samagotchi 0.151.0 → 0.153.0

data/lib/samagotchi/memory_bundle/provenance.rb

@@ -4,10 +4,14 @@ require "json"
 require "digest"
 require "date"
 require "fileutils"
+require "tmpdir"
 require_relative "../atomic_file"
 require_relative "../memory_paths"
+require_relative "../version"
 require_relative "bundle_hook"
+require_relative "file_digest"
 require_relative "installed_bundle"
+require_relative "manifest"
 
 module Samagotchi
   module MemoryBundle
@@ -15,6 +19,9 @@ module Samagotchi
     # Each installed bundle gets a directory with:
     #   manifest.json — metadata about the install (merged on reinstall)
     #   bases/        — snapshots of every file as installed (for 3-way merge later)
+    #   manifest.yml  — the bundle's own manifest as installed (#write's
+    #                   manifest_from:), its sha in the record; read live
+    #                   through InstalledManifest
     class Provenance
       def self.bundles_dir
         MemoryPaths.bundles_dir
@@ -59,6 +66,11 @@ module Samagotchi
         File.join(@bundle_dir, "scripts")
       end
 
+      # The bundle's manifest.yml as installed (InstalledBundle#kept_manifest_path).
+      def kept_manifest_path
+        File.join(@bundle_dir, "manifest.yml")
+      end
+
       # The plugin file as installed, or nil when the bundle has none.
       # @param bundle [InstalledBundle, nil] its record (read when not given)
       def plugin_path(bundle = record)
@@ -100,7 +112,7 @@ module Samagotchi
           end
           next if holding && !(data.is_a?(Hash) && data[holding].is_a?(Hash) && !data[holding].empty?)
 
-          yield name, InstalledBundle.parse(name, data)
+          yield name, InstalledBundle.parse(name, data, File.join(dir, name))
         end
       end
 
@@ -124,8 +136,11 @@ module Samagotchi
         value.to_s.delete_prefix("sha256:")
       end
 
+      # The digest of a file, nil when it isn't there (FileDigest). Every
+      # caller checks existence first; #sha_matches? reads a missing file as
+      # not the recorded one.
       def self.file_sha(path)
-        Digest::SHA256.hexdigest(File.binread(path))
+        FileDigest.hex(path)
       end
 
       # What a dev install (`chi bundle install --dev`) records instead of
@@ -144,6 +159,24 @@ module Samagotchi
         unchecked?(recorded) || file_sha(path) == recorded_sha(recorded)
       end
 
+      # The record's mirror of the manifest keys (InstalledBundle::MIRROR_KEYS)
+      # as #write records them from its kwargs: what an older chi reads, and
+      # what #adopt_manifest holds a source's manifest against.
+      def self.mirror_fields(trust_level:, requires_chi:, needs:, context_providers:, block_renderers:, session_settings:,
+                             session_setting_types:, settings:, setting_types:)
+        fields = {}
+        fields["trust_level"] = trust_level.to_s if trust_level && !trust_level.to_s.empty?
+        fields["requires_chi"] = requires_chi.to_s if requires_chi && !requires_chi.to_s.empty?
+        fields["needs"] = needs.map { |n| n.transform_keys(&:to_s).compact } if needs.is_a?(Array) && !needs.empty?
+        fields["context_providers"] = context_providers.map(&:to_h) unless context_providers.empty?
+        fields["block_renderers"] = block_renderers.map(&:to_h) unless block_renderers.empty?
+        fields["session_settings"] = Array(session_settings).map(&:to_s) unless Array(session_settings).empty?
+        fields["session_setting_types"] = session_setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless session_setting_types.to_h.empty?
+        fields["settings"] = settings.map(&:to_s) unless settings.nil?
+        fields["setting_types"] = setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless setting_types.to_h.empty?
+        fields
+      end
+
       # Writes provenance for an installation: merges into existing manifest.json
       # and saves base snapshots. Stale base snapshots (files removed from bundle)
       # are pruned.
@@ -175,10 +208,18 @@ module Samagotchi
       # @param block_renderers [Array<BlockRenderers::Renderer>]
       # @param dev [Boolean] a dev install: its files are links to the
       #   source, recorded as DEV_SHA (no sha256 check) with "dev": true
+      # @param manifest_from [String, nil] the source dir: its manifest.yml is
+      #   kept at #kept_manifest_path (a copy, a link for a dev install),
+      #   recorded as manifest_sha (DEV_SHA for dev), with installed_by: this
+      #   chi's VERSION. nil leaves the kept file, and the record's
+      #   manifest_sha and installed_by, as they are. The keys a record mirrors
+      #   (requires_chi … setting_types) are still written from the kwargs:
+      #   an older chi sharing this memories dir reads only them
+      #   (docs/internals/bundles.md); a key a later manifest gains is never added
       def write(files:, scope:, version:, source_path:, hooks: {}, trust_level: nil, source_commit: nil, hooks_files: {},
                 guardrails_files: {}, plugin_file: nil, requires_chi: nil, needs: nil, marks: [], incoming_dir: nil, includes: nil,
                 scripts_files: {}, context_providers: [], block_renderers: [], file_descriptions: {}, session_settings: [], session_setting_types: {}, settings: nil, setting_types: {},
-                dev: false)
+                dev: false, manifest_from: nil)
         FileUtils.mkdir_p(@bundle_dir)
         bases_dir = File.join(@bundle_dir, "bases")
         FileUtils.mkdir_p(bases_dir)
@@ -265,36 +306,32 @@ module Samagotchi
           "files" => merged_entries,
           "hooks" => hooks_map
         }
-        manifest_data["trust_level"] = trust_level.to_s if trust_level && !trust_level.to_s.empty?
         manifest_data["dev"] = true if dev
         if guardrails_files.is_a?(Hash) && !guardrails_files.empty?
           manifest_data["guardrails"] = guardrails_files.sort.to_h do |basename, path|
-            [basename.to_s, { "sha256" => dev ? DEV_SHA : "sha256:#{Digest::SHA256.hexdigest(File.read(path.to_s))}" }]
+            [basename.to_s, { "sha256" => dev ? DEV_SHA : FileDigest.sha256(path.to_s) }]
           end
         end
         manifest_data["source_commit"] = source_commit.to_s if source_commit && !source_commit.to_s.empty?
         FileUtils.rm_rf(File.join(bases_dir, "plugin"))
         if plugin_file
-          content = File.binread(plugin_file.to_s)
+          content = File.binread(plugin_file.to_s) # the base snapshot's bytes
           manifest_data["plugin"] = { "file" => File.basename(plugin_file.to_s),
-                                      "sha256" => dev ? DEV_SHA : "sha256:#{Digest::SHA256.hexdigest(content)}" }
+                                      "sha256" => dev ? DEV_SHA : FileDigest.sha256(plugin_file.to_s) }
           FileUtils.mkdir_p(File.join(bases_dir, "plugin"))
           File.binwrite(plugin_base_path(File.basename(plugin_file.to_s)), content)
         end
-        manifest_data["requires_chi"] = requires_chi.to_s if requires_chi && !requires_chi.to_s.empty?
-        manifest_data["needs"] = needs.map { |n| n.transform_keys(&:to_s).compact } if needs.is_a?(Array) && !needs.empty?
+        manifest_data.merge!(self.class.mirror_fields(trust_level: trust_level, requires_chi: requires_chi, needs: needs,
+                                                      context_providers: context_providers, block_renderers: block_renderers,
+                                                      session_settings: session_settings, session_setting_types: session_setting_types,
+                                                      settings: settings, setting_types: setting_types))
         manifest_data["includes"] = includes.map(&:to_s) if includes.is_a?(Array)
         unless scripts_files.empty?
           manifest_data["scripts"] = scripts_files.sort.to_h do |file, path|
-            [file.to_s, { "sha256" => dev ? DEV_SHA : "sha256:#{Digest::SHA256.hexdigest(File.binread(path.to_s))}" }]
+            [file.to_s, { "sha256" => dev ? DEV_SHA : FileDigest.sha256(path.to_s) }]
           end
         end
-        manifest_data["context_providers"] = context_providers.map(&:to_h) unless context_providers.empty?
-        manifest_data["block_renderers"] = block_renderers.map(&:to_h) unless block_renderers.empty?
-        manifest_data["session_settings"] = Array(session_settings).map(&:to_s) unless Array(session_settings).empty?
-        manifest_data["session_setting_types"] = session_setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless session_setting_types.to_h.empty?
-        manifest_data["settings"] = settings.map(&:to_s) unless settings.nil?
-        manifest_data["setting_types"] = setting_types.to_h { |k, v| [k.to_s, v.to_s] } unless setting_types.to_h.empty?
+        manifest_data.merge!(kept_manifest_fields(existing, manifest_from, dev))
 
         write_manifest(manifest_data)
         marked.each_key { |key| save_incoming(key, incoming_dir) }
@@ -404,6 +441,39 @@ module Samagotchi
         nil
       end
 
+      # Keeps +dir+/manifest.yml for an installed bundle whose record has no
+      # usable kept manifest (InstalledBundle#manifest_unkept?: an older chi
+      # wrote it, or the file is gone), when +dir+ is the source of what's
+      # installed: its manifest names this bundle at the recorded version and
+      # says what the record keeps (#manifest_difference), and every sha the
+      # record has for a memory, plugin, hook, script or rule is the source
+      # file's. Then the file is copied to #kept_manifest_path and the
+      # record gains its manifest_sha, and nothing else changes (installed_at,
+      # the mirror, installed_by). A dev record is never adopted: its next
+      # install --dev links the file. Read-only with dry_run.
+      # @return [String, nil] why it wasn't (wouldn't be) kept, nil when it was
+      def adopt_manifest(dir, dry_run: false)
+        bundle = record
+        return "#{@name} isn't installed" unless bundle
+        return "#{@name} is a dev install" if bundle.dev
+        return "#{@name} keeps its manifest already" unless bundle.manifest_unkept?
+
+        source = File.join(dir.to_s, "manifest.yml")
+        return "#{dir} has no manifest.yml" unless File.file?(source)
+
+        # One read: the bytes checked are the bytes kept.
+        bytes = File.binread(source)
+        why = adoption_mismatch(bundle, dir.to_s, bytes)
+        return why if why || dry_run
+
+        AtomicFile.write(kept_manifest_path, bytes)
+        raw = JSON.parse(File.read(File.join(@bundle_dir, "manifest.json")))
+        write_manifest(raw.merge("manifest_sha" => "sha256:#{Digest::SHA256.hexdigest(bytes)}"))
+        nil
+      rescue JSON::ParserError, SystemCallError => e
+        "#{@name}'s record can't take it: #{e.message}"
+      end
+
       # The installed bundle's record, nil when it isn't installed.
       # @return [InstalledBundle, nil]
       # @raise [JSON::ParserError] manifest.json doesn't parse
@@ -428,6 +498,125 @@ module Samagotchi
       end
       private :write_manifest
 
+      # The record's manifest_sha and installed_by: a fresh kept copy's, or
+      # (no manifest_from) the existing record's, the kept file left alone.
+      def kept_manifest_fields(existing, manifest_from, dev)
+        if manifest_from.nil?
+          return { "manifest_sha" => existing&.manifest_sha, "installed_by" => existing&.installed_by }.compact
+        end
+
+        sha = keep_manifest(File.join(manifest_from.to_s, "manifest.yml"), dev)
+        sha ? { "manifest_sha" => sha, "installed_by" => Samagotchi::VERSION } : {}
+      end
+      private :kept_manifest_fields
+
+      # +source+ to #kept_manifest_path: a link to its realpath for a dev
+      # install (DEV_SHA), else a copy written aside and renamed (a link left
+      # by a dev install is replaced, never written through), its sha.
+      # A source with no manifest.yml leaves none kept: nil.
+      def keep_manifest(source, dev)
+        dest = kept_manifest_path
+        unless File.file?(source)
+          FileUtils.rm_f(dest)
+          return nil
+        end
+
+        if dev
+          FileUtils.rm_f(dest)
+          File.symlink(File.realpath(source), dest)
+          return DEV_SHA
+        end
+        AtomicFile.write(dest, File.binread(source))
+        FileDigest.sha256(dest)
+      end
+      private :keep_manifest
+
+      # Why +dir+ isn't the source of what +bundle+ installed (#adopt_manifest), nil when it is.
+      def adoption_mismatch(bundle, dir, bytes)
+        manifest = begin
+          parsed(bytes)
+        rescue Manifest::ValidationError, Psych::Exception, EncodingError => e
+          return "#{dir}'s manifest.yml doesn't read: #{e.message}"
+        end
+        found = "#{manifest.name} #{manifest.version}"
+        return "#{dir} has #{found}, not #{@name} #{bundle.version}" unless manifest.name == @name
+        return "#{dir} has #{found}, not #{bundle.version}" unless manifest.version == bundle.version.to_s
+
+        key = manifest_difference(bundle, manifest)
+        return "#{dir}'s manifest.yml isn't the installed one (#{key})" if key
+
+        installed_shas(bundle, manifest).each do |rel, sha|
+          next if self.class.recorded_sha(sha).empty?
+          return "#{dir}'s #{rel} isn't the installed one" unless self.class.file_sha(File.join(dir, rel)) == self.class.recorded_sha(sha)
+        end
+        nil
+      end
+      private :adoption_mismatch
+
+      # +bytes+ as a manifest.yml, read where nothing else can change it.
+      def parsed(bytes)
+        Dir.mktmpdir("chi-adopt-") do |tmp|
+          path = File.join(tmp, "manifest.yml")
+          File.binwrite(path, bytes)
+          Manifest.new(path: path)
+        rescue Manifest::ValidationError => e
+          raise Manifest::ValidationError, e.message.gsub(tmp, "the source")
+        end
+      end
+      private :parsed
+
+      # The SINCE entry of a mirrored key whose shape a newer chi reads.
+      MIRROR_SINCE = { "session_setting_types" => "session_settings.types", "setting_types" => "settings.types" }.freeze
+
+      # The first manifest key in which +manifest+ says other than what the
+      # record keeps, nil when none: each mirrored key as #write records it (one
+      # the record lacks is fine only when an older chi couldn't have known it:
+      # Manifest::SINCE has it), then each recorded hook's events, on_error and
+      # priority.
+      def manifest_difference(bundle, manifest)
+        recorded = plain(bundle.mirror)
+        source = plain(self.class.mirror_fields(
+          trust_level: manifest.trust_level, requires_chi: manifest.requires_chi, needs: manifest.needs,
+          context_providers: manifest.context_providers, block_renderers: manifest.block_renderers,
+          session_settings: manifest.session_settings, session_setting_types: manifest.session_setting_types,
+          settings: manifest.settings, setting_types: manifest.setting_types
+        ))
+        differing = InstalledBundle::MIRROR_KEYS.find do |key|
+          next false if recorded[key] == source[key]
+
+          !(recorded[key].nil? && Manifest::SINCE.key?(MIRROR_SINCE.fetch(key, key)))
+        end
+        return differing if differing
+
+        same_hooks = bundle.hooks.all? do |file, hook|
+          theirs = manifest.hooks.fetch(file, BundleHook.new)
+          [hook.events, hook.on_error, hook.priority] == [theirs.events, theirs.on_error, theirs.priority]
+        end
+        same_hooks ? nil : "hooks"
+      end
+      private :manifest_difference
+
+      def plain(value) = JSON.parse(JSON.generate(value))
+      private :plain
+
+      # Each file the record has a sha for, by its path in the bundle's source
+      # => that sha: the plugin, hooks, scripts, rules, and each memory whose
+      # entry has a checksum and no conflict mark (its base is the bundle's text).
+      def installed_shas(bundle, manifest)
+        shas = bundle.files.each_with_object({}) do |(key, entry), acc|
+          acc[key] = entry[:checksum].to_s unless entry[:conflict] || entry[:checksum].to_s.empty?
+        end
+        if bundle.plugin
+          file = manifest.plugin && manifest.plugin[:file].to_s
+          shas[file && File.basename(file) == bundle.plugin.file ? file : bundle.plugin.file] = bundle.plugin.sha256
+        end
+        bundle.hooks.each { |file, hook| shas["hooks/#{file}"] = hook.sha256 }
+        bundle.scripts.each { |file, sha| shas["scripts/#{file}"] = sha }
+        bundle.guardrails.each { |file, sha| shas["guardrails/#{file}"] = sha }
+        shas
+      end
+      private :installed_shas
+
       def mark_fields(mark)
         { conflict: true, why: mark.why, missed: mark.missed.empty? ? nil : mark.missed,
           missed_places: mark.places.zero? ? nil : mark.places }.compact
@@ -435,7 +624,7 @@ module Samagotchi
       private :mark_fields
 
       def incoming_sha(path)
-        File.exist?(path) ? self.class.file_sha(path) : nil
+        FileDigest.hex(path)
       rescue SystemCallError
         nil
       end
@@ -459,11 +648,21 @@ module Samagotchi
       private :marked_in
 
       # Each file that settled loses its saved text; the folder goes with the last.
+      # A file key can nest (a manifest's `files:` may name a path), so every file
+      # under incoming/ at any depth is looked at, and a dir the prune empties goes
+      # with it, deepest first.
       def prune_incoming(keep)
         dir = File.join(@bundle_dir, "incoming")
         return unless Dir.exist?(dir)
 
-        (Dir.children(dir) - keep).each { |file| FileUtils.rm_f(File.join(dir, file)) }
+        keep = keep.map(&:to_s)
+        entries = Dir.glob("**/*", base: dir)
+        entries.each do |rel|
+          FileUtils.rm_f(File.join(dir, rel)) if File.file?(File.join(dir, rel)) && !keep.include?(rel)
+        end
+        entries.select { |rel| File.directory?(File.join(dir, rel)) }
+               .sort_by { |rel| -rel.count("/") } # deepest first, so a parent is checked after its children
+               .each { |rel| Dir.rmdir(File.join(dir, rel)) if Dir.empty?(File.join(dir, rel)) }
         Dir.rmdir(dir) if Dir.empty?(dir)
       rescue SystemCallError
         nil

data/lib/samagotchi/memory_bundle/shas.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require "digest"
 require "yaml"
+require_relative "file_digest"
 
 module Samagotchi
   module MemoryBundle
@@ -100,9 +100,10 @@ module Samagotchi
 
       def digest(dir, file)
         path = File.join(dir, file)
-        raise Error, "#{File.basename(dir)}/manifest.yml names #{file}, which isn't there" unless File.file?(path)
+        hex = FileDigest.hex(path)
+        raise Error, "#{File.basename(dir)}/manifest.yml names #{file}, which isn't there" if hex.nil?
 
-        Digest::SHA256.hexdigest(File.binread(path))
+        hex
       end
       private_class_method :digest
 

data/lib/samagotchi/memory_bundle/shipped_update.rb

@@ -3,6 +3,7 @@
 require_relative "installer"
 require_relative "listing"
 require_relative "manifest"
+require_relative "manifest_standing"
 require_relative "merger"
 require_relative "profile"
 require_relative "provenance"
@@ -51,8 +52,11 @@ module Samagotchi
       # (Installer#trash_copy_line).
       # earlier: the merge notes on its record when the plan read it
       # (FileStanding::MergeNote): this run's own merges aren't among them.
+      # manifest: what a row at the shipped version says of its manifest.yml
+      # (ManifestStanding.keep's line: would keep or kept it, or why not and
+      # the command), nil when nothing.
       Row = Struct.new(:name, :from, :to, :status, :note, :merged, :behind, :replaced, :source_dir, :scope, :adds, :kept_own,
-                       :trash_copy, :earlier, keyword_init: true) do
+                       :trash_copy, :earlier, :manifest, keyword_init: true) do
         def kept = Array(behind).map(&:file)
       end
 
@@ -67,6 +71,7 @@ module Samagotchi
           # A row that retried nothing still has its files that stay behind.
           row.behind = bundle.behind_files if row.status == :skipped && !bundle.error?
           row.earlier = bundle.merge_notes
+          row.manifest = ManifestStanding.keep(bundle, source_dir: row.source_dir, dry_run: true).line if same_version?(row)
           row
         end
       end
@@ -89,32 +94,55 @@ module Samagotchi
 
       # Runs the Installer for each :would_update row, Remerge for each
       # :would_merge row; the others pass through. A failing bundle doesn't
-      # stop the rest.
+      # stop the rest. A bundle at the shipped version whose record an older
+      # chi wrote keeps the shipped manifest.yml (#keep_manifest).
       # @return [Array<Row>]
       def apply(rows)
-        rows.map do |row|
-          next apply_remerge(row) if row.status == :would_merge
-          next row unless row.status == :would_update
-          next apply_profile(row) if row.adds
-
-          installer = Installer.new(source: row.source_dir, name: row.name, scope: row.scope, strict: true, upgrade: true,
-                                    shipped_dir: File.dirname(row.source_dir))
-          installer.run
-          row.dup.tap do |r|
-            r.status = :updated
-            r.merged = installer.merged_files
-            r.behind = installer.behind
-            r.trash_copy = installer.trash_copy_line
-          end
-        rescue StandardError => e
-          row.dup.tap do |r|
-            r.status = :failed
-            r.note = e.message.lines.first.to_s.strip
-            r.merged = installer&.merged_files || []
-            r.behind = installer&.behind || []
-            r.trash_copy = installer&.trash_copy_line
-          end
+        rows.map { |row| keep_manifest(apply_row(row)) }
+      end
+
+      def apply_row(row)
+        return apply_remerge(row) if row.status == :would_merge
+        return row unless row.status == :would_update
+        return apply_profile(row) if row.adds
+
+        installer = Installer.new(source: row.source_dir, name: row.name, scope: row.scope, strict: true, upgrade: true,
+                                  shipped_dir: File.dirname(row.source_dir))
+        installer.run
+        row.dup.tap do |r|
+          r.status = :updated
+          r.merged = installer.merged_files
+          r.behind = installer.behind
+          r.trash_copy = installer.trash_copy_line
         end
+      rescue StandardError => e
+        row.dup.tap do |r|
+          r.status = :failed
+          r.note = e.message.lines.first.to_s.strip
+          r.merged = installer&.merged_files || []
+          r.behind = installer&.behind || []
+          r.trash_copy = installer&.trash_copy_line
+        end
+      end
+
+      # The statuses of a row at the shipped version, in the plan and after
+      # apply: its record can keep the shipped dir's manifest.yml.
+      SAME_VERSION = %i[up_to_date would_merge merged].freeze
+
+      def same_version?(row) = !row.source_dir.nil? && SAME_VERSION.include?(row.status)
+
+      # ManifestStanding.keep from the shipped dir for a same-version row: a
+      # record an older chi wrote keeps the shipped manifest.yml, and the row
+      # says so (or why not). A bumped bundle gets the file from its Installer.
+      # @return [Row] the row
+      def keep_manifest(row)
+        return row unless same_version?(row)
+
+        bundle = Provenance.new(name: row.name).record
+        row.manifest = bundle && ManifestStanding.keep(bundle, source_dir: row.source_dir).line
+        row
+      rescue JSON::ParserError, SystemCallError
+        row
       end
 
       def apply_remerge(row)

data/lib/samagotchi/memory_bundle/status.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "digest"
+require_relative "file_digest"
 require_relative "provenance"
 require_relative "manifest"
 require_relative "../version"
@@ -77,7 +77,7 @@ module Samagotchi
 
       # The file's digest, nil when there is none, :unreadable when it can't be read.
       def self.checksum(path)
-        File.exist?(path) ? Digest::SHA256.file(path).hexdigest : nil
+        FileDigest.hex(path)
       rescue SystemCallError
         :unreadable
       end
@@ -86,19 +86,19 @@ module Samagotchi
       # Why none of the bundle's hooks load (this chi doesn't meet its
       # requires_chi, Hooks::BundleLoader), or nil: it has no hooks or meets it.
       def self.hooks_requires_failure(bundle)
-        return nil if bundle.hooks.empty?
+        manifest = bundle.manifest
+        return nil if manifest.hooks.empty?
 
-        Manifest.requires_chi_failure(bundle.requires_chi, Samagotchi::VERSION)
+        manifest.requires_chi_failure
       end
 
       # The stored needs, each with found: from this process's PATH (the
-      # shell's; a worker's PATH can differ, see docs/memory.md).
+      # shell's; a worker's PATH can differ, see docs/memory.md). A needs:
+      # that doesn't parse is none.
       def self.needs_status(bundle, path: ENV["PATH"])
-        Manifest.parse_needs(bundle.needs).map do |need|
+        bundle.manifest.needs.map do |need|
           need.merge(found: BundleNeeds.found?(need[:command], path: path))
         end
-      rescue Manifest::ValidationError
-        []
       end
 
       # "needs gh (reads PRs) [ok]" / "needs gh [not found]: brew install gh"
@@ -120,8 +120,9 @@ module Samagotchi
                 elsif Provenance.sha_matches?(path, bundle.plugin.sha256) then "ok"
                 else "modified"
                 end
-        { file: File.basename(path), path: path, state: state, requires_chi: bundle.requires_chi,
-          requires_failure: Manifest.requires_chi_failure(bundle.requires_chi, Samagotchi::VERSION) }
+        manifest = bundle.manifest
+        { file: File.basename(path), path: path, state: state, requires_chi: manifest.requires_chi,
+          requires_failure: manifest.requires_chi_failure }
       end
 
       def self.unchecked_file(meta)

data/lib/samagotchi/memory_bundle/system_bundle.rb

@@ -117,7 +117,9 @@ module Samagotchi
             dry_run ? planned_update(gem_manifest, from, to) : upgrade_existing(from, to)
           else
             # Already at desired version — still verify files present (e.g. user deleted one)
-            # and retry the files marked conflict.
+            # and retry the files marked conflict. A record an older chi wrote keeps
+            # the shipped manifest.yml (once: then it has it).
+            keep_manifest(bundle) unless dry_run
             verified = verify_files_present(gem_manifest, from, dry_run)
             next remerge(bundle, verified, dry_run) if verified.status == :up_to_date
 
@@ -247,11 +249,20 @@ module Samagotchi
         result(:updated, from: from, to: to, merged: forecast.merged, behind: forecast.behind)
       end
 
+      # Provenance#adopt_manifest from the shipped dir, for a record without a
+      # usable kept manifest. A refusal (a checkout whose bundle changed at the
+      # same version) leaves the record reading its mirror, as before.
+      def keep_manifest(bundle)
+        return unless bundle.manifest_unkept?
+
+        Provenance.new(name: BUNDLE_NAME).adopt_manifest(GEM_BUNDLE_DIR)
+      end
+
       def upgrade_installer
         Installer.new(source: GEM_BUNDLE_DIR, name: BUNDLE_NAME, scope: SCOPE, force: false, strict: true, upgrade: true,
                       shipped_dir: File.dirname(GEM_BUNDLE_DIR))
       end
-      private_class_method :with_lock, :note_newer_installed, :install_fresh, :upgrade_existing, :verify_files_present, :restore_file, :remerge,
+      private_class_method :with_lock, :note_newer_installed, :install_fresh, :keep_manifest, :upgrade_existing, :verify_files_present, :restore_file, :remerge,
                            :upgrade_installer, :result, :planned_update
     end
   end

data/lib/samagotchi/message_parts.rb

@@ -240,8 +240,9 @@ module Samagotchi
     # +tool_id+: its output's ToolIds id, with its ✂ mark in +marks+.
     def tool_part(call, output, registry, shown = nil, images = nil, label: nil, diff: nil, refs: nil, cwd: nil,
                   tool_id: nil, marks: {})
-      # A built-in reached through call_tool reloads as that built-in's
-      # row, with via (its saved params and label are the built-in's).
+      # A chi tool (a built-in or a plugin's) reached through call_tool
+      # reloads as that tool's row, with via (its saved params and label
+      # are the tool's).
       # A direct call of an MCP tool reloads as the call_tool row it ran as.
       call = Tools::BuiltinCalls.unwrap_saved(Tools::BuiltinCalls.wrap_saved(call, output), output)
       name = call[:name].to_s

data/lib/samagotchi/plugin/loader.rb

@@ -113,7 +113,7 @@ module Samagotchi
 
       # Why the installed file can't be loaded, or nil.
       def unloadable_reason(file, bundle)
-        failure = MemoryBundle::Manifest.requires_chi_failure(bundle.requires_chi, Samagotchi::VERSION)
+        failure = bundle.manifest.requires_chi_failure
         return failure if failure
         return "the file is missing" unless file && File.file?(file)
 

data/lib/samagotchi/session_config.rb

@@ -13,7 +13,7 @@ module Samagotchi
   # (RecapSetup). Its
   # bundles part: {bundle => {key => value}}, string keys, scalar values
   # (.typed). A bundle offers the keys a session may set in its manifest's
-  # session_settings: (recorded at install, InstalledBundle#session_settings);
+  # session_settings: (recorded at install, InstalledManifest#session_settings);
   # any other bundle or key is refused, so a typo isn't saved, and so is a
   # value of another type than the manifest gives the key (session_settings:
   # {cap: number}). The session keeps them (Session#settings, SessionSetup)
@@ -308,9 +308,10 @@ module Samagotchi
           notes[name] = "#{name} is installed but its plugin doesn't load: #{reason}"
           next
         end
-        offered[name] = bundle.session_settings
-        types[name] = bundle.session_setting_types unless bundle.session_setting_types.empty?
-        if bundle.session_settings.empty? && shipped_settings?(shipped_dir, name)
+        manifest = bundle.manifest
+        offered[name] = manifest.session_settings
+        types[name] = manifest.session_setting_types unless manifest.session_setting_types.empty?
+        if manifest.session_settings.empty? && shipped_settings?(shipped_dir, name)
           notes[name] = "(run `chi update` or `chi bundle upgrade #{name}` to refresh it)"
         end
       end

data/lib/samagotchi/system_one/record.rb

@@ -7,7 +7,8 @@ module Samagotchi
   module SystemOne
     # One rule's record: what System 1 has judged for it and what the user
     # did about those asks. Built from `SystemOne::Log#entries` (judgments
-    # joined with their last label), filtered to one rule. The gate before
+    # joined with their last label), filtered to one rule — an ask two rules
+    # raised counts for each of them (its `other_rules`). The gate before
     # System 1 answers for the user: enough clean allows at the threshold,
     # and no false allow among the rule's last 20 labelled asks
     # (docs/guardrails.md, "System 1"). A rule in
@@ -41,7 +42,14 @@ module Samagotchi
       #   rule's. A line with no repo is in no repository's record.
       def initialize(entries, rule:, repo: nil)
         @rule = rule.to_s
-        @entries = Array(entries).select { |entry| entry["rule"].to_s == @rule && (repo.nil? || entry["repo"] == repo) }
+        @entries = Array(entries).select { |entry| asks?(entry) && (repo.nil? || entry["repo"] == repo) }
+      end
+
+      # The judgment names the rule the ask was for; an ask two rules raised
+      # carries the others in `other_rules`, so it counts in each of their
+      # records too.
+      def asks?(entry)
+        entry["rule"].to_s == @rule || Array(entry["other_rules"]).any? { |other| other.to_s == @rule }
       end
 
       # @param threshold [Float] the probability an auto-allow needs