samagotchi 0.150.0 → 0.152.0

data/lib/samagotchi/memory_bundle/merger.rb

@@ -2,6 +2,7 @@
 
 require "digest"
 require_relative "../atomic_file"
+require_relative "file_digest"
 require_relative "installed_bundle"
 
 module Samagotchi
@@ -154,14 +155,12 @@ module Samagotchi
 
         # No base (legacy bundle without provenance or first file) -> treat as modified
         unless base_exists
-          incoming_digest = Digest::SHA256.hexdigest(File.read(incoming_path))
-          current_digest = Digest::SHA256.hexdigest(File.read(current_path))
-          return current_digest == incoming_digest ? NOOP : CONFLICT
+          return FileDigest.hex(current_path) == FileDigest.hex(incoming_path) ? NOOP : CONFLICT
         end
 
-        base_digest = Digest::SHA256.hexdigest(File.read(base_path))
-        current_digest = Digest::SHA256.hexdigest(File.read(current_path))
-        incoming_digest = Digest::SHA256.hexdigest(File.read(incoming_path))
+        base_digest = FileDigest.hex(base_path)
+        current_digest = FileDigest.hex(current_path)
+        incoming_digest = FileDigest.hex(incoming_path)
 
         if current_digest == incoming_digest
           NOOP
@@ -242,13 +241,13 @@ module Samagotchi
 
       # The file's digest, nil when there is none.
       def self.digest(path)
-        File.exist?(path) ? Digest::SHA256.hexdigest(File.binread(path)) : nil
+        FileDigest.hex(path)
       end
 
       def self.current_modified?(base_path, current_path)
         return true unless base_path && File.exist?(base_path) && File.exist?(current_path)
 
-        Digest::SHA256.hexdigest(File.read(base_path)) != Digest::SHA256.hexdigest(File.read(current_path))
+        FileDigest.hex(base_path) != FileDigest.hex(current_path)
       end
     end
   end

data/lib/samagotchi/memory_bundle/profile.rb

@@ -114,7 +114,8 @@ module Samagotchi
 
         Provenance.new(name: manifest.name).write(
           files: {}, scope: "system", version: manifest.version, source_path: dir,
-          trust_level: manifest.trust_level, requires_chi: manifest.requires_chi, includes: includes
+          trust_level: manifest.trust_level, requires_chi: manifest.requires_chi, includes: includes,
+          manifest_from: dir
         )
         result
       end
@@ -127,7 +128,7 @@ module Samagotchi
         # A dry run runs the Installer's too, which writes nothing, so it
         # names the files the real run would keep as the user's own.
         installer = Installer.new(source: member_dir, name: member, scope: "system", force: force, strict: true,
-                                  shipped_dir: shipped_dir, dry_run: dry_run)
+                                  shipped_dir: shipped_dir, dry_run: dry_run, chi_version: chi_version)
         installer.run
         result.installed << member
         kept = installer.results.select { |_, entry| kept_own?(entry) }.keys

data/lib/samagotchi/memory_bundle/provenance.rb

@@ -4,10 +4,14 @@ require "json"
 require "digest"
 require "date"
 require "fileutils"
+require "tmpdir"
 require_relative "../atomic_file"
 require_relative "../memory_paths"
+require_relative "../version"
 require_relative "bundle_hook"
+require_relative "file_digest"
 require_relative "installed_bundle"
+require_relative "manifest"
 
 module Samagotchi
   module MemoryBundle
@@ -15,6 +19,9 @@ module Samagotchi
     # Each installed bundle gets a directory with:
     #   manifest.json — metadata about the install (merged on reinstall)
     #   bases/        — snapshots of every file as installed (for 3-way merge later)
+    #   manifest.yml  — the bundle's own manifest as installed (#write's
+    #                   manifest_from:), its sha in the record; read live
+    #                   through InstalledManifest
     class Provenance
       def self.bundles_dir
         MemoryPaths.bundles_dir
@@ -59,6 +66,11 @@ module Samagotchi
         File.join(@bundle_dir, "scripts")
       end
 
+      # The bundle's manifest.yml as installed (InstalledBundle#kept_manifest_path).
+      def kept_manifest_path
+        File.join(@bundle_dir, "manifest.yml")
+      end
+
       # The plugin file as installed, or nil when the bundle has none.
       # @param bundle [InstalledBundle, nil] its record (read when not given)
       def plugin_path(bundle = record)
@@ -92,7 +104,7 @@ module Samagotchi
 
           begin
             data = JSON.parse(File.read(mjson), symbolize_names: true)
-          rescue JSON::ParserError, SystemCallError => e
+          rescue JSON::ParserError, EncodingError, SystemCallError => e # a key that isn't UTF-8 can't be a symbol
             if holding.nil? || Dir.exist?(File.join(dir, name, holding.to_s))
               yield name, InstalledBundle.unreadable(name, "manifest.json is unreadable: #{e.message}")
             end
@@ -100,7 +112,7 @@ module Samagotchi
           end
           next if holding && !(data.is_a?(Hash) && data[holding].is_a?(Hash) && !data[holding].empty?)
 
-          yield name, InstalledBundle.parse(name, data)
+          yield name, InstalledBundle.parse(name, data, File.join(dir, name))
         end
       end
 
@@ -124,8 +136,11 @@ module Samagotchi
         value.to_s.delete_prefix("sha256:")
       end
 
+      # The digest of a file, nil when it isn't there (FileDigest). Every
+      # caller checks existence first; #sha_matches? reads a missing file as
+      # not the recorded one.
       def self.file_sha(path)
-        Digest::SHA256.hexdigest(File.binread(path))
+        FileDigest.hex(path)
       end
 
       # What a dev install (`chi bundle install --dev`) records instead of
@@ -144,6 +159,24 @@ module Samagotchi
         unchecked?(recorded) || file_sha(path) == recorded_sha(recorded)
       end
 
+      # The record's mirror of the manifest keys (InstalledBundle::MIRROR_KEYS)
+      # as #write records them from its kwargs: what an older chi reads, and
+      # what #adopt_manifest holds a source's manifest against.
+      def self.mirror_fields(trust_level:, requires_chi:, needs:, context_providers:, block_renderers:, session_settings:,
+                             session_setting_types:, settings:, setting_types:)
+        fields = {}
+        fields["trust_level"] = trust_level.to_s if trust_level && !trust_level.to_s.empty?
+        fields["requires_chi"] = requires_chi.to_s if requires_chi && !requires_chi.to_s.empty?
+        fields["needs"] = needs.map { |n| n.transform_keys(&:to_s).compact } if needs.is_a?(Array) && !needs.empty?
+        fields["context_providers"] = context_providers.map(&:to_h) unless context_providers.empty?
+        fields["block_renderers"] = block_renderers.map(&:to_h) unless block_renderers.empty?
+        fields["session_settings"] = Array(session_settings).map(&:to_s) unless Array(session_settings).empty?
+        fields["session_setting_types"] = session_setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless session_setting_types.to_h.empty?
+        fields["settings"] = settings.map(&:to_s) unless settings.nil?
+        fields["setting_types"] = setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless setting_types.to_h.empty?
+        fields
+      end
+
       # Writes provenance for an installation: merges into existing manifest.json
       # and saves base snapshots. Stale base snapshots (files removed from bundle)
       # are pruned.
@@ -172,12 +205,21 @@ module Samagotchi
       # @param scripts_files [Hash] file name => installed script; the
       #   sha256 of each is recorded (ContextFetch checks it before a run)
       # @param context_providers [Array<ContextProviders::Provider>]
+      # @param block_renderers [Array<BlockRenderers::Renderer>]
       # @param dev [Boolean] a dev install: its files are links to the
       #   source, recorded as DEV_SHA (no sha256 check) with "dev": true
+      # @param manifest_from [String, nil] the source dir: its manifest.yml is
+      #   kept at #kept_manifest_path (a copy, a link for a dev install),
+      #   recorded as manifest_sha (DEV_SHA for dev), with installed_by: this
+      #   chi's VERSION. nil leaves the kept file, and the record's
+      #   manifest_sha and installed_by, as they are. The keys a record mirrors
+      #   (requires_chi … setting_types) are still written from the kwargs:
+      #   an older chi sharing this memories dir reads only them
+      #   (docs/internals/bundles.md); a key a later manifest gains is never added
       def write(files:, scope:, version:, source_path:, hooks: {}, trust_level: nil, source_commit: nil, hooks_files: {},
                 guardrails_files: {}, plugin_file: nil, requires_chi: nil, needs: nil, marks: [], incoming_dir: nil, includes: nil,
-                scripts_files: {}, context_providers: [], file_descriptions: {}, session_settings: [], session_setting_types: {}, settings: nil, setting_types: {},
-                dev: false)
+                scripts_files: {}, context_providers: [], block_renderers: [], file_descriptions: {}, session_settings: [], session_setting_types: {}, settings: nil, setting_types: {},
+                dev: false, manifest_from: nil)
         FileUtils.mkdir_p(@bundle_dir)
         bases_dir = File.join(@bundle_dir, "bases")
         FileUtils.mkdir_p(bases_dir)
@@ -264,35 +306,32 @@ module Samagotchi
           "files" => merged_entries,
           "hooks" => hooks_map
         }
-        manifest_data["trust_level"] = trust_level.to_s if trust_level && !trust_level.to_s.empty?
         manifest_data["dev"] = true if dev
         if guardrails_files.is_a?(Hash) && !guardrails_files.empty?
           manifest_data["guardrails"] = guardrails_files.sort.to_h do |basename, path|
-            [basename.to_s, { "sha256" => dev ? DEV_SHA : "sha256:#{Digest::SHA256.hexdigest(File.read(path.to_s))}" }]
+            [basename.to_s, { "sha256" => dev ? DEV_SHA : FileDigest.sha256(path.to_s) }]
           end
         end
         manifest_data["source_commit"] = source_commit.to_s if source_commit && !source_commit.to_s.empty?
         FileUtils.rm_rf(File.join(bases_dir, "plugin"))
         if plugin_file
-          content = File.binread(plugin_file.to_s)
+          content = File.binread(plugin_file.to_s) # the base snapshot's bytes
           manifest_data["plugin"] = { "file" => File.basename(plugin_file.to_s),
-                                      "sha256" => dev ? DEV_SHA : "sha256:#{Digest::SHA256.hexdigest(content)}" }
+                                      "sha256" => dev ? DEV_SHA : FileDigest.sha256(plugin_file.to_s) }
           FileUtils.mkdir_p(File.join(bases_dir, "plugin"))
           File.binwrite(plugin_base_path(File.basename(plugin_file.to_s)), content)
         end
-        manifest_data["requires_chi"] = requires_chi.to_s if requires_chi && !requires_chi.to_s.empty?
-        manifest_data["needs"] = needs.map { |n| n.transform_keys(&:to_s).compact } if needs.is_a?(Array) && !needs.empty?
+        manifest_data.merge!(self.class.mirror_fields(trust_level: trust_level, requires_chi: requires_chi, needs: needs,
+                                                      context_providers: context_providers, block_renderers: block_renderers,
+                                                      session_settings: session_settings, session_setting_types: session_setting_types,
+                                                      settings: settings, setting_types: setting_types))
         manifest_data["includes"] = includes.map(&:to_s) if includes.is_a?(Array)
         unless scripts_files.empty?
           manifest_data["scripts"] = scripts_files.sort.to_h do |file, path|
-            [file.to_s, { "sha256" => dev ? DEV_SHA : "sha256:#{Digest::SHA256.hexdigest(File.binread(path.to_s))}" }]
+            [file.to_s, { "sha256" => dev ? DEV_SHA : FileDigest.sha256(path.to_s) }]
           end
         end
-        manifest_data["context_providers"] = context_providers.map(&:to_h) unless context_providers.empty?
-        manifest_data["session_settings"] = Array(session_settings).map(&:to_s) unless Array(session_settings).empty?
-        manifest_data["session_setting_types"] = session_setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless session_setting_types.to_h.empty?
-        manifest_data["settings"] = settings.map(&:to_s) unless settings.nil?
-        manifest_data["setting_types"] = setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless setting_types.to_h.empty?
+        manifest_data.merge!(kept_manifest_fields(existing, manifest_from, dev))
 
         write_manifest(manifest_data)
         marked.each_key { |key| save_incoming(key, incoming_dir) }
@@ -402,6 +441,39 @@ module Samagotchi
         nil
       end
 
+      # Keeps +dir+/manifest.yml for an installed bundle whose record has no
+      # usable kept manifest (InstalledBundle#manifest_unkept?: an older chi
+      # wrote it, or the file is gone), when +dir+ is the source of what's
+      # installed: its manifest names this bundle at the recorded version and
+      # says what the record keeps (#manifest_difference), and every sha the
+      # record has for a memory, plugin, hook, script or rule is the source
+      # file's. Then the file is copied to #kept_manifest_path and the
+      # record gains its manifest_sha, and nothing else changes (installed_at,
+      # the mirror, installed_by). A dev record is never adopted: its next
+      # install --dev links the file. Read-only with dry_run.
+      # @return [String, nil] why it wasn't (wouldn't be) kept, nil when it was
+      def adopt_manifest(dir, dry_run: false)
+        bundle = record
+        return "#{@name} isn't installed" unless bundle
+        return "#{@name} is a dev install" if bundle.dev
+        return "#{@name} keeps its manifest already" unless bundle.manifest_unkept?
+
+        source = File.join(dir.to_s, "manifest.yml")
+        return "#{dir} has no manifest.yml" unless File.file?(source)
+
+        # One read: the bytes checked are the bytes kept.
+        bytes = File.binread(source)
+        why = adoption_mismatch(bundle, dir.to_s, bytes)
+        return why if why || dry_run
+
+        AtomicFile.write(kept_manifest_path, bytes)
+        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        write_manifest(raw.merge("manifest_sha" => "sha256:#{Digest::SHA256.hexdigest(bytes)}"))
+        nil
+      rescue JSON::ParserError, SystemCallError => e
+        "#{@name}'s record can't take it: #{e.message}"
+      end
+
       # The installed bundle's record, nil when it isn't installed.
       # @return [InstalledBundle, nil]
       # @raise [JSON::ParserError] manifest.json doesn't parse
@@ -426,6 +498,125 @@ module Samagotchi
       end
       private :write_manifest
 
+      # The record's manifest_sha and installed_by: a fresh kept copy's, or
+      # (no manifest_from) the existing record's, the kept file left alone.
+      def kept_manifest_fields(existing, manifest_from, dev)
+        if manifest_from.nil?
+          return { "manifest_sha" => existing&.manifest_sha, "installed_by" => existing&.installed_by }.compact
+        end
+
+        sha = keep_manifest(File.join(manifest_from.to_s, "manifest.yml"), dev)
+        sha ? { "manifest_sha" => sha, "installed_by" => Samagotchi::VERSION } : {}
+      end
+      private :kept_manifest_fields
+
+      # +source+ to #kept_manifest_path: a link to its realpath for a dev
+      # install (DEV_SHA), else a copy written aside and renamed (a link left
+      # by a dev install is replaced, never written through), its sha.
+      # A source with no manifest.yml leaves none kept: nil.
+      def keep_manifest(source, dev)
+        dest = kept_manifest_path
+        unless File.file?(source)
+          FileUtils.rm_f(dest)
+          return nil
+        end
+
+        if dev
+          FileUtils.rm_f(dest)
+          File.symlink(File.realpath(source), dest)
+          return DEV_SHA
+        end
+        AtomicFile.write(dest, File.binread(source))
+        FileDigest.sha256(dest)
+      end
+      private :keep_manifest
+
+      # Why +dir+ isn't the source of what +bundle+ installed (#adopt_manifest), nil when it is.
+      def adoption_mismatch(bundle, dir, bytes)
+        manifest = begin
+          parsed(bytes)
+        rescue Manifest::ValidationError, Psych::Exception, EncodingError => e
+          return "#{dir}'s manifest.yml doesn't read: #{e.message}"
+        end
+        found = "#{manifest.name} #{manifest.version}"
+        return "#{dir} has #{found}, not #{@name} #{bundle.version}" unless manifest.name == @name
+        return "#{dir} has #{found}, not #{bundle.version}" unless manifest.version == bundle.version.to_s
+
+        key = manifest_difference(bundle, manifest)
+        return "#{dir}'s manifest.yml isn't the installed one (#{key})" if key
+
+        installed_shas(bundle, manifest).each do |rel, sha|
+          next if self.class.recorded_sha(sha).empty?
+          return "#{dir}'s #{rel} isn't the installed one" unless self.class.file_sha(File.join(dir, rel)) == self.class.recorded_sha(sha)
+        end
+        nil
+      end
+      private :adoption_mismatch
+
+      # +bytes+ as a manifest.yml, read where nothing else can change it.
+      def parsed(bytes)
+        Dir.mktmpdir("chi-adopt-") do |tmp|
+          path = File.join(tmp, "manifest.yml")
+          File.binwrite(path, bytes)
+          Manifest.new(path: path)
+        rescue Manifest::ValidationError => e
+          raise Manifest::ValidationError, e.message.gsub(tmp, "the source")
+        end
+      end
+      private :parsed
+
+      # The SINCE entry of a mirrored key whose shape a newer chi reads.
+      MIRROR_SINCE = { "session_setting_types" => "session_settings.types", "setting_types" => "settings.types" }.freeze
+
+      # The first manifest key in which +manifest+ says other than what the
+      # record keeps, nil when none: each mirrored key as #write records it (one
+      # the record lacks is fine only when an older chi couldn't have known it:
+      # Manifest::SINCE has it), then each recorded hook's events, on_error and
+      # priority.
+      def manifest_difference(bundle, manifest)
+        recorded = plain(bundle.mirror)
+        source = plain(self.class.mirror_fields(
+          trust_level: manifest.trust_level, requires_chi: manifest.requires_chi, needs: manifest.needs,
+          context_providers: manifest.context_providers, block_renderers: manifest.block_renderers,
+          session_settings: manifest.session_settings, session_setting_types: manifest.session_setting_types,
+          settings: manifest.settings, setting_types: manifest.setting_types
+        ))
+        differing = InstalledBundle::MIRROR_KEYS.find do |key|
+          next false if recorded[key] == source[key]
+
+          !(recorded[key].nil? && Manifest::SINCE.key?(MIRROR_SINCE.fetch(key, key)))
+        end
+        return differing if differing
+
+        same_hooks = bundle.hooks.all? do |file, hook|
+          theirs = manifest.hooks.fetch(file, BundleHook.new)
+          [hook.events, hook.on_error, hook.priority] == [theirs.events, theirs.on_error, theirs.priority]
+        end
+        same_hooks ? nil : "hooks"
+      end
+      private :manifest_difference
+
+      def plain(value) = JSON.parse(JSON.generate(value))
+      private :plain
+
+      # Each file the record has a sha for, by its path in the bundle's source
+      # => that sha: the plugin, hooks, scripts, rules, and each memory whose
+      # entry has a checksum and no conflict mark (its base is the bundle's text).
+      def installed_shas(bundle, manifest)
+        shas = bundle.files.each_with_object({}) do |(key, entry), acc|
+          acc[key] = entry[:checksum].to_s unless entry[:conflict] || entry[:checksum].to_s.empty?
+        end
+        if bundle.plugin
+          file = manifest.plugin && manifest.plugin[:file].to_s
+          shas[file && File.basename(file) == bundle.plugin.file ? file : bundle.plugin.file] = bundle.plugin.sha256
+        end
+        bundle.hooks.each { |file, hook| shas["hooks/#{file}"] = hook.sha256 }
+        bundle.scripts.each { |file, sha| shas["scripts/#{file}"] = sha }
+        bundle.guardrails.each { |file, sha| shas["guardrails/#{file}"] = sha }
+        shas
+      end
+      private :installed_shas
+
       def mark_fields(mark)
         { conflict: true, why: mark.why, missed: mark.missed.empty? ? nil : mark.missed,
           missed_places: mark.places.zero? ? nil : mark.places }.compact
@@ -433,7 +624,7 @@ module Samagotchi
       private :mark_fields
 
       def incoming_sha(path)
-        File.exist?(path) ? self.class.file_sha(path) : nil
+        FileDigest.hex(path)
       rescue SystemCallError
         nil
       end
@@ -457,11 +648,21 @@ module Samagotchi
       private :marked_in
 
       # Each file that settled loses its saved text; the folder goes with the last.
+      # A file key can nest (a manifest's `files:` may name a path), so every file
+      # under incoming/ at any depth is looked at, and a dir the prune empties goes
+      # with it, deepest first.
       def prune_incoming(keep)
         dir = File.join(@bundle_dir, "incoming")
         return unless Dir.exist?(dir)
 
-        (Dir.children(dir) - keep).each { |file| FileUtils.rm_f(File.join(dir, file)) }
+        keep = keep.map(&:to_s)
+        entries = Dir.glob("**/*", base: dir)
+        entries.each do |rel|
+          FileUtils.rm_f(File.join(dir, rel)) if File.file?(File.join(dir, rel)) && !keep.include?(rel)
+        end
+        entries.select { |rel| File.directory?(File.join(dir, rel)) }
+               .sort_by { |rel| -rel.count("/") } # deepest first, so a parent is checked after its children
+               .each { |rel| Dir.rmdir(File.join(dir, rel)) if Dir.empty?(File.join(dir, rel)) }
         Dir.rmdir(dir) if Dir.empty?(dir)
       rescue SystemCallError
         nil

data/lib/samagotchi/memory_bundle/shas.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require "digest"
 require "yaml"
+require_relative "file_digest"
 
 module Samagotchi
   module MemoryBundle
@@ -100,9 +100,10 @@ module Samagotchi
 
       def digest(dir, file)
         path = File.join(dir, file)
-        raise Error, "#{File.basename(dir)}/manifest.yml names #{file}, which isn't there" unless File.file?(path)
+        hex = FileDigest.hex(path)
+        raise Error, "#{File.basename(dir)}/manifest.yml names #{file}, which isn't there" if hex.nil?
 
-        Digest::SHA256.hexdigest(File.binread(path))
+        hex
       end
       private_class_method :digest
 

data/lib/samagotchi/memory_bundle/shipped_update.rb

@@ -3,6 +3,7 @@
 require_relative "installer"
 require_relative "listing"
 require_relative "manifest"
+require_relative "manifest_standing"
 require_relative "merger"
 require_relative "profile"
 require_relative "provenance"
@@ -51,8 +52,11 @@ module Samagotchi
       # (Installer#trash_copy_line).
       # earlier: the merge notes on its record when the plan read it
       # (FileStanding::MergeNote): this run's own merges aren't among them.
+      # manifest: what a row at the shipped version says of its manifest.yml
+      # (ManifestStanding.keep's line: would keep or kept it, or why not and
+      # the command), nil when nothing.
       Row = Struct.new(:name, :from, :to, :status, :note, :merged, :behind, :replaced, :source_dir, :scope, :adds, :kept_own,
-                       :trash_copy, :earlier, keyword_init: true) do
+                       :trash_copy, :earlier, :manifest, keyword_init: true) do
         def kept = Array(behind).map(&:file)
       end
 
@@ -67,6 +71,7 @@ module Samagotchi
           # A row that retried nothing still has its files that stay behind.
           row.behind = bundle.behind_files if row.status == :skipped && !bundle.error?
           row.earlier = bundle.merge_notes
+          row.manifest = ManifestStanding.keep(bundle, source_dir: row.source_dir, dry_run: true).line if same_version?(row)
           row
         end
       end
@@ -89,32 +94,55 @@ module Samagotchi
 
       # Runs the Installer for each :would_update row, Remerge for each
       # :would_merge row; the others pass through. A failing bundle doesn't
-      # stop the rest.
+      # stop the rest. A bundle at the shipped version whose record an older
+      # chi wrote keeps the shipped manifest.yml (#keep_manifest).
       # @return [Array<Row>]
       def apply(rows)
-        rows.map do |row|
-          next apply_remerge(row) if row.status == :would_merge
-          next row unless row.status == :would_update
-          next apply_profile(row) if row.adds
-
-          installer = Installer.new(source: row.source_dir, name: row.name, scope: row.scope, strict: true, upgrade: true,
-                                    shipped_dir: File.dirname(row.source_dir))
-          installer.run
-          row.dup.tap do |r|
-            r.status = :updated
-            r.merged = installer.merged_files
-            r.behind = installer.behind
-            r.trash_copy = installer.trash_copy_line
-          end
-        rescue StandardError => e
-          row.dup.tap do |r|
-            r.status = :failed
-            r.note = e.message.lines.first.to_s.strip
-            r.merged = installer&.merged_files || []
-            r.behind = installer&.behind || []
-            r.trash_copy = installer&.trash_copy_line
-          end
+        rows.map { |row| keep_manifest(apply_row(row)) }
+      end
+
+      def apply_row(row)
+        return apply_remerge(row) if row.status == :would_merge
+        return row unless row.status == :would_update
+        return apply_profile(row) if row.adds
+
+        installer = Installer.new(source: row.source_dir, name: row.name, scope: row.scope, strict: true, upgrade: true,
+                                  shipped_dir: File.dirname(row.source_dir))
+        installer.run
+        row.dup.tap do |r|
+          r.status = :updated
+          r.merged = installer.merged_files
+          r.behind = installer.behind
+          r.trash_copy = installer.trash_copy_line
         end
+      rescue StandardError => e
+        row.dup.tap do |r|
+          r.status = :failed
+          r.note = e.message.lines.first.to_s.strip
+          r.merged = installer&.merged_files || []
+          r.behind = installer&.behind || []
+          r.trash_copy = installer&.trash_copy_line
+        end
+      end
+
+      # The statuses of a row at the shipped version, in the plan and after
+      # apply: its record can keep the shipped dir's manifest.yml.
+      SAME_VERSION = %i[up_to_date would_merge merged].freeze
+
+      def same_version?(row) = !row.source_dir.nil? && SAME_VERSION.include?(row.status)
+
+      # ManifestStanding.keep from the shipped dir for a same-version row: a
+      # record an older chi wrote keeps the shipped manifest.yml, and the row
+      # says so (or why not). A bumped bundle gets the file from its Installer.
+      # @return [Row] the row
+      def keep_manifest(row)
+        return row unless same_version?(row)
+
+        bundle = Provenance.new(name: row.name).record
+        row.manifest = bundle && ManifestStanding.keep(bundle, source_dir: row.source_dir).line
+        row
+      rescue JSON::ParserError, SystemCallError
+        row
       end
 
       def apply_remerge(row)

data/lib/samagotchi/memory_bundle/status.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "digest"
+require_relative "file_digest"
 require_relative "provenance"
 require_relative "manifest"
 require_relative "../version"
@@ -77,7 +77,7 @@ module Samagotchi
 
       # The file's digest, nil when there is none, :unreadable when it can't be read.
       def self.checksum(path)
-        File.exist?(path) ? Digest::SHA256.file(path).hexdigest : nil
+        FileDigest.hex(path)
       rescue SystemCallError
         :unreadable
       end
@@ -86,19 +86,19 @@ module Samagotchi
       # Why none of the bundle's hooks load (this chi doesn't meet its
       # requires_chi, Hooks::BundleLoader), or nil: it has no hooks or meets it.
       def self.hooks_requires_failure(bundle)
-        return nil if bundle.hooks.empty?
+        manifest = bundle.manifest
+        return nil if manifest.hooks.empty?
 
-        Manifest.requires_chi_failure(bundle.requires_chi, Samagotchi::VERSION)
+        manifest.requires_chi_failure
       end
 
       # The stored needs, each with found: from this process's PATH (the
-      # shell's; a worker's PATH can differ, see docs/memory.md).
+      # shell's; a worker's PATH can differ, see docs/memory.md). A needs:
+      # that doesn't parse is none.
       def self.needs_status(bundle, path: ENV["PATH"])
-        Manifest.parse_needs(bundle.needs).map do |need|
+        bundle.manifest.needs.map do |need|
           need.merge(found: BundleNeeds.found?(need[:command], path: path))
         end
-      rescue Manifest::ValidationError
-        []
       end
 
       # "needs gh (reads PRs) [ok]" / "needs gh [not found]: brew install gh"
@@ -120,8 +120,9 @@ module Samagotchi
                 elsif Provenance.sha_matches?(path, bundle.plugin.sha256) then "ok"
                 else "modified"
                 end
-        { file: File.basename(path), path: path, state: state, requires_chi: bundle.requires_chi,
-          requires_failure: Manifest.requires_chi_failure(bundle.requires_chi, Samagotchi::VERSION) }
+        manifest = bundle.manifest
+        { file: File.basename(path), path: path, state: state, requires_chi: manifest.requires_chi,
+          requires_failure: manifest.requires_chi_failure }
       end
 
       def self.unchecked_file(meta)

data/lib/samagotchi/memory_bundle/system_bundle.rb

@@ -117,7 +117,9 @@ module Samagotchi
             dry_run ? planned_update(gem_manifest, from, to) : upgrade_existing(from, to)
           else
             # Already at desired version — still verify files present (e.g. user deleted one)
-            # and retry the files marked conflict.
+            # and retry the files marked conflict. A record an older chi wrote keeps
+            # the shipped manifest.yml (once: then it has it).
+            keep_manifest(bundle) unless dry_run
             verified = verify_files_present(gem_manifest, from, dry_run)
             next remerge(bundle, verified, dry_run) if verified.status == :up_to_date
 
@@ -247,11 +249,20 @@ module Samagotchi
         result(:updated, from: from, to: to, merged: forecast.merged, behind: forecast.behind)
       end
 
+      # Provenance#adopt_manifest from the shipped dir, for a record without a
+      # usable kept manifest. A refusal (a checkout whose bundle changed at the
+      # same version) leaves the record reading its mirror, as before.
+      def keep_manifest(bundle)
+        return unless bundle.manifest_unkept?
+
+        Provenance.new(name: BUNDLE_NAME).adopt_manifest(GEM_BUNDLE_DIR)
+      end
+
       def upgrade_installer
         Installer.new(source: GEM_BUNDLE_DIR, name: BUNDLE_NAME, scope: SCOPE, force: false, strict: true, upgrade: true,
                       shipped_dir: File.dirname(GEM_BUNDLE_DIR))
       end
-      private_class_method :with_lock, :note_newer_installed, :install_fresh, :upgrade_existing, :verify_files_present, :restore_file, :remerge,
+      private_class_method :with_lock, :note_newer_installed, :install_fresh, :keep_manifest, :upgrade_existing, :verify_files_present, :restore_file, :remerge,
                            :upgrade_installer, :result, :planned_update
     end
   end

data/lib/samagotchi/plugin/loader.rb

@@ -113,7 +113,7 @@ module Samagotchi
 
       # Why the installed file can't be loaded, or nil.
       def unloadable_reason(file, bundle)
-        failure = MemoryBundle::Manifest.requires_chi_failure(bundle.requires_chi, Samagotchi::VERSION)
+        failure = bundle.manifest.requires_chi_failure
         return failure if failure
         return "the file is missing" unless file && File.file?(file)