samagotchi 0.148.0 → 0.150.0

data/docs/sessions.md

@@ -192,6 +192,49 @@ OSA
 [ -n "$picked" ] && pbpaste | "$chi" note --source clipboard $(print -r -- "$picked" | cut -f1)
 ```
 
+## Objectives
+
+`/objectives set A | B` gives a session a short list of what it is to achieve, and `/objectives` shows it. The list goes
+into the conversation as a note under its own frame (`[OBJECTIVES, set by the user. …]`), which asks the model to keep
+work on it, to say when something falls outside it and not to change it itself. A session with no list behaves as it
+would without the feature; its request only carries the `objectives` tool below (declared on `full`, named in the
+not-loaded line elsewhere). Each item has an id (`O1`, never reused), a status (active, done, dropped) and
+optionally a done-when hint, which nothing enforces.
+
+An edit waits for a moment between turns: it lands within seconds in an idle session, and at the turn's end during one.
+Several edits made during a turn go in as one list. A continue copies the list to the next link, as a second note after
+the carry note; a review link doesn't. `!rollback` keeps it. A chi REPL's session (`--no-shared`) refuses an edit, as it
+refuses a note. See [cli.md](cli.md#session-objectives) for the commands and
+[internals/objectives.md](internals/objectives.md) for the mechanism.
+
+The model can record a **move** with the `objectives` tool: a line on what it did or found for an objective, with
+optional evidence. A move shows as the tool's row in the turn, and `/objectives` shows each objective's latest one under
+it. It is information only: only you change the list or a status, and it never approves anything. A move costs one
+generation when it's the step's only call. On a kit that doesn't declare the tool, `/toolkit add objectives` declares it
+(the model can also reach it with `call_tool`). A participant's turn is denied it.
+
+The model can also **propose** a change with that tool (add, reword, done, drop). You see a card when the turn is over:
+Apply makes the edit, once, Dismiss leaves the list, and ignoring it changes nothing. A turn leaves at most 3. A proposed
+reword is refused when you changed that objective since. The model never changes the list by itself.
+
+**Check this** (`/objectives check O2`, or the button in the web's list, for an objective with a move) asks for an independent read of
+the latest move: one side request, on your request only, on the session's model or `objectives.check_model`. It sees the
+claim, what people and notes said, what tools returned and the agent's visible answers (never its thinking), and no file. The agent's
+words settle what it said or asked, never that its work was done: "I ran the tests" with no run behind it isn't `confirmed`. What the record doesn't
+settle comes back `unclear`. **That is up to 24,000 characters of raw tool output, messages and the agent's visible answers, which with a hosted `check_model` leaves the machine on one tap, even from a local session.** chi's redaction takes out known key shapes and `token=`-style values first, by pattern only, so another secret in them still goes. The verdict (confirmed, refuted, unclear) and its reasons come as a card and under the
+objective. It is information only: it changes no status, approves nothing, and isn't in the conversation or the model's next request.
+A second tap while one runs asks nothing. Its cost is in the session's side line. Mid-turn it runs beside the turn; on a one-slot
+local server it answers after the running request. A participant can't reach it. See
+[internals/objectives.md](internals/objectives.md#check-this).
+
+**In the web** a session with a list has a strip above the conversation: its objectives and how many are done (a phone
+shows one line, the one being worked on). A tap opens the list, where you add, mark done, drop, undo and tap a text to
+reword it, with no message and no turn. Mid-turn the strip has the change and says it applies after this turn. Each list
+in the conversation shows as pills, or as one line of what you changed. A turn's moves show as chips above its answer;
+Not yet on one (or in the list, for an objective with a move) sends `Not yet on O2 (…).` as a normal message. With the
+[decision-card](bundles.md#the-decision-card-bundle) bundle, the newest long answer offers its Short version in a card,
+which enters no history. A session with no list shows none of this. A participant doesn't see the list.
+
 ## Notes a turn leaves for the model
 
 A turn that ends without an answer leaves one line for the model to read on its next turn, as a tail
@@ -429,8 +472,8 @@ mise.toml pins Ruby 3.4 gets that `ruby`, `gem` and `bundle` in its tools while
   included, asks you first; a read-only mention (`find . -name mise.toml`) doesn't. `.envrc` and mise's local files
   (`mise.local.toml`, `mise.<env>.local.toml`, dotted or not, and `config.local.toml` / `config.<env>.local.toml` in
   `.config/mise/`, `mise/`, `.mise/`) are secrets to them, as `.env` is.
-- **What tools still drop**: every `execute`, task, `!cmd`, context source and MCP server takes no `RUBYOPT`, `RUBYLIB`, `BUNDLE_GEMFILE`,
-  `BUNDLE_BIN_PATH` or `BUNDLER_VERSION` from the project's mise env: it runs without `RUBYLIB` and Bundler's
+- **What tools still drop**: every `execute`, task, `!cmd`, context source and MCP server takes no `RUBYOPT`, `RUBYLIB`, or what `bundle exec` sets
+  (`BUNDLE_GEMFILE`, `BUNDLE_LOCKFILE`, `BUNDLE_BIN_PATH`, `BUNDLER_VERSION`, `BUNDLER_SETUP`: `BundlerEnv`) from the project's mise env: it runs without `RUBYLIB` and Bundler's
   variables, and with the worker's own `RUBYOPT`, Bundler's part removed (`TaskRuntime`).
 - **`chi` in a tool** stays the home's: with a chi home the tools' PATH starts with `$XDG_STATE_HOME/samagotchi/bin`,
   a dir holding only a `chi` script that boots the home (rewritten at each worker start when the home changed; it

data/docs/system-one.md

@@ -3,7 +3,7 @@
 System 1 is the cheap judgment model chi asks small questions: approvals
 ([guardrails.md](guardrails.md#system-1-experimental)), toolkit suggestions
 ([configuration.md](configuration.md#toolkits)), context candidates
-([context.md](context.md)) and bundles' own ([plugins.md](plugins.md#judgments-chijudgment-and-ctxjudge)). Each use keeps its own mode, gates and log. What they share is
+([context.md](context.md)), the objectives' audit ([below](#objectives-in-audit)) and bundles' own ([plugins.md](plugins.md#judgments-chijudgment-and-ctxjudge)). Each use keeps its own mode, gates and log. What they share is
 one host (`system_one.host`, `.model`, `.timeout_ms`) and one layer that saves every ask, so a later comparison or fine-tune has what
 was sent and what came of it. The runs don't leave the machine; a hosted System 1 host sees each state as it is asked.
 
@@ -20,6 +20,7 @@ one warn and never changes the answer. A use that needs the run's id at once pas
 | `approvals.allow` | `GuardrailWiring#system_one_judge` | gates, acted (the judgment line's decision), labels |
 | `toolkit.suggest` | `ToolkitSuggest.judge` | acted (the log's `did`), no labels |
 | `context.candidate` | `ContextJudge.ask` | labels |
+| `objectives.incoming`, `objectives.outgoing` | `ObjectivesAudit` | none: nothing acts on them |
 | `<bundle>.<name>` | `SystemOne::Judgments` (`ctx.judge`, `ctx.judge_later`) | the bundle's: labels, acted |
 
 Not saved: a toolkit warm-up (it goes straight to the backend), `chi guardrails replay`,
@@ -41,6 +42,21 @@ seam is common. A bundle's `judge_later` runs on the Engine's `SideJudgments` un
 at shutdown covers it, and a run cut by that one-second limit is lost. Its asks stay out of the session's spend, as all of System 1's do, and no
 cost cap covers them on a hosted host.
 
+## Objectives in audit
+
+`objectives.system_one: audit` asks whether a message may affect an objective: one yes/no (`affects`) per active objective, each ask
+one request and one run. It is off by default, and asks only with a list that has an active objective, a `system_one.host` and saving on
+(`system_one.runs`). **Mode audit only:** there is no `on`. Nothing reads an answer: no card, no wake, no push, nothing in a prompt, and no turn. A
+per-message judge on an objective didn't work as a gate on the pod (AUC about .5 to .66), so these runs are there to look at, with `chi judgments report objectives.incoming`.
+
+- `objectives.incoming`: a person's message of the owner's of 40 characters or more at its turn's start (`TurnOrigin#human?`: not a reminder's or a delegate's prompt), not a `/` or `!` line, and a note going
+  into the conversation (not the list's own, nor a continue's carry note: `Objectives.outside_note?`). A steer isn't asked about.
+- `objectives.outgoing`: a finished answer of the owner's turn of 400 characters or more, not a cancelled or exhausted one.
+- The state: `objective` (its text and done-when, no id or status) and `message` (2000 characters: a message's head, an answer's tail).
+  **That text goes to the System 1 host**, a hosted one too, and into the run. A participant's turn, a review session and a scratch session are never asked about.
+- At most 6 objectives per message. Each direction has one ask running: what comes meanwhile is a run with `asked: false`, `skipped: busy`.
+- The asks run on `SideJudgments`' threads beside the turn, so a turn doesn't wait; on a one-slot server shared with the session's model, a request can still queue behind or ahead of them. They share `/v1/systemone` with approvals: on a slow one-slot host an approval can wait behind up to 2 in-flight asks and time out to the user. A failed ask is a run with its `failure` and one log line (`system_one_failed`), and a `--no-shared` REPL's stderr shows that line as for any System 1 ask.
+
 ## The store
 
 `<state dir>/system_one/runs/<judgment>/YYYY-MM-DD.jsonl` (`SystemOne::RunsStore`): one file per UTC day,

data/docs/testing.md

@@ -40,6 +40,11 @@ that way locally: `npx playwright run-server --port 3333`, then `PW_TEST_CONNECT
 
 No spec reads your own setup. The suite points `XDG_CONFIG_HOME` and `XDG_STATE_HOME` at temp folders,
 clears your `SAMAGOTCHI_*` environment, and keeps every spec off the network (WebMock).
+It also clears what tells git which repo to act on (`GIT_DIR`, `GIT_WORK_TREE`, the rest of
+`git rev-parse --local-env-vars`: `GitEnv`), first thing in `spec_helper.rb` and as the bundle test kit's
+adapters load, so a run from `git rebase --exec`, `bisect run` or a hook can't reach the real repo through a spec's git.
+`npm run e2e` clears the same list as `spec/e2e/support/env.js` loads, asked of git. chi's own git calls on a folder chi
+chose spawn with `GitEnv::UNSET`, in any run.
 `SAMAGOTCHI_TAILSCALE_CLI` points at a file that does not exist (`spec_helper.rb`), so no spec reaches a real `tailscale`; a
 `chi web --tunnel tailscale` spec writes a fake one and sets the variable.
 

data/lib/samagotchi/atomic_file.rb

@@ -18,6 +18,8 @@ module Samagotchi
     # @param content [String] written as-is, byte for byte
     # @param perm [Integer, nil] the new file's mode; nil = a fresh file's
     #   (0666 less the umask), like File.write
+    # @yield just before the rename, when given: a last check of what is being
+    #   replaced; raising leaves +path+ as it was
     # @return [String] +path+
     def write(path, content, perm: nil)
       tmp = "#{path}.#{Process.pid}.#{SecureRandom.hex(4)}.tmp"
@@ -25,6 +27,7 @@ module Samagotchi
         io.write(content)
       end
       File.chmod(perm, tmp) if perm
+      yield if block_given?
       File.rename(tmp, path)
       path
     ensure

data/lib/samagotchi/bootstrap_command.rb

@@ -477,11 +477,14 @@ module Samagotchi
 
     def system_bundle_line(result, dry_run)
       version = "v#{result.to || result.from}"
+      standing = MemoryBundle::FileStanding.clauses(MemoryBundle::SystemBundle::BUNDLE_NAME, nil, merged: Array(result.merged),
+                                                                                                         behind: Array(result.behind), dry_run: dry_run).join("; ")
       text = case result.status
              when :installed then dry_run ? "would install #{version}" : "#{version} installed"
-             when :updated then "#{result.from} → #{result.to} #{dry_run ? "would update" : "updated"}"
+             when :updated then "#{result.from} → #{result.to} #{dry_run ? "would update" : "updated"}#{" (#{standing})" unless standing.empty?}"
              when :restored then "#{version} #{dry_run ? "would restore" : "restored"} missing files"
-             when :up_to_date then "#{version} up to date"
+             when :merged then "#{version} #{standing}"
+             when :up_to_date then "#{version} #{standing.empty? ? "up to date" : standing}"
              when :newer_installed then "v#{result.from} left as is (newer than this chi's v#{result.to})"
              when :skipped then "skipped (#{result.error})"
              else "failed (#{result.error})"

data/lib/samagotchi/bridge/card_store.rb

@@ -28,6 +28,10 @@ module Samagotchi
     # isn't the turn's but comes while one runs (an anytime command's, such
     # as /btw) goes after that turn: its prompt is already in the history.
     # A failed turn leaves no prompt, so its cards stay before the next one.
+    # A !rollback (:turn_rolled_back) takes a kept turn's prompt out again,
+    # and its count with it. Of a turn that left nothing, its cards and hook
+    # notices stay as between-turns ones where it was, without their
+    # actions; its other rows (no step to sit in) go.
     #
     # Notices (hook notices, load warnings, "asking again" rows), ✂ rows
     # and cards (with questions) are capped apart, +capacity+ each, so a
@@ -50,6 +54,15 @@ module Samagotchi
     # to a turn no worker runs any more (check-in's Nudge would steer the
     # new worker's turn). A card shown between turns (github-pr's offer,
     # btw, coordinator) keeps its buttons.
+    #
+    # A turn its worker was killed in never ended here, yet the session keeps
+    # its prompt (TurnCheckpoint, written before :turn_started) and it ends
+    # canceled. So +killed_turn_stays+ (a worker's) saves that a turn runs, and
+    # a store started from such a file counts that turn. A turn that ended
+    # (a graceful stop's cancel too) saved that it no longer runs. Started
+    # from the same file again, the count is the same: nothing is written
+    # until the next event. A REPL keeps no running turn in the session: a kill
+    # takes the prompt along, so its store saves no such thing.
     class CardStore
       CAPACITY = 20
       NOTICE_TYPES = %i[hook_notice guardrail_warning empty_answer_retry steer_cut].freeze
@@ -59,8 +72,8 @@ module Samagotchi
       FILE = "cards.json"
       # The events after which the file is written again: the ones that
       # change an entry or the turn count.
-      SAVED_ON = (%i[card hook_notice empty_answer_retry steer_cut llm_context_edited question_requested question_answered
-                     question_cancelled question_relay turn_failed] + Events::TURN_KEPT).freeze
+      SAVED_ON = (%i[turn_started card hook_notice empty_answer_retry steer_cut llm_context_edited question_requested question_answered
+                     question_cancelled question_relay turn_failed turn_rolled_back] + Events::TURN_KEPT).freeze
 
       # What a session's saved file lists, as a store started from it lists
       # (no turn running): the web's cards for a session no worker runs.
@@ -72,9 +85,12 @@ module Samagotchi
 
       # @param path [String, nil] the file the entries are saved in and
       #   started from; nil keeps them in memory only
-      def initialize(capacity: CAPACITY, path: nil)
+      # @param killed_turn_stays [Boolean] the session keeps a running turn's
+      #   prompt on disk (a worker's TurnCheckpoint): save that a turn runs
+      def initialize(capacity: CAPACITY, path: nil, killed_turn_stays: false)
         @capacity = capacity
         @path = path
+        @killed_turn_stays = killed_turn_stays
         @mutex = Mutex.new
         @entries = []
         @turns_done = 0
@@ -122,21 +138,26 @@ module Samagotchi
         return if entries.empty? && !File.exist?(@path)
 
         FileUtils.mkdir_p(File.dirname(@path))
-        AtomicFile.write(@path, JSON.generate({ "version" => 1, "turns" => @turns_done, "entries" => entries }))
+        saved = { "version" => 1, "turns" => @turns_done, "entries" => entries }
+        saved["running"] = true if @killed_turn_stays && @running
+        AtomicFile.write(@path, JSON.generate(saved))
       rescue StandardError
         nil # a card that can't be saved still shows live
       end
 
       # The entries an earlier worker saved (a missing or broken file:
       # none), their types as symbols again; a card that came during that
-      # worker's last turn stays where it was, as after a failed turn.
+      # worker's last turn stays where it was, as after a failed turn, or
+      # after that turn when the worker was killed in it. A file from before
+      # "running" has none: no turn counted.
       def seed
         return unless @path && File.file?(@path)
 
         data = JSON.parse(File.read(@path), symbolize_names: true)
         return unless data.is_a?(Hash) && data[:turns].is_a?(Integer) && data[:entries].is_a?(Array)
 
-        @turns_done = data[:turns]
+        killed_in_turn = data[:running] == true
+        @turns_done = data[:turns] + (killed_in_turn ? 1 : 0)
         @entries = data[:entries].filter_map do |entry|
           next unless entry.is_a?(Hash) && entry[:type].is_a?(String) && entry[:turns].is_a?(Integer)
 
@@ -144,7 +165,7 @@ module Samagotchi
           entry = entry.merge(actions: []) if entry[:type] == :card && entry[:in_turn] && entry.key?(:actions)
           entry unless entry[:type] == :guardrail_warning || open_question?(entry)
         end
-        settle_during(after_turn: false)
+        settle_during(after_turn: killed_in_turn)
       rescue StandardError
         @turns_done = 0
         @entries = []
@@ -169,6 +190,8 @@ module Samagotchi
           kept = Events.kept_turn?(event)
           @turns_done += 1 if kept
           settle_during(after_turn: kept)
+          unstep_turn_left_nothing unless kept
+        when :turn_rolled_back then take_turn_back
         when :card then add_card(event)
         when :hook_notice then add_notice(event)
         # What failed to load (guardrails, plugins): before the first turn
@@ -210,6 +233,28 @@ module Samagotchi
         end
       end
 
+      # The last kept turn's prompt left the conversation. An entry from
+      # after it (a card shown before the !rollback) stays before the next.
+      def take_turn_back
+        @turns_done = [@turns_done - 1, 0].max
+        unstep_turn_left_nothing
+        @entries.each { |entry| entry[:turns] = [entry[:turns], @turns_done].min }
+      end
+
+      # The turn that would be the next one's place has no prompt in the
+      # history: what it showed isn't a row of a turn any more (a later
+      # turn would read it as its own, +current+).
+      def unstep_turn_left_nothing
+        @entries = @entries.filter_map do |entry|
+          next entry unless entry[:in_turn] && entry[:turns] == @turns_done
+
+          case entry[:type]
+          when :card then entry.merge(in_turn: false, **(entry.key?(:actions) ? { actions: [] } : {}))
+          when :hook_notice then entry.except(:iteration, :calls).merge(in_turn: false)
+          end
+        end
+      end
+
       def add_notice(event)
         notice = event.slice(:type, :hook, :text, :level, :fallback_for)
         if event[:between_turns] || !@running

data/lib/samagotchi/bridge.rb

@@ -136,7 +136,7 @@ module Samagotchi
       @accumulator = TurnAccumulator.new
       # Saved in the session's folder: a later worker, and the web without
       # one, show the cards where they were.
-      @cards = CardStore.new(path: File.join(session_dir, CardStore::FILE))
+      @cards = CardStore.new(path: File.join(session_dir, CardStore::FILE), killed_turn_stays: true)
       @pending_card = PendingCard.new(session_dir)
       @heartbeat_interval = heartbeat_interval
       @epoch = SecureRandom.hex(4)

data/lib/samagotchi/bundle_command.rb

@@ -15,17 +15,19 @@ module Samagotchi
         install <source> [--scope system|project] [--force]
           Install a memory bundle from a directory, zip, tar archive, or git URL.
           Source is the path/URL to the bundle (dir/zip/tar.gz/git).
-          --force overwrites existing entries; default skips them.
+          --force overwrites existing entries (one that differs is copied to the trash first); default skips them.
 
         upgrade <source> [--scope system|project] [--force] [--dry-run] [--agent|--no-agent]
-          Upgrade a bundle (3-way merge: auto-merge if not edited, conflict otherwise).
+          Upgrade a bundle (3-way: a file you didn't edit updates; one you edited takes a text
+          merge, the old file in the bundle trash; a real conflict leaves it as it is).
           --dry-run shows what would change. --agent launches interactive session on conflict.
 
         uninstall <bundle> [--scope system|project] [--force]
-          Remove a bundle and its index entries (--force if locally edited).
+          Remove a bundle and its index entries (--force moves a locally edited file to the trash).
 
         status [<bundle>]
-          Show provenance + modification status for bundles.
+          Show provenance and each file's status for bundles. issues= counts what
+          needs you: a file that stays behind, is missing or can't be read, not one you edited.
 
         diff <bundle> [file]
           Show diffs between base/current/incoming for a bundle.
@@ -66,7 +68,7 @@ module Samagotchi
         install <source> [--scope system|project] [--force]
           Install a memory bundle from a directory, zip, tar archive, or git URL,
           or a bundle shipped with chi by name (see: chi bundle list).
-          --force overwrites existing entries; default skips them.
+          --force overwrites existing entries (one that differs is copied to the trash first); default skips them.
         install --dev PATH
           Install the bundle in the local directory PATH as a link to it: its plugin, hooks, rules and scripts
           are PATH's own files (an edit applies at the next worker or chi web restart, with no re-install) and
@@ -231,6 +233,9 @@ module Samagotchi
       run_installer(installer, failed: "Upgrade") do |manifest|
         print_hooks_and_plugin(manifest, plugin: !dry_run)
         next dry_run_done if dry_run
+
+        # Its summary said so, to someone reading.
+        Samagotchi::MemoryBundle::Provenance.new(name: bundle_name).clear_merge_notes([], files: installer.merged_files)
         next upgrade_conflicts(installer, bundle_name, expanded_source, agent) if installer.conflicts.any? && !force
 
         print_provenance(bundle_name, manifest)
@@ -321,42 +326,64 @@ module Samagotchi
     # (scripts already read it so): not CLI::Exit::USAGE by meaning.
     CONFLICTS_KEPT = 2
 
-    # @return [Integer] 0 resolved, CONFLICTS_KEPT kept the edits
+    # @return [Integer] 0 all resolved, CONFLICTS_KEPT kept some edits
     def upgrade_conflicts(installer, bundle_name, expanded_source, agent)
-      @stdout.puts "\n#{installer.conflicts.size} conflict(s) need resolution."
-      installer.conflicts.each { |k, _| @stdout.puts "  conflict: #{k}" }
+      standing = Samagotchi::MemoryBundle::FileStanding
+      @stdout.puts "\n#{standing.stay_behind(installer.behind.size)}: #{installer.behind.map(&:file).join(", ")}"
       launch = if agent.nil? && @stdin.tty?
-                 @stdout.print "Conflicts detected — launch interactive agent to resolve? [y/N] "
+                 @stdout.print "Launch an interactive agent to merge them? [y/N] "
                  ans = begin; @stdin.gets; rescue StandardError => _e; nil; end
                  ans && ans.strip.downcase.start_with?("y")
                elsif agent.nil?
-                 @stdout.puts "Non-interactive terminal: kept your edits in the file(s) above; the rest is upgraded. Re-run with --force to take the bundle's version, or --agent in a TTY to merge."
+                 @stdout.puts "Non-interactive terminal: the rest is upgraded. #{standing::FORCE_TAKES}; --agent in a TTY merges."
                  return CONFLICTS_KEPT
                else
                  agent
                end
       unless launch
-        @stdout.puts "Kept your edits in the file(s) above; the rest is upgraded. chi bundle diff #{bundle_name} FILE shows the base; re-run with --force to take the bundle's version."
+        @stdout.puts "The rest is upgraded. #{standing.diff_hint(bundle_name, "FILE")} shows the base; #{standing::FORCE_TAKES}."
         return CONFLICTS_KEPT
       end
 
       prompt = build_conflict_prompt(bundle_name, installer.conflicts, expanded_source)
-      @stdout.puts "Launching interactive session for conflict resolution… (/exit when done)"
+      before = installer.conflicts.to_h { |key, info| [key, Samagotchi::MemoryBundle::Merger.digest(info[:current])] }
+      @stdout.puts "Launching an interactive session to merge them… (/exit when done)"
       require "samagotchi/terminal_ui"
       Samagotchi::TerminalUI.new(prompt: prompt).run
-      # The installer already recorded the upgrade (conflicted files kept
-      # their old base); the resolved files now start from the bundle's
-      # version.
-      Samagotchi::MemoryBundle::Provenance.new(name: bundle_name).resolve_conflicts(installer.conflicts)
-      @stdout.puts "Provenance updated after interactive resolution."
-      @stdout.puts "Upgrade resolved interactively."
-      0
+      settle_conflicts(installer.conflicts, before, bundle_name)
     ensure
       # An owned source (git/zip/tar) was kept for the incoming files above;
       # the agent step is done with them now.
       installer.cleanup_source!
     end
 
+    # After the agent step. The installer already recorded the upgrade
+    # (conflicted files kept their old base); a file the step changed, with
+    # no conflict markers left, now starts from the bundle's version. Any
+    # other stays a conflict: moving its base would turn a visible miss into
+    # a kept edit the next upgrade says nothing about.
+    # @param before [Hash{String => String, nil}] each file's digest before the step
+    # @return [Integer] 0 all resolved, CONFLICTS_KEPT some still behind
+    def settle_conflicts(conflicts, before, bundle_name)
+      merger = Samagotchi::MemoryBundle::Merger
+      untouched, changed = conflicts.partition { |key, info| merger.digest(info[:current]) == before[key] }
+      marked, clean = changed.partition { |_, info| merger.markers?(info[:current]) }
+      settled = Samagotchi::MemoryBundle::Provenance.new(name: bundle_name).resolve_conflicts(clean.to_h)
+      gone = clean.map(&:first) - settled
+      standing = Samagotchi::MemoryBundle::FileStanding
+      untouched.each { |key, _| @stdout.puts standing.still_behind(:untouched, key) }
+      marked.each { |key, _| @stdout.puts standing.still_behind(:markers, key) }
+      gone.each { |key| @stdout.puts standing.still_behind(:incoming_gone, key) }
+      if untouched.empty? && marked.empty? && gone.empty?
+        @stdout.puts "Provenance updated after interactive resolution."
+        @stdout.puts "Upgrade resolved interactively."
+        return 0
+      end
+
+      @stdout.puts "Resolved: #{settled.join(", ")}" unless settled.empty?
+      CONFLICTS_KEPT
+    end
+
     def uninstall(rest)
       parsed = parse_flags(UNINSTALL_FLAGS, rest, "uninstall", help: UNINSTALL_HELP)
       return parsed if parsed.is_a?(Integer)
@@ -377,6 +404,7 @@ module Samagotchi
         uninstaller.run
         @stdout.puts "Uninstalled bundle '#{bundle_name}'"
         puts_trashed(uninstaller.trashed_files, uninstaller.trash_dir)
+        @stdout.puts uninstaller.trash_copy_line if uninstaller.trash_copy_line
         @stdout.puts "Removed: #{uninstaller.removed_files.join(", ")}" unless uninstaller.removed_files.empty?
         hook_removed = uninstaller.removed_files.count { |f| f.start_with?("hooks/") }
         @stdout.puts "Hooks removed: #{hook_removed}" if hook_removed > 0
@@ -402,6 +430,7 @@ module Samagotchi
       result.skipped.each { |member, why| lines << "skipped #{member}: #{why}" }
       result.failed.each { |member, why| lines << "failed #{member}: #{why}" }
       lines.concat(result.kept_own_lines)
+      lines.concat(result.trash_copies)
       lines << "nothing new to install" if lines.empty?
       lines.each { |line| @stdout.puts "  #{line}" }
       @stdout.puts "(dry-run: no changes written)" if dry_run
@@ -453,16 +482,21 @@ module Samagotchi
         else
           @stdout.puts "Target: #{st.target_dir}"
         end
+        standing = Samagotchi::MemoryBundle::FileStanding
         st.files.each do |k, info|
           next @stdout.puts("  #{k}: unchecked") if info[:unchecked]
 
           mods = []
-          mods << "conflict (kept your edits over v#{st.provenance.version}: chi bundle diff #{name} #{k})" if info[:conflict]
           mods << "modified" if info[:modified]
           mods << "missing" if info[:missing]
+          mods << "unreadable" if info[:unreadable]
           mods << "no-index" unless info[:index_present] || info[:overlay]
-          label = mods.empty? ? "ok" : mods.join(",")
+          label = mods.join(",")
+          label = "ok" if mods.empty? && !info[:behind]
           label += " (model overlay)" if info[:overlay]
+          behind = info[:behind] && "#{info[:behind].state} (#{standing.diff_hint(name, k)})"
+          label = [label, behind].reject { |part| part.nil? || part.empty? }.join("; ")
+          label += "; #{info[:merge_note].line}#{" (old copy in #{info[:merge_note].trash})" if info[:merge_note].trash}" if info[:merge_note]
           @stdout.puts "  #{k}: #{label}"
         end
         # Hooks
@@ -499,7 +533,7 @@ module Samagotchi
           next @stdout.puts("  #{bname} (manifest.json unreadable)") if record.error?
 
           st = Samagotchi::MemoryBundle::Status.bundle_status(bname)
-          mods = st.files.values.count { |v| v[:modified] || v[:missing] }
+          mods = st.files.values.count { |v| v[:behind] || v[:missing] || v[:unreadable] }
           hooks_count = st.provenance.hooks.size
           hook_info = hooks_count > 0 ? " hooks=#{hooks_count}" : ""
           plugin = st.plugin
@@ -543,77 +577,62 @@ module Samagotchi
       rescue ArgumentError => e
         @stderr.puts "Bundle '#{bname}': #{e.message}"; return 1
       end
-      files = record.files
       hooks = record.hooks
       plugin_path = prov.plugin_path(record)
       plugin_file = plugin_path && File.basename(plugin_path)
-      show_plugin = lambda do
-        @stdout.puts "=== plugin/#{plugin_file} ==="
-        @stdout.puts "--- base (provenance) ---"
-        base = prov.plugin_base_path(plugin_file)
-        @stdout.puts File.exist?(base) ? File.read(base) : "(no base)"
-        @stdout.puts "--- current (on-disk) ---"
-        @stdout.puts File.exist?(plugin_path) ? File.read(plugin_path) : "(missing)"
-        @stdout.puts "--- metadata: sha256=#{record.plugin.sha256}#{" requires_chi=#{record.requires_chi}" if record.requires_chi}"
-      end
       if file_arg
         # Try file first, then hook
         if record.owns?(file_arg)
-          base = prov.base_path(file_arg)
-          cur = File.join(target_dir, file_arg)
-          @stdout.puts "=== #{file_arg} ==="
-          @stdout.puts "--- base (provenance) ---"
-          @stdout.puts File.exist?(base) ? File.read(base) : "(no base)"
-          @stdout.puts "--- current (on-disk) ---"
-          @stdout.puts File.exist?(cur) ? File.read(cur) : "(missing)"
+          diff_memory(prov, target_dir, file_arg)
         elsif hooks.key?(file_arg)
-          base = prov.base_path(file_arg)
-          cur = File.join(prov.hooks_dir, file_arg)
-          @stdout.puts "=== hooks/#{file_arg} ==="
-          @stdout.puts "--- base (provenance) ---"
-          @stdout.puts File.exist?(base) ? File.read(base) : "(no base)"
-          @stdout.puts "--- current (on-disk) ---"
-          @stdout.puts File.exist?(cur) ? File.read(cur) : "(missing)"
-          # Show hook metadata
-          @stdout.puts hook_metadata_line(hooks[file_arg])
+          diff_hook(prov, file_arg, hooks[file_arg])
         elsif plugin_file && [plugin_file, "plugin/#{plugin_file}"].include?(file_arg)
-          show_plugin.call
+          diff_plugin(prov, record, plugin_path)
         else
           @stdout.puts "=== #{file_arg} ==="
           @stdout.puts "(not found in bundle)"
         end
         @stdout.puts ""
       else
-        files.each_key do |k|
-          base = prov.base_path(k)
-          cur = File.join(target_dir, k)
-          @stdout.puts "=== #{k} ==="
-          @stdout.puts "--- base (provenance) ---"
-          @stdout.puts File.exist?(base) ? File.read(base) : "(no base)"
-          @stdout.puts "--- current (on-disk) ---"
-          @stdout.puts File.exist?(cur) ? File.read(cur) : "(missing)"
+        record.files.each_key do |key|
+          diff_memory(prov, target_dir, key)
           @stdout.puts ""
         end
-        # Hooks diff
-        hooks.each do |k, hook|
-          base = prov.base_path(k)
-          cur = File.join(prov.hooks_dir, k)
-          @stdout.puts "=== hooks/#{k} ==="
-          @stdout.puts "--- base (provenance) ---"
-          @stdout.puts File.exist?(base) ? File.read(base) : "(no base)"
-          @stdout.puts "--- current (on-disk) ---"
-          @stdout.puts File.exist?(cur) ? File.read(cur) : "(missing)"
-          @stdout.puts hook_metadata_line(hook)
+        hooks.each do |key, hook|
+          diff_hook(prov, key, hook)
           @stdout.puts ""
         end
         if plugin_file
-          show_plugin.call
+          diff_plugin(prov, record, plugin_path)
           @stdout.puts ""
         end
       end
       0
     end
 
+    def diff_memory(prov, target_dir, key)
+      print_base_and_current(key, prov.base_path(key), File.join(target_dir, key))
+    end
+
+    def diff_hook(prov, key, hook)
+      print_base_and_current("hooks/#{key}", prov.base_path(key), File.join(prov.hooks_dir, key))
+      @stdout.puts hook_metadata_line(hook)
+    end
+
+    def diff_plugin(prov, record, plugin_path)
+      file = File.basename(plugin_path)
+      print_base_and_current("plugin/#{file}", prov.plugin_base_path(file), plugin_path)
+      @stdout.puts "--- metadata: sha256=#{record.plugin.sha256}#{" requires_chi=#{record.requires_chi}" if record.requires_chi}"
+    end
+
+    def print_base_and_current(heading, base, current)
+      @stdout.puts "=== #{heading} ==="
+      @stdout.puts "--- base (provenance) ---"
+      @stdout.puts File.exist?(base) ? File.read(base) : "(no base)"
+      @stdout.puts "--- current (on-disk) ---"
+      @stdout.puts File.exist?(current) ? File.read(current) : "(missing)"
+    end
+
     def list
       listing = Samagotchi::MemoryBundle::Listing
       shipped = listing.shipped
@@ -634,6 +653,10 @@ module Samagotchi
           line = "  #{b.name.ljust(name_w)}  #{"v#{b.version || "?"}".ljust(ver_w)}  scope=#{b.scope || "?"}  " \
                  "#{b.includes ? profile_members(b.includes, installed) : "files=#{b.files}"}  installed=#{b.installed_at || "?"}"
           line += "  (shipped v#{b.upgrade.version}: chi bundle upgrade #{b.upgrade.source})" if b.upgrade
+          if b.behind&.any?
+            count = Samagotchi::MemoryBundle::FileStanding.behind_count(b.behind.size, unsure: b.behind.any?(&:unsure))
+            line += "  (#{count}: chi bundle status #{b.name})"
+          end
           @stdout.puts line
         end
         @stdout.puts "  (or all at once: chi update)" if installed.any?(&:upgrade)

data/lib/samagotchi/bundler_env.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  # Bundler's variables, in one place. Every chi spawn that must not carry a
+  # `bundle exec` around it takes its names from here.
+  module BundlerEnv
+    # All Bundler's own and its settings (BUNDLE_PATH, BUNDLE_WITHOUT, ...), for
+    # what must take none: a pattern's start (ChiShim, ProjectEnv::RESTORE_NEVER).
+    PREFIX = "BUNDLE"
+    # What `bundle exec` sets for a child (Bundler::SharedHelpers#set_bundle_variables;
+    # bundler_env_spec asks it). Without them, and without Bundler's RUBYOPT, a
+    # child ruby is free of the bundle; BUNDLER_SETUP on its own isn't: RubyGems
+    # requires what it names at boot, and a Gemfile it then finds writes its lock
+    # to BUNDLE_LOCKFILE, the bundle's. A project's own settings (BUNDLE_PATH and
+    # the like) aren't here: its `bundle` keeps them. Nor is BUNDLER_ORIG_*, which
+    # also reaches a tool: a project's `bundle exec` there reads it, for
+    # Bundler.original_env and with_unbundled_env, whose children get the PATH and
+    # GEM_* chi's own `bundle exec` started from.
+    VARS = %w[BUNDLE_BIN_PATH BUNDLE_GEMFILE BUNDLE_LOCKFILE BUNDLER_SETUP BUNDLER_VERSION].freeze
+    # With what else `bundle exec` steers a child ruby by: what a command that
+    # isn't the bundle's runs without (TaskRuntime, ProjectEnv, ChiHome.probe).
+    CHILD_RUBY = (%w[RUBYOPT RUBYLIB] + VARS).freeze
+  end
+end

data/lib/samagotchi/bundles/coordinator/manifest.yml

@@ -1,16 +1,16 @@
 ---
 name: coordinator
-version: 0.7.0
+version: 0.8.0
 scope: system
-description: "Coordinate parallel work: the coordinator skill (split the work, one worktree and child session per task, check each report, merges under a guardrail approval (the git-merge rule) or a question, a handoff memory to resume from), /coordinate <goal>, /coordinate resume, /coordinate end, /coordinate review (experimental: a sprint review session to share) and /children; the coordinator toolkit (lean + delegate, delegate_result, list_sessions) and the coding toolkit for build children (child + be concise)"
+description: "Coordinate parallel work: the coordinator skill (split the work, one worktree and child session per task, check each report, merges under a guardrail approval (the git-merge rule) or a question, a handoff memory to resume from), /coordinate <goal>, /coordinate resume, /coordinate end, /coordinate review (experimental: a sprint review session to share) and /children; the coordinator toolkit (lean + delegate, delegate_result, list_sessions, objectives) and the coding toolkit for build children (child + be concise)"
 trust_level: reviewed
 files:
   skill_coordinator.md:
-    sha256: sha256:50b6dc3c2eca885133af9c6518964e6fe862194f2fa4556d9ee5374dde42242a
+    sha256: sha256:1cac885facd28757aaa0197b28889246f845834c17101d59b5625d1b2b89679a
     description: "Coordinate parallel work: split it, delegate each task wait:false in its own worktree (cwd:), check each report, merge under the git-merge approval or ask the user; resume from a handoff_* memory"
 plugin:
   file: plugin.rb
-  sha256: sha256:fa5d7f8b01e465d80012e141abcb2ee27cd5cec43e5a74b9721d435be92d3730
+  sha256: sha256:84535a86b754f3a12cdb2f2591027ea71bbf9ffb74734b1050899b9a4fde07ac
 # the coordinator toolkit needs chi.toolkit and ctx.use_toolkit (0.66.0); the
 # coding toolkit (chi.toolkit prompt:) and the skill's delegate toolkit: need
 # the next chi.
@@ -18,3 +18,5 @@ requires_chi: ">= 0.107.0"
 # /coordinate review uses ctx.sessions.review (the next chi).
 # No requires_chi_next for guardrails/merge.yml: its keys are long supported, and first-ever too-new rules would make a
 # live older worker deny every call. A chi without `chi guardrails rule` gives a usage error, and the skill then asks.
+# Nor for the objectives tool in the kit and the skill: on an older chi the kit's add names nothing (it declares only what
+# is registered), and a call of it comes back as an unknown tool, no harm.