samagotchi 0.155.0 → 0.156.0

data/docs/internals/llm-context-forget.md

@@ -29,7 +29,7 @@ lets the model forget its own tool outputs. The pieces:
   those steps, counted with the forget's own: `protect_steps + 1`) unless the forget keeps lines of it; a keep
   outside the output's lines, of a preview, or holding all of it; an output of `SMALL` (80) chars or less; an output
   with an edit already; an unknown id. What passes is saved as a staged `LLMContextEdit` of kind `:forget` (`by:
-  "model"`, the note, `keep`), and the apply rule runs at once as at a request (`KernelLoop#apply_llm_context!`), so
+  "model"`, the note, `keep`), and the apply rule runs at once as at a request (`LLMContextApply.apply!`, through `KernelLoop#apply_llm_context!`), so
   the result can say whether the batch goes with the next request or waits for the turn's end. `LLMContextApply`'s
   protect_steps hold covers stale's stubs only: a forget was checked when it was made.
 - **Restore** takes the forget off the entry (`LLMContextEdit.remove`, a new edits Hash); the next request sends the
@@ -38,8 +38,13 @@ lets the model forget its own tool outputs. The pieces:
 - **Which edits are sent** is one predicate, `LLMContextView#sends?(edit)`: applied, and its kind one of the view's
   layers or `:drop`. The view stubs by it and `WorkingSet` decides "still sent" by it. The view's layers are
   `LLMContextStrategy::LAYERS` (`stale`, `forget`), the strategy's words, not `LLMContextEdit::KINDS`: whatever a
-  caller passes as the strategy, an edit kind no strategy names never becomes a layer that `apply_llm_context!` would
-  hand to `LLMContextApply.run!`. Under none the view has no layers and, unless an entry holds a drop
+  caller passes as the strategy, an edit kind no strategy names never becomes a layer that `LLMContextApply.apply!` would
+  hand to `LLMContextApply.run!`. Both loops build their view with `LLMContextView.for(llm_context)` (the turn's
+  strategy, none without one) and apply with `LLMContextApply.apply!(conversation, llm_context, moment:, context:,
+  warmup:, emit:, model:)`, module functions that hold no loop state: the run, its `llm_context_apply` log line (with
+  the run's model) and its ✂ row (`LLMContextNotice`; none for the warm-up's copy). `KernelLoop#llm_context_view` and
+  `#apply_llm_context!` are one-line defaults over them (the native run's settings), `ChatLoop`'s the same over its
+  turn's. Under none the view has no layers and, unless an entry holds a drop
   (`LLMContextEdit.drop_on?`, one scan), `#messages` returns the Array it was given.
 - **The user's layer, always on**: an edit of kind `:drop` (`by: "user"`, the working set's drop:
   [working-set.md](working-set.md#steering-drop-and-undrop)) is sent under every strategy, none included, as

data/docs/internals/objectives.md

@@ -117,7 +117,7 @@ Bridge's `TurnAccumulator#current_messages`) leaves tool calls out. A move shows
 `action: propose` (`change` add, reword, done or drop; `id`; `text`; `note`, why) checks the change against the list
 (`Objectives::Proposal#refusal`: its line through `Objectives::Edit`, the edit the card's Apply runs, so the tool refuses
 what Apply would) and hands it to `Engine#propose_objective` (`TurnStages::Objectives#propose`), which keeps it until the turn is over,
-as `TurnStages::ContextJudge`'s cards are kept. `run_turn`'s ensure (`TurnStages::Objectives#finally`) shows them only for a turn that completed: a canceled or
+as `TurnStages::ContextJudge`'s cards are kept. `run_turn`'s ensure (`Engine#show_objective_proposals`, the cards `TurnStages::Objectives#finally` gives) shows them only for a turn that completed: a canceled or
 failed one drops them, so its Apply card never outlives a turn whose call a
 rollback has taken out of the history, and nothing carries over to the next turn. A card is between turns (no
 `in_turn`), so it writes no `pending_card.json`, the stage doesn't say it waits, and it keeps its buttons over a
@@ -139,7 +139,7 @@ any call. An add's text can't split on ` | `. The body names the line, for a ter
 
 `Objectives.view` (`List#to_view`) is what the page draws: the items, each with its last move, and `pending`, whether
 the newest list is a file still waiting. The session read (`objectives`, no key with no list) and the live
-`:objectives_updated` carry it. `Engine#announce_objectives` (`TurnStages::Objectives#announce`) emits when the view differs from the last: after an edit,
+`:objectives_updated` carry it. `Engine#announce_objectives` (under the event lock, `TurnStages::Objectives#announce` giving the event) emits when the view differs from the last: after an edit,
 once a list note is in (`add_context_note`), at a turn's end (its moves) and after a rollback between turns. A session
 with no list emits nothing. Between two tabs that is all it takes. A participant gets neither: the event is in
 `ParticipantView::DROPPED`.

data/docs/internals/prompt-caching.md

@@ -222,7 +222,10 @@ is prefilled once. The native and the chat loop use the same plan.
 - The debug log's `generation_completed` line: `prompt=` (the request's prompt tokens), `cached=` (read from the
   server's cache), `cache_write=` (written to it, where the provider reports writes) and `reprefill=` (of the last
   request's prompt on the same model through the same host, what was prefilled again; a `/model` to the same bare
-  model on another host is the switch's prefill, not a re-prefill). The `http` line of a
+  model on another host is the switch's prefill, not a re-prefill). The baseline is the Engine's `ReprefillMeter`
+  (`reprefill_meter.rb`), one for both loops: the last request whichever loop sent it, keyed by the model and the
+  host's client (`KernelLoop#client`, `ChatLoop#client`), so a switch to another host and back starts over on the
+  way back; the turn-end warm-up resets it (`KernelLoop#warmed_up!`). The `http` line of a
   remote Claude or Messages request shows `cache=on` (or `cache=1h`) when it carried breakpoints.
 - The warm-up logs `model warmup` with `cached=`, `prefilled=` and `prefill_ms=`.
 - `/stats`: "cached N (P%)", "cache writes" and "re-prefilled" for the session.

data/docs/internals/remote-sessions.md

@@ -121,7 +121,9 @@ the session commands*. Keep that table in step with `SessionAccessRoutes`.
 - **Refusals.** `SessionAccessRoutes#refusal_response` (and the page routes that raise) send
   `{error, detail, message, …fields}`: `detail` is the page's wording, `message` is the exception's own text, and the
   fields are those the class is built from (`session_id`, `reason`, `ids`, `busy_id`, `version`).
-  `Remote#raise_refusal` rebuilds the class that Local's callee raises: `ArgumentError`, `Session::AmbiguousId`,
+  `Remote#raise_refusal` rebuilds the class that Local's callee raises: `Session::NotFound` for a `404 not_found`
+  whose detail is `no session X` (or, from chi web 0.155.0 and older, `Session not found: X`), a plain
+  `ArgumentError` for another `not_found`, `Session::AmbiguousId`,
   `SessionManager::OwnedByTUI` / `DeleteRefused` / `ArchiveRefused` / `RestartRefused`, `SessionContinue::Refused`,
   and `ModelProfile::MissingModel` for `invalid_model` (no model there, or `--model`'s host unknown there: "could not
   start a session: …", exit 1, as here).

data/docs/internals/working-set.md

@@ -103,7 +103,7 @@ pending: [Steering: add and unadd](#steering-add-and-unadd)) (`Engine#emit_worki
 - after each `:generation_started`, in `build_stream_event_handler` (`EventFanout`), from the running turn's
   conversation (`Engine#live_conversation`, read on the turn's thread) under the turn's strategy
   (`TurnContext#settings`' `llm_context`; `EventFanout#working_set_llm_context`: the running turn's, the last turn's
-  until it has its own). Both loops start a generation after `apply_llm_context!`, so the set is
+  until it has its own). Both loops start a generation after `LLMContextApply.apply!`, so the set is
   what that request sends;
 - once in `Engine#end_turn`, after `replace_session_messages` and before the end event, from the kept messages (the
   turn-end apply has run by then);

data/docs/sessions.md

@@ -23,7 +23,7 @@ Sessions are plain files — no DB. Each session is `~/.local/state/samagotchi/s
 
 A session is deleted if **expired by age OR overflow by count** (unless `keep_status` or the live-owner guard: a session a worker or `chi` still has open is never pruned). A session's `status` is its turn state (`idle`/`running`), not whether a worker is alive. Orphan dirs without a `*.json` are never deleted, except skeleton-only ones (see *Empty sessions*). Deletion removes both `*.json` and sidecar dir atomically. Set both `DAYS=0` and `MAX=0` to retain forever.
 
-**Worker idle exit:** a background worker (plain `chi`, Web UI sessions) exits after `SAMAGOTCHI_SESSION_IDLE_EXIT_MINUTES` (`session.idle_exit_minutes`, default `30`, `0`=never) with no turn running or queued, no client on its stream (an open web tab or attached terminal keeps it), no reminder registered, no background task it watches for a [finish wake](internals/background-tasks.md#finish-wake) still running or waiting for its wake turn (with `session.task_wakes: wake`; not one whose turn you stopped) and no continue offer (the step-limit question) waiting for an answer. It removes `bridge.json` and frees `owner.lock`; the next prompt or `--attach` wakes a new worker (`WorkerIdleExit`, `SessionManager.run_session_loop`). As its Bridge stops, the worker marks the lock leaving (`OwnerLock#mark_leaving`: `leaving_at`, and `leave_wait`, its `recap.timeout`), since it keeps the lock while it writes the recap on leave: an `--attach` or `--resume` meanwhile (here, or a remote one through chi web's wake) prints `(waiting for the session to finish its recap…)` (`LaunchMode::RECAP_WAIT`) and waits for the release, up to that budget plus `OwnerLock::LEAVE_MARGIN` (5 s), before starting the new worker (`OwnerLock.await_release`). A lock held by a worker that isn't leaving (a live one, a stuck one) is left as before. A client can also ask the worker to exit right away (Bridge `POST /session/:id/exit`; `/exit` in an attached terminal does, `/detach` doesn't): the same rules apply without the timeout (even with `0`), and the asker's own stream doesn't count. The reply names what keeps it up (for background tasks, which ones and how to stop them). When every hold is one the user can stop — reminders, a watched task still running, a delegate with a live worker — the 409 also carries `holds: [{kind:, items: [{id:, label:, detail:}]}]` (a reminder's detail is its schedule, `every 20m`/`every 1h`, `, due now` when it is already due), and an attached terminal asks what to do with them; its "stop them and exit" posts `{"stop": "all"}`, which clears the reminders, stops those tasks (`TaskRuntime.stop_task`, as `task_stop`) and stops those children (`SessionManager.stop_session`) before leaving, re-checking first that nothing the user can't stop appeared meanwhile (`HoldStop`). A delegate counts only for that ask: it never holds the idle exit, and an exit that deletes or archives the session does not ask about it. The session's status stays as it was, not `stopped`. With `"restart": true` (a worker whose sidecar lists the `restart` feature) the worker hands the session to a new worker on the newest chi installed: it leaves, then starts its successor once its lock is free, keeping even an empty session and writing no recap. Clients' streams don't hold a restart (a web tab and an attached terminal reconnect to the new worker); what would be lost does: a turn running or queued, a continue offer, a question or approval waiting, a `/btw` (or another anytime command) still running, a delegate's approval relay open or settled in the last 10 minutes, and background tasks this conversation started that still run (`WorkerIdleExit#hold_for_restart`; 409 `held` with `reason`). Reminders go along: as it leaves, the worker writes them to `<id>/reminders.json` (0600: `session_id`, `written_at`, and each reminder's id, name, description, interval and next fire as wall-clock time; `ReminderCarry`), and its successor reads and deletes the file as it starts, before its idle scheduler runs. A restored reminder keeps its id and schedule; one that came due meanwhile fires once at once, and one further ahead than its interval (a clock that jumped) is due one interval from now. The file counts only for the same session within 2 minutes of `written_at`, and not once the session is stopped: otherwise it is deleted unread (log `reminders_carry_dropped`, at warn unless the session was stopped). A stop that lands while the worker leaves for a restart wins: the worker writes no file, and no successor starts (`SessionManager.run_session_loop`, log `restart_dropped`); an archive deletes the file of each session it archives. Once an exit or restart is taken (claimed before a stop-all stops anything), the first one decides how the worker leaves: a later request of the same kind is answered as that exit, one of another kind (a stop-all from another terminal after a restart, chi web's "Restart workers" after a `/exit`) gets 409 `held` with `reason` `leaving_exit`, `leaving_delete` or `leaving_restart`, and a restart says it was refused rather than "restarted". A write that fails keeps the worker up with its reminders (log `reminders_carry_failed`), and the caller reports no new worker. A reminder already due when the restart is asked runs its turn first, so the restart's wait (10 s) may report no new worker yet though the hand-off follows. A worker from before this still refuses a restart for its reminders (409 `reminders`). Only an asked restart carries them: the fallback's TERM (a worker that can't be asked, below), a stop, an idle exit (which reminders hold anyway) and a crash drop them as before. What lives only in the worker's memory goes: the event history a late client replays, the kept `/btw` answers, a plugin's in-memory state.
+**Worker idle exit:** a background worker (plain `chi`, Web UI sessions) exits after `SAMAGOTCHI_SESSION_IDLE_EXIT_MINUTES` (`session.idle_exit_minutes`, default `30`, `0`=never) with no turn running or queued, no client on its stream (an open web tab or attached terminal keeps it), no reminder registered, no background task it watches for a [finish wake](internals/background-tasks.md#finish-wake) still running or waiting for its wake turn (with `session.task_wakes: wake`; not one whose turn you stopped) and no continue offer (the step-limit question) waiting for an answer. It removes `bridge.json` and frees `owner.lock`; the next prompt or `--attach` wakes a new worker (`WorkerIdleExit`, `WorkerBoot.run_session_loop`). As its Bridge stops, the worker marks the lock leaving (`OwnerLock#mark_leaving`: `leaving_at`, and `leave_wait`, its `recap.timeout`), since it keeps the lock while it writes the recap on leave: an `--attach` or `--resume` meanwhile (here, or a remote one through chi web's wake) prints `(waiting for the session to finish its recap…)` (`LaunchMode::RECAP_WAIT`) and waits for the release, up to that budget plus `OwnerLock::LEAVE_MARGIN` (5 s), before starting the new worker (`OwnerLock.await_release`). A lock held by a worker that isn't leaving (a live one, a stuck one) is left as before. A client can also ask the worker to exit right away (Bridge `POST /session/:id/exit`; `/exit` in an attached terminal does, `/detach` doesn't): the same rules apply without the timeout (even with `0`), and the asker's own stream doesn't count. The reply names what keeps it up (for background tasks, which ones and how to stop them). When every hold is one the user can stop — reminders, a watched task still running, a delegate with a live worker — the 409 also carries `holds: [{kind:, items: [{id:, label:, detail:}]}]` (a reminder's detail is its schedule, `every 20m`/`every 1h`, `, due now` when it is already due), and an attached terminal asks what to do with them; its "stop them and exit" posts `{"stop": "all"}`, which clears the reminders, stops those tasks (`TaskRuntime.stop_task`, as `task_stop`) and stops those children (`SessionManager.stop_session`) before leaving, re-checking first that nothing the user can't stop appeared meanwhile (`HoldStop`). A delegate counts only for that ask: it never holds the idle exit, and an exit that deletes or archives the session does not ask about it. The session's status stays as it was, not `stopped`. With `"restart": true` (a worker whose sidecar lists the `restart` feature) the worker hands the session to a new worker on the newest chi installed: it leaves, then starts its successor once its lock is free, keeping even an empty session and writing no recap. Clients' streams don't hold a restart (a web tab and an attached terminal reconnect to the new worker); what would be lost does: a turn running or queued, a continue offer, a question or approval waiting, a `/btw` (or another anytime command) still running, a delegate's approval relay open or settled in the last 10 minutes, and background tasks this conversation started that still run (`WorkerIdleExit#hold_for_restart`; 409 `held` with `reason`). Reminders go along: as it leaves, the worker writes them to `<id>/reminders.json` (0600: `session_id`, `written_at`, and each reminder's id, name, description, interval and next fire as wall-clock time; `ReminderCarry`), and its successor reads and deletes the file as it starts, before its idle scheduler runs. A restored reminder keeps its id and schedule; one that came due meanwhile fires once at once, and one further ahead than its interval (a clock that jumped) is due one interval from now. The file counts only for the same session within 2 minutes of `written_at`, and not once the session is stopped: otherwise it is deleted unread (log `reminders_carry_dropped`, at warn unless the session was stopped). A stop that lands while the worker leaves for a restart wins: the worker writes no file, and no successor starts (`WorkerBoot.run_session_loop`, log `restart_dropped`); an archive deletes the file of each session it archives. Once an exit or restart is taken (claimed before a stop-all stops anything), the first one decides how the worker leaves: a later request of the same kind is answered as that exit, one of another kind (a stop-all from another terminal after a restart, chi web's "Restart workers" after a `/exit`) gets 409 `held` with `reason` `leaving_exit`, `leaving_delete` or `leaving_restart`, and a restart says it was refused rather than "restarted". A write that fails keeps the worker up with its reminders (log `reminders_carry_failed`), and the caller reports no new worker. A reminder already due when the restart is asked runs its turn first, so the restart's wait (10 s) may report no new worker yet though the hand-off follows. A worker from before this still refuses a restart for its reminders (409 `reminders`). Only an asked restart carries them: the fallback's TERM (a worker that can't be asked, below), a stop, an idle exit (which reminders hold anyway) and a crash drop them as before. What lives only in the worker's memory goes: the event history a late client replays, the kept `/btw` answers, a plugin's in-memory state.
 
 **Empty sessions:** a session nothing happened in is deleted when it is left, so `chi` → `/exit` leaves no trace. Empty means: no messages, no turn tried (a failed turn leaves a `last_prompt` and keeps it), no memory used, no pending question, nothing in `input/`, `notes/` or `images/`, nothing in its dir beyond the worker's skeleton, mode `assist`, and the default model. A session on another model (`/model`, `--model`) counts as prepared and stays (`SessionManager.discardable?`). The worker checks as it idle-exits or leaves on a client's request and deletes it once its lock is free, checking again first. The attached `/exit` then says `Detached; the session is empty: it will be discarded if nothing arrives before its worker stops.` (a note or prompt landing first keeps it). The retention sweep catches those killed first: empty sessions over an hour old with no live owner, whatever `DAYS`/`MAX`, and skeleton-only dirs with no `*.json`. `session.keep_empty: true` (env `SAMAGOTCHI_SESSION_KEEP_EMPTY`) turns all of it off.
 
@@ -345,7 +345,7 @@ The title names the session wherever its first message did: `chi sessions list`
 
 A session can **continue** an earlier one: "the next run of the same routine" (a daily coordinator, say, continued once a day or several times). The new session's `continues` field names the previous link; the chain is derived from it, never stored: follow `continues` back for the earlier links, forward for the later ones. It is not a parent: archiving one link leaves the next alone, and lists fold delegates, not links. A link is continued at most once, so a chain has no forks and its latest link is the one nobody continues.
 
-`SessionManager.continue_session` makes the next link:
+`SessionContinue.run` makes the next link:
 
 - **What it copies:** the previous link's folder, its model (the name it was typed as, so an alias holds) unless the continue names one (`--model`, the web's `model`), and its own LLM context values. A model given is checked like a new session's (a host config.yml doesn't have refuses the continue, nothing archived). An inherited model whose host can't run it any more (gone from config.yml, `enabled: false`, an alias naming another host) **falls back to the default model** with a warning, `gone:org/model can't run (unknown host 'gone' in model …); started on <default>`, decided before the archive; with no default model configured the continue is refused. The carry note doesn't mention the model. The new link carries no transcript beyond the note's last answer, so a different model, or another provider, starts clean there. Its preview is the previous link's (until its first message is saved), unless it starts with a message. Its title (`/title`) is the previous link's, with or without a first message.
 - **The carry note:** the new link starts with a context note from `session chain` (shown in its transcript as `note from session chain`), queued before its worker spawns, so its first turn sees it: `This session continues 3fa2c1d0 (2026-10-08 09:12), the previous link of its chain. Its recap, as of 2026-10-08 18:02:` and the previous link's recap (`recap.json`; cut at 8000 characters). No recap (fewer user turns than a recap needs, recaps off, none written in time): `… It left no recap.` Then `Its last answer:` and the previous link's last answer, read after the recap wait, so its exact shas, paths and next steps survive: a longer one keeps its last 4000 characters, after a `…` (a wrap-up closes on what comes next). There is none when the newest bubble was a step that asked for tools, when a later turn failed or was cut before it answered, and on a review link (a continue doesn't copy the grants, so the next link's participants could differ); `session.carry_last_answer: false` leaves it out of every note. No other transcript. The note never makes a continue fail: it stays within the 16 KiB a note may hold, the answer taking what the head and recap leave, and a session file that can't be read gives no answer. An idle new link holding only the note is kept, not discarded as empty.

data/docs/system-one.md

@@ -10,8 +10,9 @@ was sent and what came of it. The runs don't leave the machine; a hosted System
 ## The common layer
 
 `SystemOne::Client` asks. `SystemOne::Recording` wraps it where a use builds its
-client (`Engine#system_one_recording`): the same duck type, the same answers and
-the same raises. A cancelled ask saves its run, then raises; a run that can't be saved is
+client (`SystemOne::Recorder#wrap`, over the recorder `Engine#system_one_recorder` builds
+for each call: the Engine's runs and its model then; `Engine#system_one_recording` for the
+guardrails): the same duck type, the same answers and the same raises. A cancelled ask saves its run, then raises; a run that can't be saved is
 one warn and never changes the answer. A use that needs the run's id at once passes it
 (`client.ask(..., run_id: id)`); one client serves several threads.
 

data/lib/samagotchi/bootstrap/config_writer.rb

@@ -304,7 +304,7 @@ module Samagotchi
 
       def written_ok?(real, expected, name)
         parse(File.read(real)) == expected &&
-          ConfigFile.hosts_config(env: @env, path: real).key?(name.downcase)
+          HostConfig.all(env: @env, path: real).key?(name.downcase)
       rescue StandardError
         false
       end

data/lib/samagotchi/broadcast_command.rb

@@ -348,11 +348,11 @@ module Samagotchi
     # The full id +given+ names (an id or the start of one), or nil after
     # saying why there is none.
     def resolve_session(given)
-      id = Session.resolve_id(given, state_dir: @state_dir)
-      Session.load(id, state_dir: @state_dir) # raises ArgumentError when there is no such session
+      id = Session.resolve!(given, state_dir: @state_dir)
+      Session.load(id, state_dir: @state_dir) # a file that won't load is refused here too
       id
     rescue ArgumentError => e
-      error_line("chi broadcast: #{e.is_a?(Session::AmbiguousId) ? e.message : "no session #{given}"}")
+      error_line("chi broadcast: #{e.message}")
       nil
     rescue SystemCallError => e
       error_line("chi broadcast: session #{given} can't be read: #{e.message}")

data/lib/samagotchi/bundle_command/try/sandbox.rb

@@ -130,7 +130,7 @@ module Samagotchi
 
         # Stops what the run started that outlives its child chi: the
         # workers of its delegates (they leave the child's process tree,
-        # SessionManager.detach_from_spawner) and its tasks (a group of
+        # WorkerBoot.detach_from_spawner) and its tasks (a group of
         # their own each, reparented once the child exits). Found by their
         # records in the sandbox, so nothing outside it: a session's lock
         # held by a group leader, a running task's record whose pid still

data/lib/samagotchi/bundles/system/config_modification_protocol.md

@@ -55,8 +55,8 @@ Only the nested form is read. An env name used as a top-level key (`SAMAGOTCHI_D
 **Excluded maps** (YAML-only, not part of the flat registry; skipped by scalar loader):
 
 - `model_aliases:` map of alias → model id (`ModelRef.parse`, through `HostRegistry#resolve`). Keys lowercased on write (`ConfigFile.write_model_alias!`). Values may be bare `model` or qualified `host:model` (hybrid; only `:` names a host, `org/model` is an id). Aliases apply once: never point an alias at another alias.
-- `hosts:` map of `name → {host, port | url, api, api_key_env, auth, dialect, profile, first_token_timeout, vision, sampling, thinking, enabled, models}` (`ConfigFile.hosts_config`, `host_registry.rb` `HostEntry`). Names lowercased; `url:` (http/https, optional path) replaces host/port, never both; `api_key_env:` names the env var holding the API key (never write a key into config.yml); `auth:` (`bearer|x-api-key`) is the header the key goes in (default `x-api-key` on `api: anthropic`, Bearer elsewhere); `dialect:` (`fireworks`, or `standard` for the default; `api: anthropic` only) adjusts the Messages wire for that provider (Bearer by default, no thinking `display`, no `cache_control`, `x-session-affinity`; `LLM::Dialect`, docs/configuration.md "Anthropic Messages hosts"); `first_token_timeout` (seconds, `0` = off; a negative or non-number warns and is ignored) overrides `server.first_token_timeout` for that host; `models:` (a map of model ids, or a plain list) declares ids the host serves whatever its `/v1/models` lists: no "doesn't list" warning, and a bare id routes there as if listed (`HostModel`); an entry may hold `price: {input, output, cache_read?, cache_write?}` in USD per 1M tokens (`ModelPrice`; an unset cache rate is the input rate), which estimates a cost the provider doesn't report or reports as 0 (`cost_estimate`, shown as `~$`), and `served: [ids] | any`, the models a gateway may answer that id with (no served-model warning for them); model settings stay in the root `models:`; a worker reads `hosts:` from the file as it starts (no environment variable sets hosts).
-- `models:` map of model id or alias → `{profile, vision, sampling, thinking, reasoning_history}` (`ConfigFile.model_settings`). `thinking:` (here, on a host, or `thinking.level` for every model) is `off|low|medium|high|default` (`Thinking`; unquoted `off` works, `on` is not a level; `default` = send nothing). Precedence: the session's own level (`/thinking LEVEL`, saved in the session; `chi --thinking` on a session run, `chi send --new --thinking`) > `chi web --thinking`/`SAMAGOTCHI_THINKING_LEVEL` > `models:` > `hosts.<name>.thinking` > `thinking.level` in config.yml > `default`. A `sampling:` key wins over the fields a level sends (`null` drops one); `docs/configuration.md` "Thinking". `reasoning_history:` (here or on a host) is `drop|turn|all`, which of its reasoning a chat host's model gets back. Precedence: the session's own level (`/reasoning-history LEVEL`, saved in the session) > `SAMAGOTCHI_REASONING_HISTORY` > `models:` > `hosts.<name>.reasoning_history` > `turn`; `docs/configuration.md` "Reasoning history". `/thinking` and `/reasoning-history` ask before a change that restarts the prompt cache; `--yes` applies it (`chi send` commands apply directly). `sampling:` (here or on a host) is a map of request fields passed to the provider as written (`temperature`, `top_p`, `presence_penalty`, `repeat_penalty`, …; a model's fields win over its host's per field; `null` = don't send; chi's own fields like `max_tokens`/`stream` are refused with a warning; `docs/configuration.md` "Sampling"). Keys match case-insensitively. `profile` (here or on a host) is `qwen36|gemma4`: the raw prompt format for native hosts. Precedence: `--profile`/`SAMAGOTCHI_MODEL_PROFILE` > `models:` > `hosts.<name>.profile` > the llama.cpp server's chat template > the name (`qwen`/`gemma`) > `qwen36` (`ModelProfile.resolve`). Set one when a model's name hides its family (e.g. a Qwen fine-tune under another name whose server publishes no template).
+- `hosts:` map of `name → {host, port | url, api, api_key_env, auth, dialect, profile, first_token_timeout, vision, sampling, thinking, enabled, models}` (`HostConfig.all`, `host_registry.rb` `HostEntry`). Names lowercased; `url:` (http/https, optional path) replaces host/port, never both; `api_key_env:` names the env var holding the API key (never write a key into config.yml); `auth:` (`bearer|x-api-key`) is the header the key goes in (default `x-api-key` on `api: anthropic`, Bearer elsewhere); `dialect:` (`fireworks`, or `standard` for the default; `api: anthropic` only) adjusts the Messages wire for that provider (Bearer by default, no thinking `display`, no `cache_control`, `x-session-affinity`; `LLM::Dialect`, docs/configuration.md "Anthropic Messages hosts"); `first_token_timeout` (seconds, `0` = off; a negative or non-number warns and is ignored) overrides `server.first_token_timeout` for that host; `models:` (a map of model ids, or a plain list) declares ids the host serves whatever its `/v1/models` lists: no "doesn't list" warning, and a bare id routes there as if listed (`HostModel`); an entry may hold `price: {input, output, cache_read?, cache_write?}` in USD per 1M tokens (`ModelPrice`; an unset cache rate is the input rate), which estimates a cost the provider doesn't report or reports as 0 (`cost_estimate`, shown as `~$`), and `served: [ids] | any`, the models a gateway may answer that id with (no served-model warning for them); model settings stay in the root `models:`; a worker reads `hosts:` from the file as it starts (no environment variable sets hosts).
+- `models:` map of model id or alias → `{profile, vision, sampling, thinking, reasoning_history}` (`ModelSettings.all`). `thinking:` (here, on a host, or `thinking.level` for every model) is `off|low|medium|high|default` (`Thinking`; unquoted `off` works, `on` is not a level; `default` = send nothing). Precedence: the session's own level (`/thinking LEVEL`, saved in the session; `chi --thinking` on a session run, `chi send --new --thinking`) > `chi web --thinking`/`SAMAGOTCHI_THINKING_LEVEL` > `models:` > `hosts.<name>.thinking` > `thinking.level` in config.yml > `default`. A `sampling:` key wins over the fields a level sends (`null` drops one); `docs/configuration.md` "Thinking". `reasoning_history:` (here or on a host) is `drop|turn|all`, which of its reasoning a chat host's model gets back. Precedence: the session's own level (`/reasoning-history LEVEL`, saved in the session) > `SAMAGOTCHI_REASONING_HISTORY` > `models:` > `hosts.<name>.reasoning_history` > `turn`; `docs/configuration.md` "Reasoning history". `/thinking` and `/reasoning-history` ask before a change that restarts the prompt cache; `--yes` applies it (`chi send` commands apply directly). `sampling:` (here or on a host) is a map of request fields passed to the provider as written (`temperature`, `top_p`, `presence_penalty`, `repeat_penalty`, …; a model's fields win over its host's per field; `null` = don't send; chi's own fields like `max_tokens`/`stream` are refused with a warning; `docs/configuration.md` "Sampling"). Keys match case-insensitively. `profile` (here or on a host) is `qwen36|gemma4`: the raw prompt format for native hosts. Precedence: `--profile`/`SAMAGOTCHI_MODEL_PROFILE` > `models:` > `hosts.<name>.profile` > the llama.cpp server's chat template > the name (`qwen`/`gemma`) > `qwen36` (`ModelProfile.resolve`). Set one when a model's name hides its family (e.g. a Qwen fine-tune under another name whose server publishes no template).
 - `hooks:` map of `hooks_dir` + per-event lists `{path, on_error}` (`Hooks::Loader.load`). `hooks_dir` may start with `~`.
 - `guardrails:` tool-call rules (`docs/guardrails.md`; read in `Engine#guardrail_rules`, parsed by `Guardrails::Rules.parse`): `enabled` (bool, default true; `false` drops rules and hooks' asks, a deny still applies; config.yml only, like every `guardrails` setting: no env variable), `parent_answers` (`soft`, the default: a parent agent's `chi answer` may deny, answer, Continue and give "Allow once"; `standard`: no allow; `hard`: deny, Stop and plain answers only; never a wider scope; replaces `parent_approvals` and `turn.parent_continue`; a convention for an honest parent, not a security boundary, and the user's choice: set it only when the user asks), `rules:` (list), `disable:` (a rule id or a list of them, `id` or `bundle:id`, switching off a bundle's or config rule without editing it), `small_models` (`auto`, the default: small = 32B or less read from the name; a glob or list of globs; `[]` for none). A rule takes only `id`, `tool`, `command`, `path`, `git`, `models`, `verdict`, `reason`, `scopes`: `id` required; at least one of `tool` (a name, `shell` = execute + task_create, a `File.fnmatch` glob like `"mcp_*"`, or a list), `command` (a Ruby regex on the shell command), `path` (a glob, or `outside_repo`: outside the session's repo, tmp folders and memory files excepted), `git` (only `outside_repo`: a shell call runs commit/add/reset/… in another checkout); `models` (optional: `small`, a model-name glob, or a list; without it the rule is for every model); `verdict` `ask|deny`; `scopes` (for `ask`) a subset of `once, session, repo, rule`. **Any parse error (an unknown key, a bad regex, no verdict) makes chi deny every tool call** until fixed, so validate with `YAML.safe_load` and keep the list shape. Rules are read again on the next tool call after config.yml or a bundle's rules change: no restart needed. Installed bundles' rule files (`chi bundle install guardrails`) add to them; `/guardrails` lists what loaded.
 

data/lib/samagotchi/bundles/system/manifest.yml

@@ -1,11 +1,11 @@
 ---
 name: samagotchi-system
-version: 0.155.0
+version: 0.156.0
 scope: system
 description: Default system memories — identity, self map, config modification protocol, memory guide and the delegated-session rules
 files:
   identity.md: sha256:29c2f7df9f6c5acbc5ec17000a4490741e55e426af15ca0d81c8706edd9bd027
   self_map.md: sha256:709bd52710bf6c50334a89a10742ea1554c5985cc2d7c4e7571e526cc4479526
-  config_modification_protocol.md: sha256:f3f6545c93d59b624a2bf1766e26059520ffc7b236470dd9f1b51ab77312376d
+  config_modification_protocol.md: sha256:25ed2d4901f00eeea226db5eb2b75a05d6cdee4015ac8daa4bed624f745c3922
   memory_guide.md: sha256:8b7727b939b9c04486ca59859561023dcc319a73e0f5b47b3fcf5741edaa69e2
   delegated.md: sha256:a0d6ddcd4a8be06526d964898611775fd251cfd9d145a9d16afaccaa503597bd

data/lib/samagotchi/child_move.rb

@@ -18,27 +18,22 @@ module Samagotchi
   autoload :SessionContinue, File.expand_path("session_continue", __dir__)
 
   # A continue moving the previous link's open delegates to the chain's new
-  # link (SessionManager.continue_session), instead of archiving them with
+  # link (SessionContinue.run), instead of archiving them with
   # it. A moved child gets a parent override (Session::PARENT_FILE), never a
   # rewritten session file, so its live worker saving a stale copy changes
   # nothing; its worker reads the override for its rings and at each turn's
   # start (Bridge::FEATURES "reparent").
   #
   # #apply runs between the new link's save and its worker's spawn, while
-  # the link is #mark_starting (a ring from a moved child must not spawn a
-  # second worker from the child's process until the link's own holds it).
-  # Each step is idempotent,
-  # and an intent file (INTENT_FILE) in the new link's folder names the move
-  # until it is done: a worker that starts and finds one finishes the move
-  # (#adopt), and a failed continue moves the same children back.
+  # the link is marked starting (StartingMarker): a ring from a moved child
+  # must not spawn a second worker from the child's process until the link's
+  # own holds it. Each step is idempotent, and an intent file (INTENT_FILE)
+  # in the new link's folder names the move until it is done: a worker that
+  # starts and finds one finishes the move (#adopt), and a failed continue
+  # moves the same children back.
   module ChildMove
     # <new link dir>/move.json: {from, ids, noted}, while a move is under way.
     INTENT_FILE = "move.json"
-    # <new link dir>/starting: {pid, at}, from the move to the worker's spawn.
-    STARTING_FILE = "starting"
-    # A starting marker older than this, or whose process is gone, is left
-    # over from a continue that died: it holds nothing back.
-    STARTING_STALE = 60.0
     # Who the note to a moved child is from (ContextNote's label).
     NOTE_SOURCE = "session chain"
     # What a live child's worker must name in its sidecar to be moved.
@@ -206,44 +201,5 @@ module Samagotchi
              end
       SessionInbox.write_note(child_id, text: text, source: NOTE_SOURCE, state_dir: state_dir)
     end
-
-    # Hold off a worker for the continue's new link (#starting?) until its
-    # own worker holds it: written before the move, removed by that worker
-    # once it has the owner lock (Worker#start).
-    def mark_starting(session_id, state_dir:)
-      dir = Session.session_dir(session_id, state_dir: state_dir)
-      FileUtils.mkdir_p(dir)
-      AtomicFile.write(File.join(dir, STARTING_FILE), JSON.generate({ "pid" => Process.pid, "at" => Time.now.iso8601(3) }))
-    end
-
-    def clear_starting(session_id, state_dir:)
-      FileUtils.rm_f(File.join(Session.session_dir(session_id, state_dir: state_dir), STARTING_FILE))
-    end
-
-    # Whether a continue is moving delegates to +session_id+ right now: its
-    # marker is there, fresh, and the process that wrote it runs.
-    def starting?(session_id, state_dir:)
-      file = File.join(Session.session_dir(session_id, state_dir: state_dir), STARTING_FILE)
-      return false unless File.exist?(file)
-
-      data = JSON.parse(File.read(file))
-      return false if Time.now - Time.iso8601(data["at"].to_s) > STARTING_STALE
-
-      process_alive?(data["pid"].to_i)
-    rescue JSON::ParserError, ArgumentError, SystemCallError
-      false
-    end
-
-    # Signal 0 only asks whether the process exists.
-    def process_alive?(pid)
-      return false unless pid.positive?
-
-      Process.kill(0, pid)
-      true
-    rescue Errno::ESRCH
-      false
-    rescue Errno::EPERM
-      true
-    end
   end
 end

data/lib/samagotchi/children_status.rb

@@ -113,7 +113,7 @@ module Samagotchi
     # session counts loaded itself.
     def summary_of(session, state_dir:)
       live = WorkerLink.resolve(Session.session_dir(session.id, state_dir: state_dir), unlink: false).worker_owned?
-      { live: live, busy: live && session.status == Session::STATUS_RUNNING, status: session.status,
+      { live: live, busy: live && session.status == Session::STATUS_RUNNING, saved_status: session.status,
         updated_at: session.updated_at, waiting: session.waiting_question(live: live)&.dig(:kind),
         preview: session.last_prompt.to_s }
     end

data/lib/samagotchi/cli/parent_wait.rb

@@ -55,7 +55,7 @@ module Samagotchi
       def resolve(given)
         @session_id = @access.resolve(given)
       rescue ArgumentError => e
-        error_line("#{command_name}: #{e.is_a?(Session::AmbiguousId) ? e.message : "no session #{given}"}")
+        error_line("#{command_name}: #{e.message}")
         nil
       end
 

data/lib/samagotchi/config.rb

@@ -8,11 +8,14 @@ require_relative "config_text_edit"
 require_relative "log"
 require_relative "model_ref"
 require_relative "paths"
-require_relative "llm_context_strategy"
-require_relative "host_model"
 require_relative "config/restart_watch"
 
 module Samagotchi
+  # Which LLM context strategy a turn runs under; it reads Config.
+  autoload :LLMContextStrategy, File.expand_path("llm_context_strategy", __dir__)
+  # A hosts.<name>.models entry and its price; they read ConfigFile.
+  autoload :HostModel, File.expand_path("host_model", __dir__)
+  autoload :ModelPrice, File.expand_path("model_price", __dir__)
   # Parses the thinking: levels of host and model entries (it needs Config).
   autoload :Thinking, File.expand_path("thinking", __dir__)
   # One hosts: entry; it needs ConfigFile's readers.
@@ -89,6 +92,12 @@ module Samagotchi
       next_history_access next_matching_turn_display_poll_write
     ].freeze
 
+    # llm_context.policy's default: the sentence forget_outputs' description
+    # carries (ToolDeclarations::FORGET_OUTPUTS_POLICY), the plan's D7 line,
+    # adapted from CLM's steering example.
+    DEFAULT_LLM_CONTEXT_POLICY = "Tidy at subtask boundaries: once a subtask is done, forget its tool outputs and note " \
+                                 "what it established; keep anything you'll still edit against."
+
     ENTRIES = [
       # universal – env+config+cli
       Entry.new(key: "default.model",            yaml_path: %w[default model],            type: :string, default: nil,              expose: %i[env config cli], lifecycle: :new_session),
@@ -261,7 +270,7 @@ module Samagotchi
       # and hosts.<name>.llm_context_budget_tokens come first. Kept as written: LLMContextStrategy.parse_budget reads it.
       Entry.new(key: "llm_context.budget_tokens", yaml_path: %w[llm_context budget_tokens], type: :string, default: nil,           expose: %i[env config], lifecycle: :next_matching_turn_display_poll_write),
       # The policy sentence forget_outputs' description carries (the forget layer); blank: none.
-      Entry.new(key: "llm_context.policy",       yaml_path: %w[llm_context policy],       type: :string, default: LLMContextStrategy::DEFAULT_POLICY, expose: %i[env config], lifecycle: :worker_start),
+      Entry.new(key: "llm_context.policy",       yaml_path: %w[llm_context policy],       type: :string, default: DEFAULT_LLM_CONTEXT_POLICY, expose: %i[env config], lifecycle: :worker_start),
 
       # How much models think: off|low|medium|high|default, parsed by Thinking
       # (a :string, since YAML reads an unquoted off as false). The CLI flag
@@ -399,7 +408,7 @@ module Samagotchi
     # appended_prompt_files, Hooks::Loader, ConfigFile.bundle_settings.
     FREE_FORM_MAPS = %w[model_aliases hooks bundles memories append_system_prompt].freeze
     # Maps of named entries and the keys an entry may hold
-    # (ConfigFile.hosts_config, ConfigFile.model_settings).
+    # (HostConfig.all, ModelSettings.all).
     MAP_ENTRY_KEYS = {
       "hosts" => %w[host port url api api_key_env auth dialect profile first_token_timeout vision sampling thinking
                     reasoning_history enabled remote window_tokens steer_cut_after llm_context_strategy llm_context_apply llm_context_budget_tokens models].freeze,
@@ -408,6 +417,8 @@ module Samagotchi
     }.freeze
     # The keys a hosts.<name>.models entry may hold (HostModel.parse_map).
     HOST_MODEL_KEYS = %w[price served].freeze
+    # The keys a hosts.<name>.models.<id>.price may hold (ModelPrice.parse).
+    MODEL_PRICE_KEYS = %w[input cache_read cache_write output].freeze
     # Section keys beyond the registry's: guardrails' YAML rules (Engine#guardrail_rules).
     # And toolkit's kits (Toolkit.kits), and bundles' judgments' settings (SystemOne::JudgmentSettings).
     SECTION_EXTRA_KEYS = { "guardrails" => %w[rules disable].freeze, "toolkit" => %w[kits].freeze, "system_one" => %w[judgments].freeze }.freeze
@@ -887,9 +898,9 @@ module Samagotchi
       def price_key_problems(prefix, price)
         return [] unless price.is_a?(Hash)
 
-        (price.keys.map(&:to_s) - ModelPrice::KEYS).map do |k|
+        (price.keys.map(&:to_s) - MODEL_PRICE_KEYS).map do |k|
           # A renamed key is compared by its new name, so that name is the hint.
-          unknown_key_message("#{prefix}#{k}", RENAMED_PRICE_KEYS.fetch(k, k), ModelPrice::KEYS, prefix: prefix)
+          unknown_key_message("#{prefix}#{k}", RENAMED_PRICE_KEYS.fetch(k, k), MODEL_PRICE_KEYS, prefix: prefix)
         end
       end
 
@@ -1172,71 +1183,6 @@ module Samagotchi
     HOST_NAME_RE = /\A[a-z0-9][a-z0-9._-]*\z/i
     ENV_NAME_RE = /\A[A-Za-z_][A-Za-z0-9_]*\z/
 
-    # config.yml's hosts: by lowercased name; an entry that is disabled or
-    # invalid (warned) is left out. No entry left: "default", from
-    # server.host/port.
-    # @return [Hash{String => HostConfig}]
-    def hosts_config(env: ENV, path: global_path(env: env))
-      data = read_yaml(env: env, path: path)
-      raw_hosts = data[HOSTS_KEY] if data.is_a?(Hash)
-
-      normalized = {}
-      if raw_hosts.is_a?(Hash)
-        raw_hosts.each do |raw_name, raw_cfg|
-          host = HostConfig.parse(raw_name, raw_cfg)
-          normalized[host.name] = host if host
-        end
-        warn_duplicate_host_models(normalized)
-      end
-      normalized["default"] = default_host_config(data, env) if normalized.empty?
-      normalized
-    rescue StandardError => e
-      Log.error(:config, "hosts_config_failed", error: e.class.name, message: e.message)
-      {}
-    end
-
-    # The host chi uses when hosts: names none: server.host/port.
-    def default_host_config(data, env)
-      opts = { file_data: data, env: env, cli_overrides: Samagotchi::Config.cli_overrides }
-      host = Samagotchi::Config.resolve("server.host", **opts).to_s.strip
-      host = "localhost" if host.empty?
-      port = Samagotchi::Config.resolve("server.port", **opts).to_i
-      port = 8080 if port <= 0 || port > 65_535
-      HostConfig.new(name: "default", host: host, port: port)
-    end
-    private_class_method :default_host_config
-
-    # Two hosts declaring one id under hosts.<name>.models: a bare id goes
-    # where HostRegistry#host_for_model sends it (the default host when it
-    # declares the id, else the first in hosts: order); say so once.
-    def warn_duplicate_host_models(hosts)
-      declared = Hash.new { |h, k| h[k] = [] }
-      hosts.each { |name, cfg| cfg.models.each { |down, model| declared[down] << [name, model.id] } }
-      declared.each_value do |owners|
-        next if owners.size < 2
-
-        names = owners.map(&:first)
-        id = owners.first.last
-        goes = names.include?("default") ? "default" : "#{names.first} unless the default host lists it"
-        warn_once "Warning: #{names.map { |n| "hosts.#{n}.models" }.join(" and ")} #{names.size == 2 ? "both" : "all"} declare #{id}; " \
-                  "a bare #{id} goes to #{goes}"
-      end
-    end
-    private_class_method :warn_duplicate_host_models
-
-    # The names (lowercased) of the hosts entries with enabled: false, which
-    # hosts_config leaves out, from config.yml's hosts:.
-    # @return [Array<String>]
-    def disabled_host_names(env: ENV, path: global_path(env: env))
-      data = read_yaml(env: env, path: path)
-      raw = data[HOSTS_KEY] if data.is_a?(Hash)
-      return [] unless raw.is_a?(Hash)
-
-      raw.filter_map { |name, cfg| name.to_s.strip.downcase if cfg.is_a?(Hash) && HostConfig.disabled?(cfg) }
-    rescue StandardError # degrade-ok: Config↔Log: Log resolves its file and level through Config
-      []
-    end
-
     # Resolve the `recap:` section through the Config registry so scalar
     # recap settings share the single precedence path (CLI > ENV > file >
     # default). Returns false when explicitly disabled (file `recap: false`
@@ -1420,47 +1366,6 @@ module Samagotchi
       {}
     end
 
-    # The top-level `models:` map: per-model settings keyed by model id or
-    # alias (downcased), e.g. `models: {my-alias: {profile: qwen36}}`, each a
-    # ModelSettings; an entry that is not a map is skipped.
-    # @return [Hash{String => ModelSettings}]
-    def model_settings(env: ENV, path: global_path(env: env))
-      data = read_yaml(env: env, path: path)
-      raw = data[MODELS_KEY] if data.is_a?(Hash)
-      return {} unless raw.is_a?(Hash)
-
-      raw.each_with_object({}) do |(k, v), result|
-        key = k.to_s.strip.downcase
-        settings = ModelSettings.parse(key, v)
-        result[key] = settings if settings
-      end
-    rescue StandardError # degrade-ok: Config↔Log: Log resolves its file and level through Config
-      {}
-    end
-
-    # The first +names+ (model as typed, alias-resolved, bare, …) whose
-    # models: entry sets +field+ (a ModelSettings member; another name
-    # raises ArgumentError): a ModelSetting (key, value), or nil.
-    # VisionSupport and SamplingSettings look a model up the same way.
-    # @param models [Hash{String => ModelSettings}, nil] model_settings by default
-    # @return [ModelSetting, nil]
-    def model_setting(names, field, models: nil)
-      raise ArgumentError, "unknown models: field #{field.inspect}" unless ModelSettings.members.include?(field)
-
-      models ||= model_settings
-      Array(names).map { |name| name.to_s.strip.downcase }.reject(&:empty?).uniq.each do |key|
-        value = models[key]&.public_send(field)
-        return ModelSetting.new(key: key, value: value) unless value.nil?
-      end
-      nil
-    end
-
-    # +raw+ parsed against config.yml's hosts (or +hosts+) and aliases.
-    # @return [ModelRef]
-    def model_ref(raw, env: ENV, path: global_path(env: env), hosts: nil)
-      ModelRef.parse(raw, hosts: hosts || hosts_config(env: env, path: path), aliases: model_aliases(env: env, path: path))
-    end
-
     # Words /model takes as arguments (clear/default/none/off reset the
     # runtime model), so no alias may be named after one.
     RESERVED_MODEL_ALIASES = %w[clear default none off].freeze

data/lib/samagotchi/context_command.rb

@@ -428,8 +428,7 @@ module Samagotchi
       session = @access.show(id)
       Target.new(session_id: id, project_root: session.project_root, cwd: session.working_directory, label: id[0, 8])
     rescue ArgumentError => e
-      message = e.is_a?(Session::AmbiguousId) ? e.message : "no session #{given}"
-      error_line("#{command_name}: #{message}")
+      error_line("#{command_name}: #{e.message}")
       nil
     end
 

data/lib/samagotchi/context_window.rb

@@ -50,11 +50,11 @@ module Samagotchi
     # and vision look a model up), else hosts.<name>.window_tokens.
     # @param target [HostRegistry::ModelTarget]
     # @param names [Array<String>] HostRegistry#lookup_names
-    # @param models [Hash{String => ModelSettings}, nil] ConfigFile.model_settings (specs)
+    # @param models [Hash{String => ModelSettings}, nil] ModelSettings.all (specs)
     # @return [Resolved, nil]
     def setting(target, names:, models: nil)
-      models ||= ConfigFile.model_settings
-      tokens = ConfigFile.model_setting(names, :window_tokens, models: models)&.value
+      models ||= ModelSettings.all
+      tokens = ModelSettings.find(names, :window_tokens, models: models)&.value
       return Resolved.new(tokens: tokens, source: :model_setting) if positive_integer?(tokens)
 
       tokens = target&.entry&.window_tokens

data/lib/samagotchi/desktop/macos.rb

@@ -335,7 +335,7 @@ module Samagotchi
       # are left out. @return [Array<Hash>] name:, hosts:, state:
       def host_keys
         config_env = { "XDG_CONFIG_HOME" => launch_config_home }
-        hosts = ConfigFile.hosts_config(env: config_env).values.select(&:api_key_env).group_by(&:api_key_env)
+        hosts = HostConfig.all(env: config_env).values.select(&:api_key_env).group_by(&:api_key_env)
         hosts.map do |name, entries|
           state = if HostKeys.from_keychain(name, env: @env) then :keychain
                   elsif !@env[name].to_s.strip.empty? then :shell_only

data/lib/samagotchi/engine/context_judge.rb

@@ -5,7 +5,7 @@ module Samagotchi
     # The attached-context candidate judge (TurnStages::ContextJudge,
     # forwarded): prepare_turn starts its pass, run_turn's ensure shows the
     # cards it held, and a plugin's late candidate asks it. Reads
-    # @context_judge, @side_judgments, @host_registry.
+    # @context_judge, @side_judgments, @host_registry, @turn_state, @session.
     module ContextJudgePart
       private
 
@@ -13,19 +13,27 @@ module Samagotchi
       attr_reader :context_judge
 
       # A late proposal no owner prompt mentions (Plugin::Host
-      # #candidate_proposed): TurnStages::ContextJudge#late_candidates.
-      def judge_late_candidates = @context_judge.late_candidates
+      # #candidate_proposed, maybe while the plugins load, before a session
+      # or the event log is there): TurnStages::ContextJudge#late_candidates
+      # on the session the Engine is on (none, or a review session: nothing,
+      # before anything else is read), the owner's prompts so far, the
+      # recorder and the sessions dir, all read now on the caller's thread.
+      def judge_late_candidates
+        session = @session
+        return if session.nil? || session.review?
 
-      # The stage over this Engine's side asks and its session (built in
+        @context_judge.late_candidates(session, messages: plugin_messages, recorder: system_one_recorder,
+                                                state_dir: session_state_dir)
+      end
+
+      # The stage over this Engine's side asks (built in
       # #build_tools_and_plugins, before the plugins load: one may propose a
-      # candidate as it loads).
+      # candidate as it loads). Its two callables are the asks thread's late
+      # reads: the session the Engine is on and where a card goes, both as
+      # an answer comes.
       def build_context_judge
-        TurnStages::ContextJudge.new(
-          side_judgments: @side_judgments, host_registry: @host_registry, state_dir: -> { session_state_dir },
-          recording: ->(client, judgment, session, mode:) { system_one_recording(client, judgment, session, mode: mode) },
-          session: -> { session }, messages: -> { plugin_messages }, turn_running: -> { turn_running? },
-          show_card: ->(**card) { show_card(**card) }
-        )
+        TurnStages::ContextJudge.new(side_judgments: @side_judgments, host_registry: @host_registry, turn_state: @turn_state,
+                                     show_card: ->(**card) { show_card(**card) }, current_session: -> { @session })
       end
     end
   end

data/lib/samagotchi/engine/messages.rb

@@ -46,7 +46,7 @@ module Samagotchi
                      from_cwd: note[:from_cwd], text: note[:text], context_source: note[:context_source],
                      created_at: note[:created_at], objectives: entry }.compact)
           announce_objectives(session) if entry
-          @objectives_stage.note(session, note)
+          @objectives_stage.note(session, note, recorder: system_one_recorder, state_dir: session_state_dir)
           message
         end
       end