From 5c416aa6c123a73a795902dc3bb909e5ac4bdde4 Mon Sep 17 00:00:00 2001
From: Caleb LeNoir <calebl@users.noreply.github.com>
Date: Thu, 5 Nov 2026 09:05:13 -0500
Subject: [PATCH] Pin pocket-kit v0.4.0: replays expire after 7 days, viewer
 local-only

---
 Gemfile                           | 5 +++--
 Gemfile.lock                      | 6 +++---
 README.md                         | 5 +++--
 config/initializers/pocket_kit.rb | 4 ++++
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/Gemfile b/Gemfile
index 13df8edb..7f3f047e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -90,5 +90,6 @@ gem "turbo-rails"
 gem "stimulus-rails"
 # The owner-only feedback button and local error reports;
 # config/initializers/pocket_kit.rb sets both up. Pinned to pocket-kit's
-# v0.3.0 release, which adds the opt-in session replay.
-gem "pocket_kit", github: "calebl/pocket-kit", tag: "v0.3.0"
+# v0.4.0 release: stored session replays expire after 7 days and the replay
+# viewer answers only this machine.
+gem "pocket_kit", github: "calebl/pocket-kit", tag: "v0.4.0"
diff --git a/Gemfile.lock b/Gemfile.lock
index 84192f12..1a79124b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/calebl/pocket-kit.git
-  revision: cdcee988c9f49769f4b579d8078b6e43f3b0a582
-  tag: v0.3.0
+  revision: 76ac1d94d9c23a5eec32b3a0c028673121fd00bc
+  tag: v0.4.0
   specs:
-    pocket_kit (0.3.0)
+    pocket_kit (0.4.0)
       importmap-rails (>= 2.0)
       rails (>= 8.0)
       stimulus-rails (>= 1.3)
diff --git a/README.md b/README.md
index 1f2e12bf..20f524d6 100644
--- a/README.md
+++ b/README.md
@@ -223,8 +223,9 @@ A feedback note or a page error report also carries a session replay:
 pocket-kit keeps about the last 30 seconds of the page in memory and sends it
 only with a report. Typed text stays masked, both in the fields and where the
 page echoes a typed line back; narration is recorded as shown. Accepted
-replays are saved under `tmp/pocket_kit/replays` and the report names a viewer
-path, which for now opens only from the machine running the app. A page error
+replays are saved under `tmp/pocket_kit/replays`, are deleted after 7 days,
+and the report names a viewer path that opens only from the machine running
+the app. A page error
 reported as the page closes may be too large to arrive. With neither command
 set, nothing is recorded.
 
diff --git a/config/initializers/pocket_kit.rb b/config/initializers/pocket_kit.rb
index d0977af5..15336896 100644
--- a/config/initializers/pocket_kit.rb
+++ b/config/initializers/pocket_kit.rb
@@ -59,5 +59,9 @@
   # that echo a typed line back (`.command`, the saved-turn notice) carry
   # `rr-mask` so the line is not recorded in clear there either. Narration
   # that restates what the player did is game prose and is recorded.
+  #
+  # NOT KEPT AND NOT SHARED: a stored replay expires after pocket-kit's
+  # default 7 days (`replay.max_age`, left unset) and the viewer answers only
+  # this machine, which `replay.viewer` could narrow but never widen.
   config.replay.enabled = true
 end