samagotchi 0.160.0 → 0.161.0

data/lib/samagotchi/session.rb

@@ -5,6 +5,7 @@ require "json"
 require "securerandom"
 require "time"
 require_relative "atomic_file"
+require_relative "log"
 require_relative "context_note"
 require_relative "interrupted_turn"
 require_relative "last_turn"
@@ -485,6 +486,10 @@ module Samagotchi
       @archived = false
       # #save's lock: one snapshot-and-write at a time (see #save).
       @save_lock = Mutex.new
+      # Read from its file (.load, .summary_from_file) or saved once: its
+      # file is there to rewrite, and one gone was deleted (#save doesn't
+      # bring it back).
+      @persisted = false
     end
 
     # Whether a chi newer than this one saved the loaded file: its
@@ -579,8 +584,7 @@ module Samagotchi
     # @raise [Toolkit::Refused] its toolkit (setup's, else the configured
     #   one SessionManager.spawn_session gives it) builds on a config kit
     #   with an invalid groups: (Toolkit.check_new!)
-    def self.new_session(mode:, model_name:, working_directory:, test_run: nil,
-                         preloaded_memory_names: [], muted_memory_names: [], parent_id: nil, messages: [],
+    def self.new_session(mode:, model_name:, working_directory:, test_run: nil, parent_id: nil, messages: [],
                          scratch: false, model_typed: nil, delegate: false, setup: nil, continues: nil,
                          review: nil, now: Time.now)
       own = setup.to_h
@@ -607,8 +611,6 @@ module Samagotchi
         test_run: resolved_test,
         project_root: project&.root,
         project_id: project&.id,
-        preloaded_memory_names: preloaded_memory_names,
-        muted_memory_names: muted_memory_names,
         parent_id: parent_id,
         scratch: scratch,
         delegate: delegate,
@@ -636,6 +638,7 @@ module Samagotchi
       raise NotFound, session_id unless File.exist?(path)
 
       session = from_h(JSON.parse(File.read(path)))
+      session.persisted!
       session.status = STATUS_STOPPED if stopped_marker?(session.id, state_dir: state_dir)
       session.parent_id = parent_override(session.id, state_dir: state_dir) || session.parent_id
       session
@@ -764,6 +767,7 @@ module Samagotchi
       return nil unless valid_id?(data["id"])
 
       session = from_h(data, messages: false)
+      session.persisted!
       session.status = STATUS_STOPPED if stopped_marker?(session.id, state_dir: File.dirname(path))
       session.parent_id = parent_override(session.id, state_dir: File.dirname(path)) || session.parent_id
       session
@@ -771,6 +775,10 @@ module Samagotchi
       nil
     end
 
+    # This session was read from its file (#save then refuses to recreate
+    # a deleted one).
+    def persisted! = (@persisted = true)
+
     # Persist the session atomically. Updates +updated_at+ in place.
     #
     # One save at a time per Session: a worker saves its session from the
@@ -782,6 +790,11 @@ module Samagotchi
     # Never call it from a trap handler (Mutex#lock raises ThreadError
     # there; WorkerSignals saves on a thread of its own) or from inside a
     # save (the lock isn't re-entrant).
+    #
+    # A session read from its file, or saved once, whose file is gone was
+    # deleted (SessionManager.delete_session, the retention sweep): the save
+    # is skipped (and logged) rather than bring it back. Only a new
+    # session's first save creates the file.
     # @param now [Time, nil] the updated_at to stamp (a spec's clock); nil,
     #   the time the lock is taken
     def save(state_dir: self.class.default_state_dir, now: nil)
@@ -796,7 +809,13 @@ module Samagotchi
         # Auto-compute first_preview if not yet cached and messages contain a user entry.
         compute_first_preview!
 
+        if @persisted && !File.exist?(path)
+          Log.warn(:worker, "save_skipped_deleted", sid: @id)
+          return self
+        end
+
         AtomicFile.write(path, JSON.pretty_generate(to_h) + "\n")
+        @persisted = true
       end
       self
     end
@@ -860,7 +879,25 @@ module Samagotchi
 
       dir = session_dir(session_id, state_dir: state_dir)
       FileUtils.mkdir_p(dir)
-      FileUtils.touch(File.join(dir, STOPPED_FILE))
+      # Its own at, on the clock the starting marker's at is written with
+      # (StartingMarker; resume_session compares them): a file's mtime may be
+      # coarse or skewed. Older chi readers ask only whether it exists.
+      AtomicFile.write(File.join(dir, STOPPED_FILE), JSON.generate({ "at" => Time.now.iso8601(6) }))
+    end
+
+    # When the stop marker was written: its own at, or (an older chi's empty
+    # file) its mtime; nil without one.
+    # @return [Time, nil]
+    def self.stopped_at(session_id, state_dir: default_state_dir)
+      path = File.join(session_dir(session_id, state_dir: state_dir), STOPPED_FILE)
+      own = begin
+        Time.iso8601(JSON.parse(File.read(path))["at"].to_s)
+      rescue JSON::ParserError, ArgumentError, TypeError, NoMethodError
+        nil
+      end
+      own || File.mtime(path)
+    rescue SystemCallError
+      nil
     end
 
     # Remove the stop marker (a resume, before its worker starts).

data/lib/samagotchi/session_access/local.rb

@@ -19,6 +19,7 @@ require_relative "../send_command/busy"
 require_relative "../chi_invocation"
 require_relative "../worker_sidecar"
 require_relative "../worker_link"
+require_relative "../worker_presence"
 require_relative "../review_start"
 require_relative "../launch_mode"
 require_relative "../participants"
@@ -103,7 +104,7 @@ module Samagotchi
         session = show(id)
         raise Refused.new(Session::SCRATCH_REFUSED, code: "scratch") if session.scratch
 
-        link = WorkerLink.resolve(session_dir(id), unlink: true)
+        link = WorkerPresence.read(id, state_dir: state_dir!, link: :unlink).link
         case link
         when WorkerLink::Live then return Woken.new(woke: false, sidecar: link.sidecar)
         when WorkerLink::Skew then raise Refused.new(link.message(id), code: "worker_newer")
@@ -126,8 +127,8 @@ module Samagotchi
       # @raise [ArgumentError] no such session
       def worker(id)
         show(id)
-        WorkerState.new(link: WorkerLink.resolve(session_dir(id), unlink: true),
-                        stopped: Session.stopped_marker?(id, state_dir: state_dir!))
+        presence = WorkerPresence.read(id, state_dir: state_dir!, link: :unlink)
+        WorkerState.new(link: presence.link, stopped: presence.stop_marked?)
       end
 
       # --- create and send
@@ -143,11 +144,11 @@ module Samagotchi
 
         start = spec.preview ? { prompt: spec.prompt, preview: spec.preview } : { prompt: spec.prompt }
         if spec.continues
-          return SessionContinue.run(spec.continues, **start, model: spec.model_name, **dir)
+          return SessionContinue.run(spec.continues, **start, model: spec.model_name, client_id: spec.client_id, **dir)
         end
 
         SessionManager.spawn_session(**start, working_directory: spec.working_directory, model_name: spec.model_name,
-                                              setup: spec.setup, **dir)
+                                              setup: spec.setup, client_id: spec.client_id, **dir)
       end
 
       # A review session (ReviewStart): a fork of review.from, or a fresh
@@ -313,20 +314,17 @@ module Samagotchi
         return ContextPush.new(status: :missing) unless attached
         return ContextPush.new(status: :not_push) unless attached.source.push?
 
-        before, written = attached.location.locked(name) do
-          [attached.location.snapshot(name).revision, attached.location.record_text(name, fetched)]
-        end
-        if fetched.wake && before != written.revision && !target.project? && attached.location.session? &&
-           attached.source.scope == "session"
-          begin
-            subscription = attached.location.subscription(name)
-            recent_wake = context_wake_recent?(subscription)
-            SessionManager.wake_for_context(target.session_id, **dir) unless recent_wake || Config.get("context.wake") == false
-          rescue StandardError => e
-            Log.exception(:context, "context_push_wake_failed", e, sid: target.session_id, source: name)
+        record = lambda do
+          attached.location.locked(name) do
+            [attached.location.snapshot(name).revision, attached.location.record_text(name, fetched)]
           end
         end
-        ContextPush.new(status: :pushed, before: before, revision: written.revision)
+        unless !target.project? && attached.location.session? && attached.source.scope == "session"
+          before, written = record.call
+          return ContextPush.new(status: :pushed, before: before, revision: written.revision)
+        end
+
+        push_delivery(target.session_id, name, fetched, attached.location, record)
       end
 
       # The target's sources: a session's own, then its project's (shadowed
@@ -468,6 +466,36 @@ module Samagotchi
 
       private
 
+      # A session source's push, as a push delivery (SessionInbox.deliver
+      # :push): the text recorded, then a wake when it asks one (a change
+      # with wake, context.wake on, the source not woken lately) as the
+      # push WakePolicy decides (an idle-exited session starts; a stopped
+      # one never). A failed wake is logged: the push stands.
+      # @return [ContextPush]
+      def push_delivery(session_id, name, fetched, location, record)
+        before = written = asked = nil
+        delivered = begin
+          SessionInbox.deliver(:push, session_id, state_dir: state_dir!) do
+            before, written = record.call
+            asked = fetched.wake && before != written.revision && context_wake_allowed?(location, name)
+          end
+        rescue StandardError => e
+          raise unless written
+
+          Log.exception(:context, "context_push_wake_failed", e, sid: session_id, source: name)
+          nil
+        end
+        # Its session file is gone (:gone): the source's folder takes it, as before.
+        before, written = record.call if delivered&.refused?
+        ContextPush.new(status: :pushed, before: before, revision: written.revision, wake: asked ? delivered&.wake : nil)
+      end
+
+      def context_wake_allowed?(location, name)
+        return false if Config.get("context.wake") == false
+
+        !context_wake_recent?(location.subscription(name))
+      end
+
       def grants = @grants ||= Grants.new(Grants.path(state_dir: state_dir!))
 
       LOCAL_PROBE_TIMEOUT = 1.0

data/lib/samagotchi/session_access/remote.rb

@@ -317,14 +317,17 @@ module Samagotchi
       def note(id, text:, source:)
         reply = request(:post, "#{session_path(id)}/notes", body: { text: text, source: source })
         json = reply.json.is_a?(Hash) ? reply.json : {}
+        # id: the link that has it, or refused it (a chi web before it names none: +id+).
+        head = Session.valid_id?(json["id"]) ? json["id"] : id
         case reply.status
         when 200
           raise_refusal(reply) unless json["status"].is_a?(String)
 
-          NoteDelivery::Result.new(id: id, status: json["status"].to_sym, queued: json["queued"].to_i)
+          NoteDelivery::Result.new(id: head, asked: id, status: json["status"].to_sym, queued: json["queued"].to_i)
         when 409
           if json["error"] == "owned_by_tui"
-            return NoteDelivery::Result.new(id: id, status: :refused, queued: 0, scratch: json["scratch"] == true)
+            return NoteDelivery::Result.new(id: head, asked: id, status: :refused, queued: 0,
+                                            scratch: json["scratch"] == true)
           end
 
           raise_refusal(reply)
@@ -508,7 +511,10 @@ module Samagotchi
         reply = request(:post, "#{session_path(target.session_id)}/context/#{name}/push",
                         body: { text: fetched.text, summary: fetched.summary, wake: fetched.wake, hint: fetched.hint })
         case reply.status
-        when 200 then ContextPush.new(status: :pushed, before: reply.json["before"], revision: reply.json["revision"])
+        when 200
+          # An older chi web's answer names no wake: the line is as it was.
+          wake = ContextPush::WAKES.find { |known| known.to_s == reply.json["wake"] }
+          ContextPush.new(status: :pushed, before: reply.json["before"], revision: reply.json["revision"], wake: wake)
         when 404
           return ContextPush.new(status: :missing) if context_missing?(reply)
 
@@ -736,7 +742,8 @@ module Samagotchi
           raise SessionManager::ScratchSession, sid if json["scratch"] == true
 
           raise SessionManager::OwnedByTUI, sid
-        when "worker_running", "still_stopping" then raise SessionManager::DeleteRefused.new(sid, reason)
+        when "worker_running", "still_stopping", "scheduled"
+          raise SessionManager::DeleteRefused.new(sid, reason, message: message)
         when "busy", "scratch"
           raise SessionManager::ArchiveRefused.new(sid, reason, busy_id: json["busy_id"]) if reason
         when "continued", "open_children", "folder_gone"

data/lib/samagotchi/session_access/web_bridge_client.rb

@@ -141,8 +141,8 @@ module Samagotchi
 
       # POST …/cancel.
       # @return [BridgeClient::Response]
-      def cancel(reason:)
-        post(:cancel, "cancel", { reason: reason })
+      def cancel(reason:, turn_id: nil)
+        post(:cancel, "cancel", { reason: reason, turn_id: turn_id }.compact)
       end
 
       # POST …/exit: the worker asked to exit (chi web passes client_id on

data/lib/samagotchi/session_access.rb

@@ -271,9 +271,15 @@ module Samagotchi
     # chi context push's outcome: :pushed (+before+ the revision it had,
     # +revision+ the new one), :missing (no such source), :not_push (a
     # command source, whose text is its command's) or :continued (the
-    # session was continued, as +next_id+: nothing was written).
-    ContextPush = Data.define(:status, :before, :revision, :next_id) do
-      def initialize(status:, before: nil, revision: nil, next_id: nil) = super
+    # session was continued, as +next_id+: nothing was written). +wake+:
+    # what a push that asked for a wake did (SessionInbox.deliver :push:
+    # :woken, :live, :stopped, :starting, :archived, :scratch, :owned,
+    # :gone), nil when it asked none (or an older chi web's answer has none).
+    ContextPush = Data.define(:status, :before, :revision, :next_id, :wake) do
+      def initialize(status:, before: nil, revision: nil, next_id: nil, wake: nil) = super
+
+      # What chi context push adds to its line for the wake, else nil.
+      def wake_line = ContextPush::WAKE_LINES[wake]
 
       # Why a push to +name+ was refused as :not_push: a command source's
       # text is its command's, and a push between two fetches would read
@@ -289,5 +295,12 @@ module Samagotchi
           "attach it to #{next_id} (or pair again with #{next_id}) and push there"
       end
     end
+
+    # The wakes a chi web's push answer may name (Remote reads no other).
+    ContextPush::WAKES = %i[woken live stopped starting archived scratch owned gone].freeze
+    # chi context push's words for a wake; none for the others (:live: the
+    # worker sees it as any push).
+    ContextPush::WAKE_LINES = { woken: "chi woken", stopped: "chi is stopped: it sees this at its next start",
+                                starting: "chi is starting" }.freeze
   end
 end

data/lib/samagotchi/session_continue.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require "json"
+require "securerandom"
+require_relative "atomic_file"
 require_relative "session"
 require_relative "session_setup"
 require_relative "session_inbox"
@@ -9,6 +12,7 @@ require_relative "objectives"
 require_relative "child_move"
 require_relative "starting_marker"
 require_relative "context_move"
+require_relative "note_move"
 require_relative "archive_store"
 require_relative "recap_store"
 require_relative "bridge_client"
@@ -56,6 +60,8 @@ module Samagotchi
     RECAP_WAIT = 30.0
     # In the previous link's folder: one continue of a session at a time.
     LOCK = "continue.lock"
+    # A durable record in the previous link's folder, written before archive.
+    CONTINUE_INTENT = "continue.json"
     # How often a last:<id> continue looks again when another continue
     # moved the chain's end while it waited for the lock.
     TRIES = 3
@@ -67,6 +73,29 @@ module Samagotchi
     # (ChildMove::Plan) and the new link's model (ModelChoice).
     Checked = Data.define(:plan, :choice)
 
+    # Repair an interrupted continue before showing sessions or starting
+    # another continue. An active continue holds LOCK, so its intent is left
+    # alone; after a crash, an unsaved successor means the previous link is
+    # unarchived.
+    def self.repair_interrupted(state_dir:)
+      return unless Dir.exist?(state_dir)
+
+      paths = Dir.glob(File.join(state_dir, "*", CONTINUE_INTENT))
+      return if paths.empty?
+
+      sessions = Session.list(state_dir: state_dir, include_archived: true)
+      by_id = sessions.to_h { |session| [session.id, session] }
+      paths.each do |path|
+        id = File.basename(File.dirname(path))
+        session = by_id[id]
+        if session
+          repair_intent(session, state_dir, path, sessions)
+        else
+          quarantine_intent(path, id, message: "session file could not be loaded")
+        end
+      end
+    end
+
     # Start the next link of a chain: a new session that continues
     # +id_or_ref+ (Session#continues) in its folder, on its model (the name
     # it was typed as, so an alias holds) and with its own setup (SessionSetup),
@@ -105,6 +134,7 @@ module Samagotchi
     def self.run(id_or_ref, prompt: nil, preview: nil, model: nil, state_dir: nil, recap_wait: RECAP_WAIT, archive_wait: 5,
                  client_id: nil)
       sd = state_dir || Session.default_state_dir
+      repair_interrupted(state_dir: sd)
       TRIES.times do |try|
         id = SessionChain.resolve(id_or_ref, state_dir: sd)
         result = with_lock(id, sd) do
@@ -140,24 +170,100 @@ module Samagotchi
       already = [id, *SessionManager.descendant_ids(id, state_dir, except: plan.move)].select do |sid|
         ArchiveStore.archived?(Session.session_dir(sid, state_dir: state_dir))
       end
+      successor_id = SecureRandom.uuid
+      intent_path = continue_intent_path(id, state_dir)
+      intent_data = { successor_id: successor_id, previously_archived: already }
+      AtomicFile.write(intent_path, "#{JSON.generate(intent_data)}\n", perm: 0o600)
       archive = SessionManager.archive_session(id, state_dir: state_dir, wait: archive_wait, except: plan.move)
       archived = archive.archived - already
+      intent_data[:archived_ids] = archived
+      AtomicFile.write(intent_path, "#{JSON.generate(intent_data)}\n", perm: 0o600)
+      # The notes the new link took from this one (NoteMove.move).
+      notes = []
       begin
-        spawn_continuation(previous, prompt: prompt, preview: preview, choice: checked.choice, state_dir: state_dir,
-                                     move: plan.move, client_id: client_id)
-      rescue StandardError
+        link = spawn_continuation(previous, prompt: prompt, preview: preview, choice: checked.choice, state_dir: state_dir,
+                                  move: plan.move, client_id: client_id, notes: notes, session_id: successor_id)
+      rescue StandardError, Interrupt
         # Nothing started: the delegates go back, what this archived goes
         # back to the lists, and a new link saved before its worker failed
         # to spawn goes (left, it would hold the chain: "continued already",
-        # last: to it).
-        undo_move(id, state_dir, moved: plan.move)
-        begin
-          discard_failed_link(id, state_dir)
-        ensure
-          archived.each { |sid| ArchiveStore.unarchive(sid, state_dir: state_dir) }
-          wake_for_rings(id, state_dir) unless plan.move.empty?
+        # last: to it), its notes given back first.
+        undo_failed_continue(id, state_dir, moved: plan.move, archived: archived) do
+          discard_failed_link(id, state_dir, notes: notes)
         end
+        FileUtils.rm_f(intent_path)
         raise
+      else
+        FileUtils.rm_f(intent_path)
+        link
+      end
+    end
+
+    private_class_method def self.continue_intent_path(id, state_dir)
+      File.join(Session.session_dir(id, state_dir: state_dir), CONTINUE_INTENT)
+    end
+
+    private_class_method def self.repair_intent(session, state_dir, path, sessions)
+      lock_path = File.join(Session.session_dir(session.id, state_dir: state_dir), LOCK)
+      File.open(lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
+        next unless lock.flock(File::LOCK_EX | File::LOCK_NB)
+        next unless File.file?(path)
+
+        intent = JSON.parse(File.read(path))
+        intent = {} unless intent.is_a?(Hash)
+        successor_id = intent["successor_id"]
+        successor_path = Session.session_file(successor_id, state_dir: state_dir) if Session.valid_id?(successor_id)
+        successor = JSON.parse(File.read(successor_path)) if successor_path && File.file?(successor_path)
+        unless successor.is_a?(Hash) && successor["continues"] == session.id
+          previously_archived = Array(intent["previously_archived"]).select { |id| Session.valid_id?(id) }
+          archived = if intent["archived_ids"].is_a?(Array)
+                       intent["archived_ids"].select { |id| Session.valid_id?(id) }
+                     else
+                       archived_descendants(session.id, sessions, state_dir) - previously_archived
+                     end
+          undo_failed_continue(session.id, state_dir, moved: [], archived: archived)
+        end
+        FileUtils.rm_f(path)
+      end
+    rescue JSON::ParserError => e
+      quarantine_intent(path, session.id, error: e)
+    rescue Errno::ENOENT
+      nil
+    end
+
+    private_class_method def self.quarantine_intent(path, session_id, error: nil, message: nil)
+      File.rename(path, "#{path}.bad")
+      Log.warn(:worker, "continue_repair_failed", sid: session_id, path: path,
+                                                    error: error&.class&.name || "SessionUnavailable",
+                                                    msg: (message || error.message).to_s[0, 200])
+    rescue Errno::ENOENT
+      nil
+    end
+
+    private_class_method def self.archived_descendants(id, sessions, state_dir)
+      children = sessions.group_by(&:parent_id)
+      queue = [id]
+      descendants = []
+      until queue.empty?
+        children.fetch(queue.shift, []).each do |child|
+          next if descendants.include?(child.id)
+
+          descendants << child.id
+          queue << child.id
+        end
+      end
+      [id, *descendants].select do |session_id|
+        ArchiveStore.archived?(Session.session_dir(session_id, state_dir: state_dir))
+      end
+    end
+
+    private_class_method def self.undo_failed_continue(id, state_dir, moved:, archived:)
+      undo_move(id, state_dir, moved: moved)
+      begin
+        yield if block_given?
+      ensure
+        archived.each { |sid| ArchiveStore.unarchive(sid, state_dir: state_dir) }
+        wake_for_rings(id, state_dir) unless moved.empty?
       end
     end
 
@@ -175,10 +281,16 @@ module Samagotchi
     # The link a failed #run saved (no other continues +id+:
     # check! made sure under the lock): its worker stopped if one
     # started, then the rings a moved delegate wrote into it just before
-    # the undo go back to +id+, then the link goes. A worker that outlives
-    # the stop is raised (SessionManager::DeleteRefused): the link stays,
-    # and the caller hears it.
-    private_class_method def self.discard_failed_link(id, state_dir)
+    # the undo go back to +id+. Then its session file goes first, so the
+    # link is out of the chain (a note to +id+ stays there:
+    # SessionInbox::Head) and a writer that resolved it before finds it gone,
+    # then the notes it moved there (+notes+) go back with any sent to it
+    # meanwhile (NoteMove.give_back), then the link's folder goes, and one
+    # last look gives back a note an older chi wrote after the delete
+    # (its write_note recreates the folder). A worker that outlives the
+    # stop is raised (SessionManager::DeleteRefused): the link stays, and
+    # the caller hears it.
+    private_class_method def self.discard_failed_link(id, state_dir, notes:)
       orphan = SessionChain.next_of(id, state_dir: state_dir) or return
       if SessionManager.refuse_tui!(orphan, state_dir: state_dir) &&
          !SessionManager.stop_session(orphan, state_dir: state_dir, wait: SessionManager::STOP_WAIT)
@@ -186,13 +298,26 @@ module Samagotchi
       end
 
       ChildMove.return_rings(from: orphan, to: id, state_dir: state_dir)
-      SessionManager.delete_session(orphan, state_dir: state_dir)
+      FileUtils.rm_f(Session.session_file(orphan, state_dir: state_dir))
+      NoteMove.give_back(from: orphan, to: id, moved: notes, state_dir: state_dir)
+      SessionManager.delete_session(orphan, state_dir: state_dir, allow_scheduled: true)
+      give_back_strays(orphan, id, state_dir)
     rescue SessionManager::DeleteRefused
       raise
     rescue StandardError => e
       Log.warn(:worker, "continue_cleanup_failed", sid: id, error: e.class.name, msg: e.message)
     end
 
+    # A failed link's folder an older chi's note brought back after its
+    # delete: the note goes back to +id+, the folder goes again.
+    private_class_method def self.give_back_strays(orphan, id, state_dir)
+      dir = Session.session_dir(orphan, state_dir: state_dir)
+      return unless Dir.exist?(dir) && !Session.exist?(orphan, state_dir: state_dir)
+
+      NoteMove.give_back(from: orphan, to: id, moved: [], state_dir: state_dir)
+      FileUtils.rm_rf(dir)
+    end
+
     # A failed continue's previous link, back in the lists, with rings that
     # came in meanwhile: wake it for them, as the ring's own wake would have.
     private_class_method def self.wake_for_rings(id, state_dir)
@@ -203,26 +328,35 @@ module Samagotchi
       Log.warn(:worker, "continue_wake_failed", sid: id, error: e.class.name, msg: e.message)
     end
 
-    # The new link, holding off any worker but its own (StartingMarker.fresh?)
-    # while +move+ goes to it.
-    private_class_method def self.spawn_continuation(previous, prompt:, preview:, choice:, state_dir:, move:, client_id: nil)
+    # The new link, holding off any worker but its own while +move+ goes to
+    # it (spawn_session marks it starting before its file is saved:
+    # StartingMarker.fresh?).
+    # @param notes [Array<String>] gets the names of the notes moved to it
+    private_class_method def self.spawn_continuation(previous, prompt:, preview:, choice:, state_dir:, move:, notes:,
+                                                     session_id:, client_id: nil)
       recap = RecapStore.read(Session.session_dir(previous.id, state_dir: state_dir))
       start = prompt.to_s.strip.empty? ? nil : prompt
       preview = previous.first_preview if preview.to_s.strip.empty? && start.nil?
       moved_context = nil
       before_spawn = lambda do |link|
-        StartingMarker.mark(link.id, state_dir: state_dir)
         ChildMove.apply(move, from: previous.id, to: link.id, state_dir: state_dir)
         # Its movable context too, with a note saying what moved and stayed.
         moved_context = ContextMove.call(from: previous.id, to: link.id, mode: :continue, state_dir: state_dir)
-        # Its objectives last: the list reads as the latest word.
+        # Its objectives: the list reads as the latest word.
         Objectives.carry(previous, to: link.id, state_dir: state_dir)
+        # Its waiting notes last: the carry above read a pending /objectives
+        # edit from them first. They keep their names, so they still sort
+        # ahead of the link's own notes. A note sent to the previous link
+        # from here on goes to this one (SessionInbox::Head), and a
+        # straggler is adopted by its worker (NoteMove.adoption).
+        notes.concat(NoteMove.move(from: previous.id, to: link.id, state_dir: state_dir))
       end
       link = SessionManager.spawn_session(
         prompt: start, preview: preview, title: previous.title, working_directory: previous.working_directory,
         model_name: choice.model, setup: SessionSetup.of(previous), review: previous.review,
         continues: previous.id, note: SessionChain.note_text(previous, recap: recap, state_dir: state_dir),
-        note_source: SessionChain::NOTE_SOURCE, state_dir: state_dir, before_spawn: before_spawn, client_id: client_id
+        note_source: SessionChain::NOTE_SOURCE, state_dir: state_dir, before_spawn: before_spawn, client_id: client_id,
+        session_id: session_id
       )
       link.moved_children = move
       link.moved_context = moved_context

data/lib/samagotchi/session_delete_command.rb

@@ -70,7 +70,9 @@ module Samagotchi
       @stdout.puts("#{short}  refused: it is #{OwnerLock::TUI_BUSY}; let it finish first")
       false
     rescue SessionManager::DeleteRefused => e
-      line = if e.reason == :still_stopping then "its worker is still shutting down; try again in a moment"
+      line = case e.reason
+             when :still_stopping then "its worker is still shutting down; try again in a moment"
+             when :scheduled then e.message
              else "its worker is running (--force stops it first)"
              end
       @stdout.puts("#{short}  refused: #{line}")

data/lib/samagotchi/session_inbox.rb

@@ -44,6 +44,20 @@ module Samagotchi
     # NOTE_MAX_BYTES.
     class NoteRejected < ArgumentError; end
 
+    # The one delivery path (session_inbox_delivery.rb), loaded on first
+    # use: the bundle test kit's load budget stays as it was.
+    delivery = File.expand_path("session_inbox_delivery", __dir__)
+    %i[Dispatch Delivered Head Resolved WakePolicy].each { |name| autoload name, delivery }
+
+    # A delivery of +kind+ to session +target+ (Dispatch.deliver: resolve,
+    # refuse, the block's write, one presence read, the WakePolicy's wake).
+    # @return [Delivered]
+    def self.deliver(kind, target, **, &) = Dispatch.deliver(kind, target, **, &)
+
+    # The wake half of #deliver alone (Dispatch.wake).
+    # @return [Delivered]
+    def self.wake(kind, target, **) = Dispatch.wake(kind, target, **)
+
     # Queue a turn's input file: JSON with the prompt and the sender's ids.
     # +delivery+ is only written when it is "queue": a step-boundary
     # message is the default an older worker assumes, and a cut is done by
@@ -89,11 +103,17 @@ module Samagotchi
     # @param now [Time] the time the file is named and stamped by (a spec's clock)
     # @return [String] the note file's path
     # @raise [NoteRejected] for an empty note or one over 16 KiB (never cut)
+    # @raise [Session::NotFound] for a session that is gone: no file and no
+    #   folder (deleted since the writer resolved it), which a note would
+    #   otherwise bring back as a stray folder (as Session#save skips one)
     def self.write_note(session_id, text:, source: "cli", from_session: nil, from_cwd: nil, state_dir: nil,
                         objectives: nil, now: Time.now)
       body = checked_text(text)
       sd = state_dir || Session.default_state_dir
-      notes_dir = File.join(Session.session_dir(session_id, state_dir: sd), NOTES_DIR)
+      session_dir = Session.session_dir(session_id, state_dir: sd)
+      raise Session::NotFound, session_id unless Dir.exist?(session_dir) || Session.exist?(session_id, state_dir: sd)
+
+      notes_dir = File.join(session_dir, NOTES_DIR)
       FileUtils.mkdir_p(notes_dir)
 
       # The random part keeps two writers in one nanosecond apart; the
@@ -203,6 +223,11 @@ module Samagotchi
     # An id that is safe in a file name (a Bridge's or deliver_turn's
     # uuid); anything else leaves the name bare.
     ENQUEUED_ID_NAME = /\A[A-Za-z0-9_-]{1,64}\z/
+    ENQUEUED_ID_UUID = /\A[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}\z/i
+
+    def self.new_enqueued_id = SecureRandom.uuid
+
+    def self.valid_enqueued_id?(id) = id.is_a?(String) && ENQUEUED_ID_UUID.match?(id)
 
     def self.output_name(timestamp, enqueued_id)
       id = enqueued_id.to_s
@@ -221,6 +246,21 @@ module Samagotchi
       Dir.children(dir).select { |f| f.end_with?(suffix) }.max
     end
 
+    # Evidence that a prior worker took this input: a saved or interrupted
+    # turn, its reply, or a mid-turn merge record. A restarted worker's
+    # in-memory id ledger cannot cover these deliveries.
+    def self.input_taken?(session_dir, session, enqueued_id)
+      id = enqueued_id.to_s
+      return false if id.empty?
+      return true if [session.last_turn&.enqueued_id, session.interrupted_turn&.enqueued_id].include?(id)
+      return true if reply_for(session_dir, id)
+
+      require_relative "turn_checkpoint"
+      return true if TurnCheckpoint.settled_turn(session_dir, id)
+
+      !merged_into(session_dir, id).nil?
+    end
+
     # The output files' text, oldest first; with +since_time+ only files
     # modified after it.
     def self.read_outputs(session_dir, since_time: nil)