 
       # What a subscriber gets: `session` with {session: summary} for an
       # upsert, `session_gone` with {id:} for a removal, `chi` with
@@ -107,6 +109,8 @@ module Samagotchi
         @root_cache = {}    # folder → project root, for sessions saved before project_root
         @next_full_probe = nil
         @next_schedule_tick = nil
+        @schedule_tick_in_flight = false
+        @schedule_tick_thread = nil
         @wakeup = Queue.new # stop wakes the tick thread out of its sleep
         @thread = nil
         @stopped = false
@@ -129,6 +133,8 @@ module Samagotchi
         thread = @thread
         @thread = nil
         thread&.join(@scan_interval + 1.0)
+        schedule_thread = @monitor.synchronize { @schedule_tick_thread }
+        schedule_thread&.join(SCHEDULE_TICK_STOP_WAIT)
         nil
       end
 
@@ -143,6 +149,7 @@ module Samagotchi
       def scan
         @monitor.synchronize do
           full = full_probe_due?
+          SessionContinue.repair_interrupted(state_dir: @state_dir)
           scan_files
           @sessions.each_key { |id| refresh(id, probe: full) }
           if full
@@ -320,20 +327,42 @@ module Samagotchi
 
       # chi web can be the scheduler when the user opts in (schedule.auto_tick):
       # the same tick cron runs, gated by schedule.tick_interval_minutes and
-      # sharing schedules.lock, so cron and the hub never both fire.
+      # sharing schedules.lock, so cron and the hub never both fire. The scan
+      # loop only launches one tick at a time; it does not wait for a firing.
       def schedule_tick
         return unless Config.get("schedule.auto_tick")
 
         now = @now.call
-        return if @next_schedule_tick && now < @next_schedule_tick
+        @monitor.synchronize do
+          return if @schedule_tick_in_flight
+          return if @next_schedule_tick && now < @next_schedule_tick
 
-        @next_schedule_tick = now + (Samagotchi::Schedules.tick_interval_minutes * 60)
-        Samagotchi::Schedules.new(state_dir: @state_dir).tick
+          @next_schedule_tick = now + (Samagotchi::Schedules.tick_interval_minutes * 60)
+          @schedule_tick_in_flight = true
+          @schedule_tick_thread = Thread.new { run_schedule_tick }
+        end
       rescue StandardError => e
+        @monitor.synchronize do
+          if @schedule_tick_in_flight && @schedule_tick_thread.nil?
+            @schedule_tick_in_flight = false
+            @next_schedule_tick = nil
+          end
+        end
         Log.warn(:web, "schedule_tick_failed", error: e.class.name, msg: e.message)
         nil
       end
 
+      def run_schedule_tick
+        Samagotchi::Schedules.new(state_dir: @state_dir).tick
+      rescue StandardError => e
+        Log.warn(:web, "schedule_tick_failed", error: e.class.name, msg: e.message)
+      ensure
+        @monitor.synchronize do
+          @schedule_tick_in_flight = false
+          @schedule_tick_thread = nil
+        end
+      end
+
       # A change (the first look too, unless it finds nothing) is a `chi`
       # event: chi web's terminal line and the open tabs hear it.
       def check_installed
@@ -342,10 +371,25 @@ module Samagotchi
 
         @installed = newest
         emit("chi", chi_state)
+        refresh_worker_compat
       rescue StandardError => e
         Log.warn(:web, "installed_check_failed", error: e.class.name, msg: e.message)
       end
 
+      def refresh_worker_compat
+        # An installed-version change can stale a worker without changing its files.
+        @sessions.each_value do |entry|
+          summary = entry.summary
+          next unless summary&.dig(:worker_version)
+
+          compatibility = Compat.verdict(worker_version: summary[:worker_version], version: @installed || VERSION).to_s
+          next if summary[:worker_compat] == compatibility
+
+          entry.summary = summary.merge(worker_compat: compatibility)
+          emit("session", session: entry.summary)
+        end
+      end
+
       # The state dir's files: a new id is parsed and emitted, an id gone
       # from disk is dropped, a changed file is re-parsed. Skipped when the
       # dir's mtime says nothing was renamed in or unlinked since.
@@ -414,7 +458,8 @@ module Samagotchi
 
         entry.owner = owner
         entry.live = live
-        summary = SessionSummary.build(entry.session, owner: owner, session_dir: dir, registry: hub_registry)
+        summary = SessionSummary.build(entry.session, owner: owner, session_dir: dir, registry: hub_registry,
+                                       compat_version: @installed || VERSION)
         # A new worker (pid) or a new Bridge for the same session is an
         # event for the page even when the summary reads the same: it
         # reconnects its stream on it.

data/lib/samagotchi/web/session_summary.rb

@@ -11,6 +11,7 @@ require_relative "../effective_model"
 require_relative "../host_registry"
 require_relative "../bridge_client"
 require_relative "../worker_link"
+require_relative "../compat"
 require_relative "../session_row"
 require_relative "../bridge/pending_card"
 
@@ -26,7 +27,7 @@ module Samagotchi
       WEB_KEYS = %i[id status mode model_name working_directory created_at updated_at last_prompt short_id test_run
                     used_memory_names preloaded_memory_names muted_memory_names prompt_notes parent_id delegate
                     continues review first_preview title owner recap auto_title ctx_pct tokens memory_index side
-                    archived project_root bridge_up worker_version worker_features pending_question pending_card
+                    archived project_root bridge_up worker_version worker_features worker_compat pending_question pending_card
                     last_turn verdicts verify_fresh last_verdict].freeze
 
       module_function
@@ -45,9 +46,10 @@ module Samagotchi
       #   the smaller of that budget and the window, as the live meter
       #   does). nil: one is built here; a caller that builds many summaries
       #   (the session hub) keeps one and passes it.
+      # @param compat_version [String] the newest chi the worker badge compares with
       # @return [Hash] symbol keys
       def build(session, owner:, session_dir:, status: displayed_status(session, owner: owner), root_cache: nil,
-                registry: nil)
+                registry: nil, compat_version: VERSION)
         link = WorkerLink.resolve(session_dir, unlink: false, owner: owner)
         up = link.live?
         sidecar = up ? link.sidecar : nil
@@ -116,6 +118,7 @@ module Samagotchi
           # nil and [] without one): the page's stale-worker badge.
           worker_version: sidecar&.version,
           worker_features: sidecar ? sidecar.features : [],
+          worker_compat: sidecar && Compat.verdict(worker_version: sidecar.version, version: compat_version).to_s,
           # For the tab's notifications (notify.js): an open question, the
           # running turn's open card with actions, and how the last turn
           # ended. A question saved by a worker that died is not open, nor a

data/lib/samagotchi/worker.rb

@@ -4,6 +4,7 @@ require "fileutils"
 require "securerandom"
 
 require_relative "client_id"
+require_relative "command_intake"
 require_relative "config"
 require_relative "engine"
 require_relative "guardrails/parent_policy"
@@ -285,6 +286,7 @@ module Samagotchi
       end
       prune_tombstones
       settle_interrupted_turn
+      settle_stale_status
       # Before the Bridge serves anything: a UI joining a resumed worker's
       # stream gets the session's history and status in its snapshot, not
       # an empty session until the first turn.
@@ -338,7 +340,7 @@ module Samagotchi
                                         predecessor: @session.continues)
       # Its attached context's notes (ContextSources).
       @context_absorber = ContextAbsorber.new(session_id: @session_id, state_dir: @state_dir,
-                                              project_root: @session.project_root,
+                                              project_root: @session.project_root, project_id: @session.project_id,
                                               peer_sources: @engine.peer_sources, peer_turns: -> { @wakes.peer_turns })
       # What comes in between turns, and how each kind is saved.
       @inbound = WorkerInbound.new(session: @session, state_dir: @state_dir, session_dir: @session_dir, engine: @engine,
@@ -349,6 +351,9 @@ module Samagotchi
                                      @bridge.queue_command(line, client_id: client_id, after_file: after_file,
                                                                  enqueued_id: enqueued_id, author: author)
                                    })
+      # Notes its predecessor got after a continue that died before its
+      # move, or from a writer that knew no head (ChildMove.adopt's twin).
+      @inbound.adopt_notes
       # /model's default is the config's; the Engine started
       # on the session's model.  nil when there is no default.model.
       @default_model = ModelProfile.default_model_name
@@ -468,8 +473,8 @@ module Samagotchi
       # Attached context's commands, in the background; a new text wakes
       # the loop to absorb it. Not activity: the idle exit stops it.
       @context_poller = ContextPoller.new(session_id: @session_id, state_dir: @state_dir,
-                                          project_root: @session.project_root, cwd: @session.working_directory,
-                                          on_change: -> { @waker.wake }).start
+                                          project_root: @session.project_root, project_id: @session.project_id,
+                                          cwd: @session.working_directory, on_change: -> { @waker.wake }).start
       @scratch_watch = start_scratch_watch if @session.scratch
     end
 
@@ -694,6 +699,31 @@ module Samagotchi
       save_or_log(:interrupted_turn) { save_session }
     end
 
+    # No turn runs yet: a status a turn would be behind is from before this
+    # worker, and goes idle under the lock (resume_session writes nothing to
+    # the file, which this worker owns): a stopped one with no stop marker
+    # (Session.load reads it stopped while the marker is there; a stop that
+    # landed before an earlier worker took the lock saved it so), an error,
+    # a running whose worker died. Not a new session's running whose first
+    # prompt waits (WorkerInbound.initial_prompt_pending?).
+    STALE_STATUSES = [Session::STATUS_STOPPED, Session::STATUS_ERROR, Session::STATUS_RUNNING].freeze
+
+    #
+    # Saved whatever the status: the save stamps updated_at, which a resume
+    # used to move (an old session woken with no turn, an attach or a web
+    # wake, stays young for the sweep and moves up the lists). Not a
+    # stopped one: this worker leaves at once, and would write "stopped".
+    def settle_stale_status
+      return if Session.stopped_marker?(@session_id, state_dir: @state_dir)
+
+      status = @session.status
+      if STALE_STATUSES.include?(status) && !(status == Session::STATUS_RUNNING && WorkerInbound.initial_prompt_pending?(@session))
+        @session.status = Session::STATUS_IDLE
+        Log.info(:worker, "stale_status_settled", status: status)
+      end
+      save_or_log(:worker_start) { save_session }
+    end
+
     # The per-input tombstones (removed, settled, merged) older than
     # SessionInbox::TOMBSTONE_MAX_AGE, once per worker start: they only go
     # with the session dir otherwise.
@@ -759,14 +789,15 @@ module Samagotchi
     end
 
     # The first prompt (spawn_session's): a delegate child's task, which is
-    # its parent's although no client sent it. Its turn carries the id
-    # spawn_session gave it, so a wait for it (--new --wait) names it.
+    # its parent's. Its turn carries the id spawn_session gave it, so a
+    # wait for it (--new --wait) names it, and its sender
+    # (WorkerInbound#initial_origin).
     # A Verify fresh child's is a Verify turn on its claim (its verdict is
     # recorded and forwarded to the parent).
     def run_initial_prompt(prompt)
       @initial_turn = true
       fresh = @session.verify_fresh
-      run_prompt(WorkerInbound::Prompt.new(text: prompt, origin: TurnOrigin.new(enqueued_id: @session.first_turn_id),
+      run_prompt(WorkerInbound::Prompt.new(text: prompt, origin: @inbound.initial_origin,
                                            anchors: { verify: fresh&.anchor }))
     ensure
       @initial_turn = false
@@ -1222,6 +1253,14 @@ module Samagotchi
       end
     end
 
+    # A shell line from a sender that may not run one (CommandIntake: a
+    # delegate's task, a schedule's prompt, a plugin's message): not run,
+    # its command_ran an error with the one refusal text.
+    def shell_refused(command)
+      Log.warn(:worker, "shell_line_refused", client_id: command.client_id)
+      SessionCommands::Result.new(status: :error, output: CommandIntake::REFUSED, changed: [])
+    end
+
     # Whether +command+ asks before a costly /thinking or /reasoning-history
     # change (CacheConfirm): only a person at a web tab or a TUI sees the
     # question; chi send, a delegate, a plugin and a card's action apply it.
@@ -1242,6 +1281,8 @@ module Samagotchi
     # command for the line, is an error Result saying so.
     # @return [SessionCommands::Result]
     def command_result(command)
+      return shell_refused(command) if CommandIntake.refused?(command.line, command.client_id)
+
       yield || SessionCommands::Result.new(status: :error, output: "not a session command", changed: [])
     rescue StandardError => e
       SessionCommands::Result.new(status: :error, output: "#{command.line.split.first}: #{e.message}", changed: [])
@@ -1577,11 +1618,20 @@ module Samagotchi
 
           begin
             input = SessionInbox.read_input(claimed_file)
-            prompt = input.prompt.to_s.strip
-            # Which turn took it, on disk before its file goes (a wait for
-            # it reads this, not an inference: ReplyWait::Poll#follow_merge).
-            SessionInbox.mark_merged(@session_dir, input.origin.enqueued_id, into: @turn_enqueued_id) unless prompt.empty?
-            prompt.empty? ? nil : [prompt, input.origin]
+            enqueued_id = input.origin.enqueued_id
+            if SessionInbox.input_taken?(@session_dir, @session, enqueued_id) || !@engine.claim_enqueued_id(enqueued_id)
+              Log.info(:worker, "duplicate_input_dropped", enqueued_id: enqueued_id)
+              next
+            end
+            begin
+              prompt = input.prompt.to_s.strip
+              # Which turn took it, on disk before its file goes (a wait for
+              # it reads this, not an inference: ReplyWait::Poll#follow_merge).
+              SessionInbox.mark_merged(@session_dir, enqueued_id, into: @turn_enqueued_id) unless prompt.empty?
+              prompt.empty? ? nil : [prompt, input.origin]
+            ensure
+              @engine.finish_enqueued_id(enqueued_id)
+            end
           ensure
             FileUtils.rm_f(claimed_file)
           end

data/lib/samagotchi/worker_boot.rb

@@ -93,7 +93,7 @@ module Samagotchi
         # wakes a new worker, as after an idle exit.
         exit(0) if result == :stopped
         if result == :signal
-          SessionManager.resume_session(session_id, state_dir: sd) unless SessionInbox.find_new_input_files(session_dir).empty?
+          respawn(session_id, state_dir: sd, session_dir: session_dir, result: result) unless SessionInbox.find_new_input_files(session_dir).empty?
           exit(0)
         end
         exit(1) if result == :crashed
@@ -103,21 +103,31 @@ module Samagotchi
         # A restart starts its successor here, on the newest chi installed
         # (worker_command), once this one's lock is free.
         # Delegate reports that rang while it left wake one too.
-        if result == :restart && Session.stopped_marker?(session_id, state_dir: sd)
-          # A stop landed as it left: no successor (resume_session would clear
-          # the stop), and the reminders go with it.
-          ReminderCarry.remove(session_dir)
-          Log.info(:worker, "restart_dropped", why: :stopped)
-        elsif result == :restart ||
-              (%i[idle_exit exit_requested].include?(result) &&
+        if result == :restart ||
+           (%i[idle_exit exit_requested].include?(result) &&
             (!SessionInbox.find_new_input_files(session_dir).empty? || worker.wake_due?))
-          SessionManager.resume_session(session_id, state_dir: sd)
+          respawn(session_id, state_dir: sd, session_dir: session_dir, result: result)
         elsif worker.discard?
           discard_left_session(session_id, state_dir: sd, default_model: worker.default_model)
         end
         result
       end
 
+      # Start this session's next worker as this one leaves (+result+), on
+      # the session inbox's leave row (SessionInbox::WakePolicy), read on a
+      # fresh WorkerPresence now the lock is free: a stop that landed as it
+      # left wins for every way out (resume_session would clear it; a
+      # restart's reminders go with it), and a worker that took the session
+      # since, or one being started, gets no second one. What waits (input,
+      # rings) stays on disk for the next start.
+      private def respawn(session_id, state_dir:, session_dir:, result:)
+        decided = SessionInbox::WakePolicy.for(:leave).decide(WorkerPresence.read(session_id, state_dir: state_dir))
+        return SessionManager.resume_session(session_id, state_dir: state_dir) if decided == :start
+
+        ReminderCarry.remove(session_dir) if result == :restart && decided == :stopped
+        Log.info(:worker, result == :restart ? "restart_dropped" : "respawn_dropped", why: decided, reason: result)
+      end
+
       # A spawned worker leaves its spawner's process tree: a killer that
       # walks the tree by parent pid (a terminal closing, a tool's teardown
       # of a `chi send --wait` it ran in the background) no longer reaches it.
@@ -125,8 +135,9 @@ module Samagotchi
       # forks the worker, which starts a session of its own (setsid: no
       # controlling terminal, no SIGHUP from one) and returns to run the loop;
       # this one waits until the worker holds the session's OwnerLock, or has
-      # exited, or WORKER_START_GRACE passed, and exits: the spawner's waiter
-      # stays alive exactly while the worker starts (#still_starting?). The
+      # exited, or WORKER_START_GRACE passed, and exits: this process (the
+      # pid the session's starting marker names, StartingMarker) lives
+      # exactly while the worker starts (WorkerPresence#starting?). The
       # worker is reparented to init (launchd), which reaps it.
       private def detach_from_spawner(session_dir)
         worker = Process.fork

data/lib/samagotchi/worker_inbound.rb

@@ -6,9 +6,11 @@ require "time"
 
 require_relative "child_reports"
 require_relative "client_id"
+require_relative "command_intake"
 require_relative "config"
 require_relative "context_note"
 require_relative "log"
+require_relative "note_move"
 require_relative "objectives"
 require_relative "session"
 require_relative "session_inbox"
@@ -107,6 +109,21 @@ module Samagotchi
       @queue_command = queue_command
       @initial_prompt_taken = false
       @context_wake_waiting = false
+      # The link this one continues, when its notes may still come here
+      # (NoteMove.adoption): one listing, at the start.
+      @note_adoption = NoteMove.adoption(session, state_dir: state_dir)
+    end
+
+    # Take the notes written to the link this session continues since it
+    # was continued (NoteMove::Adoption): a writer that resolved the old id
+    # just before this link was saved, an older chi's. Each pass, before
+    # the notes are read; a failure is logged, the pass goes on.
+    # @return [Array<String>] the note files adopted
+    def adopt_notes
+      @note_adoption ? @note_adoption.call : []
+    rescue StandardError => e
+      Log.warn(:worker, "notes_adopt_failed", sid: @session.id[0, 8], error: e.class.name, msg: e.message)
+      []
     end
 
     # Add the queued context notes to the conversation (between turns only,
@@ -118,7 +135,9 @@ module Samagotchi
     # starts a turn nor keeps an idle worker up. Of the objectives notes in
     # a batch only the newest goes in: each is a whole list, so the older
     # ones (edits made during a turn) would only be sent for nothing.
+    # The predecessor's late notes come first (#adopt_notes).
     def absorb_notes
+      adopt_notes
       files = SessionInbox.find_new_note_files(@session_dir)
       return if files.empty? || @stopped.call
 
@@ -196,14 +215,20 @@ module Samagotchi
     # spawn_session hands the first prompt over in last_prompt, but
     # last_prompt also records every later turn's prompt (and mark_error's
     # reason), so only a session with no conversation yet has one pending; a
-    # resumed session must not replay its last turn. Taken once.
+    # resumed session must not replay its last turn. A context note may
+    # have come before the first prompt ran.
+    # @param session [Session]
+    def self.initial_prompt_pending?(session)
+      session.messages.all? { |m| ContextNote.note?(m) } && !session.last_prompt.to_s.strip.empty?
+    end
+
+    # The first prompt (.initial_prompt_pending?), taken once.
     # @return [String, nil]
     def take_initial_prompt
       return nil if @initial_prompt_taken
 
       @initial_prompt_taken = true
-      # A context note may have come before the first prompt ran.
-      return nil unless @session.messages.all? { |m| ContextNote.note?(m) } && !@session.last_prompt.to_s.strip.empty?
+      return nil unless self.class.initial_prompt_pending?(@session)
 
       prompt = @session.last_prompt
       @session.last_prompt = ""
@@ -211,11 +236,24 @@ module Samagotchi
       prompt
     end
 
+    # The first prompt's origin: the turn id spawn_session gave it (a wait
+    # for it, --new --wait, names it) and who sent it when no person did
+    # (Session#first_turn_client_id: a delegating parent, a schedule). A
+    # delegate child's task is its parent's even without the field (one
+    # spawned by an older chi, or by a caller that names no sender). NONE
+    # for a person's session from before either field.
+    # @return [TurnOrigin]
+    def initial_origin
+      client_id = @session.first_turn_client_id
+      client_id ||= ClientId.delegate(@session.parent_id) if @session.delegate? && @session.parent_id
+      TurnOrigin.of(client_id: client_id, enqueued_id: @session.first_turn_id)
+    end
+
     # The first prompt as a command (queued): the session was saved as
     # running for a turn that won't run.
     # @return [Boolean] whether it was one
     def initial_command?(prompt)
-      return false unless queue_as_command(prompt, TurnOrigin::NONE)
+      return false unless queue_as_command(prompt, initial_origin)
 
       @session.status = Session::STATUS_IDLE
       save(:initial_command, unless_stopped: true)
@@ -231,11 +269,20 @@ module Samagotchi
 
       begin
         input = SessionInbox.read_input(claimed_file)
-        return if input.prompt.to_s.strip.empty?
-        return if input.images.empty? && queue_as_command(input.prompt, input.origin, File.basename(input_file))
-
-        yield Prompt.new(text: input.prompt, origin: input.origin, no_interrupt: input.no_interrupt, images: input.images,
-                         delivery: input.delivery, anchors: input.anchors)
+        enqueued_id = input.origin.enqueued_id
+        if SessionInbox.input_taken?(@session_dir, @session, enqueued_id) || !@engine.claim_enqueued_id(enqueued_id)
+          Log.info(:worker, "duplicate_input_dropped", enqueued_id: enqueued_id)
+          return
+        end
+        begin
+          return if input.prompt.to_s.strip.empty?
+          return if input.images.empty? && queue_as_command(input.prompt, input.origin, File.basename(input_file))
+
+          yield Prompt.new(text: input.prompt, origin: input.origin, no_interrupt: input.no_interrupt, images: input.images,
+                           delivery: input.delivery, anchors: input.anchors)
+        ensure
+          @engine.finish_enqueued_id(enqueued_id)
+        end
       ensure
         FileUtils.rm_f(claimed_file)
       end
@@ -264,7 +311,11 @@ module Samagotchi
     # POST /turn; an unknown /word stays a prompt. Queued: the loop's next
     # pass runs it. A participant's is refused (dropped, with its audit
     # line): commands and shell lines are the owner's (chi web and the
-    # Bridge refuse them first; this is the worker's own layer).
+    # Bridge refuse them first; this is the worker's own layer). From a
+    # sender that may not send commands (CommandIntake.allowed?: a
+    # delegate, a schedule, a plugin...) a /word line is a prompt, and a
+    # shell line is queued for Worker#run_command_line to refuse, so its
+    # sender and the UIs see the refusal as the command's error.
     # @return [Boolean] whether +text+ was one
     def queue_as_command(text, origin, after_file = nil)
       return false unless @engine.command_registry.command?(text.to_s)
@@ -275,6 +326,7 @@ module Samagotchi
                                                 what: "command", reason: "not_permitted")
         return true
       end
+      return false unless CommandIntake.allowed?(origin.client_id) || CommandIntake.shell_line?(text)
 
       @queue_command.call(text, origin.client_id, after_file, origin.enqueued_id)
       true

data/lib/samagotchi/worker_link.rb

@@ -4,6 +4,7 @@ require "fileutils"
 require "time"
 require_relative "owner_lock"
 require_relative "version"
+require_relative "compat"
 require_relative "worker_sidecar"
 require_relative "bridge_client"
 require_relative "chi_invocation"
@@ -137,7 +138,9 @@ module Samagotchi
       return Starting.new(owner: owner, stuck: false) unless owner.worker?
       return Leaving.new(owner: owner) if owner.leaving?
       return Starting.new(owner: owner, stuck: stuck?(owner)) unless ours?(sidecar, owner)
-      return Skew.new(sidecar: sidecar, owner: owner, reason: :protocol) if sidecar.protocol.to_i > PROTOCOL
+      if Compat.verdict(worker_version: sidecar.version, worker_protocol: sidecar.protocol, protocol: PROTOCOL) == :refused
+        return Skew.new(sidecar: sidecar, owner: owner, reason: :protocol)
+      end
 
       Live.new(sidecar: sidecar, owner: owner)
     end

data/lib/samagotchi/worker_presence.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require_relative "session"
+require_relative "owner_lock"
+require_relative "worker_link"
+require_relative "starting_marker"
+require_relative "archive_store"
+
+module Samagotchi
+  # Whether a session's worker is there, coming or held off, read once for
+  # one decision: the one reader of the liveness facts that the deciders
+  # ("start a worker for this session?", "is one up?") combine. Each fact is
+  # read from disk by WorkerPresence.read; the predicates are named after what
+  # the deciders ask, and each decider keeps its own subset and order (the
+  # session inbox's WakePolicy is the table of most of them).
+  #
+  # "Stopped" is #stop_marked?, the `<id>/stopped` marker (a `chi sessions
+  # stop`; a resume removes it): no decider reads the session file's status
+  # (turn state). Nor is the file read here: the one decider that needs it
+  # (a scratch session, WakePolicy#decide) reads it last, itself.
+  #
+  # @!attribute session_id [String]
+  # @!attribute exists [Boolean] its session file is there (Session.exist?)
+  # @!attribute owner [OwnerLock::Owner, nil] the owner lock's holder: a
+  #   worker, a one-turn chi run (kind tui) or nil when free
+  # @!attribute stop_marked [Boolean] the `stopped` marker (Session.stopped_marker?)
+  # @!attribute starting_marked [Boolean] the `starting` marker, fresh
+  #   (StartingMarker.fresh?): a worker is being started for it (every spawn
+  #   writes it, until the worker holds the lock)
+  # @!attribute archived [Boolean] ArchiveStore.archived?
+  # @!attribute link [WorkerLink::Live, WorkerLink::Starting, WorkerLink::Leaving,
+  #   WorkerLink::None, WorkerLink::Stale, WorkerLink::Skew, nil] the Bridge
+  #   outcome, when read (+link:+), else nil
+  WorkerPresence = Data.define(:session_id, :exists, :owner, :stop_marked, :starting_marked, :archived, :link) do
+    # Read the facts for +session_id+ now.
+    # @param state_dir [String, nil] nil: Session.default_state_dir
+    # @param owner [OwnerLock::Owner, nil, :read, #call] the lock's holder as
+    #   the caller already read it (SessionManager.session_owner, a stand-in
+    #   manager's), or a reader of it called only for a valid id; :read reads
+    #   it here (OwnerLock.owner)
+    # @param link [nil, :look, :unlink] also resolve the WorkerLink:
+    #   :look leaves a stale sidecar, :unlink removes it (WorkerLink.resolve,
+    #   given the owner read here or by the caller: one moment's snapshot)
+    # @return [WorkerPresence]
+    def self.read(session_id, state_dir: nil, owner: :read, link: nil)
+      return absent(session_id, link: link) unless Session.valid_id?(session_id)
+
+      owner = owner.call if owner.respond_to?(:call)
+      sd = state_dir || Session.default_state_dir
+      dir = Session.session_dir(session_id, state_dir: sd)
+      owner = OwnerLock.owner(dir) if owner == :read
+      new(session_id: session_id,
+          exists: Session.exist?(session_id, state_dir: sd),
+          owner: owner,
+          stop_marked: Session.stopped_marker?(session_id, state_dir: sd),
+          starting_marked: StartingMarker.fresh?(session_id, state_dir: sd),
+          archived: ArchiveStore.archived?(dir),
+          link: link && WorkerLink.resolve(dir, unlink: link == :unlink, owner: owner))
+    end
+
+    # An id that isn't one names no session: nothing on disk is read
+    # (Session.session_dir would raise), and a link asked for is None.
+    # @return [WorkerPresence]
+    def self.absent(session_id, link: nil)
+      new(session_id: session_id, exists: false, owner: nil, stop_marked: false, starting_marked: false,
+          archived: false, link: link && WorkerLink::None.new)
+    end
+
+    def initialize(session_id:, exists:, owner:, stop_marked:, starting_marked:, archived:, link: nil) = super
+
+    def exists? = exists
+    def archived? = archived
+
+    # Someone holds the owner lock: a worker or a one-turn chi run.
+    def owned? = !owner.nil?
+
+    # A one-turn chi run (`chi -p X --non-interactive`, kind tui) holds it:
+    # nothing else may resume, stop or delete it.
+    def tui_owned? = owner&.tui? == true
+
+    # The `<id>/stopped` marker: a user's stop, not the turn's status.
+    def stop_marked? = stop_marked
+
+    # A worker is being started for it: the fresh `starting` marker
+    # (StartingMarker) a spawn writes until its worker holds the lock.
+    def starting? = starting_marked
+
+    # A worker being started (#starting?, from any process) may not hold the
+    # lock yet, and no stop came since: a stop cancels the hold-off (a
+    # resume after it clears the stop and spawns; the starting worker and
+    # the new one race the lock, one wins). Of resumes after one stop, one
+    # spawns: resume_session's claim takes over only a start marked before
+    # the stop.
+    def start_pending? = starting? && !stop_marked?
+
+    # resume_session's hold-off, after the owner: a start pending.
+    def resume_held_off? = start_pending?
+
+    # The Bridge answers (WorkerLink::Live). False when the link wasn't read.
+    def live? = link&.live? == true
+
+    # A worker holds the lock, Bridge or not (Live, Starting, Leaving, Skew).
+    # False when the link wasn't read.
+    def worker_owned? = link&.worker_owned? == true
+  end
+end

data/lib/samagotchi/worker_sidecar.rb

@@ -8,8 +8,7 @@ module Samagotchi
   # A worker's bridge.json in its session directory: how clients reach its
   # Bridge (port, bind), when it started (a new worker behind the same
   # "worker" owner), the chi it runs (chi update, the web's stale-worker
-  # badge), the input-file format it reads (SessionInbox::INPUT_FORMAT) and
-  # what else it can do (Bridge::FEATURES), and its Bridge's epoch (the
+  # badge), what else it can do (Bridge::FEATURES), and its Bridge's epoch (the
   # one worker identity: the epoch in every event id, so a remote client
   # tells a restarted worker apart; nil from a worker before it), and its
   # Bridge's secret (every request names it in X-Chi-Bridge, Bridge#secret_ok?;
@@ -57,12 +56,12 @@ module Samagotchi
 
     # Written whole or not at all, readable by this user only (0600 from the
     # moment the file exists, AtomicFile: no other account learns the
-    # worker's port or its secret from it); input_format, epoch, secret, pid
+    # worker's port or its secret from it); epoch, secret, pid
     # and protocol only when they name one.
     def write(session_dir)
       FileUtils.mkdir_p(session_dir)
       record = to_h.transform_keys(&:to_s)
-      record.delete("input_format") if input_format.nil?
+      record.delete("input_format")
       record.delete("epoch") if epoch.nil?
       record.delete("secret") if secret.nil?
       record.delete("pid") if pid.nil?