b4cabf54af
Fix 1: complexity contract (trivial|moderate|complex)
- edge-worker.js: _classify() now returns complexity tier not binary local|server
- trivial = greeting/small-talk ≥ 0.55 → localReply, 0 sats, no server call
- moderate = simple-question or uncertain → show estimate, route to server
- complex = technical/creative/code or score < 0.40 → always priced
- model-unavailable fallback → moderate (safe default)
Fix 2: UI triage driven by complexity outcome
- edge-worker-client.js fallback returns complexity:moderate (not label:server)
- ui.js send(): trivial+localReply → local; moderate/complex → _fetchEstimate()
called on classify outcome then server route
Fix 3: X-Nostr-Token on ALL session API calls
- session.js deposit poll (GET /sessions/:id): X-Nostr-Token added
- session.js topup poll (GET /sessions/:id): X-Nostr-Token added
- session.js restore (GET /sessions/:id): X-Nostr-Token added
- session.js createTopup (POST /sessions/:id/topup): X-Nostr-Token added
Fix 4: npub-only discovery no longer suppresses identity prompt
- nostr-identity.js: _canSign flag tracks signing separately from pubkey presence
- npub-only → _pubkey set, _canSign=false → prompt scheduled
- refreshToken() gated on _pubkey && _canSign (no silent failures)
- Prompt handlers set _canSign=true on NIP-07 connect or key generation
Also: all 13 pending tasks filed as Gitea issues #34-#46 with scoped ACs
and delegation labels (kimi/hermes). Tailscale Funnel replaces bore.pub.