samagotchi 0.156.0 → 0.157.0

data/lib/samagotchi/children_status.rb

@@ -5,7 +5,8 @@ require_relative "session"
 require_relative "archive_store"
 require_relative "git_head"
 require_relative "reply_wait"
-require_relative "worker_link"
+require_relative "owner_lock"
+require_relative "session_row"
 require_relative "tools/delegate"
 require_relative "tools/delegate_cursor"
 
@@ -50,44 +51,47 @@ module Samagotchi
     def of(parent_id, state_dir:, include_archived: false)
       cursors = Tools::DelegateCursors.read(parent_id, state_dir: state_dir)
       SessionManager.children_of(parent_id, state_dir: state_dir).filter_map do |row|
-        next if row[:archived] && !include_archived
+        next if row.archived && !include_archived
 
-        session = load(row[:id], state_dir: state_dir)
+        session = load(row.id, state_dir: state_dir)
         session && child(session, row, cursors, state_dir: state_dir)
       end
     end
 
     # The cheap path for the glance views: only the children in the
-    # parent's delegates.json (one Session.load and an owner check each, no
+    # parent's delegates.json (one Session.load and a SessionRow each, no
     # scan). Its keys can also name a fork the model passed to delegate
     # session: or a deleted child: only live delegates of this parent count,
     # archived ones don't.
     # @return [Counts]
     def counts(parent_id, state_dir:)
       cursors = Tools::DelegateCursors.read(parent_id, state_dir: state_dir)
+      budgets = SessionRow.budgets
       children = cursors.keys.filter_map do |id|
         session = load(id, state_dir: state_dir)
         next unless session&.delegate? && session.parent_id == parent_id
         next if ArchiveStore.archived?(Session.session_dir(id, state_dir: state_dir))
 
-        child(session, summary_of(session, state_dir: state_dir), cursors, state_dir: state_dir)
+        dir = Session.session_dir(id, state_dir: state_dir)
+        child(session, SessionRow.build(session, session_dir: dir, owner: OwnerLock.owner(dir), budgets: budgets), cursors,
+              state_dir: state_dir)
       end
       Counts.new(running: children.count { |c| c.state == "running" },
                  waiting: children.count { |c| c.state == "waiting" },
                  unreported: children.count { |c| c.last_reply && !c.reported })
     end
 
-    # @param row [Hash] a children_of row, or summary_of's keys
+    # @param row [SessionRow] the child's row
     # @param cursors [Hash] the parent's delegates.json
     def child(session, row, cursors, state_dir:)
       reply = ReplyWait.newest_reply(session.id, state_dir: state_dir)
       cursor = Tools::DelegateCursors.get_from(cursors, session.id)
-      Child.new(id: session.id, short_id: session.id[0, 8], title: (session.title || row[:preview]).to_s,
-                state: state_of(session, row, reply), waiting: row[:waiting], live: !!row[:live],
+      Child.new(id: session.id, short_id: session.id[0, 8], title: (session.title || row.preview).to_s,
+                state: state_of(session, row, reply), waiting: row.waiting, live: !!row.live,
                 delegate: session.delegate?, cwd: session.working_directory, branch: GitHead.branch(session.working_directory),
                 last_reply: reply && first_line(session.id, reply, state_dir: state_dir),
                 last_reply_at: reply && reply_time(reply), reported: !reply.nil? && reported?(session, cursor, reply),
-                updated_at: session.updated_at, archived: !!row[:archived])
+                updated_at: session.updated_at, archived: !!row.archived)
     end
     private_class_method :child
 
@@ -97,8 +101,8 @@ module Samagotchi
     private_class_method :reported?
 
     def state_of(session, row, reply)
-      return "waiting" if row[:waiting]
-      return "running" if Tools::Delegate.running?(row)
+      return "waiting" if row.waiting
+      return "running" if row.running_or_starting?
       return "stopped" if session.status == Session::STATUS_STOPPED
 
       outcome = session.last_turn&.outcome
@@ -109,16 +113,6 @@ module Samagotchi
     end
     private_class_method :state_of
 
-    # The keys of a children_of row that state_of and child read, for a
-    # session counts loaded itself.
-    def summary_of(session, state_dir:)
-      live = WorkerLink.resolve(Session.session_dir(session.id, state_dir: state_dir), unlink: false).worker_owned?
-      { live: live, busy: live && session.status == Session::STATUS_RUNNING, saved_status: session.status,
-        updated_at: session.updated_at, waiting: session.waiting_question(live: live)&.dig(:kind),
-        preview: session.last_prompt.to_s }
-    end
-    private_class_method :summary_of
-
     def first_line(id, file, state_dir:)
       text = File.read(File.join(ReplyWait.reply_dir(id, state_dir: state_dir), file), 4096)
       text.each_line.map(&:strip).find { |line| !line.empty? }.to_s

data/lib/samagotchi/cli/parent_wait.rb

@@ -17,9 +17,6 @@ module Samagotchi
     # override the constants (specs stub them on the class).
     module ParentWait
       POLL_INTERVAL = ReplyWait::POLL_INTERVAL
-      # No live worker this long while waiting: it died before it could mark
-      # the session (a worker takes well under a second to start).
-      WORKER_GONE_AFTER = 5
       FORMATS = %w[text json].freeze
 
       # @return [Integer] the exit status
@@ -59,26 +56,15 @@ module Samagotchi
         nil
       end
 
-      # Wait for the session's next reply past +cursor+ (ReplyWait) and
-      # report it. Ctrl-C leaves the turn running (130).
-      # @param owner_grace [Numeric, nil] seconds with no live worker before
-      #   it counts as gone; nil waits for whatever wakes one
-      # @param turn [String, nil] the enqueued_id of the turn waited for
-      #   (ReplyWait's turn:): a queued message's, or the turn an answer or
-      #   a --wait with no message is about (ReplyWait.own_turn)
-      # @param queued [Boolean] +turn+ is a queued message's (ReplyWait's
-      #   queued:)
-      # @param ended_before [Boolean] a last_turn that ended before the
-      #   baseline is the answer (ReplyWait's ended_before:) — the
-      #   --wait-with-no-message's settled session
-      # @param report_turn_id [String, nil] the turn id to include in the
-      #   report, even when ReplyWait uses the next-reply path
+      # Wait for what +target+ binds (ReplyWait) and report it. Ctrl-C
+      # leaves the turn running (130).
+      # @param target [ReplyWait::Target] which turn, from the cursor and
+      #   baseline prepare_wait read; its report_turn_id is the turn id the
+      #   report names, even when ReplyWait takes the next reply
       # @return [Integer] the exit status
-      def wait_for_reply(id, cursor:, baseline:, timeout:, owner_grace: self.class::WORKER_GONE_AFTER, turn: nil,
-                         queued: false, ended_before: false, report_turn_id: turn)
-        result = @access.wait_reply(id, cursor: cursor, timeout: timeout, baseline: baseline, owner_grace: owner_grace,
-                                        poll_interval: self.class::POLL_INTERVAL, turn: turn, queued: queued,
-                                        ended_before: ended_before)
+      def wait_for_reply(id, target:, timeout:)
+        report_turn_id = target.report_turn_id
+        result = @access.wait_reply(id, **target.to_h, timeout: timeout, poll_interval: self.class::POLL_INTERVAL)
         result.turn_id = report_turn_id if report_turn_id && !report_turn_id.to_s.empty?
         result.text = result.text&.dup&.force_encoding(Encoding::UTF_8)&.scrub
         @reported = true

data/lib/samagotchi/config.rb

@@ -373,6 +373,9 @@ module Samagotchi
       # The stage view's working set (files, memories and URLs the turn brought into context): a rail in the stage, a
       # footprint under each finished turn and a "set N" chip in place of the mem chip; ?working_set=1|0 overrides it per page load.
       Entry.new(key: "web.working_set",          yaml_path: %w[web working_set],          type: :bool,    default: true,            expose: %i[env config cli], lifecycle: :web_start),
+      # Opt-in: the page checks each finished turn against a reload of it (one full read per turn end) and chi web logs
+      # reload_checked, with reload_mismatch and the kinds that differed (counts only, no content).
+      Entry.new(key: "web.reload_check",         yaml_path: %w[web reload_check],         type: :bool,    default: false,           expose: %i[env config cli], lifecycle: :web_start),
       # Quick replies next to Annotate in the page's selection bubble, "|"-separated (a YAML list works too); "" leaves only Annotate.
       Entry.new(key: "web.annotate_presets",     yaml_path: %w[web annotate_presets],     type: :string, default: "Agreed|Could you please elaborate?", expose: %i[env config cli], lifecycle: :web_start),
       # What a file ref (a tool row's file, a diff line) opens on this machine: a preset (vscode, vscode-insiders, cursor, zed, none) or a URL template with {path} and an optional {line} (Web::Editor).

data/lib/samagotchi/context_sources.rb

@@ -7,6 +7,7 @@ require "time"
 require_relative "atomic_file"
 require_relative "memory_paths"
 require_relative "paths"
+require_relative "session_paths"
 require_relative "session"
 
 module Samagotchi
@@ -617,13 +618,13 @@ module Samagotchi
       nil
     end
 
-    # <state dir>/context; +state_dir+ is the sessions dir (Session.default_state_dir).
+    # <state dir>/context; +state_dir+ is the sessions dir (SessionPaths.default_state_dir).
     def root(state_dir: nil)
-      File.join(File.dirname(state_dir || Session.default_state_dir), DIR)
+      File.join(File.dirname(state_dir || SessionPaths.default_state_dir), DIR)
     end
 
     def session_location(session_id, state_dir: nil)
-      Location.new(scope: "session", dir: File.join(root(state_dir: state_dir), "sessions", Session.check_id!(session_id)),
+      Location.new(scope: "session", dir: File.join(root(state_dir: state_dir), "sessions", SessionPaths.check_id!(session_id)),
                    key: session_id)
     end
 
@@ -669,7 +670,7 @@ module Samagotchi
     # A deleted session's sources, snapshots, subscriptions and markers.
     # @return [Array<String>] the paths removed
     def remove_session(session_id, state_dir: nil)
-      return [] unless Session.valid_id?(session_id.to_s)
+      return [] unless SessionPaths.valid_id?(session_id.to_s)
 
       dir = session_location(session_id, state_dir: state_dir).dir
       return [] unless Dir.exist?(dir)

data/lib/samagotchi/context_window.rb

@@ -11,14 +11,14 @@ module Samagotchi
   #      provider's context_length)
   #   3. models.<key>.window_tokens, else hosts.<name>.window_tokens
   #      (#setting: the most specific wins)
-  #   4. context.window_tokens (CLI, SAMAGOTCHI_CONTEXT_WINDOW_TOKENS or the
-  #      config file)
+  #   4. context.window_tokens (--context-window-tokens,
+  #      SAMAGOTCHI_CONTEXT_WINDOW_TOKENS or the config file)
   #   5. DEFAULT_TOKENS
   # Settings (3 and 4) only fill in when the server and its list report
   # nothing.
   #
-  # Sources: :server, :model_list, :model_setting, :host_setting, :config
-  # (CLI or file), :env, :default.
+  # Sources: :server, :model_list, :model_setting, :host_setting, :cli,
+  # :env, :config (the file), :default.
   module ContextWindow
     DEFAULT_TOKENS = 256_000
 
@@ -48,16 +48,13 @@ module Samagotchi
     # The window config.yml gives this model or its host:
     # models.<key>.window_tokens (by the model's lookup names, as sampling
     # and vision look a model up), else hosts.<name>.window_tokens.
-    # @param target [HostRegistry::ModelTarget]
-    # @param names [Array<String>] HostRegistry#lookup_names
-    # @param models [Hash{String => ModelSettings}, nil] ModelSettings.all (specs)
+    # @param lookup [ModelLookup] the model's layers (EffectiveModel#lookup)
     # @return [Resolved, nil]
-    def setting(target, names:, models: nil)
-      models ||= ModelSettings.all
-      tokens = ModelSettings.find(names, :window_tokens, models: models)&.value
+    def setting(lookup)
+      tokens = lookup.model(:window_tokens)&.value
       return Resolved.new(tokens: tokens, source: :model_setting) if positive_integer?(tokens)
 
-      tokens = target&.entry&.window_tokens
+      tokens = lookup.host(:window_tokens)
       positive_integer?(tokens) ? Resolved.new(tokens: tokens, source: :host_setting) : nil
     rescue StandardError
       nil
@@ -79,7 +76,7 @@ module Samagotchi
       end
       return Resolved.new(tokens: DEFAULT_TOKENS, source: :default) unless positive_integer?(value)
 
-      Resolved.new(tokens: value, source: origin == :env ? :env : :config)
+      Resolved.new(tokens: value, source: { cli: :cli, env: :env }.fetch(origin, :config))
     end
 
     # For callers with no client at hand (tool output guardrails): the last

data/lib/samagotchi/effective_model.rb

@@ -4,6 +4,7 @@ require_relative "host_registry"
 require_relative "log"
 require_relative "context_window"
 require_relative "llm_context_strategy"
+require_relative "model_lookup"
 require_relative "model_profile"
 require_relative "reasoning_history"
 require_relative "sampling_settings"
@@ -22,7 +23,8 @@ module Samagotchi
 
   # The effective model resolved once (HostRegistry#resolve: its host and
   # client, the id sent) with the names its models: entry may be under
-  # (HostRegistry#lookup_names), and its settings read from them. An
+  # (HostRegistry#lookup_names), and its settings read from them through
+  # one ModelLookup (every layer's input, with the registry's env). An
   # immutable snapshot built per read, never kept across reads: config.yml,
   # a model listing (which may move a bare id to another host) and another
   # process's saved lists all change what a resolve gives without any
@@ -32,14 +34,17 @@ module Samagotchi
   # Engine has always given (Unresolved); building one raises as
   # HostRegistry#resolve does (SessionModelSettings#model_setting gives the
   # fallback then).
-  EffectiveModel = Data.define(:registry, :name, :typed, :target, :names) do
+  EffectiveModel = Data.define(:registry, :name, :typed, :target, :names, :lookup) do
     # @param registry [HostRegistry]
     # @param choice [ModelChoice]
+    # @param models [Hash{String => ModelSettings}, nil] one models: map for
+    #   many models (a picker); ModelSettings.all at each read by default
     # @raise what HostRegistry#resolve raises
-    def self.of(registry, choice)
+    def self.of(registry, choice, models: nil)
       target = registry.resolve(choice.name)
-      new(registry: registry, name: choice.name, typed: choice.typed, target: target,
-          names: registry.lookup_names(choice.typed, resolved: choice.name, target: target))
+      names = registry.lookup_names(choice.typed, resolved: choice.name, target: target)
+      new(registry: registry, name: choice.name, typed: choice.typed, target: target, names: names,
+          lookup: ModelLookup.for(target, names: names, models: models, env: registry.env))
     end
 
     # A saved session's model (no worker): its model name, the default when
@@ -50,6 +55,34 @@ module Samagotchi
       of(registry, ModelChoice.new(name: name, typed: session.model_typed || name))
     end
 
+    # A saved session's LLM context strategy, apply rule and budget, each
+    # with where it came from (LLMContextStrategy::Explained#summary), as
+    # its worker would resolve them; nil when they can't be (an unreadable
+    # config, a model that resolves nowhere). From config and the registry
+    # only: no network, no model call. What a session page, a session
+    # list's ctx % and a spawn-time check all read.
+    # @param session [Session, nil]
+    # @param registry [HostRegistry, nil] the hosts to resolve against;
+    #   HostRegistry.current by default
+    # @return [Hash, nil] Explained#summary, symbol keys
+    def self.session_llm_context(session, registry: nil)
+      return nil if session.nil?
+
+      own = session.llm_context
+      of_session(session, registry: registry || HostRegistry.current).llm_context_explained(own&.resolve_args || {})&.summary(own)
+    rescue StandardError # degrade-ok: a saved session's model that resolves nowhere has no budget to show; the readers log their own
+      nil
+    end
+
+    # The budget a saved session's turns run under
+    # (.session_llm_context's :budget_tokens), nil when it is off or can't
+    # be resolved. What a session list's ctx % counts against, so a saved
+    # session's fill reads as the live meter.
+    # @return [Integer, nil]
+    def self.session_budget(session, registry: nil)
+      session_llm_context(session, registry: registry)&.fetch(:budget_tokens, nil)
+    end
+
     def entry = target.entry
     def client = target.client
     def bare = target.bare_model
@@ -63,21 +96,21 @@ module Samagotchi
 
     # The configured request parameters (hosts: and models: sampling).
     def sampling
-      SamplingSettings.for(target, names: names)
+      SamplingSettings.for(lookup)
     rescue StandardError => e
       unresolved(:sampling_unresolved, e, SamplingSettings::EMPTY)
     end
 
     # "temperature=0.6 (hosts.work)", nil when none.
     def sampling_summary
-      SamplingSettings.summary(target, names: names)
+      SamplingSettings.summary(lookup)
     rescue StandardError => e
       unresolved(:sampling_unresolved, e, nil)
     end
 
     # The thinking level (Thinking.resolve), the session's +own+ first.
     def thinking(own:)
-      Thinking.resolve(target, names: names, session: own).first
+      Thinking.resolve(lookup, session: own).first
     rescue StandardError => e
       unresolved(:thinking_unresolved, e, Thinking::DEFAULT)
     end
@@ -85,23 +118,25 @@ module Samagotchi
     # The thinking level with where it came from (SettingExplained), nil
     # when it can't be resolved.
     def thinking_explained(own:)
-      Thinking.explain(target, names: names, session: own)
+      Thinking.explain(lookup, session: own)
     rescue StandardError => e
       unresolved(:thinking_unresolved, e, nil)
     end
 
     # What a thinking level change costs the prompt cache
     # (Thinking.cache_cost); the block gives the prompt profile, asked only
-    # on a native host. Raises.
+    # on a native host; a local chat host's is the one its name says. Raises.
     # @return [Symbol]
     def thinking_cache_cost(&)
-      Thinking.cache_cost(target, profile: entry&.chat? ? nil : yield&.name)
+      return Thinking.cache_cost(target, inferred: ModelProfile.inferred_profile_name(bare)) if entry&.chat?
+
+      Thinking.cache_cost(target, profile: yield&.name)
     end
 
     # The reasoning_history level (ReasoningHistory.resolve), the session's
     # +own+ first.
     def reasoning_history(own:)
-      ReasoningHistory.resolve(target, names: names, session: own).first
+      ReasoningHistory.resolve(lookup, session: own).first
     rescue StandardError => e
       unresolved(:reasoning_history_unresolved, e, ReasoningHistory::DEFAULT)
     end
@@ -112,7 +147,7 @@ module Samagotchi
     def reasoning_history_explained(own:, native: false)
       return nil unless native || entry&.chat?
 
-      ReasoningHistory.explain(target, names: names, session: own)
+      ReasoningHistory.explain(lookup, session: own)
     rescue StandardError => e
       unresolved(:reasoning_history_unresolved, e, nil)
     end
@@ -122,7 +157,7 @@ module Samagotchi
     def reasoning_history_summary(own:)
       return nil unless entry&.chat?
 
-      level, source = ReasoningHistory.resolve(target, names: names, session: own)
+      level, source = ReasoningHistory.resolve(lookup, session: own)
       source ? ReasoningHistory.label(level, source) : nil
     rescue StandardError => e
       unresolved(:reasoning_history_unresolved, e, nil)
@@ -139,7 +174,7 @@ module Samagotchi
     # [seconds, source] a cut waits for thinking (SteerCutAfter.resolve);
     # the global and its name when it can't be resolved.
     def steer_cut_after_explained
-      SteerCutAfter.resolve(target, names: names)
+      SteerCutAfter.resolve(lookup)
     rescue StandardError => e
       unresolved(:steer_cut_after_unresolved, e, [SteerCut.cut_after, "steer.cut_after"])
     end
@@ -148,7 +183,7 @@ module Samagotchi
     # (LLMContextStrategy.explain) under the session's +args+
     # (LLMContextOverride#resolve_args), nil when it can't be resolved.
     def llm_context_explained(args)
-      LLMContextStrategy.explain(target, names: names, **args)
+      LLMContextStrategy.explain(lookup, **args)
     rescue StandardError => e
       unresolved(:llm_context_unresolved, e, nil)
     end
@@ -156,14 +191,14 @@ module Samagotchi
     # The LLM context layers its turns run under; [] when they can't be
     # resolved.
     def llm_context_layers(args)
-      LLMContextStrategy.resolve(target, names: names, **args).active_layers
+      LLMContextStrategy.resolve(lookup, **args).active_layers
     rescue StandardError => e
       unresolved(:llm_context_unresolved, e, [])
     end
 
     # models:/hosts: window_tokens (ContextWindow.setting), nil when unset.
     def window_setting
-      ContextWindow.setting(target, names: names)
+      ContextWindow.setting(lookup)
     rescue StandardError => e
       unresolved(:window_unresolved, e, nil)
     end
@@ -171,7 +206,7 @@ module Samagotchi
     # The window config.yml gives this model or its host
     # (ContextWindow.setting), never asking a server: a session loaded on
     # it (Engine#session=, before a worker's Bridge serves). nil when none.
-    def configured_context_window = ContextWindow.setting(target, names: names)
+    def configured_context_window = ContextWindow.setting(lookup)
 
     # The window as its loop would see it (ChatLoop#context_window: a remote
     # chat host has no /props, only its model list); nil when it can't be
@@ -183,7 +218,7 @@ module Samagotchi
         adapter = registry.adapter_for(entry)
         client = nil if adapter.remote?
       end
-      ContextWindow.resolve(client: client, model: bare, adapter: adapter, setting: ContextWindow.setting(target, names: names))
+      ContextWindow.resolve(client: client, model: bare, adapter: adapter, setting: ContextWindow.setting(lookup))
     rescue StandardError => e
       unresolved(:window_unresolved, e, nil)
     end
@@ -232,7 +267,7 @@ module Samagotchi
 
     # Whether it sees images (VisionSupport.for) under +profile+.
     def vision_support(profile)
-      VisionSupport.for(target, profile: profile, adapter: vision_adapter, names: names)
+      VisionSupport.for(lookup, profile: profile, adapter: vision_adapter)
     end
 
     # A chat host's adapter (what it says of images), nil on a native host.
@@ -246,7 +281,7 @@ module Samagotchi
     # Not cached here. Raises.
     # @return [ModelProfile::Resolution]
     def profile_resolution
-      ModelProfile.resolve(names: names, entry: entry, client: client, bare_model: bare)
+      ModelProfile.resolve(names: names, entry: entry, client: client, bare_model: bare, models: lookup.models)
     end
 
     # See Unresolved.fallback.

data/lib/samagotchi/engine/plugins.rb

@@ -60,7 +60,7 @@ module Samagotchi
           prompt_sections: @prompt_sections,
           prompt_changed: -> { prompt_changed! },
           judgments: @judgments,
-          hook_failed: ->(hook, failed) { @hook_routes.plugin_hook_failed(hook, failed) }
+          hook_failed: ->(hook, failed, effect: :log) { @hook_routes.plugin_hook_failed(hook, failed, effect: effect) }
         )
         # What plugins show while they load (an MCP server that didn't
         # start) waits for the first turn, beside the load warnings: no UI

data/lib/samagotchi/engine/recap.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../recap_place"
+
 module Samagotchi
   class Engine
     # The idle recap (IdleRecap) and the shared idle scheduler: the recap job
@@ -96,9 +98,10 @@ module Samagotchi
         @recap ? @recap.request_now : :off
       end
 
-      # The recap saved with the current session (recap.json), and how many
-      # user turns came after it (0: it is current).
-      # @return [Hash, nil] {text:, covered:, turns_since:, created_at:}
+      # The recap saved with the current session (recap.json), how many
+      # user turns came after it (0: it is current), and the stamp of the
+      # last turn it covers (RecapPlace: where a page puts it; nil, the count).
+      # @return [Hash, nil] {text:, covered:, turns_since:, opening_id:, created_at:}
       def saved_recap
         state = @recap&.state
         return nil unless state
@@ -106,7 +109,8 @@ module Samagotchi
         messages = @session&.messages || []
         covered = state[:covered].to_i
         turns_since = Array(messages).drop(covered).count { |m| Steer.turn_opening?(m) }
-        { text: state[:text], covered: covered, turns_since: turns_since, created_at: state[:created_at] }
+        { text: state[:text], covered: covered, turns_since: turns_since, opening_id: RecapPlace.opening_id(messages, covered),
+          created_at: state[:created_at] }
       end
 
       # Start the shared idle scheduler (reminders + optional recap). The recap

data/lib/samagotchi/engine.rb

@@ -230,7 +230,9 @@ module Samagotchi
       @chat_backend_mutex = Mutex.new
       @side_judgments = SideJudgments.new
       @judgments = build_judgments
-      @host_registry = host_registry || HostRegistry.new
+      # Taken once: a running worker keeps the hosts it started with. A
+      # client (specs) goes on a registry of its own, never the shared one.
+      @host_registry = host_registry || (client ? HostRegistry.new : HostRegistry.current)
       # The turn stages over the objectives (its audit, view and proposals)
       # and the Verify/Revise anchors (TurnStages).
       @objectives_stage = build_objectives_stage
@@ -718,7 +720,10 @@ module Samagotchi
     # (its limit goes in last_turn). The end event names its turn
     # (`turn_id:`, as :turn_started does) and, for a Verify turn,
     # `verify: true` (its opening's stamp: a page watching it live offers
-    # no Revise on its answer, verdict or not, as a reload does).
+    # no Revise on its answer, verdict or not, as a reload does). When the
+    # turn keeps messages, the event also names its own range in them,
+    # `kept[kept_from...kept_to]` (display-side: Bridge::TurnDrawings
+    # reads it; no message gains a key).
     def end_turn(turn, outcome, save: false, exhausted: false)
       seconds = turn.elapsed
       turn.outcome = outcome
@@ -727,6 +732,7 @@ module Samagotchi
         event[:turn_id] = turn.id
         event[:verify] = true if turn.verify
         revises = @verify_anchors.stamp_opening(kept, turn, outcome)
+        kept_range!(event, turn, kept)
         replace_session_messages(turn.session, kept) if kept
         verdict = @verify_anchors.record_verdict(turn, outcome)
         event[:verdict] = verdict if verdict
@@ -744,6 +750,20 @@ module Samagotchi
     end
     private :end_turn
 
+    # The end event's kept_from/kept_to (#end_turn): only when the turn
+    # keeps messages and its start is known (#turn_messages ran). An ending
+    # that replaces an earlier turn's note at the history's tail
+    # (TurnNote.replace_trailing on a Continue stopped before its first step)
+    # leaves only system messages and its own note after it, so the range
+    # still starts at or before the turn's note and draws nothing else.
+    def kept_range!(event, turn, kept)
+      return unless kept && turn.history_size
+
+      event[:kept_from] = turn.history_size
+      event[:kept_to] = kept.size
+    end
+    private :kept_range!
+
     # What a notice may stand in for (hook_notify's fallback_for:).
     NOTICE_FALLBACKS = HookRoutes::NOTICE_FALLBACKS
 
@@ -806,8 +826,11 @@ module Samagotchi
     # +wall+: the wall time it started (MessageTime.now, once): the
     # :turn_started event's at and its user message's (and reminders') stamp.
     # +verify+, +revises+: a Verify turn's claim, a Revise turn's draft.
+    # +history_size+: turn.messages' size under the system head, before
+    # the reminders and the prompt (#turn_messages): where the turn's own
+    # messages start in what it keeps (the end event's kept_from).
     Turn = Struct.new(:context, :prompt, :continue, :on_event, :started_at, :messages, :ended, :prepared_settings,
-                      :limit, :resumed, :resume_from, :wall, :verify, :revises, :outcome) do
+                      :limit, :resumed, :resume_from, :wall, :verify, :revises, :outcome, :history_size) do
       # The turn's id (:turn_started's turn_id, its metrics record's id and
       # its saved prompt's), session, origin and controller: its context's.
       def id = context.id
@@ -1124,6 +1147,9 @@ module Samagotchi
       # Built once per Engine (and again after a model switch) so the prompt
       # prefix, and the model server's KV cache for it, stay stable.
       turn.messages = ContextNote.with_system_head(turn.messages, { role: "system", content: system_prompt })
+      # Where the turn's own messages start (the end event's kept_from):
+      # after the head this may have added, before the reminders and prompt.
+      turn.history_size = turn.messages.size
       # Explicit --memory preloads are now known after system prompt build.
       @used_memories.add(activated_memory_names).absorb(session)
 

data/lib/samagotchi/events.rb

@@ -13,8 +13,9 @@ module Samagotchi
     # (#kept_turn?).
     TURN_KEPT = %i[turn_completed turn_canceled].freeze
     # The kinds of a running turn's parts (Bridge::TurnAccumulator), which a
-    # joining UI replays as live events.
-    PART_KINDS = %w[generation thinking text tool input steer reminder notice].freeze
+    # joining UI replays as live events (a card part only in a finished
+    # turn's drawing: a join takes its cards from CardStore).
+    PART_KINDS = %w[generation thinking text tool input steer reminder notice card].freeze
     # Types no Engine emits that a UI handles: the Bridge's stream frames
     # and the web's one synthetic replay event (a prompt merged into the
     # turn, turn_events.js snapshotEvents).

data/lib/samagotchi/extension_load.rb

@@ -49,12 +49,15 @@ module Samagotchi
     end
 
     # Load the installed bundles' plugins into +registries+; one that fails
-    # goes to +failures+, and the rest still load. The block runs after them,
-    # still loading: what it shows is held with theirs.
+    # goes to +failures+, a required one (a guardrail plugin) to the hook
+    # failures, where it denies every tool call, and the rest still load.
+    # The block runs after them, still loading: what it shows is held with
+    # theirs.
     def load_plugins(registries, failures:)
       @held_events = []
       @loading = true
-      Plugin::Loader.load_installed(registries, failures: failures, settings: bundle_settings).tap { yield if block_given? }
+      Plugin::Loader.load_installed(registries, failures: failures, guardrail_failures: @hook_failures, settings: bundle_settings)
+                    .tap { yield if block_given? }
     ensure
       @loading = false
     end

data/lib/samagotchi/guardrails_command.rb

@@ -190,7 +190,7 @@ module Samagotchi
       threshold = threshold(options[:threshold])
       return usage_error(threshold) if threshold.is_a?(String)
 
-      client = @client || SystemOne::Client.from_config(host_registry: HostRegistry.new, mode: Config.get("guardrails.system_one.mode"), model: options[:model])
+      client = @client || SystemOne::Client.from_config(host_registry: HostRegistry.current, mode: Config.get("guardrails.system_one.mode"), model: options[:model])
       if client.nil?
         error_line("chi guardrails replay: no System 1 client — set guardrails.system_one.mode to audit or on " \
                    "and system_one.host in config.yml")